Government Cellphone Surveillance Catalogue

Survey Equipment ICSZ Nemo-Handy Nemo Outdoor Sagem Blackfin QRC Autonomous DRT 1101B DRT 11833 DRT 1201C DRT 1301C DRT 130133 DRT 44113 SECRET NDFORH

Capabilities Description: Integrated Collection System ?Cellular Survey Tool 068M and CDMA ~Combines scanning receiver and computer into a single device -Capable of being operated remotely -AC, DC, or battery operation Limitations Planning Factors 162 Equipment Specific: oData logging on Removable CF card oDesigned for Mobile or Fixed Operation OSoftware upgradable, with ability to add addition protocols OWeight: 9 oEach protocol can be activated individually or simultaneously cRequires laptop for remote desktop application for connection to survey device 0 Battery provides "4 hours of operation 0 Requires Decode Pro 4 Software Vendor: QRC Technologies Protocols: GSM, class 0, 1 and 5) WCDMA, $195,000.00 Approval: Ground Force Commander pending designation of target SECRET nor-om

Nemo Handy (N95) Capabilities Description: oCellular Survey Tool for testing mobile applications and measuring the air interface of Wi-Fi 802.11/g wireless networks. It is complete with voice and video streaming quality MOS testing, cell and timeslot testing, and full application level metrics on voice and video calls. Limitations 8: Planning Factors i Protocols: 2100, Nemo-Handy Eguipment Specifics: I - Can only record one network at a time 850/ 900/ 1300/ hf - Easy to conceal, although H5 is not typical 1900 size/shape . When the program is running, easy to see Cost: approx $11,500.00 on the HS screen 1' 0 Does not give extended BA list Approval: Title 10 SECRET

Nemo Outdoor CAPABILITIES oCellular Survey Tool OSystem includes '2 GSM HS 01 CDMA HS 01 TDMA HS oAssorted Scanners OGPS Receiver 0 Records cellular information for download to NEMO Analyze - Can hook DTI scanners to laptop for simultaneous recording of numerous networks LIMITATIONS PLANNING FACTORS VENDOR: Nemo Outdoor Equipment Specifics: 0 Must be hooked to a laptop 0 Using entire system can be cumbersome and difficult to conceal - Does not give extended BA list - Capable of running simultaneous multiple protocol survey PROTOCOLS: 900Mhz, 1800, 850, 1900, CDMA .6912: Approx $80,000.00 APPROVAL AUTHORITY FOR USE: Title 10 SECRET f/

Sagem 0T488, 498 1 Serving Cal 2114 I. BCCH 589 BSIC 2DSC 18/2589 LAI 208431 921? 4 .53 . Capabilities Description: oCellular Survey Tool Cellular Survey Tool for measuring the air interface of GPRS wireless networks. Limitations Planning Factors Vendor: I Protocols: 850, 900, 1800, and 1900Mhz Sagem Eguipment Specifics: oCan only record one network at a time -Easy to conceal when not hooked to laptop -When the program is running, easy to see on the HS screen -Does not give extended BA list 30le Part of MRT systems Cost: approx $10,000.00 Approval: Title 10 SECRET if NOFORN

Black?n l/ll Limitations Planning Factors Capabilities Description: II adds more performance and capability to the Blackfin system while keeping the same compact package. BF II is designed to body worn or packaged for concealed missions. Can be discretely configured and controlled via blue tooth with the Mobile controller. Quad Band interrogator that can conduct passive monitoring, survey, Interception of GSM voice and SMS of a preloaded target lists, blanketed or targeted denial of service, and geo a given GSM handset. I Blackfin Equipment Specifics: - Supported Bands: Model A Model - Low power for battery operation 5 - USB or Bluetooth connection 5 i 0 Mobile controller provides limited control 5-7 hour battery life W: Harris Corporation Wireless Products Group @9595; GSM 850, 900, 1800, 1900 30le Cost: $75,000.00 Approval: Title 10 SECRET if NOFCRN

QRC Autonomous/ Lighthouse Capabilities Description: QRC Autonomous is a wireless analyzer designed for wireless network data collection on GSM networks. It automatically detects control channel activity and logs System (GSM, 802.11, etc.) information. It requires no computer during the collection phase and is designed so that literally anyone can collect data and conduct analysis upon retrieval. Limitations Planning Factors QRC Autonomous Equipment Specifics: GSM US GSM European - Complete Decoding/Encoding of Control Channel Messages -Software upgradeable i - lnternalGPS . - Mapping - Data Logging on Removable CF Card - Rugged Design; Ethernet enabled Vendor: QRC Technologies Protocols: GSM (Multi-Protocol), CDMA- 2000 9.912.; Cost; $35,995.00 Approval: Title 10 s. ECRET .311" :3

r1- DRT 1101B Limitations Planning Factors DRT 11018 Equipment Specifics: Maximum Number of Channels: Cit?: (barf-duplex) 4E: {mif-dupiex) Frequency Coverage: 0 2 MHZ .3035! Pit?=2 Compatible with: 283-3, XP Audio Outputs: 1??Chamel Analog his-Channel lnlema! Signal Hemmer Stereo Audi): (050003? Controlled from PC. usmg Windows ma Ethernet interface User~fnendly Graphica?: User interface integrated spectrum acaiveis tool Capabilities Description: The DRT 11018 provides a compact, yet powerful, surveillance capability against a variety of analog and digital wireless standards. The DRT11013 can be configured to support DF, digital voice intercept/recording, supports target lists of up to 10,000 entries, and has a flexible tuner configuration which provides frequency coverage of all bands of interest. Up to four tuners can be incorporated in unit. Protocols; Multi-protocol BOIP: Cost: $78,850.00 Approval: Title 10/ 50 DEFT. FE: ff ?34,318'P'r' (ill: Vendor: Digital Receiver Technologies r\r r2 .. U1. Fat?3y lama [il? January 3034

DRT 11833 Z?i? i . :35fig. 53m ?1 a unit. Limitations Planning Factors IF DRT 11838 Equipment Specifics: - Flexible tuner configuration provides frequency coverage of all bands of interest. - RFT3: Dual channel transceiver coverage from 2- 3' 3000 HF from 0.5 - 32 High performance HF receiver from 0.2-30 - MUT1: Microwave receiverfrom 0.2-8.5 0 FPGA based Wireless Processor, WPMB, enables yvideband signal processing. Can also generate a 32+ narrowband signals Approval: Title 10/ 50 SECRET i/ NDFORN Capabilities Description: The DRT 1183 provides a powerful surveillance capability against a variety of analog and digital wireless standards. The DRT1183 can be configured to support DF, digital voice intercept/recording, supports target lists of up to 10,000 entries, and has a flexible tuner configuration which provides frequency coverage of all bands of interest. Up to four tuners can be incorporated in DERIVED FROM: DATED: 01 May Vendor: Digital Receiver Technologies Protocols: Multi-protocol 'vr Pb .larmar?; .7034

