Transcript CPD3000 Components - PDA Electronics

pda
electronics
Using PDA products to control / eradicate illicit
communications in Prisons.

Why ?

With direct and unmonitored communications , criminals can :
Control the supply of drugs into the prison.

Intimidate or assassinate witnesses / business rivals

Continue to run criminal businesses directly

Plan and execute escapes.
pda
electronics
Using PDA products to control / eradicate illicit
communications in prisons.






What is Required:
Real time system with central reporting and a single clock source
Remote Units linked by Radio – no wiring issues, quick installation
Mobile detectors- able to move units easily.
Add new detectors - to detect new technology threats such as :
 Bluetooth / WiFi
 Satellite Phones / Modems
 LTE – 4G phones less than 2 years away- PC modems less than
1 year
Able to supply information to PC based Intelligence Software
pda
electronics
To provide such a solution requires 2 products:

CPD3000 System for wide area use

GSM196 Handheld detector to pinpoint the actual cell
pda
electronics
CPD3000– distributed detection system



Supports up to 220 remote detectors at ranges up to 5km
Uses license free frequencies in the 458MHz ISM band
System can support different types of detectors



Standard Unit based on the 196 (2/3G detection)
Options:
 Bluetooth and /or WiFi detector
 Satellite phones (Thuraya and Iridium)
 LTE – European and US options
Applications - rapid or temporary deployments



Prisons – Intense monitoring of areas (intelligence reports)
Government events – conferences etc
Police surveillance operations
pda
electronics
Using the CPD3000 for prison applications




Monitor a complete prison for cellular traffic from a single location.
Supplies vital intelligence
 Type of phone technology- 2G(GSM) or 3G
 Type of usage – call or text
 Pattern of usage – times and dates
 Signal strengths indicates number of phones
Helps position search staff – at the right time and right place
System future proof – new threats-new detection units
CPD3000 Components

CPD310 Hub system

CPD351 Remote Detector

CPD391 Remote Repeater Unit

CPD392 Remote Trunk Repeater
CPD310 Hub system
Screen displays
Initial Start up Screen – Hub serial No and
software version
Initial 30 second scan for remote active units
Result of scan
Sample report from Detector 048
Alarm - GSM SMS/Registration detected by unit 51
Typical printout
The hourly system status

05:00:00
30 Jun 2011
SYSTEM STATUS
Hub ID & vers:
0116
V2.34+3.3

Remote Units:
2 total
(dets: 2, jmrs:0, rpts:0)
Low battery: all OK
Poor link:
all OK

EVENTS IN LAST HOUR:


23
Analysis of printout

05:03:00 D066 GSM call
00m16s S=7
Start time
Duration
Unit #
Alarm type
Max signal strength
System will alert to a call but will only print when duration is known

05:11:10 D066 GSM net/SMS
Start time

00m04s S=9
Alarm either registration or text
05:16:31 D066 GSM net/SMS
00m08s S=9
When alarm exceeds 4secs –
phone sending long text i.e. greater than 160 characters so message is spread over multiple frames

05:17:23 D066 GSM net/SMS
00m04s S=9
Could be response to the earlier text message


05:17:23 D070 GSM net/SMS
05:16:24 D066 3G call
00m04s S=3
04m24s S=5
3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48
Analysis of printout

05:03:00 D066 GSM call
00m16s S=7
Start time
Duration
Unit #
Alarm type
Max signal strength
System will alert to a call but will only print when duration is known

05:11:10 D066 GSM net/SMS
Start time

00m04s S=9*
Alarm either registration or text
05:16:31 D066 GSM net/SMS
00m08s S=9*
When alarm exceeds 4secs –
phone sending long text i.e. greater than 160 characters so message is spread over multiple frames

05:17:23 D066 GSM net/SMS
00m04s S=9*
Could be response to the earlier text message


05:17:23 D070 GSM net/SMS
05:16:24 D066 3G call
00m04s S=3
04m24s S=5
3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48
* Same signal strength-indicates possibly from the same phone
Analysis of printout

05:03:00 D066 GSM call
00m16s S=7
Start time
Duration
Unit #
Alarm type
Max signal strength
System will alert to a call but will only print when duration is known

05:11:10 D066 GSM net/SMS
Start time

00m04s S=9*
Alarm either registration or text
05:16:31 D066 GSM Call
00m16s S=9*
When alarm exceeds 4secs –
phone sending long text i.e. greater than 160 characters so message is spread over multiple frames

05:17:23 D066 GSM net/SMS
00m04s S=9*
Could be response to the earlier text message


05:17:23 D070 GSM net/SMS
05:16:24 D066 3G call
00m04s S=3
04m24s S=5
3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48
* Same signal strength-indicates possibly from the same phone
The short call length indicates that Base station has instructed phone to
reduce power and D066 has lost contact with the phone as a result. Not a
Analysing Printout

Prisoner making one call
The system will detect 3 events
 Initial registration of the phone
 The call itself
 The turn off notification

Prisoner texting
The system will detect 2 events for a single text
The incoming /outgoing SMS message
 The response – usually within a few minutes



In both the above , group events according to detected signal strength as this
is an indication that events may have come from the same phone
Short duration calls indicate that the BTS has instructed phone to reduce
power resulting in a loss of detected signal by a CPD351
CPD351 Remote Detector

Detection ranges (free space):

GSM up to 300m
UMTS 2100 –approx 80 to100m

Maximum power for a 3G class 3 phone is 250mW

typical output can be <10mW in strong areas






Battery life (internal) 3 to 4 days
Anti-tamper facility
Prison radio interference suppression (400-500MHz)
Enhanced GSM detection algorithm for calls
Can control other devices e.g. low powered jammers, audio
recording equipment etc.
Ideal locations – Service Cupboards
(with wooden doors)
Typical HMP wing layout
Deploying the CPD351






