Cellular Phone Control System for Prisons and Corrective Services Facilities ENGAGE CELLGUARD October 2011
Table of Contents 1 Introduction... 1 2 ENGAGE CELLGUARD Overview... 2 3 ENGAGE CELLGUARD Main functionality... 3 4 ENGAGE CELLGUARD Prisons solutions... 4 4.1 Tactical ad-hoc CELLGUARD... 5 4.2 Fixed CELLGUARD installation... 6 5 Summary... 7 Unauthorized use, duplication, or modification of this document in whole or in part without the written consent of Verint Systems Inc. is strictly prohibited. By providing this document, Verint Systems Inc. is not making any representations regarding the correctness or completeness of its contents and reserves the right to alter this document at any time without notice. Features listed in this document are subject to change. Please contact Verint for current product features and specifications. All marks referenced herein with the or TM symbol are registered trademarks or trademarks of Verint Systems Inc. or its subsidiaries. All rights reserved. All other marks are trademarks of their respective owners. 2010 Verint Systems Inc. All rights reserved worldwide.
1 Introduction Unlawful usage of cellular phones became a major problem in corrective services departments (CSD) and prison authorities (PA) around the world. Cellular phones, small and easy to hide, are smuggled into the inmates' cells and are in use to continue and run the inmates' illegal activities within the prison walls. There are few technologies available in the market for handling this challenge including cellular signal detectors, partial and full site jammers and special handheld phone detectors (similar to metal detectors). The common method of blocking unlawful usages of cellular phones is achieved by jamming of the cellular networks at the prison premise (full or partial). The cell-phone jamming technologies have few disadvantages: Jammers cannot distinguish between legitimate cell phone of unlawful phones. Jammers cannot identify the offender (the owner of the non legitimate cell phone). Jammers cannot know for sure if phones are actually blocked. Jammers cannot be used to collect intelligence on the smuggling patterns and usage patterns of the phone. Jammers can t be use to physically find the cell phones. Jammers blocking is based on power competition with the cellular operator's base station. Verint s ENGAGE CELLGUARD provides CDS/PA with the tools to control the usage of cellular phones, target and block (denial of service) only the unlawful handsets while the legitimate phones in the area can continue to function as normal without any interruption. Furthermore the CELLGUARD provides additional functionalities that are handy in fighting the unlawful usage of phones by inmates. The solution presented in the paper is suitable for GSM/UMTS networks and it is not applicable to CDMA network. Verint Systems Inc. is a global leader in Actionable Intelligence solutions and value-added services. More than 10,000 organizations in over 150 countries use our workforce optimization and security intelligence solutions to improve enterprise performance and make the world a safer place. For more information, visit www.verint.com. Page 1
2 ENGAGE CELLGUARD Overview ENGAGE CELLGUARD is a portable, stand-alone suite of solutions for tactical or localized communication interrogation and interception of GSM/UMTS mobile handsets over the air (off-air). ENGAGE CELLGUARD remotely interrogates, identifies, locates and intercepts mobile handsets subscribed to GSM or UMTS networks. The ENGAGE CELLGUARD can also establish and capture mobile handsets in a GSM virtual network to conduct tactical communication and/or manipulations over GSM phones. The ENGAGE CELLGUARD tactical design and form factor, along with its sophisticated applications gives Law Enforcement Agencies a powerful tool to track and intercept targets via their mobile handsets. With ENGAGE CELLGUARD law enforcement agencies can perform the following operational tasks: Identify anonymous handsets (IMSI / IMEI / TMSI) without attracting attention. Collect, verify and send alerts if target handsets are identified at scenes such as airports, borders, embassies and prisons. Selectively jam an area or specific phones to isolate target handsets from the GSM and the UMTS public network. Neutralize GSM/UMTS cellular unattended devices completely disable handsets operation. The only way to bring the handset back to service is to manually restart it. Identify the location of a target in GSM and UMTS networks. Additional optional capabilities Covertly record outgoing and incoming calls of a target handset over GSM network, as well as SMS text messages (including in A5.1 networks). Perform different SMS manipulations such as sending fake SMS to targets or sending fake SMS on behalf of the target to any