1058 lines
57 KiB
Plaintext
1058 lines
57 KiB
Plaintext
September 15, 1992
|
|
CELLULAR TELEPHONE OPERATIONS AND INTERCEPTIONS; FIRST OF ALL .
|
|
|
|
In a recent best seller, (ClearAnd PresentDanger) Tom Clancy, one hell of a
|
|
fine wordsmith, based much of the tension in the plot on the fact that the
|
|
good guys (government agents in this case) could not follow the bad guys, even
|
|
on their cellular telephones because cellular phones are "impossible to
|
|
monitor."
|
|
|
|
Tom, Tom, lack of research or just trying to be nice to those agents
|
|
who helped you out on the book? Let's face facts, it ain't exactly impos-
|
|
sible to eavesdrop on cellular phones. In fact cellular phones are just about
|
|
the easiest type of communication to monitor without major equipment
|
|
expenditures or committing grievous felonies. Ah, let me qualify that last one
|
|
just a bit, it is against the law to monitor cellular conversations because
|
|
they, unlike cordless phones which also transmit over the radio, give the
|
|
"expectation of privacy." Or it is against the law until some good ACLU type
|
|
lawyer takes the first case to court, but that is neither here nor there. It
|
|
is against the law to monitor these conversations without the correct legal
|
|
documents and I am writing this section secure in the knowledge that none of
|
|
you would break this law, and that anyone who uses these techniques has a
|
|
legal right to do so. Right? So please ignore the fact that anyone with a
|
|
halfway decent scanner, (and they don't make many without cellular coverage
|
|
anymore) can just turn on, tune in and drop, ah, in. Some scanners won't allow
|
|
this illegal listening. For instance, Radio Shack, that paragon of poor man's
|
|
eavesdropping equip- ment, although they designed their scanners to receive
|
|
these calls, made it impossible to do so after the laws were changed.
|
|
|
|
Unless you take a pair of scissors and clip one little wire...
|
|
|
|
But it's the intent of the law that is at stake here; suppose you don't have
|
|
a scanner? God forbid you should look at the frequency chart and realize that
|
|
some cellular channels can be received on an unmodified UHV television set.
|
|
Don't touch that dial!
|
|
|
|
|
|
A TRICK
|
|
The two problems with either of these drop in monitoring systems is that A.
|
|
One doesn't know who one is listening to, and B. As the target moves about in
|
|
any area covered by CP's his signal will be automatically "handed ofP' to new
|
|
cells as the signal strength of his transmis- sion falls off. These
|
|
frequencies are random on the basis that they are available on the system not
|
|
in use, and do not interfere with other conversations already in progress.
|
|
|
|
Pandora's box?
|
|
|
|
Hardly. Here is how cellular telephones work and how everybody who has any
|
|
desire to tune in on the world's greatest party line can do so with a minimum
|
|
of effort from those with $40,000 budgets to those equipped only with a
|
|
scanner and a sense of adventure...
|
|
|
|
OPERATING SYSTEMS & TRAINS THAT FLY
|
|
Cellular systems consist of a number of indi- vidual "cells" that contain a
|
|
number of indi- vidual frequencies for the transmission of audio information.
|
|
A certain number of other frequencies within the cell are allotted to channels
|
|
that transfer the data necessary to set up and maintain the call.
|
|
|
|
Every area covered in the U.S. has at least two cellular phone companies in
|
|
operation: One is a wireline company, meaning it is, or was, depending on
|
|
whose lawyers one believes, owned by Bell. The other operator is a non-
|
|
wireline, an independent rep. Both adhere to the same operating standards.
|
|
When a particular phone reaches the outer limit of a particular cell's power,
|
|
the equipment automatically senses this and "hands off" the call to an
|
|
adjacent cell to continue the conver- sation with no noticeable loss in
|
|
signal.
|
|
|
|
The hexagons usually used to illustrate cells are really only symbolic.
|
|
Graphic artists and other PR types use these shapes to describe the system but
|
|
the real boundary of a cell is a jagged line that represents a point where the
|
|
power level falls off to about -100 decibels relative to a milliwatt of radio
|
|
power hitting the receive antenna.
|
|
|
|
At that point the system doesn't work very well because it's about equal to
|
|
the regular noise input to the receiver and it becomes very difficult to get a
|
|
good signal in there so some- where in the range of -85 to -100 DBM is the
|
|
point where one would no longer use the radio in that cell and the signal is
|
|
handed off to another cell.
|
|
|
|
The decision of where and when to hand off is also mitigated by other
|
|
factors, for instance, are there any available voice channels in that cell
|
|
would be the preferred choice for the handoff target? If so the decision is
|
|
simply to take the frequency in that cell and command the mobile to change its
|
|
frequencies to that particular frequency in order to carry out the hand off.
|
|
|
|
In real life, cells do not come out to perfectly drawn symbols but rather
|
|
jagged areas of signal which are influenced by hills, buildings, and other
|
|
natural factors beyond the control of the cellular company.
|
|
|
|
There are hills in every city and every hill will create a signal shadow in
|
|
the area behind it. Tall buildings will create the same effect. If the cell
|
|
includes streets with buildings that have highly reflective windows, like
|
|
silver glass or enameled coating, this tends to form a wave guide and will cut
|
|
the power down a long distance along that street if it's in line aside an
|
|
antenna.
|
|
|
|
The waves begin bouncing back and forth and side to side, reflecting energy
|
|
like two parallel mirrors on opposite walls, so suddenly there are a lot of
|
|
strange things that weren't included in the original symmetrically-shaped
|
|
pattem. But that's life in the big city. Literally.
|
|
|
|
The combination of particular antenna placements plus buildings and
|
|
shadowing in the service city creates areas which need to be overlapped. Phone
|
|
companies want some overlap with the boundaries, which requires a little
|
|
leeway about where to make handoffs occur. They have to cover the whole city
|
|
to give good service. No area can be excluded.
|
|
|
|
Some operators employ an engineer on a full-time basis to go out and make
|
|
constant measurements. Others will bring in a consult- ant and have them make
|
|
measurements locally every other month or two depending on the rate of growth.
|
|
If a tall building goes up right on an existing antenna, they may go out and
|
|
survey it while it's still under construction in order to do some modeling and
|
|
field prediction to correct the problem before it happens. This means cell
|
|
site boundaries and handoff points are in a state of flux.
|
|
|
|
The mobile phone operates on one fre- quency, sending out one side of the
|
|
call and the cell operates at another frequency 45 MHz less than the mobile.
|
|
The cell itself broadcasts both sides of the call.
|
|
|
|
In the cells themselves there are basically two sets of channels-the
|
|
original channels were just the ones allocated to two different competitive
|
|
carriers in the world's metro areas. Of these 333 channels in each of these
|
|
two groups, 21 which are near the boundary and 21 on the other side of the
|
|
boundary, are used as the so-called set up channels. All the other channels
|
|
are available for voice.
|
|
|
|
Recently the FCC allocated an additional 83 channels to each of the two
|
|
carriers. The wireline carrier, which is a former Bell operat- ing company,
|
|
got it in one nice big chunk of 83 channels in every area. The A carrier, the
|
|
non-wireline carrier in each district, (Cellular One, for example) got the new
|
|
access in twochunks that were split apart, say 33 in one place and 50 in the
|
|
other. This is important because the FCC has said they are not going to give
|
|
out any more channel allocations until the end of the century.
