The Great Brazilian Sat-Hack Crackdown
BY Marcelo Soares / 04.20.09
Brazilian satellite hackers use high-performance antennas and homebrew gear to turn U.S. Navy satellites into their personal CB radios
Campinas, Brazil — On the night of March 8, cruising 22,000 miles above the Earth, U.S. Navy communications satellite FLTSAT-8 suddenly erupted with illicit activity. Jubilant voices and anthems crowded the channel on a junkyard’s worth of homemade gear from across vast and silent stretches of the Amazon: Ronaldo, a Brazilian soccer idol, had just scored his first goal with the Corinthians. It was a party that won’t soon be forgotten. Ten days later, Brazilian Federal Police swooped in on 39 suspects in six states in the largest crackdown to date on a growing problem here: illegal hijacking of U.S. military satellite transponders. “This had been happening for more than five years,” says Celso Campos, of the Brazilian Federal Police. “Since the communication channel was open, not encrypted, lots of people used it to talk to each other.”
The practice is so entrenched, and the knowledge and tools so widely available, few believe the campaign to stamp it out will be quick or easy. Much of this country’s geography is remote, and beyond the reach of cellphone coverage, making American satellites an ideal, if illegal, communications option. The problem goes back more than a decade, to the mid-1990s, when Brazilian radio technicians discovered they could jump on the UHF frequencies dedicated to satellites in the Navy’s Fleet Satellite Communication system, or FLTSATCOM. They’ve been at it ever since. Truck drivers love the birds because they provide better range and sound than ham radios. Rogue loggers in the Amazon use the satellites to transmit coded warnings when authorities threaten to close in. Drug dealers and organized criminal factions use them to coordinate operations. Today, the satellites, which pirates called “Bolinha” or “little ball,” are a national phenomenon. “It’s impossible not to find equipment like this when we catch an organized crime gang,” says a police officer involved in last month’s action. The crackdown, called “Operation Satellite,” was Brazil’s first large-scale enforcement against the problem. Police followed coordinates provided by the U.S. Department of Defense and confirmed by Anatel, Brazil’s FCC. Among those charged were university professors, electricians, truckers and farmers, the police say. The suspects face up to four years and jail, but are more likely to be fined if convicted.
First lofted into orbit in the 1970s, the FLTSATCOM bird was at the time a major advance in military communications. Their 23 channels were used by every branch of the U.S. armed forces and the White House for encrypted data and voice, typically from portable ground units that could be quickly unpacked and put to use on the battlefield. As the original FLTSAT constellation of four satellites fell out of service, the Navy launched a more advanced UFO satellite (for Ultra High Frequency Follow-On) to replace them. Today, there are two FLTSAT and eight UFO birds in geosynchronous orbit. Navy contractors are working on a next-generation system called Mobile User Objective System beginning in September 2009.
Until then, the military is still using aging FLTSAT and UFO satellites — and so are a lot of Brazilians. While the technology on the transponders still dates from the 1970s, radio sets back on Earth have only improved and plummeted in cost — opening a cheap, efficient and illegal backdoor. To use the satellite, pirates typically take an ordinary ham radio transmitter, which operates in the 144- to 148-MHZ range, and add a frequency doubler cobbled from coils and a varactor diode. That lets the radio stretch into the lower end of FLTSATCOM’s 292- to 317-MHz uplink range. All the gear can be bought near any truck stop for less than $500. Ads on specialized websites offer to perform the conversion for less than $100. Taught the ropes, even rough electricians can make Bolinha-ware. “I saw it more than once in truck repair shops,” says amateur radio operator Adinei Brochi (PY2ADN) “Nearly illiterate men rigged a radio in less than one minute, rolling wire on a coil.”
Brochi, who assembled his first radio set from spare parts at 12, has been tracking the Brazilian satellite hacking problem for years. Brochi says the Pentagon’s concerns are obvious. “If a soldier is shot in an ambush, the first thing he will think of doing will be to send a help request over the radio,” observes Brochi. “What if he’s trying to call for help and two truckers are discussing soccer? In an emergency, that soldier won’t be able to remember quickly how to change the radio programming to look for a frequency that’s not saturated.”
When real criminals use these frequencies, it’s easy to tell they’re hiding something, but it’s nearly impossible to know what it is. In one intercepted conversation posted to YouTube, a man alerts a friend that he should watch out, because things are getting “crispy” and “strong winds” are on their way. Sometimes loggers refer to the approach of authorities by saying, “Santa Claus is coming,” says Brochi. When the user’s location is stable, the signal can be triangulated. That’s how the Defense Department got the coordinates to feed Brazilian authorities in March’s raids.
While Brazil may be the world capital of FLTSATCOM hijacking, there have been cases in other countries — even in the United States. In February of last year, FCC investigators used a mobile direction-finding vehicle to trace rogue transmissions to a Brazilian immigrant in New Jersey. When the investigators inspected his radio gear, they found a transceiver programmed to a FLTSAT frequency, connected to an antenna in the back of his house. Joaquim Barbosa was hit with a $20,000 fine. A technician with Anatel, speaking on condition of anonymity, says the chief problem with ending the satellite abuse in this country is that U.S. and Brazilian authorities simply waited too long to start. Thousands of users are believed to have the know-how to use the system. After a bust, the airwaves always go quiet for a while, but the hijackers always return.
