Court Rejects Cell Site RF Signal Map In Murder Trial Because It's Evidence Of Nothing
from the anything-to-avoid-asking-for-a-warrant dept
The Maryland Court of Special Appeals has handed down a ruling [PDF] on quasi-cell site location info. The evidence offered by the state isn’t being so much suppressed as it is being rejected. The information wasn’t obtained illegally and no rights were violated. Rather, the court finds the evidence to be questionable, as in “evidence of what, exactly?” [via EvidenceProf Blog]
The defendant in the case is charged with murder. Bashunn Phillips filed a motion to exclude the evidence, which was granted by the lower court. The state appealed. But there’s nothing in it for the state.
The “evidence” — which is going to carry around scare quotes for the remainder of this post — doesn’t tie Phillips to anything. What was submitted isn’t even the equivalent of coarse cell site location info. What the state submitted is something that can easily be obtained without a warrant… because it doesn’t actually target any person at all.
Phillips filed a motion in limine on August 7, 2015, seeking to exclude the RF signal propagation map and related testimony. Phillips argued that the method used to create the map was not generally accepted as reliable within the relevant scientific community under Maryland’s Frye-Reed test for admissibility of evidence based on novel scientific methodology. Phillips acknowledged that cell phone tower “ping” evidence is admissible, but drew a distinction between the method used to create the RF signal propagation map and the collection of historical cell phone “ping” evidence.
This is an interesting form of evidence — something that amounts to cell tower hearsay. It’s not like it’s much trouble to obtain historical cell site data. This can be done without a warrant in Maryland, despite the recent ruling that requires warrants for Stingray deployment. Historical cell site location data is still a third-party record as far as the federal courts are concerned, so good faith, if nothing else, would have salvaged the warrantless harvesting of this data.
For whatever reason, local law enforcement chose to have the FBI perform a “drive test” of cell towers in the area of the criminal activity, ten months after it happened. Perhaps law enforcement wanted to believe this data would indicate something and allowed itself to be persuaded by pitches like this one, from a company that offers “cell site forensics” to law enforcement agencies.
Cell Site Analysis (CSA) the science of reconstructing the physical movements of a mobile telephone or telecommunication device. The evidence produced from such advanced investigations can be especially powerful in attributing contact between individuals, proximity to a scene of crime, patterns of movement of suspects, and testing the strength of alibi evidence.
These assertions are undermined further down the page when the company explains the limits of drive tests:
How accurate is Cell Site Analysis? This is a common question and there is no short answer. A number of factors come into play, including the type of signalling technology used (GSM/UMTS/CDMA), the local topology (man made or natural obstructions), the height of the antennae, type of CDRs available, physical location of other masts, angling of the transceivers, and degree of network activity (other subscribers). In some instances Cell Site Analysis can be accurate to a few metres, or sometimes a few streets (approximately a postcode).
In other words, most likely not all that accurate. Pinning down a historical cell signal based on a 10-month post facto RF analysis is extremely iffy. Being within a few streets of a committed crime proves nothing. Given the number of variables, these tests are perhaps best left to their original purpose: providing cell service providers info on possible dead zones. That doesn’t stop Afentis Forensics from wrapping up this paragraph in an overconfident manner.
However, the technique remains an extremely powerful tool to test an alibi, to show that a number of people were together at a certain time, or to highlight the fact that a suspect was at a crime scene.
The defense in this case pointed out drive tests are indicative of nothing:
Phillips maintained that drive tests are routinely performed by cell phone companies to improve coverage and minimize “dropped calls,” but that they are not generally accepted in criminal investigations. Testifying for the defense, William Folson, accepted as an expert witness “in the field of cellular technology and historical cell site analysis” explained that he “consider[s] [drive tests] a waste of time” because “[t]hey add no value to the historical analysis of a cell phone.” He further testified that the manner in which Special Agent Fennern had performed the drive test was not accepted as reliable in the relevant scientific community. Mr. Folson explained that the RF signal range in December 2013 when the murder occurred would be different than the range in October 2014 when the drive test was conducted because the strength of RF signals fluctuate. Because of this, according to Mr. Folson, a drive test is not representative of the strength of the RF signals on any other date. He also pointed out that drive tests were not peer reviewed, accepted by the scientific community, or used in criminal investigations.
