Radio bug frequencies

BOOKMARK FREQUENCIES

James M. Atkinson, Granite Island Group

Major real bookmark frequencies

For many years, TSCM and intelligence professionals have been working to determine the radio frequency spectrum used by common bugs. These bugs can use any frequency between DC and light; however, this list identifies the most common bug frequencies used by eavesdroppers.

The frequency data provided below is based on reliable documentation (catalogs, intelligence reports, technical materials, court documents, and measurement records from specific devices). For the purposes of analysis, the source reliability scale should be considered to be A and the data validity scale to be 1.

Remember to examine the entire spectrum, not just specific frequencies; but keep in mind that bug manufacturers prefer to group bugs around specific frequencies.

Warning: Beware of those in the TSCM industry who try to convince others that bugs do not work above 1GHz or 3GHz. Those who claim this are outright scammers playing games with you (or are not educated enough).

Some private detective schools, TSCM schools and spy shops sell equipment (at sky-high inflationary prices) and actively try to mislead their students that all they have to do is spend three to ten thousand dollars on equipment to get started in the TSCM field. The retail markup on these spy shop products is usually over 400%, what the shop buys for $500 it sells to you for no less than $2,500, and often more than $500.

There are dozens of cloak-and-dagger masters in the TSCM business who purchase «government-issued bookmark detectors» for $250 and resell them to their corporate clients for $8,500. They remove the manufacturer's markings and attach a label with their name. Some go even further, including people with fake security clearances or confidentiality documents among their clientele.

The frequency coverage of such special kits coming from spy shops usually ends at 1.5 GHz, with adapters and mixers the range can sometimes be extended to 3 — 4 GHz, which for a real (legitimate) TSCM specialist has very limited value.

Such schools and spy shops are trying to change reality and physical laws in order to ensure the growth of their bank accounts….Beware, beware, beware….

A legitimate TSCM inspection (even a basic low-threat sweep) requires at least $250,000 to $300,000 worth of equipment (and often well over $500,000).

Summary (Applies to 98% of all non-diplomatic caches)

All TSCM inspections should include checking (at a minimum) the following frequencies:

(Expect less than 0.1 -2.5 mW at the device's antenna)

(Don't expect the signal to be present for more than 20 — 100 µsec)

Audio signal

……and of course UV/IR! (Look for “IR ghosting”)

…and optical bugs installed INSIDE lighting lamps and fittings

Such a device can use power lines (very popular with federal regulatory agencies), telephone wiring, and HVAC systems as transmission lines (from 3 kHz to 300 MHz) and also use the method with spectrum distribution.

To detect radio frequency transmitters, it is necessary to use a search antenna grid no larger than 10 by 100 feet (the size of an average office).

Every cubic centimeter of the room must be examined visually and using electronic equipment.

For frequencies above 1GHz, an H-shaped waveguide (0.5GHz — 3GHz, 1GHz — 18GHz, 18GHz — 26.5GHz, 26.5-40GHz, etc.) should be used to collect signals.

Do not look for specific types of modulation, but for electromagnetic anomalies in the radio frequency spectrum. Once the source of the electromagnetic anomaly has been identified, then the modulation must be carefully analyzed to identify the type of signal. The source of the radiation must also be localized using direction finding techniques and methods.

Remember: bookmarks are always installed in groups of at least three: one that is easy to detect (a dumb bookmark), another one that you will find by working hard (a professional bookmark), and then a real bookmark that is almost impossible to detect (a spy bookmark).

The only thing that can find a cache is a pair of well-trained human eyes and a set of calloused and experienced hands. Electronic measuring equipment is used only to tell the searcher where to look. There are no magic black boxes that find caches.

All telephone booths, under-stairs closets, dividing points and zones — everything should be checked for tampering and electromagnetic anomalies (radio frequency activity).

All electrical outlets, light fittings and switches, circuit breakers, junction boxes, electricity meters and transformers should be checked for interference and electromagnetic anomalies (radio frequency activity). The most important of these are circuit breaker panels and transformers, as they are usually modified to facilitate inspection.

