IT AT NET

My Blogs

2010-01-21T05:41:00.001-08:00

Tourist Ways Kerala
My Blogs	Team Members
singapore
Kerala Dragons
Competition Master
free traffic net
Kerala
College Net
Free Visitors
India
Nuhman
Education in Net
Student Mate
linux
التعليم
IT AT NET
Money making
online games

KERALA TOURISM WEBSITE tourismforkerala.com Kerala Tourism website provides details of travel destinations, hotels, accommodation, culture, heritage, art forms,medical tourism.cheapadvertising opportunity also. http://tourismforkerala.com

2009-11-24T21:33:00.001-08:00

KERALA TOURISM WEBSITE tourismforkerala.com

Kerala Tourism website provides  details of travel destinations, hotels, accommodation, culture, heritage, art forms,medical tourism.cheapadvertising opportunity also.

 http://tourismforkerala.com

Arts and Festivals

> Kathakali
> Bharatanatyam
> Mohiniyattam
> Kaikottikali
> Kolkali
> Kalarippayattu
> Oppana
> Teyyam
> Ottanthullal
> Poorakali
> Kummattikali
> Margam Kali
> Duff Muttu
> Thidambu Nritham
> Chakyar Koothu
> Onam
> Vishu
> Thrissur Puram
> Sabarimala
> More arts.

BSNL rolls out 3G services in orissa

2009-10-20T05:43:00.001-07:00

Published on National Portal of India www.india.gov.in

Telecom giant BSNL today rolled its 3G services in the State making
Orissa part of the global network.
The services would be available in Bhubaneswar and Puri in the first
phase before being expanded to other parts of the State.
BSNL has plans to bring under 3G coverage all the 30 district
headquarters and 18 other industrially and commercially important
towns this year. By month-end, four more towns would be covered while
the rest will be on 3G map by June/July.
The telecom major has augmented its existing network to operationalise
the 3G services. An estimated Rs 75 crore has been invested to upgrade
its infrastructure which required installation of new equipment in the
existing 2G towers.
As of now, Cuttack has not been included under the 3G service given a
huge rural pocket and BSNL is working on enhancing its technical setup
so as to bring the Millennium City under the coverage soon.
BSNL 3G services would not only offer high speed mobile broadband but
also support multimedia services, high-resolution colour display, video
call, TV on mobile, streaming options as well as Internet besides a host of
download facilities.
Over a period of time, high-end features like mobile banking and mcommerce
would be made available. All such services would be available
on pre-paid and post-paid segments.
BSNL is the only telecom company to have been awarded 3G spectrum in
India. It, currently, enjoys a mobile subscriber base of 13 lakh in Orissa
and eyes on capitalizing on the 3G advantage to expand its base.
The 3G tariff would be available in three slabs-Rs350, Rs 650, Rs 1,350
on pre-paid platform. Post-paid customers would be given four slabs like
Rs 500, Rs 800, Rs1, 000 and Rs 2,500 since they are in the high-end
brackets.
Published on National Portal of India www.india.gov.in
The tariff has been kept affordable and would appeal to all categories of
customers.
Initially, 3G customers would be given new numbers. As upgradation of
the services goes; customers will be able to use their existing number for
3G services.
It would offer high speed mobile broadband, support multimedia
services, high-resolution colour display, video call TV on mobile as well
as internet and downloading facilities

Reliance Industries

2009-10-20T05:41:00.001-07:00

ACCUMULATE
Price Rs1,785
Target Price Rs1,833
Investment Period 12 months
Stock Info
Sector Oil & Gas
Market Cap (Rs cr) 2,80,852
Beta 1.2
52 WK High / Low 2707/ 930
Avg. Daily Volume 1713210
Face Value (Rs) 10
BSE Sensex 11,329
Nifty 3,481
BSE Code 500325
NSE Code RELIANCE
Reuters Code RELI.BO
Bloomberg Code RIL@IN
Shareholding Pattern (%)
Promoters 49.0
MF/Banks/Indian FIs 13.8
FII/ NRIs/ OCBs 20.1
Indian Public/others 17.1
Abs. 3m 1yr 3yr
Sensex (%) 30.6 (32.2) (4.9)
RIL (%) 54.8 (30.9) 82.7
􀂃 Lower crude, Product prices lead to Net Sales decline: Reliance
Industries’ (RIL) 4QFY2009 numbers were below our expectation on the
Top-line front while the same exceeded our expectations on the Bottom-line
front. RIL’s Top-line fell by 23.9% yoy to Rs28,362cr (Rs37,286cr) primarily
due to the 31.1% and 24.6% yoy fall in Petrochem and Refining Revenues
to Rs9,724cr and Rs21,631cr, while Net Profit (excluding Exceptional items)
fell 1.0% yoy to Rs3,874cr (Rs3,912cr). Crude processing during the quarter
was 7.79mn tonnes (8.10mn tonnes), a decline of 3.8% yoy. For FY2009,
Top-line increased by 9.6% yoy to Rs1,46,291cr (Rs1,33,443cr) on the back
of higher crude and product prices in 1HFY2009.
􀂃 Refining Margins disappoint; Petrochemical strengthens: During the
quarter, RIL reported GRMs at US $9.9/bbl (US $15.5/bbl) as against our
expectation of US $10.5/bbl. Benchmark complex Singapore Margins,
during the quarter, stood at around US $5.4/bbl. Thus, RIL managed to earn
a spread of US $4.5/bbl, which was marginally lower than its previous
performances. Improvement in Petchem Margins, on a qoq basis, continued
in 4QFY2009 as well. Petchem Margins stood at a strong 17.7% (10.4%)
yoy. On the Core business front, blended EBIT Margins stood at 14.5%
(12.4%) during the quarter.
􀂃 Interest Expense increases, Other Income surges: Debt at the end of
FY2009 increased substantially to Rs53,457cr (Rs36,480cr) yoy primarily on
account of increased borrowings and interest capitalisation. This increase in
debt coupled with Rupee depreciation resulted in a 75.4% yoy increase in
Interest Expenditure to Rs477cr (Rs272cr) for the quarter. Other Income
during the quarter increased significantly to Rs993cr (Rs289cr) due to higher
Interest Income on account of higher Cash and gain on sale of investments.
􀂃 PAT declines by 1.0%: PAT during 4QFY2009 stood at Rs3,546cr
(Rs3,912cr) registering a de-growth of 9.4% yoy. However, reported PAT
was suppressed because of Exceptional Item of Rs370cr incurred towards
estimated claims on account of subsidiaries. Excluding this, PAT stood at
Rs3,874cr (Rs3,912cr), a decline of a mere 1% yoy. For FY2009, PAT after
adjusting for Exceptional Items, stood at Rs15,607cr (Rs15,261cr).
Key Financials (Consolidated)
Y/E March (Rs cr) FY2008 FY2009 FY2010E FY2011E
Net sales 137,147 155,670 200,004 229,575
% chg 20.5 13.5 28.5 14.8
Net Profit 19,521 15,520 21,511 27,098
% chg 61.7 (20.5) 38.6 26.0
EPS (Rs) 118.8 94.5 130.9 164.9
EBITDA Margin (%) 16.9 15.8 18.9 19.4
P/E (x) 13.3 18.9 13.6 10.8
RoE (%) 15.6 15.6 17.5 18.3
RoCE (%) 13.1 13.1 14.2 15.4
P/BV (x) 3.0 2.6 2.2 2.0
EV/ Sales (x) 2.2 2.1 1.5 1.3
EV/ EBITDA 13.2 13.0 9.6 6.8
Source: Company, Angel Research
Performance Highlights
Amit Vora
Tel: 022 – 4040 3800 Ext: 322
e-mail: amit.vora@angeltrade.com
Deepak Pareek
Tel: 022 – 4040 3800 Ext: 340
e-mail: deepak.pareek@angeltrade.com
April 24, 2009 2
Oil & Gas
Reliance Industries
Segment-wise Performance
Refining and Marketing (R&M): The R&M Segment delivered a subdued performance
amidst volatility in crude and product prices and demand contraction. Decline in crude oil
prices led to 24.6% yoy reduction in R&M Revenues to Rs21,631cr (Rs28,686cr). On full
year basis, R&M Revenues increased to Rs1,12,351cr (Rs1,00,743cr). Crude processing
during the quarter stood at 7.79mn tonnes (8.10mn tonnes), which was lower by 3.8%
yoy, with the company reporting capacity utilisation at 94.4%. Crude oil processed was
also lower qoq, with 7.87mn tonnes of crude processed in 3QFY2009. On the Margins
front, RIL reported lower-than-expected GRMs of US $9.9/bbl (US $15.5/bbl) as against
our expectation of US $10.5/bbl. Even for FY2009, GRMs fell to US $12.2/bbl
(US $15.0/bbl) as refinery cracks declined sharply in the second half on the back of lower
crude prices and demand contraction. Thus, during the quarter, EBIT Margins were under
pressure on a yoy basis, declining by 87bp. However, the same showed a marginal
improvement on a qoq basis.
Exhibit 1: RIL v/s Benchmark Singapore GRMs
Source: Company, Angel Research
Exhibit 2: Crude Processing and Capacity Utilisation
Source: Company, Angel Research
0
2
4
6
8
10
12
14
16
18
Q1FY06
Q2FY06
Q3FY06
Q4FY06
Q1FY07
Q2FY07
Q3FY07
Q4FY07
Q1FY08
Q2FY08
Q3FY08
Q4FY08
Q1FY09
Q2FY09
Q3FY09
Q4FY09
GRMs US $/bbl
RIL GRMs Singapore GRMs
7
7.2
7.4
7.6
7.8
8
8.2
8.4
20
40
60
80
100
120
Q1FY07
Q2FY07
Q3FY07
Q4FY07
Q1FY08
Q2FY08
Q3FY08
Q4FY08
Q1FY09
Q2FY09
Q3FY09
Q4FY09
mn tonnes
Capacity Utilisation %
Capacity Utilisation % Crude Processing mn tonnes (RHS)
April 24, 2009 3
Oil & Gas
Reliance Industries
Petrochemicals: The Petrochemical Segment Revenues fell 31.1% yoy to Rs9,724cr
(Rs14,119cr) due to lower crude and product prices on yoy basis. However during the
quarter, product deltas showed an improvement, which led to spike in EBIT Margins by
733bp to 17.7% (10.4%). Even sequentially, Margins improved by 458bp.
Exhibit 3: EBIT breakup
Source: Company, Angel Research
Other Highlights
Exploration and Production (E&P): During the quarter, RIL along with Bharat Petroleum
was awarded the deep water block KG-DWN-2005/2 under NELP VII. RIL also made two
gas discoveries during 4QFY2009, one in KG-VD3 Block and other in KG-D6 Block.
On the Production side, oil production from the KG D6 Block has yet to commence as it
was shutdown for repair works in December 2008. According to RIL, production is
expected to resume in the last week of April 2009. RIL commenced its gas production from
April 2, 2009 and effects of which on Revenues and Profitability will be seen 1QFY2010
onwards.
Increased capex towards E&P: During 4QFY2009, RIL incurred capex of Rs6,798cr,
majority of which was spent towards E&P, taking the company’s total capex to Rs24,907cr
for FY2009.
RPL Refinery commissioned: RPL, which dispatched its first parcel of refinery products
in January 2009, processed 3.6mn tonnes of crude during the quarter generating
Revenues of Rs3,678cr and Net Profit of Rs84cr.
Reliance Retail: At the end of 4QFY2009, Reliance Retail had more than 900 operational
stores (same as 3QFY2009) spread across 80 cities with 4.2mn square feet of trading
space. No new stores were opened during the quarter as RIL is in the process of
consolidating its presence in the Retail business.
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
4QFY2008 1QFY2009 2QFY2009 3QFY2009 4QFY2009
Petrochemicals Refining Oil and gas Others
April 24, 2009 4
Oil & Gas
Reliance Industries
Outlook
The last six months have been a very challenging period for the company. The global
slowdown has exerted severe pressure on RIL’s benchmark Refining and Petrochemical
Margins.
Petrochemical Segment
RIL has stated that in spite of the ongoing slowdown, it has managed to improve its
cracking margins on account of fairly resilient domestic demand (72% of total demand),
which is less affected by the global slowdown. Revival in Margins could also be attributed
to the de-stocking done in the previous year, and with demand rebounding in 4QFY2009
on account of stability in the feedstock prices resulting in re-stocking at the downstream
level. Margins have particularly improved significantly in the ethylene chain. Improvement
in naphtha prices by more than 100% from its lows also resulted in propylene prices
increasing by 130%. Similarly, as the domestic demand is less affected by the slowdown,
the company was able to charge better Margins in the domestic markets over and above
the International Margins.
Exhibit 4: Domestic demand less affected by slowdown
Source: Company
Global petrochemical capacity is likely to increase by around 23% over the next 2-3 years
with significant capacity additions in China and the Middle East. The addition is set to
impact the Operating rates and Margins going forward. Thus, the current global slowdown
coupled with increasing global capacities and end of re-stocking at the downstream level
are likely to cap the Margin upside. However, we continue to believe that due to the
integrated nature of operations, RIL is likely to be lesser affected due to Margin
compression in the Petrochemical Segment.
Refining Segment
The ongoing global slowdown has resulted in demand for Petroleum products at 3.2mnbpd
in 4QFY2009. The decline in demand was more severe in the Middle Distillates Segment,
which was also noticeable from the reducing cracks in the space. However, the weak
demand did not reflect completely in the Margins as the fall in product prices lagged the
decline in crude oil prices resulting in an improvement in the benchmark Singapore
Margins on a qoq basis. Demand is expected to continue to be lower over the next few
quarters on the back of weakness in the global economy and with additional around
1.5mnbpd new refining capacity also likely to come up during the later part of year would
result into surplus capacity in turn maintaining the pressure on Margins.
April 24, 2009 5
Oil & Gas
Reliance Industries
We believe Refining Margins are likely to remain subdued going forward in the range of
US $3.5-4.0 per barrel. Moreover, weakness in heavy and light crude differential in the
Asian markets coupled with softening middle distillate cracks is likely to keep RIL’s
premium over the benchmark Singapore Margins under pressure. However, we expect
RIL to maintain its GRMs in the range of US $8.5-9.0 per barrel. However, RIL is better
placed than its peers amidst the ongoing slowdown owing to its low operating cost of
around US $2/bbl compared to industry average cost of US $5/bbl.
E&P Segment
Subdued performance of RIL’s extant businesses is more than likely to be compensated
by its E&P business. RIL has started gas production from KG-D6. Similarly, the crude
production from its MA fields, which is currently shut down, is likely to commence with
increased production of 30,000bpd. Thus, the E&P Segment is poised to deliver good set
of number in the current fiscal. However, full impact of the same will be visible in FY2011.
Moreover, we expect news flows associated with the E&P Segment to be critical
considering the fact that the extant business is likely to see subdued performance in the
near term. RIL has planned E&P activities in the prospective Cauvery, Mahanadi and
Kerala Konkan basins. Thus, any news discoveries from these blocks will provide added
upside to our valuations.
Exhibit 5: FY2010 Exploration Outlook
Source: Company
April 24, 2009 6
Oil & Gas
Reliance Industries
Valuation
RIL has successfully been able to execute its two mega ventures, viz. KG basin gas and
the RPL refinery with minimal execution problems. These ventures speak about RIL’s
successful execution capacity as KG-D6 is one the fastest deep water development across
the globe, while the RPL refinery is one of the most complex refineries. We expect these
ventures to be likely key drivers of Profitability over the next couple of years.
Commencement of gas production coupled with increased oil production is likely to
increase the share of E&P in the profit matrix in turn reducing the company’s exposure to
cyclical segments. Thus, we continue to remain positive on the future growth prospects of
the company. We maintain an Accumulate on RIL, and based on our FY2010E EPS of
Rs130.9 and Target P/E multiple of 14x, we ascribe a Fair Value of Rs1,833 on the
stock.
April 24, 2009 7
Oil & Gas
Reliance Industries
Exhibit 6: 4QFY2009 Performance
Y/E March (Rs cr) 4QFY2009 4QFY2008 %chg FY2009 FY2008 %chg
Net Operating Income 28,362 37,286 (23.9) 146,291 133,443 9.6
COGS 14,461 26,896 (46.2) 98,971 92,170 0.0
Total operating expenditure 22,925 31,268 (26.7) 122,896 110,138 11.6
EBITDA 5,437 6,018 (9.7) 23,395 23,305 0.4
EBITDA Margin (%) 19.2 16.1 16.0 17.5
Other Income 993 289 243.6 2,033 895 127.2
Depreciation 1,327 1,380 (3.8) 5,059 4,847 4.4
Interest 477 272 75.4 1,692 1,077 57.1
Extraordinary Items (370) 0 (370) 4,733
PBT 4,256 4,655 (8.6) 18,307 23,009 (20.4)
PBT Margin (%) 15.0 12.5 12.5 17.2
Total Tax 710 743 (4.4) 3,028 3,551 (14.7)
% of PBT 16.7 16.0 16.5 15.4
PAT 3,546 3,912 (9.4) 15,279 19,458 (21.5)
PAT Margin (%) 12.5 10.5 19.2 10.4 14.6
PAT without Ext. item 3,874 3,912 (1.0) 15,607 15,261 2.3
Source: Company, Angel Research
Exhibit 7: Segment-wise Performance
Y/E March (Rs cr) 4QFY2009 4QFY2008 %chg FY2009 FY2008 %chg
Revenues
Petrochemicals 9,724 14,119 (31.1) 52,767 52,999 (0.4)
Refining & Marketing 21,631 28,686 (24.6) 112,351 100,743 11.5
Oil & Gas 736 828 (11.1) 3,489 2,702 29.1
Others 210 342 (38.6) 638 778 (18.0)
Gross Revenue 32,301 43,975 (26.5) 169,245 157,222 7.6
EBIT
Petrochemicals 1,722 1,466 17.5 6,855 7,114 (3.6)
Refining & Marketing 1,953 2,839 (31.2) 9,648 10,331 (6.6)
Oil & Gas 473 447 5.8 2,226 1,503 48.1
Others 12 9 33.3 37 40 (7.5)
Total EBIT 4,160 4,761 (12.6) 18,766 18,988 (1.2)
EBIT Margin (%)
Petrochemicals 17.7 10.4 13.0 13.4
Refining & Marketing 9.0 9.9 8.6 10.3
Oil & Gas 64.3 54.0 63.8 55.6
Others 5.7 2.6 5.8 5.1
Total 12.9 10.8 11.1 12.1
Source: Company, Angel Research
April 24, 2009 8
Oil & Gas
Reliance Industries
Research Team: Tel: 4040 3800 E-mail: research@angeltrade.com Website: www.angeltrade.com
DISCLAIMER: This document is not for public distribution and has been furnished to you solely for your information and must not be reproduced or redistributed to any other person. Persons into whose
possession this document may come are required to observe these restrictions.
Opinion expressed is our current opinion as of the date appearing on this material only. While we endeavor to update on a reasonable basis the information discussed in this material, there may be
regulatory, compliance, or other reasons that prevent us from doing so. Prospective investors and others are cautioned that any forward-looking statements are not predictions and may be subject to
change without notice. Our proprietary trading and investment businesses may make investment decisions that are inconsistent with the recommendations expressed herein.
The information in this document has been printed on the basis of publicly available information, internal data and other reliable sources believed to be true and are for general guidance only. While every
effort is made to ensure the accuracy and completeness of information contained, the company takes no guarantee and assumes no liability for any errors or omissions of the information. No one can use
the information as the basis for any claim, demand or cause of action.
Recipients of this material should rely on their own investigations and take their own professional advice. Each recipient of this document should make such investigations as it deems necessary to arrive
at an independent evaluation of an investment in the securities of companies referred to in this document (including the merits and risks involved), and should consult their own advisors to determine the
merits and risks of such an investment. Price and value of the investments referred to in this material may go up or down. Past performance is not a guide for future performance. Certain transactions -
futures, options and other derivatives as well as non-investment grade securities - involve substantial risks and are not suitable for all investors. Reports based on technical analysis centers on studying
charts of a stock's price movement and trading volume, as opposed to focusing on a company's fundamentals and as such, may not match with a report on a company's fundamentals.
We do not undertake to advise you as to any change of our views expressed in this document. While we would endeavor to update the information herein on a reasonable basis, Angel Broking, its
subsidiaries and associated companies, their directors and employees are under no obligation to update or keep the information current. Also there may be regulatory, compliance, or other reasons that
may prevent Angel Broking and affiliates from doing so. Prospective investors and others are cautioned that any forward-looking statements are not predictions and may be subject to change without
notice.
Angel Broking Limited and affiliates, including the analyst who has issued this report, may, on the date of this report, and from time to time, have long or short positions in, and buy or sell the securities of
the companies mentioned herein or engage in any other transaction involving such securities and earn brokerage or compensation or act as advisor or have other potential conflict of interest with respect
to company/ies mentioned herein or inconsistent with any recommendation and related information and opinions.
Angel Broking Limited and affiliates may seek to provide or have engaged in providing corporate finance, investment banking or other advisory services in a merger or specific transaction to the companies
referred to in this report, as on the date of this report or in the past.
Sebi Registration No : INB 010996539

VIRGIN GALACTIC ROLLS OUT MOTHERSHIP “EVE”

2009-10-20T05:40:00.001-07:00

WhiteKnightTwo launch vehicle for SpaceShipTwo heralds a new era in aerospace fuel efficiency,
performance and versatility
Mojave Air and Spaceport, California
July 28th 2008
Virgin Founder, Sir Richard Branson and SpaceShipOne designer, Burt Rutan, today pulled back the
hangar doors on the new WhiteKnightTwo (WK2) carrier aircraft that will ferry SpaceShipTwo and
thousands of private astronauts, science packages and payload on the first stage of the Virgin
Galactic sub‐orbital space experience.
The rollout represents another major milestone in Virgin Galactic’s quest to launch the world’s first
private, environmentally benign, space access system for people, payload and science.
Christened “EVE” in honor of Sir Richard’s mother, who performed the official naming ceremony,
WK2 is both visually remarkable and represents ground‐breaking aerospace technology. It is the
world’s largest all carbon composite aircraft and many of its component parts have been built using
composite materials for the very first time. At 140 ft, the wing spar is the longest single carbon
composite aviation component ever manufactured.
Driven by a demanding performance specification set by Virgin Galactic, WK2 has a unique heavy lift,
high altitude capability and an open architecture driven design which provides for maximum
versatility in the weight, mass and volume of its payload potential. It has the power, strength and
maneuverability to provide for pre space‐flight, positive G force and zero G astronaut training as well
as a lift capability which is over 30% greater than that represented by a fully crewed SpaceShipTwo.
The vehicle has a maximum altitude over 50,000 ft and its U.S. coast‐to‐coast range will allow the
spaceship to be ferried on long duration flights.
An all carbon composite vehicle of this size represents a giant leap for a material technology that has
already been identified as a key contributor to the increasingly urgent requirement by the
commercial aviation sector for dramatically more fuel efficient aircraft. Powered by four Pratt and
Whitney PW308A engines, which are amongst the most powerful, economic and efficient available,
WK2 is a mold breaker in carbon efficiency and the epitome of 21st century aerospace design and
technology.
The twin fuselage and central payload area configuration allow for easy access to WK2 and to the
spaceship for passengers and crew; the design also aids operational efficiencies and turnaround
times. WK2 will be able to support up to four daily space flights, is able to carry out both day and
night time operations and is equipped with a package of highly advanced avionics.
Large numbers of VIP’s, media and more than 100 fully signed‐up future Virgin Galactic astronauts
flew into Mojave for the rollout onboard a new Airbus A320 aircraft specially chartered from Virgin
America, the youngest and most efficient US domestic airline, which launched to great acclaim in
2007.
Rutan’s Scaled Composites facility has been strictly out of bounds whilst design and construction has
been underway, but guests today were additionally given a tantalizing preview of SpaceShipTwo,
clearly visible but heavily shrouded and well on its way to completion, in the smaller of Scaled’s two
hangars awaiting its own rollout in 2009. This will be scheduled once WK2 is at the appropriate stage
in its extensive test program, which has already begun with ground tests; it is expected to take its first
flight in the fall of 2008. The flight test program will be comprehensive even before SpaceShipTwo is
carried as a payload for the first time in 2009.
Commenting on the rollout, Burt Rutan, Founder of Scaled Composites said:
“WhiteKnightTwo represents the apogee of the application of carbon composites to aerospace and
all of us at Scaled are tremendously excited at the capabilities of the Mothership for SpaceShipTwo. I
believe the vehicle will be developed and sold for a variety of launch applications beyond the initial
requirements of our launch customer, Virgin Galactic. We have set up a new business jointly with
Virgin, The Spaceship Company (TSC), to develop these vehicles and we very much hope that its
efficiency will herald a wake up call to the aerospace industry and the necessity of using new
materials and technologies in the future. “
Sir Richard Branson, Founder of Virgin Galactic added:
“As usual, Burt and the Scaled team have created a beauty and this is a very proud day for us all. The
rollout of WhiteKnightTwo takes the Virgin Galactic vision to the next level and continues to provide
tangible evidence that this most ambitious of projects is not only for real but is making tremendous
progress towards our goal of safe commercial operation.
Virgin Galactic is central to our ambition at Virgin to become the world’s leading group in the
operation of energy and environmentally efficient transportation, in the air, on the ground and in
space. We arrived here this morning on an aircraft operated by Virgin America, who run the most fuel
efficient commercial fleet in the US, to roll out what by most definitions, is the most energy efficient
aircraft in history. We are naming it EVE after my Mother, Eve Branson but also because it represents
a first and a new beginning, the chance for our ever growing group of future astronauts and other
scientists and payload specialists to see our world in a completely new light. I for one can’t wait!”
For further information go to www.virgingalactic.com.
For downloadable images and graphics go to www.virgingalactic.com/press

A Fresh Direction for Virgin Mobile Australia

2009-10-20T05:38:00.001-07:00

Online Growth; Member Benefits; New Look and Feel
Sydney, 29th Sept 2009 – It’s nicer to be treated like a member than be reminded
you’re a customer. Virgin Mobile Australia (VMA) made a number of major
announcements today revealing a new web presence and concept store. Virgin
Mobile also unveiled an exciting new brand platform, new look and feel and a
refreshed approach moving forward.
Virgin Mobile is investing in the customer experience like never before. Major
investments into customer service areas have seen complaints reduced by 25% -
more than any other telco in Australia.
In a nutshell, Virgin Mobile Australia (VMA) is changing how it does things and it is
excited.
Business Growth: Leading Online Presence and New Concept Store
About to sign up its one-millionth customer, Virgin Mobile is growing and will soon be
seen in more places than ever before both online and offline.
Virgin Mobile members interact more online than any other telco, with mobile
broadband and Internet-enabled mobile phone services making the web more
intrinsic to their everyday life. In response to this, Virgin Mobile has increased its
focus on building a robust and engaging online presence.
The first stage of this, is the refresh of the www.virginmobile.com.au website and the
addition of the Members Lounge portal. The second stage will be the relaunch of the
Virgin Mobile e-shop later this year. It will be easier to navigate than ever before,
offering new and existing members an improved online retail experience.
Supporting its increasing online presence, Virgin Mobile launched its first concept
store on Pitt Street in Sydney today. Over the past few years, Virgin Mobile has
doubled its retail footprint adding 13 kiosk in 2008. Virgin Mobile will continue to
expand its retail footprint in Australia using the new store concept unveiled today.
The new Sydney hero store is designed using the latest interactive technology.
Touch screens allow customers to easily browse and compare handset features as
well as interact with the brand and the Members Lounge. Live handsets will enable
customers to experience the features of the various phones on offer.
New brand platform – Members Welcome
Building on its existing Virgin philosophy of putting the customer at the heart of
everything, Virgin Mobile is launching a refreshing new ‘Members Welcome’ brand
strategy. This will see Virgin Mobile customers treated like members of a club with
membership perks - not just at sign-up but for the lifetime of their membership.
These benefits range from Virgin brand family offers to exclusive discounts, VIP
access to music gigs and even free beer on Fridaysi. Cheers.
Peter Bithos, CEO of Virgin Mobile Australia said, “We believe there’s an opportunity
for a mobile company that values its customers more and treats them better, whilst
still providing great value. At Virgin Mobile we want a relationship with our members
that goes beyond the transactional one.”
“We want to dial up our connection with them, engaging with members more online
and in areas of interest outside of their mobile phone. Our existing customers are just
as important to us as new ones so we’re excited to introduce a host of benefits that
make being a loyal Virgin Mobile member even more rewarding.”
Virgin family perks will allow VMA members to benefit from a host of different Virgin
offers, such as Velocity points, 10% back on Virgin Blue flights and more. With
VMA’s new benefits plus ongoing unlimited free mobile talk & text 24/7 between
membersii, VMA members will be able to connect with other members more easily.
Virgin Mobile has also secured an exclusive partnership with discount live
entertainment ticket provider Lasttix.com.au. Virgin Mobile Members will jump the
queue for priority Lasttix tickets to Live Music, Performing Arts, Comedy, Family, and
Sport – another great benefit accessible through www.MembersLounge.com.au.
The Members Lounge
Along with these new member benefits, Virgin Mobile has launched a new Members’
Lounge portal (www.MembersLounge.com.au) on its website. Not just a website, but
a destination, the Members Lounge is a digital space where members can go to view
exclusive content, read bar and restaurant reviews, get special access to gigs and
events, not to mention claim lots of great member benefits and exclusive offers.
Non-members can use a ‘guest pass’ to have a sneak peak at the Members Lounge
but only VMA members will have full access to the exclusive content and benefits on
offer.
Follow Members Lounge on Twitter to receive the latest news and member offers
from Virgin Mobile.
Brand new look and feel
There would be no point in Virgin Mobile changing the way it does things without
changing the way it looks, so as of this month you will see a whole new look for
Virgin Mobile Australia. Starting with its new website www.virginmobile.com.au and
moving right through to all of its point of sale, new store design and, in a nutshell,
everything it does.
The refreshed Virgin Mobile website (www.VirginMobile.com.au) includes a new,
simple to understand format for products and services as well as plan comparison
tools to make checking, updating or changing your plan even easier.
VMA will be producing a monthly magazine with the latest offers, handsets, plans
and lifestyle content, available through the stores or by mail on request.
Virgin Mobile Metro
Exciting news for Sydney-based members is the sponsorship of Sydney’s
contemporary music venue The Virgin Mobile Metro, giving members exclusive
tickets and VIP benefits to this iconic music venue. This sponsorship is part of Virgin
Mobile Australia’s ongoing commitment to music by providing customers with special
access to gigs and festivals.
New Campaign
Tying it all together is the new campaign all around members and the benefits they
get. This highlights Virgin Mobile member benefits such as 10% back on Virgin Blue
flights, free beers on Friday, free voicemail (Virgin Mobile is the only telco in Australia
to offer this) and VIP gig access.
Revealing a new creative direction for Virgin Mobile, the TVC is shot like a film clip
with a contemporary, ‘music video’ edge and energy. It is a completely different look
and feel to anything Virgin Mobile have done before and will no doubt appeal to a
wide audience of music lovers.
Peter Bithos said, “Virgin Mobile is always looking for further ways to provide
members with a more rewarding experience, whether that’s in terms of coverage,
getting online, the latest technology and handsets, access to stores or unique
benefits that only the Virgin brand can provide.”
~ ENDS ~
For more information or to arrange an interview please contact:
Jess Makin – One Green Bean – jess@onegreenbean.com.au or 0416 292 912
Rob Lowe – One Green Bean – rob@onegreenbean.com.au or 9699 9503
i Free beer on Fridays is being trialled in NSW in October 2009 with a view to rolling out
nationally by the end of the year
ii Pre-Paid needs 1c balance. All rates apply in Oz

Optus merges Virgin Mobile Australia and SIMplus

2009-10-20T05:36:00.001-07:00

Optus Chief Executive Paul O'Sullivan announced today the planned operational integration of two
wholly-owned Optus subsidiaries, Virgin Mobile Australia (VMA) and SIMplus Mobile.
“VMA has one of the strongest prepaid offerings in the market and SIMplus has strengths in the
post paid market through varied sales channels,” Mr O’Sullivan said.
“Synergies between the two companies are strong and in the highly competitive mobile market,
combining these operations makes good business sense.
“The integration supports Optus’ strategy to strengthen its mobile market position and provides a
solid foundation for future growth of the Virgin Mobile brand,” Mr O’Sullivan said.
Mr Matt Davey has been appointed Chief Executive of the combined operation. Mr Davey replaces
Jonathan Marchbank who has decided to pursue a new opportunity.
“I would like to thank Jonathan. He has been a great supporter of Optus’ acquisition of VMA and
working towards taking VMA into its next phase,” Mr O’Sullivan said.
SIMplus Managing Director, Keir Preedy will work with Mr Davey to oversee the realisation of
the business benefits of the two companies as acting Chief Operating Officer.
Mr Davey recently returned from a eight month posting with Globe Telecom in the Philippines, a
SingTel Group company, where he helped establish the small business group.
Mr Davey has been with Optus for over nine years working in the Consumer and Small Business
Customer Facing Units. He has extensive telecommunications experience in the prepaid and post
paid consumer and business markets.
“Optus is pleased to have secured someone with such extensive knowledge of the mobile industry
to lead the new VMA,” Mr O’Sullivan said.
“Matt will provide strong leadership during the transition of the company and drive VMA on to
further success as it expands its product range.”
Mr Davey will begin immediately, reporting to Paul O’Sullivan.
Both companies will remain as separate legal entities.
Media contact:
Simone Bergholcs
Optus Corporate Affairs
Tel: (02) 9342 7846
Media Release
3 February 2006
Media Release
3 February 2006 2 of 2
Media Release
Note to editor:
About Virgin Mobile Australia
Virgin Mobile Australia is a leading consumer focused mobile operator with its headquarters in
Sydney and stores in Sydney, Brisbane & Melbourne.
Following a successful launch in October 2000, Virgin Mobile Australia has continued to achieve
strong growth and now has over 500,000 customers, employs over 300 people.
Virgin is one of the most recognised brands globally, representing strong customer focus and good
value for money.
About SIMplus Mobile
SIMplus Mobile is one of the largest service providers of the Optus Network in Australia.
SIMplus Mobile is dedicated to offering uncomplicated, value-driven mobile solutions that put the
customer in control. This is achieved through easy to understand plans, competitive call rates, a
dependable network service and simple billing and payment options.
With more than 4,100 base stations, the Optus Network is committed to providing coverage where
and when it is needed, currently offering coverage to more than 96 per cent of the Australian
population.

