Cell Catcher CC1900 3G Target Identifier + IMSI Catcher + Phone Tracking

Transcription

1 The Cell Catcher model CC1900 tracks criminal cell phones on location, through UMTS networks, collecting and analyzing surveillance data of IMSI and IMEI numbers. 3G UMTS Gateway Technologies The Cell Catcher is miniaturized mobile network performing a unique access-control function in order to capture criminal phones operating on 3G. The Cell Catcher imposes permission-based rules upon those 3G phones. That means the Surveillance Operator can deploy this network and catch all 3G phone users in range. Once caught, the Surveillance Operator can decide: Who gets to make and receive calls (and who does not) Who should be physically tracked (located) Cell Catcher Model CC1900 3G This Cell Catcher captures several layers of data concerning UMTS phones (on 3G) seeking voice and data service. That data can be used to control the Targeted phone(s) of terrorist and criminal elements. Where the Cell Catcher operates: More than an IMSI Catcher, the Cell Catcher works as a 3G Target Identifier with the ability to operate both stationary (Prisons & Buildings) or while on the move (Tactical Tracking). Tactical & Portable - The mobile configuration of the CC1900 3G is an advanced system used by law enforcement. The system can be deployed in a vehicle for moving tracking missions, as well as stationary monitoring operations (in a hotel, apartment building, back of a store, office building, etc). Practically anywhere 3G phones need to be caught, capturing their data, and controlling their network access abilities. Prison Solutions & Government Buildings - Rack-mounted enclosures contain the CC1900 core systems for stationary large scale managed access, found in Prisons or Government office facilities. Shown above: Enclosures that house the hardware for both CC1900 3G as well as the CC1900 2G. Equipped with primary and secondary cooling fans, optimum efficiency is maintained. Should the system be deployed in temperate regions, in-board heating and / or cooling options may be implemented.

2 3G Cell Catcher - Target Identification + IMSI Interception: The 3G Cell Catcher, model CC1900 3G is able to work on regular GSM at the following frequency bands: 850, 900, 1800, and 1900 MHz. The system can be built into a Tactical, portable case, or emplaced in an enclosure for fixed use at a Prison or Government building. Operational functionality in relationship to Local RF Networks: The Cell Catcher imitates the attributes of the local UMTS tower traffic. Because the system was built using telecom Base Station (BTS) technologies, it is able to work in parallel to the local service providers of UMTS - GSM services. Imagine all the GSM phones in the area coming to the Cell Catcher because they think the Cell Catcher is the service provider. The attraction of GSM handsets to the Cell Catcher is the desired result, enabling the Surveillance Operator to be able to control what happens next. While most phones will be returned by the Surveillance Operator to the real phone networks, the Target(s) being sought for capture stay. Those Targets may be in a prison, and access to phone service is denied. Those Targets may also be in a bank, getting ready to commit a robbery, or in a building about to kidnap someone. The system's BTS (base station) is very powerful, capable of competing for service with the local phone towers. In addition, the Surveillance Operator is able to unleash a series of features in order to control the RF environment. QUESTION: How does the system know what unknown factors may be happening, as every geography is different? QUESTION: How does a Surveillance Operator acquire the intelligence to deploy the Cell Catcher effectively in every city an investigation is to take place in? ANSWER: By analyzing the environment. RF Analyzer Feature: Analyze and Classify local Networks: The system engages sensory telemetry in order to "see" the local RF environment, helping the Surveillance Officer determine who is a Target, and who is unrelated to the investigation. Once the system actively attracts mobile handsets, the Surveillance Operator may determine who should be controlled by the system (targeted or located with tracking) and who should be rejected by the system in order to connect to the local service provider. Once the system has analyzed the local environment, it is better equipped to deal with the 'unique' characteristics of that area. This familiarization will help the system 'blend-in' and work in a discreet manner so as not to draw attention that the phone is under a cellular surveillance investigation. Target Identifier Correlation Feature: Location Match: In the event the surveillance officer does not know Target's mobile identity required for tracking, the system can conduct surveys in multiple locations and process the intercepted data for forensic duplication. The operation of the system in its catcher mode will provide a good deal of mobile identities to sort through. However,

