|
|
|
|
|
|
|
PTT
Development of mobile telephony in the Netherlands
This page describes the public
mobile telephone networks that were in use
in the Netherlands between 1949 and 2000. All networks – with the
exception of GSM – were operated exclusively by the Dutch state-owned
monopolist PTT
(now: KPN).
KPN was privatised in 1989 — shortly before the introduction
of GSM — after which other network operators were admitted to the market.
The timeline above shows which networks were in operation at any given time.
The first network was the manually switched OLN, which was operational
from 1949 to 1985. It was succeeded by the automatically switched ATF
— similar to Cellnet in the UK — of which
three generations have existed: ATF-1,
ATF-2
and ATF-3. These networks
were analogue and were initially not protected against eavesdropping, hacking
and phreaking.
In 1994, they were succeeded by digital GSM.
Note that GSM became available in Europe in 1992,
but was delayed by KPN in order to get some revenues from its
ATF-3 network that had just
been expanded and in which KPN had heavily invested.
In between ATF-3
and GSM, they also operated the short-lived
Greenpoint, which was eventually also surpassed
by GSM.
The above listed networks are described in more detail below.
|
OLN ATF-1 ATF-2 ATF-3 Greenpoint GSM MNN
Openbaar Landelijk Net
The first public network for mobile telephony in the Netherlands, was
introduced shortly after WWII, in 1949.
The network was operated and maintained by the (then) state-owned PTT
(now: KPN), and was known as Openbaar Landelijk Net
(Public National Network), abbreviated OLN
[2].
At its introduction in 1949, there were 22 base station that were mainly
located near the larger cities. This had been increased to 35 by the
time the network was completed in 1951. As nobody could have foreseen the
popularity of mobile phones in later years — there were not many cars and
fewer people who could afford it — the network had a capacity of ~2500
subscribers [4].
|
OLN was based on state-of-the-art mobile radio sets (Dutch: mobilofoons),
that operated in the 80 MHz band and were built with valves (tubes).
Being a half-duplex system, the user had to press a so-called push-to-talk
button on the microphone whilst speaking. Furthermore,
all outgoing calls had to be patched manually by an operator. Incoming calls
could only be received if the caller knew in which of the 35 areas
(move over map) the mobile subscriber was located.
Users of the network had no privacy. As the 80 MHz band is at the lower end
of the FM radio broadcast band, virtually everone with a regular radio
could eavesdrop on the conversations. As there was no authentication, hacking
was easy. Everyone with a suitable transceiver could break in and pretend to
be a legitimate subscriber.
➤ View original map of 1949
➤ View original map of 1951
|
|
|
When placing a call, the mobile subscriber had to switch to the appropriate
channel (for the area) and press the push-to-talk on the microphone for
approx. 5 seconds. This was enough to wake the operator, who would
then ask for the subsriber's number and the number to be connected to.
The operator then placed the call and patched it to the mobile subscriber.
Interestingly, there was a three-minute limit on the duration of each call.
When this time had passed, the operator would break in [2].
All calls were billed manually, which must have been a logistic nightmare
for PTT.
➤ More about OLN on the sTEN website
➤ or read this article by Louis Meulstee
|
- Valves, 2 channel
- Valves
- Valve/transistor hybrid
- Transistor, 8 channels
Storno CQM-600 Transistor
|
Link 1 1498 Valves, 1 channel, 70-100 MHz, 50W - Valves, transmitter, 1962-1986
- Valves, receiver
Storno CQF-600 Transistor
|
-
Link referes to the Fred M. Link Radio Corporation
[2].
|
On 1 March 1980, PTT launched its first automatically-switched mobile telephone
network: ATF, which means AutoTeleFoon (car phone).
This implied that calls no longer had to be patched by an operator.
The system was based
on the German B-Netz, and was compatible with the networks in Germany,
Austria and Luxemburg. The network had a maximum capacity of
2500 subscribers.
As it was susceptible to phone phreaking, 1
authentication
was added in late 1987 / early 1988.
As the maximum capacity was reached already in 1983, PTT decided
to add an extra network — named ATF-2 — of which the capacity would
be larger (see below).
The new ATF-2 network was launched in 1985, at the same time as
the old manually-switched OLN service was terminated.
|
ATF, later renamed ATF-1, was a narrowband full-duplex analogue
communications system, with in-band signalling. The system worked in the
150 MHz band and was divided into three regions: north, south
and west.
An external caller had to dial a certain prefix,
based on the expected location of the mobile subscriber.
The mobile transceivers were so large and heavy, that they had to be
mounted in the trunk of the car, with a remote control unit and the
handset mounted at the dashboard. PTT subscribers had two phones to
choose from:
Castor – which was a
rebranded AEG 4015C of the German B-Netz – and
Pollux
– made by US manufacturer Motorola.
