Select Committee on Home Affairs Minutes of Evidence


Examination of Witnesses (Questions 145-159)

MR DAREN GREENER, MR VINESH PARMAR AND MR GREGORY SMITH

14 FEBRUARY 2006

  Q145 Chairman: Good morning. Thank you very much for joining us. As you know, we are carrying out an inquiry into the case for extended pre-charged detention. In the latter part of today's sessions we have looked at some of the technical arguments that the police have put forward for extending detention while they gain evidence that might be used in a charge. This session is going to look particularly at mobile phone technology in the broadest sense. I wonder if you could introduce yourselves very briefly for the record and then we will begin the questioning.

  Mr Smith: My name is Gregory Nigel Smith. I am Principal in the firm of Trew & Co. I have been involved with mobile telephone evidence for over 17 years, 13 years of which have been dealing with the current technology called GSM and three years with the new 3G technology. I run training courses for law enforcement agencies to educate them in this area of mobile telephone evidence. I conduct expert evidence in relation to mobile telephones and some other devices. I work for both the prosecution and the defence.

  Mr Parmar: I am Vinesh Parmar. I have been working with the forensic mobile team for approximately five years now, primarily with Thames Valley Police as a forensic analyst. I am now with a company called LGC doing the same type of role.

  Mr Greener: I am Daren Greener. I work for a company called Systems Technology Consultants. I have worked as an expert witness investigator on mobile phone evidence for the last four years. I present evidence on a range of issues, from mobile phone examinations, billing analysis and sub-site analysis predominantly in criminal cases in the UK.

  Q146  Mrs Cryer: I would like to ask you some questions about obtaining data from mobile phones. I wonder if you could describe for us the role played in charging suspects by information obtained from mobile phones rather than in building the final case. Do you expect this to change in the future? Would you like to see change in the future?

  Mr Parmar: It is definitely going to be case dependent or inquiry dependent as to what value the evidence would have, if any at all. There have been cases where it is the only evidence in terms of being able to charge a particular suspect and in other cases it has been a question of showing a particular pattern which leads on to the charging of a suspect.

  Mr Greener: I would agree that it is very much a crime dependent thing. A lot depends on the crime itself in relation, for example, to threatening behaviour and things like that. It may be the messaging and the content of text messages which are on there that is important. We may have videos and image sources that may relate directly to a crime that has been perpetrated.

  Q147  Mrs Cryer: Could you describe for us the causes of delay in obtaining and analysing information from mobile phones? Should it be determined that this be the main factor in determining the length of pre-charge detention? Could you suggest how long this pre-charging detention should be to accommodate this sort of inquiry?

  Mr Greener: Delays can be included from the start. The actual phone may not come to the analyst straightaway as it may be subject to DNA evidence or another type of evidence for drugs and things like that. When we finally get access to the phone there may be problems with the phone itself, ie it may be PIN locked. These obstacles need to be overcome. When we come to looking at the data and the phone, sometimes it is the case that the phone needs repairing or there is no charge in the phone. There is a wide variety of handsets available on the market today and we have to find the right charging equipment and things like that which is not always available. There are initial delays before we start analysing the data and then we come on to other issues that may be to do with the sheer volume of data on these phones nowadays that have very high capacity levels.

  Q148  Mrs Cryer: So there is a variety of reasons for the delays.

  Mr Greener: Yes.

  Q149  Mrs Cryer: And therefore you cannot suggest a period that would be needed to produce evidence prior to charging?

  Mr Greener: No. It is always done on a case-by-case basis.

  Q150  Chairman: Are we talking hours, days, weeks, months?

  Mr Smith: One cannot use one particular technical problem to hijack everything as I do not think that is correct. If you obtain a mobile telephone that has no PIN or PUK connected to it, there is no reason why you cannot turn the evidence round within seven days. People are concerned that if they have a mobile telephone that has been password protected three or four times and that causes delays then everyone should quote the worst case scenario but that is not the case. We are not dealing with the worst case scenario. If somebody picked up 20 or 30 mobile phones you may find one or two are problematical but the others would not be a problem at all.

  Q151  Mrs Cryer: So far as your experience is concerned, how useful is information obtained from a mobile phone handset without accessing the supporting data from the network providers? How long do you believe they take to provide the necessary information?

