CELL PHONE SURVEILLANCE: TACTICS, LITIGATION, AND NEXT STEPS
Nicole Valdes Hardin
NOTES
FDFCDC 51
Guide to Getting Started with a
Cell Phone Tracking Case
Nicole Hardin Assistant Federal Public Defender Middle District, Tampa, FL For questions: [email protected] [email protected]
FDFCDC 52 Table of Contents
Checklist for a cell phone case 3 Start the Analysis 4 Understanding the Technology 5-8 A. Introduction 5 B. Basic Explanation on How Cell Phones Work 5-6 C. Moving from Tower to Tower 6 D. How Cell Phone Triangulation Works – An Example 6-8 Individual “Ping” Evidence: The Most Common Evidence 9 Attacking the Technology – Exploiting Weaknesses of 10 Single “Ping” Evidence on Cross Examination
Getting Started on Your Cross Examination: An Overview 11-12
Appendix 12-24 A. Additional Materials Available by Request 13 B. Retention Periods of Cell Phone Carriers 13-14 C. Sample Motion to Compel Historical Cell Site Discovery 15-17 D. Helpful Articles for Getting Started 18-19
2
FDFCDC 53 Checklist for a cell phone case
Make sure you have all this from the prosecution: Call detail records for EVERY number the prosecution is using. These should be coming from the cell phone company. You need the calls, the times of calls and the duration. It is important to know it the communication is a text, a voice call, or a “routed call”.
A print out from the cell phone company of ALL the cell phone tower locations. This should include the tower ID number, as well as latitude and longitude location information and as much information as you can get on what sector of the tower the call used.
Any warrant, court order or subpoena that the police filed with the Court to procure the cell phone records. This can be investigatory or emergency, etc. The name and position of the person they intend to call as a witness to introduce the cell phone evidence. It is important to know if they are calling simply a custodian of records or an actual cell phone engineer. What each of those people knows and can testify about the tracking are very different.
If your case is a “ping” case, you will need to know a lot more information from the phone company. Make sure you ask if they have the records of the surrounding towers at the time and whether the phone attempted to connect with any of the surrounding towers (I have yet to see a company that still has this data but ask – because if they do your job will be a LOT harder.)
Figure out how your clients was tracked – find out if it was by GPS, triangulation or individual “pings”. If you get the run around on the “how”, try to dig into the matter. Law enforcement may have used simulated tracking – and you may have successful pre-trial motions available.
If it is a “ping” case you will want to get the estimated radius of each tower threat your client “pinged” from – this is found through the cell phone company’s internal propagation and software. It varies by company.
3
FDFCDC 54 Start at the beginning: - Make sure you get a copy of the subpoena, court order or warrant that the police used to get these records. If there is no court order find out why. Did the police use exigent circumstances? Did they use Stingray?
- Find out if the records were used to track your client OR if the records were used to try and figure out the client’s location in the past – example: the day before (historical cell phone records.)
- Check if your state has any state-specific laws regarding the disclosure of cell phone records. It is possible that the state may offer greater privacy protections than the federal statute does. You may be able to challenge the admissibility on other grounds under these types of statutes.
When challenging an improper pin or trace, be careful about arguing it violates the Electronic Communications Privacy Act of 1986 (“ECPS”) rather than the Fourth Amendment. A provision in Electronic Communications Privacy Act of 1986 specifically forbids exclusion and under federal law, suppression of evidence is NOT a remedy for violations of the ECPA.
At a minimum, make sure that the court order application outlined “specific and articulable facts.” This is the lowest standard allowed. As you will see below, case law is unsettled at this point on many of these issues. The Supreme Court has yet to rule, and seemed to rejoice in not dealing with these concerns in their recent Jones decision on GPS tracking. That decision noted that GPS tracking without actual physical intrusion may trigger Fourth Amendment protections, but their holding turned on trespass and did not reach the Fourth Amendment. Based on all the upheaval on the topic, it is usually well worth a Motion to Suppress, particularly for certain cases. As for historical cell site privacy, the U.S. Supreme Court will be ruling very soon, one way or another, on the Carpenter case – which will decide the issue for once and for all.
4
FDFCDC 55
UNDERSTANDING THE TECHNOLOGY What typically gets clients in trouble is the fact that the cell phone companies maintain call records for a lengthy period of time and to the second. These are the billing records and it is how the cell phone companies make money – by tracking and billing every second of cell phone use.
The only upshot to the unfortunate detailed recordkeeping is the fact that other crucial location data that does not make them money is NOT kept. And here is why that is important.
When your phone is on, every seven seconds or when you drop below a certain threshold, the phone company is determining the nearest tower, so as to most efficiently route calls. And for billing reasons, they track where the call is coming from and how long it has lasted. The amount of data cell phone companies keep on us is staggering. And they keep it for a very long time. But the data from every seven seconds is what enables triangulation. And the information you need to actually triangulate a location is not usually kept by cell phone companies. There is no money in it.
