[dTal]

>find out which phones pinged the phone tower near each of the locations at each of the relevant times

I don't know that that is actually possible. The police can access the records for any one number, but accessing all the records for a set of towers in a given time window is a different matter. I would actually love to know if this is within their capabilities.

[angry_octet]

It totally is within the capability of telcos. It's a database query away. Whether the police can get a warrant for it is a different matter. I'm not au fait with the details of RIPA post the EU decision [1][2] but it is safe to say the barriers are not that high. Meta data (like cell tower signal strength) is almost certainly available. Towers log everything, and location is a valued derived product.

[1] https://www.eff.org/deeplinks/2018/09/uk-surveillance-regime... [2] https://blogs.lse.ac.uk/mediapolicyproject/2016/01/05/some-t...

[multjoy]

You will never be able to justify the collateral intrusion that getting all the connections to a single cell site would represent.

If you don't know who you're looking for then it isn't actually that much help in any case.

Assuming you know that the suspect phone will have pinged a given cell site, then you still have to work out which phone it was. Assuming that they're not daft enough to use anything other than an unregistered PAYG sim, then you're left hoping that the IMEI of their handset has come to police attention.

If you had the resources, you could get the top-up data for all the unregistered sims attached to that cell site and hope there's CCTV at a given newsagent or that they've used their own bank account to top up online.

[angry_octet]

I'm not sure if you read the links? The UK doesn't have the same requirements as the US. They don't have a collateral intrusion limitation.

Once you have the IMEI of interest you can find everywhere it has been and every number dialled, and all DNS requests and IP transfers. You just need a dialled number which has a plan attached and you can look up the phone book entry from that persons phone (though police would need a warrant for that).

The only thing preventing the Met from finding this thief is a lack of person time.

[multjoy]

Yes, there is a collateral intrusion limitation. You cannot simply go on a fishing trip.

Once you have an IMEI number that you can attribute to the suspect, having exhausted all conventional means of finding the data then you go ahead and start requesting billing and cell site data.

Note, however, that this won't tell you what ip addresses have been assigned to that account.

[dTal]

That's just it. There's already a frontend for the police to use that gives them access to all the data for a single phone number, sans warrant. Does that same frontend allow them to perform arbitrary queries across the entire dataset?. If not, then pursuing this lead would involve filling out forms and writing letters to telcos, possibly even obtaining warrants (unlike the usual process), and they probably wouldn't bother.

Incidentally, the ability to perform unrestricted arbitrary queries without a warrant across the entire phone-location dataset is a fairly horrifying amount of power for the police to have. But I suppose legally that ship has sailed with RIPA, and now it's just a question of the fine details of the implementation.

[multjoy]

No.

Getting a request approved is a nightmare. It's literally easier to get a search warrant from the courts than it is persuading police SPOCs to approve your RIPA request.

The gatekeeping is fearsome. They take their duties incredibly seriously.

[dTal]

I'm not quite sure what your 'no' is specifically in reference to. I'm also not sure what a SPOC is, and I'm not familiar with the details of the process.

But The Guardian reported in 2014 that "EE, Vodafone and Three give police mobile call records at click of a mouse", and in 2015 that "UK police requests to access phone calls or emails are granted 93% of the time", with rejection rates varying wildly by county from as high as 28% to as low as 0.1%. So it doesn't seem to be as hard as you're making out, unless things have changed wildly in the last few years. May I ask your sources?

https://www.theguardian.com/world/2014/oct/10/automatic-poli...

https://www.theguardian.com/world/2015/jun/01/police-request...

[angry_octet]

SPOC = single point of contact

The filtering isn't about civil liberties (although keeping councils out seems sensible) but rate limiting requests via paperwork, so only important ones get done.

[multjoy]

What's your source for that?

[multjoy]

I'm a police officer who routinely uses communications data in investigations.

[robk]

Already exists in production