Methods and means of protecting telephone lines..
Anatoly Anatolyevich Khorev, Doctor of Technical Sciences
METHODS AND MEANS OF PROTECTION OF TELEPHONE LINES
When organizing the protection of telephone lines, it is necessary to take into account several aspects:
- telephones (even when the receiver is hung up) can be used to listen to conversations taking place in the premises where they are installed;
- telephone lines passing through premises may be used as power sources for electronic devices for intercepting speech (acoustic) information installed in these premises, as well as for transmitting the information intercepted by them;
- telephone conversations may be wiretapped by galvanic or inductive sensor connection of electronic devices for intercepting speech information to the telephone line;
- unauthorized use of the telephone line for conducting telephone conversations is possible.
Therefore, methods and means of protecting telephone lines should be aimed at eliminating:
- the use of telephone lines for listening to conversations conducted in the premises through which these lines pass;
- listening to telephone conversations conducted over these telephone lines;
- unauthorized use of telephone lines for conducting telephone conversations.
Wiretapping of conversations conducted indoors is possible due to the conversion of acoustic vibrations into electrical ones by various elements of the telephone set. These include: the bell circuit, telephone, microphone capsules, etc. Due to acoustoelectric transformations in these elements, information (dangerous) signals arise.
When the receiver is hung up, the telephone and microphone capsules are galvanically disconnected from the telephone line, and information signals arise in the elements of the ringing circuit only. The amplitude of these dangerous signals, as a rule, does not exceed fractions of a millivolt.
Interception of information signals arising in the elements of the ringing circuit is possible by galvanically connecting special highly sensitive low-frequency amplifiers to the telephone line (Fig. 1). However, due to the low amplitude of the signals, the range of information interception, as a rule, does not exceed several tens of meters.
Fig. 1. Connection diagram of special low-frequency amplifiers to a telephone line via an adapter
To increase the range of information interception, a low-frequency amplifier is connected to the line through a telephone line condition analysis device, which is included in the telephone line break (Fig. 2). This device, when the telephone receiver is hung up, disconnects the line from the PBX (the isolation resistance is more than 20 MOhm), connects a special low-frequency amplifier and switches to the mode of analyzing the lifting of the telephone receiver and the presence of call signals. When receiving call signals or lifting the telephone receiver, the device disconnects the special low-frequency amplifier and connects the telephone to the PBX line.
As a result of disconnecting the telephone from the line at the moment of information interception, the noise level in the line is significantly reduced and, consequently, the range of information interception increases.
Fig. 2. Connection diagram of a low-frequency amplifier to a telephone line via a special device for analyzing the state of a telephone line
The second method of increasing the range of information interception is to use the “high-frequency imposition” method, which can be implemented by contact injection of high-frequency currents from a generator connected to the telephone line [12]. The frequency of the “imposition” signal can be from 30 kHz to 10 MHz or more. Due to the high frequency, the “imposition” signal passes not only into the ringing circuit, but also into the microphone and telephone circuits and is modulated by the information signal arising as a result of acoustoelectric transformations. Due to the fact that nonlinear or parametric elements of the telephone set for the high-frequency signal, as a rule, represent an unmatched load, the high-frequency signal modulated by the speech signal will be reflected from it and propagated in the opposite direction along the line. The reflected high-frequency signal is received and processed by a special receiving device, also connected to the telephone line (Fig. 3). The telephone line status analysis device performs the functions discussed above.
The range of information interception using the «high-frequency imposition» method can be several hundred meters.
Fig. 3. Scheme of implementation of the high-frequency imposing method”
Both passive and active methods and means are used to protect a telephone from leakage of speech information via an electroacoustic channel.
The most widely used passive methods of protection include [11, 13]:
- limitation of dangerous signals;
- filtration of dangerous signals;
- disabling sources (converters) of dangerous signals.
Possibility of restrictions of dangerous signalsis based on the nonlinear properties of semiconductor elements, mainly diodes. The low-amplitude limiter circuit uses two back-to-back diodes with a volt-ampere characteristic (the dependence of the value of the electric current flowing through the diode on the voltage applied to it) shown in Fig. 4 [11]. Such diodes have high resistance (hundreds of kOhm) for low-amplitude currents and units of Ohm or less for high-amplitude currents (useful signals), which eliminates the passage of dangerous low-amplitude signals into the telephone line and has virtually no effect on the passage of useful signals through the diodes [12].
Fig. 4. Volt-ampere characteristic of the diode VD
Diode limiters are connected in series to the call line (Fig. 5 b) or directly to each of the telephone lines (Fig. 6) [2, 3, 5, 11].
