June, 2014

now browsing by month


Police Scanners




A nice addition to having a radar and LIDAR detector is a police scanner.  Unbeknownst to some people, police scanners can be interesting to use because they allow the user to listen to radio traffic from police and fire departments, emergency medical services, and park services.  Although radar detectors are a necessity for detecting radar usage and providing ample warning, the radio traffic between police units setting up speed traps or being notified of a speeder approaching an area is also critical information for motorists.  However, in order to capture this information, a police scanner is necessary.  With hundreds of police scanners available for purchase, choosing the right police scanner depends on knowing what type of radio traffic is used in the surrounding area and deciding which scanner has the right features at a reasonable cost.


Basic Concept

For general purposes, a police scanner operates on the same principle as a radio you might have at home or in your car.  In order to listen to a certain radio station, a radio must be tuned to a specific frequency, for example 94.5 MHz Rock N’ Roll.  Additionally, if you keep the station tuned to the same frequency, and drive about 50 miles away, the radio may tune into a new broadcasting station (94.5 MHz Classical) or just get static because there is no broadcasting station in that area.  In much the same way, a police scanner can scan certain frequencies belonging to different local agencies.  Secondly, a scanner also has the same function of programming certain frequencies for easy access.  A small difference lies in the terminology wherein a scanner will store a frequency in a channel, not a “button,” set by the user.


Federal Communications Commission (FCC)

The radio spectrum is a precious and shared commodity. If more than one entity tries to use a specific frequency they will all interfere with each other. To control this situation the federal government has delegated a federal agency — the Federal Communications Commission — to create and enforce laws regarding the use of radio waves. They were formed as the result of the Communications Act of 1934. Their jurisdiction over radio waves spans the electromagnetic spectrum from 9 kHz to 300 GHz.

Note that for common use frequencies are referred to by group. HF (High Frequency) covers 3 MHz to 30 MHz, VHF (Very High Frequency) from 30 MHz to 300 MHz, and UHF (Ultra High Frequency) from 300 MHZ to 3 GHz. In the past, most LEO use was in the VHF range — either VHF Lo (around 35 MHz) or VHF Hi (around 155 MHz). Scanners at one time only needed to receive in the VHF range. Later UHF was used (first around 450 MHz, then 850 MHz) and today UHF is common for LEO use. The latest portion of the spectrum that the FCC can allocate is in the 700 MHz UHF region. The push for this region comes from the Department of Homeland Security and their goal is to have one range of spectrum for all first responders able to communicate freely with the DHS, other branches of the federal government, and with each other.

The FCC assigns and keeps a database of frequencies and the transmitter locations (for non-mobile) that are used by public service (LE, fire, ambulance, local govenment, etc.). They have set aside certain bands of frequencies and generally speaking, if all you want to listen to is public service then the scanner only needs to receive these bands. However, there are more things that people want to listen to — HAM, CB, aircraft, military, race cars, taxi cabs, railroads, etc. — and some scanners can receive more bands than just public service. Many “general purpose” receivers can listen to any frequency between 25 MHz to 1 GHz and even beyond. However, the band of frequencies used by cell phones, by law, are not allowed, so all general purpose receivers will have this cellphone gap in their coverage.

In the 800 MHz region of the spectrum the FCC has recently made changes to its frequency allocations due to interference from public safety and commercial type systems. Some of the 800 MHz allocations assigned to public safety are being moved to a different part of the 800 MHz spectrum. This is called “rebanding”. You need to make sure that your scanner can handle this if the frequencies you need to listen to are in this range. See the following wiki from radioreference.com on rebanding – http://wiki.radioreference.com/index.php/Rebanding.


Repeaters (Sites)

For the purpose of this article, the terms sites and repeaters are equivalent.  To receive signals from a reasonable range reliably you need at least one of the antennas to have no obstacles in its way (generally you want it mounted very high) and you need a good amount of power. When a patrolman is using a walkie-talkie there is neither the power nor an unobstructed, proper antenna. To assure that radio communication is intelligible or even possible, radio engineers resort to repeaters.

