lago

2G/GSM-3G/UMTS-4G/LTE
Semi-Active Tactical System

The LAGO is an off-the-air tactical

interception system for 2G/3G/4G GSM
Cellular Networks.

The LAGO system intercepts and records

voice calls, text messages (SMS) and DTMF
tone from and to the target (incoming and
outgoing calls) in the cell.

During a conversation, both sides (persons)

are listened in excellent quality.

As the LAGO is an active system, it is proved totally transparent and undetectable neither by the mobile
operator (MO) nor by the target itself. The LAGO operates in Random mode as well as in Target mode.
It can filter, track and record only the target operation.

REAL TIME MONITORING AND CONTROL

• IMSI/IMEI CATCHER ABILITY

• A5.1, A5.2 AND A5.3 ENCRYPTION SUPPORT
• UNLIMITED NUMBER OF REGISTRED TARGETS
• FULL 2G (850, 900, 1800, 1900) SUPPORT
• BOTH SIDE OF CONVERSATION (FULL DUPLEX)
• ADJUSTABLE POWER OUTPUT
• PROPRIETARY WIRELESS TECHNOLOGY
• READY FOR USE BOTH AS A STATIONARY (VEHICLE OR OFFICE) AND AS FULLY PORTABLE SYSTEM
• 3G (850, 900, 1700, 1900, 2100) BTS OR JAMMER
• 4G (700, 1800, 2100, 2600 OR 700, 850, 1700, 1900) BTS OR JAMMERS
• COMPACT AND TRANSPORTABLE
• EASY TO USE / FRIENDLY GUI
• GPS POSITIONING
• SELECTIVE JAMMING OPTION
• FULLY TRANSPORENT
• OSINT EMBEDDED FEATURE

For Law Enforcement Agencies only and subjected to export licenses approval
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

ADVANTAGES

• Intercepts and records all outgoing/incoming calls, voice, supplementary service and SMS
• All target calls are registered in the Mobile Operator (MO) billing systems
• Pass the caller ID to the target mobile phone.
• All traffic (voice and data) is fully encrypted in the air.
• Multi MO functionality
• Easy change of Mobile Operator by changing a parameter only
• Interception distance up to 1Km,
• Interception operation starts in less than 15 seconds
• Correlation tools to detect targets
• Analysis tools to search for events
• VPN configuration allows operation in different locations and common control center.
• Operate with GSM DF system – Remote silent activation of a target
• Remote operation – controlling of interception mission via Internet
• Target communication manipulation: Block, redirect or change information to/from the target.
Change SMS content, Voice call manipulation
• Tracking cell information
• Accurate GPS target positioning using combination of both mobile phone and BTS data
• IMSI/IMEI identity correlation features
• Public Number (PN) detection
• Distant microphone activation
• Real-time database storage
• One GUI interface for full system operation and control
• Special priority algorithm forcing mobile phones to make a fast registration on the system

OPTIONS AND EXTRA FEATURES

Power Amplifier: The LAGO can be coupled with a special Power

Amplifier and very high gain antenna increasing its range of
operation to up to 2 Km (depending on the topography).

Jamming Unit: For some applications, there is an option to order

our High Power Single band 3G/4G jammer instead of 3G/4G
IMSI catcher unit to force subscribers cell phones to downgrade
to the frequencies covered by the system.

Target Direction Finder: Vehicular DF subsystem

Target Direction Finder: Homing system

Wireless Split Operation: controlling remote interception

points via special wireless communication units

Mobile casing: Fully portable installation with wireless

connection, batteries and antennas in one compact back-pack
case
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

LAGO - OVERVIEW

LAGO PURPOSE

• Real-time detecting of 2G, 3G and 4G GSM-standard mobile phones, located within the zone controlled by
the System,
• Collecting the information from the mobile phones in the area
• Downgrading the phones using 3G/UMTS and 4G/LTE standards to 2G/GSM operation mode to provide full
interception
• Registering and recording all traffic (incoming and outgoing communications) from these mobile phones
• Manipulating the state of mobile phones, which have been registered by the system.
• The System operates in stealth mode in GSM networks, which use various encoding types (А5.2, А5.1, A5.3)

LAGO SYSTEM SUPPORTS

• Defining mobile phone key parameters - IMSI, IMEI, Kc, Public Number, etc., that are required for System
operation.
• Full mobile phone incoming and outgoing traffic control within the System’s reach zone;
• Manipulating the state of mobile phones, including the possibility of identifying the location of a mobile
station (target) by activating its GPS receiver and remote silent microphone activation
• Calls and SMS from and to target using any identity