RT 1201c Ca pa bilities Description: The DRT 1201C provides a compact, yet powerful, surveillance capability against a variety of analog and digital wireless standards. The DRT1201C can be configured to support DF, digital voice intercept] recording, supports target lists of up to 10,000 entries, and has a flexible tuner configuration which provides frequency coverage of all bands of interest. Up to four tuners can be incorporated in unit. Limitations Planning Factors DRT 1201C Equipment Specifics 1 - Monitors up to 544+ half-duplex channels (32+ channels per WPMB). Software configurable to process various wireless standards. - Processes multiple formats simultaneously. DF option available. Flexible tuner configuration provides frequency coverage of all bands of interest. Dual channel transceiver coverage from 2-3000 HF from 0.5 - 32 HFle High performance HF receiver from 0.2-30 - Microwave receiver from 0.2-8.5 - FPGA based Wireless Processor, WPMB, enables wideband signal processing. Can also generate 32+ narrowband signals. 1 i SECRET ff Vendor: Digital Receiver Technologies Protocols: Multi-protocol eels; .9922 Approval: Title 10/ 50 FRITIM: DATED: 01 May 25";16 UN: January 253%

DRT 1301C Limitations Planning Factors i standards. Processes multipie formats simultaneously. DRT 1301C Equipment Specifics: - Software configurable to process various wireless DF option available. I INMARSAT software is available Provided expanded frequency coverage and i bandwidth - Designed for harsh environments - 8 full Duplex or 16 half duplex conversations simultaneously 20 to 3000 - Weight: 10.5 pounds SECRET if .2323}? <21: Ca Qabilities Description: The DRT 1301C provides a miniature, yet powerful, surveillance capability against a variety of analog and digital wireless standards. It extends the capabilities of previous DRT systems. It incorporates advanced passive cooling technology eliminating the need for a noisy fan. Vendor: Digital Receiver Technologies Protocols: Multi-protocol BOIP: Cost: Approval: Title 10/ 50

DRT 130133 I Capabilities Description: The DRT 130183 provides smaller/ rugged surveillance capability against a greater variety of analog and digital wireless standards than the DRT130183 can be configured to support DF, digital voice intercept] recording, supports target lists of up to 10,000 entries and incorporates higher performance control processors for increased processing speed and faster boot times. Limitations Planning Factors Vendor: Digital Receiver Technologies DRT 130183 EguipmentSpecifics: Protocols: Multi-protocol - Processing/Monitoring of up to 24 channels. 1 BOI P, Dual Wideband RF Tuners provide frequency coverage of all wireless bands of interest (20-1150 1429-2500 0 Auto-configuration mode facilitates setup of unit; . recognizes and decodes all control and traffic Title 10/ 50 i messages 3 0 Small size and light weight 0 Low noise signature i 0 Low power requirement u-Jau23.319; :11 lv?fu'ylc: ?3 Ir rarl?grr -- -. 'r 55mg dorsal on. feudal",

DRT 44113 Limitations Planning Factors Capabilities Description: The DRT 44113 is a miniature receiving system that provides powerful electronic surveillance capability against a variety of analog and digital wireless standards. Utilizing the latest in digital signal processing (DSP) and micro-processor technology. Vendor: Digital Receiver Technologies DRT 44113 Equipment Specifics: RESTRICTED SYSTEM Small size and light weight and quiet Low noise signature Low power requirement Protocols: 2 3 13.93 921m: 2 git}. . Approval: Title 10/ 50 DERIVED FROM: DATED: 01 May 2006 SECRET NOFCRN ASSIFY on: 07 Janna"! 303:1

Fixed Wing Geo-Location (Manned) Ga?ruda Carman I ll Typhon Windjammer Radiance Raven Deerpark Adder Traveler Nebula NGW lcarus/ Radio (New Development) Near Vertical Direction Finding (NVDF) SECRET NOFORN RATED: May 2306 ON: (37 January 33?. 4

Garuda (G-Box) Capabilities Description: The G-Box is used as a GSM airborne geo-location system to replicate a GSM network Base Station. They operate by attracting and registering handsets operating on the local commercial network. Each handset's (International Mobile Subscriber Identity) or (international Mobile Station Equipment Identity) is compared against the '5 target watch list. When a targeted handset is identified and registered to the box, a geo- location solution is calculated. G-Box was specifically designed and built for gee-location missions in fixed wing aircraft (manned/ unmanned). Garuda received a software upgrade that modified the algorithm software, which allows the system to take 1000 entries. G-Box Equipment Specifics: I - Dual band system (900/1800 850-1900 - RX BAND 880-915 1710-1785 MHZ System GPS 3 - Active Band - L1 1575.42 10 - L2 1227.00 10 MHZ - Effective Ranges- Min: 5 miles Max: UKN i i i TX BAND 925-960 8: 1805-1880 MHZ Target List Max: 1000 targets SECRET Vendor: VIA SEPCOR Protocols: GSM $185,000.00 Approval: Title 10 Lamar); 01 May 2:06 i; 51:01:50? on: 203.4

Carmn Ca Qabilities geiQLHR?Qmjhe C450): is used as a GSM air 8: ground gee-location system to replicate a GSM ?atwork Ease Station. It operates by 2? Fig-arid registeringhandseis Operating on the local commercial H?s-ref 'handset?siMSl er MB is compared against the jet ?s Fittings a targeted handset is identified and registered tease ?Elan Estelculaied. The Carmen can also be used pre I g?jSM calls. Carman has provided .c?li?ijL'jxfl'he G-boxes and Carmen are - is lit run a different firmware and LimitatIOI?IS 8: Planning Facteg; - C?Box Equipment Specifics: Single band system (850, 900, 1800 Sr. Mitzi RX BAND 880-915 MHZ TX BAND 925-960 MHZ 77 System GPS Active L1le Band L1 1575.42 10 L2 1227.00 10 Effective Range: Min 5 miles Max UKN 1 Target List Max: 500 targets, recommend <400 Agar-oval: software includes EA capabilities that the G-Box Series does not have (Deny, Disrupt, Degrade and Deceive). .. a ?l - r060.00 i a I 3mm: 01 May 22.1.16 SECRET NOFORN w: laser?? on: 3?34

