Chapter 42. Global Positioning Systems
Information in this chapter:
• An overview of global positioning systems
• An overview of the NAVSTAR Global Positioning System
• How GPS works
• Types of GPS evidence
• Collection of evidence from GPS devices
• Interpretation of GPS evidence
Global Positioning Systems, or GPS units, have become commonplace in modern society. As is true with any device that can record and store data, these devices can become a source of evidence in civil and criminal cases. In using GPS data as evidence, it is important to understand what impacts the accuracy of the data these devices produce as well as the potential for errors in analyzing the data. The first part of this chapter provides some background on global positioning systems work, and how what they store can become evidence in a case.
Keywords
Global Position System, GPS, Track Logs, Waypoints, Geo-Location, Map Data, Map Errors, Triangulation
Introduction
Global positioning systems, or GPS units, have become commonplace in modern society. As is true with any device that can record and store data, these devices can become a source of evidence in civil and criminal cases. In using GPS data as evidence, it is important to understand what impacts the accuracy of the data these devices produce as well as the potential for errors in analyzing the data. The first part of this chapter provides some background on how global positioning systems work, and how what they store can become evidence in a case.
42.1. An overview of global positioning systems
While global positioning is best known for its use in navigation, it is also used to pinpoint and record precise locations in land surveying, and the GPS system is also used for time and frequency purposes in telecommunication systems because of its extremely accurate onboard clocks located in the satellites themselves. “GPS satellites have very precise clocks that tell time to within 40 nanoseconds or 40 billionths (0.000000040) of a second.”1
GPS capability shows up in some unexpected places, and there are devices and programs that can perform GPS functionality without being a dedicated GPS unit. Companies use GPS devices to track their trucks and the employees driving them, and GPS units are in many rental cars both for navigation and for recovery of lost and stolen vehicles. The social media website Twitter can track your location, and applications for phones, such as Facebook Places, can send updates to your networking sites with information about where you are at the moment. Using your smart phone, you can also tag other’s locations for posting to Facebook. 2
42.2. An overview of the NAVSTAR Global Positioning System
The Navigation Signal Timing and Ranging Global Positioning System, (NAVSTAR) 3 as it is known in the United States, is jointly operated by the Department of Defense and the United States Air Force.
The system consists of 31 satellites in geosynchronous orbit around the earth. This arrangement ensures that a minimum of 24 satellites are operational at all times, with seven satellites available as spares. The satellites are arranged around the globe in such a way that a minimum of four satellites are always visible from any point on earth. Each of the satellites continuously transmits data toward the earth that can be received and processed by GPS devices.
The purpose of the global positioning system is to provide Position, Navigation, and Timing (PNT) services worldwide.
• Positioning: The ability to accurately determine one’s location and orientation two-dimensionally (latitude and longitude), or three-dimensionally (latitude, longitude, and altitude) as required.
• Navigation: The ability to determine current and desired position to apply corrections to course, orientation, and speed to attain a desired position anywhere in the world.
• Timing: The ability to acquire and maintain accurate and precise time from a standard coordinated universal time, anywhere in the world.
The GPS system consists of three parts or segments that can be broken down into the space segment, the ground segment, and the user segment.
• Space Segment: The space segment is the part of the system that is made up of the GPS satellites that are in geosynchronous orbit around the earth.
• Ground Segment: The ground segment is the part of the system that has the master control station operated by the Air Force, and both ground antennas and monitoring stations. The master control station is where the Air Force manages the satellite system. The ground antennas collect telemetry information from the satellites and also send commands and data up to the satellites for accuracy corrections.
• User Segment: The user segment consists of the devices that actually receive and use the data provided by the GPS satellites to perform navigation, such as handheld, marine, aviation, and automotive units.
Figure 42.1 shows the GPS system and its various segments.
42.3. How GPS works
Each satellite in the system transmits navigation data toward the earth that contains the position of the satellite, a time stamp, and the health of the satellite. When a GPS device can receive signals from at least three satellites at once, the device can calculate its position in two dimensions, latitude and longitude. This process is called triangulation, and is illustrated in Fig. 42.2.
In order for a GPS device to calculate its position vertically for altitude, it must be able to receive signals from at least four satellites at the same time. This process is called trilateration, and it’s illustrated in Fig. 42.3.
42.3.1. How geolocation works using GPS
In order for a GPS device to calculate its position, it needs to know the position of each of the satellites, the time it took for the signal to reach the device, and whether the satellite is healthy. Since the satellite signal travels at a known speed, the data provides enough information for the device to perform the calculations.
The data contained in the satellite signal is used by the GPS device to perform calculations not only for position, but also for direction (orientation) and speed. Bear in mind that direction and speed are derived values based on how the device is programmed to perform the calculations. Since device software is proprietary, the exact method and accuracy of the derived calculations can vary by manufacturer and model.
42.4. Types of GPS evidence
The most basic type of GPS evidence is made up of track points, track logs, waypoints, and routes. This is data that can be saved to the device, depending on its make and model. When a device is on, it will periodically write the current location of the device in a log of track points. When a person is planning a trip or wants to return to a location, they can tell the device to record a waypoint.
