TSCM Test Equipment - Demodulation and RF Intercept

Demodulation and RF Intercept Equipment

Rockwell International

95 ELF/VLF/HF/VHF/UHF Receiver
The 95 ELF/VLF/HF/VHF/UHF receiver is becoming the leader within the TSCM and SIGINT industry. The instrument is a wideband homodyne, fully digital radio, with signal demodulation via software control.

Due to the homodyne RF section, the sensitivity is superb, and the selectivity razor sharp. No other radio on the market even comes close.

The frequency coverage of the 95S is 3 kHz to 2 GHz, with the addition of MSY-0208 synthesizer the upper frequency range to may be increased to 8 GHz. The radio may be actually tuned all the way down to O Hz (pure DC) but the performance becomes degraded. The unit also provides an I/Q signal output to allow vector analysis of the signal.

The 95S is the 19-inch rackmount version, and the 95V a version for the VME backplane and chassis. The VME version is much more compact, and has significantly high performance.

MSS - Miniature Surveillance System
The Miniature Surveillance System (MSS) is a "TSCM Instrument in a briefcase" with general frequency coverage from 5 kHz to 2 GHz. Four versions are available, as are a wide variety of accessories (DF arrays, flux-gate compass, GPS transit, etc...)

Anyone who has received formal government training in TSCM or SIGINT has learned to use the MSS system, and will be very familiar with the MSS series.

The MSS-2100 is a complete system that provides signal detection, collection, and analysis capabilities in a single integrated package. The modular design of the system allows it to be configured to operate in a variety of operational scenarios.

The MSS-2100 system consists of:

Antenna or sensor subsystem to accept signals.
A collection and analysis subsystem for optimum signal collection within the defined frequency range.
Preprocessing of detected emissions.
A data processing function that compares detected emission characteristics to a historical database and performs analysis algorithms as defined by the operator.
A collection capability in which all spectral data is saved for later retrieval and analysis.
An operator interface to select operating modes, analyze a sensitive frequency range and display results.

The MSS-2100/WJ2 (PN: 752-8074-003) is the base-line system which uses two Watkins-Johnson receivers for the RF section (WJ-8710 and WJ-8607).

The two receivers cover the 5 kHz to 30 MHz, and 2 MHz to 2,032 MHz frequency bands respectively, to provide a system frequency range from 5 kHz to just over 2 GHz. Four additional antenna, including a built-in power-line antenna, may be connected to the VLF/HF receiver under software control. Two of the external antenna inputs may also be connected to the VHF/UHF receiver. The power-line may be routed to the VLF/HF radio to facilitate the detection of VLF eavesdropping devices installed on the AC mains.

The system includes power supply and IF interfaces for connection of an external analog signal monitor unit which may be stowed within the equipment briefcase. The system has a maximum scan rate of 350 MHz per second at maximum bandwidth. Demodulation of AM, FM, CW, IFT, ISB, AM-Pulse, USB, and LSB is included. The system supports up to five IF bandwidth filters (3 included), these filters may range from 6.4 kHz to 8 MHz.

The MSS-2100/WJ1 (PN: 752-8074-002) is the base-line system and uses one Watkins-Johnson WJ-8607 receiver, and sacrifices the VLF/HF coverage.

The MSS-2100/AOR1 (PN: 752-8074-001) utilizes a single AOR AR-3000 receiver, and provides a low cost version of the MSS (the WJ radios cost 20 times more than the single AOR radio). VLF/HF coverage in this unit is very poor, and it should not be used for TSCM services.

MSS-1200a
The MSS-1200a is an older version of the MSS with pretty much the same specifications as the MSS-2100. Frequency coverage is 10 kHz to 2 GHz, with IF bandwidths from 3 kHz to 4 MHz.

MSS-1200b
The MSS-1200b is an older version of the MSS with pretty much the same specifications as the MSS-2100. Frequency coverage is 100 kHz to 1.2 GHz, with IF bandwidths from 3 kHz to 300 kHz.

MSS-1500
The MSS-1500 is a version of the MSS-1200 which was specially made for the U.S. Government. Specifications and operations are similar to that of the MSS-1200.

MSS-3500
The MSS-3500 is expected to be announce in Fall of 1998. This system will utilize the VME version of the 95v in a mini-rack configuration. This system is expected to have coverage from DC to 8 GHz and will include both a DF, and a Modulation Recognition card.