Carman ll Limitations 8: Planning Factors C-Box ll Equipment Specifics: Single band system (850, 900, 1800 1900 Size 15.5" 3.5" 1 Weight: 15le (batteries not included) RX BAND 880-915 MHZ TX BAND 925-960 MHZ System GPS - Active L2 Band I L1 1575.42 10 MHZ L2 1227.00 10 Effective Range: Min 5 miles Max UKN Target List Max: 500 targets, recommend <400 software includes EA capabilities that the (5-50): Series does not have (Deny, Disrupt, Degrade and Deceive). SECRET ff NOFORN Capabilities Description: The C-Box II is a GSM BTS operating in the 850/900/ 1800/1900 GSM bands that establishes connection with targeting devices. It operates by attracting and registering handsets operating on the local commercial network. Each handset?s IMSI or IMEI is compared against the target watch list. Vendor: Key Protocols: GSM we: git: $130,000.00 Approval: Title 10 DERIVED FROM: DATED: 01 May 2006 UFO Oil: 07.lanu:4.ry 2034

Typhoon Capabilities Description: The Typhon is used as a GSM airborne geo-location system to replicate a GSM network Base Station. They operate by attracting and registering handsets operating on the local commercial network. Each handset?s lMSi (international Mobile Subscriber Identity) or IMEI (International Mobile Station Equipment Identity) is compared against the target watch list. When a targeted handset is identified and registered to the box, a geo-location solution is calculated. Typhoon was specifically designed and built for geo-location missions in fixed wing aircraft (manned/unmanned). Limitations 8: Planning Factors Typhoon Equipment Specifics: - 30km+ range in rural areas, 5km in urban areas - Integrated GPS Highly mobile 0 Field Upgradable Battery or vehicle power capable - 4-8 hour battery life 20 pounds with out the battery NOFORN Vendor: NSA TAO Protocols: GSM 850/1900, 900/1800 mm Egg; $175,800.00 Approval: (Title 10 only under 5-35) l- ROM: DATFD. (51 May 23:36 ON: 07 January 2(?34

r. i Windjammer on cam33* 5mm Limitations 8: Planning Factors Windjammer Equipment Specifics: Networks: lnmarsat miniM, Thuraya TX BAND: Tuning Range: L-Band (1525-1559 . RF Output Power: Selectable from -12 to +37 RX BAND: . Full Range Receiver: 1525 - 1665 Upiink Receiver: 1626.5 - 1665 1 GPS RX: Antenna Connector: SMA 20 dBi gain, SWR 2.5 Range >2 miles ground, >8 miles air capabilities Description: Windjammer is a Thuraya, INMARSAT hand- held satellite simulator that can conduct survey, stimulation, denial of service, and geo-location of a given target handset. It presents itself to satellite terminals as the network issuing commands that cause the terminals to communicate with the system directly. The terminal identities are determined at which time they may be actively geo?located. Variants include Portable (pictured), Rack System for simultaneous, multi-network operations, and UAV Systems which include a low bandwidth remote control capability. i i Antenna: External 1575.42 RH polarization, active 3 V, SECRET Vendor: SR Technologies Protocols: Inmarsat, Thuraya 5.91.93. git: $192,000.00 Approval: Title 10/ 50 (Pl Mary 2336 i'Jl?J:

Radiance 1 Capabilities Description: Radiance is a self-contained portable airborne and ground interrogator system capable of capturing, interrogating, and geo-locating CDMA-2000 and [5-95 mobile devices. Radiance captures, interrogates, and geo-locates the handset by continuously collecting range data on the target and pairing this data with the GPS location of the Radiance system. Limitations Planning Factors Radiance Equipment Specifics: - Band: (single-banded system) Requires separate network survey device (ICSZ 1 from QRC Inc.) Causes Denial of Service (DOS) during operation to CDMA network for short period - 27 Jan- 12 Feb - Deployed for two week operational assessment/Combat Evaluation (OIF) i - integration difficult due to size SECRET Vendor: Vendor West Protocols: 450, 800, and CDMA 2000 59$; 93!; Approval: Title 10 f?lz. JIM): i-l Ma}, Lu ?3 ON:

:Raven_ Qapabilities Description: Raven is used to interrogate WCDMA phones and to geolocate target phones from the air or from the ground. Interrogation is the process of getting phones to send information such as their unique identifiers IMSI and lMEl). Geolocation is the process of determining the geographical location of a target phone. Limitations Planning Factors Raven Equipment Specifics: - Band: UMTS (single banded system) - - Requires separate network survey device Causes Denial of Service (DOS) during Operation to UMTS network for short period Developmental Vendor: Vendor West Protocols: UMTS Lost; Approval: Title 10 FRCM: DARE): 01 Ma} ?337.56 January 203-4

?ee'Park Capabilities - Targets 450 sub?band NC, 800, and 1900MH2 lS-95 mobile devices - Multi-banded system - Unique identifiers include ESNIMEID - Passive survey of handsetslbase stations - Passive gee-location of handsetslbase stations - Active stimulationlgeolocation of handsets - Active survey/geolocation of handsets Limitations 8: Planning Factors Rincon [Aw NR0 ir? m? CDMA 450, 850, 1900 Deerpark Eguipment Specifics: BOIP, 5 - Ground/Airborne CDMA only Does NOT cause denial of service Cost: - 205 w! Adder all four Filter Amps 1i Requires 28 VDC at ~25 amps for operation, draws 700w for Adder and one Filter Amp - Can be operated on large wheeled vehicle utilizing 12 to 28 VDC up?converter Approval: Title 10 . BERIVEDFROM: h? .s New?? Oil 07 Jetway 211324

Trave'er (EW Ca pabilities Description: TRAVELER is a developed software defined multi-protocol system capable of active/ passive GSM geo-location, passive GSM survey/tower mapping, intercept/DE. Thu raya intercept/copy/geo? location. Traveler passive capability reduces network signature/im pact on the network. Provides robust airborne network survey capability. Limitations Planning Factors Vendor: BAE Systems Traveler Equipment Speci?cs: 0 10 channel, to airborne software programmable 3 system designed to survey and gee-locate designated signals of interest - Targets the 850, 900, 1800, and 1900MH2 GSM bands. 0 Traveler is designed so that adding additional is a matter of 3 porting software into the Traveler processing unit. - The near-term to include CDMA and UMTS 0 Multi-Channel Spatial Processing (Co-Channel Reduction} Covert On-Demand Active Techniques 0 Moveable Between Platforms in Field - Multi-Channel Direction Finding (DF) 0 Correlation Interferometer Precision Geo?location (CIGL) 2:5: .ET :4 Protocols: GSM 850/ 1900, 900/1800 passive GSM survey/semi-passive geolocate, HPCP, PTT, Thuraya (Vagrant). Future 50! ports planned include: CDMA (Deer Park), UMTS TTL $750k Approval: Title 10 .5.

