Location traces in criminal investigations

When reconstructing the events that led up to a crime, establishing the location of a suspect is often of crucial relevance. A suspect’s whereabouts can be informed by tactical and forensic information , and one of the most widely used sources in investigations are mobile phone records that can be provided by telephone network operators. However, these data are hard to analyze and easily misinterpreted. As such, location analysis is part of ROXANNE, a platform for analyzing speech and communication traces.

In a nutshell, mobile phones communicate with a telephone network via specialized base stations known as cell sites. As such, each cell services a small geographical area (see figure below). Meta data regarding a mobile phone use is stored by operators in call detail records (CDRs). These data show which cell was used for certain activity (e.g., a phone call), revealing the approximate location of the device.

This type of location traces is generally available in most European countries for lawful criminal investigations, and is an important source of location data. For example, in The Netherlands alone, 29015 permissions were granted to intercept mobile devices in the year 2020, and 69388 requests for accessing CDRs, summing up to at least 98403 documents containing location traces at a cell level[1].

Interpreting cell locations

Consider the scenario in which investigators have discovered that a certain device was connected to a cell tower and they want to establish whether such connection could have been made from the crime scene.

To address such question, the following restrictions need to be taken into account: i) the service area of a cell is poorly defined and depends on many conditions related to the physical environment and the network, ii) the service area of a cell may also overlap with neighboring cells, and iii) the range within which devices connect reliably to a cell site is not fixed, but depends on a number of factors such as azimuth (i.e., the direction each cell points in), height of the antenna on the cell tower, frequency of signal, technology used, etc. The service area can be more accurately estimated when using field measurements near the crime scene, but this is labor intensive and not always feasible, for example when too much time has elapsed since the crime. As a consequence, the information regarding the location of a device at a given time is often used for investigative guidance but analysts struggle to flawlessly present it in court.

Cell locations in ROXANNE

In ROXANNE, we are developing a method to estimate the probability of a cell being selected by a device. This is a lightweight way to estimate whether a cell could have provided service without the necessity of field measurements near the time of the crime. Moreover, the analyst not only has an informed expectation of whether a cell could have provided service or not, but also with which probability. This allows uncertainty to be quantified.

Even though, this is a “desktop assessment”, which by nature does not take into account all the information that could potentially affect the service area, it is valuable for the analyst and complementary to field measurements that may have been carried out.

We can estimate the service area of any known cell, using a statistical model. The only requirement is having a database containing information on a particular cell and all other cells in the area, such as their geographical position. The statistical model is based on knowledge of how cells are selected, as derived from a reference data set. This reference data was collected with ordinary mobile phones, and contains measurements of serving cells in combination with the actual (GPS) location of the device.

Given the evidence that a mobile device has connected to a cell at a given time, we may be able, for instance, to infer the likelihood ratio given two hypotheses: i) [the device] was at [the crime scene], and ii) [the device] was at [home].

Integrated analysis

Establishing the location of a mobile device, and therefore its user, based on location traces is done only as part of a criminal investigation and under very strict conditions. In this context, an often asked question is whether a suspect could have been at the crime scene at the time of the crime. Along with other data sources, location traces may contribute to relating devices to points of interest, or even co-locating multiple devices over a period of time.

ROXANNE facilitates interaction between different kinds of communication and location traces by providing an integrated platform for data analysis.

[1] Source: Jaarverslag en slotwet Ministerie van Justitie en Veiligheid, 2020