TSCM - Common Bugging Frequencies (2024)

Major "Real-World" Bugging Frequencies

Over the years numerous TSCM andintelligence professionals have asked for an outline of the RFspectrum used by popular bugging devices. Bugging devices mayutilize any frequency between DC and light; however, this listwill cover the more common bugging frequencies that tend to beused by eavesdroppers.

The frequencies that follow are allbased on hard documentation (catalogs, intelligence reports,technical materials, court documents, and specific deviceprotocols). For the purpose of analysis the Source ReliabilityScale should be considered A, and the Data Validity Scale shouldbe rated as 1.

If the TSCM specialist alreadyknows what frequency the RF eavesdropping device is (or may be)operating on, then the detection of the device becomes severalorders of magnitude easier. For example a very popular "SpyShop"bug frequency is 398.605 MHz, 300.455 MHz, and 399.030 MHz. Byconfiguring a modern spectrum analyser or receiver and targetingthe specific parameters of this device it may be found fromhundreds, and often thousands of feet away. There are roughly3500 popular "bugging" frequencies used by the various Spy Shopsdevices around the world. It takes less then 5 minutes for acomputer controlled radio to check all 3500 channels. Of coursethe entire RF spectrum still has to be checked in detail (whichtakes many hours), but knowing what specific frequencies might beused by the opposition gives the TSCM specialist a majoradvantage.

Remember to check the entire RFspectrum, not just specific frequencies; however, keep in mindthat people doing bugging like to stay clustered around certainfrequencies (it's one of their trade craft errors that can be exploited to bring about their demise).

Several PI schools, TSCM schools,and spy shops sell equipment (at highly inflated prices) andactively attempt to mislead students that all they have to do isspend a few hundred to a few thousand dollars on equipment toenter the TSCM field. Markup on these bogus products aretypically greater than 400%, and what the spy school buys orbuilds for $100 they sell to their gullible customers for thousands or even tens of thousands of dollars.

For every legitimate TSCM firmthere are 500 con artists (cloak and dagger types) who buy "CIABug Detectors" for $ 50 and resell them to their corporateclients for $ 8,500 (it's usually just a primitive broadbanddiode detector system). They remove the original markings andapply a stick-on labels with their name. Often they will evenreprint the operators manual with their own logo and name. Somewill even go so far as to have the client sign bogus securityclearance or confidentiality documents to make the transactionappear even spookier. These spy-shops are trying to modifyreality and the laws of physics to help them pad their bankaccounts. Beware, Beware, Beware...

The frequency coverage of thesespecial spy-shop bug detectors generally "top-out" at 1 GHz, withadapters and mixers the range they can sometimes be increased to 2-3GHz. They are very limited value in finding bugs and tend to create a dangerous false sense of security.

Therefore, I say:
Know your enemy and know yourself;
in a hundred battles, you will never be defeated.

When you are ignorant of the enemy but know yourself,
your chances of winning or losing are equal.

If ignorant both of your enemy and of yourself,
you are sure to be defeated in every battle.

-- Sun Tzu, The Art of War, c. 500bc

Summary (this will identify the majority of the bugs and wiretaps sold in Spy Shops.)

All TSCM Inspections should include(at least) the following frequencies with an examination of both radiated and conducted signal pathways. Expect to see less than ten milliWatt maximum on the antenna,and for the signal to be present for only a small amount oftime.

Audio Detection 300 Hz to 15 kHz Base Band AudioUltrasonic 10 kHz to 150 kHz Ultrasonic Audio

VLF-Free Space 20 kHz to 350 kHz Video Cameras & Tape recorders

Carrier Current .3 kHz to 50 MHz 99% Voice (CC and PLA)Carrier Current 10 MHz to 450 MHz 99% Voice (AC Mains Antenna)

Free Space-HF 3 kHz to 50 MHz 99% Voice Free Space-VHF 30 MHz to 300 MHz 10% Video/80% Voice/10% DataFree Space-UHF 300 MHz to 900 MHz 25% Video/60% Voice/15% Data

Free Space-MW1 900 MHz to 3.0 GHz 50% Video/40% Voice/10% Data Free Space-MW2 3 GHz to 18.0 GHz Mostly Video and DataFree Space-MW3 18 GHz to 26.5 GHz Mostly Video and DataFree Space-MW4 26.5 GHz to 40.0 GHz (optional, based on threat)

...and of Course UV/Infrared! (Look for "Blooms")

150 - 450 nm Modulated UV Light Bugs350 - 700 nm Modulated Visible Light Bugs (450 to 675nm very common)700 - 1100 nm Audio Transmitters/Lasers (880 to 950nm very common)800 - 1510 nm Audio Transmitters/Laser Microphones (rare)

750 - 900 nm Night Vision Illuminators850 - 1750 nm IR Bugs and IR Illuminators

...and optical bugs installed INSIDE light bulbs and fixtures

450 nm - Modulated Tungsten bugs490 nm - Modulated Sodium bugs575 nm - Modulated Fluorescent bugs

An eavesdropping device may use theAC power circuits, telephone wiring, cable TV, or HVAC systemwiring, as the transmission path (300 Hz to 450 MHz+), and mayalso use digital modulation or spread spectrum technology.