Nebula Capabilities Description: Nebula is an NSA Developmentalairborne multi-protocol box designed for gen-location against GSM (Multi-Band), CDMA, UMTS, and H. Currently can target HPCP, GS M, Inmarsat, Thuraya, CDMA-ZDOO, HSDPA. The NSA is leading system development (NSA lead). Factors Nebula Equipment Specifics: Band: GSM UMTS, . HSDPA. - Able to lock and hold traffic from 12 miles away - Air/Ground Geo-location ability to within 200m (results often closer to a 10m CEP) - Able to change channels without dropping locked HS 3 High DC power requirements (Nebula 2C) 1 Power requirement: 450 Watts 36VDC Weight 45 pounds 27 LT ff lx? 3 {5?6 F7 Lem: Protocols: GSM (multi-band), CDMA, UMTS, LTE, HSDPA, HPCP, lnmarsat, Thuraya TBD Approval: Title 50 C- Eli?l?r'l' i7 PRC-M: DATED: May EJCXG F-l?i?l ON: la: :1 20.74-

NVDF Limitations Planning Factors NVDF Equipment Specifics: Better look-angle, resolu?on, and accuracy for 1 sensors (directly above target, 60 degrees angle, sub 50m accuracy achieved in CONUS testing) - More favorable intercept conditions for low power emitters (Locate priority talkers vice repeaters) - Instantaneous Geolocation from a signal measurement due to a 2D look-down antenna array. - Proto-type (CIA) system designed for general aviation acft. AST Hydrah processor, 4x10 ft array w/ cavity backed circular polarized spiral antennas designed to cover 100- 500Mhz range. Capabilities Description: NVDF provides instantaneous PTT UHF geolocation capability to support missions where it is possibleto fly much closer to targets than traditional stand-off systems. Ideal for rural or remote areas where the density of emitters is low (no inherent interference cancellation, ideal for AFG operations) Signal types for initial system frequency range: 100-500 (Push to Talk Transceivers (PTT). FRS Transceivers, High- Powered Cordless Phones (Handset and Base Station) CW Beacons and RF Tags, Trunk Mobile Radios Vendor: AST Protocols: PTT LOB 99g; $1.5 mil Aggroval: Title 10 FRCM: DATED: Cl L'Iav 3036 DECLASSEFY January 2034

PGL Payloads on UAVs Twister 5-100 w/ Carman ll ahd Windjammer Gauva GarWind (BLOS G-Pod) Gilgamesh Airhandler BLOS Radiance (BLOS Rad-Pod) Jagged Amber Traveler Pod FROM: 1- .n DAT LU: A SECRET Mum is" UN: 07 Latin;

Current - v. a? I- minds

SECRET Twister Firescout APG Capabilities Description: Twister is a multi-frequency band, micro-class Base Station Router. Its has a power output of +43dBm, integrated GPS, Voice High-speed Data capability, GSM security making system highly mobile and deployable for field use. The system is designed for VBTS GUI Software support which includes full VBTS GUI feature base and applications. The software aliows for complete command and control, which provides support for a variety of ?eld applications. The system is optimized for low power consumption, custom installation, and familiarity of use w/ existing VBTS GUI operators. Specifications: Physical Dimensions: Twister BSR: 2.13? 0 Twister Aux Front-End: Weight - Twister BSR 3.5 Twister Aux Front-End: 6.5 Environmental Operating Temp: 0? to (90% humidity non-condensing) - Storage Temp: to Convection cooled GSM Frequency Capabilities - EGSM (900Mhz), DCS (1800Mhz), PC5 (1900 Mhz) - Full-rate Voice Encoder, Basic SMS Messaging Power: Input VoltaE Range 28 VDC Input Power Requirements 55W (Max) in typical configuration :5 7:35' SECRET integrator: Northrop Grumman ICW PMA-ZBG Protocols: GSM 900/ 1800/ 1900 Approval Authority: GFC IAW host nation GCC approvals a

Bein/Schiebel 5-100 Ca pabilities Description: System Provides Real Time Land or Sea-based ISR. KPPs - Maritime Takeoff and Landing 50?x44' Helicopter Pad, Sea-State 2 (T) - Data Link Range up to 180 km - 6 Endurance 55 25 kg (55 lbs) payload - UnpacklPack-up in <6 Hr (T) - Max Air speed: 130 (240 kmlh) IAS - Cruise Speed: 100 (185 kmlh) - Ceiling: 18, 000 ft in ISA conditions reduced GW - Operating temp: (-40 to 131 winds up to 25 (46 kmlh) . ?he, 1E. - Limitations Plannin Factors Vendor; Boeing KATAHDIN EquipmentSnecifics: Protocols: GSM, Thuraya FMV - CAN NOT ARM with weapons lnternalST6 maritime requirement On_Hand: TBD Approval: Title 10 ammo mom: DATED: 01 Mag/2006 SECRET NOFORN cw: OYJanuary 203.4

SECRET GUAVA Los Limitations Planning Factors Capabilities Description: The SP1 G-Pod system is a GSM airborne (UAV) geo-location system to replicate a GSM network Base Station. The G-pod (Garuda in an 18 inch post deployed on the MO.- 1/9 acft. Once at mission altitude,the Ground Control Data Link (operated from Surface Terminal Element, STE) contacts the G-pod and creates an Ethernet connection for payload command and control as well as data link command and control. The payload operator is than free to perform mission activities while the air to ground control data link tracks and maintainsa connection with the UAV sensor pod. Guava Eguipment Speci?cs: G-pod (G-Box in a pod, see G-box specs) Data Link: TCDL Xmit Power: >10 Watts. Power Consumption: <600 watts Dimensions: 68" 18? Weight: 125 with sensor G-Pod Ground Station (Surface Terminal Element, STE) Data Link: TCDL Xmit Power: 2 watts. Power Consumption: <2000 watts Dimensions: 8 feet diameter System Range: 90 NM Integrato Northrop Grumman ISICW General Atomics Protocols: GSM 900/1800 Approval: Ground Force Commander IAW host nation GCC approvals (PF-nt'r 'f rung-mm?

GarWind/ BLOS Pod Limitations 8: Planning Factors Garwind Equipment Speci?cs: 31 Mar 09 1 Apr: Test POD KU connectivity at Cannon Successful. 4-6 Jun 09? ConductTest bed Network evaluation and certification at . Successful. 18 Dec 09 Planned completion date for integration. Jan 10 UTC Plan to field first MQ-9 w/ BLOS POD and upgrade entire ?eet of PODS. Priority first on and then on the MQ?l?s once integration testing is completed on that platform. SECRET 1/ r??'liFCr?rlz?l Capabilities Description: BLOS G-Pod. Garwind is a GSM airborne (UAV) geo-location system to replicate a GSM network Base Station deployed on the Predator UAV. With BLOS capabilities Garwind is able to operate in areas without a Surface Terminal Element (STE) reducing the need for a ground footprint. Garwind allows the transfer of G-Pod and Windjammer sensor data over the BLOS SOCOM Ku- Band SATCOM datalink using the Garwind Ground Control System (GCS) Vendor: Protocols: GSM (multi-band) 5.912.: On?Hand: p93: Approval: Title 10 Elk-L1) i??itlh'i: DATED: 01 May 30:76 (Ill: 2531-11

