by Anthony Reep, REI Instructor
People are becoming more dependent on Bluetooth technology. Even though Bluetooth was invented in the mid-80s, it has only recently taken over commonly used products like headphones, watches, cars, health monitors, heart monitors, keyboards, and even medical equipment like stethoscopes. There seems to be no end to its application. Bluetooth (BT) efficiently transmits information at 2.4 GHz frequency for relatively short distances. Most people are familiar with the process of pairing devices, a method of establishing a connection between BT devices. Your phone and your wireless headphones, for example, transmit data back and forth once a connection is established.
Bluetooth is a short range frequency hopping data exchange between 2 or more devices, transmitting data packets within the 2.4 GHz band.
Bluetooth (BT) trackers have recently grown in popularity. They work as locators for anything you put them in or on. In other words, they help you keep track of things.
Life360 Tile, Samsung Galaxy SmartTag, and Apple AirTag are popular brands of BT trackers. Apple AirTags actually notify a person they are being tracked, however this applies only if the person has an Apple product to detect the AirTag. BT trackers are often put on computer bags, wallets, key rings, pets, and even on items loaned to friends. The idea is very convenient. However, in the security world, convenience usually means less secure and often dangerous.
BT trackers use Bluetooth Low Energy (BLE) technology. Standard BT devices can remain connected a few seconds to a few hours vs BLE which remains in sleep mode unless a connection initiates, which means much less power consumption and longer battery life (as much as a year or more).
BT tracking devices do not have cellular connections and do not require a monthly plan like traditional mobile phones or GPS trackers. Almost everyone today has a mobile phone or two and often carry other items with a Wi-Fi/BT connection in addition to their phones. BT trackers use these devices to form “networks” from which location data is gathered. Simply put, BT trackers use other nearby connectable BT devices to figure out where they are. The battery life of these devices is very good since they do not have to stay connected or transmit often. Apple’s AirTag, for instance, can operate for 12 months or more on one CR2032 coin cell battery. For people who lose or misplace things, this can be quite handy. Having a BT tracker on your pet’s collar could save time searching neighborhoods with your head out the window yelling for Sparky the family dog to come home. You can simply open your app and locate the BT device. Some Trackers can notify the user if they get within a specified distance from the tracker.
Some interesting features of the Apple AirTag include:
- When an Apple AirTag is lost, any nearby Apple phone can be notified.
- The “Find My” app will help locate the tracker and when close to it the phone can receive contact information to quickly arrange return of the item to the owner.
- If the AirTag is lost for extended time, it can periodically emit an audible chirp to help bring attention to itself.
- The Apple AirTag is more reliable than other devices because it uses any iPhone in the vicinity to connect, whereas other Android based tracking devices only use phones that contain the proper App and the App must be active.
All of this sounds amazing, right? Millions of these devices have been sold, and certainly they have been a valuable tool saving people heartache and stress.
So, what’s the danger?
REI Training Center instructors receive many calls from law enforcement agencies where people are being notified that they have a device tracking them. Their phones are telling them they have a tracker travelling with them. This happens with Apple phones when an AirTag that is not connected to their account has been in their vicinity for an extended amount of time. This doesn’t happen if the owner of the AirTag is with them. It only happens when the AirTag is away from its owner. The danger in this is that the Apple phones only indicate if an Apple AirTag is tracking them. If the tracked person has an Android device, no alert is given. The same is vice versa. In other words, an iPhone will not alert to a Tile BT tracking device (unless the phone has the Tile App active), and an Android phone will not alert to an Apple AirTag.
One trend we are seeing is college students are being tracked and getting an alert. The Apple app tells them after the alert they should go to the local police department for help. Local police departments then have the task to attempt to locate these trackers and remove them.
Imagine a predator looking for its prey. The predator needs to establish a target and then a routine. If a predator were to use a BT tracker on a person at work, in a bar, concert, or mall, they could simply sit back and monitor the tracker for a few days. The stalker may be able to gather information like patterns of behavior, work place, home, or even a person’s precise location in a large crowd. This is very dangerous.
Thinking hypothetically, what if a law enforcement officer is working a case that stands to put a criminal in prison for a very long time. Let’s say a drug dealer. Someone working with the drug dealer could slip a BT tracker in the officer’s pocket or computer bag and now can observe the officer’s movements, patterns, find out where he lives, works etc., or worse, visit the officer’s home when he/she is away. You can see how dangerous this would be.
Tracking devices can effectively be used to track people in criminal situations such as kidnapping targets, vehicle thefts, spouses tracking exes or jealous boyfriends and girlfriends, and people with restraining orders.
So, what do we do? First, it’s good to understand the weaknesses and how these BT trackers can be exploited. Trackers depend on other devices for their location services. There are phone apps to help locate BT trackers. The problem with most of the apps is that the sensitivity of the phone’s Wi-Fi/BT chip is not made for locating. These are designed to connect and make your phone more enjoyable.
TSCM Approach – Detect and Locate
The MESA, Mobility Enhanced Spectrum Analyzer, has a Wifi/BT feature that detects Bluetooth Low Energy (BLE) devices and can also be used to direction find individual devices using the Received Signal Strength Indicator (RSSI) graph. The MESA’s built in Wi-Fi/BT antenna is internal and requires no other probes- this really helps in narrowing down to the area of the tracker. In Bluetooth mode the screen lists all detected BT devices. The list shows the broadcasted MAC address, device name (if available), received signal strength (dBm), and type of BT device. The populated list can be ordered according to signal strength. Select the device you want to locate and proceed to move through the area with the MESA, observing changes in signal strength. The RSSI graph will indicate a stronger signal and greater color intensity as you get closer to the device.
This MESA Bluetooth screen shot shows a Tile detection (Dave’s Tracking Tile). The RSSI graph indicates the MESA was very close to the Tracker.
Removing known BT transmitters from the search area greatly improves MESA’s locating efficiency. Most spectrum analyzers and broadband detectors don’t allow the user to select a specific device and single out its energy from other overlapping signals. The Wifi/BT area of the spectrum is very busy- making it impossible to determine one spike of energy from the next. A broadband detector like the ANDRE can help to locate strong areas of RF energy. The shortcoming here is that in order to detect with a broadband detector, you have to be in the extreme nearfield of the BT tracker to distinguish the BT tracker signal from other normal environment RF. If you have no idea where the tracker is, it requires a meticulous physical sweep. In an area with a high concentration of RF, broadband detectors can be overwhelmed with other signal activity. You need to be very comfortable with your broadband detector to notice when you’re in the nearfield of such a low power transmitter.
