Methodology for examining premises using the CPM-700 device.

Methodology for examining premises with the CPM-700 device.

Methodology for examining premises with the CPM-700 device.

Position 1: Unauthorized devices use transmission channels that create physical fields of a certain intensity that can be measured instrumentally.

Position 2: The field intensity of physical fields increases as it approaches the source and the dependence of the increase is nonlinear.

Position 3: Physical fields of unauthorized devices have a strength much greater than the natural background of the room.

Confidential information

Confidential information can be transmitted during negotiations in the room, negotiations on telephone lines and intercom systems, visual images of the actions of people in the room.

Methods of transmitting the received information

The received information can be transmitted from the sensor to the controller via radio channel, wire lines, power wiring, in the infrared range. The following types of embedded devices are used for reception and transmission:

1. microphones
2. telephone microtransmitters
3. wired microphones
4. microphones using 220 V wiring
5. IR transmitters
6. transmitters
7. devices of the “telephone ear” type

SPECIAL CLASSES OF EMBEDDED DEVICES

A special class of devices includes dictaphones (any devices for recording conversations indoors or over a telephone line) as well as stethoscopes that read acoustic information from elements of buildings and premises in places with poor sound insulation.

UNMASKING SIGNS OF EMBEDDED DEVICES

PREPARATION FOR WORK

CALIBRATION OF THE INSTRUMENT

The SRM-700 is built on a modern element base, supplemented by temperature compensation of the circuit parameters, which ensures stable and accurate operation of the device. Due to the high gain, periodic adjustment of the parameters is sometimes required due to the aging of the elements, changes in temperature and humidity of the environment.

If you are in a low RF environment (10 segments or more at high gain), fine calibration is not necessary.

Calibration is performed by connecting the VLF probe to the probe input of the unit (do not connect the VLF probe to any other input during setup). Adjust the calibration block on the side of the unit so that the display reads 2 to 3 segments at high gain.

HEADPHONES

ATTENTION: The headphones for the SRM-700 have high sound quality and low audibility for others. Do not use the volume level in the headphones higher than necessary due to the possibility of being noticed by eavesdropping devices (feedback is possible).

RF PROBE SELF-DIAGNOSIS

The RF probe sensitivity can be tested in low to medium ambient RF conditions by shortening the antenna as much as possible and touching the end of the display scale to it. A functioning probe will produce a «switching noise» (an audible hum), while a faulty probe will produce a very quiet or no noise, regardless of the length of the antenna.

ROOM PREPARATION

A. Close all windows and curtains to eliminate visual contact.

B. Turn on the lights and all normal office equipment specific to the room.

C. Turn on a «known sound» source in the center of the control area to mask the search procedure.

D. Outside the control zone (in an unprotected room/area), deploy your equipment as quietly as possible.

D. Set the ambient radio emission level to normal before searching the control zone.

PHYSICAL SEARCH

The following procedures are of universal application. Visually inspect all items within the inspection area that are large enough to conceal illegal devices (which may be very small). Carefully inspect and, if necessary, open all tabletop appliances, picture frames, telephones, flower pots, books, etc., and powered devices.

Baseboards should be inspected and carpeting lifted to locate hidden wiring. Ceiling panels should be carefully inspected from all sides; also inspect all devices outside the inspection area that contain microphones, tape recorders, and cameras.

Ultraviolet markers are very convenient for monitoring changes in surrounding devices.

TECHNIQUE FOR SURVEYING A ROOM WITH AN RF PROBE

INTRODUCTION

RF probing is used to survey rooms, telephone lines, and electrical wiring to detect tracking systems.

The RF probe contains a low-noise, ultra-wideband (50 kHz — 3 GHz) amplifier that can handle low-level (background) signals from transmitters. The signal level is indicated on the display in the low and high sensitivity ranges and is used to detect the source of radio emission at the highest level. CAUTION: The RF probe contains a highly sensitive amplifier that can be damaged by electrical discharge through the antenna. In conditions where static electricity may occur (dry rooms, carpets), if possible, touch the object under investigation first with your hand and only then with the antenna.

