Forensic Cell Site Analysis: a Validation & Error Mitigation
Total Page:16
File Type:pdf, Size:1020Kb
Journal of Digital Forensics, Security and Law Volume 12 Number 2 Article 7 6-30-2017 Forensic Cell Site Analysis: A Validation & Error Mitigation Methodology John B. Minor [email protected] Follow this and additional works at: https://commons.erau.edu/jdfsl Part of the Computer Law Commons, and the Information Security Commons Recommended Citation Minor, John B. (2017) "Forensic Cell Site Analysis: A Validation & Error Mitigation Methodology," Journal of Digital Forensics, Security and Law: Vol. 12 : No. 2 , Article 7. DOI: https://doi.org/10.15394/jdfsl.2017.1474 Available at: https://commons.erau.edu/jdfsl/vol12/iss2/7 This Article is brought to you for free and open access by the Journals at Scholarly Commons. It has been accepted for inclusion in Journal of Digital Forensics, Security and Law by an authorized administrator of (c)ADFSL Scholarly Commons. For more information, please contact [email protected]. Forensic Cell Site Analysis: A Validation & Error … JDFSL V12N2 FORENSIC CELL SITE ANALYSIS: A VALIDATION & ERROR MITIGATION METHODOLOGY John B. Minor [email protected] johnbminor.com ABSTRACT The E911 Initiative in the mid-1990s established an opportunity to obtain location specific digital evidence of subscriber activity from cellular carriers. Call Detail Records (CDR) containing Cell Site Location Information (CSLI) evidence production was made available from cellular carriers in response to the CALEA, 911 and ECPA acts. In the late 1990s, cellular carriers began to produce evidence for investigative and litigation purposes. CDR/CSLI evidence has become an important evidentiary focus in the courtroom. This research project resulted in the creation of a method of validating cellular carrier records accuracy and mitigating errors in forensic cell site analyst conclusions. The process establishes a scientific foundation critical to satisfying key Daubert requirements. The United States Patent and Trademark Office (USPTO) awarded a patent for this methodology. Keywords: cellular carrier records, call detail records, signals analysis, forensic cell site analysis, error mitigation, validation, Daubert, CDR, CSLI, defendant location evidence, drive test, radio survey INTRODUCTION during communications. Forensic cell site analysis became a new forensic analysis In 1996, the Federal Communications discipline requiring knowledge of cellular Commission (FCC) issued an order for the carrier network infrastructure and operations as Enhanced 911 initiative. Phase 1 required that well as an ability to analyze and interpret the location of the cell site to which a CDR/CSLI evidence. subscriber device was registered during communications be documented as part of the Cellular carrier evidence produced most record keeping process (FCC, 2001). As early often are Call Detail Records (CDR) which as 1999, cellular carriers began to produce include location evidence, commonly called Call Detail Records (CDR)/Cell Site Cell Site Location Information (CSLI). Location Information (CSLI) evidence in Most significantly, CSLI is frequently response to subpoena, search warrants, and analyzed to determine the location of a court orders. The primary focus of the analysis subscriber device during active of this type of evidence is two-fold: 1) analysis communications sessions. Forensic cell site of who was communicating with the subscriber analysts often create maps exhibiting cell site and 2) where the subscriber device was located locations and estimate cell site coverage in the © 2017 ADFSL Page 33 JDFSL V12N2 Forensic Cell Site Analysis: A Validation & Error … form of pie slices or Vs. Mapping produced by The National Institute of Standards and analysts have varying levels of accuracy, often Technology (NIST) has published extensive providing an unreliable interpretation of the forensic evidence guidance and standards actual evidence. documents for the acquisition, validation and analysis of computer and cell phone evidence Analysts typically plot the GPS (Ayers, Brothers, & Jansen, 2014). Curiously coordinates of cell sites (which include Base absent are standards for the handling, analysis, Transceiver Station, NodeB, eNodeB, and validation or error mitigation of CDR/CSLI future 5G Access Points) (5G PPP AWG, evidence in NIST publications. 