As the phone could also be used in Germany, it became very popular
among inland navigation skippers, for example on the river Rhine.
But as the Dutch telecom law of the days prohibited the use of mobile
telephones aboard a ship, this was officially illegal, and skippers
risked a high fine.
|
|
|
The ban on mobile telephones aboard ships was lifted in 1988, but at the
same time the network was blocked for foreign users, in order to prevent
an overload of its capacity 2 . Anyone who still wanted to use ATF-1 in
any of the other countries, had to apply for a special telephone number.
Although ATF-1 was succeeded in 1985 by ATF-2
and in 1989 by ATF-3,
it remained in service until 1995, mainly because of its high popularity
among skippers. All these years, it was the only system that could also be
used in Germany and Luxemburg. In 1994, PTT 3 had started
rolling out the new pan-European GSM network, and allowed skippers
one year to make the transition.
|
-
Exploring a system, to understand how it works. Used – for example –
to make free telephone calls [15].
-
Probably also done to avoid phone phreaking
by using foreign numbers.
-
By then renamed: KPN.
|
|
Depending on the area in which the mobile subscriber was (presumably)
located, a caller had to dial a specific prefix. As there were 4-digit
and 5-digit numbers, two sets of prefixes were used. If a certain
subscriber could not be reached, the caller had to pick another prefix
and try again.
|
|
Region
|
5-digit subscriber number
|
4-digit subscriber number
|
|
West
|
02931-xxxxx
|
09-311 xxxx
|
|
North
|
02932-xxxxx
|
09-312 xxxx
|
|
South
|
02933-xxxxx
|
09-313 xxxx
|
|
|
The handshake between a mobile station and the base station took place
by means of in-band signalling, without any form of encryption or authentication
whatsoever. This means that the subscriber number and the
called (or calling) number, were transmitted over the air in clear.
|
This made it possible for people with a scanner
and a personal computer,
to monitor all traffic to and from (specific) car phones. Suitable software
for a Commodore 64 computer – with an adapter for driving an external
cassette recorder –
was released by SPYTECH in Arnhem under the name
Autotelefoon-decoder 1 (car phone decoder 1).
According to the Dutch telecom law, it is illegal to intercept and use/abuse
information that is sent over-the-air and that is not intended for the
interceptor, but this is usually
difficult to enforce, as receivers can generally not be traced.
|
|
|
The software was welcomed by hackers and scanner listeneners.
And although it might have been useful for the police for intercepting
criminal conversations, it was soon discovered by criminals, who
made a living out of blackmailing people based on intercepted
compromising conversations.
➤ More about the eavesdropping software
|
|
|
Clandestine use of ATF-1
Phreaking
|
|
|
|
When the subscriber rented his mobile telephone from PTT, a free
mobile number was assigned and was programmed into a so-called codeplug,
which was installed inside the mobile telephone by a PTT service engineer.
The codeplug was a small electronic unit with a simple diode-matrix.
|
Hackers soon discovered the possibility to alter the code plug, so that
it seemed to the network that a different subscriber number
was used. This technique is known as number spoofing. It allowed the
spoofer to make a call at someone else's expense, or – in case a reserved
but not yet released number was used – free of charge.
All that PTT could do when malicious use of its network was discoverd, was block
the number. But due to the lack of proper authentication — IMEI and
IMSI numbers did not yet exist — the telephone number had to be blocked
forever.
|
|
|
|
As soon as the number was blocked, the malicious party could simply 'invent'
another subscriber number, and repeat this until the database was exhausted.
And to make matters worse: any new subscriber number that had not yet been
released, was recognised by network as a valid one.
|
The hacking successes did not go unnoticed, and it wasn't before long that
the criminal world started offering the hackers substantial sums of money for
fully anonymous clandestine phones.
This was not simple however, as one needed a suitable telephone to
start with, and PTT only rented it to their subscribers. They could not
be purchased on the open market. The only way to get one, was to steal
it from someone else's car. The image on the right shows an example of a
stolen Pollux telephone that was converted for making
clandestine calls on the ATF-1 network.
|
|
|
|
The clandestine sets came in several flavours, with a preset range
of telephone numbers, or with a
set of 5 thumbwheels, so that the user
could alter the subscriber number on the fly. Some were supplied in a
large suitcase, but others came in a small briefcase for which it had to
be modified.
|
The other PTT model – Castor – could also be put to clandestine use,
as shown in the image on the right. It consists of a wide Samsonite
briefcase of which most space is taken by the (large) car phone. In
front of it, are the controls
(left) and the handset (right).
Just behind the controls is a
set of five numeric thumbwheels
that allow the subscriber number to be selected freely.
