Cell site, RF and the safe use of survey data

Matt Tart, one of CCL’s cell site specialists and a leading UK authority in this developing forensic area, discusses his latest research paper published in Science Direct:

The RF environment within which cell site analysis operates has become extremely complex after the introduction of multiple carriers on 3G and 4G and the variety of modes in which a mobile device can operate. Engineering handsets, an established tool used in surveys, can only select one Cell ID at a given time as a serving cell. This cell will be on a specific technology and carrier, meaning that there may be a large number of other overlaid (‘stacked’) serving cells that are not selected. This has clear implications for the safe use of survey data and leaves a requirement for a more complete view of the RF environment from which to form safe inference.

This is the most technically complex and detailed of the papers we have been publishing, and represents approximately two years of analysis of experimental data that required collaboration and support from the UK Forensic Science Regulator and the NPCC to gather the required ‘ground truth’ data. The paper may act as a reference for those undertaking validation exercises.

Assessments of reliability, accuracy and precision of methods are presented. A new survey method is presented, mitigating for issues arising from a more complex radio environment than previously encountered.

Types of survey, equipment used in those surveys and use of survey data to better inform findings in Cell Site Analysis are discussed, described and tested.  Experiments are presented comparing network generated CDRs (‘ground truth’ data) from a known location to survey measurements focussed on those locations at a later date.

The performance of engineering handset survey devices (Keysight Nemo) is compared with that of Software Defined Radio (QRC ICS-500) for assessment of these trial data. Bulk data resulting from wider casework as opposed to targeted testing was also used for this purpose.

Analysis is presented including false positive rates, false negative rates, stochasticity and stress testing (when the data for engineering handsets differed from that of the SDR). All UK networks are tested, on GSM, UMTS and LTE technologies.

Read more

‍