Covert Audio Technical Surveillance BURST & TMVWB Systems 1 - - PowerPoint PPT Presentation

▶
covert audio technical surveillance
SMART_READER_LITE
LIVE PREVIEW

Covert Audio Technical Surveillance BURST & TMVWB Systems 1 - - PowerPoint PPT Presentation

Dec 09, 2023 544 likes •884 views

2013 Conference Covert Audio Technical Surveillance BURST & TMVWB Systems 1 LJM Tech. Support ! 1 Why this presentation ? A typical example of ex. Gov Stuff State level threat some years ago. Now Coporate level Very good

slide-1
SLIDE 1

LJM Tech. Support

!

Covert Audio Technical Surveillance

BURST & TMVWB Systems

1

2013 Conference

1

slide-2
SLIDE 2

LJM Tech. Support

!

2

Why this presentation ?

A typical example of ex. Gov Stuff

  • State level threat some years ago. Now Coporate level
  • Very good quality
  • They aren’t brand new, so widely spread in Europe
  • Affordable and available on the commercial market
  • Easy to detect with proper tools and procedures

Introducing

  • The need for new designed equipement in TSCM
  • A new approach in TSCM procedure

2

slide-3
SLIDE 3

LJM Tech. Support

!

1/ AURORA Pulse Audio Monitoring System

3 3

slide-4
SLIDE 4

LJM Tech. Support

!

4

Aurora presentation

Type

  • Digital UHF TX - RX kit remotly controlled
  • Buffer & Burst transmission system
  • Low Probability of Interception
  • Low power consumption

Origin

  • Russia
  • Manufactured by SET-1 (www.set-1.ru)

4

slide-5
SLIDE 5

LJM Tech. Support

!

Complete set

5

!

Transmitter

!

Remote Control

!

Receiver

!

  • Extern. Microphone

5

slide-6
SLIDE 6

LJM Tech. Support

!

6

Aurora system

Operating principle

  • Audio information is picked up by external microphone
  • Transmission of audio intelligence via radio channel
  • TX. Step by step accumulation of audiodata in the

internal RAM followed by rapid rate packed RF transmission of the stored datas.

  • RX. Reception of data packets, error correction, packet

merging and digital to analog converstion.

  • RC. Control over transmitting power, sampling rate,

duration and packet reoccurrence interval.

6

slide-7
SLIDE 7

LJM Tech. Support

!

  • Tech. Specifications

TX ref RMI 400

  • Carrier freq. of data channel: 1000 - 1200 MHz
  • Output power (selectable): 50 - 350 mW,
  • Modulation: GMSK - BW: 12 MHz (-20dB)
  • Packet duration (selectable): 30 - 250 milliseconds
  • Packet reoccurrence interval (selectable): 1,2 - 26 s.
  • Power supply: 3,6 - 4,6 v
  • Current comsumption: standby: 250 µA, storage: 15mA,

packet transmission (max output); 500 mA

  • Dimensions: 137 x 30 x 10 mm

7

!

7

slide-8
SLIDE 8

LJM Tech. Support

!

RX ref PRI 400

  • Sensitivity: No less than 10 µV
  • Power supply: 4 x AA or extern. supply
  • Current consumption: > 180 mA
  • Dimensions: 170 x 70 x 35 mm
  • Connexions for :
  • Antenna
  • Headphone
  • External power supply (9 V, 300 mA)
  • Recorder

8

!

8

slide-9
SLIDE 9

LJM Tech. Support

!

RC ref DPK 010

  • Output power: + 22 dBm
  • Quantity of instructions: 17
  • Carrier frequency: 433,920 +/- 100 KHz
  • Power supply: 4 x AAA
  • Dimensions: 100 x 51 x 18 mm

9

!

9

slide-10
SLIDE 10

LJM Tech. Support

!

