Statement of Mr. David Schriner before the Joint Economic Committee http://www.house.gov/jec/hearings/radio/schriner.htm
(1 of 7)2/23/2007 8:44:14 AM
Statement of Mr. David Schriner before the Joint Economic Committee
Statement of
Mr. David Schriner
before the
Joint Economic Committee
United States Congress
Wednesday, February 25, 1998
"The Design and Fabrication of a Damage
Inflicting RF Weapon by 'Back Yard' Methods" ..
Note, this paper reflects the personal views and opinion of the author. The material in this paper has
been deemed unclassified by those who hold his security clearances but it does not specifically represent
their views. This paper is a very brief statement on the subject and it is written from a non-technical
point of view to provide an easy look at the subject manner by non-professional people or groups.
Further elaboration on any point can be requested in either a technical format or at a classified level with
the proper security restrictions in place.
For many years research activities in different countries have focused on the use of radio frequency
(RF) waves as a weapon. Most of this work has been titled or described under the title of High Powered
Microwave (HPM). Worldwide, large amounts of money have been invested in this technology to
support both the military interests but also the industrial heating needs. Like most technologies, with
maturity the applications increase and the costs to use it become lower. One primary point of this paper
is that as these technologies mature they also become affordable and usable by criminals and terrorists.
Most military programs are classified and the general public knows little concerning their nature but as
the technology becomes available to criminals and terrorists, it may be directly applied to the
infrastructure elements of our society. This paper addresses the question concerning the possibility of
certain types of this technology being used against the society.
The primary focus of this paper will be on a different and new form of HPM called Transient
Electromagnetic Devices (TED) that could, in the hands of enemies, criminals, pranksters, or terrorists
pose a significant threat to much of the United States infrastructure components that are based on micro-
circuits and computer or micro-processor control. This includes financial institutions, aircraft, security,
medical, automotive, and other critical equipment used everyday in our society. The systems necessary
well known conventional HPM narrow-band systems that are currently in development for military use.
Millions of dollars have been spent on the conventional HPM, systems and it is the type that DOD
managers and their funding offices are well acquainted with. This paper will briefly speak to these but
the main focus of it will be on the very different type, the TED systems, which is less well known and
may be the RF weapon of choice to the modern cyber or infrastructure RF warrior.
Conventional HPM systems generate RF wavessimilar to those used for many different purposes
including communications, heating, and radio location purposes. We are all very familiar with the term
frequency as expressed in mega-hertz (MHz) when we tune our FM radios over the FM band from 88 to
108 MHz. Likewise with the AM radio band from .55 to 1.5 MHz. These expressions of frequency
describe how many complete RF cycles occur each second from the radio transmitters that generate
them. Radar systems also generate RF signals but these are in thousands of MHz each second (the term
Giga-Hertz or GHz applies). This is the type of signal that conventional HPM systems generate or
radiate, a sine wave. TED systems do not generate a sine wave and operate entirely differently than
narrow-band systems.
Narrow band HPM systems are similar to microwave ovens in that they use high powered sine
waves to cause material placed in their field to generate heat. This is exactly what narrow band HPM
systems do, they attempt to use extremely high powered RF sine waves to cause a target system to burn
out. Other types of HPM use high powered, but conventional wave-like signals to enter a target system
and cause some of the conventional effects that a jammer or countermeasure system might. All of these
narrow band HPM systems employ sine waves that are very different than the signals generated and
radiated and employed by the TED systems.
RF power is expressed in Watts and one million Watts is expressed as "megaWatts" or MW. A
kitchen microwave oven, for example, uses a magnetron tube to produce a continuous wave (CW) .5 to
1 MW RF signal to provide energy to heat the material placed in its presence. In a simple way of
describing the heating, the powerful microwave signals cause the molecules of the material to rub
together at the frequency generated by the magnetron and heat results in the material exposed to the
field. Materials such as meat, many materials containing carbon molecules, and even water heat well
when placed in such a field. Many industrial heating applications require considerably larger power
levels than the home microwave oven but the basic principles are the same.
It is with this view of microwave heating that we have the first notion of the use of microwaves as a
weapon. One assumes that if a microwave signal of extremely high power level is aimed at a distant
target of some type, then heating and perhaps burnout of some part of the target would occur. If the
signal was tuned to the operating frequency of a targeted radio receiver, for example, one would assume
that if enough power was provided in the radiated beam directed at the target's radio antenna, that the
radio's "front-end", that part directly connected to the antenna, could be heated sufficiently to burn it out.
