The Great Brazilian Sat-Hack Crackdown

link=

Brazilian satellite hackers use high-performance antennas and homebrew gear to turn U.S. Navy satellites into their personal CB radios. 
Photo: Divulgação/Polícia Federal

CAMPINAS, Brazil — On the night of March 8, cruising 22,000 miles above the Earth, U.S. Navy communications satellite FLTSAT-8 suddenly erupted with illicit activity. Jubilant voices and anthems crowded the channel on a junkyard's worth of homemade gear from across vast and silent stretches of the Amazon: Ronaldo, a Brazilian soccer idol, had just scored his first goal with the Corinthians.

It was a party that won't soon be forgotten. Ten days later, Brazilian Federal Police swooped in on 39 suspects in six states in the largest crackdown to date on a growing problem here: illegal hijacking of U.S. military satellite transponders.

"This had been happening for more than five years," says Celso Campos, of the Brazilian Federal Police. "Since the communication channel was open, not encrypted, lots of people used it to talk to each other."

The practice is so entrenched, and the knowledge and tools so widely available, few believe the campaign to stamp it out will be quick or easy.

Much of this country's geography is remote, and beyond the reach of cellphone coverage, making American satellites an ideal, if illegal, communications option. The problem goes back more than a decade, to the mid-1990s, when Brazilian radio technicians discovered they could jump on the UHF frequencies dedicated to satellites in the Navy's Fleet Satellite Communication system, or FLTSATCOM. They've been at it ever since.

Truck drivers love the birds because they provide better range and sound than ham radios. Rogue loggers in the Amazon use the satellites to transmit coded warnings when authorities threaten to close in. Drug dealers and organized criminal factions use them to coordinate operations.

Today, the satellites, which pirates called "Bolinha" or "little ball," are a national phenomenon.

"It's impossible not to find equipment like this when we catch an organized crime gang," says a police officer involved in last month's action.

The crackdown, called "Operation Satellite," was Brazil's first large-scale enforcement against the problem. Police followed coordinates provided by the U.S. Department of Defense and confirmed by Anatel, Brazil's FCC. Among those charged were university professors, electricians, truckers and farmers, the police say. The suspects face up to four years and jail, but are more likely to be fined if convicted.

First lofted into orbit in the 1970s, the FLTSATCOM bird was at the time a major advance in military communications. Their 23 channels were used by every branch of the U.S. armed forces and the White House for encrypted data and voice, typically from portable ground units that could be quickly unpacked and put to use on the battlefield.

As the original FLTSAT constellation of four satellites fell out of service, the Navy launched a more advanced UFO satellite (for Ultra High Frequency Follow-On) to replace them. Today, there are two FLTSAT and eight UFO birds in geosynchronous orbit. Navy contractors are working on a next-generation system called Mobile User Objective System beginning in September 2009.

Until then, the military is still using aging FLTSAT and UFO satellites — and so are a lot of Brazilians. While the technology on the transponders still dates from the 1970s, radio sets back on Earth have only improved and plummeted in cost — opening a cheap, efficient and illegal backdoor.

To use the satellite, pirates typically take an ordinary ham radio transmitter, which operates in the 144- to 148-MHZ range, and add a frequency doubler cobbled from coils and a varactor diode. That lets the radio stretch into the lower end of FLTSATCOM's 292- to 317-MHz uplink range. All the gear can be bought near any truck stop for less than $500. Ads on specialized websites offer to perform the conversion for less than $100. Taught the ropes, even rough electricians can make Bolinha-ware.

"I saw it more than once in truck repair shops," says amateur radio operator Adinei Brochi (PY2ADN) "Nearly illiterate men rigged a radio in less than one minute, rolling wire on a coil."

Brochi, who assembled his first radio set from spare parts at 12, has been tracking the Brazilian satellite hacking problem (.pdf) for years.

Brochi says the Pentagon's concerns are obvious.

"If a soldier is shot in an ambush, the first thing he will think of doing will be to send a help request over the radio," observes Brochi. "What if he's trying to call for help and two truckers are discussing soccer? In an emergency, that soldier won't be able to remember quickly how to change the radio programming to look for a frequency that's not saturated."

When real criminals use these frequencies, it's easy to tell they're hiding something, but it's nearly impossible to know what it is. In one intercepted conversation posted to YouTube, a man alerts a friend that he should watch out, because things are getting "crispy" and "strong winds" are on their way.

Sometimes loggers refer to the approach of authorities by saying, "Santa Claus is coming," says Brochi.

When the user's location is stable, the signal can be triangulated. That's how the Defense Department got the coordinates to feed Brazilian authorities in March's raids.

While Brazil may be the world capital of FLTSATCOM hijacking, there have been cases in other countries — even in the United States. In February of last year, FCC investigators used a mobile direction-finding vehicle to trace rogue transmissions to a Brazilian immigrant in New Jersey. When the investigators inspected his radio gear, they found a transceiver programmed to a FLTSAT frequency, connected to an antenna in the back of his house. Joaquim Barbosa was hit with a $20,000 fine.

A technician with Anatel, speaking on condition of anonymity, says the chief problem with ending the satellite abuse in this country is that U.S. and Brazilian authorities simply waited too long to start. Thousands of users are believed to have the know-how to use the system. After a bust, the airwaves always go quiet for a while, but the hijackers always return.

One week after the "Operation Satellite," Brochi met with Wired.com at a gathering of amateur radio enthusiasts in a bucolic square in Campinas, about 60 miles north of Sao Paulo. Brochi switches on his UHF receiver and scans through the satellite frequencies.

It's relatively quiet now on the satellite underground, except for the static-like sound of encrypted military traffic. But eventually, a lone creaky voice cuts through. It's a man in Porto Velho, the capital of Rondônia, a day's drive north into the upper Amazon basin. He's making small talk with a friend in Portuguese. The satellite pirates are creeping back on the air.