CELL PHONE SURVEILLANCE:

TACTICS, LITIGATION, AND NEXT STEPS

Nicole Valdes Hardin

NOTES

FDFCDC 51
Guide to Getting Started with a
Cell Phone Tracking Case

Nicole Hardin
Assistant Federal Public Defender
Middle District, Tampa, FL
For questions: nicolehardin@gmail.com
Nicole_hardin@fd.org

FDFCDC 52
 Table of Contents
Checklist for a cell phone case 3
Start the Analysis 4
Understanding the Technology 5-8
A. Introduction 5
B. Basic Explanation on How Cell Phones Work 5-6
C. Moving from Tower to Tower 6
D. How Cell Phone Triangulation Works – An Example 6-8
Individual “Ping” Evidence: The Most Common Evidence 9
Attacking the Technology – Exploiting Weaknesses of 10
Single “Ping” Evidence on Cross Examination

Getting Started on Your Cross Examination: An Overview 11-12

Appendix 12-24
A. Additional Materials Available by Request 13
B. Retention Periods of Cell Phone Carriers 13-14
C. Sample Motion to Compel Historical Cell Site Discovery 15-17
D. Helpful Articles for Getting Started 18-19

FDFCDC 53
 Checklist for a cell phone case
Make sure you have all this from the prosecution:
Call detail records for EVERY number the prosecution is using. These
should be coming from the cell phone company. You need the calls, the
times of calls and the duration. It is important to know it the
communication is a text, a voice call, or a “routed call”.

A print out from the cell phone company of ALL the cell phone tower
locations. This should include the tower ID number, as well as latitude and
longitude location information and as much information as you can get on what
sector of the tower the call used.
Any warrant, court order or subpoena that the police filed with the Court to
procure the cell phone records. This can be investigatory or emergency, etc.
The name and position of the person they intend to call as a witness to
introduce the cell phone evidence. It is important to know if they are calling
simply a custodian of records or an actual cell phone engineer. What each
of those people knows and can testify about the tracking are very different.

If your case is a “ping” case, you will need to know a lot more information
from the phone company. Make sure you ask if they have the records of the
surrounding towers at the time and whether the phone attempted to connect
with any of the surrounding towers (I have yet to see a company that still
has this data but ask – because if they do your job will be a LOT harder.)

Figure out how your clients was tracked – find out if it was by GPS,
triangulation or individual “pings”. If you get the run around on the “how”,
try to dig into the matter. Law enforcement may have used simulated
tracking – and you may have successful pre-trial motions available.

If it is a “ping” case you will want to get the estimated radius of each tower
threat your client “pinged” from – this is found through the cell phone
company’s internal propagation and software. It varies by company.

FDFCDC 54
Start at the beginning:
- Make sure you get a copy of the subpoena, court order or warrant that the
police used to get these records. If there is no court order find out why. Did
the police use exigent circumstances? Did they use Stingray?

- Find out if the records were used to track your client OR if the records were
used to try and figure out the client’s location in the past – example: the day
before (historical cell phone records.)

- Check if your state has any state-specific laws regarding the disclosure of
cell phone records. It is possible that the state may offer greater privacy
protections than the federal statute does. You may be able to challenge the
admissibility on other grounds under these types of statutes.

When challenging an improper pin or trace, be careful about arguing it

violates the Electronic Communications Privacy Act of 1986 (“ECPS”) rather than
the Fourth Amendment. A provision in Electronic Communications Privacy Act of
1986 specifically forbids exclusion and under federal law, suppression of evidence
is NOT a remedy for violations of the ECPA.

At a minimum, make sure that the court order application outlined “specific
and articulable facts.” This is the lowest standard allowed.
As you will see below, case law is unsettled at this point on many of these
issues. The Supreme Court has yet to rule, and seemed to rejoice in not dealing
with these concerns in their recent Jones decision on GPS tracking. That
decision noted that GPS tracking without actual physical intrusion may trigger
Fourth Amendment protections, but their holding turned on trespass and did
not reach the Fourth Amendment. Based on all the upheaval on the topic, it is
usually well worth a Motion to Suppress, particularly for certain cases. As for
historical cell site privacy, the U.S. Supreme Court will be ruling very soon, one
way or another, on the Carpenter case – which will decide the issue for once and
for all.

FDFCDC 55
UNDERSTANDING THE TECHNOLOGY
What typically gets clients in trouble is the fact that the cell phone companies
maintain call records for a lengthy period of time and to the second. These are the
billing records and it is how the cell phone companies make money – by tracking
and billing every second of cell phone use.
The only upshot to the unfortunate detailed recordkeeping is the fact that other
crucial location data that does not make them money is NOT kept. And here is why
that is important.

When your phone is on, every seven seconds or when you drop below a certain
threshold, the phone company is determining the nearest tower, so as to most
efficiently route calls. And for billing reasons, they track where the call is coming
from and how long it has lasted. The amount of data cell phone companies keep on
us is staggering. And they keep it for a very long time. But the data from every
seven seconds is what enables triangulation. And the information you need to
actually triangulate a location is not usually kept by cell phone companies. There is
no money in it.