A repeater usually consist of a big antenna mounted high, e.g. on a tower, mountain or tall building, connected to a powerful transmitter. The repeater transmits on one frequency (the output frequency) while listening to some other different frequency (the input frequency). Any (generally weak, 5 – 10 Watts) transmissions received on the input frequency are automatically re-transmitted over the (strong, about 100 – 1000 Watts) output frequency. In this way, all the transmissions from walkie-talkies are able to be heard by everyone within range of the repeater antenna. The walkie-talkie transmits on one frequency and listens on another. As a listener, you only need to listen to the repeater output frequency to hear all transmissions.

An enhancement to this system is the “mobile repeater”. Generally, walkie-talkies don’t talk to the big system repeater. They talk to the radio in the patrolman’s car. The car has the mobile repeater: a stronger transmitter (approximately 50 – 100 Watts) and a better antenna. With mobile repeaters there are two sets of repeaters — the big system repeater at the tower(s), and mobile repeaters in each car. The walkie talkie talks to the mobile repeater in the car and the car talks to the system repeater. One can be alerted to the presence of a police car by listening on an attenuated mobile repeater frequency (car to walkie-talkie). This is the basis of the “Beartracker” feature on some of Uniden’s scanners.

radioreference.com - Las Vegas, NV site coverage

radioreference.com – Las Vegas, NV site coverage


Conventional and Trunking Radio Systems

Conventional Radio Systems

Conventional systems use one particular frequency for a particular purpose. For example, for a municipality that owns a group of frequency allocations, the police department will have their own set of frequencies, the fire department will have theirs, and the highway administration, schools, admin, etc. would all have their own set of discrete frequencies.

For conventional systems such as this, a “channel” in a scanner would be programmed with one of these frequencies. It is just like the radio in your car. Then while “scanning”, a scanner will listen for a very short moment on one channel, then move on to the next channel if no transmission is heard. If there is something there to listen to it will stop on this channel until the transmission is finished, then, after a brief pause (to catch the other side of the transmission if available), move on. The brief pause, called “delay”, is usually 2 seconds, but in some scanners it is user configurable.

To determine whether a signal exists on a frequency, or channel, the scanner uses something called “squelch”. The higher the squelch is set, the stronger the signal will have to be to break through. If the squelch is set too low then static is heard over the speaker when no signal is present. If set too high, then no signals will “break squelch” and they will not be heard. A good rule of thumb is to tune to a frequency not in use and set the squelch just past where static has stopped.

There is another type of squelch that uses sub-audible (below the frequency that a human can hear, or that a radio receiver can reproduce) tones (using one or two frequency components) to keep the radio from breaking squelch. These are known under various trademarked names like “Private Line”, “Channel Guard” and “tone squelch”. These type of schemes are known generically as Continuous Tone Code Squelch System (CTCSS) and Digital Code Squelch (DCS). In operation, the receiver does not break squelch unless a certain tone is present with the transmission. This is not encryption. All one has to do is turn the feature off to hear all transmissions on the frequency. It is so that a user is not bothered with transmissions that are not wanted. For the scanner listener, a capable scanner can use tone squelch to listen to one service versus another that share a frequency. The scanner may also have the capability to display CTCSS or DCS codes during a transmission.  Seehttp://wiki.radioreference.com/index.php/Continuous_Tone-Coded_Squelch_System and http://wiki.radioreference.com/index.php/DCS.

Now, if you tune to any given conventional frequency at any one time you will find that the frequency is not being used very much. Most of the time there is just dead air because conventional frequencies are just not “used” very much. That is, they make inefficient use of the radio spectrum.

Trunking Radio Systems

With the growing use of radio a more efficient method of using the spectrum was devised. It is called “trunking”. In trunking, a group of frequencies are allocated to a large entity, such a municipal government, and this group of frequencies is shared among all the departments. To do this, frequency use is controlled by computer. When, say a patrolman, wants to talk to the dispatcher, the radio firsts talks to the computer over a predetermined “control” channel frequency. The computer assigns one of the other frequencies from the group temporarily, to the police “talk group” and all police radios assigned to that “talk group id” (since they are always listening to the control channel) turn to the temporary computer assigned frequency to listen to the transmission from that patrolman. This happens nearly instantly so the user is not aware of the computer doing its thing. Only radios configured to use that talk group can participate on that frequency at that time. Once the patrolman’s transmission is complete, the computer releases the frequency so that the next user, whether police, fire or whatever, can use it.

