FCC ID: V27SD-61 Secure Smartphone

Bittium Tough Mobile 2 Quick Start Guide Device at a glance 1 Headset and protective cover 2 Emergency key 3 Earpiece and microphone 4 Front camera Status indicator LED 5 6 Back camera 7 Flash LED 8 Volume up key 9 Push to Talk key (PTT) 10 Volume down key 11 USB 3.1 port (USB-C) 12 Privacy Mode key 12 Power key 13 14 SIM tray Loudspeakers 15 The ambient light sensor and proximity sensor are located next to the status LED. 2 Bittium Tough Mobile 2 Quick Start Guide 1 2 3 4 5 6 7 8 9 10 15 14 13 12 11 Please read this quick guide carefully before using the device. Bittium Tough Mobile 2 is factory tested to be IP67 resistant to dust and water. Intentional underwater immersion of the device should be avoided. The device is not designed for underwater use or use in a shower. Purposeful use of the device in these environments will invalidate the warranty. For more info on Bittium Tough Mobile 2 Ingress Protection see http://

www.bittium.com/BittiumToughMobile2#support. Bittium Tough Mobile 2 Quick Start Guide 3 Box contents Device sales package contains the following items:

Charger USB C cable 3.5 mm Headset SIM tray tool Quick Start Guide Box contents and the appearance of the accessories may vary. Operating system and applications Bittium Tough Mobile 2 uses the Android operating sys-

tem. This Quick Start Guide contains only highlights and device-specific features and functionalities. For a full Android User Guide please refer to: http://www. bittium.com/BittiumToughMobile2#support. The device may have pre-installed 3rd party applica-

tions. For more information, see http://www.bittium. com/BittiumToughMobile2#support. Verify that the device is switched OFF before inserting SIM card(s). 4 Bittium Tough Mobile 2 Quick Start Guide Getting started To start using the device first open the SIM card tray and insert the SIM card(s). To open the SIM tray insert the SIM tray tool into the hole shown below. Push the tool gently into the hole until the SIM tray pops out. Insert the SIM card and optional SDHC card as shown below. Bittium Tough Mobile 2 Quick Start Guide 5 Insert your primary Nano SIM card onto the SIM card slot as shown above. If you have a secondary Nano SIM card, insert it onto the Dual Mode slot. In case you are not using two SIM cards you can insert your Micro SDHC card onto the Dual Mode slot. After the SIM and SD cards are insert-

ed, push the SIM tray back. See the figure below if you are inserting two SIM cards. NOTE: In order to maintain water and dust resistance, keep the rubber seal around the SIM tray clean of any dirt. Prior to using the device the battery should be fully charged using the charger and the USB cable provided in the sales package. Press the power key to power up the device. 6 Bittium Tough Mobile 2 Quick Start Guide Once the device has powered up, follow the on-screen instructions to set up the device using the Security Wizard. LED indications LED LED Device Device Battery color status power status status Red Blinking ON Not Battery charging

<15%

Red Constant ON or Charging Battery Yellow Constant ON or Charging Battery 15-

Green Constant ON or Charging Battery 90-

OFF OFF OFF

<15%

89%

100%

Green Blinking ON Privacy Battery Mode ON

>15%

Bittium Tough Mobile 2 Quick Start Guide 7 Security wizard The device is equipped with a Security Wizard that is launched during the initial power up of the device. Security Wizard is used to set up a number of different device settings. Follow the on-screen instructions by first setting a screen lock code. The number of set up steps may vary depending on the security features of the device. Lock screen Switching off the display locks the device. The device also locks after a period of inactivity. Switch the display off by pressing the power key once. The display can be switched on by pressing the power key or programma-

ble key. To open the screen lock and to access the home screen, follow the steps below:

1. Swipe the lock upwards. 2. Enter the screen lock code. 3. Tap the check mark

. 8 Bittium Tough Mobile 2 Quick Start Guide Special key functions The device has dedicated special keys in addition to the Push to Talk (PTT) function. The emergency key is a configurable button. The Privacy Mode key switches the device to Do not disturb mode. See Privacy Mode section for more in-

formation. Privacy Mode Bittium Tough Mobile 2 can be set to a special privacy mode in which some of the device functionalities are intentionally disabled:

Microphones are disconnected Bluetooth is disabled Device cameras are disabled Bittium Tough Mobile 2 Quick Start Guide 9 Sensor accuracy is reduced Activate/deactivate the privacy mode by pressing the Privacy Mode key for 3 seconds. Software update Use software update to manually check for available software updates and install them on your device. 1. Go to Settings -> System -> Advanced -> Additional system updates. 2. Tap Check Now to check if an update is available. You can also set the schedule for OTA (over-the-air) updates by tapping Check OTA updates. Options are:

