Kiwi TDoA Direction Finding Increases SW Pirate Institutional Paranoia Levels

[ChrisSmolinski]

As many have no doubt heard by now, the Kiwi SDR network has a new feature, TDoA direction finding. Some details here: https://www.rtl-sdr.com/kiwisdr-tdoa-direction-finding-now-freely-available-for-public-use/

This has caused some... concern in the pirate listening community. Well, more concern from the operators than the listeners, I imagine. This is not a new technique, several of us have been using a variant of this and our own equipment to locate utility stations for some time, see the posts here for example, as we located one of the pips stations: https://www.hfunderground.com/board/index.php/topic,41025.0.html

I won't go into the theory behind how TDoA works, you can read about it online. The purpose of my post is to show some concrete examples of the accuracy of this technique, now that it is available to the masses.

First, here is a plot of the Link-11 military transmission on 6942 kHz, the one that often plagues the 43 meter band:



We did not know the QTH of this transmission, now we do, the northern coast of Florida.


Next, CFRX 6070 from Toronto:



And finally WTWW 9475 Lebanon TN:



As you can see, the accuracy is such that we can locate the transmitter to the state/province in question, and for larger states, what part of the state. Eyeballing the maps, I would say theres a 50 or so mile accuracy to the location of the transmitter site.  Several orders of magnitude too much to get the transmitter's street address. But enough to determine the nearest nearby large city.

I'll also note that even without techniques such as TDoA, for some time it has been possible for hobbyists to roughly guess where a transmitter is located based on propagation characteristics. Several stations in the past have attempted to spread misinformation about the transmitter site to throw DXers off the trail, this fails pretty miserably. And now with TDoA available to the masses, it will be trivial to locate stations to 50 or 100 miles. That is the fundamental change. And, of course, governments have had far superior direction finding capabilities for some time now.

While some of us have been posting DF maps of broadcast and utility stations, I expect that all users understand that it would be best to refrain from posting any maps of pirate stations.

Still, shortwave pirate radio is going to change in some ways due to this widespread DF capability.  It's impossible to keep this technique "secret", not talking about it and the capabilities won't make it go away. It is better IMHO for everyone to be as informed as possible as to the capabilities and limitations.  Pandora's box is open, there's no closing it.

[Josh]

If the privateers weren't mobile before, I doubt the advent of tda will change their operating much. It's not like fcc can't trace a line to a specific tower or fingerprint a transmitter or tell how much rf is being pushed or anything.

[Token]

If the privateers weren't mobile before, I doubt the advent of tda will change their operating much. It's not like fcc can't trace a line to a specific tower or fingerprint a transmitter or tell how much rf is being pushed or anything.

The FCC HFDF system uses, as one of its techniques, TDOA to geolocate signals.  This technique has been available to them for years.  And small groups of hobbyist have had the ability for years also.

However now anyone with access to the Kiwi network can do it with various degrees of accuracy.

I don't think this actually increases the danger of prosecution to pirates, but it might make them more uncomfortable.  It is probably more of a perceived issue than a real threat.

T!

[redhat]

If the privateers weren't mobile before, I doubt the advent of tda will change their operating much. It's not like fcc can't trace a line to a specific tower or fingerprint a transmitter or tell how much rf is being pushed or anything.

The FCC HFDF system uses, as one of its techniques, TDOA to geolocate signals.  This technique has been available to them for years.  And small groups of hobbyist have had the ability for years also.

However now anyone with access to the Kiwi network can do it with various degrees of accuracy.

I don't think this actually increases the danger of prosecution to pirates, but it might make them more uncomfortable.  It is probably more of a perceived issue than a real threat.

T!

I suspect 'business as usual' will proceed in light of this information, however, the notion that this technology is in the hands of the average enthusiast may dissuade those from running pervasive material in a frequent manor.  I myself have received a few threats over the years, and most of what we run is pretty tame.  It does add a degree of unease knowing that the average ham with an axe to grind now has access to an easy way to locate those he doesn't like, licensed and otherwise.

+-RH

[KaySeeks]

I was waiting for someone to post about this.

It likely won't change anything directly related to enforcement activity but as we know, the authorities tend to work from information given to them and I suppose it might give extra information to someone inclined to report a station for one reason or another and that could get passed on to the authorities.

