Q3 2009 INSIDE THIS ISSUE: REI Introduces REI Launches OSCOR Blue TSCM Spectrum Analyzer Trace Analysis Features of OSCOR Blue Importance of the ORION Non-Linear Junction Detector Testing Receiver Equipment With DECT Phones In The News... TSCM Related Headlines & News REI Training Calendar Questions, comments, suggestions, or to add someone to the REI Quarterly Newsletter mailing list, please e-mail: newsletter@reiusa.net TSCM SPECTRUM ANALYZER REI is pleased to announce the NEW OSCOR Blue, a totally NEW TSCM Spectrum Analyzer designed specifically for detecting and locating illicit electronic surveillance devices with unparalleled advantages over other spectrum analyzers. OSCOR Blue provides these unique benefits: Sweeps 24 GHz in under 1 second Integrated Auto Switching Antenna 8 lbs (3.6 kg) operational weight REI designed and built the OSCOR Blue with the TSCM professional in mind, delivering a high performance spectrum analyzer in a portable package with built-in auto-switching antenna system offering security professionals better efficiencies, stealth, and mobility. Sweeps 24 GHz in 1 second OSCOR Blue s impressive sweep speed (100 khz to 24 GHz in less than a second, at 12.2 khz steps) dramatically reduces the time it takes to capture intermittent signals (i.e. burst/packet or frequency hopping), while recording 2,000,000 data points per second, providing extremely detailed resolution throughout the spectrum. Integrated Auto Switching Antenna System A fully integrated auto-switching omnidirectional antenna system (to 24 GHz) requires no extra antennas. Additionally, OSCOR Blue does include ports for attaching auxiliary antennas. The Auto Switching Antenna System allows the user to sweep, analyze and view the entire 24 GHz spectrum without having to change antennas to examine different areas of the spectrum. Operator can zoom on signals while scanning the desired spectrum range up to 24 GHz. Weight and Portability OSCOR Blue is exceptionally portable weighing 8 lbs/3.6 kg and can be carried quickly and quietly to locate transmitters while recording traces. The chassis is similar in design to REI s TALAN Telephone and Line Analyzer providing operator familiarity among REI products. Continued on page 2 Research Electronics Intl 455 Security Drive Algood, TN 38506 USA +1 931 537-6032 800-824-3190 (US only) Fax +1 931 537-6089 www.reiusa.net 1
OSCOR Blue Features Continued from page 1 Antenna Panel Input 8 GHz to 24 GHz Antenna Panel Control 50 KHz to 8 GHz TSCM SPECTRUM ANALYZER 10 MHz Baseband Out IF Out ports 75 MHz Aux Control Port Aux RF In 50 KHz - 8 GHz m Auxiliary Ports Patented Trace analysis built into receiver. (OPC capabilities internal to OSCOR Blue) Trace Sequence Recorder (Waterfall Analysis) Spectrum Zoom while trace recording Frequency spectrum update while demodulating Signal List Generation Threat Correlation Touch Type User Interface Automatic Switching Antenna Array 8.4 inch (21.3 cm) High Resolution Touch Screen Display with drag & move controls Headphone Jack Soft Function Menu Keys Power Button Built-in Speakers Auto Switched Antenna Panel (built-in) Rotary Tuning Dial Menu Control Keys Function Keys Numeric Keypad DC Power Input USB Port for Memory/Keyboard/ Mouse Compact Flash Memory Port Internal Lithium Ion Battery 2 Continued on page 3
OSCOR Blue Features Continued from page 2 Touch Screen "drag and move" User Controls An 8.4 in (21.3 cm) high resolution touch screen display includes intuitive natural drag and move, zoom and pan controls at the touch of a finger. Soft Function keys, built-in speakers and the classic rotary tuning dial help make OSCOR Blue easy to operate. Trace Analysis for Rapid Detection of Sophisticated Transmitters OSCOR Blue quickly identifies localized RF energy transmissions of all types of modulation, and has built in patented Trace Analysis. Reference and target traces are quickly captured, stored and compared for complete RF analysis. Zoom in on signals without interrupting sweeps, assuring no signals are missed. Signal lists are produced from captured traces as determined by manually set thresholds, allowing rapid comparison of signals from room to room. Waterfall zoom allows 5 MHz magnification without interruption to full spectrum capture Waterfall Trace Sequence Recorder The Waterfall Trace Sequence Recorder captures and records signal activity in a peak trace over time for historical analysis of transmissions down to 5 second intervals at 12.2 KHz resolution. The Zoom function magnifies the spectrum to 5 MHz without interrupting full spectrum capture (24 GHz or 8 GHz depending on model). Trace data is recorded in complete detailed resolution and can be zoomed and panned freely within the recorded spectrum but is not restricted to screen capture resolution. Signal Analysis, Classification, and