Do not touch the probe to circuits with power on!

Modulation: The CRM-700 is sensitive to amplitude and frequency modulation. Some transmitters use unusual modulation, pulse data transmission mode, or have a very narrow frequency band. They may not provide sufficient audio signal level and will not provide good audibility of the source of the «known sound», but only indicate the presence of the field on the display. Check all «suspicious» frequencies.

Frequencies: The CRM-700 and RF probe are a wideband radio receiver (50 kHz — 3 GHz). Typical radio microphones operate in the range from 50 to 1500 MHz. Lower frequencies require the use of large antennas, which is unacceptable in a real situation. Frequencies above 1500 MHz do not pass well through buildings due to reflection and absorption.

Power: Illegal micro transmitters can be divided into four groups: micro power, low power, medium power and high power. The broadcast area depends not only on the power, but also on the shape and location of the receiving antenna, the environment, radio noise and the parameters of the receiver. High power transmitters can transmit a signal at a distance of 400 m or more and have a power of 100 mW or higher. Medium power transmitters from 1 to 100 mW transmit at a distance of 100 to 400 m.

Low-power bugs transmit at less than 100 m, using less than 1 mW. A special group is made up of micropower transmitters, transmitting 1 µW or less. They are very small and have very short antennas. Due to the unpredictability of the situation in the use of illegal transmitters, more than the minimum required power is usually used for reliability.

PREPARE THE RF PROBE FOR WORK

The following procedures are used each time the RF probe is connected.

A. Plug in headphones, set the sound gain to minimum (counterclockwise).

B. Set the Mode Switch to the Search position.

C. Connect the RF probe to the Probe input of the device and extend the antenna to its full length.

D. Turn on the power to the device and make sure the device is activated.

D. Set the gain level. If the display shows a high noise level (more than 10 segments), switch to the low gain level and, if necessary, shorten the antenna.

E. Adjust the gain to a comfortable level.

ROOM SURVEY PROCEDURE

A. Put on the headphones and hold the RF probe by the rubber handle, position it vertically in front of you before entering the room to be surveyed.

B. Enter the room when the display shows medium. Use low gain if the display shows max (shorten the antenna if the display shows max with low gain).

B. Turn off all devices and lights in and around the control area and see if the display readings have changed. Sometimes a regular fluorescent lamp produces very strong radio emissions, in which case it should be turned off or removed from the room. If the changes in the display readings cannot be caused by such obvious reasons, then this means a real suspicion of the presence of a transmitter.

G. Turn 360 degrees around, watching the display readings, they will change depending on the level of radio emission existing in the room.

D. Select the direction with the maximum level and

examine all objects in which bugs can be hidden. If a bug is nearby, the display readings will increase (if necessary, switch the gain to low).

NOTE: Sometimes a false signal source is detected somewhere in the air, this means that the real source is somewhere nearby. Continue searching.

E : By listening to headphones, you can easily detect local radio and TV signals and two-way radios. Detecting a signal of a «known sound» means that the transmitter has been detected.

SURVEYING PREMISES WITH A STRONG BACKGROUND

It should be noted that in some rooms close to powerful commercial TV and radio transmitters you will have to use low gain (display readings more than 10 segments). Usually you have to monitor changes in the level of strong signals. Often, if the probe is located near wires or a metal object, the display will show an increase in the signal level, as well as the sound in the headphones will become louder. This may not mean the presence of a transmitter, but the operation of metal structures as an extension of the antenna. Check this with a source of «known sound».

There are miniature radio microphones available commercially that operate in the commercial FM band. To meet FCC requirements, it must be very low power, about two microwatts. For this reason, it is very difficult to detect with the

CPM-700. Fortunately, for the same reason, it is of little use as a transmitter due to its short range, less than 15 meters in most cases. In either case, a thorough physical search is necessary in addition to the CPM-700.