It’s almost impossible to find a drive test submitted as evidence in a criminal investigation. Granted, a search for this terminology is bound to miss a few cases, especially those behind the US government’s PACER paywall, but the lack of hits suggests this “evidence” is very rarely submitted in criminal trials. What can be found suggests the method used by the FBI agent in this case is completely wrong. Ten months after the fact gives you nothing but garbage.
[T]he coverage area of a cell tower should never be part of an analyst’s mapping or court presentations unless that information comes directly from the wireless telephone company in the form of a radio propagation map or in some rare cases, in the form of drive testing that occurred contemporaneous to the date and time of the incident.
Apparently, this “evidence” is a bit more popular in Australia. A paper by a legal aid group discusses several problems with using drive tests/RF signal propagation maps as evidence.
Topography, weather, usage load, broadcast wattage, and overlap of cell coverage entail that to go to point A and make test calls now with the result that some or all of those test calls go through a specified sector of a particular base station does not ‘prove’ that at some other earlier time calls from point A went through that same specified sector. At that other time they may have gone through another sector. When a user places a call, the cell phone connects to the cell site with the strongest signal. Indoor or outdoor use of the phone and cell phone orientation to the user’s head can alter the strength of the signal. These are important considerations when attempting to recreate an alleged past event.
In general it is often easier to be more definitive about the converse proposition, namely that from the Cell ID information it is unlikely that the call was made (or received) outside a specified area. Access from the Telcos to propagation prediction modelling (ie for both ‘dominant’ and ‘possible’ coverage of relevant sectors) is helpful but insufficient to be certain about phone location.
In this context of qualified uncertainty, it is highly misleading to infer positive location with the phrase ‘the Cell ID identified with a call is consistent with the call being made in that location.’
In the Maryland case, the state offered up two witnesses to rebut the “this data doesn’t prove anything” defense argument.
Providing a different opinion and testifying for the State, Special Agent Fennern was accepted as an “expert in the field of historical cell site analysis, cellular technology, and [] radio frequency drive testing for cell phone mapping.” Agent Fennern opined that factors such as weather only have a “minimal” impact on radio frequency strength. He also testified that, relying on information provided by cell phone companies, the RF signal strength only varied by five or ten percent.
The State also offered the testimony of T-Mobile employee Stephen Willingham, accepted as an expert in radio frequency engineering. He testified that cell phone companies use drive tests for “competitive analysis reasons.” He explained that when a customer complains about a missed call, a cell phone company will use a drive test to attempt to recreate that dropped call to identify a gap in service. Mr. Willingham testified that, over time, radio frequency “[f]ootprints remain consistent as long as nothing major has changed[,]” referring to the physical layout of the cell site, such as antennas and equipment. He stated that the maximum variation he had seen for a footprint was a quarter mile.
Even if all the variables stay the same, the only thing that can truthfully be said is they’re possibly accurate within a quarter mile. If that’s the case, it’s impossible to claim someone was at the scene of a crime using nothing more than an RF propagation map. And, if the arguments made by the defendant are any indication, the state never bothered obtaining or submitting historical cell site location info (the “ping” evidence).
The appeals court agrees with the lower court’s opinion: the state can’t show anyone has accepted drive tests as a reliable source of evidence in criminal cases.
After determining that the digital forensic science field is the relevant scientific community, the court found that the State’s experts lacked familiarity with that field and were unable to produce studies or peer-reviewed articles in that field supporting the reliability or general acceptance of drive tests for forensic purposes. The court ultimately concluded that the State did not establish that drive tests as used by the FBI are generally accepted in the digital forensic science community. The court then mused that, even if the drive test were considered generally accepted and reliable, the State’s experts were not qualified to testify because they were not members of the digital forensic science community and failed to satisfy the requirement of Maryland Rule 5-702.
This case is exceptionally weird, considering local law enforcement had help from the FBI. Unless the defendant’s provider was extremely proactive in scrapping old location data and/or was unresponsive to subpoenas for call records, the state should have had something better than a drive test to place the defendant at the scene. But this is the only evidence the defendant sought to exclude, which suggests other cell records were never introduced. If so, this is a case where law enforcement had several options, but for some reason chose to use the worst one.