Location While demodulating, OSCOR Blue provides Real-Time frequency display of up to 18 MHz. For example: the operator can view the realtime FM broadcast band while listening to a single signal. Signal Ranging is a feature of OSCOR Blue that shows the distance to an analog transmitter, quickly locating threatening signals. Digital signals can be easily located based on RSSI (Received Signal Strength Indicator) level change and near field locating function. An algorithm generates a signal list from captured trace data. Built-in Suite of Demodulators A built-in suite of audio and video demodulators aide in analyzing signals, including on-screen video demodulation. AUDIO DEMODULATION VIDEO FORMATS 1 FM wideband 1 NTSC, PAL, SECAM 2 FM narrowband 2 AM or FM demodulation 3 AM wideband 3 + or - synchronization pulse 4 AM narrowband IF BANDWIDTHS 5 Sub-carrier 1 Audio: 200kHz, 15kHz, 6kHz, 2kHz 6 Single Sideband 2 Video: 13.5MHz, 6.25MHz Continued on page 4 Screen illustrating video signal and display of demodulated video 3
OSCOR Blue Features Continued from page 3 OSCOR Blue delivers TSCM specialists real-time sweep speed and 24 GHz visibility in a single auto-switching antenna array. User friendly controls guide the user through a full palette of signal analysis features and functionality not found in any other spectrum analyzer. Production units of the NEW OSCOR Blue are expected to be available for shipment by year's end. Additional information including product specifications are available on the REI website at www.reiusa.net. Contact REI for more information or to place an order at sales@reiusa.net REI RF Test Transmitters We are often asked by TSCM practitioners for suggestions on test transmitters for the purpose of creating test exercises to practice detecting illicit RF signals of varying types and modulation schemes (REI stresses the importance of hands-on exercises in our TSCM training courses). There are some obvious test devices such as wireless microphones, common baby monitors, and wireless cameras, all which are easily available (bargains can be found on ebay or common retailers). But we also have requests for devices to create more sophisticated signals such as digital/encrypted signals, frequency hopping or bust transmitters to really test one s skills for detecting and locating varying signal types using techniques other than just relying on analog demodulation. For obvious legal reasons, we do not recommend that illegal bugging devices are obtained for this legitimate testing purpose, however there are many commercially available, inexpensive devices that do not pose any legal issues which create sophisticated RF signals such as digital encrypted signals, frequency hopping, burst, etc. that can be used for test transmitters. Below are some examples of several types of easily obtainable test transmitters: Common Analog CW Signals: Common baby monitors, wireless microphones, FM transmitters, etc. provide inexpensive transmitters in various frequencies. These can be purchased inexpensively from common retailers. Video Signals: Wireless video cameras can be found on ebay for $30 - $100 in various frequency ranges (900 MHz, 1.2 GHz, 2.4 GHz, and 5.8 GHz). Digital Signals: We often asked for digital test transmitters mainly for the purpose of honing skills that do not rely on listening to a signal. This can easily be achieved by simply not using the audio function on your detection equipment, relying only on trace analysis and signal strength to detect and locate the source of any test transmitter (analog or digital). DECT: Cordless phones provide a very interesting burst signal (10 ms frame with 24 time slots per frame) using a multiplexed GFSK (Gaussian Frequency Shift Keying) modulation scheme. DECT is frequency agile across multiple channels anywhere from 1880 MHz to 1930 MHz depending on country allocation (some countries use 2010 MHz to 2025 MHz). Due to the bursting nature, it can take some modern digital spectrum analyzers some time before they actually detect a DECT signal (both the OSCOR 5000 and OSCOR Blue quickly detect DECT signals). DECT phones can be purchased from any large retail department stores (or online) for $20 to $50. Frequency Hopping /Spread Spectrum Transmitters: There are many DSS Digital Spread Spectrum and FHSS Frequency Hopping Spread Spectrum cordless phones in both the 2.4 GHz and 5.8 GHz ranges (note that in many instances a cordless phone may be advertised as 5.8 GHZ when in fact the handset transmits at 2.4 GHz while the base station transmits at 5.8 GHz). Additionally, common wireless access points (802.11) can 4 Continued on page 6
