Wireless Microphones Revisited [03/15/99]
Wireless Microphones and "Bug Kit" Protocols
Several dozen companies sell wireless microphone kits to consumers to help them study radio theory, etc.
Often once these kits are assembled they are often misused and/or sold as illegal eavesdropping devices. One company even has the nerve to advertise their product as a "phone bug".
Typical cost (retail) is under 20 dollars, and uses a bill of materials costing less then five dollars.
Kits may be purchased at Radio Shack, or via mail order.
I have performed some statistical research and circuit analysis to update the technical protocol you can use to detect the usage of these devices.
1) The majority (about 70%) of these devices are normally for operation in the FM broadcast band of 88 - 108 MHz as FCC Part 15 products.
2) The minority (about 25%) of these devices are normally for operation in the 2 meter ham radio band of 144-148 MHz, but may be re-crystalled to 135-175 MHz. The frequency of 146.535 is very popular.
3) The remaining 5 percent use mostly SAW devices around 300 and 400 MHz, and tend to be a bit more expensive (upwards of $40).
4) Almost all of the units use Narrow FM deviation, typically around 30-35 kHz
5) Typical bandwidth is under 75 kHz, but may increase to 100 kHz if the modulation circuit is overloaded by loud noise.
6) Pilot signal rarely provided
7) FM circuit tends to be unstable and will drift due to LC tuning method, but there are a few crystal controlled devices.
8) Power output usually below 25 mW, but almost always below 50 mW.
9) Typical power output at 5 mW or less.
10) Low component count and lack of effective shielding permit easy detection of harmonic signals (which is usually considerable). Lack of shielding also enabled easy detection using Non-Linear Junction Detection methods.
11) Recommend usage of a tuned Discone or Biconical, followed by the use of a Yagi or dipole (45 degree - 8 directions) to facilitate detection and location of the device. The use of a preamplifier (at least 15-30 dB) is also advised.
12) Examine using a receiver with pan display covering 70 to 150 MHz and step by 1.25 kHz increments. Also repeat steps in the 225 to 410 range.
13) Apply filter bandwidth filters of 30, 50, 150, and 230 kHz to enhance detection of signal (100 kHz yields the best results).
14) Of course a spectrum analyzer must also be used, and the 10/30/100/300 kHz RBW settings are suggested (1 kHz yields the best results).
15) Frequency may or may not be snuggled next to a (or inside of a) broadcast channel.
16) Broadband diode and feedback detectors may also be helpful, but don't use them as your primary detection method.
17) Also watch for variations in the normal 200 kHz channel spacing and for uneven band crowding.
Here are a few specific frequencies to keep an eye on when performing TSCM inspections.
A preprogrammed 1000 channel scanner (with a tuned antenna) will often turn up hostile signals in an area within seconds of being turned on (provided you know what frequency to watch).
Of course you still have to search the airwaves with a Spectrum Analyzer, Search Receiver, MSS, and Oscilloscope.
It is easy to configure a single hand held scanner with a few hundred "known hostile" channels. Set it up to visit the channel first as a NBFM, and then again as a WBFM (or use two radios). This radio can be concealed (along with a body worn RF detector and a small Wavecom box) for the initial walk though before unloading the "big iron".
This will provide you with a quick check of the RF environment.
While commercial wireless microphones are found between "DC and Light" most of the products offers tend to stay clustered around specific bands and/or frequencies.
35 - 50 MHz (49.890 MHz popular)
54 - 88 MHz
135 - 174 MHz
175 - 216 MHz
450 - 890 MHz
902 - 928 MHz
944 - 960 MHz
Signal bandwidth may below 2 kHz (sliver mod), or as wide as 300 kHz (TV WBFM), but the mean average is 54.52 kHz (72.4 kHz is the median point)
Popular VHF frequencies
169.445 MHz
169.505 MHz
170.245 MHz
170.305 MHz
171.045 MHz
171.105 MHz
171.845 MHz
Channels in the 694/794-806MHz
(Typically based around TV Channel 63 - 68)
Also, wide band FM audio "within the envelope" of any UHF broadcast TV stations (400 - 900 MHz).
The following frequencies in the UHF broadcast band are also very popular
793.750
793.875
794.000
794.125
794.250
794.375
794.500
795.000
795.125
795.250
795.375
795.500
795.625
795.750
797.000
797.125
797.250
797.250
797.375
797.375
797.500
797.500
797.625
797.625
797.750
797.750
797.875
798.000
798.750
798.875
799.000
799.250
799.250
799.375
799.500
799.750
799.875
800.000
800.125
800.250
800.375
800.500
801.625
801.750
801.875
802.000
802.125
802.250
802.375
804.000
804.125
804.250
804.375
804.500
804.625
804.750
805.125
805.250
805.375
805.500
805.625
805.750
805.875
Also, don't forget the 900 MHz STL devices used out in the field.
Click HERE to obtain more TSCM Tutorials
| Home | What is TSCM | Types of Bugs | Warning Signs You're Bugged |
| How To Behave if Bugged | TSCM Threat Levels | How To Engage a TSCM Firm |
| Qualifications | TSCM Protocol | Bug Frequencies | Phone Taps and Bugging |
| Signal Analysis | TDR Analysis | TDR Tutorial | Wiretapping | Training | Tools |
| Equipment | OSC-5000 | Kaiser | Riser Bond | Avcom | Search Rcvrs |
| Outside Links | Recommended TSCM Books | TSCM Reference Library |
| Recommended U.S. TSCM Firms | TSCM-L Mailing List |
For a confidential consultation please E-mail: jmatk@tscm.com
-
Granite Island Group
127 Eastern Avenue #291
Gloucester, MA 01930
Telephone: (978) 381-9111
International Callers: 001-978-381-9111