Multi-Channel Passive Intercept System

Multi-channel passive intercept system
CN-16 is designed for searching, intercepting and analyzing voice and SMS communication, as well as the capture of all service information circulating in GSM networks. It operates on networks without encryption or with A5/1 and A5/2 encryption algorithms.
CN-16 pioneers a niche of its own, offering extensive SMS interception capabilities in a cost-effective compact solution, currently unavailable outside the framework of government intelligence agencies.
CN-16 is a professional high-tech solution built expressly for the rigors of todays law enforcement. It can be operated in both stationary and mobile (vehicle) modes.
CN-16 is designed for operation by a single user, as well as continuous automatic operation mode without operator intervention. It can be programmed to listen to multiple networks simultaneously, using simple programmable options.
It is ideal for operation in prisons, airports and areas prone to trouble, where potential targets utilize SMS as their main means of communication. In addition it allows voice calls interception of desired targets.
Very compact; light-weight and portable, yet very robust.

Built-in power pack.
Integrated internal antennas.

Supplied as either a dual-band or quad-band GSM set.
Simultaneous multi-network operation.

Intuitive wizard allowing the operator fast and easy configuration. Flexible configuration of receivers (drag & drop). SMS keywords. Tracking of targets using silent SMS. The receiver can listen to all available GSM channels, depending on the system configuration.
Unique dual operation capability, in both online (real time) and offline (delayed) modes.
Recording of all received data onto external storage, allowing post session decryption and reconstruction. Embedded software capabilities for analyzing the recorded data and other information. Multiple systems can be used and configured over a remote desktop session.
The embedded software enables the following capabilities:
Listening to a maximum of 16 BTSs simultaneously. The system only listens to dedicated channels if there is a request on the BTS to do so. Since SMS sessions are very short (average 1 - 1.5 seconds max), the receivers can be reused immediately after capturing a session.
Search and identification of BTS control channel numbers, in full working frequency range.
Collecting and displaying technical information about the communication networks, with detailed indication of the parameters for each BTS.
Displaying a list of cells in the current location, with possibility to sort by provider, Rx-Level, Cell-ID, LAC, or custom name given by the operator of the system.
Assignment of tasks for each receiver in an automated mode or in manual mode.
Operational evaluation of received signal strength on all the receiving channels, based on a combination of Rx-Level, SNR and error-rate.
Implemented error correction for dedicated channels on layer 1. Display of GSM messages passing through the control channels of the BTS and mobile stations.
Saving and fast loading of all the system configuration parameters including assigned tasks for each receiver, with an option to restore the last session.
Interception of forward and reverse dedicated channels for SMS communication (under sufficient signal strength).
Support of signaling protocols for SDCCH/8 and SDCCH/4 channel formats.

Support of Frequency-Hopping mode. Saving of decrypted SMS and auto-saving of captured data to the computer hard disk.
Linking a target and a system identifier used by a network (TMSI) using a silent SMS.
Selection of targets using both constant (IMSI, IMEI, IMEISV) and temporary (TMSI) identifiers. Maintenance of databases for all the information accumulated during system operation (SMS, voice calls, captured data, targets).
The CN-16 uses AvalonDock to create a docking layout system. Avalondock supports fly-out panes, floating windows and multiple docking managers in the same window.
The CN-16 is operated with a remote decipher over the internet, using an encrypted session. This allows a minimal hardware setup (less than 4kg) to be carried by the operator visiting a place where a target is located. The system is divided into 4 slots with 4 receivers on each. Slots are independent and power can be toggled to 4, 8, 12 or 16 receivers, to save battery power when operating in the field.
Stackable construction; The system can be upgraded with more channels.