Disabled, Daily, Weekly and Monthly. 10 Bittium Tough Mobile 2 Quick Start Guide Important health and safety precautions Please take the following safety precautions when using the device:

WARNINGS Only use the batteries, antennas and chargers ap-

proved by Bittium Wireless Ltd. The use of non-Bittium approved batteries, antennas, and chargers may be dangerous. Permanent hearing loss may occur if earphones or headphones are used at high volume for prolonged pe-

riods of time. Do not use the charger if it has a visible defect, or if you suspect it is damaged. Do not allow children to play with the device since it contains small parts that can become detached and create a choking hazard. In Japan, USA and Canada, use 5GHz WLAN only indoors. Bittium Tough Mobile 2 Quick Start Guide 11 CAUTIONS The material used in the display is glass. The display can break if your handset is dropped or if it receives a signifi-

cant impact. Do not use the device if the screen is broken or cracked as this may cause an injury. Any modification to this product is prohibited and will invalidate the warranty. Opening the device and using the components for purposes not otherwise authorized by this document, including any use in airplanes or any other Aviation application, is prohibited and will invalidate the warranty. Allow only authorized personnel to service the device and its accessories. Unauthorized service will invalidate the warranty. The device may become warm when using it for pro-

longed periods of time, such as talking on the device, charging the battery or browsing the web. In most cas-

es, this condition is normal and therefore should not be interpreted as a problem with the device. Do not expose device surfaces to sun lotion, mosquito repellent or equivalent. Do not glue any brackets or equivalent onto the device back cover. NOTES When driving, check and obey the laws and regulations on the use of mobile phones in the area where you drive. If you are going to use your phone while driving, always pay full attention to driving and use a handsfree solution, if available. The law in many countries requires the use of a vehicle handsfree solution while driving. Always create a backup of data you want to keep (such as contacts and calendar notes) before sending your de-

vice for service. 12 Bittium Tough Mobile 2 Quick Start Guide Important customer information Bittium Tough Mobile 2 is a wireless device, containing a radio transmitter and receiver which emit radio fre-

quency energy during its use. Most modern electronic equipment is shielded from RF signals. However, cer-

tain electronic equipment may not be shielded against the radio signals from a wireless phone. Do not use the device near medical equipment with-

out permission. A minimum of six (6) inches should be maintained between the device and an implantable medical device, such as a pacemaker or implantable cardiac defibrillator in order to avoid potential interfer-

ence with the medical device. Persons having implant-

ed medical devices should follow instructions from the manufacturer of the medical device for safe use within proximity of wireless devices. Wireless phones may also interfere with some hearing aids. In the event of such in-

terference, consult the service provider or call customer service to discuss alternatives. Radio signals may interfere with improperly installed or inadequately shielded electronic systems in motor vehicles. Check with the vehicle manufacturer or its representative regarding your vehicle. Aftermarket elec-

tronics which have been added to the vehicle should also be checked. Any modification of Bittium Tough Mobile 2 is prohib-

ited. Only authorized personnel should service the device and its accessories. Only use software updates provided by Bittium. Accessories for Bittium Tough Mobile 2 should be either purchased from or approved by Bittium. Only use the battery specified by and provided by Bittium in the device. Do not short-circuit the battery. Do not use the battery with a charging system which has not been approved by Bittium. Bittium Tough Mobile 2 Quick Start Guide 13 Turn Bittium Tough Mobile 2 OFF in any facility where posted notices so require. To avoid interfering with blasting operations turn Bit-

tium Tough Mobile 2 OFF when in a blasting area or in areas posted: Turn off two-way radio. Obey all signs and instructions. Turn Bittium Tough Mobile 2 OFF when in areas with a potentially explosive atmosphere and obey all signs and instructions. Sparks in such areas could cause an explo-

sion or fire resulting in bodily injury or even death. Areas with a potentially explosive atmosphere are often, but not always, marked clearly. Potential areas may include fuel-

ing areas (such as gas stations); below deck on boats; fuel or chemical transfer or storage facilities; vehicles using liquefied petroleum gas (such as propane or butane); ar-

eas where the air contains chemicals or particles (such as grain, dust, or metal powders); and any other area where you would normally be advised to switch off your vehicle engine. An emergency call can be made only within a service area. For an emergency call, make sure that you are within a service area and that the device is switched on. The device does not necessarily meet all specifica-

tions in extreme temperatures. Battery capacity (use time) is limited in low temperatures, and the device per-

formance may be limited in high temperatures. The device is equipped with intelligent battery charging control that limits battery charging in extremely hot and cold temperatures to ensure battery safety and extended operating life. 14 Bittium Tough Mobile 2 Quick Start Guide FCC notice to users This device complies with Part 15 of the FCC Rules. Op-

