CaseNote: Mobile phone call data obfuscation & techniques for call correlation

Abstract

The use of call data records (CDRs) to establish links between suspects is well known and understood. In a number of major enquiries in the UK, however, it was found that CDRs contained apparently erroneous or nonsensical data which prevented the use of well-established techniques based on caller IDs contained within CDRs. Further analysis suggested that some form of number “spoofing” was being used and techniques were developed to associate calls made using one of the two mechanisms which appeared to be in operation. A working hypothesis about how the calls are being handled in order to implement obfuscation has been developed, based on additional data leaked by some of the mobile network providers.