To find RF transmitters a searchgrid of less then 10 by 10 foot is used, and everythingthat causes any kind of deviation in the noise floor isinvestigated. Every cubic centimeter of the facility must alsobe carefully inspected with visual and electronic techniques.

For frequencies above 1 GHz aamplified dual ridged wave guide or standard gain horn (15-18 dBi)and low noise amplifier can be used to collect the signals (.5GHz - 3 GHz, 1 GHz - 18 GHz, 18 - 26.5 GHz, 26.5 - 40 GHz, etc).The goal is to use highly directional horns, and then to amplifythe signal to a high enough level to overcome all instrumentnoise and cable/connector losses.

Look for any electromagnetic energy on the RF spectrum, and not just specific modulation types. Once the source of the electromagnetic anomaly is identified then the modulation can be carefully analyzed to identify the signal type.

Remember: Bugs are always installedin groups of at least three: the one that was easy to find (thefools bug), the one that you will find if you really work hard(the novices bug), and then the real bug; that's almostimpossible to find (the professional spies bug).

The following three chartsrepresent the frequencies used by thousands of eavesdroppingdevice identified during undercover operations, and/or seized inSpyShop raids around the United States. The population for thisanalysis was just over 2500 individual eavesdropping devices,and consisted of 43 different models. All models evaluatedutilized power levels well below 50 mW, with most well below 15mW. While the bugs were available on hundreds of frequencies the following 20 were the most common.

Composite Frequency DistributionChart

VHF Frequency DistributionChart

UHF Frequency DistributionChartIn reality the only thing on earththat can actually find a bug is a pair of well trained humaneyes, and a set of calloused and experienced hands. Theelectronic test equipment is only used to suggest to the TSCMspecialist where to look, but does not in and of itself detector find the bug or wiretap.There are no magical black boxes that find bugs.During a bug sweep or TSCMinspection all phone rooms, riser closets, demarcation points,and boots, must all be checked for tampering and electromagneticanomalies (RF activity). All electrical outlets, light fixturesand switches, circuit breakers, distribution boxes, electricmeters, and transformers must be checked for tampering andelectromagnetic anomalies. The transformer andcircuit breaker panel is the most important of these, as it'scommonly modified to facilitate technical surveillance.

A microphone or video camera usedfor surveillance may be hundreds of feet away from thetransmitter or recorder so be sure to check all potentialtransmission paths and not just the power and phone lines.

In a thorough TSCM inspection; RFSpectrum Analysis and monitoring should take place for at leasttwelve solid hours before a regular sweep. This part of theinspection is performed the day before the actual sweep, andwill involve monitoring the ambient electromagnetic spectrum atlocations AWAY from the actual facility (distances range fromseveral hundred yards to several miles away from the facility).In cases when it is not possible to examine the RF spectrum inadvance of the sweep at least six hours of time during theactual sweep should be spent examining RF signals.

When properly performed, a carefulinspection of the RF spectrum can detect eavesdropping deviceseven from a considerable distance. Due to this it is highlybeneficial for the TSCM team to examine the RF spectrum near theplace to be inspected, but not actually inside the suspect area.For example, it is very desirable for the TSCM specialist to setup their instruments a few hundred feet away from the area to beinspected, and to spend at least six hours performing aninstrumented analysis. In some cases this can be a conferenceroom elsewhere in the building, a store room, warehouse, oreven from a non-de script van located out in the parking lot. Aside benefit to this type of an analysis is that it is notintrusive or disruptive at all.

To prepare for IPM or "In-PlaceMonitoring" the spectrum should be passively evaluated andmonitored (inside the facility) for at least two or three hourprior to the meeting, general six hours is best (plus at leastan hour or two for even the most basic of external physicalexaminations).

Many bugs targeted againstcorporate entities will generally have a transmit frequencybetween 20 MHz and 3 GHz. For someone willing to spend a littlemore money; bugging devices can be easily obtained which operatein the 3 GHz to 21 GHz range and above. This means the personperforming a TSCM inspection must always inspect well above andbelow these frequencies.

