Saturday, February 2, 2013

Other Simple Espionage Devices Are Found in Hotel Rooms


After my last blog spot on finding a simple RF transmitter (bug) or espionage device in my hotel room last year, I have received a number of other reader’s stories of hotel rooms having what look like bugs being left behind, and either found by accident, physical search, or simple RF detection (as I found my last device). One submission was especially Interesting.


I received a photo of the device, and a frequency that it was working at. Like mine, the device was almost dead, and was barely detectable with an RF detector identical to mine. As batteries get low on many of these cheap devices the frequency also moves, sometimes very slightly, sometimes by a few megahertz. This person obtained the frequency by taking the device to a friend with a wide band spectrum analyzer, like we used in the US Secret Service. (The reader unhooked the battery before taking it with him, since detection by the TSA could conceivably  place you in a small airport lockup for a few hours.)

I started looking at baby monitoring devices immediately based on the size and frequency of the device; 49 megahertz is a frequency used by many low power transmitters, including baby monitors. But the cheap walkie-talkie you got for your kids for Christmas also works in the FCC 15 band, which refers to the FCC regulation covering these low power transmitters.  There are groups that still call themselves 49’ers (not the Football team) and play, which you are allowed to do in this frequency and low power range.  In any case if you do a lot of counter espionage searches, you always want to look at the 49 megahertz range. Most walkie-talkies can pick up baby monitors and cheap cordless phones because they pickup everything in the 49 megahertz band.

Once again like the toy wireless microphone discussed in the last blog, this one was built in China; most inexpensive rf transmitters are.  It is then sold under different names and brands all over the world, but these are mainly sold in the US.

I need to stress that if you find one of these targeting you, it normally means a very low level attack. The chances of a person finding a bug in a hotel (by hooking up their own baby monitor, or a couple of kids using walkie-talkies) are fairly high.  I should mention that another use of the frequency range is inexpensive radio controlled toys like cars or small planes.  Many users carry walkie-talkies with them to check for possible interference with their controls. Which means they may stumble upon a device in the frequency range as well.

On the other hand, your chances of getting caught using one of these devices for espionage is very low, and many baby monitors can be plugged into an AC outlet, and thus will run forever.  So you could rent a hotel room, plug one of these devices into an AC outlet under the bed or behind the TV stand, and just wait for people to use the room.  If your firm books a block of rooms in a hotel two weeks from now, the opposition can have someone rent the room beforehand and install a device. (The nicer the room, the better the likelihood that an executive will sleep there). 

I have actually seen one plugged into the same circuit as the clock radio on the nightstand. The snoop used an extension cord the same color as the AC cord for the clock radio, and then plugged the device and the clock radio into the extension cord. This meant a casual look by a executive or their security staff would reveal one plug being used by the clock radio. In this case I would guess that a spouse or significant other had done this one. 

When you pull the transmitter out of the case and tape it to help hide it, you have lost all chance of claiming it was an error that you left it somewhere.

Here is the bad news: when a transmitter is taken out of its original case, it is possible to quickly take apart a clock radio, TV, or other electronic or electric device in the room, wire the transmitter into that device, and put it back together.  Think of all the large cheap floor and table lamps in a hotel room; simply take the bottom off and inserting the device, wire it to the same AC cord inside the lamp, and put it back together. Now you have a transmitter that is both difficult to find and always powered. 

The US Secret Service and other agencies had a stock of ugly lamps wired up to install in hotel rooms as needed, using different frequencies.  If you look at the old RF device catalogs from Germany and other countries where a lot of transmitters where made, you will see a number of lamps, pre-wired.


In these cases, the simple RF detectors may have the best chance of detecting them.  It does take some time to find some of these.  If they use carrier current devices, they are even harder to find.  But we will discuss carrier current devices another time.

No comments:

Post a Comment