The key here is whether there is an entry point for the high powered signal to enter the targeted system
and whether there is enough power to cause burnout.
http://www.house.gov/jec/hearings/radio/schriner.htm (2 of 7)2/23/2007 8:44:14 AM
Statement of Mr. David Schriner before the Joint Economic Committee
The community involved with HPM systems generally describes a "front-door" and a "back-door"
entry point. A front-door point might be, as in the above example, an antenna normally used by the
target platform, such as an aircraft or a tank, for some RF function such as communication or radar. Here
the RF weapon designer would attempt to radiate an RF signal into the target platform's antenna and
cause either a burnout or a disruption effect. A back-door entry point might be an unshielded wire at
some point on the targeted platform that would allow the RF weapon signal to enter some part of the
platform's electronic systems and, as before, cause a burnout or disruption of some sort. The weapon
designer would like to have a priori knowledge of the target so as to select the right frequency and use
the right modulations to accomplish the desired result.
Since this extremely high-powered RF generation technology also fills the needs of industrial
heating applications, essentially very high powered microwave ovens, there is a universal worldwide
need for the technology and export controls are confused when it comes to the possible use of this
technology as a weapon.
The New Kid on the block, the Transient Electromagnetic Device (TED):
There is a new type of source technology currently under development in our country and, very
likely, other countries as well. This type of directed RF energy is quite different than the narrow-band 9
systems previously described. This type of directed energy is called transient electromagnetic radiation.
Instead of generating a train of smooth sine-waves, as the conventional narrow-band systems do, it
generates a single spike-like form of energy. This spike-like burst of potential does not have "cycles" or
waves and it may be only one or two hundred pico-seconds (psec) in length. 100 psec is the time that it
takes light to travel 1.2 inches and often these short time duration puoses are described in "light-inches".
It is very similar to the type of signal that occurs when you rub your feet on the carpet on a dry day
and then touch your computer keyboard. An electrostatic discharge (ESD) occurs when you do this. The
electrostatic charge on your body discharges onto and into the computer and a very brief amount of very
high current flows quickly from your finger into the computer circuits causing a momentary break in the
normal flow of signals and bits of information. Because of this momentary break in the "bit-flow" the
ESD may cause the computer to crash and in some cases it may cause sensitive electronic circuits to be
actually damaged to the point where they are non-functional and must be replaced. This vulnerable item
may be just a single semiconductor diode in a single integrated chip in a circuit on the motherboard, and
there are hundreds or thousands of these in a desk-top computer. It is often economical to simply replace
a whole circuit board of components rather than trying to find the one specific circuit and replacing just
it. This type of new weapon source, a transient electromagnetic device (TED), is actually a system that
radiates an ESD-like signal that is intended to cause a similar responses, as just described, to the targeted
system.
Let us look at the differences between narrow-band (NB) and TED HPM systems. The NB systems
generate sine waves, the TEDs don't. The NB systems are very costly and go to great lengths to generate
very high average powers, the TEDs don't, the NB systems are very complex systems, the TEDs are not,
http://www.house.gov/jec/hearings/radio/schriner.htm (3 of 7)2/23/2007 8:44:14 AM
Statement of Mr. David Schriner before the Joint Economic Committee
the NB systems generate very high average powers (microwave heating), the TEDs generate very high
peak powers (and are poor RF heaters). They both use an antenna and the larger it is, the more power
they can radiate, in a narrow focused beam, at the target.
In a narrow-band HPM device, high technology vacuum tubes are used that are, in some ways, very
similar to those used in our highest-powered TV or FM stations and radar systems. They are very
delicate devices, are complex, and very expensive. They require large amounts of primary power and
generally require some type of cooling system, either air blowers or liquid types. All of this complexity
requires complex engineering and development, and the manufacturing time is great and costly. Not for
the amateur or a low-cost, start-up operation. Generally a highly skilled team of various technical
experts of numerous engineering specialties is required to manage the development and operation of
such devices.
TEDs, on the other hand, are relatively simple devices that generally use simple spark-gap switches,
either in oil or in pressurized gas pulse storage lines. The power supplies are relatively small in size and
much lower in average power and cost than for the NB systems. The engineering and mechanical issues
are small in comparison to the narrow-band devices. The technology is well described in the various
professional Pulse Power references found in good technical libraries. The significant development,
engineering, and manufacturing costs are small in comparison to narrow band. Most of the technology
required is available and is an outcrop of the various nuclear and flash x-ray work done in the past.
