Cellular Phone Based Surveillance Bug


One of the easiest homebrew surveillance bugs you can use is an old, AMPS Motorola handheld cellular phone.  They will need to be the slightly newer phones with software version numbers starting with 95xx.  Examples: Motorola TeleTAC 200/250 and Pipers.

Press [PWR] to turn the phone on.

Immediately enter: [FCN] [0] [0] [*] [*] [8] [3] [7] [8] [6] [6] [3] [3] [STO]

The screen will start flashing numbers.  Example: 314 059

In case you have trouble remembering the number sequence, it spells out "TESTMODE".  Your phone is now in test mode, which is where we'll begin to turn it into an excellent, stable, high-power surveillance bug.

Press [#] to get to the U5   ' prompt.  This is the test mode prompt where all the commands will be entered from.  (Note, the U5 stands for US - as in USA)

Enter the frequency you want to transmit at.  This can be anything from 824.04 MHz to 848.97 MHz in 30 kHz steps.  You'll need to enter the frequency in "Motorola Test Mode" channel format.  Example: to transmit at 837.00 MHz, cellular channel 0400, you'd enter

[1] [1] [0] [4] [0] [0] [#]

To turn the transmitter carrier on enter: [0] [5] [#]

Verify with a frequency counter or communications receiver that it is indeed transmitting at 837.00 MHz.

Next is the most important step, you need to turn the microphone (transmit audio) on!!

Do this by entering: [1] [0] [#]

Verify by listening for a feedback squeal on your communications receiver or by talking into the phone's microphone.

You are now in possession of a very powerful surveillance device.  For a complete listing of the Motorola channel numbers and more test mode commands, read the The Motorola Bible by Mike Larsen.

Notes

Pictures

  1. Outside case overview  With a simple external electret microphone for testing and an external TNC RF output connector
  2. Internal overview  After removing the three screws holding the case together
  3. RF output connection  Coax connection for adding an external RF connector
  4. Second level overview  Exposed keypad PC board.  External microphone modifications shown
  5. External microphone jack  Closeup photo of a 1/8" mono jack for adding an external electret microphone

Commercial Cellular Phone Bug

Auly International Corporation  Tel: 886-2-29398159  Fax: 886-2-29390046  E-mail: auly [at] seed.net.tw


Return to Homebrew Military & Espionage Electronics Page