hemisphere project (slide presentation)

7/30/2019 Hemisphere Project (Slide Presentation)

1/27

Los Angeles HemisphereLAW ENFORCEMENT SENSITIVE


2/27

Hemisphere Summary

The Hemisphere Project is coordinated from the Los AngelesClearinghouse and is funded by ONDCP and DEA.

Hemisphere provides electronic call detail records (CDRs) inresponse to federal, state, and local administrative/grand

jury subpoenas.

The Hemisphere database contains CDRs for any telephonecarrier that uses an AT&T switch to process a telephone call.

Hemisphere is an unclassified program.

Hemisphere provides de-confliction within the Hemispheredatabase.

4 billion CDRs populate the Hemisphere database on a dailybasis.


3/27

Hemisphere results can be returned via email within an hourof the subpoenaed request and include CDRs that are lessthan one hour old at the time of the search

The Hemisphere program has access to long distance andinternational CDRs data going back to 1987

Hemisphere data contains roaming information that canidentify the city and state at the time of the call

Results are returned in several formats that aid the analyst/investigator (I2, Penlink, GeoTime, Target Dialed Frequencyreport, Common Calls report, etc)

Hemisphere Summary


4/27

Facts and Figures

Since its inception in September 2007, the Los AngelesHemisphere Program has processed over 4,400 requests andover 11,200 individual telephone numbers

As of June 2013 Hemisphere has processed 679 requests fromthe Northwest HIDTA Hemisphere is most often used by DEA and DHS in the

Northwest HIDTA to identify replacement/additional phones

The Northwest HIDTA has recently utilized Hemisphere totrack known Canadian phones roaming in the U.S. on theAT&T network


5/27

Unique Project Features

Dropped Phones - the program uses an algorithmand advanced search features to find the new number.

Additional Phones the program can oftendetermine cell phones the target is using that areunknown to law enforcement.

International Phones the program providesCDRs for a tremendous amount of internationalnumbers that place calls through or roam on the AT&T

network. The information is provided in response tothe standard Hemisphere administrative subpoena.


6/27

Advanced Results

Analysis

Searching For Dropped Phones

Dropped Phone Requests: A service provided byHemisphere, requestors can ask for analysts to find

possible replacement phones that are no longer activeTo do this, you must mention Dropped Phone Request

in the special instructions on your request form

A dropped phone report will be returned in paragraphform and either written out in the returned email orattached with the results as a word file


7/27

Advanced Results

Analysis

Searching For Dropped Phones

The method for identifying the replacement phone forthe dropped phone involves careful analysis of thedeveloped advanced results

By systematically grading the common calls report andscrutinizing the date ranges, candidates for thereplacement phone are ranked by probability


8/27

Protecting The Program

Protecting the Hemisphere program is a formidable challenge.

We have taken the following steps to try and keep the program

under the radar.

" Training All Hemisphere training modules are inundatedwith instruction regarding how to protect Hemisphere data." Use - Hemisphere requests are vetted. Requestors must have

either attended Hemisphere training or be directly connected toa HIDTA Initiative/Agency or intelligence center familiar withthe program.


9/27


Hemisphere data will likely produce a variety of different

leads for an array of cases.

Hemisphere data will only indicate calls that hit an AT&T

switch

Therefore, the only way to get a complete and accurate

picture of the targets phone activity is to subpoena and

review a complete set of the carriers CDRs.


10/27


When a complete set of CDRs are subpoenaed from the

carrier, then all memorialized references to relevant and

pertinent calls can be attributed to the carriers records,thus walling off the information obtained from

Hemisphere. In other words, Hemisphere can easily be

protected if it is used as a pointer system to uncover

relevant numbers.


11/27

Protecting The ProgramIn special cases, we realize that it might not be possible to

obtain subpoenaed phone records that will wall off

Hemisphere.

In these special circumstances, the Hemisphere analyst

should be contacted immediately. The analyst will work

with the investigator and request a separate subpoena to

AT&T.

-ExigentCircumstances-


12/27


All requestors are instructed to never refer to Hemisphere

in any official document. If there is no alternative to

referencing a Hemisphere request, then the results should be

referenced as information obtained from an AT&T subpoena.

-Official Reporting-


13/27

Whats new with Hemisphere?