  Mr Smith: There are two sides. Whether the data on the handset has any substantive evidence in court largely depends upon how it relates to the crime. Quite often I have seen a judge saying, "I see an SMS text message here on the handset. Have you any substantive proof by way of a calling that it was sent?" and when we say we have not they kick it out and say they do not want it. The other side of the coin is that a lot of the work that they do with mobile telephones very rarely comes through into evidence, it is used for intelligence, which is a completely different matter and has got nothing to do with the detention of people.

  Mr Parmar: I would agree with those points. The actual data that is produced in a report format is pretty meaningless unless there is network data to corroborate subscriber checks and billing records and so forth. Without that the actual data is going to be meaningless.

  Mr Greener: One of the factors about a lot of the data contained within the phones is it is time stamped by an internal clock on the phone that is programmed by the end user of the phone and that is why we need to obtain the billing data, to confirm whether these events recorded within the phone are correct or not.

  Q152  Mrs Cryer: From the providers?

  Mr Greener: Yes.

  Q153  Chairman: How long does it normally take for network providers to provide the necessary information?

  Mr Parmar: It depends on the level of the crime. They have got to have five levels and they are graded one to five.

  Q154  Chairman: What about if it was a terrorist case?

  Mr Parmar: Level one is a threat to immediate life. So it really depends on whether the particular terrorist incident dictates that. If it is a level one incident then it is usually within two to three hours or, for the worst case scenario, it would be within 24 hours that the information would be available. That is not just obtaining data from the UK networks, that is also obtaining data from non-UK networks.

  Mr Smith: It is severity that produces those speeds.

  Chairman: Obviously we are asking you general technical questions but we are centred on terrorist investigations. I think it is reasonable to assume it is towards the upper end of that.

  Q155  Mr Malik: Are you detecting an increase in the encryption of data on mobile phones? Is that a trend that you are starting to see or not really?

  Mr Smith: No, I am not seeing any increase at all. It is probably not happening at all.

  Mr Parmar: I have had a few instances over the last few months where I have experienced encryption to do with external components associated with the handset in terms of memory cards. At the moment there is no solution.

  Q156  Mr Malik: Can you expand on the memory cards point?

  Mr Parmar: What we are seeing now is a change in technology, a trend towards additional storage capacities within the handset itself. What most manufacturers are doing is not only giving you an internal memory store but giving you an expandable memory store by way of a memory card, which is basically just a small chip which can vary in terms of capacity so far as memory is concerned. It is mainly used to store multi-media files in terms of pictures and videos, but I have seen cases where other data can be stored on there which is not detectable by the device itself. There is an element on some of these devices whereby you can password protect it. It is not a very strong encryption but nevertheless there are no tools that allow us to start decrypting that information, but not enough is known about it at this moment in time. A lot more research and development needs to be put into that particular area. I have also seen further increases in security options available on the handset itself by certain manufacturers. The facilities are there, but I have not seen them being used in the main at this moment in time although that could possibly change as time goes on.

  Q157  Mr Malik: To what extent are the problems you face created by the volume of data available on, for example, calls made and received?

  Mr Parmar: As far as the call history data is concerned, that is usually not historic, that is going to be pretty much current and it is going to be a small amount. For example, normally you are looking at 10 missed calls, 10 received calls and possibly a maximum of 20 dialed calls that can be obtained from a device. Is that data accurate? No, you cannot rely on that information just from the device itself, it has to be corroborated by a billing record to confirm that those calls were successful.

  Q158  Mr Malik: So the volume is not a major issue is what you are saying.

  Mr Parmar: No, it is relatively short and it has been for a number of years.

  Mr Smith: It is the interrogational interpretation of it that takes the time.

  Q159  Mr Malik: If there was twice as much resource within the police service to deal with this issue, would it be dealt with twice as quickly?

  Mr Smith: I think the problem is not chucking money at it. I do not think the problem is trying to find 24 personnel. I think the issue is providing the right skill sets and experiences they need to deal with it. The problem is that there is a dichotomy between what the law enforcement agencies are asking for and what they do through their training centre of excellence which they have just started with mobile telephone courses. How that would impact on them getting the job done quicker we think would be negligible. It is the skill sets that are missing and the experience, it is not the production line bang it on, bang it out type of effect.


 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2006
Prepared 3 July 2006