The most accurate way to trace is GPS. The next is triangulation. Triangulation
involves the use of multiple “pings” from different towers. When you have three or
more towers with “ping” information, the location data becomes more accurate. If
you lack data from the multiple towers, the location is far less accurate.

HOW CELL PHONE TOWERS WORK

In theory, when you turn on your phone, it will search for the strongest signal and
connect to that tower. I say in theory because this is not always true – sometimes
other factors will change that basic assumption. But typically that is what happens
when your phone is turned on.

When you turn on your phone the mobile switch determines what cell will carry the
call and assigns a vacant radio channel within that cell to take the conversation. It
will select the cell tower to serve you by measuring signal strength and connecting
your mobile to the cell tower that has picked up the strongest signal.

FDFCDC 56
Moving from tower to tower
When you are driving down the road, you will be using multiple towers. When the
cell phone handset moves from tower to tower, it is called a handoff or handover.
Managing handoffs or handover is handled in a similar manner to when you turn
your cell phone on. The original station/tower handling your call sends a hand-off
request to the mobile switch after your signal drops below a certain threshold.
Although the thresholds will be similar, each cell phone company will have their
own threshold standard. The cell site makes several scans to confirm this and then
switches your call to the next cell. You may drive fifty miles, use 8 different cells
and never once realize that your call has been transferred. At least, that is the goal
of a cell phone company – seamless use for the phone user.
This is why you will see multiple towers being used in the duration of one call. It is
typically because the cell phone is on the move.

HOW CELL PHONE TRIANGULATION WORKS

Remember those Venn diagrams from school? You will need those for
triangulation. After GPS tracking, triangulation is the most accurate way of
locating a cell phone. It is not perfect – and 911 operators switched to GPS for this
reason. There are stories of trying to use triangulation to find people lost in the
mountains and ending up miles away.
Still, it is much more accurate than using only one tower. But usually in cell phone
cases, the prosecution and law enforcement are not able to triangulate. This is why
the evidence they actually use is far less accurate and much faultier. To understand
why the evidence from a single tower is not nearly as accurate, it is helpful to
understand why triangulation data is more accurate. The fact that the prosecution
lacks the more accurate tracking method is a fertile ground for cross examination.

The process is not that complicated. What you need for triangulation is the location
of the cell towers that can “see” the phone. ALL of them. And the more you have,
the more accurate it is. Three or more is the best. The tower with the strongest
signal is the one that the phone will utilize, but there are a number of other towers

FDFCDC 57
can also “see” the phone as it moves. So you take the data of the tower utilized and
the other towers that also “see” the phone.

EXAMPLE
First you locate the tower with the strongest signal and draw a circle that depicts
the coverage area for the tower. You will need to get the approximate radius of the
circle (cell tower footprint) from the cell phone company. It is usually from their
“propagation” tools and it will vary by company. Now let’s assume that the cell
phone is somewhere in that circle (this is not always true – there are reasons we
will talk about later where the phone may not be in that circle.) For this example
this tower radius will be Tower 1.

TOWER 1 =
Radius of 2 miles

Now locate a second tower that can “see” the phone and draw a circle showing its
coverage area. Now you can assume that the phone is located somewhere in the
intersection of the two circles.

TOWER 1 TOWER 2=
Cell
= Radius of Radius of 2
Phone
2 miles miles

FDFCDC 58
Continue to add circles for all the towers that can communicate with or “see” the
phone.

TOWER 3
= Radius of
2 miles

Cell
Phone
TOWER 1
= Radius of TOWER
2 miles 2= Radius
of 2 miles

The intersection of all the circles helps narrow down the actual location of the
phone. The more circles you have, the more accurate it is. This is still not a very
exact science but you can generally locate the phone within 100 meters or less.

TOWER 3

TOWER 1 Cell TOWER 2

Phone

TOWER 4

FDFCDC 59
INDIVIDUAL “PING” EVIDENCE
IF TRIANGULATION IS MORE ACCURATE, WHY DON’T THEY USE IT? I
ONLY HAVE ONE TOWER ON MY RECORDS?

In a typical cell phone case, law enforcement will be attempting to place the client
at or near a crime scene. The only data that law enforcement usually has will be the
data from the tower that the call was actually connected to when it was made. All
the other towers that “saw” the call at the time will seldom still be available. This
data is unavailable because it is rarely kept by the cell phone companies. And the
data from the every 7 second connections is also rarely maintained.

