|
|
|
|
|
|
|
Voice Racal Covert PRM-5120 → ← PRM-4515
Covert Personal Radio
The PRM-4735 is a discrete secure body-wearable
covert radio, developed
by Racal
(now: Thales)
in Bracknell (UK) as part of the Cougar product line.
The device is intended for use in surveillance, observations, protection
and covert operations,
and is mainly sold to the Police and other security
agencies. It can be seen as a smaller (covert) variant of the
ruggedized military PRM-4515 radio.
|
The radio is housed in a sturdy metal enclosure and measures just
139 x 75 x 16 mm without the battery.
A suitable rechargeable battery can be attached at the rear,
either directly or via an extension lead,
and all other connections are located at the
front panel. As the radio
was used covert operations and for surveillance,
it does not have any direct controls on its front panel.
Instead it was used with a set of ancillaries, such as the ones
shown in the image on the right. In order to prevent eavesdropping,
an optional high-end encryption module could be installed.
|
|
|
A typical configuration of the PRM-4735 is shown in the image above,
but other configurations are possible as well. The channel frequencies and
cryptographic keys have to programmed into the device
prior to use and a remote control unit (RCU)
is used to select them.
Being a true covert device, it was commonly used in combination with
a wireless earpiece and a concealed mike.
The PRM-4735 was used by many law enforcement agencies and
security services in the UK,
the US, Belgium, The Netherlands and various other countries.
Depending on the customer and the requirements,
a standard MA-4437 crypto module
with a Racal proprietary
algorithm was used, or a special module like the MA-4487
or a VINSON-compatible one that uses the secret
SAVILLE cryptographic algorithm.
The latter was only supplied to US-government approved customers.
|
In order to avoid operator mistakes when the PRM-4735 is used under
stressful circumstances, the radio has no direct controls, except
for the so-called ZEROIZE button,
which is recessed and can only be operated with a pen.
Whilst the battery is connected at the rear end, all accessories
and the remote control are connected at the front,
by means of high-quality LEMO connectors.
As the radio itself has no controls (except for the ZEROIZE button),
a small Remote Control Unit (RCU) is used.
The operator can hold it in his hand,
whilst the cable runs through the sleeve of his coat. A small
inductor
is used to carry the audio output of the radio to the wireless
earpiece, which can be worn invisibly. The inductor has a small built-in
microphone that picks up the operator's voice. As an alternative to the
inductor, it is also possible to use a so-called neckloop.
|
|
Three basic versions of the PRM-4735 were available, plus numerous
customer-specific variants.
The variants were identified by a single-letter
suffix at the end of the model number, as listed below,
and sometimes by a 3-digit number.
The latter are listed at the bottom of this page.
|
PRM-4735L 76-86 MHz PRM-4735HA 138-156 MHz PRM-4735HB 154-172 MHz
|
/S Standard MA-4037 crypto module /U Special MA-4087 crypto module /P VINSON crypto module /W No crypto
|
|
In order to use the cryptographic features of the PRM-4735, a so-called
cryptographic key, or key, or initialisation vector
has to be loaded into the radio first.
Without a key, the radio can only be used in clear mode.
Keys can be loaded into the PRM-4735 by means of two different devices.
|
Full programming and key loading is possible with the large
MA-4073 Programmer,
which should be connected to the RCU socket of the radio
by means of a special so-called Fill Cable.
The image on the right shows the PRM-4735 radio without its battery,
attached to the radio socket of the MA-4073 programmer.
The latter can be used for programming up to 10 channel frequencies
as well as 4 cryptographic keys.
When transferring data to the radio, the radio is powered by the
programmer, so the battery of the radio does not have to be installed.
|
|
|
Different frequencies may be set for transmit and receive,
allowing split-frequency operation, which might be useful when operating
via a repeater. Although the radio can hold 10 channel frequencies,
only 8 of them can be selected by means of the
MA-4737 Remote Control Unit.
|
This is a limitation of the RCU.
In the same vein, only 2 of the programmed cryptographic
keys can be selected by means of the RCU:
A and B (or C and D if the RCU is configured accordingly).
As an alternative, the much smaller
MA-4083 Fill Gun
can be used, but only
for one type of data at a time (frequencies or crypto keys).
The Fill Gun itself is
loaded by the MA-4073 Programmer.
The image on the right shows a key fill operation in action.
