GENERAL SWEEP ASPECTS
HUNTING FOR ILLICIT TAPS AND BUGS
1. THE THREAT
A company or organisation can lose valuable information in a number of different ways.
1.1 The most common threat and most difficult to discover is 'by word of mouth' by a disaffected or dishonest employee. This especially by an employee who is about to leave and join a Competitor. Temporary staff may also be suspected.
1.2 By direct over-viewing or overhearing of information by outsiders. Cleaners are the most serious threat, since they usually have unlimited access to all departments while otherwise unattended. They are often issued with master keys, which they use themselves or may lend to others if dishonest. They can thus make copies of confidential data in relative safety. Being relatively low-paid, they are open to bribery. During office hours, technicians and delivery people may be suspected.
1.3 By collecting the contents of wastepaper baskets, possibly from waste bins put out for town cleansing department collection. Simple shredders that cut into strips only (rather than cross-cut into confetti) are a target for information-seekers, since presumably shredded information is likely to be valuable and it is not difficult, with some patience, to reconstitute strip-shredded paper.
1.4 By some means of electronic eavesdropping. The most common ways are discussed below.
Within one's own company, there are some obvious points to watch:
2.1 Try to ensure that staff are trustworthy and not disaffected. This means taking up references of new staff, by trying to ensure their loyalty, and by keeping in touch on a personal level.
2.2 See that sensitive information, such as salary and bonus information is kept confidential. It is surprising how many times on countersurveillance sweeps one comes across salary lists in unlocked drawers in accounts departments, employment contracts in manager's desk drawers, etc. An employee seeing a colleague at the same level is earning substantially more than he is, is likely to become disaffected and therefore a threat.
2.3 See that confidential information is locked up when offices are left unattended, especially after working hours.
2.4 Ensure there is effective access control to the premises. In a small company, ensure no outsider can get in without being noticed. In a large company, ensure that entrance can only be gained via a receptionist, and augment this where necessary with an appropriate access control system. Protect directors' suites, research departments etc. from penetration by other employees.
2.5 In large organisations, carry out periodical countersurveillance sweeps, especially before board meetings, policy meetings, etc.
2.6 Alternatively (or additionally) have a reputable outside countersurveillance company carry out high level sweeps.
3. COUNTERSURVEILLANCE SWEEPS
3.1 Physical Search
This is by far the most important part of any sweep. Some aspects of physical sweeps are as follows:
Examine all drawers, cupboards, etc. that are not locked. Any keys found in desk drawers should be used to see if they unlock other drawers, safes, or cabinets, and examine these also if so. Note any confidential information found.
Examine walls, floors, ceilings, windows and doors for anything unusual. Look behind pictures, above suspended ceilings and under 'computer-room' suspended floors. Look for small microphones and thin connecting wires especially along skirting boards. Look for small hidden radio transmitters, which may be the size of a sugar cube, especially on the underside of tables and chairs, behind filing cabinets etc. Such transmitting 'bugs' may also be disguised as a pen, ashtray or calculator etc.
Unscrew and look behind all mains outlets and telephone connection outlets, whether wall mounted or under-floor mounted. Dismantle and examine all telephone instruments.
Look behind radiators, especially those recessed in louvered enclosures. Examine heating/air-conditioning ducts.
Examine wall and ceiling lights, especially chandeliers.
Walk round outside of premises and examine for hidden wires, or anything unusual.
3.2 Radio Sweep
Radio transmitting devices are probably the most popular types of eavesdropping device. They are readily available, relatively cheap, and widely advertised. For instance, they can be bought over the retail counter from such firms as Lorraine Electronics in London. This company has advertised regularly in Exchange and Mart, The British Airways In-Flight magazine, and elsewhere.
A radio technician can manufacture a small simple transmitter in about an hour from parts he probably already has in his possession. Such a transmitter may have a range of 50 yards and work for 10 hours from a PP3 battery. The transmitter itself could be half the size of the battery.
While battery operated transmitters may be placed anywhere, it is equally easy to power transmitters from the electric mains or from a telephone line or extension. Such bugs will continue to operate for years. A popular bug of this type is built into a 2- or 3-way mains adaptor, which may be carried round as an innocuous item, and takes only a few seconds to install in any mains outlet. Alternatively, it can be disguised as a telephone 2-way adaptor and plugged into a wall socket, with the telephone reconnected into one of the two sockets.