NTN Accessory Card Cage
The NTN is a PC card cage which allow ISA cards to be driven and controlled directly by the MSS (instead of requiring a large external PC. This allows for a smaller notebook to be used and "off-loads" the ISA support to the MSS. The accessory card cage mounts inside the MSS briefcase which allows for better operational security.

MR-2100 Modulation Recognizer/Classifier
The MR-2100 Modulation Recognizer provides the TSCM team with a fully automated system which will "catalog" various types of modulation to facilitate a more though TSCM inspection. The ISA card uses multidimensional inverse co-variance matrix statistics to automatically identify up to 36 types of modulation typically within 150 millisecond per signal (33 signals in 5 seconds). A new PCMCIA and PCI version of this card is expected out in Fall 1998 (with the release of the new MSS-3500).

DF-2100 Direction Finding Subsystem
The DF-2100 Direction Finding Subsystem consists of an ISA card for a PC, and may or may not be used with an external display (depending on your requirements). Frequency coverage is from 15 - 2000 MHz in a three band 4-monopole arrangement. An optional stand-alone indicator allows independent operation without the use of a PC. Optional GPS and flux-gate compass allows mobile-in-motion use, and direct digital map overlay of vectors. The DF-2100 may be used with virtually any radio made. The system uses the well known pseudo-Doppler technique. The direction finding capability provides angle of arrival accuracy to within five degrees RMS. A new version of the DF-2100 contained on a single PCMCIA plug-in card is expected in the Fall of 1998 (with the release of the new MSS-3500).

Note: TSCM specialists using the MSS should be aware of several weaknesses with the system:

Frequency coverage is limited to below 2 GHz, which creates a problem when the threat includes the common consumer type 2.3 - 2.85 GHz video and audio transmitters available at Radio Shack and spy shops.
Frequency coverage does not fully include the 1 - 18 GHz frequency range used by covert video eavesdropping devices which are currently readily available "over-the-counter".
The unit does not address the 16, 64, and 256 QAM microwave eavesdropping devices currently in use by the various intelligence agencies worldwide.
Access to the power-line antenna system is limited to the VLF/HF sub-system and does not allow access to the VHF/UHF power line eavesdropping systems which are commonly available from 130 to 400+ Mhz.
The unit has a fairly limited IF, which causes a serious problem when the threat includes modern spread spectrum eavesdropping devices. Such devices may only be detected when an IF of 70 MHz and greater is used (the MSS is limited to a 21.4 MHz IF).
The MSS does a very poor job of detecting pulse modulated eavesdropping threats, including video transmitters, and computer bugging devices.
VLF detection only goes down to 5 kHz, which does not cover voice frequencies. When voice is applied to an AC power circuit the MSS will not indicate a threat (this is one of the favorite methods the Chinese and Soviet intelligence agencies utilize against U.S. targets).
The MSS does a very poor job of detecting Sub Carrier (Sub-C) WFM transmissions, which requires that the IF signal be applied or "looped back" to a second VLF/HF radio. The MSS does not offer a connection such as this at this time.

Watkins-Johnson

The entire Watkins-Johnson line of equipment is popular within the TSCM and SIGINT community. The equipment is expensive, ruggedized, and suitable for combat environments. The equipment is designed for use by the defense and intelligence community, with very specific requirements. Watkins-Johnson products are designed to take abuse, and virtually every spy plane, NSA facility, or listening post contains large amount of this equipment.

The bottom line regarding TSCM and WJ is that, every serious TSCM TEAM has at least $50,000 in Watkins-Johnson equipment available to use during TSCM inspections.

Anyone who has received formal government training in TSCM or SIGINT has learned to use the Watkins-Johnson receivers, and will be an expert in their usage.

WJ-8710A Compact Digital VLF/HF Receiver
This unit is a fully synthesized, general purpose HF receiver which does a fantastic job of detecting and demodulating VLF eavesdropping devices. The radio covers 5 kHz to 30 MHz, and is controlled from an external computer. Standard AM, SAM, FM, CW, USB, LSB, and ISB detection modes. The WJ-8710A is a super compact, lightweight version of the larger WJ-8711 and HF-1000. The DSO option allows Digital Scan Output, which offers the IF signal in a digital format.