SECRET Gilgamesh Ca pa bilities Description: Gilgamesh is a Geo-location device designed to conduct BLOS UAV APG operations from aircraft. Gilgamesh is controlled via the Air Handler/Predator KU Band data link and does not require a STE to operate. System geo?locates with same accuracy and generally same TTP as other systems. Currently C2 interface via NSA Net. Limitations Planning Factors rm, i Equipment Specifics: AWR completed for 4 aircraft 5 Weight: "8.5 (LRU), requires modi?ed VSAE i I a including antenna and cable harness on both 1/9 acft Bandwidth requirements: Typicalconfiguration, I 4800 uplink, 256 downlink 5 - Requires Airhandler to operate Current Payloads: Gilgamesh LRU Payload Vendorls): Protected, SNC Vendor: Sierra Nevada Corporation ICW NSA and General Atomics Protocols: GSM 900/1800 (one band available in flight). Requires separate vertical tailfin antenna assembly (VSAE) per band. Approval: Ground Force Commander .. :lAWhost nation GCC approvals SECRET

SECRET Airhand'e" - Capabilities Description: Airhandler is designed to conduct BLOS UAV gee-location operations from aircraft primarily used against low-band (PTT) signals-of- interest. Airhandler is controlled via the acft KU Band data link. Currently CZ interface via NSA Net. Requires multiple collection nodes for increased gen-location accuracy. L'm'tat'ons 8? Plann'm Facmrs Vendor: Sierra Nevada Corporation ICW Equipmentsped?w NSA and General Atomrcs - AWR completed for Protocols: PTT (primary), COMINT 130- 3 aircraft -Weight:~13 requires modified VSAE 180Mhz? 220 475Mhz? freq range 20 1 including antenna and cable harness on both 3000Mhz 1/9 . Approval: Ground Force Commander IAW - BandWIdth requirements: Typicalconflguratron, 4800 uplink, 256 downlink host natlon approvals . 0 Current Payloads: Gilgamesh LRU Payload qr - [rt-i - . w. V: 94. SECRET

SECRET - Pod - Capabilities Description: Pod based capability that allows for remote operation of Ethernet payloads removing the requirement for dedicated, line-of-sight (LOS) tactical data link. Ethernet data is routed over the aircraft?s serial SATCOM data link using an Asymmetric Ethernet Device (AED). The AED is placed on each end of the aircraft?s SATCOM data link (onboard Pod, GCS) and is used to convert Ethernet data to serial for transit across the link. Integrator: Northrop Grumman IS ICW Equipment Specifics: General Atomics - AWR completed for USSOCOM aircraft, Protocols: GSM 900/1800, - Pod weight: "123 (with payloads) Thuraya/I nmarsat Bandwidth requirements: Typical configuration, 4800 bpsupnnk'zse down?nk Approval. Ground Force Commander IAW Current Payloads: host nation GCC approvals I - Payload Vendor(s): Protected, SR Technologies SECRET

SECRET RADPOD (Radiance Pod) Capabilities Description: Pod based capability that allows for remote Operation of Ethernet payloads removing the requirement for dedicated, line-of-sight (LOS) tactical data link. Ethernet data is routed over the aircraft?s serial SATCOM data link using an Asymmetric Ethernet Device (AED). The AED is placed on each end of the aircraft?s SATCOM data link (onboard Pod, GCS) and is used to convert Ethernet data to serial for transit across the link. Integrator: Northrop Grumman IS General Atomics EquipmentSpecifics: 3 - AWR completed for ussocom aircraft .1 350Mhz - - Pod weight:"131 (with Radiance payload) Approval: Ground Force Commander IAW Bandwidth requirements: Typicalconfiguration, 4800 uplink, 256 downlink I - Current Payload Radiance 850 - Payload Vendor(s): Protected 7 .r host nation GCC approvals

UNCLASSLFIED Developmental . 2, UNCLASSIFIED

SECRET Jag-390? Amber NextGen BLOS Capabilities Description: Pod based capability that allows for remote operation of Ethernet payloads removing the requirement for dedicated, line-of?sight (LOS) tactical data link. Ethernet data is routed over dedicated airborne SATCOM terminal integrated into the pod, removing the requirement to leverage acft KU-Band C2 link and allowing for higher dedicated BW for future lO/TTL/communications requirements Ecpiipment Specifics: 0 ln development for USSOCOM 1 - Pod weight: ?250 (with payloads) i - Current Payload (s):Twister, Siren, Windjammer, Vector i Payload Vendor(s): Protected, AST, SR Technologies Integrate Northrop Grumman IS ICW Big Safari 8: General Atomics Protocols: GSM 900/1800, CDMA 450/800, Thuraya/lnmarsat, TTL Approval: Ground Force Commander lAw host nation GCC approvals

SECRET Traveler 1 Pod -Po 1 Lam ?t ?33. Description: Pod based software defined multi- s? ?we protocol system capable of GSM survey/map/geo- .I . a 1- 255*: location, CDMA survey/map geo?location, 7 interce pt/DF, Thuraya intercept/copy/geo-location. Traveler?sless instrusive techniques reduces network signature/impact on the network. Provides ,a robust airborne network survey capability. lntegrato BAE Systems ICW General EquipmentSpecifics: Atomics 0 In developmentfor USSOCOM Warrior Blk-1 Protocols: GSM, Thuraya, - 5?35 awaiting 3U Travelervariant prior to Pod integration TTL P?d Weigh? "180 Approval: Ground Force Commander lAw 0 Current Payload Traveler 6U (Warrior) . - Payload Systems hOSt nation GCC approvals .73. an.

Ground Based Geo-Location ., (Vehicular) GX-ZOO Yellowstone Kingfish Artemis . tingray I ll Maxnmus . Spartacus ll Hayden ll? Carman Carman ll . StarGrazer Cyclone Mx9 Sidewinder Windjammer RESUS - ,2 Buckshot Ra l0 (ln eve ogmen sacs-11E?