eration is subject to the following two conditions: (1) this device may not cause interference, and (2) this device must accept any interference, including interference that may cause undesired operation of the device. This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communica-

tions. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the fol-

lowing measures: Reorient or relocate the receiving an-

tenna on the radio or television equipment, increase the separation between the equipment and receiver, connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the radio or television equipment dealer. Radiation exposure statement This device complies with FCC radiation exposure lim-

its set forth for an uncontrolled environment and meets the FCC radio frequency (RF) Exposure Guidelines. This transmitter must not be co-located or operated in con-

junction with any other antenna or transmitter. Bittium Tough Mobile 2 Quick Start Guide 15 To satisfy the FCC RF Exposure requirements for mo-

bile transmitting devices, a separation distance of 10 mm should be maintained between the antennas of this de-

vice and persons during operation. To ensure compliance, operations at closer distances than this are not recom-

mended. Specific absorption rate (SAR) certification information This device has been shown to be capable of compli-

ance for localized specific absorption rate (SAR) for un-

controlled environment/general population exposure lim-

its specified in ANSI/IEEE Std. C95.1-1992 and has been tested in accordance with the measurement procedures specified in FCC RF Exposure guidelines and IEEE Std. 1528-2013. The standards include a substantial safety margin de-

signed to assure the safety of all persons, regardless of age and health. The exposure standard for wireless mo-

bile phones employs a unit of measurement known as the Specific Absorption Rate, or SAR. The SAR limit set by the FCC is 1.6W/kg. The standard incorporates a substantial margin of safety to give additional protection for the public and to account for any variations. The highest SAR value report-

ed under these guidelines when used at the ear is 0.88 W/kg and when correctly worn on the body is 1.36 W/kg. 16 Bittium Tough Mobile 2 Quick Start Guide Frequency bands and power Following table lists the frequency bands in which the radio equipment operates as well as the maximum radio-frequency power transmitted in these frequency bands:

Frequency bands and maximum transmit-

ted radio frequency power GSM850/900: 33.3dBm, GSM1800/1900: 30.8dBm, WCDMA Bands 1,2,4,5,8: 25dBm, LTE Bands FDD:

1,2,3,4,5,7,8,12,13,14,17, 20,25,26,28,29,30,66: 25.5dBm, LTE Bands TDD: 34,38,39 25dBm Wi-Fi 2.4G: 16.5dBm, Wi-Fi 5G: 17dBm, Bluetooth: 12.5dBm Operating temperature Device operating temperature range is -20C - +55C. Bittium Tough Mobile 2 Quick Start Guide 17 Limited warranty For a period of 1 year from the date of purchase, Bittium Wireless Ltd. (Bittium) warrants this Product, includ-

ing all accessories provided in the sales box, against defects in materials or workmanship. If this Product is determined to be defective within the 1 year warranty period, Bittium will repair the Product or replace it with a new or refurbished Product, at its option, at no charge to the customer, except as set forth below. This warranty does not cover cosmetic damage, or device failure caused by liquid damages, or damage due to misuse, abuse, negligence, accident, modifi-

cation or disassembly of any part of the Product. This warranty does not cover damage due to improper oper-

ation or maintenance, connection to improper voltage supply, or attempted repair by anyone other than a fa-

cility authorized by Bittium to service this Product. For more info on Bittium Tough Mobile 2 Ingress Protection see www.bittium.com/BittiumToughMobile2#support. To obtain warranty service, you must receive a Return Authorization from Bittium and ship the Product, at your expense, to Bittiums authorized service facility. You must ship the Product in either its original packaging or packaging affording an equal degree of protection. This warranty does not cover customer instruction, set up, or set up adjustments or network coverage problems. Please contact support@bittium.com for warranty support. 18 Bittium Tough Mobile 2 Quick Start Guide Notes Bittium Tough Mobile 2 Quick Start Guide 19 Published by:

Bittium Wireless Ltd. Ritaharjuntie 1 90590 Oulu Finland Phone: +358 40 344 2000 www.bittium.com For the latest Quick Start Guide see:

www.bittium.com/BittiumToughMobile2

#support Guide is also available in your device: Settings->

About phone->User guide->Quick user guide. Legal Notice Copyright 2019 Bittium. All rights reserved. The informa-

tion contained herein is subject to change without no-

tice. Bittium retains ownership of and all other rights to the material expressed in this document. Any reproduc-

tion of the content of this document without prior written permission from Bittium is prohibited. Notice Bittium reserves the right to change its products and the information in this document without notice due to continuous improvement and development. Bittium makes no warranty of any kind with regard to this mate-

rial, including, but not limited to, the implied warranties of merchantability or fitness for a particular purpose. Bittium shall not be liable for errors contained herein or for damages in connection with the furnishing, perfor-

mance, or use of this material. www.bittium.com 5800591A01_draft

Bittium Tough Mobile 2, Requlatory info Company confidential Bittium Corporation, Ritaharjuntie 1, FI-90590 Oulu, FINLAND, +358 40 344 2000, +358 8 343 032 www.bittium.com, VAT number: FI10041295, Business ID: 1004129-5, Oulu

