Court Rejects Cell Site RF Signal Map In Murder Trial Because It's Evidence Of Nothing
from the anything-to-avoid-asking-for-a-warrant dept
The Maryland Court of Special Appeals has handed down a ruling [PDF] on quasi-cell site location info. The evidence offered by the state isn't being so much suppressed as it is being rejected. The information wasn't obtained illegally and no rights were violated. Rather, the court finds the evidence to be questionable, as in "evidence of what, exactly?" [via EvidenceProf Blog]
The defendant in the case is charged with murder. Bashunn Phillips filed a motion to exclude the evidence, which was granted by the lower court. The state appealed. But there's nothing in it for the state.
The "evidence" -- which is going to carry around scare quotes for the remainder of this post -- doesn't tie Phillips to anything. What was submitted isn't even the equivalent of coarse cell site location info. What the state submitted is something that can easily be obtained without a warrant… because it doesn't actually target any person at all.
Phillips filed a motion in limine on August 7, 2015, seeking to exclude the RF signal propagation map and related testimony. Phillips argued that the method used to create the map was not generally accepted as reliable within the relevant scientific community under Maryland’s Frye-Reed test for admissibility of evidence based on novel scientific methodology. Phillips acknowledged that cell phone tower “ping” evidence is admissible, but drew a distinction between the method used to create the RF signal propagation map and the collection of historical cell phone “ping” evidence.
This is an interesting form of evidence -- something that amounts to cell tower hearsay. It's not like it's much trouble to obtain historical cell site data. This can be done without a warrant in Maryland, despite the recent ruling that requires warrants for Stingray deployment. Historical cell site location data is still a third-party record as far as the federal courts are concerned, so good faith, if nothing else, would have salvaged the warrantless harvesting of this data.
For whatever reason, local law enforcement chose to have the FBI perform a "drive test" of cell towers in the area of the criminal activity, ten months after it happened. Perhaps law enforcement wanted to believe this data would indicate something and allowed itself to be persuaded by pitches like this one, from a company that offers "cell site forensics" to law enforcement agencies.
Cell Site Analysis (CSA) the science of reconstructing the physical movements of a mobile telephone or telecommunication device. The evidence produced from such advanced investigations can be especially powerful in attributing contact between individuals, proximity to a scene of crime, patterns of movement of suspects, and testing the strength of alibi evidence.
These assertions are undermined further down the page when the company explains the limits of drive tests:
How accurate is Cell Site Analysis? This is a common question and there is no short answer. A number of factors come into play, including the type of signalling technology used (GSM/UMTS/CDMA), the local topology (man made or natural obstructions), the height of the antennae, type of CDRs available, physical location of other masts, angling of the transceivers, and degree of network activity (other subscribers). In some instances Cell Site Analysis can be accurate to a few metres, or sometimes a few streets (approximately a postcode).
In other words, most likely not all that accurate. Pinning down a historical cell signal based on a 10-month post facto RF analysis is extremely iffy. Being within a few streets of a committed crime proves nothing. Given the number of variables, these tests are perhaps best left to their original purpose: providing cell service providers info on possible dead zones. That doesn't stop Afentis Forensics from wrapping up this paragraph in an overconfident manner.
However, the technique remains an extremely powerful tool to test an alibi, to show that a number of people were together at a certain time, or to highlight the fact that a suspect was at a crime scene.
The defense in this case pointed out drive tests are indicative of nothing:
Phillips maintained that drive tests are routinely performed by cell phone companies to improve coverage and minimize “dropped calls,” but that they are not generally accepted in criminal investigations. Testifying for the defense, William Folson, accepted as an expert witness “in the field of cellular technology and historical cell site analysis” explained that he “consider[s] [drive tests] a waste of time” because “[t]hey add no value to the historical analysis of a cell phone.” He further testified that the manner in which Special Agent Fennern had performed the drive test was not accepted as reliable in the relevant scientific community. Mr. Folson explained that the RF signal range in December 2013 when the murder occurred would be different than the range in October 2014 when the drive test was conducted because the strength of RF signals fluctuate. Because of this, according to Mr. Folson, a drive test is not representative of the strength of the RF signals on any other date. He also pointed out that drive tests were not peer reviewed, accepted by the scientific community, or used in criminal investigations.
It's almost impossible to find a drive test submitted as evidence in a criminal investigation. Granted, a search for this terminology is bound to miss a few cases, especially those behind the US government's PACER paywall, but the lack of hits suggests this "evidence" is very rarely submitted in criminal trials. What can be found suggests the method used by the FBI agent in this case is completely wrong. Ten months after the fact gives you nothing but garbage.
[T]he coverage area of a cell tower should never be part of an analyst's mapping or court presentations unless that information comes directly from the wireless telephone company in the form of a radio propagation map or in some rare cases, in the form of drive testing that occurred contemporaneous to the date and time of the incident.
Apparently, this "evidence" is a bit more popular in Australia. A paper by a legal aid group discusses several problems with using drive tests/RF signal propagation maps as evidence.