Some tracking devices have built-in safety features that cause them to emit sounds to alert others that a tracking device is nearby in case it is being used illicitly. However, silent modified trackers with the speakers removed or disabled are now being sold on Etsy, eBay and other online stores. It is very easy to make these trackers silent which just makes them harder to find.
If you suspect BT trackers the MESA is one of the best tools to detect and locate these threatening devices. Also be sure to exercise necessary physical inspections.
Be alert, because the “bad guys” are always on the clock!
The ORION 2.4 HX has an IP rating of 63 and is designed and manufactured to be extremely durable, including water resistance. This video demonstrates the use of second and third harmonic test tags before and after the ORION has experienced varying contact with water. The ORION is sprayed with water for approximately one minute and then doused with a substantial amount of water a few moments later. Viewers will note the test tags’ response each time and the power level change indicated by the green LED bar on the head of the ORION. To watch the full video CLICK HERE.
To learn more about the ORION and its technical specifications please visit our website reiusa.net.
The REI Team is excited to be exhibiting at several shows this fall including:
- Global Security Exchange, Booth # 1543 in Atlanta, GA
- Security Essen, Booth 8E28 in Essen, Germany
- ISNR, Booth 09-C49 in Abu Dhabi, UAE
- Association of Old Crows, Booth # 252 in Washington D.C.
Additionally, REI will be hosting 4 TTK Demonstrations.
The remaining TTK Demonstrations will be held on September 15 at 9 am and 1 pm at the Hampton Inn & Suites Atlanta-Downtown after the conclusion of GSX. To register for a demonstration in Atlanta, CLICK HERE.
If you haven’t seen REI’s YouTube channel lately, there are quite a few helpful product videos and feature highlights. Our YouTube channel is an effective resource for anyone new to TSCM interested in learning about REI products. Many of the videos provide equipment overviews, research, and application.
TSCM in the News
TSCM is the art of protecting organizations against undesired surveillance. Historically, TSCM did not have the need or concern for drone surveillance. However, with the modern proliferation of drones, there are certainly situations where security and protection from drone surveillance is a great concern.
For every good drone application, there are probably 2 bad ones. The bad applications are often privacy related, but there are many others that may not be as obvious, including:
- Military exercises or technology demonstrations
- VIP security or paparazzi protection (politicians, dignitaries, celebrities…)
- Law enforcement: stakeouts, stings, swat operations, hostage situations & negotiations
- Corporate events: such as product demonstrations, technology experiments
- Product development and outdoor product testing
- Prisons and delivery of contraband
- Terrorism: drones used to carry dangerous payload
- Air traffic and emergency services interference
Many technologies are marketed for drone mitigation and detection. As it relates to TSCM, the MESA® is a portable and tactical Spectrum Analyzer with an inherent capability that can be used for drone detection. The MESA® Deluxe – Mobility Enhanced Spectrum Analyzer – includes a directional log periodic Down Converter antenna that easily and quickly detects drone RF communication signals at a distance far beyond visible and audible detection.
MESA Down Converter (Log Periodic) antenna
REI conducted some simple tests and demonstrations at its facility in Tennessee, U.S.A. using 2 commercial drones: DJI Phantom 3 and DJI Spark (mini drone). These commercial drones use ISM bands to transmit video; mainly using 2.4GHz and 5.8GHz WiFi based IP cameras to transmit streaming video back to the drone controller.
During the test, the MESA® was able to detect the drone’s video transmission far beyond sight and hearing, relying on the high gain directional Log Periodic antenna. In the MESA® screen shots below, the waterfall shows brighter (stronger) signal activity when the MESA® antenna was pointed in the direction of the drone. When it was pointed away from the drone the signal appears much weaker or disappears altogether. It should be noted that the MESA® was next to a building with significant Wifi transmissions which can also be seen in the red Peak Trace and waterfall.
DJI Phantom 3 Drone:
- Transmit Frequency – 2.4 GHz WiFi Video
- Signal detected 200 meters altitude, 250 meters range
- Outside of audible and limited visual range
Here (above) the MESA® detects the DJI Phantom 3 and demonstrates the signal response when the antenna is pointed at and then away from the detected drone.
The DJI Phantom 3 captures a birds-eye view of the MESA® at 200 m height and 250 m distance.
DJI Spark Drone:
- Transmit Frequency – 5.8 GHz WiFi
- Detection location – 150 meters altitude, 200 meters range
- Outside of audible and limited visual range
- Max range of the controller (no antenna improvement)
Above the MESA® detects the DJI Spark Drone at its maximum distance from the controller and demonstrates the signal response when the antenna is pointed directly at and then away from the detected drone.
The DJI Spark captures an aerial view of the MESA® demonstrating the detection range.
MESA’s Wi-Fi Mode (and internal Wi-Fi chip/antenna) can also detect the drone operator as a Wi-Fi access point when the operator is nearby, as shown in the above screenshot detecting the remote control of a DJI Phantom 3. However, when trying to detect a drone, you are likely to be closer to the drone and detect the RF from the drone using the MESA Log Periodic antenna, rather than the drone remote control which would be much farther away.
MESA’s unique way of detecting and locating drones focuses on detecting the drone’s video signal.
Some important considerations:
- The Log periodic antenna is necessary to identify RF energy in the sky.
- An IP camera will have a similar WiFi signature and may be difficult to distinguish from a drone.
- This approach may be difficult in a city environment with many WiFi signals and buildings.
- A small handheld spectrum analyzer that can search both 2.4 and 5.8 bands, and with good sensitivity and portability is required.
More about the MESA®
The MESA® was introduced by REI in 2020 as a portable, handheld RF spectrum analyzer capable of detecting known, unknown, illegal, disruptive, or interfering transmissions throughout a wide frequency span up to 6 GHz (12 GHz with Down Converter antenna). The MESA® Deluxe includes an assortment of RF antennas for various frequency ranges and applications. It also provides tools to test visible light, IR, carrier current, ultrasonic and acoustic leakage threats.
The MESA® is a unique product with the right characteristics to provide a practical drone detection solution in addition to its other TSCM solutions. More information can be found on REI’s website at www.reiusa.net.