Date: 17/04/2019 DEKRA Testing and Certification, S.A.U. Parque Tecnolgico de Andaluca C/ Severo Ochoa 2 & 6 29590 Campanillas Mlaga, Espaa Ref: Agent letter for FCC ID: V27SD-61 We, Bittium Wireless Ltd. Ritaharjuntie 1, 90590 Oulu, Finland DEKRA Testing and Certification, S.A.U. Parque Tecnologico de Andalucia C/ Severo Ochoa n 2 29590 Campanillas, Malaga, Spain Mr. Kamal Seddik e-mail: kamal.seddik@dekra.com Phone: +34 952 619 310 hereby authorize to act as our agent in the preparation of this application for equipment certification, including the signing of all documents relating to these matters. The present authorization considers the development of documents on behalf of the client, written under his own letterhead and related to the necessary information to be provided on his behalf to complete the certification process. We also hereby certify that neither we nor any party to this application are subject to a denial of U.S. Federal benefits, which include FCC benefits, pursuant to Section 5301 of the Anti-Drug Abuse Act of 1988, U.S.C. 862 because of conviction for possession or distribution of controlled substance. For instances where our authorized agent signs the application for certification on our behalf, I acknowledge that all responsibility for complying with the terms and conditions for Certification, as specified by DEKRA Testing and Certification, S.A.U., still resides with us. This agreement expires one year from the current date. Sincerely, __________________________ By: Mikko Miettinen Title: Senior Manager Company: Bittium Wireless Ltd. Telephone: +358 344 2000 e-mail: mikko.miettinen@bittium.com FCB011_02 //DEKRA Testing and Certification, S.A.U. // www.dekra-product-safety.com/wireless

Date: 17/04/2019 DEKRA Testing and Certification, S.A.U. Parque Tecnolgico de Andaluca C/ Severo Ochoa 2 & 6 29590 Campanillas Mlaga, Espaa Ref: Confidentiality request for FCC ID: V27SD-61 To whom it may concern:

Pursuant to 0.457(d)(1)(ii) and 0.459 of the Commissions Rules (47 C.F.R.) and 552 (b)(4) of the Freedom of Information Act, Bittium Wireless Ltd. hereby request requests that a part of the subject FCC application be held confidential to avoid release of sensitive information of the product to the public. For the product stated above, we request that the following information be withheld from public disclose:

Type of Confidentiality Requested Short Term Short Term Short Term Short Term Short Term Short Term Short Term Short Term Short Term Permanent Confidentiality:

Permanent Permanent Permanent Permanent Permanent Exhibit Block Diagrams External Photos Internal Photos Operation Description Parts List & Placement/BOM Tune-Up Procedure Schematics Test Setup Photos Users Manual The above materials contain trade secrets and proprietary information not customarily released to the public. The public disclosure of these matters might be harmful to us and provide unjustified benefits to our competitors. Short-Term Confidentiality:

We hereby request short-term confidentiality for the product stated above to avoid premature release of sensitive information prior to marketing or release of the product to the public. Release date of short term confidentiality is:

45 days from grant date marked 90 days from grant date marked 135 days from grant date marked 180 days from grant date marked Specific date:

We are also aware that we are responsible to notify DEKRA in the event information regarding the product or the product is made available to the public. DEKRA will then release the documents listed above for public disclosure pursuant to FCC Public Notice DA 04-1705. Sincerely, __________________________ By: Mikko Miettinen Title: Senior Manager Company: Bittium Wireless Ltd. Telephone: +358 344 2000 e-mail: mikko.miettinen@bittium.com FCB012_02 //DEKRA Testing and Certification, S.A.U. // www.dekra-product-safety.com/wireless

Date:13/03/2020 to:

Regulatory Certification Body DEKRA Testing and Certification, S.A.U. Parque Tecnolgico de Andaluca C/ Severo Ochoa 2 & 6 29590 Campanillas Mlaga, Espaa Related to product:

from:

Bittium Wireless Ltd. Ritaharjuntie 1, 90590 Oulu, Finland Type of equipment:

Secure Smartphone Brand name:

FCC ID:

IC:

Bittium V27SD-61 3282B-SD61 We hereby declare that this device is programmed to operate only in the following frequencies:

