Cryptome DVDs. Donate $25 for two DVDs of the Cryptome collection of 47,000 files from June 1996 to January 2009 (~6.9 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. The collection includes all files of cryptome.org, cryptome.info, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org, and 23,100 (updated) pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985.The DVDs will be sent anywhere worldwide without extra cost.

25 June 1998

To: cypherpunks[at]cyberpass.net
Subject: cell phone COMINT
Date: Wed, 24 Jun 98 20:30:03 -0700
From: "Vladimir Z. Nuri" <vznuri[at]netcom.com

------- Forwarded Message

Date: Wed, 24 Jun 1998 13:02:09 -0500
To: believer[at]telepath.com
From: believer[at]telepath.com
Subject: IP: "COMINT Goes to Cell Hell"

Source:  Journal of Electronic Defense, June 1998 issue

http://www.jedefense.com (Registration is free)

COMINT Goes to Cell Hell

by Zachary Lum

Modern wireless communications - the cell phone especially - pose unique
problems for military COMINT. (File photo)

Wireless communications may soon achieve everyday household status,
worldwide. For the communications-intelligence (COMINT) trade, this could
be one of the greatest boons borne of the commercial telecommunications
revolution. Or it could be one of the greatest banes. Or it could be both.
Opinion seems to vary from expert to expert.

Paradox and uncertainty are perhaps to be expected in the tumult of an
information revolution, with its as yet unknown fallout for intelligence
collection. The mobile cellular telephone, the most widespread wireless
system, is a crossover technology. It originated in the civilian
mass-communications marketplace, but it is spreading inexorably to
applications of interest to the national or military intelligence
community: criminal and terrorist uses, battlefield C3 and strategic comms.
Compared to the standard FM radio, the cellular radio (technically the more
correct term for a cell "phone," since it broadcasts its signal through the
air) is cheaper, easier to acquire and more difficult to monitor, which
makes it a popular choice for, for instance, criminal organizations in need
of mobile communications - and makes it a headache for the law-enforcement
organizations conducting surveillance against them.

As a form of general telephony, however, wireless media (and cellular
communications systems in particular) are quite vulnerable when compared to
old-fashioned telephone land lines. The explosion in wireless networks has
actually created a new and fertile frontier for COMINT exploitation. This
frontier will only grow as new, digital cellular standards become
commonplace, and as remote or underdeveloped parts of the world see rapid
penetration by cellular and eventually satellite communications. Today, the
world's airwaves are already crisscrossed with millions of conversations,
ripe for the picking. Just a few years ago, many of these transmissions
would have stayed snugly in insulated telephone wires.

Had they done so, the world would not have been privy to the infamous
"squidgey" tapes, the 1993 mobile-phone dalliance of Britain's Prince
Charles and his mistress, which was intercepted, transcribed and published
in the London tabloids. Neither would someone have been able to intercept
and distribute the contents of a 1997 telephone conference held by US House
Speaker Newt Gingrich.

Of course, there's COMINT and then there's COMINT. A cellular network can
present different levels of difficulty, depending on the interceptor's
objectives and the type of wireless system under scrutiny. The hobbyist
interested in scanning the cellular frequencies in search of random
conversations could probably find the necessay equipment at the local
electronics mart. An NSA-type organization that intends to capture, track
and sift through the entire cellular traffic of, say, a major urban area,
in search of a particular target, faces very different equipment
requirements - the kind that tend to be unpublishable in the open press.

THE ABCs OF CELLULAR

Fig. 1 A typical cellular communications network. COMINT is usually applied
between the mobile station and the base station transmitter. (Thomson-CSF
Communications photo)

The cellular telephone network consists of three basic components (see
Figure 1): the mobile telephone switching office (MTSO), the base station
system and the mobile station (the actual cellular "phone" unit).

The MTSO is the network's brain, the central computer that controls the
hundreds of thousands of communications occurring within its service area
(delineated by a cluster of base stations). The MTSO allocates frequency
and power use among base stations and mobile units, and it switches calls
within the cellular system and between the system and the public switched
telephone network. Its databases contain subscriber location information
and interface with other systems to identify and validate users attempting
to access the network.

