Granite Island Group Banner

Spread Spectrum and Frequency Hopping Bug Frequencies

Legitimate Industrial Equipment (very inexpensive/easy to buy/build)
Commonly modified for use as an eavesdropping device

  9.0 kHz - 54.00 MHz	Current Carrier Devices (very popular for video)
26.96 MHz - 27.28 MHz	Popular Spread Spectrum Devices
40.48 MHz - 40.88 MHz	Popular Spread Spectrum Devices
  902 MHz -   928 MHz	ISM band A (Very Popular)
 2400 MHz -  2484 MHz	ISM band B (Very Popular)
 5725 MHz -  5875 MHz	ISM band C
10500 MHz - 10550 MHz	ISM band D
24000 MHz - 24250 MHz	ISM band E

Spread Spectrum Bands Often used for eavesdropping (very inexpensive)
    50 MHz -   54 MHz   6.00m Amateur Radio Equipment (STA)
   144 MHz -  148 MHz   2.00m Amateur Radio Equipment (STA)
   222 MHz -  225 MHz   1.25m Amateur Radio Equipment (STA)
   420 MHz -  450 MHz	 70cm Amateur Radio Equipment (47 USC 97.305)
   902 MHz -  928 MHz 	 33cm Amateur Radio Equipment (47 USC 97.305)
  1240 MHz - 1300 MHz    23cm Amateur Radio Equipment (47 USC 97.305)
  2300 MHz - 2450 MHz    13cm Amateur Radio Equipment (47 USC 97.305)
  3300 MHz - 3500 MHz     9cm Amateur Radio Equipment (47 USC 97.305)
  5650 MHz - 5925 MHz	  5cm Amateur Radio Equipment (47 USC 97.305)

Spread Spectrum Bands Occasionally used for eavesdropping
 10.00 GHz -  10.50 GHz   3.0cm Amateur Radio Equipment (47 USC 97.305)
 24.00 GHz -  24.25 GHz   1.2cm Amateur Radio Equipment (47 USC 97.305)
 47.00 GHz -  47.20 GHz   6.0mm Amateur Radio Equipment (47 USC 97.305)
 75.50 GHz -  81.00 GHz   4.0mm Amateur Radio Equipment (47 USC 97.305)
119.98 GHz - 120.02 GHz   2.5mm Amateur Radio Equipment (47 USC 97.305)
142.00 GHz - 149.00 GHz   2.0mm Amateur Radio Equipment (47 USC 97.305)
241.00 GHz - 250.00 GHz   1.0mm Amateur Radio Equipment (47 USC 97.305)
300.00 GHz - Light (3 THz)      Amateur Radio Equipment (47 USC 97.305)
Note: Most common spread spectrum/hopping eavesdropping equipment will hop at speeds between 100 and 50,000 hops per second. Equipment is readily available that hops even faster (100,000 to 300,000 hops per second). Dwell times can be as small as 1us (one widely used system uses a dwell time of 3-5us).

Out Band Equipment

ANY Television broadcast or Cable TV frequency
ANY FM radio broadcast frequency
ANY Paging or Beeper frequency
ANY Cellular Telephone frequency

820 MHz - 960 MHz Modified (902-928) Cordless Telephones
Modified Amateur Radio Equipment (can be on ANY frequency)

Keep in mind that wideband (non-ISM) spread spectrum/hopping bugs are very difficult to detect (even if you are within a few feet). Watch for carrier feed-through, and "Noise Floor Humps".

All Spread Spectrum devices are detectable, just difficult.

Once spread spectrum/hopping bugs have been located (on the RF spectrum) all that can be done is to locate the source of the emission... it is virtually impossible to demodulate a SS signal unless you have access to the key.

Also, a 500mw spread spectrum device can easily have an effective range of over 20 miles. In 1994 I field tested a spread spectrum LPD/LPI handheld radio designed for downed pilots. The power would vary between one half milliWatt to one full watt based the quality of a duplex link. With power levels below 25mw we could communicate clearly at a distance of 45 miles on the open ocean (from a life raft), and 15 miles in the dense woods of Maine. When the device was tested in a dense urban area (as a bug) a range of 2500 to 8600 feet was obtained while keeping the power output below 15mw.

Look for spectral anomalies (humps) on the Spectrum Analyzer, and back up with a compressive or wideband receiver.

Utilize search receivers with a wideband IF output (700 MHz), and a wide IFBW (over 7-70 MHz). Look for the signature wideband hump, and then DF the signal to locate the device. Don't be surprised if you find a table leg, bulletin board, cube divider, clock, or wall emitting SS RF energy.

Note: In the early 80's I spent considerable time working with diplomatic spread spectrum devices operating on frequencies between 12 GHz and 60 GHz (detectable with IFBW 300hz to 200 MHz).

I recently became introduced to a fiber bugging system used by the French government that uses a IFBW of 44 GHz (yes that's 44 GHz, and it's not a typo).

Advanced TSCM Signals Detection and Analysis
TSCM - Sweeping the Spectrum for Eavesdropping Devices

| Home | What is TSCM | Types of Bugs | Warning Signs You're Bugged |
| How To Behave if Bugged | TSCM Threat Levels | How To Engage a TSCM Firm |
| Qualifications | TSCM Protocol | Bug Frequencies | Phone Taps and Bugging |
| Signal Analysis | TDR Analysis | TDR Tutorial | Wiretapping | Training | Tools |
| Equipment | OSC-5000 | Kaiser | Riser Bond | Avcom | Search Rcvrs |
| Outside Links | Recommended TSCM Books | TSCM Reference Library |
| Recommended U.S. TSCM Firms | TSCM-L Mailing List |


Copyright ©2002, Granite Island Group