Could your SatNav land you in jail?

[4n6]

Good afternoon to all.

I am a Director of a Computer Forensics enterprise who, whilst fascinated by all things GPS / Location Based Service-related, is happy to admit the limitations of my knowledge in the area currently, given that my work focuses primarily on disk and IP-network forensics. I'm planning to change this however by contracting some commercial research but thought this looked like a great place to gain some early appreciation related to my specific interest. I would therefore be grateful to hear any members' opinions on any of the following or on any related matters that spring to your mind having read the list;

Do SatNav devices (or other GPS devices) locally store details of previous journeys made/personal movements which are accessible from the device at a later date?

Are the same details stored remotely, say on the subscribing server?

Does any local encryption (or other security) of such data occur?

Is any data related to previous journeys time-stamped, i.e. if I drove to Newcastle yesterday would my device be able to tell me what time I passed the Angel of the North?

What software/devices/cables/etc. can retrieve such data from a device?

Can a user alter this data?

Can a device have such data manually inserted onto it, i.e. could an interrogated device be made to suggest that it had been in a location that it had not?

Does anyone know of any criminal cases where law enforcement have relied upon GPS data to secure a conviction? I am aware of US cases where GPS units have been attached to the vehicle of a suspect (without a warrant!) to track if he/she returns to the scene of a serious crime but I am not aware of any UK-based circumstances of the use of GPS data in prosecutions.

Your opinions and comments are welcomed and I thank you for your time. Any opinions subsequently used in the research will be fully credited to the individual and of course your prior permission would be sought.

Many thanks.

4n6.

[Privateer]

Hi 4n6,

to the forum!

[Darren]

Just to add to what Richard has said, the server side navigation solutions (examples are TrafficMaster's SmartNav and the mobile phone solution from Wayfinder) use off-board mapping delivered on a per route basis. Whether they store details of routes requested I do not know but it is entirely possible that they do, they may also collect information on the actual route driven as both systems by necessity have a GSM connection to their servers.

There are GPS solutions that save track logs such as Memory-Map but these tend to be off-road solutions. The tracklog shows route, speed and time but the tracklog file can be easily altered and by design can be shared so you could drive a route, change the time stamps and then upload that to another Memory-Map equipped PC or PocketPC.

The mainstream road navigation solutions from TomTom, Garmin et al do not save routes actually driven, merely a history of the last x number of destinations input so I doubt these would be of much use in a criminal investigation.
_________________
Darren Griffin

[philpugh]

Just to add to the previous replies...

Most handheld GPS devices (used for walking/sailing/flying etc) will record where they have 'been'. These are referred to as tracks. They are designed to be downloaded to other equipment (eg PCs). They are simply a log of positions, speed, direction of travel and altitudes (this varies for different GPS units) and a date/time stamp. You can set the units to record every so many seconds or every time you have moved so many metres.

Most car sat-navs don't record tracks - except for the high end (e.g. expensive) units. But there are third party bits of s/w that could be added to some systems to acheive this.

The tracklogs are plain text files and are easily edited and transferred to other GPS devices - so I suspect they wouldn't make very reliable evidence in a court of law.

Connection to devices is either by standard serial communications or, for newer units, USB. Both are common, well understood methods of communication.

It would be a very simple task to insert additional or remove places in the track log. Indeed my hand held GPS did it for me automatically a while ago - a perfectly normal walk in the Derbyshire hills - at one point it recorded a single position just in the sea above the Hebrides (!). Don't know what went on - but it was in the track log - so was I there? I suspect it was a glitch caused by me switching it off (or back on) at lunch. The time was right. So definitely not a reliable witness.

Basically GPS systems are designed to be easy to use and produce data that is simple to manipulate (in terms of reading / plotting on maps etc). They haven't been designed for providing robust (read unchangeable) information. As such - data loggers (which are just simple GPS units with limited controls/display) that are often seen as something to track people / assets etc are not that reliable as either the tracker or the trackee (?) can alter the data given a few minutes.

Other than covert data-loggers most systems will be set up to record a log of trips by the user for their own purposes.

For tracking of people it's probably more reliable (in terms of admissible evidence) to get hold of movements made by a persons mobile phone. Operators will have access to this information - but whether they are allowed to release it - I wouldn't know.
_________________
Phil

[Pc-Mobile]

The very thing that GPS data can be altered within a device or other location means that it does not stand up in court.

Therefore the answer to the heading is: very unlikely.
_________________
Pc-Mobile
http://pc-mobile.net/gps.htm

[PaulB2005]

[Skippy]

Many Garmin units have a facility to record a track log of your movements. This can be downloaded to a PC using the Mapsource program and other third party programs too.

Tracklogs can also be uploaded to Garmin GPS units so in theory it would be possible to modify a tracklog and reload it into the device.

Sometimes the Garmin tracklogs record spurious readings for a few seconds (ie, several hundred MPH) but mostly it records your speed, heading, position, time and elevation.


As an aside, I've heard that some modern cars keep a rolling record of the car's speed, ABS, ESP etc data for the last minute or so. If this is true, then the data could potentially be used to determine the cause of a crash and possibly to prosecute the owner...
_________________
Gone fishing!

