Abstract:
The present invention relates to methods and arrangements to establish an identity of a target T. The method comprises the following steps:—Collecting geographical location points A, B, C, D indicating presence of the target.—Interrogating at least one mobile network to fetch lists of identities of users located in defined areas C1-C3, each area covering a collected geographical location point.—Crosschecking between the fetched lists.—Identifying a single identity that is common to the fetched lists.

Description:
TECHNICAL FIELD 
       [0001]    The present invention relates to methods and arrangements for establishing an identity of a target. 
       BACKGROUND 
       [0002]    Lawful Interception and Data Retention of communications can be made based on knowledge of the identity of a party responsible for transmitting or receiving the communication. For example if a mobile telephone number of a criminal suspect is known, it is possible to intercept or retain electronic communication sent from or received by the criminal suspect&#39;s mobile telephone. In governments around the world, various law enforcement agencies may have the right to authorize this interception/retention in their respective jurisdictions. 
         [0003]      FIG. 1A  is part of the prior art and discloses an Intercept Mediation and Delivery Unit IMDU, also called Intercept Unit. The IMDU is a solution for monitoring of Interception Related Information IRI and Content of Communication CC for the same target. The different parts used for interception are disclosed in current Lawful Interception standards (see 3GPP TS 33.108 and 3GPP TS 33.107-Release 7). A Law Enforcement Monitoring Facility LEMF is connected to three Mediation Functions MF, MF 2  and MF 3  respectively for ADMF, DF 2 , DF 3  i.e. an Administration Function ADMF and two Delivery Functions DF 2  and DF 3 . The Administration Function and the Delivery Functions are each one connected to the LEMF via standardized handover interfaces HI 1 -HI 3 , and connected via interfaces X 1 -X 3  to an Intercepting Control Element ICE in a telecommunication system. Together with the delivery functions, the ADMF is used to hide from ICEs that there might be multiple activations by different Law Enforcement Agencies. Messages REQ sent from LEMF to ADMF via HI 1  and from the ADMF to the network via the X 1 _ 1  interface comprise identities of a target that is to be monitored. The Delivery Function DF 2  receives Intercept Related Information IRI from the network via the X 2  interface. DF 2  is used to distribute the IRI to relevant Law Enforcement Agencies LEAs via the HI 2  interface. The Delivery Function DF 3  receives Content of Communication CC, i.e. speech and data, on X 3  from the ICE. Requests are also sent from the ADMF to the Mediation 
         [0004]    Function MF 2  in the DF 2  on an interface X 1 _ 2  and to the Mediation Function MF 3  in the DF 3  on an interface X 1 _ 3 . The requests sent on X 1 _ 3  are used for activation of Content of Communication, and to specify detailed handling options for intercepted CC. In Circuit Switching, DF 3  is responsible for call control signaling and bearer transport for an intercepted product. Intercept Related Information IRI, received by DF 2  is triggered by Events that in Circuit Switching domain are either call related or non-call related. In Packet Switching domain the events are session related or session unrelated. In Packet Switching domain the events are session related or session unrelated. 
         [0005]    While Lawful Interception is a real-time exercise, data from the past is used when Data Retention is practiced.  FIG. 1B  belongs to the prior art and shows the Handover Interfaces between a Data Retention System DRS (see ETSI DTS/LI-00033 V0.8.1 and ETSI DTS/LI-0039) at a Communication Service Provider CSP, and a Requesting Authority RA. The figure shows an Administration Function AdmF used to handle and forward requests from/to the RA. A Mediation and Delivery function MF/DF is used to mediate and deliver requested information. Storage is used to collect and retain all possible data from external the data bases. The generic Handover Interface adopts a two port structure such that administrative request/response information and Retained Data Information are logically separated. The Handover Interface port  1  HIA transports various kinds of administrative, request and response information from/to the Requesting Authority and the organization at the CSP which is responsible for Retained Data matters. The HIA interface may be crossing borders between countries. This possibility is subject to corresponding national law and/or international agreements. The Handover Interface port  2  HIB transports the retained data information from the CSP, to the Requesting Authority. The individual retained data parameters have to be sent to the Requesting Authority at least once of available). The HIB interface may be crossing borders between countries. This possibility is subject to corresponding national law and/or international agreements. 