I have been using it a bit this week on the Kiwi network and I will point out that it's not exactly a "turn-key" or "fire and forget" system - it's not as simple for "the unwashed masses" as driving an automobile yet. I figured out some rules of thumb to increase likelihood of tight convergence through trial and error and I bet a lot of people who aren't as much of an introverted geek as me won't have the patience. 

[BoomboxDX]

Looks like a cool feature for stuff like finding locations of secret government transmissions, but by looking at these "maps" -- which actually are distorted in projection -- they really don't show locations well -- at least for pinpointing a pirate to more than a general area.

The maps have no cities, no roads, no state lines, no county boundaries, no grid squares... They look cool, but unless there is a way for an individual to correlate them to an actual map that has more than continental outlines I sort of doubt they would help any hobbyist or ham pinpoint anything.

Aside from the government transmission mentioned above, the other stations' locations are already known. If I hadn't known CFRX's location already, by looking at that map I'd have no idea if the transmission were in Ontario, western Quebec, Ohio, Indiana, western NY, or Michigan. It's a crummy map for pinpointing anything unless you already know where it is.

That is, unless you're satisfied knowing a transmission came from a certain state that is readily identifiable, as is the case with Florida above.

[Token]

Looks like a cool feature for stuff like finding locations of secret government transmissions, but by looking at these "maps" -- which actually are distorted in projection -- they really don't show locations well -- at least for pinpointing a pirate to more than a general area.

The maps have no cities, no roads, no state lines, no county boundaries, no grid squares... They look cool, but unless there is a way for an individual to correlate them to an actual map that has more than continental outlines I sort of doubt they would help any hobbyist or ham pinpoint anything.

The system is still under development.  My understanding is one of the hit list items is adding greater detail to the maps.

However, even without that, there are lat and long grids along the sides.  Draw the lines across the page and down the page, read the scales, and you can have lat and long to the center point.  Pop that into Google Earth or Google Maps, and away you go.

T!

[ChrisSmolinski]

Here's your new and improved map, CFRX 6070 Toronto:

[BoomboxDX]

Looks like it's off by about 30 miles. Enough to make a pirate a little less hesitant, but obviously the technology will probably improve. 

[MDK2]

I suspect 'business as usual' will proceed in light of this information, however, the notion that this technology is in the hands of the average enthusiast may dissuade those from running pervasive material in a frequent manor.  I myself have received a few threats over the years, and most of what we run is pretty tame.  It does add a degree of unease knowing that the average ham with an axe to grind now has access to an easy way to locate those he doesn't like, licensed and otherwise.

+-RH

I suppose that depends on the ham. Most are in the FCC database with their home addresses, although some use PO Boxes. No need for direction finding tools when you can just look them up by call sign. But it will be interesting to see if certain politically oriented pirates keep up their transmissions. I suppose that they'd have little to worry about if they regularly go out in the field to do their thing, but those transmitting from home (even the ones who just play music and don't have content that would offend anyone) might have to worry. A lot of hams HATE pirates.

[ChrisSmolinski]

With an accuracy of 50 or so miles, or even 25 if you are lucky, this technique is not going to identify a particular operator's address. The best you will do is get the major city / metro area.   So you do this to a particular station and end up with say the Chicago metro area. That narrows it down to a few million people 

If you're in the hobby and know the players, I suppose you could narrow things down a it, or use it to confirm or deny your guess as to who is running a particular station. Or figure out which stations are run by the same operator. Of course, you could do all of this before by looking at signal characteristics, both propagation and other technical "tells" that each operator has. The Kiwi TDoA makes this a little easier and more automated now.

[Josh]

I hope this morphs into a game, see who gets closest to the transmitter.

[ChrisSmolinski]

I remembered how "back in the day" it was common for pirates to be relayed by other stations (no doubt by mailing cassette tapes), without any on the air notice that it was a relay. This allowed listeners in other areas to hear the station, and probably caused at least a little confusion at the agencies. We might see operators doing the same thing today (well, minus the cassette tape part), if WXYZ is transmitted from half a dozen locations, no one would know which, if any, was the operator's location.

[redhat]

Plus today we have streaming, so you can run a live show from the other side of the planet if need be.

+-RH

[BoomboxDX]

How does this work when there are more than one station on a frequency?

Like, since hams have been mentioned here, could they use this to pinpoint the guys who play music and cuss a lot?

Because those frequencies have other transmissions going on simultaneously.

Does this feature only work when there is a sole signal on a frequency?