The MTSO connects to its outlying base station systems through telephone
lines. Each base station system is itself a controller connected via wire
interface to several cellular transmission sites, or cell sites. Basically
a microwave transmitter/receiver with antennas mounted atop a steel tower,
the base station cell site is the end of the line - as in telephone line -
for the traveling signal. Communications between the cell site and the end
user, the mobile unit, are high-frequency, low-power (100 W maximum),
low-power line-of-sight radio transmissions; cellular frequencies range
between 824 and 960 MHz, depending on the system and the country. Each
site is responsible for a designated area of geographic coverage, usually
a radius of no more than 12.5 mi (the typical limit of a line-of-site
transmitter mounted on a 100-ft tower). These areas overlap, however, to
provide continuous communications coverage across the service provider's
entire domain. In contrast to typical radio operation, then, where a
central high-power transmitter broadcasts over a large territory, the
cellular system parcels its territory into a series of small, interlocking
"cells." Different cellular systems can in turn connect with each other to
provide region- or even country-wide coverage, as is happening in the US
today.

One of the principal advantages of a cell-based layout is its ability to
accommodate an ever growing number of users. The US cellular standard, the
Advanced Mobile Phone Service (AMPS), makes available some 660 different RF
frequencies, or channels. The MTSO will assign each of its cell sites some
subset of this total. In a densely populated urban area, however, the
number of cell-phone users could easily exceed 660 at any given time. To
handle the demand, the system must "reuse" frequencies within its pattern
of cells. In areas of heavy phone traffic, the service provider will opt

for smaller but more numerous cells, in effect increasing the number of
channels available. The caveat to this strategy is that cells sharing the
same frequencies must have enough geographic separation to prevent
co-channel interference, which occurs when a mobile station simultaneously
receives communications from two cell sites. The result is static or even
the intrusion of another conversation.

Frequency reuse is thus not possible in adjacent cells. This fact sets the
stage for the most athletic aspect of cellular operations: the "handoff."
When a mobile phone is turned on, its transceiver surveys the different
control channels (the MTSO reserves some of the cellular frequencies to
transmit command, identification and location information), locks onto the
cell site with the strongest signal and registers itself with that base
station. Using a control message, which is essentially a
frequency-modulated signal containing directive-laden data pulses, the MTSO
will assign the phone one of the available voice channels at the cell site.
As the mobile user moves from one cell to a neighboring cell, the MTSO
detects the transition and hands the phone off to a new frequency within
the new cell site.

HOW COMINT STACKS UP

AST's Model 235 is designed specifically for cellular DF. (Applied Signal
Technology photo)

The cellular system's frequency handoff characteristics, which might be
termed "slow frequency hopping," and its specialized protocols for control,
which create a kind of communications system within a communications
system, establish it as a "fairly complicated communications system," said
Brian Bedrosian, manager of narrowband communications at Applied Signal
Technology (AST), "so you need a smart [COMINT] system as opposed to just
sticking up an antenna and putting a regular receiver onto the problem."

Conducting COMINT against a cellular network invariably means targeting the
"air interface," the airbound transmissions between the microwave towers
and the roving phones. This is usually the only naked connection in the
network (although not always), as well as the only segment of the system
where it makes sense to perform intercept for the purposes of direction
finding (DF). Intercepting the signal is not the hurdle in cellular COMINT,
however, because most cellular networks in use today are analog systems,
like the US AMPS and the UK TACS standards. Their transmissions are
unextraordinary FM-type signals, which a commercially available scanning
receiver, with some simple FM demodulating, could capture quite easily.

But interception alone does not even begin to solve the cellular COMINT
challenge. The amateur electronic sleuth can buy a cheap receiver and
listen randomly to the chatter that flits through it, but that receiver
will not be able to follow any particular call as it moves from cell to
cell, frequency to frequency. Such a tracking function requires an
additional frieze of sophistication, like canny demodulation techniques to
decode the embedded control signals, thus revealing the handoff frequencies
that the receivers must follow.

With a cell phone, a computer, a few dollars' worth of parts and some
technical savvy, the individual tinkerer can indeed construct a device that
will track another cell phone, said Jim Atkinson of the Granite Island
Group (Gloucester, MA), a COMINT consulting firm and subsystems supplier.
Atkinson, a former communications engineer with the Defense Intelligence
Agency, described encounters with cellular intercept systems "that were
literally a telephone...turned it into what's called a 'vampire'.....Every
time the target's phone would ring or he'd use his phone, it would
automatically lock onto it and start a recorder going. And [the engineers]
were just using a phone [with] about $50 worth of extra circuitry on it,
and it's a piece of cake."