|
|
|
|
HOW CALLS ARE PLACED
|
|
The overhead train, a continuous stream of data (on a data channel) that is
|
|
constantly sending out loads of information of who is where and with what will
|
|
be occasionally interrupted by a specific starting message, called a page.
|
|
This is a message that mitigates the telephone number of the call of the
|
|
mobile, indicating there's a call for the mobile.
|
|
|
|
At this point the system doesn't know where the mobile is in the city so
|
|
this page is sent out in every cell in the whole city. The mobile, if it's
|
|
there, will respond in one of the cells as it has been watching one particular
|
|
frequency in the setup channel. It will go to another channel and if that
|
|
fades out, it will scan and find another one so it's always watching one
|
|
particular frequency and responding in the same frequency.
|
|
|
|
If located the mobile will be rung up or a pre-recorded message will be
|
|
issued saying that it is busy or off hook. The caller will then be
|
|
disconnected whether he wants to stay on or not. He can dial again immediately
|
|
but with get the same result, because they are trying to limit the amount of
|
|
air time that's consumed without producing any revenue if the subscriber is
|
|
out of town or has his mobile tumed off.
|
|
|
|
What happens when a user goes to make a call? The setup channel in every cell
|
|
transmits a sequence of minor data in a certain frame in the overhead train,
|
|
which includes things like the actual number of the phone involved. Every
|
|
system in North America has a 3 digit number along with some other data which
|
|
tells the mobiles if they are from outside the local system, if they should
|
|
identify themselves or not. If a phone is visiting the city should it identify
|
|
itself or should it wait until the switch has a call for it?
|
|
|
|
When a mobile starts up cold, it begins scanning. It starts scanning the
|
|
supervisory channels. It only has 21 to look at so it scans all of them until
|
|
it finds the strongest one and locks onto it and looks for the overhead train.
|
|
As soon as overhead train is grabbed, it waits and watches. If the train fades
|
|
away, the mobile w~ go back and start scanning a~ over again.
|
|
|
|
If a mobile operator wants to originate a call, the operator enters all the
|
|
dial digits into a display register on the mobile and hits a key labeled
|
|
"send." This causes the mobile to transmit a call setup message on the reverse
|
|
frequency part of the supervisory or setup channel before it identifies itself
|
|
and gives the telephone number to be dialed and it listens to see if the train
|
|
wants any more information. The telco may only request 7 of the 10 digits of
|
|
the mobile number or it may demand every- thing including the electronic
|
|
serial number, but all the systems are capable of asking for everything and
|
|
the only reason some compa- nies reduce the amount of information is just to
|
|
save transaction time when they're very busy.
|
|
|
|
The response contains all the same informa- tion. The actual switch, which is
|
|
located at the cell site, has to have 3 types of radios: Voice channel
|
|
transceivers are for actually talking in duplex covering about 45 usable
|
|
channels per cell unless the expanded spectrum has been put into use where it
|
|
goes up to 56 channels per cell. At least one control or setup channel
|
|
transceiver is also required but most companies will install a spare for that
|
|
in case of failure because it's role is a crucial one. If it's dead,
|
|
everything's dead, calls can't be set up in either direction.
|
|
|
|
In addition, at least one locaffng receiver is required to measure radio
|
|
signal strength indication because when a handoff occurs there's always a
|
|
question. If the signal strength in this mobile is getting weak, where is it?
|
|
Is he driving north, is he driving east, west or south, which cell is he
|
|
getting closest to? The system, prior to the handoff, has to request all the
|
|
locating receivers in the nearby cells to tune tothe frequency of that mobile
|
|
in order to mea- sure the signal strength and report the stron- gest one.
|
|
|
|
The actual switches are called either an MTX or MTSO depending on the
|
|
manufacturer. MTX means Mobile Telephone Exchange and MTSO means Mobile
|
|
Telephone Switching Office.
|
|
|
|
The central switch is pretty much a standard telephone switch. Almost all
|
|
the modem ones are digital in nature with some type of a switch- ing network
|
|
which connects calls from one port to another. There is also some kind of a
|
|
control complex involved in the central proces- sor similar to a computer.
|
|
There is a digital trunk controller and some sort of interface which is used
|
|
to connect to other telephone central offices in other parts of the city.
|
|
|
|
When the call gets into that switch mecha- nism, the signal is handled like a
|
|
regular tele- phone call. All the same technologies about pen recording,
|
|
intercepting, tracking and taping all the conversation can and will be
|
|
intercepted by the carrier at this point without special equipment.
|
|
|
|
In addition to that, all the records exchanged produced by like automatic
|
|
number identifica- tion and billing and all the call records, (~UR's) can be
|
|
subpoened, so everything applies pretty much the same as it does in the
|
|
regular tele- phone system.
|
|
|
|
There's also some type of a control connec- tion to the central processor,
|
|
usually run through a voice frequency channel which leads to a controller of
|
|
some type which is another microprocessor system at the cell site that's
|
|
connected to both the radios to tell them to go on and off and then back into
|
|
the locating receiver in order to process the change to get the frequencies
|
|
and take measurements.
|
|
|
|
This is the format of one cell site. A city may have as many cell sites as
|
|
necessary. U.S. systems range from the minimum of one cell site to as many as
|
|
about 70 or 80. Los Angeles has about 80, New York runs a close secon~i
|
|
|
|
ROAMING AND ROVING
|
|
All of North American cellular operators have
|
|
uniform technical standards and in theory, if
|
|
there's no business reasons not to, a set can
|
|
roam anywhere in the continent where there's
|
|
radio coverage. The operator can at least origi-
|
|
nate calls even though he may or may not be
|
|
able to receive them, depending on whether
|
|
inter-connections exist for data transfer be-
|
|
tween the various cellular systems, but techni-
|
|
cally there's no reason why one can't originate
|
|
a call.
|
|
|
|
Any mobile set has several options. If it can't
|
|
find any supervisory channel at all-if it's
|
|
suddenly situated out in the country where
|
|
there's no cellular service-the local will scan
|
|
and scan and eventually, after a few tries it give
|
|
up and indicates that the caller is SOL.
|
|
|
|
If the operator scans all the channels but the
|
|
system number showing in the overhead train
|
|
doesn't match the one in the memory of the
|
|
telephone set, the mobile set, it will keep
|
|
watching it in the roam mode, understanding
|
|
it's outside of its home system. In most sets one
|
|
can also switch to the other carrier in the area.
|
|
|
|
The business arrangement is that most U.S. wire lines have some kind of
|
|
cross-billing contracts. All of the former Bell operating companies
|
|
subsidiaries have almost uniform aoss billing contracts and many, but not all
|
|
of the non-wire line people have cross-billing contracts, plus there are many
|
|
cross-billing contracts between wire line and non-wire line because there are
|
|
lots of cross ownership, so almost every place the phone goes there is about a
|
|
95% chance to place a call which will later appear on the operator's phone
|
|
bill.
|
|
|
|
General Telephone operates a clearinghouse that automatically bills the
|
|
correct party no matter where he happens to be at the time of the call.
|
|
|
|
If the city the call is being originated in overlaps coverage with a
|
|
neighbor, the handoff can occur between cities. In a few years the entire U.S.
