Defeating radio direction finding

[bascule]

Wow, if all goes well I may give a talk on this next year... so excuse the opening hippie rant and you'll find some substance here, I assure you.

<hippie rant>
With the Clear Channel empire mostly solidified except for a few stalwart broadcasting coroporations like Cumulus (who happens to own every radio station in my hometown) and Entercom (who owns some respectable stations), the FCC has become increasingly more militant in its crackdowns. The most notable would be Radio Free Santa Cruz, which is certainly a contentious argument against the power structure of our Constitution: despite a decade of broadcasting without destructive interference, and despite local laws passed to protect the station, the FCC together with U.S. Marshalls raided the station in full riot gear. They met a rather large protest of locals including the Mayor of Santa Cruz, who defended the station's right to exist, especially considering our national government has sold out the air waves to the biggest corporation who can buy them (who, by the way, has a political bias that puts even FOX News to shame, certainly a contentious point against the conservative whining about the 'liberal media'). With LPFM regulations derailed, and provisions in the bill stating that no one who has ever operated a pirate station is entitled to an LPFM license, I believe it's time for a little substantially warranted civil disobedience.
</hippie rant>

So, our purpose is to create a broadcasting cluster immune to radio direction finding technologies. If the FCC can't find the transmitters, they can't shut down the station, and unless RDF points them at a location definitively, they can't obtain a search warrant and thus the station is immune to all prosection.

So, assume we have a broadcasting cluster of at least 3 nodes, the more the better. All of these will broadcast audio data received over an HTTP stream, with something like mpg123 set up to establish a persistent connection.

We configure a central server designed to seed these stations with data. This includes a seperate audio stream for each station that will be transmitting.

After all transmitting stations have connected to our HTTP audio server, we begin pulling audio data from some source.

We initialize an n sized array (n being the number of stations) such that element i is initialized as follows:

A[i] = i / n;

We also will have an array of volume levels, V. All members of this array can be initialized to any value between 0 and 1.

We now enter our main loop, which will operate on time interval t (this could be around 10 seconds)

Pulling from a given audio source, we calculate a new stream to send to each of the stations from the values in array A which have been initialized by the method specified, but we will transform A in the following manner:

For a determined number of rounds (an arbitrary value, n/4 should be sufficient), we pick two random numbers v1 and v2 which such that 0 < (v1,v2) < n, and swap the values of A[v1] and A[v2].

Next, we begin a nested loop of x rounds. We calculate x as being the quotient of one t interval of PCM audio data from our audio source divided by the size of PCM chunks we will be working with (likely determined by the compressed audio format you wish to use). We will iterate a nested loop, looping i from 0 to n for each station and j through V for x rounds, performing the following pseudocode transformation:

if(V[i] < A[i]) { V[i] += A[i] * j/x; } else { V[i] -= A[i] * j/x; }

We then recompute the chunk of PCM data for station i, recomputing amplitude value k in set of amplitudes S as follows:

S[k] *= V[i];

Thus for n stations in our broadcasting cluster, the audio intensity will constantly fade between transmitting at full power and radio silence. This confuses radio direction finding equipment which will constantly attempt to seek the direction in which the transmission on a given frequency is most strongly coming from, requiring only a computer to compute these values and serve audio streams to all of the stations.

This should be more than sufficient to confuse radio direction finding equipment and make it appear as if the radio transmission is coming from a random direction at all times, unless you are a substantial distance away from all 3 (or more) transmitters. The transmission power will evenly fade over the time interval between different stations, and it should render it nearly impossible for radio direction finding equipment to determine the location of the station.

[Twigman]

what about if you at just at the edge of a mesh?
you would get a signal from the nearest one incresing and decreasing (as well as weaker signals from the other ones). Surely you could then pinpoint this one. And take it down. Then continue working your way from the outside in? ALthough this method would probably be slow and not that effective.

This maybe wrong...I was just thinking...

[Thorn]

Marking a blatantly political rant as "hippie" makes it no less so. As much as I'd like to debate you on the merits of committing crimes and calling it a euphemism ("civil disobedience"), I shall merely point out the P&R forum was shut down for a reason.