In this case, the MA-4083 Fill Gun is connected to the MA-4735
via a the special Fill Cable.
Data transfer is started automatically.
|
|
|
Note that when using the MA-4083 fill gun to load data into the PRM-4735,
the battery of the radio must be fitted, as it is needed to power the
fill gun. When using the MA-4073 Programmer however,
the current can flow either way:
the battery of the MA-4735 can feed the programmer, or the programmer
(when fitted with a battery) can feed the radio whilst programming.
➤ MA-4073 Programmer
➤ MA-4083 Fill Gun
|
|
In case security is compromised, for example when the radio may fall into
unauthorised hands, the cryptographic keys have to be deleted, so that the
radio can't be used for eavesdropping on the current communication.
The keys also have to be wiped before new keys are programmed.
|
With most cryptographic devices, this is a two-fold operation,
in order to avoid wiping the keys accidently.
On the PRM-4535, the ZEROIZE button is present on the
front panel, between the antenna socket (ANT) and the RCU socket, and can
only be operated with a pen. Pressing this button will only purge the
four crypto keys whilst the channel frequencies remain intact.
The image on the right shows how the PRM-4735 should be zeroized.
Note that the radio does not have to be powered for this. In fact, the
battery doesn't even have to be present.
|
|
|
The PRM-4735 is powered by a rechargeable NiCd battery pack,
such as the one shown in the image on the right. The battery has a nominal
voltage of 9.6V and can be used for 3.7 hours. A slightly shorter variant,
the MA-4736A, with a nominal voltage of 7.2V was also available.
In later years, better quality batteries became available in the same
enclosure. First NiMH, which has more-or-less the same specifications as
NiCd and then Li-ion. Although the latter has more capacity and weights less,
in needs a different battery charger.
|
|
|
Despite the small size of the PRM-4735, the complete assembly (radio
plus battery) might be too large to fit in a pocket of, say, a coat
or a body harness. For this reason an (optional) battery extension
lead was available, allowing the battery to be used in detached
configuration.
The battery extension lead is shown on the right. It consists of a
short piece of 2-wire cable with rectangular connectors at each end.
One connector fits the battery, whilst the other one is fitted to the
bottom of the radio.
|
|
|
Like all radios, the PRM-4735 needs an antenna, but as the radio has
to be hidden under the operator's clothing. A short piece of wire is
used for this. The wire can be hidden in, say, the collar of a coat
or a suitable body harness.
Note that an antenna of this type is never correctly matched to the
transmitter and should be seen as a compromise between range and
exposure. The wire-antenna shown here is for the VHF-L version of the
radio. The wire for the VHF-H band version is much shorter.
|
|
|
|
|
Remote Control Unit
MA-4737
|
|
|
As the PRM-4735 itself has no controls on its front panel,
a separate external Remote Control Unit (RCU) is needed. It is connected
to the RCU socket on the front panel and allows the radio to be switch on
and off, select one of 8 channels and control the volume. The Push-To-Talk
switch (PTT) is at the top of the unit and a separate button is available
for sending a tone.
The RCU communicates with the radio via a Pulse Width Modulation (PWM)
signal over the PTT line, using a proprietary Racal protocol that is also
used for loading the cryptographic keys.
|
|
|
The rotary dial at the side of the RCU has 10 positions. In the first
position (fully turned counterclockwise) the radio is OFF. In all other
positions the radio is ON. From the OFF position going clockwise, the
first 8 positions are for selecting the required channel (0-7).
Turn the rotary fully clockwise (in the drawing below marked with a red line)
to select the required crypto key. Press the minus button
to select KEY A
or the plus button for KEY B. Then return to the desired channel.
|
Although it is possible to connect a standard headset or microphone/speaker
combination to the PRM-4735, the radio was generally used with hidden (covert)
ancillaries. In most cases, a wireless earpiece was used in combination with
an inductor, such as the one shown on the right.
The inductor 'sends' the audio to the earpiece by way of an LF magnetic field,
whilst the earpiece is basically a standard hearing aid that is set to
'inductive mode'. The inductor has to be in the vicinity of the earpiece and
is commonly located on the shoulder or in the body harness.
|
|
|
The inductor shown above has the disadvantage of having to be placed in
the vicinity of the earpiece for a proper 'magnetic connection'.
When the operator turns his head, audio might be lost as a result of
a bad magnetic link.