WJ-8654 Miniature VHF/UHF Microceptor Receiver
The WJ-8654 Microceptor is an extremely small VHF/UHF general purpose receiver with frequency coverage from 20 MHz to 1 GHz. The HFE option extends the lower frequency range to 500 kHz, and the FE option extend the "upper side" all the way to 2.4 GHz. Standard AM, FM, CW, USB, and LSB detection modes. Subcarriers are detected by looping the output of the radio into an HF receiver such as the WJ-8710A (see above). The WJ-8654HFE may be tuned all the way down to 0 Hz (pure DC) with degraded performance. The WJ-9168 Signal Monitor Module is a very popular addition to the WJ-8654, which take two IF inputs of 21.4 MHz and creates a real time panoramic display. The entire system including the WJ-8654, HF extension, Microwave Extension, and Signal Monitor Module weighs less then six pounds, and measures only 4.5 * 3.0 * 7.8 inches. Six complete systems, battery pack, antenna, and laptop will easily fit into a standard briefcase (with room to spare).

WJ-8609A VHF/UHF Wide Bandwidth Receiver
The WJ-8609A is a small, lightweight, VHF/UHF general purpose receiver with frequency coverage from 20 MHz to 512 MHz. The FE option will extend this coverage from 20 Mhz to 2 GHz. The unit contains five bandwidths, ranging from 500 kHz to 40 MHz. The WJ-8609A is an excellent product for detecting video eavesdropping devices. The radio weighs five pounds, and measures 1.5 * 6.5 * 10.5 inches. This radio is controlled from an external laptop computer.

WJ-8609A-01 Wideband Microwave Miniceptor Receiver
The WJ-8609A-01 is used with a WJ-9290 Block downconverter to cover a frequency range from 235 MHz to 18 GHz. This permits the compact Miniceptor receiver to cover microwave frequencies. Very wide bandwidth are available (500 kHz to 40 MHz) to facilitate the detection of modern microwave spread spectrum devices.

WJ-8607A VHF/UHF Fast Miniceptor Receiver
The WJ-8607A Fast Miniceptor is small, frequency agile, lightweight, VHF/UHF general purpose receiver with frequency coverage from 2 MHz to 512 MHz. The FE option will extend this coverage to 2 Mhz to 2 GHz. The receiver can "scan" at a speed of 200uS per 25 Khz (1 MHz span in 8 milliseconds). The DSO option allows Digital Scan Output, which offers the IF signal in a digital format.This radio is controlled from an external laptop computer.

WJ-8607 VHF/UHF Miniceptor Receiver
The WJ-8607 Miniceptor is small, frequency agile, lightweight, VHF/UHF general purpose receiver with frequency coverage from 2 MHz to 512 MHz. The FE option will extend this coverage to 2 Mhz to 2 GHz. This is the older, less expensive version of the Miniceptor. The DSO option allows Digital Scan Output, which offers the IF signal in a digital format. This radio is controlled from an external laptop computer.

WJ-8809A/SYS Microwave Receiver System
The WJ-8809A/SYS is small, frequency agile, lightweight, Microwave Receiver System with frequency coverage from 100 MHz to 18.5 GHz. This is a very wide bandwidth receiver to facilitate the detection of modern microwave spread spectrum video and data eavesdropping devices. This radio is controlled from an external laptop computer.

WJ-31290-1 Miniature Microwave Receiver System
The WJ-31290-1 is miniature, lightweight, microwave receiver system with frequency coverage from 500 MHz to 26.5 GHz. The system is designed to receive high-order and high data rate PCM/QAM signals. IF outputs of 1 GHz, 160 MHz, and 70 MHz allow for a variety of bandwidths ranging from 250 kHz to 500 MHz. This is a very wide bandwidth receiver which will facilitate the detection of modern microwave spread spectrum video and data eavesdropping devices. This radio is designed to be controlled from an external laptop computer, and operated from a compact briefcase.

Condor Systems

CS-6700 ACES - Advanced Carry-On ELINT/ESM System
This system is very popular with TSCM teams. The basic system provides coverage from 500 MHz to 18 GHz, which may be extended up to 40 GHz. The system utilizes a wide instantaneous bandwidth, and has excellent sensitivity. The TN-618 Tuner provides a 1 GHz IF, with a 500 MHz bandwidth which allows for a very high probability of intercept. The system utilized a Sun Microsystems laptop for control, and will "track" up to 1024 suspect emissions. The emitter library may contain 4,000 to 10,000 entries. This system is excellent for detecting spread spectrum, frequency hopping, multi-beam, pulse and CW eavesdropping threats.

