This report dates from the time of the so-called 'Squidgygate' tape, which purported to be a recording of a conversation between the late Diana, Princess of Wales and Mr James Gilbey. It was alleged to have been obtained by a scanning enthusiast, but various factors suggested that this was not actually the case. We were commissioned by a leading UK Sunday newspaper to carry out a technical and parametric analysis of the tape, investigate the circumstances in which it had been allegedly obtained and make a report. Here is an extract from it.  

It was abundantly clear at the time that the recording was certainly not obtained off-air via a scanning receiver, and Mr Reenan's part in the story remains obscure. It emerged some years later that the recording had indeed been made by means of a wiretap at the Sandringham end, allegedly by a member of the Canadian security service acting on behalf of a UK government agency.   


The "Squidgygate" tape: a technical analysis

A tape recording of a conversation purporting to have taken place between the Princess of Wales and James Gilbey on New Year's Eve 1989 was submitted by a UK newspaper for technical analysis. Mr Gilbey was supposed to have been using a cellular telephone, and the Princess of Wales to have been on a normal telephone line at Sandringham. The chain of subsequent events was said to be that the conversation had been intercepted on a scanning receiver by Mr Cyril Reenan - a retired bank manager living in Abingdon - and recorded. The tape had then been passed to the Sun newspaper and a transcript had been duly published.

I was asked to consider the technical aspects of this alleged chain of events, in the face of speculation by some other newspapers that it did not correctly represent the situation. In particular, there were suggestions to the effect that the conversation might have been intercepted or "tapped" by a Government body which had some interest in discrediting the Princess of Wales, and put into the public domain by means of a rebroadcast on a frequency used by the cellular telephone system. The logic of this would presumably have been that a scanning enthusiast would have monitored and recorded the call and then leaked it in some way.

As a first step, I visited Mr Reenan and examined his receiving facilities. Mr Reenan's memory of the events seemed good considering that they took place some three years ago, and he stated quite clearly that the receiving system I saw was more or less exactly the same as that used on the evening when the recording had been made. He claimed little knowledge of radio, and in fact he demonstrated quite eloquently in the course of the evening that he possessed hardly any.

Mr Reenan's house is in Park Road, Abingdon. As a site for VHF and UHF reception, I would judge it as relatively poor since the area is not elevated and there is a poor "take-off" in most directions. Indeed, there is a large church about 50 yards away, which must act as a considerable obstruction to reception of frequencies which nominally have line-of-sight characteristics. The local Cellnet base station is at Abingdon Town, just over one mile away, and the local Vodafone base is about 6.5 miles away in a different direction.

Mr Reenan uses an Icom IC-R7000 scanning receiver. This is capable of covering a frequency range of 25MHz-1000MHz (and to 2000MHz with reduced sensitivity). The frequency range used by TACS/ETACS cellular base stations in the UK for transmission is 915-950MHz, and from personal experience the R7000 can scan across this range and receive them perfectly well. However, all radio receivers require a proper antenna to give of their best, and in this respect Mr Reenan's receiving facilities were extremely inadequate.

Contrary to some misinformed reports in the press, Mr Reenan used nothing more elaborate than his domestic UHF Yagi-type television antenna for scanning reception. In addition, the feeder cable from the antenna was ordinary "low-loss" semi-air-spaced coaxial cable. For a variety of technical reasons, a TV antenna is a very poor choice for wideband reception. A Yagi antenna is inherently a narrowband device and has very poor performance at frequencies outside the range for which it has been designed and constructed. I would expect the ordinary domestic TV antenna to exhibit little or no gain at frequencies around 900MHz and also to display a very unpredictable polar diagram. Furthermore, the television antennas in Mr Reenan's area obtain their signal from the transmitter site at Beckley. Like the majority of main-station TV broadcast transmitters, this employs what is known as horizontal polarisation - i.e. the elements of an antenna designed to receive signals from it are placed horizontally. In contrast, the cellular telephone service uses vertical polarisation; the familiar cellular antenna on the roof or wing of a car is (or should be) vertical. Attempting to receive vertically polarised signals on a horizontally polarised antenna leads to a marked reduction in signal strength because of a phenomenon called polarisation coupling loss. Other things being equal, the overall reduction due to this cause amounts to about 20dB.

The type of coaxial feeder cable used by Mr Reenan is also very lossy at frequencies in the 900MHz region. Given that his feeder is about 60ft long, I would expect there to be at least 10dB loss in it at these frequencies.

On the basis of this combination of a poor VHF/UHF site and a very sub-standard antenna and feeder, it was not surprising that Mr Reenan's receiving system performed very poorly when used to tune across the output frequencies of cellular base stations. A simple way to assess the performance of the installation was to take advantage of the fact that every cellular base station radiates a continuous data transmission on a predetermined frequency. This is known as the "forward control channel" (FOCC) and is used by mobile telephones for various purposes. The forward control-channel frequencies are found in two groups around 935 and 943MHz. At a reasonable site and with a moderate antenna, it is normally found that at least two (the local Cellnet and Vodafone cell sites) are heard at very good strength at most places in the UK and several others some distance away should also be audible.

