Tracking Device Teardown

Geschrieben von: Kyle Wiens
Veröffentlicht: 09/05/11
  • Kommentare: 20

Tracking Device Teardown

Veröffentlicht: 09/05/11

Teardown

Einleitung

We partnered with Wired to bring you a peek inside an FBI car-tracking device. The device is similar to the one Yasir Afifi found underneath his car. If you're curious where this one came from, Wired has posted a writeup about Kathy Thomas, the woman who found this tracker under her car. They've also posted a video of Kyle doing the teardown.

The device comprises a GPS unit for receiving the car's position, an RF transmitter for relaying your location to the interested authority (i.e., the FBI), and a set of sweet D-cell batteries that power the whole enchilada. But we didn't stop there, of course. Read on to find out exactly what components make this secretive device tick.

Disclaimer: We love the FBI. We've worked with them on several occasions to fight crime and locate criminals. We've helped them with instructions on gaining entry into certain devices. We have nothing against them, and we hope they don't come after us for publishing this teardown.

  1. v5SnUBE5IKgN1xur

    • We finally have one of these on the teardown table! Being in its presence, we can almost feel our civil liberties being flushed down the toilet.

    • Before we whip out the blowtorches and jackhammers, here's a look at the entire tracking system.

    • Clockwise from the top, the system consists of:

    • Battery pack

    • GPS antenna

    • Transmitter/receiver unit

    • Magnetic mounting bracket

    • The components of the system are all attached to the tracked vehicle with extremely powerful magnets. Some were so stubbornly attached that they ripped out of the mounting brackets to forever remain stuck on the undercarriage of the host vehicle.

  2. oYAZSOBmMEibujjd
    oYAZSOBmMEibujjd
    bP2HQk13HFVhIdmk
    EmeuEp3EIKHEAamj

    • Wondering what kind of technology keeps the tracking device powered? Let's remove the battery pack's end cap and find out.

    • The device is powered by four lithium-thionyl chloride (Li-SOCl2) D cell batteries.

    • Each cell is good for 13,000 mAh! That's about double the capacity of the iPad 2's battery.

    • These cells are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver. Their service life is rated at 10 to 20 years.

  3. guqDGGr6mxPXRJwl
    guqDGGr6mxPXRJwl
    mwFvYWuB6UkkhI2k

    • To begin tearing the device apart, we detached the two antennas from their screw-in mounts on the transmitter/receiver module.

    • The short antenna we disconnected in the first picture is responsible for transmitting the location signal to transponders that the FBI would use to find you.

    • The larger antenna is for receiving GPS signals from satellites orbiting far above the earth's surface.

  4. Ishk41aroEmBdqiB
    Ishk41aroEmBdqiB
    RRqoHxNifj1U33T2
    1UCMEQydQaGU5oPM

    • Removing a few Phillips screws allows us to access the innards of the GPS antenna.

    • In keeping with the non-permanent mounting solutions, the GPS antenna is attached to its bracket with a hefty piece of Velcro.

    • A quick peek at the antenna board indicates it was manufactured by SIgem, a company that partnered with Tyco in the early 2000s to make GPS components.

  5. ACyBq62iUZkM31LQ
    ACyBq62iUZkM31LQ
    oSYVKCDiyBpcbYus

    • Let's turn our attention back to the transmitter/receiver module.

    • A few screws are all that remain between us and the innards of this invasive device.

    • It seems that this rear cover is simply a method to connect the module to power. Presumably, power sources (batteries) of different shapes/sizes/capacities can be connected through the same plate to make the tracking device more universally installable.

    It seems that this rear cover is simply a method to connect the module to power.

    The spring and lithium cell look suspiciously like an active tamper-awareness mechanism to me. I can think of two good reasons for tamper-awareness.

    First, a savvy EE might disassemble the device in vivo and replay innocuous trip data briefly while engaging in mischief. This kind of attack is better than disconnecting the Tx antenna or moving the transceiver to a different car because it will be very difficult for the FBI to detect that the trackee is on to them. Sending a patrol car once a week or month to look for the tracked car at the reported position would quickly reveal that the device had been moved, as would correlation with any other observations like electronic toll data.

    Second, if as commenter Robin speculates, the FBI's receiver is listening to the more accurate encrypted GPS signals, in vivo disassembly might allow disastrous compromise of the cryptographic material necessary to do so!

    Andy Getz -

  6. jWKvoFjMjV2tXBUm
    jWKvoFjMjV2tXBUm
    EevxpOQY4FXNTUWb
    S5ymUBZPOdOAwTLI

    • To get to the brains of the module, we focus on the other end cap.

    • The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads.

    The screws are designed so that they can never be un-screwed.

    Mal -

  7. bIds1qOCYtf6imOh
    bIds1qOCYtf6imOh
    RXBLVInUPrBjrHOa
    edJIoYDM5NDSSHqY

    • Upon successfully drilling out all the screw heads, the outer case slides right off the transmitter/receiver assembly.

    • The two modules can be split apart to examine their circuits.

    • The small blue wire connects the GPS antenna to the GPS receiver board.

    • After disconnecting the GPS board, we can take a closer look at both components.

  8. pcaRs2TKgcQH5tKu
    pcaRs2TKgcQH5tKu
    xGFATBffiFE4WPd3

    • The module providing the GPS signal processing on this device is a µ-blox GPS-MS1 that's sort of ancient in the realm of modern electronics.

    • It was released June 29, 1999!

    • It features an astonishing 0.125 MB of SRAM and 1 MB of flash memory.

    • The backup battery on its reverse side powers a real time clock and maintains the GPS receiver's SRAM to allow for a much faster connection time to the satellites, called a warm start. This is usually used in conjunction with a circuit to power down most of the GPS, providing a much longer battery life.

