A discussion of Electronic Surveillance techniques
Electronic Surviellance
Who'd bug me? I hear you ask what for, well just remember that with the introduction of EPSS in the sattes and System X over here every call has a log and that log contains who you called, where it was from and how long. In a rec article in the Guardian it pointed out that BT and the police kept 40 people "Under Surviellance" for 9 months before actually arresting them for telephone fraud. Still think no-one wants to bug you?, well later on there are some hand tips to detect these bugs but first you need to know what they are:
Body Mics.
These are just mics which are concealed on the body, then hooked up to a transmitter or a recorder. These range from flat microphones taped to the skin or tieclips, cufflinks, wrist watches whatever you need.
Condenser mics need their own power as they modify the power in accordance with the sound so results in thicker leads.
Range: Small and can pick up a lot of background noise
Conditions: Close contact, quiet - good for conversations etc.
Cost: Relatively cheap.
Contact Mics. Spikes. Tube Mics.
This allows the eavesdropper to listen in on someone in the next room, they come in several types.
Contact Mics
These mics respond to vibrations in a sounding board like a door, and are available as pickups for guitars etc. The sounding board can be a door, a window, or a thin wall and only need to be pressed or glued to the board. As the wall gets thicker it is harder (if not impossible) to use a contact mic. this can be solved with ....
Spikes
A spike is a spike of hardened steel which is hammered into the wall and nearl comeout at the other end - but not quite, then a microphone is mounted on the spike which will pick up the vibrations from the next room.
Tube Mikes
These are simply microphones in a sealed box with a small plastic tube protruding from it. Then connect the mic to an amplifier and then stick the tube where u want (a keyhole) and then listen. You can drill a hole in the wal or use the back to back sockets in hotels, if drilling make sure that no bits plaster fall off - common method of detection.
Range: Next room or can be used with a transmitter
Conditions: Just needs to be close
Cost: The mics are cheap but the radio bugs and associated equipment can be expensive
Small Directional Mics.
These are designed to be used at short distances and directional so they can pick up a conversation. Can be mounted in a briefcase or in a pen etc. and must be aimed at the target - the briefcase one can be connected to a tape recorder. Pen or sleeve types can be connected to a pocket recorder. A variation is a MI mounted in a small bell shaped object and is held in the hand, then you walk i front of the target and they will not suspects anyone following from the front.
Range: Small and can pick up a lot of background noise
Conditions: Useless in a crowded street, or with something between target and
Cost: Relatively cheap.
Shotgun, Machine Gun, Rifle Mics.
These are long distance directional microphones, and often have handles and can resemble guns (be careful when aiming one of these at someone as they might think it is a gun and you might not be wearing a bullet proof vest). These are then hooked up to an amplifier or tape recorder, swing from left to right and stop when sound is loudest. These can be difficult to conceal and difficult to aim, also without a frequency analyser to level out sounds any background noise can drown the conversation.
Range: can be several hundred feet
Conditions: calm weather and quiet
Cost: expensive with amp and accessories
Parabolic Mics
These are very like rifle mikes, usually a large circular metal or plastic dis which reflects sound to a microphone mounted in the centre of the dish. They are not as sensitive as rifle mics. but are a lot cheaper, they are bulky though and difficult to hide. You can hide a rifle mike under a long coat but not a dish unless your a woman who happens to be pregnant. Can use bird song recording as a cover - with a bird book in your pocket etc. tweed jacket. Condenser or Crystal mics best for long range devices, output is usually higher than dynamic mics. These can be bought anywhere - cheap.
Range: can be several hundred feet
Conditions: calm weather and quiet
Cost: expensive with amp and accessories
Like rifle MIC.
Radio Bugs
This is a small transmitter with a microphone. The devices can be combined to perform as a receiver and a microphone (used in mind reading acts). They are broadly split into two types - those which power them selves and those which draw power from some source. Bear in mind the size also has to include the antenna which can be several inches long. There is a problem of signal drift which can be overcome with a crystal control - but this requires more power.
