Location Area Codes (LAC)

Location Area Codes (LAC)

The desire to create databases containing MCC/MNC/LAC/CellID may seem a good idea but might produce inaccurate or erroenous results depending upon the way in which the information is used. It is known that LACs (and CellIDs for that matter) change and therefore a database becomes out of data fairly quickly.

LACs change for various reasons. Commonly LAC Dimensioning can be implemented due to heavy paging load or many LACs under one BSC causing frequent Location Updates are just two examples. The outcome of Dimensioning can require reprogramming BSC (GSM) / RNC(WCDMA) for each cell. Moreover, reprogramming at the MSC. On some occasions re-parenting at the MSC maybe required that requires re-programming LACs. Cell shapes, size and traffic capacity can change from the material time.

Unlike MCCs and MNCs, LACs are not published. LAC identifiers can by assigned by the network operator. It is essential as with all broadcast data to understand what the data mean and the data relevance to mobile telephone evidence.

Location Area Code (LAC) which is a fixed length code (of 2 octets) identifying a location area within a GSM PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values:

0000, and FFFE

These reserved values are used in some special cases when no valid LAI exists in the MS.

The Location Area Identification is a type 3 information element with 6 octets length.
....8......7......6......5......4......3......2......1....
+-----------------------------------------------+
│ ...Location Area Identification IEI..│ octet 1
+-----------------------------------------------│
│ ....MCC digit 2 │ MCC digit 1..... │ octet 2
+-----------------------+-----------------------│
│ .....MNC digit 3 │ MCC digit 3.....│ octet 3
+-----------------------+-----------------------│
│ ...MNC digit 2 │ MNC digit 1...│ octet 4
+-----------------------------------------------│
│ .......................LAC......................│ octet 5
+-----------------------------------------------│
│ ............LAC (continued)............│ octet 6
+-----------------------------------------------+
Figure 10.5.3: Location Area Identification information element


Table 10.5.3: Location Area Identification information element
+----------------------------------------------------------------------+
MCC, Mobile country code (octet 2 and 3)
The MCC field is coded as in CCITT Rec. E212, Annex A.

If the LAI is deleted the MCC and MNC shall take the
value from the deleted LAI.

In abnormal cases, the MCC stored in the mobile
station can contain elements not in the set
{0, 1 ... 9}. In such cases the mobile station should
transmit the stored values using full hexadecimal
encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.

MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)
The coding of this field is the responsibility of each
administration but BCD coding shall be used. The MNC
shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two
digits in the MNC in the LAI over the radio interface. In this
case, bits 5 to 8 of octet 3 shall be coded as "1111".
Mobile equipment shall accept LAI coded in such a way.

Note 1: In earlier versions of this protocol, the possibility to use a one digit MNC in LAI was provided on the radio interface. However as this was not used this possibility has been deleted.

Note 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC format of the LAI, and therefore unable to register on a network broadcasting the LAI in this format.

In abnormal cases, the MNC stored in the mobile
station can have
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ...9, F} hex.
In such cases the mobile station
shall transmit the stored values using full hexadecimal
encoding. When receiving such an MNC, the
network shall treat the LAI as deleted.

The same handling shall apply for the network, if a
3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.

LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most
significant bit and bit 1 of octet 6 the least
significant bit.

The coding of the location area code is the
responsibility of each administration except that
two values are used to mark the LAC, and hence the
LAI, as deleted. Coding using full hexadecimal
representation may be used. The location area code
consists of 2 octets.

If a LAI has to be deleted then all bits of the
location area code shall be set to one with the
exception of the least significant bit which shall be
set to zero. If a SIM is inserted in a Mobile Equipment
with the location area code containing all zeros, then
the Mobile Equipment shall recognise this LAC as part
of a deleted LAI
+-----------------------------------------------------+

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Poppy and Hero

Poppy and Heroes

.

