
FBI Tracking Device Teardown - mikecarlton
http://www.ifixit.com/Teardown/Tracking-Device-Teardown/5250/1
======
18pfsmt
What I found interesting by component:

-Battery pack \--The device is powered by four lithium-thionyl chloride (Li-SOCl2) D cell batteries \--Each cell is good for 13,000 mAh and are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver \--Minimal service life is 10 years.

-GPS antenna \--A quick peek at the antenna board indicates it was manufactured by SIgem, a company that partnered with Tyco in the early 2000s to make GPS components. \--The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads. \--The module providing the GPS signal processing on this device is a µ-blox GPS-MS1 that's sort of ancient in the realm of modern electronics. \--This module was 1st released June 29, 1999 and it features 0.125 MB of SRAM and 1 MB of flash memory.

-Transmitter/receiver ICs \--XEMICS XE1201 Ultra low power single chip transceiver \---The XE1201 allows for data transmission and data reception in half duplex mode. \--RFM RF1172 SAW (surface-acoustic-wave) filter \---The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers.

[Edit: Please note, much of the text above is c/p'd from the ifixit post.]

~~~
joezydeco
If the FBI didn't want anyone tampering with the unit, they would have potted
it in heavy epoxy or welded the case shut. Maybe even put a light-sensitive
thermal charge inside.

More likely they were worried about the screws vibrating themselves off while
stuck to the underside of a car - thus the threadlocker glue everywhere.

~~~
18pfsmt
The fact that they didn't pot it is interesting. I hadn't thought about that.
Potting seems to be on the decline over the last 10 years from what I've seen.

~~~
joezydeco
Potting is still used heavily in industrial electronics and a lot of appliance
work (think of washing machine control boards). I would think the military
uses it a lot as well.

~~~
mey
FIPS 140-2 Level 4 <http://en.wikipedia.org/wiki/FIPS_140-2>

Level 2-4 are used in commercial and military grade hardware security Modules.

~~~
joezydeco
I remember finding a teardown of an IBM 4765 module somewhere. That was
badass.

~~~
nitrogen
Is that the PCIe crypto module shown in Google searches for IBM 4765? Please
share the link if you have it, as I couldn't find a teardown in my brief
search. I'd like to see how one would dismantle a potted circuit.

~~~
joezydeco
Yeah it's the crypto module. I think the teardown involved shaving the part
down layer by layer and examining all the parts like the fine wire meshes that
would instantly blow the chip if disrupted and etc. Wish I could remember
where I saw it.

------
kwiens
I did the teardown, and I'm a regular hacker news reader. I'll answer any
questions for the next hour or so.

~~~
tomsaffell
Is there a legal way to block them? Either the GPS signal, or the transmitter?
(I'm assuming tampering with the device directly is illegal).

~~~
kwiens
Sure, just transmit stronger white noise on 433.92 MHz. I haven't looked up
who owns that frequency and whether there are restrictions.

Or get a GPS blocker. Which I think are illegal to operate.

~~~
a1k0n
AFAIK 433MHz can be used for any short-range application, similar to 27/49MHz
for R/C cars. There are plenty off-the-shelf 433MHz transceivers for
hobbyists, and I think car remote-unlockers use that band as well. And this
doesn't appear to have a particularly powerful transmitter, so you'd have to
bring the transmitter relatively close to the receiver (like <100ft, usually)
in order to download...whatever.

If they're able to put this thing on your car in the first place, I guess it's
not infeasible for them to drive by to download updates.

------
jrockway
Those batteries are impressive. I did some Googling and found:

[http://www.batterymart.com/p-ls33600-ba-d-size-lithium-
cell....](http://www.batterymart.com/p-ls33600-ba-d-size-lithium-cell.html)

61 Watt-hours. That little battery could power a 60W light bulb for an hour!

(I'm currently working on a bluetooth -> IR bridge. I was worred about battery
life from a coin cell, but now I'm not anymore. I will get one of these in
half-AA size and keep the thing powered for the next decade :)

~~~
tomsaffell
>That little battery could power a 60W light bulb for an hour

It's a useful 'analogy', but it's not actually true. They are 3.6V, max
continuous current 250mA, so max continuous power is 0.9W

~~~
jrockway
True.

