Spy radio
Burst encoders
• • • Donate • • •
   Logo (click for homepage)
PRM-4735   Cougar
Covert Personal Radio

The PRM-4735 is a discrete secure body-wearable covert radio, developed by Racal (now: Thales) in Bracknell (UK) as part of the Cougar product line. The device is intended for use in surveillance, observations, protection and covert operations, and is mainly sold to the Police and other security agencies. It can be seen as a smaller (covert) variant of the ruggedized military PRM-4515 radio.
The radio is housed in a sturdy metal enclosure and measures just 139 x 75 x 16 mm without the battery. A suitable rechargeable battery can be attached at the rear, either directly or via an extension lead, and all other connections are located at the front panel. As the radio was used covert operations and for surveillance, it does not have any direct controls on its front panel.

Instead it was used with a set of ancillaries, such as the ones shown in the image on the right. In order to prevent eavesdropping, an optional high-end encryption module could be installed.
Cougar PRM-4735 covert radio ready for use

A typical configuration of the PRM-4735 is shown in the image above, but other configurations are possible as well. The channel frequencies and cryptographic keys have to programmed into the device prior to use and a remote control unit (RCU) is used to select them. Being a true covert device, it was commonly used in combination with a wireless earpiece and a concealed mike.

The PRM-4735 was used by many law enforcement agencies and security services in the UK, the US, Belgium, The Netherlands and various other countries. Depending on the customer and the requirements, a standard MA-4437 crypto module with a Racal proprietary algorithm was used, or a special module like the MA-4487 or a VINSON-compatible one that uses the secret SAVILLE cryptographic algorithm. The latter was only supplied to US-government approved customers.
Overview of the accessories Cougar PRM-4735 covert radio ready for use Connections at the front panel PRM-4735 front panel Connecting the battery to the radio Remote Control Unit (RCU) Close-up of inductor and earpiece Loading keys with the MA-4083 fill gun

In order to avoid operator mistakes when the PRM-4735 is used under stressful circumstances, the radio has no direct controls, except for the so-called ZEROIZE button, which is recessed and can only be operated with a pen. Whilst the battery is connected at the rear end, all accessories and the remote control are connected at the front, by means of high-quality LEMO connectors.

The image below gives a rough idea of the standard components that are needed with the body-wearable PRM-4735 covert radio. The largest part is the radio itself, which measures 139 x 75 x 16 mm. At the rear is the battery that should be attached to the bottom of the radio. As the radio will be concealed under the operator's clothing, a short wire-antenna is used as a compromise.

As the radio itself has no controls (except for the ZEROIZE button), a small Remote Control Unit (RCU) is used. The operator can hold it in his hand, whilst the cable runs through the sleeve of his coat. A small inductor is used to carry the audio output of the radio to the wireless earpiece, which can be worn invisibly. The inductor has a small built-in microphone that picks up the operator's voice. As an alternative to the inductor, it is also possible to use a so-called neckloop.
Three basic versions of the PRM-4735 were available, plus numerous customer-specific variants. The variants were identified by a single-letter suffix at the end of the model number, as listed below, and sometimes by a 3-digit number. The latter are listed at the bottom of this page.
  • PRM-4735L
    76-86 MHz
  • PRM-4735HA
    138-156 MHz
  • PRM-4735HB
    154-172 MHz
  • /S
    Standard MA-4037 crypto module
  • /U
    Special MA-4087 crypto module
  • /P
    VINSON crypto module
  • /W
    No crypto
Key loading
In order to use the cryptographic features of the PRM-4735, a so-called cryptographic key, or key, or initialisation vector has to be loaded into the radio first. Without a key, the radio can only be used in clear mode. Keys can be loaded into the PRM-4735 by means of two different devices.
Full programming and key loading is possible with the large MA-4073 Programmer, which should be connected to the RCU socket of the radio by means of a special so-called Fill Cable.