Technically discussion
It's an interesting concept. However, did I miss how are you varying the RF output? If you're tying the timing cycle to the just the audio, the RF stays on full power (assuming Frequency Modulation, which is implied in LPFM) and then the RDF is just tracking several transmitters. Since the transmitters are always on, it's trivial. Plus, the listeners in the central area will have interference. If you're tying the timing cycle directly to the RF, I'm missing why you'd go through the trouble have separate audio streams. Wouldn't it be easier to have the transmitters all receiving the same audio stream and just change the RF power based on a coordinated cycle?

Assuming that you are changing the RF power, listeners in an area located centrally and equidistant from the transmitters would apparently receive a continuous signal and probably not see a significant change. However, other listeners located on the edges of different signal lobes would get differing and varying signal strengths. Depending on where a listener was located, the effects of the varying signals would probably range from a mild fading effect to so annoying that the listener would give up on it.

As far as RDF, it might take more effort, but it wouldn't be difficult. From within the central area, it would just take two teams coordinating their signal readings. From outside the central area, one team could probably do it. In fact, by circling outside the central area, a single RDF team could probably come up with most if not all the transmitters by just taking readings from two locations in a relatively short period of time. You'd need a very large area (tens of thousands of square miles) before this would be impractical. The size of an LPFM pirate's "service area" would probably be far smaller than this.

Finally, the central server that would be the single point of failure when the MIB just hauled off the server from the colo or one of the pirate operator's home or office. The server could be located via the various ISPs in a given area. Since the pirate radio stations are operating in clear violation of Federal law, then U.S. District Court subpoenas could be issued to locate specific audio streams passing though a given ISP (or their area router in the case of large ISPs). Once located on just one ISP, then it would be a matter of doing a trace back to the originating ISP and ultimately the originating server. Yes, there are ways around this such as redundant servers, offshore ISPs, leased hard lines, etc. Most would seem to have a downside in cost, practicality or both.

[bascule]

Wow, what an awesome response Thorn. Glad to see at least someone was receptive enough to my idea to give it the once over.

And thank you for pointing out a glaring omission in my writeup!

You will have to modify the transmitters and transform the outgoing audio.

What we will be implementing is essentially a power saving feature which is built into some modern FM transmitters.

It consists of a compressor and a device to regulate output power. The compressor boosts all of the output amplitudes but in a logarithmic manner so that high amplitudes are boosted significantly lower than lower amplitudes. If you were to look at an amplitude histogram, you'd see a boost towards the higher amplitudes, so that more of the signal is in the higher amplitude range.

This all offsets the effect of a device we will use to regulate output power. It consists of three parts:

- A rectifier
This can be though of as calculating the "absolute value" of the input signal. When the input signal is in generally higher amplitudes, the output voltages of this device will be higher.

- A capacitor
This calculates a moving average of the input power coming from the rectifier. It will ensure that when the input signal is louder, the capacitor's output voltage will be higher, and the output will gradually fade as the input signal moves into lower amplitude ranges.

- An amplifier tube
This will vary the output power based upon the capacitor's input. The output power will be calculated as a moving average of the absolute value of the amplitudes of the input signal, given the circuit we've constructed. Because the input is run through a compressor, when properly balanced the lower amplitudes will be received by the radio at their proper levels, because while the amplitude level has been raised the output power will be lower due to the moving average function of the capacitor. Thus the lower transmitting power will negate the effect of the compressor.

Thus the output transmitter power can be varied by a moving average function on the absolute value of the input signal, and a compressor can be used to negate the amplitude distortion which this method creates.

[Thorn]

You're welcome. I always enjoy technical discussions.

That clears up the question regarding the output, and if implemented it might eliminate interference and noise problems for some listeners, although I'm not sure about that.

I still don't see it beating RDF, however.

Presumably, you would place these unmanned transmitters in some remote locations, and tie them into the central server via DSL lines, cable, WiFi, what have you. However, should the authorities locate one transmitter, the connection ties you back to server via the ISP(s). Once you have the connection, it's easy to trace.

