Forensic Challenges in 6G Cell Site Analysis (CSA) and Radio Frequency Propagation Surveys (RFPS)

 

Disturbing the CSA/RFPS matrix - the 6G red fog on the horizon

1. Introduction

The transition from 5G to 6G introduces significant technological advancements that fundamentally alter the reliability of Cell Site Analysis (CSA) and Radio Frequency Propagation Surveys (RFPS) in forensic investigations. Traditional forensic methodologies rely on static cell coverage assumptions, but 6G can incorporate Reconfigurable Intelligent Surfaces (RIS), beamfocusing, hybrid radio-optical links, adaptive wireless coverage, and real-time propagation optimization—all of which might disrupt conventional CSA techniques.

This article explores some possible key forensic challenges posed by 6G and proposes methodological adaptations to suggest the need to ensure an accurate approach to forensic investigations in *future wireless networks (*not active yet outside of the work performed inside the research arena).

2. Key 6G Technologies Impacting Forensic CSA

(A) Reconfigurable Intelligent Surfaces (RIS)

• How It Works: RIS dynamically manipulates electromagnetic waves to alter signal propagation, effectively "steering" radio signals in a controlled manner.
• Forensic Challenge: Traditional RFPS assumes static propagation models, but RIS can change coverage patterns in real time. Historical RF conditions may not be repeatable, rendering post-incident RF surveys unreliable.
• Adaptation Strategy: Forensic CSA must incorporate network logs from RIS controllers to reconstruct real-time signal pathways at the time of an incident.

(B) Beamfocusing and Near-Field/Far-Field Challenges

• How It Works: Unlike traditional beamforming, 6G focuses signals at a specific spatial point, requiring recalculations when users move.
• Forensic Challenge: The same beam may serve different locations at different times, making distance-based CSA unreliable. Call Detail Records (CDRs) cannot account for dynamic beam shifts, increasing uncertainty in forensic conclusions.
• Adaptation Strategy: Investigators must use beam-specific connection logs and network-side timing data to accurately map user-device interactions.

(C) Hybrid Radio-FSO (Free Space Optics) Transmission

• How It Works: 6G integrates optical wireless (FSO) and RF links, allowing networks to switch between them based on environmental factors.
• Forensic Challenge: Devices may become undetectable in RF-based forensic analyses if they transition to FSO links. Environmental factors (e.g., fog, rain) affect link selection, complicating forensic reconstructions.
• Adaptation Strategy: Investigators should obtain network-side transmission logs to track whether a device was communicating via RF or optical signals.

(D) Adaptive Wireless Coverage

• How It Works: 6G networks dynamically adjust cell coverage areas based on demand, user density, and time-of-day.
• Forensic Challenge: CSA methodologies assume static cell coverage zones, but 6G’s adaptive coverage challenges this assumption. A forensic RF survey conducted after an event may not reflect the coverage area at the time of the incident.
• Adaptation Strategy: Forensic analysts must use historical network management logs to verify coverage area configurations at the relevant time.

(E) Real-Time Propagation Optimization

• How It Works: AI-driven optimizations in 6G continuously modify network conditions to maximize efficiency and user experience.
• Forensic Challenge: Traditional RFPS methodologies rely on static RF environment assumptions, which 6G invalidates through real-time adjustments. Forensic conclusions based on past RFPS data may no longer be admissible in court.
• Adaptation Strategy: Investigators must shift from post-incident RF surveys to real-time network condition logging at the time of an event.

3. Recommendations for Future 6G Forensic CSA

(A) Move Beyond CDR-Based CSA

• CDRs are insufficient for 6G investigations due to: Beam-level user targeting, RIS-based reflections, and adaptive network changes. The inability of CDRs to track FSO-based communications.
• Alternative Data Sources: 6G Core Network Logs: Provide beam-level user connectivity data. Timing Advance and Angle of Arrival (AoA) Logs: Help estimate precise device positioning. AI-Driven Forensic Network Models: Can reconstruct historical network conditions.

(B) AI and Machine Learning for RF Reconstruction

• AI-based forensic models can: Simulate past network behaviours based on archived data. Predict how adaptive wireless coverage changed over time. Factor in RIS reflections and hybrid RF-FSO transitions.
• This enables forensic investigators to estimate historical RF conditions more accurately.