42.4.1. Waypoints and routes
When you’re using a GPS unit, the process of inputting an address and selecting it as your travel destination creates what is called a waypoint. With GPS units, it is possible to include multiple waypoints in one trip. For instance, if you were traveling across a state, but wanted to visit a park along the way, and then have lunch further down the road, the GPS unit allows you to include all of these waypoints and save them as a route. This set of waypoints makes up a route, exactly in the same way you might take a paper map and make notes of the places you want to visit along your route to a destination. And in the same way that you might decide not to stop at any of your planned waypoints on a paper map, the presence of a waypoint in the history of a GPS device is not an indication that the waypoint was ever visited.
The presence of a waypoint could show that the user intended to visit the location at some point in the future or that the user intended to return to the waypoint in the future.
In some cases, it may be possible to determine that someone was at a place where a waypoint was recorded, depending on how the waypoint itself was entered into the device. For instance, if a waypoint is set as a favorite using a feature that records the user’s current location, then it could be possible to place them at that location.
For instance, if the user of the device sets a waypoint by selecting their current location, it is possible that the device will set the location along with the date and time the waypoint was set.
On the other hand, manually entering the latitude and longitude for a waypoint may not show a date and time. Whether or not the device has the ability to record waypoints is once again dependent on the device itself.
In automotive GPS units it is very common for someone to set a waypoint for their home, office, and other favorite destinations. While not definitive, this information can also present evidence about a user’s habits, what they may have been searching for, and their recent destinations.
42.4.2. Track points and track logs
A track point is the record of a location that is recorded by the device. A series of track points is saved in a track log. Unlike waypoints, track points are recorded automatically by the device without user interaction, provided that the device supports the recording of track points. In some devices, the user can determine whether or not the device keeps any history of track points.
Also, some devices, such as certain marine units, by default do not record track points unless the function is turned on by the user.
Tracks logs are the most common type of evidence that can be obtained from a GPS device and are normally the most important. This is because the track log can give indication of a timeline as well as the locations visited by the GPS device. Note the distinction of “visited by the GPS device,” since it is not possible to connect a particular person to the device from any evidence contained within the device itself. To do so would require a larger body of evidence linking a particular person to a vehicle or GPS unit, for instance.
If you have a good track log obtained from a GPS device, the locations and the dates and times can be an indication of where the GPS was and how long it remained in that particular location.
42.4.3. Other GPS device evidence
While the most basic GPS units only record waypoints and track points, GPS-enabled cellular phones and connected GPS units can contain a great deal more data that may be of evidentiary value.
A connected GPS unit is one that has a cellular radio built into the unit. Some examples of this are the navigation systems currently available in many vehicles that use the On-Star or Microsoft Sync systems. These units have the ability to make phone calls, receive real-time traffic alerts, search for local shopping deals, find movie times, and other functions. Since many of these units will also allow Bluetooth connections to smart phones, they can contain phone call logs and contact lists. And depending on the phone and unit, they can even receive text messages.
42.5. Collection of evidence from GPS devices
The proper handling of GPS devices is a critical step to prevent the loss of potential evidence that may be present on the device. GPS devices are very similar to cellular phones in certain aspects: GPS devices are radios. Not all GPS devices can be examined using forensic software tools, and allowing data to be added to the device will destroy other data.
For these reasons, GPS devices should be handled with care to prevent any possible communication of the device and any accidental destruction of data through mishandling.
42.5.1. Preservation of GPS data
GPS units are radios that receive data from radio signals transmitted by GPS satellites. This means that in order to properly handle a GPS unit for evidence collection, the unit should be handled in a windowless room and inside a Faraday bag that will block any radio signals from reaching the unit. This is especially important in the case of units that have the Assisted GPS (AGPS) feature. The AGPS system allows the unit to receive information from the cellular phone system to help it more accurately determine its location in areas where a clear view of the sky is a problem.
42.5.2. Challenges to data collection
GPS devices are much like cell phones today. They have a wide variety of connection types, operating systems, and data storage methods and data structures.
This means that getting data from these units for preservation and analysis may require using several different forensic software tools. Forensic software tools that can collect data from cell phones in many cases can also collect data from GPS units. There is also software designed only for collecting data from GPS units. The forensic software available is covered in Chapter 5.
And in the case of in-dash vehicle navigation systems, at least for the present time, there is no simple way to retrieve data from them. In other words, the only method for collecting evidentiary data from some of the units would be the same as the manual examination of a cell phone (see Chapter 37). A video record would need to be made for preservation purposes as the unit was operated from the menu by an examiner. As with any device where a manual examination is performed, without a video recording of the entire examination, it would be difficult, if possible at all, to determine whether or not any data was deleted or created on the device in the process of the examination.
42.5.3. Service-based data collection
In addition to device-based GPS evidence, many companies used a service-based GPS collection process in which a GPS unit is located in a rental car and the data is collected by a service provider, and the location of the unit can be viewed on a map via the Internet. Also, in the case of a third-party provider for the GPS tracking, the user may have the ability to download the GPS records to his or her computer.
