Cellular Systems & Other Terms

Billing identification on an AMPS network is presented as follows: Each handset has a NAM (Numeric Address Module) and an ESN (Electronic Serial Number). When you get your handset activated, the dealer programs the NAM with your telephone number.The ESN is manufacturer-assigned and supposed to be unique. When you place or answer a call, the phone sends its ESN to the network, which checks to see if the ESN belongs to a valid cellular account. (The NAM programming is not used in the billing verification process. The reason you need to program the NAM is simply so that your phone knows which incoming calls belong to it, so it can determine when to ring). The problem with this system is that due to the primitive protocols used, it is very easy for someone with a scanner and a simple decoder circuit to collect ESNs and telephone numbers. It is then easy for such people to steal cellular service by burning a new ESN into a phone and programming its NAM with the matching telephone number. This process is referred to as "cloning" a phone.

Because the voice transmission system is a simple analog radio signal, anyone with a scanner can also listen to your conversations. In fact, as any AMPS user will tell you, sometimes it isn't even necessary to have a scanner - quite often while making AMPS calls in urban areas, you will be able to hear a conversation on the same channel in the next cell.

To illustrate this point to yourself, make sure you're out of earshot of anyone who might be able to certify you as insane, purse your lips to make the "oo" sound in "book", and start to sing a continuous-pitch note. Without moving your tongue, open your lips progressively wider. Listen to the way the tone (but not the pitch!) of the note changes. Isn't it incredible to think that this organic technology has allowed us simple apes to create complex languages, thereby organizing and directing members of our species, and dominate all other lifeforms on the planet? Now close your mouth, clamp the front of your tongue against your palate, and sing the same note through your nose. That's about as close as you can get to hearing the raw, unmodulated output from your vocal cords. It's a "soft" sound (lacking high-frequency harmonics) which suggests it's something close to a sinusoidal wave.

GSM works by extracting the base tone generated by the vocal cords and interpolating the changing configuration of the speaker's mouth from the audio waveform. This is much more efficient than simply trying to compress the audio data with a simple algorithm working on the raw byte stream. At the other end, in effect the speaker's vocal system is simulated by the decoding side of the codec.

GSM implementations exist in three flavors - GSM900, GSM1800 and GSM1900, which operate in the 900MHz, 1.8GHz and 1.9GHz bands respectively. GSM1900 is presently used only in the United States of America, but it will apparently spread to other areas soon. GSM900 is the most commonly used band. GSM1800 seems to be intended as an "extra" band to increase cell capacity in crowded GSM900 areas. However, some GSM1800-only networks do exist. Note that GSM1800 is sometimes referred to as "DCS" or "PCN", and GSM1900 is sometimes called "PCS".

At present, there are a handful of dual-mode phones such as the Motorola cd928 and Ericsson SH888 which operate in both the 900 and 1800MHz bands. There are also a number of phones such as the Ericsson I888 and Bosch Worldphone 718 which operate in both the 900 and 1900MHz bands. Unfortunately, there are no phones as yet which operate in all three bands, which means that depending on where you are,where you want to go, and what roaming agreements exist with your carrier, you may still need a rental handset.

Luckily, GSM makes it easy to switch phones as necessary. When you sign up with a GSM provider, you are issued with a smartcard ("SIM" - Subscriber Identity Module). Among other information, this card contains a serial number ("IMSI" - International Mobile Subscriber Identifier) which uniquely links it to your cellular account. Wherever you are in the world, you can simply insert the SIM into a GSM phone compatible with the local networks, and the IMSI will be transmitted to the local carrier(s) to identify you. As long as at least one of the carriers in range has a roaming agreement with your home carrier, and your cellular account is valid, you will be able to log into the local network and make calls as you please. People who call your home-country cellular number will automatically be put through to you.

For those familiar with AMPS terminology, the IMSI is equivalent to an analog phone's NAM programming. Each GSM handset also has a hardware identifier equivalent to an AMPS phone's ESN. This is the IMEI (International Mobile Equipment Identifier) which is also transmitted to the network. In theory, the IMEI can be used to keep stolen phones off-air. In practise, the difficulty of maintaining a worldwide stolen handset database online and accessible from any carrier within a few seconds means that the IMEI is ignored. Unlike AMPS, in GSM there is NO billing tie-in between the subscriber's identity and the handset. It isn't necessary, because unlike AMPS phones which can have their NAM programmed easily from the keypad, all the subscriber information in GSM is lurking inside PIN-protected memory within a smartcard. A SIM is impossible to clone without physically accessing it - and it's hard to clone even then.

One unfortunate design feature of GSM is that the size of a cell is limited to 35km unless special, capacity-reducing magic software hacks are installed in the base stations. Even if you have a line-of-sight path to the nearest base station and a nice strong signal, if you're more than 35km away you can't use the network. This is a fairly serious limitation for rural use (especially in a country like Australia, which has vast open spaces with more lizards than people), though it doesn't matter for the densely populated cities for which GSM was designed. And it doesn't matter to the lizards either; most of whom seem to be equally happy with almost any cellular phone as long as it isn't in a lizard-skin case.

TTTTTT-FF-SSSSSS-P

Digits denoted "T" are referred to as the TAC (Type Approval Code). The first two digits of the TAC are the international dialing code of the country in which type approval was sought. Note that if the TAC starts with 01 (USA), the chances are very good that you're looking at a GSM1900-only phone. 900MHz, 1800MHz and multiband phones carry European type approvals.

Digits denoted "F" are referred to as the FAC (Final Assembly Code). This code, chosen by the manufacturer, identifies the facility at which the final assembly of the phone was completed.

Digits denoted "S" are referred to as the SNR (Serial NumbeR). This is the manufacturer's serial number for the appliance. Note that this may have no relation to the separate, proprietary MSN (Mechanical Serial Number), if any, printed on the device's serialization label.

The final digit is "SPare", and most references you read will tell you that it is always zero. For modern phones, this is no longer true. However, if you are using some software that calculates a magic code of some sort based on your phone's IMEI, and the code calculated doesn't work, try substituting a zero for the last digit.

When you see an IMEI on a label or onscreen, it will not necessarily be formatted with the puctuation shown above. All fields will, however, be present as described.

Because of the vast, diverse and unfriendly AMPS networks in the United States, many phones have multiple NAMs so that they can use different carriers without reprogramming. (Note that a multi-NAM phone still has only one ESN).

If you think about this system for a moment, you will see that it is quite cleverly designed - an attacker who steals the SIM will have an impossibly small number of tries to guess the PIN, yet a user who legitimately forgets his/her PIN can fix the problem over the telephone.

Most SIMs will allow you to turn off the power-on PIN challenge. This is not advisable unless you're using a prepaid SIM where it doesn't really matter much in a monetary sense if someone steals your account temporarily.

SIMs are available in two types - "fullsize" (credit card size) and "plugin" or "chip" - a much smaller rectangular shape with a missing corner. The two types are electrically identical, differing only in the amount of plastic surrounding the chip. Plugin SIMs are always supplied as a fullsize frame with a breakout panel containing the chip. An example is shown below. (The plugin SIM in this photo doesn't actually belong to the frame shown - it was chosen because its color contrasts well with the frame, so you can compare the size and shape of fullsize vs. plugin):