Phreacking:Telefonia Celular - ALIPSO.COM: Monografías, resúmenes, biografias y tesis gratis.
Miércoles 21 de Agosto de 2019 | Hay 1 usuario online en este momento!
 

Phreacking:Telefonia Celular

Imprimir Recomendar a un amigo Recordarme el recurso

Agregado: 12 de ABRIL de 2000 (Por ) | Palabras: 45165 | Votar! | Sin Votos | Sin comentarios | Agregar Comentario
Categoría: Apuntes y Monografías > Computación > Seguridad informatica >
Material educativo de Alipso relacionado con PhreackingTelefonia Celular
  • Nucleo celular:
  • Teoria Celular: definicion.caracteristicas.glosario
  • Phreacking:Telefonia Celular:

  • Enlaces externos relacionados con PhreackingTelefonia Celular

    C e l l u l a r T e l e p h o n y

     

    by

    B r i a n O b l i v i o n

     

     

    A -=Restricted -=Data -=Transmission

     

     

    The benefit of a mobile transceiver has been the wish of experimenters

    since the late 1800's. To have the ability to be reached by another

    man despite location, altitude, or depth has had high priority in

    communication technology throughout its history. Only until the late

    1970's has this been available to the general public. That is when

    Bell Telephone (the late Ma Bell) introduced the Advanced Mobile

    Phone Service, AMPS for short.

    Cellular phones today are used for a multitude of different jobs.

    They are used in just plain jibber-jabber, data transfer(I will

    go into this mode of cellular telephony in depth later), corporate

    deals, surveillance, emergencies, and countless other applications.

    The advantages of cellular telephony to the user/phreaker are

    obvious:

    1. Difficulty of tracking the location of a transceiver

    (especially if the transceiver is on the move) makes

    it very difficult to locate

    2. Range of the unit within settled areas

    3. Scrambling techniques are feasible and can be made to

    provide moderate security for most transmissions.

    4. The unit, with modification can be used as a bug, being

    called upon by the controlling party from anywhere on

    the globe.

    5. It with the right knowledge one can modify the cellular

    in both hardware and software to create a rather diverse-

    ified machine that will scan, store and randomly change

    ESN's per call there by making detection almost impossible.

     

    I feel it will be of great importance for readers to understand the

    background of the Cellular phone system, mainly due to the fact that

    much of the pioneering systems are still in use today. The first

    use of a mobile radio came about in 1921 (remember prohibition?)

    by the Detroit police department. This system operated at 2MHz. In

    1940, frequencies between 30 and 40MHz were made available to and

    soon became overcrowded. The trend of overcrowding continues today.

    In 1946, the FCC declared a 'public correspondence system' called,

    or rather classified as "Domestic Public Land Mobile Radio Service"

    (DPLMRS) at 35 - 44 MHz band that ran along the highway between

    New York and Boston. Now the 35-44MHz band is used mainly by Amateur

    radio hobbyists due to the bands susceptibility to skip-propagation.

    These early mobile radio systems were all PTT(push-to-talk) systems

    that did not enjoy todays duplex conversations. The first real

    mobile 'phone' system was the 'Improved Mobile Telephone Service'

    or the IMTS for short, in 1969. This system covered the spectrum

    from 150 - 450MHz, sported automatic channel selection for each

    call, eliminated PTT, and allowed the customer to do their own

    dialing. From 1969 to 1979 this was the mobile telephone service

    that served the public and business community, and it is still

    used today.

    IMTS frequencies used(MHz):

    Channel Base Frequency Mobile Frequency

    VHF Low Band

    ZO 35.26 43.26

    ZF 35.30 43.30

    ZH 35.34 43.34

    ZA 35.42 43.32

    ZY 34.46 43.46

    ZC 35.50 43.50

    ZB 35.54 43.54

    ZW 35.62 43.62

    ZL 35.66 43.66

    VHF High Band

    JL 152.51 157.77

    YL 152.54 157.80

    JP 152.57 157.83

    YP 152.60 157.86

    YJ 152.63 157.89

    YK 152.66 157.92

    JS 152.69 157.95

    YS 152.72 157.98

    YA 152.75 158.01

    JK 152.78 158.04

    JA 152.81 158.07

    UHF Band

    QC 454.375 459.375

    QJ 454.40 459.40

    QO 454.425 459.425

    QA 454.45 459.45

    QE 454.475 459.475

    QP 454.50 459.50

    QK 454.525 459.525

    QB 454.55 459.55

    QO 454.575 459.575

    QA 454.60 459.60

    QY 454.625 459.625

    QF 454.650 459.650

    VHF High frequencies are the most popular frequencies of all

    the IMTS band. VHF low bands are used primarily in rural areas

    and those with hilly terrain. UHF bands is primarily used in cities

    where the VHF bands are overcrowded. Most large cities will find

    at least one station being used in their area.

    ADVANCED MOBILE PHONE SYSTEM

    The next step for Mobile telephone was made in 1979 by Bell

    Telephone, again (gee.. where was the competition?), introducing

    the Advanced Mobile Phone Service. This service is the focus

    of this document, which has now taken over the mobile telephone

    industry as the standard. What brought this system to life

    were the new digital technologies of the 1970's. This being

    large scale integrated custom circuits and microprocessors.

    Without these technologies, the system would not have been

    economically possible.

    The basic elements of the cellular concept have to do with

    frequency reuse and cell splitting.

    Frequency reuse refers to the use of radio channels on the same

    carrier frequency to cover different areas which are separated by

    a significant distance. Cell splitting is the ability to split

    any cell into smaller cells if the traffic of that cell requires

    additional frequencies to handle all the area's calls. These two

    elements provide the network an opportunity to handle more simul-

    taneous calls, decrease the transmitters/receivers output/input

    wattage/gain and a more universal signal quality.

    When the system was first introduced, it was allocated 40MHz in

    the frequency spectrum, divided into 666 duplex radio channels

    providing about 96 channels per cell for the seven cluster

    frequency reuse pattern. Cell sites (base stations) are located

    in the cells which make up the cellular network. These cells

    are usually represented by hexagons on maps or when developing

    new systems and layouts. The cell sites contain radio, control,

    voice frequency processing and maintenance equipment, as well as

    transmitting and receiving antennas. The cell sites are inter-

    connected by land-line with the Mobile Telecommunications Switching

    Office (MTSO).

    In recent years, the FCC has added 156 frequencies to the Cellular

    bandwidth. This provides 832 possible frequencies available to

    each subscriber per cell. All new cellular telephones are built

    to accommodate these new frequencies, but old cellular telephones

    still work on the system. How does a cell site know if the unit

    is old or new? Let me explain.

    The problem of identifying a cellular phones age is done by the

    STATION CLASS MARK (SCM). This Number is 4 bits long and broken

    down like this:

    Bit 1: 0 for 666 channel usage (old)

    1 for 832 channel usage (new)

    Bit 2: 0 for a mobile unit(in

    vehicle)

    1 for voice-activated transmit (for portables)

    Bit 3-4: Identify the power class of the unit

    Class I 00 = 3.0 watts Continuous Tx's 00XX...DTX <> 1

    Class II 01 = 1.2 watts Discont. Tx's 01XX...DTX = 1

    Class III 10 = 0.6 watts reserved 10XX, 11XX

    Reserved 11 = --------- Letters DTX set to 1 permits

    use of discontinuous trans-

    missions

     

    Cell Sites: How Cellular telephones get their name

    Cell sites, as mentioned above are laid out in a hexagonal type

    grid. Each cell is part of a larger cell which is made up of

    seven cells in the following fashion:

    |---| ||===|| |---| |---| |---| |---

    / \ // \\ / \ / \ / \ /

    | |===|| 2 ||===|| ||===|| |---| |---|

    \ // \ / \\ // \\ / \ / \

    |---|| 7 |---| 3 ||==|| 2 ||==|| |---| |---|

    / \\ / \ // \ / \\ Due to the \

    | ||---| 1 |---|| 7 |---| 3 ||--| difficulty of |

    \ // \ / \\ / \ // \ representing /

    |--|| 6 |---| 4 ||--| 1 |---|| |graphics with |

    / \\ / \ // \ / \\ / ASCII characters\

    | ||==|| 5 ||==|| 6 |---| 4 ||--| I will only show |

    \ / \\ // \\ / \ // \ two of the cell /

    |---| ||===|| ||===|| 5 ||==|| |types I am trying-

    / \ / \ / \\ // \ / to convey. \

    | |---| |---| ||==|| |---| |---| |

    \ / \ / \ / \ / \ / \ /

    |---| |---| |---| |---| |---| |---|

    As you can see, each cell is a 1/7th of a larger cell. Where one(1)

    is the center cell and two(2) is the cell directly above the center.

    The other cells are number around the center cell in a clockwise

    fashion, ending with seven(7). The cell sites are equipped with

    three directional antennas with an RF beam-width of 120 degrees

    providing 360 degree coverage for that cell. Note that all cells

    never share a common border. Cells which are next to each other

    are obviously never assigned the same frequencies. They will

    almost always differ by at least 60 kHz. This also demonstrates

    the idea behind cell splitting. One could imagine that the perimeter

    of one of the large cells was once one cell. Due to a traffic

    increase, the cell had to be sub-divided to provide more channels

    for the subscribers. Note that subdivisions must be made in factors

    of seven.

    There are also Mobile Cell sites, which are usually used in the

    transitional period during the up-scaling of a cell site due to

    increased traffic. Of course, this is just one of the many uses of

    this component. Imagine you are building a new complex in a very

    remote location. You could feasibly install a few mobile cellular

    cell sites to provide a telephone-like network for workers and

    executives. The most unique component would be the controller/

    transceiver which provides the communications line between the

    cell site and the MTSO. In a remote location such a link could

    very easily be provided via satellite up/down link facilities.

     

    Lets get into how the phones actually talk with each other. There

    are several ways and competitors have still not set an agreed upon

    standard.

    Frequency Division Multiple Access (FDMA)

    This is the traditional method of traffic handling. FDMA is a

    single channel per carrier analog method of transmitting signals.

    There has never been a definite set on the type of modulation to

    be used. There are no regulations requiring a party to use a single

    method of modulation. Narrow band FM, single sideband AM, digital, and

    spread-spectrum techniques have all been considered as a possible

    standard. But none have yet to be chosen.

    FDMA works like this: Cell sites are constantly searching out

    free channels to start out the next call. As soon as a call finishes

    the channel is freed up and put on the list of free channels. Or, as

    a subscriber moves from one cell to another the new cell they are in

    will hopefully have an open channel to receive the current call in

    progress and carry it through its location. This process is called

    hand-off, and will be discussed more in-depth further along.

    Other proposed traffic handling schemes include Time-Division

    Multiple Access (TDMA), Code-Division Multiple Access(CDMA), and

    Time-Division/Frequency Division Multiple Access.

    Time Division Multiple Access

    With TDMA calls are simultaneously held on the same channels, but

    are multiplexed between pauses in the conversation. These pauses

    occur in the way people talk and think, and the telephone company

    also injects small delays on top of the conversation to accommodate

    other traffic on that channel. This increase in the length of the

    usual pause results in a longer amount of time spent on the call.

    Longer calls result in higher cost of the call.

    Code Division Multiple Access

    This system has been used in mobile military communications for the

    past 35 years. This system is digital and breaks up the digitized

    conversation into bundles, compressed, sent, then decompressed and

    converted back into analog. There are said increases of throughput

    of 20 : 1 but CDMA is susceptible to interference which will result

    in packet retransmission and delays. Of course error correction can

    can help in data integrity, but will also result in a small delay in

    throughput.

    Time-Division/Frequency Division Multiple Access

    TD/FDMA is a relatively new system which is an obvious hybrid of

    FDMA and TDMA. This system is mainly geared towards the increase

    of digital transmission over the cellular network. TD/FDMA make

    it possible to transmit signals from base to mobile without

    disturbing the conversation. With FDMA there are significant

    disturbances during hand-off with prevent continual data transmission

    from site to site. TD/FDMA make it possible to transmit control

    signals by the same carrier as the data/voice thereby ridding

    extra channel usage for control.

     

    Cellular Frequency Usage and channel allocation

     

    There are 832 cellular phone channels which are split into two

    separate bands. Band A consists of 416 channels for non-wireline

    services. Band B consists equally of 416 channels for wireline

    services. Each of these channels are split into two frequencies

    to provide duplex operation. The lower frequency is for the mobile

    unite while the other is for the cell site. 21 channels of each

    Band are dedicated to 'control' channels and the other 395 are

    voice channels. You will find that the channels are numbered from

    1 to 1023, skipping channels 800 to 990.

    I found these handy-dandy equations that can be used for calculating

    frequencies from channels and channels from frequencies.

    N = Cellular Channel # F = Cellular Frequency

    B = 0 (mobile) or B = 1 (cell site)

     

     

    CELLULAR FREQUENCIES from CHANNEL NUMBER:

     

    F = 825.030 + B * 45 + ( N + 1 ) * .03

    where: N = 1 to 799

    F = 824.040 + B * 45 + ( N + 1 ) * .03

    where: N = 991 to 1023

     

     

    CHANNEL NUMBER from CELLULAR FREQUENCIES

     

    N = 1 + (F - 825.030 - B * 45) / .03

    where: F >= 825.000 (mobile)

    or F >= 870.030 (cell site)

    N = 991 + (F - 824.040 - B * 45) / .03

    where: F <= 825.000 (mobile)

    or F <= 870.000 (base)

     

    Now that you have those frequencies, what to do with them. Well,

    for starters, one can very easily monitor the cellular frequencies

    with most hand/base scanners. Almost all scanners pre-1988 have

    some coverage of the 800 - 900 MHz band. All scanners can

    monitor the IMTS frequencies.

    Remember that cellular phones operate on a full duplex channel.

    That means that one frequency is used for transmission and the

    other is used for receiving, each spaced exactly 30 kHz apart.

    Remember also that the base frequencies are 45MHz higher than

    the cellular phone frequencies. This can obviously make

    listening rather difficult. One way to listen to both parts of

    the conversation would be having two scanners programmed 45 MHz

    apart to capture the entire conversation.

    The upper UHF frequency spectrum was 'appropriated' by the Cellular

    systems in the late 1970's. Televisions are still made to

    receive up to channel 83. This means that you can receive much

    of the cellular system on you UHF receiver. One television channel

    occupies 6MHz of bandwidth. This was for video, sync, and audio

    transmission of the channel. A cellular channel only takes up

    24 kHz plus 3kHz set up as a guard band for each audio signal.

    This means that 200 cellular channels can fit into one UHF

    television channel. If you have an old black and white television

    drop a variable cap in there to increase the sensitivity of the

    tuning. Some of the older sets have coarse and fine tuning knobs.

    Some of the newer, smaller, portable television sets are tuned by

    a variable resistor. This make modifications MUCH easier, for now

    all you have to do is drop in there a smaller value pot and

    tweak away. I have successfully done this on two televisions.

    Most users will find that those who don't live in a city will

    have a much better listening rate per call. In the city, the cells

    are so damn small that hand-off is usually every other minute.

    Resulting in chopped conversations.

    If you wanted to really get into it, I would suggest to obtain an

    old Television set with decent tuning controls and remove the RF

    section out of the set. You don't want all that hi-voltage circuitry

    lying around(flyback and those caps). UHF receivers in televisions

    down-convert UHF frequencies to IF (intermediate frequencies) between

    41 and 47 MHz. These output IF frequencies can then be run into a

    scanner set to pick-up between 41 - 47 MHz. Anyone who works with

    RF knows that it is MUCH easier to work with 40MHz signals than working

    with 800MHz signals (not to far away from Ghz.. mmmmmmm.. Waveguides

    are just sooo much fun). JUST REMEMBER ONE THING!!!! Isolate the

    UHF receiver from your scanner by using a coupling capacitor(.01 -

    .1 microfarad(50V min.) will do nicely)!!!! You don't want any of

    those biasing voltages creeping into your scanners receiving

    AMPLIFIERS!!! Horrors. Also, don't forget to ground both the scanner

    and receiver.

    Some systems transmit and receive the same cellular transmission

    on the base frequencies. There you can simply hang out on the

    base frequency and capture both sides of the conversation. The

    hand-off rate is much higher in high traffic areas leading the listener

    to hear short or choppy conversations. At times you can listen in

    for 5 to 10 minutes per call, depending on how fast the caller is

    moving through the cell site.

    TV Cell & Channel Scanner TV Oscillator Band

    Channel Freq.& Number Frequency Frequency Limit

    ===================================================================

    73 (first) 0001 - 825.03 45.97 871 824 - 830

    73 (last) 0166 - 829.98 41.02 871 824 - 830

    74 (first) 0167 - 830.01 46.99 877 830 - 836

    74 (last) 0366 - 835.98 41.02 877 830 - 836

    75 (first) 0367 - 836.01 46.99 883 836 - 842

    75 (last) 0566 - 841.98 41.02 883 836 - 842

    76 (first) 0567 - 842.01 46.99 889 842 - 848

    76 (last) 0766 - 847.98 41.02 889 842 - 848

    77 (first) 0767 - 848.01 46.99 895 848 - 854

    77 (last) 0799 - 848.97 46.03 895 848 - 854

    All frequencies are in MHz

    You can spend hours just listening to cellular telephone conversations

    but I would like to mention that it is illegal to do so. Yes, it is

    illegal to monitor cellular telephone conversations. It just another

    one of those laws like removing tags off of furniture and pillows.

    It's illegal, but what the hell for? Its also illegal to spit on

    the sidewalks here in Massachusetts, yet you can carry a shotgun

    on Sundays with you to mass(thats still in the books. Obviously

    it was for the original settlers). At any rate, I just want you

    to understand that doing the following is in violation of the law.

    Now back to the good stuff.

    Conversation is not only what an avid listener will find on the

    cellular bands. One will also hear call/channel setup control

    data streams, dialing, and other control messages. At times,

    a cell site will send out a full request for all units in its

    cell to identify itself. The phone will then respond with the

    appropriate identification on the corresponding control channel.

    Whenever a mobile unit is turned on, even when not placing a call,

    whenever there is power to the unit, it transmits its phone

    number and its 8-digit ID number. The same process is done when

    an idling phone passes from one cell to the other. This process

    is repeated for as long as there is power to the unit. This allows

    the MTSO to 'track' a mobile through the network. That is why it is

    not a good reason to use a mobile phone from one site. They do have

    ways of finding you. And it really is not that hard. Just a bit

    of RF Triangulation theory and you're found. However, when the

    power to the unit is shut off, as far as the MTSO cares, you never

    existed in that cell, of course unless your unit was flagged for some

    reason. MTSO's are basically just ESS systems designed for mobile

    applications. This will be explained later within this document.

    It isn't feasible for the telephone companies to keep track of each

    customer on the network. Therefore the MTSO really doesn't know

    if you are authorized to use the network or not. When you purchase

    a cellular phone, the dealer gives the units phone ID number to the

    local BOC, as well as the number the BOC assigned to the customer.

    When the unit is fired up in a cell site its ID number and phone

    number is transmitted and checked. If the two numbers are registered

    under the same subscriber, then the cell site will allow the mobile

    to send and receive calls. If they don't match, then the cell will

    not allow the unit to send or receive calls. Hence, the most

    successful way of reactivating a cellular phone is to obtain an

    ID that is presently in use and modifying your rom/prom/eprom for

    your specific phone.

    RF and AF Specifications:

    Everything that you will see from here on out is specifically

    Industry/FCC standard. A certain level of compatibility has

    to be maintained for national intercommunications, therefore

    a common set of standards that apply to all Cellular telephones

    can be compiled and analyzed.

    Transmitter Mobiles: audio transmission

    - 3 kHz to 15 kHz and 6.1 kHz to 15 kHz

    - 5.9 kHz to 6.1 kHz 35 dB attenuation

    - Above 15 kHz, the attenuation becomes 28 dB

    - All this is required after the modulation limiter and before

    the modulation stage

    Transmitters Base Stations: audio transmission

    - 3 kHz to 15 kHz

    - Above 15 kHz, attenuation required 28 dB

    - Attenuation after modulation limiter - no notch filter required

    RF attenuation below carrier Transmitter: audio transmission

    - 20 kHz to 40 kHz, use 26 dB.

    - 45 kHz to 2nd harmonic, the specification is 60 dB or 43 + 10 log

    of mean output power

    - 12 kHz to 20 kHz, attenuation 117 log f/12

    - 20 kHz to 2nd harmonic, there is a choice: 100 log F/100 or 60 dB

    or 43 log + 10 log of mean output power, whichever is less.

    Wideband Data

    - 20 kHz to 45 kHz, use 26 dB

    - 45 kHz to 90 kHz, use 45 dB

    - 90 kHz to 2nd harmonic, either 60 dB or 43 + 10 log mean output

    power

    - all data streams are encoded so that NRZ (non-return-to-zero)

    binary ones and zeroes are now zero-to-one and one-to-zero

    transitions respectively. Wideband data can then modulate

    the transmitter carrier by binary frequency shift keying(BFSK)

    and ones and zeroes into the modulator must now be equivalent

    to nominal peak frequency deviations of 8 kHz above and below

    the carrier frequency.

    Supervisory Audio Tones

    - Save as RF attenuation measurements

    Signaling Tone

    - Same as Wideband Data but must be 10 kHz +/- 1 Hz and produce a

    nominal frequency deviation of +/- 8 kHz.

     

    The previous information will assist any technophile to modify or

    even troubleshoot his/her cellular phone. Those are the working

    guidelines, as I stated previously.

     

    UNIT IDENTIFICATION

    Each mobile unit is identified by the following sets of numbers.

    The first number is the Mobile Identification Number (MIN). This

    34 bit binary number is derived from the units telephone number,

    MIN1 is the last seven digits of the telephone number and MIN2 is

    the area code.

    For demonstrative purposes, we'll encode 617-637-8687.

    Here's how to derive the MIN2 from a standard area code. In this

    example, 617 is the area code. All you have to do is first convert

    to modulo 10 using the following function. A zero digit would be

    considered to have a value of 10.

    100(first number) + 10(second) +1(third) - 111 = x

    100(6) + 10(1) + 1(7) - 111 = 506

    (or you could just - 111 from the area code.)

    Then convert it to a 10-bit binary number: 0111111010

    To derive MIN1 from the phone number is equally as simple. First

    encode the next three digits, 637.

    100(6) + 10(3) + 1(7) - 111 = 526

    Converted to binary: 1000001110

    The remainder of the number 8687, is processed further by taking

    the first digit, eight(8) and converting it directly to binary.

    8 = 1000 (binary)

    The last three digits are processed as the other two sets of

    three numbers were processed.

    100(6) + 10(8) + 1(7) - 111 = 576

    Converted to binary: 1001000000

    So the completed MIN number would look like this:

    |--637---||8-||---687--||---617--|

    1000001110100010010000000111111010

    \________/\__/\________/\________/

     

    A unit is also identifiable by its Electronic Serial Number or

    ESN. This number is Factory Preset and is usually stored in a

    ROM chip, which is soldered to the board. It may also be found

    in a 'computer on a chip', which are the new microcontrollers

    which have rom/ram/microprocessor all in the same package. This

    type of setup usually has the ESN and the software to drive the

    unit all in the same chip. This makes is significantly harder

    to dump, modify and replace. But it is far from impossible.

    The ESN is a 4 byte hex or 11-digit octal number. I have encountered

    mostly 11-digit octal numbers on the casing of most cellular phones.

    the first three digits represent the manufacturer and the remaining

    eight digits are the units ESN. I'll go more into the ESN later in

    the document.

    The Station Class Mark (SCM) is also used for station identification

    by providing the station type and power output rating. This was

    already discussed in a previous section.

    The System IDentification (SID number is a number which represents

    the mobile's home system. This number is 15-bits long and a list

    of current nationwide SID's should either be a part of this file

    or it will be distributed along with it.

     

    In the next issue we'll discuss the Control channels, signalling

    formats, and dissecting the NAM in detail. Social.technological

    impacts (re: cellular interception designed into the units)

    -------------- cut me here ---------------------------------------------------

     

    PUTTING IT ALL TOGETHER - Signaling on the Control Channels

    There are two types of continuous wideband data stream transmissions.

    One is the Forward Control Channel which is sent from the land station

    to the mobile. The other is the Reverse Control Channel, which is

    sent from the mobile to the land station. Each data stream runs at a

    rate of 10 kilobit/sec, +/- 1 bit/sec rate. The formats for each of

    the channels follow.

     

    Forward Control Channel

    The forward control channel consists of three discrete information

    streams. They are called stream A, stream B and the busy-idle

    stream. All three streams are multiplexed together. Messages to

    mobile stations with the least significant bit of their MIN number

    equal to "0" are sent on stream A, and those with a "1" are sent

    on stream B.

    The busy-idle stream contains busy-idle bits, which are used to

    indicate the status of the reverse control channel. If the busy-idle

    bit = "0" the reverse control channel is busy, if it equals "1"

    it is idle. The busy-idle bit is located at the beginning of each

    dotting sequence, word sync sequence, at the beginning of the first

    repeat of word A and after every 10 message bits thereafter.

    Mobile stations achieve synchronization with the incoming data via

    a 10 bit dotting sequence (1010101010) and an 11 bit word sync

    sequence (11100010010). Each word contains 40 bits, including parity

    and is repeated 5 times after which it is then referred to as a

    "block". For a multi-word message, the second word block and subsequent

    word blocks are formed the same as the first word block including the

    dotting and sync sequences. A "word" is formed when the 28 content

    bits are encoded into a (40, 28; 5) BCH (Bose-Chaudhuri-Hocquenghem)

    code. The left-most bit shall be designated the most-significant bit.

    The Generator polynomial for the (40, 28;5) BCH code is:

    12 10 8 5 4 3 0

    G (X) = X + X + X + X + X + X + X

    B

    Each FOCC message con consist of one or more words. Messaging trans-

    mitted over the forward control channel are:

    - Mobile station control message

    - Overhead message

    - control-filler message

    Controller-filler messages may be inserted between messages and

    between word blocks of a multi-word message.

    Message Formats: Found on either stream A or B

    MOBILE STATION CONTROL MESSAGE

    The mobile station control message can consist of one, two, or four

    words.

    Word 1 (abbreviated address word)

    +--------+-------+---------------------------------------+-----------+

    | T t | | | |

    | 1 2 | DCC | Mobile Identification Number 1 | P |

    | | | 23-0 | |

    +--------+-------+---------------------------------------+-----------+

    bits: 2 2 24 12

    Word 2 (extended address word)

    +------+-----+-----------+------+--------+-------+----------+-----+

    | T T |SCC =| | RSVD | LOCAL | CRDQ | ORDER | |

    | 1 2| 11 | MIN2 | = 0 | | | | |

    | = +-----+ 3-24 +------+-----+--+-------+----------| P |

    | 10 |SCC =| | VMAC | CHAN | |

    | | 11 | | | | |

    +------+-----+-----------+------------+---------------------+=----+

    The Reverse Control Channel (RECC) is a wideband data stream sent

    from the mobile station to the land station. This data stream runs

    at a rate of 10 kilobit/sec, +/- 1 bit/sec rate. The format of the

    RECC data stream follows:

    +---------+------+-------+------------+-------------+-----------+-----

    | Dotting | Word | Coded | first word | Second word | Third word|

    | | sync | DCC | repeated | repeated | repeated | ...

    | | | | 5 times | 5 times | 5 times |

    +---------+------+-------+------------+-------------+-----------+-----

    DCC = Digital Color Code Dotting = 01010101...010101

    Received DCC 7-bit Codec DCC Word sync = 11100010010

    00 0000000

    01 0011111

    10 1100011

    11 1111100

    All messages begin with the RECC seizure precursor with is composed

    of a 30 bit dotting sequence (1010...101), and 11 bit word sync

    sequence (11100010010), and the coded digital color code.

    Each word contains 48 bits, including parity, and is repeated five

    times after which it is referred to as a word block. A word is

    formed by encoding 36 content bits into a (48, 36) BCH code that has

    a distance of 5, (48 36; 5). The left most bit shall be designated

    the most-significant bit. The 36 most-significant bits of the 48 bit

    field shall be the content bits.

    The generator polynomial for the code is the same for the (40,28;5)

    code used on the forward channel.

     

    CONTROL CHANNELS (SETUP CHANNELS)

    Each wireline and non-wireline service have 21 channels. These

    channels are used by the MTSO and the cell sites to directly

    communicate with the mobile unit. The first signal sent to initiate

    a call is the Supervisory Audio Tone (SAT). This can be thought of

    as the voltage used to close the loop on a land telephone.

    SAT Tones with corresponding binary codes:

    5970 Hz (00)

    6000 Hz (01)

    6030 HZ (10)

    The mobile unit receives the SAT from the cell site and transponds

    it back (closing the loop). Tone recognition must take place

    within 250 milliseconds or the site interprets it as the mobile

    is out of range. If the SAT is returned, then a Signaling Tone

    is issued. This Tone is 10kHz and is present when the user is

    either being alerted(call initialization), being handed off,

    or disconnecting The Signaling tone is used only in mobile to

    land direction.

     

     

    C e l l u l a r T e l e p h o n y I I

    by

    B r i a n O b l i v i o n

     

     

    A -=Restricted -=Data -=Transmission

     

    In the last issue we discussed the history of cellular telephony,

    monitoring techniques, and a brief description of its predecessors.

    In this issue I'll describe the call processing sequences for land-

    originated and mobile-originated calls, as well as the signaling

    formats for these processes. I apologize for the bulk of information

    but I feel it is important for anyone who is interested in how the

    network communicates. Please realize that there was very little I

    could add to such a cut and dried topic, and that most is taken

    verbatim from Industry standards, with comments and addendums salt

    and peppered throughout.