Filtering of dangerous signals is used mainly to protect telephone sets from «high-frequency interference».
The simplest filter is a capacitor installed in the ringing circuit of telephone sets with an electromechanical bell and in the microphone circuit of all sets (Fig. 5) [2, 3, 5, 11]. The capacity of the capacitors is selected to shunt the probing signals of high-frequency “imposition” and not to have a significant effect on the useful signals. Usually, capacitors with a capacity of 1 μF are used for installation in the ringing circuit, and 0.01 μF for installation in the microphone circuit [3]. A more complex filtering device is a multi-link low-pass filter on LC elements.
Fig. 5. Microphone protection circuits (a) and ringing circuit (b) of a telephone set
Devices that combine a filter and a limiter are usually used to protect telephone sets. These include devices such as «Ekran», «Granit-8», «Gran-300», etc. (Fig. 6) [3]. These devices provide suppression of the low-frequency information signal by more than 80 dB and introduce attenuation for high-frequency signals in the frequency band from 30 kHz to 30 MHz by more than 70 dB.
Fig. 6. Diagram of the device for protecting telephone sets of the Granit-8 type
Disconnecting telephone sets from the linewhen conducting confidential conversations indoors is the most effective method of protecting information. The simplest way to implement this protection method is to install a special switch in the telephone case or telephone line, which is turned on and off manually. More convenient to use is to install a special protection device in the telephone line, which automatically (without operator intervention) disconnects the telephone from the line when the handset is hung up.
A typical device that implements this protection method is the «Barrier-M1» product [14]. The device has the following operating modes: standby mode, call signal transmission mode, and operating mode.
In standby mode (with the telephone receiver on), the telephone set is disconnected from the line and the device is in the mode of analyzing the lifting of the telephone receiver and the presence of call signals. In this case, the isolation resistance between the telephone set and the PBX line is at least 20 MOhm.
When receiving call signals, the device switches to the call signal transmission mode, in which the telephone set is connected to the line via an electronic switch. The connection is made only for the duration of the call signals.
When the telephone handset is lifted, the device switches to operating mode and the telephone is connected to the line.
The product is installed in a break in the telephone line, as a rule, when it exits the designated (protected) room or in a distribution board (cross) located within the controlled zone.
The use of Barrier-M1 type protection devices, along with protection of information from leakage via an electro-acoustic channel, is practically the only method of combating electronic devices for intercepting speech information that use a telephone line as a power source.
Active methods of protecting telephone sets from information leakage via an electro-acoustic channel consist of feeding a masking low-frequency (frequency range from 100 Hz to 10 kHz) noise signal into the telephone line when the telephone receiver is in place (low-frequency masking interference method).
Protection devices that implement the method of low-frequency masking interference are often called linear noise suppression devices. They are connected to a break in the telephone line, usually directly at the telephone case (Fig. 7.) The noise signal is fed into the line when the telephone is not in use (the handset is hung up). When the telephone handset is lifted, the noise signal is no longer fed into the line.
Fig. 7. Connection diagram of linear noise suppression devices
Certified linear noise suppression devices include devices of the MP-1A type (protection of analog telephone sets) and MP-1Ts (protection of digital telephone sets), etc. [8].
Along with electroacoustic channels of information leakage, electronic devices for intercepting speech (acoustic) information can be used to listen to conversations in premises, using a telephone line as a channel for transmitting information. In this case, information can be transmitted both at low (in the speech frequency range) and at high frequencies (from 40 kHz to 10 MHz and more).
For transmitting information over a telephone line at low frequencies, wired microphone systems and devices such as a telephone ear are used” [12].
A typical electronic device for intercepting information includes: a microphone, a microphone amplifier, an electronic switch, and a device for analyzing the state of the telephone line (Fig. 8).
Fig. 8. Diagram of a wired microphone system using a telephone line to transmit information
An electronic switchboard and a telephone line analysis device are used to eliminate the possibility of detecting the fact of a bug being connected to a telephone line by the presence of extraneous signals during telephone conversations. The analysis device monitors the telephone line and, when the telephone receiver is hung up, connects the output of the microphone amplifier to the telephone line via an electronic switchboard. When the telephone receiver is lifted, the microphone amplifier is disconnected from the telephone line. A low-frequency amplifier or a portable device for recording speech information (a tape recorder, a dictaphone, recording devices based on the use of digital sound recording methods) connected to the line using a special adapter can be used as a receiving device in the system.
The range of information transmission using wired microphone systems is several kilometers.