The exception is if they were using triangulation for live tracking and kept all he
records. Or if they used “Stingray” type technology for live tracking.
But the vast majority cases that I have seen and heard about will be a list of towers
where your client “pinged” when making a call. And that is good news. Attempting
to place people through individual “pings” is the most vulnerable way to do it. It is
the least accurate and will allow you the best tools in a cross examination. Because
the single “ping” technology is far less accurate, some attorneys have had luck
excluding the evidence through Daubert and Frye challenges. If you are in the
right state with the right Judge you may want to consider challenging it – for us the
Judge clearly thought it met the Frye test so we did not bother – we also did not
want to let the prosecution shore up their engineer by giving a preview of our
questions on the weaknesses of the science.

FIGHTING THE TECHNOLOGY – THE WEAKNESSES OF SINGLE

“PING” EVIDENCE

Most of this will be covered in the presentation. This should serve as a map for
getting to an effective cross examination.
When you are dealing with a cell phone witness, start with the type of witness.
Some prosecutions have simply called a custodian of records to introduce the cell
tower information and radius. These custodians will often try to talk about how
9

FDFCDC 60
your client was in the radius of the tower (otherwise known as the cell tower
footprint.) If you find out that the other side is calling only a custodian of records,
file motions to curtail their testimony. A normal custodian of record is not usually
qualified to testify about the engineering of the network. The witness should be
able to explain the evidence and the limits of the evidence. For example, the towers
and their footprints (radiuses) are designed to be fluid. Meaning they can change –
contract to be smaller at times. A custodian of record is unlikely to know that type
of information and will instead flatly say that your client was in that circle and that
means he or she was within this many miles of the tower. But it will be unlikely
that they can explain why that is – or isn’t. They will be testifying way above their
heads. And in my opinion, the testimony will be well outside the scope of a
custodian of records.
The other type of witness they will call is a network engineer. Unlike the custodian
of record, this individual will be qualified to talk about the evidence. And the
prosecution will call this evidence irrefutable. It’s not. For what you can expect
from a prosecution side network engineer, check the appendix. It contains the
power point presentation that the network engineer used in our homicide trial, and
it will be along the lines of what you can expect.

An honest network engineer will admit to the limitations of this evidence - but only
if you make them. On direct examination on our trial, the network engineer made it
sound like my client was within 2.3-2.5 mile radius at exact times the night of the
murder. It was only on cross examination that he revealed the weaknesses in his
presentation.

An Overview of weaknesses to be sure you address in cross examination – this

is NOT a complete list, but a good place to start:

• This is NOT an exact science right? (they should admit to that)

• GPS is far more accurate
• Triangulation is more accurate
• Loss of the triangulation data - The network switch communicated with
multiple (hopefully more than three) towers when connecting these cell
phone calls.
o Where is it?

10

FDFCDC 61
 o Can it be retrieved?
o Why not? Might have it been favorable to my case?
o Would have been MUCH more accurate?
• Questions within the network – usually they don’t know this anymore,
especially if it is first asked at trial. All of these can affect which tower
handles a call – irrespective of if you are in the radius or footprint of the
tower o Ask about weather conditions?
 Thunderstorms?
 Lightning strikes? Etc.
 Were any towers affected?
o Ask about any nearby tower repairs – this affects which towers pick
up calls
o Ask about network repairs and maintenance
• Questions on call volume – this also affects which towers might have picked
up the call
• Type of phone – this is more remote but can sometimes effect
communication – bandwidth, generation of phone, etc.
• There is a LOT of questions you can ask about the tower the phone used. For
a cell phone handset to communicate with a cell tower depends on a
multitude of factors, completely independent from distance and signal
strength.
o Performance of towers

o Call volume at time

o How well it had been maintained and serviced o Height of tower o

Number of cones, type
o And so on – this can be extensive. It all adds up to letting the jury
know this science is far from exact and accurate

11

FDFCDC 62
APPENDIX

12

FDFCDC 63
APPENDIX A
Probably the best getting started materials are the two depositions I did of the
prosecution’s cell phone engineer. We found out the name of the person the day of
jury selection and I had about 36 hours to get ready for the deposition. So it is a
pretty good guide of me asking very basic questions about the technology – and
him explaining how they use the technology. Other materials include the original
power point used by the cell phone engineer in trial.

I could not include them with these materials because they exceed the page limit,
but I am happy to email them to anyone that needs them. Let me know. I can be
reached at Nicole_hardin@fd.org or nicolehardin@gmail.com.

APPENDIX B
Part of the fun is that every phone company has a different retention period for
records. Below is updated from April 2017 and includes subscriber information
(name, address, DOB etc); call history (numbers dialed and numbers of incoming
calls); the location of towers used in the call history; and text message content
when they are sent as SMS (will not include imessages)

Verizon Wireless

Subscriber Information: 7-10 years

Call History: 7 years

Tower Locations as they related to Call History: 1 rolling calendar year

SMS Content: 3-5 days (unofficially it may be as much as 7-10 days)

AT&T

Subscriber Information: 7 Years

Call History: 7 years

Tower Locations as they related to Call History: 7 years

13

FDFCDC 64
SMS Content: Not Available

Sprint

Subscriber Information: 10 years

Call History: 18 months. Bill reprint form 7-10 years, pre-pay accounts only 18 months
regardless.