NB systems operate at some given frequency with a small bandwidth, and you will find them at one
spot on the radio dial. The TEDs do not even have a definable frequency but instead, because of their
short time duration, they occupy a very large spectrum space, and you will find it everywhere on every
radio dial. When a TED pulse is generated it will have the ability to excite responses in systems
designed to receive at any frequency from as low as 100 MHz up to several GHz, from the FM band up
to the lower microwave bands. A NB system would excite only those systems that were operating at its
frequency, say 2.345 GHz, so a narrow band system must be "tuned" to a given target's known soft spot
but a TED system would go after any soft spot of the target platform, back-door or front door.
So what is the bottom line of this discussion?
Because of the simplicity of TED systems and the suspicion that they may cause disruptive effects to
electronic systems that they are aimed at, they make an attractive approach for RF terrorists to use for
various purposes. We see hints of this vulnerability in the many warnings that we get each month about
locations where we should not use radios and electronic devices for fear that we will do some damage to
something. They make passengers on aircraft, during take off and landing, turn off radios, games, and
other electronic devices. Hospitals regularly place signs that electronic devices are not allowed. Many
people do not want you using your cellular telephones near their computer. Many repair shops require
that wrist-bands attached to ground be used when opening electronic equipment for repair. We have a lot
of things out there in the world that either have known or suspected vulnerabilities to RF fields or
electrostatic discharge. A TED system provides both of these conditions, an RF electrostatic discharge
http://www.house.gov/jec/hearings/radio/schriner.htm (4 of 7)2/23/2007 8:44:14 AM
Statement of Mr. David Schriner before the Joint Economic Committee
nature and its output (the number of pulses per second) can be adjusted for maximum disruptive effect.
Its peak power output can be made much higher than those fields ordinarily found in everyday systems
like cellular radios, radar systems, TV and FM stations, and simple ESD effects.
It clearly appears, based on testing that has been done as well the information presented at
unclassified technical papers and conferences, that the TED would make a good terrorist RF weapon and
that, with the proliferation of high technology infrastructure systems that are integral to everyday life in
our country, we would be very vulnerable to such systems. It is also clear, because of the extreme cost of
repairing all of the vulnerable systems, that until this vulnerability was shown, no one would have much
concern or interest in it.
Considerable discussion and innuendo has recently been made concerning the possibility of building
a TED source using "back-yard" methods, a Radio Shack Terrorist RF weapon. Such a system would
have to have sufficient power to, with some degree of probability, cause detrimental effects to common
infrastructure items such as those found in; financial institutions (banks, ATMs, and stores), medical
facilities, airport facilities, general transportation items (auto engine controls, ABS, air-bags, etc.), utility
facilities (telephone exchanges, power grid controllers), and other infrastructure entities. This type of
source is imagined to be what a criminal, terrorist, or prankster could develop or build in a reasonable
time, with reasonable tools and materials and with open literature or reference material.
The accomplishment of such an effort would require that either some sort of estimate of what power
level would be necessary to accomplish a given objective or to simply make all of the power that could
be made, and then go out and test the weapon against various target items under either controlled
conditions or actual attempts against a family of established targets. Since it is an extremely complex
process to even come close to some predicted level of vulnerability, using even the most advanced
modeling and analysis techniques, the obvious approach would be to "go for the maximum power and
then test" approach. Normal testing would be done under strict safety and security conditions but a
terrorist would not have such limitations. Normal tests would be conducted at a test location but a
terrorist would simply drive around the block or building until something happened.
An important criteria for an RF terrorist would be that any of the parts and materials used would
have to be those that could be easily found in any city and were not traceable by conventional counter-
terrorist agencies such as the local police, insurance investigators, and FBI.
It is clear that there are four basic configurations that could be used, one the size of a briefcase that
could be placed very close to a target system (like a computer at a desk or counter), one that could be
mounted into a small van and disguised to appear as ordinary, one that was dedicated to be set up at a
remote target location and used for some purpose where appearance was not of any concern, and finally,
a system that could be located in one's back yard such that it could be aimed at over flying aircraft.
The systems would likely have much in common and the builder would employ a learning curve to
go to the next more advanced system. The results or vulnerabilities found with any system could be
http://www.house.gov/jec/hearings/radio/schriner.htm (5 of 7)2/23/2007 8:44:14 AM
Statement of Mr. David Schriner before the Joint Economic Committee
factored into the use of the next system. This learn-as-you-go process would be a natural approach for
such an amateur effort.
