Click for homepage
ATF
Development of mobile telephony in the Netherlands

This page describes the public mobile telephone networks that were in use in the Netherlands between 1949 and 2000. All networks – with the exception of GSM – were operated exclusively by the Dutch state-owned monopolist PTT (now: KPN). KPN was privatised in 1989 — shortly before the introduction of GSM — after which other network operators were admitted to the market.


The timeline above shows which networks were in operation at any given time. The first network was the manually switched OLN, which was operational from 1949 to 1985. It was succeeded by the automatically switched ATF — similar to Cellnet in the UK — of which three generations have existed: ATF-1, ATF-2 and ATF-3. These networks were analogue and were initially not protected against eavesdropping, hacking and phreaking. In 1994, they were succeeded by digital GSM.

Note that GSM became available in Europe in 1992, but was delayed by KPN in order to get some revenues from its ATF-3 network that had just been expanded and in which KPN had heavily invested. In between ATF-3 and GSM, they also operated the short-lived Greenpoint, which was eventually also surpassed by GSM. The above listed networks are described in more detail below.

OLN
ATF-1
ATF-2
ATF-3
Greenpoint
GSM
  
OLN
Openbaar Landelijk Net

The first public network for mobile telephony in the Netherlands, was introduced shortly after WWII, in 1949. The network was operated and maintained by the (then) state-owned PTT (now: KPN), and was known as Openbaar Landelijk Net (Public National Network) — or OLN [2][3].


At its introduction in 1949, there were 22 base station that were mainly located near the larger cities. This had been increased to 35 by the time the network was completed in 1951. As nobody could have foreseen the popularity of mobile phones in later years — there were not many cars and fewer people who could afford it — the network had a capacity of ~2500 subscribers [4].

OLN was based on state-of-the-art mobile radio sets (Dutch: mobilo­foons), that operated in the 80 MHz band and were built with valves (tubes).

Being a half-duplex system, the user had to press a so-called push-to-talk button on the microphone whilst speaking. Further­more, all outgoing calls had to be patched manually by an operator. Incoming calls could only be received if the caller knew in which of the 35 areas (move over map) the mobile subscriber was located.

Users of the network had no privacy. As the 80 MHz band is at the lower end of the FM radio broadcast band, virtually everone with a regular radio could eavesdrop on the conversations. As there was no authentication, hacking was easy. Everyone with a suitable transceiver could break in and pretend to be a legitimate subscriber.

 View original map of 1949
 View original map of 1951
  
Map of the Netherlands with OLN base stations in 1949/1951. Image via sTEN [x].

When placing a call, the mobile subscriber had to switch to the appropriate channel (for the area) and press the push-to-talk on the microphone for approx. 5 seconds. This was enough to wake the operator, who would then ask for the subsriber's number and the number to be connected to. The operator then placed the call and patched it to the mobile subscriber. Interestingly, there was a three-minute limit on the duration of each call. When this time had passed, the operator would break in [2]. All calls were billed manually, which must have been a logistic nightmare for PTT.

 More about OLN on the sTEN website
 or read this article by Louis Meulstee


Known OLN mobile devices
  • PTI SRR-192
    Valves, 2 channel
  • PTI SRR-296
    Valves
  • PTI Zephyr
    Valve/transistor hybrid
  • PTI CMT
    Transistor, 8 channels
  • Storno CQM-600
    Transistor
Known OLN base stations
  • Link 1 1498
    Valves, 1 channel, 70-100 MHz, 50W
  • PTI 8RZ650
    Valves, transmitter, 1962-1986
  • PTI 8RO650
    Valves, receiver
  • Storno CQF-600
    Transistor
  1. Fred M. Link Radio Corporation [2].

ATF-1   B-Netz
On 1 March 1980, PTT launched its first automatically-switched mobile telephone network: ATF, which means AutoTeleFoon (car phone). This implied that calls no longer had to be patched by an operator. The system was based on the German B-Netz, and was compatible with the networks in Germany, Austria and Luxemburg. The network had a maximum capacity of 2500 subscribers. As it was susceptible to phone phreaking 1 , authentication was added in late 1987 to early 1988.


