Using Mobile Phone Data Records to Determine Criminal Activity Space
Presented by:
Peter Schmitz*
Logistics and Quantitative Methods, CSIR Built Environment PO Box 395,Pretoria,0001,South Africa
pschmitz@csir.co.za
Antony Cooper
Logistics and Quantitative Methods, CSIR Built Environment PO Box 395,Pretoria,0001,South Africa
acooper@csir.co.za
IQPC International GIS Crime Mapping Conference
Overview
• Activity space
• Proposed new method for examples 1 and 2
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records
Using Mobile Phone Data Records to Determine Criminal Activity Space
Mental Maps
•Paths – routes of travel that tend to dominate most people’s images of cities such freeways and railways.
•Edges – boundaries of lines that help to organise cognitive maps such as rivers, freeways and railways.
•Districts – subareas with recognisable unifying characteristics consisting of well established cores with fuzzy boundaries for example business districts or skid rows.
•Nodes – intense foci of activities such as intersections, shopping mall, corner shop, etc.
•Landmarks – symbols used for orientation but which typically are not physically entered such high buildings, trees, structures (i.e. water towers), etc.
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records
Using Mobile Phone Data Records to Determine Criminal Activity Space
Journey-to-Crime
•Crimes in most cases occur close to the offender’s anchor point.
•The number of crimes committed by an offender decreases with distance from his/her anchor point.
•Crime types dictate the distance from the anchor points: violent crime tends to be closer to anchor points than property crimes.
•High crime neighbourhoods influence the crime trip pattern.
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Data from cellular (mobile) telephones
•Call Data Records
•The recorded use by the service provider of the cellular
telephone when it receives and makes calls, (including SMS and MMS).
•Actively tracking the suspect
•The cellular telephone is actively tracked at predetermined time intervals such as every five or ten minutes.
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Call Data Records
Date Time No.Called No.Calling Call.Dir Call Dur CELL_ID TOWER_ID Site location Site suburb
15/12/2002 000235 2773228250x 2783765762x I 52 08393 839ATS Millpark
15/12/2002 000400 2783446106x 2773228250x O 33 08393 839ATS Millpark
15/12/2002 000444 2783765762x 2773228250x O 36 08393 839ATS Millpark
15/12/2002 000535 2783446106x 2773228250x O 43 02772 277Auckland Park Telkom Ex AUCKLAND PARK
15/12/2002 001032 2773228250x 2783765762x I 8 08392 839ATS Millpark
15/12/2002 001100 2783446106x 2773228250x O 21 08393 839ATS Millpark
15/12/2002 001931 2783347574x 2773228250x O 0 08393 839ATS Millpark
15/12/2002 001948 2773288063x 2773228250x O 17 08393 839ATS Millpark
15/12/2002 002949 2772392694x 2773228250x O 26 08393 839ATS Millpark
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Cell Network
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Base station
Offset point to indicate a cell
Thiessen polygon giving cell coverage Begin angle
End angle Azimuth
Wedge based on begin and end angle
MBR created around wedge
Centroid of MBR giving location of the cell used for linking Cell ID
Determining the x,y position of a cell used to locate a ping in an active track
Base station
Offset point to indicate a cell
Thiessen polygon giving cell coverage Begin angle
End angle Azimuth
Wedge based on begin and end angle
MBR created around wedge
Centroid of MBR giving location of the cell used for linking Cell ID
Determining the x,y position of a cell used to locate a ping in an active track
Determining the centroid of a cell
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Actively tracking a cellular telephone
SIM
ME BSC
BSC BTS
BTS
MSC
EIR AuC
VLR HLR
PSTN, ISDN,PSPDN,
CSPDN
SIM Subscriber Identity Module ME Mobile Equipment BTS Base Transceiver Station
BSC Base Station Controller HLR Home Location Register VTR Visitor Location Register
MSC Mobile services Switching Centre EIR Equipment Identity Register AuC Authentication Centre
Mobile Station
Base Station
Subsystem Network Subsystem SIM
ME BSC
BSC BTS
BTS
MSC
EIR AuC
VLR HLR
PSTN, ISDN,PSPDN,
CSPDN
SIM Subscriber Identity Module ME Mobile Equipment BTS Base Transceiver Station
BSC Base Station Controller HLR Home Location Register VTR Visitor Location Register
MSC Mobile services Switching Centre EIR Equipment Identity Register AuC Authentication Centre SIM Subscriber Identity Module
ME Mobile Equipment BTS Base Transceiver Station
BSC Base Station Controller HLR Home Location Register VTR Visitor Location Register
MSC Mobile services Switching Centre EIR Equipment Identity Register AuC Authentication Centre
Mobile Station
Base Station
Subsystem Network Subsystem
Send a blind SMS to the cellular telephone Cellular telephone
responds by giving the cell in which it is
located
The cell is then linked to the centroid, which gives the geographic location
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
C0001
C0006
C0015
Cell ID linked to nearest road Cell ID linked to nearest road
Interaction between cells linked to nearest road
Linking interaction between Cell ID C0001 and C0006 to the road network
C0001
C0006
C0015
Cell ID linked to nearest road Cell ID linked to nearest road
Interaction between cells linked to shortest road Linking interaction between Cell ID C0001 and C0006 to the
Linking centroids to road network to determine activity space
Use Flowmap to link the interaction to the road network.