A good rule of thumb is to check toat least five times the fundamental frequency of any credible RFthreat. Up to the tenth or fifteenth multiple is ideal, and isactual dictated by various government standards. The radiofrequency and signal analysis portion of any TSCM inspectionshould cover at least 9 kHz to 21 GHz (30 Hz to above 110 GHz isideal).

VLF Emission and Subcarrier Detection

Common Eavesdropping Frequencies used by AmateurEavesdroppers

Professional and Law Enforcement Bugging Frequencies

Surveillance Device "House" Frequencies/Bands

Federal Surveillance Frequencies

Surveillance and Spy Satellite Frequencies

Spread Spectrum and Frequency HoppingBug Frequencies

Bandwidth Resolutions and Filters

Note: Typical TSCMinspections look for devices between 100 Hz to 450 MHz and conducted signals from 9 kHz to 40+ GHz.

Therefore, I say:
Know your oppositions capabilities and know your own equipment;
in a thousand bug sweeps, you will never miss a bug.

When you are ignorant of your oppositions capabilities but know your own equipment,
your chances of finding the bug are equal.

If ignorant both of oppositions capabilities and of your own equipment,
you are sure to never finding the bug, and the opponents spies will succeed.

- James M. Atkinson, c. 1986 ad (with apologies to Sun Tzu)

Extremely High Threat Frequency Bands

50 - 750 kHz - Carrier Current Bugs (power, phone, HVAC lines) 25 - 80 MHz Ultra low power devices (micro watt devices) 65 - 130 MHz Micro power Part 15 devices (FM broadcast band)130 - 150 MHz Body Wires and Wireless Microphones - Band I150 - 174 MHz Body Wires and Wireless Microphones - Band II174 - 225 MHz Body Wires and Wireless Microphones - Band III

295 - 310 MHz Spread Spectrum and Micro powered Bugs (micro watt devices)

330 - 440 MHz Audio/Video Bugs (398.605, 300.455, and 399.030 MHz are popular) 430 - 550 MHz Audio/Video Bugs (433.920 and 418 MHz is popular)800 - 990 MHz Audio/Video Bugs (902-985 MHz ISM band is popular)

1.10 - 1.95 GHz Video and Audio (980 MHz to 1.45 GHz is very popular)2.00 - 2.75 GHz Video and Audio (2.4 to 2.45 GHz is extremely popular) 5.60 - 7.50 GHz Video and Audio (5.8 to 6.2 GHz is becoming very popular)8.10 - 13.00 GHz Video and Audio (Popular)

850 - 950 nm Infrared Transmitters

Don't forget about the specificpropagation and absorption bands. Bugging devices operatingbelow 22 GHz are very inexpensive, and easy to buy. Devicesoperating between 22-60 GHz are more expensive, but just as easyto secure. Devices operating on frequencies above 60 GHz tend tobe expensive, and can be very difficult to obtain.

 DC - 3 kHz Typical Audio Band 3 kHz - 500 kHz Skin Effect (Non Radiating) 500 kHz - 3 MHz Non Radiating, Conducted RF 3 MHz - 300 MHz Conducted RF, Free Space Radiating 300 MHz - 3 GHz Free Space Radiating RF, Slightly Directional 3 GHz - 22 GHz Free Space, Low Attenuation., Highly Directional 22 GHz - 60 GHz Water Vapor Absorption Band 60 GHz - 3 Thz Limited Usage For Covert Surveillance

WARNING:
The areabetween 3 GHz and 40 GHz is a serious threat as theeavesdropping equipment in that range is inexpensive, readilyavailable, very low power, and highly directional. Additionally,many TSCM people tend not to check frequencies above 1 GHz or 3GHz (because the equipment is an order of magnitude tooexpensive for them to buy). Beware of any TSCM specialist whotries to convince you that there are no eavesdropping devicesabove 3 GHz (it is usually a dead give-away that they don't ownany real counter-measure gear).

If you are concerned about coverteavesdropping or wiretapping then it would be wise to contact Granite Island Group,or another TSCM firm and schedule a "Bug Sweep" or TSCMInspection. However, do not call from a suspect telephone,cellular telephone, or cordless phone and understand that it iscritical that you should get someone out to your location asquietly, and as quickly as possible.

To be contacted for a confidential consultation
please E-mail: jmatk@tscm.com

or send a letter via US Mail to:
James M. Atkinson
Granite Island Group
127 Eastern Avenue #291
Gloucester, MA 01931-8008

or call:
Telephone: (978) 381-9111

URL: http://www.tscm.com/