One week after the “Operation Satellite,” Brochi met with Wired.com at a gathering of amateur radio enthusiasts in a bucolic square in Campinas, about 60 miles north of Sao Paulo. Brochi switches on his UHF receiver and scans through the satellite frequencies. It’s relatively quiet now on the satellite underground, except for the static-like sound of encrypted military traffic. But eventually, a lone creaky voice cuts through. It’s a man in Porto Velho, the capital of Rondônia, a day’s drive north into the upper Amazon basin. He’s making small talk with a friend in Portuguese. The satellite pirates are creeping back on the air.
FLTSATCOM (Fleet Satellite Communications System)
AMATEUR SATELLITE USE
BOLINHA TECH (poorly auto-translated from Portuguese)
“Satellites commonly known in Brazil as “Bolinha”, are geostationary American military satellites known as FleetSatCom or UHF SatCom. These satellites were developed by RCA American Communications (RCA Americom) and were launched between 1975 and 1992. From 1986, they became controlled by General Electric American Communications (GE Americom) and from 2001 by SES Americom.
Contrary to what many think, these satellites are not “abandoned”, and are still very active, with intensive use. Most official communications are made in encrypted digital modes; there is minimum official activities in analog mode (AM, FM, SSB). In August 2007, the space shuttle Endeavor used the rate of 259,700 in AM. There are British, Italian and Russian military satellites (called Gonets) also in the band.
Information on the SatCom in Wikipedia:
Recent examples of audio from such satellites can be seen on the page:
Manual of military operations of SatCom, 2004 edition
official SatCom, defined by the standard MIL-STD-188-181 / A and B:
An excellent explanation given by Mr Roland Zurmely in February 2008: “For a geostationary satellite, one of the mandatory parameters is that it is on the equator.”
“The Clarke Belt”, the only place where geostationary satellites may be, is already almost all busy! Theoretically, each satellite GSO should be a “box” of 0.1 x 0.1 degrees, and as the belt is 360 degrees, there is room for only 3600 GSO satellites! Already has more than 1500 seating! It is for this reason that many are up in Brazil, as the Clarke belt is at the equator! Old satellites MUST be removed from the belt and are normally placed in inclined orbit with respect to GSO to give the “box” to a new GSO satellite. See more here:
Many illegal users of satellites are linked to organized crime, especially drug trafficking. Some key words or subjects are used to mask orders, delivery notes or scheduling of meetings. Most of the use of these segments in the range of 250 MHz using transmission has originated in the Brazilian Amazon, or in the southern part of Colombia. However, due to the “meddling” of camioneiros [truckdrivers?], sawmills and traders common in the region, who also started to use this as “cheap” radio, organized crime is migrating most of their communications for military satellites in geostationary band of 6 GHz. The use of such satellites is illegal (Article 183 of Law 9472/97). The U.S. military held a triangulation of signals with high emission accuracy and passed the data to Brazilian authorities, which has made dozens of seizures in this direction.
In São Paulo, transmission equipment for the “Bolinha Sat” (for his great most transverters for use with VHF) were learned with almost all the great “leadership” of the CCP who were arrested in the last two years. Moreover, two radio amateurs “manufacturers” of transverters to Sat Bolinha were arrested for provide equipment and technology to the criminal faction (they knew what were doing and what to use).
By the year 2006 there were two lists of discussion in Brazil on the SatCom Yahoo groups. After an operation of seizures triggered by authorities Brazil, with support of the U.S. military intelligence, the lists were closed, and before the arrests made, many arrived to dismantle their equipment and to remove their antennas.
So if you have equipment that can send this track, taking full care! Do not fall into the “temptation” to make any contact, because the consequences can be very serious, difficult and complicated! However, listening to radio broadcasts is not a crime, and for those who have interest in only “owl” these frequencies, here are some interesting links on the SatCom:
For those who are interested in “owl” the frequencies of SatCom but have no equipment, a cheap option is mounting a converter for use in a radio or scanner for VHF. Page of Luciano Sturaro, PY2BBS has the outline of a converter for the 220 MHz band, but it works very well at 260 MHz:
http://www.msxpro.com/py2bbs/ (projects – converter to 220 MHz)
For those who already have coverage in the range receiver with 250 to 260 MHz, here is a diagram of antenna:
I have obtained good results in the reception of signals from the satellites using a SatCom receptor IC-R10 receiver with a small Yagi for 6 elements (diagram on the link above) but if we use more than one meter of cable, the signal degrades. A solution is to use the antenna “on hand” even with the smallest possible length of cable coaxial!
To facilitate the location of the satellite with a directional antenna, leave the receiver in frequency of 244,125 MHz, where there is a beacon, or 250,550 MHz, where there is a sign of continuous telemetry.
And to optimize the reception of insensitive receptors, such as receipt of HTS extended, where the range of 260 MHz is not very sensitive or even low selectivity, may be the use of pre-low-noise amplifier (LNA). Here is the diagram of a good pre-amp for this track:
Adinei , PY2ADN
py2adn [arroba] yahoo.com [dot] br “