What could be done and what they failed to do
We live is a world where phone calls are monitored and lines are tapped. As the politicians soften the public for a life of being listened in to, they tell us that there are BAD people out there, criminals, traffickers & terrorists and we need these laws, and that law abiding citizen have nothing to fear. But what happens to those arguments when the listeners (GCHQ) listen in and still fail to stop the murder of 29 lives? In a report into the handling of intercept evidence on the day of the Omagh bombing it is claimed that 1998 technology was not up the job of locating mobile phones, this evidence I strongly refute.
NIO states. On 15 September 2008 the BBC broadcast an edition of the Panorama programme, written and presented by John Ware, entitled “Omagh: what the police were never told”.
John Ware had also written an article published in the Sunday Telegraph on 14 September alleging, inter alia, that at the relevant time, vital intercept evidence had not been passed promptly enough to the police and thereby might have prevented the bombing or subsequently assist the investigating officers to bring the perpetrators to justice.
In view of the seriousness of the issues raised, the Prime Minister on 17 September asked Sir Peter Gibson, the Intelligence Services Commissioner, to: “Review any intercepted intelligence material available to the security and intelligence agencies in relation to the Omagh bombing and how this intelligence was shared”. In his Review, Sir Peter examined the role of GCHQ in gathering and handling intercept intelligence at the material time. He also investigated what intercept was shared with the RUC.
In preparing his report, Sir Peter drew on a range of highly sensitive and highly classified material made available to him by those agencies involved in the production of intercept intelligence.
Some of this material is inevitably subject to legal constraints. Its publication would disclose information about how our security and intelligence agencies currently function and thereby compromise current operations aimed at ensuring the protection of our national security.
the Gibson Report is here [PDF]
I have a few disagreements with the report but I will focus on one. The report claims it was not possibly to track the movement of a mobile phone in 1998.
31. The portrayal in the Panorama programme of the tracking on a screen of the movement of two cars, a scout car and a car carrying a bomb, by reference to two “blobs” moving on a road map has no correspondence whatever with what intercepting agencies were able to do or did on 15 August 1998. On the basis of evidence from an independent expert witness from a mobile communications service provider I am satisfied that, in 1998 it was neither possible to track mobile phones in real time nor to visualise the location and movement of mobile phones in the way that was shown in the Panorama programme. Information on the location of a mobile telephone only existed within the mobile phone network in respect of “communications events” – when a phone was switched on or off, or during a call, for instance – and even then would have been limited to information about the cell (the area covered by a particular mast) in which the phone was active. It is clear therefore that no intelligence or security agency or law enforcement agency did see or could have seen what was suggested by the Panorama programme in its representation.
On the basis of this, and other material received by me, assertions in the programme that, if live monitoring was taking place, from 1250 hours the picture of a bomb run in progress should have begun to materialise, that those monitoring were seeing two cars, just like a bomb run heading towards Omagh, and that by 1420 hours on 15 August those monitoring should have been in little doubt about what was going to happen, are incorrect and unsupported by any evidence.
1. 1998 Mobile telephony was in the main GSM (2G) and contained the same technology as they do today with regard to location info. 100% of GSM phones could be located and followed in 1998, the technology was available to GCHQ the phone companies and it also resides on the phone itself. In 1998 while I was working at a cryptography company (one that bought a UK crypto communications supplier to British intelligence) I saw netmon is action. But Netmon was no state secret just a tech extra, Netmon is an additional menu on a range of phones like some Nokia’s that displays all the information an engineer needs from a mobile handset. The handsets in 1998 had LAC, as it is part of GSM, this allows the phone to tell the mast what signal is like. I does this in real time two way and whether or not the phone is in standby or on a call. Phones talk to anything up to 14 cells/masts in the area to decide where to get the best signal, they did this in 1998 too. This signal testing of the phone happens in real time and is relayed over the network to the mast and the telco. From this sampling the phone decides what frequency band and mast to use, to make best use of spectrum and deliver the best call quality. This same information is like having a fully functional 2D sat nav, and from the sampled data a very accurate location can be plotted as it could be in 1998.
2. The phone call intercept was of a digital phone call?. This call was decrypted to be listened to, but also the digital sub channel data layers of the call including the mast info and handset sampling results are sent over the intercept channel, this channel WAS decrypted, was the data discarded? misunderstood? ignored? The reports claim that “(this) only existed within the mobile phone network” this is incorrect, if the decryption happened outside of the telco, the data was available as it was in the layers of the decrypted signal, and if it happened inside the telco, well then it was very available. The fact that the calls were digital means this data WAS available.
3. The intercepts were cross territory. The calls were made to Irish Republic phones in the Irish Republic. In 1998 all Irish mobile Telcos were Irish owned. The mobiles later went roaming in UK territory with other carriers. As the calls were digital and required a degree of assist from the multiple telcos the ability to intercept the data layers were also not a challenge to British intelligence.
4. Even if the data layers could reveal location and movement, but this was overlooked there are other methods of signal triangulation that date back to analogue cellular mobiles which was in the gift of GCHQ pre & post 1998.
5. The assertion that British Intelligence could not plot on a map with blinking dots the locations on phones if the locations were known is the most insulting finding. It does not mater if the screen was digital computer screen or an A0 paper map of the state, the ability to plot this information existed back in Roman times. Data in, plot on map, advancing? retreating?. To portray the BBC Panorama as some Hi Tech futuristic techno babble that was not possible in 1998 is folly.