LAGO RANGE

The default LAGO system configuration supports up to 1 Km operation and it can be easily increased up to 2
Km using long-range option. The actual system range will be depending on the environment where it is being
used. Typically, in a heavily built-up urban area the range will be about 150 meters that is because BTS in an
urban area covers small area influence on the real capture area of the LAGO system. In more open areas where
the cell coverage area is larger the actual interception distances.
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

LAGO SPECIAL FEATURES

• The LAGO system can perform several manipulations to provide more information about the targets.
o Enable/disable incoming or outgoing calls / SMS
o Send SMS or make a call to a target or to other party via the system
o Change the content of the SMS before it goes to the target
o And more

• The system can force the activation and the transmission of the target phone to feed the Direction
Finder (DF) system

• Early Kc evaluation. Helps to shorten the authentication call process.

• Force the target mobile phone to a certain ARFCN traffic channel to correlate with DF system

• The system shows constant indications of the reception level from the Mobile subscriber as well as
constant level display of the BTS.

• PLMN detection – The LAGO includes a very important function that is called "Get Public number". It
detects the Mobile Subscriber telephone number (PLMN number) by capture its number when sending
the Caller ID over hidden incoming call.

• Tracking and analysis tools by saving subscribers lists that include fade out subscribers, rejected
subscribers and “target presence " subscriber lists,

• Target history tracking list - to view the information stored in the database on a subscriber with IMSI
identification

• Backup utilities - Convert Voice recording to standard .WAV files to be recorded on removable storage
media. Database can be exported due to Microsoft Access MDB format.

• Intelligence Analysis functions helps the operator to search for specific conversation or SMS. The
operator can apply many filters to search for an event. SQL query language also provide means to search
for events
Easy way to detect if Target replaces SIM cards. Each HLR list displays the IMSI (SIM ID number) and the
IMEI (Equipment Id number). Using the correlation function the operator finds the changes of new
IMSI/IMEI combinations.

• The system applies transmission level control to determine the TX level of the BTS.

• Intelligence gathering when the target does not participate in incoming/outgoing calls (call standby).

• Quick Mobile Operator change. The operator may change to a new operator by changing the LAI (MCC
+ MNC) in the system BTS parameters setup.

• VPN connectivity with AS that will be located in area which supports open mode operation

• Connection to internal A5.1 decipher, Optional External server (not include in the price) can provide
service to several systems.
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

LAGO – OPERATING MODES

“CATCHER” MODE
• IMSI and IMEI catching. (Secretly obtaining mobile station main identification parameters (IMSI, IMEI,
TMSI, Kc etc.).

• Detection, controlling of mobile stations entering and leaving, turning the power on and off in the
System's coverage zone.

• Preventing operation of a certain mobile station (Target) or of station groups, which are in the System's
coverage zone.

The System initializes the operation of the base station. Thus, one cell is formed (further - internal network)
for which the MCC, MNC and ARFCN values will correspond to the parameters of a cellular communication
operator, operating in a given district (further - external network), and the LAC is set to a different value from
what is used in the real network. The mobile phones, which are within its operation radius (further -
subscribers), will acknowledge activation of a strong channel and will start the registration procedure. They
will transmit to the System their IMSI, IMEI, TMSI (received in real GSM networks), class mark, KCN. The
program’s “BTS control” window will display a list of registered subscribers (called in the system - HLR). For
the subscribers, registration in the internal network does not differ from registration in the external
network.

“INTERCEPTOR” MODE
Maintaining full control over mobile station incoming and outgoing traffic within the System’s coverage
zone.

Two control modes:

1. Random mode Interception (all mobile stations)- Capture and record all incoming and outgoing traffic
within the System’s coverage zone;

2. Tracking mode Interception – IMSI and/or IMEI (only targets)

The System supports subscriber (target) selection by the known IMSI and/or IMEI identifiers and also has
the given identifiers search tools based on the registered subscribers’ statistical list processing results.
The System operates in stealth mode and the mobile phone users cannot detect it. The system does not
create interference for external mobile GSM networks.

“TARGET CORRELATION” MODE

The “Target Correlation” function helps to identify the Targets specific parameters from a list of all subscrib-
ers that were registered in the system.
This function is intended to search for the target’s IMSI/IMEI identifiers with the purpose of their subse-
quent use as selection parameters. This technique is based on comparing the lists of subscribers, registered
in the internal network, obtained from various sources (at different addresses) during various time periods
 lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

“LOCAL NETWORK” MODE

The System supports mobile station operation (restoring the radio coverage zone) in critical situations (natural or
technologic disasters).
Hostage situations – providing search, detection and possible contact with the GSM mobile station owners in
disaster areas, accidents (supporting exclusive System’s operator’s contact with pre-determined mobile
stations).
It can be used as a local area network for a small office.

