GENERAL   EQUIPMENT   INC.                    


8724 Sunset Drive #191Miami FL 33173 · USA                                  











GSM Interceptor


Upon Request














GSM Interception System




 Real time interception of GSM traffic

 Supports both A5.1 and A5.2 deciphering

 Totally transparent and undetectable by the Mobile Operator and the subscriber

 Support for all frequency bands

 Gathering intelligence information even when target is not using the mobile phone

 User-friendly operation

The system is designed for off-air interception for cellular communication in GSM networks. It provides the interception of 4/6/8 ( or more) simultaneously subscribers that are operating close to the system. The system intercepts and records all outgoing and incoming calls, voice and SMS, to and from the target.

The system is using an active system that captures the IMSI and IMEI of the targets but as it is an active system it is proved fully non detectable modes of operation.

The system operates in Random mode as well as in Target mode. It can filter, track and record only the target operation.


 Totally undetectable by the operator and by the user

 Intercepts and records all outgoing and incoming calls, voice and SMS

 All target calls are registered in the Mobile Operator billing systems

 Pass the caller ID to the target mobile phone.

 All traffic (voice and data) is fully encrypted in the air.

Multi Mobile Operators functionality

 Easy change of Mobile Operator by changing a parameter only

 Interception distance up to 1Km,

 Interception operation starts in less than 15 seconds

Correlation tools to detect targets

Analysis tools to search for events

VPN configuration allows operation in different locations and common control center.

 Operate with GSM DF system – remote silent activation of a target


Options and extra features:

 Optional model up to 2Km.

 Optional- interception of 3G cell phones.

 Optional- target Direction Finder – DF subsystem

 Optional – target Direction Finder – Homing system

 Optional- Dominator V - Split operation: controlling remote interception points via wireless communication

 Remote operation – controlling of interception mission via Internet

 Target communication manipulation. Block, redirect or change information to or from the target. Change SMS content, Voice call manipulation



The System Purpose

 Detecting GSM-standard mobile stations, located within the zone controlled by the System,

 Registering traffic (incoming and outgoing communications) from these mobile stations,

 Manipulating the state of mobile stations, which have been registered by the system.

The System operates in stealth mode in GSM networks, which use various encoding types (А5.2, А5.1)

The system supports:

 Defining mobile station key parameters - IMSI, IMEI, Kc, etc, which are required for System operation;

 Full control over mobile station incoming and outgoing traffic within the System’s reach zone;

 Manipulating the state of mobile stations, including the possibility of identifying the location of a mobile station (target) by activating its transmitter.

The System range:

The system is the only system in the world that can operate in a range between 1-2 Km (with long range option).

The system default configuration supports up to 1 Km. The actual system range will be depending on the environment where it is being used. Typically in a heavily built-up urban area the range will be about 150 meters that is because BTS in an urban area covers small area influence on the real capture area of system.

In more open areas where the cell coverage area is larger the actual interception distances.

Optional models can be provided for increased range.

The system special features

The dominator I can perform several manipulations to provide more information about the targets.

 The system can force the activation and the transmission of the target phone to feed the Direction Finder (DF) system

 Early Kc evaluation is performed by the MS unit. It helps to shorten the authentication call process. It helps only if Mobile Operator change the Kc every few calls.

 The system force the target mobile phone to a certain ARFCN traffic channel to correlate with the operation of a DF system

 The system shows constant indications of the reception level from the Mobile subscriber as well as constant level display of the BTS.

 PLMN detection – The Dominator I includes a very important function that called "Get Public number". It detects the Mobile Subscriber telephone number (PLMN number) by capture its number when sending the callerId over hidden incoming call.

 Tracking and analysis tools by saving subscribers lists that include fade out subscribers, rejected subscribers and " target presence " subscriber lists,

 Target history tracking list - to view the information stored in the database on a subscriber with IMSI identification

 Backup utilities - Convert Voice recording to standard .WAV files to be recorded on removable storage media. Database can be exported due to Microsoft Access MDB format.

 Intelligence Analysis functions helps the operator to search for specific conversation or SMS. The operator can apply many filters to search for an event. SQL query language also provide means to search for events

 Easy way to detect if Target replaces SIM cards. Each HLR list displays the IMSI (SIM Id number) and the IMEI (Equipment Id number). Using the correlation function the operator finds the changes of new IMSI/IMEI combinations.

 The system applies transmission level control to determine the Tx level of the BTS.

 Intelligence gathering when the target does not participate in incoming/outgoing calls (call standby).

 Quick Mobile Operator change. The operator may change to a new operator by changing the LAI ( MCC + MNC) in the system BTS parameters setup.

operating modes

“Catcher” mode

 IMSI and IMEI catching. (Secretly obtaining mobile station main identification parameters (IMSI, IMEI, TMSI, Kc etc).

 Detection, controlling of mobile stations entering and leaving, turning the power on and off in the System's coverage zone.

 Preventing operation of a certain mobile station (Target) or of station groups, which are in the System's coverage zone.