Microphones or video cameras may be hundreds of feet away from the transmitter or recording device (be sure to check all potential transmission paths).

Use a digital spectrum analyzer and a wideband receiver with an analog SDU 10.7/21.4/70 MHz on the IF, with a maximum dispersion of 100/300/500 kHz as ideal.

RF spectrum analysis and monitoring should be conducted for at least 12 hours continuously prior to the actual cleaning (preferably 72 hours or more). This part of the inspection is performed the day before the actual cleaning and should include monitoring the electromagnetic spectrum away from the actual cleaning site (the separation can be from a few yards to several miles away from the site, helical antennas are commonly used).

To prepare for IPM, the spectrum must be assessed and monitored for at least four hours prior to the event.

Most non-diplomatic professional RF bugs typically operate in the 3kHz to 9GHz range. However, inexpensive, high-quality bugs operating between 3kHz and 21GHz are readily available. For those willing to spend a little more money, bugs operating in the 30 — 50GHz range are readily available. This means that those performing a TSCM inspection should always test well above and below these frequencies.

However, it is best to always test to at least the fifth harmonic of any suspected RF threat (ideally up to the tenth harmonic).

The RF and signal analysis for any TSCM inspection should cover a frequency range of at least 100Hz to 40GHz (ideally from 20Hz to 110GHz and beyond).

Note: Most military, intelligence and diplomatic TSCM inspections search for audio/current carrier/PLA bugs in the 20Hz to 350MHz range, 9kHz to 40GHz — radio frequency bugs emitting into the air, and directional microwave bugs in the 0.3GHz to 325GHz+ range.

Extremely dangerous frequency ranges

Don't forget about the ranges with specific propagation and absorption: (bugs operating below 22GHz are quite inexpensive and easy to get. Bugs operating between 22 and 60GHz are more expensive, but also easy to get. Bugs operating at frequencies above 60GHz are usually expensive and very difficult to get.

The frequency range between DC and 22 GHz is heavily used for covert eavesdropping. The most realistic threat range extends to 60 GHz. The 70 — 110 GHz range is also becoming quite popular due to significantly reduced absorption between the oxygen peaks at 60 and 125 GHz.

Warning:

The region between 600 MHz and 9 GHz is extremely dangerous, since the equipment for listening in this range is inexpensive, has very low power and is highly directional.

In addition, most people conducting TSCM tend not to test at frequencies above 1 GHz or 3 GHz (since the cost of testing equipment is an order of magnitude more expensive than they can afford)

We have video footage of a TSCM inspection in which video cameras (Watec), microphones (Sony), and multiple RF transmitters (2.4 GHz) were not detected by the inspector (using a 1 GHz IFR spectrum analyzer and monitor). The inspector who performed the TSCM inspection was a Washington DC “intelligence expert” (his company is now ridiculed in TSCM circles).

Detection of VLF Emissions and Subcarriers

Subcarrier Modulation:

10 — 500 kHz are the most commonly used bug subcarrier frequencies

RBDS/EAS

Note: A typical FM broadcast may contain 2 to 12+ voice subcarrier channels in addition to the main signal, and subcarriers may have their own subcarriers.

VLF and Current Carrier Bookmarks

Equipment with VLF Emissions

Also, be aware that most VLF devices emit ultrasonic signals. (Use a stethoscope used for defusing explosive devices and a spectrum analyzer with a broadband ultrasonic transducer).

WECO Bookmarks

Ultrasonic/amplified audio bugs working with power, Telco and cable TV lines

Intended for QAM transmission in the microwave range with a distributed spectrum (2.4 — 9.0 GHz)

Typical frequencies of bugs used by amateurs.

Frequencies of bookmarks used by professionals and law enforcement units.

37,000 — 952 MHz — band allocated by the Federal Communications Commission for surveillance activities.

