Abandoned Burglar Alarm - LTE B5 / NR N5 Wideband RF Interference

I'm an independent RF interference-hunting contractor providing mitigation services. If you need interference eliminated, I'm available to contract.

Recently, I had an interesting case where a wideband source jammed a cell tower.

Here's what happened.

The Offending Signal

A single sector on LTE Band 5 reported interference.

Looking at the PRB data reported by the sector, we saw the interference consistently drifting in frequency over time.

The power looked fairly stable.

The Search

Mitigation Attempt #1

Driving the area for a few days with a swept-tuned spectrum analyzer with a 283ms sweep speed turned up nothing obvious.

Only one sector saw the interference.

I suspected the issue might be a broken radio internally generating noise, which would explain why I couldn't find the signal source.

To test if it was a radio issue a tower crew swapped radios between two sectors.

The interference didn't move with the radio, meaning the signal was generated external to the radio and the interference was real.

However, the interference did get marginally weaker.

It's possible that the antenna's spatial orientation to the interference source changed while the tower crew was moving the radio, changing the gain at which the interference was received.

This is an interesting development, but it's not too relevant for finding the source.

Mitigation Attempt #2 - The Trail Gets Hot

Using my swept-tuned spectrum analyzer, which has a sweep speed of 283ms, I sat next door to the cell tower in the parking lot of a former Taco Bell.

Something looked odd on the swept-tuned spectrum analyzer.

It looked mostly like LTE CPE traffic. However, only certain PRBs were activated, and for very small amounts of time; that is not LTE-like!

There was something else here.

What if we scanned faster?

Ditching my older swept-tuned spectrum analyzer for a faster real-time spectrum analyzer revealed the interference plain as day.

The RF noise was aggregated in smaller bands across the channel just like the eNB reported!

The signal was here the entire time, turning on/off so fast that it was barely distinguishable from normal LTE CPE traffic as seen through a swept-tuned spectrum analyzer.

The Triangulation

Amazingly enough, the initial power seen in the Ex-Taco Bell parking lot was in the -80 dBm range.

This meant we were very close to the source.

Circling the parking lot a few times to get triangulation bearings, the RF interference source was localized to the ominous Ex-Taco Bell building itself!

The Mitigation - Find the RF Interference Source and Disable

I entered the ominous Ex-Taco Bell premises unannounced and convinced the owner that they were emitting a signal that was disrupting cellular traffic.

After further discussion, I was given permission to search the building and tracked the interference signal to the manager's office and to a lockbox on the wall, similar to the one pictured below.

Unfortunately, neither the manager nor the employees knew what was in the box, and they didn't have the key. It was a leftover from the former Taco Bell days.

There was only one path forward, hire a Lock-Smith.

Two hours and $200 later, we opened the box, pulled the terminal #2 wire supplying power, and the interference disappeared.

What did we find?

We found an old defunct Taco Bell alarm system malfunctioning and emitting noise in the LTE Band 5 / NR Band N5 frequency range.

The system was emitting bursts of noise so fast that a classic swept-tuned spectrum analyzer could barely pick it up. A real-time spectrum analyzer was needed.

In the end, the alarm system wasn't being used, and a new system had replaced it.

Disconnecting the old alarm panel wasn't an issue for the owner and they agreed to leave it off.