Monitoring Inmarsat

[aelius]

Un articol vechi dar interesant

-------------------------------

Monitoring Inmarsat

We had an Amstrad R5000 receiver but decided not to use it for the time being. The AFN signal on 1537 MHz is an ideal source for adjusting the antenna. We did that in combination with a slightly antique SCPC receiver from the US. A 90 DM ($75 USD) investment at a flea market which we had adapted over the weekend so we could use it as an Inmarsat compatible receiver. We also found another really antique Amstrad receiver somewhere and that's where we took the tuner from, because our SCPC receiver could not process signals higher than 1450 MHz. When will Americans ever realize that today's satellite communication works with an IF up to 2150?

Anyway, even our Amstrad tuner stopped at 1750 MHz, but that wasn't a problem since Inmarsat transmits between 1525 and 1548 MHz. Finally we also had to get rid of the useless 110 kHz filter in exchange for a 20 kHz (for AFN) and a 12 kHz (for all other data) filter. Monday brought moment of truth - would our do-it-yourself version of an SCPC receiver really work? On the ground we had a small portable 60cm antenna and on the roof a professional 1 m dish. You guessed it, climbing up to the roof with all our gear was more than we could handle after a lazy weekend, so we equipped the 60 cm dish with the Koeditz antenna and cautiously started to move the unit in order to detect first Inmarsat signals. But caution was not in place because even after a very basic adjustment we could hear AFN Radio. And it got better by the minute. When a look at our spectrum analyser revealed that there was a signal at 1690 MHz we were quite puzzled. It was a very weak signal, but clearly above the general noise level. We tried out the signal on our receiver and voila: good old Meteosat came in at 1691 MHz. Obviously we hadn't mounted the antenna too exactly so that we could receive signals from both Inmarsat and Meteosat - albeit with less then perfect strength. We kept on improving the alignment and ended up with a combination of L-band feed and antenna that was probably the world's only multi-feed system for Inmarsat and Meteosat. Just imagine that these two birds have a 15 degree gap between them!

Politicians

Inmarsat features a few busy frequencies for analogue voice communication in the Inmarsat A mode. Most publications argue that only communications originating from a landline and going to an Inmarsat terminal can be intercepted. This is not true, and below 1535 MHz it is exactly the other way around. If a DTFM decoder is connected even the dialled landline number is shown on the display. One of the busiest frequencies to be found is 1534.350 MHz for 'ship-to-shore' communication, with 1535.325 MHz being used for'shoreto-ship' transmissions. We tested our converted SCPC receiver with the first frequency and were delighted to have a clear sound with a low noise level. Within a short time we monitored numerous calls, having to cope with a language mix similar to that at Heathrow Airport. Most Inmarsat users apparently didn't mind phone rates between four and five US$. To get to some really worthwhile calls we used Inmarsat-3 F2 at 15.5°W, a satellite that covers the Eastern Atlantic Region including all of Europe, the Arabic countries, Africa and the East coast of the United States. This is the satellite that is most frequently used for experiments so we really only listened to calls that seemed to be about important topics. We didn't hunt after private calls, because even after all those years this always feels like peeping in. Calls in your own mother tongue are most easily detected, of course.

On this Monday we discovered a female voice talking with her boss who was obviously en route to country X. They were discussing the results of a local election, and since our DTMF decoder made the phone number available to us we quickly checked that with our telephone book on CD ROM and were able to verify the authenticity of the two partners in the conversation. The election results basically forced the strongest party to enter a coalition with one of the two remaining parties which were both grossly unpopular. Officially no one knew which party was to be selected, but off the records the results of the internal discussions were already determined - thanks to Inmarsat. None of the two parties, however, knew anything about it. local politicians, party headquarters, journalists and hundreds of other important people would have given a lot to have that information. On the other hand, had they been able to follow all the secret Inmarsat talks they would also know a lot more about how the strongest party felt about them, and how they were planning to treat them once the party would form the next government.

Secret Talks...

If you think that secret talks via Inmarsat are rare events, then think again. Many politicians rely on the outdated Inmarsat-A system, without realising how potentially disastrous secret information can become. One would imagine that their horrific experiences with the leaking analogue mobile telephones which used to get them into troubles have taught them a lesson or two. Today they avoid GSM technology (which also isn't foolproof anymore) while being fooled by catchy Inmarsat slogans like "secure connections". What is meant by that is the quality of the connection and by no means the privacy of information. One should almost feel empathy with certain secret services whose agents still cut out newspaper articles on which to base strategies instead of teaching politicians how to keep their mobile communications private.

Pirates

Pirates are the heroes of age-old adventure stories, but most of us forget that whole regions still depend on modern pirates. The coast around Malacca in Malaysia is such a spot, together with the Bay of Thailand and the Southern Chinese Sea. In South America the coast of Northern Brazil is another centre of pirate activity. On average every other day sees an attack, and whenever pirates strike they leave good manners at home. Typically all people on board of a ship are killed, unless they manage to escape with a rescue boat. Most pirates know in advance if the ship and its cargo is worth an attack, because they use state of the art equipment to monitor Inmarsat communications and even fax transmissions listing every single cargo item. Quite a substantial portion of Inmarsat reception units that are being sold in Germany or the United States are channelled to those regions where they are of invaluable service to modern age pirates. French journalist Eric Paquier managed to interview one pirate recently and when asked what pirates do with their victims he got the following response: 'We hang them upside down on one of the masts, then burn them alive and later eat their ears for dessert."