|
|
is expected to be included in a system of mass coverage.This knowledge can be,
|
|
and is, used to protect oneself from law enforcement intercept orders as
|
|
follows (borrowed from the ah, well, a group of Italian businessmen):
|
|
|
|
If someone wants to protect his location and his number from intercept, he
|
|
registers on a non-wire line system and then "roams" in whatever city he's
|
|
located in, so, in order for his customers to reach him, they will have to
|
|
dial the local roamer number, then punch in the area code and phone number to
|
|
connect.
|
|
|
|
The transmitter could be 10' from the re- ceiver, it makes no difference.
|
|
This technique protects the caller's location and it protects the location of
|
|
the "customer" because he can't be isolated from the roamer truck, making it
|
|
effec- tively impossible to place intercept equipment to track and record the
|
|
unit's conversations.
|
|
|
|
The roam feature knocks the caller out of the regional system that normally
|
|
covers north, south, east or west in any area. Of course, the user is paying
|
|
the price of a toll call, and roaming calls are always more expensive than
|
|
non-roamers. But still...
|
|
|
|
By choosing the other wire/non-wireline system the phone will automatically
|
|
operate in the roaming mode. Something to remember, just in case that, well,
|
|
that your uncle from New Jersey drops in for an unexpected visit. . .
|
|
|
|
CELL CONSTRUCTION
|
|
AND INTERCEPTION TECHNIQUES
|
|
|
|
Law enforcement types can purchase sets to monitor, track and record cellular
|
|
phone calls. These sets are damn expensive from suppliers like HDS and are
|
|
usually just test sets designed to monitor cellular operations for a carrier.
|
|
They're still damn expensive.
|
|
|
|
If someone tries to intercept a call with a test, the results will be
|
|
printed out (including new handoff frequencies) and the sets can manually
|
|
switch to it almost as fast as the mobile does. That's because a certain
|
|
signal is transmitted in the voice channel just before the handoff containing
|
|
the mobile change frequency.
|
|
|
|
This means, among other relevant tidbits, that a person, hopefully a person
|
|
in Law Enforcement, who has a monitor that will read the overhead train
|
|
(usually a modified IFR service monitor, $25-$35K) can actually tell if a
|
|
subject is in a certain city and follow him from cell to cell even if he
|
|
doesn't make a singlephone call, as long as his phone is tumed on... In some
|
|
systems.
|
|
|
|
These sets are out of the reach of most police departments at this time, but
|
|
many big cities are purchasing some sort of auto-record equip- ment and trust
|
|
me, the Feds do have them, my friend.
|
|
|
|
Test sets such as those produced by IFR will reveal everything going on. It's
|
|
their job, after all. A good test set will not only listen to the audio, it
|
|
will display all the monitor data in the proper form and anything else asked
|
|
of it.
|
|
|
|
The test set, whether sold to telco suppliers or with a value added (say
|
|
$10,000) and sold to law enforcement as an intercept station, can mimic a base
|
|
station or it can metamorphosize itself into a mobile unit. It can follow
|
|
every handoff via the ESN or phone number auto- matically.
|
|
|
|
Test sets are programmed to become a certain mobile at any given notice and
|
|
record what calls it receives, when it changes to a different frequency and so
|
|
on. Although originally designed for sorting through a system they are ideal
|
|
for interception within any metropolitan area. Some cellular operators now
|
|
maintain a certain portion of their switch physically in the open so law
|
|
enforcement folks (armed with a warrant) can hook up their recorders right at
|
|
the switch without disturbing the phone company's personnel or equipment. The
|
|
telephone companies have only a certain number of spare ports to hook on to. A
|
|
few govemment agencies, like the Bureau had a habit of grabbing them up,
|
|
making it difficult for other companies to get them. For quite a while the
|
|
telephone companies were lying, saying they didn't have the ports avail- able,
|
|
forcing them to use a service monitor. However, so many cellular intercepts
|
|
came through that telephone companies are required by law to give the minimal
|
|
cooperation neces- sary. In the State of NewJersey, for instance, there is a
|
|
new phone building in North Jersey that has a separate room to house the
|
|
intercept equipment with space for any law enforcement goodies (slaves, etc.)
|
|
to live and work. New cellular switching stations are put~ng an appearance
|
|
outside for empty TSO's so the cops don't bother them all the time. The
|
|
routine is: Show me some paper-go hook up.
|
|
|
|
It does happen.
|
|
|
|
By understanding the concept of cellular placement and frequency allotment it
|
|
is ver,v possible to monitor cellularphone calls. Author Bill Cheek in his
|
|
fine book "Scanner Modifica- tion Handbook," published by CRB Research Books
|
|
Inc., describes cellular layout and how it can be tracked with a scanner. This
|
|
system is absolutely right-on and we are reprinting it (with permission from
|
|
Mr. Cheek and Tom Kneitel of CRB Research) here in full as our first find 'em
|
|
technique.
|
|
|
|
Table 3-1
|
|
CELLULAR BAND FREQUENCY ALLOCATIONS
|
|
|
|
Wireline (telephone company) cell sites
|
|
(bases): 880.020- 889.980
|
|
|
|
Wireline (telephone company) mobiles
|
|
(car phones): 835.020 - 844.980
|
|
|
|
Non-wireline company cell site
|
|
(bases): 870.030- 879.990
|
|
|
|
Non-wireline company mobiles
|
|
(car phones): 825.030 - 834.990
|
|
|
|
Since cellular systems are computer con- trolled and operated, the digital
|
|
data channels are always going full blast with an annoying buzzsaw sound.
|
|
These control frequencies are shown in Table 3-2.
|
|
|
|
Table 3-2
|
|
CELLULAR MOBILE TELEPHONE COMPUTER
|
|
CONTROL FREQUENCIES
|
|
|
|
Wireline (telephone company) cell site
|
|
(bases): 880.020 - 880.620
|
|
|
|
Wireline (telephone company) mobiles
|
|
(car phones): 835.020 - 835.620
|
|
|
|
Non-wireline company cell site
|
|
(bases): 879.390 - 879.990
|
|
|
|
Non-wireline company mobiles (car phones): 834.390 - 834.990 With 30 kHz
|
|
channel- spacing, in a typical 870 to 880 MHz, or 880 to 890 MHz system, there
|
|
are twenty-one computer control channels and 312 channels for voice, for a
|
|
total of 333 channels for each service provider. This, then, breaks down into
|
|
what might be considered several voice bands for cell sites and mobiles:
|
|
|
|
Band #1 870.030 to 879.360 MHz
|
|
(Non-wireline cell sites)
|
|
|
|
Band #2 880.650 to 889.980 MHz
|
|
(Wireline cell sites)
|
|
|
|
Band #3 835.650 to 844.980 MHz
|
|
(Non-wireline mobiles)
|
|
|
|
Band #4 825.030 to 834.360 MHz
|
|
(Wireline mobiles)
|
|
|
|
The bases (cell cites) use more power than the mobile units, and have antenna
|
|
systems that are higher and more formidable than the mobile units. As a
|
|
result, the cell sites present strong signals. Moreover, in almost all in-
|
|
stances, the cell sites transmit both sides of all conversations inasmuch as
|
|
they repeat the received signals from the mobile phones with which they are in
|
|
communication.