The diagram of information interception using “telephone ear” type devices is shown in Fig. 9.
In this system, an ordinary telephone is used as a remote control device (it is possible to use cellular phones).
The operating principle of the information transmission device is as follows [12]. After dialing the number of the “observer telephone” to whose line the device is connected, the subscriber switches the telephone to tone mode and dials the code number. If the telephone does not have a tone dialing mode, a special code device is used to transmit a coded sound (tone) signal to the line (this device is often called a “beeper”). At the moment of transmitting the coded signal, the “beeper” is brought to the microphone of the telephone handset. The device for analyzing the state of the bug line suppresses the call signals when receiving the coded signal, which ensures the secrecy of the device. If the received code signal coincides with the one recorded in the decoder memory, the electronic switch shunts the telephone line with a resistance of 600 ohms. In this case, the PBX switches the “observer telephone” to receive and transmit information, and a signal from the microphone amplifier output is sent to the line, which allows the calling subscriber to listen to conversations taking place in the room where the device is installed.
When the receiver of the “observer telephone” is picked up, the microphone amplifier is disconnected from the telephone line.
Fig. 9. Information interception scheme using “telephone ear” type devices
Unlike wired microphone systems, in a system for intercepting information using devices of the “telephone ear” type, the range of information transmission is practically unlimited.
As a rule, the power supply for information transmission devices is provided by a telephone line.
The diagram of the system for transmitting information over a telephone line at high frequency is shown in Fig. 10. In fact, the device is a radio transmitter, the antenna of which is a telephone wire. The greatest range of information transmission is ensured by using frequencies from 200 to 600 kHz. Frequency modulation signals are used for transmission.
The range of information transmission when using such systems is several kilometers. But at the same time, unlike wired microphone systems, information transmission is possible not only over an unoccupied telephone line, but also when conducting telephone conversations over it.
Fig. 10. Schematic diagram of the system for transmitting information via a telephone line at high frequency
Power supply for bugs transmitting information via a telephone line at high frequency can be provided either from the telephone line or from autonomous power sources.
In order to protect speech information from interception by devices using the telephone line as an information transmission channel, passive and active methods and means of protection are used.
From passive means of protectiondevices of the Barrier-M1 type are mainly used, the operating principle of which is discussed above.
The following can be attributed to active protection methods:
- low-frequency masking interference method;
- high-frequency broadband masking interference method.
Low-frequency masking interference method similar to the one discussed above. The method of high-frequency broadband masking interference consists of feeding a masking high-frequency broadband (often in the range from 20 kHz to 30 MHz) noise signal into a telephone line when the telephone receiver is in place.
Eavesdropping on telephone conversations is carried out using electronic devices for intercepting speech information, connected to telephone lines in series (in the break of one of the wires), in parallel (simultaneously to two wires) and using an inductive sensor (contactless connection) [12]. The main connection diagrams for intercepting devices are shown in Fig. 11 – 13.
Fig. 11. Scheme of serial connection of an electronic device for intercepting speech information to a telephone line
Fig. 12. Diagram of parallel connection of an electronic device for intercepting speech information to a telephone line
Power supply for electronic devices for intercepting speech information in serial and parallel connections is provided by a telephone line, and in contactless connections – by an autonomous power source. The received information is transmitted, as a rule, via a radio channel. The radio transmitting device is activated only for the duration of a telephone conversation. In addition, the device can record speech information on a magnetic medium. In this case, the recording device is activated only during a telephone conversation.
Protection of information transmitted via telephone lines can be implemented at the semantic and energy levels. At the semantic level, information protection is achieved by using cryptographic methods and means of protection and is aimed at preventing its receipt (isolation), even if the enemy (intruder) intercepts information signals. Information protection methods at the energy level are aimed at preventing (hindering) the enemy (intruder) from receiving information signals directly by reducing the signal-to-noise ratio to values that ensure the impossibility of isolating the information signal by means of unauthorized information retrieval.
This article will consider only information protection methods at the energy level.
a) when connected to one of the wires;
b) when connected to two wires
Fig. 13. Schemes for connecting an electronic device for intercepting speech information to a telephone line using an inductive sensor:
When protecting telephone conversations at the energy level, electronic devices for intercepting information are suppressed using active methods and means, the main ones of which include [13]:
- method of common-mode low-frequency masking interference;
- method of high-frequency masking interference;
- method of “ultrasonic” masking interference;
- method of increasing voltage;
- method of “zeroing”;
- method of low-frequency masking interference;
- compensation method;
- «burnout» method.