     

    Call-Processing Sequences

     

    Call-Processing Sequence for Land-Originated Calls

     

    MTSO Cell Site Mobile Unit

    ------------------------------------------------------------------------------

    1--Transmits setup channel

    data on paging channel

    2 ----------------------------Scans and locks on

    paging channel

    Receives incoming call --- 3

    and performs translations

    Sends paging message ----- 4

    to cell site

    5 -- Reformats paging

    message

    6 -- Sends paging message

    to mobile unit via

    paging channel

    7 ----------------------------Detects Page

    8 ----------------------------Scans and locks on

    access channel

    9 ----------------------------Seizes setup channel

    10 ----------------------------Acquires sync

    11 ----------------------------Sends service request

    12 -- Reformats service request

    13 -- Performs directional locate

    14 -- Sends service request to

    MTSO

    Selects voice channel --- 15

    Sends tx-on command to -- 16

    cell site

    17 -- Reformats channel designation

    message

    18 -- Sends channel designation

    message to mobile unit via

    access channel

    19 -----------------------------Tunes to voice

    channel

    20 -----------------------------Transponds SAT

    21 -- Detects SAT

    22 -- Puts on-hook on trunk

    Detects off-hook -------- 23

    Sends alert order ------- 24

    25 -- Reformats alert order

    26 -- Sends alert order to

    mobile unit via blank-

    and-burst on voice channel

    27 -----------------------------Alerts User

    28 -----------------------------Sends 10-kHz tone

    29 -- Detects 10-kHz tone

    30 -- Puts on-hook on trunk

    Detects on-hook --------- 31

    Provides audible ring --- 32

    33 -- Detects absence of 10-kHz

    tone

    34 -- Puts off-hook on trunk

    Detects off-hook -------- 35

    Removes audible ring ---- 36

    and completes connection

    Time

     

     

     

    Call-Processing Sequence for Mobile-Originated Calls

    MTSO Cell Site Mobile Unit

    ------------------------------------------------------------------------------

    1 -- Transmits setup channel

    data on paging channel

    2 --------------------------- Scans and locks-on

    paging channel

    3 --------------------------- User initiates call

    4 --------------------------- Scans and locks-on

    access channel

    5 --------------------------- Seizes setup channel

    6 --------------------------- Acquires sync

    7 --------------------------- Sends service request

    8 -- Reformats service request

    9 -- Performs directional Locate

    10 -- Sends service request to

    MTSO

    Selects voice channel ---- 11

    Sends tx-on command to --- 12

    cell site

    13 -- Reformats channel

    designation message

    14 -- Sends channel designation

    message to mobile unit via

    access channel

    15 --------------------------- Tunes to voice

    channel

    16 --------------------------- Transponds SAT

    17 -- Detects SAT

    18 -- Puts off-hook on trunk

    Detects off-hook --------- 19

    Completes call through --- 20

    network

    Time

    Let me review the frequency allocation for Wireline and non-Wireline

    systems. Remember that the Wireline service is usually provided by

    the area's Telephone Company, in my area that company is NYNEX. The

    non-Wireline companies are usually operated by other carriers foreign

    to the area, in my area we are serviced by Cellular One (which is owned

    by Southwestern Bell). Each company has its one slice of the electro-

    magnetic spectrum. The coverage is not continuous, remember that there

    are also 800 MHz trunked business systems that also operate in this

    bandwidth. Voice channels are 30 kHz apart and the Data channels are

    10 kHz apart.

     

    Frequency Range Use

    ----------------------------------------------------------------------

    870.000 - 879.360 Cellular One (mobile input 825.000 - 834.360)

    880.650 - 890.000 NYNEX (mobile input 835.650 - 845.500)

    890.000 - 891.500 Cellular One (mobile input 845.000 - 846.500)

    891.500 - 894.000 NYNEX (mobile input 846.500 - 849.000)

    879.390 - 879.990 Cellular One (data)

    880.020 - 880.620 NYNEX (data)

     

    The data streams are encoded NRZ (Non-return-to-zero) binary ones

    and zeroes are now zero-to-one and one-to-zero transitions respect-

    ivly. This is so the wide-band data can modulate the transmitter

    via binary frequency shift keying, and ones and zeroes into the

    modulator MUST now be equivalent to nominal peak frequency deviations

    of 8 kHz above and below the carrier frequency.

     

    PUTTING IT ALL TOGETHER - Signaling on the Control Channels

    The following information will be invaluable to the hobbyist that

    is monitoring cellular telephones via a scanner and can access

    control channel signals. All information released below is

    EIA/TIA - FCC standard. There are a lot of differences between

    cellular phones, but all phones must interface into the mobile

    network and talk fluently between each other and cell sites.

    Therefore, the call processing and digital signaling techniques are

    uniform throughout the industry.

     

    MOBILE CALL PROCESSING

    Calling:

    Initially, the land station transmits the first part of its SID

    to a mobile monitoring some control channel, followed by the number

    of paging channels, an ESN request, then mobile registration, which

    will either be set to 0 or 1. When registration is set to one, the

    mobile will transmit both MIN1 and MIN2 during system access, another

    1 for discontinuous (DTX) transmissions, read control-filler (RCF)

    should be set to 1, and access functions (if combined with paging

    operations) require field setting to 1, otherwise CPA (combined paging

    access) goes to 0.

    Receiving:

    As the mobile enters the Scan Dedicated Control Channels Task, it

    must examine signal strengths of each dedicated control channel

    assigned to System A if enabled. Otherwise System B control channels

    are checked.

    The values assigned in the NAWC (Number of Additional Words

    Coming) system parameter overhead message train will determine for

    the mobile if all intended information has been received. An EDN

    field is used as a cross-check, and control-filler messages are not

    to be counted as part of the message. Should a correct BCH code

    be received along with a non-recognizable overhead message, it must

    be part of the NAWC count train but the equivalent should not try

    and execute the instructions.

    Under normal circumstances, mobiles are to tune to the strongest

    dedicated control channel, receive a system parameter transmission,

    and, within 3 seconds, set up the following:

    o Set SID's 14 most significant bits to SID1 field value.

    o Set SID's least significant bit to 1, if serving system status

    enables, or to zero if not.

    o Set paging channels N to 1 plus the value of N-1 field.

    o Set paging channel FIRSTCHP as follows:

    If SIDs = SIDp then FIRSTCHPs = FIRSTCHPp (which is

    an 11-bit paging channel).

    If SIDs = SIDp and serving system is enabled, set

    FIRSTCHPs to initial dedicated channel for system

    B.

    If SIDs = SIDp and serving system is disabled, set

    FIRSTCHPs to first dedicated control channel for

    system B.

    o Set LASTCHPs to value of FIRSTCHPs + Ns -1.

    o Should the mobile come equipped for autonomous registration, it

    must:

    o Set registration increment (REGINCRs) to its 450 default

    value.

    o Set registration ID status to enabled.

    I know that was a little arcane sounding but it's the best you can

    do with specifications. Data is data, there is no way to spruce it

    up. From here on out a mobile must begin the Paging Channel Selection

    Task. If this cannot be completed on the strongest dedicated

    channel, the second strongest dedicated channel may be accessed and

    the three second interval commenced again. Incomplete results should

    result in a serving system status check and an enabled or disabled

    state reversed, permitting the mobile to begin the Scan Dedicated

    control Channels Task when channel signal strengths are once more

    examined.

    Custom local operations for mobiles may be sent and include roaming

    mobiles whose home systems are group members. A new access channel

    may be transmitted with a new access field set to the initial access

    channel. Autonomously registered mobiles may increment their next

    registered ID by some fixed value, but the global action message

    must have its REGINCR field adequately set. Also, so that all

    mobiles will enter the Initialization Task and scan dedicated

    control channels, a RESCAN global action message must be transmitted.

    Mobile stations may be required to read a control-filler message

    before accessing any system on a reverse control channel.

    System access for mobiles is sent on a forward control channel in

    the following manner. Digital Color Code (DCC) identifies the land

    station. Control Mobile Attenuation Code (CMAC) is included in the

    control-filler message for mobile power level transmitter adjustment

    before accessing any system on a reverse control channel. The WFOM

    Wait for Overhead Message field must register 0 before the mobile

    accesses a system on a reverse control channel. When mobiles are

    assigned to one or more of the 16 overload classes are not to access

    organizations on a reverse control channel, an overload control message

    is carried with the system parameter overhead message overload class

    fields are set to zero among the restricted number, and the remainder

    set to 1. Busy-to-idle status (BIS) access parameters go to zero when

    mobiles are prevented from checking on the reverse control channel and

    the message must be added to the overhead. When mobiles can't use the

    reverse control channel for seizure messages attempts or busy signals,

    access attempt parameters must also be included in the overhead. And

    when a land station receives a seizure precursor matching its digital

    color code with 1 or no bit errors, busy idle bits signals on the

    forward control channel must be set to busy within 1.2 milliseconds

    from the time of the last bit seizure. Busy-idle bit then must remain

    busy until a minimum of 30 msec following the final bit of the last

    word of the message has been received, or a total of 175 msec has

    elapsed.

    Channel Confirmation

    Mobiles are to monitor station control messages for orders and

    respond to both audio and local control orders even though land

    stations are not required to reply. MIN bits must be matched.

    Thereafter, the System Access Task is entered with a page response,

    as above, and an access timer started.

    This time runs as follows:

    o 12 seconds for an origination

    o 6 seconds for page response

    o 6 seconds for an order response

    o 6 seconds for a registration

    The last try code is then set to zero, and the equipment begins the

    Scan Access Channels Task to find two channels with the strongest

    signals which it tunes and enters the Retrieve Access Attempts

    Parameters Task.

    This is where both maximum numbers of seizure attempts and busy

    signals are each set to 10. A read control-filler bit (RCF) will

    then be checked: if the RCF equals zero, the mobile then reads a

    control-filler message, sets DCC and WFOM (wait for overhead message

    train before reverse control channel access) to the proper fields

    and sets the proper fields and sets the appropriate power level.

    Should neither the DCC field nor the control-filler message be

    received and access time has expired, the mobile station goes to

    Serving System Determination Task. But within the allowed access

    time, the mobile station enters the Alternate Access Channel Task.

    BIS is then set to 1 and the WFOM bit is checked. If WFOM equals 1,

    the station enters the Update Overhead Information Task; if WFOM

    equals 0, a random delay wait is required of 0 to 200 msec, +/- 1

    msec. Then, the station enters the Seize Reverse Control Channel

    Task.

    Service Requesting is next. This task requires that the mobile

    continue to send is message to the land station according to the

    following instructions:

    o Word A is required at all times.

    o Word B has to be sent if last try access LT equals 1 or

    if E requires MIN1 and/or MIN2, and the ROAM status is

    disabled, or if the station has been paged with a 2-word

    control message.

    o Word C is transmitted with S (serial number) being 1

    o Word D required if the access is an origination

    o Word E transmitted when the access is an origination and

    between 9 and 16 digits are dialed. When the mobile has

    transmitted its complete message, an unmodulated carrier is

    required for another 25 milliseconds before carrier turnoff.

    After words A through E have been sent, the next mobile task

    depends on the type of access.

    Order confirmation requires entry into the Serving System Determination

    Task.

    Origination means entry into the Await Message Task.

    Page response, is the same as Origination.

    Registration requires Await Registration Confirmation, which

    must be completed within 5 seconds or registration failure follows.

    The same is true for Await Message since an incomplete task in 5

    seconds sends the mobile into the Serving System Determination Task.

    Origination or Page response requires mobile update of parameters

    delivered in the message. If R equals 1, the mobile enters the

    Autonomous Registration Task, otherwise, it goes to the Initial

    Voice Channel Confirmation Task. Origination access may be either

    an intercept or reorder, and in these instances, mobiles enter the

    Serving System Determination Task. The same holds true for a page

    response access. But if access is an origination and the user

    terminates his call during this task, the call has to be released

    on a voice channel and not control channel.

    If a mobile station is equipped for Directed Retry and if a new

    message is received before all four words of the directed retry

    message, it must go to the Serving System Determination Task. There

    the last try code (LT) must be set according to the ORDQ (order

    qualifier) field of the message as follows:

    If 000, LT sets to 0

    If 0001, LT sets to 1

    Thereafter, the mobile clears the list of control channels to be

    scanned in processing Directed Retry (CCLIST) and looks at each

    CHANPOS (channel position) field contained in message words three

    and four. For nonzero CHANPOS field, the mobile calculates a cor-

    responding channel number by adding CHANPOS to FIRSTCHA minus one.

    Afterwards, the mobile has then to determine if each channel number

    is within the set designated for cellular systems. A true answer

    requires adding this/these channel(s) to the CCLIST.

     

    Awaiting Answers

    Here, an alert timer is set for 65 seconds (0 to +20 percent). During

    this period the following events may take place:

    o Should time expire, the mobile turns its transmitter off and

    enters the Serving System Determination Task.

    o An answer requires signaling tone turnoff and Conversation

    Task entry.

    o If any of the messages listed hereafter are received within

    100 milliseconds, the mobile must compair SCC digits that

    identify stored and proper SAT frequencies for the station to

    the PSCC (present SAT color code). If not equivalent, the

    order is ignored. If correct, then the following actions

    taken for each order:

    Handoff: Signaling extinguished for 500 msec, signal tone

    off, transmitter off, power lever adjusted, new

    channel tuned, new SAT, new SCC field, transmitter

    on, fade timer reset, and signaling tone on. Wait

    for an answer.

    Alert: Reset alert timer for 65 seconds and stay in

    Waiting for Answer Task.

    Stop Alert: Extinguish signaling tone and enter Waiting for

    Order Task.

    Release: Signaling tone off, wait 500 msec, then enter

    Release Task.

    Audit: Confirm message to land station, then stay in

    Waiting for Answer Task.

    Maintenance: Reset alert timer for 65 seconds and remain in

    Waiting for Answer Task.

    Change Power: Adjust transmitter to power level required and

    send confirmation to land station. Remain in

    Waiting for Answer Task.

    Local Control: If local control is enabled and order received,

    examine LC field and determine action.

    Orders other than the above for this type of action

    are ignored.

    Conversation

    In this mode, a release-delay timer is set for 500 msec. If Termin-

    ation is enabled, the mobile sets termination status to disabled and

    waits 500 msec before entering Release Task. The following actions

    may then execute:

    o Upon call termination, the release delay timer has to be checked.

    If time has expired, the Release Task is entered; if not expired,

    the mobile must wait until expiration and then enter Release Task.

    o Upon user requested flash, signaling tone turned on for 400 msec.

    But should a valid order tone be received during this interval,

    the flash is immediately terminated and the order processed. The

    flash, of course, is not then valid.

    o Upon receipt of the following listed orders and within 100 msec,

    the mobile must compare SCC with PSCC, and the order is ignored

    if the two are not equal. But if they are the same, the following

    can occur:

    Handoff: Signaling tone on for 50 msec, then off, trans-

    mitter off, power level adjusted, new channel tuned,

    adjust new SAT, set SCC to SCC field message value,

    transmitter on, fade timer reset, remain in

    Conversation Task.

    Send Called Address: Upon receipt within 10 seconds of last valid flash,

    called address sent to land station. Mobile remains

    in Conversation Task. Otherwise, remain in Conver-

    sation Task.

    Alert: Turn on signaling tone, wait 500 msec, then enter

    Waiting for Answer Task.

    Release: Check release delay timer. If time expired, mobile

    enters Release Task; but if timer has not finished,

    then mobile must wait and then enter Release Task

    when time has expired.

    Audit: Order confirmation sent to land station while

    remaining in Conversation Task.

    Maintenance: Signaling tone on, wait 500 msec, then enter Waiting

    for Answer Task.

    Change Power: Adjust transmitter to power level required by order

    qualification code and send confirmation to land

    station. Remain in Conversation Task.

    Local Control: If local control in enabled and local control order

    received, the LC field is to be checked for subse-

    quent action and confirmation.

    Orders other than the above for this type of action are ignored.

     

    Release

    In the release mode the following steps are required:

    o Signaling tone sent for 1.8 sec. If flash in transmission when

    signaling tone begun, it must be continued and timing bridged so

    that action stops within 1.8 sec.

    o Stop signaling tone.

    o Turn off transmitter.

    o The mobile station then enters the Serving System Deter-

    mination Task.

    The above is the Cellular System Mobile/Land Station Compatibility

    Specification. The following shall be Signaling Formats which are

    also found in the above document. I converted all these tables by

    HAND into ASCII so appreciate them. It wasn't the easiest thing to

    do. But I must say, I definitely understand the entire cellular

    operation format.

     

     

    There are two types of continuous wideband data stream transmissions.

    One is the Forward Control Channel which is sent from the land station

    to the mobile. The other is the Reverse Control Channel, which is

    sent from the mobile to the land station. Each data stream runs at a

    rate of 10 kilobit/sec, +/- 1 bit/sec rate. The formats for each of

    the channels follow.

     

    - Forward Control Channel

    The forward control channel consists of three discrete information

    streams. They are called stream A, stream B and the busy-idle

    stream. All three streams are multiplexed together. Messages to

    mobile stations with the least significant bit of their MIN number

    equal to "0" are sent on stream A, and those with a "1" are sent

    on stream B.

    The busy-idle stream contains busy-idle bits, which are used to

    indicate the status of the reverse control channel. If the busy-idle

    bit = "0" the reverse control channel is busy, if it equals "1"

    it is idle. The busy-idle bit is located at the beginning of each

    dotting sequence, word sync sequence, at the beginning of the first

    repeat of word A and after every 10 message bits thereafter.

    Mobile stations achieve synchronization with the incoming data via

    a 10 bit dotting sequence (1010101010) and an 11 bit word sync

    sequence (11100010010). Each word contains 40 bits, including parity

    and is repeated 5 times after which it is then referred to as a

    "block". For a multiword message, the second word block and subsequent

    word blocks are formed the same as the first word block including the

    dotting and sync sequences. A "word" is formed when the 28 content

    bits are encoded into a (40, 28; 5) BCH (Bose-Chaudhuri-Hocquenghem)

    code. The left-most bit shall be designated the most-significant bit.

    The Generator polynomial for the (40, 28;5) BCH code is:

    12 10 8 5 4 3 0

    G (X) = X + X + X + X + X + X + X

    B

    Each FOCC message can consist of one or more words. Messaging trans-

    mitted over the forward control channel are:

    - Mobile station control message

    - Overhead message

    - control-filler message

    Control-filler messages may be inserted between messages and

    between word blocks of a multiword message.

    Message Formats: Found on either stream A or B

    - Mobile Station Control Message

    The mobile station control message can consist of one, two, or four

    words.

    Word 1 (abbreviated address word)

    +--------+-------+---------------------------------------+-----------+

    | T t | | | |

    | 1 2 | DCC | Mobile Identification Number 1 | P |

    | | | 23-0 | |

    +--------+-------+---------------------------------------+-----------+

    bits: 2 2 24 12

    Word 2 (Extended Address Word)

     

    +------+-----+-----------+------+--------+-------+----------+-----+

    | T T |SCC =| | RSVD | LOCAL | CRDQ | ORDER | |

    | 1 2| 11 | MIN2 | = 0 | | | | |

    | = +-----+ 3-24 +------+-----+--+-------+----------| P |

    | 10 |SCC =| | VMAC | CHAN | |

    | | 11 | | | | |

    +------+-----+-----------+------------+---------------------+-----+

    2 2 10 3 11 12

     

    Word 3 (First Directed-Retry Word)

    +------+-----+-----------+-----------+-----------+-------+--------+

    | T T | SCC | | | | RSVD | |

    | 1 2| = | CHANPOS | CHANPOS | CHANPOS | = | |

    | = | | | | | 000 | P |

    | 10 | 11 | | | | | |

    +------+-----+-----------+-----------+-----------+-------+--------+

    2 2 7 7 7 3 12

     

    Word 4 (Second Directed-Retry Word)

    +------+-----+-----------+-----------+-----------+-------+--------+

    | T T | SCC | | | | RSVD | |

    | 1 2| = | CHANPOS | CHANPOS | CHANPOS | = | |

    | = | | | | | 000 | P |

    | 10 | 11 | | | | | |

    +------+-----+-----------+-----------+-----------+-------+--------+

    2 2 7 7 7 3 12

     

    The interpretation of the data fields:

    T T - Type field. If only Word 1 is send, set to 00 in Word 1.

    1 2 If a multiple-word message is sent, set to 01 in Word 1

    and set to 10 in each additional word.

    DCC - Digital Color Code field

    MIN1 - First part of the mobile identification number field

    MIN2 - Second part of the mobile identification number field

    SCC - SAT color code (discussed previously)

    ORDER - Order field. Identifies the order type (see table below)

    ORDQ - Order qualifier field. Qualifies the order to a specific

    action

    LOCAL - Local control field. This field is specific to each system.

    The ORDER field must be set to local control for this field

    to be interpreted.

    VMAC - Voice Mobile Attenuation Code field. Indicates the mobile

    station power level associated with the designated voice

    channel.

    CHAN - Channel number field. Indicates the designated voice channel.

    CHANPOS- CHANnel POSition field. Indicates the postiion of a control

    channel relative to the first access channel (FIRSTCHA).

    RSVD - Reserved for future use, all bits must be set as indicated.

    P - Parity field.

     

    Coded Digital Color Code

    +--------------------------------------------+

    | Received DCC 7-bit Coded DCC |

    | 00 0000000 |

    | 01 0011111 |

    | 10 1100011 |

    | 11 1111100 |

    +--------------------------------------------+

     

    Order and Order Qualification Codes

    +-------+-------------+-----------------------------------------------------+

    | Order | Order | |

    | Code |Qualification| Function |

    | | Code | |

    +-------+-------------------------------------------------------------------+

    | 00000 000 page (or origination) |

    | 00001 000 alert |

    | 00011 000 release |

    | 00100 000 reorder |

    | 00110 000 stop alert |

    | 00111 000 audit |

    | 01000 000 send called-address |

    | 01001 000 intercept |

    | 01010 000 maintenance |

    | |

    | 01011 000 charge power to power level 0 |

    | 01011 001 charge power to power level 1 |

    | 01011 010 charge power to power level 2 |

    | 01011 011 charge power to power level 3 |

    | 01011 100 charge power to power level 4 |

    | 01011 101 charge power to power level 5 |

    | 01011 110 charge power to power level 6 |

    | 01011 111 charge power to power level 7 |

    | |

    | 01100 000 directed retry - not last try |

    | 01100 001 directed retry - last try |

    | |

    | 01101 000 non-autonomous registration - don't reveal location |

    | 01101 001 non-autonomous registration - make location known |

    | 01101 010 autonomous registration - don't reveal location |

    | 01101 011 autonomous registration - make location known |

    | |

    | 11110 000 local control |

    | |

    | All other codes are reserved |

    | |

    +---------------------------------------------------------------------------+

     

    Forward Voice Channel

    The forward voice channel (FVC) is a wideband data stream sent by the

    land station to the mobile station. This data stream must be gen-

    erated at a 10 kilobit/Sec +/- .1 bit/Sec rate. The Forward Voice

    Channel format follows:

    +-----------+------+--------+-----+------+--------+-----+------+------

    || | | Repeat | | | Repeat | | |

    || | word | | | word | | | word |

    || Dotting | sync | 1 of | dot | sync | 2 of | dot | sync | ...

    || | | | | | | | |

    || | | Word | | | Word | | |

    +-----------+------+--------+-----+------+--------+-----+------+------

    101 11 40 37 11 40 37 11

    -----+--------+-----+------+--------+-----+------+--------+

    | Repeat | | | Repeat | | | Repeat ||

    | | | word | | | word | ||

    | 9 of | dot | sync | 10 of | dot | sync | 11 of ||

    | | | | | | | ||

    | Word | | | Word | | | Word ||

    -----+--------+-----+------+--------+-----+------+--------+

    40 37 11 40 37 11 40

     

    A 37-bit dotting sequence and an 11-bit word sync sequence are sent

    to permit mobile stations to achieve synchronization with the incom-

    ming data, except at the first repeat of the word, where the 101-bit

    dotting sequence is used. Each word contains 40 bits, including

    parity, and is repeated eleven times together with the 37-bit dotting

    and 11-bit word sync; it is then referred to as a word block. A word

    block is formed by encoded the 28 content bits into a (40, 28) BCH

    code that has a distance of 5 (40, 28; 5). The left-most bit (as

    always) is designated the most-significant bit. The 28 most-

    significant bits of the 40-bit field shall be the content bits. The

    generator polynomial is the same as that used for the forward

    control channel.

    The mobile station control message is the only message transmitted

    over the forward voice channel. The mobile station control message

    consists of one word.

     

    Mobile Sation Control Message:

    +-------+-------+------+-----------+-------+------+-------+------+

    | T T | SCC = | | RSVD = | LOCAL | ORDQ | ORDER | |

    | 1 2 | 11 | | 000 ... 0 | | | | |

    | = +-------| PSCC +-----------+-------+------+-------+ P |

    | | SCC = | | RSVD = | VMAC | CHANNEL | |

    | 10 | 11 | | 000 ... 0 | | | |

    +-------+-------+------+-----------+-------+--------------+------+

    2 2 2 8 3 11 12

    Interpretation of the data fields:

    T T - Type field. Set to '10'.

    1 2

    SCC - SAT color code for new channel (see SCC table)

    PSCC - Present SAT color code. Indicates the SAT color code

    associated with the present channel.

    ORDER - Order field. Identifies the order type. (see Order table)

    ORDQ - Order qualifier field. Qualifies the order to a specific

    action (see Order table)

    LOCAL - Local Control field. This field is specific to each system.

    The ORDER field must be set to local control (see Order table)

    for this field to be interpreted.

    VMAC - Voice mobile attenuation code field. Indicates the mobile

    station power level associated with the designated voice

    channel.

    RSVD - Reserved for future use; all bits must be set as indicated.

    P - Parity field.

     

     

     

    Reverse Control Channel

    The Reverse Control Channel (RECC) is a wideband data stream sent

    from the mobile station to the land station. This data stream runs

    at a rate of 10 kilobit/sec, +/- 1 bit/sec rate. The format of the

    RECC data stream follows:

    +---------+------+-------+------------+-------------+-----------+-----

    | Dotting | Word | Coded | first word | Second word | Third word|

    | | sync | DCC | repeated | repeated | repeated | ...

    | | | | 5 times | 5 times | 5 times |

    +---------+------+-------+------------+-------------+-----------+-----

    bits: 30 11 7 240 240 240

     

    Dotting = 01010101...010101

    Word sync = 11100010010

     

    All messages begin with the RECC seizure precursor with is composed

    of a 30 bit dotting sequence (1010...101), and 11 bit word sync

    sequence (11100010010), and the coded digital color code.

    Each word contains 48 bits, including parity, and is repeated five

    times after which it is referred to as a word block. A word is

    formed by encoding 36 content bits into a (48, 36) BCH code that has

    a distance of 5, (48 36; 5). The left most bit shall be designated

    the most-significant bit. The 36 most-significant bits of the 48 bit

    field shall be the content bits.

    The generator polynomial for the code is the same for the (40,28;5)

    code used on the forward channel.

    Each Reverse Control Channel message can consist of one of the five

    words. The types of messages to be transmitted over the reverse

    control channel are as follows:

    o Page Response Message

    o Origination Message

    o Order Confirmation Message

    o Order Message

    These messages are made up of combination of the following five words:

    Word A - Abbreviated Address Word

    +---+------+---+---+---+------+---+-----------------------------------+---+

    | F | | | | | RSVD | S | | |

    | | | | | | | | | |

    | = | NAWC | T | S | E | = | C | MIN 1 | P |

    | | | | | | | | 23 - 0 | |

    | 1 | | | | | 0 | M | | |

    +---+------+---+---+---+------+---+-----------------------------------+---+

    1 3 1 1 1 1 4 24 12

     

    Word B - Extended Address Word

    +---+------+-------+------+-------+----+------+-----------------------+---+

    | F | | | | | | RSVD | | |

    | | | | | | | | | |

    | = | NAWC | LOCAL | ORDQ | LOCAL | LT | = | MIN 2 | P |

    | | | | | | | | 33-24 | |

    | 0 | | | | | | 00..0| | |

    +---+------+-------+------+-------+----+------+-----------------------+---+

    1 3 5 3 5 1 8 10 12

     

    Word C - Electronic Serial Number Word

    +---+--------+--------------------------------------+---------------+

    | F | | | |

    | | | | |

    | = | NAWC | SERIAL (ESN) | P |

    | | | | |

    | 1 | | | |

    +---+--------+--------------------------------------+---------------+

    1 3 32 12

     

    Word D - First Word of the Called-Address

    +---+------+-------+-------+-----+-----+-----+-----+-------+-------+---+

    | F | | 1 st | 2 nd | | | | | 7th | 8th | |

    | | | | | | | | | | | |

    | = | NAWC | DIGIT | DIGIT | ... | ... | ... | ... | DIGIT | DIGIT | P |

    | | | | | | | | | | | |

    | 1 | | | | | | | | | | |

    +---+------+-------+-------+-----+-----+-----+-----+-------+-------+---+

    1 3 4 4 4 4 4 4 4 4 12

     

    Word E - Second Word of the Called-Address

    +---+------+-------+-------+-----+-----+-----+-----+-------+-------+---+

    | F | NAWC | 9 th | 10th | | | | | 15th | 16th | |

    | | | | | | | | | | | |

    | = | = | DIGIT | DIGIT | ... | ... | ... | ... | DIGIT | DIGIT | P |

    | | | | | | | | | | | |

    | 0 | 000 | | | | | | | | | |

    +---+------+-------+-------+-----+-----+-----+-----+-------+-------+---+

    1 3 4 4 4 4 4 4 4 4 12

     

    The interpretation of the data fields is as follows:

    F - First word indication field. Set to '1' in first word and '0'

    in subsequent words.

    NAWC - Number of additional words coming field.

    T - T field. Set to '1' to identify the message as an origination

    or an order; set to '0' to identify the message as an order

    response or page response.

    S - Send serial number word. If the serial number word is sent,

    set to '1'; if the serial number word is not sent, set

    to '0'.

    SCM - The station class mark field

    ORDER - Order field. Identifies the order type.

    ORDQ - Order qualifier field. Qualifies the order confirmation to a

    specific action.

    LOCAL - Local control field. This field is specific to each system.

    The ORDER field must be set to locate control for this field

    to be interpreted.

    LT - Last-try code field.

    MIN1 - Mobile Identification number field part one.

    MIN2 - Mobile Identification number field part two.

    SERIAL - Electronic Serial Number field. Identifies the serial number

    of the mobile station.

    DIGIT - Digit field (see table below)

    RSVD - Reserved for future use; all bits must be set as indicated.

    P - Parity field.

     

    Called-address Digit Codes

    +------------------------------------------------------------------------+

    | Digit Code Digit Code |

    | |

    | 1 0001 7 0111 |

    | 2 0010 8 1000 |

    | 3 0011 9 1001 |

    | 4 0100 0 1010 |

    | 5 0101 * 1011 |

    | 6 0110 # 1100 |

    | Null 0000 |

    | |

    | NOTE: |

    | 1. The digit 0 is encoded as binary 10, not binary zero. |

    | 2. The code 0000 is the null code, indicated no digit present |

    | 3. All other four-bit sequences are reserved, and must not be |

    | transmitted. |

    | |

    +------------------------------------------------------------------------+

     

    Examples of encoding called-address information into the called-

    address words follow:

    If the number 2# is entered, the word is as follows:

    +------+------+------+------+------+------+------+------+------+---------+

    | NOTE | 0010 | 1100 | 0000 | 0000 | 0000 | 0000 | 0000 | 0000 | P |

    +------+------+------+------+------+------+------+------+------+---------+

    If the number 13792640 is entered, the word is as follows:

    +------+------+------+------+------+------+------+------+------+---------+

    | NOTE | 0001 | 0011 | 0111 | 1001 | 0010 | 0110 | 0100 | 1010 | P |

    +------+------+------+------+------+------+------+------+------+---------+

    As you can see the numbers are coded into four bits and inserted

    sequentially into the train. Notice that when the number is longer

    than 8 numbers it is broken into two different Words.