declining public schools, and deteriorating housing conditions in

2009-10-20T05:35:00.003-07:00

declining public schools, and deteriorating housing conditions in
older suburbs surrounding the urban core. To tackle these
p ressing issues, elected officials from cities and suburbs, corporate
leaders, minority and low-income community advocates, and
religious leaders are coming together to form powerful re g i o n a l
political coalitions. They seek to revitalize struggling communities
and to improve the quality of life for urban children and families
by promoting urban reinvestment, creating aff o rdable housing,
and improving access to transportation in order to link inner- c i t y
residents with rapidly growing suburban jobs. Their work is
based on the premise that a metropolitan region is an interre l a t e d
system and that cities and suburbs cannot solve their social and
economic problems in isolation.
Serving as a bridge between the academic re s e a rch community
and practitioners, the two-day seminar hosted at Harvard
University convened nationally known re s e a rchers, practitioners,
and policy makers who shared their expertise and lessons fro m
the field about how to build successful regional coalitions. The
discussion focused on several themes including: What are the
most effective strategies for building successful coalitions? What
issues are important to consider in building cross-class and
multiracial collaborations? What can current re s e a rch tell us about
the roles collaboration builders play in creating the most enduring
coalitions? Notable re s e a rch findings and discussion themes
a d d ressing these issues are summarized in this brief.
The Urban Seminar Series
ON CHILDREN’S HEALTH AND SAFETY
Building Coalitions
to Bring About
C h a n g e
e t ropolitan areas across the country are facing common problems, including concentrated poverty in central cities,
The seminar, "Building Coalitions to
Bring About Change," part of the
Urban Seminar Series on Childre n ’s
Health and Safety, was held
December 6-7, 2001 at Harvard
U n i v e r s i t y. For more information
please visit our website at
w w w. k s g . h a r v a r d . e d u / u r b a n p o v e r t y.
M
Sponsored by
The Robert Wood Johnson Foundation
Directed by
William Julius Wilson
Joblessness and Urban Poverty Research Program
John F. Kennedy School of Government
Harvard University
Research Findings and
Lessons from the Field
Successful coalitions use four crucial strategies
These strategies include building relationships; defining
common interests; analyzing complex data; and operating on
multiple political levels.
Skillful relationship building is essential to the formation of
e ffective coalitions. In fact, members of successful and
durable coalitions tend to have links to influential parties that
can help move their agenda (1). Such ties can be particularly
useful in providing knowledge, re s o u rces, or political support
at critical moments. More o v e r, it is vital for regional coalitions
to identify and build relationships with local members fro m
the health care, religious, and labor communities. These
leaders can prove to be useful allies in forwarding the goals
of the collaborative.
Successful coalitions also have the ability to unite disparate
g roups around a common agenda. By highlighting issues of
mutual interest, alliances can begin to develop a common
mission and achieve successful integration. Acase in point is
the Smart Growth movement, which succeeded in uniting the
d i v e rgent interests of developers and enviro n m e n t a l i s t s
a round the theme of environmentally friendly urban re v i t a lization.
This strategy allowed both sides to support policies
that improved the housing options and quality of life of
urban neighborhoods while at the same time preserving the
distinctive and historical infrastru c t u re of US cities.
Access to detailed information germane to regional issues,
including economic indicators, socioeconomic characteristics
and needs assessments of residents as well as public
spending data, offers coalition builders an invaluable
re s o u rce to better define a problem and assess what measure s
may be applied to its solution. However, having data re a d i l y
available does not mean that consensus builders have the
means to interpret it. Intermediaries that specialize in data
analysis are often critical to successful regional coalitions (see
the section "Sustaining the Coalition" for further elaboration
of this point).
Coalition Building for Political
Leverage
Even if advocates are focused on local issues, the importance
of regional collaborations cannot be underestimated. For
instance, the support of key policy makers in other parts of
the state is often crucial to moving the agenda of the
coalition. Consequently, many scholars advocate a re g i o n a l
perspective, even if entities are locally focused (1). Access to
state politics is also particularly important for coalitions, since
most key regional decisions are made at the state level (1).
But state politics can be a difficult arena for regional collaborators
due to partisan division and entrenched localism in
decision making. To succeed in state level politics, it might be
a more effective strategy to create statewide campaigns
supported by a variety of local groups united by "thin agre ement"
rather than deep common intere s t .
Several significant demographic and market trends have been
shaping metropolitan areas, and seminar participants
e x p l o red how these trends affect the potential for coalition
building. Some of the most notable themes of the discussion
a re summarized below.
Suburbs are growing faster than cities
During the 1990s, the 100 largest U.S. cities grew 8.1 perc e n t
in population, compared to 6 percent growth during the
1980s. In fact, some cities, such as Chicago, Atlanta, and
Memphis, experienced population growth after decades of
losses. However, a closer examination of the data reveals that
the population expansion experienced by cities was larg e l y
due to an increase in Hispanic and Asian immigrant populations
(2). More o v e r, during the 1990s, an estimated 2.3 million
middle-income white residents moved from the central city to
outlying metropolitan areas. Consequently, the rate of population
growth for the suburbs was approximately twice that
of the central cities—17 percent compared to 8.1 percent (2).
Employment is decentralizing
The movement of middle-income white residents from the
city to outlying suburbs in the 1990s has had significant
implications for metropolitan regions. For instance, as middle
income white residents moved to the suburbs, suburban job
g rowth began to outpace that of cities. A c c o rding to some
observers, the American economy is rapidly becoming an
"exit ramp economy" with office, commercial and retail facilities
located along suburban freeways (2). This is particularly
t rue in leading technology regions like Washington, DC,
Austin, and Boston, where high-tech firms have located in
suburbs far from the city.
Recent statistics indicate a consistent pattern of economic
decentralization across the 100 largest U. S. metro p o l i t a n
a reas. On average, only 22 percent of people work within a
t h ree-mile radius of a city’s center. In cities like Chicago,
Atlanta, and Detroit more than 60 percent of the re g i o n a l
employment is located more than 10 miles from the
city center.
While opportunity is decentralizing, poverty
remains concentrated
Outlying suburbs are strong employment centers in their
regions (2). In fact, they are the predominant source of new
jobs in metropolitan areas. In the 1990s, for instance, 87
p e rcent of new entry-level jobs in the service and re t a i l
sectors were created in the outlying suburbs. However, as job
g rowth in the U.S. moves from central business districts in
cities, new areas of opportunities are re t reating further fro m
a reas of concentrated poverty and the working poor.
A c c o rding to recent reports, metropolitan areas continue to be
highly stratified by race, class, and income with the highest
concentrations of poverty among minority populations in the
central city (2, 5). Although entry-level jobs in manufacturing,
The Urban Seminar Series
ON CHILDREN’S HEALTH AND SAFETY
2
wholesale trade, and retail are available in the suburbs, the
lack of aff o rdable housing, low rates of car ownership, inadequate
public transit, and persistent residential racial discrimination
tend to prevent inner-city workers from obtaining
these jobs. Furthermore, inner-city workers constrained by
poor information networks often may not even know that
these jobs exist. This leads to a spatial mismatch between
w h e re jobs are increasingly located and where low-wage
workers live.
Decentralization has also led to negative consequences
for suburban re s i d e n t s
Urban sprawl has led to problems such as longer commute
times, traffic congestion, increased air pollution, and loss of
open space for middle-income residents of outlying suburbs.
Potential for Coalition Building
Between City and Suburb
Given the disturbing trends in metropolitan growth outlined
above, it may seem unlikely that larger alliances can be
formed to address all the associated problems. However,
many of these problems are shared and this becomes evident
in a closer examination of the development of suburbs.
A Typology of Suburbs
Decentralization is transforming the suburban
political landscape
The suburbs are often thought of as an undiff e rentiated band
of stable, affluent middle class white communities. But
re s e a rch indicates that urban sprawl gives rise to thre e
d i ff e rent categories of suburbs in the United States—at-risk
suburbs, bedroom development suburbs, and affluent
job centers.
The at-risk suburbs are located in the inner ring, immediately
outside the central city, and often resemble the central cities
f rom the perspective of their socioeconomic indicators,
declining schools, poor housing conditions, and unpro d u c t i v e
c o m m e rcial areas. Most often, they lack the fiscal capacity to
sustain economic viability.
B e d room development suburbs are located about 40 miles
f rom the central business district, and are characterized by
a ff o rdable housing for mostly white, moderate-income families
with high percentages of school-age childre n . H o w e v e r,
g rowing middle-income communities such as these are developing
without a sufficient property tax base to support
schools and other public services, and thus these communities
are at risk of becoming tomorrow's troubled suburbs.
The affluent job centers are often seen as the places that are
winning in the new economy and are considered the most
attractive places to live, with a steady flow of jobs, high-end
housing, and large retail outlets. However, these suburbs
s t ruggle with congestion, a lack of open space, and
e n v i ronmental degradation.
Urban/Suburban Commonalities
The typology of suburbs just outlined is based on a study of
the 25 largest metropolitan areas in the United States (2), and
clearly indicates that suburban communities are not a monolith
with common needs and experiences. Rather than re i n f o rc i n g
divisions between central cities and suburbs, the delineation of
these distinct residential patterns highlights the commonalties
s h a red by central cities and the inner ring suburbs which range
f rom fiscal constraints and deteriorating infrastru c t u re to
inadequate transportation and housing. In fact, by underscoring
such commonalities and shared fiscal interests, visionary
leaders have successfully forged metro-majority political coalitions
between the central city, and at-risk and low-tax-base
development suburbs (6). In Minnesota, for instance, such a
regional coalition helped pass significant state legislation
between 1993 and 1998 involving regional tax base sharing,
fair housing, transportation and transit reform, and land use
planning. Given the history of political fragmentation and
competition in metropolitan areas, regional coalition building
e fforts such as these re p resent innovative alliances among
g roups that might historically have found little in common.
New regional alliances are attempting to reverse tre n d s
toward concentrated urban poverty and sprawl
In metropolitan areas across the country, new coalitions are
forming to promote a regional agenda that addresses issues
such as concentrated urban poverty and sprawl. Many of these
coalitions are advocating smart growth strategies to curb uncont
rolled development outside urban centers and to pro m o t e
urban reinvestment. For instance, in Cleveland, a coalition of
inner ring suburban and city officials has been advocating
changes in public investment priorities so that state and federal
funds for transportation, housing, and schools are directed to
existing downtowns and neighborhoods instead of outward to
the urban fringe. In Boston, Portland, and Chattanooga, metropolitan
leaders have targeted urban sprawl by choosing
i n f r a s t ru c t u re re p a i r, mass transit, and anti-congestion strategies
over road expansion and consumption of open space.
Acoalition of city, inner ring, and bedroom development
suburbs in the Twin Cities has been successful at cre a t i n g
a ff o rdable housing options for urban children and families (6).
By creating low cost housing in suburban areas, they hope to
e n s u re that poor families have access to rapidly gro w i n g
suburban jobs and good schools. Furthermore, policymakers
contend that as aff o rdable housing becomes available at the
region’s periphery, the growth of concentrated poverty in
central cities will be reduced (2, 6). The Twin Cities coalition
also advocated regional tax sharing in order to spread the cost
of concentrated poverty among wealthy and struggling
jurisdictions. Such tax sharing has allowed the revitalization of
declining urban and older suburban areas by pro v i d i n g
re s o u rces to rebuild aging infrastru c t u re and re h a b i l i t a t e
housing. Other regional collaboration efforts have also focused
on linking inner-city residents to job opportunities t h ro u g h o u t
the region by investing in public transportation (7).
The Urban Seminar Series
ON CHILDREN’S HEALTH AND SAFETY
3
Multi-Racial Coalitions
Coalition builders must consider how local histories
of race relations in diff e rent U.S. cities affects the
collaboration building pro c e s s
Although coalitions can form around mutual interests such as
economic development, they are often fragile. The tenuous
n a t u re of such alliances is rooted in a history of racial tension
and present-day diff e rences between potential partners. Thus,
coalition builders need to recognize the important role of race
and help constituents find a common ground for alliance
forming that takes the local history of racial division and
antagonism into consideration.
C reative solutions to multiracial coalition building
include an appreciation of class-based solutions
Some consensus builders have found creative solutions to
multiracial political coalition building (3). For instance, by
making the case for a class-based solution to problems,
advocates of the Texas Ten Percent Plan were able to achieve
consensus on college enrollment quotas for historically
u n d e r re p resented minority groups. By framing the pro b l e m
a round the issue of class and economic inequality, advocates
w e re able to garner the endorsement of multiple groups that
a re often at odds. The initiative was led by Latino and black
activists who argued for class-based affirmative action, which
also appealed to low-income, working-class white families
f rom rural West Texas with limited access to flagship state
universities. The plan attracted Latino and black families
since minorities tend to be disproportionately poor and theref
o re likely to benefit from economic pre f e re n c e s .
In contrast to often divisive race-based affirmative action, the
Texas Ten Percent Plan brought the interests of working class
white families and minorities together. Because of the plan's
w i d e s p read appeal, activists were able to forge a political
coalition among Latino, black, and white state legislators. The
bill was passed by the legislature and was signed into law in
1997. The implementation of the Texas Ten Percent Plan has
significantly increased the number of Latino, black, and
low-income white students enrolled at the University of Te x a s .
Commonly held religious beliefs or lifestyle choices can
serve as the social glue that holds a cross-class
coalition together
E fforts to organize across lines of education, income, and
occupational status are difficult to sustain. As a result,
c ross-class political movements rarely endure unless they are
g rounded in a strongly held ideology, such as re l i g i o u s
conviction or a core lifestyle choice. Common re l i g i o u s
values, for instance, ease communication and facilitate
cooperation among gro u p s .
Sustaining the Coalition
In today's information age, public attention is an
i n c reasingly precious commodity, and coalitions must keep
their issues visible on the public agenda
Advocates need to recognize how issues can be transformed
f rom mere social conditions to problems that influential
players recognize and are willing to help solve. Three
strategies are essential in accomplishing this task. First, it is
critical to present an issue in concrete terms, as a clearly
defined problem whose solution seems feasible. Second,
advocates must carefully choose indicators—numbers, word s ,
images—to grab and hold public attention, whenever
possible emphasizing comparisons to other countries, states,
or cities. Third, advocates need to continually connect
important coalition issues with other topical issues re c e i v i n g
public attention. By helping policy makers and constituents
make these connections, coalitions are able to gain gre a t e r
e x p o s u re and support for their initiatives.
Important intermediaries can serve as trusted mediators
between all sectors of the city and re g i o n
Intermediaries can serve as brokers of relationships between
diverse stakeholders and as agents promoting collective
action and collective change. Examples of intermediaries
discussed during the seminar include the Rheedlen Center for
C h i l d ren and Families in their work with the Harlem
C h i l d ren’s Zone, the Urban Strategies Council, and the D. C.
Agenda. It is crucial for intermediaries to be seen as
nonpartisan and motivated only by the desire to eradicate a
particular social or economic problem. In this way, intermediaries
can be re g a rded with trust by the majority of the
stakeholders in a particular issue and help to bring disparate
g roups together without alienating any particular entity
or perspective.
Depending on the specific local conditions they encounter,
intermediaries can perform a variety of functions to achieve
their goal of building alliances between multiple stakeholders.
For instance, they can be compelled to act as "facilitators" or
"knowledge managers" when conflicts in real or perc e i v e d
i n t e rests ("turf") arise among collaborators. In these
situations, intermediaries perform the task of educating
parties about each other and can work to mend fractured or
tenuous relationships.
Intermediaries can also function as "performance investors"
whose work is to create a sense of a common mission for
diverse and multiple collaborators and to define consequences
for nonperformance by major players. Performance investors
can help groups or organizations define and achieve cre d i b l e
t a rgets, especially when established partnerships become
unfocused or underperforming. Intermediaries may also
serve as "organizers" and help stakeholders identify
important entities missing from the coalition and find ways to
engage them. Most often, intermediaries act as org a n i z e r s
when members of a collaborative lack the capacity to make
p ro g ress or achieve consensus.
The Urban Seminar Series
ON CHILDREN’S HEALTH AND SAFETY
4
The Urban Seminar Series
General Conclusions
N o n p rofit independent intermediaries can play a critical
role in engaging residents, civic groups, political leaders,
g r a s s roots organizations, public and private sector l
eadership, and faith-based organizations in a compre h e n s i v e
e ffort to achieve positive outcomes for poor children
and families
Intermediaries perform the vital role of coordinating a
sustainable effort by diverse stakeholders to revitalize
impoverished communities and expand healthy youth
development programs for low-income children. Their work is
often multifaceted and includes gathering and analyzing state
and regional data, strengthening the capacity of communitybased
organizations, and overhauling the systems that serve
low-income families. They create strategic partnerships among
public and private sectors, conduct evaluations to impro v e
p rograms for poor families, and support community
leadership. Presenters at the seminar agreed that an
intermediary is crucial to orchestrating and sustaining
c o m p rehensive change in communities that are often neglected
and suffer from the effects of persistent poverty.
Coalition builders must identify and build re l a t i o n s h i p s
with the political elites
The political elites, defined as a small group of local opinion
leaders typically from the business, health care, religious, and
labor communities, can prove to be powerful allies to re g i o n a l
coalition builders, given their ability to influence state
legislators on major issues.
To create effective multiracial political coalitions, one needs
to be aware of the unique histories of racial conflict in
d i ff e rent U.S. cities and the diversity within racial gro u p s
Asuccessful alliance must consider the unique circ u m s t a n c e s
of race relations in diff e rent U.S. cities and not attempt to
institute a "one size fits all" strategy across diff e rent re g i o n s .
Advocating for more central city and inner suburban re p re -
sentation on regional governing bodies could lead to better
outcomes for urban children and families
Regional governing bodies do not sufficiently re p resent the
central city or the diversity of suburbs. Increasing central city
and inner suburb re p resentation on appointed commissions
will aid in balancing agendas between decentralization and
urban reinvestment.
Establish regional forums for elected leaders
Many seminar participants agreed that in general, the suburbs
a re under- o rganized, and that we must strive to establish new
political institutions that reflect the growth of the suburbs.
Regional forums for elected leaders have been effective in
identifying common regional problems and potential solutions.
For instance, Mayors Daley (Chicago) and Webb (Denver)
o rganized suburban mayors around issues such as air quality,
s h a red utility purchase agreements, economic development,
a ff o rdable housing, and balanced growth. Seminar participants
p redicted that these regional forums would help facilitate
policy debates and changes beneficial to working class families.
References
The first four papers were commissioned for this seminar.
Other re f e rences were cited during the seminar discussion.
1. Marg a ret We i r. “Metropolitan Coalition-Building
S t r a t e g i e s . ”
2. Bruce Katz. “Bridging the Regional Divide.”
3. J. Phillip Thompson. “The Politics of Building Regional
Multi-racial Political Coalitions.”
4. Xavier de Souza Briggs. “The Will and the Way: Local
Partnerships, Political Strategy, and the Well-Being of
America’s Children and Yo u t h . ”
5. William Julius Wilson. The Bridge over the Racial Divide:
Rising Inequality and Coalition Politics. Berkeley: University of
California Press, 1999.
6. Myron Orfield. M e t ropolitics: A Regional Agenda for
Community and Stability. Washington, DC: Bro o k i n g s
Institution Press, 1998.
7. Peter Dre i e r, John Mollenkopf, and Todd Swanstrom. P l a c e
Matters: Metropolitcs for the Twenty-First Century. L a w re n c e ,
Kan.: University Press of Kansas, 2001.
M a rg a ret Blood, President of Strategies for Children; Hillary
Pennington, President of Jobs for the Future; and A n g e l a
Glover Blackwell, President and CEO of Policy Link were
invited discussants for the seminar.
ON CHILDREN’S HEALTH AND SAFETY
5
The Urban Seminar Series
ON CHILDREN’S HEALTH AND SAFETY
6
The Urban Seminar Series on Childre n ’s Health and Safety
brings together re s e a rchers, practitioners, and policy makers who
have a common interest in improving the health and well being of
urban children. The series is sponsored by The Robert Wo o d
Johnson Foundation (RWJF) and directed by William Julius Wi l s o n
at Harvard University’s Kennedy School of Government. The
seminars highlight the latest re s e a rch on selected topics related to
c h i l d re n ’s health and safety, and are designed to complement
RW J F ’s Urban Health Initiative.
The mission of the Urban Health Initiative (UHI) is to impro v e
the health and safety of children and youth. Local campaigns in
B a l t i m o re, Detroit, Oakland, Philadelphia, and Richmond
participate in the UHI. Each campaign seeks to change the major
systems that serve children in order to improve youth health and
safety statistics throughout the entire city or metropolitan area. The
UHI National Program Office is located at the University of
Washington and is headed by former Seattle Mayor Charles Royer.
C o re Group participants include the following:
Advisory Panel Members
Melissa Berman, President and CEO, The Philanthro p i c
Collaborative; Douglas Besharo v, Resident Scholar, American
Enterprise Institute for Public Policy Research; Geoffrey Canada,
P resident, Rheedlen Centers for Children and Families; Lindsay
Chase-Lansdale Professor and Chair, School of Education and Social
P o l i c y, Northwestern University; Ronald Ferguson, Lecturer in
Public Policy, John F. Kennedy School of Government and Senior
R e s e a rch Associate at the Wiener Center for Social Policy; Robert
G r a n g e r, Senior Vice President, William T. Grant Foundation;
G e o rge Latimer, Distinguished Professor of Urban Studies,
Macalester College and Former Mayor of St. Paul; Nicholas
Lemann, Staff Wr i t e r, The New Yorker; Sara McLanahan, Pro f e s s o r,
Department of Sociology and Public Affairs and Director of the
Bendheim-Thoman Center for Research on Child We l l b e i n g ,
Princeton University; Lawrence M. Mead, Pro f e s s o r, Department of
Politics Princeton University; Melvin Oliver, Vice President, Asset
Building and Community Development, Ford Foundation; Manuel
P a s t o r, Jr., Professor and Chair, Latin American and Latino Studies
Department, University of California at Santa Cruz; Robert J.
Sampson, Lucy Flower Professor of Sociology, Department of
S o c i o l o g y, University of Chicago; Kurt Schmoke, Partner, Law Firm
of Wi l m e r, Cutler & Pickering and Former Mayor of Baltimore ;
Marta Tienda, Dire c t o r, Office of Population Research, Princeton
University; Beth Weitzman, Associate Professor of Health Policy &
Management, Wagner Graduate School of Public Service, New Yo r k
University; Barry Zuckerman, Chairman, Department of
Pediatrics, Boston University
Urban Health Initiative
Julie Cooper, Research Director; Cynthia Curreri, Deputy Dire c t o r ;
Charles Royer, National Program Dire c t o r, Urban Health Initiative,
and Senior Lecture r, University of Wa s h i n g t o n
Site Dire c t o r s
G renae Dudley, Executive Dire c t o r, Youth Connection; Hathaway
F e rebee, Executive Dire c t o r, Baltimore Safe and Sound; Laura
P i n k n e y, Executive Dire c t o r, Safe Passages; Naomi Post-Stre e t ,
Executive Dire c t o r, Philadelphia Safe and Sound; Ve ro n i c a
Templeton, Executive Dire c t o r, Youth Matters
Robert Wood Johnson Foundation
Paul Jellinek, Vice President; James Knickman, Vice Pre s i d e n t ;
Katherine Kraft, Program Officer; Paul Tarini, Communications
O f f i c e r
Harvard University
Susan Chang, Research Associate; James Quane, Associate Dire c t o r
of the Joblessness and Urban Poverty Research Program, Kennedy
School of Government; William Julius Wilson, Lewis P. and Linda
L. Geyser University Professor and Director of the Joblessness and
Urban Poverty Research Program, Kennedy School of Government
For more information on the Urban Seminar Series, please visit our
website at www. k s g . h a r v a r d . e d u / u r b a n p o v e r t y. For more
information on the Urban Health Initiative, please visit its website
at www. u r b a n h e a l t h . o rg .
H a r v a rd University
John F. Kennedy School of Government
79 John F. Kennedy Stre e t
Cambridge, MA 0 2 1 3 8
Phone: 617.496.4514
Fax: 617.495.5834
w w w. k s g . h a r v a rd . e d u / u r b a n p o v e r t y

Guidelines on Cell Phone Forensics

2009-10-14T06:07:00.000-07:00

Reports on Computer Systems Technology
The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations.
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
National Institute of Standards and Technology Special Publication 800-101
Natl. Inst. Stand. Technol. Spec. Publ. 800-101, 104 pages (2007)
Acknowledgements
The authors, Wayne Jansen and Rick Ayers from NIST, wish to thank colleagues who reviewed drafts of this document. In particular, our appreciation goes to Tim Grance from NIST for his research, technical support, and written contributions to this document. Our appreciation also goes out to Ronald van der Knijff and his colleagues at the Netherlands Forensic Institute and Svein Willassen at the Norwegian University of Science and Technology for their assistance on technical issues that arose in our work. The authors would also like to thank Rick Mislan from Purdue University, Chris Sanft from the SEARCH Group, and all others who assisted with our review process.
This work was sponsored by the Department of Homeland Security (DHS), whose support and guidance in this effort are greatly appreciated.

