Granite Island Group

TSCM 101 - Noise and Sensitivity

In TSCM one of the more interesting technical issues to address is that of noise, and how it effects our TSCM activities. Everything in nature creates or affects some kind of electrical noise, all which must be considered when choosing equipment, or when performing a TSCM service. The two basic types of noise are shot noise, and thermal noise.

Shot noise is caused by current flow flowing though any type of load or resistance.

Thermal noise (or thermal agitation effect) however is based on Boltzmann's constant, the temperature, and the bandwidth of the signal. Thermal noise is based on the kTB formula; the only part of which is within our practical control is B (or bandwidth). Of course you can dunk all your instruments in liquid helium for the cryogenic cooling effect, but it's awkward to drag 800-lbs cryogenic tanks around.

As we narrow instrument or receiver bandwidth (RBW) the noise floor around the signal is reduced allowing the suspect signal to be identified even in extremely noisy environments. If we can time gate or phase lock the sweep of the instrument being used during the sweep an artificial aperture is created which in turn also enhances sensitivity. Instrument sensitivity is directly related to the system bandwidth, which may or may not match the actual signal bandwidth.

The noise floor may be further reduced by the use of preamplifiers, tracking pre-selector, and highly directional antenna. Of course, low loss cables, and antenna's suitable for the bands being measured are also critical to facilitate sensitive measurements.

Statistical averaging present on most modern day instruments will further enhance sensitivity by at least an additional 15-20 dB. Combining averaging with preamplifiers, pre-selectors, and directional antenna system gains of well in excess of 35-50 dB is common (which has a very dramatic effect when finding eavesdropping devices).

The following table represents the noise floor levels that can be expected for each of a given bandwidth. Eavesdropping equipment commonly calls for a signal to appear at least 3 or 6 dB above the noise floor to facilitate a useful intercept (sometimes even 12 or 20 dB). In TSCM we assume that the eavesdropping signal bandwidth is as narrow as 2.5 kHz, and sometimes below 1 kHz. This means that the TSCM specialist must examine all RF signals that exceed -150 dBm (or 6 dB below the narrowest nf-kTB of the bug).

Using the above table it's easy to see why many products used to find bugs are relatively deaf as they utilize very wide bandwidths and thus create huge amounts of noise which allows the bug to "hide in the grass" and not be detected.

Take for example a TSCM specialist using a 1 GHz frequency counter (such as the 3000A or Scout) with a collapsible antenna or a "rubber ducky". The thermal noise presented by a 1 GHz bandwidth is easily determined to be at least -83.977 dBm. In reality the noise levels are higher as the frequency counter introduces considerable noise and interference of its own.

Since the "rubber ducky" antenna is close to unity gain, and a pre-selector is not being used, the noise floor is typically not effected. Of course by simply adding an inexpensive pre-selector the bandwidth is narrowed to 2 MHz which results in a noise floor reduction to roughly -110 dBm (and a significant improvement in sensitivity, roughly 350 times). Such a product will detect an eavesdropping device but only those generating a significant amount of RF energy, and then only when it is located only a few feet from the device... but only if your lucky.

Compare that to a product such as the AVCOM PSA-65 spectrum analyzer with a "noise floor" of -125 dBm for a 75 kHz RBW on the standard unit. Adding the 10 kHz option to this instrument further reduces the noise floor to roughly -134 dBm (by roughly 8 times). This extends the detection range, but only to a few more feet.

The REI OSC-5000 OSCOR offers a 6 kHz RBW that provides a -136.196 dBm noise floor (-143.977 dBm optional with the 1 kHz IF Bandwidth option). This is a considerable increase over the PSA-65, and provides protection to an area typically involving a ten-foot radius around the system. Since most TSCM'ers are using (or should be using) a ten foot inspection grid this works out well allowing the OSCOR to detect many types of eavesdropping devices. (Note: for what the OSCOR does, it 's a really good deal for the money)

When the TSCM'er requires a noise floor below -150 dBm things start to get a bit tricky, the cost of equipment sky rockets, and high power computer based FFT solutions becomes required. The only equipment capable of such narrow bandwidth operations are high performance digital spectrum analyzers, and high performance receivers (such as MA-Com, MicroTel, Lockheed, Agilent, Rockwell, CSF, R/S, and WJ).