The essence of the method of common-mode masking low-frequency interferenceconsists of feeding masking interference signals of the speech frequency range (as a rule, the main interference power is concentrated in the frequency range of a standard telephone channel from 300 to 3400 Hz) [15] to each wire of the telephone line during a conversation using a single grounding system of the automatic telephone exchange equipment and the neutral wire of the 220 V power grid (the neutral wire of the power grid is grounded) during a conversation. In a telephone set, these interference signals compensate each other and do not interfere with the useful signal (telephone conversation). If the information is taken from one wire of the telephone line, the interference signal is not compensated. And since its level significantly exceeds the useful signal, interception of information (isolation of the useful signal) becomes impossible.
As a rule, discrete signals (pseudo-random pulse sequences) of the speech frequency range are used as a masking interference signal.
The method of common-mode masking low-frequency interference is used to suppress:
- electronic devices for intercepting speech information from telephone lines with transmission of information via a radio channel (such frequency devices are called telephone repeaters or telephone radio bugs), connected to the telephone line in series (in the break of one of the wires);
- telephone radio bugs, dictaphones and recording devices based on the use of digital methods connected to one of the wires of the telephone line using an inductive sensor.
Method of high-frequency masking interferenceconsists of feeding a broadband (the spectrum width of the interference signal is several kHz) masking interference signal into the telephone line during a conversation in the high-frequency range of the audio range (that is, in the range above the frequencies of the standard telephone channel) [4, 5, 7].
The frequencies of masking interference signals are selected in such a way that after passing through the selective circuits of the radio bug modulator or the microphone amplifier of the voice recorder, their level is sufficient to suppress the useful signal (the speech signal in the telephone line during the subscribers' conversations), but at the same time these signals would not degrade the quality of telephone conversations. The lower the frequency of the interference signal, the higher its efficiency and the greater the interfering effect it has on the useful signal. Frequencies in the range from 6 — 8 kHz to 16 — 20 kHz are usually used. For example, in the Sel SP-17/D device, interference is created in the range of 8 — 10 kHz [10].
To eliminate the impact of a masking interference signal on a telephone conversation, a special low-pass filter with a cutoff frequency above 3.4 kHz is installed in the protection device, suppressing (shunting) interference signals and not having a significant effect on the passage of useful signals. A similar role is played by bandpass filters installed on city telephone exchanges, passing signals whose frequencies correspond to the standard telephone channel, and suppressing the interference signal.
Broadband analog signals of the «white noise» type or discrete signals of the pseudo-random pulse sequence type [4, 7, 11, 15] are used as a masking signal.
This method is used to suppress almost all types of electronic devices for intercepting speech information, both contact (serial and parallel) connections to the line and contactless connection to the line using inductive sensors of various types. However, the effectiveness of suppression of means of information removal with connection to the line using inductive sensors (especially those without preamplifiers) is significantly lower than that of means with galvanic connection to the line.
In telephone radio bugs with parametric frequency stabilization, both serial and parallel connection, a «drifting» of the carrier frequency is observed, which can lead to the loss of the receiving channel [7].
Typical spectrograms of radiation of telephone radio bugs under conditions of masking high-frequency interference are shown in Fig. 14 and 15 [11].
Fig. 14. Spectrogram of radiation of a telephone radio bug with quartz frequency stabilization and narrow-band frequency modulation in conditions of masking high-frequency interference created by the UZT-01 device
Fig. 15. Spectrogram of radiation of a telephone radio bug with parametric frequency stabilization and wideband frequency modulation with the UZT-01 device turned off (dark gray tone) and turned on (light gray tone)
The “ultrasonic” masking interference method is basically similar to the one discussed above. The difference is that the frequencies of the interference signal used are in the range from 20 — 25 kHz to 50 — 100 kHz.
The voltage increase method consists of increase in voltage in the telephone line during a conversation and is used to degrade the performance of telephone bugs by switching their transmitters to a nonlinear operating mode [7]. Increasing the voltage in the line to 18–24 V causes a “carrier frequency drift” and a deterioration in speech intelligibility in telephone bugs with serial connection and parametric frequency stabilization due to “blurring of the signal spectrum”. A decrease in the signal-to-noise ratio by 3–10 dB is observed in telephone bugs with serial connection and quartz frequency stabilization. Telephone radio bugs with parallel connection at such voltages in some cases simply switch off.
The «zeroing» method involves supplying a constant voltage to the line during a conversation, corresponding to the voltage in the line when the telephone receiver is lifted, but with reverse polarity.