other subscriber or even change the content of an incoming and outgoing SMS. Establish a private GSM network for internal tactical use of the forces (with optional backhaul to external networks) and/or to directly call targets (e.g. in hostage situations). ENGAGE CELLGUARD includes embedded GSM and UMTS modules and a GSM/UMTS scanner. It allows for the interrogation and identity collection of all GSM and UMTS subscribers in the operational area in one unit, with a single unified database managed by a single custom application. Furthermore, it can hand-over UMTS subscribers into the ENGAGE CELLGUARD GSM private network for further operational manipulations such as calls and SMS interception. ENGAGE CELLGUARD system is designed to work under different operating scenarios, with easy, rapid deployment. Page 2
3 ENGAGE CELLGUARD Main functionality Monitoring and Detection The CELLGUARD can identify any unauthorized phone as soon as it enters the any area of interest. Every phone is detected by its unique identity (IMSI and IMEI) and investigation can begin to find to whom it belongs or where it has been previously used. Full/Selective Communication Blocking Any phone that is detected can be instantaneously blocked so it will not be able to communicate at all. The blocking depends on the CELLGUARD mode of the operation either full blocking of all the phones, blocking of all phone but a list of allowed phone, blocking only the listed phones while allowing all the rest to operate normally. Not like Jammers in CELLGUARD communication blocking mode the affected phones still indicate a full operator signal and operator logo but calls can t be made. Not like jammers, the blocking coverage is based on a predefined radius and therefore minimizes the interference with the commercial cellular networks surrounding the prison's facilities. Locating Unauthorized Phones The CELLGUARD Silent Call feature allows exact locating of phones within the prison with assistance of dedicated homing devices. This capability helps to pinpoint the cell phone and holder/owner of the phone. The CELLGUARD "silent call" feature is operating in all phone types: GSM phones, UMTS only phones and dual mode phones. Phone Neutralization (Denial of Service) An advanced mode of the CELLGUARD allows insertion of phones into out-of-service mode. Even if the phone will be momentarily out of the CELLGUARD s effective range, it will still be out-of-service and inoperative. The only way to bring such a phone back to service is by restarting it. However, assuming the CELLGUARD keeps transmitting, the phone will turn into out-of-service mode again as soon as it is restarted. This puts the phone in a vicious circle that does not allow any communication. (option) Interception of Voice Calls and SMS Messages With the CELLGUARD it is possible not only to block phones, but if required, also to intercept the phone communication. This advanced man-in-the-middle interception capability is seamless to the monitored subject, the party he is communicating with and the network operator. (option) SMS Catching and Fake SMS Even when no interception module is used, all the SMS messages sent by the captured phones can be read by the CELLGUARD system, while the users will actually believe the SMS messages were sent and arrived to their destination. Furthermore, SMS messages can be sent from the CELLGUARD system to captured phones in behalf of any number, so the monitored subject will believe those are authentic SMS from their mates. The CELLGUARD system, while in interception mode, allow the operator to set the SMS on the fly and to change the content of the outgoing SMS before it reaches its destination or the content of an incoming SMS before it reaches the target. Note: some of the above features are optional and will be disabled if the customer will not choose the purchase this option. Page 3
4 ENGAGE CELLGUARD Prisons solutions The main application in Prison is blocking the unlawful usage of phones by inmates. In order to achieve this functionality without interfering with legitimate phone The CELLGUARD application manages two lists, one list of friendly/legitimate phones that shouldn t be affected by the transmission of the system and a second list of un-authorized phones which will always be affected by the system operation and will be blocked from operation (unless the CELLGUARD operator decides otherwise). Phones that are in neither lists will be handles according to the CELLGUARD operation mode either no affect or denial of service. Using this capability the CSD/Prison authority (PA) can choose the desired setting of system according to the legislation and procedures in each and every jail as follows: a. Full blocking (DOS) - in case usage of phones is not allowed to anyone within the prison premise including