By James Atkinson
Granite Island Group

Click On Banner Above To Go To Extensive TSCM Site


 I've had a lot of questions recently from list members regarding how to
detect and isolate Spread Spectrum Signals and I felt it would be wise
to post this to the list as there seems to be some misunderstandings
about spread spectrum, and the level of security it provides the


Contrary to popular belief Spread Spectrum eavesdropping devices are
very easy to detect, but tricky to demodulate. Also, Spread Spectrum
modulation methods only protect against CASUAL detection, and allow
"Multiple Access" to the frequency being used. In all reality it
provided minumal protection against detection (just the illusion or


While it's helpful to demodulate the signal as an aid to in the
identification of unknown signals it's a serious liability to rely to
heavily demodulation analysis. Of course it is typically not a TSCM'ers
job to demodulate the signal, but to isolate and locate what is
generating the signals.


What follows are several issues and methods involved in identifying the
threat associated with spread spectrum eavesdropping signals.




First, we must use a high gain professional grade antenna,
preamplifier, and low loss cables to collect and concentrate as much of
the signal as possible. This is important as SS eavesdropping devices
commonly place the signal "on top of" an already occupied band (such as
the FM band)


Second, we must apply very wide bandwidths (typically over 1 MHz), and
sweep the frequency range being monitored as quickly as possible (at
least 100 times per second).


Third, The noise floor and distortion must be isolated and
characterized. This is done by allowing the equipment to warm up and
performing self alignment. Next disconnect the antenna and terminate
the cable with a lab grade terminator. Generate a noise floor
correction table, but ensure that each table covers no more then
200-250 MHz of spectrum (typically 4096 correction points per 250 MHz
of Span).


Fourth, reattach the antenna (or other transducer) and pan relative to
the antenna sensitivity patterns.


Fifth, Change polarization and repeat until each axis (including
polarization) of the antenna has utilized.


The end result of these five steps will be an amplitude corrected
series of traces (one for each antenna position). The traces which show
a noticable increase in the noise floor will require further
investigation. Remeber that we are looking for "virtually invisible"
signals, so analysis of the noise floor is critical.


Sixth, orient the antennas along each axis so as to optimize signal


Seventh, Adjust the span of the spectrum analyzer so that the main lobe
of the signal (or noise floor hump) is centered on the display, with
the center of the first side lobes placed on the far edges of the
frequency domain display. See the attached image to see what this
should look like (its the trace on top)



Eight, Place the analyzer in Zero Span, or utilize an external
oscilloscope or digitizer. Apply a bandwidth filter that is roughly the
width of the primary lobe, and optimize the amplitude and X-axis to
stabilize the display (using a threshold trigger will be helpful).


Ninth, Measure the pulse repetition frequency (in the time domain), and
pulse width or duration. Also, record the width of the main lobe. In
the attached file the trace located at the bottom of the display is in
the time domain, with pulse rate indicated by markers.


Tenth, Crisscross the primary lobe width, and pulse repetition
frequency to a list of known spread spectrum signals to determine what
is creating the signal (in the attached example a Spread Spectrum
telephone chip was used).


The trick is to first isolate in the amplitude domain, then frequency
domain. Next obtain a signature of the signals by bandwidth (of the
main lobe) and pulse repetition frequency. Then simply look up the
signature to determine components (or product) being used, and if
desired set up to demodulate.


The lookup table really doesn't need to be any more then a few pages
long, and high threat entries should be marked in bold.


By using this method you will be amazed at how easy it is to detect,
isolate, and locate virtually any spread spectrum device on earth.
Direct Spread Spectrum, Frequency Hoping, Chirp, and so on may all be
detected and located in the same way.


The enitire sequence is eaisly computerized to facilitate automated
searching for a variety of signals.


Analysis relative to the attached image file:


Product consisted of a small aluminum case, semi-rigid antenna, with
just enough space for a 9 volt battery, electret microphone, and small
circuit board.


Potting compound suspected to be "Bondo" or a similar cheap filler


Device generates a DSSS audio signal around 350 MHz (Crystal
controlled), and a 70 MHz maximum signal spread.


The pulse rate is 178.57 kHz, which cross references to a DSSS chip set
for cordless consumer telephones.


Attached is a gif image of the SA screen, and you should note that the
-72.4 dBm signal reading was taken at a distance of under 3 feet using
a tuned antenna. Once a 25 dBm preamplifier was used and the antenna
polarization matched to the device a detection range of several hundred
feet was obtained.


Total power output is well below 50 mW, and was measured via a direct
copper-to-copper connection to be just under 3.5 mW.


Internal components traced to a component distributor in India, PCB is
very poor and almost looked "homebrew".


Batch code on SS chip traces to a batch made to be shipped into India.



Component date codes reflect date of late last year.


Markings on PCB and other components trace back to India.


Fairly primitive, but very effective.


The bill-of-materials would cost no more than $100, but the products
are being openly sold (in Spy Shops) for over 10 times that amount.


Detectable by a simple scan using an RBW of 10 or 5 MHz and using a
highly directional antenna such as a log periodic with a preamplifier.




... of course your mileage may vary...





James Atkinson
Web Site:


Click On Banner Above To Go To Extensive TSCM Site




All contexts (both text and graphics)
Copyright: 1999, James Atkinson
All rights Reserved