Comments on “Court Rejects Cell Site RF Signal Map In Murder Trial Because It's Evidence Of Nothing”
Maybe it was the only one that could be used as evidence against Bashunn Phillips, with the others placing him somewhere else.
Or it was a case of fruit of the poison tree
They know he is guilty due to evidence that they can’t share to to its illegal/NSA origin. They created faked data via the map to try to dance around the lack of actual evidence that they can use in court. It has worked every other time they tried it, just not this time for some reason.
Re: Or it was a case of fruit of the poison tree
nsa don’t give a shit about some local schmucks in maryland.
… a very long & very difficult to follow explanation of what ??
Apparently the narrative bottom line was the prosecution trying to link the defendant’s cellfone to the crime scene via ‘signal triangulation from multiple cell towers’ — but the technical accuracy of such triangulation was in doubt… and rejected by that judge.
The main point (apparently) is ‘Cell Towers Triangulation Accuracy’ as legal evidence — but that’s never stated in the explanation.
The strong and emphasis on “RF Signal Map” is unnecessary and very confusing.
Re: Re:
The problem with this was the basic inaccuracy of the method. Its accuracy appears to 1/4 to 1/2 mile from the actual location. So the best one can say is someone was in the general area. This is much different from someone or a video placing him at precise spot at a definite time. The courts are correct in rejecting it as proves nothing.
Re: Re:
It isn’t even triangulation. The prosecution was essentially trying to base their location calculation on data from a single tower, and even assuming they got the right tower the error margin’s far too high for their claims. And there’s no guarantee they even identified the right tower, just imagine the error margin if they’re trying to calculate the location relative to a different tower than would’ve been used at the time of the incident.
Re: Re: Re:
And… not-even-triangulation of what? Some test phone 10 months later.
So yeah, main point rather well mischaracterized. It is about RF signal propagation maps. Which is exactly what they are and how the prosecution refers to this "evidence".
Re: Re: single tower scam
you are exactly correct — this was a ‘single cell tower’ locater scam
Cops & prosecutor here were trying to snow the judge/jury with technical bull$hit. There’s no way current cell tower design can provide accurate cell phone location from a ‘single tower’. RF experts probably told the cops that– but our cops & prosecutors value convictions much more highly than truth.
Note that current RF Interferometry technology would allow accurate location fixes from a single cell tower — but the hardware/software is very expensive.
Nevertheless, the government will very likely mandate such interferometry in all cell towers within next 25 years. All cell phone locations will be accurately tracked all the time.
Re: Re:
Triangulation accuracy?
Im gonna state that this is more of a terminology thing rather than saying that you’re incorrect, but triangulation is not what was being done here.
Think more of a Venn diagram. Where the signal strengths overlap is the basis for where the telephone “location” is. That’s a better concept and goes more to the “RF Signal map” description.
The problem is that its not a clean circular Venn diagram, but random patchy blobs of variable patchiness’s scattered around seemingly random places, all morphing and evolving in real time depending on local conditions. Providing a location requires a realtime analysis of the various signal strengths, and even then requires an amount of time to start creating a signal probability map to a usable accuracy.
The Judge was right. This indicated nothing other than that phone was vaguely in the locale at that time
Re: Re: Re:
Quite right. I’ve had to design these chips in a past life and the signal propagation changes are just massive as you move and keeping the main signal constant is a real challenge as the signal changes multiple orders of magnitude as you hit reflections, rain and humidity changes, etc. Unless you were doing real-time analysis directly beside the phone these kinds of analyses are pretty much worthless to pinning down a phone.
The defense expert witness, a Mr. William Folson, had it exactly right: the kind of analysis performed will tell you with somewhat moderately good precision that a certain area may be susceptible to dropped calls (and even then, not always if there’s a change in the weather, a truck driving beside you, etc), but unless the wireless company is able to pin down the electronic environment by monitoring multiple simultaneous nearly coincident signals it would be virtually worthless for trying to determine position accurately. There is, after all, good reason we have power-hungry GPS chips in our phones for location information.