The clandestine telephones were used by people with relatives abroad –
with whom they could make long phone calls without paying – and by
people who wanted to 'stay under the radar' [13].
|
|
|
|
The ever increasing demand from the criminal community, led to a growing
number of car phone thefts — even complete cars got stolen — that peaked
in 1986, prompting the police to start a national criminal
investigation. Finally, in October 1986 – after many observations
throughout the country – the police dismantled one criminal network and
arrested 13 people in seven cities [12].
According to the PTT, the losses had accumulated to 10 million
Guilders 1 by mid-1987 [13].
|
 |
In the 2nd issue of the Dutch techno-anarchist magazine Hack-Tic of 1989,
hackers Peter Poelman and The Key gave a good description of how
the digital signalling between the base station and the mobile subscriber
took place [18].
ATF-1 used analogue in-band signalling by means of two specific tones,
1950 Hz and 2070 Hz, representing the digital values '1' and '0'
respectively.
Signalling takes place by using 16-bit Cyclically Permutable Codewords (CPC),
with a fixed 5-bit prefix (01110) for synchronisation and two mirrored
5-bit values for each digit:
|
0 0111011000000011 1 0111010100000101 2 0111010010001001 3 0111010001010001 4 0111001100000110
Start 0111001000100010 Stop 0111010000100001
|
5 0111001010001010 6 0111001001010010 7 0111000110001100 8 0111000101010100 9 0111000011011000
Cancel 0111010101010101
|
|
On each free channel, a base station broadcasts a continuously repeated
telegram which consists of the 2-digit region code of the base
station. The first digit of this code is always a '9', e.g.:
|
|
If a mobile station wants to initiate a call, a 2070 Hz tone is sent
for 600 ms, followed by a telegram that consists of a START command,
the number of the caller (e.g. 70101) and the number of the callee, complete
with the area code (e.g. 045-381977) of which the leading '0' is omitted,
and finally a STOP command to indicate the end of the telegram, for example:
|
- START - 70101 - 45381977 - STOP
|
|
The base station replies to this by confirming the subscriber number twice:
|
- START - 70101 - 70101 - STOP
|
|
When the base station has a call for mobile subscriber 70101 on
channel 23, it will broadcast the following sequence on the calling
channel (19):
|
7 0111000110001100 0 0111011000000011 1 0111010100000101 0 0111011000000011 1 0111010100000101 23 0111010020010001
|
When all goes well, the mobile station switches itself to channel 23
and answers the call with a continuous 1950 Hz tone (logic '1'), after
which the base stations replies with the same 1950 Hz continuous tone.
In the meantime, the phone starts ringing. As soon as the user picks
up his handset, the mobile station switches to a 2070 Hz tone (logic '0')
and the call will be patched.
|
|
|
Authentication on ATF-1
Bemotel
|
|
|
After discovery of the hacks and the subsequent arrests in the Amsterdam
region, similar types of hacks started popping up in other parts of the country.
In order to counter this, PTT decided to add authentication to the concept,
which was done in 1987/1988. The authentication system was known as BEMOTEL.
It consisted of a central server – the Temporary Authentication Register
(TAR) – and a small module that was added to each mobile station – the
Subscriber Identity System (SIS).
The diagram above illustrates how it worked. When initiating a call,
the mobile unit sends its number to the base station, which passes
it on to the TAR. When recognised, the TAR generates a random number
(challenge) and sends it to the mobile unit. The mobile unit does a
calculation on it – based on its SIS – and sends the result
back to the base station (response).
Meanwhile, the TAR has performed the same calculation (based on SIS data
stored in its database). The two results are then compared.
If they are identical the call is accepted. If not, it is rejected.
This principle is known as challenge-response authentication [16].
It was later also used on ATF-2 and even found its way into the GSM standard,
albeit in a more robust implementation.
The only weakness in the BEMOTEL system was that it was a one-way
authentication system that was used on outgoing calls only (mobile originating calls).
Although hackers eventually found a way around this – by making collect calls
to the mobile subscriber – they were far less successful than before.
But as Germany, Austria and Luxemburg did not participate in the authentication
upgrade program, foreign numbers were not secured and remained susceptible to
phreaking.
|
|
|
Known ATF-1 mobile devices
|
|
|
-
Used on the German B-Netz. Not supplied by the Dutch PTT,
but illegally imported for clandestine use.
|
- Netherlands
- Germany
- Austria
- Luxemburg
|
|
ATF-1 was a full duplex system for which 37 channels were allocated,
with a channel spacing of 20 kHz and a distance of 4.6 MHz between
uplink and downlink. Uplink (mobile) was in the range 148.410-149.130 MHz,
whilst downlink (base) was in the range 153.010-153.730 MHz.
Channel 19 (153.370 MHz) – at the centre of the downlink band –
was not used for conversations, but acted as the calling channel.
