FCC rules in USA - Page 1
Forum section: electronics / rf-microwave

author: axemaster
author_rank: Contributor
timestamp: August 29, 2016, 04:03:22 am
content: Hi guys, I'm planning on building a consumer device that jams 315MHz frequencies in the USA, and I was hoping to get your advice on the legality of it. Here's a brief description of the device:My device (A) is designed to jam a specific target device (B), and ignore everything else. When B transmits, A detects it, makes sure that it's the target, then transmits a few blips of RF at the same frequency to ruin the transmission. By "blips" I mean only a few milliseconds at most, and this is done at legal RF power levels with legal harmonic levels, etc.Now, I don't know the FCC rules very well, but from a technical point of view I can't see any reason for this to be illegal. Since my jammer only jams when the target is also transmitting, nobody else can even tell that it exists - it causes no "harmful interference" to anything except the target. Essentially it's meant to modify the behavior of the target device in a way that's useful to the user.So what are your thoughts/suggestions?EDIT: Just to be clear, both the jammer and the target are owned by the user. This is NOT meant to be used to jam other people.

author: TheSteve
author_rank: Unknown
timestamp: August 29, 2016, 05:16:40 am
content: If it purposely jams the target then it has caused harmful interference - like it or not and even if it is your own device. I don't think you have any chance of having that approved.

author: Jeroen3
author_rank: Super Contributor
timestamp: August 29, 2016, 05:27:06 am
content: Owning an operational device which purpose it is to jam other wireless tranceivers is reason enough to make it illegal in the Netherlands.Since you must be using an unlicensed band, youdo not knowif you interfere.You can of course stay below legal emc limits. But the effectiveness will be low, you would have to be right next the the other device.

author: zapta
author_rank: Super Contributor
timestamp: August 29, 2016, 06:10:50 am
content: Try to find a more favorable view of your system. Using the word 'jamming' raise red flags.The main point is that you operate two conflicting transmitters at the same time but possibly you can position it as a 'controlled collision' or 'signal prioritization' whatever.You may need to be creating to make your solution fit laws and regulations and there are professionals that built their careers doing so.(I am not a lawyer).

author: varghese
author_rank: Newbie
timestamp: August 29, 2016, 07:26:44 am
content: Jammers are illegal everywhere FCC /ITU.. But if the signals range is within your own property , then no one can trace you or question you ..Govt agencies are using it for military , police & prison administration .. of course law is not applicable to them ..

author: Jeroen3
author_rank: Super Contributor
timestamp: August 29, 2016, 10:09:41 am
content: Are you trying to build a remote car fob inhibitor field generator?

author: b_force
author_rank: Super Contributor
timestamp: August 29, 2016, 12:08:37 pm
content: I guess if it's just an one time build (so not something for production), used on occasion, not interfering with any signals from neighbors or other people,transmitting power is limited to a small area and not being harmful to anything, I wouldn't be bothered.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: August 29, 2016, 01:15:25 pm
content: Read them yourself:http://www.ecfr.gov/cgi-bin/text-idx?SID=82cac7a3efde52796594f038b6a2f812&mc=true&node=pt47.1.15&rgn=div5Tim

author: axemaster
author_rank: Contributor
timestamp: August 29, 2016, 10:31:13 pm
content: Sorry for taking so long to reply, I just got back from work.Quote from: Jeroen3 on August 29, 2016, 05:27:06 amThe jammer will be right next to the target, within 2 meters. I am planning on transmitting the jamming signal probably at 0dBm. So the emitted signal will be well within legal limits.Quote from: zapta on August 29, 2016, 06:10:50 amYeah I was figuring I'd have to do something like this.So would I be best served by seeking out an FCC lawyer? Do such people exist? (EDIT: yes, of course they exist)

author: LabSpokane
author_rank: Super Contributor
timestamp: August 30, 2016, 12:28:27 am
content: 10 seconds of googling "FCC intentional interference" would have revealed:https://www.fcc.gov/general/jammer-enforcementQuoteIn short, don't do it. Full stop.

author: b_force
author_rank: Super Contributor
timestamp: August 30, 2016, 12:17:16 pm
content: Quote from: LabSpokane on August 30, 2016, 12:28:27 amThat's not what I am readingIn short it's only a problem when you do bring people "in danger" (bit far fetched but ok), and interfere with certain communications.So it is very clearly only about interfering with public and governmental communication and safety.So when you make the coverage area (very) small, out of the public and maybe shielded (internal), it's not really a problem, like a said before.