This method is used to disrupt the operation of electronic devices for intercepting information with a contact connection to the line and using it as a power source. Such devices include parallel telephone sets and telephone radio bugs.
The low-frequency masking interference method consists of feeding a masking low-frequency interference signal into the line when the telephone receiver is in place and is used to activate (switch on for recording) dictaphones connected to the telephone line using adapters or inductive sensors, which leads to the film being wound in noise recording mode (i.e., in the absence of a useful signal).
Compensation methodis used to mask (hide) voice messages transmitted to the subscriber via a telephone line, and is highly effective in suppressing all known means of unauthorized information retrieval [1].
The essence of the method is as follows [1]: when transmitting a hidden message, a masking noise (a digital or analog masking signal of the speech range with a known spectrum) is fed to the telephone line at the receiving end using a special generator. At the same time, the same masking signal («clean» noise) is fed to one of the inputs of a two-channel adaptive filter, the other input of which receives an additive mixture of the received useful signal of the speech signal (the transmitted message) and the same interference signal. The additive filter compensates (suppresses) the noise component and selects the useful signal, which is fed to the telephone or sound recording device.
The «burn-in» methodis implemented by feeding high-voltage (over 1500 V) pulses into the line, leading to electrical «burnout» of the input stages of electronic information interception devices and their power supplies, galvanically connected to the telephone line [9,10].
When using this method, the telephone set is disconnected from the line. Pulses are sent to the line twice. The first (for «burning» parallel-connected devices) — when the telephone line is open, the second (for «burning» series-connected devices) — when the telephone line is short-circuited (usually in the central distribution board of the building).
To protect telephone lines, both simple devices that implement one protection method and complex ones that provide comprehensive line protection using various methods, including protection against information leakage via an electroacoustic channel are used.
There is a wide variety of protective equipment on the domestic market. Among them, the following can be distinguished: SP 17/D, SI-2001, «KTL-3», «KTL-400», «Kom-3», «Kzot-06», «Cicada-M» (NG –305), «Procrust» (PTZ-003), «Procrust-2000», «Consul», «Grom-ZI-6», «Proton» and others. The main characteristics of some of them are given in Table. 1 [4, 5, 7, 9, 10, 15].
In active telephone line protection devices, the most frequently implemented method is high-frequency masking interference (SP 17/D, «KTL-3», «KTL-400», «SKIT», «Kom-3», «Procrustes» (PTZ-003), «Procrustes-2000», «Grom-ZI-6», «Proton», etc.) and the method of ultrasonic masking interference («Procrustes» (PTZ-003), «Grom-ZI-6»).
Method of common-mode low-frequency masking interference is used in the device «Cicada-M», and the method of low-frequency masking interference is used in the devices SP 17/D, «Procrustes», «Proton», «Kzot-06» and others.
The «zeroing» method is used, for example, in the «Cicada-M» device, and the method of increasing the voltage in the line is used in the «Procrustes» device.
The compensation method of masking voice messages transmitted over a telephone line is implemented in the «Tuman» and «Shchit» (one-sided masking) and «Iris (two-sided masking) products.
Telephone line protection devices are relatively small in size and weight (for example, the Procrustes product with dimensions of 62x155x195 mm weighs 1 kg [7]). They are usually powered from a 220 V AC network. However, some devices (for example, the Kzot-06) are powered from autonomous power sources.
Table 1.
Main characteristics of active telephone line protection devices
Name of characteristics | Device type | |||||
«Procrustes» PTZ — 003 |
«Proton» |
«Cicada-M» (NG – 305) |
Sel SP — 17/D | Thunder-ZI-6 | Kzot-06 | |
Method of common-mode low-frequency masking interference | — | — | + | & #8212; | — | — |
High-frequency masking interference method | + | — | + | + | + | |
Ultrasonic method masking interference | + | + | — | + | ||
Voltage increase method | + | — | — | — | ||
«zeroing» | — | — | · | & #8212; | — | |
Low-frequency masking interference method | + | + | — | + | & #8212; | + |
Method & #171;burning» | — | — | — | — | — | — |
Indication | light | light | light | light | light, sound | light |
Overall dimensions, mm | 157x64x205 | 205x60x285 | 155x60x200 | 152x34x104 | 150x50x200 | 210x32x85 |
Weight, kg | 1 | 2,3 | — | 0.6 | 1.5 | 0.75 |
Supply voltage, V | 220 | 220 | 220 | 220/12 | 220 | 9 |
Note | Digital indication of line voltage | Digital indication of line voltage | Frequency range HF interference: 8–10 kHz; LF interference: 0.3–3 kHz. | Digital indication of voltage decrease in the line | Digital indication of voltage in the line |
To disable («burn»output stages) unauthorized data collection devices with galvanic connection to the telephone line, devices of the type «PTL-1500, «KS-1300″, KS-1303», «Cobra» etc. are used. Their main characteristics are given in Table 2 [9,10].