SEARCHING FOR TV TRANSMITTERS

Illegal TV transmitters are heard in headphones just like local TV stations. In some cases, you can compare the level of radio and audio signals by simply moving to another room. If you notice that the tone signal changes when the lighting in the room changes, then determine the area with the highest display readings and look for the transmitter and/or camera.

METHODOLOGY OF CHECKING TELEPHONE LINES

INTRODUCTION

The presence of radio transmitters in telephone lines and devices is checked by measuring the signal level in the line in the working position, i.e. with the handset lifted. The presence of a bug is determined by listening to the dialing of a number through headphones. The source of the «known sound» can be turned off, since it is the sound information and dialing that are transmitted over the telephone line. It is possible to use long audio recordings, for example, a business report, to disguise your actions.

PROCEDURE FOR CHECKING A TELEPHONE LINE

A. Bring the SRM-700 probe to the telephone at a distance of approximately 10 cm to reduce the influence of the surrounding radio background. Wind at least four turns of the telephone handset wire around the antenna.

B. Compare the previously measured radiation levels in the room and in the telephone line when the handset is hung up. If there is a significant increase in the display readings, then it is necessary to check by the received sound signal whether this is a legal signal (most likely shortwave) or a microtransmitter powered by the telephone line.

B. After noting the current display readings, lift the handset and watch the readings change (normal increase by two segments). Listen to the dialing of the number through the headphones. If the readings increase and a signal is heard through the headphones, this indicates the possible presence of a transmitter. A «clean» phone produces only a quiet short sound and a jump in the display readings.

D. Check the telephone by repeating the above procedures, moving the probe to the side of the telephone, and measure the difference in readings with the handset lifted and lowered. Listen for dial tone.

D. Check the line where it enters the wall by repeating the lifting/lowering of the handset.

E. Similarly check the switchboard, with someone lifting and lowering the handset.

G. Do the same where the wire enters the outside wall of the building.

PHYSICAL SEARCH

A. Checking the telephone lines with the device must be supplemented by a physical search. Disassemble the telephone set and sockets and look for non-standard telephone parts with multi-colored wires and hasty or careless installation.

B. Check the line from the set to the wall and remove the wall panel, checking all non-standard parts.

C. Conduct a physical search in the patch panels.

D. Conduct a physical search of the entry/exit points of wires inside and outside the building.

METHODOLOGY OF DETECTION OF WEARABLE RADIO TRANSMITTERS

INTRODUCTION

Typical wearable micro transmitters have an output power of 50 mW to 5 W. They emit quite a strong level of radio emission and are detectable at a distance of up to 9 m.

SEARCH ORDER

Set the search mode (Search) and perform a physical search with the RF probe «from head to toe», monitoring the display. You can also navigate by the sound of the internal speaker, its loud «squeak» indicates the presence of such a transmitter.

NOTE: It is not recommended to use the speaker, because the person being examined can turn off the transmitter, and it will be impossible to detect him.

INDOOR MONITORING MODE

In the monitor mode, the SRM-700 can track the appearance of remotely controlled transmitters if the probe is hidden near the control zone. When a transmitter appears, an alarm will be triggered.

MOBILE RADIO TRANSMITTING DEVICES

INTRODUCTION

The SRM-700 can detect radio transmitters that are installed on cars to track their movement. The normal output power of the «bumper bug» is in the range from 100 mW to 5 W in pulse mode.

SEARCH AREA

Before searching, park your vehicle in a location where the radio background has low to medium values ​​(no more than 5 segments). This will prevent interference when searching for a transmitter.

START THE SEARCH

Bugs can be powered by vehicle networks or by their own source. They can be activated by motion sensors, vehicle networks or other methods. The vehicle being examined must be placed in the same conditions as during actual operation. It should be started, driven, accelerated, braked, etc., to activate the devices that may be installed.

NOTE: Sound and voice transmitters are sometimes used to obtain information about a moving object. In this case, headphones should be used.

