Using Mobile Phone Data Records to

Determine Criminal Activity Space

Presented by:
Peter Schmitz*
Logistics and Quantitative Methods, CSIR Built Environment
PO Box 395,Pretoria,0001,South Africa
pschmitz@csir.co.za

Antony Cooper
Logistics and Quantitative Methods, CSIR Built Environment
PO Box 395,Pretoria,0001,South Africa
acooper@csir.co.za

IQPC International GIS Crime Mapping Conference

Brussels, Belgium
Using Mobile Phone Data Records to Determine Criminal Activity Space

Overview

• Activity space
• Proposed new method for examples 1 and 2
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 2 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records

Mental Maps •
•
Example 2: Active tracking of a suspect
Example 3: Forensic mapping using call data records

•Paths – routes of travel that tend to dominate most people’s images of

cities such freeways and railways.
•Edges – boundaries of lines that help to organise cognitive maps such as
rivers, freeways and railways.
•Districts – subareas with recognisable unifying characteristics consisting
of well established cores with fuzzy boundaries for example business
districts or skid rows.
•Nodes – intense foci of activities such as intersections, shopping mall,
corner shop, etc.
•Landmarks – symbols used for orientation but which typically are not
physically entered such high buildings, trees, structures (i.e. water
towers), etc.

Slide 3 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
Journey-to-Crime •
•
Example 2: Active tracking of a suspect
Example 3: Forensic mapping using call data records

•Crimes in most cases occur close to the offender’s anchor point.

•The number of crimes committed by an offender decreases with
distance from his/her anchor point.
•Crime types dictate the distance from the anchor points: violent crime
tends to be closer to anchor points than property crimes.
•High crime neighbourhoods influence the crime trip pattern.

Slide 4 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Data from cellular (mobile) telephones

•Call Data Records
•The recorded use by the service provider of the cellular
telephone when it receives and makes calls, (including SMS and
MMS).
•Actively tracking the suspect
•The cellular telephone is actively tracked at predetermined time
intervals such as every five or ten minutes.

Slide 5 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
Example 3: Forensic mapping using call data records
Call Data Records
•

Date Time No.Called No.Calling Call.Dir Call Dur CELL_ID TOWER_ID Site location Site suburb
15/12/2002 000235 2773228250x 2783765762x I 52 08393 839 ATS Millpark
15/12/2002 000400 2783446106x 2773228250x O 33 08393 839 ATS Millpark
15/12/2002 000444 2783765762x 2773228250x O 36 08393 839 ATS Millpark
15/12/2002 000535 2783446106x 2773228250x O 43 02772 277 Auckland Park Telkom Ex AUCKLAND PARK
15/12/2002 001032 2773228250x 2783765762x I 8 08392 839 ATS Millpark
15/12/2002 001100 2783446106x 2773228250x O 21 08393 839 ATS Millpark
15/12/2002 001931 2783347574x 2773228250x O 0 08393 839 ATS Millpark
15/12/2002 001948 2773288063x 2773228250x O 17 08393 839 ATS Millpark
15/12/2002 002949 2772392694x 2773228250x O 26 08393 839 ATS Millpark

Slide 6 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
Cell Network • Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 7 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
Determining the centroid •
•
Example 1: Call data records
Example 2: Active tracking of a suspect
of a cell • Example 3: Forensic mapping using call data records

Determining the x,y position of a cell used to locate a ping in an active track

Wedge based on begin and end angle

Offset point to indicate a cell

Begin angle
Base station

End angle Azimuth

Centroid of MBR giving

location of the cell used
for linking Cell ID

MBR created around wedge

Thiessen polygon giving cell coverage

Slide 8 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Actively tracking a cellular telephone

Send a blind SMS to

HLR VLR
the cellular telephone
BSC Cellular telephone
PSTN, responds by giving the
SIM BTS MSC ISDN,PSPDN,
CSPDN cell in which it is
ME
BSC located