10

Operation modes

Set by the Remote Control L: Packet Duration (ms) D: Sampling rate of the A-D converter xx: Packet succession period (s) P: Tx output (250 - 450 mW) D1 D2 D3 D4

Packet Duration

L1 L2 L3 L4

Sampling Rate

1,2 1,6 4,4 3,2 30 mS 2,4 3,2 4,7 6,5 58 mS 4,7 6,5 9,4 13 116 mS 9,4 13 18,8 26 231 mS 22 KHz 16 KHz 11 KHz 8 KHz

10

slide-11
SLIDE 11

LJM Tech. Support

!

Detection

11

Methods and Means

  • RF Capture & Analysis
  • Spectrum Analysers (Maxhold configuration)
  • RF wide band & fast receivers with waterfall display
  • TSCM dedicated equipments - Oscors, Raptor, Merlin 3, SDR ?
  • Fast near field detectors (Close to the active TX)
  • Physical & Electronic search
  • Visual & optimal search
  • NLJD
  • ASMD (if the TX mic is active - powered)

11

slide-12
SLIDE 12

LJM Tech. Support

!

RF Capture (SA - R&S / FSH-6 Screenshots)

12 12

slide-13
SLIDE 13

LJM Tech. Support

!

RF Capture (SA - R&S / FSH-6 Screenshots)

13 13

slide-14
SLIDE 14

LJM Tech. Support

!

RF Capture & Analysis (EM-100 Screenshots)

14

Configuration: L2-D2 Sampling: 16 KHz Packet succession: 3,2 s Packet duration: 58 ms

14

slide-15
SLIDE 15

LJM Tech. Support

!

15

Configuration: L4-D4 Sampling: 8 KHz Packet succession: 26 s Packet duration: 231 ms

15

slide-16
SLIDE 16

LJM Tech. Support

!

2/ OMEGA-1T TMVWB Audio Monitoring System

16 16

slide-17
SLIDE 17

LJM Tech. Support

!

OMEGA-1 Présentation

17

Type

  • Digital UHF TX - RX kit remotly controlled
  • Time Modulation Very Wide Band transmission system
  • Low Probability of Interception
  • Versatile and modular by rerouting the signal
  • Extremely low power consumption (1 x 9 V batt. = 500 h)
  • «Old» product, widely distributed. Constantly upgraded

Origin

  • Italy
  • Manufactured by BEA (www.beanet.it)

17

slide-18
SLIDE 18

LJM Tech. Support

!

Complete Set

18

TX Omega 1T RX Modulo Omega 1 Master Docking station GSM Repeater Phone Line Interface RF Repeater

18

slide-19
SLIDE 19

LJM Tech. Support

!

OMEGA-1 System

19

Operating principle

  • Audio information is picked up by external microphone
  • Transmission of audio intelligence via radio channel
  • TX. UHF, TMVWB transmitter with RC receiver
  • RX. Local listening base. Docking station for RX modules
  • RC. Control over On/ Off, power adjust., mic tone & gain
  • Complementary options for rerouting the signal
  • Phone line interface server
  • RF repeater
  • Cellular network interface

19

slide-20
SLIDE 20

LJM Tech. Support

!

  • Tech. Specifications

TX - Omega 1 T

  • Frequency range: 300 - 390 MHz
  • Output power: 04 - 200 mW
  • Audio dynamic range: 60 dB
  • Power supply: 4 - 12 V or external power supply (12V)
  • Consumption: standby:0,5 mA, transmit:depend of power
  • Dimensions: 41 x 17 x 7 mm without antenna

20

Voltage Output power Range Consumption 4 V 04 mW X 1,1 mA 6 V 16 mW 2X 1,5 mA 9 V 50 mW 3X 2,0 mA 12 V 200 mW 5X 3,0 mA

20

slide-21
SLIDE 21

LJM Tech. Support

!