|
|
|
|
You might wish to refer to Tables 3-3 and 3-4 which depict the unique
|
|
frequency layout for up to seven cells. This is a complete cellular system
|
|
frequency layout plan for wireline and non-wireline systems. Visualize a
|
|
system this way: In order to avoid adjacent (side-by-side) cells from having
|
|
the same frequencies to interfere with one another, seven cells are required;
|
|
one at the center and six more sur- rounding the center cell. There is no
|
|
particular pattern as to how Cells "A" through "G" have to be laid out. That
|
|
is, Cell "D" can just as readily be a center cell with the others circling it,
|
|
as could any other combination. In a metro system consisting of many cells,
|
|
there isn't any such thing as a "center" cell, because every cell is, in
|
|
effect, a "center cell" with respect to six others which surround it.
|
|
|
|
Generally speaking, two cells can (and do) operate on the same frequencies
|
|
when they are separated by at least one different cell. Actually, the seven
|
|
cell system unit as depicted in Figure 3-1 is used over and over. Two or even
|
|
more adiacent cells on different frequencies are located between any two cells
|
|
on the some frequencies. The cellular concept thus takes advantage of low
|
|
powered, short range 800 MHz propagation to reuse the same frequencies at
|
|
several different cell sites in a large metro region. If this weren't
|
|
possible, then only 312 simultaneous conversations could take place at any one
|
|
time, as it is thousands of simuIta- neous conversations could be accommodated
|
|
within a large cellular system, thanks to fre- quency reuse.
|
|
|
|
Another factor here is the unique side effect of Frequency Modulation (FM)
|
|
where an FM receiver exclusively "hears" the stronger of two signals presented
|
|
to it on the same frequency.
|
|
|
|
So when cells on the same frequency are separated by one or more cells, even
|
|
though a mobile might be positioned to detect signals from either, it actually
|
|
will accept only the strongest one. The odds are very slim of the mobile being
|
|
located precisely where the two signals are exactly equal. But even in that
|
|
case, the odds against interference are improved even more because chances are
|
|
virtually certain that the mobile would be under the control of a stronger
|
|
third cell site signal on a different frequency.
|
|
|
|
Not only do two adjacent cells use the same frequencies, but no two cells
|
|
use adjacent frequencies. For example, a given cell (Cell "D") that transmits
|
|
on 880.950 MHz will not trans- mit on 880.980 MHz nor on 880.920 MHz.
|
|
Likewise, mobiles within any given cell will not transmit on adjacent
|
|
frequencies. This arrangement prevents adjacent channel inter- ference in
|
|
receivers located at cell sites and mobile units. FM receivers are not very
|
|
selective to begin with, and the use of adjacent channels would cause
|
|
interference within a cell. The scheme depicted in Tables 3-3 and 3-4 was
|
|
created to minimize the chances of adja- cent channel interference throughout
|
|
the entire cellular system. Note that each cell is allocated 47 or 48
|
|
frequencies, with a spacing of 210 kHz (seven channels) between each assigned
|
|
frequency. In that manner, adjacent frequencies are not used in the same or
|
|
adjacent cell sites.
|
|
|
|
DISCUSSION OF FIGURE 3-1:
|
|
Figure 3-1 illustrates the concept of a very large cellular mobile telephone
|
|
system. Cities and metro complexes are rarely symmetrical due to geographical
|
|
and other considerations, so Figure 3-1 is elongated to simulate the
|
|
configuration of a realistic cellular network.
|
|
|
|
Cities tend to grow along railroads, rivers, and major highways, so the
|
|
cellular system here is designed accordingly. Most are not this large, with
|
|
the typical system consisting ofthree to seven cells. Small communities might
|
|
even be served with a single cell, while metro areas like Los Angeles and New
|
|
York City might consist of a number of interconnected systems fanned out to
|
|
form a huge network. Frankly, size doesn't matter, because of low power, short
|
|
range, and frequency reuse. The potential size of a cellular system is
|
|
unlimited, so let's use Figure 3-1 to discuss how a "typical" system is
|
|
structured:
|
|
|
|
FIGURE 3-1.
|
|
TYPICAL CELLULAR SYSTEM LAYOUT
|
|
|
|
1. Cells of the same letter operate on same frequency groups. See Tables 3-3 &
|
|
3-4.
|
|
|
|
2. Numerical designator distinguishes cells of the same letter/frequency
|
|
group-otherwise there is no difference.
|
|
|
|
3. Two companies are permitted to operate cellular systems in any given metro
|
|
area. The two systems will be laid out functionally as shown above, even
|
|
though the physical layout will be different.
|
|
|
|
1. A hexagon is used to depict a cell's coverage territory, but the actual
|
|
coverage wouldn't be that shape; it would be more-or-less circular,
|
|
depending upon terrain and geogra- phy. However, circles don't illustrate
|
|
the cellular concept as well as hexagons, and that is why hexagons are
|
|
usually used in diagrams of cellular systems.
|
|
|
|
2. No two adjacent cell cites use the same frequencies. In other words, two
|
|
Cell "A's" are never side-by-side, nor two Cell "B's," nor Cell "C's," etc.
|
|
At least one cell site on different frequencies is always located between
|
|
two other cell sites that are assigned the some frequencies.
|
|
|
|
3. No two adjacent cell sites are assigned adjacent frequencies. So, Cells "A"
|
|
and "B" are never located next to each other. Neither are Cells "A" and
|
|
"G," or "B" and "C," etc. At least one different cell site is always
|
|
located between two other cell sites that are assigned adjacent
|
|
frequencies.
|
|
|
|
Summary: Each cell site is always assigned frequencies that differ by 60 kHz
|
|
or more from cell sites that are adjacent to it.
|
|
|
|
FIGURE 3-1
|
|
TYPICAL
|
|
CELLULAR
|
|
SYSTEM
|
|
LAYOUT
|
|
|
|
This information, while perhaps boring to lay readers, might be very useful
|
|
or handy to persons such as law enforcement officers performing
|
|
court-warranted electronic surveil- lance on cellular conversations of a drug
|
|
dealer-in-as-much as DEA and other enforce- ment officials have long been
|
|
aware that cellular phones have become heavily used by drug traffickers.
|
|
|
|
So, let's say that an authorized surveillance is taking place and the
|
|
suspect is monitored on 880.740 MHz, which is depicted in Table 3-1 under Cell
|
|
"D." Everything's fine, and the suspect starts to advise his party to meet him
|
|
at -, and then right at the crucial moment, the suspect's car enters the
|
|
control of a differ- ent cell site, and presto, the channel goes dead.
|
|
|
|
Putting the scanner into "Limit Search" mode in an attempt to track the
|
|
conversation would bring only frustration; might as well have a cup of coffee
|
|
and call it quits for the night. Chances are that the suspect's resumed
|
|
conversation will not be encountered. The "Search" mode tracks in a linear,
|
|
consecutive- frequency order, either higher or lower. If the suspect's
|
|
conversation should be relocated, it would certainly take a while.
|
|
|
|
There would, however, be a way of increas- ing the chances of zeroing back
|
|
in on the suspect. First, the scanner would have to be programmed with each
|
|
individual cellular frequency in order by cell sites as depicted in Table 3-3
|
|
or 3-4. For such an operation, it would be highly beneficial to be working
|
|
with a Realistic PRO-2004/2005 that has undergone the 6,400 channel memory
|
|
modification outlined in this book (ed. note-Bill's book) (MOD-16) so that
|
|
wireline and non-wireline cell site channels could be programmed.