6. Conversations that are monitored that use code words are of more interest than regular calls, the location and direction of these calls that could be known in 1998 from technology in the hands of the interceptors should have plotted the location & direction of coded telephone conversations that the report shows were monitored.
7. No one has been convicted of 29 murders. Evidence was and is still being withheld from inquiries, and unpublished from the pages of this report.
8. There are other questions relating to co-operation between Eircell / Digifone or not, and the Intercept of foreign nations calls by spies, but those issues are superceded by the lies told to us to support monitoring the entire population, and the deaths of 29 people and unborn twins.
The BBC Panorama report shed more light on what had failed to be done on August 15th 1998, The Gibson Report supports this by continuing to show what was not done but it also tries to cover up by painting a backward state of technology in 1998. The Systems then, were much the same as they are now, and the ability of listeners to hear must also be coupled with their ability to see and understand the data they decrypted. I urge you to comment on this, copy it and develop it, query it in Dail Eireann, Northern Assembly, Houses of Parliament and your workplaces.
July 1st, 2009 at 1:21 am
Just read much of your thread.
I’ve got to correct you on some of the technical aspects of the above. The netmon mode that you referr to on many nokia phone menus, is one of many variants of similar engineering modes on most phones. Only field engineers are meant to have access to phones with it enabled, but on older nokias it’s easy to enable.
Anyway, as netmon can show, a number of cells are scanned by a phone to look for the best signal. Makes sense, and that’s what you say. But then you made some incorrect claims about what the mobile can do. The mobile can only pick up the signals that each mast emits, and pick the best mast on signal strength. Signal strength is no judge of distance from a mast either. You could be 20 miles away in open country, or in the basement of a hospital.
A mobile phone is INCAPABLE of communicating with more than one mast simultaneously. TDMA (http://en.wikipedia.org/wiki/Time_division_multiple_access) doesn’t allow it with the one Tx in the one phone. If what you said about this “real-time sampling” was true, phones would only last a few hours before the next charge. The fact is, the only communications and handovers between phone and mast are done when signal strength drops below a certain point (usually -85 dBmW/m) and it switches to the best alterntive.
Based on the above, i would say it’s impossible to have continuous accurate pinpointing of phones back in 1993 when GSM first got going, in 1998 or indeed now on GSM-only phones. It’s probably impossible to pinpoint phones while on the move from one cell to the next. I just checked around on the net to see if it could be done during cell handovers, it seems very unlikely there too. http://www.willassen.no/msl/node7.html#radioloc explains it well.
July 5th, 2009 at 1:55 pm
thank you for the comment and clarifications.
I am not an engineer or expert on this but let me re explain some things as I see them.
GSM Phones provide continuous calls with base station (BS) handover, so the BS to BS sampling is happening in the phone in real time (every second) and it is a reception decision not a TX activity. When I mention “real-time sampling” I’m talking about received signal strengths. So GSM does simultaneously listen and has reception of multiple channels of nearest base station and other base stations in the area (fact). Even before a BS switch, the phone is sampling many channels from one BS. these channels are not omni directional, therefore the channel in use can determine the direction north, east, south or west of a mast that the phone is.
The data that the phone samples is available to the phone to decide to switch BS or not. This data is communicated in the data layer back to the provider (something I contend, but need more facts on).
Yes you are correct that received signal strength alone does not indicate distance. But many received signal strengths and some maths does indicate distance. Triangulation is used in surveying, with enough data, unknowns such as distance for BS1 BS2 BS3 etc. will plot a location. this was possible for signal tracking long before GSM.
Even without complicated triangulation, you can plot the direction of a phone just marking down the BS’s used. Along a ~straight 100KM of road a car phone passes the BSs in a very predicable and logical fashion. Take it that the car is on a road (national or motorway). BS1(+time) BS2(+time) BS3(+time) etc, we pretty much know where that phone & car is in real time (& later from records).
The Joe O’Reilly murder trial[1] relied heavily on call trace data, or (non call trace data) also the current tiger kidnapping trial in the Irish courts[2]. This data which is convicting people of murder or other crimes is from data provided to the Garda by phone companies, with GSM technology. These cases differ from the Omagh case in that the suspects were not under surveillance at the time of the crime. The alleged bombers were under GSM surveillance prior to and on the day of the bombing.
In general you may be seeking an accuracy of location greater than what I believe was and is achievable. In the link you provided I get the general impression that the discussion is about location to an accuracy of GPS or better than current LAC which is of no use to m-commerce folk who want to txt you when you are about to pass a shop, anyway with the emergence of permission based bluetooth marketing this proximity location problem has been solved somewhat.
Did a phone of a known person under wiretap surveillance travel from town A to town B? and return? did they speak in code? yes. Did they know or could they have known where they came from what route they traveled and where they went? I think yes.
My main point again, what the Gibson Report claims was not possible, was possible, I also think that it was very possible for GCHQ. If they are cracking the GSM signal they are cracking data, encoded voice and other data layers, the data layers have the BS and CH info.
[1] http://url.ie/1ynv [with reference to Real IRA]
[2] http://url.ie/1yno
August 24th, 2009 at 2:57 pm
[...] On February 2nd 2009 I wrote this review of certain evidence to the Gibson Report into the handling … [...]