    • The slightly imperfect alignment of the SMD components on the board indicates that the FBI hand-soldered them to the board and tailored the component choices to their specifications.

    I'm not sure that's really an indication of hand soldering. I worked as a quality control inspector at an SMD fab for a while, and that assembly looks better than some of the things I saw come off the line. There's a big book on tolerances in SMD manufacturing, which outlines how much alignment error is permissible for the three classes of manufacturing (most commercial is class 2, and military/aerospace is class 3) and if memory serves, even class 3 permits a 25% offset error and a 25% rotation error on 2-pin devices.

    Brendan Moran -

    You are right, and it really depends on the accuracy of your pick and place machine. They've been getting better lately, but the cost is high for the better ones (probably not an issue for the FBI). The kind of accuracy we see today on extremely dense packaging wasn't possible in the past. We just didn't have the technology.

    Scott -

    The wired article said the device was found in 2005, so a part from 1999 would only be six years old, not sixteen.

    rocketeerbkw -

  9. rJwWNscWYBp4vbV5
    rJwWNscWYBp4vbV5
    m2DxU3EukPEmXPkF

    • The larger of the two boards contains the connections for both antennas and is responsible for the RF side of the tracking device. Its notable chips include:

    • XEMICS XE1201 Ultra low power single chip transceiver

    • The XE1201 allows for data transmission and data reception in half duplex mode.

    • RFM RF1172 SAW (surface-acoustic-wave) filter

    • The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers.

    • Typical applications of this filter include wireless remote-control and security devices operating in Europe under ETSI I-ETS 300 220.

  10. 2uWYiTHSq2qpdEJd

    • Tracking device Repairability Score: -10 out of 10 (10 is easiest to repair)

    • The FBI will find you if you find their tracking device.

    • You cannot choose to be not tracked by the FBI.

    • You can legally be tracked by one of these units.

    • We'll be right back, the FBI is knocking on our door.

  11. tLGoGoebPshlHxuX
    tLGoGoebPshlHxuX
    sPqsu3Tj4e1BWtD4
    o6JKqG2yENFtA45T

    • If you think this sort of thing is super cool, we'd like you to join our team. We're hiring software engineers and designers to help us make our how-to community even more awesome.

    • iFixit is a great place to work. We have an incredible working environment, a world-class team, and a vision to change the world. Our team loves having fun together. Developers have private offices, we have regular barbecues, and we're based in San Luis Obispo, one of the most amazing places in the world.

    • Open positions:

    • Software Engineer

    • User Interface Designer

    • Software Engineering Intern

    • By the way, that last photo looks like a postcard—but we took it just down the street from our office two weeks ago. (Some HDR may have been involved. Yes, we're photo geeks.)

Tinte & Feder

Kyle Wiens

23006 Reputation

15 Kommentare

The "backup battery" on the back of the GPS module looks to me like a super-capacitor. These are usually used on GPS's to maintain the contents of the SRAM when the unit is powered down. Maintaining the SRAM means that the GPS gets a lock much faster (See GPS warm-start) when powered back up again. This combined with a power gating circuit will mean that the device can last much longer.

Brendan Moran -

It's actually a Panasonic VL1220 lithium battery.

Andrew Bookholt -

That might be an ancient GPS but if I'm not mistaken, the FBI will have access to 100% accurate GPS signals (rather than the - within 300 metres that we lowly mortals get) so that's one handy piece of kit...

Robin Layfield -

That'd be cool, but selective availability (the 300' civilian accuracy limit) was turned off more than 10 years ago. This thing's gps is probably not any more accurate than your typical smart phone.

Andrew Denyes -

Are you guys kidding me? You are going to get in so much trouble.

Don't get me wrong--this is a super cool thing you've done, but if this guide is still up 48 hours from now, I'll be flabbergasted. So I hope lots of people are mirroring this!

jonathan -

sooo you still surprised?

Joe Canales -

hmmmmm.. well. all seems well.

peter mcbride -

Are you still flabbergasted?

Ansel Moll -

FBI soldered the components ? Think again...

perzapro -

Of course you can choose to be not tracked. There are GPS signal blocking devices for cars. Once you block the receiving of GPS signal the tracking device wont know where is it thereby FBI can not track you.

karmansan -

If you put a GPS blocker on your car, then you are painting a target on yourself as you’ll be putting out disruptive noise which among others amateur radio enthusiasts will hunt you down for sport.

BFeely -

First I'd like to say that the FBI probably does have an engineering team, however, I'd assume that a contracting company built it for the agency. Secondly, was wondering if you could measure the output, transmit frequency of this device? Curious to see what frequency the location gets relayed on.

Shaun -

The Supreme Court has not determined that a warrant must be obtained. All they have ruled is that use of such a device constitutes a "search" as the law recognizes a "search". Since the government in the case in question did not claim that it was "reasonable" to search without a warrant, the court did not rule upon the necessity (or lack) of a warrant. The government's case was that there was no "search" in the first place, not that no warrant was needed for the "search". A Third Circuit case has ruled that a warrant is necessary, but that is not nationwide (look up where the Third Circuit covers). The Supremes have not rendered a decision for the USA as a whole.

Bryan Maloney -

That was likewise and therefore it is before it was.

Mal -

How do you find one of these trackers on your car? 2016 Jeep Grand Cherokee. Stalker for 4 years now, all hours of day or night, owns his own private investigation company, since I’ve consistently let the various people he’s had blatantly follow me know I know, he now uses an expensive drone capable of approximately 30” of flight time follow me practically wherever I go, even if it’s midnight when I have to go to the nursing home where my elderly, dying family member is.

Worthy Endeavors -