When idle, all mobile stations continuously monitored this channel.
|
|
CH
|
Mobile
|
Base
|
Location 1
|
|
|
|
1
|
148.410
|
153.010
|
Goes, Utrecht, Smilde
|
|
2
|
148.430
|
153.030
|
Maastricht, Rotterdam, Ugchelen
|
|
3
|
148.450
|
153.050
|
Rotterdam, Ugchelen
|
|
4
|
148.470
|
153.070
|
Venlo, Utrecht
|
|
5
|
148.490
|
153.090
|
Test and demonstration channel
|
|
6
|
148.510
|
153.110
|
Den Haag, Ugchelen
|
|
7
|
148.530
|
153.130
|
Den Haag, Maastricht, Megen, Tjerkgaast
|
|
8
|
148.550
|
153.150
|
Rotterdam, Zwollerkerspel
|
|
9
|
148.570
|
153.170
|
Leeuwarden, Mierlo, Utrecht
|
|
10
|
148.590
|
153.190
|
Rotterdam, Zwollerkerspel
|
|
11
|
148.610
|
153.210
|
Amsterdam, Mierlo, Smilde
|
|
12
|
148.630
|
153.230
|
Rotterdam, Megen, Alkmaar
|
|
13
|
148.650
|
153.250
|
Amsterdam, Mierlo, Goes
|
|
14
|
148.670
|
153.270
|
Maastricht, Megen, Rotterdam, Tjerkgaast
|
|
15
|
148.690
|
153.290
|
Den Haag, Zwollerkerspel
|
|
16
|
148.710
|
153.310
|
Masterdam, Roosendaal, Smilde
|
|
17
|
148.730
|
153.330
|
Alkmaar, Rotterdam, Ugchelen, Venlo
|
|
18
|
148.750
|
153.350
|
Wieringerwerf, Rotterdam, Markelo
|
|
19
|
-
|
153.370
|
Calling channel
|
|
20
|
148.790
|
153.390
|
Markelo, Mierlo, Rotterdam, Wieringerwerf
|
|
21
|
148.810
|
153.410
|
Den Haag, Leeuwarden
|
|
22
|
148.830
|
153.430
|
Lelystad, Loon op Zand
|
|
23
|
148.850
|
153.450
|
Rotterdam, Winschoten, Alkmaar
|
|
24
|
148.870
|
153.470
|
Lelystad, Loon op Zand, WInschoten
|
|
25
|
148.890
|
153.490
|
Leeuwarden, Utrecht, Venlo
|
|
26
|
148.910
|
153.510
|
Groningen, Den Haag, Ugchelen
|
|
27
|
148.930
|
153.530
|
Groningen, Amsterdam
|
|
28
|
148.950
|
153.550
|
Lelystad, Rotterdam, Venlo
|
|
29
|
148.970
|
153.570
|
Megen, Coevorden, Wieringerwerf, Rotterdam
|
|
30
|
148.990
|
153.590
|
Maastricht, Roosendaal, Megen, Tjerkgaast
|
|
31
|
149.010
|
153.610
|
Amsterdam, Roosendaal, Coevorden, Venlo
|
|
32
|
149.030
|
153.630
|
Groningen, Megen, Tjerkgaast
|
|
33
|
149.050
|
153.650
|
Alkmaar, Loon op Zand, Winschoten
|
|
34
|
149.070
|
153.670
|
Amsterdam, Roosendaal, Coevorden
|
|
35
|
149.090
|
153.690
|
Rotterdam, Zwollerkerspel
|
|
36
|
149.110
|
153.710
|
Goes, Markelo, Mierlo, Utrecht, Amsterman
|
|
37
|
149.130
|
153.730
|
Alkmaar, Loon op Zand, Maastricht
|
|
|
-
These are the names of the Dutch towns,
in or near which the ATF-1 base stations were located.
|
ATF-1 had a maximum capacity of approx. 2500 subscribers, which was
reached in 1983, just three years after its introduction. For this reason,
PTT launched a new network in 1985, named ATF-2. The network was rolled-out
simultaneously in the Netherlands, Belgium and Luxemburg.
ATF-2 operated in the 450 MHz band was based on the scandinavian NMT-450
standard 1 which was also used in the Nordic countries Norway, Sweden,
Finland and Denmark. It is not compatible with the Nordic system however,
as it used a different channel-spacing (20 kHz instead of 25)
to allow more channels and hence more subscribers.
ATF-2 had limited authentication capabilities.
|
NMT-450 was one of the first cellular telephone networks, in which the country
is divided into a series of areas (cells), much like a honeycomb, as shown in
the map on the right. Initially, 50 cells were planned for a maximum number of
25,000 subscribers. This was later expanded to 120 cells for a total of
32,000 subscribers. Move over the map to see how smaller cells were used to
increase the capacity of the ATF-2 network.
Unlike ATF-1, it was an analogue network with signalling through digital
modems, that provided an automatic hand-over when crossing a cell border.