Executive Summary
Mobile phone forensics is the science of recovering digital evidence from a mobile phone under forensically sound conditions using accepted methods. Mobile phones, especially those with advanced capabilities, are a relatively recent phenomenon, not usually covered in classical computer forensics. This guide attempts to bridge that gap by providing an in-depth look into mobile phones and explaining the technologies involved and their relationship to forensic procedures. It covers phones with features beyond simple voice communication and text messaging and their technical and operating characteristics. This guide also discusses procedures for the preservation, acquisition, examination, analysis, and reporting of digital information present on cell phones, as well as available forensic software tools that support those activities.
The objective of the guide is twofold: to help organizations evolve appropriate policies and procedures for dealing with cell phones, and to prepare forensic specialists to contend with new circumstances involving cell phones, when they arise. The guide is not all-inclusive nor is it prescribing how law enforcement and incident response communities handle mobile devices during investigations or incidents. However, from the principles outlined and other information provided, organizations should nevertheless find the guide helpful in setting policies and procedures. This publication should not be construed as legal advice. Organizations should use this guide as a starting point for developing a forensic capability in conjunction with extensive guidance provided by legal advisors, officials, and management.
The information in this guide is best applied in the context of current technology and practices. Every situation is unique, as are the experiences of the forensic specialists and the tools and facilities at their disposal. The judgment of the forensic specialists should be given deference in the implementation of the procedures suggested in this guide. Circumstances of individual cases; international, federal, state, local laws and rules; and organization-specific policies may also require actions other than those described in this guide. As always, close and continuing consultation with legal counsel is advised.
Implementing the following recommendations should facilitate efficient and effective digital forensic activities involving cell phones and cellular devices.
Organizations should ensure that their policies contain clear statements about forensic considerations involving cell phones.
At a high level, policy should allow authorized personnel to perform investigations of organizationally issued cell phones for legitimate reasons, under the appropriate circumstances. The forensic policy should clearly define the roles and responsibilities of the workforce and of any external organizations performing or assisting with the organization’s forensic activities. The policy should also indicate internal teams and external organizations to be contacted under various circumstances.
Organizations should create and maintain procedures and guidelines for performing forensic tasks on cell phones.
Guidelines should focus on general methodologies for investigating incidents using forensic techniques. While developing comprehensive procedures tailored to every possible situation is
ES-1
Guidelines on Cell Phone Forensics
not generally feasible, organizations should consider developing step-by-step procedures for performing all routine activities in the preservation, acquisition, examination and analysis, and reporting of digital evidence found on cell phones and associated media. The guidelines and procedures should facilitate consistent, effective, accurate, and repeatable actions carried out in a forensically sound manner, suitable for legal prosecution or disciplinary actions. The guidelines and procedures should support the admissibility of evidence into legal proceedings, including seizing and handling evidence properly, maintaining the chain of custody, storing evidence appropriately, establishing and maintaining the integrity of forensic tools and equipment, and demonstrating the integrity of any electronic logs, records, and case files. The guidelines and procedures should be reviewed periodically, and also whenever significant changes in cell phone technology appear that affect them.
Organizations should ensure that their policies and procedures support the reasonable and appropriate use of forensic tools for cell phones.
Policies and procedures should clearly explain what actions are to be taken by a forensic unit under various circumstances commonly encountered with cell phones. They should also describe the quality measures to apply in verifying the proper functioning of any forensic tools used in examining cell phones and associated media. Procedures for handling sensitive information that might be recorded by forensic tools should also be addressed. Legal counsel should carefully review all forensic policy and high-level procedures for compliance with international, federal, state, and local laws and regulations, as appropriate.
Organizations should ensure that their forensic professionals are prepared to conduct activities in cell phone forensics.
Forensic professionals, especially first responders to incidents, should understand their roles and responsibilities for cell phone forensics and receive training and education on related forensic tools, policies, guidelines, and procedures. Forensic professionals should also consult closely with legal counsel both in general preparation for forensics activities, such as determining which actions should and should not be taken under various circumstances. In addition, management should be responsible for supporting forensic capabilities, reviewing and approving forensic policy, and examining and endorsing unusual forensic actions that may be needed in a particular situation. ES-2
Guidelines on Cell Phone Forensics
1. Introduction
1.1 Authority
The National Institute of Standards and Technology (NIST) developed this guide in furtherance of its statutory responsibilities under the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347.
NIST is responsible for developing standards and guidelines, including minimum requirements, for providing adequate information security for all Federal agency operations and assets; but such standards and guidelines shall not apply to national security systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), “Securing Agency Information Systems,” as analyzed in A-130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in A-130, Appendix III.
This guide has been prepared for use by Federal agencies. It may be used by non-governmental organizations on a voluntary basis and is not subject to copyright, though attribution is desired.
Nothing in this guide should be taken to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official.
1.2 Purpose and Scope
This guide provides basic information on the preservation, acquisition, examination, analysis, and reporting of digital evidence on cell phones, relevant to law enforcement, incident response, and other types of investigations. The guide focuses mainly on the characteristics of cell phones, including smart phones having advanced capabilities. It also covers provisions to be taken into consideration during the course of an incident investigation.
The guide is intended to address common circumstances that may be encountered by organizational security staff and law enforcement investigators, involving digital electronic data residing on cell phones and associated electronic media. It is also intended to complement existing guidelines and delve more deeply into issues related to cell phones and their examination and analysis.
Procedures and techniques presented in this document are a compilation of the authors’ opinions and references taken from existing forensic guidelines. The publication is not to be used as a step-by-step guide for executing a proper forensic investigation when dealing with mobile phones or construed as legal advice. Its purpose is to inform readers of the various technologies involved and potential ways to approach them from a forensic point of view. Readers are advised to apply the recommended practices only after consultation with management and legal officials for compliance with laws and regulations (i.e., local, state, federal, and international) that pertain to their situation. 3
Guidelines on Cell Phone Forensics
1.3 Audience and Assumptions
The intended audience is varied and ranges from response team members handling a computer security incident to organizational security officials investigating an employee-related situation to forensic examiners involved in criminal investigations. The practices recommended in this guide are designed to highlight key technical principles associated with the handling and examination of electronic evidence, in general, and cell phones in particular. Readers are assumed to have a basic grounding in classical computer forensics involving individual computer systems (e.g., personal computers) and network servers. Because of the constantly changing nature of handheld devices and related forensic procedures and tools, readers are expected to take advantage of other resources, including those listed in this guide, for more current and detailed information.
1.4 Document Structure
The guide is divided into the following chapters and appendices:
􀂄 Chapter 1 (this chapter) explains the authority, purpose and scope, audience and assumptions of the document, and outlines its structure.
􀂄 Chapter 2 is an overview on cell phones, including an overview of common hardware and software capabilities.
􀂄 Chapter 3 discusses present-day cell phone forensic tools and the types of devices with which they work.
􀂄 Chapter 4 provides general information on procedures and principles that apply to cell phone forensics.
􀂄 Chapter 5 discusses considerations for preserving digital evidence associated with cell phones.
􀂄 Chapter 6 examines the process of acquisition of digital evidence from cell phones, as well as from common types of peripheral equipment.
􀂄 Chapter 7 outlines common sources of evidence on cell phones and the features and capabilities of tools for examination.
􀂄 Chapter 8 discusses the reporting of findings.
􀂄 Chapter 9 contains a list of references used in this guide.
􀂄 Appendix A contains a list of acronyms used in this guide.
􀂄 Appendix B contains a glossary defining terms used in this guide.
􀂄 Appendix C gives a summary of the steps involved in an acquisition.
􀂄 Appendix D provides an example of the structure of call records maintained by cell phone carriers. 4
Guidelines on Cell Phone Forensics
􀂄 Appendix E provides links to online resources.
5
Guidelines on Cell Phone Forensics
2. Background
The digital forensic community faces a constant challenge to stay abreast of the latest technologies that may be used to expose relevant clues in an investigation. Mobile phones are commonplace in today’s society, used by many individuals for both personal and professional purposes. Mobile phone forensics is the science of recovering digital evidence from a mobile phone under forensically sound conditions using accepted methods. Cell phones vary in design and are continually undergoing change as existing technologies improve and new technologies are introduced. When a cell phone is encountered during an investigation, many questions arise: What should be done about maintaining power? How should the phone be handled? How should valuable or potentially relevant data contained on the device be examined? The key to answering these questions is an understanding of the hardware and software characteristics of cell phones.
This chapter gives an overview of the hardware and software capabilities of cell phones and their associated cellular networks. The overview provides a summary of general characteristics and, where useful, focuses on key features. Developing an understanding of the components and organization of cell phones (e.g., memory organization and use) is a prerequisite to understanding the criticalities involved when dealing with them forensically. For example, cell phone memory that contains user data may be volatile (i.e., RAM) and require continuous power to maintain content, unlike a personal computer’s hard disk. Similarly, features of cellular networks are an important aspect of cell phone forensics, since logs of usage and other data are maintained therein. Handheld device technologies and cellular networks are rapidly changing, with new technologies, products, and features being introduced regularly. Because of the fast pace with which cellular device technologies are evolving, this discussion captures a snapshot of the cell phone area at the present time.
2.1 Cell Network Characteristics
Within the U.S., different types of digital cellular networks abound that follow distinct incompatible sets of standards. The two most dominant types of digital cellular networks are known as Code Division Multiple Access (CDMA) and Global System for Mobile Communications (GSM) networks. Other common cellular networks include Time Division Multiple Access (TDMA) and Integrated Digital Enhanced Network (iDEN). IDEN networks use a proprietary protocol designed by Motorola, while the others follow standardized open protocols. A digital version of the original analog standard for cellular telephone phone service, called Digital Advanced Mobile Phone Service (D-AMPS), also exist.
CDMA refers to a technology designed by Qualcomm in the U.S., which employs spread spectrum communications for the radio link. Rather than sharing a channel as many other network air interfaces do, CDMA spreads the digitized data over the entire bandwidth available, distinguishing multiple calls through a unique sequence code assigned. Successive versions of the IS-95 standard define CDMA conventions in the U.S., which is the reason why the term CDMA is often used to refer to IS-95 compliant cellular networks. IS-95 CDMA systems are sometimes referred to as cdmaOne. The next evolutionary step for CDMA to 3G
6
Guidelines on Cell Phone Forensics
services is cdma2000, TIA/EIA/IS-2000 Series1, Release A, based on the ITU IMT-2000 standard. Both Verizon and Sprint operate nationwide CDMA networks in the U.S.
GSM is a cellular system used worldwide that was designed in Europe, primarily by Ericsson and Nokia. Cingular and T-Mobile operate nationwide networks in the U.S. GSM uses a TDMA air interface. TDMA refers to a digital link technology whereby multiple phones share a single carrier, radio frequency channel by taking turns – using the channel exclusively for an allocated time slice, then releasing it and waiting briefly while other phones use it. A packet switching enhancement to GSM wireless networks called General Packet Radio Service (GPRS) was standardized to improve the transmission of data. The next generation of GSM, commonly referred to as the third generation or 3G, is known as Universal Mobile Telecommunications System (UMTS) and involves enhancing GSM networks with a Wideband CDMA (W-CDMA) air interface.
TDMA is also used to refer specifically to the standard covered by IS-136, which defines a specific type of cellular network. Using the term TDMA to refer to a general technique or a specific type of cellular network can be a source of confusion. For example, although GSM uses a TDMA air interface (i.e., the general technique), as does iDEN, neither of those systems is compatible with so-called TDMA cellular networks that follow IS-136.
Mobile phones work with certain subsets of the network types mentioned, typically those associated with the service provider providing the phone and from whom a service agreement was arranged. For example, a service provider or network operator for a GSM network that has some older TDMA network segments in operation might supply a phone that has GSM voice and data capabilities, and TDMA capabilities. Such a phone would not be compatible with CDMA networks. Mobile phones can also be acquired without service from a manufacturer, vendor, or other source, and have their service set up separately with a service provider or network operator, provided that the phone is compatible with the network. When in operation, mobile phones may contact compatible networks operated for or by another service provider, and gain service. To administer the cellular network system, provide subscribed services, and accurately bill or debit subscriber accounts, data about the service contract and associated service activities are captured and maintained by the network system.
As the name implies, cellular networks provide coverage based on dividing up a large geographical service area into smaller areas of coverage called cells. Cells play an important role in reuse of radio frequencies in the limited radio spectrum available to allow more calls to occur than otherwise would be possible. As a mobile phone moves from one cell to another, however, a cellular arrangement requires active connections to be monitored and effectively passed along between cells to maintain the connection
Despite their differences in technology, cellular networks are organized similarly to one another, in a manner illustrated in Figure 1. The main components are the radio transceiver equipment that communicates with mobile phones, the controller that manages the transceiver equipment and performs channel assignment, and the switching system for the cellular network. The technical names for these components are respectively the Base Transceiver Station (BTS), the Base Station Controller (BSC), and the Mobile Switching Center (MSC). The BSC and the BTS units it controls are sometimes collectively referred to as a Base Station
1 Available at the following site: http://www.tiaonline.org/standards/technology/cdma2000/cdma2000table.cfm
7
Guidelines on Cell Phone Forensics
Subsystem. The transceivers at the BTS can be configured in a variety of ways. A typical configuration involves three distinct sectors of 120 degree coverage: 0 degrees North to 120 degrees Southeast, 120 degrees Southeast to 240 degrees Southwest, and 240 degrees Southwest to 360 degrees North. A cell identifier uniquely identifies the BTS and sector involved in servicing a call.
Figure 1: Cellular Network Organization
The MSC controls a set of BSCs and manages overall communications throughout the cellular network, including interfacing to the public switch telephone network. To perform its tasks, the MSC uses several databases. A key database is the central repository system for subscriber data and service information, called the Home Location Register (HLR). Another database used in conjunction with the HLR for mobile phones roaming outside of their service area is the Visitor Location Register. Account information, such as data about the subscriber (e.g., a billing address), the subscribed services, and the location update last registered with the network are maintained at the HLR and used by the MSC to route calls and messages and to generate usage records called call detail records. The subscriber account data and call detail records are often a valuable source of evidence in an investigation.
2.2 Mobile Phone Characteristics
Mobile phones are highly mobile communications devices that perform an array of functions ranging from that of a simple digital organizer to that of a low-end personal computer. Designed for mobility, they are compact in size, battery powered, and lightweight. Most cell phones have a basic set of comparable features and capabilities. They house a microprocessor, read only memory (ROM), random access memory (RAM), a radio module, a digital signal processor, a microphone and speaker, a variety of hardware keys and interfaces, and a liquid crystal display (LCD). The operating system (OS) of the device is held in ROM, which with the proper tools typically can be erased and reprogrammed electronically. RAM, which for 8
Guidelines on Cell Phone Forensics
certain models may be used to store user data, is kept active by batteries, whose failure or exhaustion causes that information to be lost.
The latest cell phones come equipped with system-level microprocessors that reduce the number of supporting chips required and include considerable memory capacity. Built-in Mini Secure Digital (MiniSD)2, MultiMedia Card Mobile (MMCmobile)3, or other types of card slots support removable memory cards or specialized peripherals, such as an SDIO WiFi card. Wireless communications such as infrared (i.e., IrDA) or Bluetooth may also be built into the device.
Different devices have different technical and physical characteristics (e.g., size, weight, processor speed, memory capacity). Devices may also use different types of expansion capabilities to provide additional functionality. Furthermore, cell phone capabilities sometimes include those of other devices such as PDAs, global positioning systems, and cameras. Overall, they can be classified as basic phones that are primarily simple voice and messaging communication devices; advanced phones that offer additional capabilities and services for multimedia; and smart phones or high-end phones that merge the capabilities of an advanced phone with those of a PDA. Table 1 highlights the general hardware characteristics of basic, advanced, and smart phone models, which underscore this diversity.
Table 1: Hardware Characterization
Basic
Advanced
Smart
Processor
Limited Speed
Improved Speed
Superior Speed
Memory
Limited Capacity
Improved Capacity
Superior Capacity, Built-in Hard Drive Possibility
Display
Grayscale
Color
Large size, 16-bit Color (65,536 colors) or Higher
Card Slots
None
MiniSD or MMCmobile
MiniSDIO or MMCmobile
Camera
None
Still
Still, Video
Text Input
Numeric Keypad
Numeric Keypad, Soft Keyboard
Touch Screen, Handwriting Recognition, Built-in QWERTY-style Keyboard
Cell Interface
Voice and Limited Data
Voice and High Speed Data
Voice and Very High Speed Data
Wireless
IrDA
IrDA, Bluetooth
IrDA, Bluetooth, WiFi
Battery
Fixed, Rechargeable Lithium Ion Polymer
Removable, Rechargeable Lithium Ion Polymer
Removable, Rechargeable Lithium Ion
Note that the characteristics used in this classification scheme are illustrative. The features of actual devices do vary and can span more than one category identified. Over time, advanced
2 The Secure Digital home page can be found at: http://www.Sdcard.org
3 The MultiMediaCard home page can be found at: http://www.mmca.org
9
Guidelines on Cell Phone Forensics
features also tend to appear in more basic phones as new ones are added to the high end. Though the lines among this classification scheme are somewhat fuzzy and dynamic, it nevertheless serves as a general guide.
Despite the type of cell phone, nearly all devices support voice and text messaging, a set of basic Personal Information Management (PIM) applications that includes phonebook and date book facilities, and a means to synchronize PIM data with a desktop computer. More advanced devices also provide the ability to perform multimedia messaging, connect to the Internet and surf the Web, exchange electronic mail, or chat using instant messaging. They may also provide enhanced PIM applications that work with specialized built-in hardware, such as a camera.
Finally, very high-end devices called smart phones add PDA-like capability for reviewing electronic documents (e.g., reports, briefing slides, and spreadsheets) and running a wide variety of general and special-purpose applications. Smart phones are typically larger than other phones, support a bigger-size display (e.g., ¼ VGA and higher), and may have an integrated QWERTY keyboard or touch sensitive screen. They also offer more extended expansion capabilities through peripheral card slots, other built-in wireless communications such as Bluetooth and WiFi, and synchronization protocols to exchange other kinds of data beyond basic PIM data (e.g., graphics, audio, and archive file formats). Table 2 lists the differences in software capabilities found on these device classes.
Table 2: Software Characterization
Basic
Advanced
Smart
OS
Proprietary
Proprietary
Linux, Windows Mobile, RIM OS, Palm OS, Symbian
PIM
Simple Phonebook
Phonebook and Calendar
Reminder List, Enhanced Phonebook and Calendar
Applications
None
MP3 Player
MP3 Player, Office Document Viewing
Messaging
Text Messaging
Text with Simple Embedded Images and Sounds (Enhanced Text)
Text, Enhanced Text, Full Multimedia Messaging
Chat
None
SMS Chat
Instant Messaging
Email
None
Via Network Operator’s Service Gateway
Via POP or IMAP Server
Web
None
Via WAP Gateway
Direct HTTP
Wireless
IrDA
IrDA, Bluetooth
IrDA, Bluetooth, WiFi
The basic and advanced cell phones typically use a company proprietary operating system. A number of companies specializing in embedded software also offer real-time operating system solutions for manufacturers of portable devices, including cell phones. Nearly all cell phones claiming to be smart phones use one of the following operating systems: Palm OS, Windows Mobile (phone edition), RIM OS, Symbian OS, or Linux. Unlike the more limited, real-time kernels in basic and advanced phones, these operating systems are multi-tasking and full-featured, designed specifically to match the capabilities of high-end mobile devices. Besides a wide array of applications, they often come complete with a Java Virtual Machine and native
10
Guidelines on Cell Phone Forensics
application support using a Software Development Kit (SDK) for C++ or another language. Characteristics of a wide range of past, current, and future cell phones can be found on manufacturer and vendor Web sites, as well as product review sites.4
2.3 Identity Module Characteristics
Subscriber Identity Modules are synonymous with mobile phones and devices that interoperate with GSM cellular networks. Under the GSM framework, a cellular phone is referred to as a Mobile Station and is partitioned into two distinct components: the Subscriber Identity Module (SIM) and the Mobile Equipment (ME). As the name implies, a SIM is a removable component that contains essential information about the subscriber. The ME, the remaining radio handset portion, cannot function fully without one. The SIM’s main function entails authenticating the user of the cell phone to the network to gain access to subscribed services. The SIM also provides storage for personal information, such as phone book entries and text messages, as well as service-related information.
The SIM-ME partitioning of a cell phone stipulated in the GSM standards has brought about a form of portability. Moving a SIM between compatible cell phones automatically transfers with it the subscriber’s identity and the associated information and capabilities. In contrast, present-day CDMA phones do not employ a SIM. Analogous SIM functionality is instead directly incorporated within the device. While SIMs are most widely used in GSM systems, comparable modules are also used in iDEN phones and UMTS user equipment (i.e., a USIM). Because of the flexibility a SIM offers GSM phone users to port their identity, personal information, and service between devices, eventually all cellular phones are expected to include (U)SIM-like capability. For example, requirements for a Removable User Identity Module (R-UIM), as an extension of SIM capabilities, have been specified for cellular environments conforming to TIA/EIA/IS-95-A and -B specifications, which include Wideband Spread Spectrum based CDMA [3GP02].
At its core, a (U)SIM is a special type of smart card that typically contains a processor and between 16 to 128 KB of persistent electronically erasable, programmable read only memory (EEPROM). It also includes RAM for program execution and ROM for the operating system, user authentication and data encryption algorithms, and other applications. The (U)SIM’s hierarchically organized file system resides in persistent memory and stores such things as names and phone number entries, text messages, and network service settings. Depending on the phone used, some information on the (U)SIM may coexist in the memory of the phone. Information may also reside entirely in the memory of the phone instead of available memory reserved for it in the file system of the (U)SIM [Wil05, Jan06].
The (U)SIM operating system controls access to elements of the file system [3GP05a]. Actions such are reading or updating can be permitted or denied unconditionally, or allowed conditionally with certain access rights. Rights are assigned to a subscriber through 4-8 digit Personal Identification Number (PIN) codes. PINs protect core (U)SIM subscriber-related data and certain optional data. PIN codes can be modified by the subscriber, and their function disabled or enabled. A preset number of attempts, usually three, are allowed for providing the correct PIN code to the (U)SIM before further attempts are blocked completely, rendering communications inoperative. Only by providing a correct PIN Unblocking Key (PUK) can the
4 For example, specifications and product reviews for many current cell phones can be found at http://www.cnet.com. 11
Guidelines on Cell Phone Forensics
value of a PIN and its attempt counter be reset on the (U)SIM. If the number of attempts to enter the correct PUK value exceeds a set limit, normally ten attempts, the card becomes blocked permanently. The PUK for a PIN can be obtained from the service provider or network operator by providing the identifier of the SIM (i.e., its Integrated Circuit Chip Identifier or ICCID). The ICCID is normally imprinted on the (U)SIM, but can also be read from an element of the file system.
(U)SIMs have a width of 25 mm, a height of 15 mm, and a thickness of .76 mm, which is roughly the footprint of a postage stamp. Though similar in dimension to a MiniSD or an MMCmobile removable memory card supported by some cell phones, (U)SIMs follow a different set of specifications with vastly different characteristics. For example, their pin connectors are not aligned along a bottom edge as with removable media cards, but instead form a circular contact pad integral to the smart card chip, which is embedded in a plastic frame, as shown in Figure 2. (U)SIMs also employ a broad range of tamper resistance techniques to protect the information they contain.
Figure 2: (U)SIM Format
The slot for the (U)SIM card is normally not accessible from the exterior of the phone to facilitate frequent insertion and removal as with a memory card. Instead, it typically is found in the battery compartment under the battery. When a (U)SIM is inserted into a phone handset and pin contact is made, a serial interface is used for communicating between them. A (U)SIM can be removed from a phone and read using a specialized (U)SIM reader and software through the same interface. Standard-size smart card adapters are also available for (U)SIMs, which allows them to be inserted into and read with a conventional smart card reader.
Authenticating a device to a network securely is a vital function performed via the SIM. Cryptographic key information and algorithms within the tamper resistant module provide the means for the device to participate in a challenge-response dialogue with the network and respond correctly, without exposing key material and other information that could be used to clone the SIM and gain access to a subscriber’s services. Cryptographic key information in the SIM also supports stream cipher encryption to protect against eavesdropping on the air interface [Ved93, Wil03].
12
Guidelines on Cell Phone Forensics
3. Forensic Tools
The situation with forensic software tools for cell phones is considerably different from personal computers. While personal computers are designed as general-purpose systems, cell phones are designed more as special-purpose appliances that perform a set of predefined tasks. Cellular phone manufacturers also tend to rely on assorted proprietary operating systems rather than the more standardized approach found in personal computers. Because of this, the variety of toolkits for mobile devices is diverse and the range of devices over which they operate is typically narrowed to distinct platforms for a manufacturer’s product line, an operating system family, or a type of hardware architecture. Short product release cycles are the norm for cellular phones, requiring tool manufacturers to update their tools continually to keep coverage current. The task is formidable and tool manufacturers’ support for newer models often lags significantly. Some have argued that the current state is likely to continue, keeping the cost of examination significantly higher than if a few standard operating systems prevailed [Moo06].
Forensic tools acquire data from a device in one of two ways: physical acquisition or logical acquisition. Physical acquisition implies a bit-by-bit copy of an entire physical store (e.g., a memory chip), while logical acquisition implies a bit-by-bit copy of logical storage objects (e.g., directories and files) that reside on a logical store (e.g., a file system partition). The difference lies in the distinction between memory as seen by a process through the operating system facilities (i.e., a logical view), versus memory as seen in raw form by the processor and other related hardware components (i.e., a physical view).
Physical acquisition has advantages over logical acquisition, since it allows deleted files and any data remnants present (e.g., in unallocated memory or file system space) to be examined, which otherwise would go unaccounted. Extracted device images need to be parsed, decoded, and translated to uncover the data present. The work is tedious and time consuming to perform manually. Physical device images can be imported into a tool to automate examination and reporting, however, only a few tools tailored for obtaining cell phone images are currently available. A logical acquisition, though more limited than a physical acquisition, has the advantage that the system data structures are normally easier for a tool to extract and provide a more natural organization to understand and use during examination. If possible, doing both types of acquisition is preferable – a physical acquisition before a logical acquisition.
Figure 3: Data Acquisition, Decoding, and Translation
13
Guidelines on Cell Phone Forensics
Most forensic software tools for cell phones and (U)SIMs acquire data logically, using common device protocols for synchronization, communications, and debugging, as shown in Figure 3 [Gra02, Mcc05]. Some tools may also be capable of acquiring data physically for certain classes of phones. AT commands, Sync ML, and the other protocols listed are commonly used in the logical acquisition of cell phones. Because handsets can support multiple protocols, a tool may employ several of them in succession to acquire the broadest range of available data. Even if a tool uses multiple protocols for a particular handset, all of the data available may not be able to be retrieved.
Different tools can use a different protocol to acquire the same data. Table 3 illustrates the protocol exchanges used by several tools to acquire the IMEI (i.e., ASCII value of 356661005704092) from a Nokia 6101 cell phone. The first tool listed uses a standardized AT Command exchange [Nok05], while the other two tools use the FBUS protocol [Pea05]. While many of the protocols are standardized and publicly available, some such as MBUS and FBUS are proprietary. Even standardized protocols often include manufacturer extensions or variants. (U)SIMs follow stricter standards than handsets and the application protocol data unit (APDU) interface protocol listed in Figure 3 is normally used exclusively with them.
Table 3: Example IMEI Acquisition
Request/Response (Hex)
Request/Response (ASCII)
41 54 2B 43 47 53 4E 0D
A T + C G S N .
GSM .XRY
0D 0A 33 35 36 36 36 31 30 30 35 37 30 34 30 39 32 0D 0A 0D 0A 4F 4B 0D 0A
. . 3 5 6 6 6 1 0 0 5 7 0 4 0 9 2 . . . . O K . .
1E 00 0C 7F 00 02 D2 01 C0 7C 1E 00 10 1B 00 07 00 01 00 00 41 01 41 00 0E 1C
. . . . . Ò . À | . . . . . . . . . . A . A . . .
PhoneBase
1E 10 00 7F 00 02 1B 01 05 6C 1E 10 00 1B 00 1C 01 39 00 01 00 01 41 14 00 10 33 35 36 36 36 31 30 30 35 37 30 34 30 39 32 00 01 42 5B 50
. . . . . . . . l . . . . . . . 9 . . . . A . . . 3 5 6 6 6 1 0 0 5 7 0 4 0 9 2 . . B [ P
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55
… (6 more rows)
1E 00 10 1B 00 07 00 04 00 00 41 01 60 00 2F 19
U U U U U U U U U U U U U U U U U U U U U U U U U U U U U U
…
. . . . . . . . . . A . ` . / .
Secure View
1E 10 00 7F 00 02 1B 00 05 6D 1E 10 00 1B 00 1C 04 39 00 01 00 01 41 14 00 10 33 35 36 36 36 31 30 30 35 37 30 34 30 39 32 00 01 45 5E 57
. . . . . . . . m . . . . . . . 9 . . . . A . . . 3 5 6 6 6 1 0 0 5 7 0 4 0 9 2 . . E ^ W
The raw data logically acquired from a phone or (U)SIM is often encoded unconventionally, such as with text represented in the 7-bit GSM alphabet, and difficult to interpret. Other encodings that can be encountered include Binary Coded Decimal (BCD) and Unicode. To facilitate interpretation, most tools decode the data for the operator, as illustrated in Figure 3. Some tools go a step further and, where appropriate, translate the decoded data (e.g., numeric codes representing a country and a network operator) into more meaningful forms (e.g., country and network operator names) using a database (DB).
The types of software tools available for cell phone examination include commercial forensic tools, device management tools, open source tools, self-developed tools, diagnostic tools, and hacker tools. Forensic tools are typically designed to acquire data from the internal memory of
14
Guidelines on Cell Phone Forensics
a handset and any removable identity modules such as SIMs found in GSM and other types of phones. Both forensic and non-forensic software tools often use the same protocols to communicate with the device. However, non-forensic tools allow a two-way flow of information to enhance or customize one’s cellular device (e.g., to add customized phone rings, wallpaper, themes, etc.), while forensic tools are designed specifically to acquire data from the device without altering device content and to calculate integrity hashes over the acquired data. Most practitioners use a collection of both forensic and non-forensic tools along with other accessories to form their “toolbox.”5 Tools not designed specifically for forensic purposes are questionable, however [New07]. Before considering their use, they should be thoroughly evaluated and the implications of any associated forensic issues should be fully understood. In some situations, non-forensic tools might be the only means to retrieve data that could be relevant as evidence and may be appropriate to use when the proper precautions are taken.
Port Monitoring: On occasion one might be faced with having to use a non-forensic tool, such as a phone manager, to recover data. Besides using test phones in thoroughly evaluating and understanding the tool, some additional steps can be considered. One of the easiest things to do, not only during the tool evaluation, but also during an actual acquisition once the evaluation has been completed, is to capture the protocol exchanges that occur over the serial connection between the phone and forensic workstation. Port monitors with such logging capabilities for cabled devices include Portmon6 and Serial Monitor.7 Infrared and Bluetooth monitoring is also possible using a separate workstation to eavesdrop on the wireless communications.
During evaluation, the protocol exchanges can be analyzed for specific actions taken at the user interface and benign actions identified. During an actual acquisition, capturing the protocol exchanges serves as a record of the events that occurred, which can be kept for reference to refute any concerns that may be raised at a later time.
Port monitoring can also be carried out with a forensic tool to gain insight on its operation or simply to capture a complete log of an acquisition. For example, the entries shown in Table 3 were captured this way. Monitoring of (U)SIM tool exchanges can be done similarly. Built-in logging of protocol exchanges is a useful feature that some forensic tools provide, and precludes the need for a separate tool.
While most forensic tools support a full range of acquisition, examination, and reporting functions, some tools focus only on a subset. Different tools may also support different interfaces (e.g., IrDA, Bluetooth, or serial cable) to acquire device contents. Acquisition through a cable interface generally yields superior results than other interfaces. However, under certain conditions, a wireless interface such as infrared or Bluetooth can serve as a reasonable alternative (e.g., when the correct cable is not readily available and the forensic issues of using another interface are understood). Regardless of the interface used, vigilance of the potential forensic issues associated is paramount. For example, Bluetooth typically involves an exchange of information with the forensic workstation to setup a connection,
5 For an example of recommended tools to include in an investigator’s toolkit, see http://www.search.org/files/pdf/CellphoneInvestToolkit-0806.pdf.
6 For more information, see http://www.sysinternals.com/Utilities/Portmon.html.
7 For more information, see http://www.hhdsoftware.com/sermon.html.
15
Guidelines on Cell Phone Forensics
which is then retained on the device. Enabling the connection and pairing the device to the workstation also requires key entries on the handset.
Most forensic software tools address a wide range of applicable devices, handle the most common investigative situations, and require a modest level of skill to operate. Table 4 gives an overview of available tools used in cell phone investigations, and identifies the facilities they provide: acquisition, examination, or reporting. Additional tools do exist, but only those familiar to the authors are discussed. The tools are grouped into tools that target SIMs exclusively, tools that target handsets exclusively, and toolkits that target both handsets and SIMs. The range of devices a tool addresses is often narrowed to those from certain manufacturers, with specific operating systems, or with distinct hardware architectures. To cover the broadest range of mobile phones and (U)SIMs, a set of several tools is required. More detailed information about the performance forensic tools can be found in two companion reports [Aye05, Aye07]. The remaining sections of this chapter give a synopsis for each category of tool and an overview of their capabilities. Note that the capabilities of the tools listed are constantly improving and may differ slightly from the description given.
Table 4: Forensic Tools
Function
Target Devices
Forensic Card Reader
Acquisition, Reporting
􀂃 SIMs
ForensicSIM
Acquisition, Examination, Reporting
􀂃 SIMs and USIMs
SIMCon8
Acquisition, Examination, Reporting
􀂃 SIMs and USIMs
SIMIS
Acquisition, Examination, Reporting
􀂃 SIMs and USIMs
USIMdetective
Acquisition, Examination, Reporting
􀂃 SIMs and USIMs
BitPIM
Acquisition, Examination
􀂃 Certain CDMA phones using Qualcomm chipsets
Oxygen PM (forensic version)
Acquisition, Examination, Reporting
􀂃 Nokia phones
Oxygen PM for Symbian (forensic version)
Acquisition, Examination, Reporting
􀂃 Symbian phones
PDA Seizure9
Acquisition, Examination, Reporting
􀂃 Palm OS, Windows Mobile/Pocket PC, and Blackberry devices
Pilot-Link
Acquisition
􀂃 Palm OS devices
8 During the preparation of this guide, SIMCon was acquired by Paraben and incorporated into its product line.
9 During the preparation of this guide, PDA Seizure was incorporated into Device Seizure, a forensic application for mobile devices. For more information, see www.paraben-forensics.com.
16
Guidelines on Cell Phone Forensics
Function Target Devices
Cell Seizure10
Acquisition, Examination, Reporting
􀂃 TDMA, CDMA, and GSM phones
􀂃 SIMs and USIMs
CellDEK
Acquisition, Examination, Reporting
􀂃 GSM and CDMA phones
􀂃 SIMs and USIMs
GSM .XRY
Acquisition, Examination, Reporting
􀂃 GSM and CDMA phones
􀂃 SIMs and USIMs
MobilEdit!
Acquisition, Examination, Reporting
􀂃 GSM phones
􀂃 SIMs
PhoneBase
Acquisition, Examination, Reporting
􀂃 GSM phones
􀂃 SIMs and USIMs
Secure View
Acquisition
Examination
Reporting
􀂃 TDMA, CDMA, and GSM phones
􀂃 SIMs
TULP 2G
Acquisition, Reporting
􀂃 GSM phones
􀂃 SIMs
3.1 (U)SIM Tools
A few forensics tools deal exclusively with (U)SIMs. These tools perform a direct read of a module’s contents via a (U)SIM reader, as opposed to an indirect read via the phone handset. The richness and scope of data acquired varies with the capabilities and features of the tool. The majority of (U)SIM exclusive tools acquire the following data: International Mobile Subscriber Identity (IMSI), Integrated Circuit Card ID (ICCID), Abbreviated Dialling Numbers (ADN), Last Numbers Dialled (LND), SMS messages, and Location Information (LOCI) [Aye05, Aye07].
More capable tools provide additional information such as deleted SMS messages, properly rendered foreign language SMS messages, and EMS messages with simple graphics and sounds embedded [Jan06]. They also attempt to translate certain data such as country and network operator codes into meaningful names, and provide other facilities such as PIN administration. Below is a brief overview of some tools that are designed to acquire data specifically from SIMs.
􀂄 Forensic Card Reader (FCR) is a forensic tool from Becker & Partner that provides the means to extract data from SIMs. FCR does not generate a case file, but outputs the acquired data in an XML-format that can be viewed with the appropriate editor. FCR consists of the software and a proprietary USB smart card reader necessary for acquisition. Neither integrity hash protection nor customizable report facilities are provided.
10 During the preparation of this guide, Cell Seizure was incorporated into Device Seizure, a forensic application for mobile devices. For more information, see www.paraben-forensics.com.
17
Guidelines on Cell Phone Forensics
􀂄 The Forensic SIM Toolkit (FST) is a forensic tool from Radio Tactic that provides the means to extract and duplicate data from SIMs/USIMs. The case file is stored in a proprietary FST format and can be output in either an HTML or RTF/Word file-format. A USB dongle is needed to operate the software on a desktop computer. The FST acquisition terminal, a standalone unit, duplicates the contents of the target (U)SIM to a set of FST data storage cards (i.e., the Master Data Storage Card, Defense Data Storage Card, and Prosecution Data Storage Card). Data analysis can be carried out using the appropriate FST data storage card with the ForensicSIM card reader (i.e., PC/SC-compatible card reader) attached to a PC running the ForensicSIM analysis application. An MD5 checksum provides integrity protection for the generated case data. FST allows the import of archived case files and basic searches of the acquired data file.
􀂄 SIMCon is a forensic tool from InsideOut Forensics that provides the means to extract data from SIMs and USIMs. The case file has a proprietary format but can be exported to a standard ASCII text format. Additional hardware (e.g., USB dongle, proprietary card readers) are not necessary for acquisition. SIMCon acquires data from a (U)SIM via a PC/SC-compatible card reader and uses a SHA1 hash to protect the integrity of the generated case data. SIMCon provides the ability to import archived case files and export specific data out into a final report.
􀂄 SIMIS is a forensic tool from Crownhill USA that provides means to extract data from SIMs and USIMs. The case file is generated in an HTML file-format. An additional “SIM dump” feature provides a more detailed case file in a standard ASCII text format. A USB dongle is needed to operate the software on a desktop computer. SIMIS acquires information from a (U)SIM via a PC/SC-compatible card reader and generates MD5 and SHA2 hashes of the acquired data. SIMIS provides the ability to create report notes, import archived case files, search acquired data, and administer PINs. The search function can range over any archived SIMs present in the program folder.
􀂄 Quantaq Solutions’ USIMdetective SIM acquisition tool provides examiners with the ability to acquire, examine, and produce reports from any SIM or USIM card using a PC/SC compatible reader. Acquired elements can be displayed in a textual or hexadecimal format. USIMdetective uses an internal hashing facility to ensure the integrity of case. Image Integrity Check (.iic) files are created with each acquisition to protect against data tampering. SHA1 and MD5 hashes ensure that the original acquired file is consistent with the reopened case file. USIMdetective provides multiple report output types ranging from a “Standard Report” to a more detailed “File Content Report.”
3.2 Handset Tools
A few forensic tools deal with handsets exclusively, designed strictly for the acquisition of their internal memory. These tools sometimes stem from tools aimed at pure PDA devices and thus are useful with smart phones that incorporate operating systems with a PDA heritage, such as Palm OS and Windows Mobile devices. Others have arisen from phone management software modified to disable writing to the device. They generally exclude the capability to acquire data from SIMs using a direct read. Below is a brief overview of some tools designed for memory acquisition from mobile devices with cellular capabilities.
18
Guidelines on Cell Phone Forensics
􀂄 PDA Seizure is a forensic software toolkit from Paraben that provides the means to extract data from mobile devices running Palm OS, Windows CE, and RIM OS. The case file has a proprietary format and can be output in an HTML file format. Acquisition occurs via a cable, IrDA, or Bluetooth interface; no additional hardware is necessary. Although the tool can be used with smart phones, the toolkit is oriented toward non-cellular devices. PDA Seizure’s features include the ability to perform a logical acquisition and, for certain devices, a physical acquisition, providing views of internal memory as well as individual files and databases. An MD5 message digest is created for individual data objects and the overall case file. Additionally, the case files are encrypted to prevent tampering and data modification. PDA Seizure provides examiners with the ability to create customized reports and report notes, import archived case files, bookmark significant findings, and search the acquired data.
􀂄 Pilot-link is a non-forensic open source software suite originally developed for the Linux community as a means to transfer data between Linux hosts and Palm OS devices. Pilot-link provides the ability to extract RAM, ROM and individual files present on Palm OS devices. Two programs of interest to forensic examiners are pi-getram and pi-getrom, which respectively retrieve the physical contents of RAM and ROM from a device. Another useful program is pilot-xfer, which provides a means to acquire the contents of a device logically. Neither an overall case file, integrity hash computation, nor customizable report facility are provided.
􀂄 The forensic version of Oxygen Phone Manager (OPM) from Oxygen Software is a variant of the phone management product of the same name, which works mainly on Nokia phones. The forensic version differs from the non-forensic version by prohibiting modification to the target device. OPM provides examiners with the ability to extract data from cellular devices operating over the GSM network. OPM does not allow examiners to export an overall case file; however, acquired data is stored in multiple files (e.g., Phonebook, SMS, and Gallery) that correlate with the related function. OPM does not protect acquired data via hashing functions. Acquired data can be exported out into various supported format types.
􀂄 A forensic version of Oxygen Phone Manager for Symbian devices, from Oxygen Software, also exists. The tool targets mobile phones and smart phones that use the Symbian OS. The above-mentioned characteristics of OPM apply equally to OPM for Symbian devices.
􀂄 BitPIM is open source software available under the GNU General Public License. It is a phone management program that allows the viewing and manipulation of data primarily from CDMA cell phones by various manufacturers. A read-only check box is provided to disable writing to the phone when used for acquisition. BitPIM does not allow examiners to export or save an overall case file; however, acquired data is stored in multiple files (e.g., Phonebook, SMS, and Filesystem) and can be exported in common formats for reporting purposes. BitPIM does not protect acquired data via hashing functions.
􀂄 Phone flashing tools are available for different families of cell phones from a variety of sources. These tools are intended to load new versions of software into the memory of a phone as a means of repair and upgrade. While they do provide the means to acquire handset memory physically, they are strictly non-forensic in nature,
19
Guidelines on Cell Phone Forensics
have little documentation and support, and do not compute an integrity hash over acquired data. Phone flashers should be used with extreme caution only after sufficient testing and study is done. Mapping the layout of recovered memory, identifying objects, and decoding data is time-consuming to perform manually. However, the process can recover such things as phone locks, deleted data, and other useful information normally not recoverable through a logical acquisition, such as historical information (e.g., the IMSI of previous (U)SIMs used with the phone).
3.3 Integrated Toolkits
Several toolkits incorporate the capabilities of both (U)SIM and handset tools under a unified framework. One advantage for those devices that involve (U)SIMs is that the results of handset and (U)SIM examinations can appear within the same generated report. This advantage disappears if another tool is used for either device, such as in the case where a particular handset might not be supported by the tool.
􀂄 Cell Seizure from Paraben is a forensic software toolkit that provides the means to extract data from GSM and non-GSM (i.e., CDMA, TDMA) cellular devices and (U)SIMs. The case file is in a proprietary format and case data can be output in either an ASCII or HTML format. Acquisition occurs via a cable, IrDA, or Bluetooth interface. Cell Seizure also allows direct acquisition of (U)SIM cards with the included RS-232 SIM card reader. The package comes complete with cables and drivers for supported phones, as well as the application software. Cell Seizure’s features include the ability to perform a logical and physical acquisition, providing views of internal memory as well as individual files and databases. MD5 and SHA1 hash values are created for individual data objects and an overall message digest of the acquired case data is calculated. The case file is also encrypted, preventing tampering and data modification. Cell Seizure provides examiners with the ability to create customized reports and report notes, import archived case files, bookmark significant findings, and search the acquired data.
􀂄 CellDEK from Logicube Inc. is designed to acquire data from cell phones operating over GSM and non-GSM networks, PDAs, SIM cards and flash-based media. The CellDEK terminal contains an embedded touch-screen PC, data cables for various devices, a PC/SC SIM card reader, and a write-protected memory card reader, packaged in a rugged, watertight carrying case. The unit provides the ability to connect to cell phones and PDAs via a cable, Bluetooth or IrDA connection. Acquisitions are stored on the CellDEK’s hard disk and can be moved or backed up to a USB thumb drive. All data is individually hashed using the MD5 algorithm to ensure that the integrity of the data can be verified. CellDEK generates report files in an HTML format, containing all of the data recovered. Reports can be customized with company logos and case details when entered by the examiner before acquiring the device.
􀂄 GSM .XRY is a forensic software toolkit from Micro Systemation that provides the means to extract data from GSM and non-GSM (i.e., CDMA) cellular devices and SIM/USIM cards. A USB dongle is needed to operate the software. The GSM .XRY hub provides an interface for the dongle and device cables, and interfaces for Bluetooth and IrDA. The package comes complete with cables and drivers for supported phones, as well as the application software. Data acquired from cell phone 20
Guidelines on Cell Phone Forensics
devices are stored in the proprietary .XRY format and cannot be altered, but can be exported into external formats and viewed with third-party applications. GSM .XRY encrypts case data and compares digital signatures for consistency when previously stored case data is re-opened for examination. Additionally, case files can be locked and password protected, providing an extra layer of security against alteration. GSM .XRY provides the ability to create customized reports, import archived case files, and perform searches on the acquired data.
􀂄 MOBILedit! Forensic from Compelson Labs is an application that provides the means to acquire data logically from GSM or non-GSM (i.e., CDMA) devices and SIM cards. The tool is based on the non-forensic phone management software of the same name. Phone data can be acquired via cable, Bluetooth, or IrDA, and via a PC/SC compatible card reader for SIMs. Acquired data is stored in a proprietary case file format and can be exported to XML. Mobiledit! provides the ability to create customized reports, import archived case files and perform search queries on specific folders. Mobiledit! does not protect acquired data via hash value computations.
􀂄 PhoneBase 2 from Envisage Systems Ltd. provides the means to acquire data from GSM and non-GSM cellular devices and data contained on (U)SIMs. PhoneBase 2 uses the MOBILedit! acquisition engine for its handset support, but complements that with its own facility for (U)SIM acquisition. A USB dongle is needed to operate the software. Data can be acquired via cable, Bluetooth, IrDA or a PC/SC compatible card reader for SIMs. Acquired data is stored in a common database format and protected from tampering via a PhoneBase security (pbs) file. PhoneBase 2 provides examiners with the ability to create customized reports, import archived case files and perform search queries over multiple cases.
􀂄 Secure View is a commercial forensic tool from Susteen, derived from the company’s Datapilot phone management software, which provides examiners with the ability to extract data from cellular devices operating over GSM and non-GSM (i.e., CDMA, TDMA) networks. Recent versions of Secure View also can acquire SIM card data using a PC/SC-compatible reader. Secure View does not allow examiners to export an overall case file; however, acquired data is stored in multiple files (e.g., Address book, SMS, Graphics, and Audio) that correlate with the related function. The package comes complete with cables and drivers for supported phones, and the application software. Secure View does not protect acquired data via hashing functions. However, data can be password protected, allowing only authorized access. Secure View provides a search engine that allows a subset of the acquired data to be analyzed and the ability to import pre-existing case data.
􀂄 TULP2G (2nd generation) is an open source forensic software tool from the Netherlands Forensic Institute that provides the means to acquire data from cellular GSM and non-GSM (i.e., CDMA) devices and SIMs [Bos05]. Data can be acquired via a cable, Bluetooth or IrDA interface. Reading SIMs requires a PC/SC-compatible smart card reader. TULP2G generates a set of raw data in XML format, which can be converted to a readable format using embedded XSL stylesheets. SHA1 and MD5 hashes are created over the entire case file, ensuring the integrity of acquired data. TULP2G provides the ability to create a report over selected data elements or the entire case file and import archived case files.
21
Guidelines on Cell Phone Forensics
Tool Segregation: With the use of multiple forensic tools, the possibility exists for conflicts to occur among certain ones. Resolving such conflicts can sometimes be onerous and time consuming, and may need to be repeated across a number of forensic workstations. One method to avoid these problems is to use a product such as VMware to create a virtual machine environment on each forensic workstation for the tool to execute.
Each software tool and its operating system can be installed in a distinct virtual machine environment, independently from other tools, effectively segregating each tool from the others. Compatible collections of tools could also be isolated from incompatible tools this way. Cloning the virtual machine with the installed tool or tool collection can be done to baseline a configuration for distribution and execution at other workstations’ virtual machines, establishing a common computational environment throughout an organization while simplifying the configuration process. Since multiple independent virtual machines can run simultaneously on a single workstation, several tools or tool collections that otherwise would be incompatible are readily supported.
3.4 Capabilities
Forensic software tools strive to address a wide range of applicable devices to handle the most common investigative situations with modest skill level requirements and keep the device intact. More difficult situations, such as the recovery of deleted data, require more specialized tools and expertise, and often disassembly of the device [Wil05]. The range of support provided, including phone cables and drivers, product documentation, (U)SIM readers, and updates, can vary significantly among products. The features offered such as searching, bookmarking, and reporting capabilities can also vary considerably.
Quality measures should be applied when first choosing a tool to ensure its acceptability and reapplied when updates or new versions of the tool become available to uphold consistency. Validating a tool entails defining a comprehensive test data set, loading it onto the device using the same methods a user would, and following procedures to acquire and recover the test data [Goo03, Aye05, Aye07]. While tool validation can be time consuming to perform, it is a necessary standard quality practice to follow. Forensic specialists should also receive adequate up-to-date training in the tools and procedures to employ, as a quality measure.
Mobile phone forensic tools are in their early stages of maturity. They typically have limitations in both the breadth of the devices supported and the depth of evidence recovered. Subtle errors may also be encountered in their use. For example, a data item displayed on screen may vary from the same item appearing in a generated report. Practice and experience with a tool can normally compensate for such problems and procedures can be adapted accordingly. Occasionally, new versions of a tool may fail to perform as well as a previous one.
The most important characteristic of a forensic tool is its ability to maintain the integrity of the original data source being acquired and also that of the extracted data. The former is done by blocking or otherwise eliminating write requests to the device containing the data. The latter is done by calculating a cryptographic hash of the contents of the evidence files created and recurrently verifying that this value remains unchanged throughout the lifetime of those files. Preserving integrity not only maintains credibility from a legal perspective, but it also allows any subsequent investigation to use the same baseline for replicating the analysis.
22
Guidelines on Cell Phone Forensics
Forensic Hash: A forensic hash is used to maintain the integrity of an acquisition by computing a cryptographically strong, non-reversible value over the acquired data. After acquisition, any changes made to the data can be detected, since a new hash value computed over the data will be inconsistent with the old value. For non-forensic tools, hash values should be created manually using a tool such as sha1sum or md5sum and retained for integrity verification. Even tools labeled as forensic tools may not compute a cryptographic hash, and an integrity hash should be computed manually.
Note that mobile devices are constantly active, updating information (e.g., the device clock) continuously. Some devices, stemming mainly from a PDA heritage, are active even when turned off [Bur02]. Therefore, back-to-back acquisitions of a device will be slightly different and produce different hash values when computed over all the data. However, hash values computed over selected portions of the data, such as individual files and directories, generally remain constant. Only a few forensic tools offer more granular hash computation of files and directories. Some forensic tools also do not notify the user automatically about hash inconsistencies, placing the onus on the forensic specialist to check the hash values manually.
23
Guidelines on Cell Phone Forensics
4. Procedures and Principles
Investigations and incidents are handled in various ways depending upon the circumstances of the incident, the gravity of the incident, and the preparation and experience of the investigation team. Digital investigations are comparable to crime scenes where investigative techniques used by law enforcement have been applied as a foundation for the creation of procedures used when dealing with digital evidence. This chapter provides an overview of various procedural models and principles that have been proposed.
4.1 Roles and Responsibilities
Whatever the type of incident, the various types of roles involved are similar. Planning should address how existing personnel fulfill these roles when responding and participating in an investigation. A set of generic roles and associated responsibilities are given below as an example. They include First Responders, Investigators, Technicians, Forensic Examiners, Forensic Analysts, and Evidence Custodians. Organizations may need to blend together these roles to match their method of operation and level of staffing. In given situations, a single individual may also be expected to perform more than one role. Nevertheless, distinguishing distinct roles is a useful way to identify associated responsibilities and ensure that the overall scope of activities is complete and sufficient.
First Responders are trained personnel who arrive first on the scene of an incident, provide an initial assessment, and begin the appropriate level of response. The responsibilities of First Responders are to secure the incident scene, call for the appropriate support needed, and assist with evidence collection.
Investigators plan and manage preservation, acquisition, examination, analysis, and reporting of electronic evidence. The Lead Investigator is in charge of making sure that activities at the scene of an incident are executed in the right order and at the right time. The Lead Investigator may be responsible for developing the evidence, preparing a case report, and briefing any findings and determinations to senior officials.