In basic terms, tracking requires two receivers: one to pick up the audio,
the other to divert the part of the audio path containing the control
signals, probably through the use of a frequency-shift demodulator.

What's all the rage with today's cellular pirates, Atkinson continued, is
modifying the cellular modem of a PCMCIA card with a slight, downward
frequency shift below the voice channel, and into the audio range of the
control tones. The software for doing this is available on the internet.
Plugged into a laptop, the device will scroll handoff data, control codes
and security information right across the screen, while the modem digitizes
the audio and stores it in the hard drive. "They don't even need a tape
recorder anymore," he said, "just a hard drive with a couple of gigs."

A few steps up the technology ladder are the actual name-brand
manufacturers of COMINT equipment. The marketplace is replete with systems
touted for cellular intercept, monitoring and DF. To some degree, the
commercial boom in cellular communications has helped widen the field of
anticellular intelligence-product suppliers. Joining the ranks of the
established military COMINT houses (the ASTs, Rockwells, Rohdes, Thomsons,
Marconis, Rafaels, Watkins-Johnsons and so on) are a number of peripheral
manufacturers - companies like Bartec, of Hollywood, CA; DTC
Communications, of Nashua, NH; and GCOM Technologies, based in Ireland -
who target subtactical users, like law-enforcement agencies and
telecommunications-service providers. Taking advantage of commercial
software and signal-processing technologies, these companies generally
produce briefcase-sized systems that can monitor several channels and track
a couple of calls simultaneously. The New York-based Law Enforcement
Equipment Corp., for instance, advertises a Cellular Telephone Monitoring
System that monitors 19 channels and tracks three telephone conversations
simultaneously. Electronic Countermeasures Inc., a Canadian firm, offers
the Cellular Analysis System 8000, a PC-controlled, attaché-case-based
system that can employ up to 24 receivers to monitor AMPS and D-AMPS (a
new, digital version of the old standard) voice and control channels.

For the customer with more robust intelligence requirements, the military
contractors mentioned above produce the high end of cellular COMINT. A good
example is AST's standard product, the Model 1235 Multi-Channel Digital
Receiving System. The 1235 is armed with 60 independent digital receivers,
each of which can switch among FM demodulation (analog voice signals), FSK
demodulation (control data signals) and other modes as needed. Using twin
Texas Instruments digital signal processors (DSPs), the system performs all
its processing "in software," a flexibility necessary for handling new
cellular standards as they come on line. Being digital, these receivers are
naturally adept at retuning to track cellular signals on frequency
handoffs.

NEW WRINKLES

Intercepting and monitoring cellular and PCS communications is a serious
internal-security concern for many governments. A number of small SIGINT
aircraft, like this F406 Vigilant, are oriented toward this threat.
(Thomson-CSF Communications photo)

In this big league of cellular intercept and DF, known euphemistically as
"national-level" intelligence, where some systems are monitoring hundreds
of channels over a radius of maybe 200 miles, COMINT operators are
encountering some challenges they haven't seen before.

The first is sheer volume. Wartime operators may complain about the dense
communications environment on the battlefield, but they haven't seen
anything until they've encountered a large city networked for cellular
communications. The technology has proliferated across the globe, to the
extent that it is more economical to list the countries that lack wireless
standards than the ones that have them. There are more than 50 million cell
phones in use in the US alone. Even so, Finland, Australia and Japan rank
ahead of the US in terms of cellular phone usage as a percentage of total
population.

Finding and picking out the signals of interest, whether they originate
with a local drug lord or a foreign government minister, can be quite
problematical, since the targets all use the same Motorola, Ericsson or
Nokia cell phones, and their conversations all find their way into the
telephonic cacophony of these enormous civilian networks.

The problem is exacerbated by the phenomenon of co-channel interference,
which was defined earlier. For example, an airborne SIGINT platform
orbiting a city and monitoring its cellular traffic will receive the
transmissions from the various base stations at roughly equal power. Since
the frequency reuse principle is at play among the transmit sites, the
SIGINT collector will be inundated with multiple signals at each frequency,
which complicates both monitoring and DF.

Fortunately, some COMINT companies have already made headway in combatting
this obstacle. AST is marketing several products that feature adaptive
beamforming and "interference cancellation" on mobile radio control and
traffic channels. Israel's Rafael Electronic Systems Division has
introduced a super-resolution DF system that, while not explicitly claiming
a cellular orientation, emphasizes immunity to co-channel interference as a
selling point.

