AustLII Home | Databases | WorldLII | Search | Feedback

Australian Federal Police - Platypus Journal/Magazine

You are here:  AustLII >> Databases >> Australian Federal Police - Platypus Journal/Magazine >> 1998 >> [1998] AUFPPlatypus 4

Database Search | Name Search | Recent Articles | Noteup | LawCite | Author Info | Download | Help

FBI Law Enforcement Bulletin --- "Mobile phone crime brings new challenges in emerging trends for law enforcement" [1998] AUFPPlatypus 4; (1998) 58 Platypus: Journal of the Australian Federal Police, Article 4


Mobile phone crime brings new challenges in emerging trends for law enforcement

A dramatic increase in the theft of mobile phones has become an emerging trend in the eastern and southern states of Australia according to AFP National Operations Intelligence Officer Bill Deane. Mr Deane said reports had shown that NSW, Victoria and South Australia had averaged a 300 per cent increase in theft offences in 1995-96 compared to the previous year.

An Australasian Crime Conference and Seminar in Perth last year was told that many offences could be regarded as opportunity crimes, in that mobile telephones are stolen and used by the thief until disconnection from the networks occurs, however, overseas experiences indicated that the mobile telecommunications industry is open to wide scale organised criminal activity.

There are about three million mobile phones connected in Australia, and it has been estimated that there will be eight million subscribers by the time of the Olympics.

Criminality particular to analogue mobile phones, such as ease of cloning, should not be an issue by the year 2000 when the current analogue system in Australia is expected to have been removed from service with the digital Global Systems for Mobile (GSM) operated by Telstra, Optus and Vodaphone the major public mobile systems in service, Mr Deane said.

Cloning is the electronic harvesting of Electronic Serial Numbers (ESN) emitted from analogue telephones during transmissions. The ESN is replicated on an illegitimate telephone enabling the user to make telephone calls which are then billed to the original ESN subscriber. It is particularly prevalent in the USA where five analogue networks operate.

Although electronic equipment is available in Australia to harvest ESNs, the current single network and phasing out of the analogue network is not conducive to widespread offences.

The main illegality affecting industry revenue in Australia at present was subscription-based fraud, which occurs when a new customer uses a false identity to obtain a mobile service, Mr Deane said.

A significant number of such frauds was committed by transients, especially the student element, and these might increase during the Olympic period. Not knowing a customer's true identity, coupled with the difficulty of accurately locating a GSM mobile, could be useful to a criminal activity.

The following article from the FBI's Law Enforcement Bulletin, April 1997, illustrates how a successful sting operation combined the investigative expertise of law enforcement with the technical and financial assistance of the private sector to catch cellular phone thieves.

Operation Cellmate

By P. R. Beseler, M.S. chief investigator for the State Attorney's Office, Jacksonville, Florida

On the way home from work, a woman dashes into a convenience store to pick up a gallon of milk. In her haste, she leaves her portable cellular phone on the front seat of her unlocked car. When she returns, the phone is gone. Across town, another cellular phone owner opens his mail and discovers, to his dismay, that his monthly phone bill includes over $800 in calls he never made. Both of these people have become victims of cellular phone fraud.

With the proliferation of portable cellular phones, many criminals have added a new tool to their belts. Stolen and cloned phones are quickly becoming popular tools for criminals not only to obtain free phone service but also to conduct illegal activities using equipment that thwarts law enforcement's traditional wire-tapping techniques.

In an effort to combat this new crime wave, the state attorney's office in Jacksonville, Florida, pioneered a sting operation in which law enforcement officers posed as phone cloners who would, for a fee, reprogram stolen or inoperative cellular phones with numbers purportedly stolen from real cellular phone customers. Within weeks, nearly 100 people took advantage of this offer and were arrested and charged with felonies.

Every cellular phone has an electronic serial number (ESN). When customers buy phone service, they receive an additional number, known as a mobile identification number (MIN). Together, these numbers make each cellular phone unique; in essence, they serve as the phone's fingerprint. Unfortunately, these numbers are vulnerable to thieves. Anytime the phone is turned on, whether the owner is using it or not, a criminal can use an ESN reader to snatch the ESN-MIN combination literally right out of the air. A second machine allows the thief to key the stolen numbers into another phone, which also may be stolen. Using this ‘cloned' phone, the thief obtains free cellular service, while the unsuspecting victim is stuck with the bill.

