Hemisphere Summary
- The Hemisphere Project is coordinated from the Los Angeles Clearinghouse and is funded by ONDCP and DEA.
- Hemisphere provides electronic call detail records (CDRs) in response to federal, state, and local administrative/grand jury subpoenas.
- The Hemisphere database contains CDRs for any telephone carrier that uses an AT&T switch to process a telephone call.
- Hemisphere is an unclassified program.
- Hemisphere provides de-confliction within the Hemisphere database.
- 4 billion CDRs populate the Hemisphere database on a daily basis.
- Hemisphere results can be returned via email within an hour of the subpoenaed request and include CDRs that are less than one hour old at the time of the search
- The Hemisphere program has access to long distance and international CDR's data going back to 1987
- Hemisphere data contains roaming information that can identify the city and state at the time of the call
- Results are returned in several formats that aid the analyst/investigator (I2, Penlink, GeoTime, Target Dialed Frequency report, Common Calls report, etc)
Facts and Figures
- Since its inception in September 2007, the Los Angeles Hemisphere Program has processed over 4,400 requests and over 11,200 individual telephone numbers
- As of June 2013 Hemisphere has processed 679 requests from the Northwest HIDTA
- Hemisphere is most often used by DEA and DHS in the Northwest HIDTA to identify replacement/additional phones
- The Northwest HIDTA has recently utilized Hemisphere to track known Canadian phones roaming in the U.S. on the AT&T network
Unique Project Features
- "Dropped Phones" - the program uses an algorithm and advanced search features to find the new number.
- "Additional Phones" - the program can often determine cell phones the target is using that are unknown to law enforcement.
- "International Phones" - the program provides CDRs for a tremendous amount of international numbers that place calls through or roam on the AT&T network. The information is provided in response to the standard Hemisphere administrative subpoena.
Advanced Results
Analysis
Searching For Dropped Phones
- Dropped Phone Requests: A service provided by Hemisphere, requestors can ask for analysts to find possible replacement phones that are no longer active
- To do this, you must mention "Dropped Phone Request" in the special instructions on your request form
- A dropped phone report will be returned in paragraph form and either written out in the returned email or attached with the results as a word file
- The method for identifying the replacement phone for the dropped phone involves careful analysis of the developed advanced results
- By systematically grading the common calls report and scrutinizing the date ranges, candidates for the replacement phone are ranked by probability
Protecting The Program
Protecting the Hemisphere program is a formidable challenge. We have taken the following steps to try and keep the program under the radar.
Training - All Hemisphere training modules are inundated with instruction regarding how to protect Hemisphere data.
Use - Hemisphere requests are vetted. Requestors must have either attended Hemisphere training or be directly connected to a HIDTA Initiative/Agency or intelligence center familiar with the program.
Hemisphere data will likely produce a variety of different leads for an array of cases.
Hemisphere data will only indicate calls that hit an AT&T switch
Therefore, the only way to get a complete and accurate picture of the target's phone activity is to subpoena and review a complete set of the carrier's CDRs.
When a complete set of CDRs are subpoenaed from the carrier, then all memorialized references to relevant and pertinent calls can be attributed to the carrier's records, thus "walling off" the information obtained from Hemisphere. In other words, Hemisphere can easily be protected if it is used as a pointer system to uncover relevant numbers.
-Exigent Circumstances-
Protecting The Program
In special cases, we realize that it might not be possible to obtain subpoenaed phone records that will "wall off" Hemisphere.
In these special circumstances, the Hemisphere analyst should be contacted immediately. The analyst will work with the investigator and request a separate subpoena to AT&T.
-Official Reporting-
Protecting The Program
All requestors are instructed to never refer to Hemisphere in any official document.
If there is no alternative to referencing a Hemisphere request, then the results should be referenced as information obtained from an AT&T subpoena.
What's new with Hemisphere?
- First court order from Washington submitted in Dec 2012
- AT&T legal approved use of Court orders from Washington state
- Allows Local agencies to utilize Hemisphere through court orders
- Hemisphere began providing subscriber information in July 2012 for AT&T phones
- Began IMSI and IMEI searches in July 2012 if equipment is utilizing AT&T's wireless network
- Started offering mapping through the GeoTime software in July 2012
- Introduced limited pinging for some phones in May 2013
Northwest HIDTA
Hemisphere SUCCESS STORIES
DEA- Seattle 2011
o During a wire intercept conducted from Jan 2011 to April 2011, targets would continually rotate their pre-paid phones
o Utilized Hemisphere extensively to identify dropped phones and verify targets
o Hemisphere identified a significant amount of the new numbers
o Based on this wire intercept investigation DEA was able to seize;
o 136 kilos of cocaine
o 2000 pounds of marijuana
o Approximately 2.2 million dollars
o Several residences, vehicles, and other assets.