Technicians carry out actions at the direction of the Lead Investigator. Technicians are responsible for identifying and collecting evidence and documenting the incident scene. They are specially trained personnel who seize electronic equipment and acquire digital images resident within memory. More than one technician is typically involved in an incident, because different skills and knowledge are needed. Sufficient expertise should be available at the scene to address all distinct digital apparatus involved in the incident.
Evidence Custodians protect all evidence gathered that is stored in a central location. They accept evidence collected by Technicians, ensure it is properly tagged, check it into and out of protective custody, and maintain a strict chain of custody.
Forensic Examiners are specially trained personnel who reproduce images acquired from seized equipment and recover digital data. Examiners make visible evidential information on the device. Examiners may also acquire more elusive data using highly specialized equipment, intensive reverse engineering, or other appropriate means unavailable to Forensic Technicians. Having individuals serve as both an Investigator and a Forensic Examiner in an investigation should generally be avoided. 24
Guidelines on Cell Phone Forensics
Forensic Analysts evaluate the product of the Forensic Examiner for its significance and probative value to the case.
4.2 Evidential Principles
As a backdrop to any investigation, basic principles have been proposed for dealing with digital evidence. Digital evidence by its very nature is extremely fragile, especially that found on cell phones. A phone’s contents and the evidence it contains can be affected or even lost any time it is on. Digital evidence has two aspects: the physical components, peripherals, and media, that may contain data, and the data extracted from those sources. Each has associated chain of custody issues. The Association of Chief Police Officers (ACPO) Good Practice Guide for Computer based Electronic Evidence [ACPO] suggests four principles when dealing with digital evidence, summarized here:
􀂄 No actions performed by investigators should change data contained on digital devices or storage media that may subsequently be relied upon in court.
􀂄 Individuals accessing original data must be competent to do so and have the ability to explain their actions.
􀂄 An audit trail or other record of applied processes, suitable for replication of the results by an independent third-party, must be created and preserved, accurately documenting each investigative step.
􀂄 The person in charge of the investigation has overall responsibility for ensuring the above-mentioned procedures are followed and in compliance with governing laws.
The Proposed Standards for the Exchange of Digital Evidence [IOCE] suggest a similar set of principals for the standardized recovery of computer-based evidence:
􀂄 Upon seizing digital evidence, actions taken should not change that evidence.
􀂄 When it is necessary for a person to access original digital evidence, that person must be forensically competent.
􀂄 All activity relating to the seizure, access, storage, or transfer of digital evidence must be fully documented, preserved, and available for review.
􀂄 An individual is responsible for all actions taken with respect to digital evidence while the digital evidence is in their possession.
􀂄 Any agency that is responsible for seizing, accessing, storing, or transferring digital evidence is responsible for compliance with these principles.
The above sets of principles aim to ensure the integrity and accountability of digital evidence through its entire life cycle. Proper handling of evidence is always vital for it to be admissible in judicial proceedings. However, different standards may apply to different types of investigations. The degree of training and expertise required to execute a forensic task largely depends on the level of evidence required in the case [Pur]. For example, using a forensic software tool requires modest skill levels to acquire active data, compared with those required 25
Guidelines on Cell Phone Forensics
to remove a memory chip and recover data contents, which includes both active and deleted data.
The Daubert method, a set of standards that serve as a guide when dealing with evidence in a court of law, proposes several reliability factors, which should be kept in mind when applying and reporting on a scientific technique that is being used in a forensic examination [Oco04]:
􀂄 Testability – Has the scientific theory or technique been empirically tested? According to K. Popper (1989) in The Growth of Scientific Knowledge, "the criterion on the scientific status of a theory is its falsifiability, refutability, and testability."
􀂄 Acceptance – Has the scientific theory or technique been subjected to peer review and publication? This ensures that flaws in the methodology would have been detected and that the technique is finding its way into use via the literature.
􀂄 Error Rate – What is the known or potential error rate? Scientific measures generally have associated error rates, which can be estimated with a fair amount of precision. Known threats exist against the validity and reliability in any test (experimental and quasi-experimental) of a theory.
􀂄 Credibility – What is the expert's qualifications and stature in the scientific community? Does the technique rely upon the special skills and equipment of one expert, or can it be replicated by other experts elsewhere?
􀂄 Clarity – Can the technique and its results be explained with sufficient clarity and simplicity so that the court and the jury can understand its plain meaning? This criterion is implicitly assumed to be incorporated in Daubert.
The procedures used to acquire evidence affect its admissibility. This applies as well to evidence acquired from mobile phones using forensic software tools [Mcc06]. Even outside of law enforcement investigations, evidence should be collected in a manner that is suitable for admissibility in court. It may not be obvious when an investigation is initiated, for example, when a computer security incident is first detected, that court action may ensue. Important evidence might be overlooked, improperly handled, or accidentally destroyed before the seriousness of the incident is realized.
4.3 Procedural Models
The Electronic Crime Scene Investigation – A Guide for First Responders, produced by the U.S. Department of Justice [DOJ01], offers the following suggestions when approaching a digital crime scene.
􀂄 Securing and Evaluating the Scene – Steps should be taken to ensure the safety of individuals and to identify and protect the integrity of potential evidence.
􀂄 Documenting the Scene – Create a permanent record of the scene, accurately recording both digital-related and conventional evidence.
􀂄 Evidence Collection – Collect traditional and digital evidence in a manner that preserves their evidentiary value.
26
Guidelines on Cell Phone Forensics
􀂄 Packaging, Transportation, and Storage – Take adequate precautions when packaging, transporting, and storing evidence, maintaining chain of custody.
Incident Response [Man01], an “Incident Response Methodology” proposes the following phases when encountering an incident or performing a digital investigation.
􀂄 Pre-incident preparation – Through training and education, gain an understanding on how to respond to an incident.
􀂄 Detection of incidents – Develop techniques on how to detect suspect activities.
􀂄 Initial Response – Confirm that an incident has occurred and obtain volatile evidence.
􀂄 Response strategy formulation – Respond to incident based upon knowledge of all known facts collected from the Initial Response phase.
􀂄 Duplication (forensic backups) – Based upon the scenario, either create a physical forensic image or do a live retrieval of evidence.
􀂄 Investigation – Determine what happened, who did it and how the incident can be prevented in the future.
􀂄 Security measure implementation – Apply security measures to isolate and contain infected systems.
􀂄 Network monitoring – Monitor network traffic for ongoing or additional attacks.
􀂄 Recovery – Restore the affected system to a secure, operational state.
􀂄 Reporting – Document all of the details and investigative steps taken throughout the incident.
􀂄 Follow-up – Learn from the incident by reviewing how and why it happened and make necessary adjustments.
Research conducted at the U.S. Air Force proposes the following steps when dealing with a forensic investigation [Rei02].
􀂄 Identification – Recognize and determine the type of incident.
􀂄 Preparation – Prepare tools, techniques, search warrants, authorizations, and management approval.
􀂄 Approach Strategy – Maximize untainted evidence collection while minimizing the impact upon the victim.
􀂄 Preservation – Isolate, secure, and preserve the state of physical and digital evidence.
􀂄 Collection – Record the physical scene and duplicate digital evidence.
27
Guidelines on Cell Phone Forensics
􀂄 Examination – Search for evidence relating to the suspected crime.
􀂄 Analysis – Determine significance, reconstruct fragments of data, and draw conclusions based on the evidence found. The Analysis phase may go through numerous iterations until a theory has been supported.
􀂄 Presentation – Summarize and provide an explanation of conclusions.
􀂄 Return Evidence – Ensure physical and digital property is returned to the proper owner.
Although developed primarily for computer systems, each of the above procedural models and the evidential principles discussed contain important points that should be considered when dealing with digital evidence on cell phones. Because every investigation is distinct with its own unique set of circumstances, a single definitive procedural approach is difficult to prescribe. Nevertheless, most models touch on the same key areas, though stressing different aspects. The remaining chapters of this guide follow a simple framework of four topical areas: obtaining an exhibit, making a forensic copy of its contents, obtaining evidence from the forensic copy, and reporting on the evidence obtained and process used. They are respectively referred to within this document as preservation, acquisition, examination and analysis, and reporting.
28
Guidelines on Cell Phone Forensics
5. Preservation
Evidence preservation is the process of seizing suspect property without altering or changing the contents of data that reside on devices and removable media. It is the first step in digital evidence recovery. The chapter begins with a generic introduction to preservation, and then provides more specific guidance about cell phones.
Preservation involves the search, recognition, documentation, and collection of electronic-based evidence. In order to use evidence successfully, whether in a court of law or a less formal proceeding, it must be preserved. Failure to preserve evidence in its original state could jeopardize an entire investigation, potentially losing valuable case-related information.
The DOJ’s Electronic Crime Scene Investigation report covers this subject in detail [DOJ01]. The guide offers principles, policies, and procedures to follow when encountering a digital evidence scene. The reader is directed to that report for additional information. The following is a summary of the key points to observe.
􀂄 Securing and Evaluating the Scene
􀂃 Ensure the safety of all individuals at the scene.
􀂃 Protect the integrity of traditional and electronic evidence.
􀂃 Evaluate the scene and formulate a search plan.
􀂃 Identify potential evidence.
􀂃 All potential evidence should be secured, documented, and/or photographed.
􀂃 Conduct interviews.
􀂄 Documenting the Scene
􀂃 Create a permanent historical record of the scene.
􀂃 Accurately record the location and condition of computers, storage media, other digital devices, and conventional evidence.
􀂃 Document the condition and location of the computer system, including power status of the computer (on, off, or in sleep mode).
􀂃 Identify and document related electronic components that will not be collected.
􀂃 Photograph the entire scene to create a visual record as noted by the first responder. 29
Guidelines on Cell Phone Forensics
􀂄 Collecting Evidence
􀂃 Handle computer evidence, whether physical or digital, in a manner that preserves its evidentiary value.
􀂃 Recover non-electronic evidence (e.g., written passwords, handwritten notes, blank pads of paper with indented writing, hardware and software manuals, calendars, literature, text or graphical computer printouts, and photographs).
􀂄 Packaging, Transporting, and Storing Evidence
􀂃 Take no actions to add, modify, or destroy data stored on a computer or other media.
􀂃 Avoid high temperatures and humidity, physical shock, static electricity, and magnetic sources.
􀂃 Maintain chain of custody of electronic evidence, documenting its packaging, transportation and storage.
􀂃 Packaging Procedure
􀂃 Properly document, label, and inventory evidence before packaging.
􀂃 Pack magnetic media in antistatic packaging (paper or antistatic plastic bags).
􀂃 Avoid folding, bending, or scratching computer media such as diskettes, CD-ROMs, removable media, etc.
􀂃 Properly label evidence containers.
􀂃 Transportation Procedure
􀂃 Avoid magnetic sources (e.g., radio transmitters, speaker magnets).
􀂃 Avoid conditions of excessive heat, cold, or humidity while in transit.
􀂃 Avoid shock and excessive vibrations.
􀂃 Storage Procedures
􀂃 Ensure evidence is inventoried in accordance with authoritative policies.
􀂃 Store evidence material in a secure area away from temperature and humidity extremes.
􀂃 Protect evidence material from magnetic sources, moisture, dust, and other harmful particles or contaminants.
30
Guidelines on Cell Phone Forensics
The Good Practice Guide for Computer Based Electronic Evidence [ACPO] suggests the following procedures when handling cell phones:
􀂄 Before handling, consider what other types of evidence, such as DNA or fingerprints, are needed from the phone and follow the appropriate handling procedures.
􀂄 Switching the phone off is advisable, because of the potential for loss of data if either the battery expires or network activity occurs, causing call logs or other recoverable data to be overwritten.
􀂄 If the phone remains on for some purpose, it should be kept charged and not tampered with, then switched off before transport.
􀂄 To prevent accidental operation in transit, the phone should be packaged in a rigid container, secured with support ties.
􀂄 The container should be placed into an evidence bag, sealed to restrict access, and the labeling procedures completed for the exhibit.
The remaining sections of this chapter provide supplemental information related to cell phones, following the paradigm of Securing and Evaluating the Scene, Documenting the Scene, Collecting Evidence, and Packaging, Transporting, and Storing Evidence.
5.1 Securing and Evaluating the Scene
Ensuring that the proper authorizations (e.g., a search warrant or consent from the owner) are in place is paramount for beginning an investigation. When searching a site, the team should proceed cautiously. Incorrect procedures or improper handling of a mobile phone during seizure can cause loss of digital evidence. Moreover, traditional forensic measures, such as fingerprints or DNA testing, may need to be applied to establish a link between a mobile phone and its owner or user, or for other reasons. If the device is not handled properly, physical evidence can be easily contaminated and rendered useless.
Alertness to device characteristics and issues (e.g., memory volatility) and familiarity with associated accessories (e.g., media, cables, cradles, and power adapters) are essential. For cell phones, sources of evidence include the device, (U)SIM, and media. Associated peripherals, cables, cradles, power adapters, and other accessories are also of interest. The surrounding area and rooms, other than where a device is found, should be searched to ensure related evidence is not overlooked. To avoid unwanted interaction with devices found on the scene, consideration should be given to turning off wireless interfaces, such as Bluetooth and WiFi radios, on equipment brought into the search area.
Equipment associated with the cell phone, such as removable media, (U)SIMs, or even personal computers possibly synched with it, may prove more valuable than the phone itself. Removable media varies from the size of a fingernail to that of a postage stamp, and can be easily hidden and difficult to find. Most often, removable memory cards are identifiable by their distinctive shape and the presence of pins, pin receptacles, or contacts located on their body, used to establish an electrical interface with the device.
31
Guidelines on Cell Phone Forensics
When interviewing the owner or user of a mobile device, consider requesting any security codes or passwords needed to gain access to its contents. For example, a PIN can be set on GSM phones and some of them also have lock codes that can be set in conjunction with or in lieu of the PIN. Suspects should never be allowed to handle mobile phones or other mobile devices. Many phones have master reset codes that clear the contents of the phone to the original factory conditions. Removing the battery can also cause the contents of some devices to be lost, such as certain smart phones.
Phones may be found in a compromised state that can complicate seizure, such as immersed in a liquid. In the case of liquids, the battery should be removed to prevent electrical shorting. The remainder of the phone should be sealed in an appropriate container filled with the same liquid for transport to the lab, provided the liquid is not caustic. Some compromised states, such as blood contamination or use with explosives (i.e., as a bomb component) can pose a danger to the technician collecting evidence. In such situations, a specialist should be consulted for specific instructions or assistance, if doubt exists on how to proceed.11
Mobile phones and associated media may be found in a damaged state, caused by accident or deliberate action. Devices or media with visible external damage do not necessarily prevent the extraction of data from them. Damaged equipment should be taken back to the lab for closer inspection. Repairing damaged components on a mobile phone and restoring the device to working order for examination and analysis may be possible. Undamaged memory components may also be removed from a damage device and their contents recovered independently.
Legal advisors should be contacted for assistance, if needed, with the following two critical legal considerations [DOJ04]:
􀂄 Determining the extent of the authority to search and what additional legal process may be necessary to continue the search (e.g., warrant, amended consent form), if evidence is located that was not authorized in the original search authority.
􀂄 Identifying possible concerns related to applicable local policies and laws, and International, Federal, or State statutes, such as the Electronic Communications Privacy Act of 1986 (ECPA) and the Cable Communications Policy Act (CCPA).
5.2 Documenting the Scene
Evidence must be accurately accounted for and identified. Non-electronic evidence such as invoices, manuals, and packaging material may provide useful information about the capabilities of the device, the network used, account information, and unlocking codes for the PIN. The labeling process should document the case number, a brief description, signature, and the date and time the evidence was collected. Photographing the crime scene in conjunction with documenting a report of the state of each digital device and computer encountered (personal computers may contain useful data that has not been synchronized with the owner’s mobile phone) can be helpful, particularly if questioned about the environment later [Kru01].
11 The Netherlands Forensic Institute’s procedures for preservation can be found at http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm.
32
Guidelines on Cell Phone Forensics
A record of all visible data should be created. All digital devices, including mobile phones, which may store data, should be photographed along with all peripherals cables, cradles, power connectors, removable media, and connections. Avoid touching or contaminating the phone when photographing it and the environment where found. If the device’s display is in a viewable state, the screen’s contents should be photographed and, if necessary, recorded manually, capturing the time, service status, battery level, and other displayed icons. Other characteristics such as LED activity (e.g., blinking), physical condition, physical connectivity, or visible identifiers should also be noted. Having an individual in charge to perform evidence custodian duties at the scene, alongside a partner responsible for documentation of evidence, is desirable during the collection phase [Kru01].
Actions taken on the system to view and record other volatile data not under display at the time can affect the state of the device. For example, launching an application on a smart phone can overwrite parts of memory. Furthermore, it risks activating Trojan horse code hidden within the application or accidentally hitting an incorrect key sequence, and causing unintended effects.
The chain of custody procedure is a simple yet effective process of documenting the complete journey of evidence through the lifecycle of the case. Carefully maintaining the chain of custody not only protects the integrity of evidence, but also makes if difficult for someone to argue that the evidence was tampered with [Kru01]. The documentation should answer the following questions:
􀂄 Who collected it? (i.e., devices, media, associated peripherals, etc.)
􀂄 How and where? (i.e., how was the evidence collected and where was it located)
􀂄 Who took possession of it? (i.e., individual in charge of seizing evidence)
􀂄 How was it stored and protected in storage? (i.e., evidence-custodian procedures)
􀂄 Who took it out of storage and why? (i.e., on-going documentation of individual’s name and purpose for checking-out evidence)
Documentation to all of the above questions must be maintained and filed in a secure location for current and future reference.
5.3 Collecting the Evidence
The Mobile Phone Forensics Sub-Group of the Interpol European Working Party on IT Crime has identified how the ACPO Principles of Evidence apply to seizure of mobile phones [INT06]. Some key implications for proper collection are summarized below.
Isolating the phone from other devices used for data synchronization is important to keep new data from contaminating existing data. If the device is found in a cradle or connected with a computer via a cable, pulling the plug from the back of the computer eliminates data transfer or synchronization overwrites. The phone should be seized along with the cradles and cables found. Media cards, (U)SIMs, and other hardware residing in the phone should not be removed. Also, seizing the computer that was connected to the phone allows the possibility to acquire synchronized data from the hard disk that might not be obtained from the phone. Any 33
Guidelines on Cell Phone Forensics
associated hardware such as media cards, (U)SIMs, power adapters, device sleeves, or peripherals, should be seized along with related materials such as product manuals, packaging, and software.
Isolating the phone from the radio network is important to keep new traffic, such as SMS messages, from overwriting existing data, if the phone is turned on when found. Besides the risk of overwriting potential evidence, the question may arise whether data received on the phone after seizure is within the scope of the original authority granted. Add-on programs, such as LockMe12 and OmaiProtect13, are also available that enable the phone lock to be set remotely upon receipt of a properly formatted message. Moreover, vulnerabilities may exist that can be exploited. For example, a malformed message sent to a Nokia 6210 phone has been shown to disable it completely, much like the a malformed ICMP packet known as the “ping of death” did to older Windows computers [Ley01].
Two basic methods for isolating the phone from radio communication and preventing these problems are to “Turn (the) device off at the point of seizure” or to “Place (the) device in a shielded container/bag” [INT06]. Alternatively, if the device has an “Airplane Mode” function, the setting could be enabled [Bur02]. Each method has certain drawbacks, however.
􀂄 Turning off the phone may activate authentication codes (e.g., SIM PIN and/or handset security codes), which are then required to gain access to the device, complicating acquisition and delaying examination.
􀂄 Keeping the phone on, but radio isolated, hastens battery life due to increased power consumption as it tries unsuccessfully to connect to a network, raising its signal strength to the maximum. After some period, failure to connect to the network may cause certain phones to reset or clear network data that otherwise would be useful if recovered [Smi05]. Containers attenuate the radio signal, but not necessarily eliminate it completely, allowing the possibility of communications being established with a cell tower, if in its immediate vicinity. The risk of improperly sealing the radio isolation container and unknowingly allowing access to the cell network also exists.
􀂄 Enabling “Airplane Mode” requires interaction with the phone via the keypad, which poses some risk – less so, if the technician is familiar with the device in question and documents the actions taken (e.g., on paper or on video).
If user data resides in battery-dependent volatile memory, expiration of the battery would be disastrous. Before collecting such a mobile phone, the power state must be considered. For example, the device may be fully charged, receiving power from a charger or cradle plugged into an outlet, or extremely low on battery power. Steps must be taken to maintain the battery level at an appropriate level until a successful acquisition takes place. This may be especially challenging if the device needs to be radio isolated, requiring it to be placed in the container together with a portable source of supplemental power (e.g., a disposable charger such as
12 Product information is available at http://www.allaboutsymbian.com/software/item/LockMe1.php.
13 Product information is available at: http://shop.my-symbian.com/PlatformProductDetail.jsp?siteId=695&jid=9XE2C5FBA428B2D242AXA4AB13E866AX&platformId=4&productType=2&catalog=0&sectionId=0&productId=187426.
34
Guidelines on Cell Phone Forensics
cellboost14 or a battery-powered charger15), after full charging. If sufficient power cannot be supplied, consideration should be given to switching off the phone to preserve battery life, documenting the current device state and noting the time and date of the shutdown.
Charging may also be required post-examination, if reexamination of the original device is anticipated due to expected challenges to the results of the initial examination. Otherwise, replication of results cannot be achieved once battery depletion causes loss of volatile memory content. Even when the phone is isolated, content changes may occur on an active device that could be undesirable, such as the execution of a scheduled script that purges old data.
To conserve power, some smart phones are normally configured to enter energy savings mode and shut off the display after a short period of inactivity. Some phones also shut themselves off if the battery level drops below a certain threshold to protect data stored in volatile memory, which defeats the original purpose of keeping it turned on. Keeping a device in the active state is troublesome, requiring periodic interaction with the device. Anecdotal evidence suggests that built-in and add-on protections, such as user authentication and content encryption, are not employed for the vast majority of phones seized. If additional power cannot be supplied to a device and it is turned off to conserve power and preserve memory contents, the risk of encountering a protection mechanism when turned on again should overall be low. Moreover, authentication mechanisms, such as passwords, typically cannot be deactivated without first satisfying the mechanism (e.g., supplying the correct password). For these reasons, procedures for some organizations may recommend turning off certain classes of phones, if found powered on.
“A small number of mobile communication devices … use alkaline batteries as a power source. Consideration should be given to replacing the batteries prior to transit to minimize the risk of data loss due to complete battery discharge before the device reaches the examination unit [INT06].” Some smart phones use rechargeable batteries that are replaceable, and a fully charged replacement battery can be substituted, if available. Such phones keep a small charge to the device to maintain volatile data for a short amount of time during battery replacement. To prevent loss of volatile data, batteries must be replaced quickly.
The time maintained on the phone may be set independently of that from the network. Always record the date and time shown on the handset, if it is turned on, and compare them with a reference clock, noting any inconsistencies. If the screen is dim due to power management, it may be necessary to press an insignificant key such as the volume key to light the screen. When preparing the packing labels, be sure to record the manufacturer and model of the seized equipment, and also its condition. The make and model may be branded on the body of the handset and also appear in the interior of the handset under the battery. However, do not remove the battery to read this information, if the phone is on.
Caution should be exercised when handling a phone suspected of being modified, especially if the modifications are presumed to be done by a security-minded individual or organization. Certain types of modifications to the software applications and operating system of the device
14 Product information is available at http://www.cellboost.com/us/.
15 Product information is available at: http://www.chargetogo.com/specs.htm and http://www.paramountzone.com/mobile_charger.htm.
35
Guidelines on Cell Phone Forensics
might affect the way it is handled. The following is a list of examples of some classes of modifications to consider:
􀂄 Security Enhancements – Organizations and individuals may enhance their handheld devices with add-on security mechanisms. A variety of visual login, biometric, and token-based authentication mechanisms are available for smart phones to use as replacements or supplements to password mechanisms. Improper interaction with a mechanism could cause the device to lock down and even destroy its contents. This is particularly a concern with mechanisms that use security tokens whose presence is constantly monitored and whose disconnection from a card slot or other device interface is immediately acted upon.
􀂄 Malicious Programs – A phone may contain a virus or other malicious software. Such malware16 may attempt to spread to other devices over wired or wireless interfaces, including cross platform jumps to completely different platforms such as Windows computers. Common utilities or functions may also be intentionally replaced with versions that contain software designed to alter or damage data present on a phone. Such Trojan-bearing programs could conditionally be activated or suppressed based on conditions such as input parameters or hardware key interrupts. Watchdog applications could also be written to listen for specific events (e.g., key cords or over the air messages) and carry out actions such as wiping the device clean.
􀂄 Key Remapping – Hardware keys may be remapped to perform a different function than the default. A key press or combination of key presses intended for one purpose could launch an arbitrary program.
5.4 Packaging, Transporting, and Storing Evidence
Once the device is ready to be seized, the forensic specialist should seal the device in a static proof bag and tag it. The individual who seizes the device must sign and date the tag to initiate a chain of custody. The device should be secured properly to prevent keys from being pressed accidentally (e.g., turning the device on) when in the evidence bag. Hard containers are manufactured specifically for this purpose and are recommended for use.17 Radio frequency isolation bags are also available for attenuating a device’s radio signal and should be used with phones left on. An independent external power charger may be connected and placed in the bag with the device to keep the power level full during transit. Phones with volatile memory resident user data, which are left off, turned off, or in “Airplane Mode,” may be packaged to allow a power adaptor to be connected to the device through a hole in the evidence bag to keep the power level high. Rechargeable devices can usually be powered through a compatible cigarette-lighter adapter cable to keep charge to the device while in transit. If a power adapter is used in conjunction with a radio frequency isolation bag, the cable must be properly shielded to prevent it from serving as an antenna and nullifying the effect of the isolation bag.
Digital devices are fragile and easily damaged. When a device is transported, it should be handled carefully and adequately protected from shock, breakage, and extreme temperature. Due to the volatile nature of some smart phones, they should immediately be checked into a
16 For more information, see http://www.eweek.com/article2/0,1895,1750109,00.asp.
17 For example, see http://www.forensicts.co.uk/fts-packaging.asp.
36
Guidelines on Cell Phone Forensics
forensic laboratory to be processed and the evidence custodian should be made aware of the situation regarding power requirements. Battery powered devices held in storage for more than a few days risk power depletion and data loss, unless a process is in place to avoid this outcome.
Storage facilities that hold evidence should provide a cool, dry environment appropriate for valuable electronic equipment. All evidence should be in sealed containers, in a secure area with controlled access.
37
Guidelines on Cell Phone Forensics
6. Acquisition
Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media. Performing acquisition at the scene has the advantage that loss of information due to battery depletion, damage, etc. during transportation and storage is avoided. However, finding a controlled setting in which to work, having the appropriate equipment, and satisfying other prerequisites may not be possible at the scene, but readily achievable within a laboratory setting. For the purpose of discussion, a laboratory environment is assumed throughout this chapter. Powered on devices should be handled with caution in a radio frequency shielded work area or have their wireless communications disabled by some other means.
Radio Isolation Techniques: A number of techniques exist for isolating a mobile phone from cell tower communications [INT06]. Because communications are blocked, the handset continues increasing its signal strength up to the maximum as it continually attempts to make contact. This activity significantly shortens battery life. The device should be fully charged prior to examination and consideration should be given to having a fixed or portable power source attached.
Use a jamming or spoofing device - Emitting a signal stronger than a cell phone’s or interfering with the signal can render a cell phone useless. Another technique involves tricking the phone into thinking a “no service” signal is coming from the nearest cell tower. Because such devices can affect communications in the surrounding public airspace beyond the examination area, they are illegal in many countries. [Wyl00, NIJ05]
Use a shielded work area - Shielding an entire work area can be an expensive but effective way to conduct examinations safely in a fixed location. A “Faraday tent” is a cheaper alternative that also allows portability. Feeding cables into the tent is problematic, however, since without proper isolation they can behave as an antenna, defeating the purpose of the tent. The work space can also be very restrictive.
Use a shielded container - A portable shielded container can allow examinations to be conducted safely once the phone is situated inside. Cables into the box must be fully isolated to prevent network communications from occurring.
Use a substitute (U)SIM - A substitute (U)SIM mimics the identity of the original and prevents network access by the handset. Such cards trick the handset into accepting them as the original (U)SIM. The technique allows examinations to be conducted safely at any location.
Arrange for the network service to be disabled - The cellular carrier providing service to the device might be induced to disable service. The service provider or network operator must be determined and contacted with details identifying the service to be disabled (e.g., the equipment identifier, subscriber identifier, phone number). Such information is not always readily available, however, and the coordination and confirmation process also imposes delay.
Acquisition should occur at a forensics laboratory once the seized equipment has arrived and been checked in. The forensic examination begins with the identification of the device. The type of device, its operating system, and other characteristics determine the route to take in creating a forensic copy of the contents of the device. Only a few forensic software tools currently exist that image certain types of phones, and no single tool presently handles the full 38
Guidelines on Cell Phone Forensics
range of phones on the market [Aye05, Aye07]. The type of phone under examination, therefore, generally dictates which tools to use in an investigation.
6.1 Device Identification
To proceed effectively, devices need to be identified by the make, model, and service provider. This information allows examiners to select the appropriate tools for acquisition. Individuals may attempt to thwart specialists by altering the device to conceal its true identity. Device alteration could range from removing manufacturer labels to filing off logos. In addition, the operating system and applications may be modified or in rare situations completely replaced, and appear differently as well as behave differently than expected. For example, removing or replacing splash screens is a widely discussed modification in phone forums.
If the phone is powered on, the information appearing on the display can sometimes help identify the type of phone. For example, the manufacturer’s or service provider’s name may appear on the display, or the screen layout may indicate the family of operating system used. Information such as the manufacturer’s label may be found in the battery cavity (e.g., Make, Model, IMEI, or ESN). Removing the battery from the cavity of a phone, even when powered off, can affect its state, particularly the contents of volatile memory. Most phones keep user data in non-volatile memory, however, with the exception of certain smart phones. If the phone is powered on, battery removal will power it off, possibly causing an authentication mechanism to trigger when again powered on.
Other clues that allow identification of a device include such things as manufacturer logos, serial numbers, the cradle, and power adapter. Overall, knowing the make and model helps to limit the potential service providers, by differentiating the type of network the device operates over (i.e., GSM, non-GSM), and vice versa. Synchronization software discovered on an associated computer also helps to differentiate among operating system families. Further means of identification include the following areas:
􀂄 Device Characteristics – The make and manufacturer of a phone can sometimes be identified by its observable characteristics (e.g., weight, dimensions, and form factor), particularly if unique design elements exist. Various Web sites contain databases of phones that can be queried based on selected attributes to identify a particular device and obtain its specifications and features.18 Coverage is considerable, but not extensive or complete, and may require consulting more than one repository before making a match.
􀂄 Device Interface – The power connector is often specific to a manufacturer and a reliable aid to identification. With familiarization and experience, the manufacturers of certain devices can be readily identified. Similarly, the size, number of contacts, and shape of the data cable interface of a phone used to create a connection to a host computer are often specific to a particular manufacturer and may prove helpful in
18 Several examples of such Web sites include the following: http://www.phonescoop.com/phones/finder.php, http://www.gsmarena.com/search.php3, and http://mobile.softpedia.com/phoneFinder.
39
Guidelines on Cell Phone Forensics
identification.19 Unfortunately, the available databases for these interfaces lack the broad coverage to be of assistance.
􀂄 Device Label – For phones powered off, information obtained from within the battery cavity can be revealing, particularly when coupled with an appropriate database. The manufacturer’s label often lists the make and model number of the phone and also unique identifiers, such as the Federal Communications Commission Identification Number (FCC ID) and an equipment identifier (IMEI or ESN). The FCC and equipment identifiers can be found on cell phones sold in the U.S. domestic market. For GSM or other (U)SIM bearing phones, the (U)SIM is usually located under the battery and is typically imprinted with a unique identifier called the Integrated Circuit Card Identification (ICCID). For powered on GSM and UMTS phones, the International Mobile Equipment Identifier (IMEI) can be obtained by keying in *#06#. Similar codes exist for obtaining the Electronic Serial Number (ESN) from powered on CDMA phones. Various sites on the Internet offer databases for querying the identifier and providing information about the device.
􀂃 The IMEI is a 15-digit number that indicates the manufacturer, model type, and country of approval for GSM devices. The initial 8-digit portion of the IMEI, known as the Type Allocation Code (TAC), gives the model and origin. The remainder of the IMEI is manufacturer specific, with a check digit at the end [GSM04]. A database lookup service is available from the GSM numbering plan Web site.20
􀂃 The ESN is a unique 32-bit identifier recorded on a secure chip in a mobile phone by the manufacturer. The first 8-14 bits identify the manufacturer and the remaining bits the assigned serial number. Many phones have codes that can be input into the handset to display the ESN. Hidden menus can also be activated on certain phones by placing them in “test mode” through the input of a code. Besides the ESN, other useful information such as the phone number of the device can be obtained. Manufacturer codes can be checked on-line at the Telecommunications Industry Association Web site.21
􀂃 The ICCID of the (U)SIM can be up to 20 digits long. It consists of an industry identifier prefix (89 for telecommunications), followed by a country code, an issuer identifier number, and an individual account identification number [ITU06]. The country and network operator name can be determined by the ICCID. If the ICCID does not appear on the (U)SIM, it can always be obtained with a (U)SIM acquisition tool. The GSM numbering plan Web site supports ICCID queries for this information22.
19 For example, see http://www.gsm-technology.com/gsm.php/en,unlock,subpage_id,pinout.html.
20 For more information, see http://www.numberingplans.com/?page=analysis&sub=imeinr.
21 For more information, see http://www.tiaonline.org/standards/resources/esn/codes.cfm.
22 For more information, see http://www.numberingplans.com/?page=analysis&sub=simnr.
40
Guidelines on Cell Phone Forensics
􀂃 The first 3 characters of the FCC ID are the company code; the next 14 are the product code. The FCC provides a database lookup service that can be used to identify a device manufacturer and retrieve information about the phone, including photos, user manual, and radio frequency test results.23
􀂄 Reverse Lookup – If the telephone number of the phone is known, a reverse lookup can be used to identify the network operator (e.g., Cingular) and the originating city and state (e.g., Washington D.C.). For example, FoneFinder is a service to obtain such information by inputting the user’s area code, three-digit prefix, and the seventh digit of the phone number.24 The network operator’s Web site typically contains lists of supported phones that can be used to narrow down and possible identify the phone in question. Because phone numbers can be ported among service providers, in many situations more up-to-date information is needed. The Number Portability Administration Center (NPAC) provides an automated phone system for law enforcement agencies to determine the current service provider assigned to a number and obtain contact information.25 The service covers both U.S. and Canadian phone numbers.
6.2 Tool Selection and Expectations
Once the make and model of the phone are known, available manuals can be retrieved and studied. The manufacturer’s Web site is a good place to begin. Typing the model number into Google or another search engine can also reveal a significant amount of information about the device. As mentioned earlier, the device being acquired largely dictates the choice of forensic tools. The following criteria have been suggested as a fundamental set of requirements for forensic tools [Car02], and should be considered when a choice of tools is available:
􀂄 Usability – the ability to present data in a form that is useful to an investigator
􀂄 Comprehensive – the ability to present all data to an investigator so that both inculpatory and exculpatory evidence can be identified
􀂄 Accuracy – the quality that the output of the tool has been verified and a margin of error ascertained
􀂄 Deterministic – the ability for the tool to produce the same output when given the same set of instructions and input data
􀂄 Verifiable – the ability to ensure accuracy of the output by having access to intermediate translation and presentation results
23 For more information, see http://www.fcc.gov/oet/fccid/.
24 For more information, see http://www.fonefinder.net/.
25 More information about the service, including user registration, can be found at http://www.npac.com by selecting the Law Enforcement/911 tab at the left-hand side of the page.
41
Guidelines on Cell Phone Forensics
Other factors in choosing among software tools include the Daubert considerations mentioned earlier in section 4.2 (particularly Acceptance) and the following items:
􀂄 Quality – technical support, reliability, and upgrade version path
􀂄 Capability – supported feature set, performance, and richness of features with regard to flexibility and customization
􀂄 Affordability – cost versus benefits in productivity
Experimenting with various tools on test devices to find out which acquisition tools work efficiently with particular device types is highly recommended. Besides gaining familiarity with the capabilities of the tool, experimentation allows special purpose search filters and custom configurations to be set up before use in an actual case. In addition, any needed software updates from the manufacturer can be installed.
Established procedures should guide the technical process of acquisition, as well as the examination of evidence. New circumstances can arise sporadically that require adjustment to existing procedures, and in some situations require new procedures and methods be devised. Recent examples include (U)SIMs being permanently bonded into the handset of certain phones, handsets that are capable of supporting two (U)SIMS, and phones that block logical acquisition ports until a connection is made with a cell tower. Procedures must be tested to ensure that the results obtained are valid and independently reproducible. The development and validation of the procedures should be documented and include the following steps [DOJ04]:
􀂄 Identifying the task or problem
􀂄 Proposing possible solutions
􀂄 Testing each solution on an identical test device and under known control conditions
􀂄 Evaluating the results of the test
􀂄 Finalizing the procedure
6.3 Memory Considerations
A mobile phone contains various types of volatile and non-volatile memory over which several general categories of data can reside: storage for the operating system code, including the kernel, device drivers, and system libraries; memory for executing operating system applications and for storing and executing user applications loaded onto the device; and user storage for various kinds of text, image, audio, video, and other data files, including PIM application data. The structure of phone memory may be partitioned into fixed areas for certain data, such as phonebook entries, calendar entries, call logs, and SMS messages, or assigned dynamically from a common shared pool of memory. Memory may also be structured more rigorously as a formatted file system.
The type of memory in which each category of data is stored and the memory structure employed vary among manufacturers and often are based on the characteristics of the 42
Guidelines on Cell Phone Forensics
operating system used. Even for a given model of phone, data storage location assignments can vary somewhat between subsidized phones supplied by different network carriers, depending on the adaptations made for the carriers by the manufacturer. Firmware updates sent out by a network carrier can also affect data locations [Vam07].
Figure 4 illustrates the most typical arrangement in which user files reside in non-volatile memory, such as Flash ROM or possibly a micro hard drive, along with the operating system code. Since the storage is persistent, the contents are unaffected by complete power drainage. Volatile memory is used for dynamic storage and its contents are lost when power is drained from the phone.
Figure 4: Storage Assignments
A common alternative memory arrangement, used mainly in smart phones that have a PDA heritage, is shown in Figure 5. Volatile memory is used for dynamic storage and user file storage. Non-volatile memory is used mainly to hold the operating system code, and possibly PIM data or files backed up from volatile memory by the user. Completely draining power from the phone clears the contents of volatile memory, while non-volatile memory is unaffected.
Figure 5: Alternative Storage Assignments
A (U)SIM is similar to a mobile phone insofar as it has both volatile and non-volatile memory that can contain the same general categories of data as found in a mobile phone. It can be thought of as a trusted sub-processor that interfaces to a phone and draws power from it. The file system of a SIM resides in nonvolatile memory and is organized as a hierarchical tree structure, composed of three types of elements: the root of the file system (MF), subordinate
43
Guidelines on Cell Phone Forensics
directory files (DF), and files containing elementary data (EF). Figure 6 illustrates the structure of the file system. The EFs under DFGSM and DFDCS1800 contain mainly network related information for different frequency bands of operation. The EFs under DFTELECOM contain service related information.
Figure 6: SIM File System
Various types of digital evidence can exist in elementary data files scattered throughout the file system and be recovered from a (U)SIM. Some of the same information held in the (U)SIM may be maintained in the memory of the mobile phone and encountered there as well. Besides the standard files defined in the GSM specifications, a (U)SIM may contain non-standard files established by the network operator [Cas06]. Several general categories of evidence that can be found in standard elementary data files are as follows [Jan06]:
􀂄 Service-related Information, including unique identifiers for the (U)SIM, the Integrated Circuit Card Identification (ICCID), and the subscriber, the International Mobile Subscriber Identity (IMSI)
􀂄 Phonebook and Call Information, known respectively as the Abbreviated Dialling Numbers (ADN) and Last Numbers Dialled (LND)
􀂄 Messaging Information, including both Short Message Service (SMS) textual messages and Enhanced Messaging Service (EMS) simple multimedia messages.
􀂄 Location Information, including Location Area Information (LAI) for voice communications and Routing Area Information (RAI) for data communications
6.4 Unobstructed Devices
An unobstructed device refers to a device that does not require a password or other authentication technique to be satisfied to gain access to the device and perform an acquisition. Anecdotally, most devices seized in investigations appear to fall into this category. Unobstructed devices include mainly CDMA phones, freestanding (U)SIMs, and GSM phones containing a (U)SIM. A GSM phone that contains no (U)SIM is considered to be an “Obstructed Device,” discussed later in this chapter. Depending on the type of the phone, potential evidence, particularly user data, may reside in either the volatile or non-volatile 44
Guidelines on Cell Phone Forensics
memory, and must be handled accordingly. While the recoverable memory of (U)SIMs is non-volatile and in and of itself not a concern when found freestanding, their insertion and removal from a GSM mobile phone has forensic implications on the contents of the phone that must be taken into account.
To preserve the integrity of the data, examiners should handle the original evidence as little as possible. Generally, it is recommended to create a “master” forensic copy of the device case file first, which is kept completely pristine. The master copy is then used to create additional mirror images needed for analysis and examination of evidence [Gas03]. A strong one-way cryptographic hash (e.g., SHA1) should be performed to ensure that the additional images created from the master copy are identical.
6.4.1 Mobile Phone Acquisition
Often phones are submitted for laboratory processing with only specific items requested for recovery, such as phone call logs or images. If any doubt or concerns exist about the requested data, contacting the person who initiated the examination for clarification is recommended. Though it is not always necessary to recover all available data, a complete acquisition avoids having to redo the process later, if other data is needed, and the possibility that technical problems may arise on a later attempt.
To acquire data from a phone, a connection must be established to the device from the forensic workstation. Before performing an acquisition, the version of the tool being used should be documented, along with any applicable patches or errata from the manufacturer applied to the tool. As mentioned earlier, caution should be taken to avoid altering the state of a mobile phone when handling it, for example, by pressing keys that could potentially corrupt or erase evidence. Once the connection has been established, the forensic software suite can proceed to acquire data from the device. Appendix C gives an overview of the steps involved in an acquisition. They entail selecting a connection, identifying the device to be acquired, identifying the data to be recovered, and viewing the recovered data.
Acquiring a device’s contents logically, the prevailing technique used by present day forensic tools, requires the device to be switched on. This effectively means that the first evidentiary principle mentioned in section 4.2 – actions taken should not modify data contained on the device – cannot be complied with, strictly speaking. Therefore, the goal during acquisition is to affect memory contents as little as possible and then only with the knowledge of what is occurring internally, relying more on adherence to the second and third evidentiary principles that respectively emphasize high competence of the specialist and the capture of a detailed audit trail of the actions taken [ACPO].
The date and time maintained on the mobile phone is an important piece of information. The date and time may be obtained from the network or manually set by the user. Suspects may manually set the day or time to a completely different value from the actual one to leave misleading values in the call and message records found on the phone. If the phone was on when seized, the date and time maintained and differences from a reference clock should have already been recorded, as mentioned earlier. Nevertheless, confirmation at acquisition may prove useful. If the phone was off when seized, the date and time maintained and differences from a reference clock should be recorded immediately when first turned on in the laboratory. Note that actions taken during acquisition, such as removal of the battery to view the device label, may affect the time value maintained.
45
Guidelines on Cell Phone Forensics
Unlike desktop machines or network servers, only a few phones have a hard disk and rely instead completely on semiconductor memory. Specialized software exists for performing a logical acquisition of PIM data and, for certain phones, producing a physical image. However, the contents of a phone are typically dynamic and continually changing. Two back-to-back acquisitions of a device using the same tool may produce different results overall (e.g., if memory compaction occurs), though the majority of information, such as PIM data, remains unchanged.
Increasingly, mobile phones come with a built-in slot for some family of memory cards. Forensic tools that acquire the contents of a resident memory card normally perform a logical acquisition. To recover deleted data that might reside on the memory card, a direct acquisition can be performed on it after the contents of the mobile phone have been successfully acquired. With either type of acquisition, the forensic tool may or may not have the capability to decode recovered phone data stored on the card (e.g., SMS text messages), requiring additional manual steps to be taken.
After an acquisition is finished, the forensic specialist should always confirm that the contents of a device were captured correctly. On occasion, a tool may fail its task without any error notification and require the specialist to reattempt acquisition with the same tool or another tool. Similarly, some tools do not work as well with certain devices as others do, and may fail with an error notification. Thus, where possible, it is advisable to have multiple tools available and be prepared to switch to another if difficulties occur with the initial tool.
Invariably, not all relevant data viewable on a phone using the available menus can be captured through a logical acquisition. For example, draft and archived messages are sometimes not recovered by forensic tools. Manually scrutinizing the contents via the phone interface menus while video recording the process not only allows such items to be captured and reported, but also confirms that the contents reported by the tool are consistent with observable data. Manual acquisition must always be done with care, preserving the integrity of the device in case further, more elaborate acquisitions need to be conducted.
The contents of a phone’s memory often contain information, such as deleted data, that is not recoverable through either a logical acquisition or a manual examination. Lacking a software tool able to perform a physical acquisition, it may be necessary to turn to a hardware-based technique. Two techniques commonly used for non-volatile memory are acquisition through a standardized Joint Test Action Group (JTAG) test interface, if supported on the device, and acquisition by directly reading memory that has been removed from the device [Will05]. The techniques are discussed in a bit more detail in section 6.5.3, under Hardware Base Methods.
6.4.2 GSM Phone Considerations
CDMA phones and other mobile phones that do not use an identity module are relatively straightforward insofar as the acquisition entails a single device. The considerations described above are the main considerations to be addressed. GSM phones on the other hand are slightly more complex because of the handset/(U)SIM partitioning of the phone. Depending on the type of phone, whether it is on or off, and other conditions, the phone and (U)SIM could be acquired jointly or separately.
If the mobile phone is active, a joint acquisition of the handset and (U)SIM contents should be carried out before the (U)SIM is acquired directly. A direct acquisition recovers deleted
46
Guidelines on Cell Phone Forensics
messages present on a (U)SIM, while an indirect acquisition via the handset does not. The SIM must be removed from the phone and inserted into an appropriate reader for direct acquisition. One reason for this sequence is that removal of the (U)SIM, which is typically located beneath the battery, can result in the loss of non-volatile memory due to the power disruption. Additionally, the fact that the device was kept in an active state when seized may be an indication that some concern exists about triggering authentication or some other security mechanism if power is lost.
A well-known forensic issue that arises when following this sequence is that the reported status of unread SMS text messages is inconsistent between each (U)SIM acquisition – the first one declaring it to be unread, while the second one read. Reading an unread SMS message from a (U)SIM indirectly through the handset causes the operating system of the phone to change the status accordingly. Had the (U)SIM been read directly by a tool, no change in status would occur. One way to avoid the inconsistency is to omit selecting the recovery of (U)SIM-resident SMS text messages when performing the joint acquisition, if the tool allows such an option.
If the mobile phone is inactive, the contents of the (U)SIM may be acquired independently before that of the handset. The (U)SIM acquisition should be done directly through a (U)SIM reader. The handset acquisition should be attempted without the (U)SIM present. Many phones permit an acquisition under such conditions, allowing PIN entry for the (U)SIM to be bypassed, if it were enabled. If the acquisition attempt is unsuccessful, the (U)SIM can be reinserted and a second attempt made. Performing separate independent acquisitions (i.e., acquiring the (U)SIM before acquiring the contents of the handset) avoids any operating system-related forensic issues associated with an indirect read of (U)SIM data. However, removing the SIM can reportedly cause data to be deleted on some phones [Goo03]. In addition, if removing the battery is required to gain access to the SIM, a loss of the date and time values can occur in certain phones [Mel04]. Similarly, when the battery is removed from certain smart phones, the user data present in volatile memory can be lost if a second backup battery is not built-in to support battery replacement or cannot maintain volatile memory for a sufficient time. In situations where lost data can occur, the acquisition sequence described at the beginning of this section for active phones should be followed.
6.4.3 (U)SIMs
Similar to a mobile phone, to acquire data from a (U)SIM, a connection must be established from the forensic workstation to the device, using a reader. As before, the version of the tool being used should be documented, along with any applicable patches or errata from the manufacturer applied to the tool. Once the connection has been established, the forensic software tool can proceed to acquire data from the device.
Capturing a direct image of the (U)SIM data is not possible because of the protection mechanisms built into the module. Instead, forensic tools send command directives called Application Protocol Data Units (APDUs) to the (U)SIM to extract data logically, without modification, from each elementary data file of the file system. The APDU protocol is a simple command-response exchange. Each element of the file system defined in the GSM standards has a unique numeric identifier assigned, which can be used to walk through the file system and recover data by referencing an element and performing some operation, such as reading its contents.
47
Guidelines on Cell Phone Forensics
Because (U)SIMs are highly standardized devices, few issues exist with regard to a logical acquisition. The main consideration is selecting a tool that reports the status of any PINs and recovers the data of interest. Vast differences exist in the data recovered by (U)SIM tools, with some recovering only the data thought to have the highest relevance in a typical investigation, and others performing a complete recovery of all data, even though much of it is network related with little investigative value.
6.5 Obstructed Devices
Obstructed devices typically refer to devices that are shut off and require successful authentication using a password or some other means to gain access. Common obstructed devices include mobile phones with missing identity modules, with PIN-enabled identity modules, or with an enabled phone lock setting. Password locked memory cards are beginning to emerge as the capability to set such locks appears in more phones. Content encryption capabilities are currently not offered as a standard feature in most cell phones, but may be available through an add-on application.
A number of ways exist to recover data from obstructed devices. They fall into three classes: investigative, software-based, and hardware-based methods. Experimenting with a seized device to bypass or overcome its security mechanisms should be avoided and instead done with a test device of the same make, model, and version of software. Seemingly simple actions can cause the device to lock permanently or lose data, making evidence recovery more difficult or impossible. PIN and password-protected devices may require the expertise of a specially trained forensic specialist to gain access to the device contents in a forensically sound manner, once conventional techniques have been exhausted. Preserving the contents of the device when conventional techniques are applied is vital to allow more sophisticated techniques to succeed.
Software and hardware-based methods are often directed at a particular device or narrow class of device, as are some investigative methods. In developing a method, the following actions should be considered for determining possible approaches:
􀂄 Contacting the device manufacturer and service provider for information on known backdoors and vulnerabilities that might be exploited.
􀂄 Reviewing manufacturer specifications and other documentation when formulating plausible approaches.
􀂄 Contacting commercial evidence recovery professionals that specialize in handheld devices.
􀂄 Searching Internet sites for developer, hacker, and security exploit information.
􀂄 Contacting device maintenance and repair companies, as well as commercial organizations that provide architecture information on handheld device products.26
26 For handheld device architecture information, see http://www.portelligent.com/prodserv.asp.
48
Guidelines on Cell Phone Forensics
6.5.1 Investigative Methods
Investigative methods are procedures the investigative team can apply, which require no forensic software or hardware tools. The most obvious methods are the following:
􀂄 Ask the suspect – If a device is protected with a password, PIN, token, or other authentication mechanism involving knowledge-based authentication, the suspect can be queried for this information during the initial interview.
