Chris Paget, Part 97, Part 15, and RF Research

It has finally happened. I can finally write a blog post about my two favorite subjects: Information Security and Ham Radio.

Chris Paget made some news this weekend at yearly DEFCON hacker conference in Las Vegas. Paget demonstrated the flaws of the GSM cell phone protocol by creating a simple device to intercept every GSM call in a small area. Chris did a lot of work making sure that he wasn’t violating anyone’s privacy by intercepting these phone calls, up to enlisting the help of the Electronic Frontier Foundation. When reading some of Chris’ preparations, I was impressed, but the first thing that popped into my head was “Wait, that’s nice and all, but what about FCC regulations?”

To take a quick detour into FCC regulations, most unlicensed devices fall under Part 15 of the FCC rules. They have to be tested and certified by the FCC before they are marketed and sold in the United States. Whenever you see your favorite technology blog talking about how some new device is being tested by the FCC, they’re talking about this testing.

So, when Chris was explaining his presentation I figured he was going to go one of two ways: Either he was going to unveil some kind of new FCC certified cell phone interceptor (unlikely), or he was going to put on an eye patch, raise the Jolly Roger and go full pirate. However, after the presentation was done, I was reading the coverage of the presentation and saw that he did it a way that I hadn’t considered: Chris, unbeknownst to me, had an amateur radio license, so he tried to classify his transmissions under Part 97.

Part 97 is the Amateur Radio section of the FCC rules. Amateur radio is classified as an “experimental” service. As I’ve stated in my “Why you should be an Amateur” presentation, amateur radio is “radio hacking.” Chris saw that part of the European GSM band overlaps with the 33cm amateur radio band, so he (and I!) have rights to transmit there. Seems like a perfect fit, right?

Unfortunately, no. While Chris did seem to catch the “no encryption” part of the rules, he didn’t realize that his transmissions were not legal under Part 97 either for other reasons. Part 97.111 and Part 97.113 establish but “authorized” and “unauthorized” transmissions of amateur radio stations, of which Chris, by my count, violated the rules 2 or 3 different ways:

  1. Chris was using his Part 97 transmitter to communicate with Part 15 devices, not other Part 97 devices. (Violates Part 97.111(a))
  2. Chris’ GSM cell site was beaconing to cell phones to let them know it’s there. That counts as a way transmission. (Violates Part 97.113(b))
  3. Chris was impersonating a AT&T cell phone site. You can’t impersonate people on amateur radio. (Might Violate 97.113(a)(4))

Chris does get props for establishing a Morse Code beacon to ID himself every 10 minutes as defined by the rules, however, that is like a restaurant owner trying to convince the health inspector that his restaurant is OK despite the rats and roaches because his employees wash their hands after they go to the bathroom. Too little, too late.

I’m not trying to string up Chris here, I’m honestly worried for him. He’s admitted that he’s had conversations with the FCC regarding this presentation which he classified as “unproductive”. This, combined with the fact that the FCC enforcement bureau loves to hand out documents with “Notice of Apparent Liability” at the top and five figure fines on the bottom leads me to wonder if Chris isn’t headed toward a protracted legal battle with the Feds. Chris’ presentation shows a major shortcoming with the current FCC rules dealing with research. Chris should not have tried to find a loophole within the FCC regulations to do his research, it should have been legal for him to establish a low powered signal to do and demonstrate his research. We, as researchers, are running into another version of the same ostrich syndrome that prohibited users from listening to cell phone and pager traffic that were transmitted in-the-clear back in the early 1990s, and to a lesser extent, still are. With the expansion of data networks to mobile devices, it’s become even worse, as Chris’ presentation demonstrated. By not allowing research into these fields the FCC is keeping the sunlight out of the dark corners of our mobile networks and allowing the mobile phone companies to convince us that everything is OK when in reality someone with $1500 worth of equipment can intercept local mobile phone traffic is negligent at best, and criminal at worst.

While I disagree with Chris’ characterization of his transmissions being “cool” because he’s licensed as an amateur radio operator, I fully support his research and his efforts to do this research in a controlled environment. I also hope that the FCC will realize that this type of research only helps people and all the laws in the world won’t help bad people from doing this same type of activity in a malicious manner, as they already are.

5 comments.

  1. Chris was using his Part 97 transmitter to communicate with Part 15 devices, not other Part 97 devices. (Violates Part 97.111(a))

    Hmm, so is it illegal for an amateur television station to transmitter to use the same frequency as cable TV channels, even though they fall within the 70cm bands? This seems to be standard practice for ATV stations. I’m really not even aware of any FCC type accepted ATV receivers on the commercial market.

    Many of the FCC’s rules are too vague, and probably intentionally. They are considered a revenue generating agency, not a regulatory one.

  2. I think it’s partly the transceiver, and partly the operator of the transceiver. An Amateur can wave his magic license can make at Part 15 device a Part 97 device, but not vicea-versa.

    I also think that Part 97 applies to intentional radiators, I’m not sure if a receiver can fall under the jurisdiction of Part 97.

  3. In response to “Nobody”‘s post….You are incorrect in your assumption that Amateur Television is using the same frequencies as cable television. Note that analog cable channels are on different frequencies from the old over the air analog channel 14 and up – analog UHF over the air channel 14 is 471.25 MHz and 57 is 729.25 MHz, well above the 70 cm ham band. (Source: http://www.hamtv.com/ and http://www.qsl.net/atn/library/Broadcast_freqs.htm )

  4. Let me clarify my earlier reply as I misread “Nobody’s” post concerning ATV frequencies. Part 97 Amateur television stations are communicating with other Part 97 Amateur Television receivers over the air, not communicating with part 15 cable TV receivers assigned to operate through the cable tv systems. I believe that if I were to attempt to send my amateur television signal through the cable lines into the Part 15 cable TV equipment for all cable users to see, I would also end up in Chris’ shoes, even though I am authorized to operate in that portion of the band.

    I believe that all three points of Chris’ violations that you address are valid and as an amateur, he should have known that trying to circumvent the rules would land him in hot water.

  5. There is a way to do this kind of thing legally.. it’s called a Part 5 experimental license. This is how companies do things like test radios under development, radars, run outdoor antenna ranges, etc. You tell the FCC what you want to do, when you’re going to do it, and they say, “fine” and you do it. Typically there’s a requirement that you submit some sort of report of how your experiment went (but you don’t have to given them your proprietary data) and when you were on the air, etc.

    The other approach is a STA, but I don’t think that applies here.

    I agree that trying to claim your cell site simulator is legal because it overlaps the 900 MHz ham band is pretty sketchy, for the reasons you outlined.

    He could also have done the demonstration in an RF isolated environment (e.g. if you set up a screen room, you can put any kind of transmitter you want in there)