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Call data records
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Activity spaces
Grey area: overlapping activity space
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Diurnal patterns
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Frequency of use
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Active tracking
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Land use/cover
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Diurnal pattern
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
First and last pings
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsPretoria
.
Location Sporting event
Δt
People traveling to and from an event
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
# #
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
# 22 May 2000 16:08 22 May 2000 17:19 22 May 2000 18:31 22 May 2000 18:38 22 May 2000 19:10 23 May 2000 14:14 23 May 2000 14:15 23 May 2000 17:44 23 May 2000 17:45 23 May 2000 21:06 23 May 2000 21:07
23 May 2000 07:27 23 May 2000 14:18
22 May 2000 23:14 23 May 2000 07:38
23 May 2000 14:23 23 May 2000 14:34 23 May 2000 15:05
23 May 2000 15:09 23 May 2000 15:09 23 May 2000 15:12 23 May 2000 15:16
24 May 2000 09:11 23 May 2000 08:37 23 May 2000 02:34
23 May 2000 02:33 23 May 2000 02:34
23 May 2000 00:42 23 May 2000 00:43 23 May 2000 00:59
23 May 2000 00:50
23 May 2000 02:10
22 May 2000 10:37
22 May 2000 09:51 22 May 2000 13:59 23 May 2000 10:18 23 May 2000 21:58
23 May 2000 10:20
23 May 2000 10:34
23 May 2000 12:22
Westfort
Atteridgeville
Magoto Prim School Iscor
Krugersdorp North
Krugersdorp Boltonia
Lewisham
Millsite Kagiso
Protea Exchange
Paul Hof
Diswilmar
Lanseria Airport
Noordheuwel
Georgina Krugersdorp Highway
Witpoortjie
Doornkop
Anchorville Lenasia
Fochville Exchange
Randfontein
Roodekrans 22 May 2000 11:36
22 May 2000 16:39 24 May 2000 09:59
23 May 2000 07:52 23 May 2000 16:11
24 May 2000 07:42
Burger se bewegings volgens selfoon oproepe gemaak en ontvang
#
#
#
##
#
#
#
#
#
#
#
#
#
#
#
#
1
2
3 4 8
9
5
6
7
1 0
11
1 2
13
14 1 5
16 17
Vaaldriehoek strate Witwatersrand strate Pretoria strate Bewegings volgens die dagboek
#Plekke soos aangedui
8 0 8 16 Kilometers
Johannesburg 09:30 22 May 2000
Johannesburg Hof 10:00 23 May 2000 Constantia Kliniek 13:30 23 May 2000
Vertrek na Pretoria vanaf huis 23:45 22 May 2000 Terug by huis 03:00 23 May 2000
Terug by huis 17:00 23 May 2000
Terug by huis 03:15 24 May 2000
Soweto Moord en Roof 07:00 23 May 2000
Soweto Moord en Roof 11:30 23 May 2000 Soweto Moord en Roof 15:30 23 May 2000 Soweto Moord en Roof 20:00 23 May 2000
Soweto Moord en Roof 07:00 22 May 2000
Soweto Moord en Roof 12:00 22 May 2000
Sebokeng (nuwe huise) 23:45 + 22/3 May 2000
Pretoria (Attridgeville SAPD) 23:45 + 22/3 May 2000 Pretoria (Attridgeville SAPD) 23:45 + 22/3 May 2000
MX Health 12:00 23 May 2000
Bewegings van Burger soos beskryf in sy dagboek
Map drawn by CSIR CSIR Copyright 11 O ctober 2001
47 km
91 km
21 km
22 km 22 km
16 km
59 km 44 km
52 km
Activity space as provided by the
suspect to the investigating officer
Using Mobile Phone Data Records to Determine Criminal Activity Space
Bilateral movement and GPS data
Truck route
Communications between the persons
Incident location Cellular base station
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsUsing Mobile Phone Data Records to Determine Criminal Activity Space
Bilateral movement and GPS: 3D view of communications
•
•
Proposed new method•
Example 1: Call data records•
Example 2: Active tracking of a suspect•
Example 3: Forensic mapping using call data recordsConclusions
• Using call data records (CDR) and/or active tracking data it is possible to determine the activity space of an
individual using cellular telephone data.
• The data alone are not sufficient and need to be
supported by local knowledge and gathered intelligence.
• SAPS indicates that it will drastically improve their
targeted intelligence gathering based on the analysis done using CDR and/or results from the active tracking of the handset of a suspect.
• The analysis offers the investigating team an effective
method to brief a new unacquainted investigating officer
who joined the investigation with regards to the suspect’s
activity space, anchor points and the suspect’s day/night
activity.
Conclusions
• SAPS mentioned that the active tracking of a suspect can help the investigators to establish a finer detail on specific movements than what the CDR can provide.
• They will use the results of the CDR analysis to guide active tracking exercises.
• It is strongly recommended that the above should not be used for prosecution purposes, but only for assisting in solving a criminal case.
• Forensic mapping of call data records can be used for
prosecution purposes
Slide 28 © CSIR 2006 www.csir.co.za
