Tracking Device Teardown

FBI Tracking Device.

http://d3nevzfk7ii3be.cloudfront.net/igi/oPLmMAYYcgFpe11q Kyle Wiens Moderate Tracking Device

We partnered with Wired to bring you a peek inside an FBI car-tracking device. The device is similar to the one Yasir Afifi found underneath his car. If you're curious where this one came from, Wired has posted a writeup about Kathy Thomas, the woman who found this tracker under her car. They've also posted a video of Kyle doing the teardown.

The device comprises of a GPS unit for receiving the car's position, an RF transmitter for relaying your location to the interested authority (aka the FBI), and a set of sweet D-cell batteries that power the whole enchilada. But we didn't stop there, of course. Read on to find out exactly what components make this secretive device tick.

Disclaimer: We love the FBI. We've worked with them on several occasions to fight crime and locate criminals. We've helped them with instructions on gaining entry into certain devices. We have nothing against them, and we hope they don't come after us for publishing this teardown.

Tools

Drill Phillips 00 Screwdriver We finally have one of these on the teardown table! Being in its presence, we can almost feel our civil liberties being flushed down the toilet. We finally have one of these on the teardown table! Being in its presence, we can almost ''feel'' our civil liberties being flushed down the toilet. Before we whip out the blowtorches and jackhammers, here's a look at the entire tracking system. Before we whip out the blowtorches and jackhammers, here's a look at the entire tracking system. Clockwise from the top, the system consists of: Clockwise from the top, the system consists of: Battery pack Battery pack GPS antenna GPS antenna Transmitter/receiver unit Transmitter/receiver unit Magnetic mounting bracket Magnetic mounting bracket The components of the system are all attached to the tracked vehicle with extremely powerful magnets. Some were so stubbornly attached that they ripped out of the mounting brackets to forever remain stuck on the undercarriage of the host vehicle. The components of the system are all attached to the tracked vehicle with extremely powerful magnets. Some were so stubbornly attached that they ripped out of the mounting brackets to forever remain stuck on the undercarriage of the host vehicle. http://d3nevzfk7ii3be.cloudfront.net/igi/v5SnUBE5IKgN1xur Wondering what kind of technology keeps the tracking device powered? Let's remove the battery pack's end cap and find out. Wondering what kind of technology keeps the tracking device powered? Let's remove the battery pack's end cap and find out. The device is powered by four <a href="http://www.saftbatteries.com/Technologies_Lithium_LiSOCl2_303/Default.aspx" rel="nofollow">lithium-thionyl chloride</a> (Li-SOCl2) D cell batteries. The device is powered by four [link|http://www.saftbatteries.com/Technologies_Lithium_LiSOCl2_303/Default.aspx|lithium-thionyl chloride] (Li-SOCl,,2,,) D cell batteries. Each cell is good for 13,000 mAh! That's about double the capacity of the iPad 2's <a href="/Teardown/iPad+2+Wi-Fi+EMC+2415+Teardown/5071/2#s22967">battery</a>. Each cell is good for 13,000 mAh! That's about double the capacity of the iPad 2's [guide|5071|battery|stepid=22967]. These cells are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver. Their service life is rated at 10 to 20 years. These cells are suited for extremely low-draw applications where longevity is needed, making them ideal for powering an always-on transmitter/receiver. Their service life is rated at 10 to 20 '''years'''. http://d3nevzfk7ii3be.cloudfront.net/igi/oYAZSOBmMEibujjd http://d3nevzfk7ii3be.cloudfront.net/igi/bP2HQk13HFVhIdmk http://d3nevzfk7ii3be.cloudfront.net/igi/EmeuEp3EIKHEAamj To begin tearing the device apart, we detached the two antennas from their screw-in mounts on the transmitter/receiver module. To begin tearing the device apart, we detached the two antennas from their screw-in mounts on the transmitter/receiver module. The short antenna we disconnected in the first picture is responsible for transmitting the location signal to transponders that the FBI would use to find you. The short antenna we disconnected in the first picture is responsible for transmitting the location signal to transponders that the FBI would use to find you. The larger antenna is for receiving GPS signals from satellites orbiting <a href="http://en.wikipedia.org/wiki/GPS#Space_segment">far above</a> the earth's surface. The larger antenna is for receiving GPS signals from satellites orbiting [link|http://en.wikipedia.org/wiki/GPS#Space_segment|far above] the earth's surface. http://d3nevzfk7ii3be.cloudfront.net/igi/guqDGGr6mxPXRJwl http://d3nevzfk7ii3be.cloudfront.net/igi/mwFvYWuB6UkkhI2k Removing a few Phillips screws allows us to access the innards of the GPS antenna. Removing a few Phillips screws allows us to access the innards of the GPS antenna. In keeping with the non-permanent mounting solutions, the GPS antenna