Features:
- Very compact; light-weight and portable, yet very robust.
- Built-in power pack.
- Integrated internal antennas.
- Supplied as either a dual-band or quad-band GSM set.
- Simultaneous multi-network operation.
- Intuitive wizard allowing the operator fast and easy configuration.
- Flexible configuration of receivers (drag & drop).
- SMS keywords.
- Tracking of targets using silent SMS.
- The receiver can listen to all available GSM channels, depending on the system configuration.
- Unique dual operation capability, in both online (real time) and offline (delayed) modes.
- Recording of all received data onto external storage, allowing post session decryption and reconstruction.
- Embedded software capabilities for analyzing the recorded data and other information.
- Multiple systems can be used and configured over a remote desktop session.
SOFTWARE FUNCTIONAL DESCRIPTION:
- The embedded software enables the following capabilities:
- Listening to a maximum of 16 BTSs simultaneously. The system only listens to dedicated channels if there is a request on the BTS to do so. Since SMS sessions are very short (average 1 - 1.5 seconds max), the receivers can be reused immediately after capturing a session.
- Search and identification of BTS control channel numbers, in full working frequency range.
- Collecting and displaying technical information about the communication networks, with detailed indication of the parameters for each BTS.
- Displaying a list of cells in the current location, with possibility to sort by provider, Rx-Level, Cell-ID, LAC, or custom name given by the operator of the system.
- Assignment of tasks for each receiver in an automated mode or in manual mode.
- Operational evaluation of received signal strength on all the receiving channels, based on a combination of Rx-Level, SNR and error-rate.
- Implemented error correction for dedicated channels on layer 1.
- Display of GSM messages passing through the control channels of the BTS and mobile stations.
- Saving and fast loading of all the system configuration parameters including assigned tasks for each receiver, with an option to restore the last session.
- Interception of forward and reverse dedicated channels for SMS communication (under sufficient signal strength).
- Support of signaling protocols for SDCCH/8 and SDCCH/4 channel formats.
- Support of Frequency-Hopping mode.
- Saving of decrypted SMS and auto-saving of captured data to the computer hard disk.
- Linking a target and a system identifier used by a network (TMSI) using a silent SMS.
- Selection of targets using both constant (IMSI, IMEI, IMEISV) and temporary (TMSI) identifiers.
- Maintenance of databases for all the information accumulated during system operation (SMS, captured data, targets).
SYSTEM DESIGN:
The OTP-CN16 uses AvalonDock to create a docking layout system. Avalondock supports fly-out panes, floating windows and multiple docking managers in the same window.
The CN-16 is operated with a remote decipher over the internet, using an encrypted session. This allows a minimal hardware setup (less than 4kg) to be carried by the operator visiting a place where a target is located.
The system is divided into 4 slots with 4 receivers on each. Slots are independent and power can be toggled to 4, 8, 12 or 16 receivers, to save battery power when operating in the field.
Stackable construction; The system can be upgraded with more channels.
OTP-CN16 Software runs on Windows XP/Vista/Windows 7 OS environment.
TECHNICAL SPECIFICATIONS:
Working frequency bands: GSM-850, P-GSM-900, E-GSM 900, DCS-1800, PCS-1900
Number of independent receiving channels: 16* * stackable up to 4 units, 64 channels
Input impedance of RF path: 50 ohm
Frequency channel step: 200 kHz
Reception path sensitivity - not less than: -102 dBm
Frequency setting accuracy - not lower than: 1 kHz
External interface: USB
Power supply: 5V-DC 2.1A
Overall dimensions: 24x12x22cm (Height, Width, Depth)
Total weight: 3.9kg
Other: TX-ready hardware for smart jamming
Enclosure - Light-weight, portable and robust:
Enclosure type: Vertical, Botego-520
Dimensions: 24 X 12 X 20cm (H, W, D)
Material: ABS (Acrylonitrile Butadiene Styrene)
Color: Light gray (RAL-7035)
Ingress Protection: 40
Integrated internal antennas:
Type: Helical
Mounting: Vertical, Omni Directional
Gain: Max. 3dB
Frequency: 850/900/1800/1900MHz
Built-in power pack:
Cells: Li-ion, Rechargeable
Capacity: 5200mAh
Life cycle: over 1000 times
After-life cycle: 80% of initial capacity
Usage: > 4 Hours
SYSTEM COMPONENTS:
A5/1 and A5/2 remote deciphering unit.
Control computer.
Power supplies for both stationary and vehicle operation.
Software package.
Connection cables.
System description and operation manual.
THE THEORY OF PASSIVE INTERCEPTION:
Targeting
A Nokia 6120c Symbian phone is supplied as part of the system.
The phone includes two pre-installed applications:
GauzyMSG ™ - Enables sending a silent SMS in a special format to the target. The message is completely hidden from the target and used to bind the new TMSI and the target in the DB.
NetMonitor – Provides various information on the used network(s) and BTSs around.
Operating Range
Downlink SMS traffic can be intercepted from up to 10 km (in direct visibility) and up to 500 m of Uplink messages in city conditions.
The interception range of Uplink messages (sent from the MS to the BTS) depends on the distance between the target to the used BTS, the distance between the CN-16 system and the target, fading from metals in the vicinity (cars, buildings etc), RF noise, weather, etc.
Operating Range
The following list details factors that block RF signals and their interference level:
Buildings: 5-37dB, near window 12dB
Inside cars: 6dB
Human body: 6-9dB
Fast fading: ~11dB
Slow fading (holes): ~5dB
Decipher unit
The OTP-CN16 supports some of the leading deciphers on the market.
The basic version is used for demonstration purposes and for post-operation analysis of intercepted messages. It takes up to 30 seconds to get a KC key recovered using the basic version.
The system can be supplied with a 2.5sec, 700ms, 400ms, 250ms or 50ms decipher, depending on the customer requirement and the traffic in the intercepted area.
All the supported deciphers communicate with the system using TCP-IP, and can be either wired-connected or communicate over the internet, to minimize the hardware setup carried by the operator.