|
|
|
|
There wouldn't be any reason to program any of the data-only control
|
|
channels, but the scanner could be programmed with Channel 1 = 880.650 MHz;
|
|
Channel 2 = 880.860 MHz; Channel 3 = 881.070 MHz, etc. Channel 40 would have
|
|
888.840 MHz, then continuing with Ch. 41 = 889.050 MHz and ending all Cell
|
|
"A's" programming with Ch. 45 = 889.890.
|
|
|
|
Then, all zeros would be entered into Ch. 45 to 50, with Cell "B"
|
|
programming as: Ch. 51 = 880.680 MHz; Ch. 52. = 880.890 MHz; through Ch. 95 =
|
|
889.920 MHz. All zeros would go into Ch. 95 to 100, and Cell "C" program- ming
|
|
would start in Ch. 101 with 880.710 MHz. Get the picture?
|
|
|
|
When completed, the wireline company's 312 voice channel's would have been
|
|
pro- grammed into the agency's scanner, organized by cell sites and frequency
|
|
allocations.
|
|
|
|
This would be particularly useful to the surveillance officer because, as
|
|
noted earlier, when a mobile unit passes from one cell to another, the new
|
|
frequency will not be in the old cell's assignment nor will it be an adjacent
|
|
frequency!
|
|
|
|
Therefore, one could logically eliminate the frequency assignments of three
|
|
cells from any consideration. So, when the suspect's conversa- tion gets
|
|
handed off from one cell to another, up to three scan banks that are known not
|
|
to contain the call are deselected.
|
|
|
|
The scanner could then check for the re- sumed conversation on the remaining
|
|
sites and probably locate same rather quickly, as in the example following the
|
|
frequency tables.
|
|
|
|
CELL A CELL B CELL C CELL D CELL E CELL F CELL C
|
|
-I- ======= ======= ======= ======= ======= ======= =======
|
|
wireline 889 890 889 920 889 950 889 980
|
|
company cell889 680 889 710 889 740 889 770 889 800 889 830 889 860
|
|
site x-mit 889 470 889 500 889 530 889 560 889 590 889 620 889 650
|
|
& mobile 889 260 889 290 889 320 889 350 889 380 889 410 889 440
|
|
receive 889 050 889 080 889 110 889 140 889 170 889 200 889 230
|
|
frequeencies888 840 888 870 888 900 888 930 888 960 888 990 889 020
|
|
888 630 888 660 888 690 888 720 888 750 888 780 888 810
|
|
888 420 888 450 888 480 888 510 888 540 888 570 888 600
|
|
888 210 888 240 888 270 888 300 888 330 888 360 888 390
|
|
888 000 888 030 888 060 888 090 888 120 888 150 888 180
|
|
887 790 887 820 887 850 887 880 887 910 887 940 887 970
|
|
887 580 887 610 887 640 887 670 887 700 887 730 887 760
|
|
887 370 887 400 887 430 887 460 887 490 887 520 887 550
|
|
887 160 887 190 887 220 887 250 887 280 887 310 887 340
|
|
886 950 886 980 887 010 887 040 887 070 887 100 887 130
|
|
886 740 886 770 886 800 886 830 886 860 886 890 886 920
|
|
886 530 886 560 886 590 886 620 886 650 886 680 886 710
|
|
886 320 886 350 886 380 886 410 886 440 886 470 886 500
|
|
886 110 886 140 886 170 886 200 886 230 886 260 886 290
|
|
885 900 885 930 885 960 885 990 886 020 886 050 886 080
|
|
885 690 885 720 885 750 885 780 885 810 885 840 885 870
|
|
885 480 885 510 885 540 885 570 885 600 885 630 885 660
|
|
Voice 885 270 885 300 885 330 885 360 885 390 885 420 885 450
|
|
Channels 885 060 885 090 885 120 885 150 885 180 885 210 885 240
|
|
884 850 884 880 884 910 884 940 884 970 885 000 885 030
|
|
884 640 884 670 884 700 884 730 884 760 884 790 884 820
|
|
884 430 884 460 884 490 884 520 884 550 884 580 884 610
|
|
884 220 884 250 884 280 884 310 884 340 884 370 884 400
|
|
884 010 884 040 884 070 884 100 884 130 884 160 884 190
|
|
883 800 883 830 883 860 883 890 883 920 883 950 883 980
|
|
883 590 883 620 883 650 883 680 883 710 883 740 883 770
|
|
883 380 883 410 883 440 883 470 883 500 883 530 883 560
|
|
883 170 883 200 883 230 883 260 883 290 883 320 883 350
|
|
882 960 882 990 883 020 883 050 883 080 883 110 883 140
|
|
882 750 882 780 882 810 882 840 882 870 882 900 882 930
|
|
882 540 882 570 882 600 882 630 882 660 882 690 882 720
|
|
882 330 882 360 882 390 882 420 882 450 882 480 882 510
|
|
882 120 882 150 882 180 882 210 882 240 882 270 882 300
|
|
881 910 881 940 881 970 882 000 882 030 882 060 882 090
|
|
881 700 881 730 881 760 881 790 881 820 881 850 881 880
|
|
881 490 881 520 881 550 881 580 881 610 881 640 881 670
|
|
881 280 881 310 881 340 881 370 881 400 881 430 881 460
|
|
881 070 881 100 881 130 881 160 881 190 881 220 881 250
|
|
880 860 880 890 880 920 880 950 880 980 881 010 881 040
|
|
880 650 880 680 880 710 880 740 880 770 880 800 880 830
|
|
|
|
Digital 880 440 880 470 880 500 880 530 880 560 880 590 880 620
|
|
COntrOI 880 230 880 260 880 290 880 320 880 350 880 380 880 410
|
|
ChannelS 880 020 880 050 880 080 880 110 880 140 880.170 880.200
|
|
|
|
|
|
Non_wireline company cell site transmit & mobile receive frequencies
|
|
|
|
CELLA CELL B CELL C CELL D CELL E CELL F CELL G
|
|
======= ======= ======= ======= ======= ======= =======
|
|
Digital 879.900 879.930 879.960 879.990
|
|
Control 879.690 879.720 879.750 879.780 879.810 879.840 879.870
|
|
Channels 879.480 879.510 879.540 879.570 879.600 879.630 879.660
|
|
879.270 879.300 879.330 879.360 879.390 879.420 879.450
|
|
879.060 879.090 879.120 879.150 879.180 879.210 879.240
|
|
878.850 878.880 878.910 878.940 878.970 879.000 879.030
|
|
878.640 878.670 878.700 878.730 878.760 878.790 878.820
|
|
878.430 878.460 878.490 878.520 878.550 878.580 878.610
|
|
878.220 878.250 878.280 878.310 878.340 878.370 878.400
|
|
878.010 878.040 878.070 878.100 878.130 878.160 878.190
|
|
877.800 877.830 877.860 877.890 877.920 877.950 877.980
|
|
877.590 877.620 877.650 877.680 877.710 877.740 877.770
|
|
877.380 877.410 877.440 877.470 877.500 877.530 877.560
|
|
877.170 877.200 877.230 877.260 877.290 877.320 877.350
|
|
876.960 876.990 877.020 877.050 877.080 877.110 877.140
|
|
876.750 876.780 876.810 876.840 876.870 876.900 876.930
|
|
876.540 876.570 876.600 876.630 876.660 876.690 876.720
|
|
876.330 876.360 876.390 876.420 876.450 876.480 876.510
|
|
876.120 876.150 876.180 876.210 876.240 876.270 876.300
|
|
875.910 875.940 875.970 876.000 876.030 876.060 876.090
|
|
875.700 875.730 875.760 875.790 875.820 875.850 875.880
|
|
875.490 875.520 875.550 875.580 875.610 875.640 875.670
|