(C) Legal and Courtroom Considerations

• Defence may challenge 6G CSA evidence by arguing: "Did your forensic analysis account for RIS and adaptive coverage?" "Can you prove the network conditions were identical at the time of the event?" "How do you verify a device’s location given beamfocusing dynamics?"
• Solution: Forensic methodologies must include 6G network logs, AI-based reconstructions, and real-time network intelligence. Courts may require scientific validation of forensic CSA techniques before accepting 6G-based location evidence.

4. Conclusion

• 6G fundamentally disrupts traditional CSA methodologies, requiring a forensic shift from static RF assumptions to real-time data-driven analysis.
• Historical RFPS methods will no longer be reliable, necessitating AI-enhanced forensic models and network-side data extraction.
• Legal scrutiny of CSA in 6G cases will increase, requiring forensic experts to adapt their techniques to align with new wireless paradigms.
• Future forensic investigations must integrate RIS behaviour, beamfocusing effects, adaptive coverage logs, and real-time propagation adjustments to ensure credibility and accuracy in court.

This intention behind this article's is to serve as an observation post for forensic experts preparing for the 6G era of mobile network investigations. Agreeing or disagreeing with the articles observations is a good community activity and practice and such discussion must not be allowed to be discussed behind closed door when it comes to Cell Site Analysis/Radio Frequency Propagation Surveys (CSA/RFPS). The CSA/RFPS subject matter becomes even more fascinating when assessing 5G having shifted away from 2G, 3G and 4G paradigms

*The research for this article is based upon an initial assessment of the study 'The Road Towards 6G: Opportunities, Challenges, and Applications A Comprehensive View of the Enabling Technologies (Springer 2024)' [ISBN 978-3-031-42566-0 ISBN 978-3-031-42567-7 (eBook) https://doi.org/10.1007/978-3-031-42567-7 Editors: Valeria Loscri; Luca Chiaraviglio; Anna Maria Vegni] and reviewing other sources involved with or relating to CSA/RFPS.

"Outside Looking In" Part 1

 This is one of a series of articles I have prepared concerning expert evidence

"Outside Looking In" - This title relates to experts that have not gone the Forensic Science Regulator (FSR) route to hunker-down and embrace the ISO17025 accreditation process. We are told the concept of aiming for quality and reliable evidence is at or should be at the forefront of everyone's mind when involved with forensics and evidence. I think we all agree with that one. It is just how to go about that? ISO17025 was selected to meet that task but came with an excessive limitation - it only works for you if there is a high-level of quantity of cash to pay for it.
This is where the "Outside Looking In" arises as many single-person enterprise (often referred to as sole trader) and even small to medium-sized enterprises (SMEs) find it difficult to join the ISO17025 approved list. Financially, both the above mentioned enterprises can face outgoing costs of estimated an £76,000.00 before handling any work under this new ISO17025 regime.
But I see another route through all of this for these enterprises and that is expert opinion on assessing the Reports/Logs/CDRs etc., introduced as [Evidence]; assessment of that evidence doesn't require creating more, new evidence by the assessing expert, merely an opinion on it [e.g. process]. By process I mean recognition of steps taken to bring about the evidence. To illustrate, a document in a murder case said to be the original had apparently been used in order to make copies of it. Mysteriously, the duplicated copies had come from the first photocopier in history to change the original wording from lower case lettering to exactly the same wording but now appearing in upper case lettering. Amazing!
Today, there is much concern over the loss of highly experienced experts in the above enterprises no longer assisting the Criminal Justice System. It is hard to believe no clear and precise path had been created for them. To understand this concern associated with long term knowledge, skills and experience I use an example of a presentation I created back in 2008 regarding mobile telephone evidence. This is to make the point that categories used in the presentation are just "labels" BUT under which vast and deep wells of knowledge skills and experience are needed by practitioners and had to be known back then; because they regularly cropped up in evidence. These weren't learnt overnight but over many, many years.
Those "Outside Looking In" are now asking themselves why is it someone else has decided my knowledge, skills and experience is no longer worthy?

TREWMTE-Starter-Kit-Part-TWO https://www.dropbox.com/scl/fi/ec7issg2m2batw9p0okd3/TREWMTE-Starter-Kit-Part-TWO.pdf?

