Sunday, October 11, 2009

Extra-Statutory

Extra-Statutory
.
Where, for illustrative purposes only, a Home Office circular regulates e.g. the use of listening devices and aural and visual procedures, the standards set by that document may be the same as those under a Stature (say RIPA or, previously, IOCA) but that Home Office circular does not mean by following its guidance it makes any acts or omissions compliant with the statutory provisions; conduct arising from following the circulars regulation, and not the statute, could be "wholly extra-statutory" and would probably contravene the European Convention on Human Rights - see Malone v Metropolitan Police Commissioner [1979] Ch 344; cf Malone v United Kingdom (1984) 7 EHRR 14.
.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.
.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.
.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.
.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.
.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.

Monday, September 21, 2009

SMS Text Messages - Hearsay Evidence

SMS Text Messages - Hearsay Evidence
.
C2247 / R v Leonard 2009
YEAR OF CASE: 2009
CITATION: [2009] EWCA Crim 1251
COURT: Court of Appeal
.
SUMMARY:
Large quantities of various types of Class A drugs and cash were found in L's bedsit and on his person during a search by police.
.
At trial for possession of class A drugs with intent to supply, the prosecution argued that L was a street dealer and those drugs found had been his 'stock pile'. The defence argued that the drugs were for his personal use and that he was not a dealer but he had the large amount that was found because he intended to share them with his girlfriend.
.
The prosecution wished to admit two text messages as evidence to support its case. Both were from different people, one to compliment the 'gear', the other to complain about it. The defence argued that the text messages were inadmissible hearsay. The judge rejected the argument and admitted them as evidence of bad character as opposed to hearsay.
.
L was convicted and appealed arguing that the judge had been wrong in law.
.
Held:
Appeal dismissed. Convictions upheld. The text messages were hearsay evidence and not evidence of bad character. They fell in the scope of section 114 and 115 of the Criminal Justice Act 2003 and had to for the following reasons;
.
(i) they had not been made in oral evidence,
(ii) they were statements of fact or opinion within the meaning of section 115(2) of the 2003 Act,
(iii) the reason for the evidence being admitted was to establish the matters stated in the texts to try to prove that L had supplied the drugs to the senders of the texts, and
(iv) each message was designed to make the person in receipt of them believe the matters stated in them as required by section 115(3).
.
Once it is established that the texts are hearsay they then fall to be analysed as to whether they meet the statutory requirements regarding admission. The only basis upon which they could be admitted would be under section 114(1)(d); that it was in the interests of justice to do so. To ascertain whether that is the case, regard must then be had to the 9 propositions in section 114(2) and as they fail to meet some or all of those criteria, they may be hearsay, but they are inadmissible hearsay evidence. Despite this there was still a very strong case against L without them and their admission had not tainted the rest of the trial.
.
Note:
In this instance the senders of the text messages were never identified. If the authors can be identified then the text messages may become admissible where the authors can be potential witnesses. Thus allowing the evidence to be tested by way of cross-examination with any requisite measures in place, for example special measures under the Youth Justice and Criminal Evidence Act 1999 to alleviate such issues as fear.
.

Sunday, September 13, 2009

BCCH data uncovered

BCCH data uncovered
.
The data found in the elementary file broadcast control channel (EFBCCH) 7F20:6F74 / 7F21:6F74 can provide useful data relating to a geographical radio area when combined with location area information data.

.
Method for translating BCCH information data. The question is, is the translation below to find the BCCH frequencies correct and what have I not mentioned below? You will need copies of GSM11.11, GSM03.03, GSM04.08 as well as understanding coding schemes.
.
FIGURE 1 What the Standard states:
.
FIGURE 2 What that means:
.

.
FIGURE 3 Harvested data from a Orange SIM Card read:
.


.
FIGURE 4 Translating the hex output to binary:
.


.
FIGURE 5 Converting to decimal digits which translates again and corresponds to GSM assigned uplink/downlink frequencies:
.
BCCH Frequencies (ARFCN)
761 765 766 774 781 782 786 787 789 790 797 799 801 803 806 813 816 825 828 829 838 846 847 849 869
.
FIGURE 6 Corroborating the conversion using another tool:
.
.
More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Friday, July 10, 2009

Mobile Phone Flash Memory Chip Evidence

Mobile Phone Flash Memory Chip Evidence
.
When recovering data using flasher box devices it may be useful to support the notion of obtaining a detail (IMSI/ICCID/etc) about a previously inserted paricular SIM Card in a particular mobile telephone that the notion about storing such data in memory is:
.
- not new
- not clandestine shady black-box technology
- not a security breach by the handset manufacturer
.
In fact the entire process of maintaining a SIM List in the phone was designed to allow a user with more than one SIM Card to gain access to previously held memory data associated with each particular SIM Card.
.
In order to support that statement it would be helpful to see practitioners using authoratitive statements about the forensic 'reliability' and 'accuracy' of recovered data being obtained using flash reading devices and the evidential 'weight' and 'value' to be given to the data.
.
To assist, here is a statement from a 1996 published Electronic User Guide for the Nokia 2110:
.
SECURITY LEVEL (Menu 5 2) Page 71
"The phone keeps a list of the SIM cards which are used with the phone. This list may contain the information on up to five different SIM cards."
.
However under the same section in the User Guide it states:
.
"Regardless of the selected security level, all temporarily stored phone numbers are erased when a new SIM card is installed. On the other hand, these phone numbers are not erased when a previously used SIM card is inserted, regardless of the selected security level."
.
As a query about forensic reliability and accuracy:
.
- During the acquisition process and the harvesting of the data acquired is there/ has there been anything lost in translation of the data themselves, at first instance? If the IMSI you have recovered from flash memory is presented along with call logs etc, how do you know that those call logs relate to that IMSI and not another IMSI?
.
As a query about evidential weight and value:
.
- What weight can be given to the recovered IMSI being directly associated with those call logs? Moreover, what value is there in using such potentially uncorroborated evidence assigned to the recovered data being presented as evidence?

Fowler-Nordheim Tunnelling Principle

Fowler-Nordheim Tunnelling Principle
.
The floating gate can be charged and discharged by using Fowler-Nordheim "tunnelling". A principle whereby certain electrons subjected to an electric field can cross the forbidden gap of an insulator to enter the conduction band and thus flow freely for a short distance to a positively charged area.

Sunday, May 17, 2009

A808 Watch Phone With Bluetooth

A808 Watch Phone With Bluetooth
.
The spec for the A808 Tri-band (GSM 900 / 1800 / 1900 MHZ), GPRS and Bluetooth connectivity, a 1.3 inch touch screen and interestly not only keyboard but handwritten input. Additionally it comes with an MP3 / MP4 multimedia player and FM radio. And it's made in China.
.
.
The SIM is underneath the back cover and the cover carries an Apple-logo. Anyone examined this fancy goods style watch mobile telephone before and if so can you please send an email to me (to the email address located at the top my blogspot page) to let me know of any useful programs for downloading data via bluetooth. Thanks.
.