If they are not disguised they can be a dead give away (they receiver doesn't need to be disguised as the bugs can be tuned to operate on FM (VHF) or AM so just listen in your radio or car radio), to get around this several novel methods of disguise have been used.
Martini Olive Bug
This is designed to look like an olive on a cocktail stick, the transmitter is the olive and the antenna the stick. Range about fifty feet and can function happily at the bottom of the glass.
Sugar-Cube Bug
This has two audio frequency circuits and three radio frequency circuits. Sealed in a protective silicon shell designed to resemble a sugar cube. Can transmit while at the bottom of a cup of coffee.
Pen Bug
Ball point or fountain pen and switched on by twisting the barrel or removing the cap and placing on the other end and they write.
Calculator Bug
Transmitter is built into a popular calculator which will function normally and can draw power from the calculator battery.
Plug Bug
Looks like a standard 13 amp plug but has a transmitter whih has own battery or can draw power from mains. Also can use earth wire as antenna.
Adaptor Bug
Works like an ordinary plug but transmitter built in , can use mains power.
Light Switch Bug
Built into the back of a rocker type light switch and draws power from mains supply - two models available - one which is on all the time and one which transmits only when the light is on.
A problem with all these bugs is the limited battery life, there are several methods of extending battery life. Vox activated - these have a preset level at which they will switch on and a delay when they stop (so they don't stop whi there is a gap in a sentence) but because of the switch the bug is bigger. Another method is to incorporate a timer circuit and this will turn the bug on and off when set ( digital watch technology) can be set 9-5 when people are in offices. A more expensive way is to use a radio controlled bug, a coded signal is sent to activate the bug and then it switches off after two minutes. Very expensive though.
HOMERS
These are radio transmitters used to track someone, it is simply a transmitter which sends high powered pulses and a receiver picks them up as a series of beeps, the transmitter is usually the size of a cigarette packet and has a sho rigid aerial sticking out and a couple of powerful magnets to hold it onto the car. The receivers depend on what you can afford, simplest is one with no direction capability and relies on volume - the closer you get the louder it gets. Then there are those which indicate direction , this can be a vertically mounted loop aerial or a pair of aerials on on each side of the vehicle. When you pick up the sound turn until it is loudest then you are in the same plane as the homer then you can gauge how far away by the speed of the beeps ( the faster the closer) this plane can be behind you as well as in front though. Some extra features are range control - you switch as you get closer e.g 1st settings beeps until a continuous tone then within 6 miles, then 2nd setti this goes into a continuous tone within one mile etc. Another feature can be to null switch, if the target is directly in front or behind you there is no sou if the target moves left or right you will get a tone (different for left and right). Doppler shift receivers will tell you in which direction the target i moving but its expensive.
Homing people can be done by incorporating the homer into a card (business or credit, make sure its think or coloured so the electronics can't be seen) but you cannot have a battery so it relies on the radiation given out by Tv sets an radio's and other electrical appliances and converts them into a series of bee They are only suitable for close work.
Laser Bug
This is rather like a contact mike as it relies on the vibrations produced by sound on the window, it reflects light waves and when they hit the window they will be modulated slightly. Feed a pulsed power supply to a laser and direct t beam at the window and some of this light will be reflected back, use a good astronomical telescope to focus the light and then it passes through a pinhole and onto a photomultiplier tube. The tube and its electronics detects variation in pulse width and translates them back into sound. Infra red can be used, but you will have to use an ordinary light source to target it. Another way is to use cd lasers to pick up conversations and transmit them to a receiver miles away but you will have to line it up VERY accurately. It is also hard to detect or stumble across accidently.
Infra Red Transmitter
This can transmit up to 500 metres and is similar to a radio bug, the bug must be by a window though and a special receiver is needed (maybe in a camera).
Telephone Tapping
Tapping telephones can be done several ways and each relies on different equipment.