is attached to its bracket with a hefty piece of Velcro. In keeping with the non-permanent mounting solutions, the GPS antenna is attached to its bracket with a hefty piece of Velcro. A quick peek at the antenna board indicates it was manufactured by SIgem, a company that <a href="http://www.gisdevelopment.net/news/2001/mar/nps014.htm" rel="nofollow">partnered</a> with Tyco in the early 2000s to make GPS components. A quick peek at the antenna board indicates it was manufactured by SIgem, a company that [link|http://www.gisdevelopment.net/news/2001/mar/nps014.htm|partnered] with Tyco in the early 2000s to make GPS components. http://d3nevzfk7ii3be.cloudfront.net/igi/Ishk41aroEmBdqiB http://d3nevzfk7ii3be.cloudfront.net/igi/RRqoHxNifj1U33T2 http://d3nevzfk7ii3be.cloudfront.net/igi/1UCMEQydQaGU5oPM Let's turn our attention back to the transmitter/receiver module. Let's turn our attention back to the transmitter/receiver module. A few screws are all that remain between us and the innards of this invasive device. A few screws are all that remain between us and the innards of this invasive device. It seems that this rear cover is simply a method to connect the module to power. Presumably, power sources (batteries) of different shapes/sizes/capacities can be connected through the same plate to make the tracking device more universally installable. It seems that this rear cover is simply a method to connect the module to power. Presumably, power sources (batteries) of different shapes/sizes/capacities can be connected through the same plate to make the tracking device more universally installable. http://d3nevzfk7ii3be.cloudfront.net/igi/ACyBq62iUZkM31LQ http://d3nevzfk7ii3be.cloudfront.net/igi/oSYVKCDiyBpcbYus To get to the brains of the module, we focus on the other end cap. To get to the brains of the module, we focus on the other end cap. The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads. The FBI really did not want anyone tampering with the innards of their tracking devices. The screws were coated with so much threadlocker that we had to break out the power drill and eliminate the screw heads. http://d3nevzfk7ii3be.cloudfront.net/igi/jWKvoFjMjV2tXBUm http://d3nevzfk7ii3be.cloudfront.net/igi/EevxpOQY4FXNTUWb http://d3nevzfk7ii3be.cloudfront.net/igi/S5ymUBZPOdOAwTLI Upon successfully drilling out all the screw heads, the outer case slides right off the transmitter/receiver assembly. Upon successfully drilling out all the screw heads, the outer case slides right off the transmitter/receiver assembly. The two modules can be split apart to examine their circuits. The two modules can be split apart to examine their circuits. The small blue wire connects the GPS antenna to the GPS receiver board. The small blue wire connects the GPS antenna to the GPS receiver board. After disconnecting the GPS board, we can take a closer look at both components. After disconnecting the GPS board, we can take a closer look at both components. http://d3nevzfk7ii3be.cloudfront.net/igi/bIds1qOCYtf6imOh http://d3nevzfk7ii3be.cloudfront.net/igi/RXBLVInUPrBjrHOa http://d3nevzfk7ii3be.cloudfront.net/igi/edJIoYDM5NDSSHqY The module providing the GPS signal processing on this device is a <a href="http://docs.google.com/viewer?a=v&q=cache:7hhk_GsNmTQJ:www.qsl.net/d/dk7nt//gpsrx/gpsms1.pdf+u+blox+ms1+gps&hl=en&gl=us&pid=bl&srcid=ADGEESjYb3KyvNV-5XoxaKUZziNTjPhBtDzSjim37UgWzSjGAZaZoy2t_e7z0vYXjyd71JHDfJp_0ju3qRDigHxfw6DJKds49In1AH68e3kz9pa9RRyHu2xirykZSbCgbhM8yH_klN2q&sig=AHIEtbQ_Njl7T0SRfbJFmJzCO12_gdVAjA" rel="nofollow">µ-blox GPS-MS1</a> that's sort of ancient in the realm of modern electronics. The module providing the GPS signal processing on this device is a [link|http://docs.google.com/viewer?a=v&q=cache:7hhk_GsNmTQJ:www.qsl.net/d/dk7nt//gpsrx/gpsms1.pdf+u+blox+ms1+gps&hl=en&gl=us&pid=bl&srcid=ADGEESjYb3KyvNV-5XoxaKUZziNTjPhBtDzSjim37UgWzSjGAZaZoy2t_e7z0vYXjyd71JHDfJp_0ju3qRDigHxfw6DJKds49In1AH68e3kz9pa9RRyHu2xirykZSbCgbhM8yH_klN2q&sig=AHIEtbQ_Njl7T0SRfbJFmJzCO12_gdVAjA|µ-blox GPS-MS1] that's sort of ancient in the realm of modern electronics. It was released June 29, 1999! It was released June 29, 1999! It features an astonishing 0.125 MB of SRAM and 1 MB of flash memory. It features an astonishing 0.125 MB of SRAM and 1 MB of flash memory. The backup battery on its reverse side powers a real time clock and maintains the GPS receiver's SRAM to allow for a much faster connection time to the satellites, called a warm start. This is usually used in conjunction with a circuit to power down most of the GPS, providing a much longer battery life. The backup battery on its reverse side powers a real time clock and maintains the GPS receiver's SRAM to allow for a much faster connection time to the satellites, called a warm start. This is usually used in conjunction with a circuit to power down most of the GPS, providing a much longer battery life. The slightly imperfect alignment of the SMD components on the board indicates that the FBI hand-soldered them to the board and tailored the component choices