Everything in nature creates noise, all of which must be considered when selecting equipment, or when performing a TSCM service.

The two basic types of noise are shot noise, and thermal noise.

Shot noise is caused by current flow flowing though any type of load or resistance.

Thermal noise (or thermal agitation effect) on the other hand is caused by temperature and is based on Boltzmann's constant, the absolute temperature, and the bandwidth of the signal. Thermal noise is based on the kTB formula, the only part of which is within our practical control is B (or bandwidth). Of course you can dunk all of your instruments in liquid helium for the cryogenic cooling effect, but it's awkward to drag 800-lbs tanks around.

As we narrow instrument or receiver bandwidth (RBW) the noise floor around the signal is reduced allowing the suspect signal to be identified even in extremely noisy environments.

The noise floor may be further reduced by the use of preamplifiers, tracking pre-selector, and highly directional antenna. Of course low loss cables, and antenna's suitable for the bands being measured are also critical to facilitate sensitive measurements.

Statistical averaging present on most modern day instruments will further enhance sensitivity by at least an additional 15-20 dB. Combining averaging with preamplifiers, pre-selectors, and directional antenna system gains of well in excess of 50 dB is common (which has a very dramatic effect when finding eavesdropping devices).

Instrument sensitivity is directly related to the system bandwidth, which may or may not match signal bandwidth.

The following table represents the noise floor (less a 6 dB budget for the signal). The "noise floor" is actually 6 dB below the number listed (eavesdropping equipment commonly requires a signal to appear 6 dB above the noise floor to facilitate a useful signal).

Using the above table it's easy to see why may products used to find bugs are relatively deaf when they utilize very wide bandwidths.

Take for example a TSCM specialist using a 1 GHz frequency counter (such as the 3000A or Scout) with a collapsible antenna or a "rubber ducky". The thermal noise presented by a 1 GHz bandwidth is easily determined to be 6 dB below -53.977 dBm (or roughly -60 dBm).

Since the "rubber ducky" antenna is unity gain, and a pre-selector is not being used the noise floor is typically not effected. Of course by simply adding an inexpensive pre-selector the bandwidth is narrowed to 2 MHz which results in a noise floor reduction to roughly -87 dBm (and a significant improvement in sensitivity). Such a product will detect eavesdropping device but only those generating a significant amount of RF energy, and then only when it is located only a few feet from the device.

Compare that to a product such as the AVCOM PSA-65 spectrum analyzer with a "noise floor" of -101 dBm for a 75 kHz RBW on the standard unit. Adding the 10 kHz option to this instrument further reduces the noise floor to roughly -110. Of course this extends the detection range, but only to a few yards.

The REI OSC-5000 OSCOR offers a 6 kHz RBW that provides a -112 dBm noise floor (-120 dBm optional with the 1 kHz IF Bandwidth option). This is a considerable increase over the PSA-65, and provides protection to an area typically involving a ten-foot radius around the system. Since most TSCM'ers are using (or should be using) a ten foot inspection grid this works out well allowing the OSCOR to detect many types of eavesdropping devices. (Note: for what the OSCOR does, it 's a really good deal for the money)

When the TSCM'er requires a noise floor below -100 dBm things start to get a bit tricky, the cost of equipment sky rockets, and high power computer based FFT solutions becomes required. The only equipment capable of such narrow bandwidth operations are high performance digital spectrum analyzers, and high performance receivers (such as MA-Com, MicroTel, Lockheed, Rockwell, CSF, R/S, and WJ).

Also, as the bandwidth decreases (and forces the noise floor down) the ability of the instrument to "sweep" slows considerably which requires large amounts of computing power, and the use of parallel systems to overcome and compensate.

Extremely narrow bandwidths are critical in TSCM, as we do not want to approach the "sound stage" until well into the TSCM services. Ideally we should be able to detect the eavesdropping device from a quarter mile away (if it is a 100 mW or so "hot bug"), and must be able to detect sub milli-watt devices from outside a 150 foot radius loop to avoid alerting the eavesdropper.

Of course once the TSCM specialist enters the "sound stage" anything generating over a milliwatt of radiating RF would have been identified long in advance (as would all conducted emissions). The TSCM specialist then overtly or covertly creates various types of stimulus on the sound stage to observe possible variations in the spectrum.

What does all of this mean is practical terms?

TSCM requires the usage of a wide variety of instruments, methods, and systems.

In some cases products such as the Scout, 2060, close field probes/loops, and similar "near-field" products are invaluable for quickly check when you have limited time issues, (and you can get within inches of the eavesdropping device). Typically these types of products are most helpful when you can get within the signals "near-field" which is defined as the wavelength divided by 2 times the constant PI (or wavelength/2*3.14159)

In other cases an inexpensive analog spectrum analyzer, or receiver based systems such as the OSCOR, Scan Lock, or MSS are all appropriate options (to protect a limited area of under 250 sq. foot, and then only if the antenna can be moved around). The limiting factor is the sweep speed and its effect on bandwidth.

For areas greater then 250 square foot, or when the TSCM specialist is addressing a threat that requires a standoff distance the only suitable solution is a high performance spectrum analyzer or receiver. The entire system must then be interfaced to various antennas, baluns, preamplifiers, low loss cables, and other instruments to further enhance system sensitivity and overcome inherent signal loss.

Noise is our friend in that it presents an easily calculated or modeled level, slight variations of this "floor" indicate the presence of a potential eavesdropping device, or signal that requires further investigation.

It's common for TSCM procedures to specify that all signals that present energy above -145 dBm (with no system gains) or even -165 dBm (with pre-amplifiers and other system gains) must be evaluated as a potential eavesdropping device.

Take a noise floor of -145 dBm; add to that a moderate preamplifier with a gain of 15-25 dB, and a directional antenna with a gain of 5-10 dB. These simple improvements will have a radical effect on the ability to detect eavesdropping devices (even at extended distances).

Of course the theoretical noise floor is actually -174 dBm, and every effort should be made to keep TSCM measurements as close to this as possible (but leave the tanks of liquid helium and cryogenic antenna's at home)

The above set of traces reflect an instrument set up to show the effect of noise while trying to find eavesdropping devices.

The first trace (at the top, in red) is the signal being picked up with an extendable 42 inch whip antenna mounted on a tripod. Inexpensive coax, and BNC cables were used to connect the antenna to the instrument.

The second trace (at the bottom, in blue) was taken when the antenna was replaced with an omni directional biconical active antenna (with an internal 15 dB preamp). Belden 9913-F cable, and N-Type connectors were used to connect the antenna to the instrument. The actual noise floor has been reduced by roughly 30 dB, and as a result numerous other signals have "popped out" of the noise.

The actual threat was located at 447.125 MHz (note the Red "T" on the bottom trace at -149.30 dBm), and could not have been detected unless the noise floor was lowered considerably. (Note: The Raphael software took less then 6 minutes to detect, confirm, and identify the threat during a 3.1 GHz RF survey).

The threat used in this example was a sub milli-watt (.1 mW) commercially available concealed wireless microphone used by a broadcast news crew at a distance of around 300 feet.

The value of reducing your noise floor should be obvious...

Click HERE to obtain more TSCM Tutorials