Mobile phones are becoming popular bugging devices. A couple of simple adjustments can turn many of them into very effective listening devices, on demand.
While it is possible to install exotic bugs employing SSB Single Sideband modulation, or spread spectrum transmission, or frequency hopping techniques, these are most unlikely owing to cost, complexity, and size. From the practical point of view, bugs are of the following types:
The most likely frequency bands are:
50-2000 kHz for mains propagated bugs, of which the 'baby-alarm' and 'plug-and-talk' intercoms obtainable from Tandy are excellent examples, also the outgoing transmission from cordless telephones.
88-108 MHz for the cheaper bugs that may be used with any Band 2 domestic FM radio receiver.
20 MHz to 5 GHz for more sophisticated bugs, from the 27 MHz Citizen's Band to the 940 MHz cellular telephone band and upwards.
A countersurveillance radio receiver for professional use needs to be of the same order of sensitivity as the eavesdropper's receiver. It needs to cover the whole range from, say 10 kHz to 2 GHz. It needs to be adapted to Sub-Carrier demodulation as well as AM and FM, and noise makers need to be deployed in each office/area while sweeping in order to trigger voice-operated transmitters. Complementary automatic-sweep receivers are available, which require less expertise for their operation and are faster, and these are ideal for the security manager of a large company, where looking for bugs forms only one aspect of his work.
3.3 Telephone Sweep
Telephone systems are becoming increasingly more complex, with many companies having their own internal electronic exchange. In some ways, this makes the eavesdropper's job more difficult, as it does the job of bug-finding. However, as telephone bugs are likely to use the telephone line to supply the necessary power, it is possible to detect them by measuring telephone line parameters. This checks the line from the telephone itself back to the Main Distribution Frame (MDF) where the telephone cables come in from the street.
Since telephones are designed to transfer information from one place to another, they obviously require special consideration in counter-surveillance work.
Considerable time and experience is needed to carry out a comprehensive examination of telephone systems, since there are so many variations, and information on a particular installation encountered is often meagre.
Telephone taps transmit voice information down the existing line, either to an eavesdropper somewhere along the line from the telephone to the MDF - or even to the exchange, or to a distant location via the telephone system as a whole.
Telephone bugs transmit radio information to a nearby location (such as a car parked outside), and may operate only on telephone conversations, or additionally also on room conversations. Thus, radio sweeps are carried out with all telephones operated off-hook.
3.4 Wireless Network Detection
Wireless LANs are becoming prolific in our cities. Detection and assessment of active wireless network traffic is an important part of a counter-surveillance sweep. From the information obtained from a sweep an IT manager can determine whether or not identified LAN wireless access connections are either valid and known or illicit.
If they are valid access points the ranges need to be determined to ensure the data signals do not go outside the building or into public areas, and the points are set up on time zones.
Although encryption is often enabled on the access points, it should be noted that some encryption can very easily be overcome with a software switch on standard wireless LAN software packages. When within range of an access point, monitoring of LAN traffic can be relatively easy and thus subsequent penetration into the network.
3.5 Non-Linear Junction Detectors
Non-Linear Junction Detectors will find electronic units such as bugs, up to a range of a yard in favourable circumstances, even when such bugs are switched off. A non-linear device is one that conducts electricity in one direction, but not in the reverse direction, such as water in a water pipe fitted with a non-return valve. All transistors, diodes, and integrated circuits are non-linear in this respect. A transmitting head on a 'broomstick' is swept across walls and other suspect areas, while transmitting a small radio signal. Any non-linear device will cause harmonics of this signal to be generated, which are then received by a receiving antenna in the head tuned to the second harmonic and which signal a warning.
Such detectors are especially useful on such areas as fabric or wood panelled walls often found in directors' offices, or on wooden ornaments, pictures etc. They are preferably used in conjunction with a small portable X-Ray machine, so that any discovery may be verified.
3.6 Time Domain Reflectometer (TDR)
TDRs were first used to determine where a break had occurred in under-ocean telephone cables. They send out an electrical pulse, which is partially or wholly reflected where a change in impedance occurs, such as where there is a break in the cable, where an extra cable has been spliced in, or where an illicit device has been added to the circuit. The distance to the break may be calculated from the delay in reception of the return pulse.
