We seek to understand and document all radio transmissions, legal and otherwise, as part of the radio listening hobby. We do not encourage any radio operations contrary to regulations. Always consult with the appropriate authorities if you have questions concerning what is permissible in your locale.

Author Topic: TDoA Questions & maybe an article?  (Read 2359 times)

Offline Andrew Yoder

  • DX Legend
  • ******
  • Posts: 2129
    • View Profile
    • Hobby Broadcasting Blog
    • Email
TDoA Questions & maybe an article?
« on: December 30, 2019, 1626 UTC »
I've been working on the Pirate Radio Annual; it's going to be a long haul & I'm nowhere close to finished with it. I've just been starting to think about articles, etc. for it. One that I was thinking about was TDoA and if any measures can be taken to skew the results.

Would an article on this topic be of interest? If so, have any station operators experimented with TDoA and would any be interested in contacting me with information (to be used anonymously)?

Aside from broadcasting from locations where the signal can't be received by any of the participating online receivers, it seems that the best ways to intentionally alter the DF results would be to either:

* use two transmitters on exactly the same frequency from somewhat different locations that are fed with an Internet audio feed to keep the audio in sync
* use an AM transmitter in one location to lay down a carrier on a frequency and an SSB transmitter in a different location to modulate the carrier

Other less active possibilities seem to be:

* use of frequencies with a smaller ground wave
* use of antennas with low-angle radiation
* use of directional antennas

So I also wonder about the general accuracy of the TDoA results while just simply broadcasting on 43m with dipole or a nondirectional antenna. Has anyone noticed that the results are more or less accurate on different frequencies (e.g., 4 MHz vs. 6.9 MHz, etc.)? Any other variables?

Again, I'm interested in opinions, both whether this topic seems worth pursuing and, if so, any information on the topic. You can either contact me via an HFU message or at ayoder /at/ hobbybroadcasting /dot/ com
Please QSL to: POB 109, BRS, PA 17214
Hobby Broadcasting Blog: http://hobbybroadcasting.blogspot.com/
Drake R8, AOR AR-7030, R-390A, R-388, SX-28A, Philco 44 + some others    Horizontal loops & 1/2-wave inverted V

Offline ChrisSmolinski

  • Administrator
  • Marconi Class DXer
  • *****
  • Posts: 31105
  • Westminster, MD USA
    • View Profile
    • Black Cat Systems
Re: TDoA Questions & maybe an article?
« Reply #1 on: December 30, 2019, 1753 UTC »
TDoA's accuracy is IMHO highly overrated. I am not sure why it would be a concern to pirate operators, the FCC has significantly better technology (as has for a long time).

So how good is it? It.... depends.  TDoA stands for Time Difference of Arrival. The time delay/difference for the target station is compared for several receiving stations. Knowing the speed of light, you can compute the distance to the target station from the receiving stations and locate the transmitter. Your error depends on how accurately you can measure the time difference, as well as any propagation effects that affect this.

For starters, it depends a lot on how careful you are in selecting the KiwiSDR receiving stations. Ideally you want to select several that surround the target station, at an appropriate distance (which is going to depend on the frequency, and what the current propagation conditions are).  This means that in order to select the receivers, you need to... know where the transmitter is located  :)   Or at least have a rough guess. You can then iterate by selecting new receivers and removing existing receivers. Ideally by seeing how closely they converge on... where you know the transmitter is located  :)  Noticing a trend here?  You can also look for a reduced spread in errors if you don't know where the transmitter is located.

As I said, it is an iterative process. It's also a bit of an art, learning how to select receivers based on the target, frequency, etc. If you don't know what you're doing, you can select some receivers, punch the button, and hope for the best. Sometimes you get a very good result, within 50 miles or even better. Or maybe it is off by 500 miles.  Try again. If you know where the transmitter is, you'll eventually get it  :)

I've done lots of TDoA runs, on SWBC and utility stations, as well as, by request of the operators, some pirates. They were curious how good it is. Sometimes very good. Sometimes laughably bad. 

To be honest, even prior to TDoA, you could figure out about where a pirate is located, based on general propagation knowledge and several reception reports. This makes it easier for others to do it as well (to the same hundred or so mile accuracy) but does not iMHO really change the game too much. As I like to joke "Propagation gives your location away".

What to do if you're paranoid about it? Have a drink.