All in all, while an interesting idea, it seems a rather complicated way of going about it. Wouldn't just be easier to get the LPFM license in the name of someone who hasn't been busted? Or if the bad boy appeal is that strong that someone absolutely must "stick it to the man" just because they can, I'd think that a mobile rig would be cheaper and easier to implement. Now that I think about it, wasn't there a early 90's movie about a moble pirate rig...

Yup. Pump Up the Volume (1990) No idea how good it is, but I do remember they featured some music by Concrete Blond.

[John D]

As another layer of insulation couldn't you have the transmitters near someone that is feeding the transmitters wirelessly (assuming that the sheer power of the transmitter isn't killing small signal type stuff like Wifi)? That way this no hardline back to the source. Then when the transmitter is grabbed, the computer only has a wireless connection to somewhere (the person living nearby who is feeding it indirectly)? Of course the whole system would have to account for this delay.

Another way would be to record everything ahead of time. Have all transmitters having the source. And only have them in contact with each other so they know if one goes down the rest can share the load. Of course this is a lot more overhead transferring the source to each site (of course could be done by wirelessly).

John D.

[bascule]

I still don't see it beating RDF, however.

Well, being a ham operator myself and having gone on several foxhunts, with equipment ranging from an HT with an attenuator to an L-Per to a high tech triangulation rig, I'd say this method will beat all of those technologies. In order to locate stations using this method, you'd have to invest an enormous amount of time making observations from multiple locations simultaneously and attempting to correlate an enormous set of data. This will certainly defeat a traditional triangulation approach, especially if the time period during which the transition occurs is varried randomly.

Presumably, you would place these unmanned transmitters in some remote locations

They wouldn't be unmanned, they would be at the houses of volunteers. In order to enter the premises and search for the transmitter, a search warrant is required. At least in Colorado, the standard FCC policy is to issue a written warning asking you to turn off the transmitter before obtaining a warrant and shutting off the transmitter. When this happens, you simply find a new volunteer and a new location, and move the transmitter. But of course, this method is designed to prevent them from finding the transmitters in the first place.

...and tie them into the central server via DSL lines, cable, WiFi, what have you. However, should the authorities locate one transmitter, the connection ties you back to server via the ISP(s). Once you have the connection, it's easy to trace.

Except there's nothing illegal about running an Internet broadcast, only operating a transmitter. Obtaining this information would also require a search warrant or a subpoenia, the latter of which couldn't be obtained until they bust a single station.

All in all, while an interesting idea, it seems a rather complicated way of going about it. Wouldn't just be easier to get the LPFM license in the name of someone who hasn't been busted?

Which would be revoked if it were discovered that the LPFM station had ties to the pirate radio one. The law was specifically designed to disallow pirate radio stations from becoming legal LPFM stations. In order to do so a pirate station must abandon its entire identity and previous DJs, and when a pirate station has built a following (in the case of Radio Free Santa Cruz, an enormous following including the city government) abandoning an entire identity and starting over in such a way that any ties to the pirate radio station are hidden from the public view completely destroys the station identity.

Or if the bad boy appeal is that strong that someone absolutely must "stick it to the man" just because they can, I'd think that a mobile rig would be cheaper and easier to implement. Now that I think about it, wasn't there a early 90's movie about a moble pirate rig

A mobile rig is simply impractical and provides few advantages. Having an aerial antenna high enough off the ground to effect decent transmitting range would ensure that the vehicle could only operate as a radio station while parked. Then there's the matter of ensuring a reliable source signal (open WiFi would be a rather lousy solution), and the fact that RDF searches don't take much time (under an hour), it wouldn't prevent the FCC from locating the station via RDF, which was the whole point of this approach.

That's not to mention that without a land line supplying power, you'll be paying quite a bit to keep the station operating on gasoline, which is also quite a bit more maintenance intensive than hosting the transmitter at a person's home.

