Page Contents


  • Radio Transmitters
  • IR Transmitters
  • Visible Light Transmitters
  • Hardwired
  • Contact
  • Lasers
  • Probability of Intercept


  • Radio Transmitters

  • Profile:
  • An RF transmitter is the classic "bug"; a tiny device that transmits sounds around it over the radio. RF transmitters can vary in quality and sophistication, from a $20 wireless mic to burst transmitting multiple giga-hertz devices placed by professional spies. RF transmitters of various strains are frequently seen 'in the wild'.


    Common Bug Frequencies


  • Detection:

  • Depending on the sophistication of the surveillance device and the tools being used to hunt it down, detection of an RF transmitter can range from fairly simple to all but impossible. The standard tools for detecting RF transmitters are radio receivers, ranging from relatively inexpensive hand-held scanners to spectrum analyzers and surveillance countermeasures receivers, field strength meters and directional antennas. The object of these devices is obviously to detect any foreign radio transmissions in an area.


    Simply setting up a good receiver in the area and listening (through headphones) for room audio while searching through the bands is the most basic (but least efficient) way to sweep an area. This process should be supplemented by placing a sound generator in the room; either a recorded voice, radio or a tone generator of some sort. If a tone generator is used and the receiver being used is computer controllable a program designed to monitor the radio's output 'listening' for the tone would be most useful, though it would likely be obvious to the eavesdropper what was going on.


    The above debugging technique has several large shortcomings. First and foremost this technique will only tell you that there is a transmitter is within range of your intercept equipment, not where it is. This problem can be dealt with through the use of directional antennas and a signal strength meter. Secondly, directional transmitters, which are inexpensive and very common, will likely not be detected unless antenna polarization is almost perfect. Professionals deal with this problem by moving the antenna though a aproximately 1000 steps in each of the three planes. Finally some surveillance transmitters are voice-activated, hence won't be transmitting unless there is a sound source present.


    The best option for sweeping an area for radio transmitters (aside from physical search) would be to connect an Optoelectronics Scout frequency counter to a computer and a receiver with reaction tuning available. This setup will allow you to pick out any frequencies in the area via the counter, intercept and demodulate any audio available (provided it is within the receiver's coverage area) and automatically log all findings to the computer. The addition of a preselector will allow you to focus on smaller portions of the band, getting better sensitivity. Better results can be had by using a different model of counter, as the Scout's (10MHz-1.4GHz) frequency coverage is a bit lacking. Using a different counter will, however, sacrafice the reaction tuning ability.


    When searching for hostile radio signals its necessary to carefully comb out friendly signals, as the FM station a mile away isn't a bug (but a clever eavesdropper could set a device to transmit on a signal right under a broadcast frequency using a technique called 'snuggling'). If your equipment can't be set to lock out specific frequencies, you're probably better off searching them all.


    The next rule of RF sweeps is to demodulate everything. That weird beep-squeal is digital traffic. Its likely a pager, but theres no way to to be sure without demodulating it. A discussion of techniques used to attempt to evade detection and demodulation can be found lower on this page.


    If your paranoia and pockets run deep, get a scanner from another country, which will have cellular frequencies available (many eavesdroppers will use cellular phones or cellular phone parts as a surveillance transmitter because of laws banning sales of scanners that can 'listen in' on cellular frequencies).


    Have any friends that are into ham radio? Ask them about 'fox hunting' or 'T-hunting'.



  • Countermeasures:


  • Securing an area against RF transmitters can be done by either shielding the room or jamming the transmitters. Either technique will have a major drawback because anything else that utilizes radio waves (pagers and cellular phones to name two) will cease to function. Complete details on building bug proof rooms is available in the book "Building Bug Proof Rooms". Transmitters can be jammed by either using noise generators or by flooding the radio spectrum with noise from an RF signal generator or spark gap transformer.



  • Further Resources

  • * A most excellent Fox hunting index can be found at http://www.ac6v.com/


    * The foxhunting webring has some good resources, though you'll have to dig.