author: Jeroen3
author_rank: Super Contributor
timestamp: August 30, 2016, 12:29:18 pm
content: Technically you can't put people in danger by using an unlicensed band. Due to it being unlicensed air time is not guaranteed.But I'm not sure about the legality of actively marketing it as jamming device.

author: djacobow
author_rank: Super Contributor
timestamp: August 30, 2016, 04:16:42 pm
content: 47 CFR Part 15 is super complex, like most federal regulations, but the general rule is clear:15.5(b) Operation of an intentional, unintentional, or incidental radiator is subject to the conditions that no harmful interference is caused and that interference must be accepted that may be caused by the operation of an authorized radio station, by another intentional or unintentional radiator, by industrial, scientific and medical (ISM) equipment, or by an incidental radiator.If your device would interfere harmfully with another device, it would not qualify. "Harmfully" seems like the key word here. I guess if the other device is also under the control of the user and nobody would consider that interference "harmful" then maybe you could slip by. Of course, you haven't really explained to anybody here why you would want to jam the signal from another device that you control that is only a couple of meters away. But if such a situation exists, perhaps it could be ok.I actually find the second clause more interesting. What does it mean to "accept" interference. I think that is the FCC's way of saying that if you have a Part 15 device and someone else is interfering with it that it should a) not blow up and b) nobody from the FCC is going to come help you.So, in short: do not interfere, and if someone interfere's with you, too bad.

author: axemaster
author_rank: Contributor
timestamp: August 30, 2016, 05:34:32 pm
content: I see people are looking for some context, so here it is:Remote Keyless Entry (RKE) is the newer version of the radio-equipped car key. You know, where you push a button to unlock your car door. RKE is the newer variant where you pull on the door handle and the car automatically communicates with the key to authorize unlocking the door. So you don't have to pull the key out of your pocket or push any buttons etc.The trouble is that it's extremely easy to hack into this system and steal cars. The worst part being that the "stealing" doesn't look like stealing - there's no broken window or other obvious signs. So cars can be stolen in broad daylight, with nobody the wiser.So my solution is to have a jamming device, where it sits right next to the car key (like on the same keychain or in the same bag) and detects when the key is transmitting, and then jams the transmission. The user then has improved control of the RKE key fob, and it makes it much harder for someone to steal the codes and so on.

author: djacobow
author_rank: Super Contributor
timestamp: August 30, 2016, 05:46:40 pm
content: Quote from: axemaster on August 30, 2016, 05:34:32 pmI'm no lawyer, but I suspect that this, though jamming in the technical sense, probably is not jamming from a legal sense. It accomplishes the same thing as say, keeping your key in a wire mesh pouch, until you want to use it, or just removing the battery. If you want to productize this, you'll definitely want to talk to a lawyer before you expend too much effort/money. Definitely stop saying the word "jam" though. :-)

author: axemaster
author_rank: Contributor
timestamp: August 30, 2016, 06:00:20 pm
content: Quote from: djacobow on August 30, 2016, 05:46:40 pmWell, this is what Ihope. But obviously the law can be a... pain.I mean, this is why I brought it up in the first place. I'm not clear on whether this isreallyconsidered as jamming, or just one device "modifying the behavior" of another.

author: Neilm
author_rank: Super Contributor
timestamp: August 30, 2016, 06:21:58 pm
content: Any reason you don't wrap the key in tin foil?

author: djacobow
author_rank: Super Contributor
timestamp: August 30, 2016, 06:31:40 pm
content: Quote from: axemaster on August 30, 2016, 06:00:20 pmUnfortunately, I think you came to the wrong place. A bunch of engineers can tell you what happens electronically, but unless a lawyer who works in radio issues responds, I'd be wary what you hear. The only reason I responded at all is that I have a teeny bit of experience in some similar stuff and everything had to do with the _legal_ definitions of things, not their technical definitions, and the legal definitions can sometimes wander pretty far afield from the "common sense" or "technical" definitions. By the way, I just did a quick search of CFR 47 and the words "jam", "jammer", or "jamming" do not even appear in the text. So the first thing to do would be to find out what they actually do call it and then read the definition carefully. Fun times!

author: b_force
author_rank: Super Contributor
timestamp: August 30, 2016, 06:51:50 pm
content: I seriously still don't get the whole discussion.It is all about how you're gonna use it. You have to see it in perspective.As far as I understand the topic starter, it's more for accasional experiments.If so, the whole thing isn't even worth discussing about.Otherwise, worst case, just build a faraday cage around your test setup, problem solved.