Places where there’s a high concentration of RF (like big cities) make it difficult to use a Non-Linear Junction Detector (NLJD) without running into interference from other signals. It’s important to find a quiet transmit channel to avoid interference from or with other devices and equipment. Some NLJDs claim to be frequency agile, meaning they can search for quiet transmit channels, but don’t provide a way to view the channels within the spectrum, or manually select a channel.
The *ORION HX series are the only NLJDs in the world with a built in spectrum analysis view of the transmit, and 2nd and 3rd harmonic frequencies. This ensures the ability to operate on a clear frequency band and eliminate interference and false alarms in a dense RF environment. Channel selection can be done manually or automatically.
In the Frequency Adjust screen shot above, captured from an ORION 900HX in Sao Paulo, Brazil; there was clearly strong RF activity in the fundamental transmit frequency, 2nd and 3rd harmonic frequencies.
The operator was able to see the activity in all of the bands between 840.0 and 960.0MHz and tune to a quiet channel. At 939MHz, the ORION was able to be used without interference.
This and other features of the ORION Non-Linear Junction Detectors combine to minimize interference and deliver improved detection of hidden electronics. For more information on the ORION, check into any of the following resources:
* The frequency cannot be adjusted on the ORION 900 HX Commercial CE compliant model – it transmits only on a single frequency, 869.525 MHz.
REI has recently returned from several tradeshows, the first since March 2020 and we were excited to see new and old customers while demonstrating our latest TSCM products.
In July 2021, REI exhibited at NATIA, ISC West in Las Vegas and hosted a One-Day ANDRE Training. REI was also fortunate to exhibit internationally during the fall of 2021. The first was International Security Symposium in Brasilia and then at MILIPOL Paris where attendees got to see the Tactical TSCM Kit (TTK).
As we look toward the New Year we are excited to have a full schedule of domestic and international exhibitions to show our products.
For a list of 2022 Tradeshows and events check out the Events sidebar at https://reiusa.net/
REI MESA and Tactical TSCM Kit – TTK at Milipol exhibition in Paris France
TSCM in the News
MESA’s New RF Jammer/Interference Detection
A firmware update is available for the MESA spectrum analyzer that includes a new Jamming/Interference Detection feature in the Mobile Bands mode. In our last Newsletter, we discussed jammers and the role TSCM plays in the detection and location of RF jammers.
Criminal use of RF jammers continues to trouble law enforcement, military, corporate and private security and public safety. The presence of an illicit jamming signal is typically an indication of some other illegal activity or security threat. RF security is one of the main concerns of TSCM, therefore it is important to know when jammers or other forms of interference are present.
The MESA’s Jammer/Interference Detection feature is enabled by default and generates alerts when an increased density of RF energy in a frequency band is detected.
The image above shows an example of an active jammer detected in Band 2 (835-850 MHz). A Jammer Detection might appear in a single band or multiple bands depending on the frequencies being targeted. Bands 4 and 6 in the image above indicate a jammer or interference was detected in the past but is no longer active in these bands. Because the MESA Mobile Bands are customizable, the user can create a detection band at any frequency up to 6GHz. Double-clicking on a Band displays a spectrum view of that Band. Below is a screenshot of a zoomed-in view of a jamming signal from Mobile Band 2. Notice the Mode icon outlined in blue still shows Mobile Bands while displaying the spectrum view. Clicking on the magnifying glass icon will return to the Mobile Bands screen.
A Signal Overload can also occur when the receiver is saturated with strong RF energy from a jammer or interference and will show red throughout all of the bands. When this happens, moving away from the transmitter or adjusting the Attenuation may help reduce the overload status.
The Jammer/Interference feature provides configuration adjustments for power, sensitivity and alerts settings. The Band titles can be customized as well as the frequency spans of the Bands.
Jammer Detector Log
Jammer/Interference Detection logs activity and can be viewed and saved to a USB storage device. The time, date, frequency and power history of the interference is recorded.
The Lock option provides a way to prevent the Jammer Detection feature or any of the settings from being changed or disabled. Operations can still be monitored in a dimmed display but settings can’t be changed unless unlocked with the user-defined pin.
The MESA’s Jammer Detection feature is one example of REI’s continuous product improvement. The free MESA firmware update (version 1.1.9) that includes the Jammer/Interference Detection feature is available to download from the REI website along with update instructions.
Beyond Non-Alerting, a Common Mistake
We often get asked about “non-alerting” ways to keep an eavesdropper from knowing the security products and technical surveillance countermeasure equipment (TSCM) being used. In Sun Szu’s Art of War, he describes the need for secrecy when making tactical decisions.
Sun Szu’s Art of War, Chapter 6
“O divine art of subtlety and secrecy! Through you we learn to be invisible, through you inaudible; and hence we can hold the enemy‘s fate in our hands…
In making tactical dispositions, the highest pitch you can attain is to conceal them; conceal your dispositions, and you will be safe from the prying of the subtlest spies, from the machinations of the wisest brains.”
However, the question of being “non-alerting” is usually asked from the perspective of how security measures are performed, and the process for purchasing products and services is often missed as one of the most “alerting” actions.
Public tenders for acquiring intelligence security products can expose existing security weaknesses while also advertising the types of countermeasures being purchased. Public tenders are typically intended to promote competition, secure the best price, provide fair opportunity for all, and make the tender process transparent. But with intelligence products, an argument can be made that full transparency may not be the best strategy. There’s a point where transparency can be synonymous with exposure. All security products have limitations. So if you know the security products being used, you can also figure out its vulnerabilities.
When playing cards, the dealer usually slides your cards face down so other players can’t see them. And the cards are usually kept face down or held up close, to keep other players from peaking at your hand. Unless you want to lose, you don’t lay them on the table for everyone to see. Purchasing security equipment should, as much as possible, be the same. Federal government and law enforcement agencies around the world use closed processes to purchase TSCM equipment.
There are other reasons public tenders can produce undesirable results including:
- Slow process
- Confusion about technical requirements or the specifications are too broad
- Suppliers of inferior products may claim compliance when in fact they do not meet required specifications or needs
- Process puts communication barriers between provider and customer
- Difficult to know when cheaper, poor quality materials/labor are used
- After sales support, repairs, and training are often not accurately accounted for in procurement
- Post award changes can be very costly
Too often we hear stories from people who find the perfect product solution to a problem, but end up with a lesser or ineffective product as a result of the public tender process. Usually, because the person processing the tender weighed price over feature and performance criteria, or didn’t fully understand or specifically define the desired solution.