    If the number 6178680300 is entered, the words are as follows:

    Word D - First Word of the Called-Address

    +------+------+------+------+------+------+------+------+------+---------+

    | NOTE | 0110 | 0001 | 0111 | 1000 | 0110 | 1000 | 1010 | 1010 | P |

    +------+------+------+------+------+------+------+------+------+---------+

    4 4 4 4 4 4 4 4 4 12

    Word E - Second Word of the Called-Address

    +------+------+------+------+------+------+------+------+------+---------+

    | NOTE | 0010 | 1010 | 1010 | 0000 | 0000 | 0000 | 0000 | 0000 | P |

    +------+------+------+------+------+------+------+------+------+---------+

    4 4 4 4 4 4 4 4 4 12

    NOTE = four bits which depend on the type of message

     

     

    Reverse Voice Channel

    The reverse voice channel (PVC) is a wideband data stream sent from

    the mobile station to the land station. This data stream must be

    generated at a 10 kilobit/second +/- 1 bit/sec rate. The format

    is presented below.

    +-------------+------+----------+-----+------+----------+-----+------+----

    || | | Repeat 1 | | | Repeat 2 | | |

    || | word | | | word | | | word |

    || Dotting | sync | of | Dot | sync | of | Dot | sync |

    || | | | | | | | |

    || | | Word 1 | | | Word 1 | | |

    +-------------+------+----------+-----+------+----------+-----+------+----

    101 11 48 37 11 48 37 11

    ---+----------+-----+------+----------+-----+------+----------+-----+----

    | Repeat 3 | | | Repeat 4 | | | Repeat 5 | |

    | | | word | | | word | | |

    | of | Dot | sync | of | Dot | sync | of | Dot |

    | | | | | | | | |

    | Word 1 | | | Word 1 | | | Word 1 | |

    ---+----------+-----+------+----------+-----+------+----------+-----+----

    48 37 11 48 37 11 48 37

    ---+------+----------+-------- -------+----------+

    | | Repeat 1 | | Repeat 5 ||

    | word | | | ||

    | sync | of | ... | of ||

    | | | | ||

    | | Word 2 | | Word 2 ||

    ---+------+----------+-------- -------+----------+

    A 37-bit dotting sequence and an 11-bit word sync sequence are sent

    to permit land stations to achieve synchronization with the incoming

    data, except at the first repeat of word 1, where a 101-bit dotting

    sequence is used. Each word contains 48 bits, including parity, and

    is repeated five times together with the 37-bit dotting and 11-bit

    word sync sequences; it is then referred to as a word block. For a

    multi-word message, the second word block is formed the same as the

    first word block including the 37-bit dotting and 11-bit word sync

    sequences. A word is formed by encoding the 36 content bits into a

    (48, 36) BCH code that has a distance of 5, (48, 36; 5). The left-

    most bit (earliest in time) shall be designated the most-significant

    bit. The 36 most-significant bits of the 48-bit field shall be the

    content bits. The generator polynomial for the code is the same as

    for the (40, 28; 5) code used on the forward control channel.

    Each RVC message can consist of one or two words. The types of

    messages to be transmitted over the reverse voice channel are as

    follows:

    o Order Confirmation Message

    o Called-Address Message

    The message formats are as follows:

     

    Order Confirmation Message:

    +---+------+---+-------+------+-------+-----------+---------+

    | F | NAWC | T | | | | RSVD | |

    | | | | | | | | |

    | = | = | = | LOCAL | ORDQ | ORDER | = | P |

    | | | | | | | | |

    | 1 | 00 | 1 | | | | 000 ... 0 | |

    +---+------+---+-------+------+-------+-----------+---------+

    1 2 1 5 3 5 19 12

     

    Called-Address Message

    Word 1 - First Word of the Called-Address

    +---+------+---+-------+-------+-----+-----+-----+-----+-------+-------+---+

    | F | NAWC | T | | | | | | | | | |

    | | | | 1st | 2nd | | | | | 7th | 8th | |

    | = | = | = | Digit | Digit | ... | ... | ... | ... | Digit | Digit | P |

    | | | | | | | | | | | | |

    | 1 | 01 | 0 | | | | | | | | | |

    +---+------+---+-------+-------+-----+-----+-----+-----+-------+-------+---+

    1 2 1 4 4 4 4 4 4 4 4 12

    Word 2 - Second Word of the Called-Address

    +---+------+---+-------+-------+-----+-----+-----+-----+-------+-------+---+

    | F | NAWC | T | | | | | | | | | |

    | | | | 9th | 10th | | | | | 15th | 16th | |

    | = | = | = | Digit | Digit | ... | ... | ... | ... | Digit | Digit | P |

    | | | | | | | | | | | | |

    | 0 | 00 | 0 | | | | | | | | | |

    +---+------+---+-------+-------+-----+-----+-----+-----+-------+-------+---+

    1 2 1 4 4 4 4 4 4 4 4 12

     

    The fields are descriptions a the same as those for the Reverse Control

    channel above.

     

     

    Overhead Message

    A three-bit OHD field is used to identify the overhead message

    types. Overhead message type codes are listed in the table below.

    They are grouped into the following functional classes:

    o System parameter overhead message

    o Global action overhead message

    o Registration identification message

    o Control-filler message

    Overhead messages are send in a group called an overhead message

    train. The first message of the train must be the system parameter

    overhead message. The desired global action messages and/or a

    registration ID message must be appended to the end of the system

    parameter overhead message. The total number of words in an overhead

    message train is one more than the value of the NAWC field contained

    in the first word of the system parameter overhead message. The last

    word in the train must be set to '0'. For NAWC-counting purposes,

    inserted control-filler messages must not be counted as part of the

    overhead message train.

    The system parameter overhead message must be sent every .8 +/- .3

    seconds on each of the following control channels:

    o combined paging-access forward channel.

    o Separate paging forward control channel

    o Separated access forward control channel

    when the control-filler message is sent with the WFOM bit

    set to '1'.

    The global action messages and the registration identification message

    are sent on an as needed basis.

    o The system parameter for overhead message consists of two

    two words.

     

    Word 1

    +-------+-----+----------+------+------+-----+------------+

    | T T | | | RSVD | | OHD | |

    | 1 2 | | | | | | |

    | = | DCC | SID1 | = | NAWC | = | P |

    | | | | | | | |

    | 11 | | | 000 | | 110 | |

    +-------+-----+----------+------+------+-----+------------+

    2 2 14 3 4 3 12

     

    Word 2

    +-------+-------+-----+-----+------+------+-----+------+---

    | T T | | | | | | | RSVD |

    | 1 2 | | | | | | | |

    | = | DCC | S | E | REGH | REGR | DTX | = |

    | | | | | | | | |

    | 11 | | | | | | | 0 |

    +-------+-------+-----+-----+------+------+-----+------+---

    2 2 1 1 1 1 1 1

    ---+-------+-----+-----+----------+-----+-------+-----------+

    | | | | | | OHD | |

    | | | | | | | |

    | N - 1 | RCF | CPA | CMAX - 1 | END | = | P |

    | | | | | | | |

    | | | | | | 111 | |

    ---+-------+-----+-----+----------+-----+-------+-----------+

    5 1 1 7 1 3 12

     

    Overhead Message Types

    +----------------------------------------------------------+

    | Code Order |

    +----------------------------------------------------------+

    | 000 Registration ID |

    | 001 Control-filler |

    | 010 reserved |

    | 011 reserved |

    | 100 global action |

    | 101 reserved |

    | 110 Word 1 of system parameter message |

    | 111 Word 2 of system parameter message |

    +----------------------------------------------------------+

    The interpretation of the data fields:

    T T - Type field. Set to '11' indicating an overhead word.

    1 2

    OHD - Overhead message type field. The OHD field of Word 1 is

    set to '110' indicating the first word of the system

    parameter overhead message. The OHD field of Word 2 is

    set to '111' indicating the second word of the system

    parameter overhead message.

    DCC - Digital Color Code field.

    SID1 - First part of the system identification field

    NAWC - Number of Additional Words Coming field. In Word 1 this

    field is set to one fewer than the total number of words

    in the overhead message train.

    S - Serial number field.

    E - Extended address field.

    REGH - Registration field for home stations.

    REGR - Registration field for roaming stations.

    DTX - Discontinuous transmission field.

    N-1 - N is the number of paging channels in the system.

    RCF - Read-control-filler field.

    CPA - Combined paging/access field

    CMAX-1 - CMAX is the number of access channels in the system.

    END - End indication field. Set to '1' to indicate the last word

    and '0' if not the last word.

    RSVD - Reserved for future use, all bit must be set as indicated.

    P - Parity field.

     

    Each global action overhead message consists of one word. Any number

    of global action messages can be appended to a system parameter over-

    head message.

    Here are the global action command formats:

     

    Rescan Global Action Message

    +-------+-------+------+---------------+-------+-------+-------------+

    | T T | | ACT | RSVD = | | OHD | |

    | 1 2 | | | | | | |

    | = | DCC | = | | END | = | P |

    | | | | 000 ... 0 | | | |

    | 11 | | 0001 | | | 100 | |

    +-------+-------+------+---------------+-------+-------+-------------+

    2 2 4 16 1 3 12

    Registration Increment Global Action Message

    +-------+-----+------+---------+--------+-------+-------+------------+

    | T T | | ACT | | | | OHD | |

    | 1 2 | | | | RSVD = | | | |

    | = | DCC | = | REGINCR | | END | = | P |

    | | | | | 0000 | | | |

    | 11 | | 0010 | | | | 100 | |

    +-------+-----+------+---------+--------+-------+-------+------------+

    2 2 4 12 4 1 3 12

    New Access Channel Set Global Action Message

    +-------+-------+-------+--------+----------+-------+-------+----------+

    | T T | | ACT | | | | OHD | |

    | 1 2 | | | | RSVD = | | | |

    | = | DCC | = | NEWACC | | END | = | P |

    | | | | | 00000 | | | |

    | 11 | | 0110 | | | | 100 | |

    +-------+-------+-------+--------+----------+-------+-------+----------+

    2 2 4 11 5 1 3 12

     

    Overload Control Global Action Message

    +-------+-----+-------+---+---+---+-- --+---+---+---+-----+-----+------+

    | T T | | ACT | O | O | O | | O | O | O | | OHD | |

    | 1 2 | | | L | L | L | | L | L | L | | | |

    | = | DCC | = | C | C | C | ... | C | C | C | END | = | P |

    | | | | | | | | | | | | | |

    | 11 | | 0110 | 0 | 1 | 2 | | 13| 14| 15| | 100 | |

    +-------+-----+-------+---+---+---+-- --+---+---+---+-----+-----+------+

    2 2 4 1 1 1 1 1 1 1 3 12

     

    Access Type Parameters Global Action Message

    +-------+-----+------+-------+-----------+-------+-------+-----------+

    | T T | | ACT | | | | OHD | |

    | 1 2 | | | | RSVD = | | | |

    | = | DCC | = | BIS | | END | = | P |

    | | | | | 0 ... 000 | | | |

    | 11 | | 1001 | | | | 100 | |

    +-------+-----+------+-------+-----------+-------+-------+-----------+

    2 2 4 1 15 1 3 12

     

    Access Attempt Parameters Global Action Message

    +-------+-------+---------+-----------+-----------+-----------+---

    | T T | | ACT | | | |

    | 1 2 | | | MAXBUSY | MAXSZTR | MAXBUSY |

    | = | DCC | = | | | |

    | | | | - PGR | - PGR | - OTHER |

    | 11 | | 1010 | | | |

    +-------+-------+---------+-----------+-----------+-----------+---

    2 2 4 4 4 4

    ------+-----------+-------+-------+-----------+

    | | | OHD | |

    | MAXSZTR | | | |

    | | END | = | P |

    | - OTHER | | | |

    | | | 100 | |

    ------+-----------+-------+-------+-----------+

    4 1 3 12

     

    Local Control 1 Message

    +-------+-------+-------+-----------------+-------+-------+----------+

    | T T | | ACT | | | OHD | |

    | 1 2 | | | | | | |

    | = | DCC | = | LOCAL CONTROL | END | = | P |

    | | | | | | | |

    | 11 | | 1110 | | | 100 | |

    +-------+-------+-------+-----------------+-------+-------+----------+

    2 2 4 16 1 3 12

     

    Local Control 2 Message

    +-------+-------+-------+-----------------+-------+-------+----------+

    | T T | | ACT | | | OHD | |

    | 1 2 | | | | | | |

    | = | DCC | = | LOCAL CONTROL | END | = | P |

    | | | | | | | |

    | 11 | | 1111 | | | 100 | |

    +-------+-------+-------+-----------------+-------+-------+----------+

    2 2 4 16 1 3 12

     

    The interpretation of the data fields are as follows:

    T T - Type field. Set to '11' indicating overhead word.

    1 2

    ACT - Global action field (see table below).

    BIS - Busy-idle status field.

    DCC - Digital Color Code.

    OHD - Overhead Message type field. Set to '100' indicating the

    global action message.

    REGINCR - Registration increment field.

    NEWACC - News access channel starting point field.

    MAXBUSY - Maximum busy occurrences field (page response).

    - PGR

    MAXBUSY - Maximum busy occurrences field (other accesses).

    - OTHER

    MAXSZTR - Maximum seizure tries field (page response).

    - PRG

    MAXSZTR - Maximum seizure tries field (other accesses).

    - OTHER

    OLCN - Overload class field (N = 0 to 15)

    END - End indication field. Set to '1' to indicate the last word

    of the overhead message train; set to '0' if not last word.

    RSVD - Reserved for future use, all bits must be set as indicated.

    LOCAL - May be set to any bit pattern.

    CONTROL

    P - Parity field.

     

    The registration ID message consists of one word. When sent, the

    message must be appended to a system parameter overhead message in

    addition to any global action messages.

     

    +-------+-------+-------------+-------+-------+-----------+

    | T T | | | | OHD | |

    | 1 2 | | | | | |

    | = | DCC | REGID | END | = | P |

    | | | | | | |

    | 11 | | | | 000 | |

    +-------+-------+-------------+-------+-------+-----------+

    2 2 20 1 3 12

    The interpretation of the data fields:

    T T - Type field. Set to '11' indicating overhead word.

    1 2

    DCC - Digital color code field.

    OHD - Overhead message type field. Set to '000' indicating the

    registration ID message.

    REGID - Registration ID field.

    END - End indication field. Set to '1' to indicate last word of

    the overhead message train; set to '0' if not.

    P - Parity field.

     

    The control-filler message consists of one word. It is sent whenever

    there is no other message to be sent on the forward control channel.

    It may be inserted between messages as well as between word blocks of

    a multiword message. The control-filler message is chosen so that

    when it is sent, the 11-bit word sequence will not appear in the

    message stream, independent of the busy-idle bit status.

    The control-filler message is also used to specify a control mobile

    attenuation code (CMAC) for use by mobile stations accessing the

    system on the reverse control channel, and a wait-for-overhead-

    message bit (WFOM) indicating whether or not mobile stations must

    read an overhead message train before accessing the system.

     

    +-------+-----+------+------+------+--+------+---+------+----+-----+-----+

    | T T | | | | RVSD | | RVSD | | | | OHD | |

    | 1 2 | | | | | | | | | | | |

    | = | DCC |010111| CMAC | = |11| = | 1 | WFOM |1111| = | P |

    | | | | | | | | | | | | |

    | 11 | | | | 00 | | 00 | | | | 001 | |

    +-------+-----+------+------+------+--+------+---+------+----+-----+-----+

    2 2 6 3 2 2 2 1 1 4 3 16

    Interpretation of the data fields:

    T T - Type field. Set to '11' indicating overhead word.

    1 2

    DCC - Digital color code field.

    CMAC - Control mobile attenuation field. Indicates the mobile

    station power level associated with the reverse control

    channel.

    RVSD - Reserved for future use; all bits must be set as indicated.

    WFOM - Wait-for-overhead-message field.

    OHD - Overhead message type field. Set to '001' indicating the

    control-filler word.

    P - Parity field.

     

    Data Restrictions

    The 11-bit sequence (11100010010) is shorter than the length of a

    word, and therefore can be embedded in a word. Normally, embedded

    word-sync will not cause a problem because the next word sent will not

    have the word-sync sequence embedded in it. There are, however, three

    cases in which the word-sync sequence may appear periodically in the

    FOCC stream. They are as follows:

    o the overhead message

    o the control-filler message

    o Mobile station control messages with pages to mobile stations

    with certain central office codes.

    These three cases are handled by:

    1. Restricting the overhead message transmission rate to about

    once per second

    2. designing the control-filler message to exclude the word-

    sync sequence, taking into account the various busy-idle

    bits

    3. Restricting the use of certain office codes

     

    If the mobile station control message is examined with the MIN1

    separated into NXX-X-XXX as described earlier (where NXX is the

    central office code, N represents a number from 2 - 9, and X

    represents a number from 0-9) the order and order qualifications

    table can be used to deduce when the word-sync word would be sent.

    If a number of mobile stations are paged consecutively with the same

    central office code, mobile stations that are attempting to synchronize

    to the data stream may not be able to do so because of the presence of

    the false word sync sequence. Therefore, the combinations of central

    office codes and groups of line numbers appearing in the following

    table must not be used for mobile stations.

     

    RESTRICTED CENTRAL OFFICE CODES

    +-------------------------------------------------------------------------+

    | Central |

    | T T DCC NXX X XXX Office Thousands |

    | 1 2 Code Digit |

    +-------------------------------------------------------------------------+

    | 01 11 000100(1)0000 ... ... 175 0 to 9 |

    | 01 11 000100(1)0001 ... ... 176 0 to 9 |

    | 01 11 000100(1)0010 ... ... 177 0 to 9 |

    | 01 11 000100(1)0011 ... ... 178 0 to 9 |

    | 01 11 000100(1)0100 ... ... 179 0 to 9 |

    | 01 11 000100(1)0101 ... ... 170 0 to 9 |

    | 01 11 000100(1)0110 ... ... 181 0 to 9 |

    | 01 11 000100(1)0111 ... ... 182 0 to 9 |

    | 0Z 11 100010(0)1000 ... ... 663 0 to 9 |

    | 0Z 11 100010(0)1001 ... ... 664 0 to 9 |

    | 0Z 11 100010(0)1010 ... ... 665 0 to 9 |

    | 0Z 11 100010(0)1011 ... ... 666 0 to 9 |

    | 0Z Z1 110001(0)0100 ... ... 899 0 to 9 |

    | 0Z Z1 110001(0)0101 ... ... 800 0 to 9 |

    | 0Z ZZ 111000(1)0010 ... ... 909 0 to 9 |

    | 00 ZZ 011100(0)1001 0ZZZ ... 568 1 to 7 |

    | 00 ZZ 111100(0)1001 0ZZZ ... 070 1 to 7 |

    | 00 ZZ 001110(0)0100 10ZZ ... 339 8,9,0 |

    | 00 ZZ 011110(0)0100 10ZZ ... 595 8,9,0 |

    | 00 ZZ 101110(0)0100 10ZZ ... 851 8,9,0 |

    | 00 ZZ 111110(0)0100 10ZZ ... 007 8,9,0 |

    | 0Z ZZ 000011(1)0100 0010 ... 150 2 |

    | 0Z ZZ 000111(1)0001 0010 ... 224 2 |

    | 0Z ZZ 001011(1)0001 0010 ... 288 2 |

    | 0Z ZZ 001111(1)0001 0010 ... 352 2 |

    | 0Z ZZ 010011(1)0001 0010 ... 416 2 |

    | 0Z ZZ 010111(1)0001 0010 ... 470 2 |

    | 0Z ZZ 011011(1)0001 0010 ... 544 2 |

    | 0Z ZZ 011111(1)0001 0010 ... 508 2 |

    | 0Z ZZ 100011(1)0001 0010 ... 672 2 |

    | 0Z ZZ 100111(1)0001 0010 ... 736 2 |

    | 0Z ZZ 101011(1)0001 0010 ... 790 2 |

    | 0Z ZZ 101111(1)0001 0010 ... 864 2 |

    | 0Z ZZ 110011(1)0001 0010 ... 928 2 |

    | 0Z ZZ 110111(1)0001 0010 ... 992 2 |

    | 0Z ZZ 111011(1)0001 0010 ... 056 2 |

    | 0Z ZZ 111111(1)0001 0010 ... ... 2 |

    +-------------------------------------------------------------------------+

     

    1. In each case, Z represents a bit that may be 1 or 0.

    2. Some codes are not used as central office codes in the US at this

    time. They are included for completeness.

    3. The bit in parentheses is the busy-idle bit.

     

    Well there is your signaling in a nutshell. Please note I hardly have

    the most up-to-date signalling data. Basically what was presented

    here was a skeleton, the bare bones without all the additions. There

    are some additions that are system specific. As I get updates I'll be

    sure to share them with the rest of you. I would be interested in

    any feedback, so, if you have something to say, send it to:

    oblivion@atdt.org

    In the last article I said that there would be a listing of SID codes

    accompanying the article. Well, I forgot to edit that line out, but

    if you would like a copy of it, just mail me at the above address an

    you shall receive one.

    In the next article I will be going in-depth on the actual hardware

    behind the Mobile telephone, the chip sets, and its operation.

    I will also publish any updates to the previous material I find, as

    well as information on the transitory NAMPS system that will be used

    to bridge the existing AMPS cellular network over to the ISDN

    compatible fully digital network.

     

    Yet another...

    -=Restricted -=Data -=Transmission

    Truth is cheap... but information costs!

     

    The following file was written for informational purposes

    only! The author does not warrent the accuracy nor does he

    condone any form of illegal activity in respect to this file.

     

     

     

     

    Cellular Secrets by BOOTLEG

    (C) 1992

     

    Let me start out by saying this file won't be in the best of

    ordered content as I'll be skipping around a little quoting

    data from various manuals as it pops into my mind. It will

    however, allow anyone that reads it thoroughly and obtains

    the manuals & equipment specified within, to do virtually

    anything regarding Cellular!

     

    ESN= Electronic Serial Number (every cellular has one in Rom)

    MIN= The cellulars phone # " " " " " "

    Reverse Channel= The channel the Cellular phone broadcasts on.

    Foward Channel = The channel the Cell Site broadcasts on.

     

    Remember these key terms as they are the secret to cellulars.

     

    Most cellulars have the ESN/MIN located in a Eprom/EEprom

    located somewhere on the circuit board.(older cellulars may

    not have a ESN) These are usually 27c256 or 27c512 eproms

    which can be burned or changed by standard eprom burners.

    They also contain the cellulars programming which can be

    changed.

    When you power up a cellular, it sends its ESN/MIN to the

    cell site on the reverse channel. The cell site then returns

    the MIN with an OK signal if their database verifies the ESN/MIN.

    Some newer cell site software will verify the ESN/MIN with the

    C.O. before allowing the call. If everything is ok, the cellular

    will then be able to place a call.

     

    (The REVERSE channels ESN/MIN & related data can be captured by

    equipment listed at the end of this file.)

    It seems like some scoundrels have captured other peoples

    ESN/MIN and burned new Eproms enabling another cellular phone

    to act as the original. Rumor has it that hackers have gone as

    far as actually changing the eproms software whereby the program

    jumps past the ESN/MIN address in the eprom to an address location

    that can be programmed into memory via the handset! Yet another

    rumor has it that some even go as far as re-programming the

    software to capture other cellulars ESN/MIN and automatically

    store the data in memory. This naturally allows someone to place

    fraudulent calls while frequently changing ESN/MINs to avoid all

    forms of detection. The cell sites usually use frequencies on

    the Non-wireline A band as forward channels. The reverse channels

    are usually 45 mhz below the forward channels. These

    REVERSE channels are the ones scanned by "UNSAVORY DOGS" that steal

    others ESN/MINs for fraudulent use. (hehe) Note that one hacker

    seems to think one can use a Z80 Uncompiler/Compiler on the eproms

    software of some cellulars. (The Shame of it all!) Other cellulars

    use different but common microprocessors of which compilers/de

    compilers are easily available.

     

    Ok-now that you have the theory behind cellular phreaking, I'll

    continue on to some backround & tech stuff you'll need.

    ******************************************************************

     

    Cellular Overview

     

    A cell system divides the service area into small, low power

    areas called cells. A cell system has a continuous patern of these

    cells, each having a 1 to 40 mile radius (usually 5-10 miles).

    Within each cell is a base station which contain several

    transcievers and control equipment for the channels assigned

    to that cell. These are all connected to a MTSO which is in

    turn connected to a CO (central Office) switch. Each cell operates

    on an assigned channel and may have numerous paging and voice

    channels assigned to it.

    The cellular radio freqs have been divided by the FCC into 2

    equal bands to allow 2 different systems to co-exist and compete

    in the same area. Originally there were 666 channels,but that

    was expanded to 832 in 1988, and with NAMPS to 2412 in 1991.

     

    Band A- Non Wireline Band B- Wireline

     

    Control channels=21 = 313-333 21= 334-354

    Voice channels=001-312 355-666

    (395 AMPS/1185 NAMPS) (395 AMPS/1185 NAMPS)

     

    Control channels are used to send and receive only digital

    data between the cellular phone & the cell base station.

    The 21 control channels in each band may be dedicated to two

    different applications: access and paging channels.

    The data on the Foward control channels provides such info as

    the system identification number and range of channels to scan

    to find the access and paging channels. Access channels are used

    to respond to a page or to originate a call. The system and the

    cell phone will use access channels where 2-way data transfer

    occurs to determine the initial voice channel. Paging channels

    if used are the holding place for an idle cell phone. When the

    call is received at the central controller for a cellular phone,

    the paging signalling will start on a paging channel. In many

    systems, both control channel functions will be served by the

    same access channel for a particular cell. Multiplepaging

    channels are only used in high density areas.

     

    NAM = Number assignment Module: This is a memory component (usually

    an Eprom/EEprom) that contains a cell phones ESN/MIN/SCM,

    lock code,etc. Some phones can be re-programmed via the

    handset so one can change their MIN several times. (usually

    the phones software locks it up after 3 to 20 MIN changes)

    This feature was used limitedly to deceive cell sites when

    roaming. Newer cell site software is quickly making this

    trick obsolete. ( the problem being is that one cannot

    change the ESN via NAM handset programming unless one

    re-writes the Eprom Software. HeHe)

     

    MTSO= Mobile Telephone Switching Office

     

    One must know, there is no distributed intelligence in the first

    generation of cellular systems! AT these cellular base stations

    there is little or no monitering equipment of any kind.

     

    There are a mix of 3 watt, 1.2 watt and 600 milliwatt cellular

    phones in use today. (keep this in mind as the power of a

    cellular phone is stored in ROM & transmitted along with the

    ESN/MIN and the coding must be correct.)

    3 watt = mobiles, 1.6 watt=transportables, 600 milliwatt=portables

     

    IS-41 = The newest standard that will let cell switches from

    different vendors hand-off and deliver calls and transfer

    subscriber data profiles. (newest version is REVISION B)

    This document contains tons of usefull info & can be found

    at public libraries, etc. IS-41 rev b, is published by AT&T,

    although the original rev 0 published in 1987 or rev A published

    in 1990 may come in handy when dealing with older/smaller MTSOs

    that haven't upgraded yet.

     

    MTSOs typically use fiber optic links to cell sites or a 18 ghz

    microwave link. A cell site in turn then probably uses a 38 ghz

    microwave link to a Microcell Transmitter. TDMA and CDMA are

    both vying to become the industry standard.

     

    SS7 = As soon as a user turns on a cell phone the MIN/ESN for

    that phone will be carried as an SS7 network message to a database,

    known as the home location register(HLR),within the user's home

    carrier system. The HLR will provide information for validation

    as well as customer profile info for advanced features as voice

    mail. That info will then be be relayed to a second database, the

    visitor location register, maintained by the carrier that is

    hosting the roaming call. They hope to reduce fraud by checking

    the ESN with real time validation on a per call basis. The current

    system is unable to detect fraud until after a caller has made

    his first call. (This system simply uses a customers calling

    profile to detect an unusual calling pattern.) Those changing

    ESN/MINs often cannot be detected!

     

    Cell relay uses fixed length packets- 48 bytes for the payload

    and 5 bytes for the header. Two existing cell relay standards

    are IEEE 802.6 (DQDB) and ATM. They differ only in content of

    the header.

     

    Each cellular has 2 channels associated with it, the transmit

    (REVERSE) and the receive (FOWARD).

    REVERSE freqs= 824-848 mhz

    Forward freqs= 869-894 mhz

    Conventional dispatch=806-809.7 mhz and 851-854.75 mhz

    Trunked dispatch= 809.75-824 mhz and 854.75-869 mhz

    General reserve=848-851 mhz and 894-902 mhz and 928-947 mhz

    channel spacing = 30 mhz AMPS or 10 mhz NAMPS

     

    *************************************************************

     

    Reverse Channel Info

     

    Voice channels are used primarily for conversation, with signaling

    used with quick data bursts or tones to handle cell to cell handoffs,

    output power control of the cellular radio-phone and special control

    features.Foward data from the cell site and REVERSE data from the

    cell phone is sent using frequency shift keying. The data is formatted

    into groups of words with a distinct binary preamble that allows

    the receiver to syncronize to the incomming data. With AMPS, various

    tones are used. With NAMPS the data and tones have been replaced

    by sub-audible digital equivalents that ride under the audio.

    (see EIA - 553 for AMPS or Motorolas NAMPS Air interface

    specification for NAMPS)

     

    Signaling Tone(ST) and Digital ST(DST)

     

    In AMPS, the signalling tone is a 10 khz signal used by the mobile

    on the REVERSE channel (REVC) to signal activities or to acknowledge

    commands from the cell site, including handoffs,alert orders, call

    terminations and switch-hook operation. Various burst lengths are

    used on different ST activities. On NAMPS channels ST is replaced

    by a digital equivalent called Digital ST (DST) which is the

    compliment of the assigned DSAT. The 10 khz signal is sent for

    50 milliseconds.

     

    SAT (Supervisory Audio Tone) and DSAT (Digital SAT)

     

    The supervisory audio tone (SAT) is one of 3 frequencies:

    SAT 0 = 5970 hz

    SAT 1 = 6000 hz ( plus or minus 2khz on these

    SAT 2 = 6030 hz 3 freqs.)

    These are used in AMPS signaling. On NAMPS channels SAT is replaced

    by one of 7 subaudible digital equivalents or vectors called DSAT.

    SAT or DSAT is generated by the cell site, checked for frequency

    or accuracy by the cell phone, then transponded back to the cell

    site on the REVERSE voice channel (REVC). The cellular telephone

    uses (D)SAT to verify that it is tuned to the correct channel

    after a new voice channel assignment. When the CO signals the

    mobile regarding the new voice channel, it also tells the mobile

    of the SAT freq of the DSAT vector to expect on the new channel.

    The returned (D)SAT is used at the cell site to verify the presence

    of the telephones signal on the designated frequency.

     

    DSAT = +/- 700 hz deviation

     

    Data = Transmitted at 10 kbits/sec. Used for sending System

    Orders & mobile identification. In cellular the data is

    transmitted as Frequency Key Shifting, where the carrier is

    shifted high 8 khz in AMPS(700 hz in NAMPS) to represent

    a logic high (or 1), and the carrier is shifted low 8 khz in

    AMPS(700 hz in NAMPS) to represent a logic low (or 0). Control

    channels carry data only. Voice channels carry data and other

    signals listed here.