To whom it may concern, 2.4 GHz Band, Frequency Range 2.401 - 2.482 GHz Channels 1-11 (BW 22 MHz) Channels 1-11 (BW 20 MHz) Channels 3 and 11 (BW 40 MHz) 5GHz Band, In Canada, the device wont operate in the frequency range 5.6 5.65 GHz (channels within this range wont be used) Frequency Range 5.170 5.330 GHz o Channels 36-64 (BW 20 MHz) o Channels 38-62 (BW 40 MHz) o Channels 42 and 58 (BW 80 MHz) Frequency Range 5.490 5.730 GHz Canada) o Channels 100-144 (BW 20 MHz) (Except 120, 124, 128 in Canada) o Channels 102-142 (BW 40 MHz) (Except channels 118 and 126 in o Channels 106 and 138 (BW 80 MHz) (not in channel 122 in Canada) Operation modes, DFS and TPC This device support Ad-Hoc / Wi-Fi hotspot mode in 5 GHz frequency band where the device operates in both Master and Slave DFS functional modes. Ad-hoc / Wi-Fi hotspot feature is limited to 11 channels available in 2.4 GHz frequency band. As client device, this product does not initiate transmission of any probes, beacons and does not initiate Ad-Hoc operations when not associated with and under the control of a certified master device, according to Section 15.202 of FCC rules. Future changes in this device will not change theses operational characteristics, in any mode of operation. Software security description per KDB 594280 D02:

General Description 1. Describe how any software/firmware updates for elements than can affect the devices RF parameters will be obtained, downloaded, validated and installed. For software that is accessed through manufacturers website or devices management system, describe the different levels of security as appropriate. There are three ways to provision software to the device:

- Software is initially provisioned to the devices in Bittiums subcontractor factory.

- Software is updated over the air, via HTTPS connection

- Software is post-factory flashed via USB flashing method, binaries are obtained from Bittium Extranet In all of these cases, the software integrity is verified so that unauthorized firmware cannot be executed. Bittium Trusted Boot verifies the complete chain from bootloader up to Android OS. The strength of verification algorithms are at least RSA 2048 at all phases of SW bring-up. Over-the-Air SW packages signatures have been generated using ECC-256 key. Tough Mobile 2 firmware is built within secure offline environment where the build servers and key servers are located. It is an isolated network for the sole purpose of generating signed firmware images for the devices. Physical access to the firmware generation environment is limited only to Bittium IM personnel and members of Special Device Platform security team and all the servers have at least AES-

256 strength disk encryption applied and are kept offline when inactive. RF parameters are incorporated within the firmware image as pre-set tuning files and cannot be changed by end-user nor by pure SW changes. 2. Describe the RF parameters that are modified by any software/firmware without any hardware changes. Are these parameters in some way limited such that any other software/firmware changes will not allow the device to exceed the authorized RF characteristics?

Secure boot authenticates the firmware. Authentication starts by MSM670 SOC internal ROM bootloader which validates the 2nd stage bootloader XBL against factory-

provisioned public key root hash (2k RSA). Then execution is passed to the XBL. XBL starts boot sequence which validates the modem signature against the same root key hash and loads it. It also authenticates firmware images for WLAN and DSPs (2k RSA). Linux kernel integrity is authenticated against a public RSA key located within bootloader binary (2k RSA). After that the execution passes to Linux kernel. Kernel authenticates all kernel modules that are loaded against signatures (4k RSA). Kernel also authenticates the Android OS system image integrity using kernel feature dm-

verity where all the system binaries are compared against a signed (2k RSA) hash-table created during SW build-time. Any failure on signature check due to modification to AndroidOS root file system causes device to fall to non-

usable state. 3. Describe in detail the authentication protocols that are in place to ensure that the source of the RF-related software/firmware is valid. Describe in detail how the RF-

related software is protected against modification. 4. Describe in detail any encryption methods used to support the use of legitimate RF-related software/firmware. See chapter 3. On client-mode, the DFS channels are not available; scanning of these bands is disabled. On DFS mode phone does not actively scan channels, but waits for channel configuration from access point. On master mode, WLAN 2.4GHz channels 12-13 are always disabled by checking if regional or country code is U.S. Configuration files cannot be changed as they are integrity-

protected by secure boot chain. Tough Mobile 2 SW configuration is world-compatible, ie there are no separate SW variants for regional markets. WLAN 2.4GHz channels 12-

13 are always disabled by checking if regional or country code is U.S. After the airplane mode is turned off, WLAN is on world domain and in this mode WLAN 2.4GHz channels 12-13 are always disabled. Device permits 3rd party application installation but not firmware installation. See chapter 3 from General description and chapter 1 from Third-Party Access Control 5. For a device that can be configured as a master and client (with active or passive scanning), explain how the device ensures compliance for each mode? In particular if the device acts as master in some band of operation and client in another; how is compliance ensured in each band of operation?

