All Rights Reserved—John B. Minor
Litigators Guide to Simplified Cellular Carrier Cell Site
Working Range Estimation Issues
©John B. Minor, CSA CCE CSE
Cell phone call detail records (CDR’s) are often requested in civil and criminal investigations for one or more persons of interest. CDR’s typically contain geolocation data for most mobile originated (outbound communication) sessions from the cell phone and, for some carriers, a lesser number of mobile terminated (inbound communication sessions) to the cell phone.
One of the most common requests of a cell phone carrier expert is to perform signals analysis of CDR’s and estimate where the cell phone was located at a given time during an outbound or inbound communications session.
Historical geolocation mapping produced from CDR’s exhibit the cell site location and an estimated sector orientation and coverage area. Most law enforcement agencies, including the U.S. Marshal’s Technical Operations Group (TOG), uses an average cell site sector radius of 1.5 miles to demonstrate the theoretical area within which a cell phone was located during a communications session. In less populated areas the cell site sector radius may extend to several miles. Cellular carrier Radio Frequency Network Managers sometimes express opinions underestimating the possible working range of a cell site, usually because nominal or ideal network operating conditions are the only consideration expressed.
Several issues affect how a cell phone performs on the carrier network and thereby affect the estimated working range of a cell phone during a communications session.
Call Handover/Neighbor Cells/Sectors Issues
Call Handover/Handoff is the process of automatically switching between cell sites and/or sectors.
A cell phone utilizes invisible control channels (in contrast to voice & data channels that produce tangible or visible results to cell phone users) to determine the Received Signal Strength Indicator (RSSI) of two and up to six or seven cell site sectors concurrently at regular intervals of several seconds, determining which is the strongest signal and initiating the call handover process to a stronger sector when appropriate. RSSI monitoring occurs continuously when the cell phone is in either an idle mode and while a communications session is occurring.
Cell breathing is a phenomenon in CDMA and UMTS carrier networks related to traffic on a cell. The size of the cell shrinks or grows dependent on the traffic load on a cell site sector. This can be a significant factor in determining working range.
Apple iPhone Field Service Mode Exhibiting GSM Neighboring Cell Monitoring
The Nokia GSM Traffic Management Training Document states that “Handover occurs when the quality or the strength of the radio signal falls below certain parameters specified in the BSC [Base Station Controller]. The deterioration of the signal is detected by the constant signal measurements carried out by both the mobile station [cell phone] and the BTS [Base Transceiver Station or Cell Site]. As consequence, the connection is handed over to a cell with a stronger signal”.1 The illustration above is an example of the GSM Neighboring Cells concept in a real world example.
Apple iPhone Field Service Mode Exhibiting UMTS Neighboring Cell Monitoring (NOTE: Highest Signal Strength is 3rd on List)
Every cell phone maintains an updated list of cell sites with respective receive signal levels. This list is called Neighbor Set (CDMA), Neighbor Cells (UMTS) or Neighboring Cells (GSM) and helps determine which cell site sector the cell phone is registered with when calls are placed or received. A cell phone may not always be registered to the closest/strongest signal level “neighbor”.
Factors such as communications traffic load/congestion control issues, weather conditions and certain maintenance events on the carrier network may cause the working range of a sector to be lengthened.
As an example, cell sites in operation for several years in areas experiencing temperature and wind speed extremes often begin to experience network communications faults due to equipment cable connection issues. This type of fault can be the cause of call handover failures, higher call drop rates, and sector outages. The intermittency of such issues can result in neighboring cells seizing communications traffic or the problem sector holding communications traffic at longer distances from the cell site than nominal operational.
Diagram & Photo of Antenna Cable Connections for a Single Sector
Any of these scenarios involve maintenance crews working with the carrier NOC personnel to displace active communications traffic onto another cell site sector and ultimately “blocking” or shutting down a sector for the maintenance routine.
Network Operations Center (NOC) Operations Maintenance Logging Example Demonstrating Cell Site & Sector Outages During a Weather Event
Most carrier networks are reaching the age that end of life cycle issues require maintenance on a proactive basis to prevent serious system failures such as dropped calls and general network failures. Serious system failures resulting in subscriber impacting downtime are a sign of network instability.
A significant percentage of cell phone Call Detail Records (CDR) analyzed in justice system matters may be incorrectly interpreted regarding the historical location of a cell phone because a CDR analyst did not consider important factors that sometimes dramatically affect the working range estimate of a cell site.
Carriers have a paranoia regarding public perceptions that network instability exists because this can lead to “network churn”, or subscribers switching to a different carrier.
Cellular carriers are imperfect records custodians bound by both regulatory compliance and huge demand for voluminous records requests. Mistakes occur despite the best records compliance efforts such as in the AT&T Global Compliance Department’s 312 terabyte SCAMP (Security Call Analysis and Monitoring Platform) records system2.
Litigants should be wary of the double edged sword that cellular carrier call detail records represent and the Pandora’s Box often discovered within. Consultation with a qualified communications expert is highly recommended.
The foregoing information has broad litigious implications and may require thorough analytical evaluation of cellular carrier evidence prior to the rendering of expert opinions.
About the Author – John B. Minor is a practicing communications expert, cell phone signals analyst, digital Investigator and forensic examiner. John has leveraged major successes for litigation teams by locating digital evidence under unusual scenarios. John’s casework takes his expertise to the corners of the globe in a variety of investigations ranging from terrorism threats to corporate financial fraud and to more common civil and criminal venues including homicides. See http://johnbminor.com for more information about Mr. Minor.
1Nokia GSM Traffic Management Training Document issued January 2002.