         [0006]    Lawful Interception and Data Retention needs specific target information to be activated on a suspect. Law Enforcement Authorities receive the mandate to intercept a certain person usually from a judge. Their first task is to discover the target identities that they can use to activate LI. If the user has a subscription with a telecom operator it is rather straightforward to ask the operator for this information and then activate the interception on the discovered identities. Valid for both Lawful Interception and Data Retention is that in most cases criminals try to keep their “identities” secret by for example using prepaid anonymous subscriptions to mobile networks, possibly buying the SIM cards abroad in countries where it is not mandatory to disclose own identity to buy a prepaid SIM or by using SIMS registered to someone else. The problem at hand is thus how to discover efficiently the target identities of a well known person subject of lawful interception and or data retention due to a judicial warrant. 
       SUMMARY 
       [0007]    The present invention relates to a problem how to identify target identities of a target that is subject of lawful monitoring due to a judicial warrant, which target identities are necessary to perform Lawful Interception and/or Data Retention. 
         [0008]    This problem and others are solved by the invention by mechanisms that collect trails left behind by the target and that make a crosscheck between the trails until a single specific target identity in a mobile network is identified. 
         [0009]    More in detail, by tracing a number of geographical locations where the target has been present and collecting from a mobile network all mobile subscribers known to the network to be present in each location, a single subscriber can be identified as the only one present in all locations at collection time. The method comprises the following steps:
       Geographical location points indicating presence of the target are collected.   At least one mobile network is interrogated and lists of identities of users located in defined areas, each area covering at least one of the collected geographical location points, are fetched.   A crosscheck between the fetched lists is performed.   A single identity that is common to the fetched lists is identified.       
 
         [0014]    In one aspect of the invention a Lawful Interception embodiment is disclosed. Real time data is collected from geographical location points and lists of identities are fetched from mobile networks. 
         [0015]    In another aspect of the invention a Data Retention embodiment is disclosed. Data collected from geographical location points and lists of identities fetched from mobile networks are stored for later usage. 
         [0016]    An object of the invention is to enhance the Lawful Interception and Data Retention solution in order to ensure efficiently discovering of target identities of a well known target that is subject of lawful monitoring due to a judicial warrant. This object and others are achieved by methods, arrangements, nodes, systems and articles of manufacture. 
         [0017]    An advantage with the invention is that an agency will be able to identify for example a phone number or mobile identity of a suspect in an automatic way when other specific information of the individual is known. In these way commonly used techniques, such as using for example anonymous prepaid foreign subscriptions to elude monitoring can be neutralized. 
         [0018]    The invention will now be described more in detail with the aid of preferred embodiments in connection with the enclosed drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]      FIG. 1A  is part of the prior art and discloses a block schematic illustration of an Intercept Mediation and Delivery Unit attached to an Intercepting Control Element. 
           [0020]      FIG. 1B  is part of the prior art and discloses a block schematic illustration of a Data Retention System attached to a Requesting Authority. 
           [0021]      FIG. 2  is a block schematic illustration disclosing a target which at different times is present in different locations within the operator networks. A Lawful Interception Unknown Terminal LIUT is attached to the operator networks. 
           [0022]      FIG. 3  discloses a signal sequence diagram representing collecting and handling of various data in a Lawful interception environment. 
           [0023]      FIG. 4  is a block schematic illustration disclosing collection of data into a storage which data later is handled in a data retention environment. 
           [0024]      FIG. 5  discloses a signal sequence diagram representing collecting and handling of various data in a data retention environment. 