Third-Party Access Control 1. Explain if any third parties have the capability to operate a U.S.-sold device on any other regulatory domain, frequencies, or in any manner that may allow the device to operate in violation of the devices authorization if activated in the U.S. 2. Describe, if the device permits third-

party software or firmware installation, what mechanisms are provided by the manufacturer to permit integration of such functions while ensuring that the RF parameters of the device cannot be operated outside its authorization for operation in the U.S. In the description include what controls and/or agreements are in place with providers of third-party functionality to ensure the devices underlying RF parameters are unchanged and how the manufacturer verifies the functionality. Not applicable for Tough Mobile 2 device. It is not a WIFI module. 3. For Certified Transmitter modular devices, describe how the module grantee ensures that host manufacturers fully comply with these software security requirements for U-

NII devices. If the module is controlled through driver software loaded in the host, describe how the drivers are controlled and managed such that the modular transmitter RF parameters are not modified outside the grant of authorization. Sincerely, __________________________ By: Mikko Miettinen Title: Senior Manager Company: Bittium Wireless Ltd. Telephone: +3583442000 e-mail: mikko.miettinen@bittium.com

Date:29/01/2020 to:

Regulatory Certification Body DEKRA Testing and Certification, S.A.U. Parque Tecnolgico de Andaluca C/ Severo Ochoa 2 & 6 29590 Campanillas Mlaga, Espaa Related to product:

from:

Bittium Wireless Ltd. Ritaharjuntie 1, 90590 Oulu, Finland Type of equipment:

Secure Smartphone Brand name:

FCC ID:

IC:

Bittium V27SD-61 3282B-SD61 We hereby declare that this device is programmed to operate only in the following frequencies:

To whom it may concern, 2.4 GHz Band, Frequency Range 2.401 - 2.482 GHz Channels 1-11 (BW 22 MHz) Channels 1-11 (BW 20 MHz) Channels 3 and 11 (BW 40 MHz) 5GHz Band, In Canada, the device wont operate in the frequency range 5.6 5.65 GHz (channels within this range wont be used) Frequency Range 5.170 5.330 GHz o Channels 36-64 (BW 20 MHz) o Channels 38-62 (BW 40 MHz) o Channels 42 and 58 (BW 80 MHz) Frequency Range 5.490 5.730 GHz Canada) o Channels 100-144 (BW 20 MHz) (Except 120, 124, 128 in Canada) o Channels 102-142 (BW 40 MHz) (Except channels 118 and 126 in o Channels 106 and 138 (BW 80 MHz) (not in channel 122 in Canada) Operation modes, DFS and TPC This device does not support Ad-Hoc / Wi-Fi hotspot mode in 5 GHz frequency band where the device operates in both Master and Slave DFS functional modes. Ad-hoc / Wi-Fi hotspot feature is limited to 11 channels available in 2.4 GHz frequency band. As client device, this product does not initiate transmission of any probes, beacons and does not initiate Ad-Hoc operations when not associated with and under the control of a certified master device, according to Section 15.202 of FCC rules. Future changes in this device will not change theses operational characteristics, in any mode of operation. Software security description per KDB 594280 D02:

General Description 1. Describe how any software/firmware updates for elements than can affect the devices RF parameters will be obtained, downloaded, validated and installed. For software that is accessed through manufacturers website or devices management system, describe the different levels of security as appropriate. There are three ways to provision software to the device:

- Software is initially provisioned to the devices in Bittiums subcontractor factory.

- Software is updated over the air, via HTTPS connection

- Software is post-factory flashed via USB flashing method, binaries are obtained from Bittium Extranet In all of these cases, the software integrity is verified so that unauthorized firmware cannot be executed. Bittium Trusted Boot verifies the complete chain from bootloader up to Android OS. The strength of verification algorithms are at least RSA 2048 at all phases of SW bring-up. Over-the-Air SW packages signatures have been generated using ECC-256 key. Tough Mobile 2 firmware is built within secure offline environment where the build servers and key servers are located. It is an isolated network for the sole purpose of generating signed firmware images for the devices. Physical access to the firmware generation environment is limited only to Bittium IM personnel and members of Special Device Platform security team and all the servers have at least AES-

256 strength disk encryption applied and are kept offline when inactive. RF parameters are incorporated within the firmware image as pre-set tuning files and cannot be changed by end-user nor by pure SW changes. 2. Describe the RF parameters that are modified by any software/firmware without any hardware changes. Are these parameters in some way limited such that any other software/firmware changes will not allow the device to exceed the authorized RF characteristics?