author: djacobow
author_rank: Super Contributor
timestamp: August 30, 2016, 07:09:33 pm
content: Quote from: b_force on August 30, 2016, 06:51:50 pmFirst post:"Hi guys, I'm planning on building a consumer device that jams 315MHz frequencies in the USA..."consumer device means productUSA + 315 MHz means unlicensed, which means Part 15 rules.part 15 + consumer device for sale means your product needs to be authorized

author: Len
author_rank: Frequent Contributor
timestamp: August 30, 2016, 07:11:06 pm
content: Quote from: b_force on August 30, 2016, 06:51:50 pmNo, read what he wrote:Quote from: axemaster on August 29, 2016, 04:03:22 am(emphasis added)The FCC has published an FAQ about jammers:https://transition.fcc.gov/eb/jammerenforcement/jamfaq.pdfI'm no lawyer, but it seems obvious to me that they're saying that a device that deliberately interferes with communications is illegal, period.If you make one for personal use, you probably won't get caught. If you try to market such a device, you likely will get caught. If you try to get FCC certification for the device, well, good luck.

author: janoc
author_rank: Super Contributor
timestamp: August 30, 2016, 07:11:37 pm
content: Quote from: axemaster on August 30, 2016, 05:34:32 pmUhm, a FAR simpler and a completely legal solution is to keep your car key in a metal box/bag, which will prevent any transmissions getting out.Or, don't buy a car having that feature in the first place. Or install an aftermarket immobilizer and alarm system. All legal and much more effective than any jammers. And no need to deal with the FCC.BTW, the "extremely easy" part is not completely true. The one attack that has been making rounds is the "amplifier" attack - one thief has to come close to where the key is located (e.g. room in your house) and relay that signal over the distance to the car where his accomplice is waiting to steal the car. It is certainly possible and some expensive cars have been stolen like this, but it is not a very practical attack. Many cars require that the key is in the car while the engine is running as well - in that case the perps would be able to steal stuff from the vehicle, but probably not make away with the car. But that depends on how clueless (or not) the manufacturer implementing this has been.You are much more likely to have your car broken into and stereo stolen in the "old school" way than this, IMO.

author: axemaster
author_rank: Contributor
timestamp: August 30, 2016, 07:45:34 pm
content: Quote from: janoc on August 30, 2016, 07:11:37 pmThere are far more effective methods of attacking than the "two-thief" and amplifier-based attacks. I won't discuss them since I don't want them to spread, but you can probably work them out pretty easily on your own.Quote from: Neilm on August 30, 2016, 06:21:58 pmWell, you could do that and it *might* work (it's actually much less effective than you'd think), but it's still very inconvenient because you can't turn the protection off/on easily. In other words it ruins the convenience of the RKE system.

author: LabSpokane
author_rank: Super Contributor
timestamp: August 31, 2016, 01:28:47 am
content: Quote from: b_force on August 30, 2016, 12:17:16 pmOK. Submit an application to the FCC for such a device and post the response. I already know what the answer will be.

author: CJay
author_rank: Super Contributor
timestamp: August 31, 2016, 05:10:51 am
content: You could just build a class D amp and ignore the application note with regard to filtering, a 2 in 1 product.(does this guy seem familiar to anyone else or is it just my imagination?)

author: Jeroen3
author_rank: Super Contributor
timestamp: August 31, 2016, 05:51:32 am
content: Ask the dealer to turn off RKE. It's a firmware option.The immobilizer (start inhibitor?) is often an infrared signal.x-y problem once again.

author: b_force
author_rank: Super Contributor
timestamp: August 31, 2016, 11:29:01 am
content: Quote from: Len on August 30, 2016, 07:11:06 pmYes, I can read.A consumer product could also be read as a product that could be used by someone else than me (and me as in a designer who makes the product for someone, even if it's test gear). I already agreed before (as you can read) that if you're talking about something is going into production, it will be an issue.

author: b_force
author_rank: Super Contributor
timestamp: August 31, 2016, 11:40:10 am
content: Quote from: LabSpokane on August 31, 2016, 01:28:47 amIt's all about some words being used. But like said before 'harmful' is a key word.It very clearly reads that it has to be in a certain frequency spectrum/bandwith PLUS it needs to be harmful?That by definition means that if I can prove that even if I have a jammer but it isn't harmful, by using it in a faraday cage for example, which is part of the product, I haven't done anything that's illegal.In fact, from a noise (or radio sent/recive) point of view the product is non excisting. It transmits as much as a piece of wood and therefore I don't even need to aply for FCC.The difficulty is that you will need good measurements and documentation (best done by a notified body)So the question is not if a product is harmful, but HOW harmful it is. Like said before a Class-D amplifier (or a SMPS) is also harmful and can be seen as a jammer (even if that's not its the main purpose).So in other words, everything is pretty much a jammer. But some more than others.