“DETECTION”
Supports detection by the usual (standard) radio control resources of the location of a given mobile station, locat-
ed within the System's coverage zone, by concealed activation of the mobile station’s transmitter.

LAGO – STRUCTURE
The following units may be included with the System:
• BTS cloning system includes:
o 2G UNIT, with single or dual GSM frequency band transceivers (depends on configuration) and two channels
of mobile stations for Kc calculation in one enclosure (with internal antennas and wireless unit as an option);
o 3G and 4G UNITS, BTS or Jammers - to downgrade communication to 2G (GSM).
o Back-pack bag unit include internal antennas, wireless transmitted and batteries for 2-3 hours of operation.

• Cloning target’s channels - to interact with the external GSM network on behalf of the subscriber, registered
in the internal network.
o A complete set of 4 active stations (optional extra 4 channels)

• SYSTEM CONTROLLER unit - to provide power and communication to the BTS components of the
system includes:
o Power supply systems
o Network components
o Wireless communication transmitters
o A 5.1 decipher unit (as option)

• LAPTOP PC to perform the control, storage, information production and analysis tools. The Notebook Pc is
handling the real time deciphering function.
A notebook with the corresponding software (PC)
o Lenovo ThinkPad laptop
o Intel I7 quad-core processor
o 128GB SSD hard disk
o 4 GB RAM;
** Laptop model can be changed due to availability

• External Directional antenna for the GSM frequency multi band (optional)

• A set of connection cables

lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

LAGO – VEHICLE INSTALLATION MODE

The system will be house in a rack specially design for quick vehicle installation.
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

LAGO – WIRELESS MODE

INCREASE THE RANGE

The range of the system is defined between the system and the target. The range is between 150
meters in town to 1km in rural areas and up to 2km with long distance option.
With wireless option the range will be defined by the sum of the distance between the target and the
battery operate 2G/3G/4G UNITS and the distance between the 2G/3G/4G UNITS to the SYSTEM
CONTROLLER with connected system Laptop. So the range may be increase to 600 meters in town to
much more even 5-10 km in LOS (Line Of Sight – 10Km is with high power wireless transmitter,
directional antennas that are installed on towers for LOS).

PENETRATE BUILDINGS
With the wireless option we can make interception inside buildings while the recording system will be in
a van out of the building.
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

SPECIFICATIONS
Number of channels 4 /6/8/12/18 or more full duplex channels
Kc calculation separate channels for prior calculation.
Interception direction Incoming and outgoing calls
Interception content Voice
SMS
SS-message
2G Frequency Bands 900/1800 MHz or 850 /1900MHz
3G Frequency Bands 850 / 900 / 1700 / 1900 / 2100 MHz
4G Frequency Bands 700, 1800, 2100, 2600 MHz or 700, 850, 1700, 1900 MHz
Operation modes IMSI/IMEI catching
Random interception mode
Tracking Target mode
Target PLMN (phone number) detection
"Local Network"
Target correlation mode
Kc evaluation
Interception setup time Within 10-20 seconds
BTS information LAC
ARFCN
Rx level
MCC MNC
Interception method Fully transparent active
Tones interception DTMF
DTMF Real time decipher
Real time decipher Available few models:
A5.1 decipher - Different average decipher time
- Less than 1 sec real time decipher
- VPN connectivity to share resource
Voice and data recording
Voice and data recording 120 G Byte hard disk or more
120 G Byte hard disk or more Target filter
Target filter IMSI, IMEI
IMSI, IMEI PLMN number detection
PLMN number detection Manual or Automatic
 lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

SPECIFICATIONS
Event real time status Incoming/Outgoing call
Emergency call
Incoming/Outgoing SMS
SS operation
IMSI attach
Power off
Registration period timer
Periodic /Normal Location Update
HLR display Local subscriber
TACS – Phone model presentation
Fade out Subscribers
Rejected subscribers
TACS (IMEI) support More than 20,000 cell phone models are supported
Display design Color change for each message type
Protocol filter Yes
Processing software Correlation target lists
Detecting SIM replacements
Database Microsoft Access DB
Query method SQL queries
Search parameters by date, time, IMSI, IMEI, TMSI,
Target name
location LAC
DTMF
SMS word content,
Partial number using * and ?
Voice features Target detection Alarm
Stereo listening for both parties of conversation
Automatic voice activation
Possible to listen to one speaker side
Replacing Operator Change MCC +MNC parameters
Connectivity to DF system Yes
Silent call Yes
Test Presence Yes
 lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