Secure boot authenticates the firmware. Authentication starts by MSM670 SOC internal ROM bootloader which validates the 2nd stage bootloader XBL against factory-

provisioned public key root hash (2k RSA). Then execution is passed to the XBL. XBL starts boot sequence which validates the modem signature against the same root key hash and loads it. It also authenticates firmware images for WLAN and DSPs (2k RSA). Linux kernel integrity is authenticated against a public RSA key located within bootloader binary (2k RSA). After that the execution passes to Linux kernel. Kernel authenticates all kernel modules that are loaded against signatures (4k RSA). Kernel also authenticates the Android OS system image integrity using kernel feature dm-

verity where all the system binaries are compared against a signed (2k RSA) hash-table created during SW build-time. Any failure on signature check due to modification to AndroidOS root file system causes device to fall to non-

usable state. 3. Describe in detail the authentication protocols that are in place to ensure that the source of the RF-related software/firmware is valid. Describe in detail how the RF-

related software is protected against modification. 4. Describe in detail any encryption methods used to support the use of legitimate RF-related software/firmware. See chapter 3. On client-mode, the DFS channels are not available; scanning of these bands is disabled. On DFS mode phone does not actively scan channels, but waits for channel configuration from access point. On master mode, WLAN 2.4GHz channels 12-13 are always disabled by checking if regional or country code is U.S. Configuration files cannot be changed as they are integrity-

protected by secure boot chain. Tough Mobile 2 SW configuration is world-compatible, ie there are no separate SW variants for regional markets. WLAN 2.4GHz channels 12-

13 are always disabled by checking if regional or country code is U.S. After the airplane mode is turned off, WLAN is on world domain and in this mode WLAN 2.4GHz channels 12-13 are always disabled. Device permits 3rd party application installation but not firmware installation. See chapter 3 from General description and chapter 1 from Third-Party Access Control 5. For a device that can be configured as a master and client (with active or passive scanning), explain how the device ensures compliance for each mode? In particular if the device acts as master in some band of operation and client in another; how is compliance ensured in each band of operation?

Third-Party Access Control 1. Explain if any third parties have the capability to operate a U.S.-sold device on any other regulatory domain, frequencies, or in any manner that may allow the device to operate in violation of the devices authorization if activated in the U.S. 2. Describe, if the device permits third-

party software or firmware installation, what mechanisms are provided by the manufacturer to permit integration of such functions while ensuring that the RF parameters of the device cannot be operated outside its authorization for operation in the U.S. In the description include what controls and/or agreements are in place with providers of third-party functionality to ensure the devices underlying RF parameters are unchanged and how the manufacturer verifies the functionality. Not applicable for Tough Mobile 2 device. It is not a WIFI module. 3. For Certified Transmitter modular devices, describe how the module grantee ensures that host manufacturers fully comply with these software security requirements for U-

NII devices. If the module is controlled through driver software loaded in the host, describe how the drivers are controlled and managed such that the modular transmitter RF parameters are not modified outside the grant of authorization. Sincerely, __________________________ By: Mikko Miettinen Title: Senior Manager Company: Bittium Wireless Ltd. Telephone: +3583442000 e-mail: mikko.miettinen@bittium.com

Date:11/04/2019 to:

Regulatory Certification Body DEKRA Testing and Certification, S.A.U. Parque Tecnolgico de Andaluca C/ Severo Ochoa 2 & 6 29590 Campanillas Mlaga, Espaa Related to product:

from:

Bittium Wireless Ltd. Ritaharjuntie 1, 90590 Oulu, Finland Type of equipment:

Secure Smartphone Brand name:

FCC ID:

IC:

Bittium V27SD-61 3282B-SD61 To whom it may concern, We hereby declare that this device is programmed to operate only in the following frequencies:

2.4 GHz Band, Frequency Range 2.401 - 2.482 GHz Channels 1-11 (BW 22 MHz) Channels 1-11 (BW 20 MHz) Channels 3 and 11 (BW 40 MHz) 5GHz Band, In Canada, the device wont operate in the frequency range 5.6 5.65 GHz (channels within this range wont be used) Frequency Range 5.170 5.330 GHz o Channels 36-64 (BW 20 MHz) o Channels 38-62 (BW 40 MHz) o Channels 42 and 58 (BW 80 MHz) Frequency Range 5.490 5.730 GHz o Channels 100-144 (BW 20 MHz) (Except 120, 124, 128 in Canada) o Channels 102-142 (BW 40 MHz) (Except channels 118 and 126 in Canada) o Channels 106 and 138 (BW 80 MHz) (not in channel 122 in Canada) Operation modes, DFS and TPC This device does not support Ad-Hoc / Wi-Fi hotspot mode in 5 GHz frequency band where the device operates as a client device without Radar detection. Ad-hoc / Wi-Fi hotspot feature is limited to 11 channels available in 2.4 GHz frequency band. As client device, this product does not initiate transmission of any probes, beacons and does not initiate Ad-Hoc operations when not associated with and under the control of a certified master device, according to Section 15.202 of FCC rules. Future changes in this device will not change theses operational characteristics, in any mode of operation. Software security description per KDB 594280 D02:

General Description 1. Describe how any software/firmware updates for elements than can affect the devices RF parameters will be obtained, downloaded, validated and installed. For software that is accessed through manufacturers website or devices management system, describe the different levels of security as appropriate. There are three ways to provision software to the device:

- Software is initially provisioned to the devices in Bittiums subcontractor factory.