CN-16 Software runs on Windows XP/Vista/Windows 7 OS environment.
Working frequency bands: GSM-850, P-GSM-900, E-GSM 900, DCS-1800, PCS-1900

Number of independent receiving channels: * stackable up to 4 units, 64 channels Input impedance of RF path: 16* 50 ohm
Frequency channel step:

Reception path sensitivity - not less than:
200 kHz
-102 dBm
Frequency setting accuracy - not lower than:
1 kHz
External interface:
Power supply:
USB
5V-DC 2.1A
Overall dimensions:
Total weight:
24x12x22cm (Height, Width, Depth)

2.5kg
Other:
TX-ready hardware for smart jamming
Enclosure - Light-weight, portable and robust:
Enclosure type:
Vertical, Botego-520
Dimensions:
Material:
24 X 12 X 20cm (H, W, D)
ABS (Acrylonitrile Butadiene Styrene)
Color:
Ingress Protection:
Light gray (RAL-7035)

40
Integrated internal antennas:
Type:
Helical
Mounting:
Gain:
Vertical, Omni Directional

Max. 3dB
Frequency:
850/900/1800/1900MHz
Built-in power pack:
Cells:
Li-ion, Rechargeable
Capacity:
Life cycle:
5200mAh
over 1000 times
After-life cycle:
Usage:
80% of initial capacity

> 4 Hours
A5/1 and A5/2 remote deciphering unit. Control computer. Power supplies for both stationary and vehicle operation.
Software package.
Connection cables.
System description and operation manual.
TMSI Unlike active systems, passive interception systems identify mobile subscribers by their TMSI (Temporary Mobile Subscriber Identity). IMSI and IMEI are transmitted only on the registration phase, and once the MS is registered, only TMSI is used. TMSI is used in order to prevent transmitting of the IMSI (fixed identifier) over the air. In order to get the TMSI, a silent SMS is sent to the target so that the TMSI and target are bound and added to the database. The system will automatically follow TMSI changes (location update)
Targeting A Nokia 6120c Symbian phone is supplied as part of the system. The phone includes two pre-installed applications: 1. GauzyMSG - Enables sending a silent SMS in a special format to the target. The message is completely hidden from the target and used to bind the new TMSI and the target in the DB. 2. NetMonitor Provides various information on the used network(s) and BTSs around.
Operating Range Downlink SMS and reverse voice traffic can be intercepted from up to 10 km (in direct visibility) and up to 500 m of Uplink messages and voice calls in city conditions. The interception range of Uplink messages and forward voice frequency (sent from the MS to the BTS) depends on the distance between the target to the used BTS, the distance between the CN-16 system and the target, fading from metals in the vicinity (cars, buildings etc), RF noise, weather, etc.
Operating Range The following list details factors that block RF signals and their interference level: Buildings: 5-37dB, near window 12dB
Inside cars: Human body: Fast fading: Slow fading (holes):
6dB 6-9dB ~11dB ~5dB
Decipher unit The CN-16 supports some of the leading deciphers on the market. The basic version is used for demonstration purposes and for postoperation analysis of intercepted messages. It takes up to 10 seconds to get a KC key recovered using the basic version. The system can be supplied with a 2.5sec, 700ms, 400ms, 250ms or 50ms decipher, depending on the customer requirement and the traffic in the intercepted area. All the supported deciphers communicate with the system using TCPIP, and can be either wired-connected or communicate over the internet, to minimize the hardware setup carried by the operator.

Multi-Channel Passive Intercept System

Uploaded by

Copyright:

Available Formats

Multi-Channel Passive Intercept System

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Multi-Channel Passive Intercept System

Uploaded by

Copyright:

Available Formats

Multi-channel passive intercept system

Very compact; light-weight and portable, yet very robust.

Integrated internal antennas.

Simultaneous multi-network operation.

The embedded software enables the following capabilities:

Support of signaling protocols for SDCCH/8 and SDCCH/4 channel formats.

Stackable construction; The system can be upgraded with more channels.

Working frequency bands: GSM-850, P-GSM-900, E-GSM 900, DCS-1800, PCS-1900

Frequency channel step:

Frequency setting accuracy - not lower than:

24x12x22cm (Height, Width, Depth)

TX-ready hardware for smart jamming

Enclosure - Light-weight, portable and robust:

Light gray (RAL-7035)

Integrated internal antennas:

Vertical, Omni Directional

Built-in power pack:

80% of initial capacity

System description and operation manual.

Inside cars: Human body: Fast fading: Slow fading (holes):

6dB 6-9dB ~11dB ~5dB

You might also like