􀂄 Review seized material – Passwords or PINs may be written down on a slip of paper and kept with or near the phone, at a desktop computer used to synchronize with the phone, or on the suspect’s person, such as within a wallet, and may be recovered through visual inspection. Packaging material for a (U)SIM or a GSM phone may disclose a PIN unlocking key (PUK) that can be used to reset the value of the PIN.
􀂄 Manually supply commonly used input – Users may weaken a mechanism by the way in which it is used. For example, if the (U)SIM of a mobile phone requires a 4-digit PIN, an examiner may wish to try a commonly used PIN combination (e.g.,1-2-3-4, 0-0-0-0, etc.), as one of the three attempts allowed before the device is completely locked down [Kni02]. Most (U)SIM tools, but not all, report the remaining number of attempts.
􀂄 Ask the service provider – If a GSM mobile phone is protected with a PIN-enabled (U)SIM, the SIM’s identifier (i.e., the ICCID) can be obtained from it and used to request the PUK from the service provider and reset the PIN. Some service providers offer the ability to retrieve the PUK on-line, by entering the telephone number of the phone and certain subscriber information into public web pages set up for this purpose.
􀂄 Exploit possible insecure settings – Some models of phones may easily yield access because of common user configuration errors. For example, certain Motorola phones provide a two-level access mechanism that can be enabled on the handset: a phone lock needed to gain access to the device and a security code needed to reset the phone lock in case it is forgotten. A user may set the phone lock, but not change the security code from its default value, allowing anyone to gain access using the default security code value to reset or disable the phone lock.
6.5.2 Software-based Methods
Software-based methods involve software techniques used to break or bypass authentication mechanisms. While some general-purpose software techniques and tools may apply to a class of mobile phones, most of the techniques are specialized for a specific model within a class. When a specialized technique is developed, it is normally programmed and tested on an identical test device. Software-based methods include the following:
􀂄 Exploit known weaknesses in authentication – If an authentication mechanism is weak, exploiting the weaknesses to defeat it may be possible. For example, early password protection schemes on Palm OS PDAs obfuscated the password using a reversible algorithm [Kin01], allowing it to be recovered easily from devices running version 4.0 or earlier, using a utility. Similarly, early versions of the Pocket PC
49
Guidelines on Cell Phone Forensics
ActiveSync protocol allow unlimited authentication attempts to be made without penalty, allowing a dictionary attack of commonly used passwords to be attempted. Some devices may have a reserve password or master password built into the authentication mechanism, which allows unfettered access when entered, bypassing the phone lock set by the user [Kni02, Smi06]. For example, the master security code for overriding the phone lock mechanism on certain Nokia handsets can be calculated directly from the equipment identifier.27 A number of GSM mobile phones allow acquisition, if a PIN-enabled (U)SIM is missing or removed from the device, as mentioned earlier. It is also possible to create a substitute (U)SIM for certain models of phones that fools them into treating the (U)SIM as though it were the original and allowing access.
􀂄 Gain access through a backdoor – Manufacturers often build in test facilities or have other software backdoors that an examiner can exploit to obtain information. For example, a few software tools are able to acquire the memory of certain phones directly through a diagnostic/debugging protocol that bypasses the authentication mechanism. Scanning the memory contents can reveal authentication information such as passwords or phone locks. The bootloaders on some mobile phones and PDA devices also support functions that, among other things, allow the devices’ memory to be read. For instance, the iPAQ 3900 and other models in that product series support the parrot bootloader, an unadvertised utility so named because of the bird that appears on the display [Log01]. When triggered by a specific combination key chord and provided appropriate commands via the serial port, the bootloader returns the contents of memory or copies it to a memory card. Similarly, the penguin bootloader for Linux handheld devices can be used to copy memory to a memory card.
􀂄 Exploit known system vulnerabilities – Mobile systems may possess system vulnerabilities within a standard interface protocol that an examiner can exploit to bypass authentication and gain access to information. For example, access to the device may be possible via a misconfigured network service [Cha02], a flaw in a standard networking protocol supported by the device, or an error in the protocol’s implementation that makes it susceptible to an attack method such as a buffer overflow. Possible communications interfaces for exploitation include the serial, USB, IrDA, Bluetooth, WiFi, and GSM/GPRS facilities.
Substitute (U)SIMs: Occasionally, a (U)SIM may not be recovered with a phone, or may be intentionally damaged and unusable with the phone, but needed for the acquisition of the phone with a forensic tool. One of the most common mistakes a forensic specialist can make is to insert another available (U)SIM into the phone to acquire the data with a forensic tool. Certain data stored in the memory of the phone, such as call logs (missed, incoming and outgoing calls) and SMS messages, is linked to the last (U)SIM used. Inserting a different (U)SIM causes that data to be erased from the phone’s memory. Some phones may also start copying SIM data to the phone memory when another (U)SIM is inserted.
27 For more information, see http://www.fonefunshop.co.uk/Unlocking/nokiasecuritycode.htm.
50
Guidelines on Cell Phone Forensics
A better approach is to create a substitute (U)SIM to use with the phone that mimics key characteristics of the original (U)SIM, tricking the phone to accept it as the original. Several tools that can be used to create a substitute (U)SIMs are the Forensic SIM Toolkit, GSM .XRY SIM ID Cloner, SIMgen, and the TULP 2G SIMIC protocol plug-in.
Substitute (U)SIMs, sometimes referred to as access cards, can be useful in a number of situations:
• As already mentioned, if the (U)SIM for a phone is missing or damaged and needed for acquisition with a forensic tool, a substitute (U)SIM allows phone data to be recovered.
• If the (U)SIM for a phone is present, but requires a PUK code, a substitute (U)SIM allows acquisition to proceed immediately without having to contact the service provider for the PUK.
• If radio isolation is needed to prohibit communications to acquire evidence from a phone, avoiding incoming calls or messages from altering or modifying evidence, a substitute (U)SIM can be used in lieu of a Faraday room or enclosure.
• If the forensic tool used to examine a handset accesses the resident (U)SIM indirectly, using a substitute (U)SIM in the handset eliminates the possibility of the original being altered during examination.
The values by which the phone remembers the previously inserted (U)SIMs are the ICCID and the IMSI. Often only one of these values is used. Both identifiers are unique and used to authenticate the user to the network. If these values are known for a specific phone (e.g., either indirectly through the service provider records or directly by reading memory from the phone), it may be possible to prepare a substitute (U)SIM with the correct values needed to trick the phone to accepting it. While the minimum data needed to create a (U)SIM may be simply one of these two values, some phones may require additional data to be populated on the (U)SIM to be correctly recognized. The possibility exists that data, other than user data, may change on the handset as the result of inserting a substitute (U)SIM [INT06].
6.5.3 Hardware-based Methods
Hardware-based methods involve a combination of software and hardware to break or bypass authentication mechanisms and gain access to the device. For example, the value of a phone lock can be readily recovered from a memory dump of certain phones, allowing for a follow-on logical acquisition. Few general-purpose hardware-based methods apply to a general class of mobile phone. Most of the techniques are specialized for a specific model within a class. As with software-based methods, when a specialized technique is developed, a test device identical to the one under examination should be used. The device manufacturer may also provide useful information and tools for extracting data. Hardware-based methods include the following:
􀂄 Gain access through a hardware backdoor – Hardware backdoors, such as interfaces for debugging, production testing, or maintenance, may be used to gain access to memory. For example, some mobile phones have active hardware test points on the circuit board that can be used to probe the device. Many manufacturers now support the JTAG standard, which defines a common test interface for processor, memory, and other semiconductor chips, on their devices [Int96]. Forensic examiners can communicate with a JTAG-compliant component by utilizing software and an add-in hardware controller in a personal computer card slot or a special purpose
51
Guidelines on Cell Phone Forensics
standalone programmer device to probe defined test points [Will05]. The JTAG testing unit can send commands and data to the JTAG-compliant component and return the results to the unit for storage and rendition [Bre06, Xjt03]. JTAG gives specialists another avenue for imaging devices that are locked or devices that may have minor damage and cannot be properly interfaced otherwise.
􀂄 Examine memory independently of the device – An experienced examiner may be able to examine memory chips directly on the device and extract information from them. For example, the Netherlands Forensic Institute has developed a general-purpose tool for examining a wide range of memory chips. Once physically connected via a memory clip, the tool is able not only to read and store memory contents, but also to overwrite them [Kni02]. Memory may also be acquired by dismantling the phone, heating the circuit board sufficiently to desolder the memory chips, and using a memory chip reader to access their contents [Will05].
􀂄 Find and exploit vulnerabilities – Mobile phone vulnerabilities discovered through close study and experimentation are sometimes posted on the Web.28 They can also be discovered through reverse engineering. Reverse engineering involves retrieving the operating system code from the ROM of a mobile phone identical to the one under examination and analyzing the code to understand its structure and use of the device hardware [Haa04]. With the understanding gained, any plausible vulnerabilities noted can be systematically tested to determine a useful exploit technique. For example, for a password authentication mechanism, it may be possible using memory injection to overwrite the password with a known value or replace the authentication program with a version that always authenticates successfully [Kni02]. Similarly, flipping two bits in a data structure, which determine whether the start-up password is active and configured, may turn off the mechanism completely, as reported for the XDA PDA/phone hybrid device [Its].
􀂄 Infer information by monitoring physical device characteristics – Techniques that monitor power consumption or other device characteristics have been effective in systematically determining the password or PIN. For example, forensic specialists report that the passwords of some electronic organizers have been uncovered by determining the address area of the password and, as characters are entered, systematically monitoring the data and address bus of those memory locations to reveal the value one character at a time [Kni02]. Differential power analysis, which has been shown to be effective in gaining information from smart cards, is another technique that could be applied [Aig]. Simply observing data on an interface can also reveal information. For example, the dialog between the phone and a password-protected memory card can be monitored to reveal the password supplied by the phone to unlock the card, which can then be used in an external examination to access the memory card contents.
􀂄 Use automated brute force – If a password mechanism has no restrictions on the number of manual attempts made and the examiner had time to spare, a brute force dictionary attack could be attempted. Normally, this approach would be out of the
28 For example, a security hole discovered in the Motorola MPx200 is discussed at http://msmobiles.com/news.php/1640.html.
52
Guidelines on Cell Phone Forensics
question. However, with automated keystroke entry, it is plausible. For example, the Netherlands Forensic Institute developed an automated password entry system for devices with a keyboard and screen. Equipped with a robot arm and video camera, the unit can systematically enter passwords until the correct entry is detected or, in the worst case, the keys become damaged [Kni02].
6.6 Tangential Equipment
Tangential equipment includes devices that contain memory and are associated with a mobile phone. The two main categories are memory cards and host computers to which a mobile phone has synchronized its contents. Surprisingly, USB memory drives, which are a common peripheral for host computers, are generally not a factor for mobile phones because of interface issues.
Mobile phones, especially higher smart phones, typically support Secure Digital (SD), MultiMedia Cards (MMC), and other types of removable media designed specifically for handheld devices, which can contain significant amounts of data. Memory cards are typically semiconductor memory, used as auxiliary user file storage, for backup of important content, or as a means to convey files to and from the device. The physical sizes of memory cards supported by handheld devices are noteworthy insofar as they are quite small, about the size of a coin, and easy to overlook. Therefore, investigators should take their time and thoroughly search the premises when seizing material. Data can be acquired from removable media with the use of a media reader and a forensic application used to image hard drives.
The data contained on a mobile phone is often present on a personal computer, due to the capability of mobile phones to synchronize or otherwise share information among one or more host computers. Such personal computers or workstations are referred to as synched devices. Because of synchronization, a significant amount of evidence on a mobile phone may also be present on the suspect’s laptop or personal computer, and recovered using a conventional computer forensic tool for hard drive acquisition and examination.
6.6.1 Synched Devices
Synchronization refers to the process of resolving differences in certain classes of data, such as e-mail residing on two devices (i.e., a mobile phone and a computer), to obtain a version that reflects any actions taken by the user (e.g., deletions or additions) on one device or the other. Synchronization of information may occur at either the record level or the file level. When done at the file level, any discrepancies from the last synchronization date and time result in the latest version automatically replacing the older version. Occasionally manual intervention may be needed if both versions were modified independently since the last synchronization occurred. Record level synchronization is done similarly, but with more granularity, whereby only out-of-date parts of a file are resolved and replaced.
Phones are typically populated with data from the personal computer during the synchronization process. A significant amount of informative data, therefore, may reside locally on a personal computer. Data from the phone can also be synchronized to the computer, through user-defined preferences in the synchronization software. Because the synchronized contents of a phone and personal computer tend to diverge quickly over time, additional information may be found in one device or the other.
53
Guidelines on Cell Phone Forensics
The synchronization software and the device type determine where the phone’s files are stored on the PC. Each synchronization protocol has a default installation directory, but the locale can be user specified.
6.6.2 Memory Cards
Mobile phones use a wide array of memory cards, ranging from the size of a contact lens to that of a matchbook. Unlike RAM within a device, such removable media is non-volatile storage and requires no battery to retain data. Memory card storage capacity ranges from 8MB to 2GB and beyond. As technological advances are made, such media becomes smaller and offers larger storage densities. Removable media extends the storage capacity of mobile phones, allowing individuals to store additional files beyond the device’s built-in capacity and to share data between compatible devices.
Some forensics tools are able to acquire the contents of memory cards; many are not. If the acquisition is logical, deleted data present on the card is not recovered. Fortunately, such media can be treated similarly to a removable disk drive, and imaged and analyzed using conventional forensic tools with the use of an external media reader. Memory card adapters exist that support an Integrated Drive Electronics (IDE) interface. Such adapters allow removable media to be treated as a hard disk and used with a write blocker, which ensures that the removable media remains unaltered. A Universal Serial Bus (USB) memory card reader used with write blocker hardware is also an available alternative.
Data contained on the media can be imaged and searched, and deleted files can be recovered, providing possibilities of uncovering evidence. One drawback is that phone data, such as SMS text messages, stored on the media may require manual decoding or a separate decoding tool to interpret. A more serious issue is that content protection features incorporated into the card may block the recovery of data. The most notable example is MMC cards that conform to version 4.1 of the standard, which provides for password protection and is supported increasingly on newer models of phones. Table 5 gives a brief overview of various storage media in use today.
Table 5: Memory Cards
Name
Characteristics
Compact Flash Card (CF)
Matchbook size (length-36.4 mm, width-42.8 mm, thickness-3.3 mm for Type I cards and 5mm for Type II cards)
50-pin connector, 16-bit data bus
MMCplus (compatible with original MultiMedia Card or MMC)
Postage stamp size (length-32 mm, width-24 mm, and thickness-1.4 mm)
13-pin connector, 1, 4, or 8 bit data bus
(7-pin connector, 1-bit data bus, MCC compatibility)
MMCmobile (compatible with original Reduced Size MMC or RS-MMC)
Thumbnail size (length-18 mm, width-24 mm, and thickness-1.4 mm)
13-pin connector, 1, 4, or 8 bit data bus
(7-pin connector, 1-bit data bus, RS-MMC compatibility)
Requires a mechanical adapter to be used in a full size MMCplus slot
MMCmicro
Contact lens size (length-14 mm, width-12 mm, and thickness-1.1 mm)
10-pin connector and a 1 or 4-bit data bus
Requires a mechanical adapter to be used in a full size MMCplus slot
Secure Digital (SD) Card
Postage stamp size (length-32 mm, width-24 mm, and thickness-2.1mm)
9-pin connector, 1 or 4-bit data bus
Features a mechanical erasure-prevention switch 54
Guidelines on Cell Phone Forensics
Name Characteristics
MiniSD Card
Thumbnail size (length-21.5 mm, width-20 mm, and thickness-1.4 mm)
9-pin connector, 1 or 4-bit data bus
Requires a mechanical adapter to be used in a full size SD slot
MicroSD (formerly Transflash)
Contact lens size (length-15 mm, width-11 mm, and thickness-1 mm)
6-pin connector, 1 or 4-bit data bus
Requires a mechanical adapter to be used in a full size SD slot
Memory Stick
Chewing gum stick size (length-50 mm, width-21.45 mm, thickness-2.8 mm)
10-pin connector, 1-bit data bus
Features a mechanical erasure-prevention switch
Memory Stick Duo
Partial chewing gum stick size (length-31mm, width-20 mm, thickness-1.6 mm)
10-pin connector, 4-bit data bus
Features a mechanical erasure-prevention switch
Requires a mechanical adapter to be used in a full size Memory Stick slot
Memory Stick Micro
Contact lens size (length-12.5 mm, width-15 mm, and thickness-1.2 mm)
11-pin connector, 4-bit data bus
Requires a mechanical adapter to be used in a full size Memory Stick slot
Memory cards may support extensions for added functionality. For example, the X-Mobile Card from Renesas is a MultiMedia card that contains both a smart card and a memory chip. Through the use of a built-in controller, the card is able to function in either mode. Another example is SD cards that have WiFi or other wireless capability.
6.6.3 USB Memory Drives
USB drives, sometimes referred to as thumb drives, are chewing-gum-pack size hardware components with a USB connector at one end, and built as a printed circuit board within a plastic housing that encases a processor and memory. USB memory drives can be treated similarly to a removable disk drive, and imaged and analyzed using conventional forensic tools.
Many manufacturers produce USB memory drives of various capacities. Currently, however, very few mobile phones support host USB ports, which are needed to interface with these peripherals. Moreover, few if any USB drive manufacturers provide the necessary drivers for mobile phone operating systems. This situation is understandable, given that host USB specifications intend for an interface to be capable of supporting multiple devices sharing the port, which if permitted would place a significant power drain on the battery of the device. Other factors include the restrictions in mobility imposed by a USB drive sticking out of the side of a mobile phone compared to the benefits of providing one or more memory card slots that completely contain a card when inserted.
As with memory card extensions, USB drives may offer additional capabilities such as a wireless interface. Access to memory contents may also be protected through a built-in fingerprint reader or some other mechanism such as a smart card, which complicates the acquisition process. However, for the reasons mentioned above these peripherals are not normally associated with mobile phones. 55
Guidelines on Cell Phone Forensics
7. Examination and Analysis
The examination process uncovers digital evidence, including that which may be hidden or obscured. The results are gained through applying established scientifically based methods, and should describe the content and state of the data fully, including the source and the potential significance. Data reduction, separating relevant from irrelevant information, occurs once the data is exposed. The analysis process differs from examination in that it looks at the results of the examination for its direct significance and probative value to the case [ACPO]. Examination is a technical process that is the province of a forensic specialist. However, analysis may be done by roles other than the forensic analyst, such as the investigator or the forensic examiner.
The examination process begins with a copy of the evidence acquired from the device. Fortunately, compared with classical examination of individual workstations or network servers, the amount of acquired data to examine is much smaller with mobile phones. Because of the prevalence of proprietary case file formats, the forensic toolkit used for acquisition will typically be the one used for examination and analysis. Interoperability among the acquisition and examination facilities of different tools is also unlikely for this reason, with the exception of certain Palm OS devices and perhaps other devices with a PDA lineage.
The examiner should have studied the case, if possible, and become familiar with the parameters of the wrongdoing, the parties involved, and potential evidence that might be found. Conducting the examination in a partnership with the forensic analyst or the investigator guiding the case construction is advisable for the examiner. The investigator or analyst provides insight into the types of things sought, while the forensic examiner provides the means to find relevant information that might be on the system [Wol03].
If the forensic examiner performs the analysis independently, without conferring directly with the forensic analyst or investigator, the understanding gained by studying the case should provide ideas about the type of data to target and specific keywords or phrases to use when searching the acquired data. Depending on the type of case, the strategy varies. For example, a case about child pornography may begin with browsing all of the graphic images on the system, while a case about an Internet-related offense might begin with browsing the Internet history files [Wol03].
Examination often reveals not only potentially incriminating data but also useful information such as passwords, network logon names, and Internet activity. Certain data can also provide linkage to other potential sources of evidence maintained elsewhere, particularly by network service providers. In addition to evidence directly related to an incident, information can be uncovered about the lifestyle of suspects, their associates, and the types of activities in which they are involved.
7.1 Potential Evidence
Mobile phone manufacturers typically offer a similar set of information handling features and capabilities, including Personal Information Management (PIM) applications, messaging and e-mail, and Web browsing. The set of features and capabilities can vary, of course, with the era in which the phone was manufactured, the version of firmware running, modifications 56
Guidelines on Cell Phone Forensics
made for a particular service provider, and any modifications or applications installed by the user. The potential evidence on these devices includes the following items:
􀂄 Subscriber and equipment identifiers
􀂄 Date/time, language, and other settings
􀂄 Phonebook information
􀂄 Appointment calendar information
􀂄 Text messages
􀂄 Dialed, incoming, and missed call logs
􀂄 Electronic mail
􀂄 Photos
􀂄 Audio and video recordings
􀂄 Multi-media messages
􀂄 Instant messaging and Web browsing activities
􀂄 Electronic documents
􀂄 Location information
Other data found on a mobile phone may also prove useful in an investigation. For example, something seemingly immaterial such as ring tones can have relevance, given that mobile phone users often load distinctive ring tones onto a phone to distinguish theirs from others’. A witness to an incident may recall having heard a particular tune on a suspect’s phone, which may contribute to the identification of an individual. Even esoteric network information found on a (U)SIM may prove useful in an investigation. For example, if a network rejects a location update from a phone attempting to register itself, the list of forbidden network entries in the Forbidden PLMNs elementary file is updated with the code of the country and network involved [3GP05a]. The phone of an individual suspected of traveling to a neighboring country might be checked for this information.
The items present on a device are dependent not only on the features and capabilities of the phone, but also on the voice and data services subscribed to by the user. For example, prepaid phone service typically does not include data services and rules out the possibility for multi-media messaging, electronic mail, and Web browsing. Similarly, a contract subscription may selectively exclude certain types of service, though the phone itself could support them.
Reported Examples: News articles sometimes describe the types of digital evidence found on a mobile phone that was used successfully in an investigation. Some illustrative examples are given below.
􀂃 Text Message and Call Data – “A pastor of the Pentecostal congregation in the small community of Knutby was sentenced to life in prison for persuading one of his lovers (the au pair) to shoot and kill his wife and trying to kill the husband of another mistress. Two days after the murder, the pastor’s au pair Sarah S. claimed that she did it. Despite her claims … the police believed she had an accomplice.” “The strongest evidence against the pastor was the extensive communication through text messages and voice calls between him and the au pair on the day of the murder and just before that. What they did not know was that their (anonymously sent and) carefully deleted text messages were possible to recover.” [Bur05]
57
Guidelines on Cell Phone Forensics
􀂃 Email Data – “The case against Dan Kincaid was strong. A homeowner in northern Boise, Idaho, had identified Mr. Kincaid, 44, as the person who had broken into his suburban house. But eyewitness testimony isn't always rock solid, and Mr. Kincaid was refusing to talk. The police wanted more. So they searched Mr. Kincaid's BlackBerry e-mail-capable phone electronically, and found all the evidence they needed.“ “‘Just trying to find a way out of this neighborhood without getting caught,’ Mr. Kincaid wrote to his girlfriend on Aug. 1, 2005, shortly after he had been spotted. ‘Dogs bark if I'm between or behind houses. ... ‘ ‘Cops know I have a blue shirt on,’ he continued. ‘I need to get out of here before they find me.’ Faced with his e-mailed admission, Mr. Kincaid agreed to a deal with prosecutors over that crime and a string of others.” [Sha06]
􀂃 Image and Multi-media Message Data – “It was alleged that a young boy had conducted a serious assault on another child whilst his friend took pictures on his mobile phone. The young boy was initially denying all knowledge of the incident, until the Police were informed that there was evidence on the mobile phone.” “… analysts recovered the pictures in question in a forensically sound manner following ACPO guidelines. They also recovered a deleted multimedia text message sent to another child with one of the pictures attached to it.”29
􀂃 Location Data – “Mr Bristowe told BBC News Online: ‘It was mobile phone evidence which made the police look more closely at Huntley. He had been Mr. Useful, helping them to search the college grounds, but when they checked Jessica's phone and discovered when and where it had been switched off alarm bells began to ring… (Jessica's phone) disengaged itself from the network, in effect it says goodbye’ at 1846 BST on the Sunday when the girls disappeared. Jessica's phone contacted the Burwell mast when it was turned off.” "’The police provided us with a map of the route they thought the girls would have taken, and the only place on that route where the phone could have logged on to Burwell (and disengaged itself) was inside or just outside Huntley's house.’ It is believed to be that crumb of crucial evidence which forced Huntley to change his story earlier this year and suddenly admit the girls died in his bathroom.” [Sum03]
Two types of computer forensic investigations generally take place. The first type is where an incident has occurred, but the identity of the offender is unknown (e.g., a hacking incident). The second is where the offender and the incident are both known (e.g., a child-porn investigation). Prepared with the background of the incident, the forensic examiner and analyst can proceed toward accomplishing the following objectives:
􀂄 Gather information about the individual(s) involved {who}.
􀂄 Determine the exact nature of the events that occurred {what}.
􀂄 Construct a timeline of events {when}.
􀂄 Uncover information that explains the motivation for the offense {why}.
29 For more information, see “Mobile Phone Analysis – video retrieval” Case Study at http://www.ccl-forensics.com/Case_Studies-27.html?linkto=38.
58
Guidelines on Cell Phone Forensics
􀂄 Discover what tools or exploits were used {how}.
Table 6 below provides a cross reference of generic evidence sources commonly found on mobile phones and their likely contribution toward satisfying the above objectives. In many instances, the data is peripheral to an investigation, useful in substantiating or refuting the claims of an individual about some incident. On occasion, direct knowledge, motivation, and intention may be established. Most of the evidence sources are from PIM data, call data, messaging, and Internet related information. Other support applications that run on the device potentially provide other evidence sources. User files placed on the device for rendition, viewing, or editing are also another important evidence source. Besides graphic files, other relevant file content includes audio and video recordings, spreadsheets, presentation slides, and other similar electronic documents. Installed executable programs may also have relevance in certain situations. Perhaps the most important data recovered is that which links to information held by the service provider. Service providers maintain databases for billing or debiting accounts based on call logs, which can be queried using the subscriber or equipment identifiers. Similarly, undelivered SMS text messages, multi-media, or voice messages may also be recoverable.
Table 6: Cross Reference of Sources and Objectives
Who
What
Where
When
Why
How
Subscriber/Device Identifiers
X
Call Logs
X
X
Phonebook
X
Calendar
X
X
X
X
X
X
Messages
X
X
X
X
X
X
Location
X
X
Web URLs/Content
X
X
X
X
X
X
Images/Video
X
X
X
X
X
Other File Content
X
X
X
X
X
X
7.2 Applying Tools
Once a copy of the acquisition results is available, the next steps involve searching the data, identifying evidence, creating bookmarks, and developing the contents of a final report. Knowledge and experience with the tools used for examination is extremely valuable, since proficient use of the available features and capabilities of a forensic tool can greatly speed the examination process.
Forensic tools are a crucial component, as they translate data from a raw encoded form to a format and structure that is understandable by the examiner, enabling identification and recovery of evidence. A variety of different and sometimes unusual encodings are used with
59
Guidelines on Cell Phone Forensics
cell phone data and found in the memory of handsets and (U)SIMS, such as text encoded in the packed 7-bit GSM alphabet, which would be onerous, errorful, and time consuming to decode manually.
It is important to note that forensic tools have the possibility to contain some degree of error in their operation. For example, the implementation of the tool may have a programming error; the specification of a file structure used by the tool to translate bits into data comprehensible by the examiner may be inaccurate or out of date; or the file structure generated by another program as input may be incorrect, causing the tool to function improperly [Car02]. Experiments conducted with mobile phone forensic tools indicate a prevalence of such errors [Aye05, Jan06, Aye07]. Therefore, having a high degree of trust and understanding of the tool’s ability to perform its function properly is essential.
A knowledgeable suspect may tamper with device information, such as purposefully misnaming a file extension to foil the workings of a tool, altering the date/time of the phone to falsify timestamps associated with logged activities, creating false transactions in the memory of the phone or (U)SIM, or applying a wiping tool to remove or eliminate data from memory. Seasoned experience with a tool provides an understanding of its limitations, allowing an examiner to compensate for them and avoid error to achieve the best possible results.
To uncover evidence, specialists should gain a background of the suspect and offense and determine a set of terms for the examination. Search expressions can be developed in a systematic fashion, such as using contact names that may be relevant. By proceeding systematically, the specialist creates a profile for potential leads that may unveil valuable findings. Forensic Examination of Digital Evidence – A Guide for Law Enforcement, produced by the U.S. Department of Justice [DOJ04], offers the following suggestions for the analysis of extracted data:
􀂄 Ownership and possession – Identify the individuals who created, modified, or accessed a file, and the ownership and possession of questioned data by placing the subject with the device at a particular time and date, locating files of interest in non-default locations, recovering passwords that indicate possession or ownership, and identifying contents of files that are specific to a user.
􀂄 Application and file analysis – Identify information relevant to the investigation by examining file content, correlating files to installed applications, identifying relationships between files (e.g., e-mail files to e-mail attachments), determining the significance of unknown file types, examining system configuration settings, and examining file metadata (e.g., documents containing authorship identification).
􀂄 Timeframe analysis – Determine when events occurred on the system to associate usage with an individual by reviewing any logs present and the date/time stamps in the file system, such as the last modified time. Besides call logs, the date/time and content of messages and e-mail can prove useful. Such data can also be corroborated with billing and subscriber records kept by the service provider [Hos98].
􀂄 Data hiding analysis – Detect and recover hidden data that may indicate knowledge, ownership, or intent by correlating file headers to file extensions to show intentional obfuscation; gaining access to password-protected, encrypted, and compressed files;
60
Guidelines on Cell Phone Forensics
gaining access to steganographic information detected in images; and gaining access to reserved areas of data storage outside the normal file system.
The capabilities of the tool and the richness of its features, versus the operating system and type of device under examination, determines what information can be recovered, identified, and reported, and the amount of effort needed. The search engine plays a significant role in the discovery of information used for the creation of bookmarks and final reporting. For example, some tools used to search for textual evidence identify and categorize files based on file extension, where others use a file signature database. The latter feature is preferable since it eliminates the possibility of missing data because of an inconsistent file name extension (e.g., eliminating a text file whose extension was changed to that of a graphics or image file). Similarly, the ability for the tool to find and gather images automatically into a common graphics library for examination is extremely useful.
Searching data for positive results on incriminating evidence takes patience and can be time consuming. Some tools have a simple search engine that matches an input text string exactly, allowing only for elementary searches to be performed. Other tools incorporate more intelligent and feature rich search engines, allowing for generalized regular expression patterns (grep) type searches, including wildcard matches; filtering of files by extension, directory, etc.; and batch scripts that search for specific types of content (i.e., e-mail addresses, URLs). The greater the tool’s capabilities, the more the forensic examiner benefits from experience with and knowledge of the tool.
7.3 Call and Subscriber Records
Records maintained by the service provider capture information needed to accurately bill a subscriber or, in the case of a prepaid service plan, debit the balance. The records collected are referred to as call detail records, which are generated by the switch handling an originating call or SMS message from a mobile phone. For some service providers, the records may also include fixed line, international gateway, and voice over IP transaction information. While the content and format of these records can differ widely from one service provider to another, the fundamental data needed to identify the subscriber/device initiating the call, the initial cell servicing the call, the number dialed, and the duration of the call is captured. Detailed information such as the identifier of the cell (i.e., the BTS) and the sector involved are often included. Appendix D gives an example of the data elements of a call detail record, specified in the GSM standards. As one can see, considerable discretion about what is implemented is left open to the service providers and network operators.
The retention period for maintaining call detail and other types of records varies among service providers [GSM05]. However, the period is generally limited, requiring immediate action to avoid data loss. One should act quickly to have the cellular carrier preserve any data that can be used to identify communications that have occurred and are linked to the parties of interest, stressing non-disclosure of that action to the account subscriber [Ala03, Ala04]. The data available may include subscriber records, the content of email servers (i.e., undelivered email), email server logs, RADIUS or other IP address authentication logs, the content of SMS and MMS message servers, and the content of voicemail servers. Note that certain types of undelivered content, such as voicemail, may be considered in transit from a legal standpoint in some jurisdictions, and obtaining or listening to them without the proper authority may be treated as an illegal interception of communications [Ala03]. While the USA PATRIOT Act
61
Guidelines on Cell Phone Forensics
eliminated this issue at the federal level, state statutes may be intentionally more restrictive or not yet be realigned completely with the federal statute.30
Call detail records can be obtained from U.S. service providers through their law enforcement point of contact, with the appropriate legal documents. Procedures may vary among states in the U.S., and new laws regarding proper seizure are continually legislated. Procedures also vary for getting records from service providers and network operators located in other countries. Close and continuing consultation with legal counsel is advised. Various on-line law enforcement forums can also be helpful in identifying points of contact and sharing tips on procedures for accurately obtaining the required data.31
Besides call detail records, subscriber records maintained by a service provider can provide data useful in an investigation. For example, for GSM systems, the database usually contains the following information about each customer [Wil03]:
􀂄 Customer name and address
􀂄 Billing name and address (if other than customer)
􀂄 User name and address (if other than customer)
􀂄 Billing account details
􀂄 Telephone number (MSISDN)
􀂄 IMSI
􀂄 (U)SIM serial number (ICCID)
􀂄 PIN/PUK for the (U)SIM
􀂄 Services allowed
Other useful information, including phone numbers (i.e., work or home), contact information (e.g., email address), and credit card numbers used, may also be retained in subscriber records. Pay-as-you-go prepaid phones purchased anonymously over the counter may also have useful information maintained with their accounts, which was supplied by the subscribers, such as the credit card numbers used for purchases of additional time or an email address registered online for receipt of notifications. Gaining access to the call records of prepaid phones should not be ruled out.
Call detail records and other records maintained by the service provider can be requested using subscriber or equipment identifier information seized or acquired from a phone or (U)SIM. Subscriber information often used for this purpose includes the IMSI from the (U)SIM and the cell phone number. Equipment identifiers used are the ESN or IMEI of the phone and the
30 For example, see the California wiretap clarification bill at http://info.sen.ca.gov/pub/bill/asm/ab_1301-1350/ab_1305_cfa_20050603_115538_sen_comm.html.
31 For example, see the PhoneForensics Yahoo Group at http://groups.yahoo.com/group/phoneforensics/ or the High Tech Crime Consortium mail list at https://htcc.secport.com/mailman/listinfo/htcc.
62
Guidelines on Cell Phone Forensics
serial number (i.e., ICCID) of the (U)SIM. The search criteria used could be, for example, all calls received by a certain phone number (e.g., that of a victim) or all calls handled by a base station responsible for a particular cell (i.e., to determine who was in a certain area at a certain time) [Wil05]. The analysis of the initial set of records obtained usually leads to additional requests for related records of other subscribers and equipment, based on the data uncovered. For example, frequent calls to a victim’s mobile phone from one or more other phones before a homicide would logically lead to interest in obtaining the records of the caller(s).
Call detail records can be analyzed for a variety of purposes. For example, a service provider may use them to understand the calling patterns of their subscribers and the performance of the network [Aja06, Hin96]. Call detail records can also be used with cell site tower information obtained from the service provider to translate cell identifiers into geographical locations for the cells involved and identify the general locale from which calls were placed. While plotting call record locations and information onto a map can sometimes be useful, it does not necessarily provide a complete and accurate picture. Cell towers can service phones at distances of up to 35 kilometers (approximately 21 miles) and may service several distinct sectors. Radio frequency coverage maps maintained by the service provider can be obtained to create a more exact portrayal of the data for the sectors involved. The results of the data analysis can be used to corroborate or refute statements made by individuals regarding their whereabouts at a given time. A change of cell identifier between the beginning and the end of a call, over a series of calls, may also indicate a general direction of travel or pattern of behavior.
Cell boundaries are somewhat fuzzy. Various factors, such as terrain, seasonal changes, antenna performance, and call loading, affect the coverage area of cells and the plausible locale to associate with a call record. Detailed field tests and measurements may be required to ensure accuracy the analysis. Such surveys are regularly performed by network operators to verify and improve network performance [Ko96]. Tools also exist to aid law enforcement in performing cell site analysis and mapping activities independently.32 In some situations, however, such as densely populated urban locations involving microcells or picocells with a limited coverage area, location determination may be relatively straightforward by the very nature of the network [Gar01].
Identifying the geographical coverage of specific cells can provide valuable information when combined with call detail records, geographically establishing plausible locations with some degree of certainty for the times involved. Professional criminals are aware of these capabilities and may attempt to turn them to their advantage by having someone use their phone to establish a false alibi. Attempts at evasion may also occur. A common ploy used is to purchase, use, and quickly dispose of pay-as-you-go prepaid phones to minimize exposure or use stolen phones. To obfuscate usage and complicate analysis of records, a variety of different (U)SIMs may be swapped among different GSM/UMTS handsets.
Careful analysis of the call records in conjunction with other forms of available evidence overcomes most of these kinds of attempts at evasion. For example, call detail records of pay-as-you-go prepaid phones are maintained by and available from network providers, the same as for contract subscriptions. By analyzing the patterns and content of communications and
32 For example, see the Cell View information at http://www.icardforensics.com/documents/CellSiteMonitor.pdf or the CSurv information at http://www.teeltech.com/tt/TeelTechCsurv.pdf.pdf.
63
Guidelines on Cell Phone Forensics
mapping the evidence to known associates of a suspect, ownership of such phones is possible to establish. Other traditional forms of forensic evidence may also be used to establish ownership.
64
Guidelines on Cell Phone Forensics
8. Reporting
Reporting is the process of preparing a detailed summary of all the steps taken and conclusions reached in the investigation of a case. Reporting depends on maintaining a careful record of all actions and observations, describing the results of tests and examinations, and explaining the inferences drawn from the evidence. A good report relies on solid documentation, notes, photographs, and tool-generated content.
Reporting occurs once the data has been thoroughly searched and relevant items bookmarked. Many forensic tools come with a built-in reporting facility that usually follows predefined templates and may allow customization of the report structure. Permitted customizations include allowing for organization logos and report headers and selection of styles and structure to provide a more professional look tailored to the organization’s needs. Reports generated by a forensic tool typically include items from the case file, such as the specialist’s name, a case number, a date and title, the categories of evidence, and the relevant evidence found. Report generation typically either outputs all of the data obtained or allows examiners to select relevant data (i.e., bookmarked items) for the final report. Including only relevant findings in the report minimizes its size and lessens confusion for the reader.
The software-generated contents are only one part of the overall report. The final report contains the software-generated contents along with data accumulated throughout the investigation that summarizes the actions taken, the analysis done, and the relevance of the evidence uncovered. Ideally, the supporting documentation is in electronic form and able to be incorporated directly into the report.
Reporting facilities vary significantly across mobile device acquisition applications. Report generation typically can render a complete report in one of several common formats (e.g., .txt, .rtf, .csv, .doc, .html) or at least provide a means to export out individual data items to compose a report manually. A few tools include no means of report generation or data export and instead require examiners to capture individual screenshots of the tool interface for later assembly into a report format. Regardless of how reports are generated, checking that the finalized report is consistent with the data presented in the user interface representation is vital to identify and eliminate any possible inconsistencies that may appear [Aye05, Jan06, Aye07].
The ability to modify a pre-existing report and incorporate data (e.g., images, video stills) captured by alternative means is advantageous. Auxiliary acquisition techniques are sometime required to recover specific data types, as mentioned earlier. For example, video recording a manual examination documents the recovery of evidence that the automated forensic tool did not acquire. Video editing software allows still images to be captured for inclusion into the report. Snapshots could also be taken of the manual exam using a digital camera, though the process is less efficient and does not document the entire process, nor allows the entire procedure to be viewed if questions arise.
The type of data determines whether it is presentable in a hard-copy format. Today, many popular cellular devices are capable of capturing video and audio. Such evidentiary data (e.g., audio, video) cannot be presented in a printed format and instead should be included with the finalized report on removable media (e.g., CD-ROM, DVD-ROM, or thumb drive) along with the appropriate application for proper display. 65
Guidelines on Cell Phone Forensics
Reports of forensic examination results should include all the information necessary to identify the case and its source, outline the test results and findings, and bear the signature of the individual responsible for its contents. In general, the report may include the following information [DOJ04]:
􀂄 Identity of the reporting agency
􀂄 Case identifier or submission number
􀂄 Case investigator
􀂄 Identity of the submitter
􀂄 Date of receipt
􀂄 Date of report
􀂄 Descriptive list of items submitted for examination, including serial number, make, and model
􀂄 Identity and signature of the examiner
􀂄 The equipment and set up used in the examination
􀂄 Brief description of steps taken during examination, such as string searches, graphics image searches, and recovering erased files.
􀂄 Supporting materials such as printouts of particular items of evidence, digital copies of evidence, and chain of custody documentation
􀂄 Details of findings:
􀂃 Specific files related to the request
􀂃 Other files, including deleted files, that support the findings
􀂃 String searches, keyword searches, and text string searches
􀂃 Internet-related evidence, such as Web site traffic analysis, chat logs, cache files, e-mail, and news group activity
􀂃 Graphic image analysis
􀂃 Indicators of ownership, which could include program registration data
􀂃 Data analysis
􀂃 Description of relevant programs on the examined items 66
Guidelines on Cell Phone Forensics
􀂃 Techniques used to hide or mask data, such as encryption, steganography, hidden attributes, hidden partitions, and file name anomalies
􀂄 Report conclusions
Digital evidence, as well as the tools, techniques and methodologies used in an examination, is subject to being challenged in a court of law or other formal proceedings. Proper documentation is essential in providing individuals the ability to re-create the process from beginning to end. As part of the reporting process, making a copy of the software used and including it with the output produced is advisable. This is especially pertinent for custom tools, since confusion about the version of the software used to create the output is eliminated, should it become necessary to reproduce forensic processing results at a later time. The same practice applies to commercial software tools, which could be upgraded after an examination is completed [NTI].
67
Guidelines on Cell Phone Forensics
9. References
[3GP02] 3GPP2 (2002), Removable User Identity Module for Spread Spectrum Systems, 3rd Generation Partnership Program 2, 3GPP2 C.S0023-A, Version 1.0, September 13, 2002, .
[3GP05a] 3GPP (2005a), Specification of the Subscriber Identity Module - Mobile Equipment (SIM - ME) interface, 3rd Generation Partnership Project, TS 11.11 V8.13.0 (Release 1999), Technical Specification, (2005-06).
[3GP05b] 3GPP (2005b), Technical Realization of the Short Message Service (SMS), 3rd Generation Partnership Project, TS 23.040 V6.6.0 (Release 6), Technical Specification (2005-12).
[3GP98] 3GPP (1999), Alphabets and Language-specific Information, 3rd Generation Partnership Project, TS 03.38, version 7.2.0 (Release 1998), Technical Specification (1999-07).
[ACPO] Good Practice Guide for Computer-based Electronic Evidence, Association of Chief Police Officers, Version 3, .
[Aig] Manfred Aigner, Elisabeth Oswald, Power Analysis Tutorial, Seminar Paper, Institute for Applied Information Processing and Communication, .
[Aja06] Ireti Ajala, Spatial Analysis of GSM Subscriber Call Data Records, Directions Magazine, Mar 07, 2006, .
[Ala03] Searching Voicemail and E-mail, Point of View, Alameda County District Attorney's Office, Winter 2003, .
[Ala04] Phone, E-mail, and Internet Records, Point of View, Alameda County District Attorney's Office, Fall 2004, .
[Aye05] Rick Ayers, Wayne Jansen, Nicolas Cilleros, Ronan Daniellou, Cell Phone Forensics Tools: An Overview and Analysis, NIST Interagency Report (IR) 7250, October 2005, .
[Aye07] Rick Ayers, Wayne Jansen, Aurelien Delaitre, Ludovic Moenner, Cell Phone Forensics Tools: An Overview and Analysis Update, NIST Interagency Report (IR) 7387, February 2007.
[Bre06] Breeuwsma, M. F., Forensic imaging of embedded systems using JTAG (boundary-scan), Digital Investigation, Volume 3, Issue 1, 2006, pp.32-42.
68
Guidelines on Cell Phone Forensics
[Bos05] Jeroen van den Bos, Ronald van der Knijf, TULP2G – An Open Source Forensic Software Framework for Acquiring and Decoding Data Stored in Electronic Devices, International Journal of Digital Evidence, Vol. 4, Issue 2, Fall 2005.
[Bur02] Michael W. Burnette, Forensic Examination of a RIM (BlackBerry) Wireless Device, June 2002, .
[Bur05] Robert Burnett, Ylva Hård af Segerstad, The SMS Murder Mystery: the dark side of technology, Safety & Security in a Networked World: Balancing Cyber-Rights & Responsibilities, September 2005, .
[Car02] Brian Carrier, Defining Digital Forensic Examination and Analysis Tools, Digital Forensics Research Workshop II, August 2002, .
[Cas00] Eoghan Casey, Chapter 13: Forensic Examination of Handheld Devices, Digital Evidence and Computer Crime, Academic Press, March 2000.
[Cas06] Casadei, F. et al., Forensics and SIM cards: an Overview, International Journal of Digital Evidence, Volume 5, Issue 1, Fall 2006, .
[Dea05] Dearsley, T., Mobile Phone Forensics – Asking the Right Questions, New Law Journal, July 29, 2005, pp. 1164-1165.
[Dec93] Dechaux, C., Scheller, R., What are GSM and DECT?, Electrical Communication, 2nd Quarter, 1993, pp. 118-127.
[DOJ01] Electronic Crime Scene Investigation: A Guide for First Responders, U.S. Department of Justice, NCJ 187736, July 2001, .
[DOJ04] Forensic Examination of Digital Evidence: A Guide for Law Enforcement, U.S. Department of Justice, NCJ 199408, April 2004, .
[ETS99] Digital cellular telecommunications system (Phase 2) - Event and call data (GSM 12.05 version 4.3.1), European Telecommunication Standard (ETS), ETSI TS 100 616 V7.0.1, July 1999.
[Gar01] You can ring, but you can't hide, The Guardian, November 29, 2001, .
[Gas03] Ty Gast, Forensic Data Handling, Security Assurance Group, White Paper, 2003, .
69
Guidelines on Cell Phone Forensics
[Goo03] Amanda Goode, Forensic Extraction of Electronic Evidence from GSM Mobile Phones, IEE Seminar on Secure GSM & Beyond, Digest No. 2003/10059, February 11, 2003.
[Gra02] Joe Grand, pdd: Memory Imaging and Forensic Analysis of Palm OS Devices, Proceedings of the 14th Annual FIRST Conference on Computer Security Incident Handling and Response, June, 2002, .
[GSM04] IMEI Allocation and Approval Guidelines, Version 3.3.0, GSM Association, Permanent Reference Document TW.06, December 2004, .
[GSM05] GSME Position On Data Retention – Implications for The Mobile Industry, GSM Europe, GSM Association, 23 August 2005, .
[Haa04] Job de Haas, Reverse Engineering ARM Based Devices, Black Hat Europe, May 2004, .
[Hin96] S. F. Hinde, Call Record Analysis, IEE Colloquium on Making Life Easier - Network Design and Management Tools, Digest No: 1996/216, 10 Oct 1996, pp. 8/1-8/4, .
[Hos98] Chet Hosmer, Time Lining Computer Evidence, WetStone Technologies, Inc., 1998, .
[Int96] Designing for On-Board Programming Using the IEEE 1149.1 (JTAG) Access Port, Intel, Application Note, AP-630, November 1996, .
[Its] XDA Bootloader, ITSX, .
[ITU06] ITU-T (2006), Automatic International Telephone Credit Cards, International Telecommunications Union, Telecommunication Standardization Sector (ITU-T), Recommendation E.118, (02/01).
[INT06] Mobile Phone Forensics, 47th EWPITC meeting – Final report, European Working Party on IT Crime, INTERPOL, September 7, 2006.
[IOCE] Digital Evidence: Standards and Principles, Scientific Working Group on Digital Evidence (SWGDE), International Organization on Computer Evidence (IOCE), Forensic Science Communications, Vol. 2, No. 2, April 2000, .
70
Guidelines on Cell Phone Forensics
[Jan06] Wayne Jansen, Rick Ayers, Forensic Software Tools for Cell Phone Subscriber Identity Modules, Conference on Digital Forensics, Association of Digital Forensics, Security, and Law (ADFSL), April 2006, .
[Kin01] Joe Grand (Kingpin) and Mudge, Security Analysis of the Palm Operating System and its Weaknesses Against Malicious Code Threats, August 2001, pp. 135-152, Proceedings of the 10th Usenix Security Symposium, .
[Kni02] Ronald van der Knijff, Chapter 11: Embedded Systems Analysis, Handbook of Computer Crime Investigation, Edited by Eoghan Casey, Academic Press, 2002.
[Ko96] Y. F. Ko, Automatic Call Generation and Analysis - Network Testing and Cellular Survey Tools, IEE Colloquium on Making Life Easier - Network Design and Management Tools, Digest No: 1996/217, 10 Oct. 1996, pp. 7/1 - 7/6, .
[Kru01] Warren G. Kruse II, Jay G. Heiser, Computer Forensics – Incident Response Essentials, Pearson Education, September 26, 2001.
[Ley01] John Leyden, How to crash a phone by SMS, The Register, November 2001,
[Man01] Kevin Mandia, Chris Prosise, Incident Response: Investigating Computer Crime, McGrawHill Osborne Media, 2001.
[Mcc05] Paul McCarthy, Forensic Analysis of Mobile Phones, BS CIS Thesis, University of South Australia, School of Computer and Information Science, Mawson Lakes, October 2005, .
[Mcc06] Paul McCarthy, Jill Slay, Mobile phones: admissibility of current forensic procedures for acquiring data, the Second IFIP WG 11.9 International Conference on Digital Forensics, 2006.
[Mel04] Barrie Mellars, Forensic Examination of Mobile Phones, Digital Investigation, Vol.1, No. 4, 2004, pp. 266-272.
[Meu02] Pascal Meunier, Sofie Nystrom, Seny Kamara, Scott Yost, Kyle Alexander, Dan Noland, Jared Crane, ActiveSync, TCP/IP and 802.11b Wireless Vulnerabilities of WinCE-based PDAs, Proceedings of the Eleventh IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE’02), June 2002, .
[Moo06] Tyler Moore, The Economics of Digital Forensics, Fifth Annual Workshop on the Economics and Information Security, June 2006, .
71
Guidelines on Cell Phone Forensics
[New07] Annalee Newitz, Courts Cast Wary Eye on Evidence Gleaned From Cell Phones, WIRED, May 10, 2007, .
[NIJ05] No More ‘Cell’ Phones, TechBeat, Winter 2005, National Law Enforcement and Corrections Technology Center, .
[Nok05] AT Command Set for Nokia GSM and WCDMA Products, Version 1.2, Nokia Corporation, July 2005, .
[NTI] Computer Evidence Processing Steps, New Technologies Inc., .
[Oco04] Thomas R. O'connor, Admissibility of Scientific Evidence Under Daubert, North Carolina Wesleyan College, March 2004, .
[Pie99] Claire Pieterek, How to get an extra 824K using FlashPro, PalmPower Magazine, May 1999, .
[Pea05] Wayne Peacock, An Introduction to Nokia F-bus, April 2005, .
[Pmd02] Palm Security, How-To Guide, pdaMD.com, 2002, .
[PPC04] Palm OS Programmer's Companion, Volume I, PalmSource, Inc., May 2004, .
[Pur] Stephen R. Purdy, The Reality of Computer Forensics: Electronic Evidence Discovery and Recovery, Agile Risk Management Group LLC.
[Rei02] Mark Reith, Clint Carr, and Gregg Gunsch, An Examination of Digital Forensic Models, International Journal of Digital Evidence, Fall 2002, Volume 1, Issue 3 .
[Sha06] Noah Shachtman Fighting Crime with Cellphones' Clues, NY Times, May 3, 2006, .
[Smi05] Greg Smith, Switch On ~ Update = Lose Evidence, Mobile Telephone Evidence Newsletter, INDEX NO: VOL 4-MTE05- 2006, Trew & Co, 2005, .
[Smi06] Greg Smith, Handset Password Unlock, Mobile Telephone Evidence Newsletter, INDEX NO: VOL 4-MTE03- 2006 supp: 002, Trew & Co, 2006.
72
Guidelines on Cell Phone Forensics
[Sum03] Chris Summers, Mobile phones - the new fingerprints, BBC News Online, December 18, 2003, .
[Vam07] Robert Vamosi, Cell Phone ‘CSI,’ CNET Reviews, May 25, 2007, ,URL: http://reviews.cnet.com/4520-3513_7-6737586-1.htm>.
[Ved93] Vedder, K., 1993, Security Aspects of Mobile Communications, in Computer Security and Industrial Cryptography - State of the Art and Evolution, Lecture Notes in Computer Science, Vol. 741, pp. 193-210.
[Wie02] Officer Fred J.Wiechmann, Processing Flash Memory Media, New Technologies Inc., November 2002, .
[Wil03] Svein Willassen, Forensics and the GSM Mobile Telephone System, International Journal of Digital Evidence, Volume 2, Issue 1, 2003, .
[Wil05] Svein Willassen, Forensic Analysis of Mobile Phone Internal Memory, IFIP WG 11.9 International Conference on Digital Forensics, National Center for Forensic Science, Orlando, Florida, February 13-16, 2005, in Advances in Digital Forensics, Vol. 194, Pollitt, M.; Shenoi, S. (Eds.), XVIII, 313 p., 2006.
[Wol03] Henry B.Wolfe, Evidence Analysis, Computers and Security, May 2003, Volume 22, Issue 4, pp. 289-291, .
[Wyl00] Margie Wylie, Cell Phone Jammers, Illegal in U.S., Can Create Silent Zones, Newhouse News Service, 2000, .
[Xjt03] JTAG testing with XJTAG, Version 0.1, XJTAG, March 2003, .
73
Guidelines on Cell Phone Forensics
Guidelines on Cell Phone Forensics
Appendix E. Online Resources for Mobile Device Forensics
This appendix contains lists of online resources that may be useful to incident response communities and law enforcement when mobile devices are encountered during an incident or crime. The resources provide additional information on aspects of cell phone forensics.
Table 8: Technical Resource Sites
Resource
URL
The Electronic Evidence Information Center
http://www.e-evidence.info/cellular.html
High Tech Crime Consortium mail list
https://htcc.secport.com/mailman/listinfo/htcc
Phone Forensics Portal
http://www.phone-forensics.com/forum/portal.php
Phone Forensics Group
http://groups.yahoo.com/group/phoneforensics/
SEARCH: Investigator’s Toolkit
http://www.search.org/files/pdf/CellphoneInvestToolkit-0806.pdf
The Netherlands Forensic Institute’s procedures for preservation
http://www.holmes.nl/MPF/FlowChartForensicMobilePhoneExamination.htm
Secure Digital Homepage
http://www.Sdcard.org
Multi-Media Card Homepage
http://www.mmca.org
CDMA Documents
http://www.tiaonline.org/standards/technology/cdma2000/cdma2000table.cfm
Table 9: Databases for Identification Queries
Resource
URL
Device Characteristics
http://www.phonescoop.com/phones/finder.php
http://www.gsmarena.com/search.php3
http://mobile.softpedia.com/phoneFinder
IMEI Queries
http://www.numberingplans.com/?page=analysis&sub=imeinr
Manufacturer Codes
http://www.tiaonline.org/standards/resources/esn/codes.cfm
ICCID Queries
http://www.numberingplans.com/?page=analysis&sub=simnr
FCCID Queries
http://www.fcc.gov/oet/fccid/
Phone Carrier Finder
http://www.fonefinder.net/
Phone Number Carrier Lookup
www.npac.com
Table 10: Forensic Tools
Resource
URL
Forensic Card Reader
http://www.becker-partner.de/forensic/intro_e.htm
ForensicSIM
http://www.radio-tactics.com
SIMCon
http://www.simcon.no
SIMIS
http://www.crownhillmobile.com
USIMdetective
http://www.quantaq.com/
BitPIM
http://www.bitpim.org 95
Guidelines on Cell Phone Forensics
Resource
URL
Oxygen PM(forensic version)
http://www.opm-2.com/forensic
Oxygen PM for Symbian (forensic version)
http://www.opm-2.com/forensic
PDA Seizure
http://www.paraben-forensics.com
Pilot-Link
http://www.pilot-link.org
Cell Seizure
http://www.paraben-forensics.com
CellDEK
http://www.logicubeforensic.com
GSM .XRY
http://www.msab.com
MobilEdit!
http://www.mobiledit.com
PhoneBase
http://www.phonebase.info
Secure View
http://www.susteen.com
TULP 2G
http://tulp2g.sourceforge.net
SIMgen
http://www.3gforensics.co.uk/simgen.html
Table 11: Other Related Tools
Resource
URL
CSurv
http://www.teeltech.com/tt/TeelTechCsurv.pdf.pdf
Cell View
http://www.icardforensics.com/documents/CellSiteMonitor.pdf
Port Monitoring Utilities
http://www.sysinternals.com/Utilities/Portmon.html
http://www.hhdsoftware.com/sermon.html
Master Unlock Code Calculator
http://www.fonefunshop.co.uk/Unlocking/nokiasecuritycode.htm
96

