Federal Reserve Richmond Using Capacity Plus

[dtscho]

The Federal Reserve Richmond is using a Capacity Plus system now. I was unable to get confirmed LCN or groups while traveling through the city last Thursday evening. If someone could use DSD+ or similar and determine the LCNs, groups, etc. it would be much appreciated. (The other likely system frequency is 406.6625.)

https://www.radioreference.com/apps/db/?sid=9442

Thanks,
Dave

 

[W4UVV]

Not looking good for monitoring FRB RIC Comms

The Federal Reserve Bank (FRB) Richmond for many years had only analog paging/maintenance on 413.9250 mhz. and rarely used. This morning about 0800 I started monitoring 410.4875 mhz. using a home DMR system. The first short audio comms I heard sounded encrypted.

Subsequent monitoring showed the FRB RIC loves to transmit data. Maybe it's our cancelled checks info being routed somewhere from upstairs to downstairs? The partial voice portions I heard along with a few data transmissions sounded like a partial syllable of a word. Other than that it was data, data, data until the system defaulted to idling with a weaker signal burst.

The trs voice comms I understand but not the tremendous volume of data comms. I'm sure there is a building internal secure CAT5 or greater closed loop network. To whom located outside the building are they sending all this data? I doubt all this data is to control the building temperatures on different floors. Even though the data is encrypted, whatever the subject matter is, why place any of it at risk of being hacked off air?

After I had taken a few screen captures I programed my 536 for a Capacity Plus trs using 406.6625 mhz. and 410.4875 mhz. 406.6625 mhz. is significantly weaker at my location, which is about 20 air miles south of the building. So far no unencrypted audio heard. ARC536PRO Virtual Control so far has logged several talkgroups of encrypted audio because at the same time I briefly heard one or maybe two partial syllables of a word before the 536 muted the audio..

VC logged TG 106 from 406.6625 mhz. as NAC 1, with no text tag @ 11:50AM.
TG 102 from 406.6625 mhz. as NAC 1, with no text tag @ 12:06PM
TG 5 from 406.6625 mhz. as NAC 1 with no text tag @ 12:20PM

From the screen captures I concluded SL1=Voice and SL2=Data
Data can be sent either at 4800 or 9600 baud.
406.6625 mhz. = CC1
410.4875 mhz. = CC2
Embedded IP? = CC13

I'm also saving the DMR Decode CSV & TXT files monitored on 410.4875mhz.

John
W4UVV

 

[RFI-EMI-GUY]

They may be using the embedded data for GPS tracking of vehicles, or a guard tour reporting system to make sure guards are checking that doors are locked at night.

Sent from my SM-T350 using Tapatalk

 

[W4UVV]

A few more encrypted talkgroups

After two days monitoring FRB RIC below are the encrypted talkgroups/UIDs logged by ARC536PRO Virtual Control:

TG UID

1 = 108/149/14001
5
49
61
65
137 = 13969
248
441

John
W4UVV

 

[EricCottrell]

The Federal Reserve Bank (FRB) Richmond for many years had only analog paging/maintenance on 413.9250 mhz. and rarely used. This morning about 0800 I started monitoring 410.4875 mhz. using a home DMR system. The first short audio comms I heard sounded encrypted.

Subsequent monitoring showed the FRB RIC loves to transmit data. Maybe it's our cancelled checks info being routed somewhere from upstairs to downstairs? The partial voice portions I heard along with a few data transmissions sounded like a partial syllable of a word. Other than that it was data, data, data until the system defaulted to idling with a weaker signal burst.

The trs voice comms I understand but not the tremendous volume of data comms. I'm sure there is a building internal secure CAT5 or greater closed loop network. To whom located outside the building are they sending all this data? I doubt all this data is to control the building temperatures on different floors. Even though the data is encrypted, whatever the subject matter is, why place any of it at risk of being hacked off air?

After I had taken a few screen captures I programed my 536 for a Capacity Plus trs using 406.6625 mhz. and 410.4875 mhz. 406.6625 mhz. is significantly weaker at my location, which is about 20 air miles south of the building. So far no unencrypted audio heard. ARC536PRO Virtual Control so far has logged several talkgroups of encrypted audio because at the same time I briefly heard one or maybe two partial syllables of a word before the 536 muted the audio..

VC logged TG 106 from 406.6625 mhz. as NAC 1, with no text tag @ 11:50AM.
TG 102 from 406.6625 mhz. as NAC 1, with no text tag @ 12:06PM
TG 5 from 406.6625 mhz. as NAC 1 with no text tag @ 12:20PM

From the screen captures I concluded SL1=Voice and SL2=Data
Data can be sent either at 4800 or 9600 baud.
406.6625 mhz. = CC1
410.4875 mhz. = CC2
Embedded IP? = CC13

I'm also saving the DMR Decode CSV & TXT files monitored on 410.4875mhz.

John
W4UVV

Hello,

You are not getting a good decode with almost every frame showing errors in the screenshots. I would not trust any data and partial syllables of a word can occur with data errors.

The 4800 and 9600 numbers in the window titles are the signalling rates of the protocol and there is only one rate used for DMR. The two numbers are likely the result of a weak signal.

I also do not see any Capacity Plus protocol messages. A Capacity Plus system only uses one color code per repeater. The different color codes are due to data errors.

You need to improve the strength of the signal or set the level properly to get a better decode.

73 Eric