Inductive Tap
Induction microphones are very cheap and be bought anywhere , they are a couple of inches long and about half an inch across (cylindrical), it has two wires coming out of one end and a sucker on the other end. The wiring can go to a tape recorded or an amplifier, obviously this can't be used but there are mics which are disguised as pads or other desk objects, in most cases a miniature amplifier is needed. Another type fits over the phone line and alos houses a transmitter also it doesn't cut into the cable although the sound is weak. Alos note that they can be detected if a radio transmitter is built in and the can pick up humming from electrical devices.
Radio Tap
These are transmitting bugs specifically designed for use with phones. The most common device in the ...
Drop in Mike
This is so called as in america the microphone just had to be unscrewed and the new transmitter dropped in. It draws its power from the phone and needs no maintenance. It acts like a normal microphone and transmits all conversations.
Series an Parallel
The obvious difference between these is the way in which theuy are connected to the phone line, the parallel is connected over both lines whereas the series is connected over one, they can both incorporate a small transmitter.
The Parallel bug can be line or battery powered, but you can get the best of both worlds by having them trickle charged - it draws minute quantities and is difficult to detect via a meter. Battery powered versions are said to have a better range and they operate all the time so could lead to detection. No wires have to be cut to install this bug.
The series bug is more common and cheaper, it can be battery or line powered b will only transmit when the phone is in use - this makes detection difficult. The line powered versions are smaller, about an inch square and half an inch think - hiding it in a phone or junction box is easy.
Third Wire Bug
These bugs are connected in parallel and normally line powered although a rechargable battery version is available. Average size is around 1 and half inches by half an inch, it operates like a parallel bug but when not in use switches to its own internal microphone and transmits sound from the room, this is reputedly favourite amongst USA law enforcement agencies.
Infinity Transmitter
These are around the size of a third wire bug and are the most exotic type of bug. They cannot monitor telephone conversations but the device is line powered and can be connected anywhere along the phone line ( or inside the phone) the person calls the target and then sends a tone down the line which activates the Bug. The tone is matched to a receiving unit in the bug and thus they are also known as Harmonica bugs. The bug cancels the bell of the victim's phone and uses an internal mic or the phones mic to send the room conversation down the line - note that these cannot be used where there is a switchboard due to the direct dialling technique. There are several variations of this bug - One device waits for the eavesdropper to dial and then expects a tone immediately this cancels the bell so it doesn't even ring. However the bell could ring and alert the victim. Another device waits for the victim to answer and then says he has a wrong number, when the victim hangs up the device is activated. Another device automatically cuts out the handset if the phone is lifted so operates normally, some cut off after a certain amount of time, some incorporate an led so that installation is easy as the light will b on if installed correctly. They don't need batteries or further attention once installed. They are very difficult to detect and even the phone company can miss it if its off.
Hookswitch Defeat
This is the switch the handset is dropped onto, by defeating this the microphone will still be activated and you can listen in. The defeat can be done by a resistor connected across the switch - an amplifier would be needed on the listeners side as the volume level will be low. The method is to call up say that you have a wrong number and then don't hang up when he does, then listen Although this can work for anyone else too so some are remote controlled. (ton or radio activated). They are hard to detect and cheap, (can't detect as its only one component).
Drop Out Relay
These are widely available and are just electronic switches which switch on whenever the phone is in use. Some have their own batteries or line powered and can activate tape recorders etc. by the relay - just clip on and put the other lead in the tape recorder. They are easy to install and can be used legitimately.
Lost Transmitters
This is a bug which is designed to blend in with the electrical components - they are wired into the circuit board and transmit whenever it is in use and will pick up sounds from the room. These are very expensive if one is found this means you are dealing with some very nasty people.
Direct Tap
All you need is a pair of high impedance head phones and connected to the line via crocodile clips with a capacitor in between to keep out the phone companie electricity. There are many disadvantages as it is very easy to spot and when installing and produce clicking noises on the line. A higher voltage will pass through the lines or terminals and this can be detected by a meter or bulb, the headphones can be replaced by a transformer and then to a tape recorder. Excellent Quality.