The means of manufacturing the system includes parts and tools that one could purchase at a
hardware store or those found in an average garage shop. Tools such as a small lathe with an integral
milling machine (available via mail-order at a cost about $2,000), drill press, and general garage tools
should be all that were needed, nothing exotic.
The effort would likely be started with the small briefcase-sized unit. It could use automobile
ignition parts and a camcorder ni-cad battery for the power supply. It might use a small dish antenna
bought mail-order and some parts picked up at a surplus store. The total cost of such a unit would be
about $300 and it could be built in about one week. The development behind its design could be
accomplished by doing some basic experiments with stun-guns or other high voltage components found
in surplus stores, automotive shops, and parts from a "well equipped electronics junk box". The unit
could easily be tested at close range to the type of computers and hardware found in any home office and
if it caused some ill effect, then the terrorist would have proven the effectiveness of the system. Success
with step 1.
The next step would be to refine the technology and increase the voltage and the repetition
frequency. An advanced design might use a 6-foot TV dish antenna that could be bought mail-order (for
$200) and it might use a more advanced spark-gap unit than was used in the earlier model. Such learn-as-
you-go is a natural process in the design of spark-gaps.
Such a unit using a larger antenna (a mail-order 12-foot TV dish), when finished would look like a
simple TV dish system and it (or many like it) could be mounted such that it could easily be pointed at
over-flying aircraft.
In support of the information presented in this testimony and taking advantage of the winter's need to
work indoors, a unit that uses oil spark-gaps was designed, built, and tested. The materials for it were
mail-ordered at a cost of about $500 and about one week was needed to fabricate the mechanical
hardware. It use two ignition coils and a battery for power, an automobile fuel pump and filter for the oil
circulation, and commonly available transformer oil. An additional week was required to work out all of
the electrical wiring, the oil lines, and the general finishing details. This unit was ready for testing in two
weeks after starting the effort.
The signal radiated from the unit was measured and found to be a very significant power level that
can be compared against available vulnerability and susceptibility levels of military equipment. When
the weather permits, this unit will be tested against a set of infrastructure targets at an official test range.
From the measurements and known signal levels, this unit is expected to be consistently deadly to many
types of infrastructure items at ranges suitable for terrorist usage.
This quickly-developed low-cost system could easily be placed in a small van and used in a parking
http://www.house.gov/jec/hearings/radio/schriner.htm (6 of 7)2/23/2007 8:44:14 AM
Statement of Mr. David Schriner before the Joint Economic Committee
lot or directed at buildings that the van was driven past. It is highly likely that this type of device would
be a very effective terrorist system and the findings of its design could be factored into another either a
larger, higher powered device, or a more advanced design each with significantly greater effectiveness.
The net result of all of this design, experimentation, fabrication and measurement proves that such a
weapon system could be made by anyone with an engineering degree or even a bright technician with
good hardware experience. The technical information required can be found in open sources, if not just
from good common engineering sense. The materials needed are nothing special and if the effort is
made, advanced concepts can be made using everyday hardware such as automotive ignition systems.
The testing to date has been very limited but the results of this testing have provided considerable insight
to just what is vulnerable in infrastructure systems. This insight and work leads to a firm opinion that a
terrorist would have little trouble developing such technology and that he would have a high probability
of success in the use as an RF weapon against our infrastructure elements found in any city or near
facilities around the country.
This work has been done within the proper security guidelines since:
1. The models made in my home laboratory/workshop used off-the-shelf materials
and open-source references.
2. The laboratory tests of this hardware were made in a controlled environment with
the proper security in place.
3. The results of these tests, the data capabilities, and the target set identities are kept
in a facility cleared for classified storage.
4. The development of any of this hardware is reported on a regular basis to those
with whom I relate at a classified level to assure that they are informed of the work
and are able to apply this to their interests and efforts if necessary. Any of this
hardware can be used by them for any determination of utility to military interests.
Work in this area will be continued and an aggressive test and evaluation of these "back yard"
techniques and methods will be accomplished. This process will be done in cooperation, and if
requested, under the direction of agencies with an interest in this non-military weapon related process.
The author of this report will, if requested, provide to the Committee further details at a classified level
in the proper security environment.
Return Home
http://www.house.gov/jec/hearings/radio/schriner.htm (7 of 7)2/23/2007 8:44:14 AM
No comments:
Post a Comment