This document proposes a portable cellular network solution using commercial off-the-shelf Global System for Mobile Communications (GSM) technology. The solution includes a field deployable controller with integrated mobile switching center, base station controller and other functions. It can support up to 50 subscribers across a 2.4 square mile area. The system is scalable and can interconnect to existing telephone networks. It also has features to monitor commercial cellular traffic and selectively add unauthorized phones to the private network.

1. Cellular Continuity of Operations Option
Jon R. Marcy
Sr. I.T. Consultant
Jon Marcy Consulting Services
March 4, 2013
jonmarcy@ucnetmaker.net

2. Cellular Continuity of Operations Option 1
Table of Contents
Executive Summary ........................................................ 2
Requirements Definition ................................................ 3
Solution Option .............................................................. 3
GDIT Sectera Handset Compatibility .............................. 6
Antennas......................................................................... 6
Applications scenarios .................................................... 6
Portable GSM System Subscriber Grabbing Feature ...... 6
Portable GSM system with no/limited connectivity to PSTN 7
Portable GSM system connected to PSTN and Internet 8
Portable GSM system as a roaming GSM network ........ 9
Past Performance Examples ......................................... 10
Summary....................................................................... 12
Jon Marcy Consulting Services

3. Cellular Continuity of Operations Option 2
Executive Summary
With the growing dependency on mobile
communications with the United States and
abroad, comes an emerging risk in the advent of a
manmade or natural disaster. Commercial cellular
networks are designed to support normal business
type operations, and are not equipped to support
sudden surges in use or meet the survivability
requirements that come with event that interrupts
or destroys these services.
This paper provides for a Commercial-Off-The-Shelf
(COTS) capability that has a proven track record in
support of both the Tsunami relief effort in
Indonesia and the Hurricane relief effort in New
Orleans in the aftermath of Katrina.
The technology is based on COTS Global System for Mobile (GSM) 3G technology that is
operational in over 80% of the globe today. Within the USA, companies such as AT&T and T-
Mobile both operate national GSM networks, and most 4G handsets today are dual-band and
work with 3G GSM frequencies. There are Enhanced Voice Data Only (EVDO) options to the
technology being presented in this paper, however EVDO technology is primarily limited to use
within the USA by companies such as Verizon and Sprint, and thus don’t represent an option
that can be deployed globally in support of emergency communications.
While many commercial cellular networks are being upgraded with 4G Long Term Evolution
(LTE), the LTE strategy represents the next generation of GSM. As such, most all LTE enabled
handsets are backwards compatible with GSM radios, as they are equipment with dual-band
radios. One of the baseline assumptions made during the development of this option was that in
the event of disaster recovery plan that the primary means of communications to be supported
would be voice, thus the focus was placed on the less expensive 3G technology.
Jon Marcy Consulting Services

4. Cellular Continuity of Operations Option 3
Introduction
Pico-cell technology has been around for over 10 years, with systems being manufactured to
support both legacy GSM and EVDO bands. Companies such as Qualcomm and Motorola both
have rich histories in the development of EVDO radio technology, while GSM, being an
international standard, have international manufactures like Nokia-Siemens, Ericsson, and
others, to name a few. The primary difference between cellular pico-cell technology and their
larger commercial carrier grade cousins is the emitting power of the transmitters, and the
number of handsets they can support. Other than that, they are identical in both software and
radio technology.
Requirements Definition
The Department of Defense (DOD) needs to provide assured wireless communications that will
interoperate with existing commercial Global Systems for Mobile Communications (GSM)
wireless networks located within the United States and overseas. The wireless communications
system shall also provide the ability to monitor, as required, commercial GSM traffic collected by
the system. The cellular requirement includes a comprehensive wireless communications
system package consisting of:
• A secure GSM cellular system,
• Coverage for the operational areas covers approximately 2.4 square miles,
• Operate in the 900MHz & 1800MHz GSM spectrums,
• Support for 40 to 50 private subscribers/users (expandable to 200),
• Interface to an existing commercial or DOD telephone switch or communications
elements,
• System scalability in terms of capacity and features.
Solution Option
The components listed are compliant with DOD Directive 8100.2, and will interoperate with
commercial carrier GSM networks. The proposed solution will meet the basic operational
requirements stated in the above requirements definition. It will provide a private GSM wireless
communications system with the ability to passively collect commercial GSM traffic within the
range of the system. The system’s capacity will easily support 100 private users, and up to 200
subscribers & users depending on quality of service needs.
The ‘Field Deployable’ controller is a small, portable, light weight GSM network with limited
capacity that combines a software based GSM MSC (Mobile Switching Center), BSC (Base Station
Controller), SMSC (Short Messages Service Center), HLR (Home Location Register), VLR (Visitor
Location Register), IWF (Inter Working Function) and network management functions. The
Jon Marcy Consulting Services