     

    Audio = includes all microphone audio & DTMF while in a call

    (maximum =/- 12 khz deviation AMPS,=/- 5 khz dev NAMPS).

    DTMF uses 2 tones (one high one low)from a selection of seven

    tones (4 low,3 high tones) to indicate digits being dialed.

    In AMPS signalling, audio & ST are accompanied by SAT.

     

    *******************************************************************

     

    Placing a call from a Cellular Phone

     

    When first turned on, the cellular scans through the FOCCs and

    measure the strengt of each signal. It will then tune to the

    strongest & attempt to decode the overhead control message.

    From the overhead the phone can determine if it is in its

    home system and range of channels to scan for paging and access.

    If paging channels are used, the phone next scans each paging

    channelin the specified range & tunes to the strongest one.

    Its on that channel the phone will continuously receive

    overhead message info plus paging messages. At this point the

    phone idles, continuously updating the overhead message info in

    its memory and monitoring the paging messages for its telephone

    number.

    When the cellular phone user originates the call, the phone

    rescans the access channels to assure that its tuned to the

    strongest one. It then transmits at 10kbits per sec on the

    control channel to notify the switch of its MIN (mobile

    identification number (phone number)), its ESN and the number it

    wants to reach. The switch verifies the incomming data and

    assigns a voice channel and a SAT (or DSAT forNAMPS) to the

    telephone. The phone tunes to the assigned voice channel and

    verifies the presence of the proper foward SAT frequency or (DSAT

    message. If SAT (DSAT) is correct the phone transponds SAT(DSAT)

    back to the cell site and unmutes the forward audio. The cell site

    detects reverse SAT(DSAT) from the cellular & unmutes reverse

    audio. At this point the user can hear the other end ring.

    SAT(DSAT is sent and received more or less continuously by both

    the base station & the phone but SAT(DSAT) is not sent during

    data transmissions and the phone does not transpond SAT

    continously during VOX operation. DSAT is suspended during the

    transmission of DST. SAT 7 signalling tones are only used on

    AMPS voice channels & the signalling tone is only transmitted

    by the cellular phone.

     

    Note that the number called, the ESN, MIN etc. are transmitted

    4 or 5 times & it only takes 260 milliseconds for all this

    data exchange.

     

    Call termination = 10 khz tone burst for 1.8 seconds.

    ****************************************************************

     

    Formulae

     

    Freq calc for channels 1-799 = REVERSE = 825mhz + (Ch.# X .03 mhz)

    Forward = 870mhz + (Ch.# X .03 mhz)

    Freq calc for channels 991-1023 REV = 825mhz - (.03 mhz X(1023-Ch#))

    For = 870mhz - " " " "

    Duplex spacing = 45 mhz

     

    ***********************************************************************

     

    Station Class Mark (SCM)

     

    SCM 666 or 832 Ch. VOX Max Power in Watts

     

    00 666 n 3

    01 666 n 1.2

    02 666 n .6

    03

    04 666 y 3

    05 666 y 1.2

    06 666 y .6

    07

    08 832 n 3

    09 832 n 1.2

    10 832 n .6

    11

    12 832 y 3

    13 832 y 1.2

    14 832 y .6

    15

     

    If the SCM is not set properly during programming the EProm, it

    might have adverse effects on the operation of the phone. It may

    also flag security software to a "Tumbled Phone". Smart cell

    phreaks will only use ESN/MINs that have the same SCM as their

    own phone they plan on TUMBLING.

     

    *********************************************************************

     

     

    Cellular phone channel construction

     

    ===============================================================================

     

    Here is a method of determining which frequencies are used in a cellular

    system, and which ones are in what cells. If the system uses OMNICELLS, as

    most do, you can readily find all the channels in a cell if you know just one

    of them, using tables constructed with the instructions below.

     

    Cellular frequencies are assigned by channel number, and for all channel

    numbers, in both wireline and non-wireline systems, the formula is:

     

    Transmit Frequency = (channel number x .030 MHz) + 870 MHz

    Receive Frequency = (channel number x .030 Mhz) + 825 Mhz

     

    "Band A" (one of the two blocks) uses channels 1 - 333. To construct a

    table showing frequency by cells, use channel 333 as the top left corner of a

    table. The next entry to the right of channel 333 is 332, the next is 331,

    etc., down to channel 313. Enter channel 312 underneath 333, 311 under 332,

    etc. Each channel across the top row is the first channel in each CELL of the

    system; each channel DOWN from the column from the the first channel is the

    next frequency assigned to that cell. You may have noted that each channel

    down is 21 channels lower in number. Usually the data channel used is the

    highest numbered channel in a cell.

     

    "Band B" uses channels from 334 to 666. Construct your table in a similar

    way, with channel 334 in the upper left corner, 335 the next entry to the

    right. The data channel should be the lowest numbered channel in each cell

    this time.

     

    Cellular Phone Band A (Channel 1 is Data)

     

    Cell # 1

    --------------------------------------------------

    Channel 1 (333) Tx 879.990 Rx 834.990

    Channel 2 (312) Tx 879.360 Rx 834.360

    Channel 3 (291) Tx 878.730 Rx 833.730

    Channel 4 (270) Tx 878.100 Rx 833.100

    Channel 5 (249) Tx 877.470 Rx 832.470

    Channel 6 (228) Tx 876.840 Rx 831.840

    Channel 7 (207) Tx 876.210 Rx 831.210

    Channel 8 (186) Tx 875.580 Rx 830.580

    Channel 9 (165) Tx 874.950 Rx 829.950

    Channel 10 (144) Tx 874.320 Rx 829.320

    Channel 11 (123) Tx 873.690 Rx 828.690

    Channel 12 (102) Tx 873.060 Rx 828.060

    Channel 13 (81) Tx 872.430 Rx 827.430

    Channel 14 (60) Tx 871.800 Rx 826.800

    Channel 15 (39) Tx 871.170 Rx 826.170

    Channel 16 (18) Tx 870.540 Rx 825.540

     

    Cell # 2

    --------------------------------------------------

    Channel 1 (332) Tx 879.960 Rx 834.960

    Channel 2 (311) Tx 879.330 Rx 834.330

    Channel 3 (290) Tx 878.700 Rx 833.700

    Channel 4 (269) Tx 878.070 Rx 833.070

    Channel 5 (248) Tx 877.440 Rx 832.440

    Channel 6 (227) Tx 876.810 Rx 831.810

    Channel 7 (206) Tx 876.180 Rx 831.180

    Channel 8 (185) Tx 875.550 Rx 830.550

    Channel 9 (164) Tx 874.920 Rx 829.920

    Channel 10 (143) Tx 874.290 Rx 829.290

    Channel 11 (122) Tx 873.660 Rx 828.660

    Channel 12 (101) Tx 873.030 Rx 828.030

    Channel 13 (80) Tx 872.400 Rx 827.400

    Channel 14 (59) Tx 871.770 Rx 826.770

    Channel 15 (38) Tx 871.140 Rx 826.140

    Channel 16 (17) Tx 870.510 Rx 825.510

     

    Cell # 3

    --------------------------------------------------

    Channel 1 (331) Tx 879.930 Rx 834.930

    Channel 2 (310) Tx 879.300 Rx 834.300

    Channel 3 (289) Tx 878.670 Rx 833.670

    Channel 4 (268) Tx 878.040 Rx 833.040

    Channel 5 (247) Tx 877.410 Rx 832.410

    Channel 6 (226) Tx 876.780 Rx 831.780

    Channel 7 (205) Tx 876.150 Rx 831.150

    Channel 8 (184) Tx 875.520 Rx 830.520

    Channel 9 (163) Tx 874.890 Rx 829.890

    Channel 10 (142) Tx 874.260 Rx 829.260

    Channel 11 (121) Tx 873.630 Rx 828.630

    Channel 12 (100) Tx 873.000 Rx 828.000

    Channel 13 (79) Tx 872.370 Rx 827.370

    Channel 14 (58) Tx 871.740 Rx 826.740

    Channel 15 (37) Tx 871.110 Rx 826.110

    Channel 16 (16) Tx 870.480 Rx 825.480

     

    Cell # 4

    --------------------------------------------------

    Channel 1 (330) Tx 879.900 Rx 834.900

    Channel 2 (309) Tx 879.270 Rx 834.270

    Channel 3 (288) Tx 878.640 Rx 833.640

    Channel 4 (267) Tx 878.010 Rx 833.010

    Channel 5 (246) Tx 877.380 Rx 832.380

    Channel 6 (225) Tx 876.750 Rx 831.750

    Channel 7 (204) Tx 876.120 Rx 831.120

    Channel 8 (183) Tx 875.490 Rx 830.490

    Channel 9 (162) Tx 874.860 Rx 829.860

    Channel 10 (141) Tx 874.230 Rx 829.230

    Channel 11 (120) Tx 873.600 Rx 828.600

    Channel 12 (99) Tx 872.970 Rx 827.970

    Channel 13 (78) Tx 872.340 Rx 827.340

    Channel 14 (57) Tx 871.710 Rx 826.710

    Channel 15 (36) Tx 871.080 Rx 826.080

    Channel 16 (15) Tx 870.450 Rx 825.450

     

    Cell # 5

    --------------------------------------------------

    Channel 1 (329) Tx 879.870 Rx 834.870

    Channel 2 (308) Tx 879.240 Rx 834.240

    Channel 3 (287) Tx 878.610 Rx 833.610

    Channel 4 (266) Tx 877.980 Rx 832.980

    Channel 5 (245) Tx 877.350 Rx 832.350

    Channel 6 (224) Tx 876.720 Rx 831.720

    Channel 7 (203) Tx 876.090 Rx 831.090

    Channel 8 (182) Tx 875.460 Rx 830.460

    Channel 9 (161) Tx 874.830 Rx 829.830

    Channel 10 (140) Tx 874.200 Rx 829.200

    Channel 11 (119) Tx 873.570 Rx 828.570

    Channel 12 (98) Tx 872.940 Rx 827.940

    Channel 13 (77) Tx 872.310 Rx 827.310

    Channel 14 (56) Tx 871.680 Rx 826.680

    Channel 15 (35) Tx 871.050 Rx 826.050

    Channel 16 (14) Tx 870.420 Rx 825.420

     

    Cell # 6

    --------------------------------------------------

    Channel 1 (328) Tx 879.840 Rx 834.840

    Channel 2 (307) Tx 879.210 Rx 834.210

    Channel 3 (286) Tx 878.580 Rx 833.580

    Channel 4 (265) Tx 877.950 Rx 832.950

    Channel 5 (244) Tx 877.320 Rx 832.320

    Channel 6 (223) Tx 876.690 Rx 831.690

    Channel 7 (202) Tx 876.060 Rx 831.060

    Channel 8 (181) Tx 875.430 Rx 830.430

    Channel 9 (160) Tx 874.800 Rx 829.800

    Channel 10 (139) Tx 874.170 Rx 829.170

    Channel 11 (118) Tx 873.540 Rx 828.540

    Channel 12 (97) Tx 872.910 Rx 827.910

    Channel 13 (76) Tx 872.280 Rx 827.280

    Channel 14 (55) Tx 871.650 Rx 826.650

    Channel 15 (34) Tx 871.020 Rx 826.020

    Channel 16 (13) Tx 870.390 Rx 825.390

     

    Cell # 7

    --------------------------------------------------

    Channel 1 (327) Tx 879.810 Rx 834.810

    Channel 2 (306) Tx 879.180 Rx 834.180

    Channel 3 (285) Tx 878.550 Rx 833.550

    Channel 4 (264) Tx 877.920 Rx 832.920

    Channel 5 (243) Tx 877.290 Rx 832.290

    Channel 6 (222) Tx 876.660 Rx 831.660

    Channel 7 (201) Tx 876.030 Rx 831.030

    Channel 8 (180) Tx 875.400 Rx 830.400

    Channel 9 (159) Tx 874.770 Rx 829.770

    Channel 10 (138) Tx 874.140 Rx 829.140

    Channel 11 (117) Tx 873.510 Rx 828.510

    Channel 12 (96) Tx 872.880 Rx 827.880

    Channel 13 (75) Tx 872.250 Rx 827.250

    Channel 14 (54) Tx 871.620 Rx 826.620

    Channel 15 (33) Tx 870.990 Rx 825.990

    Channel 16 (12) Tx 870.360 Rx 825.360

     

    Cell # 8

    --------------------------------------------------

    Channel 1 (326) Tx 879.780 Rx 834.780

    Channel 2 (305) Tx 879.150 Rx 834.150

    Channel 3 (284) Tx 878.520 Rx 833.520

    Channel 4 (263) Tx 877.890 Rx 832.890

    Channel 5 (242) Tx 877.260 Rx 832.260

    Channel 6 (221) Tx 876.630 Rx 831.630

    Channel 7 (200) Tx 876.000 Rx 831.000

    Channel 8 (179) Tx 875.370 Rx 830.370

    Channel 9 (158) Tx 874.740 Rx 829.740

    Channel 10 (137) Tx 874.110 Rx 829.110

    Channel 11 (116) Tx 873.480 Rx 828.480

    Channel 12 (95) Tx 872.850 Rx 827.850

    Channel 13 (74) Tx 872.220 Rx 827.220

    Channel 14 (53) Tx 871.590 Rx 826.590

    Channel 15 (32) Tx 870.960 Rx 825.960

    Channel 16 (11) Tx 870.330 Rx 825.330

     

    Cell # 9

    --------------------------------------------------

    Channel 1 (325) Tx 879.750 Rx 834.750

    Channel 2 (304) Tx 879.120 Rx 834.120

    Channel 3 (283) Tx 878.490 Rx 833.490

    Channel 4 (262) Tx 877.860 Rx 832.860

    Channel 5 (241) Tx 877.230 Rx 832.230

    Channel 6 (220) Tx 876.600 Rx 831.600

    Channel 7 (199) Tx 875.970 Rx 830.970

    Channel 8 (178) Tx 875.340 Rx 830.340

    Channel 9 (157) Tx 874.710 Rx 829.710

    Channel 10 (136) Tx 874.080 Rx 829.080

    Channel 11 (115) Tx 873.450 Rx 828.450

    Channel 12 (94) Tx 872.820 Rx 827.820

    Channel 13 (73) Tx 872.190 Rx 827.190

    Channel 14 (52) Tx 871.560 Rx 826.560

    Channel 15 (31) Tx 870.930 Rx 825.930

    Channel 16 (10) Tx 870.300 Rx 825.300

     

    Cell # 10

    --------------------------------------------------

    Channel 1 (324) Tx 879.720 Rx 834.720

    Channel 2 (303) Tx 879.090 Rx 834.090

    Channel 3 (282) Tx 878.460 Rx 833.460

    Channel 4 (261) Tx 877.830 Rx 832.830

    Channel 5 (240) Tx 877.200 Rx 832.200

    Channel 6 (219) Tx 876.570 Rx 831.570

    Channel 7 (198) Tx 875.940 Rx 830.940

    Channel 8 (177) Tx 875.310 Rx 830.310

    Channel 9 (156) Tx 874.680 Rx 829.680

    Channel 10 (135) Tx 874.050 Rx 829.050

    Channel 11 (114) Tx 873.420 Rx 828.420

    Channel 12 (93) Tx 872.790 Rx 827.790

    Channel 13 (72) Tx 872.160 Rx 827.160

    Channel 14 (51) Tx 871.530 Rx 826.530

    Channel 15 (30) Tx 870.900 Rx 825.900

    Channel 16 (9) Tx 870.270 Rx 825.270

     

    Cell # 11

    --------------------------------------------------

    Channel 1 (323) Tx 879.690 Rx 834.690

    Channel 2 (302) Tx 879.060 Rx 834.060

    Channel 3 (281) Tx 878.430 Rx 833.430

    Channel 4 (260) Tx 877.800 Rx 832.800

    Channel 5 (239) Tx 877.170 Rx 832.170

    Channel 6 (218) Tx 876.540 Rx 831.540

    Channel 7 (197) Tx 875.910 Rx 830.910

    Channel 8 (176) Tx 875.280 Rx 830.280

    Channel 9 (155) Tx 874.650 Rx 829.650

    Channel 10 (134) Tx 874.020 Rx 829.020

    Channel 11 (113) Tx 873.390 Rx 828.390

    Channel 12 (92) Tx 872.760 Rx 827.760

    Channel 13 (71) Tx 872.130 Rx 827.130

    Channel 14 (50) Tx 871.500 Rx 826.500

    Channel 15 (29) Tx 870.870 Rx 825.870

    Channel 16 (8) Tx 870.240 Rx 825.240

     

    Cell # 12

    --------------------------------------------------

    Channel 1 (322) Tx 879.660 Rx 834.660

    Channel 2 (301) Tx 879.030 Rx 834.030

    Channel 3 (280) Tx 878.400 Rx 833.400

    Channel 4 (259) Tx 877.770 Rx 832.770

    Channel 5 (238) Tx 877.140 Rx 832.140

    Channel 6 (217) Tx 876.510 Rx 831.510

    Channel 7 (196) Tx 875.880 Rx 830.880

    Channel 8 (175) Tx 875.250 Rx 830.250

    Channel 9 (154) Tx 874.620 Rx 829.620

    Channel 10 (133) Tx 873.990 Rx 828.990

    Channel 11 (112) Tx 873.360 Rx 828.360

    Channel 12 (91) Tx 872.730 Rx 827.730

    Channel 13 (70) Tx 872.100 Rx 827.100

    Channel 14 (49) Tx 871.470 Rx 826.470

    Channel 15 (28) Tx 870.840 Rx 825.840

    Channel 16 (7) Tx 870.210 Rx 825.210

     

    Cell # 13

    --------------------------------------------------

    Channel 1 (321) Tx 879.630 Rx 834.630

    Channel 2 (300) Tx 879.000 Rx 834.000

    Channel 3 (279) Tx 878.370 Rx 833.370

    Channel 4 (258) Tx 877.740 Rx 832.740

    Channel 5 (237) Tx 877.110 Rx 832.110

    Channel 6 (216) Tx 876.480 Rx 831.480

    Channel 7 (195) Tx 875.850 Rx 830.850

    Channel 8 (174) Tx 875.220 Rx 830.220

    Channel 9 (153) Tx 874.590 Rx 829.590

    Channel 10 (132) Tx 873.960 Rx 828.960

    Channel 11 (111) Tx 873.330 Rx 828.330

    Channel 12 (90) Tx 872.700 Rx 827.700

    Channel 13 (69) Tx 872.070 Rx 827.070

    Channel 14 (48) Tx 871.440 Rx 826.440

    Channel 15 (27) Tx 870.810 Rx 825.810

    Channel 16 (6) Tx 870.180 Rx 825.180

     

    Cell # 14

    --------------------------------------------------

    Channel 1 (320) Tx 879.600 Rx 834.600

    Channel 2 (299) Tx 878.970 Rx 833.970

    Channel 3 (278) Tx 878.340 Rx 833.340

    Channel 4 (257) Tx 877.710 Rx 832.710

    Channel 5 (236) Tx 877.080 Rx 832.080

    Channel 6 (215) Tx 876.450 Rx 831.450

    Channel 7 (194) Tx 875.820 Rx 830.820

    Channel 8 (173) Tx 875.190 Rx 830.190

    Channel 9 (152) Tx 874.560 Rx 829.560

    Channel 10 (131) Tx 873.930 Rx 828.930

    Channel 11 (110) Tx 873.300 Rx 828.300

    Channel 12 (89) Tx 872.670 Rx 827.670

    Channel 13 (68) Tx 872.040 Rx 827.040

    Channel 14 (47) Tx 871.410 Rx 826.410

    Channel 15 (26) Tx 870.780 Rx 825.780

    Channel 16 (5) Tx 870.150 Rx 825.150

     

    Cell # 15

    --------------------------------------------------

    Channel 1 (319) Tx 879.570 Rx 834.570

    Channel 2 (298) Tx 878.940 Rx 833.940

    Channel 3 (277) Tx 878.310 Rx 833.310

    Channel 4 (256) Tx 877.680 Rx 832.680

    Channel 5 (235) Tx 877.050 Rx 832.050

    Channel 6 (214) Tx 876.420 Rx 831.420

    Channel 7 (193) Tx 875.790 Rx 830.790

    Channel 8 (172) Tx 875.160 Rx 830.160

    Channel 9 (151) Tx 874.530 Rx 829.530

    Channel 10 (130) Tx 873.900 Rx 828.900

    Channel 11 (109) Tx 873.270 Rx 828.270

    Channel 12 (88) Tx 872.640 Rx 827.640

    Channel 13 (67) Tx 872.010 Rx 827.010

    Channel 14 (46) Tx 871.380 Rx 826.380

    Channel 15 (25) Tx 870.750 Rx 825.750

    Channel 16 (4) Tx 870.120 Rx 825.120

     

    Cell # 16

    --------------------------------------------------

    Channel 1 (318) Tx 879.540 Rx 834.540

    Channel 2 (297) Tx 878.910 Rx 833.910

    Channel 3 (276) Tx 878.280 Rx 833.280

    Channel 4 (255) Tx 877.650 Rx 832.650

    Channel 5 (234) Tx 877.020 Rx 832.020

    Channel 6 (213) Tx 876.390 Rx 831.390

    Channel 7 (192) Tx 875.760 Rx 830.760

    Channel 8 (171) Tx 875.130 Rx 830.130

    Channel 9 (150) Tx 874.500 Rx 829.500

    Channel 10 (129) Tx 873.870 Rx 828.870

    Channel 11 (108) Tx 873.240 Rx 828.240

    Channel 12 (87) Tx 872.610 Rx 827.610

    Channel 13 (66) Tx 871.980 Rx 826.980

    Channel 14 (45) Tx 871.350 Rx 826.350

    Channel 15 (24) Tx 870.720 Rx 825.720

    Channel 16 (3) Tx 870.090 Rx 825.090

     

    Cell # 17

    --------------------------------------------------

    Channel 1 (317) Tx 879.510 Rx 834.510

    Channel 2 (296) Tx 878.880 Rx 833.880

    Channel 3 (275) Tx 878.250 Rx 833.250

    Channel 4 (254) Tx 877.620 Rx 832.620

    Channel 5 (233) Tx 876.990 Rx 831.990

    Channel 6 (212) Tx 876.360 Rx 831.360

    Channel 7 (191) Tx 875.730 Rx 830.730

    Channel 8 (170) Tx 875.100 Rx 830.100

    Channel 9 (149) Tx 874.470 Rx 829.470

    Channel 10 (128) Tx 873.840 Rx 828.840

    Channel 11 (107) Tx 873.210 Rx 828.210

    Channel 12 (86) Tx 872.580 Rx 827.580

    Channel 13 (65) Tx 871.950 Rx 826.950

    Channel 14 (44) Tx 871.320 Rx 826.320

    Channel 15 (23) Tx 870.690 Rx 825.690

    Channel 16 (2) Tx 870.060 Rx 825.060

     

    Cell # 18

    --------------------------------------------------

    Channel 1 (316) Tx 879.480 Rx 834.480

    Channel 2 (295) Tx 878.850 Rx 833.850

    Channel 3 (274) Tx 878.220 Rx 833.220

    Channel 4 (253) Tx 877.590 Rx 832.590

    Channel 5 (232) Tx 876.960 Rx 831.960

    Channel 6 (211) Tx 876.330 Rx 831.330

    Channel 7 (190) Tx 875.700 Rx 830.700

    Channel 8 (169) Tx 875.070 Rx 830.070

    Channel 9 (148) Tx 874.440 Rx 829.440

    Channel 10 (127) Tx 873.810 Rx 828.810

    Channel 11 (106) Tx 873.180 Rx 828.180

    Channel 12 (85) Tx 872.550 Rx 827.550

    Channel 13 (64) Tx 871.920 Rx 826.920

    Channel 14 (43) Tx 871.290 Rx 826.290

    Channel 15 (22) Tx 870.660 Rx 825.660

    Channel 16 (1) Tx 870.030 Rx 825.030

     

    Cell # 19

    --------------------------------------------------

    Channel 1 (315) Tx 879.450 Rx 834.450

    Channel 2 (294) Tx 878.820 Rx 833.820

    Channel 3 (273) Tx 878.190 Rx 833.190

    Channel 4 (252) Tx 877.560 Rx 832.560

    Channel 5 (231) Tx 876.930 Rx 831.930

    Channel 6 (210) Tx 876.300 Rx 831.300

    Channel 7 (189) Tx 875.670 Rx 830.670

    Channel 8 (168) Tx 875.040 Rx 830.040

    Channel 9 (147) Tx 874.410 Rx 829.410

    Channel 10 (126) Tx 873.780 Rx 828.780

    Channel 11 (105) Tx 873.150 Rx 828.150

    Channel 12 (84) Tx 872.520 Rx 827.520

    Channel 13 (63) Tx 871.890 Rx 826.890

    Channel 14 (42) Tx 871.260 Rx 826.260

    Channel 15 (21) Tx 870.630 Rx 825.630

     

    Cell # 20

    --------------------------------------------------

    Channel 1 (314) Tx 879.420 Rx 834.420

    Channel 2 (293) Tx 878.790 Rx 833.790

    Channel 3 (272) Tx 878.160 Rx 833.160

    Channel 4 (251) Tx 877.530 Rx 832.530

    Channel 5 (230) Tx 876.900 Rx 831.900

    Channel 6 (209) Tx 876.270 Rx 831.270

    Channel 7 (188) Tx 875.640 Rx 830.640

    Channel 8 (167) Tx 875.010 Rx 830.010

    Channel 9 (146) Tx 874.380 Rx 829.380

    Channel 10 (125) Tx 873.750 Rx 828.750

    Channel 11 (104) Tx 873.120 Rx 828.120

    Channel 12 (83) Tx 872.490 Rx 827.490

    Channel 13 (62) Tx 871.860 Rx 826.860

    Channel 14 (41) Tx 871.230 Rx 826.230

    Channel 15 (20) Tx 870.600 Rx 825.600

     

    Cell # 21

    --------------------------------------------------

    Channel 1 (313) Tx 879.390 Rx 834.390

    Channel 2 (292) Tx 878.760 Rx 833.760

    Channel 3 (271) Tx 878.130 Rx 833.130

    Channel 4 (250) Tx 877.500 Rx 832.500

    Channel 5 (229) Tx 876.870 Rx 831.870

    Channel 6 (208) Tx 876.240 Rx 831.240

    Channel 7 (187) Tx 875.610 Rx 830.610

    Channel 8 (166) Tx 874.980 Rx 829.980

    Channel 9 (145) Tx 874.350 Rx 829.350

    Channel 10 (124) Tx 873.720 Rx 828.720

    Channel 11 (103) Tx 873.090 Rx 828.090

    Channel 12 (82) Tx 872.460 Rx 827.460

    Channel 13 (61) Tx 871.830 Rx 826.830

    Channel 14 (40) Tx 871.200 Rx 826.200

    Channel 15 (19) Tx 870.570 Rx 825.570

     

    **************************************************

     

    Cellular Phone Band B (Channel 1 is Data)

     

    Cell # 1

    --------------------------------------------------

    Channel 1 (334) Tx 880.020 Rx 835.020

    Channel 2 (355) Tx 880.650 Rx 835.650

    Channel 3 (376) Tx 881.280 Rx 836.280

    Channel 4 (397) Tx 881.910 Rx 836.910

    Channel 5 (418) Tx 882.540 Rx 837.540

    Channel 6 (439) Tx 883.170 Rx 838.170

    Channel 7 (460) Tx 883.800 Rx 838.800

    Channel 8 (481) Tx 884.430 Rx 839.430

    Channel 9 (502) Tx 885.060 Rx 840.060

    Channel 10 (523) Tx 885.690 Rx 840.690

    Channel 11 (544) Tx 886.320 Rx 841.320

    Channel 12 (565) Tx 886.950 Rx 841.950

    Channel 13 (586) Tx 887.580 Rx 842.580

    Channel 14 (607) Tx 888.210 Rx 843.210

    Channel 15 (628) Tx 888.840 Rx 843.840

    Channel 16 (649) Tx 889.470 Rx 844.470

     

    Cell # 2

    --------------------------------------------------

    Channel 1 (335) Tx 880.050 Rx 835.050

    Channel 2 (356) Tx 880.680 Rx 835.680

    Channel 3 (377) Tx 881.310 Rx 836.310

    Channel 4 (398) Tx 881.940 Rx 836.940

    Channel 5 (419) Tx 882.570 Rx 837.570

    Channel 6 (440) Tx 883.200 Rx 838.200

    Channel 7 (461) Tx 883.830 Rx 838.830

    Channel 8 (482) Tx 884.460 Rx 839.460

    Channel 9 (503) Tx 885.090 Rx 840.090

    Channel 10 (524) Tx 885.720 Rx 840.720

    Channel 11 (545) Tx 886.350 Rx 841.350

    Channel 12 (566) Tx 886.980 Rx 841.980

    Channel 13 (587) Tx 887.610 Rx 842.610

    Channel 14 (608) Tx 888.240 Rx 843.240

    Channel 15 (629) Tx 888.870 Rx 843.870

    Channel 16 (650) Tx 889.500 Rx 844.500

     

    Cell # 3

    --------------------------------------------------

    Channel 1 (336) Tx 880.080 Rx 835.080

    Channel 2 (357) Tx 880.710 Rx 835.710

    Channel 3 (378) Tx 881.340 Rx 836.340

    Channel 4 (399) Tx 881.970 Rx 836.970

    Channel 5 (420) Tx 882.600 Rx 837.600

    Channel 6 (441) Tx 883.230 Rx 838.230

    Channel 7 (462) Tx 883.860 Rx 838.860

    Channel 8 (483) Tx 884.490 Rx 839.490

    Channel 9 (504) Tx 885.120 Rx 840.120

    Channel 10 (525) Tx 885.750 Rx 840.750

    Channel 11 (546) Tx 886.380 Rx 841.380

    Channel 12 (567) Tx 887.010 Rx 842.010

    Channel 13 (588) Tx 887.640 Rx 842.640

    Channel 14 (609) Tx 888.270 Rx 843.270

    Channel 15 (630) Tx 888.900 Rx 843.900

    Channel 16 (651) Tx 889.530 Rx 844.530

     

    Cell # 4

    --------------------------------------------------

    Channel 1 (337) Tx 880.110 Rx 835.110

    Channel 2 (358) Tx 880.740 Rx 835.740

    Channel 3 (379) Tx 881.370 Rx 836.370

    Channel 4 (400) Tx 882.000 Rx 837.000

    Channel 5 (421) Tx 882.630 Rx 837.630

    Channel 6 (442) Tx 883.260 Rx 838.260

    Channel 7 (463) Tx 883.890 Rx 838.890

    Channel 8 (484) Tx 884.520 Rx 839.520

    Channel 9 (505) Tx 885.150 Rx 840.150

    Channel 10 (526) Tx 885.780 Rx 840.780

    Channel 11 (547) Tx 886.410 Rx 841.410

    Channel 12 (568) Tx 887.040 Rx 842.040

    Channel 13 (589) Tx 887.670 Rx 842.670

    Channel 14 (610) Tx 888.300 Rx 843.300

    Channel 15 (631) Tx 888.930 Rx 843.930

    Channel 16 (652) Tx 889.560 Rx 844.560

     