Ok so there are the bugs now how the F**K do you find them!
BUGGING - Guidelines
Stick to these if possible, use own judgement in special situations.
Situation Device Used Remarks
Rural Rifle,MIC. Bulky, difficult to conceal,
Location Parabolic mic. need little background noise
and good weather.
Urban Small Directional Difficult to operate in
Location MIC. crowded streets. Background
noise a problem.
Vehicle Radio bug, Am- FM Power a problem unless
VHF, connected to car power.
Can pick up interference fro
vehicle electrics, efficient
will fluctuate as receiver
will have to follow close
behind.
Tape Recorder Normally lots of space in ca
( dash, under seat ), but ne
change tapes. Quality and
reliability excellent.
Restaurants etc. Concealed directional Easy to use, good quality,
Mike. Get close to target. Table b
wall - less background noise
use less against noisy room.
Offices/Rooms Tape Recorder Difficult to conceal and nee
with access. regular access - excellent
quality.
Wired Mic. Range limited to length of w
can be time consuming to
install - may lead to detect
no further attention after
installation. Quality very
good.
Radio Bug Battery type have a limited
life but more flexible in
installation. 100 yard range
quality can be very poor.
use VOX ( voice activate) to
reduce detection.
Hookswitch Defeat Open telephone MIC. room
conservation carried down li
Resistor, capacitor or diode
can be used.Can be missed by
physical search. Works Well.
Office/Room
Without access Contact Mic. Easy and quick, install on
window, door, or wall. Good
results depends on thickness
of wall ( sounding board ).
Difficult to detect.
Tube Mic. Can be pushed through cracks
wall, through keyholes, under
doors, in back to back socket
installation can be noisy
(drill holes), work well.
Very difficult to detect.
Spike Mic. Noisy and difficult to insta
but can work well. Difficult
detect. But can be detected
metal detector.
Infinity Transmitter Fitted easily along phone line
carries conversation anywhere
works, good quality and hard
to detect.
Laser Bug Safest way, but expensive.
Telephone Tapping
Type Remarks
Direct Tap Simple to install, especially at terminal box,
Headphones can be used, or drop out relay and recorded
Very good quality.
Inductive Tap No connections needed, easy to install but has to be
close to phone, needs wiring to transmitter - can be
easy to detect. Quality is poor.
Series or Parallel Can be connected anywhere along the line or concealed
Tap in phone or junction box. Transmits phone conversation
to receiver, poor quality ( as in radio bug) but can
power from line or battery.
Third Wire Bug As above but transmits room conversation when phone n
in use.
Lost transmitter Made to blend in with background of electronics
components - expensive, difficult to fit but equally
difficult to detect.
Drop in Bug Simple to install and some difficult to detect by
physical search. Needs no attention and is reliable.Detecting
1. Physical search
Outside House: start outside the house and walk slowly around it and examine everything carefully, look for any wires going int the walls and make sure you know what they are for and follow them back to the pole etc. look for wires spliced into the cable, particularly in the top of the pole. There may be an inspection hatch if the cables go under ground so try and lift and inspect it. If in a large building look in the terminal box for any wires across terminals i anything suspicious is found then call the company. While walking outside examine the windows ( frames as well) loo for signs of disturbance.