The most accurate way to trace is GPS. The next is triangulation. Triangulation involves the use of multiple “pings” from different towers. When you have three or more towers with “ping” information, the location data becomes more accurate. If you lack data from the multiple towers, the location is far less accurate.
HOW CELL PHONE TOWERS WORK In theory, when you turn on your phone, it will search for the strongest signal and connect to that tower. I say in theory because this is not always true – sometimes other factors will change that basic assumption. But typically that is what happens when your phone is turned on.
When you turn on your phone the mobile switch determines what cell will carry the call and assigns a vacant radio channel within that cell to take the conversation. It will select the cell tower to serve you by measuring signal strength and connecting your mobile to the cell tower that has picked up the strongest signal.
5
FDFCDC 56 Moving from tower to tower When you are driving down the road, you will be using multiple towers. When the cell phone handset moves from tower to tower, it is called a handoff or handover. Managing handoffs or handover is handled in a similar manner to when you turn your cell phone on. The original station/tower handling your call sends a hand-off request to the mobile switch after your signal drops below a certain threshold. Although the thresholds will be similar, each cell phone company will have their own threshold standard. The cell site makes several scans to confirm this and then switches your call to the next cell. You may drive fifty miles, use 8 different cells and never once realize that your call has been transferred. At least, that is the goal of a cell phone company – seamless use for the phone user.
This is why you will see multiple towers being used in the duration of one call. It is typically because the cell phone is on the move.
HOW CELL PHONE TRIANGULATION WORKS Remember those Venn diagrams from school? You will need those for triangulation. After GPS tracking, triangulation is the most accurate way of locating a cell phone. It is not perfect – and 911 operators switched to GPS for this reason. There are stories of trying to use triangulation to find people lost in the mountains and ending up miles away.
Still, it is much more accurate than using only one tower. But usually in cell phone cases, the prosecution and law enforcement are not able to triangulate. This is why the evidence they actually use is far less accurate and much faultier. To understand why the evidence from a single tower is not nearly as accurate, it is helpful to understand why triangulation data is more accurate. The fact that the prosecution lacks the more accurate tracking method is a fertile ground for cross examination.
The process is not that complicated. What you need for triangulation is the location of the cell towers that can “see” the phone. ALL of them. And the more you have, the more accurate it is. Three or more is the best. The tower with the strongest signal is the one that the phone will utilize, but there are a number of other towers
6
FDFCDC 57 can also “see” the phone as it moves. So you take the data of the tower utilized and the other towers that also “see” the phone.
EXAMPLE First you locate the tower with the strongest signal and draw a circle that depicts the coverage area for the tower. You will need to get the approximate radius of the circle (cell tower footprint) from the cell phone company. It is usually from their “propagation” tools and it will vary by company. Now let’s assume that the cell phone is somewhere in that circle (this is not always true – there are reasons we will talk about later where the phone may not be in that circle.) For this example this tower radius will be Tower 1.
TOWER 1 = Radius of 2 miles
Now locate a second tower that can “see” the phone and draw a circle showing its coverage area. Now you can assume that the phone is located somewhere in the intersection of the two circles.
TOWER 1 TOWER 2= = Radius of Cell Radius of 2 Phone 2 miles miles
7
FDFCDC 58 Continue to add circles for all the towers that can communicate with or “see” the phone.
TOWER 3 = Radius of 2 miles
Cell Phone TOWER 1
= Radius of TOWER 2= Radius 2 miles of 2 miles
The intersection of all the circles helps narrow down the actual location of the phone. The more circles you have, the more accurate it is. This is still not a very exact science but you can generally locate the phone within 100 meters or less.
TOWER 3
Cell TOWER 1 TOWER 2 Phone
TOWER 4
8
FDFCDC 59 INDIVIDUAL “PING” EVIDENCE IF TRIANGULATION IS MORE ACCURATE, WHY DON’T THEY USE IT? I ONLY HAVE ONE TOWER ON MY RECORDS?
In a typical cell phone case, law enforcement will be attempting to place the client at or near a crime scene. The only data that law enforcement usually has will be the data from the tower that the call was actually connected to when it was made. All the other towers that “saw” the call at the time will seldom still be available. This data is unavailable because it is rarely kept by the cell phone companies. And the data from the every 7 second connections is also rarely maintained.
The exception is if they were using triangulation for live tracking and kept all he records. Or if they used “Stingray” type technology for live tracking.
But the vast majority cases that I have seen and heard about will be a list of towers where your client “pinged” when making a call. And that is good news. Attempting to place people through individual “pings” is the most vulnerable way to do it. It is the least accurate and will allow you the best tools in a cross examination. Because the single “ping” technology is far less accurate, some attorneys have had luck excluding the evidence through Daubert and Frye challenges. If you are in the right state with the right Judge you may want to consider challenging it – for us the Judge clearly thought it met the Frye test so we did not bother – we also did not want to let the prosecution shore up their engineer by giving a preview of our questions on the weaknesses of the science.
