Using PDA products to control / eradicate illicit communications in Prisons. Using PDA products to control / eradicate illicit communications in Prisons.  Why ?  With direct and unmonitored communications, criminals can :-  Control the supply of drugs into the prison.  Intimidate or assassinate witnesses / business rivals  Continue to run criminal businesses directly  Plan and execute escapes.

Using PDA products to control / eradicate illicit communications in prisons. Using PDA products to control / eradicate illicit communications in prisons.  What is Required:  Real time system with central reporting and a single clock source  Remote Units linked by Radio – no wiring issues, quick installation  Mobile detectors- able to move units easily.  Add new detectors - to detect new technology threats such as :  Bluetooth / WiFi  Satellite Phones / Modems  LTE – 4G phones less than 2 years away- PC modems less than 1 year  Able to supply information to PC based Intelligence Software

To provide such a solution requires 2 products: To provide such a solution requires 2 products:  CPD3000 System for wide area use  GSM196 Handheld detector to pinpoint the actual cell

CPD3000– distributed detection system CPD3000– distributed detection system  Supports up to 220 remote detectors at ranges up to 5km  Uses license free frequencies in the 458MHz ISM band  System can support different types of detectors  Standard Unit based on the 196 (2/3G detection)  Options:  Bluetooth and /or WiFi detector  Satellite phones (Thuraya and Iridium)  LTE – European and US options  Applications - rapid or temporary deployments  Prisons – Intense monitoring of areas (intelligence reports)  Government events – conferences etc  Police surveillance operations

Using the CPD3000 for prison applications  Monitor a complete prison for cellular traffic from a single location.  Supplies vital intelligence  Type of phone technology- 2G(GSM) or 3G  Type of usage – call or text  Pattern of usage – times and dates  Signal strengths indicates number of phones  Helps position search staff – at the right time and right place  System future proof – new threats-new detection units

CPD3000 Components  CPD310 Hub system  CPD351 Remote Detector  CPD391 Remote Repeater Unit  CPD392 Remote Trunk Repeater

CPD310 Hub system

Screen displays Initial Start up Screen – Hub serial No and software version Initial 30 second scan for remote active units Result of scan Sample report from Detector 048 Alarm - GSM SMS/Registration detected by unit 51

Typical printout

The hourly system status  05:00:00 30 Jun 2011 SYSTEM STATUS Hub ID & vers: 0116 V  Remote Units:2 total (dets: 2, jmrs:0, rpts:0)  Low battery:all OK  Poor link: all OK  EVENTS IN LAST HOUR: 23

Analysis of printout  05:03:00D066GSM call00m16s S=7 Start timeUnit #Alarm typeDuration Max signal strength System will alert to a call but will only print when duration is known  05:11:10D066GSM net/SMS00m04s S=9 Start time Alarm either registration or text  05:16:31D066GSM net/SMS00m08s S=9 When alarm exceeds 4secs – phone sending long text i.e. greater than 160 characters so message is spread over multiple frames  05:17:23D066GSM net/SMS00m04s S=9 Could be response to the earlier text message  05:17:23D070GSM net/SMS00m04s S=3  05:16:24D0663G call04m24s S=5 3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48

Analysis of printout  05:03:00D066GSM call00m16s S=7 Start timeUnit #Alarm typeDuration Max signal strength System will alert to a call but will only print when duration is known  05:11:10D066GSM net/SMS00m04s S=9* Start time Alarm either registration or text  05:16:31D066GSM net/SMS00m08s S=9* When alarm exceeds 4secs – phone sending long text i.e. greater than 160 characters so message is spread over multiple frames  05:17:23D066GSM net/SMS00m04s S=9* Could be response to the earlier text message  05:17:23D070GSM net/SMS00m04s S=3  05:16:24D0663G call04m24s S=5 3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48 * Same signal strength-indicates possibly from the same phone

Analysis of printout  05:03:00D066GSM call00m16s S=7 Start timeUnit #Alarm typeDuration Max signal strength System will alert to a call but will only print when duration is known  05:11:10D066GSM net/SMS00m04s S=9* Start time Alarm either registration or text  05:16:31D066GSM Call00m16s S=9* When alarm exceeds 4secs – phone sending long text i.e. greater than 160 characters so message is spread over multiple frames  05:17:23D066GSM net/SMS00m04s S=9* Could be response to the earlier text message  05:17:23D070GSM net/SMS00m04s S=3  05:16:24D0663G call04m24s S=5 3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48 * Same signal strength-indicates possibly from the same phone The short call length indicates that Base station has instructed phone to reduce power and D066 has lost contact with the phone as a result. Not a system fault – this is how GSM phones work when on a call

Analysing Printout  Prisoner making one call The system will detect 3 events  Initial registration of the phone  The call itself  The turn off notification  Prisoner texting The system will detect 2 events for a single text  The incoming /outgoing SMS message  The response – usually within a few minutes  In both the above, group events according to detected signal strength as this is an indication that events may have come from the same phone  Short duration calls indicate that the BTS has instructed phone to reduce power resulting in a loss of detected signal by a CPD351

CPD351 Remote Detector  Detection ranges (free space):  GSM up to 300m  UMTS 2100 –approx 80 to100m  Maximum power for a 3G class 3 phone is 250mW typical output can be <10mW in strong areas  Battery life (internal) 3 to 4 days  Anti-tamper facility  Prison radio interference suppression ( MHz)  Enhanced GSM detection algorithm for calls  Can control other devices e.g. low powered jammers, audio recording equipment etc.  Ideal locations – Service Cupboards (with wooden doors)