|
875.280 875.310 875.340 875.370 875.400 875.430 875.460
|
|
voice 875.070 875.100 875.130 875.160 875.190 875.220 875.250
|
|
channels 874.860 874.890 874.920 874.950 874.980 875.010 875.040
|
|
874.650 874.680 874.710 874.740 874.770 874.800 874.830
|
|
874.440 874.470 874.500 874.530 874.560 874.590 874.620
|
|
874.230 874.260 874.290 874.320 874.350 874.380 874.410
|
|
874.020 874.050 874.080 874.110 874.140 874.170 874.200
|
|
873.810 873.840 873.870 873.900 873.930 873.960 873.990
|
|
873.600 873.630 873.660 873.690 873.720 873.750 873.780
|
|
873.390 873.420 873.450 873.480 873.510 873.540 873.570
|
|
873.180 873.210 873.240 873.270 873.300 873.330 873.360
|
|
872.970 873.000 873.030 873.060 873.090 873.120 873.150
|
|
872.760 872.790 872.820 872.850 872.880 872.910 872.940
|
|
872.550 872.580 872.610 872.640 872.670 872.700 872.730
|
|
872.340 872.370 872.400 872.430 872.460 872.490 872.520
|
|
872.130 872.160 872.190 872.220 872.250 872.280 872.310
|
|
871.920 871.950 871.980 872.010 872.040 872.070 872.100
|
|
871.710 871.740 871.770 871.800 871.830 871.860 871.890
|
|
871.500 871.530 871.560 871.590 871.620 871.650 871.680
|
|
871.290 871.320 871.350 871.380 871.410 871.440 871.470
|
|
871.080 871.110 871.140 871.170 871.200 871.230 871.260
|
|
870.870 870.900 870.930 870.960 870.990 871.020 871.050
|
|
870.660 870.690 870.720 870.750 870.780 870.810 870.840
|
|
870.450 870.480 870.510 870.540 870.570 870.600 870.630
|
|
870.240 870.270 870.300 870.330 870.360 870.390 870.420
|
|
870.030 870.060 870.090 870.120 870.150 870.180 870.210
|
|
======= ======= ======= ======= ======= ======= =======
|
|
|
|
|
|
EXAMPLE
|
|
|
|
Suspect is on a frequency in Cell "D" when the call is switched. The officer
|
|
immediately knows that the new cell will not be "C," "D," or "E," so those are
|
|
deselected and the scanner does not bother with them. The suspect will be on
|
|
only one of about 180 possible frequencies, which the officer could locate
|
|
within thirty seconds or less if he knows what to do and can react quickly
|
|
enough. If he had unsuccessfully used the "search" to look for resumed
|
|
conversa- tions, there were more than 300 frequencies to check through that
|
|
way. Note: If the suspect was originally in Cell "A," then Cells "B" and "G"
|
|
can be eliminated as possibilities. Likewise, if the original call was in Cell
|
|
"G," then calls from Cells "A" and "F" would be eliminated.
|
|
|
|
Remember: Cells of the same and/or adjacent frequencies are never physically
|
|
located next to another! A judicious law enforcement surveil- lance expert
|
|
would use both the "scan banks" and the "search" feature as tools to relocate
|
|
a handed-off cellular conversation.
|
|
|
|
Note: Cellular handoffs occur quite rapidly, especially when a mobile goes
|
|
from one cell through the fringe area of a second and then soon after into a
|
|
third cell. The two handoffs could take place within seconds, and a search for
|
|
the first handoff could well be in progress when the second handoff takes
|
|
place. That's when a cell map of a particular area or system would come in
|
|
handy.
|
|
|
|
Since the time Bill calculated the above information, new frequencies have
|
|
been allocated to cellular companies as follows:
|
|
|
|
824.010 - 834.990 Mobiles non-wireline A
|
|
835.020 - 844.980 Mobiles wireline B
|
|
845.010 - 846.480 Mobiles non-wireline A
|
|
846.510 - 849.000 Mobiles wireline B
|
|
|
|
869.010 - 879.990 Bases non-wireline A
|
|
880.020 - 889.980 Bases wireline B
|
|
890.010 - 891.480 Bases non-wireline A
|
|
891.510 - 894.000 Bases wireline B
|
|
|
|
It would be a simple matter to create the same frequency-cell tables with
|
|
these new frequencies.
|
|
|
|
OUR OWN REFINEMENTS:
|
|
I sat in on a cellular phone interception project with a couple of law
|
|
enforcement types during the writing of this book using an offshoot of Bill's
|
|
idea. Here's how they did it:
|
|
|
|
The target was operating in a major metropoli- tan city in the U.S. with a
|
|
number of hills and dead airvalleys. The LPwas situated in a house on a hill
|
|
that overlooked much of the city.
|
|
|
|
The LP was equipped with an ICOM 7000 receiver and a non-directional 800
|
|
sensitive antenna. The ICOM had been modified slightly by clipping an intemal
|
|
lead which allowed it to receive a baud rate of 9600.
|
|
|
|
The receiver was connected to an IBM PC clone that was loaded with a
|
|
frequency scan- ning program called Program 801. The local frequency banks
|
|
were programmed into the computer and we had a colleague watching the target's
|
|
residence.
|
|
|
|
When the target left his residence, the watcher called us on his cellular
|
|
phone and so informed us-we began scanning.
|
|
|
|
Within a few moments we had identified the subject by both his voice and the
|
|
subject of the conversation on a certain cell. When a handoff to another cell
|
|
occurred, the F4 key was stroked on the computer and it began to look through
|
|
the logical frequencies.
|
|
|
|
Did it work? The intercept was conducted on a weekend so, admittedly, the
|
|
traffic was light but in every case we found the target within a few seconds.
|
|
The maximum conversation loss was at most, 20 seconds.
|
|
|
|
The ICOM and the elevated listening post followed the target through each
|
|
and every cell as he changed position. There was NO cell that he accessed that
|
|
we could not receive from our stationary LP.
|
|
|
|
INDIVIDUAL CELLULAR TAILING
|
|
Another system tested for this book which proved luite invigorating was to
|
|
take a Motorola bench equency counter and equip it with a directional antenna.
|
|
This set up allowed me to follow a icular subject from a distance of 100-200
|
|
feet ~d simply read the operating frequency of his cellular whenever it was
|
|
put into use.
|
|
|
|
The keys to this system are to use a 12 volt bench counter with high
|
|
sensitivity and a gain antenna. Omni direction cellular antennas are limited
|
|
by a 3 dB gain. Use at least a 5 dB gainer from the 800 business band, or,
|
|
better yet, a Yagi transmit/receive antenna from one of several antenna
|
|
suppliers.
