Cell Phone Tower Evidence is Junk Science

On May 28th, Lisa Marie Roberts, of Portland, Oregon, was released from prison after serving nine and a half years for a murder she didn’t commit. A key piece of overturned evidence was cell-phone records that allegedly put her at the scene.

Roberts pleaded guilty to manslaughter in 2004, after her court-appointed attorney persuaded her that she had no hope of acquittal. The state’s attorney had told him that phone records had put Roberts at the scene of the crime, and, to her lawyer, that was almost as damning as DNA. But he was wrong, as are many other attorneys, prosecutors, judges, and juries, who overestimate the precision of cell-phone location records. Rather than pinpoint a suspect’s whereabouts, cell-tower records can put someone within an area of several hundred square miles or, in a congested urban area, several square miles. Yet years of prosecutions and plea bargains have been based on a misunderstanding of how cell networks operate. No one knows how often this occurs, but each year police make more than a million requests for cell-phone records. “We think the whole paradigm is absolutely flawed at every level, and shouldn’t be used in the courtroom,” Michael Cherry, the C.E.O. of Cherry Biometrics, a consulting firm in Falls Church, Virginia, told me. “This whole thing is junk science, a farce.”

The paradigm is the assumption that, when you make a call on your cell phone, it automatically routes to the nearest cell tower, and that by capturing those records police can determine where you made a call—and thus where you were—at a particular time. That, he explained, is not how the system works.

When you hit “send” on your cell phone, a complicated series of events takes place that is governed by algorithms and proprietary software, not just by the location of the cell tower. First, your cell phone sends out a radio-frequency signal to the towers within a radius of up to roughly twenty miles—or fewer, in urban areas—depending on the topography and atmospheric conditions. A regional switching center detects the signal and determines whether to accept the call. There are hundreds of such regional centers across the country.

The switching center determines the destination of your call and connects to the land lines that will take it to cell towers near the destination. Almost simultaneously, the software “decides” which of half a dozen towers in your area you’ll connect with. The selection is determined by load-management software that incorporates dozens of factors, including signal strength, atmospheric conditions, and maintenance schedules. The system is so fluid that you could sit at your desk, make five successive cell calls and connect to five different towers. During a conversation, your signal could be switched from one tower to the next; you’ll also be “handed off” to another tower if you travel outside your coverage area while you’re speaking. Designed for business and not tracking, call-detail records provide the kind of information that helps cell companies manage their networks, not track phones.

If I make a cell call from Kenmore Square, in my home town of Boston, you might think that I’m connecting to a cell site a few hundred feet away. But, if I’m standing near Fenway Park during a Red Sox game, with thousands of fans making calls and sending texts, that tower may have reached its capacity. Hypothetically, the system might send me to the next site, which might also be at capacity or down for maintenance, or to the next site, or the next. The switching center may look for all sorts of factors, most of which are proprietary to the company’s software. The only thing that you can say with confidence is that I have connected to a cell site somewhere within a radius of roughly twenty miles.

Aaron Romano, a Connecticut lawyer who says that he has seen many cases involving cell records, has done a series of calculations to show how imprecise these locations can be. If you suppose that a cell tower has picked up a signal from ten miles away, you’re looking at a circle with a radius of ten miles, which has an area of three hundred and fourteen square miles. Cell-tower coverage is divided into sectors. Most towers have three directional antennae, each of which covers one third of the circle. Including that factor gives you a sector of 104.67 square miles. “That’s a huge area,” Romano said. “So how can anyone say, with any degree of certainty, that a handset was at the scene of the crime?”

Some technologies can locate you precisely. If you carry an iPhone, you’re also carrying a G.P.S. transmitter, which links to a ground station and then to several satellites, which can find your location to within fifty to a hundred feet. You enable the G.P.S. when you use certain software, such as Google Maps. Similarly, if you make an emergency 911 call, your company will use three towers to triangulate your location; if you’re using a smartphone, it will use G.P.S. to pinpoint where you are. If you’re the target of an ongoing investigation and law-enforcement agencies want to track you, they can ask a phone company to “ping” your phone in real time. (They also use that technique when trying to find a kidnapping victim.) Those methods are not what’s captured by phone-company cell-tower records of the sort that helped put Roberts in prison.

When investigating a crime that occurred in the past, police tend to have two options: seize the G.P.S. chip and download the locations, or obtain the cell records. Wednesday’s Supreme Court decision made it mandatory for police to obtain warrants before searching the cell phones of people they arrest. But the case law on getting cell-tower information is split. In most jurisdictions, police can obtain your call-detail records without a warrant. The disparity in requirements between the two could encourage police to rely increasingly on call-detail records, Hanni Fakhoury, a staff attorney for the Electronic Frontier Foundation, said.

Put another way, if I’m making a cell-phone call from my couch and someone commits a murder in a bar half a mile away, my cell records may serve as corroborating evidence that I took part in the crime. That might be true if I’d claimed to be in another state at the time, but those records cannot place me next to the body. What they don’t show is the precise location of a cell phone. Yet prosecutors often present those records as if they were DNA.

A few years ago, the F.B.I. established a unit specializing in cell records, called C.A.S.T. (Cellular Analysis and Surveillance Team), with the mission of analyzing cell-location evidence. The Bureau declined requests for an interview, but C.A.S.T. agents in recent cases have asserted a different theory of how cell networks operate. Testifying at a trial for murder and robbery in Florida in June, 2013, Special Agent David Magnuson said that the instant a call is received or placed, it’s the phone that decides which tower to go to—not the software that adjusts network load—and that, “ninety-nine per cent of the time, it’s the closest tower.” Although he conceded that cell records can be imprecise, he described them as “like a historical digital fingerprint.”

He added that the F.B.I. checks its information by doing periodic “drive tests,” in which it measures radio-frequency information emitted by cell towers to see if the coverage area agrees with its models. Independent experts I spoke to called this testimony into question—both the accuracy of the estimates and the validity of the drive tests. Conditions are so changeable that, even if a drive test confirms the model on a particular day, it may not on another, and certainly not on a day years in the past. It’s a probabilistic statement, not a scientific one.

In 2012, the U.S. District Court for the Northern District of Illinois ruled that an F.B.I. agent could not testify about the location of a defendant’s cell phone because the analyses did not rise to the level of trusted, replicable science. Other courts have found for the defendant after the defense attorney discredited the prosecution’s expert witness.

Lisa Marie Roberts’s original lawyer wasn’t one of them. There were reasons to suspect her: she had a tumultuous, sometimes violent relationship with the victim, Jerri Williams. Cell records showed that at 10:27 on the morning of the murder, Roberts’s phone connected to a tower within 3.4 miles of Kelley Point Park, where Williams’s body was discovered. Her attorney felt that was enough to convict her.

But she was making that call while driving a red pickup truck more than eight miles away, as confirmed by a witness. The system had simply routed her call through the tower near the park. It also emerged that new DNA evidence placed another suspect, a man, at the crime scene. And another piece of evidence helped: moments earlier, Roberts had received another call that came through a different site. The two towers were 1.3 miles apart. She could not have traveled that distance in the forty seconds between the calls. And so her cell records, in a sense, helped to save her.

Courtesy of the NEW YORKER

Posted by DOUGLAS STARR