N4JRI's Radio Pages

Scanning for Security with N4JRI

I am primarly an environmental scanner. I see a plane, a train, or a person with a radio and I want to focus in and tune in as quickly as possible. Nothing presents a more amusing or rewarding challenge for me than trying to tune in the security force at some shopping mall, office building, hospital, hotel, etc. that I happen to be visiting. Over time, I've gotten pretty good at it. Following are my tips and tricks for locating these frequencies. Scanning for security guards has the following challenges:

• Transmissions are generally infrequent
• A wide variety of frequencies are availble for use
• Systems may be low-powered simplex or low-range 'leaky coax'
• Users are not used to the thought of being monitored and may become paranoid if aware of your efforts

As with every section on this web, I encourage you to click over to a page of basic conventions on this subject, so that you'll have a feel for things.

Where to Hunt:  Whether the security forces are contracted or proprietary, the radio frequencies used generally belong to the entity who is being guarded. Most of these frequencies are going to be in the Business Radio Service ("IB" in the freq list in the back of Police Call). Almost any business or educational institution is going to be eligible to use these frequencies, and they are also utilized by those off-the-shelf, 'colored dot' radios. So these are always the primary ones to check. If the outfit being guarded qualifies in other radio services, their frequencies should be checked also. Here are some hints for specific situations:

• Hotels - Will almost always use business frequencies. Repeaters used only in the largest ones. Don't be too quick to blow off a frequency where you hear paging. A handheld equipped with CTCSS or DCS squelch can listen to these frequencies in silence even if your scanner can't.
• Hospitals - Although this practice is on the wane, hospitals qualify for frequencies in the Special Emergency Radio Service. Handhelds have been known to share frequencies with paging. Federal, state and municipal hospitals are eligible to use federal, state and municipal government frequencies, and generally do. Repeater systems are more and more in vogue. Trends in emergency preparedness led to the licensing of many repeaters on 'local control' frequencies during the 1990's.
• Colleges - For the most part, government colleges are found on government frequencies and private colleges are found on business frequencies. Smaller colleges often have a phone patch.
• Shopping Malls - Almost always on business frequencies. Smaller ones often have a phone patch. Security at individual stores usually have their own frequencies, but at some malls they can also access the main system. Off-duty police officers may have both private and police radios.
• Factories - Often use frequencies from the Manufacturers Radio Service.
• Department Stores - Almost always on business frequencies. Chain stores will often have standard frequencies nationwide. It's always best to research as much as possible before monitoring on-site. Be alert to any frequencies which you hear keyed up with no audio. Camera operators often click the mic switch to page the floorwalker without alerting bystanders to his identity. The floorwalker will then go to a discreet location and return the call by radio or by telephone. This system allows floorwalkers to avoid wearing telltale earphones.
• Office Buildings - Usually found on business frequencies, but what is the nature of the business? One conglomerate in my hometown uses a Power/Water frequency.

CLEVER HIDING PLACES

• Paging Frequencies - A number of hotels and hospitals in my area used to do this, when they were on small, simplex systems. Two-way radios would be equipped with CTCSS so that they didn't pick up the paging, but anyone with a scanner had to sit through all the tones. This is what first got me interested in coded squelch. One office building in my town got authorized for a repeater at 462.825 MHz. The band 462.75-462.925 is set aside for business paging, so the frequency escaped my search for a long time. I didn't discover it until I heard the handhelds operating on the 2-watt frequency of 467.825.
• Splinter Frequencies - There is a world of low power activity on all those 12.5 kHz offset frequencies in the UHF band. Not only are the frequencies offset (and possibly subject to adjacent-frequency interference from strong nearby signals), but there are more available for non-specialized use even in very specialized bands. This means that you might have to scan through some heavy traffic, just to catch the light traffic that you're looking for. I found a hotel somewhere using 462.8375, which was very difficult to find because of busy and powerful paging transmissions in the 462.85-462.925 band.
• Shipboard Low Power Frequencies - A lesser known source of low power UHF frequencies is the band allocated for marine use on ships and at dockside. These come in four repeater pairs spaced at 10.225 MHz.:
  • Ch.1        457.525r/467.750in
  • Ch.2        457.550r/467.775in
  • Ch.3        457.575r/467.800in
  • Ch.4        457.600r/467.825in

  The lower frequency in each pair is also authorized for simplex use. In the US, these frequencies are used a lot more than just aboard ships. These same pairs (and the 12.5 kHz spinters between them) can be used for low power 'colored dot' radios, fast food headsets, medical equipment, and other licensed low power uses. I've also heard wireless microphones. In addition, 467.85, 467.875, 467.900 and 467.925 can have simplex use. When you consider that 457.525-457.600 has only four 25 kHz channels, and 467.75-467.925 has only eight, (plus the fact that nearby fast foods will hang up your scanner), these are not favorite searching areas for most scannists. Even so, they can yield much hidden treasure.

• "Leaky Coax" Repeater Systems - For on-site use, there are repeater systems now available which would be difficult to hear more than a few miles from the building. These work by running coax throughout the building with slots cut in the shield. This leaks just enough radio energy to work with handhelds in and around the building. Five miles away, it won't even break your squelch. The solution is fairly easy. Listen to the input frequency. The handhelds themselves may have a range much greater than the repeater.
• Borrowed Frequencies - An increasing phenomenon today is the use of frequencies borrowed from other radio services. The monitor's biggest ally in frequency hunting is the rules that the frequency users are bound by. This is why features like "Service Search" are even possible on commerical scanners. It also makes band searches easy and logical. The larger the bands we must search, the harder it is to find what we're looking for. This is especially true with security users, who don't tend to talk as frequently. The smaller the town you're in the more that users are eligible for borrowing. For example, taxicab frequencies are all available for business use in Metropolitan Statistical Areas of 50,000 or less.
• Trunked Systems - Trunked systems offer a really thick haystack in which to look for your needle. The best way to defeat this is to monitor repeater input frequencies. This keeps your scanner from getting hung up listening to users who are not nearby. People often use trunked systems to communicate where simplex would do fine and you can easy follow a nearby conversation by moniting the handhelds themselves--who are transmitting on these input frequencies.
• Free Frequencies - Cheap, multichannel Family Radio Service (FRS) radios are now available and many have coded squelch. I'm seeing them more at special events. Some low-power VHF frequencies are now available unlicensed in the Multi Use Radio Service (MURS). Although a number of people are setting up CB-type operations here, these frequencies have very good characteristics for portable radios, and the use of CTCSS or DCS can help them to exist in this new, freer environment. Another terrific aspect of these frequencies is that the new Bearcat 780 scanner includes them in a service search.
• Illegal Frequencies - One plantation here on the James River uses Marine Channel 72 (156.625) for valet parking. Hopefully, MURS and FRS now provide a cure for this.

N4JRI's Guard-Grabbing Strategies and Scanner Banks

Back to Scanner Page    Home      Email N4JRI