|
|
|
|
This will make it directional but will make the entire conceptviable. Remem-
|
|
ber, although the carphone onlybroad- casts one side of the conversation, the
|
|
cell rebroadcasts both at a frequency of 45 MHz lower than the mobile channel.
|
|
When the frequency counter latches on to a frequency, a handheld scanner is
|
|
manually pro- grammed to the correct frequency and the entire conversation is
|
|
monitored.
|
|
|
|
When a handoff occurs the new frequency is quickly acquired in a similar
|
|
manner and the monitoringresumes with only a minor loss of conversation. It is
|
|
possible to drop back from the 200 foot limitation until a handoff occurs at
|
|
which time the LP car must move back into position, but only long enough for
|
|
the counter to read the new frequency. And now folks, there's a brand new tool
|
|
about to come onto the market as we speak which does a much better job than on
|
|
individual intercepts.
|
|
|
|
A TRICK
|
|
Besides the previously-detailed cellular system there used to be a pattem in
|
|
use that involved 12 cells. This gave no adjacent fre- quencies in any
|
|
adjacent cells, but most cities have given that up and gone to above, more
|
|
compact 7 factored pattem because it offers more frequencies in each cell (1
|
|
of 7 instead of 1 in 12). The current system is likely to remain around a
|
|
while because it's about as down as it can be taken without bringing in
|
|
directional antennas.
|
|
|
|
TECHNIQUES FOR INCREASING CELLULAR DENSITY
|
|
It is possible to use a 320 degree directional antenna by having a heavy
|
|
signal lobe to avoid pickups of signals from the back side from that
|
|
particular antenna segment. This gives the option to the frequency right
|
|
behind it fairly close in so we get a liffle more density in a particular
|
|
system. Another approach to get more capacity buries some low power channels
|
|
in the middle of a particular cell which are so low in power that they don't
|
|
really get out to more than half way of the radius. It is then possible to use
|
|
these same allocations somewhere else because they interfere less than the
|
|
channels that run full power.
|
|
|
|
PHONE NUMBERS AND ESN S
|
|
The actual phone number is stored in a pro- grammable chip known as a NAM. In
|
|
most parts of the country this chip must be pre- programmed with an available
|
|
number on one of the local companies before the phone can be sold, or at least
|
|
before it can be put into use. The NAM is a 16 digit chip which contains the
|
|
phone number plus other info-in older style phones they are programmed in an
|
|
EPROM. New phones have programming capability built into their handsets. The
|
|
ESN or electronic serial number (some- times referred to as Electronic
|
|
Identification Number, EIN) is not stored in the in NAM chip. At the moment
|
|
there are about 125 different phones being manufactured and they all store the
|
|
ESN in a different place in their memory in either an EPROM or a ROM. Each
|
|
company can, and does utilize separate locations and different methods of
|
|
coding. NAM's themselves can be programmed at such mundane points of purchase
|
|
as Radio Shack stores. NAM programmers are openly available for about $1,000.
|
|
What is to stop someone from cloning a phone so their cellular will ring every
|
|
time a target's does? or even so when the cloned phone makes a call, the
|
|
target w~uld he hilled?
|
|
|
|
Several things, the first being the law of the land. No clones allowed. A
|
|
larger barrier is posed by the inclusion of the (usually) nonprogrammable
|
|
electronic serial number that is often accessed with the phone number. If a
|
|
set is stolen this number is put on a com- puterized hot list which shows up
|
|
immediately when the unit is used. Some new switches are also rumored to be
|
|
able to tell if more than one phone with the same number is on line at any
|
|
given time by comparing the serial numbers in a real time situation.
|
|
|
|
Does this mean no clones?
|
|
|
|
Well, not exactly. See early phones, before somebody in power decided the
|
|
ESN's should be a permanent part of the unit, allowed both NAM and ESN
|
|
programming. When research- ing this article, I was offered a series 1 or 2
|
|
Novetel mobile phone cloned to any set of numbers I required for $600.
|
|
|
|
This is to allow busy executives the opffon to have an extension mobile but
|
|
it could also be rigged to act as an unscrupulous clone, ringing and recording
|
|
every call made to the target number.
|
|
|
|
I have also been told of black market chips that can replace the ESN chips
|
|
in modem phones. The FCC doesn't like these, the phone associations don't like
|
|
these and even, yes, the FBI don't like these...
|
|
|
|
Although most people don't realize it, cellulars broadcast a super audible ID
|
|
tone along with the normal audio. The operator will not hear this because it's
|
|
filtered out, but it provides three choices for security, helping to make
|
|
certain that only one phone is on the system at any one time. The system
|
|
listens to what id tone is offered and if it's the wrong one, it'll disconnect
|
|
the offender.
|
|
|
|
This feature is designed to protect against radio propagaffon faults wherein
|
|
the signal comes back to the base too strong and over- powers the desired
|
|
signal but it is also a factor in cloning because the system will allow 5
|
|
seconds for the proper signal and then it willdisconnect the "wrong" signal
|
|
automatically. Not a perfect system, but one that must be taken into account
|
|
for any cloning attempt.
|
|
|
|
In fact, there are modified cellulars on the black market that the various
|
|
government agencies lLke even less than they do clones. I was also offered a
|
|
modified phone that would come up with a random and differentESN and serial
|
|
number every time it was used for $2500!
|
|
|
|
This option lets the user put the phone into the roam mode so it would
|
|
access this "traveler's" feature on every call but bill it to a different
|
|
number each time.
|
|
|
|
At first glance this seems to be the ideal (criminal) way to beat phone
|
|
charges since the unit will bill to a different number on every call the
|
|
operator will not be bothered by those annoying little notices from the local
|
|
telco every month.
|
|
|
|
But the real selling feature of this type of phone is that it cannot be
|
|
legally monitored. If a law enforcement agency gets a court order to monitor a
|
|
particular telephone (identified by the phone number) it will not be valid,
|
|
and in fact will not work if the unit in question changes its identity like
|
|
some sort of maddened electronic chameleon every time it is used...
|
|
|
|
Bet the farm I ain't the only person who has been offered one of these
|
|
phones...
|
|
|
|
In fact, one basic cellular flaw is considered to be the existence of fraud.
|
|
The rules of the FCC and the Canadian Department of Commu- nication require
|
|
portable phones have an unchangeable identification in a read-only memory in
|
|
the set. The wording says it should not be possible to modify the
|
|
identification without rendering the set inoperative. One industry study
|
|
recently reported that it was possible, with varying degrees of difficulty, to
|
|
change the identification in about 80% of the sets which are now out in the
|
|
field.
|
|
|
|
Fraud, fake, and oscillating ESN numbers are estimated to account for
|
|
somewhere between 4% of the industry's gross billing.
|
|
|
|
One of the inducements to fraud is that when a mobile identifies itself, the
|
|
local system has to decide if it should query the mobile for the full 10
|
|
digits or only 7 of the actual phone number? Should the ESN be required? Some-
|
|
times the operating company, to save on transmission time, cuts down on the
|
|
number of digits that are transferred in these opera- tions, especially at
|
|
rush hour.