Importance of a NLJD ORION NON-LINEAR JUNCTION DETECTOR Bugging devices are often thought to be transmitters, but hardwired devices or devices that can be turned on and off remotely that do not emit an RF signal could be overlooked. The ORION Non-Linear Junction Detector is made to find these types of hidden electronic devices. The ORION NLJD detects hidden electronic devices regardless of whether the device is transmitting, hard wired, or even turned on at all. It transmits an RF signal and then listens for harmonic returns to detect the presence of electronics. When the transmitted signal encounters semi-conductor junctions (diodes, transistors, etc...), a signal is returned at harmonic frequency levels according to the characteristics of the junction, providing an indication of the presence of electronics. NLJD's also respond to corrosive junctions such as rust or oxidation Stronger 2nd Harmonic indicates electronics/semiconductor Stronger 3rd harmonic indicates corrosive junction and where dissimilar metals make contact. Corrosive junctions normally appear as false alarms and so it's important to ensure the NLJD can discriminate between true semiconductor junctions and corrosive junctions. The ORION provides excellent discrimination between the 2nd and 3rd harmonics, and utilizes automatic power control which reduces the transmit power to a level where a good distinction between the 2nd and 3rd harmonic levels is visible, making it easy to discriminate between true electronic junctions and false corrosive junctions. HOW ORION WORKS 1. ORION Transmits RF energy at a specific, known frequency (i.e. 915 MHz) 2. Detects (listens for) harmonic (2X, 3X, etc.) returns of known frequency (1830MHz, 2745MHz etc.) generated by electronic devices (i.e. diode, transistor, integrated circuit etc.) ORION s advantages include: Minimum Set-up Time, no cables or bulk transceiver units to carry Light weight, balanced ergonomic design for ease of use High Transmit power for rapidly searching a large area Circularly Polarized Antenna reduces search time and improves reliability Dual Harmonic with Discrimination Algorithms Minimizes False Alarms Standard type camcorder battery with long use time and quick charge function Wireless Headphones and Graphic Display for simultaneous Audio & Visual Information The ORION detects electronics, even when they re not turned on. OPERATING MODES Search 2&3 - Continuous Wave and Pulse modes Frequency Hopping Mode ID Mode Listen Mode For more information in the ORION NLJD, contact REI at sales@reiusa.net. REI 5
2009 REI TRAINING CALENDAR TCC-110 Telephone Security Countermeasures October 6-9 TSE-101 Technical Security Equipment October 6-9 DTC-210 Digital Telephony October 12-16 TSCM-201 Technical Security Countermeasures October 12-16 ATC-301 Advanced TSCM Concepts October 19-23 TEC-250 Telephone Equipment Certification October 19-23 TCC-110 Telephone Security Countermeasures November 3-6 TSE-101 Technical Security Equipment November 3-6 DTC-210 Digital Telephony November 9-13 TSCM-201 Technical Security Countermeasures November 9-13 TCC-110 Telephone Security Countermeasures December 1-4 TSE-101 Technical Security Equipment December 1-4 DTC-210 Digital Telephony December 7-11 TSCM-201 Technical Security Countermeasures December 7-11 Questions, comments, or to add someone to the REI Quarterly Newsletter mailing list, please e-mail: newsletter@reiusa.net Visit our online calendar be used as 2.4 GHz test transmitters that use various signal schemes depending on protocols (i.e. DSSS, OFDM, etc.), which show up on digital spectrum analyzers as quick busts of energy on various channels. In addition to testing your skills and equipment with the above commonly available transmitters, you may also want to consider REI s training courses as our training facility includes multiple project rooms and environments where we can introduce various types of signals to simulate real world situations. For more information, contact REI at sales@reiusa.net REI RF Test Transmitters Cell phones Can easily be turned into eavesdropping devices NEWSWEEK Source: www.newsweek.com Article: http://www.newsweek.com/id/200878 Thinning Government Intelligence Contractors US News Source: www.usnews.com Article: http://tiny.cc/lme6v privacy concerns Raised over canada s Cyber eavesdropping Canada.com Source: www.canada.com Article: http://tinyurl.com/q7vbjp Jamming cell phones in prisons Interference Technology Source: www.interferencetechnology.com Article: http://tinyurl.com/mgs83a Continued from page 4 FORMER BOSS CHARGED WITH WIRETAPPING MY SANews Source: www.sanantonio.com Article: http://tinyurl.com/pt5awz Zoomed-in screen capture of a frequency agile DECT phone signal on an OSCOR Blue. Secret videos could turn multi-billion dollar lawsuit TIME Source: www.time.com http://tinyurl.com/n934e2 Research Electronics International 455 Security Drive Algood, TN 38506 USA TEL +1 931.537.6032 FAX +1 931.537.6089 www.reiusa.net 6