3.. Limitatio ns 8: Planning Fac. GKQBO EquipmentSpecj?cs: 2x Dual band arm/18:19 high pewer receivere Airointerface survey, interrogation and release functionality 6 High volume registration and cave rt traf?c channel establishment - High performance cuctom RF and signal processing hardware - Advanced smart diversity reverse enhanced receiver 0 Largely replaced by the Maximus 31 i . ET NUFORN Qagabili?ties Nearly identical to the (33.109 S-erles (Nemasis), the upgraded series performs the same capacity in gromdorole GEM stimufation: however, the a more rubusi ap-erator system capable of better advanced o-?set targeting. and h?gher S- tern reiies on second system. Artem?s, for i?gphon issued t0 SIGINT laced with Maximus. or: Ma?rtone Radio Technology, Inc. {ll ON: 137 Jarluai', 3753/1

Artemis Capabilities Description: Artemis is a dual band 850/1900 900/ 1800 system that provides a GSM gee-location capabilitv similar to Carmen and G-box. However, it cannot be operated effectively from air platforms and is currently used exclusively as a ground system in coordination with Nemesis/Maximus (or other stimulation device that locks a handset and enables the Mobile antennas can be located with an accuracy of 5 degrees used to create a CEP around the target. Limitations Planning Factors Artemis Equipment Speci?cs: User friendly GUI End to End Built in Test - Fully digital processing of RF signals based on angle resolving techniques - 6?channel simultaneous wideband DF measurement Artemis to be used for Thuraya in development SECRET f/ NOFORN Vendor: MRT Protocols: Dual band 850/1900 900/1800 GSM (lei $83,333.00 Approval: Title 10 Bill! JED 01 if.ng 2005 ASSEFT Sill: January 25134

Artemis ll CEP around the target. Capabilities Description: Artemis is a dual band 850/1900 900/1800 system that provides a GSM gee-location capabilig similar to Carmen and G-box. However, it cannot be operated effectively from air platforms and is currently used exclusively as a ground system in coordination with Nemesis/Maximus (or other stimulation device that locks a handset and enables the DF). Mobile antennas can be located with an accuracy of 5 degrees used to create a Limitations Planning Factors Vendor: MRT Artemis Equipment Speci?cs: User friendly End to End Built in Test - Fully digital processing of RF signals based on angle resolving techniques 0 6-channel simultaneouswideband DF measurement Artemis to be used for Thuraya in development 900/ 1800 GSM BOIP: Cost: $83,333.00 Approval: Title 10 SECRET NOFCRN Protocols: Dual band 850/1900 [if lilVEi?J i-?Fifi?lvi: DATED: 01' Mai,- 2006 DELLASSIFY Old: 07 January 2030

Maximus Ca abilities Description: Ground GSM stimulation 8: geo-location device 0 Replicates BTS to STIM handset into RF TCH allowing for DF 0 Provides limited capability to isolate targets utilizing Firewall op?on - Sagem HS included to provide network survey 0 Incorporates Artemis in system to provide geo?location data from both moving and stationary vehicle (zero baseline) 0 System provides extended BA list with commonality chart Limitations 8: Planning Factors Maximus Equipment Specifics: 0 Approx ground distance 1- 4 Km 0 Target Handset must be on 8: not engaged in a call 0 Locking handset into TCH drains battery and raises signal strength 0 Use of system requires deconfliction w/ other geo i elements in A0 0 Network can identify rogue BTS 0 Improper use can impact network SECRET Vendor: Martone Radio Technology, Inc. Protocols: GSM BOIP: 33 Cost: $365,000.00 Approval: Title 10 Lil-?Cl E5): 01 20:16 Littll?lSSEF?i? (Eli: Jan-:55; Ell-?4

.Sartacus Capabilities match i can then be . 3 (55 ?nt call) and goo-located vein "Artemis" device or __Iocated with the use of direction finding devices. y-tg . Radio Technology, Inc. Limitations 8: Planning Factors. I a - .l .. 1800 (single band) Spartacus Eguigment Speci?cs: - Caution should be used to avoid direct cont-act with the antenna element while transmitting Currently only a single band GSM system to be I upgraded to multiband . 4 hour battery life 0 Approx ground distancesystem requires deconfliction w/other geo Apgroval: Ground Force Commander elements in A0 a - Improper use can impact network M. . . "m . wow: 01 May 2.7.136 SECRET EECLASSIH on: 07 Janan 2634

Spartacus ll Capabilities Description: Standalone, man portable, vehicle and airborne PGL system. Simultaneous dual band/ dual BTS with Receive diversity. Artemis l/ll interface for cross border operations. Works in conjunction with Rover software application. Able to go from Airborne or vehicle mount configuration to dismounted operation with no change to system. Grab and go. The smallest dual band/high powered system on the market Limitations Planning Factors Vendor: Martone Radio Technology, Inc. i artacusIlE ui mentS ecifics: GSM 900/1800 (SingIEband) - 900 8: 1800 simultaneous operation BOIP: 10 watts per BTS Cost. - Size: 12? 3.5? 10" i Weight: 12 I DF when connected with Artemis l/ll, TOA ABE-ova}: Title 10 in stand-alone 5 hours battery life at 5 watts - Improper use can impact network mom: DATED: 01 May 20:95 SECRET NOFORN DEC: Assn-Y on; Partner; 25-9?:

Cyclone Mx9 (Micro/ Macro) No Photo Available C_apa_bi i_ti_e_? Description: Developmental highly mobile ground GSM stimulation geo-location device - Replicates BTS to STIM handset into RF TCH allowing for DF - GSM security and - Integrated GPS - Overlay GSM cellular communications supporting up to 32 Cyclone systems Limitations Planning Factors Cyclone Mx9 Eguipment Specifics: - 15+ km range, Urban range 1.25 km 3 - Utilizes existing Typhon GUI, no additional training required . - Weight: 6 pounds a - AC, DC, or battery powered - 70 WH battery provides 90 minutes run time, 800WH battery provides 9-15 hours SECRET NOFOFN Vendor: Protocols: GSM 5913: Developmental Q9333 $106,000.00 estimate Approval: 35mm: mom: 01 May 202-6 mm on: or awry 202:4

Windjammer (Ground) See Windjammer under Fixed-Wing (Manned) {.WtiiEU: L?l {.1617 ?035 SECRET iWle?lef UN: 01' Murry

Buckshot Capabilities Description: Project Buckshot is a ground direction finding (DF) system specifically targeting PTT radios. The system is designed as a carry-on system suitable for quick install, low profile passive missions. Developmental item of interest. Not fielded in quantity. Limitations Planning Factors Vendor: Herrick Technical Laboratories Protocols: PTT Buckshot Equipment Specifics: i DIP. - Frequency Coverage: 30MH2 to i - Capture bandwidth: Programmable up to $401000-00 200 KH Approval: Title 10 l'l-Cllv'l: DATED: 3-1 May Pic-=73} "p r' .gm . .-.. Etc-cl Le sulfa: girl. Nani-cry

. . CAPABILITIES Description: 0 Ground GSM stimulation device 0 Replicates BTS to STIM handset into RF TCH allowing for DF 0 Provides limited capability to isolate targets utilizing wild card or reject cause 0 Plots to Falcon View and allows track of dynamic targets 0 Optional 5 Watt Amp can be attached Backpack version of Carman LIMITATIONS 8: PLANNING FACTORS Yellowstone Equipment Specifics: - Approx ground distance 200m 0 Target Handset must be on not engaged in a call 0 Locking handset into TCCH drains battery and raises signal strength 0 Target watch list limited to 500 IMEI 8; IMSI - Use of system requires deconfliction w/other geo elements in A0 0 Network can identify rogue BTS - Improper use can impact network SECRET VENDOR: OGA provide vendor protected PROTOCOLS: 900Mhz, 1800Mhz, 850Mhz and 1900Mhz (not multi- protocol and requires antenna) 521?; m: $38,382.00 APPROVAL AUTHORITY FOR USE: Ground Force Commander pending designation of target DATED: 01 May 2006 I on: 0? January 2034