Tower Locations as they related to Call History: 18 months

SMS Content: Not Available

T-Mobile

Subscriber Information: 3-5 years. Canceled accounts are purged after account closes.

Call History: 23 months

Tower Locations as they related to Call History: 23 months

SMS Content: Not Available

U.S. Cellular

Subscriber Information: up to 7 years

Call History: 1 rolling calendar year. Bill reprint: 7 years.

Tower Locations as they related to Call History: 1 rolling calendar year

SMS Content: 3-5 days

Source: ProDigital Forensic Consulting

14

FDFCDC 65
APPENDIX C – Sample Motions to Compel

IN THE CIRCUIT COURT OF THE FIFTH

JUDICIAL CIRCUIT IN AND FOR
MARION COUNTY, FLORIDA

STATE OF FLORIDA, CASE NO.: XXXXXXX

vs.

XXXXXXXXXXXXX,
Defendant.
/

MOTION TO COMPEL CELL PHONE RECORD DISCOVERY

COME NOW the Defendant, by and through his undersigned counsel, pursuant to Florida
Rules of Criminal Procedure, Rule 3.220(b)(1)(J), the Fifth, Sixth, Eighth, and Fourteenth
Amendments to the United States Constitution (right to due process of law, right to a fair trial,
right to effective assistance of counsel, right to confront witnesses), Article I, Sections Two,
Nine, Sixteen and Twenty-two of the Florida Constitution, and respectfully moves this
Honorable Court for entry of an Order directing the State to provide the Defense with copies of
certain relevant written protocols, materials, documents, maps, and electronic data regarding cell
phone tracking by law enforcement. These items are requested to assist counsel in evaluating the
efficacy of all cell phone tracking by law enforcement conducted in this cause, and as grounds
would state:

1. On March 12, 2013, the Marion County Sheriff Office responded to a homicide in Ocala,
Florida. Later that day, law enforcement arrested XXXX for the crime.
2. On March 19, 2013, Detective Whiteside filed for a court order and search warrants for
cell phone records and text messages associated with the phone number XXX-
XXXXXXX.
3. Defense counsel is in receipt of these records.

15

FDFCDC 66
4. The records provided in discovery list for each phone call: a date, time, duration, dialed
number, destination number, status, feature, caller ID, as well as switch, sector, tower for
beginning and ending cells.
5. To date the State Attorney’s Office has only listed two business record custodian
witnesses to testify about cell phone location data.
6. The records contain insufficient information for counsel or her expert, if retained, to
analyze and rebut the assumptions of locations from the cell phone records.
7. Defense counsel does not have independent access to this material.
8. Defense counsel cannot render effective assistance of counsel for the Defendant without
examining the following witnesses and records from the cell phone company. In order to
render effective representation, Defense requests:
i. The names of any and all cell phone engineer witnesses the State Attorney
intends to call at trial to testify about any location information containing the
number 352-426-1237.
ii. The names of any and all cell phone company employees the State Attorney
intends to call at trial to testify about any location information containing the
number 352-426-1237.
iii. The names of any and all law enforcement witnesses the State Attorney
intends to call at trial to testify about any location information containing the
number 352-426-1237.
iv. Call detail records for 352-426-1237, dated 3/10/2013 to 3/13/2013, noting
whether each communication is a text, a voice call, or a routed call.
v. Any records or policies on how routed calls are handled through towers. vi.
Any records from the surrounding cell towers for each cell phone call the
State intends to introduce at trial, including the number and volume of calls
and the types of calls.
vii. Any records from all the nearby cell towers for each cell phone call the State
intends to introduce at trial that the cell phone 352-426-1237 communicated
with or attempted to communicate with before or during any voice call.
viii. Any records or data that supports location analysis by “triangulation”, or
global positioning service (GPS).

16

FDFCDC 67
 ix. The radius/cell tower footprint for every tower contained within the phone
records of 352-426-1237 dated 3/10/2013-3/13/2013.
9. The materials requested should be contained in the cell phone company’s possession.
10. Should the defense retain a cell phone expert in this case, that expert cannot assist
counsel without the items requested above to determine whether the cell phone record
data contains reliable location information.
11. Counsel cannot effectively represent the Defendant without this evidence and would be
unable to investigate and challenge this evidence denying the defendant right to due
process of law, the right to a fair trial, the right to present a full and fair defense, the right
to effective assistance of counsel and the right to confront witnesses and evidence against
him.
12. Defense counsel certifies that this request is being made in good faith.

WHEREFORE the Defendant respectfully requests entry of an order requiring the State
to produce the material requested above within 10 working days.

Respectfully submitted this __________ day of March, 201X.

CERTIFICATE OF SERVICE
I HEREBY CERTIFY that a copy of the foregoing Motion to Compel Cell Phone Record
Discovery has been furnished to the Office of the State Attorney, 110 NW 1st Avenue, Suite
5000, Ocala, FL 34475, by hand and/or mail delivery this ____ day of March, 201X.

