Examination of Witnesses (Questions 145-159)
MR DAREN
GREENER, MR
VINESH PARMAR
AND MR
GREGORY SMITH
14 FEBRUARY 2006
Q145 Chairman: Good morning. Thank you
very much for joining us. As you know, we are carrying out an
inquiry into the case for extended pre-charged detention. In the
latter part of today's sessions we have looked at some of the
technical arguments that the police have put forward for extending
detention while they gain evidence that might be used in a charge.
This session is going to look particularly at mobile phone technology
in the broadest sense. I wonder if you could introduce yourselves
very briefly for the record and then we will begin the questioning.
Mr Smith: My name is Gregory Nigel
Smith. I am Principal in the firm of Trew & Co. I have been
involved with mobile telephone evidence for over 17 years, 13
years of which have been dealing with the current technology called
GSM and three years with the new 3G technology. I run training
courses for law enforcement agencies to educate them in this area
of mobile telephone evidence. I conduct expert evidence in relation
to mobile telephones and some other devices. I work for both the
prosecution and the defence.
Mr Parmar: I am Vinesh Parmar.
I have been working with the forensic mobile team for approximately
five years now, primarily with Thames Valley Police as a forensic
analyst. I am now with a company called LGC doing the same type
of role.
Mr Greener: I am Daren Greener.
I work for a company called Systems Technology Consultants. I
have worked as an expert witness investigator on mobile phone
evidence for the last four years. I present evidence on a range
of issues, from mobile phone examinations, billing analysis and
sub-site analysis predominantly in criminal cases in the UK.
Q146 Mrs Cryer: I would like to ask
you some questions about obtaining data from mobile phones. I
wonder if you could describe for us the role played in charging
suspects by information obtained from mobile phones rather than
in building the final case. Do you expect this to change in the
future? Would you like to see change in the future?
Mr Parmar: It is definitely going
to be case dependent or inquiry dependent as to what value the
evidence would have, if any at all. There have been cases where
it is the only evidence in terms of being able to charge a particular
suspect and in other cases it has been a question of showing a
particular pattern which leads on to the charging of a suspect.
Mr Greener: I would agree that
it is very much a crime dependent thing. A lot depends on the
crime itself in relation, for example, to threatening behaviour
and things like that. It may be the messaging and the content
of text messages which are on there that is important. We may
have videos and image sources that may relate directly to a crime
that has been perpetrated.
Q147 Mrs Cryer: Could you describe
for us the causes of delay in obtaining and analysing information
from mobile phones? Should it be determined that this be the main
factor in determining the length of pre-charge detention? Could
you suggest how long this pre-charging detention should be to
accommodate this sort of inquiry?
Mr Greener: Delays can be included
from the start. The actual phone may not come to the analyst straightaway
as it may be subject to DNA evidence or another type of evidence
for drugs and things like that. When we finally get access to
the phone there may be problems with the phone itself, ie it may
be PIN locked. These obstacles need to be overcome. When we come
to looking at the data and the phone, sometimes it is the case
that the phone needs repairing or there is no charge in the phone.
There is a wide variety of handsets available on the market today
and we have to find the right charging equipment and things like
that which is not always available. There are initial delays before
we start analysing the data and then we come on to other issues
that may be to do with the sheer volume of data on these phones
nowadays that have very high capacity levels.
Q148 Mrs Cryer: So there is a variety
of reasons for the delays.
Mr Greener: Yes.
Q149 Mrs Cryer: And therefore you
cannot suggest a period that would be needed to produce evidence
prior to charging?
Mr Greener: No. It is always done
on a case-by-case basis.
Q150 Chairman: Are we talking hours,
days, weeks, months?
Mr Smith: One cannot use one particular
technical problem to hijack everything as I do not think that
is correct. If you obtain a mobile telephone that has no PIN or
PUK connected to it, there is no reason why you cannot turn the
evidence round within seven days. People are concerned that if
they have a mobile telephone that has been password protected
three or four times and that causes delays then everyone should
quote the worst case scenario but that is not the case. We are
not dealing with the worst case scenario. If somebody picked up
20 or 30 mobile phones you may find one or two are problematical
but the others would not be a problem at all.
Q151 Mrs Cryer: So far as your experience
is concerned, how useful is information obtained from a mobile
phone handset without accessing the supporting data from the network
providers? How long do you believe they take to provide the necessary
information?
Mr Smith: There are two sides.
