09.11.2007 - Uni – Secteur d'analyse
L'analyse des communications des TP9 entre le 2 et le 4 mai, enregistrées par les antennes (3 opérateurs) qui desservent Praia da Luz est signée par l'inspecteur Paulo Dias.
Introduction
An operational analysis
has as a primary objective, to suggest “ways” to the
investigation, and to open new perspectives for the investigation.
For that it analyses the data available and constants in the legal
records, having recourse to tools recognized at national and
international level – Excel and Analyst Notebook V. 6.
The analyst, facing the
data, will have to analyse them, that is, divide them, separate
them, in order to, at the end of the correlations, built a synthesis
of the results in an objective and synthesized form.
Whenever possible he
should raise a hypothesis, based always and solely on the existing
evidence in the records, in other words he should maintain an
objective stance, not allowing subjectivity on top of the objective
results, nor should should he extrapolate beyond the results
obtained.
With these presumptions,
the report that follows was elaborated so the research was available
to other elements, in order to clarify some matters.
Objet
The review
of the contacts recorded in the BTS (retransmission antennas) that
serve the locality of Praia da Luz, from the 3 national
operators.
Objectif
Jauger et éventuellement corriger le rapport du 10 septembre 2007 signé par les inspecteurs Victor Pereira et Sérgio Cruz. Vérifier la possibilité d'extraire, de la totalité des communications de ces 3 journées, des indices menant à une piste permettant de comprendre ce qui est arrivé à MMC. Ce rapport et ses annexes serviront à la présentation du rapport d'analyse final, fondé sur ces données et sur le reste des éléments de preuve joints aux autos.
Développement
Compte tenu de l'ampleur des données remises par les enquêteurs, il n'est pas faisable d'effectuer une analyse menant à la formulation d'une hypothèse pouvant à son tour fournir de nouvelles pistes d'investigation.
Nevertheless,
already some attempts were performed, notably it was tried to
determine the existence of “numbers” that activated one of the
BTS on day 3 and did not do it on the 4th. The
result of this analysis is 1859 numbers, i.e this value indicates the
mobile phone numbers that did not activate the antennas on the 4th,
but had done it on the 3rd, amongst nationals and foreigners.
This
would require the consultation of all domestic and foreign operators,
that would take us to a lot of information, which most likely nothing
would be of no use for the investigation, because the responses would
not be conclusive, many of the numbers are pre-paid cards of unknown
user and because most likely the answers would not arrive in time. After
these replies, it became necessary to consult the Spanish operators
to determine if any of these numbers had activated any antenna in
Spain. Supposing that the author(s) of the MMC's kidnap fled to
Spain. This wouldn't indicate anything, as most likely there were
various situations of that kind.
Before
we continue, it should be noted that we are dealing with a universe
of 74104 communications, which are distributed as shown in table 1.
Operator/Day
|
Day
02
|
Day
03
|
Day
04
|
Total/operator
|
Optimus
|
2797
|
2568
|
3560
|
8925
|
TMN
|
9948
|
9519
|
13572
|
33039
|
Vodaphone
|
9506
|
9559
|
13075
|
32140
|
Total
Per day
|
22251
|
21646
|
30207
|
74104
|
As is
generally known, an Excel sheet (2003 version) has only 65536 lines,
which prevents the processing of all the data together (3
days).
Similarly,
the other tool available – notebook Analyst V.6. - has not solved
the problem, since the result is a stain, that cannot be portrayed in
one mere sheet of A4, (the program itself does not allow its
printing) and to become possible, your impression would take such
dimensions that it would not be humanly possible to perform any
reading/analysis of the result.
For
example, it may be noted that even with a short number of
communications, for example 2 thousand monthly contacts, Analyst
Notebook produces an “output” on paper of considerable dimensions
– 2000 mm x 600 mm, and with the objects 30 to 40% of normal size,
if not less.
