top
Police State
Police State
Indybay
Indybay
Indybay
Regions
Indybay Regions North Coast Central Valley North Bay East Bay South Bay San Francisco Peninsula Santa Cruz IMC - Independent Media Center for the Monterey Bay Area North Coast Central Valley North Bay East Bay South Bay San Francisco Peninsula Santa Cruz IMC - Independent Media Center for the Monterey Bay Area California United States International Americas Haiti Iraq Palestine Afghanistan
Topics
Newswire
Features
From the Open-Publishing Calendar
From the Open-Publishing Newswire
Indybay Feature

Police Radio Jamming as a Means of Information Warfare - HOWTO

by (A)Tech
Technical instructions on how to jam the San Francisco Police's radio system.

With a massive police presence brutalizing peaceful protesters in San Francisco, some people are thinking of creative ways to fight back. My investigation lead me into jamming police radio systems as a means of information warfare. If the police can't hear their orders or communicate back to headquarters, they can't track the masses of people. Thus jamming police radio handsets is an effective means of non-violent resistance.

The following article will provide enough information to build such a system specifically for San Francisco, given enough knowledge, time and energy. It by no means will provide step-by-step instructions to a novice. To understand this and adapt it, you will need some knowledge of electrical engineering, radio, mathematics, and printed circuit board layout. To assemble such a unit, you will need some electronics parts, a high quality printed curcuit board kit, and a suitable antenna (microwave or GPS).

The basic concept behind radio jamming is to overwhelm one signal with a stronger signal on that frequency. San Francisco uses digital FM signals on many frequencies at once. Thus all of the frequencies need to be jammed. Jamming an FM transmission is fairly simple: All you need to do is produce a sine wave on that frequency of a higher amplitude than the signal you want to jam. That should foil most radio receivers.

The City of San Francisco's police system operates on the 800 to 900 Mhz range, in the microwave spectrum. However, each frequency needs to be locked onto in a range possibly as small as 100 Hz. Because of this, no simple kit made out of home parts will do. It is necessary to build a digital tuner into the device.

The basic concept behind digital tuning is a feedback loop called a phase-locked loop (PLL). This loop contains a voltage controlled oscillator (VCO), which is tuned through a series of steps to a multiple of a reference frequency from a crystal. The output of the oscillator is put through a divide-by-n counter, n being the multiple of the reference frequency (and programmed in, usually in binary through the input to an integrated circuit.) The output of this divide-by-n counter is one pulse for every n pulses of the input. This in turn is fed into a phase comparator, which compares the signal to the reference frequency and then produces an error voltage. The error voltage controls the voltage controlled oscillator, which produces the output signal.

Because of the high frequencies in microwave circuitry, normal leaded components and wires act like active components and interfere with the working of the circuit. This makes high quality printed circuit board components necessary. According to the author's understanding, this apparently means that gold alloy circuitry is necessary.

You can amplify the signal as far as you want, but microwaves will only travel in line-of-sight. Skyscrapers and other geographical impediments will stop the signal. To sweep a wide area, transmitting from somewhere high is a good idea. The City of San Francisco has eight different transmitting stations linked together to cover the entire city.

You will need an antenna of course. A GPS antenna will work well and the purchase of one is fairly inconspicuous. Directional or omnidirectional microwave antennae will work even better, depending on your purposes.

Once you have the whole kit together and you want to use it, you will need to excercise some precautions to avoid getting caught. Keeping it on for only a short time is one way. If you want to keep it on for a much longer time, however, you will have to keep moving. Having multiple moving transmitters operating simultaneously will make it even harder to be tracked down.

The following is the set of frequencies the San Francisco Police Department operates on (according to http://www.bearcat1.com/fleetca.htm):

System:  San Francisco, City & County
County:  San Francisco
Type:    II (Digital Smartzone)
Use:     Police, Fire, Hospital & Court Security operations

Frequencies:
Site 1:
866.0500        866.2250        866.2500        866.4500        866.5750
866.6500        866.7750        866.8250        866.9625        867.2250
867.2750        867.4375        867.4562        867.6500        867.7000
867.9000        868.0625        868.1125        868.5375        868.7375
868.7875        868.9000

Site 2:
856.2375        857.2375        858.2375        866.8625        867.7250
868.3375

You should note that fire and emergency response operates on the same frequency and think about the ethical dilemmas. Personally, I think that such a jammer can be used ethically, especially for short ranger purposes, because even the Fire Department has been a party to oppression lately, helping to cut through lock-boxes and clear protestors away from intersections. And emergency response does have another set of general frequencies they can use.

I found designs for an 800 Mhz police radio jammer at the following website: http://gbppr.dyndns.org/PROJ/mil/ccecm/

Below are the schematics from this site:

§Programming Matrix/LED Display/Sweep Generator Sections
by (A)Tech
cc_ecm-1.png
§PLL/VCO/DC Offset/Noise Sections
by (A)Tech
cc_ecm-2.png
§Further Technical Information
by (A)Tech

Sample programming matrix:

PLL Reference Frequency : 976.5625 Hz
  PLL Crystal Frequency : 2 MHz
           PLL R-Divide : 2048
       Prescaler Divide : 64