Sole source justification is one way of protecting intelligence product purchases from public exposure and to clearly define the purpose and application of the procurement. Sole Source definition according to Office of Justice Programs, U.S. Department of Justice Sole Source Justification Fact Sheet:
“Procurements by noncompetitive proposals, referred to as sole source procurement, is procurement through solicitation of a proposal from only one source. Recipients may conduct competitive (‘sole source’) procurement through solicitation of proposals from only one source when one or more of the following circumstances apply:
- The item is available from only one source
- The public exigency or emergency for the requirement will not permit a delay resulting from competitive solicitation
- Competition is determined inadequate after solicitation of a number of sources”
Because of the sensitive nature of security products and the unique technical requirements, REI recommends considering closed procurement methods where appropriate. This not only ensures that the proper equipment is purchased, but also that the security capability is not exposed, which can lead to an even greater security risk.
When you make efforts to increase security capabilities, be sure not to disclose them, either during security activities or the procurement process.
REI does not propose sidestepping good contracting practices, or using sole source justification to avoid competition. Government and commercial procurement agencies can, and should verify manufacturer pricing to ensure it is fair, reasonable and equitable, and free from conflict of interest.
If you are considering a non-alerting purchase of REI products and need sole source information, contact us at email@example.com.
GPS Tracking Devices and the ANDRE®
GPS tracking devices leave a minefield of malicious threat opportunities. This can include the endangerment of military personnel by having their location revealed, the discovery of secret business meetings, or someone being tracked by an abusive partner. GPS tracking can expose anyone to unwanted surveillance.
A GPS tracker receives signals transmitted by satellite to determine its location on earth. A tracker usually receives location signals from at least four satellites, while additional satellites help refine and improve location data. With the boom of mobile devices, GPS has improved to incorporate the use of cell tower, Wi-Fi and Bluetooth information to help pinpoint locations. Location accuracy depends on the type of GPS device being used and the location data it can receive.
Three Types of GPS Devices
GPS tracking devices come in three types: data logging, data pushing and data-pulling devices. Data Logging devices only use satellite signals and the information is stored on the tracker. This type of device must be retrieved to access the information. Data Pushing trackers receive satellite information and then continuously push the information to a cellular network. The data gets transferred to a server and then to the internet, where location data can be viewed through an app or browser. Data-pulling devices receive location information and broadcast this information to the person doing the tracking at set intervals, when a predefined parameter has been met, or at the user’s request. Parameters may include geofencing, movement, speed, when a car is turned on, etc. For example, the device may be programmed to send a notification when the vehicle arrives at specific location, like an office, stadium, house, etc.
Adding Technical Surveillance Counter-Measures (TSCM) to the Mix
TSCM can help protect privacy and information from GPS threats. The ANDRE Broadband Receiver is good for detecting GPS pushing and pulling trackers. The ANDRE can detect the RF transmission from the tracker to the cellular tower, even as fast as 1/1000th of a second. Because the ANDRE is a broadband receiver, it displays the amplitude of the strongest RF signal; regardless where in the 6GHz (or 12GHz with the Down Converting antenna) it occurs, which will be mostly in the cell phone band for trackers. This ensures almost 100% probability of intercept (POI).
Typical search procedures and methods for working with the ANDRE to detect GPS devices include:
- Set up the ANDRE Deluxe and whip antenna in the center of the vehicle
- Activate the Data Logging feature (ANDRE Deluxe)
- Drive the vehicle to check for geofencing, speed, interval, Bluetooth and/or Wi-Fi perimeter triggers
- You may also choose to leave the ANDRE in the vehicle for a period of time (up to 250 hours) to look for transmit patterns
- Turn on the “Chart Audio/Live Audio” feature on the ANDRE to hear distinctive pings from the transmission of GPS data to a cellular tower
- Block off all incoming cellular tower signals to the GPS tracker. Once cellular frequencies are available again the GPS will quickly have more active connection “frenzy” while re-establishing communication with a tower. This may give the ANDRE a stronger signal to detect.
- Eliminating signal activity may be possible by isolating the vehicle from cell towers using natural barriers or by using a sterile RF environment.
- Jamming the surrounding signals may also be possible; however the use of jammers is highly regulated. Know the responsibility you have using a jammer and the legal/regulatory implications.
As good as the ANDRE® is, it doesn’t replace the necessity for a physical search. The longer an enemy has to install an illicit tracker, the more sophisticated the installation can be – making the TSCM search more difficult. GPS trackers require either a physical retrieval or a transmission of RF energy to view target location data. For a tracker that requires retrieval, or transmits only upon request, nothing replaces a thorough physical search of the vehicle. For other transmitting GPS devices the ANDRE Deluxe provides the best chance of detecting unknown GPS trackers.
Training at REI is back to regularly scheduled classes, but COVID-19 continues to restrict open travel for many who want or need TSCM training. REI’s online seminars provide an opportunity to learn fundamental TSCM concepts from anywhere, regardless of skill level.
These seminars are free 1 hour live presentations on a variety of TSCM related topics. The interactive seminars are presented by an REI Training instructor and include opportunities for questions and answers.
If product-focused remote learning is needed, REI’s E-Training courses offer 1-2 day online training for anyone with equipment. E-Training is an effective way to get refresher training.
Remote working may be here to stay and REI is pleased to offer new learning opportunities for TSCM professionals. To sign up for one of the free seminars, visit: https://reiusa.net/online-seminars
Bangladesh Live News
Bangladesh High Court dismisses writ demanding investigation on eavesdropping and leaking of telephonic conversation
Source: Daily Maverick
BAT’s UK headquarters oversaw and financed a South African corporate spy ring
Source: Post Magazine
Surveillance and countersurveillance in China: the former private detective who went from installing spy cameras to rooting them out
10 Innovative Devices from the History of Espionage
Competitive intelligence in Africa
Source: Central Recorder
Secret Hearing Focuses on Hidden Microphones at Guantánamo Prison
Ikea Workers find hidden cameras above toilets and locker rooms at distribution centre
|REI’s New TSCM Travel Kit (TTK) Packs It In!|
|If you need a small portable TSCM sweep kit, now is a perfect time to look at the new REI TSCM Travel Kit (TTK). The TTK is a professional carry-on, deployment-ready sweep kit for detecting and locating hidden electronics and RF transmitters.
