Using PDA products to control / eradicate illicit communications in Prisons. Using PDA products to...

Using PDA products to control / eradicate illicit communications in Prisons.

Why ? With direct and unmonitored communications , criminals can :-

Control the supply of drugs into the prison.

Intimidate or assassinate witnesses / business rivals

Continue to run criminal businesses directly

Plan and execute escapes.

pda elec tronics

Using PDA products to control / eradicate illicit communications in prisons.

What is Required:

Real time system with central reporting and a single clock source

Remote Units linked by Radio – no wiring issues, quick installation

Mobile detectors- able to move units easily. Add new detectors - to detect new technology threats such as :

Bluetooth / WiFi Satellite Phones / Modems LTE – 4G phones less than 2 years away- PC modems less

than 1 year Able to supply information to PC based Intelligence Software

pda elec tronics

To provide such a solution requires 2 products:

CPD3000 System for wide area use

GSM196 Handheld detector to pinpoint the actual

cell

pda elec tronics

CPD3000– distributed detection system Supports up to 220 remote detectors at ranges up to

5km Uses license free frequencies in the 458MHz ISM band System can support different types of detectors

Standard Unit based on the 196 (2/3G detection) Options:

Bluetooth and /or WiFi detector Satellite phones (Thuraya and Iridium) LTE – European and US options

Applications - rapid or temporary deployments Prisons – Intense monitoring of areas (intelligence reports) Government events – conferences etc Police surveillance operations

pda elec tronics

Using the CPD3000 for prison applications Monitor a complete prison for cellular traffic from a single location. Supplies vital intelligence

Type of phone technology- 2G(GSM) or 3G Type of usage – call or text Pattern of usage – times and dates Signal strengths indicates number of phones

Helps position search staff – at the right time and right place System future proof – new threats-new detection units

pda elec tronics

CPD3000 Components

CPD310 Hub system

CPD351 Remote Detector

CPD391 Remote Repeater Unit

CPD392 Remote Trunk Repeater

CPD310 Hub system

Screen displays

Initial Start up Screen – Hub serial No and software version

Initial 30 second scan for remote active units

Result of scan

Sample report from Detector 048

Alarm - GSM SMS/Registration detected by unit 51

Typical printout

The hourly system status

05:00:00 30 Jun 2011 SYSTEM STATUSHub ID & vers: 0116 V2.34+3.3

Remote Units: 2 total(dets: 2, jmrs:0, rpts:0)

Low battery: all OK Poor link: all OK EVENTS IN LAST HOUR: 23

Analysis of printout

05:03:00 D066GSM call 00m16s S=7Start time Unit # Alarm type Duration Max signal strengthSystem will alert to a call but will only print when duration is known

05:11:10 D066GSM net/SMS 00m04s S=9Start time Alarm either registration or text

05:16:31 D066GSM net/SMS 00m08s S=9When alarm exceeds 4secs –phone sending long text i.e. greater than 160 characters so message is spread over multiple frames

05:17:23 D066GSM net/SMS 00m04s S=9Could be response to the earlier text message

05:17:23 D070GSM net/SMS 00m04s S=3 05:16:24 D0663G call 04m24s S=5

3G call detected – call lasted for 4minutes and 24 seconds but time now is 05:20:48



05:11:10 D066GSM net/SMS 00m04s S=9*Start time Alarm either registration or text

05:16:31 D066GSM net/SMS 00m08s S=9*When alarm exceeds 4secs –phone sending long text i.e. greater than 160 characters so message is spread over multiple frames

05:17:23 D066GSM net/SMS 00m04s S=9*Could be response to the earlier text message



* Same signal strength-indicates possibly from the same phone



05:11:10 D066GSM net/SMS 00m04s S=9*Start time Alarm either registration or text

05:16:31 D066GSM Call 00m16s S=9*When alarm exceeds 4secs –phone sending long text i.e. greater than 160 characters so message is spread over multiple frames

05:17:23 D066GSM net/SMS 00m04s S=9*Could be response to the earlier text message



* Same signal strength-indicates possibly from the same phoneThe short call length indicates that Base station has instructed phone to reduce power and D066 has lost contact with the phone as a result. Not a system fault – this is how GSM phones work when on a call

Analysing Printout

Prisoner making one callThe system will detect 3 events

Initial registration of the phone The call itself The turn off notification

Prisoner textingThe system will detect 2 events for a single text

The incoming /outgoing SMS message The response – usually within a few minutes

In both the above , group events according to detected signal strength as this is an indication that events may have come from the same phone

Short duration calls indicate that the BTS has instructed phone to reduce power resulting in a loss of detected signal by a CPD351

CPD351 Remote Detector

Detection ranges (free space): GSM up to 300m UMTS 2100 –approx 80 to100m Maximum power for a 3G class 3 phone is 250mW

typical output can be <10mW in strong areas

Battery life (internal) 3 to 4 days Anti-tamper facility Prison radio interference suppression (400-500MHz) Enhanced GSM detection algorithm for calls Can control other devices e.g. low powered jammers, audio

recording equipment etc. Ideal locations – Service Cupboards

(with wooden doors)