As an alternative to the inductor, a so-called neck loop might be used,
such as the one shown on the right. The neck loop provides a much stronger
and wider spread magnetic field so that the earpiece can always receive it.
The operator wears it around the neck and connects it to the
MIC socket. It also has a built-in microphone.
|
|
|
When the PRM-4735 is used with an inductor or neckloop,
a wireless in-ear inductive earpiece was used, such as the
Danavox 131-CD/T
shown in the image on the right. The device is powered by a single
button-type battery cell, and fits entirely inside the user's ear canal.
➤ More information
|
|
|
|
The inductor that was supplied with the PRM-4735 has a built-in microphone
behind a small hole at the top,
that picks up the operator's voice. It is therefore necessary to place the
inductor in such a position that is not blocked too much by the clothing.
In some cases, the microphone was brought out on a separate cable, so that
it could be mounted elsewhere on the body or in the operator's hand.
|
|
|
|
The PRM-4735 is housed in a metal enclosure that consists of two shells
or 'halves'. Each of the shells is held in place by 6 recessed screws.
Removing the 6 screws from either side allows the two case shells to be
removed. This reveals a sandwich of two PCBs
attached to the font panel.
|
The radio consists of a Control Board
and a Transceiver Board
that can be separated by removing the 4 screws by which the
transceiver board is mounted to the sub-frame. The transceiver
board can then be lifted from the control board.
The image on the right shows the two PCBs after the two boards
have been separated.
The Transceiver Board is similar to the one that is used in the
Cougar PRM-4515 handheld radio,
albeit a bit smaller.
It has components on
both sides of the PCB
and is fully controlled
by the Control Board when slotted into the blue socket.
|
|
|
Note that besides the blue 16-pin socket, the transceiver board also
connects to the control board via a small
2-pin connector inside the metal transmitter can.
It should be connected to the 2-pin header (SK8) towards the
front of the control board, just behind the antenna socket.
|
The control board contains
the microprocessor, the firmware, the
(clear) audio amplifier, the squelch circuit and the digital CVSD
audio codec. The control board also holds the (optional)
Crypto Module,
of which various types were available.
The image on the right shows the special MA-4487 module that was
available as an alternative to the standard MA-4437.
The crypto module can hold up to four keys (or two in the case of
the VINSON module) of which only two can be used by the PRM-4735 radio.
This is a limitation of the Remote Control Unit.
|
|
|
Depending on the version of the crypto module and the requirements of
the customer, the key variables are retained for several minutes up to
several years, when the main battery is removed. This was done by mounting
either a SuperCap or a Lithium battery on the control board.
|
|
For secure communication, the PRM-4735 could be enhanced with a voice
encryption/decryption module (or Crypto Module, or Crypto Unit), that was
installed on the Control Board.
Various types of crypto modules were
available for different customers and different needs. Note that each type
requires a different version of the MA-4073 Programmer
and/or the MA-4083 fill gun.
|
The standard crypto module that was delivered to most customers, is
the MA-4437 shown in the image on the right.
It uses a Racal-proprietary cryptographic algorithm and can hold
up to four cryptographic keys, each of which consists of 120 bits.
The key is constructed in the MA-4073 Programmer from 36 octal digits
(0-7, or 3 bits) plus a 12-bit fixed prefix (all '1's by default).
The crypto module can encrypt or decrypt the radio's digital 16 kb/s CVSD
modulated data stream, but not both at the same time. That means that it
can only be used in simplex mode.
|
|
|
The keys are stored inside a Harris MH-6504-9 4096-bit CMOS memory,
that is located at the upper side of the module.
When using this module, the keys are retained by a built-in battery
for more than 3 years, even when the radio is disconnected from the power [1].
This is known as long crypto retention.
The presence of a crypto module causes a 128 ms delay in the audio path,
which is needed for crypto processing.
At the start of a transmission is a 96 ms preamble.
Although 4 keys can be stored on the MA-4437,
only two of them can be used by the PRM-4735.
|
This is a different module that was supplied to some European customers.
It is not compatible with the MA-4437 and requires a different version of
the programmer and the fill gun ('G' instead of 'C'-version).
Nevertheless, the key length seems to be identical (120 bits) [1].
MA-4487 boards are generally red, whilst MA-4437 boards are green.