I bet it would release its energy a bit more quickly if you dropped it into a
nearby fire.

------
sebastianavina
So, can we study the frequency and if the out signal uses any encryption?

Maybe we can use a homemade receiver to find the people the FBI is tracking...

~~~
runjake
Frequency and transceiver information are already posted. My guess is that the
transmissions aren't encrypted, or are encrypted trivially or encoded (to
obfuscate).

Since you said "we should", you should get started on it and post your
findings here or better yet on a blog. The iFixit article provides a lot of
bases to research from.

~~~
chopsueyar
The board is running at 4MHz, so I'm not sure if too much can be done with
such hardware.

------
SlowOnTheUptake
If the trackee removed this from his own car and attached it to some other
car, would he be violating some law?

~~~
pavel_lishin
It might be more effective, and more legal, to just sell your car as soon as
you become aware that you've been tagged. Bonus points if you sell it to
someone who is either taking a cross-country drive, or shipping it overseas.

~~~
mattmanser
Surely it's much, much easier to just put it on your neighbour's car. They'd
probably believe they were getting real data or your partner was using the
car. And could probably never accuse you of tampering as they couldn't be sure
it wasn't just a mistake by the planting agent.

------
SpacemanSpiff
Wow, the components on the GPS board look like they are hand soldered, which
to me means very low volume/specialized production.

~~~
kwiens
Yeah, that was the first thing I noticed. Some of the solder joints look
rather suspect.

------
rglover
Checking under my car with a mirror after work.

------
daimyoyo
I don't want to trivialize how scary it is that the FBI does this, but what I
found interesting about this story was the insane capacity of the batteries.
Why aren't more consumer electronics(especially iStuff where they aren't user
serviceable) using this technology?

~~~
tlb
Lithium thionyl chloride batteries are not rechargeable. You get 2-3x the
capacity of a rechargeable battery, once. Makes sense for this application but
not consumer devices.

------
adolph
I wonder where they got the device? In Wired's account, the FBI demanded back
from a fellow who found one on his car:

[http://www.wired.com/threatlevel/2010/10/fbi-tracking-
device...](http://www.wired.com/threatlevel/2010/10/fbi-tracking-device/)

~~~
kwiens
This story gives background on Karen Thomas, the environmental activist who
was tracked by the device. <http://www.wired.com/threatlevel/2011/05/gps/>

The FBI demanded the device back and she said no. Amazingly, that was the end
of the story—until the Afifi story came out, and she decided to give Wired the
tracker.

The interesting legal question (in addition to whether you need a warrant to
do this sort of thing) is who owns something attached to your car?

~~~
sehugg
I'll be very interesting in hearing what the Supreme Court has to say about
all this. Consider the following worst-case scenario:

1\. Supreme Court rules that use of GPS tracking devices by law enforcement do
not violate 4th Amendment.

2\. Future court rulings find that tampering with GPS devices amounts to
interfering with a police investigation.

3\. Law enforcement starts planting GPS devices directly on persons, such as
in a purse, or when miniaturized further, in wallets or attached to clothing.
Maybe these devices only capture data "when in public areas" and are
eventually declared legal.

4\. Since they cannot be tampered with, police begin attaching wristbands to
citizens stopped at routine traffic stops who they suspect of crimes.

Sounds far-fetched, but not when you consider the amount of surveillance that
goes on already via cell phones and credit cards.

~~~
marshray
What do you mean "sounds far-fetched"?

There are people walking around with government installed GPS bracelets right
now: <http://en.wikipedia.org/wiki/Ankle_monitor>

------
alecco
I'd love to see how much those devices cost. And the TCO.

------
pyrhho
I want a kit! Would be good fun to play with.