CS-2040 - Mini-Hawk Receiving System
The Mini-Hawk Receiving System is based on the HAWK architecture, and may be configured to control two spinning DF antenna systems. The C-244 controller weighs only 40 pounds, and provides a color 640 * 480 pixel display. IF outputs of 1 GHz, 160 MHz, and 21.4 MHz allow for a variety of bandwidths ranging from 100 kHz to 500 MHz. Frequency coverage of the primary system is 500 MHz to 18 GHz. Optional frequency converters will extend this coverage to include 20 MHz to 40 GHz. This system is typically vehicle mounted and used to profile the exterior of the facility prior to performing TSCM inspections.

CS-2221 - Miniature Receiving System
The CS-2221 Miniature Receiving System is a laptop controlled system covering a frequency range of 500 Mhz to 18 GHz. The system measure only 11.5" * 11" * 3.5" and weighs 28 pounds.

WJ-36400 - Spectrum Monitoring System
The WJ-36400 is easily transported and may be installed in either a transit case of rack. A cost effective superhetrodyne microwave receiver with frequency coverage from 80 MHz to 18 GHz. The scan rates, sensitivity, and wide RF/IF bandwidth exceeds that of most spectrum analysers. This system is very popular for in-place monitor of classified areas, SCIF's, and screen rooms.

Thomson-CSF

TRC-620 Series Receivers
The TRC-620 series is one finest families of intercept radios available. Three models offer frequency coverage from 300 kHz to 1.35 GHz which may be extended up to 2.7 GHz. These units utilize a digital IF, and high performance signal processing algorithms. The TRC-2981 and TRC-3941B are excellent additions to any TRC-620 series radio, and provides a panoramic display.

Marconi Defence Systems, Ltd.

Marconi Bragg Cell Receiver
A Bragg Cell receiver splits an extremely high bandwidth signal into a series of parallel frequency channels. The split signal is then detected by a series of photo detector elements. Frequency coverage is available to well over 2 GHz, with frequency resolution down to 100 kHz. Several non-linear junction detectors utilize Bragg Cells to enhance operation. A product such as this is typically used to detect frequency hopping, and spread spectrum signals.

E-Systems

Nanomin Receiver
Miniature multi-channel intercept receiver with a frequency range from 20 MHz to 1.5 GHz. Multiple IF bandwidths, and demodulation of AM, FM, and CW signals permitting the interception of voice, data, telemetry and pulse signals. Primarily used by TSCM teams as a "very fine grain" spectrum analyser which is totally controlled by a laptop.

Andrew SciComm

SCR-7204 Receiver
An excellent VHF/UHF series of radios with frequency coverage from 20 MHz to 2.5 GHz. Compact size, and integral SCD-7304 IF panoramic display.

Racal Communications

RG-5545A VHF/UHF Receiver
VHF/UHF radios with frequency coverage from 20 MHz to 1 GHz. Integral RG-1320A IF panoramic display and four IF bandwidths.

Rohde and Schwarz

EB-100 Miniport Receiver
Portable VHF/UHF radios with frequency coverage from 20 MHz to 1 GHz. Fairly sensitive, but weak above 500 MHz. HE-100 active directional antenna is handheld and provided close range detection of RF activity. Integral EPZ-100 mini IF panoramic display displays 200 kHz of the 10.7 IF. This system is very popular with TSCM teams in Europe and England but not the United States.

Hewlett Packard

HP E6501A VXI Receiver
New HP VXI mini rack based receiver system with frequency coverage from 20 MHz to 1 GHz (DC - 3 GHz optional). Powerful DSP IF processing, and very sensitive analog section. Multiple units may be used to provide a very cost effective DF system for space domain analysis. A VLF/HF mixer is typically used to extend the lower coverage to DC levels. This receiver may be used to monitor the IF output of 21.4 from a spectrum analyser. Signal demodulation is available via powerful DSP algorithms (AM, FM, PM, SS, CW, and others). Digital I and Q outputs are available to permit vector analysis. While a basic system costs $15,000 this is a very valuable system for TSCM usage.

Audiotel International

The Scanlock ECM+ Countermeasures Receiver is a TSCM instrument which covers the frequency range from 12 KHz to over 4 GHz. The spectrum is covered in two ranges; 8 KHz to 10 MHz, and 10 Mhz to 4+ GHz.

The Scanlock 2000 is an older unit with coverage from 10 Mhz to 4 GHz.

Both units are expensive, the ECM+ has a base price of $9500, and the 2000 has a base price of $5520. While both units fill a specific instrumentation requirement the funds would best be spent on a Watkins-Johnson or Rockwell radio.

Both instruments are strictly for use in low threat TSCM services.

TSCM Intercept and Search Receivers/Radios