In "Outside Looking In" Part 2 I want to show acquisition of "Knowledge" and its relevance to expert opinion. I will be using Cell Site Analysis as the relevant science in relation to evidence.

LTE Attach and Default Bearer Setup Messaging

Prior to the LTE mobile phone being tracked in the LTE network their is still the setup process that enables the handset to gain access to network services. This useful guide illustrates the steps involved which a CSA investigator should have an understanding, not least of which is knowing S1AP: when the IMSI and GUTI are used; S11: The IP assigned to the mobile station and current location of the user; and a host of other useful information that often crops up in investigations.

 

LTE-Attach-Messaging

LTE Tracking Area Update

This useful guide produced using EventStudio System Designer drives home the processes and procedures involved to understand how LTE Tracking Area Update works. Every CSA investigator will need to have knowledge in this area to be able to define in a statement, report or at Court how a mobile phone is tracked whilst switched ON and moving around in an LTE network.

LTE Tracking Area Update

3G Networks position techniques.pdf

For those CSA investigators interested in a skeleton outline on 3G Networks position techniques, this info should help as a starting point.

Network Positioning Techniques

Cell Site Analysis - location and radio coverage signals

It still holds true with LTE radio coverage that signals arrive in a scattered manner detected at the mobile phone handset. A good CSA investigator will know how to explain how coverage might inconceivably be thought by the untrained not to be detected at a particular location, may well be possible due to the location of the phone at the material time.

 

As mentioned in a previous post understanding density of masts in an area must equally be understood not simply from the point of calls handled by a single mast. There is also the instance where a call's start and end masts are different that can be involved, which may involve the network having to deal with 'hard handover'. Advancements with 3G and 4G enables calls (data) being handled by several masts delivering data to the smartphone in a seamless fashion. This maybe due to the amount of data involved or fast-fading etc. These types of handovers are called 'soft-handover'. When understood correctly the use of these combined masts in soft-handover because they are often in very close proximity can narrow down the location through improved triangulation (etc.). 

 

 

There is the occasion where the operator only has one mast in a particular area but several sectors of the same mast might be used seamlessly for an e.g. data call, and this is called softer-handover. When thinking about soft and softer handover think in terms of 'inter' and 'intra'.

 

 

 

Furthermore, smartphones, which I call 'ultra-smarts' due to their increased embedded communications capabilities, use close proximity masts or access points (Wi-Fi) to enable uninterrupted communication and network access. Network operators have deployed microcells, as you (may) know. Microcells deployment help remove the burden of signalling and traffic on macro-cells by directing slow-moving mobiles to short range coverage. These microcells can be useful for slow-moving users, walking down the high street or located in one area for a period of time. Remaining in an area for a period of time is called 'dwell time'. The latter is a term CSA investigators should know as it can have important bearing upon a case. In some instances, small coverage points have been deployed called pico-cells and nano-cells which can refine location distances between the mobile phone and the cell to a few meters.

 

The 'ultra-smarts' Wi-Fi capability creates an additional attractive proposition for cell site analysis investigations as the investigator will need to be keenly aware that dual usage of cellular and Wi-Fi coverage can produce a rich resource of location positioning. The image below has been used at this blog before but it is still a useful reminder what should be considered when conducting radio surveys.

 

 

And if further illustration is needed to illuminate a survey assessment criteria then hopefully this image below will provide the investigator with some ideas.

 

 

Cell site analysis has evolved so much more from the days of GSM and early days of WCDMA. It is not enough to use call records and CDRs in isolation and/or going to a particular geographical location to conduct tests at one single location; the wider area needs to be taken into context as to what impact that might have on a call or calls being handled by a cell or cells etc. (mast, masts or access points).

 

LTE Positionng Methods

 

As with GSM and WCDMA, LTE is no different. Cell Site Analysis investigators still need to have a general understanding of location positioning methods in order to refine how using static and drive test radio test measurements do not clearly define radio boundaries alone. There are a enormous range of strategies that can be adopted and should be adopted based on a case-by-case basis.

 

If network operator adopted methods for determining location (and they have the infrastructure to do that) an external investigator cannot use CDRs and radio test measurements to pinpoint call location at the material time. It still requires knowing how each operator has planned their network radio coverage and still does no harm to request single cell prediction maps and best server plots -density maps.

 

 

Remember the density-map is important as it provides an underlying indication of potential cell usage or handover.