First court order from Washington submitted in Dec2012AT&T legal approved use of Court orders from Washington stateAllows Local agencies to utilize Hemisphere through court orders

Hemisphere began providing subscriberinformation in July 2012 for AT&T phones

Began IMSI and IMEI searches in July 2012 ifequipment is utilizing AT&Ts wireless network

Started offering mapping through the GeoTimesoftware in July 2012

Introduced limited pinging for some phones in May2013


14/27

Hemisphere2012Requests

617

1610

543

Atlanta

Houston

LosAngeles


15/27

HemisphereRequestsByHIDTA

2012-201328

4

304

459

152

19

183

85

CentralValleyHIDTA

HawaiiHIDTA

LosAngelesHIDTA

NevadaHIDTA

NorthernCalifornia

HIDTA

NorthwestHIDTA

OregonHIDTA

SouthwestBorder

HIDTA:Arizona

SouthwestBorder

HIDTA:California


16/27

HemisphereRequestsByAgency

NorthwestHIDTA2012-2013

77

69

4 11 DEA

DHS

FBI

TacomaPd

WashingtonDOC


17/27

RequestbyType


46

106

BASIC DROPPEDPHONE


18/27

HemisphereDrugTypes


*Fugi'ves,Homicides,Kidnappings,MissingPersons,Etc.

26%

10%

7%21%

28%

4% 4%

COCAINE

HEROIN

MARIJUANAMETH

POLYDRUG

ECSTASY

*OTHER


19/27

HemisphereSUCCESS

STORIES

Northwest HIDTA


20/27

DEA- Seattle 2011

During a wire intercept conducted from Jan2011 to April 2011, targets would continuallyrotate their pre-paid phones

Utilized Hemisphere extensively toidentify dropped phones and verify targets

Hemisphere identified a significantamount of the new numbers

Based on this wire intercept investigation DEAwas able to seize;

136 kilos of cocaine2000 pounds of marijuanaApproximately 2.2 million dollarsSeveral residences, vehicles, and otherassets.Plus, we really pissed off the HellsAngels in Canada


21/27

HemisphereSUCCESS

STORIES

2012-2013


22/27

Montclair PD- Los Angeles2012

Men wearing ski masks smashed cases inside the BenBridge store at Montclair Plaza and grabbed 30 Rolexwatches while holding employees and customers atgunpointPolice officers worked with law enforcement inHenderson, Nev., after discovering two similar heistsoccurred thereThrough Hemisphere, detectives identified a new targetnumber being used by the main suspect

Montclair PD quickly tracked the new target number and thesuspect and six others were apprehended

Seven people were arrested and officers seized twomotorcycles and $180,000, believed to be bought withcash from the robberiesThey also found evidence that they were planning to robthe Glendale Galleria that day and another jewelry store inSan Francisco later


23/27

Redondo Beach PD-Los Angeles2012

A warrant was issued for Rene Avina's arrestMonday after authorities identified him as a second

man wanted in connection with the June 2 death of49-year-old bar bouncer Terie ColecchiThrough Hemisphere detectives identified a targetnumber being used by the main suspectHe was arrested on suspicion of murder


24/27

DEA- Los Angeles/South CarolinaFeb 2013

Melissa Ann Griggs made repeated bomb threats tohospitals, schools, banks and county offices in SouthCarolinaThe local authorities were having great difficultyfinding the number being used and reached out for

federal assistance

One of the numbers presented on the caller id wasthe cell phone number of a local drug trafficker

Analysis of subpoenaed toll records indicatedthis phone was not making the calls.

Hemisphere toll record analysis of the threatenedbusinesses showed the calls were coming from aVerizon Wireless customer

With this knowledge, calls to destinationsearches were requested of Verizon Wirelessrevealing the actual number making the calls.

She was arrested Feb. 14 at the Walmart in Senecaon a trespassing charge, and charged with 30 countsof making bombing threats


25/27

DEA- Arizona2013

Numerous dropped phone searches wereconducted over the course of a continuousinvestigation with multiple replacement phonesidentifiedMultiple Mexican phones roaming in the U.S.were identifiedSince early 2012 the investigation has yieldedthe following seizures

100lbs of meth225 lbs of hashish9kg of cocaine$190,0005 assault riflesBullet proof vest

Investigation is ongoing with more seizuresexpected


26/27

NCIS- San DiegoMarch 2013

Kennard Walters, allegedly impersonating a 2 StarGeneral, was asked to show an identification card atNaval Base San Diego

He stated he left the card in his vehicle anddrove off

Walters physically assaulted and subsequently ranover a Naval Criminal Intelligence Service SpecialAgent and fled the baseAfter the initial incident the suspect changed hisphone number and drove to northern CaliforniaAfter a return to the Los Angeles area, he thendrove to Tehama County in Northern California

where he was apprehendedHemisphere was able determine his new telephonenumber, and provide cell site data leading to his

arrest


27/27

Questions?

hemisphere project (slide presentation)

Documents