Investigating Terrorist Attacks Using CDR Data: A Case Study

Abstract

Call Detail Records (CDR) are commonly used by police and intelligence services all over the world. In many countries, GSM operators are obligated to keep CDR data for all of their subscribers. For prosecutors, courts, and judges investigating criminal cases it is beneficial to use CDR data. This case study shows how mining CDR data helped in the investigation of a terrorist attack that happened in Istanbul, Turkey. A truck was put on fire by a terrorist organization to protest against the conditions of a terrorist leader in prison. Arsonists were identified and arrested after the interrogation of suspects. The judge asked GSM operators to provide the suspects’ CDR data for verifying their testimonies. Five different attributes retrieved from the CDR were merged. Date, time, and location of suspects were compared with the log of signals received by base stations. In order to find out whether subjects are acquainted with each other, their phone calls on the day of the attack were matched using GSM line numbers. Furthermore, suspects’ cell phone handsets were matched using International Mobile Equipment Identity (IMEI) numbers in order to find out whether same handsets or SIM cards have been used in the past. Friendship, spatiotemporal, GSM line number, and IMEI number analysis using CDR data revealed that some testimonies were wrong and thus helped in identifying the suspects who carried out the attack.