Table 2.
Main characteristics of «burners» telephone bugs
Characteristic name | Device type | ||
«Cobra» | KS-1300 | KS-1303 | |
Output voltage, V | 1600 | ||
Pulse power, VA |
15 | 50 | |
Operating modes |
Automatic Manual |
Automatic Manual |
Manual |
Continuous operation time in automatic mode |
20 sec | 24 hours | — |
Continuous operation time in manual mode |
10 min | ||
Time intervals set by the timer |
from 10 minutes to 2 days | ||
Overall dimensions, mm |
65? 170х185 | 170х180х70 | 170х180х70 |
Supply voltage, V |
220 | 220 | 220 |
Number of connected telephone lines |
1 | 2 | 2 |
The devices use high-voltage pulses with a voltage of at least 1500 — 1600 V. The power of the «burning» pulses is 15 — 50 VA. Since the circuits of the bugs use miniature low-voltage components, the high-voltage pulses break them down and the circuit of the bug is put out of order.
The «burners» of telephone bugs can work both in manual and automatic modes. The time of continuous operation in automatic mode is from 20 seconds to 24 hours.
The KS-1300 device is equipped with a special timer, which allows, when operating in automatic mode, to set the time interval for sending pulses to the line within the range from 10 minutes to 2 days [11].
Along with active protection means, various devices are widely used in practice, which allow monitoring certain parameters of telephone lines and establishing the fact of unauthorized connection to them.
Methods ofmonitoring telephone linesare mainly based on the fact that any connection to them causes a change in the electrical parameters of the lines: the amplitudes of voltage and current in the line, as well as the values of capacitance, inductance, active and reactive resistance of the line [4, 5, 8, 9, 11]. Depending on the method of connecting the information interception device to the telephone line (serial, in a break in one of the wires of the telephone cable, or parallel), the degree of its influence on the change in the parameters of the line will be different.
With the exception of particularly important facilities, communication lines are built according to a standard model. The line is introduced into the building by a trunk multi-pair (multi-core) telephone cable to the internal distribution board. Then, from the board to each subscriber, wiring is carried out using a two-wire telephone cable of the TRP or TRV brand. This scheme is typical for residential and small administrative buildings of sizes. For large administrative buildings, internal wiring is done with a set of trunk cables to special distribution blocks, from which, for short distances (up to 20 — 30 m), wiring is also carried out using a TRP or TRV cable [6].
In static mode, any two-wire line is characterized by wave impedance, which is determined by the linear capacitance (pF/m) and inductance (H/m) of the line. The wave resistance of the main cable is within the range of 130–160 Ohm for each pair, and for TRP and TRV brand wires it has a range of 220–320 Ohm [6].
Connecting data collection devices to the trunk cable (both external and internal) is unlikely. The most vulnerable connection points are: the input distribution board, internal distribution blocks and open sections of the TRP wire, as well as telephone sockets and devices. The presence of modern internal mini-ATS does not affect this situation.
The main parameters of radio bugs connected to a telephone line are as follows. For bugs with parallel connection, the important thing is the value of the input capacitance, the range of which can vary from 20 to 1000 pF or more, and the input resistance, the value of which is hundreds of kOhm [6]. For bugs with series connection, the main thing is the input resistance, which can be from hundreds of Ohms to several Mohms.
Telephone adapters with an external power source, galvanically connected to the line, have a large input resistance of up to several Mohms (in some cases more than 100 Mohms) and a fairly small input capacitance [6].
Of great importance are the energy characteristics of the means of information collection, namely the current consumption and the voltage drop in the line.
The most informative and easily measurable parameter of a telephone line is the voltage in it with the telephone receiver in place and lifted. This is due to the fact that when the telephone receiver is hung up, a constant voltage of 60-64 V (for domestic PBXs) or 25-36 V (for imported mini-PBXs, depending on the model) is supplied to the line. When the handset is lifted, a signal is sent to the line from the PBX, which is converted into a long beep in the telephone receiver, and the voltage in the line decreases to 10-12 V [6, 7].
Most protection devices automatically measure the voltage in the line and display its value on a digital indicator.
If a bug is connected to the line, these parameters will change (the voltage will differ from the typical voltage for this telephone set).