[hackajar]

the dc702 locals out here in Las Vegas have cooked up an idea, that has yet to get off ground. We were thinking something less then "civil disobedance" as some want to keep their jobs and such.

Our idea, very simple:
Have LPFM transmitter around town attched to friends, family and our own apparments/homes/businesses that transmit no farther then 1.5 miles. All transmitter take live feed from one source thought WLAN or Internet source. Since FCC can't touch FM stations < 1.5 miles, and all transmitters are operated "independantly" (by adding 'unique' call sign at each terminal during station reconinion commercial).

Any thoughts? (aside from my asine spelling efforts)

[TheCotMan]

Any thoughts? (aside from my asine spelling efforts)

For both ideas, if you use different WLAN or routes for delivery (or even the same network in some cases), differences in latency for delivery of voice data to the radio broadcasting stations can lead to broadcasted messages being out of sync between stations. Use of same frequencies for overlapping coverage can lead to interference-- and if audio is time delayed, result in a strange effect when the receiver is bewtween stations.

Some sort of synchronization would be needed.

[Even significant differences in CPU used can alter the speed at which the data is decompressed and broadcast.]

[hackajar]

I suppose we could impose a 5 second buffer, and have all machines on NTP, ensuring that things get syned up.

That's great thinking btw, we will have to insure everyone gets equal equpement at very least, will help a little.

Thanks for your thoughts! (sorry bas for thread hacjacking :))

[bascule]

All of these approaches would require a jitter buffer on all transmitters and network jitter correction. This could be done with what hackajar described, something as simple as NTP synchronization and an "event start" time at which data in the jitter buffer begins to be played back from all stations.

[TheCotMan]

All of these approaches would require a jitter buffer on all transmitters and network jitter correction. This could be done with what hackajar described, something as simple as NTP synchronization and an "event start" time at which data in the jitter buffer begins to be played back from all stations.

Good solution (from you and hackajar) but you should also include some sort of indexed event for long broadcasts and resynchronizations. If all broadcasts are songs, and only 2-5 minutes long, then it would be resynchronized often enough to not be any problem. If your broadcasts push to several hours without re-sync, then system scheduling (assuming generic systems with other tasks) can lead to small delays which add up over time and lead different delays.

You two are both bright people and have probably considered this too...
... sometimes I can be Mr Obvious. :-)

[And I am not being sarcastic when I state I think you two were bight people. :-]

[picoweb]

You are presuming that the delay will be introduced by conventional WLAN technology with is Approx 100-150ms Delay, but Motorola have brought out a Wireless platform called canopy advantage witch has a delay of 5-7ms making it ideal for voip streaming, audio etc.

Why reinvent the wheel, hook up apples airport express direct into the Canopy advantage unit (BTW its all plug and play, no config needed and DES encryption is available) point it all back to your main access point problem solved, house it in a convenient waterproof box.

Unless ive missed the point somewhere

[Deviant Ollam]

Unless ive missed the point somewhere

a point may have been missed somewhere... but it has less to do with radio and more to do with the dates of the posts in this thread.

[UPDATE: perhaps i being a bit hard on this newcomer... a glance a the rules doesn't show much about posts to dead threads. my understanding has been that threads with no posts in the past couple months should be left alone unless a wickedly informative new post with loads of data comes along. maybe a formal policy in the rules thread could clear this up.]

[TheCotMan]

a point may have been missed somewhere... but it has less to do with radio and more to do with the dates of the posts in this thread.

[UPDATE: perhaps i being a bit hard on this newcomer... a glance a the rules doesn't show much about posts to dead threads. my understanding has been that threads with no posts in the past couple months should be left alone unless a wickedly informative new post with loads of data comes along. maybe a formal policy in the rules thread could clear this up.]

In the case of bringing up old threads, a general guideline is this:
The value* of what you plan to contribute is directly proportional the the "age" of the thread.
About 2 weeks of age leaves a thread nearly open. (Not open to me too posts but seemingly open to casual*, productive* comments.)

* These are mostly subjective and learned through lurking.
(A social comment can be productive.)