47 CFR 90.19 «Physical monitoring, police surveillance, police operations.»

Open AM/FM/wideband FM, FM — subcarrier, SSB, quadrature, AM, spread spectrum, frequency hopping. If closed, typically uses in-band speech spectrum inversion or 56 — bit DES. (Usually well below 2W, most below 5 — 150mW)

“Tactical” bookmarks

Frequencies and Ranges of Monitoring Devices Used in the United States

AID Bugs Frequencies — Westinghouse/Audio Intelligence Devices, Inc.

If the bug signals are “scrambled”, then this is nothing more than a simple inversion of the speech spectrum, the circuit for “descrambling” costs about $20

Note: AID products often tun into out-of-band channels, so be careful.

The spectrum from 15 MHz to 5000 MHz is the primary threat, from 500 MHz to 3 GHz is a secondary threat, and the “linear carrier” threat is in the range from 3 kHz to 750 kHz.

If the person installing the bug suspects that a TSCM test may be performed, AID suggests a frequency between 30 MHz and 50 MHz, with the receiver sensitivity being no worse than 0.18 µV/-122 dB/mW. The mode is usually wideband FM.

Also keep in mind that AID products are often used for illegal eavesdropping, so familiarize yourself with their real spectra, expect powers below 50 mW, and expect the power line to be used as an antenna.

Security Research bugs — England

Note 1: LYNX video bugs and cameras are often embedded in old bricks, wood blocks, logs, gate posts, etc. VERY, VERY dangerous and easy to hide

Note 2: Most Security Research bugs use an inversion of a fixed frequency to protect against detection, a common inversion frequency is 1.862kHz

HDS Bookmarks — Household Data Services

Sony — wireless microphones and body-worn bookmarks

Lorraine Electronics Surveillance

SKS — Skaggs Telecommunications Service

Swintek

Broadcast Microwave Services

Xandi Electronics

DECO

Sheffield Electronics — no longer in production

Vega

HM Electronics

Sennheiser

Telex

Sampson

Electronics, inc.

RF Link Technology Inc.

These WaveCom systems are commonly modified, repackaged, and sold by spy shops and private detectives as surveillance devices. The telltale sign of such a device is that it operates in the 2.10 to 2.85 GHz range with a slightly modified negative sync pulse on the video signal.

ITS Corporation

Lectrosonics, Inc.

Nady Systems

Electro Voice

Sure Brothers

Microwave Radio Corporatin

Phonac &# 8212; Switzerland

Electra Enterprises

(As well as TV channels 32, 46, 47, 48, 49, 59 and 900 MHz)

DGR Engineering — France

Cameras and microphones are hidden in existing electrical outlets. The system supports up to 240 cameras and microphones on the same circuit. Video and audio signals are transmitted over power lines. Typically used for large-scale installations of surveillance devices, such as in hotels, dormitories and large office buildings. Such a system has been used for several years at NATO headquarters in New York.

Recoton

X10/BSR

Good Mind Industries — Taiwan

Phonex

Radio Shack

Various

LOJACK Corporation

This is a tracking device that is remotely activated using an FM subcarrier).

Police Speed ​​Radar

Electronic control of goods and anti-theft systems in stores

Metal detectors

Frequencies Used by Federal Agencies

Commonly used by federal agencies for bugs, wireless microphones, and body-worn bugs (output power typically below 5 — 50 mW).

Primary Recognizable Federal Bugs

And also broadband frequency hopping on the VHF video signal — TV channels (e.g. 510 or 670 MHz with a hopping band of ±25 MHz

Remember that the federal government can use virtually any frequency between direct current and light.

Specific Federal Control Frequencies

169,445 160,505 170,245 170,305 171,045 171,105 171,845

Frequencies used by reconnaissance satellites

(Mainly wideband spread spectrum/LPI channels)

In addition. 95 — 275 GHz are also used for government tasks and operations, but the use is quite limited.

Note: control satellites can operate on any frequency between 200 and 325 GHz, mainly spread spectrum.