inmates, visitors and CSD staff the CELLGUARD can be configured for complete denial of service mode in which all the phones within the effective area are block. b. Selective blocking (DOS) for inmates. In this case only CSD/PA staff allowed using the phones within the prison area while any other detected phone will be automatically blocked by the system. In addition the CELLGUARD provided the following optional capabilities that might be required for advanced actions against inmates: a. Locate hidden cell phones b. Interception of voice calls and SMSs c. Warning SMS broadcast for all affected phones. The ENGAGE CELLGUARD can be deployed at prisons in several configurations depending on the operational needs and legislation: a. Tactical ad-hoc CELLGUARD forward/area specific operation b. Fixed installation for full premise coverage. Page 4
4.1 Tactical ad-hoc CELLGUARD CELLGUARD is designed for ad-hoc tactical covert operation. The CELLGUARD can be hand carried to the area of interest in the prison premise and remote controlled by a PDA. During the operation the CELLGUARD covers a limited area only and is affecting only the phones within the area. Such deployment can be used in case it is required to block specific ward or performing any operation on specific ward like locating all the hidden phones or intercepting specific inmate/group of inmates. Page 5
4.2 Fixed CELLGUARD installation CELLGUARD Fixed installation configuration is installed in a rack connected to centralized cell tower with high gain anttena or distributed anttenas that can covers the whole prison complex. The CELLGUARD power is ammlifiled by a dedicated power amplifier ensureing complete covarage of the compound. The system can operate 24/7 to block all un-authorized phones, covering concurrently 2G and 3G networks of all the service providers and controled by a centerlized administrator workstation. The CELLGUARD administrator will be able to manage the legitimate phones list and the unlawful phones according to the legislations and the operational requirements. In case the system shouldn t in any case interferes with legitimate phones the CELLGUARD administrator should manually add the un-authorized phones to the blocked list. These phones can be identified by time of startup, distance information from the cell etc. The legitimate phones of the prison staff and prisons emploees should be updated in the system s internal list the phones in these list will not be affected by the system in any case. An advanced capability of the CELLGUARD fixed installation alowes automatic identification of unlawful phones withing the prison. The system automaticlly idetifies the unlawful phones by several parametes parameters including RF messurment, network parameters and usage patterns. The system can either alert the CELLGUARD administrator for suspected phones or aotumatlly block the suspected phones. Page 6
5 Summary Verint ENGAGE CELLGUARD tactical solutions provide law enforcement and government agencies with a variety of modular, portable, and covert solutions for controlling, blocking, tracking a subjects handsets over GSM and UMTS networks, optionally monitoring calls and SMS s, and locating the mobile handsets of known terrorist, criminals, and suspects in the field. This technology provide corrective services departments/prison authorities with a unique capability for controlling the unlawful usage of cell phones in prisons or corrective services facilities starting from the very basic selective blocking, locating the phones and additional advanced capabilities mentioned in the paper. Verint ENGAGE CELLGUARD is widely used by many law enforcement and government security organizations for many different applications and operational needs, Verint in-house experts can discuss any operation requirement in details and tailor the solution to comply with legislation and guidelines. Page 7
Annex A: Prison Success story CELLGUARD has been deployed over the world in more than 40 countries over the past 8 years. There are many success stories that customer s kindly share with us, however we cannot distribute them with other customers due to their sensitive nature. Nevertheless, the case below was published in the media and we have obtained the customers approval to refer it to the CELLGUARD. Success story in Brazil CELLGUARD in prisons The above extract is taken from the official newspaper of the Ministry of Security, of the State of Rio Grande do Sul in Brazil. The article provides a report of a 2 days trial in 4 prisons in Brazil. During the trial 689 GSM phones were detected! In the highlighted paragraph: The equipment of latest technology used for this was given by an Israeli company. It permits to scan the frequency of the cellular working inside the prisons and locate them exactly Page 8