Weighing less than 25 lbs./11.3kg, the TTK is designed as a durable non-alerting tactical sweep kit for the frequent traveler.
MESA® handheld Spectrum Analyzer for portable RF detection and analysis to 12 GHz
- 10kHz to 6 GHz spectrum analyzer (12 GHz with Down Converter Antenna)
- Sweeps 200GHz per second
- SmartBars™ Mode for rapid detection (Patented)
- Mobile Bands Mode showing RF levels of customize-able spans
- Wi-Fi and Bluetooth modes to identify access points
- Touchscreen controls, with visual, audible, and haptic alerts
- Cached Peak Function (Patent Pending)
ANDRE® Broadband Detector for near-field detection and location of RF transmitters
- Broadband RF detection up to 12GHz, plus Infrared and Visible Light
- Histogram display of signals over varying time spans up to 24 hours
- Quick and easy to use
- Provides short-range detection
- Fast Detection with POI of 10nsec pulses for the full 6GHz band
ORION® 2.4 HX Non-Linear Junction Detector for finding hidden electronics (active or inactive), FCC 3.3W or G 6.6W
- 2.4GHz Digital Spread Spectrum transmit signal
- Spectral analysis for frequency channel selection with more than 60 available channels
- Digitally correlated 2nd and 3rd harmonic response
- Touch screen display showing unique harmonic histogram and a spectrum view of operational bands
- Visual, audible, and haptic vibration alerts
CMA-100 Countermeasures Amplifier for detecting wired surveillance devices
- 110dB of Gain
- Built-in AC/DC voltmeter
- Variable bias voltage available from -15V to +15V DC
FLIR DM285 Industrial Imaging Multimeter (US only, not included in exported kits)
All of the products and accessories fit in a Pelican™ Air 1535 case with REI custom foam inserts. Whether in a congested airport or coming to and from the job site, the retractable extension handle and quiet rolling wheels make the TTK simple and easy to transport.
Antennas and probes for the MESA and ANDRE include Whip Dipole, VLF, and the Log Periodic Down Converter (12GHz) antenna. The MESA also includes the Fixed Dipole and the MCP Multi-Carrier Probe for carrier current testing. A complete accessories list is available here.
No one else provides an REI Spectrum Analyzer, Broadband Detector/receiver, digitally correlated NLJD, and audio amplifier in a single light-weight travel-friendly package like the TTK. Contact firstname.lastname@example.org for a quote or more information.
When you’re in a Jam
RF Jammers are used to block or interfere with the physical transmission and reception of wireless communications. In most cases, they work by generating RF energy to overwhelm or confuse RF transmissions. They can deny service indiscriminately or they can target specific classes of transmission (GPS, Wi-Fi, Bluetooth, cell phone, etc.).
Jamming technology has not been historically considered in TSCM applications, but the fact that jammers may interfere and disrupt RF transmissions means the necessity to investigate for jammers will undoubtedly increase.
New technologies and the Internet of Things (IoT) are being developed all the time that use wireless communications and so are opportunities to interfere, disrupt, and manipulate them. Causing denial of service can be disruptive and, possibly, extremely dangerous.
A quick list of wireless applications that can be affected shows just how harmful illegal or illicit jamming can be:
- GPS (location, navigation, tracking, mapping, timing)
- Cell phones (emergency 911 calls)
- Bluetooth devices
- Key-fob/car locks
- Wi-Fi communications
- RF equipment+
- Security equipment
- Radio transmissions
- Industrial controls
- Home automation
- Fleet management
Despite the illegality of jammers (in most countries), they are commercially available, inexpensive, and used privately, often marketed as security devices, but criminals use them to conceal illegal operations, disrupt law enforcement or first responder communications, disrupt surveillance efforts by law enforcement, block or disrupt wireless security equipment, block GPS trackers, even parole ankle bracelets. Types of jammers include 5G/4G/LoJack/XM, GSM/GPS, Walkie-Talkie, Wi-Fi, Bluetooth, and more.
Can Jammers Be Defeated?
There are only a few ways to practically defeat a jammer:
- Move out of its range:
- Distance – getting out of range of the jamming signal. Without knowing the location of the jammer, this will be difficult.
- Frequency -searching for quiet channel or possibly selecting a different frequency modulation scheme.
- Amplitude – using power management techniques, increase the transmit amplitude for outbound transmissions (attempt to overcome the jammer interference)
- Detect, locate and disable the jammer source.
This is where TSCM skills come into play. Jammers, by design, transmit strong RF signals, meaning the transmit signal can be detected with a spectrum analyzer. The right spectrum analyzer for detecting and possibly locating an RF jammer should include:
Portability: The spectrum analyzer must be portable and mobile so it can sweep and rapidly analyze energy in different areas.
Frequency Range: The spectrum analyzer needs to cover a wide frequency span. A signal strength indicator alone, like most basic RF detectors have doesn’t provide the information needed to differentiate a jamming signal from other RF activity. Some jammers flood multiple frequency spans simultaneously while others target specific spans, so it’s important to have a spectrum analyzer that shows the scope of the jamming signal.
Analysis Capability: A spectrum analyzer that can isolate jamming signals into frequency bands (cell phone, Wi-Fi, Bluetooth) provides an excellent method for quickly identifying targeted devices. Spectrum view, Waterfall and Persistence display also provide additional perspective on the signal’s activity over time.
These are just a few things to look for in a spectrum analyzer to aid in signal jammer search and detection. REI will soon be introducing new features in the MESA Mobile Bands function to help detect and locate RF jammers. This feature will be available as a free firmware update on REI’s website and will be in new shipments beginning in July. Watch for more information in the next edition of the REI Newsletter.
While the Team at REI has adapted to online tradeshows and continued to connect with our customers at events like Security and Policing (pictured above). The team at REI is excited to announce a list of Summer and Fall tradeshows we will be attending in person.