As the maximum capacity was reached already in 1983, PTT decided to add an extra network — named ATF-2 — of which the capacity would be larger (see below). The new ATF-2 network was launched in 1985, at the same time as the old manually-switched OLN service was terminated.

ATF, later renamed ATF-1, was a narrow­band full-duplex analogue communications system, with in-band signalling. The system worked in the 150 MHz band and was divided into three regions: north, south and west. An external caller had to dial a certain prefix, based on the area in which the mobile subscriber was located.

The mobile transceivers were so large and heavy, that they had to be mounted in the trunk of the car, with a remote control unit and the handset mounted at the dashboard. PTT subscribers had two phones to choose from: Castor – which was a rebranded AEG 4015C of the German B-Netz – and Pollux – made by US manufacturer Motorola.

As the phone could also be used in Germany, it became very popular among inland navigation skippers, for example on the river Rhine. But as the Dutch telecom law of the days prohibited the use of mobile telephones aboard a ship, this was officially illegal, and skippers risked a high fine.
  
Map of the Netherlands with ATF-1 base stations in 1980.

The ban on mobile telephones aboard ships was lifted in 1988, but at the same time the network was blocked for foreign users, in order to prevent an overload of its capacity 2 . Anyone who still wanted to use ATF-1 in any of the other countries, had to apply for a special telephone number.

Although ATF-1 was succeeded in 1985 by ATF-2 and in 1989 by ATF-3, it remained in service until 1995, mainly because of its high popularity among skippers. All these years, it was the only system that could also be used in Germany and Luxemburg. In 1994, PTT 3 had started rolling out the new pan-European GSM network, and allowed skippers one year to make the transition.

  1. Exploring a system, to understand how it works. Used – for example – to make free telephone calls [15].
  2. Probably also done to avoid phone phreaking by using foreign numbers.
  3. By then renamed: KPN.

Prefix
Depending on the area in which the mobile subscriber was (presumably) located, a caller had to dial a specific prefix. As there were 4-digit and 5-digit numbers, two sets of prefixes were used. If a certain subscriber could not be reached, the caller had to pick another prefix and try again.

Region 5-digit subscriber number 4-digit subscriber number
West 02931-xxxxx 09-311 xxxx
North 02932-xxxxx 09-312 xxxx
South 02933-xxxxx 09-313 xxxx
Eavesdropping on ATF-1
The handshake between a mobile station and the base station took place by means of in-band signalling, without any form of encryption or authentication whatsoever. This means that the subscriber number and the called (or calling) number, were transmitted over the air in clear.

This made it possible for people with a scanner and a personal computer, to monitor all traffic to and from (specific) car phones. Suitable software for a Commodore 64 computer – with an adapter for driving an external cassette recorder – was released by SPYTECH in Arnhem under the name Autotelefoon-decoder 1 (car phone decoder 1).

According to the Dutch telecom law, it is illegal to intercept and use/abuse information that is sent over-the-air and that is not intended for the interceptor, but this is usually difficult to enforce, as receivers can generally not be traced.
  
Autotelefoon-decoder (car phone decoder) software

The software was welcomed by hackers and scanner listeneners. And although it might have been useful for the police for intercepting criminal conversations, it was soon discovered by criminals, who made a living out of blackmailing people based on intercepted compromising conversations.

 More about the eavesdropping software


Clandestine use of ATF-1   Phreaking
When the subscriber rented his mobile telephone from PTT, a free mobile number was assigned and was programmed into a so-called codeplug, which was installed inside the mobile telephone by a PTT service engineer. The codeplug was a small electronic unit with a simple diode-matrix.

Hackers soon discovered the possibility to alter the code plug, so that it seemed to the network that a different subscriber number was used. This technique is known as number spoofing. It allowed the spoofer to make a call at someone else's expense, or – in case a reserved but not yet released number was used – free of charge.