Deploy 1 unit per wing initially with sensitivity setting =9
Gather information for approx. 1 week to map the type of
phones in use (2G/3G) and how they are being used
When using multiple detectors in a wing, reduce sensitivity so
detectors cover separate areas.
Use directional antennas to monitor specific areas.
When moving detectors to new locations-press the Test button
on the unit so printer records the event.
If strong external GSM signals being detected, sensitivity can
be further reduced via rear switch-UMTS sensitivity
unchanged
SDA351 Directional Antenna
Specifically designed to enhance performance of the
CPD351
Directional – 60º wide sensitivity beam*
* applies to GSM1800 and UMTS only, GSM900 is less directional
Increased gain at 1950Mhz for better 3G detection
Small size aids deployment
SA918 Antenna
Same antenna as used with GSM196
Directional -60º wide sensitivity beam
*applicable across all bands
Monitoring of a wing
using a single CPD351 located centrally
05:14:17
05:14:4200m04s
00m04s
D016
D016
S=7
S=7
GSM net/SMS
GSM net/SMS
S=7
S=7
Problem: Difficult to tell whether at S=7 there is more than one
phone – only use one detector per wing for intelligence gathering
Monitoring of a wing
using two units
05:48:23
D016
S=9
05:48:2300m04s D044
00m04s S=2
S=9
S=2
GSM net/SMS
GSM net/SMS
Monitoring of a wing
two units but with different sensitivity settings
05:34:07
D016
S=9
05:55:2700m04s D044
00m04s S=7
S=9
S=7
GSM net/SMS
GSM net/SMS
Monitoring of a wing
using different types of antenna
05:34:07
05:55:2700m04s
00m04s
D016
S=9
D044
S=7
GSM net/SMS
GSM net/SMS
S=9
Using omni-directional
antenna with variable
sensitivity settings
S=7
Using a directional
antenna to monitor
a specific cell
Monitoring of a wing
covering Landings as well
05:30:24
D016
00m04s S=9
05:30:24
D024
00m04s S=7
S=9
GSM net/SMS
GSM net/SMS
Level 1
Re-enforced concrete floor
S=7
Ground Level
Monitoring of a wing
covering Landings as well
05:42:15
D016
00m04s S=6
05:42:15
D047
00m04s S=9
S=6
GSM net/SMS
GSM net/SMS
Level 1
Re-enforced concrete floor
S=9
Ground Level
CPD391 Repeater




Designed to pick up and re-transmit CPD351 signals
Detected signals validated before retransmission
Use the same transmit frequency as CPD351 units
Allows detector signals to be collected from a shielded
building / wing and retransmitted via an external
antenna. Typical location –roof spaces
CPD392 Trunk Repeater
Accommodation Block
Admin
Building
and
security
office
20:34 D016 GSM net/SMS
00m04s S=7
Workshops,
Gym and
Canteen
Facilities
CPD351
CPD351 (D016)
transmissions
screened by
workshops
CPD391
Only
transmissions
from other
CPD391
repeaters are
recognized
CPD392
CPD351
Detectors
deployed in
wings
GSM196
Handheld Cell-phone Detector

Detects both 2 and 3G phones.




LED Bargraph signal level indication
Automatic Brightness Control




Feature requested by prison security officers
Unique Signal Analysis for accurate detection
Cadenced vibration alert for covert operation
Ease of Use


Range better than 400metres to a 2W source (GSM900)
Imbedded filters to restrict detection to Handset
frequencies
Single button operation
Directional antenna option

SA918 antenna allows accurate location of a target
and increases range
GSM196 + directional antenna option
Detection area primarily
restricted to ± 30º both in the
horizontal and vertical planes
Searching with GSM196 + SA198 Antenna
A Single search officer can quickly identify source of a signal.
The antenna projects an area of sensitivity very much like a torch beam
Check readings on the 196 as the antenna is moved.
Only really useful for tracing ‘calls’
Upper Level
Lower Level
When walking the landings,
the beam is approximately the
width of one cell at the window
end of the cell.
Check whether signal
is coming from the
lower or upper levels
Set 196 to ‘S’ mode and put outside each cell
suspected of sending GSM text messages.
The one with a flashing blue ‘N’ LED will be
the cell. For 3G text messages –only the ‘3’
LED will be flashing
Conclusion

Install CPD3000 system and deploy detectors in wings / cell blocks

Capture ‘intelligence’ on how phones are being used ( call or text)
when (time) and where.

Move detectors to hot spots to improve location accuracy.

Search teams to be deployed to active areas with handheld detectors
to pinpoint cells if alarms are calls.

Deploy GSM196 units in HO or S modes to monitor suspect cells for
text alarms

Continue to monitor area after seizures to see how quick
replacements are being supplied.

The phone problem may not just confined to the prison wings
The latest security threat :
the GSM audio bug
Contains a GSM phone which can be accessed
from anywhere. Simply add a Pay as you Go SIM
card to activate.
Placed in security offices, operations rooms
etc by cleaners – takes only 10 seconds
Allows third parties ( criminals) to listen in on
operational planning meetings.
Now drug dealers will know when and where to
make next shipment to the prison.
Solution
Deploy additional detectors
in security related areas
Mobile CPD3000 system
For small prisons where there is
insufficient justification to
install a system – PDA can
supply a complete system in a
ruggedized case.
The detectors can be deployed
and the hub can be ‘hidden’ in a
suitable roof space.
Data is collected onto a memory
stick to be analysed when the
system is collected by the
regional search personnel.
All equipment including hub
powered by internal batteries for
up to 4 days