    Infrared Transmitters

  • Profile:


  • Infrared transmitters differ from most people's conception of "bugs", utilizing modulated infra-red light (usually near-IR) to transmit sound instead of radio waves. IR transmitters are increasingly seen "in the wild" despite their operating limitations. IR devices require a line of sight to the L.P. (if they're inside, they'll need to be near a window) and work best at night because of background noise caused by the IR component of sunlight.


    Before dismissing infrared transmitters as James Bond nonsense, consider how pevalent infrared stereo headphones have become. A few dollars worth of microphone parts can turn these peripherals into a nasty surveillance threat.


    IR transmitters also exist as a native threat, in the form of wireless PC peripherals.



  • Detection:


  • Near-IR transmitters can be detected through the use of an infrared video camera. Viewing the area through the camera with all white light turned off and blocked out will show 'blooms' where infrared pulses are being emmitted. Care must be taken with infrared cameras to make sure that an illuminator is either removed, turned off off or covered in order to prevent the illumiator's infrared light from overwhelming the IR generated by a transmitter. Many infrared video cameras have their illuminator on the front.


    Night vision devices can also be used to detect IR transmitters (be very careful and use a 99% filter or you risk frying your tubes and retinas), as can IR sensitive plastics (which are sold as testers for remote controls).



  • Countermeasures:

  • Pull the shades!! Infrared transmitters are using light to broadcast audio and still have to follow the basic laws of physics, so blocking their transmission is the simplest method to defeat them. If you enjoy your view IR blocking glass is available but expensive. Make sure that the glass in use blocks near-infrared, not just thermal IR.


    In place monitoring with a near-IR camera is so inexpensive as to be worth it. If wireless peripherals are in use, bite your tongue and use a cable.


  • Further Resources


  • Visible Light Transmitters
  • Profile:

  • Visible light transmitters (light modulators) are one of the more bizarre surveillance devices currently seen in the wild. Visible light transmitters work by by altering the voltage flowing through a light source (usually a pre-existing one like a lamp). The light's intensity fluctuates according to room audio, transmiting it to the eavesdropper. A special purpose receiver is required to intercept the signal. Due to their method of transmission, this breed of visible light transmitter is used almost exclusively at night. Light modulators can also use external light sources such as lasers (popular because of range benefits), LEDs or lamps; though this particular type of modulator is more difficult to conceal.

  • Detection:


  • The fluctuations in light levels caused by a visible light transmitter can be detected with a photographer's light meter. An AC voltmeter can detect the voltage fluctuations caused a visible light transmitter, if every light source in the area is checked.



  • Countermeasures:


  • Blackout curtains over all windows will reduce the threat posed by light modulators down to almost nil, by blocking the escape of light from the area.



  • Further Resources


  • Through The Air Optical Communication Handbook



    Hardwired Devices

  • Profile:


  • Look around your home and office. Someone ( you if its your home, your company if its your office) has gone to great lengths to install an infrastructure that an eavesdropper needs to spy on you. Wired intercoms, stereo speakers, power lines, LAN cabling and telephone lines are all running through the building and many of them are unused. These wires provide an excellent pathway for microphones to be connected to, making for an innocuous surveillance system simply by connecting a transducer such as a microphone or a speaker (yes, a speaker!!).



  • Detection:


  • Hardwired microphones can be detected in the same way as a telephone hot-mic, or by using an oscilloscope to check all lines for abnormal wave forms.



  • Countermeasures:


  • Audio jamming

    Contact microphones

  • Profile:


  • In order to understand how contact and spike microphones work, its important to grasp the fundamentals of microphones. Microphones and speakers are essentially the same (this is GROSS over-simplification, but true); they both have a diaphragm to interact with the air, 2 coils of fine wire, and a power source. In the case of a microphone the air around the diaphragm is moved in and out via sound waves moving one coil of wire in and out in relation to the other. The movement of the coils causes a fluctuation in voltage which is transmitted down the wire and reconstructed by a speaker. A contact microphone simply does away with an external diaphragm, using a wall or air duct instead.


  • Detection:


  • Physical search for a contact mic is the only real option for detection.