to their specifications. The slightly imperfect alignment of the SMD components on the board indicates that the FBI hand-soldered them to the board and tailored the component choices to their specifications. http://d3nevzfk7ii3be.cloudfront.net/igi/pcaRs2TKgcQH5tKu http://d3nevzfk7ii3be.cloudfront.net/igi/xGFATBffiFE4WPd3 The larger of the two boards contains the connections for both antennas and is responsible for the RF side of the tracking device. Its notable chips include: The larger of the two boards contains the connections for both antennas and is responsible for the RF side of the tracking device. Its notable chips include: <a href="http://xemics.com/docs/xe1200/xe1201evk_userguide.pdf" rel="nofollow">XEMICS XE1201</a> Ultra low power single chip transceiver [http://xemics.com/docs/xe1200/xe1201evk_userguide.pdf|XEMICS XE1201] Ultra low power single chip transceiver The XE1201 allows for data transmission and data reception in half duplex mode. The XE1201 allows for data transmission and data reception in half duplex mode. RFM <a href="http://www.rfm.com/products/spec_sheet.php?record=RF1172" rel="nofollow">RF1172</a> SAW (surface-acoustic-wave) filter RFM [link|http://www.rfm.com/products/spec_sheet.php?record=RF1172|RF1172] SAW (surface-acoustic-wave) filter The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers. The RF1172 provides front-end selectivity (the capability to separate signals in one frequency from all other frequencies) in 433.92 MHz receivers. Typical applications of this filter include wireless remote-control and security devices operating in Europe under ETSI I-ETS 300 220. Typical applications of this filter include wireless remote-control and security devices operating in Europe under ETSI I-ETS 300 220. http://d3nevzfk7ii3be.cloudfront.net/igi/rJwWNscWYBp4vbV5 http://d3nevzfk7ii3be.cloudfront.net/igi/m2DxU3EukPEmXPkF Tracking device Repairability Score: -10 out of 10 (10 is easiest to repair) Tracking device Repairability Score: '''-10 out of 10''' (10 is easiest to repair) The FBI will find you if you find their tracking device. The FBI will find you if you find their tracking device. You cannot choose to be not tracked by the FBI. You cannot choose to be not tracked by the FBI. You can <a href="http://www.time.com/time/nation/article/0,8599,2013150,00.html" rel="nofollow">legally be tracked</a> by one of these units. You can [link|http://www.time.com/time/nation/article/0,8599,2013150,00.html|legally be tracked] by one of these units. We'll be right back, the FBI is knocking on our door. We'll be right back, the FBI is knocking on our door. http://d3nevzfk7ii3be.cloudfront.net/igi/AHKiCiDSVmDk2VPB If you think this sort of thing is super cool, we'd like you to <a href="/Info/jobs">join our team</a>. We're hiring software engineers and designers to help us make our how-to community even more awesome. If you think this sort of thing is super cool, we'd like you to [[Info:jobs|join our team]]. We're hiring software engineers and designers to help us make our how-to community even more awesome. iFixit is a great place to work. We have an incredible working environment, a world-class team, and a vision to change the world. Our team loves having fun together. Developers have private offices, we have regular barbecues, and we're based in <a href="http://www.flickr.com/places/United+States/California/San+Luis+Obispo" rel="nofollow">San Luis Obispo</a>, one of the most amazing places in the world. iFixit is a great place to work. We have an incredible working environment, a world-class team, and a vision to change the world. Our team loves having fun together. Developers have private offices, we have regular barbecues, and we're based in [http://www.flickr.com/places/United+States/California/San+Luis+Obispo|San Luis Obispo], one of the most amazing places in the world. Open positions: Open positions: <a href="/Info/jobs#Section_Software_Engineer">Software Engineer</a> [[Info:jobs#Section_Software_Engineer|Software Engineer]] <a href="/Info/jobs#Section_User_Interface_Designer">User Interface Designer</a> [[Info:jobs#Section_User_Interface_Designer|User Interface Designer]] <a href="/Info/jobs#Section_Software_Engineering_Intern">Software Engineering Intern</a> [[Info:jobs#Section_Software_Engineering_Intern|Software Engineering Intern]] By the way, that last photo looks like a postcard—but we took it just down the street from our office two weeks ago. (Some <a href="http://en.wikipedia.org/wiki/High_dynamic_range_imaging">HDR</a> may have been involved. Yes, we're photo geeks.) By the way, that last photo looks like a postcard—but we took it just down the street from our office two weeks ago. (Some [http://en.wikipedia.org/wiki/High_dynamic_range_imaging|HDR] may have been involved. Yes, we're photo geeks.) http://d3nevzfk7ii3be.cloudfront.net/igi/tLGoGoebPshlHxuX http://d3nevzfk7ii3be.cloudfront.net/igi/sPqsu3Tj4e1BWtD4 http://d3nevzfk7ii3be.cloudfront.net/igi/o6JKqG2yENFtA45T

To reassemble your device, follow these instructions in reverse order.