8  4  2  1
1  0  0  0  5  2  1
9  9  4  2  1  5  2  6  3  1
2  6  8  4  2  6  8  4  2  6  8  4  2  1     N       RF OUT FREQ
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1  1  0  0  1  0  1  0  1  0  0  0  1  1     12963   810.1875
1  1  0  0  1  0  1  0  1  1  0  0  1  1     12979   811.1875
1  1  0  0  1  0  1  0  1  1  1  0  1  1     12987   811.6875
1  1  0  0  1  0  1  1  0  0  0  0  1  1     12995   812.1875
1  1  0  0  1  0  1  1  0  1  0  0  1  1     13011   813.1875
1  1  0  0  1  0  1  1  1  0  0  0  1  1     13027   814.1875
1  1  0  0  1  0  1  1  1  1  0  0  1  1     13043   815.1875
1  1  0  0  1  0  1  1  1  1  1  0  1  1     13051   815.6875
1  1  0  1  0  1  0  1  1  1  0  0  1  1     13683   855.1875
1  1  0  1  0  1  1  0  0  0  0  0  1  1     13699   856.1875
1  1  0  1  0  1  1  0  0  0  1  0  1  1     13707   856.6875
1  1  0  1  0  1  1  0  0  1  0  0  1  1     13715   857.1875
1  1  0  1  0  1  1  0  1  0  0  0  1  1     13731   858.1875
1  1  0  1  0  1  1  0  1  1  0  0  1  1     13747   859.1875
1  1  0  1  0  1  1  1  0  0  0  0  1  1     13763   860.1875
1  1  0  1  0  1  1  1  0  0  1  0  1  1     13771   860.6875
         *  *  *  *  *  *  *  *

The following is a perl script designed to calculate the N values, from an older version of the device:

#!/usr/bin/perl

$x = 4000000; # Crystal Reference Frequency, Hz
$rdiv = 8192; # Crystal Reference Divide
$pre_div = 256; # VCO Prescaler Divide
$a = 855212500; # 1st Frequency, Hz
$b = 856212500; # 2nd Frequency, Hz
$c = 856737500; # 3rd Frequency, Hz
$d = 857212500; # 4th Frequency, Hz
$e = 858212500; # 5th Frequency, Hz
$f = 859212500; # 6th Frequency, Hz
$g = 860212500; # 7th Frequency, Hz

$ref = $x / $rdiv;

print "\n\nReference: $ref Hz\n\n";

$a1 = $a / $pre_div;
$a2 = $a / $ref;
$a3 = $a2 / $pre_div;
$b1 = $b / $pre_div;
$b2 = $b / $ref;
$b3 = $b2 / $pre_div;
$c1 = $c / $pre_div;
$c2 = $c / $ref;
$c3 = $c2 / $pre_div;
$d1 = $d / $pre_div;
$d2 = $d / $ref;
$d3 = $d2 / $pre_div;
$e1 = $e / $pre_div;
$e2 = $e / $ref;
$e3 = $e2 / $pre_div;
$f1 = $f / $pre_div;
$f2 = $f / $ref;
$f3 = $f2 / $pre_div;
$g1 = $g / $pre_div;
$g2 = $g / $ref;
$g3 = $g2 / $pre_div;

print "A1: $a1\t$a2\t$a3\n";
print "B1: $b1\t$b2\t$b3\n";
print "C1: $c1\t$c2\t$c3\n";
print "D1: $d1\t$d2\t$d3\n";
print "E1: $e1\t$e2\t$e3\n";
print "F1: $f1\t$f2\t$f3\n";
print "G1: $g1\t$g2\t$g3\n";

$a3 = sprintf "%.f", $a3;
$b3 = sprintf "%.f", $b3;
$c3 = sprintf "%.f", $c3;
$d3 = sprintf "%.f", $d3;
$e3 = sprintf "%.f", $e3;
$f3 = sprintf "%.f", $f3;
$g3 = sprintf "%.f", $g3;

$a2 = $ref * $a3;
$b2 = $ref * $b3;
$c2 = $ref * $c3;
$d2 = $ref * $d3;
$e2 = $ref * $e3;
$f2 = $ref * $f3;
$g2 = $ref * $g3;

$a1 = $pre_div * $a2;
$b1 = $pre_div * $b2;
$c1 = $pre_div * $c2;
$d1 = $pre_div * $d2;
$e1 = $pre_div * $e2;
$f1 = $pre_div * $f2;
$g1 = $pre_div * $g2;

print "\nN Divide\n\n";

print "A1: $a1\t$a2\t=> $a3\n";
print "B1: $b1\t$b2\t=> $b3\n";
print "C1: $c1\t$c2\t=> $c3\n";
print "D1: $d1\t$d2\t=> $d3\n";
print "E1: $e1\t$e2\t=> $e3\n";
print "F1: $f1\t$f2\t=> $f3\n";
print "G1: $g1\t$g2\t=> $g3\n";

$a4 = $a1 - $a;
$b4 = $b1 - $b;
$c4 = $c1 - $c;
$d4 = $d1 - $d;
$e4 = $e1 - $e;
$f4 = $f1 - $f;
$g4 = $g1 - $g;

print "\nAOFF: $a4 Hz\n";
print "BOFF: $b4 Hz\n";
print "COFF: $c4 Hz\n";
print "DOFF: $d4 Hz\n";
print "EOFF: $e4 Hz\n";
print "FOFF: $f4 Hz\n";
print "GOFF: $g4 Hz\n";
Add Your Comments
Listed below are the latest comments about this post.
These comments are submitted anonymously by website visitors.
TITLE
AUTHOR
DATE
peter
Mon, Mar 24, 2003 8:57PM
james
Mon, Mar 24, 2003 6:53PM
jennajameson430@hotmail.com
Mon, Mar 24, 2003 6:24PM
George Lowry
Mon, Mar 24, 2003 9:57AM
james
Sun, Mar 23, 2003 10:24PM
We are 100% volunteer and depend on your participation to sustain our efforts!

Donate

$330.00 donated
in the past month

Get Involved

If you'd like to help with maintaining or developing the website, contact us.

Publish

Publish your stories and upcoming events on Indybay.

IMC Network