BTS The cell is then linked

EIR AuC
to the centroid, which
gives the geographic
Mobile Base Station
Station Subsystem
Network Subsystem location
SIM Subscriber Identity Module BSC Base Station Controller MSC Mobile services Switching Centre
ME Mobile Equipment HLR Home Location Register EIR Equipment Identity Register
BTS Base Transceiver Station VTR Visitor Location Register AuC Authentication Centre

Slide 9 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Linking centroids to road network to determine

activity space
Linking interaction between Cell ID C0001 and C0006 to the road network

C0006
Cell ID linked to nearest road

C0015

Interaction between cells

linked to shortest
nearest road
road

Cell ID linked to nearest road

Use Flowmap to link the C0001
interaction to the road
network.
Slide 10 © CSIR 2006 www.csir.co.za
 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
Call data records •
•
Example 2: Active tracking of a suspect
Example 3: Forensic mapping using call data records

Slide 11 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 12 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
Activity spaces •
•
Example 2: Active tracking of a suspect
Example 3: Forensic mapping using call data records

Grey area: overlapping activity space

Slide 13 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
Diurnal patterns •
•
Example 2: Active tracking of a suspect
Example 3: Forensic mapping using call data records

Slide 14 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 15 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 16 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
Frequency of use • Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 17 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
Active tracking •
•
Example 1: Call data records
Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 18 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
Land use/cover •
•
Example 1: Call data records
Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 19 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
Diurnal pattern •
•
Example 1: Call data records
Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 20 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
First and last pings •
•
Example 1: Call data records
Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records

Slide 21 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
• Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data records
People traveling to and from an event

Sporting event
Δt

Pretoria
.

Location

Slide 22 Johannesburg
© CSIR 2006 www.csir.co.za
Using Mobile Phone Data Records to Determine Criminal Activity Space

Activity space as provided by the Burger se bewegings volgens selfoon oproepe

suspect to the investigating officer gemaak en ontvang

Bewegings van Burger soos beskryf in sy dagboek

23 May 2000 00:50

Pretoria (Attridgeville SAPD) 23:45 + 22/3 May 2000 #
#
Westfort
Pretoria (Attridgeville SAPD) 23:45 + 22/3 May 2000
#5
7

23 May 2000 00:42

#
Paul Hof
23 May 2000 00:43
23 May 2000 00:59 #
Atteridgeville 23 May 2000 02:10
Magoto Prim School #
#
Iscor

MX Health 12:00 23 May 2000 12

#

47 km

44 km

23 May 2000 02:34

#
#
Lanseria Airport

Terug by huis 03:00 23 May 2000

59 km

Vertrek na Pretoria vanaf huis 23:45 22 May 2000 48

# 17
15
Terug by huis 17:00 23 May 2000 #
#
Krugersdorp Highway
23 May 2000 02:33
23 May 2000 02:34
Terug by huis 03:15 24 May 2000

Constantia Kliniek 13:30 23 May 2000

13
#

22 May 2000 16:08

22 May 2000 17:19
22 May 2000 18:31 #
#
Diswilmar
16 km Johannesburg 09:30 22 May 2000 22 May 2000 18:38 23 May 2000 07:27 22 May 2000 23:14
22 May 2000 19:10 23 May 2000 14:18
23 May 2000 14:14
22 km 2
23 May 2000 14:15 23 May 2000 07:38
21 km 10 #
# 23 May 2000 17:44 #
#
Krugersdorp North
23 May 2000 17:45
23 May 2000 21:06 #
#
Johannesburg Hof 10:00 23 May 2000 23 May 2000 21:07 # Noordheuwel
#
Boltonia ## Krugersdorp #
#
Roodekrans
22 km