3 Target Identification, IMSI Catching, & Location Match: This correlation feature will then alert the operator whenever the same IMSI is found at 2 separate locations, yielding the Target's identity required to track the Target on command. In other words, should the Surveillance Operator not know the targets IMSI, he could go into separate locations (where he knows the target is), and acquire the location match (the Targets SIM identity) by means of cross-referencing the captured IMSI values within the system s database. The Target Identifier is able to provide the interception characteristics through its sub-system ( its IMSI Catcher ) in order to provide the Surveillance Officer with MSS and MNC values of the Target s phone. This collection of information is assimilated into the system s database for a variety of forensic applications, one of which is Phone Tracking. RF Tracking Features: Direction Finding: The system is able to covertly locate a Target using its active Base Station technology with a unique localization feature. This involves sending a silent tracking signal to the Target's handset. The Surveillance Operator would select the Target Identifier (the IMSI) from the list of captured GSM handsets, and then send a silent command for that handset to transmit on a specific free channel. This transmission is detected using the optional Direction Finder and provides a visual indication of the signal strength as well as an audible indication (the optional earphone is recommended for covert use). The Graphic User Interface of the Direction Finder will also provide an approximate indication of the distance the Target is located in relationship to the 3G Cell Catcher, so that the Surveillance Operator knows where to go with the portable Direction Finder. The optional Direction Finder is a good complement to the CC1900 3G. Covert and Discreet GUI Directional Antenna Wireless Interface Power Supply

4 CC1900 3G System GUI Screenshots Managed Access Screenshot Shown here is the CC1900 as Targets are a) identified [captured] b) entered into the system s database, where UMTS users may be given permission or denied from accessing the local service provider. 3G Tracking Screenshot Shown here is the CC1900 with a UMTS Target that is 324 meters away from the system. The distance window has a power level control, enabling the Surveillance Operator to increase or decrease the covert tracking alert signal.

5 System Features The Cell Catcher imitates the local GSM environment, actively attracting phones. It can capture mobile identities, including manufacturer details of the of the Target's GSM phone as well as phone type. It can 'hit the ground running' by configuring its internal BTS to work automatically by local GSM networks. The CC1900 Fully identifies the IMSI, IMEI, and TMSI (the temporary mobile subscriber ID) used to Black List and White List phones (in a prison, for example) It can operate as a private cellular network, allowing authorized users to make calls to each other, while denying calls to others. It has an optional Direction Finder for localized cell tracking of Targets It is optimized to operate in a stable manner under congested multi-path RF environments The system's core BTS is able to work independently on all RF Networks for 3G GSM (for 2G, see our 2G Cell Catcher) The system can increase its range of capturing phones by modifying the Broadcast Control Channel attributes, which makes it seem like the system is as powerful (in Wattage) as the local towers of the local service providers. This is used to attract many GSM handsets. It has record keeping of GPS location attributes for archiving and reporting. It has an available Java Client for additional administrator / participate to view on a Desktop or Laptop PC. PDA Feature: The system has an available PDA Client for portable and discreet missions, enabling the Surveillance Operator to move the system and not remain stationary (Windows Mobile based). The system is database driven in order to identify IMEI attributes of 2G phones and cross-reference PLMN (against public networks) and gain intelligence on the Target handsets. It has remote accessibility using inborn wifi It has a network port (uplink to WAN) to permit remote diagnostics as well as any upgrades to system software. Operating Specifications Number of monitored mobiles Minimum 255 Power Supply Vehicle battery, 11-30V DC, or mains via AC adaptor RF Power Contains two fully functional commercial grade 15W BTS transceivers Handsets acquisition speed Processing Capability Effective Range (City with dense apartment areas, for example) Effective Range (rural area) Effective Range (Flat terrain with direct LoS) up to 800 per minute across two networks 1x BCCH, 1x CBCH (CBAI.50), 19x SDCCH, 6x TCH (EFR/FR) With the Vehicle mounted directional antenna m, without the Vehicle mounted directional antenna m. With the Vehicle mounted directional antenna m, without the Vehicle mounted directional antenna m With the Vehicle mounted directional antenna m, without the Vehicle mounted directional antenna m