Under one Flag

.

http://www.poppy.org.uk/

.

http://www.helpforheroes.org.uk/

Extra-Statutory

Extra-Statutory

.

Where, for illustrative purposes only, a Home Office circular regulates e.g. the use of listening devices and aural and visual procedures, the standards set by that document may be the same as those under a Stature (say RIPA or, previously, IOCA) but that Home Office circular does not mean by following its guidance it makes any acts or omissions compliant with the statutory provisions; conduct arising from following the circulars regulation, and not the statute, could be "wholly extra-statutory" and would probably contravene the European Convention on Human Rights - see Malone v Metropolitan Police Commissioner [1979] Ch 344; cf Malone v United Kingdom (1984) 7 EHRR 14.

.
The above represents past history events and matters have or should have moved on since then. When RIPA was introduced it was made clear that "no" extra-statutory conduct or operations were possible arising out of that new legislation. That any acts outside of that may amount to contravention and be unlawful.

.
Having illustrated a simplistic model about "extra-statutory" activity by public authority and public bodies or their personnel to avoid giving advice, direction or guidance which would/could probably mean such acts may operate in parallel to the statutory provisions instead of being enshrined within them, the same principle of extra-statutory can apply across many other areas covered by other statutes, too.

.
Advice, direction and guidance given to facilitate the transmission of sensitive and/or unlawfuly material over public systems to aid extraction and harvesting of data from device/s might probably be "wholly extra-statutory" conduct or operations. That is even where it is a one-off case. Where advice is given to do acts which appear to go against previously stated authority in dealing with certain types of materials, the expert/examiner should record all dealings with those acts that have been instructed.

.
I picked up on this whilst reading books and papers dealing with judicial review of administrative action, Blackstones Criminal Practice, Archbold, telecommunications law and practice and the laws of the internet etc etc. I also noted that ACPO Guidelines and other provisions in public sector procurement documents appear not to cover any examiner/expert who enters into extra-statutory acts.

.
These are only my observations based upon what I read, which may assist other examiners/experts. I am not giving legal advice and I do hold out to be a lawyer. It could be from what I have read that my observations may be wrong and therefore it is always recommended to seek legal advice about instructions given or past instructions acted upon, under the belief those instructing were authorised to give such directions to do such acts in the first place.

SMS Text Messages - Hearsay Evidence

SMS Text Messages - Hearsay Evidence

.

C2247 / R v Leonard 2009

YEAR OF CASE: 2009

CITATION: [2009] EWCA Crim 1251

COURT: Court of Appeal

.

SUMMARY:

Large quantities of various types of Class A drugs and cash were found in L's bedsit and on his person during a search by police.

.

At trial for possession of class A drugs with intent to supply, the prosecution argued that L was a street dealer and those drugs found had been his 'stock pile'. The defence argued that the drugs were for his personal use and that he was not a dealer but he had the large amount that was found because he intended to share them with his girlfriend.

.

The prosecution wished to admit two text messages as evidence to support its case. Both were from different people, one to compliment the 'gear', the other to complain about it. The defence argued that the text messages were inadmissible hearsay. The judge rejected the argument and admitted them as evidence of bad character as opposed to hearsay.

.

L was convicted and appealed arguing that the judge had been wrong in law.

.

Held:

Appeal dismissed. Convictions upheld. The text messages were hearsay evidence and not evidence of bad character. They fell in the scope of section 114 and 115 of the Criminal Justice Act 2003 and had to for the following reasons;

.

(i) they had not been made in oral evidence,

(ii) they were statements of fact or opinion within the meaning of section 115(2) of the 2003 Act,

(iii) the reason for the evidence being admitted was to establish the matters stated in the texts to try to prove that L had supplied the drugs to the senders of the texts, and

(iv) each message was designed to make the person in receipt of them believe the matters stated in them as required by section 115(3).

.