Topography, weather, usage load, broadcast wattage, and overlap of cell coverage entail that to go to point A and make test calls now with the result that some or all of those test calls go through a specified sector of a particular base station does not ‘prove’ that at some other earlier time calls from point A went through that same specified sector. At that other time they may have gone through another sector. When a user places a call, the cell phone connects to the cell site with the strongest signal. Indoor or outdoor use of the phone and cell phone orientation to the user’s head can alter the strength of the signal. These are important considerations when attempting to recreate an alleged past event.
In general it is often easier to be more definitive about the converse proposition, namely that from the Cell ID information it is unlikely that the call was made (or received) outside a specified area. Access from the Telcos to propagation prediction modelling (ie for both ‘dominant’ and ‘possible’ coverage of relevant sectors) is helpful but insufficient to be certain about phone location.
In this context of qualified uncertainty, it is highly misleading to infer positive location with the phrase ‘the Cell ID identified with a call is consistent with the call being made in that location.’
In the Maryland case, the state offered up two witnesses to rebut the "this data doesn't prove anything" defense argument.
Providing a different opinion and testifying for the State, Special Agent Fennern was accepted as an “expert in the field of historical cell site analysis, cellular technology, and [] radio frequency drive testing for cell phone mapping.” Agent Fennern opined that factors such as weather only have a “minimal” impact on radio frequency strength. He also testified that, relying on information provided by cell phone companies, the RF signal strength only varied by five or ten percent.
The State also offered the testimony of T-Mobile employee Stephen Willingham, accepted as an expert in radio frequency engineering. He testified that cell phone companies use drive tests for “competitive analysis reasons.” He explained that when a customer complains about a missed call, a cell phone company will use a drive test to attempt to recreate that dropped call to identify a gap in service. Mr. Willingham testified that, over time, radio frequency “[f]ootprints remain consistent as long as nothing major has changed[,]” referring to the physical layout of the cell site, such as antennas and equipment. He stated that the maximum variation he had seen for a footprint was a quarter mile.
Even if all the variables stay the same, the only thing that can truthfully be said is they're possibly accurate within a quarter mile. If that's the case, it's impossible to claim someone was at the scene of a crime using nothing more than an RF propagation map. And, if the arguments made by the defendant are any indication, the state never bothered obtaining or submitting historical cell site location info (the "ping" evidence).
The appeals court agrees with the lower court's opinion: the state can't show anyone has accepted drive tests as a reliable source of evidence in criminal cases.
After determining that the digital forensic science field is the relevant scientific community, the court found that the State’s experts lacked familiarity with that field and were unable to produce studies or peer-reviewed articles in that field supporting the reliability or general acceptance of drive tests for forensic purposes. The court ultimately concluded that the State did not establish that drive tests as used by the FBI are generally accepted in the digital forensic science community. The court then mused that, even if the drive test were considered generally accepted and reliable, the State’s experts were not qualified to testify because they were not members of the digital forensic science community and failed to satisfy the requirement of Maryland Rule 5-702.
This case is exceptionally weird, considering local law enforcement had help from the FBI. Unless the defendant's provider was extremely proactive in scrapping old location data and/or was unresponsive to subpoenas for call records, the state should have had something better than a drive test to place the defendant at the scene. But this is the only evidence the defendant sought to exclude, which suggests other cell records were never introduced. If so, this is a case where law enforcement had several options, but for some reason chose to use the worst one.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
Maybe it was the only one that could be used as evidence against Bashunn Phillips, with the others placing him somewhere else.
[ link to this | view in chronology ]
Or it was a case of fruit of the poison tree
[ link to this | view in chronology ]
Re: Or it was a case of fruit of the poison tree
[ link to this | view in chronology ]
Apparently the narrative bottom line was the prosecution trying to link the defendant's cellfone to the crime scene via 'signal triangulation from multiple cell towers' -- but the technical accuracy of such triangulation was in doubt... and rejected by that judge.
The main point (apparently) is 'Cell Towers Triangulation Accuracy' as legal evidence -- but that's never stated in the explanation.
The strong and emphasis on "RF Signal Map" is unnecessary and very confusing.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
It isn't even triangulation. The prosecution was essentially trying to base their location calculation on data from a single tower, and even assuming they got the right tower the error margin's far too high for their claims. And there's no guarantee they even identified the right tower, just imagine the error margin if they're trying to calculate the location relative to a different tower than would've been used at the time of the incident.
[ link to this | view in chronology ]
Re: Re:
And... not-even-triangulation of what? Some test phone 10 months later.
So yeah, main point rather well mischaracterized. It is about RF signal propagation maps. Which is exactly what they are and how the prosecution refers to this "evidence".
[ link to this | view in chronology ]
Re: single tower scam
Cops & prosecutor here were trying to snow the judge/jury with technical bull$hit. There's no way current cell tower design can provide accurate cell phone location from a 'single tower'. RF experts probably told the cops that-- but our cops & prosecutors value convictions much more highly than truth.