Thus,
one can tell that this data serves once and only when one has a
possible suspect or group of suspects. In this case the data will
show its usefulness, confirming, if there have been contacts, the
presence of the author or authors in Praia da Luz in the days 2-4
May, of this year. In this sense, and to verify that the
methodology used was efficient, following the report of the
criteria produced by the elements of BCAI, the DCCB, we analysed the
contacts made by known mobile phones and telephone numbers of the 9
adult elements of the group that travelled with Madeleine.
Suit un tableau comportant les 24 numéros (téléphones cellulaires et fixes) du groupe dit TP9.
Méthodologie adoptée
In view of the different
formats of databases that operators sent, as can be seen in the autos, formatting the data was necessary. For example, it was
necessary to separate the elements that made up the date, in the case
of Vodaphone – 20070502, and then to return to regroup them
correctly – 02-05-2007. The hours in the case of TMN are recorded
with the digits related to the separate hours of the minutes and the
seconds 17 345, creating formulas to add “0” (zero), where they
were necessary, it separated minutes from seconds and then regrouped
the three pairs of numbers, adding the world separator of hours “:”
17:03:45 hours.
Apart from this “cleaning”,
it was necessary to determine which table column corresponded to the
phone transmitter and receiver, as well as what activated the
antenna, because even in these cases the three operators would adopt
different ways to archive their records.
TMN sent only a sheet in
CSV (Comma-Separated Values) where in addition to the date, time,
name of the antenna and respective code, it has a column marked with
“MSISDN”, which contains the numbers which activate the antenna
and another called “OTHER_PARTHY”. The distinction between the
transmitter and the receiver number, is made across the indications,
“Voice started”, “Voice ended”, “SMS originated” or “SMS
finished”, that are in the column labelled
“CALL_TRANSACTION_GROUP”. Existing also a column for duration.
Vodaphone sent 3 Excel books, corresponding to the three days requested. Each book
consisted of 4 pages – “Outgoing calls”, “Incoming
Calls”, “SMS sent” and “SMS received”. The separation
between types of contacts makes it possible to determine the
direction of the contact, which is the numbers always in the column
entitled “Number of Phone Caller” intended for the numbers that
are in the “Phone Number Called” column. As for the activation of
the antennas, it depends on whether you are in the paper of made or
received contacts. The pages of voice or SMS made, who activates the
antenna is the source phone – caller – while on the other the
voice and SMS received is the receptor – called – who activates
the antenna.
Optimus sent only one
book, distributing the contacts by multiple sheets, “Cell ID”,
“Calls Made”, “Calls Received”, “GPRS”, “SMS Sent”,
“SMS Received”, “Roamers In”, “Roamers Out” and “UMTS”
. As to the activation of the antennas (14931, 14932 and 14933), this
information is contained in the sheets themselves with the indication
in column – “A_BTS_CGI” or “B_BTS_CGI”, where these agree
with “A_MSISDN” or “B_MSISDN” to activate the antenna.
Now in the concern of the
contact direction, the direction is always “A_MSISDN” to
“B_MSIDSN”, except for “SMS Sent” in that the constant
numbers “B_MSIDSN”, are message centres through which the SMSs
pass, whereby the meaning is “A_MSISDN” to “C_MSIDSN”, the
sheet “SMS Received”, also it is a particular case that had to be
studied “manually”, to avoid the triangulation of this type of
contact (C sends to A which in turn sends to B, which receives).
When there existed
whether in “A_MSISDN”, or in “C_MSISDN”, numbers that
corresponded to messaging centres and the numbers that actually sent
the message, only the latter was picked up, in order to with the
resource of the program/analysis tool (Analyst Notebook ), draw up a
representative graph of the communications made.
As regards the sheet
“RoamersIn,” according to an official of this operator, this
sheet should not have been included in the book, since there would be
constant data, to the match, in the other sheets. However, he advised
to carry out a detailed analysis of that data, as he feared to have
occurred some error in the system that makes the records.
As it turned out in
verification only one contact that was in this sheet was not found in
the rest.
The contact maintained
with that employee it was obtained the information that in the
“SERVED_NUMBER” column, in the “RoamersIn” sheet are
indicated the numbers that activate the antennas, there having no
indication or way to tell whether it was making or receiving
communication.