There are several methods of implementing a trunking system, from several different manufacturers. Some of these manufacturers include Motorola, and M/A-Com (previously GE, then Harris). The systems go by the names of Type I, Type II, SmartZone, Smartnet, EDACS, LTR, TETRA, APCO P25, etc. It is important to note that APCO (Association of Public-Safety Communications Officials) P25 is not associated with one manufacturer. It aims to be an interoperable standard so that any agency using this type of system will, in theory, be able to communicate with other systems using APCO P25. Another thing to note about APCO P25 is that it not only defines how trunking is done, but other aspects such as digital modulation (see below). When acquiring a scanner that does trunking, make sure that it is compatible with the type of trunking system that you want to listen to. Not all trunking scanners can listen to all types of trunking systems. See http://wiki.radioreference.com/index.php/Trunking_Basics.

To program a scanner for trunking, things become a little more complicated. First a “site” needs to be programmed in. This involves inputing the trunk’s group of frequencies and identifying the control channel. Then the talk group id can be programmed into a scanner “channel”. In essence, what happens is that whenever the talk group id is heard on the control channel the scanner will tune to the frequency allocated by the control channel to listen to that talk group. It is probably best to think of a talk group as the conventional assigned frequency.

Note that several municipalities can get together to share one trunking site. For example, two adjacent counties. Or a city sharing a system with a county. They, of course, will have their own sets of talk groups. Also note that a trunking system may have several sites. Programming a scanner to receive a system will require at least one site. More may be available, but it hardly makes sense to use a site if you will never be near to it.


Modulation Types

Analog Modulation

We are all familiar with AM and FM broadcast bands. While these broadcast bands are separated in frequency, they are named for the type of modulation they use. LEO communications have used analog narrow FM in the past. Many still do. This is the same type of modulation as the FM broadcast band, but does not use as much spectrum per channel (“deviation”). (In fact, most VHF and higher frequency signals use FM. AM is only used by aircraft in this spectrum region. CB also uses AM.) Frequency allocations were spaced at 25 MHz apart. Now they are 12.5 MHz apart and the FM deviation is narrower. In the future, the FCC wants all allocated frequencies to use the 12.5 MHz step, and even smaller to 6.25 MHz. This has implications to scanner listeners. Older scanners could only tune in 5 MHz steps or greater and may not be able to tune to some of the newer frequencies, even if they are in the band of frequencies covered by the scanner. Fortunately, most newer scanners are able to handle current frequency allocations, and may even be compatible with future FCC whims. However, if buying a lesser or older, used scanner check that it is compatible with what you want to listen to. See http://wiki.radioreference.com/index.php/Narrowbanding.

Digital Modulation

The latest technology is digital modulation. In this case, the radio signal is modulated to send zeros and ones, i.e. numbers. The sound that will get transmitted must first be encoded digitally then that digital stream of numbers will be transmitted to the other end where the receiver will decode the numbers back to an analog signal. Currently, the types of digital signal modulation schemes that are being used by LEO departments in the US are defined by APCO P25.

The first type of system defined by APCO P25 is known as Phase I. It uses frequency division multiple access (FDMA) for multiplexing signals. Until recently, “digital” scanners were only compatible with Phase I and could only receive this type of digital signal. However, APCO P25 has come out with a newer digital modulation scheme known as Phase II. This scheme uses time division multiple access (TDMA) and a different encoding scheme. This is a different sort of technology than FDMA and is not backward compatible with Phase I. Older digital scanners are not automatically compatible with this scheme either. However, the very latest scanners are able to receive Phase II (as well as Phase I). Todays “top of the line” digital scanners can pick up not only Phase I and Phase II digital but all analog signals and all of them include the ability to follow all of the common trunked signals.

One other type of digital system currently in use is known as APCO P25 X2-TDMA. It is only being used by a handful of departments. This is very similar to APCO P25 Phase II. However, while it was supposed to be like Phase II, it was implemented before the Phase II standard was complete and therefore not completely compatible with Phase II. However, scanners that receive Phase II will also receive X2-TDMA. To make things even more complicated, Phase II comes in 2-slot and 4-slot versions. Only 2-slot is currently being used and digital scanners compatible with Phase II can only listen to 2-slot. There are even more digital standards that could be enumerated here, especially coming out of Europe, yet so far the radio system manufacturers have not embraced these standards.

