ADVANCED SIGNAL ACQUISITION FOR PRIVATE SCANNER OPERATORS

By Nigel Ballard 28 Maxwell Road Winton Bournemouth
Dorset BH9 1DL ENGLAND. 20 July 1990

There is more than one way to skin a cat. So if we put our brains into
top gear, let's consider some alternative ways to hunt down those
illusive spot frequencies.

The first and most obvious way is to let the scanner do the work by
searching up or down the band. Not very scientific, but if you split a large area up into small segments, then concentrate on that one single area
for say two days, mathematically your chances of coming across active channels are greatly increased. Repeating this process across the band over a
period of several months will reap great rewards. Okay, you know all
this right? So on we go with some different approaches.

THE PLAN OF ATTACK!
Firstly, get hold of a trade magazine that covers PMR business radio.
Make up a good sounding company name and tick all the boxes relating to antenna's and two way radio's. The company name is to ensure they bother
in replying. When all the info arrives you will have the start of your identification file. The more companies you get info from, the greater
the chance that if you spot a radio or antenna, you will be able to
determine it's mode, frequency area and general capabilities. Read
through and inwardly digest the look of various antenna designs, even
though different companies make them, a low band folded dipole pretty
much looks the same who ever you buy it from. Excepting a few strange
variants you cannot change the laws of physics, a uhf yagi is a uhf yagi
and they all look pretty much identical. Catalogues covering handheld
rubber ducks (helicals) are also of great use. Icom as an example
produce the H-16 (136 to 184MHz) and the U-16 (422 to 473MHz) and apart
from the antenna is long and thin on the UHF, but long and fat on the
VHF there is no real physical distance. So if you spot someone
interesting walking around with a h/held, you try and identify the make,
match that to the antenna, and already you have narrowed down the
search.

Gathering similar information on two way radio's, although useful is not
quite as productive. However some producers have different front panels
for different bands. Also if you peer in a car and spot a tone pad or a
series of selcall buttons then this will help you confirm this radio's operating frequency, as monitoring a possible allocation and never
hearing any tones would seem to indicate you are sat on the wrong
channel. Remember that CTCSS tones used to open repeaters etc are below
the usual range of the human ear, so you won't hear them. DTMF however
is familiar to everyone. And five tone signalling is equally easy to
recognise due to it's musical content ( a fast series of five up and
down tones).

MOBILE ANTENNA'S
After a while experience will immediately tell you that the antenna on
the car in front is a quarter wave on high vhf, a centre loaded collinear
on uhf, or the familiar cellular antenna etc etc. About two years ago a
friend introduced me to a man who wanted to pay me some serious amount
of cash to locate the frequency of a competitor. After a moments thought
I took the assignment not so much for the money but more for the
challenge. So off I drive to the competitors head office, luckily enough
they had a two way radio on the roof, unluckily it was one of those
popular collinear types protected in a white fibreglass tube. These are a
bitch to identify because low gain, high gain, low band and frequencies
up to 950MHz are all catered for in these tubes of various lengths. Using
a frequency counter was out because the roof was too far away from any
point I could get to. And so I waited for one of their vehicles to
arrive. Ten minutes later a car pulled into their yard with an unloaded
whip on the roof. I recognised it as a quarter wave on vhf high-band. In
the UK the limits for PMR users in this area are BASE TX 164.5 to
169.9875. Back home now I pulled my high band vhf log book, as it
happened I already had two loggings for companies operating in a similar
line of work, so I discounted these. I then entered in every gap or
suspect allocation not confirmed as someone or other. About 87 freqs in
all. One by one I heard traffic that didn't fit the bill, until much
later in the day the scanner stopped on a conversation that looked
promising, a quick phone call to my customer confirmed that I had the
buggers. Case closed and another gold star for this frequency detective.

COVERT ANTENNA'S
There are certain people out there who for one reason or another who would
not want it known that they are radio equipped, and as such they go
covert. The radio is either well under the dash, mounted in the glove
box or remoted from the trunk. But they still need an antenna. Over the
years I have seen allsorts of approaches from antennas mounted in the
wing mounted rear view mirrors, in the mudflaps (hopeless approach this
was), under the vinyl on the rear parcel shelf, even a circle of
tuned printed circuit board stuck on the roof and covered with a smooth
layer of body filler or a vinyl roof was layed over the top. The latter
is still very much in use, the only way to tell is to spot two identical
cars parked side by side, the one with the covert antenna will have a roof about 4mm higher than the other car, or a non standard cloth top. But
without doubt the most popular choice just has to be the disguised radio antenna. Basically what you have is an exact replacement for the factory
radio antenna. the antenna lead splits via a diplexer to supply signal
to both the car and two way radio. Filtering in the diplexer stops the
RF shunting up the car radio lead. They work better than any other type currently available, the signal is vertically polarised and most of the
signal is clear of the car's bodywork. They are very difficult to spot.
Some types however are actually thicker than the standard unit, so get
those micrometers out boys and girls. The only other spanner in the
works is that a great number of car producers are now incorporating the
car antenna into the rear window defroster wires by way of a large
choke. This causes problems to the covert unit. I know of one such car,
a Ford Granada that has the so-called covert antenna mounted on the rear
wing. To me this really stands out as Granada's just do not have
external antenna's. I have heard that some people are experimenting with
using the rear demist wires as the transmitting antenna, but so far the
results have been rather poor.

GETTING BOLDER
Pen and paper in hand you set off to your local Police open day, try and
find an older and more layed back officer, approach him with a look of admiration, say hello and remark, 'your handheld looks heavy don't you
mind lugging it around all day?' with this the macho officer will yank
it off his/her belt and hand it over so you can be suitably impressed.
My first course of action is to flip it over and see if any of the
channels are etched on the back. Some crystal controlled radio's come
with a little plate where the engineer writes the TX and RX frequencies.
I lose count of the amount of info gained from public service open days
using this innocent approach. Having a good memory helps greatly. This
method works for both public services and private companies. Those
private security guards just love the power a uniform and a handheld
seems to give them. Just remember to approach them with a sense of awe,
and you might get lucky.

RADIO RALLIES
PMR radio's get old and scruffy, companies sell them off at cheap prices
to amateur radio dealers who sell them on as seen, many work and many of
the older one's still have the crystals installed. Once again I have
gained piles of previously unknown freqs from hunting through the radio wreckage at these rallies.

Well that's about it for now. Once again I hope I have given you a few
pointers in the right direction. In a later article I hope to cover
emitter density, radio location methods and the little known I.F.
detection principle. If I have missed any obvious methods of frequency detection then I look forward to hearing from you. Until next time
Best Regards Nigel.



--- Mystic BBS v1.12 A43 (Linux/32)
* Origin: HAMRADIO telnet lu9dce.dynu.com (21:5/101)