back
79 comments
What I found interesting by component:

-Battery pack --The device is powered by four lithium-thionyl chloride (Li-SOCl2) D cell batteries --Each cell is good for 13,000 mAh and are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver --Minimal service life is 10 years.

-GPS antenna --A quick peek at the antenna board indicates it was manufactured by SIgem, a company that partnered with Tyco in the early 2000s to make GPS components. --The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads. --The module providing the GPS signal processing on this device is a µ-blox GPS-MS1 that's sort of ancient in the realm of modern electronics. --This module was 1st released June 29, 1999 and it features 0.125 MB of SRAM and 1 MB of flash memory.

-Transmitter/receiver ICs --XEMICS XE1201 Ultra low power single chip transceiver ---The XE1201 allows for data transmission and data reception in half duplex mode. --RFM RF1172 SAW (surface-acoustic-wave) filter ---The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers.

[Edit: Please note, much of the text above is c/p'd from the ifixit post.]

If the FBI didn't want anyone tampering with the unit, they would have potted it in heavy epoxy or welded the case shut. Maybe even put a light-sensitive thermal charge inside.

More likely they were worried about the screws vibrating themselves off while stuck to the underside of a car - thus the threadlocker glue everywhere.

The fact that they didn't pot it is interesting. I hadn't thought about that. Potting seems to be on the decline over the last 10 years from what I've seen.
Yeah it looked to me more like the product designer was concerned about ruggedizing it for the automotive environment and possibly making a weak attempt at making it tamper-evident.

It certainly didn't look like anything designed to protect secrets.

Does this thing actually transmit at 433.92 MHz? That's right in the 70 cm ham band!
This is part of ISM and it's a fairly common frequency for low power tx/rx modules

http://www.google.com/search?q=433.92+MHz&ie=utf-8&o...

Even car keys operate around this frequency.

That band is a shared service.
I did the teardown, and I'm a regular hacker news reader. I'll answer any questions for the next hour or so.
So this tracker does NOT use cell connections? A receiver would have to get whitin range to download tracking data?
Correct. There's specs on the short-range transmitter here: http://xemics.com/docs/xe1200/xe1201evk_userguide.pdf

Now this is an old device, and they very well might be using cell phone transmitters now.

When do you expect to find one of these stuck to the bottom of your car? ;)

In all seriousness, do you believe it would be possible for the FBI to make a similar device to use on bicycles (inside handle bars), motorcycles, scooters, or Segways?

I'd be surprised if they _didn't_ make one for honeypot bicycles.
Does it use military mode (the one that is even more precise than regular GPS)? Now that would be great reverse engineering project :)

Where was the GPS receiver mounted? These things need view of the sky, no?

I don't know the answer to either of these questions. It appeared to be a standard GPS receiver, but some investigation would reveal whether the manufacturer supports military mode. http://docs.google.com/viewer?a=v&q=cache:7hhk_GsNmTQJ:w...

I never saw it on the car, but the antenna mount had a hinge that would allow it to stick out from the side of the car. But that would be rather conspicuous—I think that's why the antenna is so large.

Is there a legal way to block them? Either the GPS signal, or the transmitter? (I'm assuming tampering with the device directly is illegal).
Sure, just transmit stronger white noise on 433.92 MHz. I haven't looked up who owns that frequency and whether there are restrictions.

Or get a GPS blocker. Which I think are illegal to operate.

I wonder what would happen if you took it off and attached it to a random other car. Then the FBI would be tracking someone else illegally, in theory.
Why would tampering with such a device be illegal? Or blocking their signal? It's your car and until proven otherwise, you have no reason to bear with other people or the government installing such surveillance equipment.

If you're a convict then you might be released earlier but with some electronic surveillance, but even that is with your own consent.

Very cool. Have you all done any firmware/software hacking?
We have not—I had limited time with the device at Wired's office. We powered it on and used a frequency analyzer on it, but that was the extent of our investigation. We were concerned that black helicopters might show up if we left it on too long. But I hope someone else does!
Could you estimate the price of this thing, as the FBI told him it was expensive (and at least the batteries seem to be).
What protocol is it using to transmit the location? Is it encrypted or authenticated? (Could it be spoofed?)
Do you know the maximum range the transceiver can transmit? The datasheet gives lots of design guidance, but nothing specific.