Not all systems are digital today. In fact, most are still analog. However, especially with the push from the federal government more and more systems will be upgrading to digital. (The DHS gives money away for radio upgrades, but only if the upgrade is to APCO P25 digital.) It is not a matter of your area currently using digital or not; it is a question of when. While digital scanners are more expensive than analog-only scanners, it may be cheaper in the long run to spend the extra money right now for a top of the line digital scanner. See http://en.wikipedia.org/wiki/Project_25.

Another aspect of digital modulation is that any digital information can be transferred, not just digitized voice. More and more police departments are equipping their officers with Mobile Data Terminals (MDT). And more and more information is being transferred over these channels. Fortunately, voice is still being used and for the foreseeable future, there will still be something for the scanner user to listen to.


n the past, analog voice scrambling techniques were used to disguise transmissions. To be fair, it was comically easy to break such systems. However, with the advent of digital transmissions, it is now trivial to add encryption to the ones and zeros being transmitted. High grade techniques such as DES and AES can be used. (Although DES is considered broken, it still requires a good deal of resources to analyze and is not practically do-able in real time.) Unless you know the “key” there is basically no hope to decrypt a digital channel using this type of encryption. There may be other ways of breaking the encryption depending on mistakes made in the protocol and in implementation. However, by law, <bold>any attempt to break such a system is illegal in the US.</bold> (There are exceptions for professionals, but it’s a fuzzy line and we won’t go there.)

There are other encryption schemes that exist, such as scrambling the control channel on some trunked systems. However, most encryption is directly applied to the voice transmission. Listening to an encrypted channel gives a very harsh sound. Digital capable scanners can detect encrypted signals and can either skip them, play silence or in some cases play a tone, such as a telephone busy signal. This will of course be user configurable.


Analog, Analog Trunking, and Digital Scanners

Knowing whether your area uses VHF (high band), Low band, or UHF, users can decide which scanner is required for monitoring radio traffic.  There are three types of scanners: analog conventional, analog trunking, and digital (covers digital and analog systems).  An analog conventional scanner is the simplest and generally the cheapest radio to purchase.  It allows users to scan analog FM frequencies used by emergency services and certain aviation services.  However, these scanners do not allow users to scan trunking or digital frequencies which are in the frequency range of 700 – 900 MHz.  The second type of scanner, which is the analog trunking scanner, allows users to scan frequencies that are trunked.  In a trunked radio system, departments share a group of frequencies.  Each department is also assigned to multiple “talk groups.”  As an example, the emergency services in a town might be allotted the following frequencies: 866.31250, 866.53750, 866.56250, 866.78750, 867.28750c MHz (where “c” stands for the control channel).  The town’s police, fire, and local city service can use all these frequencies and any time and alternate through them at the discretion of the radio controller located at the main station.  Since the police are given a specific talk group identification number, which is different than the identification talk group number assigned to the fire department, anytime a cop keys their radio to talk with other cops, the radio controller at the station knows to transmit the message from the cop to other cops whose radios are programmed to the same talk group identification number.  The frequency the radio controller chooses from its list is irrelevant since data encoded in each transmission contains the talk group identification number which can only be received by other radios tuned to that talk group identification number.  A trunking scanner has the electronic architecture to decode these embedded signals and know which frequency to monitor for different talk groups.  In the case mentioned above, a trunked scanner can be programmed with the all the talk group identification numbers for the police, fire, and emergency medical services, and monitor each agency as they hop frequencies amongst the five possible frequencies.  A digital scanner is simply a scanner that is configured to receive analog, trunked analog, and digital frequencies like APCO 25 (trunked).

A police car’s radio in a trunking system works similarly like a cell phone. As the car moves about the area, it is listening to a special ID signal sent from a site (repeater), and the radio determines which signal is strongest. As the car moves farther away, the signal becomes weaker. When it determines a closer site-repeater has a stronger signal, it “registers” with that new site, all without the radio actually being used for transmit by the trooper. Each radio is pre-programmed with information for all of the sites it may encounter, which in most cases is the entire system of repeaters. In this way, a trooper may drive 100 miles and never change the TalkGroup on his radio, and still be able to communicate with clear reception back to his home area.