o "Plus, we really pissed off the Hells Angel's in Canada"
Montclair PD- Los Angeles
2012
o Men wearing ski masks smashed cases inside the Ben Bridge store at Montclair Plaza and grabbed 30 Rolex watches while holding employees and customers at gunpoint
o Police officers worked with law enforcement in Henderson, Nev., after discovering two similar heists occurred there
o Through Hemisphere, detectives identified a new target number being used by the main suspect
o Montclair PD quickly tracked the new target number and the suspect and six others were apprehended
o Seven people were arrested and officers seized two motorcycles and $180,000, believed to be bought with cash from the robberies
o They also found evidence that they were planning to rob the Glendale Galleria that day and another jewelry store in San Francisco later
Redondo Beach PD-Los Angeles
2012
o A warrant was issued for Rene Avina's arrest Monday after authorities identified him as a second man wanted in connection with the June 2 death of 49-year-old bar bouncer Terie Colecchi
o Through Hemisphere detectives identified a target number being used by the main suspect
o He was arrested on suspicion of murder
DEA- Los Angeles/South Carolina
Feb 2013
o Melissa Ann Griggs made repeated bomb threats to hospitals, schools, banks and county offices in South Carolina
o The local authorities were having great difficulty finding the number being used and reached out for federal assistance
o One of the numbers presented on the caller id was the cell phone number of a local drug trafficker
o Analysis of subpoenaed toll records indicated this phone was not making the calls.
o Hemisphere toll record analysis of the threatened businesses showed the calls were coming from a Verizon Wireless customer
o With this knowledge, calls to destination searches were requested of Verizon Wireless revealing the actual number making the calls.
o She was arrested Feb. 14 at the Walmart in Seneca on a trespassing charge, and charged with 30 counts of making bombing threats
DEA- Arizona
2013
o Numerous dropped phone searches were conducted over the course of a continuous investigation with multiple replacement phones identified
o Multiple Mexican phones roaming in the U.S. were identified
o Since early 2012 the investigation has yielded the following seizures
o 100lbs of meth
o 225 lbs of hashish
o 9kg of cocaine
o $190,000
o 5 assault rifles
o Bullet proof vest
o Investigation is ongoing with more seizures expected
Questions?
- The Hemisphere Project is coordinated from the Los Angeles Clearinghouse and is funded by ONDCP and DEA.
- Hemisphere provides electronic call detail records (CDRs) in response to federal, state, and local administrative/grand jury subpoenas.
- The Hemisphere database contains CDRs for any telephone carrier that uses an AT&T switch to process a telephone call.
- Hemisphere is an unclassified program.
- Hemisphere provides de-confliction within the Hemisphere database.
- 4 billion CDRs populate the Hemisphere database on a daily basis.
- Hemisphere results can be returned via email within an hour of the subpoenaed request and include CDRs that are less than one hour old at the time of the search
- The Hemisphere program has access to long distance and international CDR's data going back to 1987
- Hemisphere data contains roaming information that can identify the city and state at the time of the call
- Results are returned in several formats that aid the analyst/investigator (I2, Penlink, GeoTime, Target Dialed Frequency report, Common Calls report, etc)
Facts and Figures
- Since its inception in September 2007, the Los Angeles Hemisphere Program has processed over 4,400 requests and over 11,200 individual telephone numbers
- As of June 2013 Hemisphere has processed 679 requests from the Northwest HIDTA
- Hemisphere is most often used by DEA and DHS in the Northwest HIDTA to identify replacement/additional phones
- The Northwest HIDTA has recently utilized Hemisphere to track known Canadian phones roaming in the U.S. on the AT&T network
Unique Project Features
- "Dropped Phones" - the program uses an algorithm and advanced search features to find the new number.
- "Additional Phones" - the program can often determine cell phones the target is using that are unknown to law enforcement.
- "International Phones" - the program provides CDRs for a tremendous amount of international numbers that place calls through or roam on the AT&T network. The information is provided in response to the standard Hemisphere administrative subpoena.
Advanced Results
Analysis
Searching For Dropped Phones
- Dropped Phone Requests: A service provided by Hemisphere, requestors can ask for analysts to find possible replacement phones that are no longer active
- To do this, you must mention "Dropped Phone Request" in the special instructions on your request form
- A dropped phone report will be returned in paragraph form and either written out in the returned email or attached with the results as a word file
- The method for identifying the replacement phone for the dropped phone involves careful analysis of the developed advanced results
- By systematically grading the common calls report and scrutinizing the date ranges, candidates for the replacement phone are ranked by probability
Protecting The Program
Protecting the Hemisphere program is a formidable challenge. We have taken the following steps to try and keep the program under the radar.