       
    
    
     DETAILED DESCRIPTION 
       [0025]      FIG. 2  discloses a telecommunication system. The system comprises in this example two Operator Networks ON 1  and ON 2 . A target T, i.e. a subject under interception, can be seen in  FIG. 2 . The target is present in four different places in this example. In the figure three different access entities A, B and C can be seen within the first operator Network ON 1 . The first access entity A is an ATM System, the second entity B is a Credit Card System and the third entity C is a highway automatic toll payment system. The first Operator Network ON 1  comprises two cell areas C 1  and C 2 . The first access entity A is located within the first cell area C 1  and the second and third entities B and C are located within the second cell area C 2 . A Mobile Switching Centre MSC 1  controls the cell areas C 1  and C 2 . A Lawful Interception Unknown Terminal LIUT is disclosed in  FIG. 2 . LIUT has similar functionalities as the IMDU discussed in the BACKGROUND ART section of this application. The LIUT will be further explained below together with the first embodiment. The second operator network ON 2  comprises a GPS mikrospy client D. The microspy client is a device attached at the target&#39;s car. The microspy client periodically reports the car&#39;s location to the LIUT. The second Operator Network ON 2  comprises a cell area C 3 . The mikrospy client D is in the first embodiment located within the cell area C 3 . A Mobile Switching Centre MSC 2  controls the cell area C 3 . The MSC 1 , MSC 2 , A, B, C and D are all able to communicate with the LIUT as can be seen in  FIG. 2 . 
         [0026]    A method according to the first embodiment of the invention will now be explained together with  FIG. 3 . Signalling points A, C, D, LIUT, MSC 1  and MSC 2  have all been shown and briefly explained earlier in  FIG. 2 . The Lawful Interception Unknown Terminal LIUT is shown more in detail in  FIG. 3 . As mentioned, the LIUT has similar functionalities as the IMDU discussed in the BACKGROUND ART section of this application and the reference signs mentioned in the text below refer to the already explained  FIG. 1A . In the LIUT, a Law Enforcement Monitoring Facility LEMF is connected to two Mediation Functions MF and MF 2  respectively for ADMF and DF 2 . The Administration Function is connected to the LEMF via standardized handover interfaces HT 1  and DF 2  is connected to LEMF via HI 2 . The ADMF and DF 2  are connected via interfaces X 1  and X 2  respectively to Intercepting Control Elements that in  FIG. 3  are represented by A, B, C, MSC 1  and MSC 2 . Messages are sent from LEMF to ADMF via the Nil interface and from the ADMF to A, B, C, MSC 1  or MSC 2  via the X 1 _ 1  interface. The Delivery Function DF 2  receives Intercept Related Information IRI from A, B, C, MSC 1  and MSC 2  via the X 2  interface. The LIUT comprises a data base DB wherein collected IRI data received to DF 2  is stored. It is to be noted that DB as well can be located outside the LIUT. A prerequisite for the invention is that a subscriber is subject of lawful monitoring due to a judicial warrant. In this example a prerequisite is also that a requesting agency in control of the LEMF, has obtained information about the subscriber&#39;s bank account number and highway pay number. A further prerequisite in this example is also that the mikrospy client D has been attached to the subscriber&#39;s car. Of course, the above mentioned prerequisites are valid only in this particular example. The method according to the first embodiment comprises the following steps:
       The agency sends out  1 , via the ADMF, object marking signals to selected ATM system entities where the target is expected to be present. In  FIG. 3  only one object marking signal is shown. The object marking signal is sent  1  from ADMF to the first access entity A.   The agency sends out  4  object marking signals to selected highway automatic toll payment systems where the target is expected to be present. In  FIG. 3  only one object marking signal is shown. The object marking signal is sent  4  from ADMF to the third access entity C.   The target T makes cash withdrawal from the ATM system A.   A report location signal comprising the subscriber&#39;s bank account number, geographical location and a time stamp showing the time that the cash withdrawal was made is sent  2  from the first access entity A to the DF 2 .   The report location signal is forwarded from DF 2  to the LEMF via the interface H 12 . This step is not disclosed in  FIG. 3 .   The target T transports himself to another location by using his car and makes a payment using the highway automatic toll payment systems i.e. the third access entity C.   A report location signal comprising the subscriber&#39;s highway pay account number, geographical location and a time stamp showing the time that the payment was made is sent  5  from the third access entity C to the DF 2 .   The report location signal is forwarded from DF 2  to the LEMF via the interface H 12 . This step is not disclosed in  FIG. 3 .   All time when the target T moves by using his car, the microspy client attached at the target&#39;s car periodically reports the car&#39;s location to the LIUT. In this exemplified embodiment a report location signal comprising a geographical location and a time stamp is sent  7  from the GPS mikrospy client D to the DF 2  when the target is located within cell area C 3 .   The report location signal is forwarded from DF 2  to the LEMF via the interface HI 2 . This step is not disclosed in  FIG. 3 .       