FIGHTING THE TECHNOLOGY – THE WEAKNESSES OF SINGLE “PING” EVIDENCE
Most of this will be covered in the presentation. This should serve as a map for getting to an effective cross examination.
When you are dealing with a cell phone witness, start with the type of witness. Some prosecutions have simply called a custodian of records to introduce the cell tower information and radius. These custodians will often try to talk about how
9
FDFCDC 60 your client was in the radius of the tower (otherwise known as the cell tower footprint.) If you find out that the other side is calling only a custodian of records, file motions to curtail their testimony. A normal custodian of record is not usually qualified to testify about the engineering of the network. The witness should be able to explain the evidence and the limits of the evidence. For example, the towers and their footprints (radiuses) are designed to be fluid. Meaning they can change – contract to be smaller at times. A custodian of record is unlikely to know that type of information and will instead flatly say that your client was in that circle and that means he or she was within this many miles of the tower. But it will be unlikely that they can explain why that is – or isn’t. They will be testifying way above their heads. And in my opinion, the testimony will be well outside the scope of a custodian of records.
The other type of witness they will call is a network engineer. Unlike the custodian of record, this individual will be qualified to talk about the evidence. And the prosecution will call this evidence irrefutable. It’s not. For what you can expect from a prosecution side network engineer, check the appendix. It contains the power point presentation that the network engineer used in our homicide trial, and it will be along the lines of what you can expect.
An honest network engineer will admit to the limitations of this evidence - but only if you make them. On direct examination on our trial, the network engineer made it sound like my client was within 2.3-2.5 mile radius at exact times the night of the murder. It was only on cross examination that he revealed the weaknesses in his presentation.
An Overview of weaknesses to be sure you address in cross examination – this is NOT a complete list, but a good place to start:
• This is NOT an exact science right? (they should admit to that) • GPS is far more accurate • Triangulation is more accurate • Loss of the triangulation data - The network switch communicated with multiple (hopefully more than three) towers when connecting these cell phone calls. o Where is it?
10
FDFCDC 61 o Can it be retrieved? o Why not? Might have it been favorable to my case? o Would have been MUCH more accurate? • Questions within the network – usually they don’t know this anymore, especially if it is first asked at trial. All of these can affect which tower handles a call – irrespective of if you are in the radius or footprint of the tower o Ask about weather conditions? . Thunderstorms? . Lightning strikes? Etc. . Were any towers affected? o Ask about any nearby tower repairs – this affects which towers pick up calls o Ask about network repairs and maintenance • Questions on call volume – this also affects which towers might have picked up the call • Type of phone – this is more remote but can sometimes effect communication – bandwidth, generation of phone, etc. • There is a LOT of questions you can ask about the tower the phone used. For a cell phone handset to communicate with a cell tower depends on a multitude of factors, completely independent from distance and signal strength. o Performance of towers
o Call volume at time
o How well it had been maintained and serviced o Height of tower o Number of cones, type o And so on – this can be extensive. It all adds up to letting the jury know this science is far from exact and accurate
11
FDFCDC 62
APPENDIX
12
FDFCDC 63 APPENDIX A Probably the best getting started materials are the two depositions I did of the prosecution’s cell phone engineer. We found out the name of the person the day of jury selection and I had about 36 hours to get ready for the deposition. So it is a pretty good guide of me asking very basic questions about the technology – and him explaining how they use the technology. Other materials include the original power point used by the cell phone engineer in trial.
I could not include them with these materials because they exceed the page limit, but I am happy to email them to anyone that needs them. Let me know. I can be reached at [email protected] or [email protected].
APPENDIX B Part of the fun is that every phone company has a different retention period for records. Below is updated from April 2017 and includes subscriber information (name, address, DOB etc); call history (numbers dialed and numbers of incoming calls); the location of towers used in the call history; and text message content when they are sent as SMS (will not include imessages)
Verizon Wireless
Subscriber Information: 7-10 years
Call History: 7 years
Tower Locations as they related to Call History: 1 rolling calendar year
SMS Content: 3-5 days (unofficially it may be as much as 7-10 days)
AT&T
Subscriber Information: 7 Years
Call History: 7 years
Tower Locations as they related to Call History: 7 years
13
FDFCDC 64 SMS Content: Not Available
Sprint
Subscriber Information: 10 years
Call History: 18 months. Bill reprint form 7-10 years, pre-pay accounts only 18 months regardless.
Tower Locations as they related to Call History: 18 months
SMS Content: Not Available
T-Mobile
Subscriber Information: 3-5 years. Canceled accounts are purged after account closes.