Office of Michael Graves

Public Defender
Fifth Judicial Circuit

_____________________________
NICOLE VALDES HARDIN
Assistant Public Defender
Florida Bar No. 0026194
204 NW 3rd Avenue
Ocala, FL 34475

17

FDFCDC 68
APPENDIX D – Helpful Articles/Websites for
Getting Started
Good Explanations of how cell phone tracking works
Cellular Telephone Basics
http://www.privateline.com/mt_cellbasics/

Cell Tower Triangulation – How it Works

http://wrongfulconvictionsblog.org/2012/06/01/cell-tower-triangulation-how-
itworks/

Cell phone tracking, historical

“Wireless Firms Are Flooded by Requests to Aid Surveillance” by Eric Lichtblau,
in The New York Times.
http://www.nytimes.com/2012/07/09/us/cell-carriers-see-uptick-in-requests-to-
http://www.slate.com/blogs/future_tense/2013/02/15/stingray_imsi_catcher_fbi_fil
es_unlock_history_behind_cellphone_tracking.html

“Can Police Track You Through Your Cellphone Without a Warrant?” by Nina
Totenberg, NPR, November 28, 1017.
https://www.npr.org/2017/11/28/564713772/can-police-track-you-through-your-
cellphone-without-a-warrant

Stingray Use

Street Level Surveillance, Electronic Frontier Foundation – available at

https://www.eff.org/pages/cell-site-simulatorsimsi-catchers

“Does cellphone-sweeping "StingRay" technology go too far?” by CrimeSider

Staff, CBS News, November 27, 2017.

18

FDFCDC 69
https://www.google.com/amp/s/www.cbsnews.com/amp/news/does-cellphone-sweeping-
stingray-technology-go-too-far/

Department of Justice Policy Guidance: Use of Cell-Site Simulator Technology,

available at https://www.justice.gov/opa/file/767321/download

19

FDFCDC 70
How Police Use Stingray in Everyday Police Work
The next fourteen pages are an excerpt of the testimony of an officer in Tallahassee
on the deployment of a Stingray device. It offers a rare glimpse into police practice
with the devices, often kept secret.

“In the early morning hours of September 13, 2008, a woman notified the Tallahassee Police
Department (TPD) that she had been raped and that her purse, containing her mobile phone, had
been stolen. Within 24 hours, the Florida capital’s police had contacted Verizon and obtained
real-time ping information, which gave the police a “general area” where they might find the
phone and thus, hopefully, the perpetrator of the crime. But that general area still covered plenty
of ground—where exactly was the phone?

To answer that question, the cops deployed a secretive device called a stingray, which operates
as a fake cell phone tower used to track targeted phones. Though law enforcement typically
fights attempts to learn how stingrays work or how often they are used, a court victory by the
American Civil Liberties Union (ACLU) has unsealed Tallahassee police testimony of exactly
how the 2008 cell phone hunt happened.

This newly released transcript provides what is likely the first-ever verbatim account of how
stingrays are used in actual police operations. And it shows that stingrays are so accurate, they
can pinpoint the very room in which a phone is located.”

- Excerpt from “How Florida cops went door to door with fake cell device to find one
man,” by Cyrus Farivar – available at https://arstechnica.com/tech-policy/2014/06/how-
florida-cops-went-door-to-door-with-fake-cell-device-to-find-one-man/

FDFCDC 71
 11

1 A Yes, I did.
2 Q All right. And if you would, tell the cour~ how it
3 is you go about trying to track the location of the cellphone
4 in this case.
5 A okay. It varies by case. But specifically for this
6 incident we made contact with the provider, who was verizon
7 wireless. They were able to provide us with the tower, the
8 cellphone tower or cell site for which that handset is
9 currently registered and communicating with. In addition,
10 they are able to provide us with a distance from that tower,
11 an approximate distance. But we're able to use that to define
12 a general area that that handset will be located.
13 From that point, we will take equipment that is meant to
14 intercept the radio signals emanating from that device and
15 provide us some direction finding capabilities and allow us to
16 basically walk to the device, to the handset.
17 Q okay. so if I understand you correctly, you're
18 indicating that you find out, you knew who the provider was
19 verizon?
20 A Yes.
21 Q Yo~ contact verizon. And did they give you some
22 information as to whether or not that cellphone is using any
23 towers in the area?
24 A correct.
25 Q All right. And when you said an approximate