In large areas, like the deserts in Nevada, there are two possibilities when a trooper’s radio registers with a site:

  1. Once registered to a site, only that site will transmit to the radio when a conversation is in progress. That is, when dispatch is talking to that trooper, only the site his radio is registered to will transmit back to him. This means if you are out of range for that site, you will not hear any of that conversation, or possibly only hear one side of the conversation – typically the dispatcher side.
  2. When the trooper is communicating with dispatch, an entire set of sites may broadcast this conversation, making it possible to hear both sides of this conversation, even 100 miles away.

This control is handled by the dispatcher by some site control radio software on their console.

Technical TidBit:

  • It is possible on some systems like Motorola, to only program the control channel and not the frequencies for a site, because the frequency is specified when the control channel reports to the radio. This does not work with EDACS as it uses the LCN number which must map to a frequency that you program.


The Police Scanner for Your Area

TX DPS is slowly transitioning to the UHF APCO-25, which covers frequencies in the 800 MHz range.  This particular system is digitally trunked, and therefore a digital trunked scanner is required to listen to the radio traffic.  An analog trunked scanner also has the ability to tune to low band frequencies such as the 150 MHz and 400 MHz range, which are still commonly used, like the police department in Houston, Texas; however, an analog trunked scanner cannot scan APCO-25.  Therefore, a user who wants to cover the best of both worlds will invest in a digital trunked scanner.  Additionally, most digital trunked scanners are capable of decoding digitally trunked radio signals that are encoded by the four popular methods: APCO Project 25 (P25), Motorola (SmartZone), EDACS, and LTR.  However, some users may not have a need for a trunked scanner because the frequencies in their area are not trunked, and in such cases, users can purchase a conventional scanner for less than $100.

Checking HamUniverse.com, we can fill-out a form that will provide us some really helpful information about frequencies used by emergency services in our area.  Using Houston, Texas as an example this is the information we get:

hamuniverse.com - frequency information for Harris County

hamuniverse.com – frequency information for Harris County

Now, suppose we lived in a rural part of Texas, like Kermit in Winkler County.  This is the information we would get, and therefore only a really basic conventional scanner is all that is necessary:

hamuniverse.com - Winkler County

hamuniverse.com – frequency information for Winkler County


Finding Police Frequencies

In the following discussion, I will provide go through an example scenario of determining what frequencies are in an area of Texas:

–       Suppose I live in Houston, Texas and I want to listen to radio traffic from local agencies.  Do I need a conventional scanner or trunked scanner?

  • Go to http://www.radioreference.com
  • Select the tab Databases -> Frequency Databases

    radioreference.com main page

    radioreference.com main page

  • Select your state (Texas)

    radioreference.com - choose a state

    radioreference.com – choose a state

  • Select the county where Houston resides (Harris County)

    radioreference.com - counties in Texas

    radioreference.com – counties in Texas

    • You will see the Police table showing frequencies beginning with 460.22500 MHz and ending with 851.71250 MHz.  The first series of the 400 MHz frequencies are all FM, which means you can use a conventional scanner, but the 800 MHz frequencies are shown with a P25 Mode meaning they are trunked AND encrypted.  Despite having a trunked scanner, you would not be able to listen to those 800 MHz frequencies due to a special encryption.

      radioreference.com - police frequencies in Houston, TX

      radioreference.com – police frequencies in Houston, TX

    • The Tags showing “Deprecated” next to the frequencies means that those frequencies are no longer in usage.
  • At this point, if you have a conventional scanner, then make sure you jot down the Tone codes listed next to the frequency so you can input that in your scanner.  Once you do this, you are done with identifying the necessary information to program your conventional scanner.      
  • If you have a trunked scanner, then continue reading.
    • Now, notice the message about “Texas Wide Area Radio Network (TxWARN) Project 25.”  This means that there are radio frequencies (trunked) that the Houston police department uses. The note says: “Houston Police operates on the RFSS 3 public safety sites and RFSS 3 stand-alone fill-in public safety sites.”
    • Click the hyperlink titled “Texas Wide Area Radio Network (TxWARN) Project 25.”
    • Scroll down the first table until you see the RFSS 3 listings

      radioreference.com - Harris County Trunked Frequencies

      radioreference.com – Harris County Trunked Frequencies

      radioreference.com - Harris County Trunked Frequencies (continued)

      radioreference.com – Harris County Trunked Frequencies (continued)