Call History: 23 months
Tower Locations as they related to Call History: 23 months
SMS Content: Not Available
U.S. Cellular
Subscriber Information: up to 7 years
Call History: 1 rolling calendar year. Bill reprint: 7 years.
Tower Locations as they related to Call History: 1 rolling calendar year
SMS Content: 3-5 days
Source: ProDigital Forensic Consulting
14
FDFCDC 65 APPENDIX C – Sample Motions to Compel
IN THE CIRCUIT COURT OF THE FIFTH JUDICIAL CIRCUIT IN AND FOR MARION COUNTY, FLORIDA
STATE OF FLORIDA, CASE NO.: XXXXXXX vs.
XXXXXXXXXXXXX, Defendant. /
MOTION TO COMPEL CELL PHONE RECORD DISCOVERY
COME NOW the Defendant, by and through his undersigned counsel, pursuant to Florida Rules of Criminal Procedure, Rule 3.220(b)(1)(J), the Fifth, Sixth, Eighth, and Fourteenth Amendments to the United States Constitution (right to due process of law, right to a fair trial, right to effective assistance of counsel, right to confront witnesses), Article I, Sections Two, Nine, Sixteen and Twenty-two of the Florida Constitution, and respectfully moves this Honorable Court for entry of an Order directing the State to provide the Defense with copies of certain relevant written protocols, materials, documents, maps, and electronic data regarding cell phone tracking by law enforcement. These items are requested to assist counsel in evaluating the efficacy of all cell phone tracking by law enforcement conducted in this cause, and as grounds would state:
1. On March 12, 2013, the Marion County Sheriff Office responded to a homicide in Ocala, Florida. Later that day, law enforcement arrested XXXX for the crime. 2. On March 19, 2013, Detective Whiteside filed for a court order and search warrants for cell phone records and text messages associated with the phone number XXX- XXXXXXX. 3. Defense counsel is in receipt of these records.
15
FDFCDC 66 4. The records provided in discovery list for each phone call: a date, time, duration, dialed number, destination number, status, feature, caller ID, as well as switch, sector, tower for beginning and ending cells. 5. To date the State Attorney’s Office has only listed two business record custodian witnesses to testify about cell phone location data. 6. The records contain insufficient information for counsel or her expert, if retained, to analyze and rebut the assumptions of locations from the cell phone records. 7. Defense counsel does not have independent access to this material. 8. Defense counsel cannot render effective assistance of counsel for the Defendant without examining the following witnesses and records from the cell phone company. In order to render effective representation, Defense requests: i. The names of any and all cell phone engineer witnesses the State Attorney intends to call at trial to testify about any location information containing the number 352-426-1237. ii. The names of any and all cell phone company employees the State Attorney intends to call at trial to testify about any location information containing the number 352-426-1237. iii. The names of any and all law enforcement witnesses the State Attorney intends to call at trial to testify about any location information containing the number 352-426-1237. iv. Call detail records for 352-426-1237, dated 3/10/2013 to 3/13/2013, noting whether each communication is a text, a voice call, or a routed call. v. Any records or policies on how routed calls are handled through towers. vi. Any records from the surrounding cell towers for each cell phone call the State intends to introduce at trial, including the number and volume of calls and the types of calls. vii. Any records from all the nearby cell towers for each cell phone call the State intends to introduce at trial that the cell phone 352-426-1237 communicated with or attempted to communicate with before or during any voice call. viii. Any records or data that supports location analysis by “triangulation”, or global positioning service (GPS).
16
FDFCDC 67 ix. The radius/cell tower footprint for every tower contained within the phone records of 352-426-1237 dated 3/10/2013-3/13/2013. 9. The materials requested should be contained in the cell phone company’s possession. 10. Should the defense retain a cell phone expert in this case, that expert cannot assist counsel without the items requested above to determine whether the cell phone record data contains reliable location information. 11. Counsel cannot effectively represent the Defendant without this evidence and would be unable to investigate and challenge this evidence denying the defendant right to due process of law, the right to a fair trial, the right to present a full and fair defense, the right to effective assistance of counsel and the right to confront witnesses and evidence against him. 12. Defense counsel certifies that this request is being made in good faith.
WHEREFORE the Defendant respectfully requests entry of an order requiring the State to produce the material requested above within 10 working days.
Respectfully submitted this ______day of March, 201X.
CERTIFICATE OF SERVICE I HEREBY CERTIFY that a copy of the foregoing Motion to Compel Cell Phone Record Discovery has been furnished to the Office of the State Attorney, 110 NW 1st Avenue, Suite 5000, Ocala, FL 34475, by hand and/or mail delivery this ____ day of March, 201X.
Office of Michael Graves Public Defender Fifth Judicial Circuit
______NICOLE VALDES HARDIN Assistant Public Defender Florida Bar No. 0026194 204 NW 3rd Avenue Ocala, FL 34475
17
FDFCDC 68 APPENDIX D – Helpful Articles/Websites for Getting Started
Good Explanations of how cell phone tracking works
Cellular Telephone Basics http://www.privateline.com/mt_cellbasics/
Cell Tower Triangulation – How it Works http://wrongfulconvictionsblog.org/2012/06/01/cell-tower-triangulation-how- itworks/
Cell phone tracking, historical
“Wireless Firms Are Flooded by Requests to Aid Surveillance” by Eric Lichtblau, in The New York Times. http://www.nytimes.com/2012/07/09/us/cell-carriers-see-uptick-in-requests-to- http://www.slate.com/blogs/future_tense/2013/02/15/stingray_imsi_catcher_fbi_fil es_unlock_history_behind_cellphone_tracking.html
“Can Police Track You Through Your Cellphone Without a Warrant?” by Nina Totenberg, NPR, November 28, 1017. https://www.npr.org/2017/11/28/564713772/can-police-track-you-through-your- cellphone-without-a-warrant
Stingray Use
Street Level Surveillance, Electronic Frontier Foundation – available at https://www.eff.org/pages/cell-site-simulatorsimsi-catchers
“Does cellphone-sweeping "StingRay" technology go too far?” by CrimeSider Staff, CBS News, November 27, 2017.
18
FDFCDC 69 https://www.google.com/amp/s/www.cbsnews.com/amp/news/does-cellphone-sweeping- stingray-technology-go-too-far/
Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology, available at https://www.justice.gov/opa/file/767321/download
19
FDFCDC 70 How Police Use Stingray in Everyday Police Work
The next fourteen pages are an excerpt of the testimony of an officer in Tallahassee on the deployment of a Stingray device. It offers a rare glimpse into police practice with the devices, often kept secret.
“In the early morning hours of September 13, 2008, a woman notified the Tallahassee Police Department (TPD) that she had been raped and that her purse, containing her mobile phone, had been stolen. Within 24 hours, the Florida capital’s police had contacted Verizon and obtained real-time ping information, which gave the police a “general area” where they might find the phone and thus, hopefully, the perpetrator of the crime. But that general area still covered plenty of ground—where exactly was the phone?
To answer that question, the cops deployed a secretive device called a stingray, which operates as a fake cell phone tower used to track targeted phones. Though law enforcement typically fights attempts to learn how stingrays work or how often they are used, a court victory by the American Civil Liberties Union (ACLU) has unsealed Tallahassee police testimony of exactly how the 2008 cell phone hunt happened.
This newly released transcript provides what is likely the first-ever verbatim account of how stingrays are used in actual police operations. And it shows that stingrays are so accurate, they can pinpoint the very room in which a phone is located.”
- Excerpt from “How Florida cops went door to door with fake cell device to find one man,” by Cyrus Farivar – available at https://arstechnica.com/tech-policy/2014/06/how- florida-cops-went-door-to-door-with-fake-cell-device-to-find-one-man/
FDFCDC 71 11
1 A Yes, I did.
2 Q All right. And if you would, tell the cour~ how it
3 is you go about trying to track the location of the cellphone 4 in this case. 5 A okay. It varies by case. But specifically for this 6 incident we made contact with the provider, who was verizon 7 wireless. They were able to provide us with the tower, the 8 cellphone tower or cell site for which that handset is 9 currently registered and communicating with. In addition, 10 they are able to provide us with a distance from that tower, 11 an approximate distance. But we're able to use that to define 12 a general area that that handset will be located. 13 From that point, we will take equipment that is meant to 14 intercept the radio signals emanating from that device and 15 provide us some direction finding capabilities and allow us to 16 basically walk to the device, to the handset.
17 Q okay. so if I understand you correctly, you're 18 indicating that you find out, you knew who the provider was 19 verizon?
20 A Yes.
21 Q Yo~ contact verizon. And did they give you some 22 information as to whether or not that cellphone is using any 23 towers in the area?
24 A correct.
25 Q All right. And when you said an approximate
180 TERESA SELVA, OFFICIALFDFCDC DIGITAL 72 REPORTER 12
1 distance from the tower, is that information that you got from
2 verizon that -- that would indicate how far away from the
3 tower the actual cellphone was being used?
4 A That's correct.
5 Q okay. And when we say used, does that mean somebody 6 is actually using it, or does it just need to be on? 7 A It varies by provider. But, for this case, the
8 handset merely needed to be on and registered and they were
9 able to determine that distance.
10 Q okay. And then I think you've indicated that you 11 have some sort of device that you use that can intercept radio 12 signals?
13 A That's correct.
14 Q okay. How does that work?
15 A In essence, we emulate a cellphone tower. so just 16 as the phone was registered with the real verizon tower, we 17 emulate a tower; we force that handset to register with us. 18 we identify that we have the correct handset and then we're 19 able to, by just merely direction finding on the signal 20 emanating from that handset --we're able to determine a 21 location. 22 Q okay. And what kind of training were you provided 23 in the use of this equipment? 24 A The manufacturer of the equipment provides 25 approximately a six-day training program. In addition to that
181 TERESA SELVA, OFFICIALFDFCDC DIGITAL 73 REPORTER 13
1 I attended numerous classes on the use of cell phones and 2 various communications, communication items for locating
3 persons.
4 Q okay. And are there any quality assurance things
5 that are in place? I mean how do you know the equipment is
6 working properly when you're using it? 7 A well, it's Very difficult to say quality assurance.
8 The in hundreds of uses the equipment has proven completely
9 reliable. The equipment will basically decode information
10 from the handset and provide certain unique identifying
11 information about the handset, being a subscriber identity and 12 equipment identity. 13 The equipment provides that to us. we compare that with 14 the information provided from verizon to insure that we are 15 looking at the correct handset. once we know that that 16 information is correct, then the location of that becomes 17 simply a matter of detecting where the signal is the 18 strongest. And it's a matter of getting closer and closer. 19 Q And when you say the handset you're referring to the
20 cellphone that you're attempting to locate through the use of
21 basically forcing that cellphone to come to your equipment 22 rather than going to a tower that it normally would? 23 A That is correct.
24 Q And is that -- what information do you put into your
25 equipment that will lead that signal to be transferred to your
182 TERESA SELVA, OFFICIALFDFCDC DIGITAL 74 REPORTER 14
1 equipment, versus going to the tower? 2 A well, the equipment-- or the information that we
3 would put in would be that unique subscriber identity and 4 unique equipment identity, a serial number and a subscriber
5 identity
6 Q of the cellphone you're looking for?
7 A of the cellphone we're looking for, which would be
8 the victim's cellphone. we put that information into the
9 equipment. And as the equipment is evaluating all the 10 handsets in the area, when it comes across that handset -- the
11 one that we're looking for, for the information that we put 12 into the box -- then it will hang onto that one and allow us 13 to direction find at that point.
14 Q And is that subscriber information and that serial 15 number unique to the telephone that you're actually trying to 16 find or track?
17 A In the case of a verizon phone, the serial number is
18 unique to the physical handset. The subscriber identity is
19 unique to that handset, so long as that handset is registered
20 to the account. The subscriber identity can be changed; 21 that's how werre able to port our phone numbers. You can go 22 from one carrier to the next. 23 so that number can change over time. The serial number 24 is always unique to that specific handset.
25 Q Okay. And you had information that you had
183 TERESA SELVA, OFFICIALFDFCDC DIGITAL 75 REPORTER 15
1 information that linked the serial number that you diverted to
2 your equipment actually belonged to the victim in this case.
3 Is that correct? 4 A That is correct.
5 Q All right. okay so what were the results of your 6 attempts to track this phone? 7 A we were, after some time based upon the environment
8 there -- we were able to locate the phone, or to actually 9 capture the phone to begin with and then a relatively lengthy 10 process of determining exactly where that signal was emanating
11 from. 12 using portable equipment we were able to actually 13 basically stand at every door and every window in that complex 14 and determine, with relative certainty you know, the 15 particular area of the apartment that that handset was 16 emanating from. 17 Q okay. Now you started off by saying based on the 18 environment. what do you mean by that? 19 A Just the apartment complex.
20 Q okay. 21 A Being multi-story, with the way it's configured.
22 Q Okay. so and then you used the phrase you captured 23 the phone. That means that after putting that information 24 into your equipment you were able to direct the signal from 25 the .tower to your equipment?
184 TERESA SELVA, OFFICIALFDFCDC DIGITAL 76 REPORTER 16
1 A That is correct.
2 Q And that being the phone -- that was the serial 3 number that belonged to the handset of the victim in this 4 case. Is that correct? 5 A That is correct.
6 Q All right. And you said it was a lengthy process. 7 Did that mean finding the apartment complex in general, or 8 finding the actual location at the apartment complex? 9 A Really finding the complex was the difficult part, 10 just that signal, getting it to emanate outside of the 11 apartment complex. we actually worked during the day and it 12 was actually later into the evening when there was less 13 interference around, less other traffic around that our 14 equipment was able to detect the handset. once we were able 15 to detect it and get close to it, then it beEame very simple 16 at that point.
17 Q okay. And what, if any, time constraints are there? 18 when you're in this case you're talking about verizon and as 19 long as the phone is on, you're able to utilize the technique. 20 correct? 21 A Correct.
22 Q Are there time restraints on how effective this is 23 going to be or before you might lose your potential to find
24 this evidence?