Note that current RF Interferometry technology would allow accurate location fixes from a single cell tower -- but the hardware/software is very expensive.
Nevertheless, the government will very likely mandate such interferometry in all cell towers within next 25 years. All cell phone locations will be accurately tracked all the time.
[ link to this | view in chronology ]
Re:
Im gonna state that this is more of a terminology thing rather than saying that you're incorrect, but triangulation is not what was being done here.
Think more of a Venn diagram. Where the signal strengths overlap is the basis for where the telephone "location" is. That's a better concept and goes more to the "RF Signal map" description.
The problem is that its not a clean circular Venn diagram, but random patchy blobs of variable patchiness's scattered around seemingly random places, all morphing and evolving in real time depending on local conditions. Providing a location requires a realtime analysis of the various signal strengths, and even then requires an amount of time to start creating a signal probability map to a usable accuracy.
The Judge was right. This indicated nothing other than that phone was vaguely in the locale at that time
[ link to this | view in chronology ]
Re: Re:
The defense expert witness, a Mr. William Folson, had it exactly right: the kind of analysis performed will tell you with somewhat moderately good precision that a certain area *may* be susceptible to dropped calls (and even then, not always if there's a change in the weather, a truck driving beside you, etc), but unless the wireless company is able to pin down the electronic environment by monitoring multiple simultaneous nearly coincident signals it would be virtually worthless for trying to determine position accurately. There is, after all, good reason we have power-hungry GPS chips in our phones for location information.
About all this "analysis" would be good for is impugning the honesty of a suspect who says he across town at the time. I'm glad the judge listened to the actual technical folks who work on these things rather than the law enforcement types who, frankly, aren't practitioners. It's rare enough to see good science understanding in a judge that I think we should celebrate what he did here.
[ link to this | view in chronology ]
Bad link
The EvidenceProf link is giving a 404: "The page you visited could not be found"--though with the odd addendum "If you're a visitor to this site, please try back a bit later."
[ link to this | view in chronology ]
If so, this is a case where law enforcement had several options, but for some reason chose to use the worst one.
Give 'em credit, they didn't actually go with "Let's just find the guy, yell 'Waistband!', & shoot the him in the back."
[ link to this | view in chronology ]
There's a more obvious flaw with this "evidence"
That's great. That's lovely. That shows WHERE THE CELL PHONE WAS. That does not show where the defendant was. In fact, it's of no value whatsoever in establishing the latter, because absent constant observation of the defendant (in which case why does the state need this?) there's no way to prove that the phone was on the defendant's person the entire time.
The state is implicitly PRESUMING that this is the case and is asking everyone else to join them in that presumption. But we shouldn't: the onus is on the state to prove its claims, not merely assert them.
[ link to this | view in chronology ]
Re: There's a more obvious flaw with this "evidence"
[ link to this | view in chronology ]
Re: Re: There's a more obvious flaw with this "evidence"
Logically it makes sense, the problem is that it flips the 'innocent until proven guilty' idea on it's head.
It shouldn't be up to the defendant to prove that they weren't carrying their phone at a particular point in time, it should be up to the prosecution to prove that they were using it then.
[ link to this | view in chronology ]
Re: Re: There's a more obvious flaw with this "evidence"
1. My phone frequently stays at home when I go to work, either because I forgot it or just didn't think I'd need it.
2. My phone's gone all kinds of places in my wife's car because I left it there by accident.
3. I've left my phone at work overnight/over the weekend because I forgot it there and didn't bother to go back for it.
4. I carried around a stranger's phone for four days because I found it was trying to return it -- thus had it in my constant possession in case one of their friends/family responded to my texts asking for their assistance.
And so on. As you might guess, I'm not someone who's stapled to his cellphone, so perhaps my experiences aren't typical. Maybe someone who uses it a lot would be more careful about keeping it nearby.
But that doesn't matter. It is the obligation of the state to PROVE, in a court of law, that the person was there, not the phone: the phone isn't the accused. So even if the method is completely accurate as hyped, at best it yields only circumstantial evidence.
[ link to this | view in chronology ]
Re: Re: Re: There's a more obvious flaw with this "evidence"
[ link to this | view in chronology ]
Re: There's a more obvious flaw with this "evidence"
Does it? The EvidenceProf link is 404 and I don't see anything in the Techdirt summary linking it to the defendent or their phone. It seems like they're just saying some cellphone could have hypothetically had service at a location.
[ link to this | view in chronology ]
Re: Re: There's a more obvious flaw with this "evidence"
As they noted in the first sentence the idea was that even assuming that the claims about how accurate the method the government is using were are true, even then they'd still have nothing beyond 'this phone was in this general area at roughly this time period'.
[ link to this | view in chronology ]
A nice way to bust an alibi, but that is it.
[ link to this | view in chronology ]
Bluntest tool in the box.
[ link to this | view in chronology ]