In the first five months of 1996, thieves in Jacksonville stole over 300 hand-held cellular phones and cloned even more. Members of the law enforcement community knew they had a problem on their hands, but their favoured means of fighting these types of crimes — undercover operations — seemed just out of reach. Indeed, the cost to run a successful venture of this magnitude, which would include cellular phone equipment and air time, could prove prohibitive. .

Fortunately, a cellular provider in the Jacksonville area offered free equipment and air time for use during this operation. With the financing obstacle removed, Operation Cellmate moved forward rapidly.

Calling all crooks

Investigators from the state attorney's office joined forces with agents from the US Secret Service, whose jurisdiction includes cellular phone fraud, and the Naval Criminal Investigative Service, because of the large naval presence in Jacksonville. Together, they secured a storefront location, renovated the building, and set up a waiting area in the front lobby. A back room was used for cloning, and another room was used for monitoring transactions via hidden microphones and video cameras.

Investigators received training on how to operate the telephone programming equipment and practiced cloning different telephone makes and models. The phone company provided a list of ESN-MIN combinations for investigators to program into customers' phones. With the addition of the logo painted on the front window, Cellmate Communications, Inc., was open and ready for business.

To keep honest citizens from mistaking the new company for a legitimate phone service provider, investigators operated strictly on a referral basis. They gave business cards to informants, who spread the word among drug dealers, prostitutes, burglars, and others engaged in criminal activities. Within days, the first customers began calling to inquire about Cellmate's services.

From the start, investigators told potential customers that the services they were paying for were illegal. By recording these initial phone conversations, investigators showed the suspects' predisposition to commit crimes and prevented them from successfully using entrapment defences later in court. Finally, customers received directions to the undercover location, where investigators eagerly awaited their arrival.

Investigators were alerted to the arrival of customers by video cameras aimed at the parking lot. As customers entered the store, officers in the monitoring room would start videotaping. Investigators who greeted the customers quickly realised that many were looking for a secure means of communication to conduct lucrative drug and prostitution transactions and were willing to pay for it. Undercover officers sold these customers preprogrammed phones, making it clear that both the phones and the numbers were stolen. Later, in addition to charges related to purchasing cloned phones, these suspects would face charges for their drug-and-prostitution-related crimes, with prosecution made easy thanks to the detailed billing records generated by their phones.

An equal number of customers brought in phones for reprogramming. When investigators asked about the origin of the phones, almost all of the suspects provided accurate details. They represented stolen phones as just that, and others candidly admitted that the phone company had turned off their legally acquired phones due to delinquent payments.

To reprogram a phone, investigators would turn it on near the ESN reader, which would capture and print the ESN-MIN combination. In addition to providing evidence of the phone's original code, this printout gave investigators in the back room a way to verify the identity of the phone's owner.

After calling the cellular phone company to obtain this information, investigators would persuade customers to trade stolen phones for one of Cellmate's phones. If a customer refused or if the phone merely had been turned off for non-payment, investigators would use the cloning equipment to enter a new number. After making a test call to show the customer that the phone worked, investigators collected the fee.

Fees ranged from $75 to $250 for preprogrammed phones, depending on the model. For reprogrammed phones, $50 guaranteed that the new number would work for at least two weeks. Investigators promised to reprogram for free any phones cut off by the legal owner during that time. This gave investigators an opportunity to reiterate the illegality of the suspects' actions. It also set the stage for investigators to cancel the numbers, requiring suspects to return to the shop for new ones. This way, officers could find suspects more readily at arrest time.

Tracking the clones

Suspect identification proved difficult with walk-in customers, who usually introduced themselves only by their street names. When possible, surveillance units would obtain tag numbers from the suspects' cars. But the most reliable identification method proved to be pretext traffic stops performed by uniformed officers who completed field interrogation cards on the vehicles' occupants.

Officers made the pretext stops several miles from the store, and no-one ever became suspicious. In fact, some even called afterward to brag about how they had cleverly avoided detection or arrest despite having just conducted an illegal transaction.