All that PTT could do when malicious use of its network was discoverd, was block the number. But due to the lack of proper authentication —
IMEI
and
IMSI
numbers did not yet exist — the telephone number had to be blocked forever.
  
ATF-1 codeplug (unprogrammed)

As soon as the number was blocked, the malicious party could simply 'invent' another subscriber number, and repeat this until the database was exhausted. And to make matters worse: any new subscriber number that had not yet been released, was recognised by network as a valid one.

The hacking successes did not go unnoticed, and it wasn't before long that the criminal world started offering the hackers substantial sums of money for fully anonymous clandestine phones.

This was not simple however, as one needed a suitable telephone to start with, and PTT only rented it to their subscribers. They could not be purchased on the open market. The only way to get one, was to steal it from someone else's car. The image on the right shows an example of a stolen Pollux telephone that was converted for making clandestine calls on the ATF-1 network.
  
Modified handset of a clandestine Pollux ATF-1 car phone

The clandestine sets came in several flavours, with a preset range of telephone numbers, or with a set of 5 thumbwheels, so that the user could alter the subscriber number on the fly. Some were supplied in a large suitcase, but others came in a small briefcase for which it had to be modified.

The other PTT model – Castor – could also be put to clandestine use, as shown in the image on the right. It consists of a wide Samsonite brief­case of which most space is taken by the (large) car phone. In front of it, are the controls (left) and the handset (right). Just behind the controls is a set of five numeric thumbwheels that allow the subscriber number to be selected freely.

The clandestine telephones were used by people with relatives abroad – with whom they could make long phone calls without paying – and by people who wanted to 'stay under the radar' [13].
  
Clandestine Castor car phone (AEG 4015C) in Samsonite briefcase

The ever increasing demand from the criminal community, led to a growing number of car phone thefts — even complete cars got stolen — that peaked in 1986, prompting the police to start a national criminal investigation. Finally, in October 1986 – after many observations throughout the country – the police dismantled one criminal network and arrested 13 people in seven cities [12]. According to the PTT, the losses had accumulated to 10 million Guilders 1 by mid-1987 [13].

  1. 4.5 million Euros.

Clandestine ATF-1 phones
Hacked Castor car phone (AEG 4015C) Hacked Pollux car phone (Motorola) Hacked German Becker car phone (Telefunken)
Technical backgrounds
In the 2nd issue of the Dutch techno-anarchist magazine Hack-Tic of 1989, hackers Peter Poel­man and The Key gave a good description of how the digital signalling between the base station and the mobile subscriber took place [18]. ATF-1 used analogue in-band signalling by means of two specific tones, 1950 Hz and 2070 Hz, representing the digital values '1' and '0' respectively.

Signalling takes place by using 16-bit Cyclically Permutable Codewords (CPC), with a fixed 5-bit prefix (01110) for synchronisation and two mirrored 5-bit values for each digit:

  • 0
    0111011000000011
  • 1
    0111010100000101
  • 2
    0111010010001001
  • 3
    0111010001010001
  • 4
    0111001100000110

  • Start
    0111001000100010
  • Stop
    0111010000100001
  • 5
    0111001010001010
  • 6
    0111001001010010
  • 7
    0111000110001100
  • 8
    0111000101010100
  • 9
    0111000011011000

  • Cancel
    0111010101010101
On each free channel, a base station broadcast a continuously repeated telegram which consists of the 2-digit region code of the base station. The first digit of this code is always a '9', e.g.:

  • 95
    0111000011001010
If a mobile station wants to initiate a call, a 2070 Hz tone is sent for 600 ms, followed by a tele­gram that consists of a START command, the number of the caller (e.g. 70101) and the number of the callee, complete with the area code of which the leading '0' is omitted (e.g. 045-381977), and finally a STOP command to indicate the end of the telegram, for example:

  • START - 70101 - 45381977 - STOP
The base station replies to this by confirming the subscriber number twice:

  • START - 70101 - 70101 - STOP
When the base station has a call for mobile subscriber 70101 on channel 23, it will broadcast the following sequence on the calling channel (19):

  • 7
    0111000110001100
  • 0
    0111011000000011
  • 1
    0111010100000101
  • 0
    0111011000000011
  • 1
    0111010100000101
  • 23
    0111010020010001
When all goes well, the mobile station switches itself to channel 23 and answers the call with a continuous 1950 Hz tone (logic '1'), after which the base stations replies with the same 1950 Hz continuous tone. In the meantime, the phone starts ringing. As soon as the user picks up his handset, the mobile station switches to a 2070 Hz tone (logic '0') and the call will be patched.


Authentication on ATF-1   Bemotel
After discovery of the hacks and the subsequent arrests in the Amsterdam network, similar types of hacks started popping up in other parts of the country. In order to counter this, PTT decided to add authentication to the concept, which was done in 1987/1988. The authentication system was known as BEMOTEL. It consisted of a central server – the Temporary Authentication Register (TAR) – and a small module that was added to each mobile station – the Subscriber Identity System (SIS).


The diagram above illustrates how it worked. When initiating a call, the mobile unit sends its number to the base station, which passes it on to the TAR. When recognised, the TAR generates a random number and sends it to the mobile unit (challenge). The mobile unit does a calculation on it – in combination with its SIS – and sends the result back to the base station (response).

Meanwhile, the TAR has performed the same calculation (based on SIS data stored in its data­base). The two results are then compared. If they are identical the call is accepted. If not, it is rejected. This principle is known as challenge-response authentication [16]. It was later also used on ATF-2 and even found its way into the GSM standard, albeit in a more robust implementation.

The only weakness in the BEMOTEL system was that it was a one-way authentication system that was used on outgoing calls only (mobile originating calls). Although hackers eventually found a way around this – by making collect calls to the mobile subscriber – they were far less successful than before. But as Germany, Austria and Luxemburg did not participate in the authentication upgrade project, foreign numbers were not secured and were still susceptible to phreaking.


Known ATF-1 mobile devices
  1. Used on the German B-Netz. Not supplied by the Dutch PTT, but illegally imported for clandestine use.

Countries
  • Netherlands
  • Germany
  • Austria
  • Luxemburg

ATF-2   NMT-450
ATF-1 had a maximum capacity of approx. 2500 subscribers, which was reached in 1983, just three years after its introduction. For this reason, PTT launched a new network in 1985, named ATF-2. The network was rolled-out simultaneously in the Netherlands, Belgium and Luxemburg.


ATF-2 operated in the 450 MHz band was based on the scandinavian NMT-450 standard 1 which was also used in the Nordic countries Norway, Sweden, Finland and Denmark. It is not compatible with the Nordic system however, as it used a different channel-spacing (20 kHz instead of 25) to allow more channels and hence more subscribers. ATF-2 had limited authentication capabilities.

NMT-450 was one of the first cellular telephone networks, in which the country is divided into a series of areas (cells), much like a honeycomb, as shown in the map on the right. Initially, 50 cells were planned for a maximum number of 25,000 subscribers. This was later expanded to 120 cells for a total of 32,000 subscribers. Move over the map to see how smaller cells were used to increase the capacity of the ATF-2 network.

Unlike ATF-1, it was an analogue network with signalling through digital modems, that provided an automatic hand-over when crossing a cell border. As a result, it was no longer necessary to dial a specific area-code (prefix) for each region.

As the conversation was still transmitted in FM (analogue) however, eavesdropping remained possible by means of a simple computer scanner like the Handic 0016. This was done by criminals — for blackmailing people based on intercepted compromising conversations — as well as by the police — for intercepting criminal conversations.
  
Map of the Netherlands with ATF-2 base stations in 1985 and 1988.