Kingfish I CAPABILITIES Description: 0 Ground stimulation device - Replicates BTS to STIM handset into RF allowing for DF 0 Optional 5 Watt Amp available 0 Backpack version 0 Can lock and DF from same unit LIMITATIONS PLANNING FACTORS Kingfish Eguipment Specifics: - Approx ground distance 200 Meters - Target Handset must be on not engaged in a call 0 Cannot DF with Gjallar or Datong system - Locking handset into drains battery and raises signal strength - Use of system requires deconfliction w/other geo elements in A0 0 Network can identify rogue BTS Improper use can impact network - Can be used by Helo Assault forces VENDOR: Harris Corporation PROTOCOLS: 900Mhz, 1800Mhz, 850Mhz, 1900Mhz and CDMA (malti- protocol and requires antenna) COST: $32,433.00 APPROVAL AUTHORITY FOR USE: Title 10/ 50 8- FROM- 01 May 2636 OH: January 3034

Stingray l/ll - Ground stimulation device - Replicates BTS to STIM handset into RF allowing for DF - Passive and active modes of operation - Optional 5 Watt Amp available LIMITATIONS PLANNING FACTORS VENDOR: Harris Corporation Stingray Equipment Specifics: - Approx ground distance 200 Meters - Target Handset must be on 8: not engaged in a call 0 Cannot DF with Gjallar or Datong system 0 Locking handset into drains battery and raises signal strength 0 Use of system requires deconfliction w/other geo elements in A0 0 Network can identify rogue BTS - Improper use can impact network PROTOCOLS: 900Mhz, 1800Mhz, 850Mhz, 1900Mhz and CDMA (multi- protocol and requires antenna) 13% $134,952.00 APPROVAL AUTHORITY FOR USE: Title 10 l'llf In: 3?fo FD: 5.71 If; LNG SECRET f/ REFORM :vrr 9:3: or January

PRU-13 CAPABILITIES Description: The PRO-13 is a radio frequency (RF) and direction finding (DF) signals intelligence system that provides signal location and exploitation. The PRD-13 provides Tier IO EW Operators with the ability to DF any GSM signal of interest; however, the PRO-13 is much larger than other DF systems. This system is part of the Tier EW inventory for certain conditions that require a broad spectrum, large area focus LIMITATIONS PLANNING FACTORS VENDOR: L3 Communications, Linkabit PRU-13 Equipment Speci?cs - Directed Search (Channel scan) 400 channels; 20 PROTOCOLS: - 26 Hz Priority channels; 9 bands - Freq Coverage: 2x Intercept; 2x COST: Monitor; 2x DF - Signal List: Logs up to 400 . APPROVAL AUTHORITY FOR USE: Title 10/ 50 - BUllt-In Test (BIT): End-to?end system test is-Eiit i FROM. C?l l-I'iat- lift-J Kl. UPI: Lz'zplanua:

. Hayden i/ll Capabilities Description: Project Hayden is a survey, interrogation, stimulation, denial of service, and gee-location system to track high powered cordless phones (HPCP). Hayden can stimulate handsets to allow direction finding systems such as or Hydrah to ground track. Ongoing development will allow Hyden software be ported into Project Traveler. Limitations Planning Factors i I I HAYDEN Equipment Specifics: DEVELOPMENTAL - Weight: 30 b - Initially a 4 channel system to be increased to 12 channels for air operations - Requires E3200 HIDRA or HEAT for DF SECRET NOFGRN Vendor: BAE Systems Protocols: HPCP 0n_-Han_d= _Co_st: $110,000.00 Approval: Title 10 FRO-M: DATED: May 2006 ASbii?r? ON: 0? January 2054

Stargrazer Capabilities Description: Stargrazer is an Army system developed to deny, degrade and/or disrupt a targeted adversary?s command and control (C2) system on the Thuraya Handset (HS) via electronic means. Stargrazer is able to extract and IMEI data from the handset. STARGRAZER is a flexible and expandable Special Purpose Electronic Attack (SPEA) capability designed primarily to target Mobile Satellite Services communication downlink paths. Limitations Planning Factors STARGRAZER Eguipment Speci?cs: Operates in three different phases: 1. Phase II: Monitor mode. 2. Phase II: Attack mode: identify, capture and jam one or more handsets while gaining 1M51, 1ME1, and geo-location data. 3. Phase ?Impersonate?mode: lmpersonate actual Thuraya network with - network and requiring the Thuraya handsets in range to register with the impersonated network and transmit their 1M51, 1ME1, and gee-locational data. The phone/phones can essentially be brute force, or surgically jammed. SECRET NOFORN Vendor: Protocols: Thuraya, Thuraya DSL, On-Hand: @541 Approval: Title 10 DEEMED FROM: DATED: (31 May 23:36 UN: January 3034

Sidewinder Capabilities Description: Project SIDEWINDER is a compact, software defined ground-based HPCP and GSM geo?location system. Currently in the development phase with the potential to become the replacement for the Carmen gee?location system. SIDEWINDER will employ the core technology of the TRAVELER system with 3 AL channel receiver to increase to a 12-channel receiver in the future. I Limitations Planning Factors Vendor: BAE Systems Sidewinder EguipmentSpecifics: protocols: HPCP and GSM BOT - Much of technolo for Sidewinder was transferred from thinraveler program - Fully ruggedized to permit operations in a Q?s?t3 TBD 1 variety of ground platforms and for low- Approval: Title 10 altitude rotary wing missions - Contains both active and passive i capabilities - Frequency range from 20 to 3000 mum tram: cur-JED: SECRET f/ 1 mu: 2.924

.7 REBUS Capabilities Description: Ground GSM stimulation device - Replicates BTS to STIM handset into RF TCH allowing for DF Provides limited capability to isolate targets utilizing Firewall option 0 Sagem HS incorporated to provide network survey - Backpack version of Series 200 box Limitations 8: Planning Factors Vendor: CellXion REBUS EquipmentSpecifics: Protocols: GSM 0 Approx ground distance 200 meters - Target Handset must be on 8: not engaged in a i call 3 0 Locking handset into TCCH drains battery and Egg: $152,000.000 3 raises signal strength i Aggravalz Title 10 - Use of system requires deconfliction w/other geo elements in A0 1 5 0 Network can identify rogue BTS i improper use can impact network E): ls?lay 331:6 SECRET NOFCW may err on: 2334