The image on the right shows the PRM-4735 radio without its battery, attached to the radio socket of the MA-4073 programmer. The latter can be used for programming up to 10 channel frequencies as well as 4 crypto­graphic keys. When transferring data to the radio, the radio is powered by the programmer, so the battery of the radio does not have to be installed.
Programming the PRM-4835

Different frequencies may be set for transmit and receive, allowing split-frequency operation, which might be useful when operating via a repeater. Although the radio can hold 10 channel frequencies, only 8 of them can be selected by means of the MA-4737 Remote Control Unit.
This is a limitation of the RCU. In the same vein, only 2 of the programmed cryptographic keys can be selected by means of the RCU: A and B (or C and D if the RCU is configured accordingly).

As an alternative, the much smaller MA-4083 Fill Gun can be used, but only for one type of data at a time (frequencies or crypto keys). The Fill Gun itself is loaded by the MA-4073 Programmer. The image on the right shows a key fill operation in action. In this case, the MA-4083 Fill Gun is connected to the MA-4735 via a the special Fill Cable. Data transfer is started automatically.
Loading keys with the MA-4083 fill gun

Note that when using the MA-4083 fill gun to load data into the PRM-4735, the battery of the radio must be fitted, as it is needed to power the fill gun. When using the MA-4073 Programmer however, the current can flow either way: the battery of the MA-4735 can feed the programmer, or the programmer (when fitted with a battery) can feed the radio whilst programming.

 MA-4073 Programmer
 MA-4083 Fill Gun
In case security is compromised, for example when the radio may fall into unauthorised hands, the cryptographic keys have to be deleted, so that the radio can't be used for eavesdropping on the current communication. The keys also have to be wiped before new keys are programmed.
With most cryptographic devices, this is a two-fold operation, in order to avoid wiping the keys accidently. On the PRM-4535, the ZEROIZE button is present on the front panel, between the antenna socket (ANT) and the RCU socket, and can only be operated with a pen. Pressing this button will only purge the four crypto keys whilst the channel frequencies remain intact.

The image on the right shows how the PRM-4735 should be zeroized. Note that the radio does not have to be powered for this. In fact, the battery doesn't even have to be present.
Zeroizing the PRM-4735

Programming the PRM-4835 Loading data from the programming into the fill gun Loading keys with the MA-4083 fill gun Loading keys with the MA-4083 fill gun Crypto Fill Cable Zeroizing the PRM-4735

Rechargeable batteries Battery extension lead Wire-antenna Remote Control Unit
Inductor for wireless earpiece (and microphone) Neckloop inductor Optional crypto unit to be plugged into the crypto board

Battery   MA-4736B
The PRM-4735 is powered by a rechargeable NiCd battery pack, such as the one shown in the image on the right. The battery has a nominal voltage of 9.6V and can be used for 3.7 hours. A slightly shorter variant, the MA-4736A, with a nominal voltage of 7.2V was also available.

In later years, better quality batteries became available in the same enclosure. First NiMH, which has more-or-less the same specifications as NiCd and then Li-ion. Although the latter has more capacity and weights less, in needs a different battery charger.

Battery extension lead
Despite the small size of the PRM-4735, the complete assembly (radio plus battery) might be too large to fit in a pocket of, say, a coat or a body harness. For this reason an (optional) battery extension lead was available, allowing the battery to be used in detached configuration.

The battery extension lead is shown on the right. It consists of a short piece of 2-wire cable with rectangular connectors at each end. One connector fits the battery, whilst the other one is fitted to the bottom of the radio.
Battery extension lead

Battery Connecting the battery to the radio Battery connected to the radio Releasing the battery Battery extension lead Close-up of the battery extension lead Battery connected to the radio via extension lead

Like all radios, the PRM-4735 needs an antenna, but as the radio has to be hidden under the operator's clothing. A short piece of wire is used for this. The wire can be hidden in, say, the collar of a coat or a suitable body harness.