Typical HMP wing layout

Deploying the CPD351  Deploy 1 unit per wing initially with sensitivity setting =9  Gather information for approx. 1 week to map the type of phones in use (2G/3G) and how they are being used  When using multiple detectors in a wing, reduce sensitivity so detectors cover separate areas.  Use directional antennas to monitor specific areas.  When moving detectors to new locations-press the Test button on the unit so printer records the event.  If strong external GSM signals being detected, sensitivity can be further reduced via rear switch-UMTS sensitivity unchanged

SDA351 Directional Antenna Specifically designed to enhance performance of the CPD351 Directional – 60º wide sensitivity beam* * applies to GSM1800 and UMTS only, GSM900 is less directional Increased gain at 1950Mhz for better 3G detection SA918 Antenna Same antenna as used with GSM196 Directional -60º wide sensitivity beam * applicable across all bands Small size aids deployment

Monitoring of a wing using a single CPD351 located centrally S=7 05:14:17D016GSM net/SMS 00m04sS=7 05:14:42D016GSM net/SMS 00m04sS=7 Problem: Difficult to tell whether at S=7 there is more than one phone – only use one detector per wing for intelligence gathering

Monitoring of a wing using two units S=9 S=2 05:48:23D016GSM net/SMS 00m04sS=9 05:48:23D044GSM net/SMS 00m04sS=2

Monitoring of a wing two units but with different sensitivity settings S=9 S=7 05:34:07D016GSM net/SMS 00m04sS=9 05:55:27D044GSM net/SMS 00m04sS=7

Monitoring of a wing using different types of antenna S=9 S=7 Using a directional antenna to monitor a specific cell Using omni-directional antenna with variable sensitivity settings 05:34:07D016GSM net/SMS 00m04sS=9 05:55:27D044GSM net/SMS 00m04sS=7

Monitoring of a wing covering Landings as well Ground Level Level 1 S=7 S=9 Re-enforced concrete floor 05:30:24D016GSM net/SMS 00m04sS=9 05:30:24D024GSM net/SMS 00m04sS=7

Monitoring of a wing covering Landings as well Ground Level Level 1 S=6 S=9 05:42:15D016GSM net/SMS 00m04sS=6 05:42:15D047GSM net/SMS 00m04sS=9 Re-enforced concrete floor

CPD391 Repeater  Designed to pick up and re-transmit CPD351 signals  Detected signals validated before retransmission  Use the same transmit frequency as CPD351 units  Allows detector signals to be collected from a shielded building / wing and retransmitted via an external antenna. Typical location –roof spaces

CPD392 Trunk Repeater Admin Building and security office Workshops, Gym and Canteen Facilities CPD392 CPD391 CPD351 Detectors deployed in wings Accommodation Block Only transmissions from other CPD391 repeaters are recognized 20:34 D016 GSM net/SMS 00m04s S=7 CPD351 (D016) transmissions screened by workshops

GSM196 Handheld Cell-phone Detector  Detects both 2 and 3G phones.  Range better than 400metres to a 2W source (GSM900)  Imbedded filters to restrict detection to Handset frequencies  LED Bargraph signal level indication  Automatic Brightness Control  Feature requested by prison security officers  Unique Signal Analysis for accurate detection  Cadenced vibration alert for covert operation  Ease of Use  Single button operation  Directional antenna option  SA918 antenna allows accurate location of a target and increases range

GSM196 + directional antenna option GSM196 + directional antenna option Detection area primarily restricted to ± 30º both in the horizontal and vertical planes

Searching with GSM196 + SA198 Antenna A Single search officer can quickly identify source of a signal. The antenna projects an area of sensitivity very much like a torch beam Check readings on the 196 as the antenna is moved. Only really useful for tracing ‘calls’ Lower Level Upper Level Set 196 to ‘S’ mode and put outside each cell suspected of sending GSM text messages. The one with a flashing blue ‘N’ LED will be the cell. For 3G text messages –only the ‘3’ LED will be flashing When walking the landings, the beam is approximately the width of one cell at the window end of the cell. Check whether signal is coming from the lower or upper levels

Conclusion  Install CPD3000 system and deploy detectors in wings / cell blocks  Capture ‘intelligence’ on how phones are being used ( call or text) when (time) and where.  Move detectors to hot spots to improve location accuracy.  Search teams to be deployed to active areas with handheld detectors to pinpoint cells if alarms are calls.  Deploy GSM196 units in HO or S modes to monitor suspect cells for text alarms  Continue to monitor area after seizures to see how quick replacements are being supplied.  The phone problem may not just confined to the prison wings

The latest security threat : the GSM audio bug  Contains a GSM phone which can be accessed from anywhere. Simply add a Pay as you Go SIM card to activate.  Placed in security offices, operations rooms etc by cleaners – takes only 10 seconds  Allows third parties ( criminals) to listen in on operational planning meetings. Now drug dealers will know when and where to make next shipment to the prison.  Solution Deploy additional detectors in security related areas

Mobile CPD3000 system For small prisons where there is insufficient justification to install a system – PDA can supply a complete system in a ruggedized case. The detectors can be deployed and the hub can be ‘hidden’ in a suitable roof space. Data is collected onto a memory stick to be analysed when the system is collected by the regional search personnel. All equipment including hub powered by internal batteries for up to 4 days