180
FDFCDC
TERESA SELVA, OFFICIAL 72
DIGITAL REPORTER
 12

1 distance from the tower, is that information that you got from
2 verizon that -- that would indicate how far away from the
3 tower the actual cellphone was being used?
4 A That's correct.
5 Q okay. And when we say used, does that mean somebody
6 is actually using it, or does it just need to be on?
7 A It varies by provider. But, for this case, the
8 handset merely needed to be on and registered and they were
9 able to determine that distance.
10 Q okay. And then I think you've indicated that you
11 have some sort of device that you use that can intercept radio
12 signals?
13 A That's correct.
14 Q okay. How does that work?
15 A In essence, we emulate a cellphone tower. so just
16 as the phone was registered with the real verizon tower, we
17 emulate a tower; we force that handset to register with us.
18 we identify that we have the correct handset and then we're
19 able to, by just merely direction finding on the signal
20 emanating from that handset --we're able to determine a
21 location.
22 Q okay. And what kind of training were you provided
23 in the use of this equipment?
24 A The manufacturer of the equipment provides
25 approximately a six-day training program. In addition to that

181
FDFCDC
TERESA SELVA, OFFICIAL 73
DIGITAL REPORTER
 13

1 I attended numerous classes on the use of cell phones and

2 various communications, communication items for locating
3 persons.
4 Q okay. And are there any quality assurance things
5 that are in place? I mean how do you know the equipment is
6 working properly when you're using it?
7 A well, it's Very difficult to say quality assurance.
8 The in hundreds of uses the equipment has proven completely
9 reliable. The equipment will basically decode information
10 from the handset and provide certain unique identifying
11 information about the handset, being a subscriber identity and
12 equipment identity.
13 The equipment provides that to us. we compare that with
14 the information provided from verizon to insure that we are
15 looking at the correct handset. once we know that that
16 information is correct, then the location of that becomes
17 simply a matter of detecting where the signal is the
18 strongest. And it's a matter of getting closer and closer.
19 Q And when you say the handset you're referring to the
20 cellphone that you're attempting to locate through the use of
21 basically forcing that cellphone to come to your equipment
22 rather than going to a tower that it normally would?
23 A That is correct.
24 Q And is that -- what information do you put into your
25 equipment that will lead that signal to be transferred to your

182
FDFCDC
TERESA SELVA, OFFICIAL 74
DIGITAL REPORTER
 14

1 equipment, versus going to the tower?

2 A well, the equipment-- or the information that we
3 would put in would be that unique subscriber identity and
4 unique equipment identity, a serial number and a subscriber
5 identity
6 Q of the cellphone you're looking for?
7 A of the cellphone we're looking for, which would be
8 the victim's cellphone. we put that information into the
9 equipment. And as the equipment is evaluating all the
10 handsets in the area, when it comes across that handset -- the
11 one that we're looking for, for the information that we put
12 into the box -- then it will hang onto that one and allow us
13 to direction find at that point.
14 Q And is that subscriber information and that serial
15 number unique to the telephone that you're actually trying to
16 find or track?
17 A In the case of a verizon phone, the serial number is
18 unique to the physical handset. The subscriber identity is
19 unique to that handset, so long as that handset is registered
20 to the account. The subscriber identity can be changed;
21 that's how werre able to port our phone numbers. You can go
22 from one carrier to the next.
23 so that number can change over time. The serial number
24 is always unique to that specific handset.
25 Q Okay. And you had information that you had

FDFCDC
TERESA SELVA, OFFICIAL 75
DIGITAL REPORTER 183
 15

1 information that linked the serial number that you diverted to

2 your equipment actually belonged to the victim in this case.
3 Is that correct?
4 A That is correct.
5 Q All right. okay so what were the results of your
6 attempts to track this phone?
7 A we were, after some time based upon the environment
8 there -- we were able to locate the phone, or to actually
9 capture the phone to begin with and then a relatively lengthy
10 process of determining exactly where that signal was emanating
11 from.
12 using portable equipment we were able to actually
13 basically stand at every door and every window in that complex
14 and determine, with relative certainty you know, the
15 particular area of the apartment that that handset was
16 emanating from.
17 Q okay. Now you started off by saying based on the
18 environment. what do you mean by that?
19 A Just the apartment complex.
20 Q okay.
21 A Being multi-story, with the way it's configured.
22 Q Okay. so and then you used the phrase you captured
23 the phone. That means that after putting that information
24 into your equipment you were able to direct the signal from
25 the .tower to your equipment?

FDFCDC
TERESA SELVA, OFFICIAL 76
DIGITAL REPORTER 184
 16

1 A That is correct.
2 Q And that being the phone -- that was the serial
3 number that belonged to the handset of the victim in this
4 case. Is that correct?
5 A That is correct.
6 Q All right. And you said it was a lengthy process.
7 Did that mean finding the apartment complex in general, or
8 finding the actual location at the apartment complex?
9 A Really finding the complex was the difficult part,
10 just that signal, getting it to emanate outside of the
11 apartment complex. we actually worked during the day and it
12 was actually later into the evening when there was less
13 interference around, less other traffic around that our
14 equipment was able to detect the handset. once we were able
15 to detect it and get close to it, then it beEame very simple
16 at that point.
17 Q okay. And what, if any, time constraints are there?
18 when you're in this case you're talking about verizon and as
19 long as the phone is on, you're able to utilize the technique.
20 correct?
21 A Correct.
22 Q Are there time restraints on how effective this is
23 going to be or before you might lose your potential to find
24 this evidence?
25 A certainly. In the case of a victim phone, victim

185
FDFCDC
TERESA SELVA, OFFICIAL 77
DIGITAL REPORTER
 17

1 handset being taken, there is not an apparent ability to

2 charge the handset so the battery going dead for us is always
3 a concern. Additionally, once the equipment comes into play
4 and we capture that handset, to make locating it easier ; the
5 equipment forces that handset to transmit at full power.
6 Again~ that's why I say once we capture it, it becomes
7 .much easier to specifically locat~.