SEARCH IN THE CAR:

A. Measure the average radio background level at a distance of about 9 meters from the vehicle.

B. Simulate real driving conditions and watch for a distinct periodicity in the display.

C. Hold the RF probe some distance above the ground and walk around the car with it, also check the car antenna. If the car is equipped with a cell phone or other two-way communication, it should be turned off. (Do not touch the cell phone antenna if it is active, it may damage the RF probe.)

G. If a suspicious signal is detected, its source can be localized by monitoring its maximum level.

NOTE: If the search is performed in a vehicle that is not provided specifically for this purpose, but is on a real trip, the search may be difficult due to fluctuations in the radio background. Driving through areas with a high level of «friendly» signals may cause fluctuations in the display readings.

PHYSICAL SEARCH

As with any inspection, the search for a car bug should be supplemented by a thorough physical search. There are a great many ways to activate such a transmitter in a car. Inspect the frame, remove the seats, check all the circuits that have an output to the car antenna.

METHODOLOGY OF INSPECTING PREMISES WITH THE HELP OF A VLF PROBE

INTRODUCTION

The VLF probe is used to search for low-frequency listening devices that use power lines as transmission paths. (A household FM intercom is an example of such a device.) The VLF probe plugs into mains sockets and has an input bandpass filter in the range from 15 kHz to 1 MHz. You can also check other networks, cables and telephone lines for VLF transmitters by connecting their input pair of wires to the VLF probe plug. Some equipment powered by the mains can produce similar low-frequency noise on the mains, which can be mistaken for the desired transmitter signal. Disconnect these devices one by one to isolate the one producing the low-frequency noise. If you are not sure that the detected noise is from the power supply of such a device, then check it for a transmitter.

PREPARING THE VLF PROBE FOR WORK

A. Connect headphones, turn the volume down to minimum.

B. Set the operating mode switch to the Search position (pressed).

C. Connect the VLF probe to the probe input of the device.

D. Check the calibration, the display should be between two and three segments with the gain set to High.

E. Plug the VLF probe into a power outlet in an unprotected area.

G. Set the gain level (high or low). DC noise normally has a reading of three to seven segments.

NOTE: Dimmers and faulty fluorescent lamps can also produce low frequency noise due to harmonics in the circuit. This can be eliminated by removing the lamp or turning the dimmer to maximum. Using a sound filter can also help reduce the low frequency noise. Simply turning off the noisy circuit may also turn off the bug.

CHECKING THE NETWORK

A. Plug the VLF probe into a wall outlet in the test area and compare the display reading with the reading in the unprotected area.

B. Adjust the volume to a comfortable level and turn on the «known sound» source.

B. Check all sockets in the control area in this way.

As ​​you approach the VLF transmitter, the signal level on the display increases. Listen for the «famous sound» in your headphones.

NOTE: The VLF signal does not pass through the transformer, so check all sockets as they may be located on different sides of the windings.

PHYSICAL SEARCH

As always, a thorough physical search should be conducted, as bugs can be disabled remotely or not detected by conventional detection equipment.

Check all power outlets, wall switches, light fixtures, and powered equipment such as computers, copiers, radios, etc. for unusual components and conductors.

ADDITIONAL INPUT

INTRODUCTION

The additional input amplifier is used for «listening» to networks that are suspicious in terms of transmitting audio and other signals. The balanced input allows you to test phones and telephone circuits for external intrusion or track such intrusion in the monitoring mode and record on an external tape recorder. Depending on the input signal level, the high or low amplifier level is selected.

ATTENTION: The additional input should not be connected to circuits with a voltage of more than 52 volts. This can lead to damage to the device and even electric shock!

SWITCHING ON PROCEDURE

Unless otherwise noted, this procedure is used for each auxiliary input.

A. Disconnect any probe if it was connected to the probe input and connect the special cable to the auxiliary input on the side of the device.

B. Connect headphones and set the volume gain to minimum, then set the operating mode and gain selection to Search and High, i.e. in the pressed position.