    Cell # 5

    --------------------------------------------------

    Channel 1 (338) Tx 880.140 Rx 835.140

    Channel 2 (359) Tx 880.770 Rx 835.770

    Channel 3 (380) Tx 881.400 Rx 836.400

    Channel 4 (401) Tx 882.030 Rx 837.030

    Channel 5 (422) Tx 882.660 Rx 837.660

    Channel 6 (443) Tx 883.290 Rx 838.290

    Channel 7 (464) Tx 883.920 Rx 838.920

    Channel 8 (485) Tx 884.550 Rx 839.550

    Channel 9 (506) Tx 885.180 Rx 840.180

    Channel 10 (527) Tx 885.810 Rx 840.810

    Channel 11 (548) Tx 886.440 Rx 841.440

    Channel 12 (569) Tx 887.070 Rx 842.070

    Channel 13 (590) Tx 887.700 Rx 842.700

    Channel 14 (611) Tx 888.330 Rx 843.330

    Channel 15 (632) Tx 888.960 Rx 843.960

    Channel 16 (653) Tx 889.590 Rx 844.590

     

    Cell # 6

    --------------------------------------------------

    Channel 1 (339) Tx 880.170 Rx 835.170

    Channel 2 (360) Tx 880.800 Rx 835.800

    Channel 3 (381) Tx 881.430 Rx 836.430

    Channel 4 (402) Tx 882.060 Rx 837.060

    Channel 5 (423) Tx 882.690 Rx 837.690

    Channel 6 (444) Tx 883.320 Rx 838.320

    Channel 7 (465) Tx 883.950 Rx 838.950

    Channel 8 (486) Tx 884.580 Rx 839.580

    Channel 9 (507) Tx 885.210 Rx 840.210

    Channel 10 (528) Tx 885.840 Rx 840.840

    Channel 11 (549) Tx 886.470 Rx 841.470

    Channel 12 (570) Tx 887.100 Rx 842.100

    Channel 13 (591) Tx 887.730 Rx 842.730

    Channel 14 (612) Tx 888.360 Rx 843.360

    Channel 15 (633) Tx 888.990 Rx 843.990

    Channel 16 (654) Tx 889.620 Rx 844.620

     

    Cell # 7

    --------------------------------------------------

    Channel 1 (340) Tx 880.200 Rx 835.200

    Channel 2 (361) Tx 880.830 Rx 835.830

    Channel 3 (382) Tx 881.460 Rx 836.460

    Channel 4 (403) Tx 882.090 Rx 837.090

    Channel 5 (424) Tx 882.720 Rx 837.720

    Channel 6 (445) Tx 883.350 Rx 838.350

    Channel 7 (466) Tx 883.980 Rx 838.980

    Channel 8 (487) Tx 884.610 Rx 839.610

    Channel 9 (508) Tx 885.240 Rx 840.240

    Channel 10 (529) Tx 885.870 Rx 840.870

    Channel 11 (550) Tx 886.500 Rx 841.500

    Channel 12 (571) Tx 887.130 Rx 842.130

    Channel 13 (592) Tx 887.760 Rx 842.760

    Channel 14 (613) Tx 888.390 Rx 843.390

    Channel 15 (634) Tx 889.020 Rx 844.020

    Channel 16 (655) Tx 889.650 Rx 844.650

     

    Cell # 8

    --------------------------------------------------

    Channel 1 (341) Tx 880.230 Rx 835.230

    Channel 2 (362) Tx 880.860 Rx 835.860

    Channel 3 (383) Tx 881.490 Rx 836.490

    Channel 4 (404) Tx 882.120 Rx 837.120

    Channel 5 (425) Tx 882.750 Rx 837.750

    Channel 6 (446) Tx 883.380 Rx 838.380

    Channel 7 (467) Tx 884.010 Rx 839.010

    Channel 8 (488) Tx 884.640 Rx 839.640

    Channel 9 (509) Tx 885.270 Rx 840.270

    Channel 10 (530) Tx 885.900 Rx 840.900

    Channel 11 (551) Tx 886.530 Rx 841.530

    Channel 12 (572) Tx 887.160 Rx 842.160

    Channel 13 (593) Tx 887.790 Rx 842.790

    Channel 14 (614) Tx 888.420 Rx 843.420

    Channel 15 (635) Tx 889.050 Rx 844.050

    Channel 16 (656) Tx 889.680 Rx 844.680

     

    Cell # 9

    --------------------------------------------------

    Channel 1 (342) Tx 880.260 Rx 835.260

    Channel 2 (363) Tx 880.890 Rx 835.890

    Channel 3 (384) Tx 881.520 Rx 836.520

    Channel 4 (405) Tx 882.150 Rx 837.150

    Channel 5 (426) Tx 882.780 Rx 837.780

    Channel 6 (447) Tx 883.410 Rx 838.410

    Channel 7 (468) Tx 884.040 Rx 839.040

    Channel 8 (489) Tx 884.670 Rx 839.670

    Channel 9 (510) Tx 885.300 Rx 840.300

    Channel 10 (531) Tx 885.930 Rx 840.930

    Channel 11 (552) Tx 886.560 Rx 841.560

    Channel 12 (573) Tx 887.190 Rx 842.190

    Channel 13 (594) Tx 887.820 Rx 842.820

    Channel 14 (615) Tx 888.450 Rx 843.450

    Channel 15 (636) Tx 889.080 Rx 844.080

    Channel 16 (657) Tx 889.710 Rx 844.710

     

    Cell # 10

    --------------------------------------------------

    Channel 1 (343) Tx 880.290 Rx 835.290

    Channel 2 (364) Tx 880.920 Rx 835.920

    Channel 3 (385) Tx 881.550 Rx 836.550

    Channel 4 (406) Tx 882.180 Rx 837.180

    Channel 5 (427) Tx 882.810 Rx 837.810

    Channel 6 (448) Tx 883.440 Rx 838.440

    Channel 7 (469) Tx 884.070 Rx 839.070

    Channel 8 (490) Tx 884.700 Rx 839.700

    Channel 9 (511) Tx 885.330 Rx 840.330

    Channel 10 (532) Tx 885.960 Rx 840.960

    Channel 11 (553) Tx 886.590 Rx 841.590

    Channel 12 (574) Tx 887.220 Rx 842.220

    Channel 13 (595) Tx 887.850 Rx 842.850

    Channel 14 (616) Tx 888.480 Rx 843.480

    Channel 15 (637) Tx 889.110 Rx 844.110

    Channel 16 (658) Tx 889.740 Rx 844.740

     

    Cell # 11

    --------------------------------------------------

    Channel 1 (344) Tx 880.320 Rx 835.320

    Channel 2 (365) Tx 880.950 Rx 835.950

    Channel 3 (386) Tx 881.580 Rx 836.580

    Channel 4 (407) Tx 882.210 Rx 837.210

    Channel 5 (428) Tx 882.840 Rx 837.840

    Channel 6 (449) Tx 883.470 Rx 838.470

    Channel 7 (470) Tx 884.100 Rx 839.100

    Channel 8 (491) Tx 884.730 Rx 839.730

    Channel 9 (512) Tx 885.360 Rx 840.360

    Channel 10 (533) Tx 885.990 Rx 840.990

    Channel 11 (554) Tx 886.620 Rx 841.620

    Channel 12 (575) Tx 887.250 Rx 842.250

    Channel 13 (596) Tx 887.880 Rx 842.880

    Channel 14 (617) Tx 888.510 Rx 843.510

    Channel 15 (638) Tx 889.140 Rx 844.140

    Channel 16 (659) Tx 889.770 Rx 844.770

     

    Cell # 12

    --------------------------------------------------

    Channel 1 (345) Tx 880.350 Rx 835.350

    Channel 2 (366) Tx 880.980 Rx 835.980

    Channel 3 (387) Tx 881.610 Rx 836.610

    Channel 4 (408) Tx 882.240 Rx 837.240

    Channel 5 (429) Tx 882.870 Rx 837.870

    Channel 6 (450) Tx 883.500 Rx 838.500

    Channel 7 (471) Tx 884.130 Rx 839.130

    Channel 8 (492) Tx 884.760 Rx 839.760

    Channel 9 (513) Tx 885.390 Rx 840.390

    Channel 10 (534) Tx 886.020 Rx 841.020

    Channel 11 (555) Tx 886.650 Rx 841.650

    Channel 12 (576) Tx 887.280 Rx 842.280

    Channel 13 (597) Tx 887.910 Rx 842.910

    Channel 14 (618) Tx 888.540 Rx 843.540

    Channel 15 (639) Tx 889.170 Rx 844.170

    Channel 16 (660) Tx 889.800 Rx 844.800

     

    Cell # 13

    --------------------------------------------------

    Channel 1 (346) Tx 880.380 Rx 835.380

    Channel 2 (367) Tx 881.010 Rx 836.010

    Channel 3 (388) Tx 881.640 Rx 836.640

    Channel 4 (409) Tx 882.270 Rx 837.270

    Channel 5 (430) Tx 882.900 Rx 837.900

    Channel 6 (451) Tx 883.530 Rx 838.530

    Channel 7 (472) Tx 884.160 Rx 839.160

    Channel 8 (493) Tx 884.790 Rx 839.790

    Channel 9 (514) Tx 885.420 Rx 840.420

    Channel 10 (535) Tx 886.050 Rx 841.050

    Channel 11 (556) Tx 886.680 Rx 841.680

    Channel 12 (577) Tx 887.310 Rx 842.310

    Channel 13 (598) Tx 887.940 Rx 842.940

    Channel 14 (619) Tx 888.570 Rx 843.570

    Channel 15 (640) Tx 889.200 Rx 844.200

    Channel 16 (661) Tx 889.830 Rx 844.830

     

    Cell # 14

    --------------------------------------------------

    Channel 1 (347) Tx 880.410 Rx 835.410

    Channel 2 (368) Tx 881.040 Rx 836.040

    Channel 3 (389) Tx 881.670 Rx 836.670

    Channel 4 (410) Tx 882.300 Rx 837.300

    Channel 5 (431) Tx 882.930 Rx 837.930

    Channel 6 (452) Tx 883.560 Rx 838.560

    Channel 7 (473) Tx 884.190 Rx 839.190

    Channel 8 (494) Tx 884.820 Rx 839.820

    Channel 9 (515) Tx 885.450 Rx 840.450

    Channel 10 (536) Tx 886.080 Rx 841.080

    Channel 11 (557) Tx 886.710 Rx 841.710

    Channel 12 (578) Tx 887.340 Rx 842.340

    Channel 13 (599) Tx 887.970 Rx 842.970

    Channel 14 (620) Tx 888.600 Rx 843.600

    Channel 15 (641) Tx 889.230 Rx 844.230

    Channel 16 (662) Tx 889.860 Rx 844.860

     

    Cell # 15

    --------------------------------------------------

    Channel 1 (348) Tx 880.440 Rx 835.440

    Channel 2 (369) Tx 881.070 Rx 836.070

    Channel 3 (390) Tx 881.700 Rx 836.700

    Channel 4 (411) Tx 882.330 Rx 837.330

    Channel 5 (432) Tx 882.960 Rx 837.960

    Channel 6 (453) Tx 883.590 Rx 838.590

    Channel 7 (474) Tx 884.220 Rx 839.220

    Channel 8 (495) Tx 884.850 Rx 839.850

    Channel 9 (516) Tx 885.480 Rx 840.480

    Channel 10 (537) Tx 886.110 Rx 841.110

    Channel 11 (558) Tx 886.740 Rx 841.740

    Channel 12 (579) Tx 887.370 Rx 842.370

    Channel 13 (600) Tx 888.000 Rx 843.000

    Channel 14 (621) Tx 888.630 Rx 843.630

    Channel 15 (642) Tx 889.260 Rx 844.260

    Channel 16 (663) Tx 889.890 Rx 844.890

     

    Cell # 16

    --------------------------------------------------

    Channel 1 (349) Tx 880.470 Rx 835.470

    Channel 2 (370) Tx 881.100 Rx 836.100

    Channel 3 (391) Tx 881.730 Rx 836.730

    Channel 4 (412) Tx 882.360 Rx 837.360

    Channel 5 (433) Tx 882.990 Rx 837.990

    Channel 6 (454) Tx 883.620 Rx 838.620

    Channel 7 (475) Tx 884.250 Rx 839.250

    Channel 8 (496) Tx 884.880 Rx 839.880

    Channel 9 (517) Tx 885.510 Rx 840.510

    Channel 10 (538) Tx 886.140 Rx 841.140

    Channel 11 (559) Tx 886.770 Rx 841.770

    Channel 12 (580) Tx 887.400 Rx 842.400

    Channel 13 (601) Tx 888.030 Rx 843.030

    Channel 14 (622) Tx 888.660 Rx 843.660

    Channel 15 (643) Tx 889.290 Rx 844.290

    Channel 16 (664) Tx 889.920 Rx 844.920

     

    Cell # 17

    --------------------------------------------------

    Channel 1 (350) Tx 880.500 Rx 835.500

    Channel 2 (371) Tx 881.130 Rx 836.130

    Channel 3 (392) Tx 881.760 Rx 836.760

    Channel 4 (413) Tx 882.390 Rx 837.390

    Channel 5 (434) Tx 883.020 Rx 838.020

    Channel 6 (455) Tx 883.650 Rx 838.650

    Channel 7 (476) Tx 884.280 Rx 839.280

    Channel 8 (497) Tx 884.910 Rx 839.910

    Channel 9 (518) Tx 885.540 Rx 840.540

    Channel 10 (539) Tx 886.170 Rx 841.170

    Channel 11 (560) Tx 886.800 Rx 841.800

    Channel 12 (581) Tx 887.430 Rx 842.430

    Channel 13 (602) Tx 888.060 Rx 843.060

    Channel 14 (623) Tx 888.690 Rx 843.690

    Channel 15 (644) Tx 889.320 Rx 844.320

    Channel 16 (665) Tx 889.950 Rx 844.950

     

    Cell # 18

    --------------------------------------------------

    Channel 1 (351) Tx 880.530 Rx 835.530

    Channel 2 (372) Tx 881.160 Rx 836.160

    Channel 3 (393) Tx 881.790 Rx 836.790

    Channel 4 (414) Tx 882.420 Rx 837.420

    Channel 5 (435) Tx 883.050 Rx 838.050

    Channel 6 (456) Tx 883.680 Rx 838.680

    Channel 7 (477) Tx 884.310 Rx 839.310

    Channel 8 (498) Tx 884.940 Rx 839.940

    Channel 9 (519) Tx 885.570 Rx 840.570

    Channel 10 (540) Tx 886.200 Rx 841.200

    Channel 11 (561) Tx 886.830 Rx 841.830

    Channel 12 (582) Tx 887.460 Rx 842.460

    Channel 13 (603) Tx 888.090 Rx 843.090

    Channel 14 (624) Tx 888.720 Rx 843.720

    Channel 15 (645) Tx 889.350 Rx 844.350

    Channel 16 (666) Tx 889.980 Rx 844.980

     

    Cell # 19

    --------------------------------------------------

    Channel 1 (352) Tx 880.560 Rx 835.560

    Channel 2 (373) Tx 881.190 Rx 836.190

    Channel 3 (394) Tx 881.820 Rx 836.820

    Channel 4 (415) Tx 882.450 Rx 837.450

    Channel 5 (436) Tx 883.080 Rx 838.080

    Channel 6 (457) Tx 883.710 Rx 838.710

    Channel 7 (478) Tx 884.340 Rx 839.340

    Channel 8 (499) Tx 884.970 Rx 839.970

    Channel 9 (520) Tx 885.600 Rx 840.600

    Channel 10 (541) Tx 886.230 Rx 841.230

    Channel 11 (562) Tx 886.860 Rx 841.860

    Channel 12 (583) Tx 887.490 Rx 842.490

    Channel 13 (604) Tx 888.120 Rx 843.120

    Channel 14 (625) Tx 888.750 Rx 843.750

    Channel 15 (646) Tx 889.380 Rx 844.380

     

    Cell # 20

    --------------------------------------------------

    Channel 1 (353) Tx 880.590 Rx 835.590

    Channel 2 (374) Tx 881.220 Rx 836.220

    Channel 3 (395) Tx 881.850 Rx 836.850

    Channel 4 (416) Tx 882.480 Rx 837.480

    Channel 5 (437) Tx 883.110 Rx 838.110

    Channel 6 (458) Tx 883.740 Rx 838.740

    Channel 7 (479) Tx 884.370 Rx 839.370

    Channel 8 (500) Tx 885.000 Rx 840.000

    Channel 9 (521) Tx 885.630 Rx 840.630

    Channel 10 (542) Tx 886.260 Rx 841.260

    Channel 11 (563) Tx 886.890 Rx 841.890

    Channel 12 (584) Tx 887.520 Rx 842.520

    Channel 13 (605) Tx 888.150 Rx 843.150

    Channel 14 (626) Tx 888.780 Rx 843.780

    Channel 15 (647) Tx 889.410 Rx 844.410

     

    Cell # 21

    --------------------------------------------------

    Channel 1 (354) Tx 880.620 Rx 835.620

    Channel 2 (375) Tx 881.250 Rx 836.250

    Channel 3 (396) Tx 881.880 Rx 836.880

    Channel 4 (417) Tx 882.510 Rx 837.510

    Channel 5 (438) Tx 883.140 Rx 838.140

    Channel 6 (459) Tx 883.770 Rx 838.770

    Channel 7 (480) Tx 884.400 Rx 839.400

    Channel 8 (501) Tx 885.030 Rx 840.030

    Channel 9 (522) Tx 885.660 Rx 840.660

    Channel 10 (543) Tx 886.290 Rx 841.290

    Channel 11 (564) Tx 886.920 Rx 841.920

    Channel 12 (585) Tx 887.550 Rx 842.550

    Channel 13 (606) Tx 888.180 Rx 843.180

    Channel 14 (627) Tx 888.810 Rx 843.810

    Channel 15 (648) Tx 889.440 Rx 844.440

     

    ===============================================================================

     

    Cellular phone frequency and cell construction

     

    ===============================================================================

    __ __

    \__/C \__/D \__

    \__/G \__/A \__/

    _/D \__/E \__/F \__

    \__/B \__/C \__/

    _/F \__/G \__/A \__

    \__/D \__/E \__/

    _/A \__/B \__/C \__

    \__/ \__/ \__/

     

    This represents how a cellular system might be laid out. Cells A and B

    never share a common border. Neither do B and C, A and G, etc. Cells that

    are next to each other are never assigned adjacent frequencies. They always

    differ by at least 60 kiloHertz. To track a mobile phone as it changes cells,

    let's put the mobile in a B cell. When the mobile switches frequencies, you

    know that he could only go to an D, E, F or G cell because A and C have

    adjacent frequencies. The two tables below will help you determine which

    channel cells can go next to each other. You can contact your local cellular

    phone company and see if they have any maps of the cells available. This is

    not a sure thing, but it couldn't hurt to try.

     

    Cells that can go next to each other:

     

    Cell Compatible cells

    A C, D, E, F

    B D, E, F, G

    C E, F, G, A

    D F, G, A, B

    E G, A, B, C

    F A, B, C, D

    G B, C, D, E

     

    Here is a frequency/cell layout chart. The cell frequencies are used by

    the cell site towers, and the mobile frequencies are the input frequencies

    used by the cars.

     

    Wireline company cell frequencies (BAND B)

     

    CELL A CELL B CELL C CELL D CELL E CELL F CELL G

    ======= ======= ======= ======= ======= ======= =======

    889.890 889.920 889.950 889.980 ¿

    889.680 889.710 889.740 889.770 889.800 889.830 889.860

    889.470 889.500 889.530 889.560 889.590 889.620 889.650

    889.260 889.290 889.320 889.350 889.380 889.410 889.440

    889.050 889.080 889.110 889.140 889.170 889.200 889.230

    888.840 888.870 888.900 888.930 888.960 888.990 889.020

    888.630 888.660 888.690 888.720 888.750 888.780 888.810

    888.420 888.450 888.480 888.510 888.540 888.570 888.600

    888.210 888.240 888.270 888.300 888.330 888.360 888.390

    888.000 888.030 888.060 888.090 888.120 888.150 888.180

    887.790 887.820 887.850 887.880 887.910 887.940 887.970

    887.580 887.610 887.640 887.670 887.700 887.730 887.760

    887.370 887.400 887.430 887.460 887.490 887.520 887.550

    887.160 887.190 887.220 887.250 887.280 887.310 887.340

    886.950 886.980 887.010 887.040 887.070 887.100 887.130

    886.740 886.770 886.800 886.830 886.860 886.890 886.920

    886.530 886.560 886.590 886.620 886.650 886.680 886.710

    886.320 886.350 886.380 886.410 886.440 886.470 886.500 Voice

    886.110 886.140 886.170 886.200 886.230 886.260 886.290

    885.900 885.930 885.960 885.990 886.020 886.050 886.080

    885.690 885.720 885.750 885.780 885.810 885.840 885.870

    885.480 885.510 885.540 885.570 885.600 885.630 885.660

    885.270 885.300 885.330 885.360 885.390 885.420 885.450

    885.060 885.090 885.120 885.150 885.180 885.210 885.240

    884.850 884.880 884.910 884.940 884.970 885.000 885.030

    884.640 884.670 884.700 884.730 884.760 884.790 884.820

    884.430 884.460 884.490 884.520 884.550 884.580 884.610

    884.220 884.250 884.280 884.310 884.340 884.370 884.400

    884.010 884.040 884.070 884.100 884.130 884.160 884.190 Channels

    883.800 883.830 883.860 883.890 883.920 883.950 883.980

    883.590 883.620 883.650 883.680 883.710 883.740 883.770

    883.380 883.410 883.440 883.470 883.500 883.530 883.560

    883.170 883.200 883.230 883.260 883.290 883.320 883.350

    882.960 882.990 883.020 883.050 883.080 883.110 883.140

    882.750 882.780 882.810 882.840 882.870 882.900 882.930

    882.540 882.570 882.600 882.630 882.660 882.690 882.720

    882.330 882.360 882.390 882.420 882.450 882.480 882.510

    882.120 882.150 882.180 882.210 882.240 882.270 882.300

    881.910 881.940 881.970 882.000 882.030 882.060 882.090

    881.700 881.730 881.760 881.790 881.820 881.850 881.880

    881.490 881.520 881.550 881.580 881.610 881.640 881.670

    881.280 881.310 881.340 881.370 881.400 881.430 881.460

    881.070 881.100 881.130 881.160 881.190 881.220 881.250

    880.860 880.890 880.920 880.950 880.980 881.010 881.040

    880.650 880.680 880.710 880.740 880.770 880.800 880.830

    -------------------------------------------------------------------

    880.440 880.470 880.500 880.530 880.560 880.590 880.620 ¿Digital

    880.230 880.260 880.290 880.320 880.350 880.380 880.410 Control

    880.020 880.050 880.080 880.110 880.140 880.170 880.200 Channels

     

    Wireline company mobile frequencies (BAND B)

     

    CELL A CELL B CELL C CELL D CELL E CELL F CELL G

    ======= ======= ======= ======= ======= ======= =======

    844.890 844.920 844.950 844.980 ¿

    844.680 844.710 844.740 844.770 844.800 844.830 844.860

    844.470 844.500 844.530 844.560 844.590 844.620 844.650

    844.260 844.290 844.320 844.350 844.380 844.410 844.440

    844.050 844.080 844.110 844.140 844.170 844.200 844.230

    843.840 843.870 843.900 843.930 843.960 843.990 844.020

    843.630 843.660 843.690 843.720 843.750 843.780 843.810

    843.420 843.450 843.480 843.510 843.540 843.570 843.600

    843.210 843.240 843.270 843.300 843.330 843.360 843.390

    843.000 843.030 843.060 843.090 843.120 843.150 843.180

    842.790 842.820 842.850 842.880 842.910 842.940 842.970

    842.580 842.610 842.640 842.670 842.700 842.730 842.760

    842.370 842.400 842.430 842.460 842.490 842.520 842.550

    842.160 842.190 842.220 842.250 842.280 842.310 842.340

    841.950 841.980 842.010 842.040 842.070 842.100 842.130

    841.740 841.770 841.800 841.830 841.860 841.890 841.920

    841.530 841.560 841.590 841.620 841.650 841.680 841.710

    841.320 841.350 841.380 841.410 841.440 841.470 841.500 Voice

    841.110 841.140 841.170 841.200 841.230 841.260 841.290

    840.900 840.930 840.960 840.990 841.020 841.050 841.080

    840.690 840.720 840.750 840.780 840.810 840.840 840.870

    840.480 840.510 840.540 840.570 840.600 840.630 840.660

    840.270 840.300 840.330 840.360 840.390 840.420 840.450

    840.060 840.090 840.120 840.150 840.180 840.210 840.240

    839.850 839.880 839.910 839.940 839.970 840.000 840.030

    839.640 839.670 839.700 839.730 839.760 839.790 839.820

    839.430 839.460 839.490 839.520 839.550 839.580 839.610

    839.220 839.250 839.280 839.310 839.340 839.370 839.400

    839.010 839.040 839.070 839.100 839.130 839.160 839.190 Channels

    838.800 838.830 838.860 838.890 838.920 838.950 838.980

    838.590 838.620 838.650 838.680 838.710 838.740 838.770

    838.380 838.410 838.440 838.470 838.500 838.530 838.560

    838.170 838.200 838.230 838.260 838.290 838.320 838.350

    837.960 837.990 838.020 838.050 838.080 838.110 838.140

    837.750 837.780 837.810 837.840 837.870 837.900 837.930

    837.540 837.570 837.600 837.630 837.660 837.690 837.720

    837.330 837.360 837.390 837.420 837.450 837.480 837.510

    837.120 837.150 837.180 837.210 837.240 837.270 837.300

    836.910 836.940 836.970 837.000 837.030 837.060 837.090

    836.700 836.730 836.760 836.790 836.820 836.850 836.880

    836.490 836.520 836.550 836.580 836.610 836.640 836.670

    836.280 836.310 836.340 836.370 836.400 836.430 836.460

    836.070 836.100 836.130 836.160 836.190 836.220 836.250

    835.860 835.890 835.920 835.950 835.980 836.010 836.040

    835.650 835.680 835.710 835.740 835.770 835.800 835.830

    -------------------------------------------------------------------

    835.440 835.470 835.500 835.530 835.560 835.590 835.620 ¿Digital

    835.230 835.260 835.290 835.320 835.350 835.380 835.410 Control

    835.020 835.050 835.080 835.110 835.140 835.170 835.200 Channels

     

    ===============================================================================

     

    Non-wireline company cell frequencies (BAND A)

     

    CELL A CELL B CELL C CELL D CELL E CELL F CELL G

    ======= ======= ======= ======= ======= ======= =======

    879.900 879.930 879.960 879.990 ¿Digital

    879.690 879.720 879.750 879.780 879.810 879.840 879.870 Control

    879.480 879.510 879.540 879.570 879.600 879.630 879.660 Channels

    ------------------------------------- 879.390 879.420 879.450

    879.270 879.300 879.330 879.360 --------------------------- ¿

    879.060 879.090 879.120 879.150 879.180 879.210 879.240

    878.850 878.880 878.910 878.940 878.970 879.000 879.030

    878.640 878.670 878.700 878.730 878.760 878.790 878.820

    878.430 878.460 878.490 878.520 878.550 878.580 878.610

    878.220 878.250 878.280 878.310 878.340 878.370 878.400

    878.010 878.040 878.070 878.100 878.130 878.160 878.190

    877.800 877.830 877.860 877.890 877.920 877.950 877.980

    877.590 877.620 877.650 877.680 877.710 877.740 877.770

    877.380 877.410 877.440 877.470 877.500 877.530 877.560

    877.170 877.200 877.230 877.260 877.290 877.320 877.350

    876.960 876.990 877.020 877.050 877.080 877.110 877.140

    876.750 876.780 876.810 876.840 876.870 876.900 876.930

    876.540 876.570 876.600 876.630 876.660 876.690 876.720

    876.330 876.360 876.390 876.420 876.450 876.480 876.510

    876.120 876.150 876.180 876.210 876.240 876.270 876.300

    875.910 875.940 875.970 876.000 876.030 876.060 876.090

    875.700 875.730 875.760 875.790 875.820 875.850 875.880 Voice

    875.490 875.520 875.550 875.580 875.610 875.640 875.670

    875.280 875.310 875.340 875.370 875.400 875.430 875.460

    875.070 875.100 875.130 875.160 875.190 875.220 875.250

    874.860 874.890 874.920 874.950 874.980 875.010 875.040

    874.650 874.680 874.710 874.740 874.770 874.800 874.830

    874.440 874.470 874.500 874.530 874.560 874.590 874.620

    874.230 874.260 874.290 874.320 874.350 874.380 874.410

    874.020 874.050 874.080 874.110 874.140 874.170 874.200

    873.810 873.840 873.870 873.900 873.930 873.960 873.990

    873.600 873.630 873.660 873.690 873.720 873.750 873.780

    873.390 873.420 873.450 873.480 873.510 873.540 873.570 Channels

    873.180 873.210 873.240 873.270 873.300 873.330 873.360

    872.970 873.000 873.030 873.060 873.090 873.120 873.150

    872.760 872.790 872.820 872.850 872.880 872.910 872.940

    872.550 872.580 872.610 872.640 872.670 872.700 872.730

    872.340 872.370 872.400 872.430 872.460 872.490 872.520

    872.130 872.160 872.190 872.220 872.250 872.280 872.310

    871.920 871.950 871.980 872.010 872.040 872.070 872.100

    871.710 871.740 871.770 871.800 871.830 871.860 871.890

    871.500 871.530 871.560 871.590 871.620 871.650 871.680

    871.290 871.320 871.350 871.380 871.410 871.440 871.470

    871.080 871.110 871.140 871.170 871.200 871.230 871.260

    870.870 870.900 870.930 870.960 870.990 871.020 871.050

    870.660 870.690 870.720 870.750 870.780 870.810 870.840

    870.450 870.480 870.510 870.540 870.570 870.600 870.630

    870.240 870.270 870.300 870.330 870.360 870.390 870.420

    870.030 870.060 870.090 870.120 870.150 870.180 870.210

     

    Non-wireline company mobile frequencies (BAND A)

     

    CELL A CELL B CELL C CELL D CELL E CELL F CELL G

    ======= ======= ======= ======= ======= ======= =======

    834.900 834.930 834.960 834.990 ¿Digital

    834.690 834.720 834.750 834.780 834.810 834.840 834.870 Control

    834.480 834.510 834.540 834.570 834.600 834.630 834.660 Channels

    ------------------------------------- 834.390 834.420 834.450

    834.270 834.300 834.330 834.360 --------------------------- ¿

    834.060 834.090 834.120 834.150 834.180 834.210 834.240

    833.850 833.880 833.910 833.940 833.970 834.000 834.030

    833.640 833.670 833.700 833.730 833.760 833.790 833.820

    833.430 833.460 833.490 833.520 833.550 833.580 833.610

    833.220 833.250 833.280 833.310 833.340 833.370 833.400

    833.010 833.040 833.070 833.100 833.130 833.160 833.190

    832.800 832.830 832.860 832.890 832.920 832.950 832.980

    832.590 832.620 832.650 832.680 832.710 832.740 832.770

    832.380 832.410 832.440 832.470 832.500 832.530 832.560

    832.170 832.200 832.230 832.260 832.290 832.320 832.350

    831.960 831.990 832.020 832.050 832.080 832.110 832.140

    831.750 831.780 831.810 831.840 831.870 831.900 831.930

    831.540 831.570 831.600 831.630 831.660 831.690 831.720

    831.330 831.360 831.390 831.420 831.450 831.480 831.510

    831.120 831.150 831.180 831.210 831.240 831.270 831.300

    830.910 830.940 830.970 831.000 831.030 831.060 831.090

    830.700 830.730 830.760 830.790 830.820 830.850 830.880 Voice

    830.490 830.520 830.550 830.580 830.610 830.640 830.670

    830.280 830.310 830.340 830.370 830.400 830.430 830.460

    830.070 830.100 830.130 830.160 830.190 830.220 830.250

    829.860 829.890 829.920 829.950 829.980 830.010 830.040

    829.650 829.680 829.710 829.740 829.770 829.800 829.830

    829.440 829.470 829.500 829.530 829.560 829.590 829.620

    829.230 829.260 829.290 829.320 829.350 829.380 829.410

    829.020 829.050 829.080 829.110 829.140 829.170 829.200

    828.810 828.840 828.870 828.900 828.930 828.960 828.990

    828.600 828.630 828.660 828.690 828.720 828.750 828.780

    828.390 828.420 828.450 828.480 828.510 828.540 828.570 Channels

    828.180 828.210 828.240 828.270 828.300 828.330 828.360

    827.970 828.000 828.030 828.060 828.090 828.120 828.150

    827.760 827.790 827.820 827.850 827.880 827.910 827.940

    827.550 827.580 827.610 827.640 827.670 827.700 827.730

    827.340 827.370 827.400 827.430 827.460 827.490 827.520

    827.130 827.160 827.190 827.220 827.250 827.280 827.310

    826.920 826.950 826.980 827.010 827.040 827.070 827.100

    826.710 826.740 826.770 826.800 826.830 826.860 826.890

    826.500 826.530 826.560 826.590 826.620 826.650 826.680

    826.290 826.320 826.350 826.380 826.410 826.440 826.470

    826.080 826.110 826.140 826.170 826.200 826.230 826.260

    825.870 825.900 825.930 825.960 825.990 826.020 826.050

    825.660 825.690 825.720 825.750 825.780 825.810 825.840

    825.450 825.480 825.510 825.540 825.570 825.600 825.630

    825.240 825.270 825.300 825.330 825.360 825.390 825.420

    825.030 825.060 825.090 825.120 825.150 825.180 825.210

     

    Monitoring of the base sites is obviously going to be easier than

    monitoring the mobiles. The cell base sites are towers (usually blue) with a

    triangle shaped "head" on top, and sporting a couple of what appear to be

    vertical antennas. These base sites have a range of 3-5 miles. If you take a

    look at the honeycomb diagram, you can see how they are laid out. The cell

    transmitter is in the middle of the cell. It is possible to hear many, most,

    or all of the cells in your city, depending on your location. The closer you

    live to a boundary, the greater the chances of your being able to receive more

    cells. Due to the nature of radio signals, the actual cell shape is more or

    less round. However, the hexagon shape lends itself better to show how the

    system is laid out. With a circular coverage area, there will be some

    overlapping between adjacent cells.