The usefulness of the TDR is somewhat limited with readings difficult to interpret, but it is the only device which will detect a parallel connection (for eavesdropping in another room or building) to a telephone cable, even if this parallel connection is not terminated.
3.7 Cable Examination
All accessible electrical mains cable and outlets should not be forgotten. Until all accessible cables are identified and tested they should be treated with suspicion.
4. GENERAL SWEEP ASPECTS
Before undertaking a sweep, it is desirable to carry out a survey of the premises, although this is not always possible, especially if the location is abroad or at a great distance. Number of rooms/offices, total area in square feet/metres, number of telephones, type of telephone system, number of employees, and plan of the premises all provide helpful information. Heavily cluttered offices with suspended ceilings obviously take longer to sweep than a tidy boardroom with plastered ceiling, little furniture and a single telephone.
Sweeps normally take place outside working hours, at night or at weekends. One operative can carry out physical aspect of a sweep at between 100 and 200 square feet of office per hour, depending on clean or cluttered conditions. It is not normal to sweep the whole of an office area, but to confine the sweep to high risk or high information-value areas such as directors' offices, sales/marketing offices, boardroom, etc.
Audiotel Scanlock M2 - Radio Bug Detection System
The Scanlock M2 Countermeasures receiver is designed to quickly detect, identify and locate active radio transmitters that are using either free space or cables as the transmission medium. All cables including mains, telephone can be checked for current carrier or radio frequency transmitters using the Scanlock M2's full range of facilities. The frequency range of the M2 is DC to 10MHz (Carrier Frequency), and 10MHz to above 5GHz (Radio Frequency).
Scanlock Spectral Analysis Software
Scanlock M2 Spectral Analysis software allows full control of the Scanlock M2 counter surveillance receiver directly from the computer. Suspicious signals identified on the computer display can be investigated further. The Scanlock M2 software allows logging, analysis, storage and comparison of all signals captured by the Scanlock M2.
Audiotel SuperBroom Advanced Non Linear Junction Detector
SuperBroom Plus is a portable, advanced non-linear junction detector which discriminates between electronic targets and innocent return signals. Radiating a spectrally pure signal SuperBroom Plus detects the second and third harmonic return signals re-radiated by non-linear junctions that are found in all semiconductors such as diodes and transistors. Combined with SuperBroom Plus' superb sensitivity, this and other techniques allow you to detect active, dormant or non-operational electronic devices.
Audiotel TCM-03 Cable Checker
TCM-03 is a sophisticated and operationally flexible cable checking system used to test room cables and wiring for microphone and other bugging signals at levels from micro volts to volts on all types of cable including AC and DC power cable to telephone lines.
Icom ICR3 Audio/Video Receiver
Operating from 0.495MHz to 2.45GHz this dual LCD receiver is used to tune into suspect signals to check for any audio or video signals in the area being surveyed.
Portable 200-Channel Direct Entry Programmable Scanner with continuous 25MHz to 1.3GHz coverage. For tuning into and recording any suspect radio signals. Automatic Modulation Mode selects the modulation method most often used for each band, with manual override.
Sony DCR-PC9E Digital Video Camera Recorder.
A camcorder is used to take video or still pictures of findings.
Necessary or desirable ancillary equipment includes:
· Extendible illuminated mirrors for examining roof-spaces etc.
· Security seals, ultraviolet pens and lamps, as required
· An electric multi-meter
· A cable-tracing oscillator and receiver
· Hand-held radios for communication between operatives
· Small tools, electric screwdrivers etc.
6. HUNTING FOR ILLICIT TAPS AND BUGS
Remember that, if you suspect that you are losing information, it may be due to:
a) an inside person dishonestly passing information on to other people,
b) someone secretly looking at your correspondence, such as office cleaners or bogus telephone engineers, or someone collecting the contents of your wastepaper basket or shredder (if its not a crosscut variety),
c) someone who has put a tap or bug, or other remote listening device, in a sensitive area where you have, or where you discuss, confidential matters.
The first two methods for gaining illicit access to confidential information are not covered in this discussion. Being to do with people, these aspects have to be dealt with by the organisation itself.