This as it turned out
caused some errors in the charts (Charts) developed by elements of
the English authorities and rectified by colleagues of the DCCB (Direcção
Central de Combate ao Bandestismo).
These errors are: the
direction of contact; their duplication, because there are
differences of seconds between the registration of the contact and
the registration of the “roamings”; and, the lack of SMS’s
received.
After this work, they
produced the graphics (1) that are attached (2).
(1) It joins a file that
must be installed to proceed to the reading of this type of computer
file.
(2) In the different
graphics it will be possible to bring together two contacts of
different colours very close, the two overlap, between the two
participants, but this is due to the fact that the participants
activated different operators in the same contact and as such has
seconds of difference.
Conclusions
Il y a des situations
dans lesquelles les deux interlocuteurs se trouvent dans la zone
géographique de Praia da Luz et activent des antennes d'opérateurs
différents. Dans le graphique apparaissent deux contacts qui
représentent le même, mais une différence de secondes dans
l'enregistrement par chaque opérateur va faire qu'apparaissent deux
liaisons. Cette distinction est signalée par des couleurs
différentes.
À l'exception de Rachael
MO, tous les éléments du groupe activent un seul opérateur. RMO
active les antennes de Vodafone et de Optimus.
Il existe une
augmentation du trafic produit par les éléments du groupe après
l'annonce de la disparition de MMC.
Fiona WP n'a effectué
aucune communication pendant les 3 journées analysées.
David WP et Dianne W ont
deux contacts en commun (indication des numéros de téléphone, le
premier étant la résidence de DW au Royaume-Uni, le second n'ayant
pas été identifié, mais n'activant aucune des antennes
considérées).
Avant l'alerte sur la
disparition de MMC, David WP n'a eu un contact du type GPRS avec le
numéro xxxxx vers 20h, le 3 mai. Le premier contact, après l'alerte
(hypothétiquement vers 22h) est à 1h17 et vers le numéro de Dianne
W. Sur le graphique représentant ses contacts, en orange (Optimus),
apparaissent quelques liaisons en bleu (TMN) entre son téléphone
cellulaire et celui de Russell TB. Ceci indique que David était hors
de la zone d'influence des antennes qui desservent PDL, au moment de
ces contacts. Selon les autos, il devait être dans les installations
de la police pour déposer. David WP a divers contacts avec des
éléments extérieurs au groupe. Aucun de ces contacts n'a activé
une antenne au cours des 3 jours analysés, ni n'a de contacts avec
des tiers qui l'aient fait.
Dans le tableau 3 (p. 9)
se trouvent les enregistrements des communications de David WP.
Hormis les contacts qu'il
a eu avec Jane TB et David WP, Russell TB a un contact en commun avec
Kate MC, le 44xxx678 auquel il sera fait référence plus loin.
Toutefois il faut souligner que ce numéro a envoyé un message et en
a reçu un de Kate MC avant la disparition de MMC, vers 12h31 et
12h34 respectivement, le 3 mai. Ce numéro était alors hors de
l'influence des antennes qui desservent PDL, donc quand il reçoit le
contact de Russell, le 4 mai vers 19h43, il active une antenne de
Optimus à PDL. Ce fait se voit sur le graphique de l'Analyst
Notebook, de David, apparaissant en orange. Dans la base de données
que Optimus nous a envoyée, ce numéro active l'antenne pour la
première fois à cette heure-là.
Avant la disparition qui,
selon les déclarations des éléments du groupe aurait eu lieu entre
20h30 et 22h, Russell n'a reçu qu'un SMS provenant du téléphone
cellulaire 44xxx801 à 10h52, le 3, et le premier contact qu'il a
établi après l'alerte a été à 8h13 le 4 mai vers le 44xxx469
(2'49") ; ce numéro n'active aucune des antennes analysées.
Russell TB a établi un
autre contact vers le numéro 44xxx603 à 10h52, le 4 (13"), qui
n'active aucune antenne non plus.
Le numéro 44xxx678