SPECIFICATIONS
Event real time status Incoming/Outgoing call
Emergency call
Incoming/Outgoing SMS
SS operation
IMSI attach
Power off
Registration period timer
Periodic /Normal Location Update
HLR display Local subscriber
TACS – Phone model presentation
Fade out Subscribers
Rejected subscribers
TACS (IMEI) support More than 20,000 cell phone models are supported
Display design Color change for each message type
Protocol filter Yes
Processing software Correlation target lists
Detecting SIM replacements
Database Microsoft Access DB
Query method SQL queries
Search parameters by date, time, IMSI, IMEI, TMSI,
Target name
location LAC
DTMF
SMS word content,
Partial number using * and ?
Voice features Target detection Alarm
Stereo listening for both parties of conversation
Automatic voice activation
Possible to listen to one speaker side
Replacing Operator Change MCC +MNC parameters
Connectivity to DF system Yes
Silent call Yes
Test Presence Yes
 lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

SPECIFICATIONS
Call manipulation Enable/disable incoming or outgoing calls
Enable/disable incoming or outgoing SMS
Change incoming/outgoing call direction
Send SMS to a target or to other party via the system
Make a call to a target / other party via the system
Change content of SMS before it goes to the target
Block Supplementary Services
Transmission Power 4/10 Watts
100 Watt high power (optional)
Power TX control Yes
AC Power supply 115/230V AC 47 Hz to 63 Hz
DC Power supply 10 – 32 VDC– customer request
Batteries Internal in the back-pack
Power Consumption Total of 350 watts for basic configuration
Networking LAN cable
VPN connectivity
Wireless communication Proprietary optional
- Increase distance up to 1000 meters in urban
- Penetrate buildings
- Increase distance to 5000 meters out of town –special model)
- Field complex scenario design.
Internal Directional Antenna GSM Multi Band
6 dBi @800-900MHz ,8 dBi @1700-2600MHz
External Directional Antenna 8 dBi @800-900MHz ,12 dBi @1700-2600MHz
External power amplifier 100 Watt - optional
Directional high power/high gain Long distance Optional
3G/4G option 120 watts high power long distance low cost Jammer
to capture 3G/4G phones in 3G/4G networks
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

LAGO DF – VEHICULAR DIRECTION FINDER

(OPTIONAL)
The LAGO DF adds both a direction finding and a tracking vehicle GPS location capability to existing LAGO
basic GSM phone interception systems. The whole system fits into a single case and can be deployed on any
vehicle in less than ten minutes.

Extremes of performance of mobile tracking have always required sophisticated equipment and highly
skilled operators. The LAGO DF offers simplicity of deployment and use whilst maintaining the range and
sensitivity of more complex and expensive equipment. The LAGO DF has been designed to offer the simplest
dual band GSM cellular phone location solution available on the market today.

FEATURES

• Installed and ready to use in under ten minutes

• Single page controller display shows all tracking information
• Audible tone varies according to range for ease of use
• Digital signal processing removes need for operator fine tuning and improves sensitivity
• Data interface allows the GPS position of the tracking vehicle and the direction to the target to be
displayed by Director mapping software.
• Suitable for mobile deployment & operation
• Audible tone changes to indicate GSM lock.
The LAGO DF add-on option comprises three major components:
• Antenna pod
• Receiver
• Hand held controller
lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

GPS MAPPING
(OPTIONAL)
Vehicle based mapping application design with large buttons for optional touch screen use. It displays the
local and the target position with LAGO DF cone when available. It also enables easy interface with Google
earth maps and images.

OPERATION

The method of operation is based on two vehicles. First vehicle with the interception system that forces the
target phone to send continues signal transmission. The second vehicle is deployed with the LAGO DF com-
ponents. The direction to target is displayed as a compass pointer and the relative signal strength is shown
as a bar graph and numerically. The audio tone increases in frequency as LAGO DF gets closer to the target
giving a clear warning of a close encounter.
 lago
completely Independent,
self-hosted & managed,
encrypted voice & text network

HOMING DEVICE GSM FINDER(

OPTIONAL)

• Indoor direction finder

• Small and light weight

• Support 2G 850/900/1800/1900

• Rechargeable batteries

• Sound and visual indication