Mobile Forensics is the art of extracting information from mobile phones. In the third season of The Wire, David Simon’s critically acclaimed police procedural masterpiece, a core element of the plot concerns trying to monitor prepaid “burner” phones and successfully get the titular wire. They find themselves stymied by the combination of corporate and legal bureaucracy: By the time they successfully get a subpoena, even an ongoing one, the mobile phone company claims they can only get the customer data to them and get the wire activated within a few days to a few weeks, which obviates the point because the burner has been thrown away. It illustrates masterfully the difficulty of actually acquiring actionable forensics from mobile phones.
On their face, a mobile phone is a snoop’s wildest dream (Snider and Cross, 2008). Most people view cellular or mobile telephones as, in essence, just telephones. Someone can bug the line, sure, but it’s difficult to do so legally, and in any case all they can get is the time you made the call and what you said, right? But, in fact, mobile phones to perform their very basic functions, let alone to use all their modern bells and whistles, end up needing to give far more information. Even when just sending a text message or accessing the web, the cell phone typically has to be sending signals out to cellular towers which communicate the data across the network and back to the phone. To do this, the phone must be triangulated. That gives its present location. Most telephones store a bevy of information that is useful to the forensic investigator: Outgoing calls, incoming calls, recent text messages, browser surfing history, phone book, times calls were made, etc. All this is typically stored on the phone’s “sim card”, a small memory card. And most telephones are beginning to be installed with GPS, in order to aid cellular towers in finding the phone and sending a signal as well as to facilitate features such as Mapquest-style services. The modern cellular phone is basically a phone, computer, telegraph or fax machine, portable GPS device, and video game machine all in one.
The practical upshot is that a mobile phone recovered from a suspect contains an easily-mineable set of data. Most SIM cards aren’t encrypted: The algorithms on the phone would take too much space and time for fast reading. Other data on the cell phone might be encrypted specifically, but usually not. The phone can simply be read at one’s leisure like a book. Dates and times of contact, the names of other suspects or contacts of the suspect, and in the case of text messages even the content of communications can be recovered simply by acquiring a subpoena or recovering it through some other means. In particular, a cellular phone is a very tempting device for a drug dealer.
This is even before a wire is acquired. While the law is still forming around the issue, the 2001 PATRIOT Act makes it so cell phone records can be subpoenaed without a prior warrant. This means that a tap can be acquired relatively easily, and the cellular company cannot even inform the client about investigations or taps on their phone. Further, there is a reduced First and Fifth Amendment defense for the privacy of cellular conversations. This stems from a core legal concept called a “reasonable expectation of privacy” (LexisNexis, 2011; Romm, 2010). If a suspect dumps a couch onto a public area like the sidewalk and does nothing to conceal it, then it is legal to search the couch. If a suspect puts the evidence into a sealed trash can, however, then it is likely that a subpoena will be necessary barring exigent circumstances. This is because they had a reasonable expectation that people wouldn’t search their sealed trash can. A telephone conversation on a landline is considered to have a reasonable expectation of privacy: Suspects can argue that they expected that they would not be being observed in the privacy of their home. This is why it is illegal, even under very pro-law enforcement interpretations of the PATRIOT Act, to get a wiretap without a warrant. But a cellular phone does not have the same aegis of protection. Since cellular phones’ data goes out through the open air and the conversation could be happening in public, most cellular conversations and uses are considered to have a lower threshold of a reasonable expectation of privacy. GPS records are much harder to get due to the onerous nature of such monitoring, but just acquiring a tap on a mobile phone is quite easy.
Further, it is easy to acquire a phone during a search of a suspect. It is legal for a police officer to conduct a search for evidence. This means reasonable search and seizure, and therefore analysis, of the phone. Exigent circumstances also helps.
Of course, as the law evolves, so do criminals. The trend now and for some years has been pre-paid burners. The problem is that the pre-paid phones, while they have to keep the same data as any other phones, are much easier to buy anonymously or quasi-anonymously and in any case are typically thrown away afterwards. By the time that law enforcement can get a subpoena and a tap, the phone isn’t in use anymore and is usually practically unrecoverable. This will be the next challenge for mobile forensics.
Works Cited
LexisNexis (2011). Cell Phone Privacy. Lawyers.com. Web.
Romm, T. (2010). Federal court to hear cell phone tapping case. The Hill.
Snider and Cross (2008). Scene of the Cybercrime, 2nd Edition. Syngress: Burlington, MA.
Simon, D. (2002). The Wire [Television series]. Baltimore: Home Box Office Productions.