As a result, it was no longer necessary to dial a specific area-code (prefix)
for each region.
As the conversation was still transmitted in FM (analogue) however,
eavesdropping by means of a simple computer scanner
like the Handic 0016 remained possible.
This was done by criminals — for blackmailing people based on intercepted
compromising conversations — as well as by the police — for intercepting
criminal conversations.
|
|
|
|
Over the years, PTT introduced three mobile stations for the ATF-2
network, each supplied by a different manufacturer. They were designated
CARVOX 2451,
2452 and
2453
repectively, and each model was smaller than its predecessor.
The first one, CARVOX 2451, was supplied by Philips, but was in fact
a rebranded 3533-2, manufactured by AP Radiotelefon A/S in Denmark.
|
It consisted of a large main unit that had to be mounted in the trunk of the
car, whith a long thick cable running to the dashboard where the handset
with built-in controls was located. It was mounted horizontally on the
dashboard, so that the user was able to read the text on the buttons and
on the wide liquid crystal display (LCD).
The next model – CARVOX 2452 – was supplied by
Siemens and had a more elegant
handset that was mounted vertically. The last model,
CARVOX 2453 (shown here), was actually a
Nokia Mobira RD-59 and was the first
truely portable model.
|
|
|
It consisted of a main unit that could be removed from the car, and
was powered by an optional battery that was fitted to its right side.
The handset had to be removed from the dashboard and was fitted to a magnetic
cradle at the front of the main unit. This model also became a popular
amateur transceiver after the ATF-2 service was terminated in 1999,
as it was easily convertable.
Initially, a network expansion to 150 base stations (for 50,000
subscribers) was planned, but the plans were dropped when it became
clear that with the rapidly increasing number of subscribers, this limit
would have been reached by 1989.
As the new pan-European GSM network (planned for 1990) was
delayed by at least one year, it was decided to add an intermediate
network: ATF-3.
In 1989, ATF-2 was succeeded by ATF-3 which had an increased capacity.
Both networks would remain in service until long after GSM had been
rolled-out, and were finally shut down in 1999. This means that ATF-2
had a life-span of 14 years, one year less that its predecessor
ATF-1.
➤ More about the CARVOX 2453
|
|
-
NMT = Nordic Mobile Telephone.
|
|
Because ATF-2 featured digital signalling, the system was less
prone to phreaking than ATF-1. Subscriber numbers were no
longer send over the air in clear, but due to the fact that
there was no form of authentication whatsoever, hacking was still possible,
albeit more difficult than before.
|
It appeared to be impossible for the hackers to give the clandestine user
full control over the subscriber number, but it was still possible to
spoof numbers by adding a microprocessor to the hacked phone,
which was capable of using up to 10 previously selected phone numbers.
The image on the right shows a stolen
CARVOX 2451 – which is in fact an
AP Radiotelefon A/S 3533-2 supplied by Philips 1
– that was modified for clandestine operation on the ATF-2 network.
It is housed in a professionally made flightcase and has a built-in
rechargeable 12V battery.
|
|
|
The handset is mounted at the top and an antenna should be installed
on the socket at the front left. Inside the recessed part is a
single-digit thumbwheel
that allows selection of any of the pre-programmed subscriber
numbers. When all subscriber numbers were exhaused — after PTT had discovered
their use and blocked them — the user had to return the phone to the hacker
to have it reprogrammed. Reportedly, some hackers ran a life-time warranty
program for this service.
➤ More about the CARVOX 2451
|
-
PTT's
CARVOX 2541
was supplied by Philips, but was in fact made by
AP Radiotelefon A/S in Denmark, since 1978 a Philips subsidary.
in 1994, Philips sold the Danish business unit to Nokia.
|
Shortly after the introduction of ATF-2, in mid-1986, PTT noticed a
rapid increase in the illegal use of its networks, first on the
ATF-1 network,
and then also on the new ATF-2. This prompted them to come up
with a solution, which they found in the
BEMOTEL authentication system.
BEMOTEL was first implemented on the ATF-1 network,
for which all mobile subscribers had to be called-in, in order to have
their phones modified. PTT then had to persuade Nordic Telecom
– the developers of the NMT-450 standard – to implement authentication
in their standard as well. An agreement was reached and authentication
was implemented in the Nordic countries as well, for which PTT provided
on-line authentication,
through its TAR servers in Rotterdam (Netherlands).
Once the upgrade of the ATF-1 mobile units was completed, all ATF-2
users had their phones modified as well. The same
authentication system also became an integral part of the NMT-900
standard, on which the later ATF-3 network was based. PTT and Nordic
Telecom insisted that a similar system had to be adopted for the GSM
standard as well, which was eventually accepted by the ETSI, leading
to the introduction IMEI numbers,
IMSI numbers and the well-known
SIM card.
