Wireless headsets have become the norm in college football. CoachComm LLC claims to have 97% of the market share of FBS programs. The best known competitor is Westcom Wireless. Westcom recently had a case dismissed where the plaintiff, CoachComm, claimed that Westcom was advertising false information and patent claims.

The case itself is relatively mundane, but upon researching the differences between the two company's flagship models, we discover a potentially serious issue.

CoachComm's X-System model is advertised as the FBS/FCS model used by 97 % of programs across the county. Jason Smith, Director of Equipment Operations at the University of Maryland, is the most prominent testimonial on the page, stating "Technical support has been phenomenal...great system!" CoachComm lists the premiere features as "Powerful Management of Game Communications, Enhanced Sound and Clarity, X-System Sideline Cart, Rugged Design and Advanced Features, etc."

Westcom's flagship model, the Atlas Flex System, claims to be "Always ahead of the game" with "900 MHz Clear Call Chipset (Patented feature), 256 Bit Point to Point High End Security, 32 Coaches, 6 channels, etc." The Clemson Tigers are featured on the Westcom homepage, and the Atlas page claims that the system is used by the XFL.

As a side note - the NFL appears to use a standardized Bose system with technology incorporated in aviation and the military. Here is Jim Harbaugh rocking a Bose.

The glaring difference between CoachComm and Westcom is the lack of security mentioned in the CoachComm system specs. Searching the X-system's manual and game day guides (direct link PDF warnings) returns nothing regarding wireless security, encryption, nor passwords. It does mention that the headset uses 900 MHz and 2.4 GHz frequencies.

Police, fire, and EMS operate on the 800 MHz spectrum, and those frequencies are commonly listened to via scanner hardware and applications. I reached out to a fellow first responder, who is also an emergency dispatcher and Marine Corps veteran, to determine the risk to the 900 MHz frequency. He states that without encryption, the 900 Mhz range is just as open to scanner devices as the 800 Mhz range.

The 2.4 GHz range could be accessed via something like HackRF, "open source hardware for software-defined radio." Again, this spectrum appears vulnerable without encryption.

We have been told that most schools use CoachComm. There are a lot of pictures of school helmets on the CoachComm page but not much clarity to who is actively using their equipment. There is an oddity in the photograph, where it appears an Ohio State helmet has had a Rutgers "R" layered over it. Westcom has a picture of Clemson, but their main testimonial is from McMurry University. Instead, let us look at photographic evidence, new and old.

First, here is an archive.org capture of CoachComm's website in 2017 with Michigan at the forefront. Looking at Michigan's past and present photos we see some older technology in 2016. In 2017 we see Don Brown rocking the CoachComm system. Jim Harbaugh has a similar receiver in 2022, however it looks like it may have some potential modifications. In 2023 we see Mike Hart with a similar receiver to Don Brown, with a few extra dials. 

Let's check out Maryland and verify the testimonial: Mike Locksley, you are a handsome Brand Ambassador and a heck of a football coach. Unfortunately, Maryland's gameday communications may be vulnerable.

So let's turn to Ohio State. In 2017, Urban Meyer has a receiver with a giant ATT logo. Could just be a sponsorship placement, or maybe a cellular frequency is being used. Whatever it is, that model does not appear to be from CoachComm nor Westcom. Ryan Day currently has a very sleek and modern looking receiver. Hot dang, that is as slick as your beard, Ryan.  

Let's check out some recent sideline footage from Urban Meyer. It appears he is intently listening to his cell phone while the Ohio State Buckeyes are trailing Maryland 10-7 in the 2nd quarter. I have seen that intent gaze inside a football stadium before. During the 1990s (and probably earlier), it was common in my seating section to have a guy with a handheld radio listening to the gameday radio broadcasts to help understand everything happening on the field. Gleaning facts from Urban Meyer's past, there is no person nor event that would be more important than an Ohio State football game. He is probably listening to something football related. Could be work related. Could be Urban Meyer doing Urban Meyer things.

Going back to Michigan, it is very likely that between 2016 and 2023 Michigan did change its wireless communication technology a bit. It is not for certain if Michigan still uses CoachComm or a system similar to CoachComm. But there looks to have been some upgrades.

It is possible that Michigan had learned about these communication vulnerabilities from somebody with military experience. After all, the NFL uses a standardized system with military level technology.

There is a common tactic amongst cheats - smoke and mirrors. If you are engaged in a high-level espionage technique, then you may want to have people focus on other, more common, cheating techniques. Things like stealing signs. 

It is awfully strange that Connor Stalions operation was so blatantly out in the open. Of course somebody was going to "catch" him. I am not sure if Stalions designed it purposely because he thought it wasn't against the rules, or if he thought he wouldn't get caught, or if he was simply trying to smoke out a few cheaters.

Either way, there definitely appears to be a major difference between Ohio State's communication equipment and other schools. Nick Saban - CoachComm. Dabo Swinney - CoachComm. (Side note - Ryan Day compared Dabo Swinney's sign stealing operation to the KGB)

I can safely say there is a severe vulnerability in college football's gameday communication methods. What schools have taken the ample precautions is not clear. I hope they all take security very seriously. It is possible CoachComm can be encrypted, but without that information in the manual, there is a non-zero chance there are some schools with unencrypted communications.

Ah, just one more thing. 

Even if there was encryption of sideline communications, it is still possible that a bad actor could steal the encryption password and pass that information along to an opponent. Of course, anybody engaging in the act of sharing passwords without authority to do so would be violating the Computer Fraud and Abuse Act.

Those crimes are investigated by the actual FBI. Not the former FBI.

Go Blue.