25 A certainly. In the case of a victim phone, victim
185 TERESA SELVA, OFFICIALFDFCDC DIGITAL 77 REPORTER 17
1 handset being taken, there is not an apparent ability to 2 charge the handset so the battery going dead for us is always 3 a concern. Additionally, once the equipment comes into play 4 and we capture that handset, to make locating it easier ; the 5 equipment forces that handset to transmit at full power.
6 Again~ that's why I say once we capture it, it becomes
7 .much easier to specifically locat~. 8 so we're forcing that handset to transmit at full signal, 9 consuming battery faster, in an effort to help us locate that 10 handset. so it going dead would - - that battery dying would 11 essentially end our ability to locate it.
12 Q okay. And you mentioned earlier that you were able 13 to eventually locate or track the signal from this cel l phone 14 to an apartment complex. Is that correct?
15 A That is correct.
16 Q And what was the name of the apartment complex?
17 A 2060 Continental, Berkshire Manner, if I recall 18 correctly. 19 Q All right. And what exactly did you do to narrow it 20 down, once you got to the apartment complex? 21 A Again, using portable equipment, quite literally 22 stood in front of every door and window measuring, determining 23 that direction of where that signal was emanating from and 24 contacting investigators, and advised them that we had an 25 apartment.
186 TERESA SELVA, OFFICIALFDFCDC DIGITAL 78 REPORTER 18
1 Q okay. And what apartment was that?
2 A I don't recall the specific number (inaudible)
3 recall the specific door number, Apartment number.
4 Q okay. once you located the apartment then, did you
5 let the other investigators take over?
6 A Yes, I did. I pointed out the specific apartment
7 that I identified to them as they arrived and remained close
8 by as they continued the investigation.
9 Q Do you have a recollection or do you have anything 10 in your notes that would indicate what time it was when you 11 located the apartment that you believe the cellphone would be 12 in, based on your tracking of it?
13 A when we first identified the apartment it was
14 probably approximately 1:00 to 2:00 a.m. I'm not sure if I 15 have anything in my notes specifically, to that. I know that 16 we returned to the area sometime around midnight and located 17 it shortly thereafter. 18 Q Do you have any idea how much time elapsed between 19 the time of the sexual assault in this case and the time you 20 tracked the phone to the apartment complex? 21 A If I recall, the sexual battery occurred early, 22 early Saturday morning -- you know, late, late Friday night 23 into Saturday morning. And it was now early sunday morning
24 when we had actually located a handset.
25 Q okay. was time becomino of the essence to you
187 TERESA SELVA, OFFICIALFDFCDC DIGITAL 79 REPORTER 19
1 all
2 A Yes.
3 Q - - based on what you have already testified to about 4 not having the ability to necessarily recharge the phone or
5 know someone was recharging it - - 6 A Absolutely.
7 Q -- and the drain of power that would be on the phone 8 based on your directing, I guess, it to your equipment?
9 A That's correct.
10 Q And you did not actually enter the residence; is 11 that torrect? I think you said the other investigators took 12 over at that point. Is that correct?
13 A That is correct.
14 Q And was it your belief, based on your training and 15 experience as both an officer and that equipment, that you 16 believed the property of the victim of that sexual assault to 17 be at the residence where you tracked that cellphone to? 18 A That is correct. 19 MS. RAY: I have nothing further.
20 THE COURT: Cross? 21 MR. SHIPPY: Yes, Your Honor. Thank you. 22 CROSS-EXAMINATION
23 BY MR. SHIPPY:
24 Q Good afternoon, sir.
25 A Good afternoon.
188 TERESA SELVA, OFFICIALFDFCDC DIGITAL 80 REPORTER 20
1 Q I may have missed it, but how long have you been
2 with the Tallahassee Police Department Technical operations
3 unit?
4 A The Technical Operations unit, a little over five 5 years. I've been with the police department since '95.
6 Q Is it a requirement in order for the equipment, that 7 apparently TPD has purchased, to track a cellphone that the 8 cellphone be turned on? 9 A The cellphone does have to be powered on for us to 10 be able to actively locate the handset. And it's not -- the 11 Tallahassee Police Department is not the owner of the 12 equipment.
13 Q And it's a technical question, but bear with me. 14 when we say turned on, that means the battery still may 15 be full, but if I turn the phone off then the equipment that 16 you're utilizing doesn't work. Is that correct? 17 A That is correct.
18 Q And as long as the cellphone is turned on and as 19 long as there is power where the battery has power, I guess 20 then you're able to track the cellphone? 21 A Generally speaking, yes. As long as the handset is 22 on, then you know we have the ability to attempt to track it.
23 Q And for how long has the Tallahassee Police 24 Department been utilizing this equipment? 25 A If I recall, it was March. Spring of '07 is when we
189 TERESA SELVA, OFFICIALFDFCDC DIGITAL 81 REPORTER 21
1 first started utilizing the equipment, if I remember properly.
