Where you’ve been, who you’ve talked to, who you’ve been sleeping with – secrets that people wouldn’t even share with their closest friends are being spilled into a device that knows you better than any confidant.
Apple may have publicly denied that it’s tracking people via their iPhones, but the police and private forensic experts have no compunction about unlocking the secrets stored in smartphones.
Last year, the National Policing Improvement Agency placed mobile phone evidence in the top tier of training requirements for officers, teaching them how to secure evidence gleaned from handsets, with 3,500 officers a year expected to take the course.
The police and private forensic experts have no compunction about unlocking the secrets stored in smartphones
On top of in-house expertise, a huge number of handsets are sent to forensic specialists for analysis to discover where they’ve been and what they contain. “From what we see, 18 months or two years ago the proportion of smartphones we were seeing compared to PCs was very small,” said Phil Ridley, a mobile phone analyst with CCL-Forensics. “Now it’s well over half the devices that we see. We see both prosecution and defence – as well as private cases.”
Your smartphone could place you at the scene of a crime, destroy an alibi or maybe even provide one – which is why one of the first things police now do at the scene of a crime is take away a suspect’s mobile. “There’s so much in there,” said Ridley. “Pictures, notations, communications records, location information from cell records and Wi-Fi. You have navigation information in there from satnav software – the list goes on.”
Access all areas
With so much potentially incriminating evidence available to the police, you might think that there would be privacy protection in place to stop authorities probing your handset – but you’d be wrong.
According to legal experts, police have wide-ranging powers to search mobile phones providing they have a “reasonable suspicion” that a crime may have been committed. Once inside a handset, they could well stumble across other evidence, which could also be used in court.
“The baseline rule has to be that there is a reasonable suspicion that an offence has been committed for a phone to be inspected and to do an on-the-spot search,” said Tracey Stretton, legal consultant for data-recovery specialist Kroll Ontrack. “If you see a man after a car accident, you wouldn’t need a warrant because you could have a reasonable suspicion that a traffic offence had been committed.
“If you’re looking into one crime and find something else on the phone, then I guess the police would follow that line of inquiry. They wouldn’t stop to get a warrant because they now have suspicion of a further offence.”
No wonder the Police Central e-crime Unit dedicates significant space in its guidance notes on how to secure and retain data from mobiles, which is considered more difficult than PCs.
“The problem with telephone evidence is that it’s very volatile, and you need to act quickly, because if the battery goes flat you could lose information stored in the flash memory,” Stretton said.
According to analysts, the police are also instructed to take the SIMs out of phones upon seizure to ensure suspects can’t call the phone and remotely wipe data or delete incriminating images. The standard operating procedure is evolving, but if any information is stored in a handset it may be used as evidence against you.
Where in the world?
As the recent Apple tracking furore showed, smartphones routinely track their own whereabouts, and indeed report back to the mothership. But information collected by the handset is only one part of the picture – the authorities have several methods of finding where a handset has been.
“Location information is prime, for both the prosecution and the defence. If you can prove that someone was at a particular location that’s very important,” said Ridley. “If a handset has GPS, then the information stored on the device is more accurate than using cell tower information, which has been used for some time. A lot of people will use GPS, and that information also includes a time stamp, so you can say with a high degree of accuracy that at this time he was here.”
Older tracking methods involve triangulating data from the mobile masts that a phone has used for service. Analysing data about which masts were passed allows police to map a route history.
There’s a lot of collateral information on a device that we can use to build up a picture
Investigative company Forensic Mobile Services says it used this information to build a picture of a recent lorry and driver hijack, when a goods vehicle was stolen for its valuable cargo. “Police inquiries identified seven mobile telephones believed to have been associated with this offence and the investigating officers obtained the relevant call data records for each telephone,” the company said. “Mapping the movement of the subject phones by using the cells used, and producing a table listing chronologically all the calls made and received by the phones, helped secure the convictions.”
Given the wealth of information inside a phone, forensics can quickly build a case. “We’ve seen examples of this being used to help in prosecutions,” said Ridley. “An iPhone had been taken over to Spain, and we could see when the phone was switched on at the airport and where they went. You could argue that it was the handset and not the person, but why would you give your shiny new iPhone to someone else to go on holiday with?”
Using the phone’s history files, Ridley was able to build a picture of the suspect’s routine calls and activities that proved he was carrying the phone at the time.
“We can prove what’s called association, so you can look at the activity on the phone around that time, In the Spanish case we could see the phone was being used for calls and messaging while it was in Spain, and the numbers and messages were close friends and relations of that individual,” he said. “There’s a lot of collateral information on a device that we can use to build up a picture.”