5. Cellular Continuity of Operations Option 4
system is designed specifically for deployment with small user groups, where limited traffic
capacity is required. Optional T1, FXO (4 ports included in basic system) and Modem backhaul
options are available to enable connectivity to the PSTN or a DSN PBX. Up to five picoBTS can be
connected to the Field Deployable controller through IP/Ethernet links. The picoBTS can
therefore be co-located with the controller or remotely connected by an IP/Ethernet
connection. The proposed rugged transit case includes one (1) controller and one (1) picoBTS.
Features:
• Provides remote GSM voice, secure voice and data solutions to small user groups
• Supports 7 simultaneous mobile to land calls (codec processing is limited by the PC
processor capacity) and up to 5 GSM TRX at 1800, 1900MHz. Mobile to mobile calls are
streamed directly between BTS’s as an IP stream; as such Mobile to Mobile call capacity
is limited to the number of available traffic channels
• Supports 9.8kbps circuit switched data
• Simple to use Browser Based Management interface
• Integrated PBX for local traffic routing
• Small, portable PC hardware platform
• Optional T1, FXO (4 ports included in basic system) and Modem ports support local
traffic routing
BSS: BSC software is licensed with the purchase of each picoBTS. The picoBTS is available at
900MHz, 1800MHz, 1900MHz
OS: Red Hat Linux 8.0 (2.4 kernel).
O&M: Integrated browser based interface for system configuration and management
Capacity: The Field deployable controller is capacity limited to 7 simultaneous mobile to land
calls – limited by the fixed processing capacity of the PC. Additional coverage may be made
available by deploying up to 5 GSM pico-cells.
Backhaul options: including T1, FXO (4 ports included in basic system) and Modem ports can be
added to provide alternative routing options. Note that up to two PCI modules can be
incorporated into the controller
Hardware Options: The capacity requirements for the Field Deployable controller are
determined primarily by the PC processor. Up to 7 simultaneous outgoing calls are available for
termination to an external network. Only two PCI modules may be installed in the Field
deployable unit: Options include
Additional BTS: Up to four (4) additional Pico cells may be deployed with the Field Deployable
controller. Each Pico cell comprises a single (1) nanoBTS and (1) BSC RTU (runtime) license.
Jon Marcy Consulting Services

6. Cellular Continuity of Operations Option 5
Available frequency options include 900MHz, 1800MHz or 1900MHz. All frequency variants may
be deployed simultaneously if required
T1 module: Option comprises the T1 hardware module and appropriate SW license for a single
T1 port (23 channels) to allow clear call progression via a standard T1 interface. The T1 interface
supports clear calls only.
FXO module: Includes a 4 port FXO hardware module and the appropriate SW license for up to 4
x FXO ports for local routing to POTS lines. The FXO interface supports clear calls only.
Secure call module: The Option includes a 4 port modem module and the appropriate SW
license for the internal IWF to facilitate local routing of secure calls via POTS lines. The modem
PCI module supports secure calls only.
BTS Range Enhancement: This is a custom option which allows the pico-cell range to be
extended significantly. Additional Power Amplifiers and Antennas are quoted to implement this
option.
Architecture Schematic
Traffic
FXO/T1 to
PBX/PSTN
Browser
• System
Management
• Packet Data
Services
GSM FD Controller
• Software based MSC, BSC,
VLR, IWF and SMSc on PC BTS
platform
• Clear and Secure traffic • 200mW 1800MHz
routed via PBX or PSTN GSM pico-cell
• Optional GPRS • optional range
GGSN./SGSN for packet enhancement
data services
Inherent Subscriber grabbing feature: All GSM cell phones will attempt to register to an
operational network. When the phone detects the control channel of the tactical network it will
transmit its IMSI to the network MSC/HLR or home location register. The 15 digit hexadecimal
number from the cell phone is compared to the HLR database. If the number does not have a
Jon Marcy Consulting Services