Typical HMP wing layout

Deploying the CPD351

Deploy 1 unit per wing initially with sensitivity setting =9 Gather information for approx. 1 week to map the type of

phones in use (2G/3G) and how they are being used When using multiple detectors in a wing, reduce sensitivity

so detectors cover separate areas. Use directional antennas to monitor specific areas. When moving detectors to new locations-press the Test

button on the unit so printer records the event. If strong external GSM signals being detected, sensitivity

can be further reduced via rear switch-UMTS sensitivity unchanged

SDA351 Directional Antenna

Specifically designed to enhance performance of the CPD351

Directional – 60º wide sensitivity beam** applies to GSM1800 and UMTS only, GSM900 is less directional

Increased gain at 1950Mhz for better 3G detection

SA918 Antenna Same antenna as used with

GSM196Directional -60º wide sensitivity beam*applicable across all bands

Small size aids deployment

Monitoring of a wingusing a single CPD351 located centrally

S=7

S=7

05:14:17 D016 GSM net/SMS00m04s S=705:14:42 D016 GSM net/SMS00m04s S=7

Problem: Difficult to tell whether at S=7 there is more than one phone – only use one detector per wing for intelligence gathering

Monitoring of a wingusing two units

S=9

S=2


Monitoring of a wingtwo units but with different sensitivity settings

S=9

S=7


Monitoring of a wingusing different types of antenna

S=9

S=7

Using a directional antenna to monitor a specific cell

Using omni-directional antenna with variable sensitivity settings


Monitoring of a wingcovering Landings as well

Ground Level

Level 1

S=7

S=9

Re-enforced concrete floor


Monitoring of a wingcovering Landings as well

Ground Level

Level 1S=6

S=9


Re-enforced concrete floor

CPD391 Repeater

Designed to pick up and re-transmit CPD351 signals Detected signals validated before retransmission Use the same transmit frequency as CPD351 units

Allows detector signals to be collected from a shielded building / wing and retransmitted via an external antenna. Typical location –roof spaces

CPD392 Trunk Repeater

Admin Building

and security office

Workshops, Gym and Canteen Facilities

CPD392

CPD391

CPD351

CPD351Detectors deployed in wings

Accommodation Block

Only transmissions

from other CPD391

repeaters are recognized20:34 D016 GSM net/SMS

00m04s S=7

CPD351 (D016) transmissions screened by workshops

GSM196 Handheld Cell-phone Detector

Detects both 2 and 3G phones. Range better than 400metres to a 2W source (GSM900) Imbedded filters to restrict detection to Handset

frequencies

LED Bargraph signal level indication Automatic Brightness Control

Feature requested by prison security officers Unique Signal Analysis for accurate detection Cadenced vibration alert for covert operation Ease of Use

Single button operation Directional antenna option

SA918 antenna allows accurate location of a target and increases range

GSM196 + directional antenna option

Detection area primarily restricted to ± 30º both in the horizontal and vertical planes

Searching with GSM196 + SA198 Antenna

A Single search officer can quickly identify source of a signal. The antenna projects an area of sensitivity very much like a torch beam

Check readings on the 196 as the antenna is moved. Only really useful for tracing ‘calls’

Lower Level

Upper Level

Set 196 to ‘S’ mode and put outside each cell suspected of sending GSM text messages. The one with a flashing blue ‘N’ LED will be the cell. For 3G text messages –only the ‘3’ LED will be flashing

When walking the landings, the beam is approximately the width of one cell at the window end of the cell.

Check whether signal is coming from the lower or upper levels

Conclusion

Install CPD3000 system and deploy detectors in wings / cell blocks

Capture ‘intelligence’ on how phones are being used ( call or text)

when (time) and where.

Move detectors to hot spots to improve location accuracy.

Search teams to be deployed to active areas with handheld

detectors to pinpoint cells if alarms are calls.

Deploy GSM196 units in HO or S modes to monitor suspect cells

for text alarms

Continue to monitor area after seizures to see how quick

replacements are being supplied.

The phone problem may not just confined to the prison wings

The latest security threat :the GSM audio bug

Contains a GSM phone which can be accessed from anywhere. Simply add a Pay as you Go SIM card to activate.

Placed in security offices, operations rooms etc by cleaners – takes only 10 seconds

Allows third parties ( criminals) to listen in on operational planning meetings.

Now drug dealers will know when and where to make next shipment to the prison.

Solution

Deploy additional detectors in security

related areas

Mobile CPD3000 system

For small prisons where there is insufficient justification to install a system – PDA can supply a complete system in a ruggedized case.

The detectors can be deployed and the hub can be ‘hidden’ in a suitable roof space.

Data is collected onto a memory stick to be analysed when the system is collected by the regional search personnel.

All equipment including hub powered by internal batteries for up to 4 days

Using PDA products to control / eradicate illicit communications in Prisons. Using PDA products to...

Documents

Transcript of Using PDA products to control / eradicate illicit communications in Prisons. Using PDA products to...