Soweto Moord en Roof 07:00 23 May 2000 22 May 2000 11:36

24 May 2000 07:42
22 May 2000 16:39 #
#
Lewisham
24 May 2000 09:59
11 1 3
# 14

Soweto Moord en Roof 11:30 23 May 2000

16 9
23 May 2000 07:52
23 May 2000 16:11

23 May 2000 14:23

Soweto Moord en Roof 15:30 23 May 2000 23 May 2000 14:34 # Witpoortjie
# 23 May 2000 08:37
#
#
Georgina
Soweto Moord en Roof 07:00 22 May 2000 23 May 2000 15:05 # Millsite #
Kagiso
24 May 2000 09:11
Soweto Moord en Roof 20:00 23 May 2000
# Randfontein
23 May 2000 15:09
23 May 2000 15:09
23 May 2000 15:12
23 May 2000 15:16
Soweto Moord en Roof 12:00 22 May 2000

#
#
Doornkop
22 May 2000 10:37

22 May 2000 09:51

22 May 2000 13:59
91 km 23 May 2000 10:18 #
#
Protea Exchange
23 May 2000 21:58

52 km
#
#
Lenasia
23 May 2000 10:20

Sebokeng (nuwe huise) 23:45 + 22/3 May 2000 #

6
#
Anchorville
#
23 May 2000 10:34

# Plekke soos aangedui

Bewe gings volgens die dagboek
Pretoria strate
Witwatersrand strate
Vaaldriehoek stra te

Map drawn by CSIR

CSIR Copyright 11 O ctober 2001 8 0 8 16 Kilo meters

#
#
Fochville Exchange
23 May 2000 12:22

Activity space according to the

suspect’s call data records
Bewegings van Burger volgens oproepe
Map drawn by CSIR
# Burger se selfoon oproepe 5 0 5 10 Kilometers
CSIR copyright 11 October 2001 # Vodacom sel torings

Slide 23 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
Bilateral movement and GPS data • Proposed new method
• Example 1: Call data records
• Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data
records

Cellular base station

Incident location
Truck route

Communications between the persons

Slide 24 © CSIR 2006 www.csir.co.za

 • Activity space
Using Mobile Phone Data Records to Determine Criminal Activity Space
Bilateral movement and GPS: 3D • Proposed new method
• Example 1: Call data records
view of communications • Example 2: Active tracking of a suspect
• Example 3: Forensic mapping using call data
records

Slide 25 © CSIR 2006 www.csir.co.za

Using Mobile Phone Data Records to Determine Criminal Activity Space

Conclusions

• Using call data records (CDR) and/or active tracking data

it is possible to determine the activity space of an
individual using cellular telephone data.
• The data alone are not sufficient and need to be
supported by local knowledge and gathered intelligence.
• SAPS indicates that it will drastically improve their
targeted intelligence gathering based on the analysis done
using CDR and/or results from the active tracking of the
handset of a suspect.
• The analysis offers the investigating team an effective
method to brief a new unacquainted investigating officer
who joined the investigation with regards to the suspect’s
activity space, anchor points and the suspect’s day/night
activity.
Slide 26 © CSIR 2006 www.csir.co.za
Using Mobile Phone Data Records to Determine Criminal Activity Space

Conclusions

• SAPS mentioned that the active tracking of a suspect can

help the investigators to establish a finer detail on specific
movements than what the CDR can provide.
• They will use the results of the CDR analysis to guide
active tracking exercises.
• It is strongly recommended that the above should not be
used for prosecution purposes, but only for assisting in
solving a criminal case.
• Forensic mapping of call data records can be used for
prosecution purposes

Slide 27 © CSIR 2006 www.csir.co.za

Using Mobile Phone Data Records to Determine Criminal Activity Space

Acknowledgements
• CSIR for funding this research through its Strategic
Research Panel, project number PPTH/2005/036,
"GenDySI (Generation and Harnessing of Dynamic Spatial
Intelligence)".
• CSIR employees for the permission to use the 5 minute
interval tracking data for this project.
• Adv Riley and colleagues from the National Prosecuting
Authority of South Africa to use the suspects’ data.
• The cellular service providers MTN and Vodacom for
providing the necessary data to do the study.
• Capt Dreyden and colleagues from the South African
Police Services for input on the various suspects used in
the examples.
• IPQC for the invitation and partial sponsorship
Slide 28 © CSIR 2006 www.csir.co.za
Thank you!

Peter Schmitz
pschmitz@csir.co.za