 
         [0037]    The LIUT triggered by the received report location signals now starts to interrogate the mobile networks ON 1  and ON 2  to fetch lists of subscribers (i.e. identities IMSI, MSISDN and IMEI) in the cells covering the reported locations. The LIUT server hereby need to have available the cell planning data from the different mobile networks, so that when having a geographical coordinate the LIUT understands which cells in the different mobile networks cover that area. Moreover the LIUT may reduce the number of interrogated MSCs if it knows which MSC serves which Cell thus focusing only on the MSC serving that specific identified cell. The method hereby comprises the following further steps:
       The agency sends out  8  a CollectUsers signal to the Mobile Switching Centre that controls the cell areas C 1  and C 2  where the first access entity A and the third access entity C is located. The agency hereby requests information of all subscribers located in C 1  during a time falling together with the time stamp received from the first access entity A. The agency also requests information of all subscribers located in C 2  during a time falling together with the time stamp received from the third access entity C. The CollectUsers signal is sent  8  from ADMF to the MSC 1 .   A ReportUsers signal is sent  9  from the MSC 1  to the DF 2 . The ReportUsers signal comprises a so called A-list with all subscribers present in C 1  at the time specified by the first access entity A. The ReportUsers signal also comprises a so called C-list with all subscribers present in C 2  at the time specified by the third access entity C. Lists are in  FIG. 3  disclosed by listsymbols A and C.   The A-list and the C-list are forwarded  10  from DF 2  to the data base DB.   The agency sends out  11  a CollectUsers signal to the Mobile Switching Centre that controls the cell areas C 3  where the GPS mikrospy client D is located. The agency hereby requests information of all subscribers located in C 3  during a time falling together with the time stamp received from the GPS mikrospy client D. The CollectUsers signal is sent  11  from ADMF to the MSC 2 .   A ReportUsers signal is sent  12  from the MSC 2  to the DF 2 . The ReportUsers signal comprises a so called D-list with all subscribers present in C 3  at the time earlier specified by the GPS mikrospy client D.   The D-list is forwarded  13  from DF 2  to the data base DB.       
 
         [0044]    The agency, via the LEMF now starts to perform a crosschecking between the three lists A-list, C-list and D-list stored in the database. In this example the LEMF finds one single identity common to the three lists and consequently the found single identity belong to target T. 
         [0045]    As a variation to the example described above where electronic trails were sent in from the entities A, C or from the GPS mikrospy client D, instead a shadowing agent could have reported the targets presence with a geographical location together with a time stamp representing the time of collecting the presence information. 
         [0046]      FIG. 4  discloses in a second embodiment a Data Retention configuration.  FIG. 4  shows the Handover Interfaces between a Data Retention System DRS at a Communication Service Provider CSP, and a Requesting Authority RA. This configuration including the AdmF, MF/DF, STORAGE, HIA, HIB and RA has been explained earlier in the background part of this application. The earlier explained entities A, B and C as well as the Mobile Switching Centre MSC 1  are in this embodiment acting as data retention sources. The transportation of data from the data retention sources A-C and MSC 1  to the MF/DF is schematically shown with a filled arrow in  FIG. 4 . Data records are transferred to the mediation function in the Data Retention System, and data fulfilling configured filtering criteria are mediated from MF/DF to the Storage. Updating of the Storage depends on the policy regulating the notifications with the user, session or operator related data, from the data retention sources towards the storage. Accordingly, the transportation of the data from the sources to the storage via the MF/DF is handled by an automatic data retention system. The automatic data retention system is part of the prior art and the transportation of data is a pre-requisite for this invention. In this example the following data transportations have been made:
       Data comprising customer&#39;s bank account number, geographical location and a time stamp showing the time that cash withdrawals were made has been sent from the first access entity A to the STORAGE.   Data comprising customer&#39;s credit card number, geographical location and a time stamp showing the time credits were used has been sent from the first access entity B to the STORAGE.   Data comprising customer&#39;s highway pay account number, geographical location and a time stamp showing the time that payments were made has been sent from the third access entity C to the STORAGE.   Data is sent from the MSC 1  to the STORAGE. The Data comprises information of all subscribers present in C 1  at various times. The Data also comprises information of all subscribers present in C 2  at various times.       