- Software is updated over the air, via HTTPS connection

- Software is post-factory flashed via USB flashing method, binaries are obtained from Bittium Extranet In all of these cases, the software integrity is verified so that unauthorized firmware cannot be executed. Bittium Trusted Boot verifies the complete chain from bootloader up to Android OS. The strength of verification algorithms are at least RSA 2048 at all phases of SW bring-up. Over-the-Air SW packages signatures have been generated using ECC-256 key. Tough Mobile 2 firmware is built within secure offline environment where the build servers and key servers are located. It is an isolated network for the sole purpose of generating signed firmware images for the devices. Physical access to the firmware generation environment is limited only to Bittium IM personnel and members of Special Device Platform security team and all the servers have at least AES-

256 strength disk encryption applied and are kept offline when inactive. RF parameters are incorporated within the firmware image as pre-set tuning files and cannot be changed by end-user nor by pure SW changes. 2. Describe the RF parameters that are modified by any software/firmware without any hardware changes. Are these parameters in some way limited such that any other software/firmware changes will not allow the device to exceed the authorized RF characteristics?

Secure boot authenticates the firmware. Authentication starts by MSM670 SOC internal ROM bootloader which validates the 2nd stage bootloader XBL against factory-

provisioned public key root hash (2k RSA). Then execution is passed to the XBL. XBL starts boot sequence which validates the modem signature against the same root key hash and loads it. It also authenticates firmware images for WLAN and DSPs (2k RSA). Linux kernel integrity is authenticated against a public RSA key located within bootloader binary (2k RSA). After that the execution passes to Linux kernel. Kernel authenticates all kernel modules that are loaded against signatures (4k RSA). Kernel also authenticates the Android OS system image integrity using kernel feature dm-

verity where all the system binaries are compared against a signed (2k RSA) hash-table created during SW build-time. Any failure on signature check due to modification to AndroidOS root file system causes device to fall to non-

usable state. 3. Describe in detail the authentication protocols that are in place to ensure that the source of the RF-related software/firmware is valid. Describe in detail how the RF-

related software is protected against modification. 4. Describe in detail any encryption methods used to support the use of legitimate RF-related software/firmware. See chapter 3. 5. For a device that can be configured as a master and client (with active or passive scanning), explain how the device ensures compliance for each mode? In particular if the device acts as master in some band of operation and client in another; how is compliance ensured in each band of operation?

On client-mode, the DFS channels are not available; scanning of these bands is disabled. On DFS mode phone does not actively scan channels, but waits for channel configuration from access point. On master mode, WLAN 2.4GHz channels 12-13 are always disabled by checking if regional or country code is U.S. Configuration files cannot be changed as they are integrity-

protected by secure boot chain. Third-Party Access Control Tough Mobile 2 SW configuration is world-compatible, ie there are no separate SW variants for regional markets. WLAN 2.4GHz channels 12-

13 are always disabled by checking if regional or country code is U.S. After the airplane mode is turned off, WLAN is on world domain and in this mode WLAN 2.4GHz channels 12-13 are always disabled. Device permits 3rd party application installation but not firmware installation. See chapter 3 from General description and chapter 1 from Third-Party Access Control 1. Explain if any third parties have the capability to operate a U.S.-sold device on any other regulatory domain, frequencies, or in any manner that may allow the device to operate in violation of the devices authorization if activated in the U.S. 2. Describe, if the device permits third-

party software or firmware installation, what mechanisms are provided by the manufacturer to permit integration of such functions while ensuring that the RF parameters of the device cannot be operated outside its authorization for operation in the U.S. In the description include what controls and/or agreements are in place with providers of third-party functionality to ensure the devices underlying RF parameters are unchanged and how the manufacturer verifies the functionality. Not applicable for Tough Mobile 2 device. It is not a WIFI module. 3. For Certified Transmitter modular devices, describe how the module grantee ensures that host manufacturers fully comply with these software security requirements for U-

NII devices. If the module is controlled through driver software loaded in the host, describe how the drivers are controlled and managed such that the modular transmitter RF parameters are not modified outside the grant of authorization. Sincerely, __________________________ By: Mikko Miettinen Title: Senior Manager Company: Bittium Wireless Ltd. Telephone: +3583442000 e-mail: mikko.miettinen@bittium.com