➤ More about Bemotel
|
- Netherlands
- Belgium
- Luxemburg
- Norway 1
- Sweden 1
- Finland 1
- Denmark 1
|
-
The Dutch ATF-2 system is not compatible with the NMT-450 system of the
Nordic countries, due to a difference in channel spacing.
|
ATF-3 was the third and last automatic analogue car phone network
in the Netherlands. It was launched in 1989 as a gap-fill solution between the
saturated ATF-2 network and the anticipated new
digital GSM network that had been planned for 1990 but was delayed
by at least one year.
ATF-3 operated in the 900 MHz band — initially reserved for GSM
— and was based on the NMT-900 standard of the Nordic countries.
Due to the higher frequency, more channels were available with a shorter
range, which means that smaller cells could be used, as shown in the map below.
|
As a result, the mobile unit needed less power to reach the base station
— 1W instead of 6W as with the ATF-2 network — which allowed the
introduction of truely portable telephone sets,
also known as pocket phones or hand-helds.
The network had an initial capacity of 30,000 subscribers, but this
was later increased to no less than 300,000 in order to accomodate the
ever increasing popularity of mobile phones. This was done by adding
extra base stations, especially in the larger cities, as a result of
which the distance between a base station and the mobile subscriber was
reduced to approx. 3 km.
Much to dismay of KPN however, the growth of the number of subscribers
halted and the total capacity of 300,000 users was never reached. This
was due to the high cost of an ATF-3 subscription, in combination
with the fact that the new GSM network had already been announced
and was being implemented in other countries.
|
|
|
So far, the ATF networks had mainly been used by business users
who could afford the high cost of a subscription.
In order to get some return on investment, KPN tried to make it
attractive to private users as well, by marketing it at a reduced
cost under the name Hi. At the same time, they delayed the
introduction of GSM by another few years to persuade more people
to use ATF-3.
Although Hi was reasonably successful, it is unlikely that
KPN ever earned its investment back, also because in 1992 they had
launched the ill-fated Greenpoint mobile network (see below).
In 1994, KPN at long last started rolling out the new GSM network, two
years later than the rest of Europe.
The arrival of GSM resulted in a further decline of ATF-3.
In 1999, both the ATF-2 and ATF-3 services were terminated. The
older ATF-1 service had already been terminated in 1995.
This means that ATF-3 had a life-span of 10 years, four years less
than its predecessor ATF-2.
|
|
As ATF-3 is bascially an analogue network with digital signalling,
very similar to ATF-2, eavesdropping was still possible
although most simple scanners did not support the higher frequency
of 900 MHz at the time. As a result, ATF-3 became
an interesting new way of communication for criminals, who were under the
impression that their conversations could not be intercepted.
|
The increased use of ATF-3 mobile phones by criminal networks, soon
attracted the attention of the Dutch police, who tried to find ways
to eavesdrop on their conversions in order to gain evidence in a
running criminal investigation.
Because of the higher number of channels on the ATF-3 network,
it appeared to be difficult to find the correct channel, especially after
the call was handed over to another cell. The Police Signals Service (PVD)
therefore developed a
scanner that was able to interpret the digital hand-over data between
the base station and the mobile unit.
|
|
|
It provided the police with a gap-free intercept of the conversation,
even when the parties moved between cells. The scanner – which
became known as Kolibrie – contained two
receivers, allowing the base station and the mobile unit to be intercepted
separately. It would later become a subject of controversy,
during the parlementary inquiry of the Van Traa Commission of 1995.
➤ More about Kolibrie
|
|
|
Known mobile ATF-3 devices
|
|
|
Pocketline 8000 ? Pocketline Columbus Motorola Micro-Tac Carvox 2500 Nokia Carvox Voyager Nokia
|
- Netherlands
- Norway
- Sweden
- Finland
- Denmark
- Switzerland
|
In 1992, PTT (by that time renamed: PTT Telecom), introduced the so-called
Greenpoint network as an affordable alternative to the expensive ATF-3.
Greenpoint — initially known as Kermit, after a popular Muppet Show character —
was a digital system, based on the Cordless Telephone Type 2 (CT2) standard [6].
By 1996, at the hight of its success, the network had 60,000 subscribers.
CT2 recognised two types of network: private and public.
The private network consisted of a base station that was connected to the
subscribers local analogue telephone line, much like a
regular cordless telephone. The public network consisted of ~5000
short range base stations, placed at strategic locations around the country,
like supermarkets, airports, train stations and parkings.
|
Despite its technically advanced features, Greenpoint had many drawbacks.
A subscriber had to be within 150 metres of an access point (known as a
telepoint) in order to make a phone call, and – more importantly – the user
could only place outgoing calls and could not be called. 1
For this reason, some greenpoint models were equipped with a built-in
Semafoon (a Motorola pager). A potential caller first had to send
his own telephone number to the pager, after which the Greenpoint
subscriber could call him back.