    • You will see two Houston Northeast Simulcast channels, two Houston Southeast Simulcast channels, and one Houston General Government Services Simulcast channel for Harris County.

      radioreference.com - Talk Groups for Houston Police Department

      radioreference.com – Talk Groups for Houston Police Department

    • For this example, I am interested in all of Houston
    • I will upload the Simulcast frequencies for the General Government Services Simulcast and ensure I copy over the control station frequency (red).
    • Scroll down the page until you see Houston – Police – Field Operations Talkgroups
    • Depending on what kind of trunking scanner you have, you will need to upload the Talk Group codes.
    • Suppose we have a Uniden scanner, we would upload the Talk Group codes that have “General Government Services Layer” in the description and have Modes that are either A, D, M, or T.  E codes are encrypted and of no use.
    • Once you have those Talk Group codes loaded into your scanner, you are now set.


Sources of Information for Police Scanners and Frequencies & Where to Buy

    • Website for finding police frequencies and other emergency services frequencies, and wiki information on radios :  RadioReference.com
    • Website for helping find a police scanner based on where you live: HamUniverse.com
    • Where to buy?  Try scannermaster.com
    • Video on the different trunking frequencies (thank you DEFCON):

    • Video on how program a police scanner (thanks to K4DPS):


SmartPhone App Scanners

A few smartphone apps which act like police scanners are available to users for free or a small fee.  One disadvantage to these apps is that they have a fixed set of frequencies programmed for streaming.  Thus, there might be a frequency you see on radioreference.com that may not be available for tuning on the app.  Here a two popular apps for either the Apple or Android smartphones:


Police Scanner – Daily Use

The following paragraph is from one our members who describes his experience with using police scanners:

“After using and understanding my radio and trunking systems for quite some time, I found it an awesome countermeasure tool in Nevada. I discovered that part of when a trooper’s car ‘registers’ with a site, then that site starts transmitting the talk group that the trooper is assigned to. I would often drive through areas and the radio was dead silent. I was not sure if the radio was broken. I met a radio-head HAM guy in Utah and he explained a lot to me, and what I found out was that if there are no radios registered to a site after a certain time period, then that site would no longer simulcast on that talk group. When a trooper went out-of-area and his radio registered with another site, the previous site would go dark if there were no other radios registered on that talk group, hence the silence. So “silence is golden”, in that if I were in a region served by a particular site, and it was dead quiet for 10 minutes, then I knew there were no troopers anywhere in that area. NHP did status checks every 10 minutes on all troopers who had not called in, so I knew their protocol was to broadcast something every 10 minutes, so once I heard nothing, it was 100 mph all the way.

I don’t know if any radio system east of the Rockies has the range of what I experienced in Nevada, but I was able to hear traffic stops which were literally 250 miles away from me, along my path, due to the sites re-broadcasting over every site in Northern Nevada.

The huge state was divided into 3 regions for the radio, by dispatch. Reno, Elko, Las Vegas. I spoke with a user who picked up Reno area traffic stops, but the guy was scanning in Las Vegas. If a car that is assigned to Reno region drives down to Las Vegas area for a meeting or something, his radio talk group may still be set to Reno, and it “wakes up” the sites in Las Vegas area for that talk group, and suddenly you can hear stuff that’s happening 300 miles to the north. It’s pretty spooky, actually.”



Knowing what type of frequencies used by emergency services in an area and having an understanding of how these agencies communicate on VHF and UHF systems will provide an interested radio buyer the necessary knowledge to choose the right police scanner.  In some areas, a conventional analog scanner will suffice because the emergency services only communicate over non-trunked radio frequencies.  However, some people will encounter counties where the services use a combination of both VHF and UHF systems, like we saw as an example in the article.  Since many agencies are slowly transitioning to trunked systems, a digital trunked scanner offers users the future benefit of listening to this radio traffic.  Additionally, users should check the frequencies used in their areas monthly or quarterly since agencies can change to different frequencies unannounced.  All in all, police scanners are a neat addition for motorists who want to monitor the radio traffic by emergency services in order to be prepared for unexpected speed traps or bad road conditions that radar detectors cannot detect.


Special Thanks

We would like to thank ersin and OpenRoad who are members of our forum and have contributed a great amount to the correctness of this information and allowed us to present this information to help others learn about radio scanners.  To follow discussions about police scanners and cb radios, please follow us here on forum!