The Deep Sweep (2015)

High-altitude Signal Research

INTRODUCTION The Deep Sweep is an aerospace probe scanning the otherwise out-of-reach signal space between land and stratosphere, with special interest placed in UAV/drone to satellite communication. Taking the form of a high-altitude weather balloon, tiny embedded computer and RF equipment, The Deep Sweep project is being developed to function as a low-cost, aerial signal-intelligence (SIGINT) platform. Intended for assembly and deployment by public, it enables surveying and studying the vast and often secretive world of signal in our skies. Taking the form of a high-altitude weather balloon, tiny embedded computer and RF equipment, The Deep Sweep project is being developed to function as a low-cost, aerial signal-intelligence (SIGINT) platform. Intended for assembly and deployment by public, it enables surveying and studying the vast and often secretive world of signal in our skies. Two launches have been performed so far, from sites in Germany, landing in Poland and Belarus respectively. We intend to make many more, in Europe and beyond. PROCESS During the ascent the probe sweeps for signal. As air grows thinner the balloon expands, finally bursting between 24 and 30 kilometers above the Earth. At this point a parachute is enacted and the balloon descends. When the tracker is within reach of GSM networks it sends SMSs reporting its location, and so the challenge of finding it can begin. No collected data is sent live mid-flight - aerial transmission is detectable and illegal at the speed we require it, reserved for military and aerospace use. Rather, data is extracted from the probe on recovery. All data captured is stored in open formats suitable for both data visualisation and signal analysis. The acrylic shell is chosen for its aerodynamic and radar-reflective properties. It was built from two 'fisheye' surveillance mirrors. This is significant for us.

The Deep Sweep



The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The Deep Sweep

The signal ranges of capture are currently: LF/HF: 10khz - 30MHz (long range comms in transport, military, marine) UHF: 650MHz - 1650MHz (military, weather, marine) SHF: 10GHz - 12GHz (satellite communications, drones/UAVs)

Deep Sweep probe, just before launch



Hardware mounted on light-weight vertical plates inside insulation shell

Intel Edison, powered USB hub, cigarette lighter <=14v to 5v converter

~5 EUR <=14v down to 5v converter made from automobile cigarette lighter 'USB-charger'

Pressure-based altitude sensor, ready for mounting

Pressure-based altitude sensor, ready for mounting

Bottom acrylic shell with equi-distant antennae mounts in place

GoPro with battery removed to avoid battery freeze at sub -40C temperatures, modified to draw power directly from USB bus.

The Deep Sweep

Probe with hardware inside styro-foam insulation shell, mounted inside acrylic exo-shell

A 600g Pawan balloon filled with 3.71 cubic meters of helium was launched in the early evening of August 27 2015 in Magdeburg, Germany, on a quiet spot of green near the Elbe river. This launch was intended to firstly prove the concept and basic implementation such that we might later refine our RF capture strategy in future flights.

Following spurious problems with the USB power bus on the Intel Edison, we launched later than anticipated and nervously watched the balloon and payload rise quickly, soon after leaving for Berlin under a black sky. All our flight predictions had it landing near the Polish border.



The total flight time was modeled at just over two hours and so on reaching that mark we suspected that we'd given our probe a sky burial. With little hope we turned to bed and the following morning, many hours later than all predictions, we received an SMS of coordinates from the probe.



To our surprise locations reported back from the probe showed it travelling over Kaliningrad, at a land-speed of ~130km an hour - as fast as 141km/hr at one point. Continued conversation with the probe, as the battery ran down on the tracker, saw it settling in a corn field near Minsk - over 1000km away.



With Minsk being in Belarus, itself under an oppressive regime, we were not able to drive to the site and retrieve the data and so were reliant on a friend with contacts in Belarus. Soon enough two bold people we've never met were driving out to the field...



We are as yet unable to solve this mystery drift.



DATA: CONTEXT

Data retrieved from the sensor logs shows the battery ran out at about an altitude of 10km, far short of our target burst altitude of 24000m, where it did eventually burst. Evidence points to the likelihood that the probe spent much of the upward journey covering vast distances over land and so the battery simply ran down in what would otherwise be vertical travel to burst altitude.

Nonetheless, the RF logs are very interesting in themselves, with plenty of activity in sweeps done in the LF space, with curious and intense sudden bursts in GHz SHF bands. As our first launch was focused on general sweeps rather than sweeping and dwelling on bands known to be in use, we will not attempt fingerprinting conversations between machines.

Here's a 37M gzip-compressed tarball of the sensor and RF logs.

Christopher Pietsch contributed a visualisation of the data, plotting GPS trace, sensor and RF logs.









HARDWARE USED 7 port USB HUB

GoPro Hero (modified to take power directly from USB bus)

Intel Edison and breakout board

1x RTLSDR (mini) 820T

2x RTLSDR 820T2

1x mini-whip 10khz-30Mhz antenna

1x NooElec Upconverter board (125MHz LO)

1x VERT900 antenna

1x high-gain 802.11/b/g antenna (for administration access point)

1x AVENGER LNB(F) Avenger PLL321S-2 Ku-Band satellite TV antenna (internal downconverter)

1x GPS module

1x Arduino

1x Analog temperature sensor

1x 2200mAh 11.1v battery

1x automobile cigarette-ligher-to-USB-charger (cheap 12v-14v to 5v converter)

1x MS5611 Pressure Altimeter (Barometric sensor IC)

2x GPS trackers and LycaMobile SIM cards (separate battery supply, styrofoam insulated) SOFTWARE USED Debian GNU/Linux 'wheezy'

GNURadio

librtlsdr

OsmoSDR, especially osmocom_spectrum_sense

Bash (scripts) and GNU utilities

VIDEO

The Deep Sweep launches 1 and 2 from CriticalEngineering on Vimeo.

THANKS

Our first mission landed in a corn-field in Poland. We drove there at around 2am from Frankfurt an der Oder. Sneaking quietly under a moonless sky, trying not to wake an edgy dog, we found it. Data extraction began in the car on the way back to Berlin. We soon discovered that it only collected 7mins of launch data due to power failure early into the flight.