NATIA – Tampa, FL – July 11-14
ISC West – Las Vegas, NV -July 19-21
*One-Day ANDRE Training – July 22
DSEI– Excel, London – September 14-17
GSX – Orlando, FL – September 27-29
MILIPOL Paris – Paris, France – October 19-22
AOC Annual Symposium – Washington, DC – November 30 – December 2
*Additionally, REI will be hosting a One-Day ANDRE Training in Las Vegas at the end of ISC West. For more information go to https://reiusa.net/rei-training-center/andre-remote-training-2/
To keep up with the REI Tradeshow schedule check out the Events section of our homepage: https://reiusa.net/
REI offers online E-Training courses that provide introductory and refresher level instruction to anyone with an REI product who wants to learn its basic operations, but is unable to travel to REI’s Training Center. We currently offer 6-12 hours of E-Training on the ANDRE & ORION, MESA, OSCOR, and TALAN. The limited class size encourages higher student engagement, allowing students and instructors to explore topics more in-depth and answer more specific questions. Students are required to have their own equipment on hand to train on software navigation, functions, and accessories. REI’s E-Training does not replace in-person classroom training and exercises, but it does provide operational overview for users who are unable to travel.
To learn more about REI’s E-Training options, click here.
Curso de formación de español
REI esta ofreciendo un paquete de Curso en Español que incluye Los Conceptos Principales de Contramedidas-Nivel 1 y un curso combinado de RF OSCOR y TALAN -Nivel 2.
septiembre 13, 2021 – septiembre 24, 2021
Note: Training begins at 8:30 a.m. CST and typically ends at 4:30 p.m.
Titulo: Conceptos Principales de Contramedidas – Nivel 1
El segmento de los Conceptos Principales de Contramedidas se enfoca en la introduccion a los procedimientos y equipo de contramedidas de vigilancia. Los estudiantes seran introducidos a las pruebas de telefonos, tecnicas de busqueda basica RF, como procedimientos basicos de investigacion. Esta parte del curso esta diseñada para introducir y familiarizar al especialista en seguridad tecnica con varios productos de contramedidas de vigilancia y sus procedimientos basicos de barrido.
Topicos del Curso:
- Investigaciones Basicas Tecnicas, cubriendo los conceptos de procedimiento para integrar seguridad tecnica con la seguridad de instalaciones que existe
- Vision de Conjunto de Amenaza de dispositivo comercialmente disponible
- Ver más información
Titulo: RF OSCOR y TALAN Curso Nivel 2
Requisito Previo: Conceptos Principales de Contramedidas – Nivel 1
Esta parte del curso se enfocara primordialmente en la operacion y despliegue del Analizador de Espectro OSCOR RF y la del Analizador de Linea y Telefono TALAN. El curso iniciara con un breve realce de las Contramedidas de Vigilancia Tecnica, amenazas basicas, detectores de uniones no lineales y detectores de banda ancha. La porcion de entramiento de telefonos digitales provee instruccion en pruebas de los sistemas de telefonos digitales y el analisis de amenazas tecnicas, incluyendo la operacion del Analizador de Linea y Telefono TALAN de REI.
Topicos del Curso:
- Indicadores de Perdida de Propiedad Intelectual
- Inspecciones de Seguridad Tecnica Reaccionaria
- Ver más información
The REI Training Center is offering new online Basic E-Training courses to customers who own an REI product and want to learn its basic operations and functions. While E-Training courses do not replace in-person training at REI, these instructor led courses provide introductory level students and those who need refresher training, the opportunity to walk through menus and functions of the products.
ANDRE® & ORION® E-Training
The ANDRE & ORION E-Training is a one-day course, lasting approximately 6 hours, and covers ANDRE’s Histogram Display, Zoom View, Signal Information and Band Details, Audio Mode, Data Logging (Deluxe Feature). Additionally, trainers will review the ANDRE Antennas.
ORION features to be covered include digitally modulated transmit signal, Correlated 2nd & 3rd harmonic response, Adjustable DSP gain, Histogram graph showing continuous history of harmonic response and power adjustment, Touch screen displays, alert tones and haptic (vibration).
The MESA course will be held over two days (approximately 12 hours total) discussing sweep modes (SmartBars™, Spectrum Analyzer, Mobile Bands and Wi-Fi and Bluetooth®) display features, display and controls, various probes/antennas, remote access, signal list generation, and GPS.
The OSCOR course runs two-days (approximately 12 hours total) covering Radio Frequency (RF) Detection, Radio Frequency (RF) Analysis, Spectrum Analysis, Signal Analysis, Eavesdropping Detection, Surveillance Equipment Detection and Electronic Surveillance Detection.
The final installment of the REI E-Training covers the TALAN Telephone & Line Analyzer. This two-day course will review all menu options, basic functions, and basic telephone line testing procedures.
Students must have their own equipment and should be prepared to use it during the course. Each E-Training will be held via Zoom, attendees are encouraged to test Zoom prior to the course start. At the end of each E-Training course, students will receive a certificate of completion.
For pricing options, course dates or more information, visit reiusa.net/e-training.
It’s no secret the REI team misses connecting with customers in person at tradeshows and conferences, and we hope to return to shows in the near future. In the meantime, REI along with IPS will host a booth at the annual Security and Policing show March 9-11. If you have already registered and would like to visit REI’s virtual booth, click the button below to get connected:
Non-Linear Junction Detectors (NLJDs) have been used for decades to detect and locate hidden electronics, and REI’s ORION was among the earliest brands developed. A number of NLJD manufacturers have since come and gone but ORION has remained, adapted to technology changes, and today is by all standards considered the leading NLJD internationally, and not because it outlived the others. The ORION has many advanced features that make it stand out from the rest.
The ORION antenna head radiates a low power 1.25 MHz-wide OFDM spread spectrum RF signal. Shown here is a screen shot from an OSCOR spectrum analyzer that demonstrates the difference between ORION’s wide digital spread spectrum signal compared to a narrow analog TX signal of a typical NLJD. The wider Digital Spread Spectrum signal provides higher probability of detection using less peak power.
ORION HX models are the only NLJDs with a touchscreen display delivering specialized data graphs that can be screen captured and saved to micro-SD for reporting. Display graphs include:
- Frequency Adjust Screen – displays a graph of the ambient RF activity in the TX, 2nd and 3rd harmonic frequencies. This is necessary for selecting quiet channels to prevent interference in the transmit and harmonic frequencies
- Spectrogram View – provides a spectral view of the 2nd and 3rd harmonic receivers
- Histogram Display – a graph that displays a history of transmit power and harmonic activity over time (see below). No other NLJD can deliver this kind of data.
