Summary (this will identify the majority of the bugs and wiretaps sold in Spy Shops.)

All TSCM Inspections should include (at least) the following frequencies with an examination of both radiated and conducted signal pathways. Expect to see less than ten milliWatt maximum on the antenna, and for the signal to be present for only a small amount of time.

 

 

An eavesdropping device may use the AC power circuits, telephone wiring, cable TV, or HVAC system wiring, as the transmission path (300 Hz to 450 MHz+), and may also use digital modulation or spread spectrum technology.

To find RF transmitters a search grid of less then 10 by 10 foot is used, and everything that causes any kind of deviation in the noise floor is investigated. Every cubic centimeter of the facility must also be carefully inspected with visual and electronic techniques.

For frequencies above 1 GHz a amplified dual ridged wave guide or standard gain horn (15-18 dBi) and low noise amplifier can be used to collect the signals (.5 GHz - 3 GHz, 1 GHz - 18 GHz, 18 - 26.5 GHz, 26.5 - 40 GHz, etc). The goal is to use highly directional horns, and then to amplify the signal to a high enough level to overcome all instrument noise and cable/connector losses.

Look for any electromagnetic energy on the RF spectrum, and not just specific modulation types. Once the source of the electromagnetic anomaly is identified then the modulation can be carefully analyzed to identify the signal type.

Remember: Bugs are always installed in groups of at least three: the one that was easy to find (the fools bug), the one that you will find if you really work hard (the novices bug), and then the real bug; that's almost impossible to find (the professional spies bug).

 

 

The following three charts represent the frequencies used by thousands of eavesdropping device identified during undercover operations, and/or seized in SpyShop raids around the United States. The population for this analysis was just over 2500 individual eavesdropping devices, and consisted of 43 different models. All models evaluated utilized power levels well below 50 mW, with most well below 15 mW. While the bugs were available on hundreds of frequencies the following 20 were the most common.

 


Composite Frequency Distribution Chart

 


VHF Frequency Distribution Chart

 


UHF Frequency Distribution Chart

 

 

In reality the only thing on earth that can actually find a bug is a pair of well trained human eyes, and a set of calloused and experienced hands. The electronic test equipment is only used to suggest to the TSCM specialist where to look, but does not in and of itself detect or find the bug or wiretap.

 

There are no magical black boxes that find bugs.

 

 

During a bug sweep or TSCM inspection all phone rooms, riser closets, demarcation points, and boots, must all be checked for tampering and electromagnetic anomalies (RF activity). All electrical outlets, light fixtures and switches, circuit breakers, distribution boxes, electric meters, and transformers must be checked for tampering and electromagnetic anomalies. The transformer and circuit breaker panel is the most important of these, as it's commonly modified to facilitate technical surveillance.

A microphone or video camera used for surveillance may be hundreds of feet away from the transmitter or recorder so be sure to check all potential transmission paths and not just the power and phone lines.

In a thorough TSCM inspection; RF Spectrum Analysis and monitoring should take place for at least twelve solid hours before a regular sweep. This part of the inspection is performed the day before the actual sweep, and will involve monitoring the ambient electromagnetic spectrum at locations AWAY from the actual facility (distances range from several hundred yards to several miles away from the facility). In cases when it is not possible to examine the RF spectrum in advance of the sweep at least six hours of time during the actual sweep should be spent examining RF signals.

When properly performed, a careful inspection of the RF spectrum can detect eavesdropping devices even from a considerable distance. Due to this it is highly beneficial for the TSCM team to examine the RF spectrum near the place to be inspected, but not actually inside the suspect area. For example, it is very desirable for the TSCM specialist to set up their instruments a few hundred feet away from the area to be inspected, and to spend at least six hours performing an instrumented analysis. In some cases this can be a conference room elsewhere in the building, a store room, warehouse, or even from a non-de script van located out in the parking lot. A side benefit to this type of an analysis is that it is not intrusive or disruptive at all.

To prepare for IPM or "In-Place Monitoring" the spectrum should be passively evaluated and monitored (inside the facility) for at least two or three hour prior to the meeting, general six hours is best (plus at least an hour or two for even the most basic of external physical examinations).

Many bugs targeted against corporate entities will generally have a transmit frequency between 20 MHz and 3 GHz. For someone willing to spend a little more money; bugging devices can be easily obtained which operate in the 3 GHz to 21 GHz range and above. This means the person performing a TSCM inspection must always inspect well above and below these frequencies.

A good rule of thumb is to check to at least five times the fundamental frequency of any credible RF threat. Up to the tenth or fifteenth multiple is ideal, and is actual dictated by various government standards. The radio frequency and signal analysis portion of any TSCM inspection should cover at least 9 kHz to 21 GHz (30 Hz to above 110 GHz is ideal).

(source of info: www.tscm.com)