The System initializes the operation of the base station. Thus, one cell is formed (further - internal network) for which the MCC, MNC and ARFCN values will correspond to the parameters of a cellular communication operator, operating in a given district (further - external network), and the LAC is set to a different value from what is used in the real network. The mobile phones, which are within its operation radius (further - subscribers), will acknowledge activation of a strong channel and will start the registration procedure. They will transmit to the System their IMSI, IMEI, TMSI (received in real GSM networks), class mark, KCN. The program’s “BTS control” window will display a list of registered subscribers (called in the system - HLR). For the subscribers, registration in the internal network does not differ from registration in the external network.


Maintaining full control over mobile station incoming and outgoing traffic within the System’s coverage zone;

Two control modes:

1. Random mode Interception (all mobile stations)- Capture and record all incoming and outgoing traffic within the System’s coverage zone;

2. Tracking mode Interception – IMSI and/or IMEI (only targets)

The System supports subscriber (target) selection by the known IMSI and/or IMEI identifiers and also has the given identifiers search tools based on the registered subscribers’ statistical list processing results.

The System operates in stealth mode and it cannot be detected by the mobile stations’ users. The system does not create interference for external mobile GSM networks.

“Target correlation” mode.

The “Target Correlation” function helps to identify the Targets specific parameters from a list of all subscribers that were registered in the system.

This function is intended to search for the target’s IMSI/IMEI identifiers with the purpose of their subsequent use as selection parameters. This technique is based on comparing the lists of subscribers, registered in the internal network, obtained from various sources (at different addresses) during various time periods

“Local network” mode

 The System supports mobile station operation (restoring the radio coverage zone) in critical situations (natural or technologic disasters);

 Hostage situations - search, detection and possible contact with the GSM mobile station owners in disaster areas, accidents (supporting exclusive System’s operator’s contact with pre-determined mobile stations).

 It can be used as a local area network for a small office.


Supports detection by the usual (standard) radio control resources of the location of a given mobile station, located within the System's coverage zone, by concealed activation of the mobile station’s transmitter.


The following units are included with the System:

 Paging channel stations - to receive from one external network’s LAC incoming subscribers’ call messages, registered in the internal network;

 Mobile stations - to support authentication procedure, initiated by the external network, during incoming and outgoing subscribers’ calls, registered in the internal network. The mobile stations are automatically tuned to the internal network base station’s ARFCN channel;

 Active stations - to interact with the external GSM network on behalf of the subscriber, registered in the internal network.

 Notebook PC to perform the control, storage, information production and analysis tools. The Notebook Pc is handling the real time deciphering function.




 BTS cloning system includes:

o A base station (BTS), tuned to one of the GSM-900 or GSM-1800 frequency bands (with preliminary agreement);

 Multi BTS (multi bands and multi Mobile operators support) connection could be ordered

o A base station transmitting channel amplifier

o Two (or more) channels of mobile stations for Kc calculation.

o Internal Directional antennas

 Target cloning unit includes:

o A complete set of up to 6 active stations.

o A paging channel station 1 or 2 units;

 A notebook with the corresponding software (PC)

o IBM ThinkPad T60 or better

o Processor 1.86GHz

o 80Gbyte hard disk

o 2.048 Gbyte RAM;

 External Directional antenna for the GSM frequency multi band

 A set of connection cables.

 Long distance optional components

o High gain High power antennas

o Long distance amplifiers units


Operational Scenarios with wireless system Increase the range

The range of the system is defined between the system and the target. The range is between 150 meters in town to 1km in rural areas and up to 2km with long distance option.

With wireless option the range will be defined by the sum of the distance between the target and the battery operate BTS cloning and the distance between the cloning BTS to the recording system

– the Laptop. So the range may be increase to 600 meters in town to much more even 15 km in LOS (Line Of Sight).


Penetrate to buildings:

With the wireless option we can make interception Inside buildings while the recording system will be in a van out of the building.


Penetrate to difficult areas



The system Graphic User Interface (GUI) is composed of main window and some sub programs that enables the process of the information that was captured during the interception process:

The main windows enable the full and easy control of the field interception mission. It provides an easy setup of the system parameters and a full automatic capture and presentation of the communication protocols of the subscribers.


The system main windows:

The main window presents the status of the 4 channels receivers and voice recorders.

Via the main windows the system operator manages the target list parameters and controls the modes of operations.

The target correlation window enables to isolate the target IMSI/IMEI parameters by correlating of subscribers lists with or without the target presence. The targets correlation window enables also to detect the replacing of SIM cards in mobile handsets by correlating the IMSI and IMEI data.




Vehicle DF option:

The system DF adds both a direction finding and a tracking vehicle GPS location capability to existing system basic GSM phone interception systems. The whole system fits into a single case and can be deployed on any vehicle in less than ten minutes.

Extremes of performance of mobile tracking have always required sophisticated equipment and highly skilled operators. The system DF offers simplicity of deployment and use whilst maintaining the range and sensitivity of more complex and expensive equipment. The system DF has been designed to offer the simplest dual band GSM cellular phone location solution available on the market today.