7. Cellular Continuity of Operations Option 6
match within the HLR an error message will be sent back to the MSC and network BSS to
indicate "NO SERVICE"! The process that creates the NO Service can be monitored and from the
message string the cell phones IMSI number can be displayed and then entered into the tactical
systems HLR/subscriber database. A feature can also be added to capture a cell phone and add
it to the tactical network. More details are provided about this feature in a later section of this
document. More details about the grabbing feature are provided in later sections.
GDIT Sectera Handset Compatibility
The Sectera Secure Wireless Phone for GSM provides end-to-end high assurance
secure voice and data communications for GSM cellular networks operating in
the 1800/1900 MHz spectrum worldwide. The Sectera Secure Wireless Phone
has been certified by the National Security Agency (NSA) because of its ability to
protect classified information up to the Top Secret level using Type One
encryption algorithms available to authorized U.S. government personnel. This
phone complies with the U.S. Government sponsored Future Narrow Band
Digital Terminal (FNBDT) standards and will securely interoperate with other
FNBDT compatible devices. The optional Sectera Secure Wireless Phone consists of a state-of-
the-art Motorola Timeport GSM tri-band phone and the Sectera clip-in Secure Module that
provides the Type One high assurance end-to-end security.
Antennas
The following antennas will support the above solution:
3”±1” omni-directional with at least 0 dB gain and ground plane
12”±2” omni-directional with at least 3 dB of gain
24”±4” omni-directional with at least 6 dB of gain
36”±6” omni-directional with at least 8 dB of gain
Corner reflector with at least 10 dB of gain
a. Azimuth beam angle to be between 30 and 40 degrees
b. Elevation beam angle to be between 40 and 50 degrees
Applications scenarios
The proposed GSM/GPRS system can operate in the 1800Mhz ETSI DCS (Digital Communication
System) band or 1900Mhz PCS (Personal Communication System) band. It can also support ETSI
900Mhz band. Many applications are possible for the portable GSM/GPRS (Global System for
Mobile Communication/General Packet Radio Service) system. The following are some “use case”
examples with first a description of how subscribers can be grabbed by the network.
Portable GSM System Subscriber Grabbing Feature
• Scan available PLMN’s (Public Land Mobile Networks)
o Identify and display available networks
Jon Marcy Consulting Services

8. Cellular Continuity of Operations Option 7
o Identify and display the server and neighbor list for each PLMN
• Clone the required network
o Select the appropriate network and neighbor cell to clone (in most cases it is easier
to use the weakest neighbor to facilitate LU (Location Update))
• Manage subscriber information
o Populate list of IMSI’s (International Mobile Subscriber Identity) by allowing
handset to LU – reject the handset and build a list of available targets – identify
IMSI’s and IMEI’s (International Mobile Equipment Identity) and date stamp. Allow
the information to be saved and downloaded
o System user may identify target handset and selectively allow specific IMSI’s to
camp on the cloned network
o Allocate a temporary unique MSISDN (Mobile Station International ISDN Number) if
allowed to LU – this will not be SMS’d (Short Message Services) to target user
o Allow system user to call target handset to identify the user via the ring indicator –
no audio will be sent – and the call will terminate after 15 seconds – CLI (Calling
Line Identity) will indicate a private call
• Call routing
o When a target handset that is camped on the network initiates a call, route all
dialed numbers transparently via the FXO (analog RJ11/FXO port could be
backhauled by public cellular network as part of SPAWAR backhaul solutions)
o Allow use of * or # to prefix numbers for in network calling between ‘known’ users
o Allow users to specify how to treat emergency and special numbering schemes
• Call tracking/recording
o Provide the ability to record all calls and SMS messaged from a target handset –
this may be set on a per subscriber basis.
• User Interface
o Inverted color set for the GUI (Graphical User Interface) to white on black to reduce
the glare from the PC if used at night in a vehicle
Portable GSM system with no/limited connectivity to PSTN
In this scenario, the portable GSM system operates in standalone mode and does not or has only
limited TDM or analog connectivity to a PBX (Private Telephone Switch), the PSTN (Public
Switched Telephone Network) or some PLMN/HPLMN. The system is also not connected to the
internet so that GPRS service is not available. As soon as terminals detect a strong enough BCCH
(Broadcast Control Channel) signal they will attempt to register to the network. Under this
scenario the handsets will register to the internal HLR (Home Location Register) within the GSM
controller and according to one of the following modes:
• auto-registration, which attaches all handsets that attempt to register with the network
(e.g. Disaster recovery)
• manual subscriber registration, allowing only permitted IMSI's to attach
As the system might not have any connectivity to the public network, the operator might
require only certain users to register to the system. In this case manual registration would be
Jon Marcy Consulting Services

