The other side of mobile forensics

How service provider data fits into the larger mobile-evidence picture

     To that end, Loving recommends developing a relationship with carriers' designated contacts and their supervisors. This can help smooth the growing degree of cooperation. She adds, "Having said that, it is law enforcement's responsibility to be aware of what information they can obtain from the companies, as well as understand the data they receive and how it can be used in their investigations."

     Christa Miller is a Maine-based freelance writer who specializes in public safety. She can be contacted at

Carrier data legalities

     Many states make it possible for officers to search a subject's cell phone incident to arrest; some require a search warrant. To obtain carrier data, however, investigators almost always need a court order.

     The good news: suspicious activity alone is enough. "Looking at records is not considered as intrusive as kicking down a door," says Loving. "If the license plate of a car seen near a burglary comes back to a woman whose boyfriend is on parole, that's enough to obtain a court order for their cell phone records. A search warrant also works if you can't locate a subject; it's possible to have the carrier ping the phone and receive feedback."

     Still, Robert Morgester, California Deputy Attorney General with the Special Crimes Unit at the California Attorney General's Office says, "This area of law can get complex quickly. Depending on the type of records you are looking for, the process needed to get those records will vary. For example, basic subscriber records can be obtained with a subpoena. Historical files relating to cell phone location can be had with an articulable facts order. Reading e-mail or locating a person in real time requires a search warrant."

     In most cases, investigators will have enough time to obtain a warrant for service providers' data. In some cases, however, exigent circumstances come into play. Here, warns Morgester, obtaining tower data can get even trickier. "The Patriot Act has an amendment that permits the provider to give information to law enforcement in the event of a missing child or homicide investigation — an 'emergency involving the risk of imminent death or serious physical injury,' " he says.

     The key word is "permits." Prior to the amendment's passage, the federal Electronic Communications Privacy Act prohibited carriers from disclosing customers' private information, including the tower data that showed their whereabouts. Carriers who did provide that information, even in an emergency, could be sued in federal court.

     The amendment in the Patriot Act, then, makes such disclosures allowable. "Emergencies with an imminent threat of death or serious physical injury were the reason why that change was made," says Morgester. Still, disclosure is not mandatory, nor do carriers have to follow up to ensure their customers' continued good behavior (as Web sites like MySpace have begun to do, largely to avoid regulation, he states).

     Moreover, even allowable disclosures run afoul with state law because most states continue to preserve citizens' privacy. "In California, for example, tower and other data from service providers are protected," Morgester notes. "You are still required to have judicial approval regardless of the federal amendment."

     That means a request on letterhead. In most cases, carriers will comply. "You have no legal remedy if they don't, but those who are not good corporate citizens want to avoid public embarrassment," says Morgester. Some providers require warrants, but will supply information in an emergency as long as the request is later backed up.

     Some seemingly exigent circumstances still are not enough for forensic examinations of phones or other electronics. This is especially true of suicides. "An investigator might claim that the subject has a chance to be saved, or at least that the body can be recovered for the family," explains Morgester. "But ultimately, the individual's privacy supersedes all else."

  • Enhance your experience.

    Thank you for your regular readership of and visits to To continue viewing content on this site, please take a few moments to fill out the form below and register on this website.

    Registration is required to help ensure your access to featured content, and to maintain control of access to content that may be sensitive in nature to law enforcement.