 Installed and ready to use in under ten minutes

 Single page controller display shows all tracking information

 Audible tone varies according to range for ease of use

 Digital signal processing removes need for operator fine tuning and improves


 Data interface allows the GPS position of the tracking vehicle and the direction to the target to be displayed by Director mapping software.

 Suitable for mobile deployment & operation

 Audible tone changes to indicate GSM lock.

The system DF add-on option comprises three major components:

 Antenna pod

 Receiver

 Hand held controller

The Antenna Pod

The antenna pod receives the incoming signal and is connected by two screened cables to the receiver. If the system is deployed on a car the pod is fixed to the roof by magnets and/or roof straps to each corner. The use of roof straps is recommended under all conditions.


The Receiver

The receiver detects the cell phone signals, automatically synchronizes to the GSM signal and calculates the bearing to the selected phone. Tracking data is displayed on the hand held display (HHC1) which is also used to select the optimum average period.

The Hand Held Controller

HHC1 displays the signal bearing on a polar display with a resolution of +/- 1 degree. The signal strength is displayed on a bar graph and the signal quality is indicated by the length of the direction pointer.


GPS Mapping

Vehicle based mapping application design with large buttons for optional touch screen use. It displays the local and the target position with DF cone when available. It also enables easy interface with Google earth maps and images.



The method of operation is based on two vehicles. First vehicle with the interception system that forces the target phone to send continues signal transmission. The second vehicle is deployed with the DF components. The direction to target is displayed as a compass pointer and the relative signal strength is shown as a bar graph and numerically. The audio tone increases in frequency as Dominator DF gets closer to the target giving a clear warning of a close encounter.


Homing Device

 Indoor direction finder

 Small and light weight

 Support GSM900, DCS1800 and PCS1900

 Rechargeable batteries

 Sound indication




Suite case N° 1
Software unit + Active Station

Suite case N° 2



GSM Interception methods

Active vs. Passive

Advantages and Disadvantages of passive system:

Many clients are asking for passive because they do not want that the interception mission will be detected by the targets. The client assumes that the fact that the system transmit signal to the air may cause the detection by the target.

Yes, this 'non transmission' is the benefit of the passive method but this is the only benefit of these systems.

The passive method cause many difficulties and disadvantages. More facts about A5.1 passive interception systems:

1. There are no fully passive real time interception systems for A5.1 today

2. System are detecting the key after minutes

3. All the passive and semi passive system are losing the first conversation

4. If Kc (encryption key) is changing every call the systems can't totally work. There are many GSM operators that change the Kc every call.

5. It can work in larger distances but receive only one side of the conversation

6. For good interception, the system should be very close to the target. Bad reception gives high BERR (bit error rate) that eliminate the possibility to detect the key.

7. The interception and recording of many calls stopped in the middle.

8. The rate of capturing a call is depending on the number of

channels (4+4, 8+8, 16+16,,,,) that the system has relative to the

number of channels in the area.

9. Detection of targets is based on Temporary identification numbers –TMSI. It always nee to be detected and updated.

10. The system collects information only if the target is using the cell phone(talking or SMS)

11. The systems are much much more expensive than active.


Advantages and Disadvantages of active system:

The Dominator I is the only non detectable active system in the world.

Here are some of the characteristics of the modern active system:

1. Yes it is active and transmit signal to the air

2. It provides real time interception in all the operators and all the working modes!!!!

3. Collect intelligence information when the targets are not using the cell phone

4. It captures IMSI and IMEI in the target area.

5. Interception filtering is by SIM identification or equipment identification

6. Since it is active the quality of target voice as well as other party voice is absolute.

7. It provides benefits like target correlation, target phone number detection, easy operation, almost absolute rate of success.

8. Much easy to detect the targets. Easy to detect if target is replacing SIM or Equipment.

9. Distance is affected by other base stations. Standard distance is up to 1Km.


Differences Summary:

• Probability of interception

o GSM network uses frequency hopping and changing channels (frequencies) in the middle of a call. The GSM also uses TDMA which many calls can use the same BTS channel. Because of those factors there is a probability of reception, that means there is a chance that conversation will be captured by the system. For that the more channels the system has the better chance to capture conversations.

o The Active system capture 100% of the calls

• Quality of voice

o In the passive system the quality of voice is a factor of quality of reception. You may listen and record a noisy conversation because the reception of the mobile unit is very low. Sometimes you can hear only the Base Station and not the mobile handset

o In active system that works as a relay the quality of voice is


• Intelligence gathering

o In passive systems you capture only targets that are talking

o In active system you can gather information about a target even if he is not making conversation

• Detecting a target

o In passive system you detect a target by TMSI ( temporary number that changes every few hours)

o In active system you may find the target by IMSI which is a fix number even before he makes a call.

• Target phone number

o Passive system can't find the number

o Active system you can find the number of the target





Specification and photos are not contractual and are subject to verification upon inspection







This paper was prepared by General Equipment Inc.
The paper represents an offer of a partner of General Equipment Inc.
All rights are reserved by and for General Equipment Inc.
All content and ideas of this paper are the property of General Equipment Inc.






Defense items are subject to final destination approval and granting of an

export license issued by exporting country's authorities