2016; Freescale Semiconductor, 2009) provided by the cellular carrier and illustrate an estimate The United Kingdom is addressing the of coverage for communications sessions of field of Digital Forensics – Cell Site Analysis interest without establishing any basis for the by creating a code of practice and conduct estimate. If challenged, and absent adequate through its Forensic Science Regulator analysis error mitigation or evidence validation, Department (United Kingdom Forensic Science the resulting analysis fails to meet Daubert Regulator, 2016). The UK Accreditation requirements. Service for Laboratory Accreditation has also initiated an accreditation program for Forensic In the United States, forensic cell site Cell Site Analysis. Validation is mentioned analysis has been utilized extensively in generally in the United Kingdom accreditation criminal cases. The United States Department specifications and standards; however, no of Justice stated that defendant location specific methodologies are delineated (United evidence is of utmost importance and that Kingdom Accreditation Service, 2016). This is historical cell site analysis is a primary means the only state sponsored certification and of establishing such evidence (O’Malley, 2011). standards development program for forensic In civil cases, such as distracted driving cell site analysis discovered during research. litigation, cell site analysis of CDR/CSLI evidence is frequently used to determine driver ERROR RATES fault. Chief Justice Roberts noted that “[m]odern cell phones … are now such a Live multilateration and trilateration device pervasive and insistent part of daily life that location calculation techniques, utilized during the proverbial visitor from Mars might 911 calls, upon declaration of exigent conclude they were an important feature of circumstance, or during authorized wiretap human anatomy” (Riley v. California, 2014). A intercepts include confidence and uncertainty review and analysis of caselaw regarding the (C/U) data (FCC, 2015). This type of limitations and admissibility of historical cell evidence is produced in criminal cases and the site evidence resulted in publication of a law C/U data is the only error rate information journal article in which several conclusions acknowledged or produced by cellular carriers were offered including the statement that, in real time device tracking. “[h]opefully courts will preclude the admission The absence of statistical data regarding of sub-par tracking testimony that is based on CDR/CSLI evidence error rates coupled with unreliable and unsubstantiated techniques” the discovery of several types of errors (Blank, 2011). encountered during research and analysis is the basis of a growing sense of fallibility in the cellular industry’s record keeping process. Page 34 © 2017 ADFSL Forensic Cell Site Analysis: A Validation & Error … JDFSL V12N2 Errors have been discovered during and performance records. Thus, CDR/CSLI CDR/CSLI evidence review and analysis in evidence production has historically been several distinct areas. Cellular carriers have submitted as accurate by cellular carrier legal documented neither error rates nor validation compliance departments and acknowledged as methodologies for the following: accurate by the courts without any validation or error mitigation. 1. Carrier cell site location database records. For this research project, criminal and civil 2. CDR/CSLI records. cases were reviewed in which historical 3. Documented network infrastructure CDR/CSLI evidence was produced and and operational failures. analyzed for subscriber device location. In every case selected for the control group, a The FCC maintains Universal Licensing preliminary analysis mapping of the CSLI was Filings which include cellular carrier produced by the analyst (the first item in transmitting cell site licensing (FCC, n.d). The the Table 1 chart). FCC has documented neither error rates nor a validation methodology for the filings. Each case was next reviewed to determine if an analyst performed any type of validation The Scientific Working Group on Digital of the evidence or error mitigation of the Evidence (SWGDE, 2017) establishes that “a preliminary analysis mapping. process for recognizing and describing both errors and limitations” (p. 8) should be utilized Research was conducted of the cellular so “that confidence in digital forensic results is carrier network infrastructure, subscriber best achieved by using an error mitigation communications flow through the network, analysis approach that focuses on recognizing subscriber authentication techniques and potential sources of error and then applying CDR/CSLI records creation methods. The fact techniques used to mitigate them, including that cellular carriers document all aspects of trained and competent personnel using tested subscriber access and usage of the network and validated methods and practice” (p. 8). infrastructure verifies that validation and error mitigation of this type of evidence can be RESEARCH accomplished by the forensic cell site analyst. METHODOLOGY Further data was collected regarding how This study addresses three fundamental cellular carrier planned and unplanned questions: maintenance logs are recorded.