Table 3 shows experimentally obtained values of line voltage drop for some telephone bugs [7].
However, line voltage drop (with the receiver on and off) does not provide a clear answer as to whether a bug is installed in the line or not, since voltage fluctuations in the telephone line may occur due to its poor quality (as a result of changes in the atmospheric conditions, time of year, or precipitation, etc.). Therefore, to determine whether an information interception device is connected to the line, constant monitoring of its parameters is necessary.
When connecting a data interception device to a telephone line, the amount of current consumed also changes (when the telephone handset is picked up). The amount of power taken from the line depends on the transmitter power of the bug and its efficiency.
Table 3.
Experimentally obtained values of voltage drop on the line when connecting some telephone radio bugs
Type of radio bug | Line voltage | |||||
On hook | On hook | |||||
U, B | DU, V | DU,% | U, B | DU, In | DU, % | |
No bookmarks |
63.7 | 0 | 0.00 | 10.4 | 0 | 0.00 |
Series connection, parametric frequency stabilization (f = 140 MHz) |
63.2 | — 0.5 | — 0.78 | 9.9 | — 0.5 | — 4.81 |
With series connection, quartz frequency stabilization (f = 140 MHz) |
61.8 | — 1.9 | — 2.98 | 10 | — 0.4 | — 3.85 |
With series connection, quartz frequency stabilization (f = 472 MHz) |
62.5 | — 1.2 | — 1.88 | 9.7 | — 0.7 | — 6.73 |
With parallel connection, quartz frequency stabilization (f = 640 MHz) |
61.7 | — 2 | — 3.14 | 9.3 | — 1.1 | — 10.58 |
Combined with parallel connection, parametric frequency stabilization (f = 140 MHz) |
61.9 | — 1.8 | — 2.83 | 10.3 | — 0.1 | — 0.96 |
Combined with parallel connection, quartz frequency stabilization (f = 420 MHz) |
62.1 | — 1.6 | — 2.51 | 9.4 | — 1 | — 9.62 |
«Phone ear» |
60 | — 3.7 | — 5.81 | — | — | — |
When connecting a radio bug in parallel, the current consumption (with the telephone handset lifted) usually does not exceed 2.5-3.0 mA [6].
When connecting to the line of a telephone adapter with an external power source and high input resistance, the current consumed from the line is insignificant (20 — 40 μA) [6].
Combined radio bugs with autonomous power sources and parallel connection to the line have low input resistance (several kOhm) and practically do not consume energy from the telephone line, but significantly increase its capacity.
By measuring the current in the line when the telephone handset is removed and comparing it with the standard, it is possible to detect the fact of connecting embedded devices with a current consumption of more than 500-800 μA [6].
The detection of embedded devices with low current consumption from the line by technical means of control is limited by the inherent noise of the line, caused by the instability of both static and dynamic parameters of the line. The instability of dynamic parameters primarily includes fluctuations in the leakage current in the line, the value of which reaches 150 μA [6].
The simplest device for monitoring telephone lines is a voltage meter. When setting up, the operator records the voltage value corresponding to the normal state of the line (when no extraneous devices are connected to the line) and the alarm threshold. When the voltage in the line decreases more than the set threshold, the device gives a light or sound alarm signal.
Devices that signal a disconnection of a telephone line, which occurs when a bug is connected in series, are also built on the principles of measuring line voltage.
As a rule, such devices also contain filters to protect against eavesdropping due to the «microphone effect» in the elements of the telephone set and high-frequency «imposition».
Telephone line monitoring devices built on the principle discussed above react to voltage changes caused not only by connecting data collection devices to the line, but also by voltage fluctuations at the telephone exchange (which is quite common for domestic lines), which leads to frequent false alarms of signaling devices. In addition, these devices do not allow detecting parallel connection of high-resistance (with a resistance of several megohms) eavesdropping devices to the line. Therefore, such devices are not widely used in practice.
The operating principle of more complex devices is based on periodic measurement and analysis of several line parameters, most often: voltage, current, and complex (active and reactive) line resistance.
The most effective method for detecting unauthorized connection to the line, implemented in most telephone line controllers, is to measure the leakage current when the voltage in the line changes. The method is based on the abrupt increase in the leakage current in the telephone line when the transmitter of the transmitting device is turned on. The essence of the method is as follows. When the telephone receiver is put down, a constant voltage of reverse polarity is supplied to the line, the amplitude of which abruptly (for example, with a step of 1 V) increases in a certain interval (for example, from 10 to 45 V). As a result, the voltage in the line will abruptly decrease. After each change in the voltage amplitude, the amplitude of the leakage current in the line is measured, the value of which is compared with the previous one. If the difference in amplitudes exceeds a certain threshold value, a decision is made about the presence of an unauthorized connection to the line.