9. Cellular Continuity of Operations Option 8
used so that access to this network is selective. The auto-registration feature could also be used
to determine if certain users are present in the coverage area. A specific dummy MNC (Mobile
Network Code) could also be allocated to these portable networks.
For the case where limited connectivity is required, it is also possible to use a public cellular
terminal on this configuration connected to an RJ11/FXO port on the controller in order to
backhaul the calls through the public cellular network. This terminal would be part of a Post,
Base, Camp, Station (P/B/C/S) backhaul solution. If a specific user has been grabbed by the
portable network and needs to be monitored, the RJ11/FXO port and the GSM terminal can
actually be associated with that user’s specific IMSI. This scenario provides a light monitoring
function when the monitoring and grabbing feature is implemented on the GSM controller.
As an example, a possible application for this configuration could be the monitoring of certain
members of a terrorist cell who use the public GSM system for communication and possibly to
detonate bombs. The portable system could be deployed to monitor a given area at specific
times with 25 US soldiers participating to the mission.
Portable GSM system connected to PSTN and Internet
The standard four ports FXO on the controller are used to interconnect to a PBX. A numbering
plan can then be implemented for the users on the portable GSM network so that incoming and
outgoing calls can be processed. With the FXO options on the GSM controllers, a POTS (Plain Old
Telephone Service) phone line is directly plugged into the interface card. POTS lines terminate to
the respective wire-line phone service provider. Outgoing calls are determined by setting
appropriate access numbers in the controller routing tables – for instance a ‘9’ may be used to
route calls to the FXO port. The prefix may be deleted before the digits are dialed and sent out
across the FXO. Each FXO will have a number assigned to it by the respective wire-line service
provider. The controller may be configured to allow access to only one MSISDN (as defined in
the local HLR) or to allow access to any MSISDN in the HLR by allowing a DTMF (Dual Tone Multi
Frequency) over-dial when a DTMF prompt is provided in the earpiece of the calling party
Jon Marcy Consulting Services

10. Cellular Continuity of Operations Option 9
device. Any mobile subscriber on the portable GSM network can of course forward his public
MSISDN number to the POTS line allocated to him so that incoming calls can be received.
In this scenario it is also possible to use the optional GPRS core network function (SGSN/GGSN:
Serving GPRS Support Node/Gateway GPRS Support Node) and interconnect to the internet for
access to email and other data services. To implement the SGSN/GGSN function, a PCC (Packet
Core Controller) would have to be provisioned either locally or remotely. A Gb/IP (Interface
between BSC (Base Station Controller) and SGSN) interface would interconnect the primary
controller to the PCC. Up to 50 GPRS subscribers can be supported from a single PCC. The PCC
would then provide a IP interface to the internet and from which the secure email servers and
public internet could be accessed from the PDA’s. As with the limited connectivity scenario, this
scenario can also set a specific MNC for this network.
This network could be used to track specific users and substitute a public cell according to the
subscriber grabbing scenario described at the beginning of this section. As an example, a
possible application for this configuration could be the monitoring of certain individuals who are
part of the coalition but also suspected to collaborate with the Taliban in Afghanistan.
Portable GSM system as a roaming GSM network
In this case, the portable GSM system is used as a roaming network that could be deployed for
example for the support of natural disaster recovery operations. A specific MNC would be data
filled in these systems and recognized by all AT&T, T-Mobile and other public GSM carriers’
subscribers’ handsets. The system would interconnect to the MAP/SS7 (Mobile Application
Part/Signaling System No.7) signaling network and be able to process location area updates. The
system could also be provisioned with GPRS so that users can access their home GGSN and
standard portal for email and other data services. As the network is turned up the subscribers
would recognize it as being part of a valid roaming network and attempt to register. In this case
the HLR function of the portable system is not used for public subscribers. MAP/SS7 signaling
will trigger a location area update for all the users registering to the portable system and each
user profile will be downloaded into the VLR (Visitor Location Register) while the public network
Jon Marcy Consulting Services