|
|
|
|
Regardless of the saturation ad campaigns for cellular use, the systems are
|
|
filling up fast and most claim to operate at only marginally profitable
|
|
levels, yet corporations are always interested in purchasing cellular
|
|
companies. Why?
|
|
|
|
They're buying future potential. Capacity limitation will become a thing of
|
|
the past when digital cellular comes into play (scheduled to be the norm
|
|
within five years) because digital systems can multiplex 3 or more
|
|
conversations on each channel.
|
|
|
|
The technique has been standardized al- ready. There is digital equipment on
|
|
the market available for use with the proper support equipment already
|
|
although all the in-place equipment will be continued to be supported for
|
|
several years, probably until the end of the century, but digital will
|
|
gradually take over the market as surely as color television edged out black
|
|
and white.
|
|
|
|
Digital has several appetizing features for cellular users. It involves using
|
|
a digital code technique for speech to use 16,000 bytes per second per radio
|
|
channel, per conversation. This, plus 3-5 different conversations on each
|
|
channel, simultaneously will make the format secure from casual eavesdroppers.
|
|
|
|
Without a doubt scanner adaptable modules will be marketed to decipher and
|
|
demultiplex digital cellular, but from the point of view of security, the
|
|
important thing is that when digital speech coding is present one can take
|
|
advantage of these superior techniques inher- ent in encrypting digital
|
|
signals as opposed to the problems of scrambling analog dialogue.Systems are
|
|
now available (see the scrambling section) which will lock out almost
|
|
everybody but are still not considered military level secure. Digital
|
|
suppliers will probably offer a option for secrecy levels than it is to
|
|
constructively distort voice transmissions.
|
|
|
|
If you need to have a sensitive conversation during a mobile situationyou
|
|
have two choices, use a digital scrambler, or stop and use a coin phone by the
|
|
side of the road.
|
|
|
|
Remember this fact.
|
|
|
|
At one point I took a mobile phone and made a call to a friend and for about
|
|
15 min- utes, in the middle of a normal business day, drove around running a
|
|
tape asking anyone who was listening in on a scanner to give me an anonymous
|
|
phone call for a research study.
|
|
|
|
In the city of San Francisco I got three calls from casual listeners.
|
|
|
|
And these were just the people who bothered to call...
|
|
|
|
DATA AND FUTURE MODES
|
|
Because cellular was designed for audio and, at this writing, uses analog FM
|
|
transmission, it is difficult to transmit data over the system even though
|
|
mobile faxes and modems are available.
|
|
|
|
Using an ordinary data modem of the type that would be utilized on a
|
|
landline telephone, provides less than normal service. One problem is that as
|
|
the position changes the mobile passes through a combination of direct and
|
|
reflected radio waves which can get out of phase with each other and produce a
|
|
phenom- enon called multipath which means that the RF signal is going
|
|
constantly up and down like an elevator. The resulting conglomerate is okay
|
|
for speech but for data it's a no-no.
|
|
|
|
In most cases the solution to this is to stop the car. Immediately the
|
|
quality will improve and reasonable results will occur AS LONG AS A LOW BAUD
|
|
RATE IS MAINTAINED. This is important in digitally-scrambled transmissions, as
|
|
well as in data swapping, as well as with mobile FAX transmissions.
|
|
|
|
Any rate over 2400 is likely to cause some problems.
|
|
|
|
A new possibility for increasing the availabil- ity of cellular channels has
|
|
already been brought before the FCC. This new system is microcellular in
|
|
design and uses spread spec- trum technology.
|
|
|
|
The company that requested a license for this technology (Millicom) has
|
|
requested a frequency band in the 1710-2290 MHz region.
|
|
|
|
Great Britain is testing out a very short range RF-based system known as
|
|
Telepoint. This concept gives the user a small, portable unit for a base fee
|
|
of $12-$15 per month that can be used as a wireless/cellular phone only when
|
|
the operator is within 300 feet of a clearly marked base station.
|
|
|
|
Many base stations can be located in any given area because they cost only a
|
|
fraction of a cellular site and they are extremely low in power.
|
|
|
|
TAPPING CELLULARS
|
|
At first glance it seems to be an oxymoron- why tap a cellular? I mean the
|
|
damn things broadcast over the public air waves with 600 beautiful milliwatts
|
|
of power. Who needs to tap?
|
|
|
|
Some people, that's who. Someone out there needs to tap anything and right
|
|
at this mo- ment there are about 32 readers wondering how to tap a cellular.
|
|
|
|
The quickest method to hear at least one side of any conversation is simply
|
|
to secret a VOX activated tape recorder in the car. And hope the driver
|
|
doesn't play the stereo too loudly...
|
|
|
|
Saul Mineroff offers a car caddy, you know, one of those things that holds a
|
|
Big Mac and a drink and slips over the transmission console, with a great
|
|
little stereo recorder built right into the unit.
|
|
|
|
It would make a nice gift for, say your wife...
|
|
|
|
Olympus Corporation markets (available from C.I.A., the company, not the
|
|
company) a series of drop out recorders for cellular phones. These liffle
|
|
boxes connect between the handset and the phone and operate just like a
|
|
regularrecord both sides of the conversation when the phone is taken off hook.
|
|
|
|
These units, called Woodbury Interfaces, are not designed to be hidden but
|
|
are supposed to be used to record one's own conversations (legal in one-party
|
|
states) for later study.
|
|
|
|
They can be used somewhat surreptitiously by stashing them, along with a
|
|
mini recorder, in some sort of camouflaged unit like the Mineroff car caddy,
|
|
or even installed under the phone itself or under the upholstery.
|
|
|
|
Two elements necessary for success here are access to the target vehicle and a
|
|
not overly observant driver.
|
|
|
|
AID makes a bug that is concealed in a rechargeable Motorola-type battery
|
|
for portable phones. This unit works off the battery, which still operates the
|
|
phone, and picks up and transmits local conversation.
|
|
|
|
It would be possible to design some sort of infinity transmitter for a
|
|
cellular, although each make of phone is different enough to require some
|
|
uptown design work and when the transmitter was in operation, all the air time
|
|
would be billed to the target, allowing him a nice printout of the connection.
|
|
|
|
A wiser move would be to employ some sort of hookswitch bypass so the phone
|
|
would be hot on hook and broadcast the local audio. However, even this
|
|
technique has problems because it could easily cause interference problems
|
|
with other phones and might alarm the switch because more than one phone would
|
|
be on a single channel.
|
|
|
|
A quick thought: You want to record a cellular conversation that you are
|
|
part of without alerting anyone else in the car? Think ear mic's (devices that
|
|
receive and transmit inside the user's ear and look like a miniature earphone)
|
|
put one in your ear and have a conversation.
|
|
|
|
The DEA recently bought 1,000 of these from, well, from an unnamed New York
|
|
sup- plier.
|
|
|
|
A cellular phone can also be "accidentally" left operating after a call is
|
|
made to a recording phone. If l~ ehind ~n a ~u~iness conference, it will work
|
|
as a long distance bug. Some portable cellulars are now made with a hot switch
|
|
so they will broadcast to a nearby re- ceiver for the same sort of "forgetful"
|
|
bug~in~.
|
|
|
|
|
|
"CELLULAR PHONES ARE IMPOSSIBLE TO MONITOR"
|
|
|
|
|
|
|
|
RIGHT
|
|
|