Tracking Device Teardown

Teardown

Teardown

Teardowns provide a look inside a device and should not be used as disassembly instructions.

We partnered with Wired to bring you a peek inside an FBI car-tracking device. The device is similar to the one Yasir Afifi found underneath his car. If you're curious where this one came from, Wired has posted a writeup about Kathy Thomas, the woman who found this tracker under her car. They've also posted a video of Kyle doing the teardown.

The device comprises a GPS unit for receiving the car's position, an RF transmitter for relaying your location to the interested authority (i.e., the FBI), and a set of sweet D-cell batteries that power the whole enchilada. But we didn't stop there, of course. Read on to find out exactly what components make this secretive device tick.

Disclaimer: We love the FBI. We've worked with them on several occasions to fight crime and locate criminals. We've helped them with instructions on gaining entry into certain devices. We have nothing against them, and we hope they don't come after us for publishing this teardown.

Image #1

Edit Step 1 Tracking Device Teardown  ¶ 

  • We finally have one of these on the teardown table! Being in its presence, we can almost feel our civil liberties being flushed down the toilet.

  • Before we whip out the blowtorches and jackhammers, here's a look at the entire tracking system.

  • Clockwise from the top, the system consists of:

    • Battery pack

    • GPS antenna

    • Transmitter/receiver unit

    • Magnetic mounting bracket

  • The components of the system are all attached to the tracked vehicle with extremely powerful magnets. Some were so stubbornly attached that they ripped out of the mounting brackets to forever remain stuck on the undercarriage of the host vehicle.

Image #1

Edit Step 2  ¶ 

  • Wondering what kind of technology keeps the tracking device powered? Let's remove the battery pack's end cap and find out.

  • The device is powered by four lithium-thionyl chloride (Li-SOCl2) D cell batteries.

    • Each cell is good for 13,000 mAh! That's about double the capacity of the iPad 2's battery.

  • These cells are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver. Their service life is rated at 10 to 20 years.

Image #1

Edit Step 3  ¶ 

  • To begin tearing the device apart, we detached the two antennas from their screw-in mounts on the transmitter/receiver module.

  • The short antenna we disconnected in the first picture is responsible for transmitting the location signal to transponders that the FBI would use to find you.

  • The larger antenna is for receiving GPS signals from satellites orbiting far above the earth's surface.

Image #1

Edit Step 4  ¶ 

  • Removing a few Phillips screws allows us to access the innards of the GPS antenna.

  • In keeping with the non-permanent mounting solutions, the GPS antenna is attached to its bracket with a hefty piece of Velcro.

  • A quick peek at the antenna board indicates it was manufactured by SIgem, a company that partnered with Tyco in the early 2000s to make GPS components.

Image #1

Edit Step 5  ¶ 

  • Let's turn our attention back to the transmitter/receiver module.

  • A few screws are all that remain between us and the innards of this invasive device.

  • It seems that this rear cover is simply a method to connect the module to power. Presumably, power sources (batteries) of different shapes/sizes/capacities can be connected through the same plate to make the tracking device more universally installable.

Image #1

Edit Step 6  ¶ 

  • To get to the brains of the module, we focus on the other end cap.

  • The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads.

Image #1

Edit Step 7  ¶ 

  • Upon successfully drilling out all the screw heads, the outer case slides right off the transmitter/receiver assembly.

  • The two modules can be split apart to examine their circuits.

  • The small blue wire connects the GPS antenna to the GPS receiver board.

  • After disconnecting the GPS board, we can take a closer look at both components.

Image #1

Edit Step 8  ¶ 

  • The module providing the GPS signal processing on this device is a µ-blox GPS-MS1 that's sort of ancient in the realm of modern electronics.

    • It was released June 29, 1999!

  • It features an astonishing 0.125 MB of SRAM and 1 MB of flash memory.

  • The backup battery on its reverse side powers a real time clock and maintains the GPS receiver's SRAM to allow for a much faster connection time to the satellites, called a warm start. This is usually used in conjunction with a circuit to power down most of the GPS, providing a much longer battery life.

  • The slightly imperfect alignment of the SMD components on the board indicates that the FBI hand-soldered them to the board and tailored the component choices to their specifications.

Image #1

Edit Step 9  ¶ 

  • The larger of the two boards contains the connections for both antennas and is responsible for the RF side of the tracking device. Its notable chips include:

  • XEMICS XE1201 Ultra low power single chip transceiver

    • The XE1201 allows for data transmission and data reception in half duplex mode.

  • RFM RF1172 SAW (surface-acoustic-wave) filter

    • The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers.

    • Typical applications of this filter include wireless remote-control and security devices operating in Europe under ETSI I-ETS 300 220.