What to do if that didn't work? Can you spoof it? Well yes, to some degree.  My off the cuff thoughts about the ideas:

Quote
* use two transmitters on exactly the same frequency from somewhat different locations that are fed with an Internet audio feed to keep the audio in sync

The time delays due to propagation are going to cause all sorts of problems, resulting in an unlistenable signal.  Now, if you completely switched between transmitters every few seconds, you would probably screw up TDoA enough, and maybe not cause too much of a problem for listeners? If it was SSB anyway. Seems like a lot of effort, though.

Quote
* use an AM transmitter in one location to lay down a carrier on a frequency and an SSB transmitter in a different location to modulate the carrier

Might work in theory, if the carrier is stronger than the SSB signal. Which it may be for some receivers, but not for others. I guess this could slow down some would be TDoAers, but I don't see it being that effective.

Quote
Other less active possibilities seem to be:

* use of frequencies with a smaller ground wave
* use of antennas with low-angle radiation

TDoA works with sky waves, it does not rely on ground waves.

Quote
* use of directional antennas

You're still going to light up enough receivers for TDoA to work. As well as TDoA works  :P

There's one idea I can think of that might work - use very low power. The weaker you can make your signal, the larger the TDoA error will be. Probably not an ideal solution, however.

I understand the concern operators have... but think TDoA may be overrated. It's not helping the FCC. I guess if an operator is really concerned about listeners knowing roughly where they are located (as in, in one of these states here, or maybe one of those states over there...) it may be an issue. 
« Last Edit: December 30, 2019, 1811 UTC by ChrisSmolinski »
Chris Smolinski
Westminster, MD
eQSLs appreciated! csmolinski@blackcatsystems.com
netSDR / AFE822x / AirSpy HF+ / KiwiSDR / 900 ft Horz skyloop / 500 ft NE beverage / 250 ft V Beam / 58 ft T2FD / 120 ft T2FD / 400 ft south beverage / 43m, 20m, 10m  dipoles / Crossed Parallel Loop / Discone in a tree

Offline Josh

  • DXing Phenomena
  • *******
  • Posts: 4322
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #2 on: December 30, 2019, 2223 UTC »
I suspect the only real way to obfuscate is with multiple tx sites that are gps timed to be offset/skewed so as to smear the tdoa results. I doubt it would sound very good. Think of it as a modern day conelrad but for pirates!
« Last Edit: December 30, 2019, 2300 UTC by Josh »
We do not encourage any radio operations contrary to regulations.

Offline NJQA

  • Sr. Member
  • ****
  • Posts: 321
  • Virginia
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #3 on: December 31, 2019, 1303 UTC »
The other factor I didn’t see mentioned is where some receivers are getting single hop reception and others are ground wave or multiple hops.  That will impact the position estimate unless the TDOA algorithm corrects for that.

The varying height of the reflecting ionosphere (which can be different for each receiver site) impacts the accuracy.  Picking receiver sites on either side of the day/night terminator could have an impact on accuracy. If you could get receiver stations that all heard the xmtr via ground wave then the position estimate could be very good...but you already have a good idea of where they are then don’t you?

Chris is right - modern day DF networks will spit out a lat/lon on a station in a fraction of a second. I imagine the biggest delay is just ensuring that all stations in the network are hearing the same station. All that is left at that point is to send a van through the area and find the specific house. If the FCC wants you, they can find you with little effort.

The biggest issue for pirates would be hobbyists doing their own DF work, getting a good location, publicizing their results, and drawing attention from the FCC. 

“The nail that sticks out is the one that gets hammered.”

Offline Josh

  • DXing Phenomena
  • *******
  • Posts: 4322
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #4 on: December 31, 2019, 2246 UTC »
I'd be more worried about some nut showing up at the door than the fcc.
We do not encourage any radio operations contrary to regulations.

Offline Token

  • Global Moderator
  • DX Legend
  • *****
  • Posts: 2118
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #5 on: January 01, 2020, 1435 UTC »
I've been working on the Pirate Radio Annual; it's going to be a long haul & I'm nowhere close to finished with it. I've just been starting to think about articles, etc. for it. One that I was thinking about was TDoA and if any measures can be taken to skew the results.

Are you specifically talking about impacting the ability of hobbyist or hobby networks like the Kiwi TDOA plug in?  Or are you worried about professionals?

At the hobby level you may be able to reduce the accuracy, but probably not at the professional level.

* use two transmitters on exactly the same frequency from somewhat different locations that are fed with an Internet audio feed to keep the audio in sync
* use an AM transmitter in one location to lay down a carrier on a frequency and an SSB transmitter in a different location to modulate the carrier

The multi transmitter solution has the most probability of success, as long as they are all the same mode.  What is that going to do to the audio though?  Propagation delays will produce echoes, even if the audio starts out in sync.