  • Countermeasures:

  • Contact microphones rely on the surface their attached to vibrating only with room audio. A device that randomly vibrated the walls in question would make using contact microphones terribly difficult. Piezoelectrics will generate a constant buzz that is not only annoying to everyone in the room, but can be filtered out by an eavesdropper with a notch filter. While acoustic noise generators can run into the thousands of dollars, a cheap radio tuned to a non-english station with a speaker turned to a wall makes an expediant alternative. Remember that several may be needed depending on the size of the wall and the material. Checking for effectiveness can be done with a stethoscope and a tape.





    Laser Surveillance

  • Profile:


  • Readers of magazines like Popular Science or Nuts and Volts have undoubtedly come across ads for a device that claims to allow remote eavesdropping by bouncing a laser off a convenient window. Surveillance systems like these work by aiming a laser containing a sine wave either at a window or hard (hence vibrating) object in the room and analyzing the returned laser beam (by creating a standing wave to cancel out the sine wave and then applying Fast Fourier Transform techniques to transform it into sound). Unfortunately for the eavesdropper that same window pane will vibrate from passing traffic, loud noises, and a host of other sources.



  • Detection:


  • Detecting laser surveillance can be tricky. As any wavelength of light can be used in a laser, techniques can vary. The laser in use must obviously be low power (burning holes in walls or blinding the people who are under surveillance is not to sneaky), and outside the visible spectrum (imagine how people would react to seeing a tiny red dot moving around a room). These restrictions limit lasers to either infrared or ultraviolet wavelengths. Infrared lasers may be detected in the same way as IR transmitters. Ultraviolet lasers (rare) can be detected by using a UV sensitive coating.



  • Countermeasures:


  • A device that randomly vibrated the windows in question would make laser surveillance terribly difficult. Piezoelectrics will generate a constant buzz that is not only annoying but can be filtered out by using a notch filter. A cheap radio tuned to a non-english station with a small speaker glued to the corner of a window makes an expediant alternative (two or more radios would be better for a large window and tuning them to different stations better still). There is glass available for industrial applications that has been coated to be reflective to certain wavelengths of light, which may help prevent laser surveillance. Don't underestimate the importance of good curtains, too.


    Probability of Intercept

    There are many ways surveillance transmitters can evade detection, from broadcastig on non-standard frequecies like cellular guard-bands to utilizing burst transmission. The techniques below are some of the more common methods of 'hiding' from possible detection.


  • Burst Transmitters:

  • Burst transmitters operate by storing a pre-set amount of information (usually room audio, but any intelligence can be broadcast with a burst transmitter) and transmitting it at pre-set intervals. Because the transmitter is only transmitting for very brief periods, detection of burst transmitters is usually very difficult. A receiver can be set to search for burst transmitters by setting it to store every frequency a half mile from the area to be searched so strong signals (like commercial radio) are loaded into the receiver's memory but weak signals (from surveillance devices) are not. Set the receiver up on-site to search its entire coverage looking for signals not loaded into the receivers memory.



  • Sub-Carrier Modulation:


  • Sub-carrier transmissions (also called FM/FM transmissions) are another way to conceal surveillance transmissions. Sub-carrier modulation uses the audio signal to modulate a low frequency carrier wave, and in turn modulates the actual carrier signal. Intercepting sub carrier signals is impossible without knowing the sub carrier frequency, though a spectrum analyzer will show all sub carriers.



  • Spread Spectrum:


  • 'Spread spectrum' is a technique utilized by surveillance transmitters to evade detection and jamming efforts. Spread spectrum devices send out their signal over a wide range of frequencies mixed in with pseudo random noise, making them more difficult to locate with countermeasures equipment and allowing them to support high bandwidth transmissions like video. James Atkinson has authored an excellent tutorial on SS detection, and the magazine Spread Spectrum Scene offers an excellent tutorial.



  • Encryption

  • Encrypted transmissions from a surveillance transmitter are common on high-end systems. Encrypting the transmission makes any attempt to demodulate the signal difficult, and increases the chances that a sloppy or unequipt sweeper will chalk the transmission up to an encrypted phone call or wireless LAN connection.



    Index