Once it is established that the texts are hearsay they then fall to be analysed as to whether they meet the statutory requirements regarding admission. The only basis upon which they could be admitted would be under section 114(1)(d); that it was in the interests of justice to do so. To ascertain whether that is the case, regard must then be had to the 9 propositions in section 114(2) and as they fail to meet some or all of those criteria, they may be hearsay, but they are inadmissible hearsay evidence. Despite this there was still a very strong case against L without them and their admission had not tainted the rest of the trial.

.

Note:

In this instance the senders of the text messages were never identified. If the authors can be identified then the text messages may become admissible where the authors can be potential witnesses. Thus allowing the evidence to be tested by way of cross-examination with any requisite measures in place, for example special measures under the Youth Justice and Criminal Evidence Act 1999 to alleviate such issues as fear.

.

http://www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=4567

BCCH data uncovered

BCCH data uncovered

.
The data found in the elementary file broadcast control channel (EFBCCH) 7F20:6F74 / 7F21:6F74 can provide useful data relating to a geographical radio area when combined with location area information data.
.
Method for translating BCCH information data. The question is, is the translation below to find the BCCH frequencies correct and what have I not mentioned below? You will need copies of GSM11.11, GSM03.03, GSM04.08 as well as understanding coding schemes.
.
FIGURE 1 What the Standard states:
.
FIGURE 2 What that means:
.

.
FIGURE 3 Harvested data from a Orange SIM Card read:
.


.
FIGURE 4 Translating the hex output to binary:
.


.
FIGURE 5 Converting to decimal digits which translates again and corresponds to GSM assigned uplink/downlink frequencies:
.
BCCH Frequencies (ARFCN)
761 765 766 774 781 782 786 787 789 790 797 799 801 803 806 813 816 825 828 829 838 846 847 849 869
.
FIGURE 6 Corroborating the conversion using another tool:
.
.
More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Mobile Phone Flash Memory Chip Evidence

Mobile Phone Flash Memory Chip Evidence

.

When recovering data using flasher box devices it may be useful to support the notion of obtaining a detail (IMSI/ICCID/etc) about a previously inserted paricular SIM Card in a particular mobile telephone that the notion about storing such data in memory is:

.

- not new

- not clandestine shady black-box technology

- not a security breach by the handset manufacturer

.

In fact the entire process of maintaining a SIM List in the phone was designed to allow a user with more than one SIM Card to gain access to previously held memory data associated with each particular SIM Card.

.

In order to support that statement it would be helpful to see practitioners using authoratitive statements about the forensic 'reliability' and 'accuracy' of recovered data being obtained using flash reading devices and the evidential 'weight' and 'value' to be given to the data.

.

To assist, here is a statement from a 1996 published Electronic User Guide for the Nokia 2110:

.

SECURITY LEVEL (Menu 5 2) Page 71

"The phone keeps a list of the SIM cards which are used with the phone. This list may contain the information on up to five different SIM cards."

.

However under the same section in the User Guide it states:

.

"Regardless of the selected security level, all temporarily stored phone numbers are erased when a new SIM card is installed. On the other hand, these phone numbers are not erased when a previously used SIM card is inserted, regardless of the selected security level."

.

As a query about forensic reliability and accuracy:

.

- During the acquisition process and the harvesting of the data acquired is there/ has there been anything lost in translation of the data themselves, at first instance? If the IMSI you have recovered from flash memory is presented along with call logs etc, how do you know that those call logs relate to that IMSI and not another IMSI?

.

As a query about evidential weight and value:

.

- What weight can be given to the recovered IMSI being directly associated with those call logs? Moreover, what value is there in using such potentially uncorroborated evidence assigned to the recovered data being presented as evidence?

Fowler-Nordheim Tunnelling Principle

Fowler-Nordheim Tunnelling Principle

.

The floating gate can be charged and discharged by using Fowler-Nordheim "tunnelling". A principle whereby certain electrons subjected to an electric field can cross the forbidden gap of an insulator to enter the conduction band and thus flow freely for a short distance to a positively charged area.