Use of an AM transmitter combined with an SSB signal will not prevent or degrade TDOA.  For the purposes of TDOA you can ignore (in fact, most hobby based applications probably do this) the carrier as it has no easily / grossly identifiable features.  Instead you look only at the modulation and you correlate events in the modulation between the samples taken.

Other less active possibilities seem to be:

* use of frequencies with a smaller ground wave
* use of antennas with low-angle radiation
* use of directional antennas

Short of reducing the area over which a transmission is heard none of these will be useful.  TDOA works regardless of the propagation technique, direct path, ground wave, sky wave, short of backscatter there is little that can be done there.  Direct path may be the most accurate, but good results can be achieved with any kind of propagation that does not involve angular multipath or backscatter.

So I also wonder about the general accuracy of the TDoA results while just simply broadcasting on 43m with dipole or a nondirectional antenna. Has anyone noticed that the results are more or less accurate on different frequencies (e.g., 4 MHz vs. 6.9 MHz, etc.)? Any other variables?

The accuracy of Kiwi type TDOA applications is highly variable.  The accuracy of professional systems much less so.

Professional sensors can use TDOA or combinations of TDOA and other techniques to plot the source of a transmission at significant distances to very small areas.  I have used TDOA and other passive systems capable of plotting the position of a target at 10's of km to within a few meters, at hundreds of km to within a large city lot, and at thousands of km to within a few miles.

Long range TDOA, thousands of km, gets you close, short range TDOA or other techniques get you exact.


TDoA's accuracy is IMHO highly overrated. I am not sure why it would be a concern to pirate operators, the FCC has significantly better technology (as has for a long time).

<<<<snip some relevant stuff>>>>

As I like to joke "Propagation gives your location away".


I 100% agree when you are talking about hobby TDOA like the Kiwi system.

And yes, it has always been possible to get a good idea where an operator was, at least to the general region.  With that information, and if you really wanted to invest the time and expense, you could use other techniques to find the exact location.

Since hobby TDOA became widely available I have plotted, for my own information, the majority of pirates I have heard on HF.  I have not shared those results with anyone, and see no reason to, but in general there have been very few surprises, most of the ops appear to be transmitting from about the locations I previously thought.  The availability of TDOA generally has not revealed ops locations to me that I did not already suspect.

There's one idea I can think of that might work - use very low power. The weaker you can make your signal, the larger the TDoA error will be. Probably not an ideal solution, however.

Distributed low power transmitters, a network of multiple transmitters working at low enough power to not deliver usable energy to more than a couple of TDOA nodes, would work, but is not practical in this application.

If no more than 2 TDOA nodes can receive a given signal you cannot resolve its location.  If the third node is receiving the, seemingly, same signal (or two versions of the same signal, one weak and one significantly stronger) from a different transmitter location then the plotted results will be garbage.

I understand the concern operators have... but think TDoA may be overrated. It's not helping the FCC. I guess if an operator is really concerned about listeners knowing roughly where they are located (as in, in one of these states here, or maybe one of those states over there...) it may be an issue.

This.  Professional facilities already have (and have had for some time) the ability to plot with far greater accuracy than the hobby TDOA systems like Kiwi can deliver.  The hobby TDOA solutions just bring a "lite" version of that technology to the common man.

If anyone with nation-state pockets is looking at you they will find you, the question is do they have the time, manpower, or desire to look for you?

The other factor I didn’t see mentioned is where some receivers are getting single hop reception and others are ground wave or multiple hops.  That will impact the position estimate unless the TDOA algorithm corrects for that.

The varying height of the reflecting ionosphere (which can be different for each receiver site) impacts the accuracy.  Picking receiver sites on either side of the day/night terminator could have an impact on accuracy. If you could get receiver stations that all heard the xmtr via ground wave then the position estimate could be very good...but you already have a good idea of where they are then don’t you?

Only if you are trying to get accuracy measured in a few km at extended distances.

And that is a key.  No TDOA system, pro or otherwise, in one plot yields a street address at thousands of km distances.  But it can get you to within direct path or ground wave receive distances from that far.  Then stage 2 is getting to that approximate location and using local techniques (can be TDOA also, or maybe just AOA).  Of course, if you start in the general area and know you are there (say by propagation characteristics) then local techniques can be used initially.

T!
T!
Mojave Desert, California USA

Offline KaySeeks

  • DX Legend
  • ******
  • Posts: 1246
  • Quebec. Vive la différence.
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #6 on: January 01, 2020, 2134 UTC »
Professional sensors can use TDOA or combinations of TDOA and other techniques to plot the source of a transmission at significant distances to very small areas.  I have used TDOA and other passive systems capable of plotting the position of a target at 10's of km to within a few meters, at hundreds of km to within a large city lot, and at thousands of km to within a few miles.

