Usage of the radio spectrum is very tightly regulated. Regular, unlicensed people are allowed only so little of the RF spectrum in emission. In the 90s, the European Union came together to allocate a small 200 kHz band for license-free use with the narrow FM mode (FM mode and 12.5 kHz bandwidth). The name of the norm that would be used on it is Portable Mobile Radio 446, or PMR 446, for short. That little unlicensed band lies within the 70cm ham radio band.
The original standard actually defined a 1 MHz band (446.0 MHz - 446.1 MHz), with 8 channels. Voice would be modulated by frequency (FM) with a 12.5 kHz bandwidth, and transmitted on the air at 500mW of power maximum1. A revision to the standard would later add another megahertz (446.1 MHz to 446.2 MHz) for a digital version of the standard using Frequency-Shift Keying for modulation of a digital voice signal. At some point, both methods of transmitting were allowed to use the whole 2 MHz band (depending on the country) and we are now left with walkie-talkies that have 16 channels in Europe.
Oh yeah, because these things are used for walkie-talkies. Baby phones as well. Camping radios. Construction workers who need cheap radios. Everything the general public is potentially in a position to use on land for transmitting over radio in Europe is most likely PMR446. Escape rooms in my city use PMR446. The cheap radio phone toys kids get for Christmas also use PMR446.
And you can hear all of it. Take any radio, change its mode to narrow (12.5 kHz) bandwidth, and go to 446.00625 kHz for the first channel, with an increment of 12.5 kHz to get to the next channel.
And.. that's it. It is very straightforward. i do not have a lot to say about the technical aspects of listening to these radios, but below are somewhat disjointed thoughts about listening to PMR446.
# CTCSS & DCS to Isolate Communication Groups
With only 16 channels available, there is a possibility that you could interfere with someone else who is also using that channel. If you both emit sparsely, you could use a mechanism to know which emission is meant for who, and only enable reception when you're signaled to do so.
The Continuous Tone-Coded Squelch System is a signaling technique where an emitting radio will add a very low constant tone to the voice being transmitted. There is a list of different tones that define different subgroups within a common channel: receiving equipment that is configured for a specific CTCSS code will only consider that a received signal is meant to be listened to when the de-modulated audio contains the correct CTCSS frequency. CTCSS does ont guarantee any real privacy however: you can bypass this mechanism by not setting any CTCSS code at reception, or using bypass features (such as "Monitor" buttons on some radios, or an SDR which does not care about CTCSS at all), will let you receive all voices transmitted regardless of whether the CTCSS code is the correct one.
Digital-Coded Squelch (DCS), also called Continuous Digital-Coded Squelch System (CDCSS), is the digital little brother of CTCSS. In DCS, an inaudible stream is added to the transmitted audio containing a code and some error-correction, which eventually decode to 9 bits that are used to encode a number. Complicated error-correction maths detailed on the wikipedia page explains that out of those 512 possible combinations, 83 are kept to avoid false positives due to alignment problems.
CTCSS and DCS are not exclusive to PMR446, but they are often incorporated as built-in features in consumer-grade radios.
# My Own Portable Mobile Raspberry 446
i had an old raspberry pi lying around, which used to be my old router before the current one. While i would not buy one of those anymore today, i still have a couple boards that have no use. i installed a clean Debian for Raspberry Pi on it and designed a little system that goes as follows:
- The Raspberry Pi boots when plugged on an external battery inside my bag. That battery is big enough to charge up my phone twice and still have some juice left;
- My phone is plugged into one of the USB ports of the board and provides internet access via USB tethering;
- the RTL-SDR dongle is plugged on another port of the board, and a little 33&nbps;cm antenna is neatly attached to the outside of my bag;
- The raspberry pi launches two important pieces of software at boot: a Wireguard interface that connects to a remote Wireguard server, and WebSDR, which binds to the Wireguard interface;
- My phone shares the same Wireguard network and is also connected to my Wireguard server, and i use it to access WebSDR with a profile set up for PMR446.
- Alternatively, i turn off WebSDR and use the shared network to SSH onto the board from my phone and launch a scanning command for PMR446, while my headphones are plugged on the phone jack;
And then, just walk around. It is not by any means discrete: you have an antenna that sticks out, but otherwise you should be pretty innocuous. Most people will think you are a weirdo.
The exact scanning command for a RTL-SDR should be something along the lines of:
rtl_fm -s 22050 -l 10 \
-f 466006250 -f 446018750 -f 446031250 -f 446043750 -f 446056250 -f 446068750 -f 446081250 -f 446093750 \
-f 466106250 -f 446118750 -f 446131250 -f 446143750 -f 446156250 -f 446168750 -f 446181250 -f 446193750
Which will rapidly scan all the frequencies (-f) and lock on to one as long as
it passes the squelch level (-l). Fidget a bit with the level depending on how
much noise you get, and remove frequencies that are polluted by noise as well.
# The Voyeur & The Watcher
This gets into a more philosophical argument about privacy. To an extent, it should be common knowledge that whenever you emit on the air, anybody with a receiver will potentially pick your signal up and, unless you are a cop or the military, you are not allowed to encrypt it. On the other paw, i was also a kid with a walkie-talkie playing with friends, and it makes me queasy to know that sometimes, the voices i pick up when scanning the 16 channels of PMR446 are children. This whole dynamic is true of most frequencies in fact. As a listener, you are in a position where you observe signals that are most often explicitly put over the radio by people who intend for anyone who can to pick them up. Amateur radio bands are made to be listened to by hams and non-hams. Commercial FM radio is expected to be listened to by a wide audience, and so is AM radio in countries that still emit it (or via Skywave, a topic for a later article). Pager protocols (another topic for an upcoming article) are also transmitted and repeated over the air, but, from my experience, some people who use that are not as worried as they (perhaps) should about who can see what goes on it. Listening to the airwaves might be a form of weird expensive voyeurism, but, to an extent, a lot of people who voluntarily emit on the airwaves are themselves exhibitionists.
PMR446 was, when i wrote the first draft of this article, one of the most common bands i scan, because whenever you go to any densely populated area or facility where people will need to communicate over short-to-medium distances simply, there will be walkie-talkies. Private security, airports train stations, you get it. There's a weird feeling in knowing what is happening around you in the backrooms, though the law compels you not to act upon it (as you are not the intended recipient). Sometimes, i stay on the same channel and listen to two guys talking for half an hour about everything or nothing. Often, though, when i clearly feel that the people involved have no idea anyone can listen to them, i just.. go listen to somewhere else.
# Conclusion
PMR446 is not the end-all-be-all of portable mobile radios. In fact, in an upcoming post, i will discuss another PMR protocol, fully digital this time, that was standardized in Europe: Terrestrial Trunked Radio (TETRA).