Data sheet: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-40...

App note: http://www.datasheetarchive.com/pdf-datasheets/Datasheets-31...

I don't know, but perhaps an RF engineer could weigh in given the frequency and transmission power.
Those batteries are impressive. I did some Googling and found:

http://www.batterymart.com/p-ls33600-ba-d-size-lithium-cell....

61 Watt-hours. That little battery could power a 60W light bulb for an hour!

(I'm currently working on a bluetooth -> IR bridge. I was worred about battery life from a coin cell, but now I'm not anymore. I will get one of these in half-AA size and keep the thing powered for the next decade :)

>That little battery could power a 60W light bulb for an hour

It's a useful 'analogy', but it's not actually true. They are 3.6V, max continuous current 250mA, so max continuous power is 0.9W

True.

I bet it would release its energy a bit more quickly if you dropped it into a nearby fire.

They're not cheap, either. They cost us $25 EACH plus a $10 Hazmat shipping fee.
Batteries(maybe not these but definitely car batteries) are typically rated at the 20hour drain rating. If you increase the current draw you will increase the power dissipated over the resistance inside the battery and reduce the amount of available power in a non linear fashion.
P = v*I
So, can we study the frequency and if the out signal uses any encryption?

Maybe we can use a homemade receiver to find the people the FBI is tracking...

Frequency and transceiver information are already posted. My guess is that the transmissions aren't encrypted, or are encrypted trivially or encoded (to obfuscate).

Since you said "we should", you should get started on it and post your findings here or better yet on a blog. The iFixit article provides a lot of bases to research from.

If the trackee removed this from his own car and attached it to some other car, would he be violating some law?
I am sure they could find one. When dealing with the government it's heads they win, tails you lose.

edit: I still think it would be worth it. One of these cars for maximum effect: http://homeland.house.gov/about/membership

It might be more effective, and more legal, to just sell your car as soon as you become aware that you've been tagged. Bonus points if you sell it to someone who is either taking a cross-country drive, or shipping it overseas.
if he does it to tamper with federal investigation - then i'd guess it'd be a violation.

If he does it to improve fuel efficiency of the car and remove unnecessary weight from the car ... it'd be interesting whether it is possible to bill the government for the service of carrying their stuff around. Or for not being able to use the car at all as having the GPS tracker attached the car may become unsuitable for your use. Shouldn't anybody whose property taken over and used by the government to be justly compensated?

Wow, the components on the GPS board look like they are hand soldered, which to me means very low volume/specialized production.
Yeah, that was the first thing I noticed. Some of the solder joints look rather suspect.
Checking under my car with a mirror after work.
I don't want to trivialize how scary it is that the FBI does this, but what I found interesting about this story was the insane capacity of the batteries. Why aren't more consumer electronics(especially iStuff where they aren't user serviceable) using this technology?
Lithium thionyl chloride batteries are not rechargeable. You get 2-3x the capacity of a rechargeable battery, once. Makes sense for this application but not consumer devices.
To be honest, I think it's perfectly fine for the FBI to do this if there's judicial oversight.

The problem is there ain't.

I wonder where they got the device? In Wired's account, the FBI demanded back from a fellow who found one on his car:

http://www.wired.com/threatlevel/2010/10/fbi-tracking-device...

The device torn down was one given to them by a woman who kept it after being tracked in 2005: http://www.wired.com/threatlevel/2011/05/gps/
This story gives background on Karen Thomas, the environmental activist who was tracked by the device. http://www.wired.com/threatlevel/2011/05/gps/

The FBI demanded the device back and she said no. Amazingly, that was the end of the story—until the Afifi story came out, and she decided to give Wired the tracker.

The interesting legal question (in addition to whether you need a warrant to do this sort of thing) is who owns something attached to your car?

I suppose its as simple as their demands not being met. "We want it back." "Nope, I already took it apart and posted it to teh intarwebs." "Well then."
I'd love to see how much those devices cost. And the TCO.
I want a kit! Would be good fun to play with.