Needless to say that this was overly complicated and unnecessarily expensive.
The image on the right shows a typical Kermit 2000 phone, which was made
by US-based manufacturer Motorola.
|
|
|
|
By 1998, the number of subscribers had dropped to ~20,000, mainly because
of the popularity of the new GSM network that had meanwhile been
introduced in the Netherlands in 1994 (two years after the rest of Europe).
On 1 January 1999, PTT terminated its Greenpoint service.
In retrospect, it is difficult to comprehend why PTT ever introduced
Greenpoint with all its technical limitations, whilst the digital GSM
standard (to which PTT had contributed) was being rolled out elsewhere.
|
-
Although incoming calls are possible in the CT2 standard, this feature
was not implemented in the Netherlands and in most other countries.
|
Global System for Mobile communication
In 1994, KPN introduced the fully digital GSM network in the Netherlands.
GSM had originally been planned for 1990, but was delayed several times due
to technical issues. Other European countries started rolling-out GSM in
1992 1 but KPN held it back for two years to get a return on investment
on its analogue ATF-3 network,
which had been expanded heavily a few years earlier.
GSM – the Global System for Mobile communication 2 – is a standard
developed by the
European Telecommunications Standards Institute
(ETSI),
to describe a digital switched-circuit network that is optimised for full-duplex
voice telephony, also known as 2G (second generation).
In the same vain, the earlier analogue networks — such as the Dutch
ATF-1,
2
and 3 — are known as 1G.
KPN initially called the new network ATF-4 — following existing
naming conventions — but eventually dropped this
in favour of the more universal name GSM. With the introduction of GSM,
KPN (meanwhile privatised) lost its monopoly on the telecom market. The first
additional provider to offer 2G in the Netherlands was Libertel
(later renamed: Vodafone).
➤ More about GSM
|
|
-
Finland was the first country to roll out GSM in December 1991.
-
Originally: Groupe Spécial Mobile (French).
|
Although initially developed as a pan-European system, GSM quickly grew
out to an international standard, which even got adopted in the US.
Over the years, the standard was expanded with new frequency ranges
(e.g. 1800 MHz) and with provisions for data transfer, GPRS, video and
internet. This led to the introduction of the 3G UMTS standard –
developed by the 3GPP – and the 4G LTE Advanced standard, which
were no longer part of the original ETSI GSM standard.
In 2019, steps were taken to move to the next standard which will
be a broadband system known as 5G (fifth generation).
It was first rolled-out in South-Korea and is backwards compatible
with 2G, 3G and 4G. China has heavily invested in the developed of
5G equipment, but many countries have restricted or eliminated the
use of Chinese 5G equipment because of espionage fears [10].
|
One of the key features of GSM is the Subscriber Identity Module (SIM)
– also known as a SIM card – which contains the user's
identity, known as the International Mobile Subscriber Identity (IMSI).
This is different from the phone's own identity, which is known as
International Mobile Equipment Identity (IMEI). This allows stolen
phones to be blocked without losing the telephone number.
GSM is a fully digital system that uses CODECs for converting analogue
speech into digital data. In addition, the digital data is encrypted with
a high-end encryption algorithm that can not be broken easily (1990) but
is prone to several attacks, including man-in-the-middle attacks [9].
For lawful interception, a so-called IMSI-catcher can be used for
eavesdropping [11].
The encryption was initially planned to use a 128-bit key, but this
was later reduced to 54 bits
after intervention by the
British intelligence service GCHQ.
Since 2010, the algorithm is no longer deemed secure.
➤ More about GSM
|
Mobiel Nationaal Noodnet
In the late 1990s, experts began to fear that computers could cause huge,
and possibly life-threatening, problems at the turn of the century. Most
computers had a real-time clock chip (RTC) that used only two digits to
identify the current year. As a result, the year 2000 could be interpreted
as 1900, causing computers, access control systems, telephone exchanges,
elevators, energy plants, payment systems, medical databases
and other critical infrastrucure to fail.
|
This faillure to properly recognise the year 2000, is also known as the
Millenium Bug or the Year 2000 problem,
commonly abbreviated Y2K [19].
As it could potentially lead to economic and social disruption, many countries
ordered all critical systems to be checked well in advance of the turn of the
millennium. Many companies were required to have their systems
audited.
As part of a series of Y2K measures, the Dutch Government ordered
the largest national telecom provider,
the former state-owned KPN, to extend its
wired national emergency network – Nationaal Noodnet (NN) – and expand it with
a temporary mobile network that was certain to be Y2K proof.