     

    __ __

    \__/C \__/D \__

    \__/G \__/A \__/

    _/D \__/E \__/F \__

    \__/B \__*C \__/

    _/F \__/G \__/A \__

    \__/D \__/E \__/

    _/A \__/B \__/C \__

    \__/ \__/ \__/

     

    If, for example, you live near the asterisk (*) in the above diagram, you

    will be able go easily hear the G, C, E, and A cells you're near. Since the

    maximum _practical_ range of a cell is 3-5 miles, you'll be able to hear them

    a bit farther away. However, due to the nature of the FM transceivers at the

    cell sites (they capture only the _strongest_ signal), you should be able to

    hear all seven cells. Which _one_ of each cell you hear will depend on your

    location and the strength of the received signal. In the above diagram,

    you'll most likely hear the F cell in the upper right, rather than the one on

    the left.

     

    Mobile reception is almost a waste of time unless you have an outdoor

    antenna. And, since the mobile will be repeated on the cell site, it's better

    to listen to the cell frequencies. You may not be able to hear both sides of

    the conversation if you listen only to the mobile frequencies!!! It is useful,

    however, for determining which channel cell you're in. If you use the antenna

    that came with the scanner, mobile range will be decreased down to 1 or 2

    miles. By checking the scanner readout against the cell list above

    (825.030-844.980 MHz), you can tell what cell the mobile is in. This is also

    useful on the cell site frequencies. If you hear someone say, "I'm at the

    corner of highway FF and 37," and you know where the cell site antenna is in

    that area, you can check the frequency listing above and determine what cell

    that antenna belongs to.

    *******************************************************************************

     

    Where to get What you NEED!

     

    Obviously, a device is needed to download all those ESN/MINs etc.

    off the cellular airwaves. Heres the stuff I found so far that

    is under $2000 (This ain't a cheap hobby)

     

    CCS Company, P.O. Box 11191, Milwaukee, WI 53211 (Mark 414-781-2482)

    They sell everything ya need for $3-400. Kits are cheaper. Their

    device interfaces between a 800 mhz capable scanner & your computer.

    Make sure you tell them you want the REVERSE model DDI. (this tis

    what I use)

     

    Curtis Electro Devices, 1235 Pear Ave, Mountain View,CA 94043

    800-332-2790 Fax 415-964-3574

    They sell an ESN reader for $1295 that can read ESN\MIN\etc. but

    only from a short distance (Max= 30 ft.) They also sell a security

    model for $1595 and a nam programmer for $1195. They publish a

    book called NAMFAX for $179 that tells ya how to re-program

    hundreds of different cellulars through the keypad on the handset.

    (Note-You can't reprogram ESNs through the keypap unless you re-write

    the phones software.)

     

    Wavetek Communications Div., 5808 Churchman Bypass, Indianapolis,

    IN 46203-6109, 800-245-6356 or 317-788-5965

    They sell a "Cellular I.D. Tester" thats real similiar to Curtis's

    ESN reader but supposedly has a longer range. price= $1495.

     

    Needham Electronics, 4539 Orange Grove Ave., Sacramento, CA 95841

    916-924-8037

    They sell eprom burners for $139.95 (I bought one myself)

     

    Motorola, 1-800-433-5202

    They sell a Cellular service manual thats used in their cellular

    service classes for $30. Ask for the Order Fullfillment dept:

    Item # 68-093-00a60.

    This manual tells it all! An absolute must to have.

     

    (Remember-ya can use your credit card for many items! hehe)

     

    Bishop Co: 800-829-0572

    They publish books similiar to Curtis's Namfax. send for catalog

     

    ******************************************************************

     

    Cellular Security

     

    Well we know a properly cloned cell phone is virtually impossible

    to detect- or is it? Security companies rely on matching call

    patterns of subscribers historys to current use. I.E. when 200

    calls to Bum Fuck Egypt show up in a day or 80 long distance

    calls to Culman Alabama show up in a short period, all kinds

    of Flags & whistles go off! The security companies will even

    keep records of people that call numbers that have been previously

    called by Tumbled phones & flag the phone calling that number as

    a potential fraudulent phone. These flags can be set go go off

    by a number of parameters: Number of LD calls per Hr/Day/mo, etc.

    Another method they use is when the real phone places a call & the

    Tumbled phone places another call soon afterwards, but from a

    distance from the 1st call thats impossible to travel in such a

    short period of time. I.E. At 5 P.M. friday phone A calls from

    Manhatten & completes call at 5.10 p.m. At 5.12 P.M. Cloned phone

    B calls from Queens. No-one can travel those distances in 2 minutes,

    thus that ESN/MIN is tagged as a Clone by the phone company. These

    databases are just now starting to be used in larger cities.

    Some software will track a flagged cell phone from cell site to

    cell site.

    Commonly used discrepancies cell co software looks for are

    different ESNs, Manufacturer, model, SCMs, etc. that are broadcast

    by the cellular phone on its REVERSE channel. (If one captures

    all that data off the Reverse channel & incorporates it in the

    CLONED phone, detection via this method becomes nearly impossible.)

     

    Some daring souls have been known to use fake ID & Cards to even

    subscribe to a cellular service, then burn out the phone before

    the first months bill arrives to the unsuspecting real person.

     

    ****************************************************************************

     

    Conclusion

     

    The future for cellular fraud is wide open. As the secret software

    of the over 300 brands of cellular phones in existance becomes

    "Cracked" and re-written and spread via the underground, Fraud

    will increase like Wildfire. Virtually nothing can be done to

    stop the informed phone phreak as he will change ESN/MINs, etc.

    easily and frequently. A new era not seen since the 2600 hz

    tone was discovered is just now dawning via cellular phreaking.

     

    Nuff Said,

    Bootleg

     

    P.S. Since I'm lettin the cat out of the bag for the 1st time

    here, I hereby dub the box needed to read REVERSE channels

    the BOO Box! (Shit- after 12 years I finally get to name

    a box.) hehe

     

     

     

     

    ===============================================================================

     

    The Electronic Communications Privacy Act of 1986 and CMT

     

    ===============================================================================

     

    The ECPA, passed in 1986, is partly responsible for the extreme interest

    in CMT monitoring. After all, if you tell someone they can't listen to these

    phone calls, they'll immediately want to do so. "There must be _something_

    going on there that's either interesting or important. Why else would they

    want to keep us from listening?" seems to be the predominant reaction.

     

    Be assured that it is illegal under the ECPA to listen to cellular phone

    calls. This law was passed mainly to satisfy the CMT manufacturers. They can

    now tell their customers that their conversations are 'protected by federal

    law.' However, when this law was drawn up, it was obviously felt to be too

    narrow in its views, since it protected only one service. So it was amended

    to include various services, such as microwaves, some satellites, broadcast

    STL links (studio-transmitter links), and the descrambling of scrambled

    signals.

     

    However, from the very beginning, the government has shown an extremely

    bored attitude when it comes to the ECPA. There is virtually no attempt at

    enforcement, unless it's a case involving blackmail, or an overt attempt is

    being made to provide radios with CMT-specific frequencies. In the latter

    case, a dealer was modifying the radios he was selling. After a government

    visit, he agreed not to modify the radios, but he was allowed to include

    instructions on how to make the modification. With the Pro-2005 and Pro-2006,

    this consists of opening the radio and clipping one diode, an operation that

    takes all of 15 minutes, including disassembly.

     

    What does all this mean? You can receive any frequency you wish. There

    is literally no way to tell what you're listening to in the privacy of your

    home. Your scanner (as well as EVERY radio) _does_ transmit an extremely

    small amount of RF energy from the local oscillator, but unless the radio is

    in very bad shape, that energy won't go past 40 or 50 feet. The "gummint"

    would have to drive around in detection vans with beam antennas, and with

    100,000 scanner owners, it's an extremely good bet that they're not even going

    to consider thinking about the merest possibility that someone might put this

    idea forward to be comtemplated. They've got more important stuff to worry

    about. What it comes down to is this: listen to whatever you want to, but

    don't divulge it or use the information for personal or illegal gain. That

    will get you into deep doo-doo in double-quick time.

     

    Most people have the opinion that if it's unscrambled, and it's passing

    freely through their home and body, that they have the right to receive it.

    This sounds like good solid thinking. The laws of this land provide for just

    compensation to individuals. Perhaps a few bills to CMT companies for

    transmission rights would help to remove this silly law from the books.

     

    ===============================================================================

     

    The Electronic Communications Privacy Act of 1986

     

    ===============================================================================

     

    February 2, 1987

     

     

    TITLE 18 - CRIMES AND CRIMINAL PROCEDURE

     

    PART I. CRIMES

     

    Chapter Sec.

    * * *

    General provisions............................................. 1

    * * *

    119. Wire and electronic communications interception and

    interception of oral communications................. 2510

    * * *

    121. Stored Wire and Electronic Communications and Transactional

    Records Access...................................... 2701

    * * *

     

     

    PART II. CRIMINAL PROCEDURE

     

    201. General provisions.................................. 3001

    * * *

    206. Pen Registers and Trap and Trace Devices............ 3121

    * * *

     

     

    CHAPTER 65 - MALICIOUS MISCHIEF

     

    Sec.

    * * *

    1367. Interference with the operation of a satellite.

    * * *

     

    { 1367. Interference with the operation of a satellite

     

    (a) Whoever, without the authority of the satellite operator,

    intentionally or maliciously interferes with the authorized operation of a

    communications or weather satellite or obstructs or hinders any satellite

    transmission shall be fined in accordance with this title or imprisoned not

    more than ten years of both.

     

    (b) This section does not prohibit any lawfully authorized

    investigative, protective, or intelligence activity of a law enforcement

    agency or of an intelligence agency of the United States.

     

    * * *

    CHAPTER 109 - SEARCHES AND SEIZURES

    * * *

     

    { 2232. Destruction or removal of property to prevent seizure

     

    (a) Physical Interference With Search. -- Whoever, before, during, or

    after seizure of any property by any person authorized to make searches and

    seizures, in order to prevent the seizure or securing of any goods, wares,

    or merchandise by such person, staves, breaks, throws overboard, destroys,

    or removes the same, shall be fined not more than $10,000 or imprisoned more

    than five years, or both.

     

    (b) Notice of Search. -- Whoever, having knowledge that any person

    authorized to make searches and seizures has been authorized or is otherwise

    likely to make a search or seizure, in order to prevent the authorized

    seizing or securing of any per- son, goods, wares, merchandise or other

    property, gives notice or attempts to give notice of the possible search or

    seizure to any person shall be fined not more than $100,000 or imprisoned

    not more than five years, or both.

     

    (c) Notice of Certain Electronic Surveillance. -- Whoever, having

    knowledge that a Federal investigative or law enforcement officer has been

    authorized or has applied for authorization under chapter 119 to intercept a

    wire, oral, or electronic communication, in order to obstruct, impede, or

    prevent such interception, gives notice or attempts to give notice of the

    possible interception to any person shall be fined under this title or

    imprisoned not more than five years, or both.

     

    Whoever, having knowledge that a Federal officer has been

    authorized or has applied for authorization to conduct electronic

    surveillance under the Foreign Intelligence Surveillance Act (50 U.S.C.

    1801, et seq.), in order to obstruct, impede, or prevent such activity,

    gives notice or attempts to give notice of the possible activity to any

    person shall be fined under this title or imprisoned not more than five

    years, or both.

     

    * * *

     

    CHAPTER 119 -- WIRE AND ELECTRONIC COMMUNICATIONS

    INTERCEPTION AND INTERCEPTION OF ORAL COMMUNICATIONS

     

    Sec.

    2510. Definitions.

     

    2511. Interception and disclosure of wire or oral communications

    prohibited.

     

    2512. Manufacture, distribution, possession, and advertising of

    wire or oral communication intercepting devices

    prohibited.

     

    2513. Confiscation of wire, oral, or electronic communication

    intercepting devices.

     

    2514. Immunity of witnesses.

     

    2515. Prohibition of use as evidence of intercepted wire, oral,

    or electronic communications.

     

    2516. Authorization for interception of wire, oral, or electronic

    communications.

     

    2517. Authorization for disclosure and use of intercepted wire,

    oral, or electronic communications.

     

    2518. Procedure for interception of wire, oral, or electronic

    communications.

     

    2519. Reports concerning intercepted wire, oral or electronic

    communications.

     

    2520. Recovery of civil damages authorized.

     

    2521. Injunction against illegal interception.

     

     

    { 2510. Definitions

     

    As used in this chapter --

     

    (1) "wire communication" means any aural transfer made in whole

    or in part through the use of facilities for the transmission of

    communications by the aid of wire, cable, or other like connection

    between the point of origin and the point of reception (including the

    use of such connection in a switching station) furnished or operated by

    any person engaged in providing or operating such facilities for the

    transmission of interstate or foreign communications or communications

    affecting interstate or foreign commerce and such term includes any

    electronic storage of such communication, but such term does not

    include the radio portion of a cordless telephone communication that is

    transmitted between the cordless telephone handset and the base unit;

     

    (2) "oral communication" means any oral communication uttered by

    a person exhibiting an expectation that such communication is not

    subject to interception under circumstances justifying such

    expectation, but such term does not include any electronic

    communication;

     

    * * *

     

    (4) "intercept" means the aural or other acquisition of the

    contents of any wire, electronic, or oral communication through the use

    of any electronic, mechanical, or other device.

     

    (5) "electronic mechanical, or other device" means any device or

    apparatus which can be used to intercept a wire, oral, or electronic

    communication other than --

     

     

    (a) any telephone or telegraph instrument, equipment or

    facility, or any component thereof, (i) furnished to the

    subscriber or user by a provider of wire or electronic

    communication service in the ordinary course of its business and

    being used by the subscriber or user in the ordinary course of its

    business or furnished by such subscriber or user for connection to

    the facilities of such service and used in the ordinary course of

    its business; or (ii) being used by a communications common

    carrier in the ordinary course of its business, or by an

    investigative or law enforcement officer in the ordinary course of

    his duties;

     

    * * *

     

    (8) "contents", when used with respect to any wire, oral, or

    electronic communication, includes any information concerning the

    substance, purport, or meaning of that communication;

     

    (9) "Judge of competent jurisdiction" means --

     

    (a) a judge of a United States district court or a United

    States court of appeals; and

     

    (b) a judge of any court of general criminal jurisdiction of

    a State who is authorized by a statute of that State to enter

    orders authorizing interceptions of wire, oral, or electronic

    communications;

     

    (10) "communication common carrier" shall have the same meaning

    which is given the term "common carrier" by section 153(h) of title 47

    of the United States Code;

     

    (11) "aggrieved person" means a person who was a party to any

    intercepted wire, oral, or electronic communication or a person against

    whom the interception was directed;

     

    (12) "electronic communication" means any transfer of signs,

    signals, writing, images, sounds, data, or intelligence of any nature

    transmitted in whole or in part by a wire, radio, electromagnetic,

    photoelectronic or photo optical system that affects interstate or

    foreign commerce, but does not include --

     

    (A) the radio portion of a cordless telephone communication

    that is transmitted between the cordless telephone handset and the

    base unit;

     

    (B) any wire or oral communication;

     

    (C) any communication made through a tone-only paging

    device; or

     

    (D) any communication from a tracking device (as defined in

    section 3117 of this title);

     

    (13) "user" means any person or entity who --

     

    (A) uses an electronic communication service; and

     

    (B) is duly authorized by the provider of such service to

    engage in such use;

     

    (14) "electronic communications system" means any wire, radio,

    electromagnetic, photooptical or photoelectronic facilities for the

    transmission of electronic communications, and any computer facilities

    or related electronic equipment for the electronic storage of such

    communications;

     

    (15) "electronic communication service" means any service which

    provides to users thereof the ability to send or receive wire or

    electronic communications;

     

    (16) "readily accessible to the general public" means, with

    respect to a radio communication, that such communication is not --

     

    (A) scrambled or encrypted;

     

    (B) transmitted using modulation techniques whose essential

    parameters have been withheld from the public with the intention

    of preserving the privacy of such communication;

     

    (C) carried on a subcarrier or other signal subsidiary to a

    radio transmission;

     

    (D) transmitted over a communication system provided by a

    common carrier, unless the communication is a tone only paging

    system communication; or

     

    (E) transmitted on frequencies allocated under part 25,

    subpart D, E, or F of part 74, or part 94 of the Rules of the

    Federal Communications Commission, unless, in the case of a

    communication transmitted on a frequency allocated under part 74

    that is not exclusively allocated to broadcast auxiliary services,

    the communication is a two-way voice communication by radio;

     

     

    (17) "electronic storage" means --

     

    (A) any temporary, intermediate storage of a wire or

    electronic communication incidental to the electronic transmission

    thereof; and

     

    (B) any storage of such communication by an electronic

    communication service for purposes of backup protection of such

    communication; and

     

    (18) "aural transfer" means a transfer containing the human voice

    at any point between and including the point of origin and the point of

    reception.

     

     

    { 2511. Interception and disclosure of wire or oral

    communications prohibited

     

    (1) Except as otherwise specifically provided in this chapter any

    person who--

     

    (a) intentionally intercepts, endeavors to intercept, or procures

    any other person to intercept or endeavor to intercept, any wire, oral,

    or electronic communication;

     

    (b) intentionally uses, endeavors to use, or procures any other

    person to use or endeavor to use any electronic, mechanical, or other

    device to intercept any oral communication when --

     

    (i) such device is affixed to, or otherwise transmits a

    signal through, a wire, cable, or other like connection used in

    wire communication; or

     

    (ii) such device transmits communications by radio, or

    interferes with the transmission of such communication; or

     

    (iii) such person knows, or has reason to know, that such

    device or any component thereof has been sent through the mail or

    transported in interstate or foreign commerce; or

     

    (iv) such use or endeavor to use (A) takes place on the

    premises of any business or other commercial establishment the

    operations of which affect interstate or foreign commerce; or (B)

    obtains or is for the purpose of obtaining information relating to

    the operations of any business or other commercial establishment

    the operations of which affect interstate or foreign commerce; or

     

    (v) such person acts in the District of Columbia, the

    Commonwealth of Puerto Rico, or any territory or possession of the

    United States;

     

    (c) intentionally discloses, or endeavors to disclose, to any

    other person the contents of any wire, oral, or electronic

    communication, knowing or have reason to know that the information was

    obtained through the interception of a wire oral, or electronic

    communication in violation of this subsection; or

     

    (d) intentionally uses, or endeavors to use, the contents of any

    wire, oral, or electronic communication, knowing or having reason to

    know that the information was obtained through the interception of a

    wire, oral, or electronic communication in violation of this

    subsection; shall be punished as provided in subsection (4) or shall be

    subject to suit as provided in subsection (5).

     

    (2)(a)(i) It shall not be unlawful under this chapter for an operator

    of a switchboard, or an officer, employee, or agent of a provider of wire or

    electronic communication service, whose facilities are used in the

    transmission of a wire communication, to intercept, disclose, or use that

    communication in the normal course of his employment while engaged in any

    activity which is a necessary incident to the rendition of his service or to

    the protection of the rights or property of the provider of that service,

    except that a provider of wire communication service to the public shall not

    utilize service observing or random monitoring except for mechanical or

    service quality control checks.

     

    (ii) Notwithstanding any other law, providers of wire or electronic

    communication service, their officers, employees, and agents, landlords,

    custodians, or other persons, are authorized to provide information

    facilities, or technical assistance to persons authorized by law to

    intercept wire, oral, or electronic communications or to conduct electronic

    surveillance, as defined in section 101 of the Foreign Intelligence

    Surveillance Act of 1978, if such provider its officers, employees, or

    agents, land- lord, custodian, or other specified person has been provided

    with --

     

    (A) a court order directing such assistance signed by the

    authorizing judge, or

     

    (B) a certification in writing by a person specified in section

    2518(7) of this title or the Attorney General of the United States that

    no warrant or court order is required by law, that all statutory

    requirements have been met, and that the specified assistance is

    required.

     

    setting forth the period of time during which the provision of the

    information, facilities, or technical assistance is authorized and

    specifying the information, facilities, or technical assistance required.

    No provider of wire or electronic communication service officer, employee,

    or agent thereof, or landlord, custodian, or other specified person shall

    disclose the existence of any interception or surveillance of the device

    used to accomplish the interception or surveillance with respect to which

    the person has been furnished an order or certification under this

    subparagraph, except as may otherwise be required by legal process and then

    only after prior notification to the Attorney General or to the principal

    prosecuting attorney of a State or any political subdivision of a State, as

    may be appropriate. Any such disclosure, shall render such person liable

    for the civil damages provided for in section 2520. No cause of action

    shall lie in any court against any provider of wire or electronic

    communication service its officers, employees, or agents, landlord,

    custodian, or other specified person for providing information, facilities,

    or assistance in accordance with the terms of a court order or certification

    under this chapter.

     

    (b) It shall not be unlawful under this chapter for an officer,

    employee, or agent of the Federal Communications Commission, in the normal

    course of his employment and in discharge of the monitoring responsibilities

    exercised by the Commission in the enforcement of chapter 5 of title 57 of

    the United States Code, to intercept a wire or electronic communication, or

    oral communication transmitted by radio, or to disclose or use the

    information thereby obtained.

     

    (c) It shall not be unlawful under this chapter for a person acting

    under color of law to intercept a wire, oral, or electronic communication,

    where such person is a party to the communication or one of the parties to

    the communication has given prior consent to such interception.

     

    (d) It shall not be unlawful under this chapter for a person not

    acting under color of law to intercept a wire, oral, or electronic

    communication where such person is a party to the communication or where one

    of the parties to the communication has given prior consent to such

    interception unless such communication is intercepted for the purpose of

    committing any criminal or tortious act in violation of the Constitution or

    laws of the United States or of any State.

     

    (e) Notwithstanding any other provision of this title or section 705

    or 706 of the Communications Act of 1934, it shall not be unlawful for an

    office, employee, or agent of the United States in the normal course of his

    official duty to conduct electronic surveillance, as defined in section 101

    of the Foreign Intelligence Surveillance Act of 1978, as authorized by that

    Act.

     

     

    (f) Nothing contained in this chapter or chapter 121, or section 705

    of the Communications Act of 1934, shall be deemed to affect the acquisition

    by the United States Government of foreign intelligence information from

    international or foreign communication, or foreign intelligence activities

    conducted in accordance with otherwise applicable Federal law involving a

    foreign electronic communications system, utilizing a means other than

    electronic surveillance as defined in section 101 of the Foreign

    Intelligence Surveillance Act of 1978, and procedures in this chapter and

    the Foreign Intelligence Surveillance Act of 1978 shall be the exclusive

    means by which electronic surveillance, as defined in section 101 of such

    Act, and the interception of domestic wire and oral communications may be

    conducted.

     

    (g) It shall not be unlawful under this chapter or chapter 121 of this

    title for any person --

     

    (i) to intercept or access an electronic communication made

    through an electronic communication system that is configured so that

    such electronic communication is readily accessible to the general

    public;

     

    (ii) to intercept any radio communication which is transmitted --

     

    (I) by any station for the use of the general public, or

    that relates to ships, aircraft, vehicles, or persons in distress;

     

    (II) by any governmental, law enforcement, civil defense

    private land mobile, or public safety communications system,

    including police and fire, readily accessible to the general

    public;

     

    (III) by a station operating on an authorized frequency

    within the bands allocated to the amateur, citizens band, or

    general mobile radio services; or

     

    (IV) by any marine or aeronautical communications system;

     

    (iii) to engage in any conduct which --

     

    (I) is prohibited by section 633 of the Communications Act

    of 1934; or

     

    (II) is excepted from the application of section 705(a) of

    the Communications Act of 1934 by section 705(b) of that Act;

     

    (iv) to intercept any wire or electronic communication the

    transmission of which is causing harmful interference to any lawfully

    operating station or consumer electronic equipment, to the extent

    necessary to identify the source of such interference; or

     

    (v) for other users of the same frequency to intercept any radio

    communication made through a system that utilizes frequencies monitored

    by individuals engaged in the provision or the use of such system, if

    such communication is not scrambled or encrypted.

     

    (h) It shall not be unlawful under this chapter --

     

    (i) to use a pen register or a trap and trace device (as those

    terms are defined for the purposes of chapter 206 (relating to pen

    registers and trap and trace devices) of this title); or

     

    (ii) for a provider of electronic communication service to record

    the fact that a wire or electronic communication was initiated or

    completed in order to protect such provider, another provider

    furnishing service toward the completion of the wire or electronic

    communication, or a user of that service, from fraudulent, unlawful or

    abusive use of such service.

     

    (3)(a) Except as provided in paragraph (b) of this subsection a

    person or entity providing an electronic communication service to the public

    shall not intentionally divulge the contents of any communication (other

    than one to such person or entity, or an agent thereof) while in

    transmission on that service to any person or entity other than an addressee

    or intended recipient of such communication or an agent of such addressee or

    intended recipient.

     

    (b) A person or entity providing electronic communication service to

    the public may divulge the contents of any such communication --

     

    (i) as otherwise authorized in section 2511(2)(a) or 2517 of this

    title;

     

    (ii) with the lawful consent of the originator or any addressee

    or intended recipient of such communication;

     

    (iii) to a person employed or authorized, or whose facilities are

    used, to forward such communication to its destination; or

     

    (iv) which were inadvertently obtained by the service provider

    and which appear to pertain to the commission of a crime, if such

    divulgence is made to a law enforcement agency.

     

    (4)(a) Except as provided in paragraph (b) of this subsection or in

    subsection (5), whoever violates subsection (1) of this section shall be

    fined under this title or imprisoned not more than five years, or both.

     

    (b) If the offense is a first offense under paragraph (a) of this

    subsection and is not for a tortious or illegal purpose or for purposes of

    direct or indirect commercial advantage or private commercial gain, and the

    wire or electronic communication with respect to which the offense under

    paragraph (a) is a radio communication that is not scrambled or encrypted,

    then --

     

    (i) If the communication is not the radio portion of a cellular

    telephone communication, a public land mobile radio service

    communication or a paging service communication, and the conduct is not

    that described in subsection (5), the offender shall be fined under

    this title or imprisoned not more than one year, or both, and

     

    (ii) if the communication is the radio portion of a cellular

    telephone communication, a public land mobile radio service

    communication or a paging service communication, the offender shall be

    fined not more than $500.

     

    (c) Conduct otherwise an offense under this subsection that consists

    of or relates to the interception of a satellite transmission that is not

    encrypted or scrambled and that is transmitted --

     

    (i) to a broadcasting station for purposes of retransmission to

    the general public; or

     

    (ii) as an audio subcarrier intended for redistribution to

    facilities open to the public, but not including data transmissions or

    telephone calls,

     

    is not an offense under this subsection unless the conduct is for the

    purposes of direct or indirect commercial advantage or private financial

    gain.

     

    (5)(a)(i) If the communication is --

     

    (A) a private satellite video communication that is not scrambled

    or encrypted and the conduct in violation of this chapter is the

    private viewing of that communication and is not for a tortious or

    illegal purpose or for purposes of direct or indirect commercial

    advantage or private commercial gain; or

     

    (B) a radio communication that is transmitted on frequencies

    allocated under subpart D of part 74 of the rules of the Federal

    Communications Commission that is not scrambled or encrypted and the

    conduct in violation of this chapter is not for a tortious or illegal

    purpose or for purposes of direct or indirect commercial advantage or

    private commercial gain.

     

    then the person who engages in such conduct shall be subject to suit by the

    Federal Government in a court of competent jurisdiction.