Whether the data on the handset has any substantive evidence in
court largely depends upon how it relates to the crime. Quite
often I have seen a judge saying, "I see an SMS text message
here on the handset. Have you any substantive proof by way of
a calling that it was sent?" and when we say we have not
they kick it out and say they do not want it. The other side of
the coin is that a lot of the work that they do with mobile telephones
very rarely comes through into evidence, it is used for intelligence,
which is a completely different matter and has got nothing to
do with the detention of people.
Mr Parmar: I would agree with
those points. The actual data that is produced in a report format
is pretty meaningless unless there is network data to corroborate
subscriber checks and billing records and so forth. Without that
the actual data is going to be meaningless.
Mr Greener: One of the factors
about a lot of the data contained within the phones is it is time
stamped by an internal clock on the phone that is programmed by
the end user of the phone and that is why we need to obtain the
billing data, to confirm whether these events recorded within
the phone are correct or not.
Q152 Mrs Cryer: From the providers?
Mr Greener: Yes.
Q153 Chairman: How long does it normally
take for network providers to provide the necessary information?
Mr Parmar: It depends on the level
of the crime. They have got to have five levels and they are graded
one to five.
Q154 Chairman: What about if it was
a terrorist case?
Mr Parmar: Level one is a threat
to immediate life. So it really depends on whether the particular
terrorist incident dictates that. If it is a level one incident
then it is usually within two to three hours or, for the worst
case scenario, it would be within 24 hours that the information
would be available. That is not just obtaining data from the UK
networks, that is also obtaining data from non-UK networks.
Mr Smith: It is severity that
produces those speeds.
Chairman: Obviously we are asking you
general technical questions but we are centred on terrorist investigations.
I think it is reasonable to assume it is towards the upper end
of that.
Q155 Mr Malik: Are you detecting
an increase in the encryption of data on mobile phones? Is that
a trend that you are starting to see or not really?
Mr Smith: No, I am not seeing
any increase at all. It is probably not happening at all.
Mr Parmar: I have had a few instances
over the last few months where I have experienced encryption to
do with external components associated with the handset in terms
of memory cards. At the moment there is no solution.
Q156 Mr Malik: Can you expand on
the memory cards point?
Mr Parmar: What we are seeing
now is a change in technology, a trend towards additional storage
capacities within the handset itself. What most manufacturers
are doing is not only giving you an internal memory store but
giving you an expandable memory store by way of a memory card,
which is basically just a small chip which can vary in terms of
capacity so far as memory is concerned. It is mainly used to store
multi-media files in terms of pictures and videos, but I have
seen cases where other data can be stored on there which is not
detectable by the device itself. There is an element on some of
these devices whereby you can password protect it. It is not a
very strong encryption but nevertheless there are no tools that
allow us to start decrypting that information, but not enough
is known about it at this moment in time. A lot more research
and development needs to be put into that particular area. I have
also seen further increases in security options available on the
handset itself by certain manufacturers. The facilities are there,
but I have not seen them being used in the main at this moment
in time although that could possibly change as time goes on.
Q157 Mr Malik: To what extent are
the problems you face created by the volume of data available
on, for example, calls made and received?
Mr Parmar: As far as the call
history data is concerned, that is usually not historic, that
is going to be pretty much current and it is going to be a small
amount. For example, normally you are looking at 10 missed calls,
10 received calls and possibly a maximum of 20 dialed calls that
can be obtained from a device. Is that data accurate? No, you
cannot rely on that information just from the device itself, it
has to be corroborated by a billing record to confirm that those
calls were successful.
Q158 Mr Malik: So the volume is not
a major issue is what you are saying.
Mr Parmar: No, it is relatively
short and it has been for a number of years.
Mr Smith: It is the interrogational
interpretation of it that takes the time.
Q159 Mr Malik: If there was twice
as much resource within the police service to deal with this issue,
would it be dealt with twice as quickly?
Mr Smith: I think the problem
is not chucking money at it. I do not think the problem is trying
to find 24 personnel. I think the issue is providing the right
skill sets and experiences they need to deal with it. The problem
is that there is a dichotomy between what the law enforcement
agencies are asking for and what they do through their training
centre of excellence which they have just started with mobile
telephone courses. How that would impact on them getting the job
done quicker we think would be negligible. It is the skill sets
that are missing and the experience, it is not the production
line bang it on, bang it out type of effect.
| 