Over the years, PTT introduced three mobile stations for the ATF-2 network, each supplied by a different manufacturer. They were designated CARVOX 2451, 2452 and 2453 repectively, and each model was smaller than its predecessor. The first one, CARVOX 2451, was supplied by Philips, but was in fact a rebranded 3533-2, manufactured by AP Radiotelefon A/S in Denmark.

It consisted of a large main unit that had to be mounted in the trunk of the car, whith a long thick cable running to the dashboard where the handset with built-in controls was located. It was mounted horizontally on the dashboard, so that the user was able to read the text on the buttons and on the wide liquid crystal display (LCD).

The next model – CARVOX 2452 – was supplied by Siemens and had a more elegant handset that was mounted vertically. The last model, CARVOX 2453 (shown here), was actually a Nokia Mobira RD-59 and was the first truely portable model.
  
Nokia Mobira RD-59, sold by the PTT as the CARVOX 2453

It consisted of a main unit that could be removed from the car, and was powered by an optional battery that was fitted to its right side. The handset had to be removed from the dashboard and was fitted to a magnetic cradle at the front of the main unit. This model also became a popular amateur transceiver after the ATF-2 service was terminated in 1999, as it was easily convertable.

Initially, a network expansion to 150 base stations (for 50,000 subscribers) was planned, but the plans were dropped when it became clear that with the rapidly increasing number of subscribers, this limit would have been reached by 1989. As the new pan-European GSM network (planned for 1990) was delayed by at least one year, it was decided to add an intermediate network: ATF-3.

In 1989, ATF-2 was succeeded by ATF-3 which had an increased capacity. Both networks would remain in service until long after GSM had been rolled-out, and were finally shut down in 1999. This means that ATF-2 had a life-span of 14 years, one year less that its predecessor ATF-1.

 More about the CARVOX 2453

  1. NMT = Nordic Mobile Telephone.

Clandestine use of ATF-2
Because ATF-2 featured digital signalling, the system was less prone to phreaking than ATF-1. Subscriber numbers were no longer send over the air in clear, but due to the fact that there was no form of authentication whatsoever, hacking was still possible, albeit more difficult than before.

It appeared to be impossible for the hackers to give the clandestine user full control over the subscriber number, but it was still possible to spoof numbers by adding a microprocessor to the hacked phone, which was capable of using up to 10 previously selected phone numbers.

The image on the right shows a stolen CARVOX 2451 – which is in fact an AP Radiotelefon A/S 3533-2 supplied by Philips 1 – that was modified for clandestine operation on the ATF-2 network. It is housed in a professionally made flightcase and has a built-in rechargeable 12V battery.
  
CARVOX 2451 handset and antenna

The handset is mounted at the top and an antenna should be installed on the socket at the front left. Inside the recessed part is a single-digit thumbwheel that allows selection of any of the pre-programmed subscriber numbers. When all subscriber numbers were exhaused — after PPT had discovered their use and blocked them — the user had to return the phone to the hacker to have it reprogrammed. Reportedly, some hackers ran a life-time warranty program for this service.

 More about the CARVOX 2451

  1. PTT's CARVOX 2541 was supplied by Philips, but was in fact made by AP Radiotelefon A/S in Denmark, since 1978 a Philips subsidary. in 1994, Philips sold the Danish business unit to Nokia.

Authentication on ATF-2
Shortly after the introduction of ATF-2, in mid-1986, PTT noticed a rapid increase in the illegal use of its networks, first on the ATF-1 network, and then also on the new ATF-2. This prompted them to come up with a solution, which they found in the BEMOTEL authentication system.

BEMOTEL was first implemented on the ATF-1 network, for which all mobile subscribers had to be called-in, in order to have their phones modified. PTT then had to persuade Nordic Telecom – the developers of the NMT-450 standard – to implement authentication in their standard as well. An agreement was reached and authentication was implemented in the Nordic countries as well, for which PTT provided on-line authentication, through its TAR servers in Rotterdam (Netherlands).