I worked on some tech that, once I was allowed to see how it worked and the results, was very surprising to me. That was the type of stuff that if I were a pirate, I might worry about. That was decades ago. Kiwi TDoA is not as good as what I was seeing then and consider that the world has moved on since then. You get the idea.


The multi transmitter solution has the most probability of success, as long as they are all the same mode.  What is that going to do to the audio though?  Propagation delays will produce echoes, even if the audio starts out in sync.

Since we are talking about potential countermeasures, here's some spew of (un)conciousness from me:

1) Perhaps one way would be to set up a triangle or polygon of low-power "confusion transmitters" in the ground wave area around the real TX, so that when they actually come near you to triangulate your exact location, there is some error introduced into the determination. Throw in some random amplitude and phase modulation onto the confusion transmitter signal. The effectiveness would greatly depend upon many variables. Think of this as "local jamming" or akin to a fighter aeroplane throwing out heat-producing chaff to confuse the infra-red detection systems of oncoming missiles. Obviously this would be wholly inappropriate for low-powered, non-HF pirates where local reception is desired.

2) Here's a real brain fart: if you could have one TX producing NVIS (Near Vertical Incidence Skywave, bouncing off the F2 layer and coming straight down) and simultaneously another TX producing a "normal" (non-vertical) skywave signal, this might introduce enough "confusion" local to the TX. However: a) finding a single frequency where  both NVIS and normal skywave work simultaneously would seem fundamentally impossible. b) It might be unpleasant for many listeners. (See Token's comments above.) Like I said, this is a brain fart.
« Last Edit: January 01, 2020, 2137 UTC by KaySeeks »
Just somebody with a radio, a computer and a pair of headphones...

Offline Andrew Yoder

  • DX Legend
  • ******
  • Posts: 2129
    • View Profile
    • Hobby Broadcasting Blog
    • Email
Re: TDoA Questions & maybe an article?
« Reply #7 on: January 03, 2020, 0056 UTC »
Thanks to everyone for the insights. I'm always blown away by the amount of talented people with great information on the board.

Yeah, my primary Q about this is in regard to the general public DFing people, not any government agencies. As Josh said, "I'd be more worried about some nut showing up at the door than the fcc." I think that's the thought process of many people over the past five or ten years, whether because they view the private person's visit as leading to an online (or on-air) rampage or a pin through the coax . . . or that it will cause an FCC visit.


Please QSL to: POB 109, BRS, PA 17214
Hobby Broadcasting Blog: http://hobbybroadcasting.blogspot.com/
Drake R8, AOR AR-7030, R-390A, R-388, SX-28A, Philco 44 + some others    Horizontal loops & 1/2-wave inverted V

Offline ChrisSmolinski

  • Administrator
  • Marconi Class DXer
  • *****
  • Posts: 31105
  • Westminster, MD USA
    • View Profile
    • Black Cat Systems
Re: TDoA Questions & maybe an article?
« Reply #8 on: January 03, 2020, 1309 UTC »
Thanks to everyone for the insights. I'm always blown away by the amount of talented people with great information on the board.

Yeah, my primary Q about this is in regard to the general public DFing people, not any government agencies. As Josh said, "I'd be more worried about some nut showing up at the door than the fcc." I think that's the thought process of many people over the past five or ten years, whether because they view the private person's visit as leading to an online (or on-air) rampage or a pin through the coax . . . or that it will cause an FCC visit.

There have indeed been some online and on-air rampages. The nuts in question were operators, not listeners, who attacked quite a few listeners and even some fellow operators. Fairly well documented at the excellent http://whisperinyourfear.blogspot.com/ site.

Even if they "officially" try to keep a low profile of their private information, many operators and listeners still share personal info with trusted fellow hobbyists. Sometimes this info leaks out to a wider audience. Quite a few operators "give away" their identity on the air (you can compare things they say/do on the air as well as online postings by people with their real name or at least a well known pseudonym and often figure out hey, they're the same person).