8 so we're forcing that handset to transmit at full signal,

9 consuming battery faster, in an effort to help us locate that
10 handset. so it going dead would - - that battery dying would
11 essentially end our ability to locate it.
12 Q okay. And you mentioned earlier that you were able
13 to eventually locate or track the signal from this cel l phone
14 to an apartment complex. Is that correct?
15 A That is correct.
16 Q And what was the name of the apartment complex?
17 A 2060 Continental, Berkshire Manner, if I recall
18 correctly.
19 Q All right. And what exactly did you do to narrow it
20 down, once you got to the apartment complex?
21 A Again, using portable equipment, quite literally
22 stood in front of every door and window measuring, determining
23 that direction of where that signal was emanating from and
24 contacting investigators, and advised them that we had an
25 apartment.
186
FDFCDC
TERESA SELVA, OFFICIAL 78
DIGITAL REPORTER
 18

1 Q okay. And what apartment was that?

2 A I don't recall the specific number (inaudible)
3 recall the specific door number, Apartment number.
4 Q okay. once you located the apartment then, did you
5 let the other investigators take over?
6 A Yes, I did. I pointed out the specific apartment
7 that I identified to them as they arrived and remained close
8 by as they continued the investigation.
9 Q Do you have a recollection or do you have anything
10 in your notes that would indicate what time it was when you
11 located the apartment that you believe the cellphone would be
12 in, based on your tracking of it?
13 A when we first identified the apartment it was
14 probably approximately 1:00 to 2:00 a.m. I'm not sure if I

15 have anything in my notes specifically, to that. I know that

16 we returned to the area sometime around midnight and located
17 it shortly thereafter.
18 Q Do you have any idea how much time elapsed between
19 the time of the sexual assault in this case and the time you
20 tracked the phone to the apartment complex?
21 A If I recall, the sexual battery occurred early,
22 early Saturday morning -- you know, late, late Friday night
23 into Saturday morning. And it was now early sunday morning
24 when we had actually located a handset.
25 Q okay. was time becomino of the essence to you

187
FDFCDC
TERESA SELVA, OFFICIAL 79
DIGITAL REPORTER
 19

1 all
2 A Yes.
3 Q - - based on what you have already testified to about
4 not having the ability to necessarily recharge the phone or
5 know someone was recharging it - -
6 A Absolutely.
7 Q -- and the drain of power that would be on the phone
8 based on your directing, I guess, it to your equipment?
9 A That's correct.
10 Q And you did not actually enter the residence; is
11 that torrect? I think you said the other investigators took
12 over at that point. Is that correct?
13 A That is correct.
14 Q And was it your belief, based on your training and
15 experience as both an officer and that equipment, that you
16 believed the property of the victim of that sexual assault to
17 be at the residence where you tracked that cellphone to?
18 A That is correct.
19 MS. RAY: I have nothing further.
20 THE COURT: Cross?
21 MR. SHIPPY: Yes, Your Honor. Thank you.
22 CROSS-EXAMINATION
23 BY MR. SHIPPY:
24 Q Good afternoon, sir.
25 A Good afternoon.

FDFCDC
TERESA SELVA, OFFICIAL 80
DIGITAL REPORTER 188
 20

1 Q I may have missed it, but how long have you been
2 with the Tallahassee Police Department Technical operations
3 unit?
4 A The Technical Operations unit, a little over five
5 years. I've been with the police department since '95.
6 Q Is it a requirement in order for the equipment, that
7 apparently TPD has purchased, to track a cellphone that the
8 cellphone be turned on?
9 A The cellphone does have to be powered on for us to
10 be able to actively locate the handset. And it's not -- the
11 Tallahassee Police Department is not the owner of the
12 equipment.
13 Q And it's a technical question, but bear with me.
14 when we say turned on, that means the battery still may
15 be full, but if I turn the phone off then the equipment that
16 you're utilizing doesn't work. Is that correct?
17 A That is correct.
18 Q And as long as the cellphone is turned on and as
19 long as there is power where the battery has power, I guess
20 then you're able to track the cellphone?
21 A Generally speaking, yes. As long as the handset is
22 on, then you know we have the ability to attempt to track it.
23 Q And for how long has the Tallahassee Police
24 Department been utilizing this equipment?
25 A If I recall, it was March. Spring of '07 is when we

TERESA SELVA, OFFICIAL DIGITAL REPORTER 189

FDFCDC 81
 21

1 first started utilizing the equipment, if I remember properly .