Image #1

Edit Step 10  ¶ 

  • Tracking device Repairability Score: -10 out of 10 (10 is easiest to repair)

    • The FBI will find you if you find their tracking device.

    • You cannot choose to be not tracked by the FBI.

    • You can legally be tracked by one of these units.

    • We'll be right back, the FBI is knocking on our door.

Image #1

Edit Step 11 Come work at iFixit!  ¶ 

  • If you think this sort of thing is super cool, we'd like you to join our team. We're hiring software engineers and designers to help us make our how-to community even more awesome.

  • iFixit is a great place to work. We have an incredible working environment, a world-class team, and a vision to change the world. Our team loves having fun together. Developers have private offices, we have regular barbecues, and we're based in San Luis Obispo, one of the most amazing places in the world.

  • Open positions:

  • By the way, that last photo looks like a postcard—but we took it just down the street from our office two weeks ago. (Some HDR may have been involved. Yes, we're photo geeks.)

Required Tools

Phillips #00 Screwdriver

$5.95 · 50+ In stock

Recommended Tools

Universal Drive Adapter

$29.95 · 50+ In stock

iFixit Lock Pick Set

$29.95 · 50+ In stock

Inspection Scope

$39.95 · 50+ In stock

Frictionless Ratchet

$24.95 · 50+ In stock

Portable Anti-Static Mat

$34.95 · 42 In stock

Popular Products

1 TB SSD Hybrid 2.5" Hard Drive

$139.95 · 3 In stock

iPhone 5 Replacement Battery

$24.95 · 50+ In stock

iPhone 3GS Replacement Battery

$19.95 · 43 In stock

T5 Torx Screwdriver

$4.95 · 50+ In stock

Comments Comments are onturn off

The "backup battery" on the back of the GPS module looks to me like a super-capacitor. These are usually used on GPS's to maintain the contents of the SRAM when the unit is powered down. Maintaining the SRAM means that the GPS gets a lock much faster (See GPS warm-start) when powered back up again. This combined with a power gating circuit will mean that the device can last much longer.

Brendan Moran, · Reply

It's actually a Panasonic VL1220 lithium battery.

Andrew Bookholt,

That might be an ancient GPS but if I'm not mistaken, the FBI will have access to 100% accurate GPS signals (rather than the - within 300 metres that we lowly mortals get) so that's one handy piece of kit...

Robin Layfield, · Reply

That'd be cool, but selective availability (the 300' civilian accuracy limit) was turned off more than 10 years ago. This thing's gps is probably not any more accurate than your typical smart phone.

Andrew Denyes,

Are you guys kidding me? You are going to get in so much trouble.

Don't get me wrong--this is a super cool thing you've done, but if this guide is still up 48 hours from now, I'll be flabbergasted. So I hope lots of people are mirroring this!

jonathan, · Reply

FBI soldered the components ? Think again...

perzapro, · Reply

Of course you can choose to be not tracked. There are GPS signal blocking devices for cars. Once you block the receiving of GPS signal the tracking device wont know where is it thereby FBI can not track you.

karmansan, · Reply

First I'd like to say that the FBI probably does have an engineering team, however, I'd assume that a contracting company built it for the agency. Secondly, was wondering if you could measure the output, transmit frequency of this device? Curious to see what frequency the location gets relayed on.

Shaun, · Reply

It seems that this rear cover is simply a method to connect the module to power.

The spring and lithium cell look suspiciously like an active tamper-awareness mechanism to me. I can think of two good reasons for tamper-awareness.

First, a savvy EE might disassemble the device in vivo and replay innocuous trip data briefly while engaging in mischief. This kind of attack is better than disconnecting the Tx antenna or moving the transceiver to a different car because it will be very difficult for the FBI to detect that the trackee is on to them. Sending a patrol car once a week or month to look for the tracked car at the reported position would quickly reveal that the device had been moved, as would correlation with any other observations like electronic toll data.

Second, if as commenter Robin speculates, the FBI's receiver is listening to the more accurate encrypted GPS signals, in vivo disassembly might allow disastrous compromise of the cryptographic material necessary to do so!

Andy Getz, · Reply

I'm not sure that's really an indication of hand soldering. I worked as a quality control inspector at an SMD fab for a while, and that assembly looks better than some of the things I saw come off the line. There's a big book on tolerances in SMD manufacturing, which outlines how much alignment error is permissible for the three classes of manufacturing (most commercial is class 2, and military/aerospace is class 3) and if memory serves, even class 3 permits a 25% offset error and a 25% rotation error on 2-pin devices.

Brendan Moran, · Reply

View Statistics:

Today: 10

This Week: 131

This Month: 370

All Time: 789,359