 
         [0051]    The second embodiment of the invention will now be explained together with  FIG. 5 . The method in the second embodiment comprises according to the invention the following steps:
       A monitoring request regarding access activities related to the use of the target&#39;s bank account number, credit card number and/or highway pay account number is determined by the requesting Authority RA and sent  21  to the AdmF via the interface HIA.   The AdmF informs  22  the Mediation and Delivery function MF/DF of the request.   The requested data regarding bank account number, credit card number and highway pay account number together with time stamps indicating the targets time of usage of bank account, credit card and highway pay account are found  23  and fetched  24  by the Mediation and Delivery function MF/DF from the Storage.   The found data is sent  25  as Message Data Records from the MF/DF on the interface HIB, to the RA.   The Requesting Agency analyses  26  received data from the data base DB. A monitoring request regarding information of all users located in C 1  and C 2  during a time falling together with the time stamps received from the data base DB is prepared by the Requesting Agency.   The agency RA sends out  27  the monitoring request to the AdmF via the interface HIA.   The AdmF informs  28  the Mediation and Delivery function MF/DF of the request.   The requested data regarding information of all users located in C 1  and C 2  during times falling together with the three time stamps received from the data base DB are found  29  and fetched  30  by the Mediation and Delivery function MF/DF from the Storage. Three different lists, a so called A-list, B-list and C-list are hereby forwarded from the data base to the Requesting Agency. The A-list comprises identities of subscribers located with cell C 1  at the time the target made a bank account transaction. The B-list comprises identities of subscribers located with cell C 2  at the time the target made a credit card transaction. The C-list comprises identities of subscribers located with cell C 2  at the time the target made highway payment.   The lists are sent  31  as Message Data Records from the MF/DF on the interface HIB, to the RA.   The Requesting Agency may now start to perform a crosschecking between the three lists A-list, B-list and C-list. In this example the RA find one single identity common to the three list and consequently the found single identity must belong to target. By using the above method, the Requesting Authority has been able to connect the target that previously only was known by e.g. name, with the identity (for example IMSI, MSISDN and or IMEI) he is using at the moment. When aware of the target&#39;s identity, Lawful Interception and Data Retention can be performed.       
 
         [0062]    The reciprocal signaling between the above different Data Retention entities is to be seen just as example. For example can the STORAGE be an integrated part of the MF/DF. In this example the criteria are sent from the RA but may also be communicated by an intermediary, such as a human operator who receives the command from an authorized source, and then inputs the criteria to the DRS. 
         [0063]    A system that can be used to put the invention into practice is schematically shown in the  FIGS. 1-5 . Enumerated items are shown in the figure as individual elements. In actual implementations of the invention, however, they may be inseparable components of other electronic devices such as a digital computer. Thus, actions described above may be implemented in software that may be embodied in an article of manufacture that includes a program storage medium. The program storage medium includes data signal embodied in one or more of a carrier wave, a computer disk (magnetic, or optical (e.g., CD or DVD, or both), non-volatile memory, tape, a system memory, and a computer hard drive. 
         [0064]    The systems and methods of the present invention may be implemented for example on any of the Third Generation Partnership Project (3GPP), European Telecommunications Standards Institute (ETSI), American National Standards Institute (ANSI) or other standard telecommunication network architecture. Other examples are the Institute of Electrical and Electronics Engineers (IEEE) or The Internet Engineering Task Force (IETF). 
         [0065]    The description, for purposes of explanation and not limitation, sets forth specific details, such as particular components, electronic circuitry, techniques, etc., in order to provide an understanding of the present invention. But it will be apparent to one skilled in the art that the present invention may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known methods, devices, and techniques, etc., are omitted so as not to obscure the description with unnecessary detail. Individual function blocks are shown in one or more figures. Those skilled in the art will appreciate that functions may be implemented using discrete components or multi-function hardware. Processing functions may be implemented using a programmed microprocessor or general-purpose computer. The invention is not limited to the above described and in the drawings shown embodiments but can be modified within the scope of the enclosed claims.