Note that an antenna of this type is never correctly matched to the transmitter and should be seen as a compromise between range and exposure. The wire-antenna shown here is for the VHF-L version of the radio. The wire for the VHF-H band version is much shorter.
Wire antenna

Remote Control Unit   MA-4737
As the PRM-4735 itself has no controls on its front panel, a separate external Remote Control Unit (RCU) is needed. It is connected to the RCU socket on the front panel and allows the radio to be switch on and off, select one of 8 channels and control the volume. The Push-To-Talk switch (PTT) is at the top of the unit and a separate button is available for sending a tone.

The RCU communicates with the radio via a Pulse Width Modulation (PWM) signal over the PTT line, using a proprietary Racal protocol that is also used for loading the cryptographic keys.
Remote Control Unit (RCU)

The rotary dial at the side of the RCU has 10 positions. In the first position (fully turned counter­clockwise) the radio is OFF. In all other positions the radio is ON. From the OFF position going clockwise, the first 8 positions are for selecting the required channel (0-7). Turn the rotary fully clockwise (in the drawing below marked with a red line) to select the required crypto key. Press the minus button to select KEY A or the plus button for KEY B. Then return to the desired channel.

Although it is possible to connect a standard headset or microphone/speaker combination to the PRM-4735, the radio was generally used with hidden (covert) ancillaries. In most cases, a wireless earpiece was used in combination with an inductor, such as the one shown on the right.

The inductor 'sends' the audio to the earpiece by way of an LF magnetic field, whilst the earpiece is basically a standard hearing aid that is set to 'inductive mode'. The inductor has to be in the vicinity of the earpiece and is commonly located on the shoulder or in the body harness.
Inductor/microphone with wireless earpiece

The inductor has a built-in microphone behind a small hole at the top, that picks up the operator's voice. It is therefore necessary to place the inductor in such a position that is not blocked too much by the clothing. In some cases, the microphone was brought out on a separate cable, so that it could be mounted elsewhere on the body or in the operator's hand.
The inductor shown above has the disadvantage of having to be placed in the vicinity of the earpiece for a proper 'magnetic connection'. When the operator turns his head, audio might be lost as a result of a bad magnetic link.

As an alternative to the inductor, a so-called neck loop might be used, such as the one shown on the right. The neck loop provides a much stronger and wider spread magnetic field so that the earpiece can always receive it. The operator wears it around the neck and connects it to the MIC socket. It also has a built-in microphone.

Remote Control Unit (RCU) Inductor/microphone with wireless earpiece Inductor with extension cable Wire antenna Short antenna for UHF Neckloop Close-up of the microphone in the neckloop

The PRM-4735 is housed in a metal enclosure that consists of two shells or 'halves'. Each of the shells is held in place by 6 recessed screws. Removing the 6 screws from either side allows the two case shells to be removed. This reveals a sandwich of two PCBs attached to the font panel.
The radio consists of a Control Board and a Transceiver Board that can be separated by removing the 4 screws by which the transceiver board is mounted to the sub-frame. The trans­ceiver board can then be lifted from the control board. The image on the right shows the two PCBs after the two boards have been separated.

The Transceiver Board is similar to the one that is used in the Cougar PRM-4515 handheld radio, albeit a bit smaller. It has components on both sides of the PCB and is fully controlled by the Control Board when slotted into the blue socket.
The two boards separated

Note that besides the blue 16-pin socket, the transceiver board also connects to the control board via a small 2-pin connector inside the metal transmitter can. It should be connected to the 2-pin header (SK8) towards the front of the control board, just behind the antenna socket.
The control board contains the microprocessor, the firmware, the (clear) audio amplifier, the squelch circuit and the digital CVSD audio codec. The control board also holds the (optional) Crypto Module, of which various types were available. The image on the right shows the special MA-4487 module that was available as an alternative to the standard MA-4437.