The purpose of this paper is to cover the third eventuality above, where information is being secretly obtained by electronic means, such as by the use of listening devices including tape recorders, miniature radio transmitters, or telephone taps.
6.1 PHYSICAL SEARCH
The first and most important check is to carry out a detailed physical examination of the target area. A tiny microphone in a room, connected by fine wires to a remote listening place, is unlikely to be detected except by visual observation. Likewise, a miniature tape recorder with voice activation is unlikely to be found except by visual inspection. There are some sophisticated instruments such as non-linear junction detectors that can detect tape recorders and radio transmitters, at close range (up to half a metre) even when they are switched off. However, these require skilled interpretation and can be blinded by legitimate electronic equipment nearby (such as TV receivers, pocket calculators, telephones etc. In carrying out a physical inspection, pay special attention to areas where illicit devices may be hidden, such as:
stuck to the undersides of tables, chairs, settees etc.,
stuck to the backs or undersides of drawers in cabinets and desks,
placed behind books on a shelf, or hidden in the spines of books,
placed behind or in hanging files in filing cabinet drawers,
placed in the arch recess of lever arch files,
placed on top of wardrobes, high cupboards and cabinets,
disguised as commonplace items such as mains 2 and 3 way adaptors, inkstands, and other items given as gifts, or which have appeared unexpectedly,
False ceilings, panelled walls and concave coving mouldings,
Lamps, lampshades and chandeliers,
Inside battery driven device such as calculators,
Inside battery driven devices such as calculators,
Inside telephones and telephone wall connection boxes,
A typical miniature tape recorder is about 10 x 6 x 3 cm in size, and a typical radio bug may be half the size of a 9 Volt PP3 battery. It may be powered by a PP3 or alternatively it may be powered from a telephone line or by the mains, in which case the battery is not required.
6.2 RADIO SEARCH
The favourite way to bug a room is by placing a small radio transmitter in a suitable hiding place in the room. Even better, get the telephone line or the mains supply to provide power, in which the villain has no need to return to the hiding place to collect tapes (in the case of tape recorders) or to replace batteries.
Bugs can be bought over the counter in many countries, and tens of thousands of them are sold each year. In the United Kingdom, it appears not to be illegal to make, sell, buy, and own such bugs, but it is illegal to use them.
Many illicit bug transmitters operate on the VHF FM broadcast band, where an ordinary VHF-FM receiver can be used for their reception. Many of these can also be simply tuned (by the use of a small screwdriver) over the entire civil aviation band 110-135 MHz, thereby becoming a potential hazard to the safety of passenger aircraft.
Radio transmitting bugs normally transmit on VHF (80-130 MHz) with a range of perhaps 100-400 metres, or alternatively on VLF 50-500 kHz with a similar range, over the domestic electric mains supply. Citizen band walkie-talkies may be bought and used for such illicit purposes, as an example of the former, and these operate at HF (27-28 MHz).
Examples of mains bugs are baby alarms, and plug-and-talk intercoms, which may be bought freely in high-street shops, are very quick to install, and are very effective for eavesdropping purposes.
Thus, any radio sweep has to cover both eventualities, and also has to cover a very broad spectrum of the radio bands.
For this reason, the units forming part of this countersurveillance kit have been chosen with care to cover these various types of bugs.
6.3 TELEPHONE TAPS
There are certain types of telephone tap that can be attached to a telephone, either inside the instrument itself, or inside the wall connection box, or further down the line, which are capable of remote control from a caller anywhere in the world. These are generally known as 'infinity' taps since they can be operated from an infinite distance.
In practice, they are seldom employed, since they have to be fairly sophisticated to enable operation without the target person becoming aware. They are often triggered by the villain calling the target number and activating the tap by means of a whistle.
It is possible to connect tape recorders to telephone lines through VOX voice operated switch. However, the villain has to retrieve the tapes periodically, and also to renew any batteries.
The favourite way to tap a telephone line is by means of a small radio transmitter, which derives its power from the telephone line. If connected across the line, it will transmit continuously conversations in the room. If connected in series with the line, it will only transmit telephone conversations when the telephone is 'off-hook' and in use.
7. TYPICAL REPORT
A typical report is available upon request.