[robertn]

Navman devices that I am familar with have a "Recent" list - record a number of recently visited locations. These are sorted by the most recent first. I don't know if a time stamp is stored or if they are just sorted that way at the time the trip is calculated.
The also store the most recently looked up location. Again, no time stamp, and not proof you went there.

Without being a legal expert, my guess that that as evidence it would unlikely stack up in court, however, it could provide collaberating evidence, and certain has enough information for a police investigation to "find items of interest", that could lead them to find other "items of interest"

A case was reported a while back where a motorist was let off a speeding ticket, based solely on the GPS track from his Garmin, so there is some recognition in the courts of vlidity of GPS data. I do not remember which country though. Probably established 'Reasonable doubt' ?

Most GPS recievers when first turned on use the last known location as a starting point to establish a fix (Warm start), therefore they must have stored in memory the Lat/Long and time they last had a fix. This information would be lost as soon as the GPS got a fix, and is probably discarded after a period of time.

If I was up on serious charges - I would not willingly hand over my GPS device, and would insist on a search warrent before I gave the police access to it.

I am also aware of at least one car manufacturer that was recording such information in the car management system without telling it's customers. Who is to say the Sat Nav manufactures are not doing the same, either intentionaly or not, and malicously or not?

[Darren]

[theripper]

[robertn]

[PaulB2005]

[4n6]

Thanks guys, I am loving your responses and discussions.

Firstly, let me answer the question that is occuring in the discussions in relation to alteration of other digital evidence as this is my area of expertise (digital forensics), for those that are interested; there is something known as 'Locard's Principle' which basically states that anything removed from or introduced into a crime scene leaves a trace. Whilst it originated for other forensic science purposes, it applies pretty well to digital data, in such that any alteration of digital data will also leave a trace on the disk or out in a network, at routers, switches, firewalls etc. I guess the main manner in which Locard's Principle should be updated to encompass digital evidence is that it can be altered remotely, i.e. by someone not at the crime scene. Clearly, if someone wanted to clean up any spilt blood at the scene of a murder, they would need to be present at the scene to achieve this.

Another method of validating digital evidence on a disk is to generate a hash function value of the disk image at the point of seizure. The hash value would alter if a single bit was changed on the disk.

So returning to the main thrust of the discussion, does Locard's Principle apply to SatNav devices - or those that you have identified as having the capability to store data and timestamps - either by merit of their 'high end' design or by use of third party software? In other words, would any alteration of data on devices be traceable and capable of being proved?

Likewise, do we think that US law enforcement, in the cases I mentioned in my original post, have developed a robust, read-only tracking/logging system or simply use the GPS device to alert them that a suspect may be returning to the scene of a crime and simply get their butts over there...?

Is there any regulation that providers (TomTom et al) are subject to in relation to data retention, similar to how Internet Service Providers will soon be required to retain records of each webpage we visit for a longer time than they currently do? If not, what's the feeling of the forum - is data related to our journeys being stored on providers' servers for whatever reason without our knowledge - similar to the car manufacturer scenario mentioned by robertn or TrafficMaster's SatNav mentioned by Darren, given their GSM server connection. The final minute of vehicle data as mentioned by skippy - is this stored locally (in the car) or reported off somewhere centrally (now that would be big brother in full swing!).

Could data loggers or handheld GPS devices be made robust enough for criminals to use to subvert any investigation into their real movements? Or could the data be altered without trace (Locard's Principle being bypassed) to introduce reasonable doubt, as in the case of the speeding motorist mentioned by robertn?

It is quite rare for mobile phone operators to release 'tracking' details they may have on a single subscriber to law enforcement, although there have of course been some infamous examples, such as the Ian Huntley case. The question is why should this data be any more reliable than GPS data, assuming the latter is stored somewhere. A GSM SIM card can be cloned, a phone stolen, data deleted by a corrupt O2 employee, a phone communicating with a base station other than the nearest for a multitude of reasons, etc.

Please keep the discussion going - for one, I am finding it fascinating.

Thanks to all contributers thus far.

4n6.

[welshgasman]

My Inforad is not a GPS satnav device but a GPS speed camera warning device. This keeps a log of your trips to the amount of memory available for this purpose.
Just start and end positions with distance

[robertn]

Some devices would bypass 'Locard's Principle' as they use static ram, and removal of batteries would erase the memory contents. I have heard stories about contents or RAM being accessible long after the power is removed, I put them in the NSA/Spooke/James Bond camp of probability -I am sure you have more detail as this is your feild of expertise.

Others, such as the early iCN's, have flash memory. My limited experiance in embedded development leads me to beiive that the file system on these devices is likely to relocate blocks rather than overwrite them, similar to a hard disk, but even more likely. Flash memory has a limited life cycle of 10000 to 100000 writes, so you cannot just keep updating the same location all the time. Therefore a forensic expert could physically remove the memory chip and access it's full contents, completely bypassing the devices operating system. (Or just ask the manufacturer for a special OS to dump the contents).

We see you’re using an ad-blocker. We’re fine with that and won’t stop you visiting the site.
Have you considered making a donation towards website running costs?.
Or you could disable your ad-blocker for this site. We think you’ll find our adverts are not overbearing!