All tools, settings and operations are controlled through the touchscreen menus. ORION HX also has an antenna head display for line of site monitoring of the target area.
The ORION is the only NLJD in the world with a built in spectrum analysis view for transmit, and both 2nd and 3rd harmonic frequencies. This ensures the ability to operate on a clear frequency band and eliminate interference and false alarms in a dense RF environment. In this screen shot taken in Sao Paulo, Brazil; there was clearly RF interference in each band, but the unit was easily tuned to a clear channel for reliable operation. Other competitive products claim frequency agility, but no other NLJD in the world has 60+ channels in which to find a quiet frequency and avoid interference.
The ORION also provides several transmit frequency selection modes including Auto (automatically sweeps for a quiet channel) and Manual (user selects the TX frequency). Select models also include a Sweep mode (continually sweeps sequentially through channels), and Hop mode (randomly hops through channels).
The ORION digitally modulates the transmit signal with OFDM technology that correlates the 2nd and 3rd harmonic when received by the ORION. This significantly increases detection gain and helps prevent false detections.
The ORION has unparalleled receiver sensitivity: -140 dBm
Another feature unique to the ORION is the adjustable DSP (Digital Signal Processing) Gain feature. This setting configures the level of DSP integration used to process the received signals. Sensitivity increases as the DSP Gain is increased from Low to High.
ORION provides 3 types of alerts when RX signals exceed adjustable thresholds. Alerts are important for discreet sweeping and for sweep efficiency. Alerts include Audio (headphone or speaker), Visual (antenna and touchscreen displays), and Haptic (handle vibration). In most NLJDs, audio and/or visual may be available, but not all 3.
Transmit power level on the ORION can be changed manually or automatically. In the Auto transmit power mode, the transmit power will automatically reduce whenever the receiver becomes saturated. In Manual, the transmit power remains at the same level until it is manually changed.
The ORION 2.4 has a smaller antenna head that transmits a shorter wave length signal, which is better for smaller, modern electronics. The ORION 900’s larger wavelength antenna is better for larger, older electronics, and it is also better for penetrating denser materials (bricks, walls, etc.). The ORION HX Deluxe includes both interchangeable antenna heads in a single package to provide better detection sensitivity throughout changing environments.
The ORION’s unique Patented spiral antenna is circularly polarized to transmit and receive, removing the risk of missing a threat due to incorrect antenna polarization, improving reliability and sweep efficiency.
The ORION is designed for harsh environments:
- Water resistant
- Protected from dust ingress
- Operating temperatures -10° to 60°C / 14° to 140°F
ORION is the only NLJD available that has FCC AND CE mark models, which is very important to ensure safe operation and legal use around the world. No other NLJD meets the regulatory standards of the ORION.
There are many intangible benefits that come with the ORION — in-house manufacturing for reliable quality control, training, experienced sales and product support, just to name a few. At the end of the day, it’s important to have the right NLJD that provides the highest probability for finding electronics.
REI has released two new free online seminars:
The Radio Frequency Fundamentals
This seminar is an introduction to the world of RF, its characteristics and limitations. Highlighted in the presentation are:
- Basic RF Theory
- Applicable terminology
- Frequency classifications
- Modes of propagation and attenuation/signal path loss
This seminar also pairs well with the Technical Threats seminar to continue growing awareness of security vulnerabilities. Intellectual property theft and illicit eavesdropping causes countries and businesses billions in damages.
OSCOR® Data Viewer Seminar
This is an intermediate seminar covering best practices and technical applications of the Data Viewer software for analysis and reporting. Operations covered in the OSCOR Data Viewer Seminar include:
- Analyzing OSCOR Blue Trace Record Waterfall or OSCOR Green Spectrogram files
- Understanding trace files – Peak/Average
- Layering multiple trace files can be layered in one graph view for comparison
- Reviewing Signal Lists
For more information or to register for an upcoming Online Seminar, click here.
When you take the best features of a portable, handheld broadband RF detector (size, portability, utility) and combine them with the analysis capability of a spectrum analyzer, you get the MESA® – Mobility Enhanced Spectrum Analyzer. The MESA® is a compact, full-featured portable spectrum analyzer with physical search capability similar to a broadband receiver.
The first thing you may notice about the MESA® is how easy it is to navigate. Once you get a feel for the menus, icons, buttons and the main screen controls on the 7” capacitive touch screen, it may seem like you have it all figured out, but really, you’ve only begun to scratch the surface. Beneath the user friendly display is a powerful palette of tools and functions to help identify and locate signals.
MESA® is available in a Basic and Deluxe package (see the Accessories comparison chart). The MESA® Deluxe includes six RF antennas. The Fixed Dipole and Whip Antenna, are uniquely designed hybrid antennas that include a circular dipole for a higher frequency, and a longer mass antenna for low-frequency signals. The Down Converter antenna is a directional antenna with a frequency range from 500MHz to 12GHz. Other antennas include a Locator Probe, VLF probe, and low-frequency directional antenna. The QMA antenna input allows for non-REI antennas to be connected.
MESA® also has a Multi-Carrier Probe (carrier current), Ultrasonic, IR/Visible light, Audio Transformer and Audio Leakage probe. MESA® automatically recognizes REI antennas and probes when connected and adjusts the frequency display.
Operation Modes – Spectrum Analysis
MESA®, like the OSCOR®, is a portable swept-tuned super heterodyne spectrum analyzer that sweeps to 6GHz (12GHz with the Down Converter antenna included in the Deluxe model), at a speed of >200GHz per second at 312.5 kHz resolution bandwidth.
The Resolution Bandwidth (RBW) auto-adjusts depending on the frequency span.
• The narrower the span the finer the resolution bandwidth
• The wider the span, the higher the sweep speed
MESA® displays a full range of frequency data including span, start and stop frequencies, dB, RBW, Peak/Average Trace, Persistence Trace (below 200MHz spans), raster waterfall, RSSI, Alerts, and signal lists.
A new patented Cached Peak feature, preserves and displays 312.5kHz and 39kHz resolution Cached Peak traces as the span is zoomed in to higher resolutions, enabling peaks obtained at previous resolution bandwidths to be seen.
SmartBars™ – Mobile Bands – WiFi/Bluetooth®
SmartBars™ is a new patented mode that quickly detects and locates RF energy by displaying a bar graph of new signals, or increased RF energy, compared to a reference trace from outside the target sweep area. SmartBars™ offers a Fast Scan and a Signal Resolution scan which creates a signal list of signals that exceed the user-defined threshold.