In a death penalty case, one of the primary evidence items was the GPS records collected from a computer at a small rental car company for a car that was rented by the defendant. The records had been collected by law enforcement officers from the computer at the rental business in the form of printouts of HTML pages since the original electronic data was not preserved.
Upon review of the GPS records, numerous problems were noted regarding the GPS data contained in the records. There were instances where the GPS location would mysteriously jump from one location to another with no time difference, as if the vehicle had teleported from one spot to another, placing it conveniently in the area that the prosecution needed for the vehicle to be to support the case against the defendant. The defense attorney challenged the authenticity of the records. Since the computer from the rental company was no longer available and the hard drive had never been copied during the initial investigation, there was no way to authenticate the records. The client was allowed to plea to a minor felony and received credit for time served awaiting trial.
42.6. Interpretation of GPS evidence
Proper interpretation of GPS evidence is a critical step to make sure that the evidence is presented as correctly as possible. GPS units are not infallible, and errors in the data and in the interpretation can creep in, in subtle ways.
42.6.1. Data errors
GPS devices are radio receivers just like cell phones. And as such, they are subject to errors in reception due to multipath errors (radio signals bouncing off buildings) and data noise. While most units can and will correct this, the amount of correction is impossible to determine.
Additionally, data in GPS units can be either deliberately or accidentally deleted by persons attempting to retrieve data from the device, and through poor preservation practices.
Finally, data can be saved to a device in the form of a track point that is completely inaccurate due to the unit not having a view of enough satellites.
A good example of how GPS units can become confused is when you are driving in your car and pull into a parking garage. The GPS unit will continue to attempt to assist you with navigation, even though it no longer is receiving adequate signals from satellites. This is because some GPS units will operate by using historical data to “fill in” areas where satellite signal may be temporarily lost. The GPS unit will also attempt to make predictions based on loaded map data.
An illustration of this behavior is found in the parking garage example. You are in the parking garage and you start up your GPS. The GPS unit will alert you that you are not receiving satellite data and ask if you want to calculate your new route based on your last position. You input a new destination and the GPS starts attempting to assist you in navigating. However, you notice that the GPS unit keeps telling you to turn in the wrong direction and at the wrong place. This is because the unit is basically guessing based on its internal compass, the most recent historical data, and the map data in the unit. The longer you spend outside the view of satellites, the more inaccurate this data becomes.
When GPS devices are mounted on vehicles for the purpose of remote collection, that is, via a service that receives the GPS information from the remote units, the possibility of data errors is also present. This is because the remote unit may transmit to the service information that is inaccurate at the time, or the data may be corrupted by signal problems or noise and introducing inaccuracies during transmission.
42.6.2. Map errors
GPS satellites do not have any knowledge of anything on the ground. They do not contain map data or any other information except for what they “know” about themselves and the other satellites in the constellation.
Think of satellites like lighthouses. They are in a fixed location that they send to your GPS receiver. The receiver performs the calculations to determine your position and determines the raw coordinates for your current location.
For most people these raw coordinates don’t mean anything in a human sense. If you wanted to figure out where you were in a way that you could actually use, you could take those raw coordinates and plot them on a map.
Modern GPS units provide that map plotting function for the user. However, what happens when you see a location on a map on the GPS unit and yet you know it isn’t correct? Is the GPS unit wrong or is the map wrong?
And yet it is common in automotive GPS units for exactly this problem to occur. The map display does not match the actual road system due to new construction or traffic configuration changes that have occurred since the last map update.
Another issue in interpreting GPS data is using online maps for plotting purposes. Each of the major mapping services such as Google Maps, Bing Maps, and Yahoo Maps all collect and maintain their data individually.
When you are plotting a GPS coordinate on one of these maps and then look at the map in satellite or earth view, you can see the actual buildings and terrain. However, if you plot exactly the same coordinate using two of the mapping servers, there is a chance that the buildings and terrain will not match.
While Larry was in GPS certification training, one exercise he had to perform was to determine where a coordinate was and what the implications might be of a cluster of GPS track points. By viewing the coordinates in both Google Maps and Bing Maps, an interesting anomaly presented itself. In Google Maps the location showed a parking garage. However, in Bing Maps the location showed an empty lot where the parking garage should be. The Google map in Fig. 42.4 shows the presence of the parking garage. The Bing map in Fig. 42.5 shows an empty lot.
 |
| Figure 42.5 |
This underscores the importance of making sure that the map data being used is accurate for the date and time of any GPS track points that are being analyzed and presented as evidence in a case.
Summary
In this chapter we learned about the global positioning system operated by the United States, and what makes up the global positioning system. We also looked at how GPS devices work in the system to provide geolocation information and navigation. Also discussed were the types of evidence that a GPS device can have, what impacts the accuracy of that data, and also some of the issues with interpreting GPS data. The importance of correct map data was illustrated using map images from the same location on the same date from two sources that differed significantly.
References
[1]
[2]
[3]
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.