About all this “analysis” would be good for is impugning the honesty of a suspect who says he across town at the time. I’m glad the judge listened to the actual technical folks who work on these things rather than the law enforcement types who, frankly, aren’t practitioners. It’s rare enough to see good science understanding in a judge that I think we should celebrate what he did here.
Bad link
The EvidenceProf link is giving a 404: "The page you visited could not be found"–though with the odd addendum "If you’re a visitor to this site, please try back a bit later."
If so, this is a case where law enforcement had several options, but for some reason chose to use the worst one.
Give ’em credit, they didn’t actually go with "Let’s just find the guy, yell ‘Waistband!’, & shoot the him in the back."
There's a more obvious flaw with this "evidence"
Suppose, for a moment, that it’s accurate: that is, that the science is sound, that nothing significant changed, and that it lives up to the hype surrounding it.
That’s great. That’s lovely. That shows WHERE THE CELL PHONE WAS. That does not show where the defendant was. In fact, it’s of no value whatsoever in establishing the latter, because absent constant observation of the defendant (in which case why does the state need this?) there’s no way to prove that the phone was on the defendant’s person the entire time.
The state is implicitly PRESUMING that this is the case and is asking everyone else to join them in that presumption. But we shouldn’t: the onus is on the state to prove its claims, not merely assert them.
Re: There's a more obvious flaw with this "evidence"
It’s a pretty good presumption, though. People don’t just go loaning out their phones for extended periods, so if he had it on him at all around that time it’s likely he had it on him for the entire period. It’s an easy presumption to rebut, but absent any rebuttal it’s reasonable to assume that his phone didn’t go randomly wandering off.
Re: Re: There's a more obvious flaw with this "evidence"
Logically it makes sense, the problem is that it flips the ‘innocent until proven guilty’ idea on it’s head.
It shouldn’t be up to the defendant to prove that they weren’t carrying their phone at a particular point in time, it should be up to the prosecution to prove that they were using it then.
Re: Re: There's a more obvious flaw with this "evidence"
But “loaning out their phone” is only one possible explanation. Let me give you a few from personal experience:
1. My phone frequently stays at home when I go to work, either because I forgot it or just didn’t think I’d need it.
2. My phone’s gone all kinds of places in my wife’s car because I left it there by accident.
3. I’ve left my phone at work overnight/over the weekend because I forgot it there and didn’t bother to go back for it.
4. I carried around a stranger’s phone for four days because I found it was trying to return it — thus had it in my constant possession in case one of their friends/family responded to my texts asking for their assistance.
And so on. As you might guess, I’m not someone who’s stapled to his cellphone, so perhaps my experiences aren’t typical. Maybe someone who uses it a lot would be more careful about keeping it nearby.
But that doesn’t matter. It is the obligation of the state to PROVE, in a court of law, that the person was there, not the phone: the phone isn’t the accused. So even if the method is completely accurate as hyped, at best it yields only circumstantial evidence.
Re: Re: Re: There's a more obvious flaw with this "evidence"
Your experiences and habits are probably very typical of most who are slaves to the device. It is usually in their possession but not always for any of a number of innocent reasons. Also, phones can be easily lost.
Re: There's a more obvious flaw with this "evidence"
Does it? The EvidenceProf link is 404 and I don’t see anything in the Techdirt summary linking it to the defendent or their phone. It seems like they’re just saying some cellphone could have hypothetically had service at a location.
Re: Re: There's a more obvious flaw with this "evidence"
As they noted in the first sentence the idea was that even assuming that the claims about how accurate the method the government is using were are true, even then they’d still have nothing beyond ‘this phone was in this general area at roughly this time period’.
A nice way to bust an alibi, but that is it.
Also requires that the alibi is for a location more than ~5 miles from the crime.
Bluntest tool in the box.
Here in the UK there is a common misunderstanding of the accuracy and little understanding of the limitations of Cell Site Analysis. It is in the sole interest of analysts to promote this misunderstanding because of the financial implications of revealing the true limits to accuracy. This so called science is fit only in accurately proving where a cell phone was not rather than where it was. It’s about time that this very blunt forensic tool is revealed for what it is.