     

    (ii) In an action under this subsection --

     

    (A) if the violation of this chapter is a first offense for the

    person under paragraph (a) of subsection (4) and such person has not

    been found liable in a civil action under section 2520 of this title,

    the Federal Government shall be entitled to appropriate injunctive

    relief; and

     

    (B) if the violation of this chapter is a second or subsequent

    offense under paragraph (a) of subsection (4) or such person has been

    found liable in any prior civil action under section 2520, the person

    shall be subject to a mandatory $500 civil fine.

     

    (b) The court may use any means within its authority to enforce an

    injunction issued under paragraph (ii)(A), and shall impose a civil fine of

    not less than $500 for each violation of such an injunction,

     

     

    { 2512. Manufacture, distribution, possession, and advertising of wire

    or oral communication intercepting devices prohibited

     

    (1) Except as otherwise specifically provided in this chapter, any

    person who intentionally --

     

    (a) sends through the mail, or sends or carriers in interstate or

    foreign commerce, any electronic, mechanical, or other device, knowing

    or having reason to know that the design of such device renders it

    primarily useful for the purpose of the surreptitious interception of

    wire, oral, or electronic communications;

     

    (b) manufacturers, assembles, possesses, or sells any electronic,

    mechanical, or other device, knowing or having reason to know that the

    design of such device renders it primarily useful for the purpose of

    the surreptitious interception of wire, oral, or electronic

    communications, and that such device or any component thereof has been

    or will be sent through the mail or transported in interstate or

    foreign commerce; or

     

    (c) places in any newspaper, magazine, handbill, or other

    publication any advertisement of--

     

    (i) any electronic, mechanical, or other device knowing or

    having reason to know that the design of such device renders it

    primarily useful for the purpose of the surreptitious interception

    of wire, oral, or electronic communications; or

     

    (ii) any other electronic, mechanical, or other device, where

    such advertisement promotes the use of such device for the purpose

    of the surreptitious interception of wire, oral, or electronic

    communications,

     

    knowing or having reason to know that such advertisement will be sent

    through the mail or transported in interstate or foreign commerce,

     

    shall be fined not more than $10,000 or imprisoned not more than five years,

    or both.

     

    (2) It shall not be unlawful under this section for-

     

    (a) a provider of wire or electronic communication service or an

    officer, agent, or employee of, or a person under contract with, such a

    provider, in the normal course of the business of providing that wire

    or electronic communication service, or

     

    (b) an officer, agent, or employee of, or a person under contract

    with, the United States, a State, or a political subdivision thereof,

    in the normal course of the activities of the United States, a State,

    or a political subdivision thereof, to send through the mail, send or

    carry in interstate or foreign commerce, or manufacture, assemble,

    possess, or sell any electronic, mechanical, or other device knowing or

    having reason to know that the design of such device renders it

    primarily useful for the purpose of the surreptitious interception of

    wire, oral, or electronic communications.

     

    { 2513. Confiscation of wire, oral, or electronic communication

    intercepting devices

     

    Any electronic, mechanical, or other device used, sent, carried,

    manufactured, assembled, possessed, sold, or advertised in violation of

    section 2511 or section+ 2512 of this chapter may be seized and forfeited to

    the United States. All provisions of law relating to (1) the seizure,

    summary and judicial forfeiture, and condemnation of vessels, vehicles,

    merchandise, and baggage for violations of the customs laws contained in

    title 19 of the United States Code, (2) the disposition of such vessels, -

    vehicles, merchandise, and baggage or the proceeds from the sale thereof,

    (3) the remission or mitigation of such forfeiture, (4) the compromise of

    claims, and (5) the award of compensation to informers in respect of such

    forfeitures, shall apply to seizures and forfeitures incurred, or alleged to

    have been incurred, under the provisions of this section, insofar as

    applicable and not inconsistent with the provisions of this section; except

    that such duties as are imposed upon the collector of customs or any other

    person with respect to the seizure and forfeiture of vessels, vehicles,

    merchandise, and baggage under the provisions of the customs laws contained

    in title 19 of the United States Code shall be performed with respect to

    seizure and forfeiture of electronic, mechanical, or other intercepting

    devices under this section by such officers, agents, or other persons as may

    be authorized or designated for that purpose of the Attorney General.

     

    { 2515. Prohibition of use as evidence of intercepted wire, oral, or

    electronic communications

     

    Whenever any wire, oral, or electronic communications has been

    intercepted, no part of the contents of such communication and no evidence

    derived therefrom may be received in evidence in any trial, hearing, or

    other proceeding in or before any court, grand jury, department, officer,

    agency, regulatory body, legislative committee, or other authority of the

    United States, a State, or a political subdivision thereof if the disclosure

    of that information would be in violation of this chapter.

     

     

    { 2516. Authorization for interception of wire, oral, or electronic

    communications

     

    (1) The Attorney General, Deputy Attorney General, Associate Attorney

    General, any Assistant Attorney General, any acting Assistant Attorney

    General, or any Deputy Assistant Attorney General in the Criminal Division

    specially designated by the Attorney General, may authorize an application

    to a Federal judge of competent jurisdiction for, and such judge may grant

    in conformity with section 2518 of this chapter an order authorizing or

    approving the interception of wire of oral communications by the Federal

    Bureau of Investigation, or a Federal agency having responsibility for the

    investigation of the offense as to which the application is made, when such

    interception may provide or has provided evidence of-

     

    (a) any offense punishable by death or by imprisonment for more

    than one year under sections 2274 through 2277 of title 42 of the

    United States Code (relating to the enforcement of the Atomic Energy

    Act of 1954), section 2284 of title 42 of the United States Code

    (relating to sabotage of nuclear facilities or fuel), or under the

    following chapters of this title: chapter 37 (relating to espionage),

    chapter 105 (relating to sabotage), chapter 115 (relating to treason),

    chapter 192 (relating to riots), chapter 65 (relating to malicious

    matter mischief), chapter 111 (relating to destruction of vessels), or

    chapter 81 (relating to piracy);

     

    (b) a violation of section 186 or section 501(c) of title 29,

    United States Code (dealing with restrictions on payments and loans to

    labor organizations), or any offense which involves murders,

    kidnapping, robbery, or extortion, and which is punishable under this

    title;

     

    c) any offense which is punishable under the following section

    of this title: section 201 (bribery of public officials and

    witnesses), section 224 (bribery in sporting contests), subsection (d),

    (e), (f), (g), (h), or (i) of section 844 (unlawful use of explosives),

    section 1084 (transmission of wagering information), section 751

    (relating to escape), sections 1503, 1512, and 1513 (influencing or

    injuring an officer, juror, or witness generally), section 1510

    (obstruction of criminal investigations), section 1511 (obstruction of

    State or local law enforcement), section 1751 (Presidential and

    Presidential staff assassination, kidnapping, and assault), section

    1951 (interference with commerce by threats or violence), section 1952

    (interstate and foreign travel or transportation in aid of racketeering

    enterprises), section 1952A (relating to use of interstate commerce

    facilities in the commission of murder for hire), section 1952B

    (relating to violent crimes in aid of racketeering activity), section

    1954 (offer acceptance, or solicitation to influence operations of

    employee benefit plan), section 1955 (prohibition of business

    enterprises of gambling), section 659 (theft from interstate shipment),

    section 664 (embezzlement from pension and welfare funds), section 1343

    (fraud by wire, radio, or television), section 2252 or 2253 (sexual

    exploitation of children), Section 2251 and 2252 (sexual exploitation

    of children), section 2312, 2313, 2314, and 2315 (interstate

    transportation of stolen property), the second section 2320 (relating

    to trafficking in certain motor vehicles or motor vehicle parts),

    section 1203 (relating to hostage taking), section 1029 (relating to

    fraud and related activity in connection with access devices), section

    3146 (relating to penalty for failure to appear), section 3521(b)(3)

    (relating to witness relocation and assistance), section 32 (relating

    to destruction of aircraft or aircraft facilities), section 1963

    violations with respect to racketeer influenced and corrupt

    organizations), section 115 (relating to threatening or retaliating

    against a Federal official), the section in chapter 65 relating to

    destruction of an energy facility, and section 1341 (relating to mail

    fraud), section 351 (violations with respect to congressional, Cabinet,

    or Supreme Court assassination, kidnapping, and assault), section 831

    (relating to prohibited transaction involving nuclear materials),

    section 33 (relating to destruction of motor vehicles or motor vehicle

    facilities), or section 1992 (relating to wrecking trains);

     

    (d) any offense involving counterfeiting punishable under section

    471, 472, or 473 of this title;

     

    (e) any offense involving fraud connected with a case under title

    11 or the manufacture, importation, receiving, concealment, buying,

    selling, or otherwise dealing in narcotic drugs, marijuana, or other

    dangerous drugs, punishable under any law of the United States;

     

    (f) any offense including extortionate credit transactions under

    sections 892, 893, or 894 of this title;

     

    (g) a violation of section 5322 of title 31, United States Code

    (dealing with the reporting of currency transactions);

     

    (h) any felony violation of sections 511 and 2512 (relating to

    interception and disclosure of certain communications and to certain

    intercepting devices) of this title;

     

    (i) any violation of section 1679(c)(2) (relating to destruction

    of a natural gas pipeline) or subsection (i) or (n) of the United

    States Code;

     

    (j) any criminal violation of section 2778 of title 22 (relating

    to the Arms Export Control Act); or

     

    (k) the location of any fugitive from justice from an offense

    described in this section; or

     

    (l) any conspiracy to commit any of the foregoing offenses.

     

    (2) The principal prosecuting attorney of any State, or the principal

    prosecuting attorney of any political subdivision thereof, if such attorney

    is authorized by a statute of that State to make application to a State

    court judge of competent jurisdiction for an order authorizing or approving

    the interception of wire, oral, or electronic communications, may apply to

    such judge for, and such judge may grant in conformity with section 2518 of

    this chapter and with the applicable State statute an order authorizing, or

    approving the interception of wire, oral, or electronic communications by

    investigative or law enforcement of officers having responsibility for the

    investigation of the offense as to which the application is made, when such

    interception may provide or has provided evidence of the commission of the

    offense of murder, kidnapping, gambling, robbery, bribery, extortion, or

    dealing in narcotic drugs, marijuana or other dangerous drugs, or other

    crime dangerous to life, limb, or property, and punishable by imprisonment

    for more than one year, designated in any applicable State statute

    authorizing such interception, or any conspiracy to commit any of the

    foregoing offenses.

     

    (3) Any attorney for the Government (as such term is defined for the

    purposes of the Federal Rules of Criminal Procedure) may authorize an

    application to a Federal judge of competent jurisdiction for, and such judge

    may grant, in conformity with section 2518 of this title, an order

    authorizing or approving the interception of electronic communications by an

    investigative or law enforcement officer having responsibility for the

    investigation of the offense s to which the application is made, when such

    interception may provide or has provided evidence of any Federal felony.

     

    { 2517. Authorization for disclosure and use of intercepted

    wire, oral, or electronic communication

     

    (1) Any investigative or law enforcement officer who, by any means

    authorized by this chapter, has obtained knowledge of the contents of any

    wire, oral, or electronic communication, or evidence derived therefrom may

    disclose such contents to another investigative or law enforcement officer

    to the extent that such disclosure is appropriate to the proper performance

    of the official duties of the officer making or receiving the disclosure.

     

    (2) Any investigative or law enforcement officer who, by an means

    authorized by this chapter, has obtained knowledge of the contents of any

    wire, oral, or electronic communication or evidence derived therefrom any

    use such contents to the extent such use is appropriate to the proper

    performance of his official duties.

     

    (3) Any person who has received, by any means authorized by this

    chapter, any information concerning a wire, oral, or electronic

    communication, or evidence derived therefrom intercepted in accordance with

    the provisions of this chapter may disclose the contents of that

    communication or such derivative evidence while giving testimony under oath

    or affirmation in any proceeding held under the authority of the United

    States of of any State or political subdivision thereof.

     

    (4) No otherwise privileged wire, oral, or electronic communication

    intercepted in accordance with, or in violation of, the provisions of this

    chapter shall lose its privileged character.

     

    (5) When an investigative or law enforcement officer, while engaged in

    intercepting wire or oral communications in the manner authorized herein,

    intercepts wire, oral, or electronic communications relating to offenses

    other than those specified in the order of authorization or approval, the

    contents thereof, and evidence derived therefrom, may be disclosed or used

    as provided in subsections (1) and (2) of this section. Such contents and

    any evidence derived therefrom may be used under subsection (3) of this

    section when authorized or approved by a judge of competent jurisdiction

    where such judge finds on subsequent application that the contents were

    otherwise intercepted in accordance with the provisions of this chapter.

    Such application shall be made as soon as practicable.

     

     

    { 2518. Procedure for interception of wire, oral, or electronic

    communications

     

    (1) Each application for an order authorizing or approving the

    interception of a wire, oral, or electronic communication under this chapter

    shall be made in writing upon oath or affirmation to a judge of competent

    jurisdiction and shall state the applicant's authority to make such

    application. Each application shall include the following information:

     

    (a) the identity of the investigative or law enforcement officer

    making the application, and the officer authorizing the application;

     

    (b) a full and complete statement of the facts and circumstances

    relied upon by the applicant, to justify his belief that an order

    should be issued, including (i) details as to the particular offense

    that has been, is being, or is about to be committed, (ii) except as

    provided in subsection (11), a particular description of the nature and

    location of the facilities from which or the place where the

    communication is to be intercepted, (iii) a particular description of

    the type of communications sought to be intercepted, (iv) the identity

    of the person, if known, committing the offense and whose

    communications are to be intercepted;

     

    (c) a full and complete statement as to whether or not other

    investigative procedures have been tried and failed or why they

    reasonably appear to be unlikely to succeed if tried or to be too

    dangerous;

     

    (d) a statement of the period of time for which the interception

    is required to be maintained. If the nature of the investigation is

    such that the authorization for interception should not automatically

    terminate when the described type of communication has been first

    obtained, a particular description of facts establishing probable cause

    to believe that additional communications of the same type will occur

    thereafter;

     

    (e) a full and complete statement of the facts concerning all

    previous applications known to the individual authorizing and making

    the application, made to any judge for authorization to intercept, or

    for approval of interceptions of, wire, oral, or electronic

    communications involving any of the same persons, facilities or places

    specified in the application; and

     

    (f) where the application is for the extension of an order, a

    statement setting forth the results thus far obtained from the

    interception, or a reasonable explanation of the failure to obtain such

    results.

     

    (2) The judge may require the applicant to furnish additional

    testimony or documentary evidence in support of the application.

     

    (3) Upon such application the judge may enter an ex parte order, as

    requested or as modified, authorizing or approving interception of wire,

    oral or electronic communications within the territorial jurisdiction of the

    court in which the judge is sitting (and outside that jurisdiction but

    within the United States in the case of a mobile interception device

    authorized by a Federal court within such jurisdiction) if the judge

    determines on the basis of the facts submitted by the applicant that-

     

    (a) there is probable cause for belief that an individual is

    committing, has committed, or is about to commit a particular offense

    enumerated in section 2516 of this chapter;

     

    (b) there is probable cause for brief that particular

    communications concerning that offense will be obtained through such

    interception;

     

    (c) normal investigative procedures have been tried and have

    failed or reasonably appear to be unlikely to succeed if tried or to be

    too dangerous;

     

    (d) except as provided in subsection (11), there is probable

    cause for belief that the facilities from which, or the place where the

    wire, oral, or electronic communications are to be intercepted are

    being used, or are about to be used, in connection with the commission

    of such offense, or are leased to, listed in the name of, or commonly

    used by such person.

     

    (4) Each order authorizing or approving the interception of any wire,

    oral, or electronic communication under this chapter shall specify-

     

    (a) the identity of the person, if known, whose communications

    are to be intercepted;

     

    (b) the nature and location of the communications facilities as

    to which, or the place where, authority to intercept is granted;

     

    (c) a particular description of the type of communication sought

    to be intercepted, and a statement of the particular offense to which

    it relates;

     

    (d) the identity of the agency authorized to intercept the

    communications, and of the person authorizing the application; and

     

    (e) the period of time during which such interception is

    authorized, including a statement as to whether or not the interception

    shall automatically terminate when the described communication has been

    first obtained.

     

    An order authorizing the interception of a wire, oral, or electronic

    communication under this chapter shall, upon request of the applicant,

    direct that a provider of wire or electronic communication service,

    landlord, custodian or other person shall furnish the applicant forthwith

    all information, facilities, and technical assistance necessary to

    accomplish the interception unobtrusively and with a minimum of interference

    with the services that such service provider, landlord, custodian, or person

    is according the person whose communications are to be intercepted. Any

    provider of wire or electronic communication service, landlord, custodian or

    other person furnishing such facilities or technical assistance shall be

    compensated therefor by the applicant for reasonable express incurred in

    providing such facilities or assistance.

     

    (5) No order entered under this section may authorize or approve the

    interception of any wire, oral, or electronic communication for any period

    longer than is necessary to achieve the objective of the authorization nor

    in any event longer than thirty days. Such thirty-day period begins on the

    earlier of the day on which the investigative or law enforcement officer

    first begins to conduct an interception under the order or ten days after

    the order is entered. Extensions of an order may be granted, but only upon

    application for an extension made in accordance with subsection (1) of this

    section and the court making the findings required by subsection (3) of this

    section. The period of extension shall be no longer than the authorizing

    judge deems necessary to achieve the purposes for which it was granted and

    in no event for longer than thirty days. Every order and extension thereof

    shall contain a provision that the authorization to intercept shall be

    executed as soon as practicable, shall be conducted in such a way as to

    minimize the interception of communications not otherwise, subject to

    interception under this chapter, and must terminate upon attainment of the

    authorized objective, or in any event in thirty days. In the event the

    intercepted communications is in a code or foreign language, and an expert

    in that foreign language or code is not reasonably available during the

    interception period, minimization may be accomplished as soon as practicable

    after such interception. An interception under this chapter may be

    conducted in whole or in part by Government personnel, or by an individual

    operating under a contract with the Government, acting under the supervision

    of an investigative or law enforcement officer authorized to conduct the

    interception.

     

    (6) Whenever an order authorizing interception is entered pursuant to

    this chapter, the order may require reports to be made to the judge who

    issued the order showing what progress has been made toward achievement of

    the authorized objective and the need for continued interception. Such

    reports shall be made at such intervals as the judge may require.

     

    (7) Notwithstanding any other provision of this chapter, any

    investigative or law enforcement officer, specially designated by the

    Attorney General, the Deputy Attorney General, the Associate Attorney

    General, or by the principal prosecuting attorney of any State or

    subdivision thereof acting pursuant of that State, who reasonably determines

    that-

     

    (a) an emergency situation exists that involves-

     

    (i) immediate danger of death or serious physical injury to

    any person;

     

    (ii) conspiratorial activities threatening the national

    security interest; or

     

    (iii) conspiratorial activities characteristic of organized

    crime,

     

    that requires a wire, oral, or electronic communication to be

    intercepted before an order authorizing such interception can, with due

    diligence, be obtained, and

     

    (b) there are grounds upon which an order could be entered under

    this chapter to authorize such interception.

     

    may intercept such wire, oral, or electronic communication if an application

    for an order approving the interception is made in accordance with this

    section within forty-eight hours after the interception has occurred, or

    begins to occur. In the absence of an order, such interception shall

    immediately terminate when the communication sought is obtained or when the

    application for the order is denied, whichever is earlier. In the event

    such application for approval is denied, or in any other case where the

    interception is terminated without an order having been issued, the contents

    of any wire, oral, or electronic communication intercepted shall be treated

    as having been obtained in violation of this chapter, and an inventory shall

    be served as provided for in subsection (d) of this section on the person

    named in the application.

     

    (8)(a) The contents of any wire, oral, or electronic communication

    intercepted by any means authorized by this chapter shall, if possible, be

    recorded on tape or wire or other comparable device. The recording of the

    contents of any wire, oral, or electronic communication under this

    subsection shall be done in such a way as will protect the recording from

    editing or other alterations. Immediately upon the expiration of the period

    of the order, or extensions thereof, such recordings shall be made available

    to the judge issuing such order and sealed under this directions. Custody

    of the recordings shall be wherever the judge orders. They shall not be

    destroyed except upon an order of the issuing or denying judge and in any

    event shall be kept for ten years. Duplicate recordings may be made for use

    or disclosure pursuant to the provisions of subsections (2) and (2) of

    section 2517 of this chapter for investigations. The presence of the seal

    provided for by this section, or a satisfactory explanation for the absence

    thereof, shall be a prerequisite for the use or disclosure of the contents

    of any wire, oral, or electronic communication or evidence derived therefrom

    under subsection (3) of section 2517.

     

    (b) Applications made and orders granted under this chapter shall be

    sealed by the judge. Custody of the applications and orders shall be

    wherever the judge directs. Such applications and orders shall be disclosed

    only upon a showing of good cause before a judge of competent jurisdiction

    and shall not be destroyed except on order of the issuing or denying judge,

    and in any event shall be kept for ten years.

     

    (c) Any violation of the provisions of this subsection may be punished

    as contempt of the issuing or denying judge.

     

    (d) Within a reasonable time but not later than ninety days after the

    filing of an application for an order of approval under section 2518(7)(b)

    which is denied or the termination of the period of an order or extensions

    thereof, the issuing or denying judge shall cause to be served, on the

    persons named in the order or the application, and such other parties to

    intercepted communications as the judge may determine in his discretion that

    is in the interest of justice, and inventory which shall include notice of-

     

    (1) the fact of the entry of the order or the application;

     

    (2) the date of the entry and the period of authorized, approved

    or disapproved interception, or the denial of the application, and

     

    (3) the fact that during the period wire, oral, or electronic

    communications were or were not intercepted.

     

    The judge, upon the filing of a motion, may in his discretion make available

    to such person or his counsel for inspection such portions of the

    intercepted communications, applications and orders as the judge determines

    to be in the interest of justice. On an ex parte showing of good cause to a

    judge of competent jurisdiction the serving of the inventory required by

    this subsection may be postponed.

     

    (9) The contents of any wire, oral, or electronic communication

    intercepted pursuant to this chapter or evidence derived therefrom shall not

    be received in evidence or otherwise disclosed in any trial, hearing, or

    other proceeding in a Federal or State court unless each party, not less

    then ten days before the trial, hearing, or proceeding, has been furnished

    with a copy of the court order, and accompanying application, under which

    the interception was authorized or approved. This ten-day period may be

    waived by the judge if he finds that it was not possible to furnish the

    party with the above information ten days before the trial, hearing, or

    proceeding and that the party will not be prejudiced by the delay in

    receiving such information.

     

    (10)(a) Any aggrieved person in any trial, hearing, or proceeding in

    or before the any court, department, officer, agency, regulatory body, or

    other authority of the United States, a State, or a political subdivision

    thereof, may move to suppress the contents of any wire or oral communication

    intercepted pursuant to this chapter, or evidence derived therefrom, on the

    grounds that-

     

    (i) the communication was unlawfully intercepted;

     

    (ii) the order of authorization or approval under which it was

    intercepted is insufficient on its face; or

     

    (iii) the interception was not made in conformity with the order

    of authorization or approval.

     

    Such motion shall be made before the trial, hearing, or proceeding unless

    there was no opportunity to make such motion or the person was not aware of

    the grounds of the motion. If the motion is granted, the contents of the

    intercepted wire or oral communication, or evidence derived therefrom, shall

    be treated as having been obtained in violation of this chapter. The judge,

    upon the filing of such motion by the aggrieved person, may in his

    discretion make available to the aggrieved person or his counsel for

    inspection such portions of the intercepted communication or evidence

    derived therefrom as the judge determines to be in the interests of justice.

     

    (b) In addition to any other right to appeal, the United States shall

    have the right to appeal from an order granting a motion to suppress made

    under paragraph (a) of this subsection, or the denial of an application for

    an order of approval, if the United States attorney shall certify to the

    judge or other official granting such motion or denying such application the

    the appeal is not taken for purposes of delay. Such appeal shall be taken

    within thirty days after the date the order was entered and shall be

    diligently prosecuted.

     

    (c) The remedies and sanctions described in this chapter with respect

    to the interception of electronic communications are the only judicial

    remedies and sanctions for nonconstitutional violations of this chapter

    involving such communications.

     

    (11) The requirements of subsections (1)(b)(ii) and (3)(d) of the

    section relating to the specification of the facilities from which, or the

    place where, the communication is to be intercepted do not apply if-

     

    (a) in the case of an application with respect to the

    interception of an oral communication-

     

    (i) the application is by a federal investigative or law

    enforcement officer and is approved by the Attorney General, the

    Deputy Attorney General, the Associate Attorney General, an

    Assistant Attorney General, or an acting Assistant Attorney

    General;

     

    (ii) the application contains a full and complete statement

    as to why such specification is not practical and identifies the

    person committing the offense and whose communications are to be

    intercepted; and

     

    (iii) the judge finds that such specification is not

    practical; and

     

    (b) in the case of an application with respect to a wire or

    electronic communication-

     

    (i) the application is by a Federal investigative or law

    enforcement officer and is approved by the Attorney General, the

    Deputy Attorney General, the Associate Attorney General, and

    Assistant Attorney General, or an acting Assistant Attorney

    General;

     

    (ii) the application identifies the person believed to be

    committing the offense and whose communications are to be

    intercepted and the applicant makes a showing of a purpose, on the

    part of that person, to thwart interception by changing

    facilities; and

     

    (iii) the judge finds that such purpose has been adequately

    shown.

     

    (12) An interception of a communication under an order with respect to

    which the requirements of subsections (1)(b)(ii) and (3)(d) of this section

    do not apply by reason of subsection (11) shall not begin until the

    facilities from which, or the place where, the communication is to be

    intercepted is ascertained by the person implementing the interception

    order. A provider of wire or electronic communications service that has

    received an order as provided for in subsection (11)(b) may move the court

    to modify or quash the order on the ground that its assistance with respect

    to the interception cannot be performed in a timely or reasonable fashion.

    The court, upon notice to the government, shall decide such a motion

    expeditiously.

     

    { 2519. Reports concerning intercepted wire, oral, or electronic

    communications

     

    (1) Within thirty days after the expiration of an order (or each

    extension thereof) entered under section 2518, or the denial of an order

    approving an interception, the issuing or denying judge shall report to the

    Administrative Office of the United States Courts-

     

    (a) the fact that an order or extension was applied for;

     

    (b) the kind of order or extension was applied for (including

    whether or not the order was an order with respect to which the

    requirements of sections 2518(1)(b)(ii) and 2581(3)(d) of this title

    did not apply by reason of section 2518(11) of title);

     

    (c) the fact that the order or extension was granted as applied

    for, was modified, or was denied;

     

    (d) the period of interceptions authorized by the order, and the

    number and duration of any extensions of the order;

     

    (e) the offense specified in the order or application, or

    extension or an order;

     

    (f) the identity of the applying investigative or law enforcement

    officer and agency making the application and the person authorizing

    the application; and

     

    (g) the nature of the facilities from which or the place where

    communications were to be intercepted.

     

    (2) In January of each year the Attorney General, an Assistant

    Attorney General specially designated by the Attorney General, or the

    principal prosecuting attorney of a State, or the principal prosecuting

    attorney for any political subdivision of a State, shall report to the

    Administrative Office of the United States Courts-

     

    (a) the information required by paragraphs (a) through (g) of

    subsection (1) of this section with respect to each application for an

    order or extension made during the preceding calendar year;

     

    (b) a general description of the interceptions made under such

    order or extension, including (i) the approximate nature and frequency

    of incriminating communications intercepted, (ii) the approximate

    nature and frequency of other communications intercepted, (iii) the

    approximate number of persons whose communications were intercepted,

    and (iv) the approximate nature, amount, and cost of the manpower and

    other resources used in the interceptions;

     

    (c) the number of arrests resulting from interceptions made under

    such order or extension, and the offenses for which arrests were made;

     

    (d) the number of trials resulting from such interceptions;

     

    (e) the number of motions to suppress made with respect to such

    interceptions, and the number granted or denied;

     

    (f) the number of convictions resulting from such interceptions

    and the offenses for which the convictions were obtained and a general

    assessment of the importance of the interceptions; and

     

    (g) the information required by paragraphs (b) through (f) of

    this subsection with respect to orders or extensions obtained in a

    preceding calendar year.

     

    (3) In April of each year the Director of the Administrative Office of

    the United States Courts shall transmit to the Congress a full and complete

    report concerning the number of applications for orders authorizing or

    approving the interception of wire, oral, or electronic communications

    pursuant to this chapter and the number of orders and extensions granted or

    denied pursuant to this chapter during the preceding calendar year. Such

    report shall include a summary and analysis of the data required to be filed

    with the Administrative Office by subsections (1) and (2) of this section.

    The Director of the Administrative Office of the United States Courts is

    authorized to issue binding regulations dealing with the content and form of

    the reports required to be filed by subsections (1) and (2) of this section.

     

     

    { 2520. Recovery of civil damages authorized

     

    (a) IN GENERAL,--Except as provided in section 2511(2)(a)(ii), any

    person whose wire, oral, or electronic communication is intercepted,

    disclosed, or intentionally used in violation of this chapter may in a civil

    action recover from the person or entity which engaged in that violation

    such relief as may be appropriate.

     

    (b) RELIEF.--In an action under this section, appropriate relief

    includes-

     

    (1) such preliminary and other equitable or declaratory relief as

    may be appropriate;

     

    (2) damages under subsection (c) and punitive damages in

    appropriate cases; and

     

    (3) a reasonable attorney's fee and other litigation costs

    reasonably incurred.

     

    (c) COMPUTATION OF DAMAGES.--(1) In an action under this section, if

    the conduct is in violation of this chapter is the private viewing of a

    private satellite video communication that is not scrambled or encrypted or

    if the communication is a radio communication that is transmitted on

    frequencies allocated under subpart D of part 74 of the rules of the Federal

    Communications Commission that is not scrambled or encrypted and the conduct

    is not for a tortious or illegal purpose or for purposes of direct or

    indirect commercial advantage or private commercial gain, then the court

    shall assess damages as follows:

     

    (A) If the person who engaged in that conduct has not previously

    been enjoined under section 2511(5) and has not been found liable in a

    prior civil action under this section, the court shall assess the

    greater of the sum of actual damages suffered by the plaintiff, or

    statutory damages of not less than $50 and not more than $500.

     

    (B) If, on one prior occasion, the person who engaged in that

    conduct has been enjoined under section 2511(5) or has been found

    liable in a civil action under this section, the court shall assess the

    greater of the sum of actual damages suffered by the plaintiff, or

    statutory damages of not less than $100 and not more than $1,000.

     

    (2) In any other action under this section, the court may assess as

    damages whichever is the greater of-

     

    (A) the sum of the actual damages suffered by the plaintiff and

    any profits made by the violator as a result of the violation; or

     

    (B) statutory damages of whichever is the greater of $100 a day

    for each day of violation or $10,000.

     

    (d) DEFENSE.--A good faith reliance on-

     

    (1) a court warrant or order, a grand jury subpoena, a

    legislative authorization, or a statutory authorization;

     

    (2) a request of an investigative or law enforcement officer

    under section 2518(7) of this title; or

     

    (3) a good faith determination that section 2511(3) of this title

    permitted the conduct complained of;

     

    is a complete defense against any civil or criminal action brought under

    this chapter or any other law.