GETTING "DIGI" WITH IT

Fig. 2 One proposed technique for monitoring digital wireless networks is
to create a "virtual" base station, spoofing the mobile users. (Thomson-CSF
Communications photo)

Traditional cellular communications may throw a few new twists into COMINT
operations, but what truly fills the intelligence professional with dread
is the advent of digital wireless communications. Digital cellular phone
standards are already in place in the US (Digital AMPS, which is actually
backward-compatible with the analog AMPS), Western Europe (GSM, or Global
System for Mobile Communications) and Japan (NTT). They are more properly
characterized as personal communications systems (PCSs), since they can
also perform paging and data transmission.

Although they operate in the same basic frequency ranges as traditional
cellular phones, digital wireless systems use much more complex signals and
usually have built-in security features, like encryption. The three
existing digital standards are Time Division Multiple Access systems, which
means they squeeze three conversations onto the same channel that one
analog call used to occupy, by transmitting them in sequence in time. This
makes the COMINT system's job three times as hard.

Another digital standard, Code Division Multiple Access, would add to
network capacity by using spread-spectrum techniques, which are also
inherently low-probability-of-detection techniques. In fact, few
communications techniques are as inimical to the COMINT profession as
spread spectrum.

To date, COMINT suppliers have yet to find an adequate solution to digital
wireless communications, although these protocols are the ones for which
customers are clamoring with increasing insistency. For instance, Zeta's
ZS-2015 integrated COMINT/DF workstation, which flies aboard the Swiss
Pilatus PC-12 turboprop reconnaissance aircraft and a King Air-based
reconnaissance bird for an undisclosed South American customer, can
intercept and DF PCS-type signals, but not monitor them. Responding to the
strident demand for anti-PCS COMINT in the regions in which it has
marketed, the company is currently working on an upgrade that will allow
the system to correlate the data or encrypted voice into a text message as
it pursues the call from cell to cell (see "Airborne Surveillance, Big and
Small" in the December 1997 JED,).

Thomson-CSF Communications, meanwhile, has devised an interesting concept
for intercepting and monitoring encrypted GSM-type signals. Using the
publicly available GSM protocols, the company would build a "virtual" base
station, carried in a van perhaps, which could insinuate itself into the
cell system, preempting and capturing the communications of nearby mobile
units. Having taken control of the units, the system could then instruct
them to turn off their cipher modes (Figure 2).

DON'T BELIEVE THE HYPE?

"Handoff" and frequency reuse make the cellular signal more elusive than
regular FM tactical radio. (Thomson-CSF Communications photo)

Is the digital threat really as menacing as the EW alarmists have
proclaimed? Some have scoffed at the notion that anything emerging from the
civilian world should be cause for distress. As seen by Atkinson, "It is
actually easier today than it has ever been to intercept cellular telephone
communications. And it doesn't matter if it's PCS, if it's GSM or if it's
just ordinary analog cellular telephone, or digital. It's incredibly
simple. You just have to have the right equipment to do it, and you have to
have a technical person who knows what they're doing to put the whole
system together."

What about encryption? According to Atkinson, "there's a difference between
encryption and randomization. Most of the phones out there that claim to be
digitally encrypted are actually randomized with a known
algorithm....There's very few real encryption devices out there."

The same holds true for commercial spread spectrum. What commercial phones
advertise as spread spectrum is actually a form of scrambling, a
pseudorandom code that many users might share, "so it's obscenely easy to
monitor," he said.

The basic rule of thumb, according to this tack, is that "it's impossible
to build good security into anything that's cheap."

Of course, it may not be long before military users begin introducing
wireless nets with STU-style encryption, true spread spectrum and other
"expensive" security features. Then no one will laugh at the COMINT world's
worries.
- -----------------------
NOTE: In accordance with Title 17 U.S.C. section 107, this material is
distributed without profit or payment to those who have expressed a prior
interest in receiving this information for non-profit research and
educational purposes only. 
- -----------------------

**********************************************
To subscribe or unsubscribe, email:
     majordomo[at]majordomo.pobox.com
with the message:
     (un)subscribe ignition-point email[at]address
**********************************************

www.telepath.com/believer
**********************************************

------- End of Forwarded Message