Watch this video for an overview of how SmartBars™ works.
Additional display modes include Mobile Bands displaying RF energy levels for multiple RF Bands (i.e. WiFi, GSM, etc.) on one screen. Each Band is customizable to user-defined spans. This mode is excellent for quickly searching for RF energy in specific spans.
WiFi and Bluetooth® modes display nearby WiFi access points and Bluetooth® devices, relative signal strength, and links to the Spectrum View to view it in live frequency trace mode.
The MESA® is a completely new product that complements REI’s existing RF products – ANDRE® and OSCOR®. With the complexity and sophistication of new threats, multiple RF detection tools are required. Here are some of MESA’S benefits:
• Easy to use spectrum analyzer in a handheld package with touch screen controls
• Portable: 5 x 8 x 2 inches; (12.7cm x 20.3cm x 5.08cm), 1.08kg
• Sweep speed: >200GHz/second at 312.5kHz resolution; 30GHz/second at 39kHz resolution
• Quiet, flat noise floor with no internal spurious signals
• Quick to deploy and easy to use and walk around with, for fast effective site surveys.
• Patented SmartBars™ function to quickly and easily identify new signals using inside to outside comparison.
• Mobile Bands function displays RF energy level in user-defined spans
• Built in ITU database provides additional band information on detected signals
This fast, hand-held spectrum analyzer has operational capabilities suited for detecting illegal, disruptive, rogue transmissions across a wide frequency range and is ideal for:
• Communication systems site surveys
• RF emissions analysis
• Wireless service providers and installers
• Investigations of corrupt RF spectrum misuse
• Security surveys for eavesdropping detection
When COVID brought travel to a halt in early 2020, REI had to cancel many of its training courses, but customer demand for product and TSCM information never diminished. Since change and adaptation became the theme for 2020, REI instructors began searching for different ways to stay connected and at least try to satisfy some of the appetite for information.
REI customer feedback has always concluded that virtual training will never achieve the standard of in-person training for a number of reasons (hands-on access to equipment, live exercises, personal instruction, and networking). Under the present circumstances; however, virtual webinars can certainly provide value in the absence of in-person training.
REI instructors developed a series of free online Zoom Seminars to provide an overview of products and popular TSCM topics which includes ANDRE; OSCOR; TALAN; ORION; GPS Tracking; Basic Telephony; Introduction to VoIP, with more to come. Each seminar is approximately 1 hour long with Q&A at the end. The format is informal and interaction is encouraged. Capacity is limited to ensure optimal participation, so early registration is recommended.
In-person training courses have resumed, but REI plans to continue offering the online seminars. Schedule and registration information for online seminars and REI Training courses are available through the links below.
The REI Training Center recently added a new Level 2 course for REI’s newest product: MESA® – Mobility Enhanced Spectrum Analyzer.
The 5-day MESA® course will review radio frequency energy fundamentals. This module will further explore the basic characteristics of radio frequency (RF) energy and how it behaves in a normal environment. The purpose of this segment will be to build on the student’s knowledge of RF energy as it relates to spectrum analyzers.
Trainees will be introduced to the MESA by examining its technical specifications, operational features and function compared to other REI RF products – ANDRE and OSCOR. Modes and features to be examined in hands-on exercises include Spectrum Mode, the patented SmartBars™, Mobile Bands, Wi-Fi and Bluetooth®.
The Countermeasures Core Concepts course is a prerequisite to the MESA Course. Schedule and registration for the MESA® training course is available here.
7 Ways to Protect Your Equipment from Electrostatic Discharge (ESD).
The weather is changing and cooler temperatures mean short days, cozy sweaters, and static electricity. Colder, drier air outside causes us to turn on heat indoors further lowering humidity, which adds to the conditions that promote static electricity. Today’s electronic components and assemblies tend to be smaller more efficient, and also more delicate and sensitive to ESD and can be affected by even the smallest unseen, unfelt electrical charge. ESD can cause erratic operation, shortened electronic life expectancy, or catastrophic failure.
At REI our production teams take extra precautions to prevent static electricity, and here are a few tips to keep your products functioning properly.
- Review the product user manual.
- Prep your work area – use a grounding work surface or mat when possible.
- Check the humidity levels of the environment you’re sweeping in, take extra ESD precautions when working in a dry environment.
- Transport and store the equipment in the original manufacturer’s case to prevent accidental ESD events.
- To discharge built up ESD on your person, touch a piece of metal before handling any electronic equipment.
- Practice social distancing – keep charged materials about a foot from your devices. Be aware of how close you’re keeping plastic, foam, scotch tape, and other materials that can build up a charge.
- Try not to overdrive your equipment inputs.
Taking precautions for ESD can save time in your sweeps and money.
REI and parent company HEICO completed acquisition of 2 partner companies in August, 2020: Transformational Security (“TS”) and Intelligent Devices (“ID”).
ID, which was founded in 1995 by Edmund Pirali, and TS, which was founded in 2004 by Jon Whittingham, are leading security technology companies that design, develop, manufacture and support state-of-the-art detection and monitoring systems used to protect critical spaces from wireless transmission exploitation, technical surveillance, and listening devices. Their products include hardware and software which detect, identify and analyze an array of information and radio frequency security threats.
Laurans A. Mendelson, HEICO’s Chairman and Chief Executive Officer, along with Victor H. Mendelson, HEICO’s Co-President and Chief Executive Officer of its Electronic Technologies Group, and Mr. Jones, jointly commented, “We welcome all of the Intelligent Devices and Transformational Security Team Members to our HEICO family. The crucial TSCM field provides vital equipment and services to keep sensitive information from reaching the wrong hands and we are excited about the potential for all of our companies to bring great products to our customers.”
TS specializes in advanced technology supporting In-Place Monitoring Systems (IPMS), LPI/LPD detection challenges, frequency management, multi-mission collection operations, security modeling, security consulting, access control systems, SCIF and safe rooms, and technical security hardware and software. ID provides state of the art audio solutions to the professional audio, government and law enforcement community.
REI will be closed on the following dates:
- Christmas – December 23 – 25
- New Year’s – Jan 1st
We wish all our friends, family and business relations a blessed Christmas and holiday season.