Inside House: Examine ALL furniture, check backs and drawers, wardrobes etc. Look under beds - under the fabric underneath, look for holes, bedrooms are favourite. Standard bugs have a w trailing from them, and a battery on the outside. Don't forget all the disguised bugs and any household ornaments remove green felt or feel underneath for holes.Ask where all objects came from, look at all pictures and frames ma sure they haven't been tampered with . Examine walls, ceilings and floors, also curtains and pelmets, roll back carpets and examine floorboards. Anything suspicious then take up the floor boards and have a look. Look for any suspicious wires tucked under the edges of carpets. Alway examine ceilings from above if possible, especially in bedrooms, wear overalls. If only from below have a look at flaking paint in walls and ceiling and look for mis- matched areas of paint. Examine any holes but check for electrical wires etc. first. Houses and apartments with party walls have problems, the best way to see these is t check for flaking paint or small holes. Don't go round to neighbours when found - they aren't going to let you in they have bugged you. You can dig away at the wall and kn the spike out. Holes for tube mikes can be blocked up wit plaster filler effectively knocking it out. Switch off the mains and look at light sockets ( unscrew ), and look for any extra components. With the power unscrew the ceiling roses and take a look inside, also any other light fittings.
The telephone Pickup the handset and unscrew, examine the telephone thoroughly, small black cubes with wires are trouble, che the hookswitch action, make sure it shuts off the mic, examine all wires thoroughly and see where they go, check to see if any are thinner or thicker and if they use pro terminals or not. Put phone back together and check junct box, look at terminals and check telegraph pole and the junction box at the top.
2. Electrical
First use metal detector, check walls, celings, floors any pipes will run in a straight line , helpful to know where the pipes etc. run Check any ornaments with the detector shake ornaments and check weight, look at base for holes covered with filler.
If no equipment use VHF radio and turn control to see if any screech happens, put next to phone if screech then th line bug, make a call and test again , check junction box same way, Use tv with indoor aerial, make a loud noise an turn tv down and tune tv - if a bug then horizontal lines appear which will jump to the music - nearer the bug large the jump, - this will pick up the bug ( if VHF) from a distance away , send the sound source to several adjoining rooms to detect bugs further away. If found carry on onto rest of bandwidth, get someone to make a call and check again. examine terminal box - voltage between terminals should be 46-50v if lower may be a bug in parallel, infin drop till under 10, lift handset measure voltage 2-12v. i higher then something connected in series (series bug). Open phone and check microphone terminals - hold down hoo switch and if voltage across mic then hookswitch defeat e Check volts across terminal while sending tones down line Examine car, underneath for homers, look at woring for splicing and under dash, feedback search,
Deterrence Paint a thin stripe of nail varnish across gaps, tighten screws then undo by a quarter or 3/4 then make a note of where the slots and the screws are. Apply to junction box too. Check all people coming in and restrict entry - watch at all times. If to toilet go to bedroom and find summit do. If bug found hold a bait meeting to lure eaves droppe If not return to bug and drain battery so has to replace. if bug reconnect wire several times while making a call, series jiggle the hookswitch and then cut off bug.
Training Use labour force, Carbon ribbons just dumped in bin wherea documents shredded. Short hand pads left in drawer document locked away. People wander around freely - ask who - if be careful of security etc. car phone a big risk and portable or freeway wireless ones. use phones far away fr hotels etc. use different tables at restaurants etc. lase bug prevent heavy curtains blinds etc. and clean windows ( dirty ones reflect more) - item ised phone bills, cellul radio - big brother - easy to detect, satellite,
Detecting Bugs
This can be quite cheap and easy.
Field Strength Meter
This is basically a crystal radio set connected to a meter instead of a speaker. It shows the power output of any transmitter in the vicinity and is sold as an aid to ham radio operators. The sensitivity is low so detection should not be further than 12 inches away from the bug. If it does detect something the need will swing across so the furthest swing will be closest to the meter. A problem can be that they will react to a passing police car or a commercial radio station. If one is bought with a receiver circuit then it is tunable so you ca tune into the frequency of the bug. Also an amplifier can aid detection.
Feed Back Detector
When a transmitter gets to close to a receiver then feedback is produced (if at the same frequency). This type of detector relies on feedback and is couple to an amplifier and a receiver circuit. When using these you will need a noise for the bug to transmit (singing etc.), then you simply scan through the frequencies and if there is a bug transmitting you will get a squeal as the detector hits the same frequency. The Feedback detector generally has a further range but can tip off an eavesdropper because of the noise.
