Wireless Microphones and "Bug Kit" Protocols

Several dozen companies sell wireless microphone kits to consumers to help them study radio theory, etc.

Often once these kits are assembled they are often misused and/or sold as illegal eavesdropping devices. One company even has the nerve to advertise their product as a "phone bug".

Typical cost (retail) is under 20 dollars, and uses a bill of materials costing less then five dollars.

Kits may be purchased at Radio Shack, or via mail order.

I have performed some statistical research and circuit analysis to update the technical protocol you can use to detect the usage of these devices.

1) The majority (about 70%) of these devices are normally for operation in the FM broadcast band of 88 - 108 MHz as FCC Part 15 products.

2) The minority (about 25%) of these devices are normally for operation in the 2 meter ham radio band of 144-148 MHz, but may be re-crystalled to 135-175 MHz. The frequency of 146.535 is very popular.

3) The remaining 5 percent use mostly SAW devices around 300 and 400 MHz, and tend to be a bit more expensive (upwards of $40).

4) Almost all of the units use Narrow FM deviation, typically around 30-35 kHz

5) Typical bandwidth is under 75 kHz, but may increase to 100 kHz if the modulation circuit is overloaded by loud noise.

6) Pilot signal rarely provided

7) FM circuit tends to be unstable and will drift due to LC tuning method, but there are a few crystal controlled devices.

8) Power output usually below 25 mW, but almost always below 50 mW.

9) Typical power output at 5 mW or less.

10) Low component count and lack of effective shielding permit easy detection of harmonic signals (which is usually considerable). Lack of shielding also enabled easy detection using Non-Linear Junction Detection methods.

11) Recommend usage of a tuned Discone or Biconical, followed by the use of a Yagi or dipole (45 degree - 8 directions) to facilitate detection and location of the device. The use of a preamplifier (at least 15-30 dB) is also advised.

12) Examine using a receiver with pan display covering 70 to 150 MHz and step by 1.25 kHz increments. Also repeat steps in the 225 to 410 range.

13) Apply filter bandwidth filters of 30, 50, 150, and 230 kHz to enhance detection of signal (100 kHz yields the best results).

14) Of course a spectrum analyzer must also be used, and the 10/30/100/300 kHz RBW settings are suggested (1 kHz yields the best results).

15) Frequency may or may not be snuggled next to a (or inside of a) broadcast channel.

16) Broadband diode and feedback detectors may also be helpful, but don't use them as your primary detection method.

17) Also watch for variations in the normal 200 kHz channel spacing and for uneven band crowding.

Here are a few specific frequencies to keep an eye on when performing TSCM inspections.

A preprogrammed 1000 channel scanner (with a tuned antenna) will often turn up hostile signals in an area within seconds of being turned on (provided you know what frequency to watch).

Of course you still have to search the airwaves with a Spectrum Analyzer, Search Receiver, MSS, and Oscilloscope.

It is easy to configure a single hand held scanner with a few hundred "known hostile" channels. Set it up to visit the channel first as a NBFM, and then again as a WBFM (or use two radios). This radio can be concealed (along with a body worn RF detector and a small Wavecom box) for the initial walk though before unloading the "big iron".

This will provide you with a quick check of the RF environment.

While commercial wireless microphones are found between "DC and Light" most of the products offers tend to stay clustered around specific bands and/or frequencies.

35 - 50 MHz (49.890 MHz popular)

54 - 88 MHz

135 - 174 MHz

175 - 216 MHz

450 - 890 MHz

902 - 928 MHz

944 - 960 MHz

Signal bandwidth may below 2 kHz (sliver mod), or as wide as 300 kHz (TV WBFM), but the mean average is 54.52 kHz (72.4 kHz is the median point)

Popular VHF frequencies

169.445 MHz

169.505 MHz

170.245 MHz

170.305 MHz

171.045 MHz

171.105 MHz

171.845 MHz

Channels in the 694/794-806MHz

(Typically based around TV Channel 63 - 68)

Also, wide band FM audio "within the envelope" of any UHF broadcast TV stations (400 - 900 MHz).

The following frequencies in the UHF broadcast band are also very popular

793.750

793.875

794.000

794.125

794.250

794.375

794.500

795.000

795.125

795.250

795.375

795.500

795.625

795.750

797.000

797.125

797.250

797.250

797.375

797.375

797.500

797.500

797.625

797.625

797.750

797.750

797.875

798.000

798.750

798.875

799.000

799.250

799.250

799.375

799.500

799.750

799.875

800.000

800.125

800.250

800.375

800.500

801.625

801.750

801.875

802.000

802.125

802.250

802.375

804.000

804.125

804.250

804.375

804.500

804.625

804.750

805.125

805.250

805.375

805.500

805.625

805.750

805.875

Also, don't forget the 900 MHz STL devices used out in the field.