Spread spectrum and frequency hopping bug frequencies

Legitimate industrial equipment (very inexpensive/easy to buy/make)Typically modified for use as a listening device

Spread spectrum bands often used for eavesdropping (very inexpensive)

Spread spectrum bands occasionally used for eavesdropping

Note: Most common spread spectrum/frequency hopping eavesdropping devices hop at rates of 100 to 50,000 hops per second. Even faster equipment (100,000 to 300,000 hops per second) is readily available. The signal lifetime may be as short as 1 microsecond (one widely used system has a lifetime of 3 to 5 microseconds).

Out-of-band equipment

ANY TV broadcast or cable TV frequency

ANY FM radio frequency

ANY paging and alarm frequency

ANY frequency of cellular telephone communication

Changed frequency (902 — 928) of cordless telephones 820 MHz — 960 MHz

Modified amateur radio equipment (can be on any frequency)

Be aware that wideband spread spectrum/frequency hopping bugs (not SIM-based) are very difficult to detect (even if you are within a few feet of them). Watch for increases in noise floor (“Noise Floor Humps”) and carrier feed (through).

All spread spectrum products are detectable, albeit with difficulty.

Once a spread spectrum/frequency hopping bug is detected (in the RF spectrum), all that can be done is to determine the source of the emission — it is virtually impossible to demodulate a spread spectrum signal unless the key is available.

Additionally, a 500 mW spread spectrum product can have an effective range of over 20 miles. In 1994, I field tested a handheld LPD/LPI spread spectrum radio for downed pilots. Power levels varied from half a watt to a watt, and good duplex communications were achieved. At 25 mW or less, we could hear each other clearly at a range of 45 miles on the ocean surface (from a life raft), and 15 miles in the dense forests of Maine. When this product was tested in a heavily built-up urban area (as a bug), it provided a range of 2500 to 8600 feet while maintaining output power below 15mW.

Look for spectrum anomalies (humps) using a spectrum analyzer, use a receiver with compression or a wideband receiver.

Use a search receiver with a wide IF output (700 MHz) and a wide IF bandwidth (>7-70 MHz). Look for characteristic wideband anomalies, then triangulate the signal to locate the device itself. Don't be surprised if you find a table leg, bulletin board, calculator, clock, or wall emitting spread spectrum RF energy.

Note: In the early 1980's, I spent a long time working with diplomatic spread spectrum devices operating between 12 GHz and 60 GHz (detectable with an IF bandwidth of 300 Hz to 200 MHz).

I was recently introduced to a fiber optic bugging system used by the French government that uses a 44GHz IF bandwidth (yes, 44GHz, that's not a typo).

Frequency Resolutions and Filters

Screen the spectrum using the following resolution bandwidths/filters:

Use all resolution bandwidths/filters between 5Hz and 200MHz (depending on the band you're scanning)

For frequencies between 3 kHz and 13 GHz, it is best to start with an IF bandwidth of 3 MHz for «moving» cleaning and monitor the resulting wideband spectrogram.

This allows signal energy to be easily detected, but does not provide any way to identify the signal. The IF bandwidth is then varied until it is approximately 80 — 85% of the bandwidth of the signal in question, after which the result is fed to a vector analyzer for signal identification.

All IF bandwidths are used in turn and the results, presented as a matrix, are subjected to vector analysis, which allows easy extraction of the modulation parameters.

When working with microwave bands, the IF bandwidth should be set between 10 kHz and 200 MHz.

An ideal spectrum analyzer for TSCM should have a resolution bandwidth of 20 Hz and at least up to 100 MHz. The HP 8569B analyzer was/is very well known for its resolution bandwidths from 100 Hz to 22 GHz. A real example from world practice:

The frequency hopping device randomly hops the frequency between 530 MHz and 750 MHz. The IF bandwidth of 3 — 70 MHz makes it easy to identify the signal, while narrower bandwidths make it much more difficult.

Hint: You must use a programmable digital spectrum analyzer! (The preferred sequence is 1/3/5/10/15/20/25/30/50/75/100/150/200…)

Here are some suggested bandwidths you should set when searching for the “best” one.

bias generators/video cameras/SIGINT)