author: CJay
author_rank: Super Contributor
timestamp: August 31, 2016, 12:29:35 pm
content: Not. At. All.Besides, if the product is inside an effective Faraday cage then the product is pointless.

author: janoc
author_rank: Super Contributor
timestamp: August 31, 2016, 01:15:56 pm
content: Quote from: axemaster on August 30, 2016, 07:45:34 pmPossibly, especially if the car manufacturer was clueless and didn't use multiple challenge/response transactions or one time codes, facilitating various possible replay attacks. You don't need to worry about "them spreading", the attacks are published - they have been at Defcon and BlackHat recently, I believe. Anyhow, the info is widely available for anyone who knows how to use Google.Quote from: axemaster on August 30, 2016, 07:45:34 pmWhat you don't realize is that that jammer you are proposing would have to be very indiscriminate - the moment it detects something on one of the assigned frequencies (these systems usually use frequency hopping, not a single fixed frequency), it would have to start jamming right away - all the while possibly interfering with someone else's key fob, garage door openers, alarm remote, etc.And if it wanted to minimize this and waited until it could positively identify the signal as coming from the key, it would likely be too late - the thief could have recorded the signal already and your subsequent jamming would be useless.In this context the tin foil would actually be a lot more effective than what you are proposing.Anyhow, you don't have to have this option active on your car or just don't buy a car with it. A good theft insurance on a new car would go a long way towards mitigating any of these issues. Also, not sure how it is in the US, but in Central/Eastern Europe where car theft is a common problem, it has been a common wisdom for a long time to not rely only on the manufacturer's lock and immobilizer, because the thieves are familiar with them and most have publicly known more or less trivial bypasses. Actually some insurance companies used to turn you down unless you have bought an aftermarket alarm.X-Y problem, indeed.

author: CJay
author_rank: Super Contributor
timestamp: August 31, 2016, 01:35:01 pm
content: Quote from: janoc on August 31, 2016, 01:15:56 pmReplay attacks work against one time codes.

author: janoc
author_rank: Super Contributor
timestamp: August 31, 2016, 02:01:39 pm
content: Quote from: CJay on August 31, 2016, 01:35:01 pmReplay attack cannot work against one time code by definition.What works is that you de-synchronize the key and the lock - by forcing the key to generate multiple codes that are not used right away (e.g. because the lock is out of range or the attacker actively jams the receiver). The attacker can then use one of these codes to open the lock and get a new "clean" code from the key (that the lock doesn't "see" and thus cannot invalidate) for the use next time. This is known as the RollJam attack, mainly used against classic keyfobs with rolling code (that's why the name).On the other hand, there are apparently recent (2006) cars on the market that don't even use a rolling code (!), so a replay attack is pretty trivial:http://calebmadrigal.com/hackrf-replay-attack-jeep/However, there are possible counter-measures against such attacks - that's why I have always said that the success very much depends on how much clueless (or not) the manufacturer implementing this was. Anyway, I think this debate is off-topic, the information about how this works is available if you want to study it:Relay attacks (and possible countermeasures on keyless entry and start systems - from 2010!):https://eprint.iacr.org/2010/332.pdfGood overview of the possible attacks and their mitigation, including the recent attack on the crypto used by the VW cars (and many of their brands):http://www.cs.tufts.edu/comp/116/archive/fall2015/arichardson.pdf

author: CJay
author_rank: Super Contributor
timestamp: August 31, 2016, 02:16:54 pm
content: Quote from: janoc on August 31, 2016, 02:01:39 pmOK, I've obviously misunderstood somewhere and I'm genuinely curious as to what I've misunderstood, why can't you jam a receiver and snag the code from the key for a one time code?Unless there's two way communication (challenge response) or the code is time sensitive it should work shouldn't it?(admittedly it'd be *very* fiddly)

author: b_force
author_rank: Super Contributor
timestamp: August 31, 2016, 03:14:47 pm
content: Quote from: CJay on August 31, 2016, 12:29:35 pmPointless?Depends what you wanna do with it and how big the cage is.I have seen cages as big as a small house.These kind of jammers were used (and needed) for testing and troubleshooting certain products.