     

    (e) LIMITATION.--A civil action under this section may not be

    commenced later than two years after the date upon which the claimant first

    has a reasonable opportunity to discover the violation.

     

     

    { 2521. Injunction against illegal interception

     

    Whenever it shall appear that any person is engaged or is about to

    engage in any act which constitutes or will constitute a felony violation of

    this chapter, the Attorney General may initiate a civil action in a district

    court of the United States to enjoin such violation. The court shall

    proceed as soon as practicable to the hearing and determination of such an

    action, and may, at any time before final determination, enter such a

    restraining order or prohibition, or take such other action, as is warranted

    to prevent a continuing and substantial injury to the United States or to

    any person or class of persons for whose protection the action is brought.

    A proceeding under this section is governed by the Federal Rules of Civil

    Procedure, except that, if an indictment has been returned against the

    respondent, discovery is governed by the federal Rules of Criminal

    Procedure.

     

     

    CHAPTER 121- STORED WIRE AND ELECTRONIC COMMUNICATIONS AND TRANSACTIONAL

    RECORDS ACCESS

     

    Sec.

    2701. Unlawful access to stored communications.

    2702. Disclosure of contents.

    2703. Requirements for governmental access.

    2704. Backup preservation.

    2705. Delayed notice.

    2706. Cost reimbursement.

    2707. Civil action.

    2708. Exclusivity of remedies.

    2709. Counterintelligence access to telephone toll and

    transactional records.

    2710. Definitions

     

    2701. Unlawful access to stored communications

     

    (a) OFFENSE.- Except as provided in subsection (c) of this section

    whoever-

     

    (1) intentionally accesses without authorization a facility through

    which an electronic communication service is provided; or

     

    (2) intentionally exceeds an authorization to access that facility;

     

    and thereby obtains, alters, or prevents authorized access to a wire or

    electronic communication while it is in electronic storage in such system

    shall be punished as provided in subsection (b) of this section.

     

    (b) PUNISHMENT.- The punishment for an offense under subsection (a) of

    this section is-

     

    (1) if the offense is committed for purposes of commercial advantage,

    malicious destruction or damage, or private commercial gain-

     

    (A) a fine of not more than $250,000 or imprisonment for not more than

    one year, or both, in the case of a first offense under this subparagraph;

    and

     

    (B) a fine under this title or imprisonment for not more than two

    years, or both, for any subsequent offense under this subparagraph; and

     

    (2) a fine of not more than $5,000 or imprisonment for not more than

    six months, or both, in any case.

     

    (c) EXCEPTIONS.- Subsection (a) of this section does not apply with

    respect to conduct authorized-

     

    (1) by the person or entity providing a wire or electronic

    communications service;

     

    (2) by a user of that service with respect to a communication of or

    intended for that user; or

     

    (3) in section 2703, 2704 or 2518 of this title.

     

    { 2702. Disclosure of contents

     

    (a) PROHIBITIONS.- Except as provided in subsection (b)-

     

    (1) a person or entity operating an electronic communication service to

    the public shall not knowingly divulge to any person or entity the contents

    of a communication while in electronic storage by that service; and

     

    (2) a person or entity providing remote computing service to the public

    shall not knowingly divulge to any person or entity the contents of any

    communication which is carried or maintained on that service-

     

    (A) on behalf of, and received by means of electronic transmission from

    (or created by means of computer processing of communications received by

    means of electronic transmission from), a subscriber or customer of such

    service; and

     

    (B) solely for the purpose of providing storage or computer processing

    services to such subscriber or customer, if the provider is not authorized

    to access the contents of any such communications for purposes of providing

    any services other than storage or computer processing.

     

    (b) EXCEPTIONS.- A person or entity may divulge the contents of a

    communication-

     

    (1) to an addressee or intended recipient of such communication or an

    agent of such addressee or intended recipient;

     

    (2) as otherwise authorized in section 2516, 2511(2)(a), or 2703 of

    this title;

     

    (3) with the lawful consent of the originator or an addressee or

    intended recipient of such communication, or the subscriber in the case of

    remote computing service;

     

    (4) to a person employed or authorized or whose facilities are used to

    forward such communication to its destination;

     

    (5) as may be necessarily incident to the rendition of the service or

    to the protection of the rights or property of the provider of that service;

    or

     

    (6) to a law enforcement agency, if such contents-

     

    (A) were inadvertently obtained by the service provider; and

     

    (B) appear to pertain to the commission of a crime.

     

    { 2703. Requirements for governmental access

     

    (a) CONTENTS OF ELECTRONIC COMMUNICATIONS IN ELECTRONIC STORAGE.- A

    governmental entity may require the disclosure by a provider of electronic

    communication service of the contents of an electronic communication, that

    is in electronic storage in an electronic communications system for one

    hundred and eighty days or less, only pursuant to a warrant issued under the

    Federal Rules of Criminal Procedure or equivalent State warrant. A

    governmental entity may require the disclosure by a provider of electronic

    communications services of the contents of an electronic communication that

    has been in storage in an electronic communications system for more than one

    hundred and eighty days by the means available under subsection (b) of this

    section.

     

    (b) CONTENTS OF ELECTRONIC COMMUNICATIONS IN A REMOTE COMPUTING

    SERVICE.- (1) A governmental entity may require a provider of remote

    computing service to disclose the contents of any electronic communication

    to which this paragraph is made applicable by paragraph (2) of this

    subsection-

     

    (A) without required notice to the subscriber or customer, if the

    governmental entity obtains a warrant issued under the Federal Rules of

    Criminal Procedure or equivalent State warrant; or

     

    (B) with prior notice from the governmental entity to the subscriber or

    customer if the governmental entity-

     

    (i) uses an administrative subpoena authorized by a Federal or State

    statute or a Federal or State grand jury subpoena; or

     

    (ii) obtains a court order for such disclosure under subsection (d) of

    this section; except that delayed notice may be given pursuant to section

    2705 of this title.

     

    (2) Paragraph (1) is applicable with respect to any electronic

    communication that is held or maintained on that service-

     

    (A) on behalf of, and received by means of electronic transmission from

    (or created by means of computer processing of communications received by

    means of electronic transmission from), a subscriber or customer of such

    remote computing service; and

     

    (B) solely for the purpose of providing storage or computer processing

    services to such subscriber or customer, if the provider is not authorized

    to access the contents of any such communications for purposes of providing

    any services other than storage or computer processing.

     

    (c) RECORDS CONCERNING ELECTRONIC COMMUNICATION SERVICE OR REMOTE

    COMPUTING SERVICE.- (1)(A) Except as provided in subparagraph (B), a

    provider of electronic communication service or remote computing service may

    disclose a record or other information pertaining to a subscriber to or

    customer of such service (not including the contents of communications

    covered by subsection (a) or (b) of this section) to any person other than a

    governmental entity.

     

    (B) A provider of electronic communication service or remote computing

    service shall disclose a record or other information pertaining to a

    subscriber to or customer of such service (not including the contents of

    communications covered by subsection (a) or (b) of this section) to a

    governmental entity only when the governmental entity-

     

    (i) uses an administrative subpoena authorized by a Federal or State

    statute, or a Federal or State grand jury subpoena;

     

    (ii) obtains a warrant issued under the Federal Rules of Criminal

    Procedure or equivalent State warrant;

     

    (iii) obtains a court order for such disclosure under subsection (d) of

    this section; or

     

    (iv) has the consent of the subscriber or customer to such disclosure.

     

    (2) A governmental entity receiving records or information under this

    subsection is not required to provide notice to a subscriber or customer.

     

    (d) REQUIREMENTS FOR COURT ORDER.- A court order for disclosure under

    subsection (b) or (c) of this section shall issue only if the governmental

    entity shows that there is reason to believe the contents of a wire or

    electronic communication, or the records or other information sought, are

    relevant to a legitimate law enforcement inquiry. In the case of a State

    governmental authority, such a court order shall not issue if prohibited by

    the law of such State. A court issuing an order pursuant to this section,

    on a motion made promptly by the service provider, may quash or modify such

    order, if the information or records requested are unusually voluminous in

    nature or compliance with such order otherwise would cause an undue burden

    on such provider.

     

    (e) NO CAUSE OF ACTION AGAINST A PROVIDER DISCLOSING INFORMATION UNDER

    THIS CHAPTER.- No cause of action shall lie in any court against any

    provider of wire or electronic communication service, its officers,

    employees, agents, or other specified persons for providing information,

    facilities, or assistance in accordance with the terms of a court order,

    warrant, subpoena or certification under this chapter.

     

    { 2704. Backup preservation

     

    (a) BACKUP PRESERVATION.- (1) A governmental entity acting under

    section 2703(b)(2) may include in its subpoena or court order a requirement

    that the service provider to whom the request is directed create a backup

    copy of the contents of the electronic communications sought in order to

    preserve those communications. Without notifying the subscriber or customer

    of such subpoena or court order, such service provider shall create such

    backup copy as soon as practicable consistent with its regular business

    practices and shall confirm to the governmental entity that such backup copy

    has been made. Such backup copy shall be created within two business days

    after receipt by the service provider of the subpoena or court order.

     

    (2) Notice to the subscriber or customer shall be made by the

    governmental entity within three days after receipt of such confirmation,

    unless such notice is delayed pursuant to section 2705(a).

     

    (3) The service provider shall not destroy such backup copy until the

    later of --

     

    (A) the delivery of the information; or

     

    (B) the resolution of any proceedings (including appeals of any

    proceeding) concerning the government's subpoena or court order.

     

    (4) The service provider shall release such backup copy to the

    requesting governmental entity no sooner than fourteen days after the

    governmental entity's notice to the subscriber or customer if such service

    provider --

     

    (A) has not received notice from the subscriber or customer that the

    subscriber or customer has challenged the governmental entity's request; and

     

    (B) has not initiated proceedings to challenge the request of the

    governmental entity.

     

    (5) A governmental entity may seek to require the creation of a backup

    copy under subsection (a)(1) of this section if in its sole discretion such

    entity determines that there is reason to believe that notification under

    section 2703 of this title of the existence of the subpoena or court order

    may result in destruction of or tampering with evidence. This determination

    is not subject to challenge by the subscriber or customer or service

    provider.

     

    (b) CUSTOMER CHALLENGES -- (1) Within fourteen days after notice by the

    governmental entity to the subscriber or customer under subsection (a)(2) of

    this section, such subscriber or customer may file a motion to quash such

    subpoena or vacate such court order, with copies served upon the

    governmental entity and with written notice of such challenge to the service

    provider. A motion to vacate a court order shall be filed in the court

    which issued such order. A motion to quash a subpoena shall be filed in the

    appropriate United States district court or State court. Such motion or

    application shall contain an affidavit or sworn statement --

     

    (A) stating that the applicant is a customer or subscriber to the

    service from which the contents of electronic communications maintained for

    him have been sought; and

     

    (B) stating the applicant's reasons for believing that the records

    sought are not relevant to a legitimate law enforcement inquiry or that

    there has not been substantial inquiry or that there has not been

    substantial compliance with the provisions of this chapter in some other

    respect.

     

    (2) Service shall be made under this section upon a governmental entity

    by delivering or mailing by registered or certified mail a copy of the

    papers to the person, office, or department specified in the notice which

    the customer has received pursuant to this chapter. For the purposes of

    this section, the term "delivery" has the meaning given that term in the

    Federal Rules of Civil Procedure.

     

    (3) If the court finds that the customer has complied with paragraphs

    (1) an (2) of this subsection, the court shall order the governmental entity

    to file a sworn response, which may be filed in camera if the governmental

    entity includes in its response the reasons which make in camera review

    appropriate. If the court is unable to determine the motion or application

    on the basis of the parties' initial allegations and response, the court may

    conduct such additional proceedings as it deems appropriate. All such

    proceedings shall be completed and the motion or application decided as soon

    as practicable after the filing of the governmental entity's response.

     

    (4) If the court finds that the applicant is not the subscriber or

    customer for whom the communications sought by the governmental entity are

    maintained, or that there is a reason to believe that the law enforcement

    inquiry is legitimate and that the communications sought are relevant to

    that inquiry, it shall deny the motion or application and order such process

    enforced. If the court finds that the applicant is the subscriber or

    customer for whom the communications sought by the governmental entity are

    maintained, and that there is not a reason to believe that the

    communications sought are relevant to a legitimate law enforcement inquiry,

    or that there has not been substantial compliance with the provisions of

    this chapter, it shall order the process quashed.

     

    (5) A court order denying a motion or application under this section

    shall not be deemed a final order and no interlocutory appeal may be taken

    therefrom by the customer.

     

    { 2705. Delayed notice

     

    (a) DELAY OF NOTIFICATION --(1) A governmental entity acting under

    section 2703(b) of this title may --

     

    (A) where a court order is sought, include in the application a

    request, which the court shall grant, for an order delaying the notification

    required under section 2703(b) of this title for a period not to exceed

    ninety days, if the court determines that there is reason to believe that

    notification of the existence of the court order may have an adverse result

    described in paragraph (2) of this subsection; or

     

    (B) where an administrative subpoena authorized by a Federal or State

    statute or a Federal or State grand jury subpoena is obtained, delay the

    notification required under section 2703(b) of this title for a period not

    to exceed ninety days upon the execution of a written certification of a

    supervisory official that there is reason to believe that notification of

    the existence of the subpoena may have an adverse result described in

    paragraph (2) of this subsection.

     

    (2) An adverse result for the purposes of paragraph (1) of this

    subsection is --

     

    (A) endangering the life or physical safety of an individual;

     

    (B) flight from prosecution;

     

    (C) destruction of or tampering with evidence;

     

    (D) intimidation of potential witnesses; or

     

    (E) otherwise seriously jeopardizing an investigation or unduly

    delaying a trial.

     

    (3) The governmental entity shall maintain a true copy of certification

    under paragraph (1)(B).

     

    (4) Extensions of the delay of notification provided in section 2703 of

    up to ninety days each may be granted by the court upon application, or by

    certification by a governmental entity, but only in accordance with

    subsection (b) of this section.

     

    (5) Upon expiration of the period of delay of notification under

    paragraph (1) or (4) of this subsection, the governmental entity shall serve

    upon, or deliver by registered or first-class mail to, the customer or

    subscriber a copy of the process or request together with notice that --

     

    (A) states with reasonable specificity the nature of the law

    enforcement inquiry; and

     

    (B) informs such customer or subscriber --

     

    (i) that information maintained for such customer or subscriber by the

    service provider named in such process or request was supplied to or

    requested by that governmental authority and the date on which the supplying

    or request took place.

     

    (ii) that notification of such customer or subscriber was delayed;

     

    (iii) what governmental entity or court made the certification or

    determination pursuant to which that delay was made; and

     

    (iv) which provision of this chapter allowed such delay.

     

    (6) As used in this subsection, the term "supervisory official" means

    the investigative agent in charge or assistant investigative agent in charge

    or an equivalent of an investigating agency's headquarters or regional

    office, or the chief prosecuting attorney or the first assistant prosecuting

    attorney or an equivalent of a prosecuting attorney's headquarters or

    regional office.

     

    (b) PRECLUSION OF NOTICE TO SUBJECT OF GOVERNMENTAL ACCESS. -- A

    governmental entity acting under section 2703, when it is not required to

    notify the subscriber or customer under section 2703(b)(1), or to the extent

    that it may delay such notice pursuant to subsection (a) of this section,

    may apply to a court for an order commanding a provider of electronic

    communications service or remote computing service to whom a warrant,

    subpoena, or court order is directed, for such period as the court deems

    appropriate, not to notify any other person of the existence of the warrant,

    subpoena, or court order. The court shall enter such an order if it

    determines that there is reason to believe that notification of the

    existence of the warrant, subpoena, or court order will results in --

     

    (1) endangering the life or physical safety of an individual;

     

    (2) flight from prosecution;

     

    (3) destruction of or tampering with evidence;

     

    (4) intimidation of potential witnesses; or

     

    (5) otherwise seriously jeopardizing an investigation or unduly

    delaying a trial.

     

    { 2706. Cost reimbursement

     

    (a) PAYMENT -- Except as otherwise provided in subsection (c), a

    governmental entity obtaining the contents of communications, records, or

    other information under section 2702, 2703, or 2704 of this title shall pay

    to the person or entity assembling or providing such information a fee for

    reimbursement for such costs as are reasonably necessary and which have been

    directly incurred in searching for, assembling, reproducing, or otherwise

    providing such information. Such reimbursable costs shall include any costs

    due to necessary disruption of normal operations of any electronic

    communication service or remote computing service in which such information

    may be stored.

     

    (b) AMOUNT -- The amount of the fee provided by subsection (a) shall be

    as mutually agreed by the governmental entity and the person or entity

    providing the information, or in the absence of agreement, shall be as

    determined by the court which issued the order for production of such

    information (or the court before which a criminal prosecution relating to

    such information would be brought, if no court order was issued for

    production of the information).

     

    (c) The requirement of subsection (a) of this section does not apply

    with respect to records or other information maintained by a communications

    common carrier that relate to telephone toll records and telephone listings

    obtained under section 2703 of this title. The court may, however, order a

    payment as described in subsection (a) if the court determines the

    information required is unusually voluminous in nature or otherwise caused

    an undue burden on the provider.

     

    { 2707. Civil action

     

    (a) CAUSE OF ACTION. -- Except as provided in section 2703(e), any

    provider of electronic communication service, subscriber, or customer

    aggrieved by any violation of this chapter in which the conduct constituting

    the violation is engaged in with a knowing or intentional state of mind may,

    in a civil action, recover from the person or entity which engaged in that

    violation such relief as may be appropriate.

     

    (b) RELIEF. -- IN a civil action under this section, appropriate relief

    includes --

     

    (1) such preliminary and other equitable or declaratory relief as may

    be appropriate;

     

    (2) damages under subsection (c); and

     

    1/2 of (b), all of (c) & (d) omitted see p. 514,447

     

    (e) LIMITATION. -- A civil action under this section may not be

    commenced later than two years after the date upon which the claimant first

    discovered or had a reasonable opportunity to discover the violation.

     

    { 2708. Exclusivity of remedies

     

    The remedies and sanctions described in this chapter are the only

    judicial remedies and sanctions for nonconstitutional violations of this

    chapter.

     

    { 2709. Counterintelligence access to telephone toll and transactional

    records

     

    (a) DUTY TO PROVIDE. -- A wire or electronic communication service

    provider shall comply with a request for subscriber information and toll

    billing records information, or electronic communication transactional

    records in its custody or possession made by the Director of the Federal

    Bureau of Investigation under subsection (b) of this section.

     

    (b) REQUIRED CERTIFICATION. -- The Director of the Federal Bureau of

    Investigation (or an individual within the Federal Bureau of Investigation

    designated for this purpose by the Director) may request any such

    information and records if the Director (or the Director's designee)

    certifies in writing to the wire or electronic communication service

    provider to which the request is made that --

     

    (1) the information sought is relevant to an authorized foreign

    counterintelligence investigation; and

     

    (2) there are specific and articulable facts giving reason to believe

    that the person or entity to whom the information sought pertains is a

    foreign power or an agent of a foreign power as defined in section 101 of

    the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801).

     

    (c) PROHIBITION OF CERTAIN DISCLOSURE. -- No wire or electronic

    communication service provider, or officer, employee, or agent thereof,

    shall disclose to any person that the Federal Bureau of Investigation has

    sought or obtained access to information or records under this section.

     

    (d) DISSEMINATION BY BUREAU. -- The Federal Bureau of Investigation may

    disseminate information and records obtained under this section only as

    provided in guidelines approved by the Attorney General for foreign

    intelligence collection and foreign counterintelligence investigations

    conducted by the Federal Bureau of Investigation, and, with respect to

    dissemination to an agency of the United States, only if such information is

    clearly relevant to the authorized responsibilities of such agency.

     

    (e) REQUIREMENT THAT CERTAIN CONGRESSIONAL BODIES BE INFORMED. -- On a

    semi-annual basis the Director of the Federal Bureau of Investigation shall

    fully inform the Permanent Select Committee on Intelligence of the House of

    Representatives and the Select Committee on Intelligence of the Senate

    concerning all requests made under subsection (b) of this section.

     

    { 2710. Definitions for chapter

     

    As used in this chapter -

     

    (1) the terms defined in section 2510 of this title have, respectively,

    the definitions given such terms in that section; and

     

    (2) the term "remote computing service" means the provision to the

    public of computer storage or processing services by means of an electronic

    communications system.

     

    CHAPTER 205-SEARCHES AND SEIZURES

     

    Sec. 3101. Effect of rules of court--Rules

     

    * * *

     

    3117. Mobile tracking devices.

     

    * * *

     

    { 3117. Mobile tracking devices

     

    (a). IN GENERAL.--If a court is empowered to ussue a warrant or other

    order for the installation of a mobile tracking device, such order may

    authorize the use of that device within the jurisdiction of the court, and

    outside that jurisdiction if the device is installed in that jurisdiction.

     

    (b). DEFINITION.--As used in this section, the term "tracking device"

    means an electronic or mechanical device which permits the tracking of the

    movement of a person or object.

     

    CHAPTER 206-PEN REGISTERS AND TRAP TRACE DEVICES

     

    Sec.

     

    3121. General prohibition on pen register on trap and trace device use;

    exception.

     

    3122. Application for an order for a pen register or a trap and trace

    device.

     

    3123. Issuance of an order for a pen register or a trap or trace

    device.

     

    3124. Assistance in installation and use of a pen register or a trap and

    trace device.

     

    3125. Reports concerning pen registers and trap and trace devices.

     

    3126. Definitions for chapter.

     

    { 3121. General prohibition on pen register and trap and trace device use;

    exception

     

    (a) In General.-Except as provided in this section, no person may

    install or use a pen register or a trap and trace device without first

    obtaining a court order under section 3123 of this title or under the

    Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.).

     

    (b) Exception.-The prohibition of subsection (a) does not apply with

    respect to the use of a pen register or a trap and trace device by a

    provider of electronic or wire communication service-

     

    (1) relating to the operation, maintenance, and testing of a wire or

    electronic communication service or to the protection of the rights or

    property of such provider, or to the protection of users of that service

    from abuse of service or unlawful use of service; or

     

    (2) to record the fact that a wire or electronic communication was

    initiated or completed in order to protect such provider, another provider

    furnishing service toward the completion of the wire communication, or a

    user of that service, from fraudulent, unlawful or abusive use of service;

    or with the consent of the user of that service.

     

    (c) Penalty.-Whoever knowingly violates subsection (a) shall be fined

    under this title or imprisoned not more than one year, or both.

     

    { 3122. Application for an order for a pen register or a trap and trace

    device

     

    (a) Application.-(1) An attorney for the Government may make

    application for an order or an extension of an order under section 3123 of

    this title authorizing or approving the installation and use of a pen

    register or a trap and trace device under this chapter, in writing under

    oath or equivalent affirmation, to a court of competent jurisdiction.

     

    (2) Unless prohibited by State law, a State investigative law

    enforcement officer may make application for an order or an extension of an

    order under section 3123 of this title authorizing or approving the

    installation and use of a pen register or a trap and trace device under this

    chapter, in writing under oath or equivalent affirmation, to a court of

    competent jurisdiction of such State.

     

    (b) Contents Of Application.-An application under subsection (a) of

    this section shall include-

     

    (1) the identity of the attorney for the Government or the State law

    enforcement or investigative officer making the application and the identity

    of the law enforcement agency conducting the investigation; and

     

    (2) a certification by the applicant that the information likely to be

    obtained is relevant to an ongoing criminal investigation being conducted by

    that agency.

     

    { 3123. Issuance of an order for a pen register or a trap and trace device

     

    (a) In General.-Upon an application made under section 3122 of this

    title, the court shall enter an ex parte order authorizing the installation

    and use of a pen register or a trap and trace device within the jurisdiction

    of the court if the court finds that the attorney for the Government or the

    State law enforcement or investigative officer has certified to the court

    that the information likely to be obtained by such installation and use is

    relevant to an ongoing criminal investigation.

     

    (b) Contents Of Order.-An order issued under this section-

     

    (1) shall specify-

     

    (A) the identity, if known, of the person to whom is leased or in

    whose name is listed the telephone line to which the pen register or trap

    and trace device is to be attached;

     

    (B) the identity, if known, of the person who is the subject of the

    criminal investigation;

     

    (C) the number and, if known, physical location of the telephone line

    to which the pen register or trap and trace device is to be attached and, in

    the case of a trap and trace device, the geographic limits of the trap and

    trace order; and

     

    (D) a statement of the offense to which the information likely to be

    obtained by the pen register or trap and trace device relates; and

     

    (2) shall direct, upon the request of the applicant, the furnishing of

    information, facilities, and technical assistance necessary to accomplish

    the installation of the pen register or trap and trace device under section

    3124 of this title.

     

    (c) Time Period And Extensions.-(1) An order issued under this section

    shall authorize the installation and use of a pen register or a trap and

    trace device for a period not to exceed sixty days.

     

    (2) Extensions of such an order may be granted, but only upon an

    application for an order under section 3122 of this title and upon the

    judicial finding required by subsection (a) of this section. The period of

    extension shall be for a period not to exceed sixty days.

     

    (d) Non-disclosure Of Existence Of Pen Register Or A Trap And Trace

    Device.-An order authorizing or approving the installation and use of a pen

    register or a trap and trace device shall direct that-

     

    (1) the order be sealed until otherwise ordered by the court; and

     

    (2) the person owning or leasing the line to which the pen register or

    a trap and trace device is attached, or who has been ordered by the court to

    provide assistance to the applicant, not disclose the existence of the pen

    register or trap and trace device or the existence of the investigation to

    the listed subscriber, or to any other person, unless or until otherwise

    ordered by the court.

     

    { 3124. Assistance in installation and use of a pen register or a trap and

    trace device

     

    (a) Pen Registers.-Upon the request of an attorney for the Government

    or an officer of a law enforcement agency authorized to install and use a

    pen register under this chapter, a provider of wire or electronic

    communication service, landlord, custodian, or other person shall furnish

    such investigative or law enforcement officer forthwith all information,

    facilities, and technical assistance necessary to accomplish the

    installation of the pen register unobtrusively and with a minimum of

    interference with the services that the person so ordered by the court

    accords the party with respect to whom the installation and use is to take

    place, if such assistance is directed by a court order as provided in

    section 3123(b)(2) of this title.

     

    (b) Trap And Trace Device.-Upon the request of an attorney for the

    Government or an officer of a law enforcement agency authorized to receive

    the results of a trap and trace device under this chapter, a provider of a

    wire or electronic communication service, landlord, custodian, or other

    person shall install such device forthwith on the appropriate line and shall

    furnish such investigative or law enforcement officer all additional

    information, facilities and technical assistance including installation and

    operation of the device unobtrusively and with a minimum of interference

    with the services that the person so ordered by the court accords the party

    with respect to whom the installation and use is to take place, if such

    installation and assistance is directed by a court order as provided in

    section 3123(b)(2) of this title. Unless otherwise ordered by the court,

    the results of the trap and trace device shall be furnished to the officer

    of a law enforcement agency, designated in the court, at reasonable

    intervals during regular business hours for the duration of the order.

     

    (c) Compensation.-A provider of a wire or electronic communication

    service, landlord, custodian, or other person who furnishes facilities or

    technical assistance pursuant to this section shall be reasonably

    compensated for such reasonable expenses incurred in providing such

    facilities and assistance.

     

    (d) No Cause Of Action Against A Provider Disclosing Information Under

    This Chapter.-No cause of action shall lie in any court against any provider

    of a wire or electronic communication service, its officers, employees,

    agents, or other specified persons for providing information, facilities, or

    assistance in accordance with the terms of a court order under this chapter.

     

    (e) Defense.-A good faith reliance on a court order, a legislative

    authorization, or a statutory authorization is a complete defense against

    any civil or criminal action brought under this chapter or any other law.

     

    { 3125. Reports concerning pen registers and trap and trace devices

     

    The Attorney General shall annually report to Congress on the number of

    pen register orders and orders for trap and trace devices applied for by law

    enforcement agencies of the Department of Justice.

     

    { 3126. Definitions for chapter

     

    As used in this chapter-

     

    (1) the terms "wire communication", "electronic communication", and

    "electronic communication service" have the meanings set forth for such

    terms in section 2510 of this title;

     

    (2) the term "court of competent jurisdiction" means-

     

    (A) a district court of the United States (including a magistrate of

    such a court) or a United States Court of Appeals; or

     

    (B) a court of general criminal jurisdiction of a State authorized by

    the law of that State to enter orders authorizing the use of a pen register

    or a trap and trace device;

     

    (3) the term "pen register" means a device which records or decodes

    electronic or other impulses which identify the numbers dialed or otherwise

    transmitted on the telephone line to which such device is attached, but such

    term does not include any device used by a provider or customer of a wire or

    electronic communication service for billing, or recording as an incident to

    billing, for communications services provided by such provider or any device

    used by a provider or customer of a wire communication service for cost

    accounting or other like purposes in the ordinary course of its business;

     

    (4) the term "trap and trace" device means a device which captures the

    incoming electronic or other impulses which identify the originating number

    of an instrument or device from which a wire or electronic communication was

    transmitted;

     

    (5) the term "attorney for the Government" has the meaning given such

    term for the purposes of the Federal Rules of Criminal Procedure; and

     

    (6) the term "State" means a State, the District of Columbia, Puerto

    Rico, and any other possession or territory of the United States.

     

     

    ===============================================================================

     

    A lawyer's review and perspective of the ECPA

     

    ===============================================================================

     

    WHEN IS LISTENING TO THE RADIO A CRIME?

     

    By FRANK TERRANELLA

     

    The federal Electronic Communications Privacy Act has turned many radio

    listeners into criminals. The problem is, most of them don't know about it. I

    will attempt here to describe in very non-legalistic and general terms

    (extremely difficult for a lawyer), exactly what listening is legal and what

    is illegal.

     

    Section 2511 of the Federal Criminal Statutes (18 U.S.C.) is where most of

    the action is in this field. The statute is primarily a wiretap and bug

    statute and only recently has been expanded to include radio listening. I

    will not be discussing the provisions dealing with oral communications or

    wiretaps and bugging devices here.

     

    The statute starts out by saying that it is illegal to intentionally

    intercept, disclose or use the contents of any wire or electronic

    communication. The statute then goes on to carve out exceptions to this

    general rule.

     

    It is important to understand what the law means by wire or electronic

    communication. A wire communication is any communication over a telephone or

    other wire. However, the definition specifically includes cellular telephones

    and excludes cordless telephones (even though both involve the use of radio

    and wire transmission). An electronic communication includes all radio

    transmissions, but excludes cordless telephones and pagers.

     

    After making a blanket prohibition of intercepting all electronic (i.e.

    radio) transmissions, the statute lists the exceptions. The first exception

    is that it is legal to listen to all radio transmissions which are "readily

    accessible to the general public." This term is defined in the statute to

    mean radio signals which are (1) not encrypted, scrambled, carried on a