The crypto module can hold up to four keys (or two in the case of the VINSON module) of which only two can be used by the PRM-4735 radio. This is a limitation of the Remote Control Unit.
Close-up of the Crypto Module

Depending on the version of the crypto module and the requirements of the customer, the key variables are retained for several minutes up to several years, when the main battery is removed. This was done by mounting either a SuperCap or a Lithium battery on the control board.
Sandwich of Control Board (bottom) and Transceiver Board (top) The two boards separated Control board with MA-4487 crypto module fitted Bottom side of the control board Transceiver board Bottom side of the transceiver board Transceiver board detail Close-up of the Crypto Module

Crypto modules
For secure communication, the PRM-4735 could be enhanced with a voice encryption/decryption module (or Crypto Module, or Crypto Unit), that was installed on the Control Board. Various types of crypto modules were available for different customers and different needs. Note that each type requires a different version of the MA-4073 Programmer and/or the MA-4083 fill gun.
The standard crypto module that was delivered to most customers, is the MA-4437 shown in the image on the right. It uses a Racal-proprietary cryptographic algorithm and can hold up to four cryptographic keys, each of which consists of 120 bits. The key is constructed in the MA-4073 Programmer from 36 octal digits (0-7, or 3 bits) plus a 12-bit fixed prefix (all '1's by default).

The crypto module can encrypt or decrypt the radio's digital 16 kb/s CVSD modulated data stream, but not both at the same time. That means that it can only be used in simplex mode.
MA-4437 top side

The keys are stored inside a Harris MH-6504-9 4096-bit CMOS memory, that is located at the upper side of the module. When using this module, the keys are retained by a built-in battery for more than 3 years, even when the radio is disconnected from the power [1]. This is known as long crypto retention. The presence of a crypto module causes a 128 ms delay in the audio path, which is needed for crypto processing. At the start of a transmission is a 96 ms preamble. Although 4 keys can be stored on the MA-4437, only two of them can be used by the PRM-4735.
This is a different module that was supplied to some European customers. It is not compatible with the MA-4437 and requires a different version of the programmer and the fill gun ('G' instead of 'C'-version). Nevertheless, the key length seems to be identical (120 bits) [1].

MA-4487 boards are generally red, whilst MA-4437 boards are green. Although it is possible that this board contains the SAVILLE encryption algorithm, but it is more likely that it is 'just' a variation of the standard MA-4437 module. Like the MA-4437 is sends a 96 ms preamble.
MA-4487 top side

The layout of the MA-4487 board is identical to that of the MA-4437 and the 4 chips are also similar, except for the fact that the product code of the two large chips (one at the top and one at the bottom) have a C-suffix (MT70083C versus MT70083, and MT70084C versus MT70084). Like the MA-4437, this board can hold up to 4 crypto keys, but only two of them can be selected.
VINSON   Special module
For selected US-approved customers, a so-called Special Module was available that contained the secret SAVILLE encryption algorithm developed by GCHQ and the NSA. This offered compatibility with VINSON equipment like the American KY-57 and the British BID/250 Lamberton voice ciphers.

As SAVILLE uses a 128-bit key (120 key bits plus an 8-bit checksum), the standard MA-4073 and MA-4083 key fillers can not be used. Instead, the keys were transferred by means of a DS-102 fill gun, such as the KYK-13, in combination with the special Racal MA-4778 key fill interface.
MA-4437 top side

When using this module, only two crypto keys can be stored in the device. Furthermore, the crypto keys are only retained for a minimum of 15 minutes (typically several hours) when the device is disconnected from its power source. This principle is known as short crypto retention.

Help required - So far we have never seen the VINSON compatible module, although it is mentioned in official sales information [2] and the required key loaders have been found. If you have any additional information about this mysterious module, please contact us.
No crypto
When the radio is used without a crypto module, four wire loops have to be inserted in the socket the normally contains the crypto module. These wire loops ensure that the 16 kb/s CVSD data is properly bypassed.

The drawing on the right shows the position of the four wire links, as seen from the top. Note the position of the notch, which is close to the edge of the PCB.