author: CJay
author_rank: Super Contributor
timestamp: August 31, 2016, 03:30:16 pm
content: Quote from: b_force on August 31, 2016, 03:14:47 pmYou're going to look rather odd driving a Faraday cage around.

author: Neilm
author_rank: Super Contributor
timestamp: August 31, 2016, 06:37:19 pm
content: I've just checked the manual for a Toyota with that entry system. The system can be turned off at the key and in the car so it will only work on the button as per any other remote unlock system

author: janoc
author_rank: Super Contributor
timestamp: September 01, 2016, 10:37:54 pm
content: Quote from: CJay on August 31, 2016, 02:16:54 pmThat's the RollJam attack I have mentioned. That is, strictly speaking, not a true replay attack, because no code is ever used multiple times to open the lock. The idea of a replay attack is that you capture some signalwhile it is being usedand then use it again to reproduce the desired behavior without the original key. That obviously doesn't work if a true one time code (e.g. a rolling code) is in use, because the receiver will detect the code as having been used before and rejects it.That is a bit simplified, because there is the whole transmitter/receiver synchronization issue - the receiver must handle even a situation when some codes in the sequence are skipped (e.g. because the transmitter has been activated while out of range or jammed) and there must be a way to ensure that the two can resynchronize again should the key get wildly out of sync (someone kept pressing the button on the fob, the battery died, new key, etc.). Some cars synchronize the keys every time when they are inserted in the ignition, with others you have to go through some special manual procedure should the key get out of sync for whatever reason.That Jeep hack I have linked to is a replay attack - it works only because that car doesn't use even something so basic as a rolling code.QuoteYou do realize that a Faraday cage can be simply something like this:http://www.idstronghold.com/,right?Or even the proverbial Altoids tin or that aluminium foil. There is no need for it to be a literal cage.

author: Jeroen3
author_rank: Super Contributor
timestamp: September 02, 2016, 07:11:40 am
content: I think Mercedes can also disable the RF part and only work on IR. (IR receiver next to door handle)If anyone want to steal your code they have to be nearby enough that it would cause suspicion.

author: CJay
author_rank: Super Contributor
timestamp: September 02, 2016, 08:24:30 am
content: Quote from: janoc on September 01, 2016, 10:37:54 pmI do indeed, but the post I replied to suggested encasing the entire car and key inside a Faraday cage, that'd be rather a lot of aluminium foil and would look a little odd.I genuinely don't understand why a one time code could be rejected by the car if, as far as the car is concerned, it's never been presented to the car unless there's a challenge-response handshake mechanism in play or the codes are somehow dependant on key and receiver being time synchronised (like the RSA ID tokens for instance)?I'm perfectly happy to accept that my logic is flawed and would welcome an explanation other than 'it's a one time code'.

author: b_force
author_rank: Super Contributor
timestamp: September 02, 2016, 10:23:02 am
content: I don't know how people read posts, but I never ever suggested that at all.I was just talking about FCC in general. It's to the creativity of the developer to find out what works in his case.

author: CJay
author_rank: Super Contributor
timestamp: September 02, 2016, 11:50:50 am
content: Quote from: b_force on September 02, 2016, 10:23:02 amMea culpa, my bad, I didn't get my point across.The 'pointless product' comment was intended to convey that having the key in a Faraday cage would stop it communicating with anything so it rendered the jammer pointless.To effectively stop the key being 'sniffed' but allowing the key to still open the car would need the car and key to be inside such a cage, hence it'd look rather odd to be driving a Faraday cage around.After this, I give up.

author: janoc
author_rank: Super Contributor
timestamp: September 02, 2016, 12:40:31 pm
content: Quote from: CJay on September 02, 2016, 08:24:30 amYour logic isn't flawed, but you have missed my point. What you are describing happens during the RollJam attack. My point was that it is not a true replay attack because no key is being reused, not that it doesn't work. So it is not a good argument if you want to claim that one time codes are breakable using replay attacks - as there is no replay attack here.

author: CJay
author_rank: Super Contributor
timestamp: September 02, 2016, 01:14:58 pm
content: Ah, gotcha.For the life of me I could not see (other than technical issues with jamming/receiving keys) how it would fail on a theoretical level.I don't seem to be covering myself in glory in this thread as I misused 'replay' in terms of the documented attacks and used it to mean the hacker would replay a recorded but unused key, not a previously used and accepted key.