Training - All Hemisphere training modules are inundated with instruction regarding how to protect Hemisphere data.
Use - Hemisphere requests are vetted. Requestors must have either attended Hemisphere training or be directly connected to a HIDTA Initiative/Agency or intelligence center familiar with the program.
Hemisphere data will likely produce a variety of different leads for an array of cases.
Hemisphere data will only indicate calls that hit an AT&T switch
Therefore, the only way to get a complete and accurate picture of the target's phone activity is to subpoena and review a complete set of the carrier's CDRs.
When a complete set of CDRs are subpoenaed from the carrier, then all memorialized references to relevant and pertinent calls can be attributed to the carrier's records, thus "walling off" the information obtained from Hemisphere. In other words, Hemisphere can easily be protected if it is used as a pointer system to uncover relevant numbers.
-Exigent Circumstances-
Protecting The Program
In special cases, we realize that it might not be possible to obtain subpoenaed phone records that will "wall off" Hemisphere.
In these special circumstances, the Hemisphere analyst should be contacted immediately. The analyst will work with the investigator and request a separate subpoena to AT&T.
-Official Reporting-
Protecting The Program
All requestors are instructed to never refer to Hemisphere in any official document.
If there is no alternative to referencing a Hemisphere request, then the results should be referenced as information obtained from an AT&T subpoena.
What's new with Hemisphere?
- First court order from Washington submitted in Dec 2012
- AT&T legal approved use of Court orders from Washington state
- Allows Local agencies to utilize Hemisphere through court orders
- Hemisphere began providing subscriber information in July 2012 for AT&T phones
- Began IMSI and IMEI searches in July 2012 if equipment is utilizing AT&T's wireless network
- Started offering mapping through the GeoTime software in July 2012
- Introduced limited pinging for some phones in May 2013
Northwest HIDTA
Hemisphere SUCCESS STORIES
DEA- Seattle 2011
o During a wire intercept conducted from Jan 2011 to April 2011, targets would continually rotate their pre-paid phones
o Utilized Hemisphere extensively to identify dropped phones and verify targets
o Hemisphere identified a significant amount of the new numbers
o Based on this wire intercept investigation DEA was able to seize;
o 136 kilos of cocaine
o 2000 pounds of marijuana
o Approximately 2.2 million dollars
o Several residences, vehicles, and other assets.
o "Plus, we really pissed off the Hells Angel's in Canada"
Montclair PD- Los Angeles
2012
o Men wearing ski masks smashed cases inside the Ben Bridge store at Montclair Plaza and grabbed 30 Rolex watches while holding employees and customers at gunpoint
o Police officers worked with law enforcement in Henderson, Nev., after discovering two similar heists occurred there
o Through Hemisphere, detectives identified a new target number being used by the main suspect
o Montclair PD quickly tracked the new target number and the suspect and six others were apprehended
o Seven people were arrested and officers seized two motorcycles and $180,000, believed to be bought with cash from the robberies
o They also found evidence that they were planning to rob the Glendale Galleria that day and another jewelry store in San Francisco later
Redondo Beach PD-Los Angeles
2012
o A warrant was issued for Rene Avina's arrest Monday after authorities identified him as a second man wanted in connection with the June 2 death of 49-year-old bar bouncer Terie Colecchi
o Through Hemisphere detectives identified a target number being used by the main suspect
o He was arrested on suspicion of murder
DEA- Los Angeles/South Carolina
Feb 2013
o Melissa Ann Griggs made repeated bomb threats to hospitals, schools, banks and county offices in South Carolina
o The local authorities were having great difficulty finding the number being used and reached out for federal assistance
o One of the numbers presented on the caller id was the cell phone number of a local drug trafficker
o Analysis of subpoenaed toll records indicated this phone was not making the calls.
o Hemisphere toll record analysis of the threatened businesses showed the calls were coming from a Verizon Wireless customer
o With this knowledge, calls to destination searches were requested of Verizon Wireless revealing the actual number making the calls.
o She was arrested Feb. 14 at the Walmart in Seneca on a trespassing charge, and charged with 30 counts of making bombing threats
DEA- Arizona
2013
o Numerous dropped phone searches were conducted over the course of a continuous investigation with multiple replacement phones identified
o Multiple Mexican phones roaming in the U.S. were identified
o Since early 2012 the investigation has yielded the following seizures
o 100lbs of meth
o 225 lbs of hashish
o 9kg of cocaine
o $190,000
o 5 assault rifles
o Bullet proof vest
o Investigation is ongoing with more seizures expected
Questions?
( Drug Enforcement )
www.ChordsAZ.com