Local student crowned Australia’s National Champion for mobile phone recycling

2009-10-14T06:02:00.000-07:00

Bradley Marsh from Reynella Primary School, South Australia has been crowned Australia’s mobile
phone recycling Champion after handing in 850 mobile phone handsets, the single largest collection in
the 2009 MobileMuster ‘Old Phones, New Fence Posts’ Schools Recycling Challenge.
The Challenge created by the official recycling program of the mobile phone industry, MobileMuster,
encouraged students to round up and recycle old and unused mobile phones lying around at home.
For every 5kg of old mobiles handed in for recycling by schools from 1 May and until World
Environment Day – June 5, MobileMuster and Australia Composite Technology (ACT) pledged to
donate 1 Plasmar plastic fence post to communities affected by the Victorian bushfires.
Rose Read, Manager of the Australian Mobile Telecommunication Association’s (AMTA), mobile
phone recycling program, MobileMuster, said Bradley Marsh rounded up 850 mobile phone handsets,
roughly 70kg in weight and four times the collection amount of the runner up. Bradley has enabled 232
fence posts to be erected in the areas destroyed by the bush fires.
“We congratulate Bradley for his phenomenal recycling effort. It is wonderful to see students such as
Bradley working together with their teachers and families to help the environment as well as local
farmers and schools whose properties were devastated by the bush fires.
In recognition of Bradley’s efforts he will receive a National Champion certificate and a Milton Mobile
Family Experience Pack to the value of $250.
“As a result, 720 Plasmar plastic fence posts have been donated to fence more than 5km of property
and creek boundaries in the Baw Baw Shire Council and Kinglake areas.
“Over 90% of the materials found in mobile phones can be recovered and used to make new products.
The plastics from the handsets and chargers are shredded and combined with other plastics to make
Plasmar fence posts, made locally in Melbourne by Australia Composite Technology (ACT). This
includes the plastic fence posts which have been donated to Labertouche Primary, Middle Kinglake
Primary Schools and a number of local farmers in the Baw Baw Shire area,” concluded Ms Read.
MobileMuster is a year round free program, so residents can continue to hand in their old mobile
phones, batteries, accessories and chargers for recycling at any one of MobileMuster’s 3,500 drop-off
points nationally. Alternatively they can pick up a free recycling satchel from participating Australia
Post outlets or downloading a free reply paid label from www.mobilemuster.com.au
To find your nearest MobileMuster drop off point or to download a free mailing label go to
www.mobilemuster.com.au or call 1300 730 070.
ENDS
For more information or to arrange an interview contact:
Eileen Lorenzo
Professional Public Relations
Telephone: 02 9818 0979
Email: elorenzo@ppr.com.au
About MobileMuster (figures current at 30 June, 2009)
• There are over 3,500 MobileMuster collection points across Australia, including
Nokia Care and Motorola Service One Centres; mobile phone retailers Telstra,
Optus, Vodafone, 3 Mobile, Virgin Mobile, Crazy Johns, Fone Zone, Allphones as
well as participating local councils, Cartridge World and Battery World stores and
selected ANZ and Sydney Credit Union branches
• There are over 21 million mobile phone subscribers
• Australians upgrade or exchange their mobile phones every 18 to 24 months
• 80% of people choose to keep or give away their old mobile phones, less than 2% throw
them out
• Net imports of mobile phones into Australia for 2008/09 were 7.8 million units. This is
equivalent to 1,560 tonnes (assuming average unit weight of 200g – handset,
battery, charger and accessory included)
• In 2008/2009 MobileMuster collected 122 tonnes of mobile phone components
including 806,000 handsets and batteries, 26% more than 2007/08.
• 621 tonnes of handsets, batteries, chargers and accessories have been collected since
the recycling program was initiated by AMTA in 1999. This includes 4.26 million batteries
and handsets

MOBILE PHONES & JAPANESE YOUTH

2009-10-14T05:55:00.001-07:00

Mizuko Ito
Keio University
Okabe Daisuke
Yokohama National University
2
MOBILE PHONES, JAPANESE YOUTH,
AND THE RE-PLACEMENT OF SOCIAL CONTACT
Mizuko Ito
Keio University
Okabe Daisuke
Yokohama National University
Abstract
What social structural factors relate to unique patterns in teen mobile phone usage,
particularly text messaging? We propose that the power dynamics inherent in the
institutions of family, public places, and peer relations are key factors. Teens use mobile
phones because they enable new kinds of social contact, but also because teens are
limited in access to adult forms of social organization. This paper relies on interviews
with twenty-four Japanese college and high school students and a set of “communication
diaries” and follow-up interviews with twenty-four mobile phone users of different ages.
The paper analyzes this material in terms of intergenerational dynamics of mobile phone
use in three kinds of places: the private space of the home, public spaces of public
transportation and street, and the virtual space of online peer connectivity. The paper
concludes that many patterns of teen text messaging are structured by adult control over
the spaces that they frequent and an increasingly structured set of social norms governing
mobile communications.
1
MOBILE PHONES, JAPANESE YOUTH,
AND THE RE-PLACEMENT OF SOCIAL CONTACT
This paper examines how the mobile phone is embedded in the power-dynamics of the
home, school, and street for Japanese youth, looking at what cultural geographer Doreen
Massey (1993) has called the “power-geometry of space-time compression.” The mobile
phone is an emblematic technology of space-time compression, touted as a tool for
anytime, anywhere connectivity. Contrary to this popular depiction, workplace studies
have demonstrated how mobile phones produce issues in the maintenance and
construction of personal boundaries in the face of increased accessibility by the
workplace (Churchill and Wakeford 2002; Gant and Kiesler 2002; Laurier 2002;
Schwarz, Nardi, and Whittaker 1999; Sherry and Salvador 2002). By contrast, youth
tend to see mobile phones as liberating and expressive personal technologies. While
recognizing the unique social functions of youth mobile communications, we also believe
that they can be understood in relation power-geometries of institutions and places. While
youth do have large amounts of discretionary time, energy, and mobility that is the envy
of working professionals and parents, they are limited in their activities by their weak
social position and limited access to material resources. Their lives are governed by
certain structural absolutes, such as dependence on parents, educational requirements,
and regulation in public places.
This paper presents a picture of how Japanese youths’ mobile phone use is both
located within an existing power-geometry of space-time compression, and constitutive
of new ones. We describe how mobile phone use is embedded in specific social and
material locations that youth occupy in urban Japanese culture and society, and in turn,
how usage changes their experience of places and their relationships to peers and parents.
After first presenting the methodological and conceptual framework for this paper, we
present our ethnographic material in relation to the power-dynamics and regulation of
different kinds of places: the private space of the home, the classroom, the public spaces
of the street and public transportation, and the virtual space of peer connectivity enabled
by mobile communications.
2
Method and Conceptual Framework
Our Research
This paper draws from ongoing ethnographic research on mobile phone use and location,
centered at Keio Shonan Fujisawa Campus near Tokyo. We draw primarily from two
different sets of data. One is a set of ethnographic interviews conducted by Ito in the
winter of 2000, with twenty-four high school and college students about their use of
media, including mobile phones. The central body of data behind this paper is a set of
twenty-four “communication diaries” and interviews collected between July-February
2003 by Okabe and Ito. We aim to collect detailed information on where and when
particular forms of mobile communication were used by a diverse set of people. We seek
direct observational records in addition to interview data, as it is notoriously difficult to
capture the fleeting particularities of mobile communication after the fact. In another
project, we are conducting observations of mobile phone use in public transportation.
For this study, our intent was to capture the usage patterns of particular individuals. We
adapted data collection methods piloted by Rebecca Grinter and Margery Eldridge (2001)
where they asked ten teenagers to record the time, content, length, location, and recipient
(or sender) of all text messages for seven days. As with interviews, this data collection
method still relies on second-hand accounting, but has the advantage of providing much
more detail on usage than can be recalled in a stand-alone interview.
We expanded the communication log to include voice calls and mobile Internet,
and more details about the location and context of use. Participants were asked to keep
records of every instance of mobile phone use, including voice, short text messages,
email, and web use, for a period of two days. They noted the time of the usage, who they
were in contact with, whether they received or initiated the contact, where they were,
what kind of communication type was used, why they chose that form of communication,
who was in the vicinity at the time, if there were any problems associated with the usage,
and the content of the communication. After completion of the diaries, we conducted indepth
interviews that covered general attitudes and background information relevant to
mobile phone use, and detailed explication of key instances of usage recorded in the
3
diaries. Our study involved seven high school students (aged 16-18), six college students
(aged 18-21), two housewives with teenage children (in their forties), and nine
professionals (aged 21-51). The gender split was roughly equal, with 11 males and 13
females. 594 instances of communication were collected for the high school and college
students and 229 for the adults. The majority of users were in the Tokyo Kanto region.
Seven were recruited in the Osaka area in southern Japan to provide some geographic
variation. This paper focuses on the communications of the high school and college
students. We turn now to the theoretical and conceptual framework for our analysis.
Mobile Phones and Youth
In countries where there is widespread adoption, there are cross-cultural similarities in
the intersection of youth and mobile phones. Richard Ling and Birgitte Yttri (2002) have
coined the term “hyper-coordination” to describe the expressive and socially active uses
of mobile phones by Norwegian teens. In contrast to the more instrumental uses that
older subjects described, youths describe using phones for emotional and social
communications, particularly for cementing peer relations. Ling and Yttri describe
adolescence as a unique time in the lifecycle, how peers play a central role during this
period, and how the mobile phone becomes a tool to “define a sense of group
membership, particular vis-à-vis the older generation (2002: 162). A growing body of
work with teens in locations such as the UK (Green Forthcoming; Grinter and Eldridge
2001), Finland (Kasesniemi and Rautianinen 2002), Norway (Skog 2002), and Sweden
(Weilenmann and Larsson 2002), finds similar patterns in other countries. Text
messaging appears as a uniquely teen-inflected form of mobile communication, in that is
lightweight, less intrusive, less subject to peripheral monitoring, inexpensive, and enables
easy contact with a spatially distributed peer group (Grinter and Eldridge 2001;
Kasesniemi and Rautianinen 2002; Ling and Yttri 2002).
We believe that this body of work that has preceded ours has made the case for
unique forms of teen mobile communication. Our data and other material on Japan
(Matsuda 2000; Okada and Matsuda 2002; Yoshii et al. 2002) also support these general
findings. Taking this body of work as a starting point, our analysis focuses less on the
4
distinctive qualities of youth communication and more on the institutional and material
conditions in which this distinctiveness is produced. We argue that the practices and
cultures of youth are not solely outcomes of a certain level of developmental maturity, or
even of social relations, but are also conditioned by the regulative and normative force of
places. We shift the center of attention from the practices and identities of youth
themselves to their institutional and cross-generational surrounds, considering “youth” as
a category constructed and consumed by people of all ages, and produced in particular
power-geometries (James, Jenks, and Prout 1998; James and Prout 1997).1 We cut our
data along these lines as well. We apply the category of youth to those institutionalized
as such—high school and college students who are financially dependent on adults.
For a theory of place, we look to cultural geographical conversations on new
media. We see place as a hybrid of the social, cultural, and material (including
technology, architecture, and geography). Massey’s insistence that hierarchical relations
are key components of place-making are particularly important in our analysis.
Critiquing “easy and excited notions of generalized and undifferentiated space-time
compression,” Massey argues that
different social groups are placed in very distinct ways in relation to late modern
flows of media, people, and capital. This point concerns not merely the issue of who
moves and who doesn’t, although that is an important element of it; it is also about
power in relation to the flows and the movement. Different social groups have
distinct relationships to this anyway-differentiated mobility; some are more in charge
of it than others; some initiate flows and movement, others don’t; some are more on
the receiving end of it than others; some are effectively imprisoned by it (1993, 61).
We draw from Massey’s framing, but also work further to specify the
particularities of these power-geometries of space-time compression by looking at the
particularities of intergenerational power dynamics. Just as social theory has
interrogated race, class, and gender, generational dynamics need to be analyzed with a
1 In her study of Japanese youth, Merry White (1994: 11) describes the differences
between US and Japanese labels for young people. The category of “teenager” of
“cheenayja” has been borrowed from English, but is not in widespread use. The native
categories are shonen and seinen which are closer to the English term “youth” or “young
person.”
5
similar social structural lens (Alanen 2001). Further, it is not only that certain people are
differentially located within power-geometries. The same person can be alternatively in
control or lacking control of communicative and cultural flows depending on lifecycle
stage, different spatial and temporal locations and their access to new technology. Youth
communications are regulated by peers or adults depending on place and time of day, and
that access to mobile media takes a central role in managing and inflecting that control.
Conceptually, our approach shares much in common with Nicola Green’s in her analysis
of the role of mobile phones in surveillance and monitoring between adults and teens and
among teens (Green 2002). Mobile phones are embedded in existing power-geometries
and creating new social disciplines and accountabilities.
Cross-cultural similarities in mobile phone usage can be understood in relation to
shared and different structural conditions in the lives of young people. While this study
does not present a comparative analysis, it does lay out conditions that contextualize
Japanese youth’s mobile phone use, and suggests that the cross-cultural similarities in
mobile phone usage are partially an outcome of the similarities in the institutionalized
status of youth. After an overview of Japanese youth usage of mobile phones, we
examine the institutionalization of mobile phone use in relation to the urban home,
school, street, public transportation, and online mobile space.
Japanese Youth and Communication Technology
Since the late nineties, youth have had higher rates of mobile phone ownership than the
general population, but the gap is closing. A national survey of mobile phone
communications conducted by Video Research (2002) in July 2002 found that the overall
penetration of mobile phones in Japan was 73.7% with ownership by students age 12 and
up at 75.7%. A survey the prior year by the Mobile Communications Research Group
(Yoshii et al. 2002) found a more substantial gap between high school (76.8%) and
college (97.8%) students and the general population (64.6%). Even as mobile phones
have become common in all age groups, the younger demographic has a higher volume
and unique patters of usage that differentiate them from older users. In contrast to the
¥5613 average monthly payments of the general population, students pay an average of
6
¥7186 for their monthly bills (IPSe 2003). Particularly distinctive is usage of mobile
email2. 95.4% of students describe themselves as mobile email users, in contrast to 75.2%
of the general population (VR 2002). Teens send twice as many emails than twentysomethings,
sending approximately 70 a month in contrast to 30 for the slightly older set
(Yoshii et al. 2002). In contrast to the general population (68.1%), almost all students
(91.7%) report that they send over 5 messages a day. They also tend to be more
responsive to the email that they receive. Almost all students (92.3%) report that they
view a message as soon as they receive it, whereas a slimmer majority of the general
population (68.1%) is as responsive. May older users say that they view a message when
convenient to them, or at the end of the day (VR 2002).
The current generation of college students has a particular historical relationship
to messaging technologies. Many heavy users moved from using pagers in middle school
and high school in the mid nineties, to using PHS (an inexpensive version of a mobile
phone), switching over to the current mobile Internet in the late nineties. Different
variants of mobile phones have proliferated since the late nineties, but in the past four
years or so it has become common for high school students to carry them. Beginning with
pagers, messaging functions have had a strong association with girls, particularly kogyaru
(high school gals), a label attached to the newly precocious and street savvy high school
students of the nineties who displayed social freedoms previously reserved for college
students. In certain city centers, kogyaru continue to be highly visible, sporting platform
sandals, brightly-colored fashions, sun-tanned faces, colored hair, and often a highly
decorated mobile phone hanging from their necks. Unlike the male otaku (techno-geeks)
associated with video games and computers, media savvy girls have been associated with
communications technologies such as pagers and mobile phones. Kogyaru are commonly
thought to be the social group that pioneered and popularized recreational uses of mobile
communications, first with their appropriation of pagers in early nineties, and then with
2 I use the term mobile email to refer to all types of textual and pictoral transmission via
mobile phones. This includes what Japanese refer to as “short mail” and Europeans refer
to as “short text messages,” as well as the wider variety of email communications enabled
by the mobile Internet. At the time of this writing, this includes text, graphics,
photographs and just recently, video clips. Since Japanese mobile phones became
7
mobile phones the latter half of the nineties. Within a space of a few years between
1995-98, mobile phones shifted from association with business uses to an association
with teen street culture. This shift coincided with the high visibility of kogyaru in the
media and on the streets.
These girls became the object public attention in the mid nineties as an indicator
of trends in communication and fashion, as well as the most recent icon for ongoing
laments about the moral decline and growing promiscuity of youth. Kogyaru culture
flies in the face of mainstream norms that insist that young women be modest, quiet, pale,
and domestic. Pagers as well as mobile phones have been associated with a lowachievement
and pleasure-seeking mentality as it infiltrated the youth population. Until
recently, the popular assumption has been that heavy mobile phone users are socializing
rather than studying. These associations are fading now with the proliferation of phones,
but much advertising and product design still caters to the youth market, particularly
girls. Ads for cutting-edge phones tend to feature young women, and many designs
feature cute characters and feminine colors. Mobile youth culture is an object of both
fascination and concern, produced by adults and industrialists, as well as subject to
regulation and repression. Even with pundits declaring the death of the kogyaru at the
turn of the millennium, this youth subculture has a lasting legacy in mobile texting
cultures.
Postwar Japanese youth culture has featured a succession of highly visible but
transient youth subcultures like the current kogyaru. Most Japanese girls take stylistic
cues from these subcultures—bleached hair, platform sandals, keitai usage—but tend not
to have oppositional relationships with their parents and teachers. Even full-blown
kogyaru often lead double lives, hiding their kogyaru identity from parents and teachers.
In her study of American and Japanese youth, Merry White (1994) sees fewer conflicts
between Japanese parents and youths than their American counterparts, and less
pathologization of youth as a problematic life stage. Dependency has less social stigma
that it does among Euro-American youths, and this is institutionalized in the protective
functions of family that extend through college and often beyond. White also describes
Internet enabled in 1998, users have been able to communicate across service providers
and have not been limited to the “short message” length of prior forms of mobile email.
8
how youth are defined by marital and employment status rather than by age, and “such
institutional definitions have more weight than social and psychological identities” (1988:
11). Arguably, youth culture has been subject to more concern since the rise of kogyaru
in the nineties, after White completed her work. Yet we believe her overall findings still
hold, in that the regulatory and protective functions of institutions such as family and
school still dominate the lives of Japanese youth into their twenties.
The life rhythms of high school and college students are substantially different.
High school students spend most of their free time in school, particularly if they have
sports and other after-school activities. By contrast, college students have extremely
flexible schedules, and often stay up until all hours of the night and miss classes the next
day. Unlike US university life, college students at even the top universities see their time
in college as a relief from the pressures of academics that haunted them during high
school. Rather than a time of independence where they leave the parental home, most
urban college students live with their parents and are financially dependent. Unlike high
school students, however, they are not expected to share the same life rhythms and meals
of the household, and are allowed to lead relatively independent social lives. Our sample
of college students for the communication diary part of our study is a bit skewed in this
respect, as our student pool at the Keio campus was largely comprised of youth living on
their own. As a suburban campus of an elite urban university, the situation at our campus
is unique in attracting students from around the country in an area with a relatively low
urban density. Overall, our interviewee pool represented a range from mainstream
middle class to elite. Many of the high school girls we interviewed had the bleached hair
popularized by the kogyaru, and all had a keitai, but none would have identified herself
as a kogyaru.
Most college and high school students move back and forth from the space of the
home—where they may have some privacy and discretion over their activities, but lack
physical access to friends—and the space of school—where they are physically copresent
with their friends, but have severe constraints on forms of social contact. Urban
spaces such as the street and cafes become key sites for gathering on their own terms.
The home, though not a place where youth congregate, is a privileged site for mobile
communications, and we begin our entry into the empirical material at this location.
9
Mobile Youth Culture and the Politics of Place
Mobile Phones in the Home
There are peculiarities to the urban Japanese case with respect to the politics of location,
particularly the home context. Most notably, Japanese youths, through college, have less
private space compared their US and even European counterparts. The Japanese urban
home is tiny by middle-class American standards, and teens and children generally share
a room with a sibling or a parent. Most college students in Tokyo live with their parents,
often even after they begin work, as the costs of renting an apartment in an urban area are
prohibitively high. Because of these factors, urban Japanese youth generally take to the
street to socialize. For high school students, this usually means a stop at a local fast food
restaurant on the way home from school. College kids have more time and mobility,
gathering in cafes, stores, bars, and karaoke spots. Unlike the US, there is no practice for
teens to get their own landline at a certain age, or to have a private phone in their room.
The costs of running a landline to a Japanese home are very high, from $600 USD and
up, about twice what it costs to get a mobile phone. It is thus extremely rare for a home
to have more than one landline.
Here is an excerpt from an interview with four high school girls who are close
friends.
Interviewer: You all live close to each other. Do you visit each other’s homes?
Student1: We don’t. It’s not that we are uncomfortable, or our parents get on our
case, but it’s like they are too sweet and caring, and you worry about saying
something rude, or talking too loud. You can’t be too rowdy. So we don’t meet in
our homes.
Student2: Occasionally. Maybe once a year. Actually, that’s not even occasional.
Student1: And if it happens, it is at a friend’s house where they have their own
room.
This stance was consistent across the youths that we interviewed. Meetings among
friends almost always occurred in a third-party space run by indifferent adults, such as a
fast food restaurant, karaoke spot, or family restaurant. Even for college students living
10
on their own, their space is generally so small and cramped that it is not appropriate for
hanging out with groups of friends.
The phone has always provided a way of overcoming the spatial boundary of the
home, for teens to talk with each other late at night, and shut out their parents and
siblings. As noted in other studies (Green 2002; Ling and Yttri 2002; Skog 2002), the
mobile phone has further revolutionized the power-geometry of space-time compression
for teens in the home, enabling teen to communicate without the surveillance of parents
and siblings. This has freed youths to call each other without the embarrassment of
revealing a possible romantic liaison, or at hours of the day when other family members
are likely to be asleep. All that we interviewed were consistent in stating a preference for
calling a friend on a mobile rather than home phone despite the higher cost. Youths now
do not have the home phone numbers of any but their most intimate friends. A high
school girl describes how she makes gender-based choices of what phone to call.
If it is a boy, I will call their mobile. If they have one, I will call their mobile. If
it is a girl, I will call their home. If it is a girl, well, I’m a girl right? So if I call
they think I am just a regular friend. But if it is a boy, his family might tease him,
and I’ve made a friend very uncomfortable in the past because of this. I’ve also
been told some nasty things by a parent. I was totally pissed off when a parent of
a boy told me off like I wasn’t a proper girl. So since then, I don’t use the home
phone.
The home phone once was a means for parents to monitor and regulate their children’s
relationships with their peers. With the mobile phone, the spatial boundaries of the home
become highly porous to discretionary communication. The spatial dispersion of homes,
coupled with the freedom of communication via the mobile phone is an inversion of the
dynamics of the classroom, where kids occupy the same physical space, but are not in
control of their communications with each other. Communications in the home by youths
are a combination of more instrumental uses, such as coordinating meetings and
homework, and more social and chatty uses. Among close friends and couples, most
youths (2 out of 3 in our sample) maintained ongoing lightweight contact as they went
about their daily routines, sending each other messages about their current status and
thoughts such as: “Just woke up with a hangover,” “The episode (of the TV drama) really
11
sucked didn’t it,” or “good night.” They enjoy a sense of co-presence with peers that
they are not able to realize physically because of their dependence on the parental home.
Informants for our communication diary research included ten cases of high
school students living at home: seven high school students, three mothers, and one father.
We also had one example of a college student living at home. Parents exhibited varying
degrees of comfort with the changes accompanying the mobile phone. On one hand, they
enjoyed the phone as a device for them to get in touch with their children, exploiting the
fact that their kids were constantly checking their mobile email. One mother, rather than
shout up to her daughter to wake up in the morning, would send her a text message that
she knew would get her out of bed to check the phone. Without exception, parents with
children at home would send messages telling them that it was time to come home, or
coordinating details such as pickup and meeting times. We saw mild to acute tensions
surrounding extensive use of mobile phones by the children. Parents and children alike
voiced a rule that emailing should not happen during mealtimes. Although the two
parents in our study did not take such measures, one of the high school students described
how he had gotten caught with cigarettes, and his mother had imposed strict limits on his
mobile phone usage as punishment. All the parents we interviewed described a sense of
unease and curiosity about their children’s mobile communications. Conversely, all the
children took measures to keep parents in the dark about the content of their email and
calls. Generally this was done by going to their bedroom when taking a voice call. One
high school girl in our study shared her study room with her father. When she received a
voice call she would leave the house to talk outside, out of earshot, even in the dead of
winter. One parent voices what we take to be a typical parental stance.
Okabe: Do you have a problem with her using her mobile phone during meals, or
after meals in the living room, when you are together?
Mother: I don’t have a problem with it when we are just lounging around. But
during meals or when she is studying, I try to tell her to tell the other person on
the line.
Okabe: Are you curious or concerned about with who and what she is
communicating?
Mother: I am concerned about all of it… though I can usually guess who it is.
Okabe: When you tell her to stop, does she stop?
Mother: She goes to her room… if I am strict about it.
12
…
Okabe: Do you ever ask her, like “What in the world are you talking about!”
Mother: I do ask sometimes. But I just get a vague reply.
Of particular interest are the logs of one teenage couple in our study, which is a
somewhat more intense version of couple communications that we saw in other instances.
Their typical pattern is to begin sending a steady stream of email messages to each other
after parting at school. These messages will continue through homework, dinner,
television shows, and bath, and would culminate in voice contact in the late evening,
lasting for an hour or more. A trail of messages might follow the voice call, ending in a
good night exchange and revived again upon waking. On days that they were primarily
at home in the evening, they sent 34 and 56 messages to each other. On days that they
were out and about the numbers dwindled to 6 and 9. The content of the messages ranged
from in-depth conversation about relational issues, to coordination of when to make voice
contact, to lightweight notification of their current activities and thoughts. In this case,
and to a smaller degree for other couples living apart, messaging became a means for
experiencing a sense of private contact and co-presence with a loved one even in the face
of parental regulatory efforts and their inability to share any private physical space.
Mobile Phones at School
In the school context, there is variability in how teachers deal with mobile phones. Some
schools have greeted the recent ubiquity of mobile phones with blanket prohibition. Two
high school students reported how their teachers would take the phones if discovered in
class. Almost all school officially ban phones from the classrooms, but most students do
use email during class at least occasionally. It is not uncommon for students to leave their
mobile phones out on their desks during class, claiming that they use the clock function.
All students, both in high school and college voiced the rule that they would not use
voice communication in class, but almost all said that they would read and sometimes
send messages. The mobile phone gets used most frequently during the lunch time hour
and immediately after school, as students scurry to hook up with their friends. We saw
email being sent during class in only two of our communication diary cases, but almost
13
all students reported in their interviews that they would receive and send messages in
class, hiding their phones under their desks. Here is the response from one of the high
school students who we did see using her phone during class.
Okabe: What sorts of places and situations do you use your phone a lot?
Student: At school, during class…. I leave my phone on my desk and it vibes.
Okabe: Your teacher doesn’t care?
Student: Well, the teacher pretty much knows. He doesn’t do anything about it.
Okabe: Really? You can leave it out?
Student: Everyone has them out…. Some kids even let their phone ring, and the
teacher is like, hey, it’s ringing… I think this is just our school.
…
Okabe: Do you take voice calls during class?
Student: No. That would be going to far.
Okabe: Oh, so you wouldn’t answer. What kinds of exchanges do you have over
email during class? Do you send email to people sitting in the same classroom?
Student: Yes, I do that too.
Okabe: What do you say?
Student: “This is boring.”
Okabe: And you get a reply?
Student: Yes.
Okabe: When you write your email, do you hide it?
Student: Yes. When the teacher is facing the blackboard, I quickly type it in.
Like this student, three other students described conversations with students in the same
classroom, making comments like “this sucks,” “this is boring,” or “check it out, the
teacher buttoned his shirt wrong.” More commonly, students reported that they
conducted “necessary” communications during class, such as arranging a meeting or
responding to an email from somebody with a specific query. The communications in
class that we saw in the diaries involved coordinating meetings after school or receiving
email from friends who were absent, asking for notes or other class information. In all
14
these cases, mobile email is being used to circumvent the communicative limitations of
the classroom situation, much as passing notes and glances across the classroom did in an
earlier era. Perhaps more uniquely, the mobile phone in the classroom is a way to
challenge the communication hierarchy of the traditional lecture format that insists that
students passively listen to an active teacher. Mobile email enables students to resist
their role in this one-way communication and to make more productive use of their
attentional “dead time” between jotting notes and waiting for teachers to finish writing
theirs.
Mobile Phones in Urban Space
Our research has focused on the greater Tokyo metropolitan area, which is an extremely
dense urban setting well connected to its more suburban surrounds. This urban landscape
is amenable to appropriation by youth because of the extensive public transportation
system, and the fact that it is quite safe to be on public transportation and out on the street
even for young women at night. Youth will take public transportation from city outskirts
and congregate in city centers like Shibuya and Ikebukuro, considered the epicenters of
youth culture. Not surprisingly, Shibuya crossing has the highest density of mobile
phone use in the world.
Mobile phones embody a fast and footloose street culture beyond the surveillance
of the institutions of home and school. For example, there is a practice called enjo kousai
that started in the nineties, where high school girls, particularly kogyaru, meet older men
on the street and date them for money. The argument has been that without mobile
phones this would not have been possible. Such practices have reinforced the perception
that mobile communications support superficial and fleeting relationships. Japanese
researchers have argued that their observations do not bear out these pervasive fears
about the corruption of youth, and that mobile phones have made youths’ relationships
selective rather than superficial (Matsuda 2000). Public perception, however, persists that
youth technoculture is related to moral decline. For example, the popular weekly
magazine, Aera, ran a series of articles about kogyaru and enjo kousai, depicting Lolitacomplex
middle aged men and “old man hunting” teenagers meeting on the street,
15
keeping in touch with pagers and mobile phones (Hayamizu 1996). In part, this
association between mobile phones, declining morals, and personal (rather than business)
communication translates to a negative image of youth usage and intensifying efforts at
regulation of mobile phones in urban space.
Most trains and buses display “no mobile phone signs,” and announcements are
made every few minutes prohibiting use of mobile phones. The street and train platforms
are open to voice calls, but are generally extremely noisy, and it is difficult to have a
sustained conversation in these locations. In a separate study, currently under process,
we have been observing uses of mobile phones on trains and subways. In over a hundred
cases observed, almost all involve text input. When voice calls are received (we have no
instances of calls being initiated on a train), people will without exception cut the call
almost immediately.
Our interviews and communication logs also bear out this norm. Without
exception, and regardless of age, interviewees said that they did not make voice calls on
public transportation and in formal restaurants. There was some variability as to whether
they would answer a call on public transportation, but if they did, they stated that they
would cut the call right away and call back later. Phone ringing is also considered a
violation in public space. Interviewees who were heavy mobile users almost invariably
reported that they put their phones in “manner mode” (silent mode) when they left the
home. In the communication diaries, we saw only once instance of a voice call being
initiated on public transportation, when the subject was the only passenger on a bus (see
example below). The call lasted only a few minutes, and was cut as soon as another
passenger entered the bus. Despite the virtual lack of voice mobile communication on
trains in the Tokyo area, the announcements are relentless, attesting to a high level of
social regulation work even in the absence of major transgressions.
In contrast to voice calls, mobile email is considered ideal for use in public
spaces. Some trains announcements and signage specify no voice calls, thus implying
that Internet and email use is permitted. While bus drivers will prohibit someone
speaking on a mobile phone from entering a bus, we have not observed any instances of
regulation of silent mobile phone uses. Just as the power-geometries of the home make
email a privileged, private form of communication, regulatory efforts on public
16
transportation have also contributed to the rise of email as a preferred form of mobile
communication. Largely because of the risk that their interlocutor may be on public
transit, a social norm has arisen among the younger generation that you should not
initiate voice calls without first checking availability with a text message. Unless certain
that their recipient is at home, most youths (there were two exceptions in our study) will
send a message first asking if they can call.
During a physical gathering, youth will generally prioritize the co-present
encounter, but there are instances when they are interrupted by a mobile email or call.
Unless in public transport or fancy restaurant, they will attend to the interruption. All
interviewed voiced a general rule that family and fast food restaurants were acceptable
for voice calls. Email will be attended to regardless of place. Those that require an
immediate response, such as a mother asking when they are going to return, or a message
from somebody they are planning to meet, will be responded to right away. When with
friends, youth will almost always take the call, but will cut it short if it is a one-on-one
gathering. When multiple parties are meeting up (we saw this in two of our documented
cases), it is common for mobile communications to be used to contact those that have yet
to appear on the scene, adding relevant information to the current co-present encounter.
At other times, contact with distant others can be used to augment a particular gathering.
One observation I made of a group of high school students on a bus illustrates this
dynamic.
I am sitting near the front of a bus that is not very crowded. Most
seats are occupied, but there is nobody standing. A group of five high
school boys in black uniforms are congregated just behind me,
speaking rather loudly across the middle aisle. They are discussing
some kind of gathering they are arranging. I am not able to determine
exactly the nature of the gathering, but they are involved in a heated
dispute over who is coming and why some members are not coming,
and suspicions that somebody is sabotaging the arrangements.
17
“Ask ‘Ken.’” One boy suggests. “Ask him if he is coming.” One of the
boys carrying a phone punches in a message. As they await their reply
they continue to debate about what is going on. “If the girls are coming,
they the guys will come too.” “Send a message to ‘Kei’ then.” “Or do
you want me to send it?” “No, you send it.” In the meantime, Ken has
responded that he thinks he will come, a fact that the recipient announces
to the group. “Okay, then he’s not the problem” they all agree. The
exchange continues in this manner, with the boys making selective contact
with their friends and collectively developing a theory of the fate of their
planned gathering.
A feeling of urban anonymity is disappearing as youths stay in ongoing and
lightweight contact though messages with their peers and loved ones. Out shopping, a
lone girl sends a picture of the shoes she is buying to a friend. Another sends a message
announcing that she just discovered a great sale. After a physical gathering, as friend
disperse on trains, buses, cars, and on foot, a trail of messages often continues the
conversation, thanks somebody for a ride, or announces that they forgot to return an
object. This kind of communication is freed from prior contingencies that required
infrastructures of pay phones and physical co-presence. Rather than fixing a meeting
place, gatherings between youth are now almost always arranged in a fluid way, as
people coordinate their motion through urban space, eventually converging on a shared
point in time and space. At the same time, mobile communications are highly responsive
to the power-geometries of urban space and an emergent set of social and communicative
norms. I present one example from our communication diaries of one female college
student who carried on a text message conversation while moving between different
forms of public transportation. She has just finished work, and makes contact with her
boyfriend after she boards the bus.
22:30 (boards bus)
22:24 (send) Ugh. I just finished (>_<). I’m wasted! It was so busy.
22:28 (receive) Whew. Good job. (>_<)
22:30 (send) I was running around the whole time. Are you okay?
18
22:30 (Only other passenger leaves. Makes voice call. Hangs up after 2 minutes
when other passengers board.)
22:37 (send) Gee I wish I could go see fireworks ( ; _ ; )
22:39 (receive) So let’s go together! I asked you!
22:40 (gets off bus and moves to train platform)
22:42 (send) sniff sniff sniff ( ; _ ; ) Can’t if I have a meeting! I have to stay
late!
22:43 (receive) You can’t come if you have to stay late?
22:46 (send) Um, no􀁼 I really want to go􀁼 ( ; _ ; )
22:47 (receive) Can’t you work it out so you can make it?
22:48 (boards train)
22:52 (send) Oh􀁼 I don’t know. If I can finish preparing for my presentation
the next day. I really want to see you. (>_<) I am starting to feel bad
again. My neck hurts and I feel like I am going to be sick. ( ; _; ) Urg
22:57 (receive) I get to see you tomorrow so I guess I just have to hang in there!
(^o^)
23:04 (gets off train)
23:05 (send) Right right. I still have a lot of work tonight. I can’t sleep!
In our interview, she describes how her messaging embeds subtle clues that indicate her
status and availability for communication keyed to her physical location.
Okabe: You talk about the fireworks for about ten minutes. Is this the kind of
thing you usually communicate about over email?
Student: Part of the way through, it becomes just something to keep the
conversation going just for the sake of continuing. Around when this firework
topic comes up. All I wanted to really say was about my work day, but since I
still have some time to kill. I didn’t really care about the fireworks. Oh, I
shouldn’t be saying this.
Okabe: So you didn’t really want to go.
Student: It isn’t exactly a lie, but since I couldn’t go, I wrote “Oh, I don’t know,”
kind of grinning.
Okabe: So the important thing was to keep the conversation going.
Student: Yes, that’s right. And after I started feeling that this was going on too
long, I suddenly changed topic to my physical condition.
This last change of topic that she describes happens just as she is getting ready to get off
the train. The change of topic is an indicator that the conversation has come to an end.
She has enlisted a companion on her solitary bus ride, successfully filling dead time with
small talk, ending it at precisely the moment when she arrived at her destination. This is
but one example of many that we have gathered that attests to the highly nuanced and
19
place-sensitive nature of mobile communications made in transit. Approximately half of
the students in our study engaged in this sort of chat like sequence while in transit. The
regulatory efforts of public transport operators in Japan have structured a set of emergent
social practices coordinated to the rhythms of youths’ motion through urban space. We
conclude with an analysis of the technical and social structuring of the online space of
mobile connectivity.
Mobile Virtual Places
The use of email, and the growing expectation that mobile phones define a space of
persistent connectivity, points to an alternative sort of technosocial space being defined
by new mobile technologies for Japanese youths. While mobile phones have become a
vehicle for youths to challenge the power-geometries of places such as the home, the
classroom, and the street, they have also created new disciplines and power-geometries,
the need to be continuously available to friends and lovers, and the need to always carry a
functioning mobile device. These disciplines are accompanied by new sets of social
expectations and manners. One interviewee explains:
I am constantly checking my mail with the hopeful expectation that somebody has
sent me a message. I always reply right away. With short text messages I reply
quickly so that the conversation doesn’t stall.
When unable to return a message right away, there is a sense that a social expectation has
been violated. When one girl did not notice a message sent in the evening until the next
morning, she says that she felt terrible. Three of the students in our diary study reported
that they did not feel similar pressure to reply right away. Yet even in these cases, they
acknowledged that there was a social expectation that a message should be responded to
within about thirty minutes unless one had a legitimate reason, such as being asleep. One
describes how he knows he should respond right away, but doesn’t really care. Another,
who had an atypical pattern of responding with longer, more deliberate messages hours
later, said that her friends often chided her for being so slow. In one instance, a student
did not receive a reply for a few hours, and his interlocutor excused himself by saying he
20
didn’t notice the message. The recipient perceived this as a permissible white lie that got
around an onerous social expectation. All students who were asked about responses
delayed an hour or more said that they would generally make a quick apology or excuse
upon sending the tardy response.
With couples living apart, there is an even greater sense of importance attached to
the ongoing availability via messaging. The underside to the unobtrusive and ubiquitous
nature of mobile email is that there are few legitimate excuses for not responding,
particularly in the evening hours when one is at home. Five of the ten student couples in
our study were in ongoing contact during the times when they were not at school, and all
these couples had established practices for indicating their absence from the shared online
space. They invariably send a good night email to signal unavailability, and would often
send status checks during the day such as “are you awake?” or “are you done with
work?” We saw a few cases when they would announce their intention to take a bath, a
kind of virtual locking of the door. Just as mobile workers struggle to maintain
boundaries to between their work and personal lives, youths struggle to limit their
availability to peers and intimates.
Conclusions
This paper has described the institutions and places which condition Japanese youths’
mobile phone use. We see place as a power-geometry that integrates the social, material,
and cultural. We have argued that this perspective is a useful complement to prior
research that has examined the more personal and relational aspects of mobile phone use
by teens. Another goal of this work has been to argue that far from destroying the
integrity of place with unfettered communication, mobile phones participate in the
structuring of new forms of place-based norms and disciplines.
Given this perspective, we can understand youths’ penchant for text messaging as
an outcome of a wide range of factors. These include the unique expressive functions and
styles of this form of communication, as well as certain economic and historical factors
unique to this generation. In this paper, we have focused on factors that relate to
regulation and surveillance in particular places. Japanese youth, particularly high-school
21
students move between the places of home, school, and urban space that are all subject to
a high degree of regulation and surveillance by adults. Even urban space is highly
regulated by certain codes of social conduct as well as a range of regulatory efforts that
limit communications on public transportation. Unlike the institutions of family and
school, youth peer groups and couples are “institutions” that lack ownership and control
of place. The outcome of these power-geometries is that couples and friends have few
opportunities for private conversation. Although a limited form of contact, mobile email
has fulfilled a function akin to co-presence for people that lack the means to share the
same private physical space. As these same couples get married and share a home, we
would expect that their messaging would shift toward the more instrumental functions
that Ling and Yttri (2002) have described as micro-coordination. Our research with
married couples bears out this hypothesis. New technologies become infrastructure for
new disciplines and institutional relations as much as they challenge old ones that they
grow out of, and the mobile phone is no exception.
REFERENCES
Alanen, Leena. 2001. "Explorations in Generational Analysis." Pp. 11-22 in
Conceptualizing Child-Adult Relations, edited by L. Alanen and B. Mayall. New
York: RoutledgeFalmer.
Churchill, Elizabeth F. and Nina Wakeford. 2002. "Framing Mobile Collaboration and
Mobile Technology." Pp. 154-179 in Wireless World: Social and Interactional
Aspects of the Mobile Age, Computer Supported Cooperative Work, edited by B.
Brown, N. Green, and R. Harper. London: Springer-Verlag.
Gant, Dana and Sara Kiesler. 2002. "Blurring the Boundaries: Cell Phones, Mobility, and
the Line between Work and Personal Life." Pp. 212-132 in Wireless World:
Social and Interactional Aspects of the Mobile Age, Computer Supported
Cooperative Work, edited by B. Brown, N. Brown, and R. Harper. London:
Springer-Verlag.
Green, Nicola. 2002. "Who's Watching Whom? Monitoring and Accountability in Mobile
Relations." Pp. 32-45 in Wireless World: Social and Interactional Aspects of the
Mobile Age, Computer Supported Cooperative Work, edited by B. Brown, N.
Green, and R. Harper. London: Springer-Verlag.
—. Forthcoming. "Outwardly Mobile: Young People and Mobile Technologies." in
Machines that Become Us, edited by J. E. Katz. Cambridge: Cambridge
University Press.
22
Grinter, Rebecca E. and Margeryu A. Eldridge. 2001. "y do tngrs luv 2 txt msg?" Pp.
219-238 in Seventh European Conference on Computer-Supported Cooperative
Work, edited by W. Prinz, M. Jarke, Y. Rogers, K. Schmidt, and V. Wulf. Bonn,
Germany: Kluwer Academic Publishers.
Hayamizu, Yukiko 1996. "Toragyaru tachi no osorubeki enjo kousai (The dangerous
prostitution of tiger-gals)." Aera, pp. 62.
IPSe. 2003. "Third Annual Consumer Report: Survey Results from Research on Mobile
Phone Usage." IPSe Communications, Tokyo.
James, Allison, Chris Jenks, and Alan Prout. 1998. "Theorizing Childhood." New York:
Teachers College Press.
James, Allison and Alan Prout. 1997. "Constructing and Reconstructing Childhood:
Contemporary Issues in the Sociological Study of Childhood." Philadelphia:
RoutledgeFarmer.
Kasesniemi, Eija-Liisa and Pirjo Rautianinen. 2002. "Mobile culture of children and
teenagers in Finland." Pp. 170-192 in Perpetual Contact: Mobile Communication,
Private Talk, Public Performance, edited by J. E. Katz and M. Aakhus.
Cambridge: Cambridge University Press.
Laurier, Eric. 2002. "The Region as a Socio-Technical Accomplishment of Mobile
Workers." Pp. 46-61 in Wireless World: Social and Interactional Aspects of the
Mobile Age, Computer Supported Cooperative Work, edited by B. Brown, N.
Green, and R. Harper. London: Springer-Verlag.
Ling, Richard and Birgitte Yttri. 2002. "Hyper-coordination via mobile phones in
Norway." Pp. 139-169 in Perpetual Contact: Mobile Communication, Private
Talk, Public Performance, edited by J. E. Katz and M. Aakhus. Cambridge:
Cambridge University Press.
Massey, Doreen. 1993. "Power-geometry and a progressive sense of place." Pp. 59-69 in
Mapping the futures: local cultures, global change, edited by L. Tickner. New
York: Routledge.
Matsuda, Misa. 2000. "Friendship of Young People and Their Usage of Mobile Phones:
From the view of 'superficial relation' to 'selective relation'." Shakai Jouhougaku
Kenkyuu 4:111-122.
Okada, T and M. Matsuda. 2002. "Keitaigaku Nyuumon."
Schwarz, Heinrich, Bonnie A. Nardi, and Steve Whittaker. 1999. "The Hidden Work in
Virtual Work." in International Conference on Critical Management Studies.
Manchester, UK.
Sherry, John and Toy Salvador. 2002. "Running and Grimacing: The Struggle for
Balance in Mobile Work." Pp. 108-120 in Wireless World: Social and
Interactional Aspects of the Mobile Age, Computer Supported Cooperative Work,
edited by B. Brown, N. Green, and R. Harper. London: Springer-Verlag.
Skog, Berit. 2002. "Mobiles and the Norweigian teen: identity, gender and class." Pp.
255-273 in Perpetual Contact: Mobile Communications, Private Talk, Public
Performance, edited by J. E. Katz and M. Aakhus. Cambridge: Cambridge
University Press.
VR. 2002. "Mobile Phone Usage Situation." Video Research, Tokyo.
Weilenmann, Alexandra and Catrine Larsson. 2002. "Local Use and Sharing of Mobile
Phones." Pp. 92-107 in Wireless World: Social and Interactional Aspects of the
23
Mobile Age, Computer Supported Cooperative Work, edited by B. Brown, N.
Green, and R. Harper. London: Springer-Verlag.
White, Merry. 1994. The Material Child: Coming of Age in Japan and America.
Berkeley: University of California Press.
Yoshii, H., M. Matsuda, C. Habuchi, S. Dobashi, K. Iwata, and N. Kin. 2002. "Keitai
Denwa Riyou no Shinka to sono Eikyou." Mobile Communications Kenkyuukai,
Tokyo.