Once the upgrade of the ATF-1 mobile units was completed, all ATF-2 users had their phones modified as well. The same authentication system also became an integral part of the NMT-900 standard, on which the later ATF-3 network was based. PTT and Nordic Telecom insisted that a similar system had to be adopted for the GSM standard as well, which was eventually accepted by the ETSI, leading to the introduction
IMEI
numbers,
IMSI
numbers and the well-known
SIM
card.

 More about Bemotel


Countries
  • Netherlands
  • Belgium
  • Luxemburg
  • Norway 1
  • Sweden 1
  • Findland 1
  • Denmark 1
  1. The Dutch ATF-2 system is not compatible with the NMT-450 system of the Nordic countries, due to a difference in channel spacing.

Known mobile devices
Known base stations
ATF-3   NMT-900
ATF-3 was the third and last automatic analogue car phone network in the Netherlands. It was launched in 1989 as a gap-fill solution between the saturated ATF-2 network and the anticipated new digital GSM network that had been planned for 1990 but was delayed by at least one year.


ATF-3 operated in the 900 MHz band — initially reserved for GSM — and was based on the NMT-900 standard of the Nordic countries. Due to the higher frequency, more channels were available with a shorter range, which means that smaller cells could be used, as shown in the map below.

As a result, the mobile unit needed less power to reach the base station — 1W instead of 6W as with the ATF-2 network — which allowed the introduction of truely portable tele­phone sets, also known as pocket phones or hand-helds.

The network had an initial capacity of 30,000 subscribers, but this was later increased to no less than 300,000 in order to accomodate the ever increasing popularity of mobile phones. This was done by adding extra base stations, especially in the larger cities, as a result of which the distance between a base station and the mobile subscriber was reduced to approx. 3 km.

Much to dismay of KPN however, the growth of the number of subscribers halted and the total capacity of 300,000 users was never reached. This was due to the high cost of an ATF-3 sub­scription, in combination with the fact that the new GSM network had already been announced and was being implemented in other countries.
  
Map of the Netherlands with ATF-3 base stations in 1990.

So far, the ATF networks had mainly been used by business users who could afford the high cost of a subscription. In order to get some return on investment, KPN tried to make it attractive to private users as well, by marketing it at a reduced cost under the name Hi. At the same time, the introduction of GSM was delayed by another few years to persuade more people to use ATF-3. Although Hi was reasonably successful, it is un­likely that KPN ever earned its investment back, also because in 1992 they had launched the ill-fated Greenpoint mobile network (see below).

In 1994, KPN at long last started rolling out the new GSM network, two years later than the rest of Europe. As a result of this, the popularity of ATF-3 further declined. In 1999, both the ATF-2 and ATF-3 services were terminated. The older ATF-1 service had already been terminated in 1995. This means that ATF-3 had a life-span of 10 years, four years less than its predecessor ATF-2.

Eavesdropping on ATF-3
As ATF-3 is bascially an analogue network with digital signalling, very similar to ATF-2, eaves­dropping was still possible although most simple scanners did not support the higher frequency of 900 MHz at the time. As a result, ATF-3 became an interesting new way of communication for criminals, who were under the impression that their conversations could not be intercepted.

The increased use of ATF-3 mobile phones by criminal networks, soon attracted the attention of the Dutch police, who tried to find ways to eavesdrop on their conversions in order to gain evidence in a running criminal investigation.

Because of the higher number of channels on the ATF-3 network, it appeared to be difficult to find the correct channel, especially after the call was transferred to another cell. The Police Signals Service (PVD) therefore developed a scanner that was able to interpret the digital hand-over data between the base station and the mobile unit.
  
Kolibrie ATF-3 interceptor, developed by the Dutch Police

It provided the police with a gap-free intercept of the conversation, even when the parties moved between cells. The scanner – which became known as Kolibrie – contained two receivers, allowing the base station and the mobile unit to be intercepted separately. It would later become a subject of controversy, during the parlementary inquiry of the Van Traa Commission of 1995.