Also, as the bandwidth decreases (and forces the noise floor down) the ability of the instrument to "sweep" slows considerably which in turn requires large amounts of computing power, and the use of parallel systems to overcome and compensate.

Extremely narrow bandwidths, anti-saturation/intermod filters, and preamplifiers are critical in TSCM, as we do not want to approach the "sound stage" until well into the TSCM services. Ideally we should be able to detect the eavesdropping device from a quarter mile away (if it is a 250 mW or so "hot bug"), and must be able to detect sub milli-watt devices from outside a 150 foot radius to avoid alerting the eavesdropper in any way.

Of course once the TSCM specialist enters the "sound stage" anything generating over a milliwatt of radiating RF would have been identified long in advance (as would all conducted emissions). The TSCM specialist can then overtly or covertly create various types of stimulus on the sound stage to observe possible variations in the spectrum.

What does all of this mean is practical terms?

TSCM requires the usage of a wide variety of instruments, methods, and systems.

In some cases products such as the Scout, 2060, close field probes/loops, CPM-700, and similar "near-field" products are invaluable for quickly checking when you have limited time issues, (and you can get within inches of the eavesdropping device). Typically these types of products are most helpful when you can get within the signals "near-field" which is defined as the wavelength divided by 2 times the constant PI (or wavelength/2*3.14159)

In other cases an inexpensive analog spectrum analyzer, or receiver based systems such as the OSCOR, Scan Lock, or MSS are all appropriate options (to protect a limited area of under 250 sq. foot, and then only if the antenna can be moved around). The limiting factor is the sweep speed and its effect on bandwidth.

For areas greater then 250 square foot, or when the TSCM specialist is addressing a threat that requires a standoff distance the only suitable solution is a high performance spectrum analyzer or receiver. The entire system must then be interfaced to various antennas, baluns, preamplifiers, low loss cables, and other instruments to further enhance system sensitivity and overcome inherent signal loss.

Noise is our friend in that it presents an easily calculated or modeled level, slight variations of this "floor" indicate the presence of a potential eavesdropping device, or signal that requires further investigation.

It's common for TSCM procedures to specify that all signals that present energy above -150 dBm (with no system gains) or even -165 dBm (with pre-amplifiers and other system gains) must be evaluated as a potential eavesdropping device.

Take a noise floor of -150 dBm; add to that a moderate preamplifier with a gain of 30-40 dB, and a directional antenna with a gain of at least 5-10 dB. These simple improvements will have a radical effect on the ability to detect covert eavesdropping devices (even at extended distances).

Of course, the theoretical noise floor is actually -174 dBm, and every effort should be made to keep TSCM measurements as close to this as possible (but leave the tanks of liquid helium and cryogenic antenna's at home.)

It is critical that you band pass or preselect the signal, and then pass it though an instrumentation grade preamplifier BEFORE the signal goes into a spectrum analyzer or receiver. Failure to do so will cause your readings to be 30-40 dB below what they should be, and you will miss the bugs you are trying to find.

The above set of traces reflect an instrument set up to show the effect of noise while trying to find eavesdropping devices.

The first trace (at the top, in red) is the signal being picked up with an extendable 24 inch whip antenna mounted on a tripod. Inexpensive coax, and BNC cables were used to connect the antenna to the instrument.

The second trace (at the bottom, in blue) was taken when the antenna was replaced with an omni directional biconical active antenna (with an internal 15 dB preamp). Belden 9913-F cable, with N-Type connectors were used to connect the antenna to the instrument. The actual noise floor has been reduced by roughly 30 dB, and as a result numerous other signals have "popped out" of the noise.

The actual threat was located at 447.125 MHz (note the Red "T" on the bottom trace at -149.30 dBm), and could not have been detected unless the noise floor was lowered considerably. (Note: The Raphael software took less then 6 minutes to detect, confirm, and identify the threat during a completely 3.1 GHz RF survey).

The threat used in this example was a ten milli-watt (10 mW) commercially available concealed wireless microphone used by a broadcast news crew at a distance of around 85 feet.

The value of reducing your noise floor should be obvious...

Click HERE to obtain more TSCM Tutorials