Suspects who provided driver's licences made identification easy. For others, investigators had to identify the suspects by searching arrest records and other archives in order to retrieve photographs and match the faces with the names. In many cases, police reports filed by victims of cellular phone fraud confirmed the suspects' criminal acts.

Early in the investigation, it became apparent that some of the individuals who came to buy cloned phones were involved in a host of other criminal activities. Investigators were offered a variety of different drugs, including ‘Roofies' (Rophynol, the ‘date rape drug'), stolen property, weapons, and even illegal cable television descrambling devices in exchange for phone service.

So many suspects came to the shop armed that undercover officers always worked in pairs for protection. One undercover officer, who spoke with a fake Eastern European accent, used the customs of his adopted persona to hug a customer and perform a quick pat-down for weapons.

Bringing in the thieves

In 36 working days, investigators conducted 172 separate transactions with 98 different suspects. After reviewing the cases, the state attorney's office issued arrest warrants for 92 of them. In order to arrest as many suspects as possible before word spread to others, investigators arranged for the phone company to disconnect service to all of the phones at 3pm on the day before the scheduled arrests. Naturally, the suspects began calling Cellmate Communications to report that their phone service had been interrupted. Investigators told them to come in the next morning to have their phones reprogrammed for free.

Most were happy to comply. In fact, over 30 suspects were arrested within the first two hours of business as they entered the store, phones in hand. By the end of the first day, 72 suspects were in custody.

One customer showed up the following day to have his phone turned on as investigators, wearing sidearms, were loading furniture and emptying out the storefront. It seems that despite being on television and the front page of the newspaper, the sting had gone unnoticed by some of Cellmate's customers.

In an ironic twist of fate, a flashlight belonging to one of the Secret Service agents working the sting was recovered from one of the suspect's cars at the time of his arrest. The flashlight, with the agent's name engraved into the metal from his days as a uniformed police officer, had been stolen months before.

Finally, agents from the Naval Criminal Investigative Service also harvested the fruits of their labor. The operation uncovered sailors who had used cloned phones to make bomb threats in order to get a day off from work.

Prosecuting the offenders

During the prosecution of the cases, every plea agreement required that the defendant make full restitution to the phone company and the state attorney's office. Detailed records, including usage bills for each phone and case logs for each suspect, made the process easier.

Suspects with no arrest history were given the opportunity to enter pretrial intervention programs after signing deferred prosecution agreements. These agreements stipulated that if the defendants made restitution, completed community service, and did not re-offend for one year, the charges would be purged from their permanent records.

Interestingly, only six of the 92 suspects had no prior records. Most of the suspects had extensive criminal backgrounds, some qualifying for enhanced federal penalties for possessing a firearm after three violent felony convictions. For these offenders, jail will be the only cell they will see for a long time.

Deterring would-be thieves

The success of any sting operation often is measured by the number of potential offenders deterred from committing similar crimes because of the perceived chance for arrest. Operation Cellmate offered a prime opportunity to deter those individuals who may not have considered phone cloning a ‘real' crime. People who might have considered buying a cloned phone likely changed their minds after watching the evening news and seeing dozens of suspects chained together and loaded onto jail buses.

To further enhance the deterrent effect and maximise media coverage, investigators asked a national news organisation to accompany them during the sting. The team then highlighted the operation on its weekly news magazine show, bringing a flood of interest from law enforcement administrators, telecommunications industry officials, and civilians.

Conclusion

In less than two months, Cellmate Communications customers had used over $165,000 in ‘stolen' air time. These numbers illustrate the billion-dollar problem this crime represents nationally. Yet, excluding salaries and equipment, the cost of the investigation to taxpayers was under $3,000, with most of this money paying for building renovations and utilities.

Operation Cellmate focused attention on a new problem facing law enforcement and highlighted the connection between cellular technology and different types of criminal activity. Most important, it proved that law enforcement, working with the private sector, can use new technology and traditional sting techniques to snare criminal opportunists. Indeed, using similar methods, law enforcement agencies in other jurisdictions can give cellular phone thieves a much-needed wake-up call.

Courtesy FBI Law Enforcement Bulletin, April 1997


AustLII: Copyright Policy | Disclaimers | Privacy Policy | Feedback
URL: http://www.austlii.edu.au/au/journals/AUFPPlatypus/1998/4.html