Crypto retention
When the main battery of the PRM-4735 is disconnected, the crypto keys are retained for at least 15 minutes (typically several hours), to ensure that the batteries can be swapped without loosing the keys. Normally, a large capacitor (known as a 'SuperCap') on the control board ensures that sufficient power is supplied to the crypto module during this period. In Racal terminology, this is known as short crypto retention. It was typically used in combination with the VINSON module.

Depending on the requirements of the customer, a Lithium battery could be installed in place of the SuperCap, to ensure that the keys were retained indefinitely (typically more than 3 years) when the main battery was disconnected. This is known as long crypto retention. Although it was typically used with the MA-4437, any combination of retention/crypto module was possible.
MA-4437 top side MA-4437 bottom side MA-4437 top side MA-4437 bottom side MA-4487 top side MA-4487 bottom side MA-4487 top side MA-4487 bottom side

Compatible equipment
All crypto modules have the same footprint and can be installed in any PRM-4735. They are also used in other Racal crypto-capable products, such as the PRM-4515 and the MA-4777. A full list of compatible products is given below. Note that devices are only inter­operable if they use the same crypto algorithm, the same frequencies and the same keys. Please note that the devices marked with a * do not use a Racal crypto module, but a proprietary VINSON compatible module, that is interoperable with a Racal device that has the mysterious VINSON module installed.
Racal PRM-4515 Cougar handheld radio with voice encryption Thales PRM-5120 Cougar covert radio with voice encryption Racal MA-4777 Digital voice encryptor KY-57 VINSON voice encryptor (USA) KY-99 voice and data encryptor (USA) in VINSON mode UK Lamberton (BID/250)
*) Only if the PRM-4735 is fitted with a VINSON-compatible crypto module.

 Other Cougar equipment

Below is an incomplete list of customer-specific PRM-4735 variants that have been seen so far:
  • PRM-4735H3CAP
    NSN 5820-99-752-1264 (MOD VHF-H version with VINSON)
  • PRM-4735L/009
    VHF-L version with MA-4487 crypto and 30 sec TX limit
  • PRM-4735L/010
    VHF-L version with MA-4487 crypto and unlimited TX
All connections to the PRM-4735, with the exception of the battery (rear), are located at the front panel. As for covert use the radio has to be hidden under the operator's clothing, it is important that the connectors are properly secured, which is why LEMO connectors have been used. These small connectors are securely locked when pushed in, and can be released by pulling the sleeve.
MIC Socket
The microphone connection (MIC) at the front panel is a LEMO 5-pin female socket with a so-called F-key (the position of the second notch). The pinout, when looking into the socket, is as described below. Note that the case shell is the chassis ground (GND).
  1. PWM
    Serial control data I/O and PTT input
  2. CAA
    Test output
  3. +V
    7.2V supply (in or out)
  4. OFF
    Force OFF (when connected to 0V)
  5. TONE
    Fill tone output
RCU Socket
The connection for the remote control unit (RCU) is also a LEMO 5-pin female socket, but this one has a so-called D-key (note the different position of the second notch), so that the two plugs can be swapped. Note that the case shell is the chassis ground (GND). The pinout is as follows:
  1. MIC
    Microphone signal/ON-OFF
  2. GND
    Microphone ground
  3. SPK
    Induction loop signal
  4. GND
    Induction loop ground
  5. TEST
  1. Racal, Covert Personal Radio - PRM 4735, leaflet
    Publication No. 2488-3. June 1989.

  2. Racal Tacticom, Covert VHF Transceiver PRM 4735L, Technical Manual
    Ref. A2083. Issue 2, June 1995.

  1. Racal Radio Ltd., MA 4073C and MA 4073G Programmer, User Handbook
    Ref. RH 8224. Issue 3. Date unknown.

  2. Jane's Military Communications, AN/CSZ-6 Vinson-compatible Hand-held Transceiver
    Fifteenth Edition 1994-1995. p. 551.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Last changed: Sunday, 07 June 2015 - 16:44 CET.
Click for homepage