Driving for work: mobile phone

2009-10-14T05:54:00.000-07:00

Produced with the support of
The Department for Transport
riving is the most dangerous work activity that most people do. Research indicates that about
20 people are killed and 250 seriously injured every week in crashes involving someone who
was driving, riding or otherwise using the road for work purposes.
HSE Guidelines for employers,‘Driving atWork’, state that “health and safety law applies to on-the-road
work activities as to all work activities and the risks should be effectively managed within a health and
safety system”.
Therefore, employers must assess the risks involved in their staff’s use of the road for work and put in
place all ‘reasonably practicable’measures to manage those risks. Such measures are likely to more than
pay for themselves by reducing the organisation’s accident costs,many of which will be uninsured, such
as lost staff time or just doing the paperwork.
Mobile Phones
One risk is staff making or receiving calls on a mobile phone while driving*.
A substantial body of research shows that using a hand-held or hands-free mobile phone while driving is
a significant distraction, and substantially increases the risk of the driver crashing.High mileage and
company car drivers are more likely than most to use a mobile phone while driving.
Some employers provide mobile phones or reimburse the cost of work-related calls made on private ones.
There are good business reasons to do so.There are also good health and safety reasons for lone workers
and staff who travel in areas where summoning help (if they break down, for example) may be difficult.
But, this should not mean that staff should use the phone while driving. Drivers who use a mobile phone,
whether hand-held or hands-free:
■ are much less aware of what’s happening on the road around them
■ fail to see road signs
■ fail to maintain proper lane position and steady speed
■ are more likely to ‘tailgate’ the vehicle in front
■ react more slowly and take longer to brake
■ are more likely to enter unsafe gaps in traffic
■ feel more stressed and frustrated.
Research indicates that they are also four times more
likely to crash, injuring or killing themselves and/or
other people.
Using a hands-free phone while driving does not
significantly reduce the risks because the problems are
caused mainly by the mental distraction and divided
attention of taking part in a phone conversation at the
same time as driving.
*The terms ‘drivers’and ‘driving’in the leaflet include ‘riders’and ‘riding’.
D
The Law
Hand-held Phones
It is illegal to use a hand-held mobile phone while
driving. It is also an offence to “cause or permit”
a driver to use a hand-held mobile phone while
driving.Therefore, employers can be held liable as
well as the individual driver if they require
employees to use a hand-held phone while driving.
Hands-free Phones
It can be illegal to use a hands-free phone while
driving. Depending upon the individual
circumstances, drivers could be charged with ‘failing
to have proper control of their vehicle’. In more
serious cases, the use of any type of mobile phone could
result in prosecution for careless or dangerous driving.
The Police may check phone records when investigating
fatal and serious crashes to determine if use of the
phone contributed to the crash.
Employers who require staff to use any mobile phone
while driving for work could be prosecuted if an
investigation determined that such use of the phone
contributed to a crash. Claims in the civil courts could
also result.
This leaflet gives simple advice on how employers and
line managers can easily enjoy the business and
communication benefits of mobile phones, without
experiencing the financial and safety risks of their staff
using mobile phones while driving on work journeys.
A sample ‘Mobile Phones and Driving Policy’is attached.This can be adopted as written or adapted to suit
your organisation’s needs. It can be used as a stand-alone policy or incorporated into a wider ‘Driving for
Work’policy.
What employers should do
Expect Safe Driving
Ensure all staff, including senior managers and line managers,
understand that the organisation expects everyone who drives
for work to drive safely for their own, and others’benefit.
Consult Staff
Ensure that staff and/or their safety representatives are fully
consulted about the organisation’s policy on Mobile Phones and
Driving and that this is reviewed periodically in joint health and
safety committee meetings.
Raise Awareness
As part of recruitment, training and staff appraisal, ensure that drivers and line managers are
reminded about:
■ the dangers of using a hand-held or hands-free mobile phone while driving
■ the organisation’s policy on mobile phone use
■ the need to go to voicemail, or to switch the phone off while driving, and to stop in a safe place to
check messages, or to allow a passenger to use the phone
■ that good communication can easily be maintained without using a phone while driving
■ the importance of line managers not expecting staff to make or receive calls when driving
■ the legal, financial and bad PR consequences that could result from using a mobile phone while driving.
Avoid Using a Mobile Phone
In particular, emphasise that staff should never make or receive calls on a mobile phone, or use any
similar device, while driving.
Lead by Example
Senior Managers, from the head of the organisation down, should lead by personal
example by not using a mobile phone while they are driving themselves.
Plan Safer Journeys
Ensure that journey plans include time and places to stop for rest and refreshment,
and to check messages and return calls. For further advice see ‘Driving for Work:
Safer Journey Planning’at www.rospa.com/roadsafety/info/worksafejourney.pdf
Review Work Practices
Review work practices to ensure they do not pressurise staff into making or
receiving calls when driving.
Record and Investigate Crashes and Incidents
Require staff who are involved in any crash or damage-only incident when
driving at work (in their own, a hire or company vehicle) to report this to their
line manager. Check if the driver was using a mobile phone, and what (if any)
action is necessary to prevent repeat occurrences. If the company provides the
phone, a check could be made against the phone bill.
Provide Training
Interview staff who have been identified as using a phone while driving, or been involved in a crash, to
establish the details and to identify what lessons can be learned.The approach should be positive and
helpful, rather than punitive, although it should be made clear that further incidents may lead to
disciplinary procedures. Consider if driving training would help.
Liaise with the Police
Make it clear to staff that the organisation will co-operate with police enquiries resulting from a crash
and will supply to the police all relevant information on the employee to whom the vehicle is allocated or
if someone else was driving at the time, their details.
Monitor Compliance
Managers should discuss this issue with their drivers during periodic staff appraisals and team meetings.
It should form part of an individual employee’s performance appraisal, leading, where appropriate, to new
personal performance targets. Staff should be encouraged to report any pressure from managers or
customers to use a phone while driving.
Further Advice
■ HSE Guide,‘Driving atWork’– www.hse.gov.uk/pubns/indg382.pdf
■ ‘Managing Occupational Road Risk:The RoSPA Guide’(price £25.00) – www.rospa.com/drivertraining
■ ‘The Risk of Using a Mobile Phone While Driving’– www.rospa.com
■ www.orsa.org.uk
■ www.dft.gov.uk (Road safety section)
■ DfT FAQs on the mobile phone and driving offence –
www.dft.gov.uk/stellent/groups/dft_rdsafety/documents/page/dft_rdsafety_025216.hcsp
■ DfT leaflet on ‘Mobile phones and driving’– www.thinkroadsafety.gov.uk/advice/mobilephones.htm
■ www.hse.gov.uk/roadsafety/index.htm
■ ‘Driving for Work: Safer Journey Planner’– www.rospa.com/roadsafety/info/worksafejourney.pdf
■ ‘Driving for Work: Safer Speed Policy’– www.rospa.com/roadsafety/info/workspeeds.pdf
The Royal Society for the Prevention of Accidents
Edgbaston Park, 353 Bristol Road, Birmingham B5 7ST
Telephone: 0870 777 2171/0121 248 2000
Fax: 0870 777 2199/0121 248 2001
Registered Charity No. 207823
VAT Registration No. 655 1316 49 www.rospa.com
MS191
Company Mobile Phones and Driving Policy
As part of our overall health and safety policy, ________________________________________________
is committed to reducing the risks which our staff face and create when driving or riding for work.We ask
all our staff to play their part, whether they use a company vehicle, their own or a hire vehicle.
Staff driving for work must never make or receive calls on a mobile phone, whether hand-held or
hands-free, while driving. Persistent failure to do so will be regarded as a serious matter.
Senior Managers must:
Lead by example, both in the way they drive themselves and by not tolerating poor driving practice
among colleagues.They must never make or receive a call on a mobile phone while driving.
Line Managers must ensure:
■ they also lead by personal example
■ they do not expect staff to answer calls when they are driving
■ staff understand their responsibilities not to use a hand-held or hands-free mobile phone
while driving
■ staff switch phones to voicemail, or switch them off, while driving, or ask a passenger to use
the phone
■ staff plan journeys to include rest stops which also provide opportunities to check messages and
return calls
■ work practices do not pressurise staff to use a mobile phone while driving
■ compliance with the mobile phone policy is included in team meetings and staff appraisals and
periodic checks are conducted to ensure that the policy is being followed
■ they follow our monitoring, reporting and investigation procedures to help learn lessons which could
help improve our future road safety performance
■ they challenge unsafe attitudes and behaviours, encourage staff to drive safely, and lead by personal
example by never themselves using a phone when driving.
Staff who drive for work must
■ never use a hand-held or hands-free phone while driving
■ plan journeys so they include rest stops when messages can be checked and calls returned
■ ensure their phone is switched off and can take messages while they are driving, or allow a
passenger to use the phone
■ co-operate with monitoring, reporting and investigation procedures.

NET2272 Key Features

2009-10-14T05:52:00.001-07:00

Issue No. 2

♦ Hi-Speed USB 2.0 Peripheral Port
♦ Fully backwards compatible to Full-Speed USB connections
♦ Virtual Comm Firmware available
♦ Sustained throughput up to 40Mbytes/sec
♦ Lowest active power requirements (148mW)
♦ Lowest standby power (0.6uW)
♦)
Variable I/O voltage (2.5V to 5.0V♦ 6x6mm, 64 ball, Lead Free BGA Package
Application:
Mobile Phones
PLX Product:
NET2272 – USB 2.0 Hi-Speed Device Controller
Hi-Speed USB 2.0 for Mobile Phones
Most mobile phones today support a Full-Speed USB connection. This popular standard is used for transferring contact and calendar information from a PC, storing pictures from a mobile phone onto a PC, and using the mobile phone as an internet gateway for a lcomputer.
Actual Size aptop
However, as mobile phones continue to embrace rich content (high resolution pictures, videos, mp3s, etc.) and network speeds continue to increase, the need for a faster transfer mechanism to the PC is required.
Hi-Speed USB 2.0 is a natural fit. It offers 40 times the transfer speed of Full-Speed USB, it is compatible with all existing Full-Speed USB software, and it is already widely deployed in other applications like Portable Video Players, Printers, High End Digital Cameras and other products.
Using the NET2272 USB 2.0 Controller
The PLX Technology NET2272 Local Bus to USB 2.0 Hi-Speed Peripheral Controller is optimized for mobile phone applications. It easily connects to most mobile phone chip sets without glue logic. Its I/O bus can run at 2.5V, the I/O voltage used by many mobile phone digital baseband chips.
The NET2272 is the fastest, smallest, and lowest powered USB 2.0 peripheral controller of its kind. Furthermore, PLX supplies communications class firmware with the NET2272, allowing it to connect to standard PC communications software without the need for any additional drivers.
Page 1 of 2
March 2005, ExApp2_MobilePhone.doc
Page 2 of 2
March 2005, ExApp2_MobilePhone.doc
Issue No. 2
(actual size)
Block Diagram of a Typical Multimedia Mobile Phone
Additional PLX Advantages
♦ Superior USB 2.0 expertise and support
♦ Wide Range of Application Notes
♦ Schematic and Layout Design Reviews
♦ USB 2.0 Compliance Testing
♦ PCI Based Development Systems
♦ Complete firmware library for many standard USB devices (including communications class), and APIs for custom applications
♦ Supported in Windows, WinCE, and Linux
Design Tools & Documentation:
http://www.plxtech.com/products/NET2000/NET2272/default.asp
♦ DataBook, Application Notes, Performance Reports, Migration Guide, Design Guidelines, Video Demos, etc.
o
Contact Information
PLX Technology, Inc.
870 Maude Ave.
Sunnyvale, CA 94085 USA
Tel: 1-800-759-3735
Tel: 1-408-774-9060
Fax: 1-408-774-2169
Product Marketing: Adam Chen: achen@plxtech.com
Web Site: www.plxtech.com
© 2005 PLX Technology, Inc. All rights reserved. PLX and the PLX logo are registered trademarks of PLX Technology, Inc. ExpressLane, PowerDrive and the PowerDrive logo are trademarks of PLX Technology, Inc., which may be registered in some jurisdiction. All other product names that appear in this material are for identification purposes only and are acknowledged to be trademarks or registered trademarks of their respective companies. Information supplied by PLX is believed to be accurate and reliable, but PLX Technology, Inc. assumes no responsibility for any errors that may appear in this material. PLX Technology, Inc. reserves the right, without notice, to make changes in product design or specification.
6150-SIL-EA-1.0