 More about Kolibrie


Known mobile ATF-3 devices
  • Pocketline 8000
    ?
  • Pocketline Columbus
    Motorola Micro-Tac
  • Carvox 2500
    Nokia
  • Carvox Voyager
    Nokia
Countries
  • Netherlands
  • Norway
  • Sweden
  • Findland
  • Denmark
  • Switzerland

Greenpoint
In 1992, PTT (by that time renamed: PTT Telecom), introduced the so-called Greenpoint network as an affordable alternative to the expensive ATF-3. Greenpoint — initially known as Kermit, after a popular Muppet Show character — was a digital system, based on the Cordless Telephone Type 2 (CT2) standard [6]. By 1996, at the hight of its success, the network had 60,000 subscribers.


CT2 recognised two types of network: private and public. The private network consisted of a base station that was connected to the subscribers local analogue telephone line, much like a regular cordless telephone. The public network consisted of ~5000 short range base stations, placed at strategic locations around the country, like supermarkets, airports, train stations and parkings.

Despite its technically advanced features, Green­point had many drawbacks. A subscriber had to be within 150 metres of an access point (known as a telepoint) in order to make a phone call, and – more importantly – the user could only place outgoing calls and could not be called. 1 For this reason, some greenpoint models were equipped with a built-in Semafoon (Motorola pager). A potential caller first had to send his own tele­phone number to the pager, after which the Greenpoint subscriber would call him back.

Needless to say that this was overly complicated and unnecessarily expensive. The image on the right shows a typical Kermit 2000 phone, which was made by US-based manufacturer Motorola.
  
Typical Kermit 2000 sold by KPN. Photograph via Telefoonmuseum.eu [8].

By 1998, the number of sucscribers had dropped to ~20,000, mainly because of the popularity of the new GSM network that had meanwhile been introduced in the Netherlands in 1994 (two years after the rest of Europe). On 1 January 1999, PTT terminated its Greenpoint service. In retrospect, it is difficult to comprehend why PTT ever introduced Greenpoint with all its technical limitations, whilst the digital GSM standard (to which PTT had contributed) was being rolled out elsewhere.

  1. Although incoming calls are possible in the CT2 standard, this feature was not implemented in the Netherlands and in most countries.


GSM   ATF-4
Global System for Mobile communication

In 1994, KPN introduced the fully digital GSM network in the Netherlands. GSM had originally been planned for 1990, but was delayed several times due to technical issues. Other European countries started rolling-out GSM in 1992 1 but KPN held it back for two years to get a return on investment on its analogue ATF-3 network, which had been expanded heavily a few years earlier.

Development of GSM and subsequent networks in the Netherlands

GSM – the Global System for Mobile communication 2 – is a standard developed by the European Telecommunications Standards Institute (ETSI), to describe a digital switched-circuit network that is optimised for full-duplex voice telephony, also known as 2G (second generation). In the same vain, the earlier analogue networks — such as the Dutch ATF-1, 2 and 3 — are known as 1G.

KPN initially called the new network ATF-4 — following existing naming conventions — but eventually dropped this in favour of the more universal name GSM. With the introduction of GSM, KPN (meanwhile privatised) lost its monopoly on the telecom market. The first additional provider to offer 2G in the Netherlands was Libertel (now: Vodafone).

  1. Finland was the first country to roll out GSM in December 1991.
  2. Originally: Groupe Spécial Mobile (French).

Later standards
Although initially developed as a pan-European system, GSM quickly grew out to an international standard, which even got adopted in the US. Over the years, the standard was expanded with new frequency ranges (e.g. 1800 MHz) and with provisions for data transfer, GPRS, video and internet. This led to the introduction of the 3G UMTS standard – developed by the 3GPP – and the 4G LTE Advanced standard, which are no longer part of the original ETSI GSM standard.