Although it is possible that this board contains the
SAVILLE encryption algorithm,
but it is more likely that it is 'just' a variation
of the standard MA-4437 module. Like the MA-4437 is sends a 96 ms preamble.
|
|
|
The layout of the MA-4487 board is identical to that of the MA-4437 and
the 4 chips are also similar, except for the fact that the product code of
the two large chips (one at the top and one at the bottom)
have a C-suffix (MT70083C versus MT70083, and MT70084C versus MT70084).
Like the MA-4437, this board can hold up to 4 crypto keys,
but only two of them can be selected.
|
|
|
VINSON
Special module — wanted item
|
|
|
When using this module, only two cryptographic keys can be stored in the
device. Furthermore, the crypto keys are only retained for a
minimum of 15 minutes (typically several hours) when the device is
disconnected from its power source. This principle is known as
short crypto retention.
The image above shows a white BID/422/1 module, which is the British
version of VINSON.
|
When the radio is used without a crypto module, four
wire loops have to be inserted in the socket the normally contains that
crypto module. These wire loops ensure that the 16 kb/s CVSD
data is properly bypassed.
The drawing on the right shows the
position of the four wire links, as seen from the top. Note the position
of the notch, which is close to the edge of the PCB.
|
|
|
When the main battery of the PRM-4735 is disconnected, the crypto
keys are retained for at least 15 minutes (typically several hours),
to ensure that the batteries can be swapped without loosing the keys.
Normally, a large capacitor (known as a 'SuperCap') on the
control board ensures that sufficient power is supplied to the
crypto module during this period. In Racal terminology, this is known as
short crypto retention. It was typically used in combination
with the VINSON module.
Depending on the requirements of the customer, a Lithium battery
could be installed in place of the SuperCap, to ensure that the
keys were retained indefinitely (typically more than 3 years)
when the main battery was disconnected. This is known as
long crypto retention. Although it was typically used
with the MA-4437, any combination of retention/crypto module was
possible.
|
|
All crypto modules have the same footprint and can be installed
in any PRM-4735. They are also used in other Racal crypto-capable
products, such as the PRM-4515
and the MA-4777.
A full list of compatible products is given below.
Note that devices are only interoperable if they
use the same algorithm (i.e. the same colour crypto module),
the same frequencies and the same keys.
|
VINSON —
Please note that the devices marked with a * do not
use a Racal crypto module, but a proprietary VINSON compatible module,
that is interoperable with a Racal device that has the mysterious
VINSON module installed. VINSON uses the highly secret
SAVILLE encryption algorithm
developed by GCHQ and NSA.
➤ More
|
Below is an incomplete list of customer-specific PRM-4735 variants
that have been seen so far:
|
PRM-4735H3CAP NSN 5820-99-752-1264 (MOD VHF-H version with VINSON) PRM-4735L/009 VHF-L version with MA-4487 crypto and 30 sec TX limit PRM-4735L/010 VHF-L version with MA-4487 crypto and unlimited TX
|
|
All connections to the PRM-4735, with the exception of the battery (rear),
are located at the front panel. As for covert use the radio has to be hidden
under the operator's clothing,
it is important that the connectors are properly
secured, which is why LEMO connectors have been used.
These small connectors are
securely locked when pushed in, and can be released by pulling the sleeve.
|
|
The microphone connection (MIC) at the front panel
is a LEMO 5-pin female socket with a so-called F-key (the position of the
second notch). The pinout, when looking into the socket, is as described below.
Note that the case shell is the chassis ground (GND).
|
MIC Microphone signal/ON-OFF GND Microphone ground SPK Induction loop signal GND Induction loop ground TEST Test
|
|
|
The connection for the remote control unit (RCU) is also a LEMO 5-pin
female socket, but this one has a so-called D-key (note the different position
of the second notch), so that the two plugs can not be swapped. Note that the
case shell is the chassis ground (GND). The pinout is as follows:
|
PWM Serial control data I/O and PTT input CAA Test output +V 7.2V supply (in or out) OFF Force OFF (when connected to 0V) TONE Fill tone output
|
|
- Racal Radio Ltd., MA 4073C and MA 4073G Programmer, User Handbook
Ref. RH 8224. Issue 3. Date unknown.
- Jane's Military Communications, AN/CSZ-6 Vinson-compatible Hand-held Transceiver
Fifteenth Edition 1994-1995. p. 551.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Tuesday 19 May 2015. Last changed: Wednesday, 19 October 2022 - 06:43 CET.
|
 |
|
|
|