2 Q Are you the person within the Department who
3 primarily utilizes the equipment?
4 A Yes, I am.
5 Q In your estimation, since the spring of 2007, how
6 many times have you utilized the equipment to locate a
7 particular cellphone?
8 A Probably, I could answer specifically. But off the
9 top of my head, probably in the 200 or more times.
10 Q And in those 200 or more times, what have you found
11 to be the level of reliability as to the accuracy of the
12 equipment?
13 A Truthfully at this point, 100 percent.
14 Q Does the equipment undergo any sort of maintenance
15 or anything of that nature, similar to what we're -- similar
16 to what we experience in the DUI machines?
17 A There is not maintenance, per se. The equipment is
18 under a maintenance contract. The software is periodically
19 updated. The equipment performs self calibration, but there
20 is not a specific maintenance schedule for it.
21 Q would it be -- if this is a good way to phrase it
22 similar to if my car is running okay, it's continuing to run
23 okay?
24 A Yes, for the most it's -- you know, it works or it
25 doesn't. And as long as everything is functioning properly

TERESA SELVA, OFFICIAL DIGITAL REPORTER 190

FDFCDC 82
 22

1 all the process that goes on insures the reliability.

2 Q And the proprietary nature of the equipment is that
3 it allows you to stand in the place of the service provider.
4 Is that correct?
5 A That's correct.
6 Q In this instance you picked up the signal from the
7 cellphone. That is correct?
8 A Yes.
9 Q when you initially do that, are you doing that from
10 the Tallahassee Police Department or some other location?
11 A No. we have to be within close proximity of the
12 handset to capture it.
13 Q That's where verizon then first comes in, that
14 they're providing you some information as to what tower it's
15 close to?
16 A That is correct.
17 Q Then you go to some general vicinity/location,
18 operate your equipment, and then that's when you then hone
19 your location?
20 A That is correct.
21 Q And in this instance, although you weren't able to
22 recall the apartment number, if I was to tell you that it was
.23 Apartment 251 at Berkshire Manor Apartments, would you agree
24 with that?
25 A I would. I actually have it written down on a note .

TERESA SELVA, OFFICIAL DIGITAL REPORTER 191

FDFCDC 83
 23

1 Yes, 251.
2 Q All right. And how much time in your memory elapses
3 from when you get to ·the general vicinity, to the point where
4 you have actually located a specific apartment? what's your
5 best case estimate in this case?
6 A In this case, we actually -- I actually worked
7 several hours ta attempt to capture the phone, initially; so
8 from the time that -- the time that we actually captured the
9 handset the first time, then I know that I'm relatively close
10 to it. That was from a vehicle-based system.
11 At that point, then we know that we're close. we use the
12 vehicle-based system to help give us an area of the apartment
13 complex. And at that point we switch over to a hand held
14 device. With a hand held device it took really approximately
15 -- I would say really no more than 20 to 25 minutes, maybe 30
16 minutes to confidently determine the apartment. And we
17 continue to, you know -- continually check that and measure
18 that and continue to confirm that. But from the initial
19 determination, probably 25 to 30 minutes.
20 Q And if I understood your testimony on direct
21 examination, your best estimate is that may have been
22 somewhere in the neighborhood of 1:00 to 2:00 in the morning,
23 on that sunday morning?
24 A I as I recall, yes. I basis that again on having
25 gone home for a little bit and coming back out as I recall,

192
TERESA SELVA, OFFICIAL DIGITAL
FDFCDC 84 REPORTER
 24

1 shortly after midnight and then working from that point.

2 Q And at that point in time, do you pass it on to the
3 primary investigating officer in the case?
4 A Yes.
5 Q would you pass that information on, to Investigator
6 wester?
7 A He was present; Investigator Suleski was present.
8 several ended up responding to the scene at that point. I

9 believe that sergeant Adams was present as well, and that

10 information was provided to numerous people.
11 Q were you present when contact was made with the
12 occupants of Apartment 251 at Berkshire Manor Apartments?
13 A I was present, close by.
14 Q What is your memory with respect to how much time
15 elapsed from the point when you know you've got the apartment
16 where the cellphone is in, versus someone arriving at the door
17 and knocking on it. How much time elapses between those two?
18 A It's very hard for me to recall. I know that there
19 was discussion as far as tactics and techniques that would be
20 employed. But I was waiting for a supervisor to arrive on
21 scene, waiting for sufficient officers to arrive on scene.
22 But I don't recall that being more than you know, maybe an
23 hour or two at most.
24 Q What Were the techniques that were discussed while
25 you were deciding what it is you're going to do to do after

TERESA SELVA, OFFICIAL DIGITAL REPORTER 193

FDFCDC 85
THIS PAGE INTENTIONALLY LEFT BLANK

FDFCDC 86