In 2019, steps were taken to move to the next standard which will be a broadband system known as 5G (fifth generation). It was first rolled-out in South-Korea and is backwards compatible with 2G, 3G and 4G. China has heavily invested in the developed of 5G equipment, but many countries have restricted or eliminated the use of Chinese 5G equipment because of espionage fears [10].

Security
One of the key features of GSM is the Subscriber Identity Module (SIM) – also known as a SIM card – which contains the user's identity, known as the International Mobile Subscriber Identity (IMSI). This is different from the phone's own identity, which is known as International Mobile Equipment Identity (IMEI). This allows stolen phones to be blocked without losing the telephone number.

GSM is a fully digital system that uses
CODEC
s for converting analogue speech into digital data. In addition, the digital data is encrypted with a high-end encryption algorithm that can not be broken easily (1990) but is prone to several attacks, including man-in-the-middle attacks [9]. For lawful interception, a so-called IMSI-catcher can be used for eavesdropping [11]. The encryption was initially planned to use a 128-bit key, but this was later reduced to 54 bits after intervention by the British intelligence service GCHQ. The algorithm is no longer deemed secure since 2010.

 More about GSM


Glossary
ATF   Autotelefoon
Name for the Dutch automatically-switched analogue carphone networks, of which three generations have existed (nown as ATF-1, ATF-2 and ATF-3. Succeeded in 1994 by GSM.
GSM   Global System for Mobile Communication
KPN   Koninklijke PTT Nederland
Royal PTT of The Netherlands. This was the name of the former Dutch state-owned telecom monopolist PTT after its privatisation in 1989.
OLN   Openbaar Landelijk Net
First Dutch public radio network for mobile telephony in the 80 MHz band, introduced in 1949 and operated by the PTT (now: KPN). The network was manually-switched, which means that the subscriber had to be patched by an operator. Terminated in 1985.
PTT   Staatsbedrijf der Posterijen, Telegrafie en Telefonie
Dutch state-owned telecommunications monopolist from 1881 until its privatisation in 1989. Responsible for the development and operation of the post, telegraph and telephone networks in the Netherlands. Also responsible for monitoring the radio spectrum and for enforcing the telecom laws.
References
  1. COMM (formerly: Museum voor Communicatie)
    Retrieved May 2019.

  2. sTEN, Telecom Canon 9 - Niets te gek om los te lopen
    Retreived May 2019.

  3. Louis Meulstee, Wireless for the Warrior
    1992-1994. Retrieved May 2019.

  4. Wegwijs in Frequentieland,
    Retrieved May 2019.

  5. Wikipedia, Greenpoint (telefoonnetwerk)
    Retrieved May 2019.

  6. Wikipedia, CT2
    Retrieved May 2019.

  7. Wikipedia, Autotelefoon
    Retrieved May 2019.

  8. Telefoonmuseum.eu, Kermit 2000
    Retrieved May 2019.

  9. Wikipedia, GSM
    Retrieved May 2019.

  10. Wikipedia, 5G
    Retrieved May 2019.

  11. Wikipedia, IMSI-catcher
    Retrieved May 2019.

  12. Provinciale Zeeuwse Courant, Wijdvertakte zwendelzaak met autotelefoons ontdekt
    28 October 1986, page 5.  Direct download

  13. Leidse Courant, Misbruik van autotelefoons kost PTT tien miljoen
    25 September 1987, page 3 (Dutch).  Direct download

  14. Huib Visser, Halogeenlampen, Funnyphones, Kacheltjes en Harries
    Tijdschrift van het NERG, deel 67-nr.1-2002. p. 30

  15. Wikipedia, Phreaking
    Retrieved May 2019.

  16. Wikipedia, Challenge-response authentication
    Retrieved May 2019.

  17. Wikipedia, B-Netz
    Retrieved May 2019.

  18. Peter Poelman en The Key, Autotelefoonnet 1 gehackt
    Hack-Tic Magazine, Issue 2, 1989. Page 7 (Dutch).
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Sunday 19 May 2019. Last changed: Thursday, 13 June 2019 - 12:19 CET.
Click for homepage