Social engineering is a much easier and more effective way to figure out who is running a particular station, or who is really behind an online pseudonym.  TDoA is by comparison the hard way to figure this out  ;D

Chris Smolinski
Westminster, MD
eQSLs appreciated! csmolinski@blackcatsystems.com
netSDR / AFE822x / AirSpy HF+ / KiwiSDR / 900 ft Horz skyloop / 500 ft NE beverage / 250 ft V Beam / 58 ft T2FD / 120 ft T2FD / 400 ft south beverage / 43m, 20m, 10m  dipoles / Crossed Parallel Loop / Discone in a tree

Offline Josh

  • DXing Phenomena
  • *******
  • Posts: 4322
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #9 on: January 04, 2020, 2327 UTC »
Perhaps the description "nut" was a bit harsh and judgemental in my previous post, a less pejorative term might be "unexpected guests".

:D

Also, with the tech they (they meaning gov agencies) use today, you key up and they have you because they record the entire spectrum and save it all as if they were a multitrilliondollar smolinksi with 24/7/365 hard drive space. The question isn't does the fcc know it's me and where I am, the question of import is; is the fcc interested enough to pursue me.
« Last Edit: January 04, 2020, 2333 UTC by Josh »
We do not encourage any radio operations contrary to regulations.

Offline redhat

  • DX Legend
  • ******
  • Posts: 1585
  • USA
  • Music is my drug.
    • View Profile
    • Email
Re: TDoA Questions & maybe an article?
« Reply #10 on: January 04, 2020, 2348 UTC »
All the more reason to approach this hobby with some level of professionalism.  If you don't give people a reason to complain or hold a grudge, all the better.

+-RH
Somewhere under the stars...
Airspy HF+, MLA-30/Mini-whip/Chi-Town Loop
Please send QSL's and reception reports to xfmshortwave [at] proton [d0t] me

Offline Ray Lalleu

  • Marconi Class DXer
  • ********
  • Posts: 36230
  • Western part of France
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #11 on: January 05, 2020, 0003 UTC »

Since we are talking about potential countermeasures, here's some spew of (un)conciousness from me:

1) Perhaps one way would be to set up a triangle or polygon of low-power "confusion transmitters" in the ground wave area around the real TX, so that when they actually come near you to triangulate your exact location, there is some error introduced into the determination. Throw in some random amplitude and phase modulation onto the confusion transmitter signal. The effectiveness would greatly depend upon many variables. Think of this as "local jamming" or akin to a fighter aeroplane throwing out heat-producing chaff to confuse the infra-red detection systems of oncoming missiles. Obviously this would be wholly inappropriate for low-powered, non-HF pirates where local reception is desired.

That  was used in England during the WWII to confuse the German planes: small transmitters at a distance from the main ones, to fool the goniometers aboard the German planes.

2) Here's a real brain fart: if you could have one TX producing NVIS (Near Vertical Incidence Skywave, bouncing off the F2 layer and coming straight down) and simultaneously another TX producing a "normal" (non-vertical) skywave signal, this might introduce enough "confusion" local to the TX. However: a) finding a single frequency where  both NVIS and normal skywave work simultaneously would seem fundamentally impossible. b) It might be unpleasant for many listeners. (See Token's comments above.) Like I said, this is a brain fart.

This is easy to imagine. If a Dutch pirate wants only to be heard in NL and Be, he can use NVIS with a well selected antenna, then choose a channel permanently used by a mid-level Stanag transmission. At short distance, his signal will be stronger than the stanag, but at any longer distance, the TDOA will be jammed. The TDOA and DF can't be be accurate on a sky wave when the distance is less than the height of the ionized layer.

 But the agency can use many many remote SDRs to find the station by direct or surface wave.  Those SDRs are easy to place almost anywhere, much easier than any DF system.

So, what antennas are really good  for NVIS without some vertically polarized wave spreading around ? And I would like to know if the agencies have already used any drone ?
 
D/E/F/G/It/Sp : Dutch/English/French/German/Italian/Spanish
+/- : about 0.02 offset, ++/-- 0.03/0.04 offset
Balanced wire antennas, wire lines and ATU
***** Mes pages OEM sont bloquées par "le club", alors pour les recevoir, joignez-moi par les autres membres ****

Offline Josh

  • DXing Phenomena
  • *******
  • Posts: 4322
    • View Profile
Re: TDoA Questions & maybe an article?
« Reply #12 on: January 05, 2020, 0100 UTC »
For nvis, a dipole only a foot or two off the ground will do.

There are some crazy nvis designs out there;
http://on5au.be/content/ao/ao12.html
http://duvalaresjax.org/wp-content/uploads/2019/09/nvisBook.pdf
http://arrl-ohio.org/SEC/nvis/nvis.pdf



We do not encourage any radio operations contrary to regulations.

 

HFUnderground T-Shirt
HFUnderground Garden Flag
by MitchellTimeDesigns