Modern controllers allow to determine not only the fact of connection of means of information collection to the line, but also the method of connection (serial or parallel). For example, telephone line controllers «KTL-2», «KTL-3» and «KTL-400» allow to detect bugs with power supply from the telephone line in 4 minutes regardless of the method, place and time of their connection, as well as the parameters of the line and the voltage of the automatic telephone exchange [8]. The devices also give a light alarm signal in case of short-term (at least 2 seconds) opening of the line.
Modern telephone line controllers, as a rule, in addition to the means of detecting the connection of unauthorized devices to the line, are also equipped with means of suppressing them. The method of high-frequency masking interference is mainly used for suppression. The suppression mode is switched on automatically or by the operator upon detection of an unauthorized connection to the line.
Along with protecting telephone lines from eavesdropping, it is necessary to exclude unauthorized use of a telephone line for telephone conversations. For these purposes, the following are used: the method of blocking the number dialing and the method of low-frequency masking interference.
To block the operation (dialing) of unauthorizedly connected parallel telephone sets, special electronic blockers are used. The operating principle of such devices will be explained using the example of the Rubin product [13]. In standby mode, the device analyzes the state of the telephone line by comparing the voltage in the line and on the reference (base) load connected to the telephone circuit. When the handset of an unauthorized parallel telephone is lifted, the voltage in the line decreases, which is recorded by the protection device. If this fact is recorded during a telephone conversation (the handset on the protected telephone is lifted), an audible and visual alarm is triggered (the LED for unauthorized connection to the line lights up). And if the fact of an unauthorized connection to the line is recorded in the absence of a telephone conversation (the handset on the protected telephone is not lifted), then the alarm is triggered and the protection device switches to the mode of blocking dialing from the parallel telephone. In this mode, the protection device shunts the telephone line with a 600 Ohm resistance (simulating the removal of the handset on the protected telephone), which completely eliminates the possibility of dialing a number from a parallel telephone.
Using the low-frequency masking interference method discussed earlier eliminates the possibility of not only dialing a number, but also conducting a conversation from a parallel telephone.
Thus, the conducted analysis showed that with the integrated use of various technical means it is possible to completely eliminate the possibility of using telephone lines for eavesdropping on conversations conducted in the premises through which they pass, eavesdropping on telephone conversations conducted on these lines and unauthorized use of telephone lines for conducting telephone conversations.
Literature
- Abalmazov E.I. New technology for protecting telephone conversations//Special equipment. 1998, 1. — P. 4 — 8.
- Baranov V.M., Valkov G.V., Eremeev M.A. et al. Information security in communication systems and means. Study guide. — St. Petersburg: VIKKA named after A.F. Mozhaisky. 1994, — 113 p.
- Gavrish V.F. Practical guide to protecting commercial secrets. — Simferopol: Tavrida. 1994, — 112 p.
- Lagutin V.S., Petrakov A.V. Information leakage and protection in telephone channels. — M.: Energoatomizdat. 1996, — 304 p.
- Review of active technical means of protection//Information protection. 1997, No. 6. — pp. 61 — 63.
- Features of information retrieval devices and methods of blocking them. — M.: Tomsk, NPP «Vikhr», 1996. — 32 p.
- Telephone bug suppressor PTZ-003 «Procrustes». User's manual. — M.: Nelk, 1996. — 12 p.
- Special equipment: Catalog. — M.: NPO Protection of Information», 2000.
- Special equipment for the protection and control of information: Catalog. — M.: Maskom, 2000.
- Technical information protection systems: Catalog. — M.: AOZT «Nelk», 2000.
- Torokin A. A. Fundamentals of engineering and technical information protection. — M.: Publishing house «Os», 1998. — 336 p.
- Khorev A. A. Information protection from leakage through technical channels. Part 1. Technical channels of information leakage. – M.: Gostekhkomissiya RF, 1998. – 320 p.
- Khorev A.A. Methods and means of information protection. Study guide. – M.: MO RF, 2000. – 316 p.
- Device for protecting telephone lines «Barrier-M1». Operating instructions. – M.: TOO «Ensanos», 1998. – 4 p.
- Device for protecting telephone lines and premises from eavesdropping «Cicada-M». Operating instructions. – M.: TOO «Ensanos», 1998. – 6 p.