MOBILE ADVERTISING GUIDELINES

2009-10-13T06:15:00.000-07:00

The MMA’s Mobile Advertising Guidelines provide recommendations for the global ad units broadly used in
mobile advertising in the following mobile media channels: Mobile Web, messaging, applications and mobile
video and TV. The Guidelines recommend ad unit usage best practices, creative technical specifications, as
well as guidance on ad insertion and delivery necessary to implement mobile advertising initiatives. The
guidelines are intended to promote the development of advertising on mobile phones by:
• Reducing the effort required to produce creative material,
• Ensuring that advertisements display effectively on the majority of mobile phones
• Providing an engaging, non-intrusive consumer experience.
The MMA’s Mobile Advertising Overview is a supplemental document that provides an overview of the mobile
media channels that are available to advertisers today, as well as the benefits of, and considerations for,
optimizing campaign effectiveness and strengthening consumer satisfaction. The Mobile Advertising
Overview can be found on the MMA Website at http://www.mmaglobal.com/mobileadoverview.pdf
The MMA guidelines are the result of ongoing collaboration across
the MMA Mobile Advertising Committee with representation from
companies in Asia Pacific (APAC), Europe, Middle East and Africa
(EMEA), Latin America (LATAM) and North America (NA).
Committee members are representative of all parties in the mobile
marketing ecosystem, including handset manufacturers, operators,
content providers, agencies, brands and technology enablers.
The target audience for these guidelines is all companies and
individuals involved in the commissioning, creation, distribution and
hosting of mobile advertising. The MMA Mobile Advertising
Guidelines present a baseline through which widespread adoption
will accelerate market development and ensure consumer
satisfaction.
Universal Mobile Ads
The MMA’s Mobile Advertising Guidelines are increasingly accepted across the industry worldwide. In order
to make preferred MMA ad units easier to define, adopt and reference, a subset of advertising units have
been defined as “universal” mobile ad units. These “universal” mobile ad units already enjoy broad support
across the industry.
The model for this package of ad unit identification is the Interactive Advertising Bureau’s Universal Ad
Package (UAP). The MMA hopes to adopt a similar structure in the future.
Publishers who are compliant with the MMA Mobile Advertising Guidelines will provide advertisers with at
least one of the ad units designated “universal” in this document, and will attest that those ad units have the
ability to reach the majority of that publisher’s audience. Publishers are also free to offer more ad units
beyond universal units.
Advertisers can be sure that by producing creative material according to these universal ad units, they will be
able to advertise through publishers who are compliant with the MMA Mobile Advertising Guidelines.
Advertisers are not obliged to provide all ad units in every case. Also, advertisers are free to use ad units
beyond those defined as universal.
The MMA is also working on an initiative with the Interactive Advertising Bureau (IAB) to drive accuracy in the
Measurement of mobile ad units.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 2 of 25
© 2009 Mobile Marketing Association
2.0 Mobile Web
This section provides recommendations for the most prevalent advertising units on the Mobile Web; graphical
banner advertising and text links.
The Mobile Web features text and graphics optimized to match the specific screen resolutions and browser
capabilities of each user’s mobile phone. Therefore, a smartphone with a high resolution screen can be
served large, visually rich ads and a mobile phone with fewer resources can be served light-weight ads
designed for small screens with limited resolution.
In order to accommodate the wide range of mobile phone capabilities, it is recommended that advertisers
produce and provide ad creative in a few pre-defined dimensions, discussed in this section. The appropriate
ad unit is selected from this set of pre-defined forms based on a particular mobile phone model’s capabilities
so that it best fits the mobile phone’s display. This approach helps ensure a good user experience and
increases process and campaign effectiveness.
2.1 Mobile Web Advertising Unit Definitions
The recommended ad units for Mobile Web are as follows:
• Mobile Web Banner Ad is a universal color graphics ad unit displayed on a Mobile Web site. The
universal Mobile Web Banner Ad is defined as a still image intended for use in mass-market
campaigns where the goal is a good user experience across all mobile phone models, network
technologies and data bandwidths. In some cases, particularly in Europe, animated Mobile Web
Banner Ads may be available for supplemental use in campaigns to convey a rich media experience.
All Mobile Web Banner Ads must be clickable by the end user and may be placed in any location on a
Mobile Web site. Supplementary, a Mobile Web Banner Ad can be followed by a Text Tagline Ad to
emphasize the clickable character of the ad unit.
• WAP 1.0 Banner Ad is a supplemental black-and-white, still graphics ad unit for use in campaigns that
target older mobile phones. A WAP 1.0 Banner Ad can be followed by a supplemental Text Tagline Ad
to emphasize the clickable character of the ad unit.
• Text Tagline Ad is a supplemental ad unit displaying only text. Text links may be used in older mobile
phones not capable of supporting graphical images and/ or by publishers that prefer to use text ads
instead of graphical ads on their mobile sites.
2.2 Mobile Web Banner Ad Specifications
The recommended specification for a Mobile Web ad unit consists of a series of specification components,
i.e. aspect ratios, media formats, dimensions and file sizes. When providing inventory specifications,
publishers should remember to also quantify those parameters they support. Agencies and advertisers
should remember to verify the specifications with each publisher on their media plan.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 3 of 25
© 2009 Mobile Marketing Association
Summary
Tables 1 and 2 provide a summary of Mobile Web Banner ad unit specifications and examples in the 4:1 and
6:1 aspect ratios. Every publisher should deliver the universal Mobile Web Banners ad units specified in
Tables 1 and 2. Supplemental Mobile Web Banners ad units may be supported to create additional
opportunities, (i.e. animated or advanced graphics).
Table 1: MMA Mobile Web Ad Guidelines
Mobile Web Banner Ad Units in 6:1 Aspect Ratio
Name Technical Specifications Sample Creative (approx. dimension)
X-Large Image
Banner
• 300 x 50 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 5 KB file size
Supplemental unit:
• Animated GIF for animation
• < 7.5 KB file size
Large Image
Banner
• 216 x 36 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 3 KB file size
Supplemental unit:
• Animated GIF for animation
• < 4.5 KB file size
Medium Image
Banner
• 168 x 28 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 2 KB file size
Supplemental unit:
• Animated GIF for animation
• < 3 KB file size
Small Image
Banner
• 120 x 20 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 1 KB file size
Supplemental unit:
• Animated GIF for animation
• < 1.5 KB file size
Text Tagline
(optional)1
• Up to 24 characters for X-Large
• Up to 18 characters for Large
• Up to 12 characters for Medium
• Up to 10 characters for Small
Show Times Click Here
1. There are regional differences in the use of text tag below the banner ad. See Section 2.3.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 4 of 25
© 2009 Mobile Marketing Association
Table 2: MMA Mobile Web Ad Guidelines
Mobile Web Banner Ad Units in 4:1 Aspect Ratio
Name Technical Specifications Sample Creative (approx. dimension)
X-Large Image
Banner
• 300 x 75 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 5 KB file size
Supplemental unit:
• Animated GIF for animation
• < 7.5 KB file size
Large Image
Banner
• 216 x 54 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 3 KB file size
Supplemental unit:
• Animated GIF for animation
• < 4.5 KB file size
Medium Image
Banner
• 168 x 42 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 2 KB file size
Supplemental unit:
• Animated GIF for animation
• < 3 KB file size
Small Image
Banner
• 120 x 30 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 1 KB file size
Supplemental unit:
• Animated GIF for animation
• < 1.5 KB file size
Text Tagline
(supplemental)2
• Up to 24 characters for X-Large
• Up to 18 characters for Large
• Up to 12 characters for Medium
• Up to 10 characters for Small
Show Times Click Here
2. There are regional differences in the use of text tag below the banner ad. See Section 2.3.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 5 of 25
© 2009 Mobile Marketing Association
Future: Mobile Web Banner Ads
The MMA recognizes the need to
provide larger than 300 pixels banner
dimensions. However, new mobile
phones coming to market vary in their
Mobile Web display characteristics
and clustering does not allow
identifying the most appropriate
dimension at this point in time. MMA’s
mobile advertising committee has
started exploring the opportunities of
using Rich Media as an advertising
format and plans to come up with
guidelines likely to feature flexible
widths especially beyond 300 pixels. In
the meantime, MMA encourages
experimentation in this space and
invites companies to share best
practice with the MMA mobile
advertising committee.
Future: File Sizes
The MMA recognizes that as new
mobile phones are introduced into the
market, and networks continue to
expand capacity, that file size limits
should increase accordingly. The MMA
has agreed to increase future
maximum file sizes to the limits
indicated in Appendix 2.
Specification Components
2.2.1 Aspect Ratios The recommended universal aspect ratios for
Mobile Web Banner Ads are 6:1 and 4:1. Key considerations for
providing universal aspect ratios include:
• Keeping the aspect ratio constant simplifies resizing of images
and reduces effort.
• Both aspect ratios provide sufficient creative space to ensure an
effective advertising experience, yet small enough not to be
intrusive. Having two aspect ratios gives publishers flexibility in
terms of layout and positioning in different contexts
2.2.2 Dimensions The recommended universal Mobile Web Banner
Ad widths are 120, 168, 216 and 300 pixels. Establishing guidelines
for Mobile Ad unit dimensions has several benefits:
• Limiting the amount of distinct dimensions reduces the amount
of time and resources spent on creative production.
• Dimensions selected provide a good fit for the majority of mobile
phones.
• Dimensions selected for Mobile Web Banner Ads provide for an
exact pixel height for both ratios defined which simplifies scaling of the creative.
2.2.3 Media Formats The recommended formats for Mobile Web Banner Ads are:
• GIF, PNG or JPEG as universal formats for still images.
• GIF for animated images.
2.2.4 File Size The maximum graphic file size is dependent on the
banner chosen. Tables 1 and 2 provide the maximum file size
recommendations across the banner ad unit types.
Character Limits for Text Taglines Character limits (rather than file
size limits) are applicable for Text Taglines appended to Mobile Web
Banner Ads. Screen width has no effect on text tagline sizes, which
Tables 1 and 2 summarize.
WAP 1.0 Banner Ad Specifications Appendix 1 provides a regional
summarization of WAP 1.0 ad specifications. This ad unit is still in use
in some markets, however, its importance, overall, is decreasing.
2.3 Mobile Web Advertising Creative Design Principles
In addition to the MMA Mobile Advertising Guidelines, other established guidelines for Mobile Web content
delivery should apply to Mobile Web sites containing image banners, as well as to Mobile Web sites that
users reach via links in image banners (post-click), such as jump pages, campaign sites and self-contained,
permanent third-party Mobile Web sites.
More detailed design principles and style guides for Mobile Web sites can be found in the W3C Mobile Web
Best Practices at http://www.w3.org/TR/mobile-bp. The MMA Mobile Advertising Committees also
recommends that Mobile Web sites conform to W3C mobileOK Basic 1.0 Guidelines, which are available at
http://www.w3.org/TR/mobileOK-basic10-tests.
Irrespective of using supplemental text taglines, the MMA recommends that advertisements contain some
form of call-to-action clearly identifiable by the user (e.g., “find out more” icon button).
Text Taglines
Text taglines are a supplemental feature that can be added to Mobile Web Banner Ad.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 6 of 25
© 2009 Mobile Marketing Association
Purpose:
• In cases where consumers are unfamiliar with Mobile Web Banner Ads and may not realize that
Mobile Web Banner Ads can be navigated to and clicked on, they may have a greater awareness that
text taglines can be navigated to and clicked on.
• A Mobile Web Banner Ad with a text tagline may generate higher click rates.
• Some older browsers cannot navigate graphical elements at all. In those cases, a text tagline is
required to make the Mobile Web Banner Ad clickable.
Limitations:
• Mobile Web Banner Ads with text taglines together use more real estate (space in the usable browser
window), typically at the expense of other Web elements, such as navigation and content.
Media owners and publishers need to make a case-by-case decision about what best suits their business
requirements.
2.4 Mobile Web Advertising Insertion and Delivery
The following recommendations are for Mobile Web advertising insertion and delivery, as appropriate to the
technology.
2.4.1 Ad Indicators
Some publishers and markets recommend or require the use of ad indicators (signifiers) when displaying an
ad unit. The publisher or local market guidelines define the exact format and placement of the ad indicator.
Indicators are used with both text and banner ads:
• A Text link ad indicator is defined as text used to indicate the text link is an ad. An example is the use
of “Ad:” preceding the ad text link.
• A Banner ad indicator is defined as a portion of the Mobile Web Banner Ad used to display the ad
indicator and indicate the Mobile Web Banner Ad is an ad unit rather than content. The indicator
typically is located on the side or the corner of the ad unit and may use text (e.g., “AD” in English
speaking markets or “Anzeige” or “-w-“ in Germany) or an icon.
The Mobile Web Banner ad unit specifications in Section 2.1 are inclusive of the ad indicator. When choosing
to use an ad indicator, the MMA recommends that the ad indicator be included with the creative ad.
2.4.2 Functionality
Automatic resizing of Mobile Web banners
Some publishers and ad-serving solutions provide a capability to re-size the ad creative dynamically to match
the mobile phone’s screen dimensions and capabilities.
In cases where the publisher or ad-serving solution requires only one banner image, the MMA recommends
using the X-Large Mobile Web Banner ad unit specifications as the default re-sizeable banner. It’s important
that the creative takes into account both the impact of image re-sizing (i.e. certain amount of degradation of
image quality) and that the automatic resizing may not work well with animated banners.
Animated banner images
When using animated Mobile Web Banner Ads, please note:
• Mobile phones that don’t support image animation tend to render only the first image frame. For this
reason, the MMA recommends that the first image frame should contain the entire advertising
message, instead of leaving important information for subsequent frames.
• To date, automatic resizing of animated images does not always deliver ideal results. Therefore, the
MMA does not recommend applying automatic resizing with animated image banners. The MMA is
studying this issue in order to find a workable recommendation.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 7 of 25
© 2009 Mobile Marketing Association
• There are several possible animation formats, including animated GIF, SVG, Flash, Silverlight and
interlaced JPEG. Animated GIF currently is the most widely supported on mobile phones. The MMA is
studying options for improvements that will be incorporated into future guidelines.
3.0 Text Messaging (SMS)
Short Message Service (SMS) is a communications service that allows the exchange of short text messages,
limited to160 characters, between mobile phones. It is also referred to as “text messaging” or “texting.” SMS
messages can be sent and received between virtually all operator networks. Virtually every mobile phone in
the world supports SMS, creating a ubiquitous market for SMS-based advertising campaigns. SMS supports
messages sent from one user to another, as well as messages sent from a machine, such as a PC,
application or server, to a user.
3.1 SMS Advertising Unit Definitions
The recommended ad units for SMS are as follows:
• Initial SMS Ad (Appended) is a universal text ad unit of variable length (often between 20-60
characters) appended to the content (or body) portion of the message containing the primary, nonadvertising
content of the message. This ad unit uses the remaining space after the content portion of
the message, and can be made available for advertiser usage by the publisher. As a principle, focus
should remain on the content portion which should not be compromised by the ad unit.
• Complete SMS Ad (Full Message) is a universal text ad unit with up to 160 characters available for
advertiser usage. There is no primary, non-advertising content in the message and this ad unit is
typically delivered as a reply to an Initial SMS Ad or “Text (keyword) to (short code)” call-to-action.
These ads may be delivered as part of an ongoing opt-in mobile advertising campaign.
3.2 Initial SMS Ad Specifications
Specification Components
3.2.1 Format SMS is a text-only medium. It does not support any rich media; however some mobile
phones with click-to-call or click-to-web capability will display colored links and underlining of URLs and
phone numbers. The font size is entirely controlled by the mobile phone and is not under control of advertiser
or publisher. Therefore the message renders differently on different mobile phones.
3.2.2 Length The length of the ad is the subject to the available space after the content. Consult your
publisher for the maximum allowable length. Current practice is typically ads under 20-60 characters, with
ads up to 80 characters. Advertisers should be aware that shorter copy allows for increased publishing
inventory availability.
When using double-byte characters (otherwise known as 16-bit) to send an SMS, the limit is 70 characters.
16-bit characters are associated with sending a Unicode text message, which is required to convey some of
the special characters used in non-Latin alphabets, such as Chinese, Japanese or Korean.
3.2.3 Location The ad copy will be inserted only at the end of the content portion of the SMS. In cases
where the sender uses a personal SMS signature, the ad should be inserted after the signature.
3.3 Complete SMS Ad (Full Message) Specifications
Specification Components
3.3.1 Format See Short SMS Ad format
3.3.2 Length A length of up to 160 Latin characters
3.3.3 Location The Complete SMS Ad will be the entire SMS message.
3.4 SMS Advertising Insertion and Delivery
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 8 of 25
© 2009 Mobile Marketing Association
3.4.1. SMS Ad Indicators
The publisher or advertising insertion partner is responsible for including an ad indicator in Initial (Appended)
SMS Ads. There should be a clear separation between the text message content and the ad. A carriage
return or line break is recommended, however not all carriers support line breaks, so an ad indicator should
also precede the ad copy. Acceptable ad indicators are:
• “*” (single asterisk)
• “**” (double-asterisk)
• “AD:” (or similar local language abbreviation)
• “-“ (dash)
Note that a carriage return may count as two characters.
3.4.2 SMS Ad Functionality
Delivery
• Delivery of SMS Ad messages should be consistent with the MMA Global Code of Conduct. In the
U.S., SMS Ad messages should also follow the MMA Consumer Best Practice Guidelines:
http://www.mmaglobal.com/bestpractices.pdf
• SMS Ad messages should be delivered per the watershed hours requirements of your local market.
Response (return SMS)
• If a user requests additional information be delivered to them via SMS, advertisers should respond to
that request within 12 hours or the request (opt-in) for that particular message will be deemed expired.
• Responses to user requests may be delivered by an alternate common short code or phone number,
but the relationship to the original request should be clearly identifiable by the user. (For information
about short codes, see the MMA Common Short Code Primer, available at
http://www.mmaglobal.com/shortcodeprimer.pdf )
Click-to-call
• Phone numbers should be local or domestic to the country that the ads are targeting.
• Phone numbers should be functional. Ensure that the numbers are in service before the campaign
launches.
• Premium destination numbers that would result in a charge that exceeds standard rates to the end
user should not be used unless the terms are fully disclosed in the ad.
• Emergency numbers (e.g., 911 in the United States and Canada, or 112 in parts of Europe), or any
unrelated service numbers, are not allowed in SMS ad units.
Link to Mobile Web site
• Landing page should be viewable in Mobile Web browsers.
• Content of the linked Mobile Web site should be related to the advertisement.
• The landing page should be working properly.
• Please see Section 2.3 of this document for best practices on mobile web content.
3.5 Creative Design Principles
The primary design goal should be that the SMS Advertising unit is clearly identifiable as an advertisement
and is easily understood by the receiver of the message. The following design principles are suggestions.
3.5.1 General Design Principles for SMS Ads
• Use abbreviations and “text speak” (e.g., LOL) with caution and avoid grammatical errors or
misunderstandings.
• Use punctuation when required for clarity or emphasis.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 9 of 25
© 2009 Mobile Marketing Association
• Note that a carriage return may count as two characters.
• Conduct testing to ensure that the publishing network recognizes, and mobile phones properly render,
any non-Latin or accented letters prior to use.
• Note that URLs contained in the text may allow click through to Mobile Web pages, depending on
handset capability, and may appear underlined or in color.
3.5.2 Design Principles for Initial SMS (Appended) Ads
• If a URL is included in an appended ad, the URL should be as short as possible. A URL under 20-
characters is recommended.
• To optimize the potential for frequency of delivery, the advertiser may develop several versions of ads
with varying lengths, maximizing the ads’ availability for insertion based on the length of the content
portion of the message. For example, “Nike” or “Just do it - Nike.”
3.5.3 Design Principles for Complete SMS (Full Message) Ads
• The Complete SMS Ad unit can be used for any type of promotional message or call to action.
• The advertiser should be clearly identified in the ad copy.
• Creative may contain a URL. Use of short URLs is recommended to use reduce character count and
maximize clarity and use of advertising space.
• The title or header of the message should reflect the consumer query or subscription that resulted in
delivery of the full ad message copy. For example, if the consumer replied “HOME” to get more info on
real estate, the resulting ad should have “HOME” in the first line. If the resulting ad is unfamiliar, the
recipient may dismiss it as “Spam”.
4.0 Multimedia Messaging (MMS)
Multimedia Messaging Service (MMS) is a rich media messaging service that allows mobile users to send
and receive messages that can include graphics, photos, audio, video and text. As such, it provides
marketers with increased ad effectiveness over SMS. Another benefit is that unlike the Mobile Web, this
media resides on the user’s mobile phone, so a data connection isn’t required to access the ad content once
the message has been received. It should be noted that unlike SMS, MMS is not yet universally supported by
all operator networks and all mobile phones; however the advertising opportunity using MMS is significant.
These guidelines seek to ensure a clear distinction of MMS Advertising units from content to avoid perception
of MMS Advertising as unsolicited communication and ensure maximum ad campaign effectiveness.
The MMS guidelines consist of a set of ad unit dimensions, file formats and maximum file sizes, as well as
additional considerations for advertisers and publishers.
4.1 MMS Advertising Unit Definitions
The recommended ad units for MMS are as follows:
• MMS Short Text Ad is a supplementary text ad unit appended to the content (or body) portion of an
MMS slide containing the primary, non-advertising content of the MMS slide. A MMS Short Text Ad
can contain links that are clickable by the end user. As a principle, focus should remain on the content
portion of the MMS slide which should not be compromised by the ad unit.
• MMS Long Text Ad is a supplementary text ad unit filling all of an MMS slide, whereby the text can
contain a link that is clickable by the end user.
• MMS Banner Ad is a supplementary color graphics ad unit displayed at the top or bottom of an MMS
slide. The supplementary MMS Banner Ad is defined as a still image intended for use in mass-market
campaigns where the goal is a good user experience across all mobile phone models, network
technologies and data bandwidths. However, in some cases, particularly in Europe, supplementary
animated MMS Banner Ads are available for use in campaigns where it is imperative to convey a rich
media experience. An MMS Banner Ad can be clickable by the end user, in which case a separate
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 10 of 25
© 2009 Mobile Marketing Association
text link can be considered. The MMS Banner Ad unit specification is similar to the Mobile Web Banner
Ad specification in terms of aspect ratio and dimension.
• MMS Rectangle Ad is a universal color graphics plus optional text ad unit filling all of an MMS slide,
whereby the text can contain a link. The universal MMS Rectangle Ad is defined as a still image
intended for use in mass-market campaigns where the goal is a good user experience across all
mobile phone models, network technologies and data bandwidths. However, in some cases,
particularly in Europe, supplemental animated MMS Rectangle Ads are available for use in campaigns
where it is imperative to convey a rich media experience. An MMS Rectangle Ad can be clickable by
the end user, in which case a separate text link below the graphics is recommended. An MMS
Rectangle Ad can be placed before the original content (pre-roll), within (mid-roll) or after (post-roll) of
the MMS, on a separate slide. Mixing an MMS Rectangle Ad with other content (except audio) on one
slide is not recommended.
• MMS Audio Ad is a supplementary audio clip that is played while an MMS Rectangle Ad or an MMS
Full Ad is displayed.
• MMS Video Ad is a supplementary video ad unit and usually gets delivered as part of a MMS Full Ad.
• MMS Full Ad is a supplementary ad unit which only contains advertising content. The MMS Full Ad is
a complete MMS composed of elements of MMS Short Text Ads, MMS Long Text Ads, MMS Banner
Ads, MMS Rectangle Ads, MMS Audio Ads and MMS Video Ads and distributed over one or multiple
slides. There is no primary, non-advertising content in the MMS Full Ad and this ad unit is typically
delivered in response to an ad request or based on some form of valid consent (opt-in) provided by the
recipient.
4.2 MMS Advertising Unit Specifications
Specification Components
The following ad unit specifications provide the framework for producing MMS ad creative material suitable
across a broad range of mobile phones with a compelling and engaging user experience.
4.2.1 Media Formats for MMS ad units are as follows:
• JPG or GIF as universal formats for still images.
• GIF for animated images.
• AMR-NB (on GSM networks) and QCELP (on CDMA networks) are prevailing audio formats.
• AAC+, AAC, MP3, WAV (PCM encoded) become increasingly available on mobile phones.
• 3GP and 3G2 the are prevailing video formats. Recommended audio quality: @ 16bit 44 KHz Stereo;
Recommended video quality: QVGA @250kbps, 20-30 frames per second.
4.2.2 Aspect Ratio
Mobile phones vary substantially in their screen display designs: landscape, square or portrait. Unlike in the
Mobile Web, MMS creators have no visibility of the individual target mobile phone and its screen
characteristics at the time of MMS composing.1
As a consequence, and to keep the need for vertical scrolling of ad messages to a minimum, the MMA
recommends using any landscape aspect ratio for MMS Rectangle Ad images. This typically includes 16:9
and 4:3 ratios. Also, a 1:1 (square) ratio can produce acceptable results. Such aspect ratios usually allow for
ad text to be visible together with the ad image on screens. Portrait aspect ratios are not recommended.
For the MMS Banner Ad, aspect ratios apply as defined for the Mobile Web Banner Ad units in Section 2.2
(6:1 and 4:1).
1 Mobile operators and MMS service providers (e.g. VASP) may be able to provide information of individual users’ mobile phone
display and media capabilities, which can be used to build richer and even more engaging MMS ad campaigns.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 11 of 25
© 2009 Mobile Marketing Association
For MMS Video Ads, the recommended aspect ratios are the following:
• 16:9 (HD)
• 4:3 (QVGA)
• 11:9 (QCIF)
4.2.3 Dimensions
For all graphical MMS Ad elements, regardless of their aspect ratio, widths are recommended as defined for
the Mobile Web Banner Ad units in Section 2.2, i.e.
• X-Large MMS Image (width 300 pixels)
• Large MMS Image (width 216 pixels)
• Medium MMS Image (width 168 pixels)
• Small MMS Image (width 120 pixels)
• Respective heights being according to the aspect ratio selected.
The Large MMS Image width (216 pixels) is the universal dimension recommended for use in MMS Ad
campaigns where only one dimension is used. This width has proven to produce satisfactory user experience
across today’s mobile phones in mature mobile markets.
For all MMS Video Ad elements, the following are the most common examples of frequently used
dimensions:
• Large MMS Video (320 x 240 pixels)
• Medium MMS Video (176 x 144 pixels)
• Small MMS Video (128 x 96 pixels)
4.2.4 File Size
The maximum MMS message file size available for advertisements depends on the following factors:
• Mobile phones are currently capable of receiving MMS messages between a maximum of 100 KB to
600 KB sizes2.
• Mobile network configurations apply irrespective of the mobile phone capability. Currently most
networks support a maximum of 300 KB. However, some networks already increase this limit to 600
KB.
In order to reach a broad audience, the MMA recommends that the complete MMS file size does not exceed
300 KB. Maximum MMS file size and maximum ad file sizes are inclusive of all applicable elements (e.g.,
graphics, text and audio3).
• For ads inserted to other content, the MMS ad file size should not exceed 100 KB. This limit allows 200
KB or more for the original content. This file size allows for good quality MMS Rectangle Ad images,
even for many animated images.
• For the MMS Full Ad unit, a maximum file size of 300 KB is recommended.
4.3 MMS Advertising Creative Design Principles
4.3.1 Sender identification
The sender of the MMS Full Ad message should be clearly identifiable by the message recipient. The “from”
and “subject” field as well as the first message slide should reflect the consumer request or opt-in context that
2 The number of mobile phones supporting less than 300 KB maximum MMS size is decreasing.
3 In case of using SMIL, about 1 KB of formatting information should be considered part of the MMS size.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 12 of 25
© 2009 Mobile Marketing Association
resulted in delivery of the full ad. The message subject field alone is not sufficient for carrying this information
because it is not shown on many mobile phones.4
For example, if the consumer has opted in to receiving advertisements from brand XYZ, the full ad messages
delivered should have “XYZ” not only in the “from” and “subject” field but also in the first element (text or
graphic) of the first slide. Local market guidelines or regulation might be in place requesting sender
identification placement.
4.3.2 Ad Indicators
Advertisers should consult their publisher and local markets to determine requirements for ad indicators.
Indicators could be used with both text and graphical ads:
• Text ad indicators, where text is used to indicate the text is an ad. An example is the use of “Ad:”
preceding the ad text. See also Section 3.4.1 on SMS ad indicators for more guidance.
• Graphical ad indicators, where a part of the creative is used to display the ad indicator and thus make
it clear that the graphic is an ad rather than content. The indicator typically is located on the side or the
corner of the creative and may use text (e.g., “AD” in English speaking markets or “Anzeige” or “-w-“ in
Germany) or an icon to indicate that the image is an ad.
The ad indicator is part of the graphical and text ad elements as per the technical specifications in Section
4.2. The MMA recommends that when advertisers choose to use an ad indicator, it should be included with
the creative material. Conventions for ad indicators vary by market and publisher.
4.3.3. Illustrations
The following example seeks to illustrate a possible pre-roll design.
4.4 MMS Advertising Insertion and Delivery
4.4.1 Impact of Transcoding and Rendering of media on mobile phones
MMS Message delivery includes two steps, transcoding and rendering; both which potentially impact the
quality of the message, its formats, and the resolution of media elements.
4 Please reference the MMA Global Code of Conduct: http://www.mmaglobal.com/codeofconduct.pdf
Example 1: MMS Pre Roll
Key elements are:
← Announce the service
← Clearly distinguish publisher brand from
advertisement
← Inform customer that the content
message will display on the following
slide(s)
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 13 of 25
© 2009 Mobile Marketing Association
Many mobile operators support transcoding, also known as media adaptation. Transcoding, which
automatically adapts content during message delivery, is done according to the receiving mobile phone
capabilities (e.g. screen resolution, maximum message file size, supported media formats) to avoid negative
user experience. While transcoding ensures that advertisements (along with possible other content) are
consistently presented on all mobile phones, it can have a negative impact on the audio and visual elements
if applied extensively. The ad unit specifications as defined in chapter 4.1 seek to reduce the need for
transcoding, and retain the quality of the ad creatives.
Transcoding and rendering have advantages that are relevant for the purpose of MMS advertising:
• To provide a good experience for users on almost all MMS-capable mobile phones.
• To allow creative material to be provided in one version only.
However, some caution is recommended:
• Image creative should be chosen that properly resizes down to lower resolutions. For example, tiny
text and graphical details should be avoided.
• Extensive media adaptation (from very large graphics down to very small ones) may render some
creative material into poor quality for low-resolution mobile phone screens. This can happen to
graphics containing text, details, thin lines or color palettes with texture.
• Creative producers are recommended to contact MMS service providers and/or network operators for
more details. In case transcoding is not available on a network, only the standard audio formats (AMRNB
on GSM networks and QCELP on CDMA networks) are recommended in MMS advertising5 6.
The process of MMS delivery can influence the content of MMS, therefore; testing the impact of resizing on
quality and legibility of the creative material is recommended. The MMA further recommends that MMS ad
delivery be tested on real phones prior to any campaign execution.
4.4.2 Synchronized Multimedia Integration Language (SMIL)
For MMS messages, SMIL defines the order of images and text on a slide, the time a slide is displayed, and
other parameters. Media creators should consider the following SMIL parameters:
• Region – defines the order of text and graphics on MMS slides. It determines whether all slides of an
MMS will start with graphics followed by text or vice versa. Without this parameter it is up to the MMS
client to set the order of image and text on one slide, which may lead to an unfavorable display
representation.
• Height – determines the percentage of display space reserved for text and graphics respectively; this
enables forcing the display of text below a picture in the visible area of the mobile phone display.
• Duration (dur) – controls the duration of display for each individual slide of the MMS. This parameter
is of importance to synchronize the duration of slide display and length of audio play measured in
seconds. If not properly set, the slide show may progress to the next slide before the audio (or video)
has finished playing.
4.4.3 Other Considerations
International Roaming
Inserting ads into MMS messages sent to users who are roaming abroad can generate additional costs for
those users because they typically pay roaming fees for MMS data usage. The industry is still developing
best practices for this situation. Some MMS service providers/operators provide the ability to block ad
injection and sending ad MMS messages to roaming users, thus ensuring a good customer experience. If
possible, this option should be used.
5 For GSM networks: http://www.openmobilealliance.org/Technical/release_program/docs/MMS/V1_3-20080128-C/OMA-TS-MMSCONF-
V1_3-20080128-C.pdf
6 The MMA recommends to extend the capabilities of MMS audio composition tools to include the mandatory formats as defined in the
standards
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 14 of 25
© 2009 Mobile Marketing Association
Response timing (return MMS)
If a user requests advertising information to be delivered to him via MMS, this request should be respond to
within 12 hours or the request (opt-in) for that particular message will be deemed expired.
MMS Video Ads
Advertisers should consider the following when developing MMS Video Ads:
• Avoid using fast-moving videos
• Avoid rapid scene changes (many scene changes in a short period)
• Avoid using small letters for advertising messages
For further considerations, please refer to the Mobile Video and TV Advertising Creative Design Principles in
Section 5.2.
5.0 Mobile Video and TV
This section provides recommendations for the most prevalent advertising units used in Mobile Video and TV.
5.1 Mobile Video and TV Advertising Unit Definitions
The recommended ad units for Mobile Video and TV are described as follows:
Ad Breaks are video or still/animated image advertisements rendered before, during or after streamed or
downloaded Mobile Video and TV content.
Linear Ad Breaks take over the full mobile display screen and replace the streamed or downloaded video
content for a given period of time. Ad unit formats include:
• Billboard Ad –a static image or brand logo typically displayed full screen before or after the video
content
• Bumper Ad – a short video advertisement or sponsorship indent typically shown before or after the
video content
• Pre-Roll Ad – a video advertisement shown prior to the video content
• Mid-Roll Ad – a video advertisement appearing as a break during the video content
• Post-Roll Ad – a video advertisement shown after the video content has ended
• Book Ending Ad – a Pre-roll video advertisement with a corresponding bumper ad from the same ad
campaign appearing at the end of the video content
Non-Linear Ad Breaks share the mobile display with the streamed or downloaded video content for a given
period of time. Ad unit formats include:
• Overlay Ads are still/animated image advertisements that appear over top video content during
playback. These ads can be semi-transparent or opaque and can be shown for the full or partial
duration of the video content (appear/disappear effect). Variations include horizontal or vertical
promotion banners, sponsorship skins (picture frames) and ad bugs.
• Companion Ads are still/animated image advertisements that appear adjacent to video content during
playback. Variations include drop-down horizontal banners or L-shaped banners that surround a
resized video (shrink and surround).
Interactive Mobile Video and TV Ads are advertisements that allow for user interaction including clicking,
browsing, zooming. Guidelines for these types of Mobile TV and Video advertisements are still being
researched by the MMA but may include click-to-web, click-to-call, click-to-SMS, click-to-video, click-todownload,
click-to-locate, click-to-ad etc .
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 15 of 25
© 2009 Mobile Marketing Association
5.2 Mobile Video and TV Ad Break Specifications
5.2.1 Aspect Ratios
Although most handset display screens have a portrait format, Mobile Video and TV content is typically
created and rendered in a landscape format. Recommended landscape aspect ratios for Mobile Video and
TV content are 4:3, 16:9 and 11:9.
5.2.2 Ad Placement and Length
Shorter ad break durations of 15 seconds (also 10 – 20 seconds) are recommended for short form video
content of 3 to 5 minutes in length. Longer form video content over 5 minutes may support ad breaks of 30
seconds or more but should be considered in consultation with the content publisher to ensure the best
consumer viewing experience.
Table 3: Mobile TV and Video Ad Breaks
Design Model Advertisement Placement Recommended Length
Bumper/Billboard Before or after content 5 seconds or less.
Pre-Roll only Before content Typically 15 seconds.
30 seconds or less
Mid-Roll only During content Typically 15 seconds.
30 seconds or less
Post-Roll only After content Typically 15 seconds.
30 seconds or less
Book Ending Before and after content Typically 15 seconds.
30 seconds or less
5.2.3 Video/ TV Ad Lengths Exceptions
Video downloads: The total file size of a downloadable video is important, especially for consumers
downloading over 2G connections. Due to the download time, a downloadable video is typically 30 seconds
in length, and may go up to 2 minutes in length. For downloads, the MMA suggests shorter pre-rolls and / or
short bumper, or vice versa depending on the length of the content (For example a 10-second pre-roll and a
3-second post-roll, or a 3-second pre-roll and a 10-second post-roll).
Broadcast TV: Mobile TV is still nascent, so more research is necessary to ascertain consumer preferences
regarding advertising lengths within mobile TV. “Traditional” TV ad breaks can be long (several minutes) and
should be reviewed with the publisher to ensure good consumer experience.
5.2.4 Media Formats
The recommended formats and resolutions for Mobile Video and TV ad units are:
• Video Ad Specifications (e.g. Pre-Roll Video Ad):
• File formats: WMV, AVI, MOV, MPEG2, .3GP
• Resolution/Aspect Ratio: QVGA, CIF, QCIF
• Recommended audio quality: 16bit 44Khz stereo
• Recommended video quality: 250kbps, 20-30 frames per second
Image Ad Specifications (e.g. Billboard Ad):
• File formats: .JPG, .PNG
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 16 of 25
© 2009 Mobile Marketing Association
Future: Location Based Advertising
The MMA recognizes the need to
provide guidelines for location based
advertising. However, models for using
location currently vary, and do not
allow identifying the most appropriate
guidelines at this point in time. MMA’s
mobile advertising committee has
started exploring the opportunities of
using location in advertising and plans
to come up with guidelines for location
based advertising. In the meantime,
MMA encourages experimentation in
this space and invites companies to
share best practice with the MMA
mobile advertising committee.
Mobile Video and TV Advertising Creative Design Principles
Advertisers should consider the following when developing mobile video/TV campaigns:
• Avoid using fast-moving videos
• Avoid rapid scene changes (many scene changes in a short period)
• Avoid using small letters for advertising messages
• Avoid dark shots
• Shoot made-for-mobile versions of commercials
Existing video advertising creative assets that have been shot for TV or online may not be optimal for mobile
and could need re-editing. For instance, text may be difficult to read, and fast-moving action that is too far into
the distance may not be visible or look good on the mobile screen.
6.0 Mobile Applications
This section addresses advertising guidelines for applications that
host ads inside the application design and logic. Specifications
presented here are applicable to a wide range of application types
comprising managed platforms, virtual machines, native applications
and widgets. There are applications that may not be able to make
use of these guidelines (e.g. ad units within idle screen applications).
These types of applications will be addressed in future releases of
these guidelines. For a more comprehensive overview of the mobile
applications landscape, please consult chapter 4.0 of MMA’s Mobile
Advertising Overview document
(http://www.mmaglobal.com/mobileadoverview.pdf).
6.1 Mobile Application Advertising Unit Definitions
The recommended ad units for Mobile Applications are as follows:
• In-App Display Advertising Units
Mobile Application Banner Ad – is a universal color graphics ad unit displayed on a Mobile
Application. The universal Mobile Application Banner Ad is defined as a still image(s), text or
combination of these, intended for use in mass-market campaigns where the goal is a good
user experience across all mobile phone models, network technologies and data bandwidths.
In some cases, animated Mobile Application Banner Ads may be available for supplemental
use in campaigns to convey a rich media experience. A Mobile Application Banner Ad can be
clickable by the end user and may be placed anywhere in a Mobile Application (e.g., on the
application main menu page or subpages).
Mobile Application Interstitial Ad - is a full-screen advertisement, which may be placed as a
“bumper” screen for the launch and exit of the application, or as a splash or jump page within
the application. It may be used as the landing page from an earlier ad banner or may be a
stand-alone Interstitial. This Interstitial may also be active or static.
• Integrated Ad – is an advertisement that is integrated with the application or game experience (also
known as product placement) and is formatted to be compatible with the main content type used in the
application context. It can be resized, reshaped and freely positioned as part of the core application
content. Respective guidelines are under study and expected to be added in future releases of this
document.
• Branded Mobile Application - many downloadable application advertising campaigns will continue to
be custom designed to support the needs and expectations of the target audience. Respective
guidelines are under study and expected to be added in future releases of this document.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 17 of 25
© 2009 Mobile Marketing Association
• Sponsored Mobile Application – publisher’s downloadable application which features a sponsoring
arrangement at various places across the application. Respective guidelines are under study and
expected to be added in future releases of this document.
6.2 Mobile Application Advertising Unit Specifications
Specification Components
The following ad unit specifications provide the framework for producing In-App Display Ad creative material
suitable across a broad range of mobile phones with a compelling and engaging user experience.
6.2.1 Media Formats The recommended formats for In-App Display Ads are:
• JPG, PNG or GIF as universal formats for still images.
• GIF for animated images.
6.2.2 Aspect Ratios The recommended aspect ratios for In-App Display Ads include:
• Mobile Application Banner Ads: 6:1 and 4:1 as per the respective Mobile Web Banner Ad unit.
• Mobile Application Interstitial Ad: Any landscape aspect ratio as per respective MMS Rectangle Ad
unit. This typically includes 16:9 and 4:3 ratios and also a 1:1 (square) ratio.
6.2.3 Dimensions For all graphical In-App Ad elements, regardless of their aspect ratio, widths are
recommended as defined for the Mobile Web Banner Ad units in Section 2.2 (except for the Text Tagline unit
which does not apply in Mobile Applications), i.e.
• X-Large Mobile Application Image (width 300 pixels)
• Large Mobile Application Image (width 216 pixels)
• Medium Mobile Application Image (width 168 pixels)
• Small Mobile Application Image (width 120 pixels)
Respective heights are according to the aspect ratio selected.
6.2.4 File Size File size considerations are currently ongoing for mobile applications. For the time being,
following respective guidance from Mobile Web Banner and MMS Rectangle Ads is recommended (see
Sections 2.2.4 and 4.2.4).
6.2.5 Display Length
Mobile Application Banner Ad units are displayed with application content
• Banner Ads may be replaced periodically with a new ad. Refresh intervals may vary by publisher and
application.
Mobile Application Interstitial ads should be displayed in full, during which click-through actions are enabled.
• At any time the Interstitial ad is displayed in full, the user should be able to click to continue past the ad
into the content.
• A preliminary recommendation for Interstitial ad display time is that the units disappear after a
maximum of 5 seconds.
6.3 Mobile Application Advertising Creative Design Principles
6.3.1 Banner Ad Unit Creative Design Principles
Mobile Application Banner Ad units are presented alongside the host application. Banners may be presented
anywhere on the screen at the publisher or developer’s discretion.
Applications may contain a dividing area between the banner and application content, but this is applicationspecific
and not considered a part of the ad unit specification. Banner ads are opaque (zero image
transparency), such that the ad image does not blend with the application content.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 18 of 25
© 2009 Mobile Marketing Association
Mobile Application Interstitial Ad units are intended for display on a complete screen or with minimal
components of the application (e.g., title bar or soft-button labels). Generally, Mobile Application Interstitial
ads should use as much of the screen area as possible. However, landscape or square aspect ratios seem to
allow the most flexibility for both Mobile Web and Mobile Application platforms, are convenient for advertisers,
and leave room for the title bar and/or soft-button labels.
6.3.2 In-App Display Ad Unit Actions
In-App Display Advertising Units can either be:
• Non-active/non-highlighted/static means that the ad unit is visible on screen, but it is not clickable.
• Active/highlighted/non-static means that the ad unit is in the “select” state. Users can click on it for
more information.
Action initiation:
Clicking on ad units provide opportunities for the user to receive additional information from the advertiser.
Both ad banners and Interstitial ad images may be active and link either to places inside the application or to
outside the application. This functionality must be consistent with a mobile phone’s capabilities (e.g.,
interactivity such as click-to-call, WAP push) and will be limited by both type of mobile phone and mobile
phone connectivity. Examples include:
• Click-to-Mobile Web: click launches the web browser.
• Click-to-call: click initiates an outgoing call to the content provider or advertiser.
• Click-to-video: click initiates an advertiser’s video commercial for a product or service.
• Click-to-SMS: click initiates an SMS for a user to send a keyword to a shortcode to request more
information.
• Click-to-locate: click initiates a map enabled by location-based services where a user may find, for
example, the closest car dealer or movie theatre.
• Click-to-buy: click initiates a jump page where a user may make a purchase using some form of
mobile payment (i.e. credit card, operator bill, etc).
• Click-to-storyboard: click transitions to a second interstitial ad (which itself may provide additional
actions).
For applications and games whose flow may be greatly disrupted by a click-through, click-through ads should
only display before the launch or exit of the application, or be queued until the end of the application
experience, or avoided altogether. If it is required to switch the user away from the application context, the
MMA recommends that, where possible, and in mobile phones that support click through, users are returned
to the place in the application that they left after interacting with the ad (e.g., World Series of Poker, with $1
million in chips).
If there is a risk that switching the user away from the application context will cause the application to
terminate, requiring the user to completely re-launch of the application, the application developer or publisher
is recommended to apply specific user warnings as follows:
• Notification: Clearly notifying users that they will be leaving the application environment to
experience the advertisement. And clearly communicating that, in most cases, users will need
to completely re-launch the application in the same way they started the application.
• Right to Cancellation: Giving users the option of interrupting the action to return to the
application.
For ads displayed during the use of an application, MMA recommends using banners or interstitials that avoid
switching the user away from the application context (e.g. expandable banners).
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 19 of 25
© 2009 Mobile Marketing Association
7.0 Technical Requirements for Mobile Advertisers
Advertiser/merchant site infrastructure
• Advertisers are responsible for the infrastructure costs for a site or associated click-through pages
including: keeping up with traffic demands, communications, hosting, hardware and software, as well
as the costs of implementation.
Ad unit serving
• Ad-serving infrastructure will serve the ad units defined in these guidelines to phones on-the-fly, based
on device-type detection and according to the best-fit principle, where the specification choice is based
on what a particular mobile phone’s screen can accommodate.
• Content that cannot be displayed by a mobile phone should not be delivered. For example, if a mobile
phone does not support GIF, then that format must not be served to that particular mobile phone.
Ad format testing
• The MMA recommends that tests be conducted prior to launching a campaign.
Automatic resizing of ad formats (optional and where applicable)
• Ad-serving infrastructure may be capable of performing automatic resizing, where a standard
dimension is dynamically adjusted to match the phone’s display while maintaining the aspect ratio of
the standard ad unit.
• Based on early experiences, automatic resizing works well for still images and provides value, such as
the ability to support large screens. The absence of MMA guidelines should not stop companies from
collecting experience in the field of automatic resizing by working along their own guidelines.
• Advertisers are advised to ensure that their creative is suitable for automatic resizing, especially in
cases where visual detail is essential.
8.0 Who We Are
About the Mobile Marketing Association
The Mobile Marketing Association (MMA) is the premier global non-profit
trade association established to lead the growth of mobile marketing and
its associated technologies. The MMA is an action-oriented organization
designed to clear obstacles to market development, establish mobile
media guidelines and best practices for sustainable growth, and
evangelize the use of the mobile channel. The more than 700 member
companies, representing over forty countries around the globe, include all
members of the mobile media ecosystem. The Mobile Marketing
Association’s global headquarters are located in the United States and it
has regional chapters including North America (NA), Europe (EUR), Latin
America (LATAM), Middle East and Africa (MEA) and Asia Pacific (APAC)
branches. For more information, please visit www.mmaglobal.com.
About the MMA Mobile Advertising Committee
The MMA Mobile Advertising Committee, with active committee
participation across the globe, has been established to create a library of
format and policy guidelines for advertising within content on mobile
phones. By creating mobile advertising guidelines, the MMA ensures that
the industry is taking a proactive approach to keep user experience, content integrity and deployment
simplicity as the driving forces behind all mobile advertising programs world-wide.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 20 of 25
© 2009 Mobile Marketing Association
The MMA Mobile Advertising Committee, chaired by Madhouse, Inc., Verizon Wireless, Vodafone Group
Services, Ltd. and Velti developed these guidelines in collaboration with the following MMA member
companies:
MMA Global Mobile Advertising Committee - Global Members
AdMob Inc.
Catapult Marketing
JumpTap
Microsoft (MSN and Windows Live)
Mobext
Motorola
Motricity
MX Telecom
Neustar, Inc.
Playboy Enterprises
Telecom Italia SpA
Telefónica S.A.
Turkcell Iletisim Hizmetleri A.S.
Unkasoft Advergaming
Velti
Vodafone Group Services Ltd.
MMA Global Mobile Advertising Committee – Regional Members
Asia Pacific
Madhouse Inc.
Europe
Jinny Software
Mobile Advertising
Solutions
Mobixell Networks Ltd
MOMAIL
Orange NSM
Out There Media GmbH
North America
4INFO, Inc.
AT&T Mobility
Azuki Systems
Buzzd
North America (cont.)
Fox Interactive Media
GoldSpot Media
Greystripe Incorporated
Impact Mobile Inc.
Mobile Behavior, LLC
Mobile Posse
Myxer Inc.
News Over Wireless
Platform A
Quattro Wireless
Rhythm NewMedia
Ringleader Digital
Sensei, Inc.
SinglePoint
North America (cont.)
SkyFire Labs, Inc.
Smaato Inc.
Snac, Inc.
Sybase 365
Tapioca Mobile
TelePages, Inc.
Telescope, Inc.
Telescope, Inc.
The Weather Channel
Interactive
U.S. Cellular Corp
Verizon Wireless
Verve Wireless, Inc.
Vibes Media
9.0 References
The following links provide additional sources of information and reference:
Guidelines and Best Practices
• MMA Global Code of Conduct
http://www.mmaglobal.com/codeofconduct.pdf
• MMA U.S. Consumer Best Practices Guidelines for Cross-Carrier Mobile Content Programs
http://www.mmaglobal.com/bestpractices.pdf
Educational Documents
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 21 of 25
© 2009 Mobile Marketing Association
• Mobile Applications
http://www.mmaglobal.com/mobileapplications.pdf
• Mobile Measurement Ad Currency Definitions
http://www.mmaglobal.com/adcurrencies.pdf
• Understanding Mobile Marketing: Technology and Reach
http://www.mmaglobal.com/uploads/MMAMobileMarketing102.pdf
• Off Portal – An Introduction to the Market Opportunity
http://www.mmaglobal.com/offportal.pdf
• Mobile Marketing Sweepstakes and Promotions Guide
http://www.mmaglobal.com/mobilepromotions.pdf
• Mobile Search Use Cases
http://www.mmaglobal.com/mobilesearchusecases.pdf
• Introduction to Mobile Coupons
http://www.mmaglobal.com/mobilecoupons.pdf
• Introduction to Mobile Search
http://www.mmaglobal.com/mobilesearchintro.pdf
• Short Code Primer
http://www.mmaglobal.com/shortcodeprimer.pdf
Websites
• Mobile Marketing Association Website
http://www.mmaglobal.com
• W3C Mobile Web Best Practices
http://www.w3.org/TR/mobile-bp/
• W3C mobileOK Basic 1.0 Guidelines
http://www.w3.org/TR/mobileOK-basic10-tests/
• W3C mobileOK Checker
http://validator.w3.org/mobile
10.0 MMA Guidelines Approval Process
The MMA implements a collaborative process for industry guidelines review and approval, prior to public
release. The process not only considers feedback from industry leaders and experts but also helps to
determine work streams for future releases. The summarized approval process is as follows:
• Committees generate a draft guidelines document developed and approved by MMA committee
member companies (“Committee”).
• Once the guidelines are approved by Committee, the guidelines are issued for public review. Public
review will last a minimum of four weeks.
• Feedback from the public comment period is circulated to Committee for review and incorporation as
appropriate. Note: In the event substantial revisions are suggested, the Committee must again
approve the guidelines prior to release.
• Once all approvals and feedback is gathered, incorporated and approved, the guidelines are released.
The guidelines are released every six months and are the result of collaboration across the MMA
Mobile Advertising Committee with representation from companies in Asia Pacific (APAC), Europe,
Middle East and Africa (EMEA), Latin America (LATAM) and North America (NA). If deemed
appropriate, the Committee may elect to release an interim revision of the guidelines.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 22 of 25
© 2009 Mobile Marketing Association
11.0 Supporting Associations
The following associations currently support the MMA Mobile Advertising Guidelines in our collective mission
to establish a consistent global guidelines and best practices for mobile advertising:
12.0 Contact Us
For more information, please contact:
Mobile Marketing Association
Email: mma@mmaglobal.com
www.mmaglobal.com
13.0 Glossary of Terms
The MMA maintains a nomenclature glossary of all terms within MMA guidelines, education documents and
research. The glossary is available at:
http://www.mmaglobal.com/glossary.pdf.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 23 of 25
© 2009 Mobile Marketing Association
Appendix 1 – WAP 1.0 Specifications
Appendix Table A-1: Technical Specifications – WAP 1.0 Banners
Ad Unit Technical Specifications Sample Creative
Asia Pacific:
Standard Text Link for 128 and
176 screen sizes
• 1 line of text maximum
• Up to 8 characters maximum
ABCD酷炫网站
Asia Pacific:
Text Link for 240 screen size
• 1 line of text maximum
• Up to 12 characters maximum
ABCD广告片流畅下载
Europe, Middle East and
Africa:
Standard Text Banner
• 3 lines of text maximum
• Up to 16 characters per line
• Max. 35 characters total, including
spaces
Europe, Middle East and Africa
and North America:
Standard Image Banner
• 80 x 15 pixels
• B&W, 1-bit bitmap
• < 200 bytes file size
Europe, Middle East and Africa
and North America:
Standard Image/Text
Combination Banner
• 80 x 12 pixels
• B&W, 1-bit bitmap
• Text: Up to 16 characters
• < 200 bytes files size
North America:
Standard Text Banner
• 2 lines of text maximum
• 12-16 characters per line
• 32 characters total, including spaces
Aspect Ratios t.b.d.
Dimensions see Table A-1 above
Media Formats The recommended formats for WAP 1.0 Banner Ads.
• bmp (1-bit bitmap)
• Text ads are based on the default mobile phone character format.
File Sizes see Table A-1 above.
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 24 of 25
© 2009 Mobile Marketing Association
Appendix 2 – Future Mobile Web Banner Ad Specifications
Tables A-2 and A-3 provide a summary of future Mobile Web banner ad specifications and examples in the
4:1 and 6:1 aspect ratios. Please note the expanded file sizes.
Table A-2: MMA Mobile Web Ad Guidelines
Mobile Web Banners Ad in 6:1 Aspect Ratio
Name Technical Specifications Sample Creative (approx. dimension)
X-Large Image
Banner
• 300 x 50 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 10 KB file size
Supplemental unit:
• Animated GIF for animation
• < 15 KB file size
Large Image
Banner
• 216 x 36 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 6 KB file size
Supplemental unit:
• Animated GIF for animation
• < 9 KB file size
Medium Image
Banner
• 168 x 28 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 4 KB file size
Supplemental unit:
• Animated GIF for animation
• < 6 KB file size
Small Image
Banner
• 120 x 20 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 2 KB file size
Supplemental unit:
• Animated GIF for animation
• < 3 KB file size
Mobile Advertising Guidelines
Mobile Marketing Association Version 4.0 www.mmaglobal.com Page 25 of 25
© 2009 Mobile Marketing Association
Table A-3: MMA Mobile Web Ad Guidelines
Mobile Web Banners Ad in 4:1 Aspect Ratio
Name Technical Specifications Sample Creative (approx. dimension)
X-Large Image
Banner
• 300 x 75 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 10 KB file size
Supplemental unit:
• Animated GIF for animation
• < 15 KB file size
Large Image
Banner
• 216 x 54 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 6 KB file size
Supplemental unit:
• Animated GIF for animation
• < 9 KB file size
Medium Image
Banner
• 168 x 42 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 4 KB file size
Supplemental unit:
• Animated GIF for animation
• < 6 KB file size
Small Image
Banner
• 120 x 30 pixels
Universal unit:
• GIF, PNG, JPEG for still image
• < 2 KB file size
Supplemental unit:
• Animated GIF for animation
• < 3 KB file size

Linux whole

2009-10-13T06:10:00.001-07:00

▼ September (93)

IT AT NET

My Blogs

My Blogs

Team Members

KERALA TOURISM WEBSITE tourismforkerala.com Kerala Tourism website provides details of travel destinations, hotels, accommodation, culture, heritage, art forms,medical tourism.cheapadvertising opportunity also. http://tourismforkerala.com

BSNL rolls out 3G services in orissa

Reliance Industries

VIRGIN GALACTIC ROLLS OUT MOTHERSHIP “EVE”

A Fresh Direction for Virgin Mobile Australia

Optus merges Virgin Mobile Australia and SIMplus

declining public schools, and deteriorating housing conditions in

Guidelines on Cell Phone Forensics

Local student crowned Australia’s National Champion for mobile phone recycling

MOBILE PHONES & JAPANESE YOUTH

Driving for work: mobile phone

NET2272 Key Features

MOBILE ADVERTISING GUIDELINES

Linux whole