RX - Modulo F Module

  • Frequency range: 300 - 399,9 MHz
  • Tuning steps: 100 KHz
  • Sensitivity: - 90 dBm
  • Audio bandwidth: 50 Hz - 5 KHz
  • Freq. Shift compensation (± 3 MHz) + Notch filter
  • Power supply: 8 - 14 VDC
  • Current consumption: 50 mA
  • Dimensions: 73 x 45 x 10 mm without antenna
  • To be integrated into the docking station Omega Master

21 21

slide-22
SLIDE 22

LJM Tech. Support

!

RX - Omega 1 Master

  • Listening and docking station for the Modulo
  • Front panel indications: RSSI (dBm), BF (mV), Vlin (V)
  • Control adjustement: Volume, REC and VOX gain
  • Power supply: 1,5 Ah rechargeable batt. or extern. supply
  • Current consumption: > 180 mA
  • Dimensions: 130 x 90 x 40 mm
  • Connexions and control knobs for :
  • Headphone, recorder and phone line
  • External power supply (100-240 VAC - 12 VDC)

22 22

slide-23
SLIDE 23

LJM Tech. Support

!

RC - TC 2002

  • Carrier frequency: 433,9 mhz
  • Output power: 2 W
  • Quantity of code: 99
  • Features control :
  • Mic ON/Off
  • Tone transmission quality and mic. preamplification
  • Mic output power
  • Remotable functions: Via DTMF tones
  • Power supply: 1,5 Ah rechargeable batt. or extern. supply
  • Dimensions: 80 x 58 x 27 mm

23 23

slide-24
SLIDE 24

LJM Tech. Support

!

Complementary rerouting options

RF repeater - Omega 1 Ponte

  • Extend the RF transmission range
  • Output power: 1 W
  • RX sensitivity: - 90 dBm
  • Dimensions: 80 x 58 x 27

Phone line interface - Omega Server

  • Repeat the signal through a dedicated phone line
  • Power supply: 18 - 60 V
  • Line isolation: > 20 M Ω
  • Dimensions: 80 x 58 x 27

24 24

slide-25
SLIDE 25

LJM Tech. Support

!

GSM repeater - TFG08C

  • Re-launch the signal over the cellular network
  • Securely programmed using SMS or DTFM tones
  • Many features can be programmed (Vox, motion detec ...)
  • Power supply: 6 - 36 V
  • Consumption: 250 mA - 12 V
  • Dimensions: 123 x 64 x 30 mm

25 25

slide-26
SLIDE 26

LJM Tech. Support

!

Detection

Methods and Means

  • RF Capture & Analysis
  • Spectrum Analysers (Maxhold configuration)
  • RF wide band & fast receivers with waterfall display
  • TSCM dedicated equipments - Oscors, Raptor, Merlin 3, SDR ?
  • Fast near field detectors (Close to the active TX)
  • Physical & Electronic search
  • Visual & Optical search
  • NLJD
  • ASMD (if the TX mic is active - powered)

26 26

slide-27
SLIDE 27

LJM Tech. Support

!

RF Capture (SA-R&S FSH-6 Screenshots)

27 27

slide-28
SLIDE 28

LJM Tech. Support

!

(SA-R&S FSH-6 Screenshots)

28 28

slide-29
SLIDE 29

LJM Tech. Support

!

RF Capture & Analysis (EM-100 Screenshots)

29

300,000

29

slide-30
SLIDE 30

LJM Tech. Support

!

30 30

slide-31
SLIDE 31

LJM Tech. Support

!

Conclusion - The introduction to :

31

The need for specially designed systems which:

  • Cover high freqency range
  • Scan very quickly with good selectivity and sensitivity
  • Record data for replay with time & frequency read out
  • An analysis capability to identify/classify particuliar signals
  • Can be remotly controled (Ethernet, wireless networks)

The need to adapt our procedures

  • A capability to analyse in differ mode
  • A capability to analyse from a remote place (big challenge!)
  • A capability to face new threats - GSM, Wifi, Bluetooth bugs

31

slide-32
SLIDE 32

LJM Tech. Support

!

32

« Thanks for your time & attention »

32