Telephone Analyser
This is expensive equipment which will carry out a series of tests on a phone line semi automatically. These are particularly useful when dealing with complicated phone set ups like a switchboard. Tracing an individual pair of wires without one of these can be tedious.
The tests actually carried out vary from machine to machine, they usually come in attache cases and are battery powered. The first test will be to measure the voltage across a phone line when the phone is on and off the hook. If the volt is lower than it should be it may be a bug. If the voltage at the mic is too high then it could be a bug. There is no difference between this and an ordinary volt meter. The next test is a tone sweep, the analyser sweeps through the spectrum and then if anything which reacts to a tone is on the line it will reduce the voltage on the line and the analyser will detect this, stop and give you a warning.
The next test is high voltage pulsing a charge is built up then fired down the line, some hookswitch defeats use a change of voltage to trigger them, if a hook switch is activated the analyser will pick up the voltage of the microphone and the alarm will go off.
Another test is audio listening, the operator will listen to the line and an acoustic generator is switched on. If the operator hears a tone down the line then some sort of hookswitch defeat is in operation, this method can also detect infinity transmitters as any noise will be transmitted down the line which the operator will hear. Each individual wire is tested against each other to see i the sound from the generator is being transmitted down the phone line. (n.b. tone has to be around voice frequency).
Any good analyser will test al these any may even test for conductive paint on casing being used.
Spectrum Analyser
This sweeps entire frequency bands in the same way as a field strength meter searches for radiation. A typical sophisticated Spectrum Analyser can sweep between 20 kilohertz and 2000 megahertz. Some can do this all in one go or in separate plug in modules. It should carry out the scan automatically and when it detects a transmission it will stop and display the frequency, and the strength of the signal on a field strength meter and let you listen to the transmission on an internal speaker. Some analysers have a cathode ray tube as an oscilloscope to display the waveform and even buy another CRT which show the frequency versus amplitude of demodulated components of the primary signal such as subcarriers, and a second frequency indicator for the subcarrier.
You can pick up a spectrum analyser which detects RF radiation including single sideband, pulse width transmissions and those with the carrier wave removed, o a very wide band coverage.
Cable Checkers
This is just a portable metal detector to see where mysterious wiring is going they can be bought anywhere. Also a screamer is available which will detect whether there is a microphone on either end and the MIC will emit a loud noise and so can be located. Also you can use an inductive mic and an amplifier to check to see if anything is on the line.
Detectors can be built using a field strength meter and replacing it with a led, some have a sensitivity control.
Another way to detect a bug is to install a telephone watchdog which detects the resistance or capacitance of the line, if anybody cuts in or installs a bu the devices led will go on - this will only respond to change so any bug on already wil not be detected.
Scramblers - simple scramblers are available, but so are descrambler`s. The more expensive scramblers alter the frequency and parts of speech around 650 to 750 times a second. These can virtually defeat any attempt to descramble, except of course the american security agency.
Jammers - these are simply wide band transmitters which transmit white noise. these will also jam tv's radios etc ... Another jammer uses two high frequency transmitters and will cause any microphone to squeal at the difference between the two. Another magnetically induces an intense noise in the handset microphone which will block any infinity or hookswitch defeats. Any contact mics can be jammed by buzzers or vibrators stuck to the window or sounding board.
THE detector - all bugs use at least one semi conductor, if an ultra high frequency carrier wave is emitted it will be radiated back by the bug. This radiation will contain strong harmonic components - ( a harmonic is a component where the frequency is an exact numerical multiple of the fundamental or strongest frequency. This strongest frequency is the first harmonic, twice the frequency is the second harmonic and so on.). Other objects will only radiate back to the second harmonic and only a semi-conductor junction will produce a third harmonic. A small UHF transmitter and a receiver tuned to the third harmonic is all that is needed ( use like a field strength meter), the radiati emitted back will be minute so the detector will be expensive and have to be v close to the bug.