2 Q Are you the person within the Department who 3 primarily utilizes the equipment?
4 A Yes, I am.
5 Q In your estimation, since the spring of 2007, how 6 many times have you utilized the equipment to locate a
7 particular cellphone?
8 A Probably, I could answer specifically. But off the 9 top of my head, probably in the 200 or more times.
10 Q And in those 200 or more times, what have you found 11 to be the level of reliability as to the accuracy of the 12 equipment?
13 A Truthfully at this point, 100 percent.
14 Q Does the equipment undergo any sort of maintenance 15 or anything of that nature, similar to what we're -- similar 16 to what we experience in the DUI machines? 17 A There is not maintenance, per se. The equipment is 18 under a maintenance contract. The software is periodically 19 updated. The equipment performs self calibration, but there 20 is not a specific maintenance schedule for it.
21 Q would it be -- if this is a good way to phrase it 22 similar to if my car is running okay, it's continuing to run 23 okay? 24 A Yes, for the most it's -- you know, it works or it 25 doesn't. And as long as everything is functioning properly
190 TERESA SELVA, OFFICIALFDFCDC DIGITAL 82 REPORTER 22
1 all the process that goes on insures the reliability.
2 Q And the proprietary nature of the equipment is that
3 it allows you to stand in the place of the service provider.
4 Is that correct? 5 A That's correct.
6 Q In this instance you picked up the signal from the 7 cellphone. That is correct?
8 A Yes.
9 Q when you initially do that, are you doing that from 10 the Tallahassee Police Department or some other location? 11 A No. we have to be within close proximity of the 12 handset to capture it.
13 Q That's where verizon then first comes in, that 14 they're providing you some information as to what tower it's 15 close to?
16 A That is correct.
17 Q Then you go to some general vicinity/location, 18 operate your equipment, and then that's when you then hone 19 your location? 20 A That is correct. 21 Q And in this instance, although you weren't able to 22 recall the apartment number, if I was to tell you that it was .23 Apartment 251 at Berkshire Manor Apartments, would you agree 24 with that? 25 A I would. I actually have it written down on a note .
191 TERESA SELVA, OFFICIALFDFCDC DIGITAL 83 REPORTER 23
1 Yes, 251.
2 Q All right. And how much time in your memory elapses 3 from when you get to ·the general vicinity, to the point where 4 you have actually located a specific apartment? what's your 5 best case estimate in this case?
6 A In this case, we actually -- I actually worked
7 several hours ta attempt to capture the phone, initially; so 8 from the time that -- the time that we actually captured the 9 handset the first time, then I know that I'm relatively close 10 to it. That was from a vehicle-based system. 11 At that point, then we know that we're close. we use the 12 vehicle-based system to help give us an area of the apartment 13 complex. And at that point we switch over to a hand held 14 device. With a hand held device it took really approximately 15 -- I would say really no more than 20 to 25 minutes, maybe 30 16 minutes to confidently determine the apartment. And we 17 continue to, you know -- continually check that and measure 18 that and continue to confirm that. But from the initial 19 determination, probably 25 to 30 minutes. 20 Q And if I understood your testimony on direct 21 examination, your best estimate is that may have been 22 somewhere in the neighborhood of 1:00 to 2:00 in the morning, 23 on that sunday morning?
24 A I as I recall, yes. I basis that again on having 25 gone home for a little bit and coming back out as I recall,
192 TERESA SELVA, OFFICIALFDFCDC DIGITAL 84 REPORTER 24
1 shortly after midnight and then working from that point.
2 Q And at that point in time, do you pass it on to the 3 primary investigating officer in the case?
4 A Yes.
5 Q would you pass that information on, to Investigator 6 wester? 7 A He was present; Investigator Suleski was present.
8 several ended up responding to the scene at that point. I 9 believe that sergeant Adams was present as well, and that 10 information was provided to numerous people.
11 Q were you present when contact was made with the 12 occupants of Apartment 251 at Berkshire Manor Apartments?
13 A I was present, close by.
14 Q What is your memory with respect to how much time 15 elapsed from the point when you know you've got the apartment 16 where the cellphone is in, versus someone arriving at the door 17 and knocking on it. How much time elapses between those two?
18 A It's very hard for me to recall. I know that there 19 was discussion as far as tactics and techniques that would be
20 employed. But I was waiting for a supervisor to arrive on 21 scene, waiting for sufficient officers to arrive on scene.
22 But I don't recall that being more than you know, maybe an 23 hour or two at most.
24 Q What Were the techniques that were discussed while 25 you were deciding what it is you're going to do to do after
TERESA SELVA, OFFICIAL DIGITAL REPORTER 193 FDFCDC 85 THIS PAGE INTENTIONALLY LEFT BLANK
FDFCDC 86