11. Cellular Continuity of Operations Option 10
HLR will be upgraded with the new location information for these users so that they can receive
and initiate calls and be charged for them. The system is using standard roaming procedures to
support this.
To implement MAP/SS7 signaling for the roaming network, a CGC (Central GSM Controller)
would have to be provided to interface the existing portable GSM networks to the SS7 GSM
network and the operator would have to obtain the relevant authorization to interconnect with
at least one GSM service provider.
A possible application for this configuration could be the support of disaster recovery operations
like hurricane Katrina. In this case a number of portable systems are deployed with
interconnectivity to the different HPLMN through the MAP/SS7 signaling gateway.
Past Performance Examples
The deployment of Pico-Cell technology has been used by the US Navy in two memorable
disaster relief efforts supported by the USNS Mercy and the USNS Comfort. In both cases, in
support of humanitarian aid missions, the availability of a deployable commercial GSM solution
resulted in saved lives.
In 2004, the Indian Ocean Tsunami came as a result of a record setting undersea earthquake,
which left over 150,000 dead in 11 different countries. The US Navy initially dispatched the USS
Abraham Lincoln to support logistics and communications requirements associated with the
distribution of aid and supporting the surge of Non-Government Official (NGO) personnel form
various non-profit medical teams. Within a week, the tactical radio systems aboard the USS
Abraham Lincoln could not keep up with communications demand, which resulted in the Pacific
Fleet Command ordering the USNS Mercy to the region in relief of the USS Abraham Lincoln. On
arrival, off the coast of Banda Ache, Indonesia the USNS Mercy deployed a portable GSM
capability on the deck of the ship that provided ship-to-shore communications between shore
based medical personnel and US Navy doctors and nurses aboard the USNS Mercy.
Jon Marcy Consulting Services

12. Cellular Continuity of Operations Option 11
Images from US Navy response to Indonesian Tsunami relief effort
In 2005, New Orleans, LA took the brunt of a Category 4 Hurricane (e.g. Katrina) which
devastated the city and the surrounding coast line. The US Navy sent the USS Iwo Jima there to
provide Command and Control (C2) oversight of the rescue mission, coordinating rescue efforts
between the US Coast Guard and the various National Guard units who were deployed in
response of the disaster. In addition to the USS Iwo Jima, the Navy also deployed the USNS
Comfort to provide necessary emergency medical assistance to recovered survivors.
As part of the USS Iwo Jima mission, the US Navy deployed one vehicle mounted mobile GSM
system and two portable systems that were positioned on city building roof-tops to provide
GSM radio coverage over the flooded city. Using the “Subscriber Grabbing” feature, the GSM
system began capturing several commercial GSM handsets owned by survivors that were still
active. The US Coast Guard was able to use the GSM communications with survivors to pin-point
their locations for emergency recovery and for coordinating emergency medical response. With
many survivors trapped in their attics, it is believed the portable GSM technology was
responsible for saving thousands of lives.
Jon Marcy Consulting Services

13. Cellular Continuity of Operations Option 12
Images from US Navy response to Hurricane Katrina relief effort
Summary
Commercial GSM Pico-cell technology represents a realistic and cost effective solution for
providing an emergency response capability for DOD P/B/C/S facilities in times of either
manmade or natural disasters. With systems being capable of being packaged in ruggedized
containers or motorized vehicles, they can be rapidly deployed to any part of the globe to
support both disaster recovery and humanitarian efforts.
For more information on Cellular Continuity of Operations technology, please contract:
Jon Marcy Consulting Services
Ph: 540-323-7236
E-Mail: jonmarcy@ucnetmaker.net
Web: http://jonmarcy.comcastbiz.net
Jon Marcy Consulting Services