The network was designated Mobiel Nationaal Noodnet (MNN)
— mobile national emergency network — and was basically a trunking radio
system with national coverage. It worked in semi-duplex mode in the
450 MHz band (using the frequencies of the
old NMT-450 network ATF-2),
and required the user to press a button on the inside of the handset
whilst speaking.
|
|
|
|
Each subscriber could be called directly by users of the MNN and NN
networks, using a 7-digit subscriber number.
In case of an emergency, an operator could patch the call
to the public telephone network.
As the capacity of the MNN was limited, the duration of a call was limited
to 4 minutes, with a warning tone 10 s before the end.
Once expired, it was terminated automatically.
|
The MNN was rolled out during the course of 1999 and consisted of more
than 1500 Nokia RD-72 mobile trunking radios
with tailored software.
These mobile stations were typically installed at strategic nodes, such
as the (local) government, emergency services, hospitals
and operators of critical
infrastructure, such as the various telecom operators and energy
providers.
The telephone number of the most important subscribers were listed in
a printed directory
that was issued in September 1999 [20]
and that was supplied with each
Nokia RD-72 MNN telephone.
|
|
|
Despite the fears for national disruption during the turn of the century,
no major problems were reported, probably because of the precautions that
had been taken during the preceeding years.
The MNN network was operational for 6 months and was switched off on
1 April 2000, after which it was dismantled again. All mobile nodes were
recalled by KPN, and were disposed off.
➤ More about the Nokia RD-72
|
|
ATF
|
|
Autotelefoon
Name for the Dutch automatically-switched analogue carphone networks,
of which three generations have existed (nown as ATF-1,
ATF-2
and ATF-3.
Succeeded in 1994 by GSM.
|
|
GSM
|
|
Global System for Mobile Communication
|
|
KPN
|
|
Koninklijke PTT Nederland
Royal PTT of The Netherlands. This was the name of the former Dutch
state-owned telecom monopolist PTT after its privatisation in 1989.
|
|
OLN
|
|
Openbaar Landelijk Net
First Dutch public radio network for mobile telephony in the 80 MHz band,
introduced in 1949 and operated by the PTT (now: KPN). The network was
manually-switched, which means that the subscriber
had to be patched by an operator. Terminated in 1985.
|
|
PTT
|
|
Staatsbedrijf der Posterijen, Telegrafie en Telefonie
Dutch state-owned telecommunications monopolist from 1881 until its
privatisation in 1989.
Responsible for the development and operation of the post, telegraph
and telephone networks in the Netherlands. Also responsible for monitoring
the radio spectrum and for enforcing the telecom laws.
➤ More
|
- COMM (formerly: Museum voor Communicatie)
Retrieved May 2019.
- sTEN, Telecom Canon 9 - Niets te gek om los te lopen
Retreived May 2019.
- Louis Meulstee, Wireless for the Warrior
1992-1994. Retrieved May 2019.
- Wegwijs in Frequentieland,
Retrieved May 2019.
- Wikipedia, Greenpoint (telefoonnetwerk)
Retrieved May 2019.
- Wikipedia, CT2
Retrieved May 2019.
- Wikipedia, Autotelefoon
Retrieved May 2019.
- Telefoonmuseum.eu, Kermit 2000
Retrieved May 2019.
- Wikipedia, GSM
Retrieved May 2019.
- Wikipedia, 5G
Retrieved May 2019.
- Wikipedia, IMSI-catcher
Retrieved May 2019.
- Provinciale Zeeuwse Courant, Wijdvertakte zwendelzaak met autotelefoons ontdekt
28 October 1986, page 5.
➤ Direct download
- Leidse Courant, Misbruik van autotelefoons kost PTT tien miljoen
25 September 1987, page 3 (Dutch).
➤ Direct download
- Huib Visser, Halogeenlampen, Funnyphones, Kacheltjes en Harries
Tijdschrift van het NERG, deel 67-nr.1-2002. p. 30
- Wikipedia, Phreaking
Retrieved May 2019.
- Wikipedia, Challenge-response authentication
Retrieved May 2019.
- Wikipedia, B-Netz
Retrieved May 2019.
- Peter Poelman en The Key, Autotelefoonnet 1 gehackt
Hack-Tic Magazine, Issue 2, 1989. Page 7 (Dutch).
- Wikipedia, Year 2000 problem
Retrieved December 2020.
- KPN, Mobiel Nationaal Noodnet, Telefoongids
Directory, September 1999. DIN A5 booklet (in Dutch language).
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Sunday 19 May 2019. Last changed: Sunday, 24 March 2024 - 09:35 CET.
|
|
|
|
|
| |
![Map of the Netherlands with OLN base stations in 1949/1951. Image via sTEN [x].](svg/map_oln1.svg)
![Typical Kermit 2000 sold by KPN. Photograph via Telefoonmuseum.eu [8].](img/greenhopper_500.jpg)