The phone can not only locate where you have been but also what you were doing at the time, which is how the police can tell if a motorist was making a call at the time of a crash. “Time and date on the handset itself can be unreliable, because a user can set it to whatever they want,” said Ridley. “Having said that, if you were texting or making calls, because it passes through your mobile network operator, that is time-stamped by the network and their clocks are accurate. Certainly for court purposes, they’re considered true.”
Damning data
Where old-fashioned dumb phones had limited memory and function, the modern smartphone connects its owner to the internet, and although that brings many more features, it also means handset secrets are much harder to keep. Assuming you were able to wipe any incriminating data from your handset – no mean feat – the phone’s interaction with the servers at various service providers could still hand incriminating data to the authorities.
According to analysts, the tracking cookies dropped onto a handset by Google and other companies during search and browsing sessions routinely highlight sites visited. Even if you have cleared your history, the cookies could be used to build a picture of browsing habits on a handset. “How to build a nail bomb” sites, for example, could provide a lead in anti-terror investigations.
So much information leaks off the handset and onto third-party hardware that it’s almost impossible to lock down potentially incriminating data.
“If we’re talking smartphones, most would be synced to a central server,” said Robert Winter, chief engineer at Kroll Ontrack. “If you have deleted data on your mobile device, there should be a copy of a file or message on your sync server, whether that’s from your IT department if you’re a BlackBerry user, or you’re syncing an iPhone through iTunes, which should hold a backup of the actual data.”
Messages are routinely used as evidence that a suspect has organised a drugs drop or been involved in a conspiracy. Ripley’s company has also been involved in cases where either authorities or employers wanted to know when someone had been making VoIP calls.
We were contacted by police who couldn’t get a video to work on a handset – it turned out to be a bloke beheading someone in his garage
“We see VoIP apps as well, such as Skype,” he said. “Because it’s going over your data connection it isn’t shown on phone bills as a voicecall – it’s a bunch of data – so the only place that it’s ever going to be recorded is on the device itself.”
There are even data booby-traps hidden in the most innocuous functions of a handset, making it even harder to delete them because they aren’t stored in obvious folders.
“With an iPhone, when you rotate it, it flips the image around, and what the device is doing is effectively taking a screenshot of what’s on the screen at the moment you rotate the device,” said Ridley. “Even if you’re careful and you think you have deleted things, if you rotate that device there’s a picture on that phone somewhere. If you’re looking at your email messages and you rotate the phone, there’s a snapshot of that message.”
Caught on camera
While the police may rummage through messages to find evidence of a crime, the cameras on smartphones have led to people incriminating themselves. Location data and time-stamps are included in the Exif data accompanying a digital photo, providing evidence that a picture on a handset was taken at an exact time and location. It could be enough to prove a suspect was at the scene of a crime, or destroy an alibi.
“People take snaps on a phone and it could be the inside of a house, or a picture of a car, but because there’s all this data behind it, it can be used to say ‘you have been here’,” said Simon Steggles, director of forensics at Disklabs. “You have a lot of people who incriminate themselves by taking photographs of where they’ve buried drugs. The geotagging in the photo files taken on phones can give you a very specific geographical location, and if you go there and have an image it’s easier to find where you’ve stashed the drugs.”
You have a lot of people who incriminate themselves by taking photographs of where they’ve buried drugs
Smartphones have revealed horrific scenes with criminals, too, including sex offenders choosing to video themselves during an assault. “It isn’t just happy slapping, people video all sorts,” said Steggles. “We were contacted by police who couldn’t get a video to work on a handset – it turned out to be a bloke beheading someone in his garage.”
And it isn’t only the authorities that might have access to your phone’s dirty secrets. Forensics companies have to check that you’re the rightful owner of any handset that you want investigated, but they can then perform almost any search, whether it’s on an employee or a partner.
“We also get a lot of couples – and often it’s him or her thinking the other one is sleeping around – and they want to see the person’s deleted texts,” said Steggles. “The law says we can’t look unless they own the phone – we’ve been offered lots of money, but we don’t. A lot of PI companies out there might – look at the News of the World scandal.
“There was a guy who brought his wife’s phone down, and because he’d paid for the contract and handset and had proof, we were allowed to look. When he came back we had to tell him that his wife had been videoing herself being shagged by lots of different blokes and she’d stored it all on her phone.”
In short, if you want to keep a secret, "switch off your smartphone".
0 comments:
Post a Comment