3g; Limitations 8: Planning Factors Capabilities The RadioEye system is a lightweight, man packable, push-to-talk (PTT) radio situational awareness and DF system intended to provide operators with the capability to monitor PTT activity within range and determine from what direction a given PTT emitter is broadcasting. The system is designed to provide a ground assault force with situational awareness of any PTT activity in their immediate area. Since the majority of PTT radios operate with 50mW of ampli?cation their typical effective range is between 300m and 400m. PTT communications networks are driven by the capability of PTT radios to transmit and receive between one another. RadioEye: Power Consumption 3.3V Size: 12? 3.5" 10" - Weight: 10 Battery life 6 (1 2590) SECRET NGFORN Vendor: Ventis Protocols: Man packable PTT Poi ?0.51; 597 Aggroval: Title 10 FRUM: BATED: ?31 May ?006 DECLASSEH ON: 0? .ianuaryr 2034

7 a Gjaller Jugular II II Quasimodo HEATR Thoracic SECRET NOFORN DERIVED FROM: DATED: 01 May 2006 DECLASSIFY ON: 07 January 2034

GJALLE Gaga bilities Description: Project Gialler was initially developed for the CIA as a GSM direction finding capability. Locks onto HS locked onto an interrogation device. The small size allows for the operator to use the Gjaller in a covert, low-visibility role for both night/day 9F operations. Limitations 81 Planning Factors G?alier ui merits ratifies: 1 Close in EMS Geo-location- device 1. Handheld size device Protocols: Weight: 2 pounds Different handsets used for different bands GOTS provided equipment Cost: $4,300.00 I GSM band. specific direction finding capability i Approval: Ground Force Commander FFIJM: 12?1 May {305) SECRET [f NQFORN oraasezrir on; 07 January 3034

JUGULAR 2 Capabilities '6 band GSM, CDMA and UMTS receiver capable of detecting and measuring RSSI - Uses either internal antenna or external antenna Audible alert via Bluetooth or wired ear piece 0 Channel scan feature stops at GSM TCH detect - High and low gain selectable Limitations Planning Factors - - releasable to conventional forces 1 - Dense environments increase difficulty of BF operations 3 0 Utilized for close in DF operations; difficult to identify targets from distance 3-4 hours of operation Comes in Black, Green, Tan or Gray f/ Vendor: Keyw Corporation Protocols: GSM 850, 900, 1800, 1900, 2100 4 CDMA 450 A-H, 850, 1700 8: 1900 M: On-Hand: $5500.00 Approval: Ground Force Commander DEF l?u'EL} ll): cl [flay 2306 r: inseam" 11H: :37 January

QUASIMODO Capabilities - GSM receiver capable of detecting and measuring RSSI - 10 Band Radio Receiver 0 850, 900, 1800, 1900 and 2100 capable GSM, CDMA, UMTS - Rugged, sealed and water resistant Limitations Planning Factors Vendor: Keyw Corporation -Sun ight and NVG readable GSM - Internal rechargeable battery, 4?6 hours - Bluetooth, wired or-internal speaker 0n_Hand: Approval: Ground Force Commander FROM: omen: 01 May 2006 SECRET NOFORN DELLAESIFY on: (37 January 2054

. Capabilities Description: Hostile Emitter Angle Tracker Revised is the primary direction finding (DF) tool for . Locks onto HS locked onto an interrogation device. Standard HEATR systems are now with a Android powered remote for covert operation. Remote allows the user to fully control the HEATR unit and antenna while being hidden. Limitations Planning Factors HEATR Equipment Specifics: 11M: Syndet'x' Inc' COTS provided equipment GSM, CDMA, Thuraya 'WEight 3 Modified systems can include TTL and I 0 Detection of signals with a wide signal PTT bandwidth such as GSM, UMTS, CDMA, Paits or . . i Landmark . Requrres Multr-Protocol Antennas - Due to sensitivity, usein conjunction with Gjaller when entering buildings I The system will operate from an external power source to extend the operational time indefinitely Cost: $43,000.00 antennas) 0 Not recommended for release to non-US forces Aggrovalz Tit e 10 2m SECRET NOFCRN reams-arr ow.- c-?z January 2034

THO Capabilities Description: - Miniature, 8 band radio receiver able to detect and measure the signal strength of any channel in the uplink portions of common cellular communication bands (GSM, UMTS, CDMA iDen). -The radio can be controlled via a bluetooth data link to an applet operating on select phone such as Nokia N95. Limitations Planning Factors THORACIC Equipment Specifics: m: Keyw COTS provided equipment Protocols: GSM, and iDen U55 Chargab'e i Cost: $7,500.00 antennas) - Dual output 12/24 VDC automotive adapter A var Tue 10 - 3 omni directional antennas I 3 body worn patch antennas 0 Wireless headset 1_ 2 sets of 3 antennas to cover GSM CDMA and iDen - Dimensions: 3.3? 2.2? 0.6" . 0 Weight: 2 [rim-3 mom: . A .. . l. lL) SECRET ,x?i NOFGRN arsr?r on; gore:

Battle?eld Data Recovery/SSE 9 - Cyberhawk - Cellbrite rr .. Ll kl?. Lh .

CYBERHAWK Capabilities Description: These BDR systems serves as a small exploitation system for GSM handsets. Cyber Hawk exploits over 79 cell phones; uses US made software and components and presents a much smaller foot print than CELLTECH. Exploitation includes phonebook, names, SMS, media files, text, deleted SMS, calendar items and notes Limitations Planning Factors I. . i BDR Eguipment Speci?cs: GSM only I - Takes 4-10 mins for download i - Saved and dialed numbers, missed calls, SMS I data, pictures, calendar, sound ?les all i consolidated into one report SECRET ff NOFCRN Vendor: NSA-SIGDEV Protocols: A roval: Ground Force Commander DEr-irrai? mom; DATED: 01 May 2095 DECLASSIW on: Pan-nary 2034

Capabilities Description: Is a portable, handheld, field proven forensic system for the quick extraction and analysis of 95% cell phones, smart phones and PDA devices . Extracts information such as phonebook, pictures, video, text messages, call logs, and MSISDN information 0 Portable end-to-end solution - battery operated, easy-to- use device that requires no PC or associated phone drivers 0 Developed for field use ruggedized housing offers additional protection in harsh environments 0 SIM card extraction and SIM ID cloning Limitations 8: Planning Factors BDR Equipment Specifics: - AC 50/60Hz; Output DC 15V, 2A 217mm 124mm 77mm - Time required to complete data exchange depends on amount of data (approx 1-3 minutes) SECRET UFOR Vendor: CelleBrite USA Corp. Protocols: GSM, CDMA and selected Thuraya BOIP: Cost: $9,920.00 5900/1 yr service support 8: maintenance) Approval: Ground Force Commander DEREK-ED FROM: DATED: 01 May 2006 ON: 07" january 203d