But the pirates are not the only ones relying in Inmarsat. The International Maritime Bureau (IMB) monitors the distress band between 1544 and 1545 MHz to identify vicious attacks and to localise the exact position of an attack. If they manage to do that they then forward their information to one of the police authorities in the region and to ships within the potential danger zone. The IMB has monitoring stations in Kuala Lumpur for the South East Asian region and in Recife for the Brazilian coast. In most instances, however, the pirates are much quicker than local police, so that by the time law enforcement units reach the site the pirates have completed their attack and have left with all valuables. With good equipment and a good deal of patience emergency signals of threatened ships can even be received in Europe which is covered by three Inmarsat satellites. Positioned at 64° East Inmarsat-3 F1 covers the Indian Ocean. Inmarsat-3 F2 (15.5° West) controls the Eastern Atlantic Region while the 3 - (54° West) is in charge of the Western Atlantic region. Finally there is Inmarsat- F3 (1 78° East) whose footprint extends over the Pacific region. With the right receiver for the L-band and with a serial data port there is computer software available enabling the user to monitor a selected frequency range with high reliability. To check the distress band between 1544 and 1545 MHz the author uses an AR5000 in association with HAWK-5000 software. This software not only controls the receiver but also analyses the frequency spectrum of a given frequency range.

Underworld

To be sure, more than 95% of Inmarsat calls are used for absolutely legitimate purposes: to make calls between maritime, mobile and aeronautic units and landlines. In the past mobile phones have got a bad name due to Mafia bosses using them. After all there was a time when calls originating from a cellular phone were hard to trace and even harder to intercept. Times have changed and today chances are that underworld bigheads travel around with a light briefcase which includes a complete Inmarsat unit. Even two permanent underworld headquarters may decide to communicate via inexpensive Inmarsat-A terminals in order to circumvent the public telephone network. For instance, the author knows the case of a dubious money broker ("don't leave your money in your bank - put it in our secure investment project and enjoy interest of up to 49% per annum") residing on a Southern island who gets the daily figures from his chief money collector. Quote: "Sorry, it's been a real bad day just slightly over 200.000..." The combination of politics and business is another segment that surfaces frequently among the not quite legal activities on Inmarsat. The author of this article is now specifically looking for businesspeople and/or politicians who deliberately break international embargo laws. The AR5000 receiver comes with a built-in DTMF decoder which identifies and display the dialling tones of a telephone. The only disadvantage is that most numbers are fairly long and thus the first digits disappear when the display becomes too small for the whole number to be shown. In most cases, however, the first two digits are "00", the access code for international calls in many countries. With the right software, however, all this isn't a problem anymore. The receiver delivers the complete number to the PC which in turn displays, modifies or stores it. In addition to that, individual number sequences can be preprogrammed so that the PC issues a 'warning' whenever such a sequence of pre-set numbers is dialled via Inmarsat, It's a simple program, but very effective.

We set the following numbers on our PC: 00964 for Iraq and 00218 for Libya. Both countries are subject to strict international trade embargoes. We set the numbers and chose 1534.350 MHz as our background frequency. During the night from Monday to Tuesday all we received was a call from a poor oil worker who announced the divorce from his wife on Inmarsat, plus many conversations about spare parts for a variety of cars. Not exactly the kind of stuff James Bond would be interested in. Our PC issued two alarms, but both calls were normal 'ship-to-shore' calls. Thursday, 4pm: another alarm from our PC! "009641xxxxxx", a male voice answers. The call originated from an A terminal, the language is English but with a strong accent which could be German. Luckily one side has their external speaker on so that both persons came in clear and sharp. The location of the caller with the A terminal could not be identified, but judging form the background voices it could have been Luxembourg. The caller asked to speak to Mr. Shamari (phonetic transcription) and his call was forwarded right away. The conversation was about electronics components and the possibility of assembling them in Iraq. Assembly was said to be rather easy and could be performed by untrained personnel. Next, the route of transportation was discussed - apparently the package was to be sent from the originating country to Iraq via at least two or three other countries in order to disguise the exact trace.

Mr. Shamari then came back to the final assembly of the components and argued that it would best if it was performed in one of his departments, pending approval by Mr. Kartan (phonetic transcription). The conversation ended with the agreement to have another telephone conversation the following Monday. Both the type of conversation and the complicated delivery method for just 52 kg of electronic compon got us suspicious right away. But what could we do only one telephone number and two with possibly incorrect - names? How could we find somebody who knew Iraq from inside?

There is a Technical University close to where we live and usually students from many nations live and work together on university campuses. It didn't take us long to find an Iraqi student, even though his family hadn't been to Iraq for years. Still, he was able to help us by referring us to the Iraqi opposition Iraqi National Congress INC" which has contact offices in many big cities. Believe it of not, they recognised our telephone number right away. The number belongs to an organisation called "Mukhabarat" and according to an INC speaker it is a kind of internal security service. The office with our number is in the Baghdad suburb of Zeyounna and the man we overheard on the phone could be a Mr. M. Y. AI Shammari who is assistant to the director of the D4 department. The D4 surveys politicians within Iraq, members of embassies and party members. The boss of the department is a person by the narne of General-Major A. Aziz AI Qurtan. Could this be man we identified as Mr. Kartan?

Suddenly everything seemed to add up and the story started to make sense. The following Monday we set up our equipment again in order to identify the call that had been arranged the week before. However, we weren't as lucky as before. The busy frequencies, the large frequency range and the lack of an exact time when this call would be made all contributed to the failure of our search. And this is why this article has to end right here, rather abruptly.

Source: Monitoring Inmarsat...