B. Turn on the display and verify the following display settings:

NOTE: The auxiliary input will not function if one of the probes is connected to the probe input.

NOTE: The CPM-700 uses automatic gain control in the audio amplifier circuit to control volume and prevent overload. In this mode, the display will not function at readings above 2 — 3 segments.

CHECKING TELEPHONE LINES

The auxiliary input allows you to check for bugs on telephone lines that work when the receiver is put down and listen to the room by the excited harmonics.

VERIFICATION PROCEDURE:

A. Identify the telephone wires for power and the actual sound (usually red and green) and connect the auxiliary input cable to them.

B. Listen to the signal from the source of the «known sound» through headphones, «clear» the phone does not transmit sound when the receiver is idle. If there is an «electronic trigger» on the line or a jumper in the phone to activate the microphone when the receiver is idle, then you will hear your sound in the headphones. In this case, check the line and the telephone for bugs.

C. Repeat this test with each combination of wires connected to the phone. If necessary, check the purpose of each wire with a digital voltmeter.

D. You may want to perform this test in monitor mode since these devices may be remotely controlled and not currently operating.

NOTE: RF and VLF probes can be used to test telephone lines for RF and VLF as described in the relevant chapters of this manual.

IDENTIFYING DETECTED WIRING

During a physical search, you may find «unknown» cables and wires. Using the additional input of the CPM-700, you can listen to these lines to determine whether they are used for legal purposes or for illegal transmission of information.

Even if the line is used legally, it does not mean that it is safe from the point of view of information leakage. Loudspeakers, intercoms, computers, tabletop radios and security alarms that respond to sound can be used to illegally listen in on a room. When a loudspeaker is producing sound, it usually cannot function as a microphone, but if it is turned off, it certainly can. To protect yourself in this regard, disconnect and remove all speakers not used in the room. For the remaining ones, proceed as follows: upgrade the speaker circuit with a switch and resistor, as shown in the figure, in order to physically isolate the speaker. The load impedance should be 1 watt for office equipment or tabletop speakers and 5-10 watts for more powerful music speakers. The resistance value should be the same as the speaker.

Caution should be exercised when dealing with a company that installs an office security alarm that works by listening to a specific line, thereby monitoring what is happening in the room. While most companies are trustworthy, the fact that a line is being listened to is a red flag. Even if the alarm system is turned off during business hours, the line with the microphone is still in place and can be used for illegal eavesdropping. Using switches as described above to physically isolate the microphone can minimize the danger. Depending on the level of security required, it may make sense to not equip a room such as a conference room with an alarm that monitors the sound in the room.

NOTE: Graphite or electret amplifiers may require a DC power source. Usually, if you are searching and the other party does not know about it, or there is no remote control for the power line with the bug, then the audio signal transmitted by the bug will be detected. But if the power can be disconnected, then there will be no signal. In this case, you should check the purpose of all the wires found. Make sure that wires that look like thermostat wires actually go from the thermostat to the air conditioner, and not somewhere else.

WARNING! Before attempting to connect the device to an unknown wire or cable, make sure that it is not under dangerous voltage. The voltage value should not exceed 50 V for both AC and DC.

CHECKING WIRES/CABLES FOR AUDIBLE SIGNALS

A. Perform the procedure for turning on the device with an additional input, as described at the beginning of the chapter.

B. Make sure that the wire or cable being tested is not under dangerous voltage and connect a special cable from the auxiliary input to it.

C. Adjust the automatic gain control to a comfortable audible level. You can use a filter to reduce DC noise.

D. Try to hear your source of a «known sound» or any unusual noises.

E. If there is an overload of the input sound, you can change the gain to Low.

E. In a multi-core cable, each pair of wires should be checked, regardless of whether they are twisted pair or not. All paired combinations of wires should be checked.

G. Test all suspicious wires in the control area.

NOTE: RF and VLF probes can be used to test telephone lines for RF and VLF as described in the relevant chapters of this manual.