At Mr Reenan's site, only one FOCC was audible. This was on a frequency of 943.2125MHz, which is that of the FOCC of the Cellnet base station at Abingdon Town, and it was not by any means a strong signal. It deflected the receiver's S-meter to about S6, which was insufficient to produce full quieting and some smooth noise could be heard on the signal. Considerable fading was also heard, and seen on the S-meter. The local Vodafone base station's FOCC was extremely weakly audible, and no transmissions on its voice-output frequencies could be resolved into usable audio. To hear it at all, the squelch control needed to be turned fully anti-clockwise, implying that the signal was on or just under the receiver's inherent FM sensitivity threshold.

With the squelch control reset so that the receiver was just muted (i.e. as it would be set in normal use) it took no less than 22 minutes of continuous scanning to find a conversation taking place. When found, it displayed similar characteristics to that of the Cellnet FOCC: the S-meter reading was similar and there was audible fading, flutter and smooth noise which occasionally degraded into rough noise. Occasionally, for periods of a few seconds, the audio would reduce beneath the squelch threshold of the R7000, which would consequently mute until the signal became strong enough to lift the squelch. At no time was the signal clear of noise. A recording of the conversation was made and is available for checking.

Taking all factors into consideration, the conclusion is that Mr Reenan's receiving set-up is very poor. Given some other factors - such as his evident ignorance about how to use the receiver to the best of its capabilities, his inability to use the programmed scan-limit mode in the R7000 and his very inadequate understanding of how cellular radio works - it is considered something of a miracle that he ever hears anything at all.

We may now turn to the tape recording alleged to have been made by Mr Reenan. Before we do so, two technical points are of some importance and are explained first.

(lengthy technical analysis details removed)

Finally, the Cellnet transmitter site in Abingdon Town -- the FOCC of which was the only one audible on the occasion of my visit -- was not in service at the date of the alleged telephone conversation. It was first commissioned on 3 March 1990.

Interim conclusion 2

The recording could not have been made via Mr Reenan's receiver, or any other receiver, tuned to the output frequency of a cellular base station.

The marked degree of 50Hz hum on the tape could be explained if it was assumed to be the result of recording a telephone conversation by making a direct connection of the A and B wires to the input of a recorder with a fairly high input impedance, together with the use of isolating capacitors of rather too high a value. It is also consistent with a recording made with a less than optimally sited inductive pickup. There is no other simple explanation available for the fact that the hum is at 50Hz. No explanation for the presence of the 31Hz tone can be derived from the tape itself, although it is relevant to note that some types of "bug" require a sub-audible tone of this or a similar frequency to activate them.

It is not possible to make or receive calls via the UK cellular radio system without using BT's Megastream distribution network. For technical reasons, this will not carry any frequency at all in excess of 4kHz, or indeed any below about 300Hz. However, the purported "FVC" data is essentially a 4kHz burst at almost full level. Equally, the 50Hz hum could not have been transmitted by either the telephone network as a whole, by Megastream or by the cellular system. It is therefore necessary to conclude that both are associated with a recording made at the local end of the wired telephone line.

A narrowband spectrum analysis shows that the 50Hz component on the tape is in fact made up of separate components at just under and just over 50Hz respectively. This suggests that for some reason another hum component was added after the initial recording in order to "mask" the first, possibly to cover evidence of tampering with the tape.

Final conclusions

The tape recording analysed by myself of the conversation between the two parties alleged to be the Princess of Wales and James Gilbey could not have been recorded by means of Cyril Reenan's scanning receiver (or any other scanning receiver) tuned to the output frequency of a cellular base station. This conclusion applies irrespective of whether the putative call was recorded in real time or as the result of some form of rebroadcast.

The "FVC data" could not have been genuine, for the reasons given above.

The combination of evidence from an analysis of the radio-frequency issues involved and that derived from a comprehensive audio analysis leads inexorably to the conclusion that the recording can only have been made by means of a direct (or possibly inductive-pickup) tapping of the telephone line somewhere between the female party's telephone line itself and the local exchange.

An attempt has been made to disguise the fact that the recording was made by a local tap by making it appear that it was recorded over cellular radio. This is proven by the presence of the spurious "FVC" data. However, it would not have been technically possible to attempt a compression of the female voice without also affecting the male voice, and in consequence the female voice could not be made to sound as though it was transmitted via cellular radio. Together with the excessive HF energy in the spectrum of the female voice, this is the clearest proof that no radio link was actually involved.

Crew Green Consulting Ltd, 1993 & 2004

Return to samples:

Return to home page:

Contact us: