[Contents] [Library] [Reprint policy] [Disasters]
Frequencies Used by Bugs and Surveillance Technology
by James M. Atkinson, jmatk@tscm.com.Copyright © 1996 by James M. Atkinson. All rights reserved.
Republished in Ham Radio Online by permission.
Here is the current list of frequencies used for bugging, technical surveillance and similar activities.
Lots more information on Counterintelligence is available on the web at http://www.tscm.com and is provided courtesy of James Atkinson, jmatk@tscm.com.
If you have any additions please E-mail them to jmatk@tscm.com. Also, check out the NEW usenet group: news:alt.security.tscm.
The most up-to-date version of this file is available at http://www.tscm.com/bugfreq.html.
Common Wireless Bugs (Low Power - Well under 35-50 mw)
44.500 - 51.000 mhz "Baby/Room" monitors
72.100 - 75.400 mhz Hearing Assistance systems
54.000 - 150.000 mhz "Kit" Bugs
98.000 - 108.000 mhz Cheap out-of-band FM Bugs
112.000 - 142.000 mhz Cheap out-of-band FM Bugs
140.000 - 160.000 mhz Cheap out-of-band FM Bugs
60.000 - 320.000 mhz Low Cost kit bugs
398.000 - 406.000 mhz DECO Bugs (398.600/605, 399.450/455,
399.025/030, 406mhz)
25.000 - 450.000 mhz European/English Kit Bugs
150.000 - 216.000 mhz Typical VHF "Body Wire" & Pro-Grade Bugs
109.000 - 140.000 mhz Digital VHF Pro-Grade Bugs
138.000 - 174.000 mhz Typical "Spy Shop" & LE Cheap VHF Bugs
(155-172 Popular)
140.000 - 150.000 mhz Popular Xandi Flea power kits (143/144mhz)
150.000 - 170.000 mhz Popular Japanese Flea power kits (under 5mw)
150.000 - 220.000 mhz Commercial Wireless Microphones
169.000 - 172.000 mhz 47 CFR 90.265 Authorization *** VERY Popular ***
174.000 - 216.000 mhz 47 CFR 2.106 (NG115) Authorization
395.000 - 410.000 mhz German UHF Wireless Microphones (PK Electronics)
219.000 - 530.000 mhz English UHF Wireless Microphones (300-500
popular)
470.000 - 608.000 mhz Commercial Wireless Microphones
730.000 - 806.000 mhz Commercial Wireless Microphones
889.000 - 960.000 mhz Modified Cordless Phones (S/S & Hoppers)
380.000 - 480.000 mhz Video Bugs - US
890.000 - 960.000 mhz Video Bugs - US (902-928 Hot)
905.000 - 928.000 mhz Video/Audio Consumer Products (i.e.: Recoton)
1.700 - 1.930 ghz Video Bugs - US
2.400 - 2.500 ghz Video Bugs - US *** VERY Popular ***
5.725 - 5.850 ghz Video Bugs - US *** VERY Popular ***
1.100 - 1.400 ghz PAL Video Bugs *Very Hot in England/France/etc*
2.400 - 2.500 ghz PAL Video Bugs *Very Hot in England/France/etc*
3.500 - 4.500 ghz PAL Video Bugs *Very Hot in England/France/etc*
430 - 550 mhz Popular French Video/Audio Bugging System
950 - 2500 mhz Popular French Video/Audio Bugging System
700 - 900 mhz Popular Italian Audio Bugging System
"Tactical" Bugs
225 - 400 mhz "Throw away" bugs (10uw-300mw Beer can bugs)
290 - 330 mhz Micro-powered Bugs (5uw-10mw Cigarette Butt Bugs)
30 - 500 mhz Tactical Repeaters (75mw-300mw)
285 - 400 mhz Tactical Repeaters (50mw-10watts)
100 - 152 mhz VHF Tactical Repeaters (300mw-25watts)
135 - 174 mhz VHF Tactical Repeaters (300mw-25watts)
VLF and Carrier Current Type Bugs
9khz - 490 khz Carrier Current 47 CFR 15.219 Auth (250 microvolts)
490khz - 1.705 mhz Lossy Cable 47 CFR 15.221 Auth (1000 microvolts)
450khz - 30.00 mhz PLA Systems 47 CFR 15.207 Auth (30 mv@ft/30ft)
3 - 200 khz 300 mw High Grade Pro Bugs (over 500$ each)
100 - 200 khz 50-100 mw Older Bugs
120 - 200 khz 30-50 mw Pre 1990 intercoms
200 - 300 khz 30-50 mw Post 1990 intercoms
300 - 400 khz 250-400 mw TELCO Line transmitters (355khz popular)
300hz - 30 khz Cable TV Carrier - Hardwired microphones
30khz -300 khz Cable TV Carrier - Coaxial Bugs
100 - 450 khz Threat Window #1 Most CC Bugs
3khz - 3 mhz Threat Window #2 Expensive "Pro-Grade" Bugs
5khz - 32 mhz Threat Window #3 Popular WJ Carrier Current Rcvr
3khz - 50 mhz Threat Window #4 Realistic Threat Window for Telephone Wire
15mhz - 70 mhz Threat Window #5 Audio/Video "Micro-Wire" RF circuits
WECO Bugs "boosted/ultrasonic audio" found on Power/CATV/Telco lines
64kbps to 1.5mbps Digital Bugs T-Carrier-Lo (T-1 and Below)
1.5mbps to 50mbps Digital Bugs T-Carrier-Hi (T-1 and above)
2.048mbps Digital Bugs Definity Circuit Pack Bug
32mbps Digital Bugs TMS Channel/Backplane bridge
Designed to transmit on CC or Microwave ISM Spread Spectrum (2.4-6.0ghz)
VLF Devices
25khz - 90khz Tape Recorder Bias Osc-Low End (35-45khz Common)
80khz - 145khz Tape Recorder Bias Osc-Mid Range (88.2, 96, 100khz Common)
100khz - 325khz Tape Recorder Bias Osc-Pro Grade (100, 150, 300khz Common)
40khz - 50khz Tape Recorder DAT/Hi8 (44.1/48khz Common)
8khz - 35khz Recorder Audio Servo Noise (10-20khz Common)
7khz - 35khz Video Camera VLF Detectable emmisions
15.750 mhz Common NTSC Video Camera
15.734 mhz CCD/PCB Video Camera (very easy to detect)
15.625 mhz Common Video Camera
Also, be aware of ultrasonic/audio emmisions from most VLF devices.
(Utilize a EOD/Bomb Tech Stethoscope, and Ultrasonic Spectrum Analyser)
Spread Spectrum/Hopping Bugging Frequencies
Legit Industrial Equipment (very inexpensive)
902 mhz - 928 mhz ISM band A (Very Popular)
2400 mhz - 2484 mhz ISM band B (Very Popular)
5725 mhz - 5850 mhz ISM band C
10500 mhz - 10550 mhz ISM band D
24075 mhz - 24250 mhz ISM band E
SS Amateur Radio Bands Often used for eavesdropping (very inexpensive)
50 mhz - 54 mhz 6.00m Amateur Radio Equipment (STA)
144 mhz - 148 mhz 2.00m Amateur Radio Equipment (STA)
222 mhz - 225 mhz 1.25m Amateur Radio Equipment (STA)
420 mhz - 450 mhz 70cm Amateur Radio Equipment (47 USC 97.305)
902 mhz - 928 mhz 33cm Amateur Radio Equipment (47 USC 97.305)
1240 mhz - 1300 mhz 23cm Amateur Radio Equipment (47 USC 97.305)
2300 mhz - 2450 mhz 13cm Amateur Radio Equipment (47 USC 97.305)
3300 mhz - 3500 mhz 9cm Amateur Radio Equipment (47 USC 97.305)
5650 mhz - 5925 mhz 5cm Amateur Radio Equipment (47 USC 97.305)
SS Amateur Radio Bands Occasionally used for eavesdropping
10.00 ghz - 10.50 ghz 3.0cm Amateur Radio Equipment (47 USC 97.305)
24.00 ghz - 24.25 ghz 1.2cm Amateur Radio Equipment (47 USC 97.305)
47.00 ghz - 47.20 ghz 6.0mm Amateur Radio Equipment (47 USC 97.305)
SS Amateur Radio Bands Rarely used for eavesdropping (very expensive)
75.50 ghz - 81.00 ghz 4.0mm Amateur Radio Equipment (47 USC 97.305)
119.98 ghz - 120.02 ghz 2.5mm Amateur Radio Equipment (47 USC 97.305)
142.00 ghz - 149.00 ghz 2.0mm Amateur Radio Equipment (47 USC 97.305)
241.00 ghz - 250.00 ghz 1.0mm Amateur Radio Equipment (47 USC 97.305)
300.00 ghz - Light (3 Thz) Amateur Radio Equipment (47 USC 97.305)
Note: Most commmon spread spectrum/hopping bugging equipment will hop at speeds
between 100 and 50,000 hops per second. Equipment is readily available that
hops even faster (100,000 to 300,000 hops per second). Dwell times
can be as small as 1us (one widely used military system uses a dwell
time of 3-5us)
Outband Equipment
ANY Television broadcast or Cable TV frequency
ANY FM radio broadcast frequency
ANY Paging or Beeper frequency
ANY Cellular Telephone frequency
820 mhz - 960 mhz Modified (902-928) Cordless Telephones
Modified Amateur Radio Equipment (can be on ANY frequency)
Keep in mind that wideband (non-ISM) Spread Spectrum/Hopping Bugs are very
difficult to detect (even if you are within a few feet). Watch for carrier
feed-through, and "Noise Floor Humps".
All Spread Spectrum devices are detectable
Once Spread Spectrum/Hopping Bugs have been located (on the RF spectrum) all
that can be done is to locate the sourse of the emission... it is virtually
impossible to demodulate a SS signal unless you have access to the key.
Also, a 500mw ISM device can easily have an effective range of over 20 miles.
Look for spectral anomalies (humps) on the Spectrum Analyzer, and back up
with a Compressive receiver.
Commonly Used Law Enforcement Bugging Frequencies
37.000 - 952 mhz FCC Surveillance Blanket Authorization
47 CFR 90.19 "Physical surveillance, stakeouts, raids..."
Straight AM/FM, FM-Subcarrier, SSB, Spread Spectrum, and Hoppers.
If encrypted, it usually uses in-band voice inversion or DES.
(Normally well under 2 watts... most under 35-150mw)
148 - 174 mhz
135 - 250 mhz Out-band Wireless Microphone
174 - 216 mhz In-band Wireless Microphone
350 - 440 mhz Common Video Freqs
380 - 930 mhz Wide Band Hoppers
806 - 824 mhz
851 - 869 mhz
905 - 930 mhz Popular Audio/Video Band
1.4 - 1.5 ghz Common Video Freqs
1.7 - 1.9 ghz Common Video Freqs (1.710 - 1.755 REAL Popular at 1/10 watt)
2.4 - 2.5 ghz Common Video Freqs (2.400 - 2.450 REAL Popular)
5.7 - 5.9 ghz Common Video Freqs (5.725 - 5.850 REAL Popular)
8.5 - 10.8 ghz Common Video Freqs
173.075 - LOJACK Auto tracking system beacon (200ms burst every second)
Police Speed Enforcement Radar
10.450 - 10.600 ghz X-Band
11.488 - 11.628 ghz RD Detector
22.976 - 23.256 ghz RD Detector-2nd Harmonic
24.050 - 24.250 ghz X-Band
33.400 - 36.000 ghz Ka-Band
700nm - 1100nm Laser Threat
Electronic Article Suveillance/Anti-Shoplifting Systems
8.10mhz - 9.30mhz Checkpoint (Hi-Q Tags) 8.2mhz Common
57.75khz - 58.75khz Sensormatic (Magnetic) Books, CDs, and Tapes
915mhz and 1830mhz Knogo (Microwave Resonant) Adhesive Labels
25 - 50 mhz "Bumper Beepers" (38 - 47 mhz very popular)
135 - 170 mhz "Bumper Beepers" (150-170 mhz very popular)
450 - 512 mhz "Bumper Beepers"
903 - 904 mhz "Bumper Beepers"
904 - 912 mhz "Bumper Beepers"
918 - 926 mhz "Bumper Beepers"
926 - 927 mhz "Bumper Beepers"
WARNING:
The area between 900 mhz and 6 ghz is EXTREMELY DANGEROUS as
the eavesdropping equipment in that range is inexpensive, low power,
and highly directional.
Additionally, most TSCM people will not check frequencies above 1.0/1.5 ghz or
3 ghz (because the equipment is too expensive for them to buy).
I have seen surveillance video tapes of TSCM inspections where the video
cameras (Watec), microphones (Sony), and microwave RF transmitters (AID -
2.4ghz) were never detected by the inspectors (using 1ghz AVCOM Spectrum
Analyzers).
Surveillance Satellite (TK-Keyhole) Frequencies
Note: Mostly Wideband Spread Spectrum/LPI channels
420mhz - 450mhz
1.2ghz - 1.4ghz
1.7ghz - 1.9ghz (1.76-1.84 real active)
1.9ghz - 2.2ghz (2.115 real active)
4.9ghz - 5.0ghz
7.5ghz - 8.3ghz
10.6ghz - 12.6ghz (11.7-12.2 active)
23.6ghz - 24.0ghz
25.5ghz - 25.7ghz
22.8ghz - 33.5ghz
42.5ghz - 47.0ghz
50.3ghz - 52.4ghz
78.0ghz - 85.5ghz
86.3ghz - 98.3ghz (86-92 real active)
Commonly Used by Federal Agencies for Bugs, Wireless Microphones,
and Body Wires (also 138-220 mhz, and 399-420 mhz, under 25-50 mw).
149.3500, 165.9125, 167.3375, 167.3425, 167.4875, 168.0115,
169.2000, 169.4450, 169.5050, 170.2450, 170.3050, 171.0450,
171.1050, 171.4500, 171.6000, 171.7500, 171.8450, 171.8500,
171.9050, 172.0000, 172.2000, 172.2125, 172.2375, 172.2625,
172.2875, 172.3125, 172.3375, 172.3625, 172.3875, 172.5500
173.3375
169.445, 169.505, 170.245, 170.305, 171.045, 171.105, 171.845, 171.905
27.5750 Customs Low Power <5 watts 27.5850 Customs Low Power < 5 watts 163.1000 Customs Low Power < 30 watts 418.5750 Customs Low Power < 30 watts 40.1200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 40.1700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 40.2200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 40.2700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers" 164.9125 FBI Surveillance 165.9125 ATF F5 Surveillance 166.2875 ATF 170.4125 ATF 407.8000 Secret Service 406.2750 Secret Service 408.5000 Secret Service 408.9750 Secret Service 172.2000 DOJ/DEA CH.1 171.6000 DOJ/DEA CH.2 418.0500 DEA Low Power 418.0750 DEA Low Power 418.5750 DEA Low Power 418.7500 DEA 418.6750 DEA 418.9000 DEA F2 CINDY (416.325) Surveillance 418.7500 DEA F3 GAIL Surveillance/Strike Force 418.6750 DEA F4 EMILY (416.325) Surveillance 407.8000 CIA, State Department 408.0500 Federal Shared 408.5750 Federal Shared 409.4000 Federal Shared 960-1215mhz Spread Spectrum Systems (Wideband) Generally Recognized Federal Bug/Spy Bands Primary 25-50mhz, 135-175mhz, 225-440mhz, 1710-1950mhz, 8.3-12.5ghz Secondary 890mhz-5.50ghz, 7.0-9.5ghz, 10-39.6ghz Also, Wide Band Frequency Hopping centered on various UHF-TV channels (ie: 510 or 670 mhz with a hopping width of +/- 25 mhz) Keep in mind that the federal government can use virtually any frequency between DC and light. Band Width Resolution and Filters Examine the spectrum with the following BW resolutions/filters: Utilize all BW resolutions/filters between 5hz 200mhz (depending on band being checked) Note: A programmable digital spectrum analyzer should be used! (1/3/5/10/15/20/25/30/50/75/100/150/200... Sequence is prefered) BW Res Usage/Primary Function 100/200 mhz Resonate Cavity Bugging Devices/SIGINT Devices 125/35/8mhz Resonate Cavity Bugging Devices/SIGINT Devices 50/20/10mhz Diplomatic/Intelligence Microwave Bugs 40/20/10mhz Diplomatic/Intelligence Microwave Bugs 13/16/20mhz Microwave Wideband 11/12/13mhz Microwave Wideband .5/1/2/5mhz Microwave Wideband (Burst Bugs) 18/26/36mhz Satellite Wideband (Video) 2/4/6/8 mhz Microwave Wideband (Video) 3/6/12 mhz Microwave Wideband (Video) Common .5/1/3 mhz Microwave Wideband (Video/Burst/Pulse) 1.5/.75 khz Frequency Hopping Bugs VERY Common .4/.2/.1khz Frequency Hopping Bugs VERY Common 3.2/6.4 khz Frequency Hopping Bugs VERY Common 10/20/25khz Frequency Hopping Bugs VERY Common 50/75 khz Frequency Hopping Bugs VERY Common 100/250 khz Frequency Hopping Bugs 300/500 khz Frequency Hopping Bugs 1/2/4/8 mhz Frequency Hopping Bugs 300/250 khz Regular Wide Band Broadcast FM 150 khz Narrowband Broadcast FM Audio, Television Audio 280 khz Narrowband Broadcast FM Audio, Television Audio 200/150 khz Commercial Wireless Microphone High Grade 150/100 khz Commercial Wireless Microphone Concert/Broadcast Grade 58/77/84khz Commercial Wireless Microphone Typical Body Wire 50/60/75khz Commercial Wireless Microphone Typical police device 8/25/50 khz European/Japanese Industrial Bugging Devices 50/30 khz Wideband FM two-way communications (ie: Cellular Telephone) 16/15/6khz Normal FM two-way communications 3/6/8/12khz Narrowband Commercial Voice 1/3.2/6khz Narrowband (Marine, HF, etc...) 120/9/1 khz Narrowband (Bias Osc./Video Cameras/SIGINT) 30/750/500hz- Narrowband (Bias Osc./Video Cameras/SIGINT) 56/75/100hz Narrowband (Bias Osc./Video Cameras/SIGINT) 30/150/200hz- Narrowband (Bias Osc./Video Cameras/SIGINT) 250/300 hz Narrowband (Bias Osc./Video Cameras/SIGINT) 300/250 hz Narrowband OOK/FSK/Data, etc... 300/250 hz Narrowband OOK/FSK/Data, etc... Subcarrier Detection: 10 500 khz Most Commonly Used Subcarriers 30 150 khz Typical Broadcast FM Subcarrier (FMSubC) 19/27/38 khz Typical Stereo Broadcast FM Subcarrier (FMSubC) 67 khz Typical Musicast/Musak Broadcast FM Subcarrier (FMSubC) 2 10 mhz Audio Subcarriers often used with Video (4.2-8 mhz common) 5khz 950khz Realistic Subcarrier Threat (Audio) 1mhz 15 mhz Realistic Subcarrier Threat (Video) Summary (this will catch 99.99% of all Non-Intell/Diplomatic RF bugs) All TSCM Inspections should include the following frequencies: (Expect to see less than 10-35 mw maximum at the TX antenna) (Do not expect the signal to be present for more than 20uS-100uS) To find RF transmitters a search grid of 15 foot by 15 foot (or less) should be used. Also, all phone rooms, riser closets, demarcs, boots, etc. MUST be checked. Remember that the microphone/camera can be hundreds of feet away from the transmitter. Use a digital spectrum analyzer and a wideband receiver with an analog 10.7/21.4mhz SDU on the IF, dispersions of 100/200/500khz). RF Spectrum Analysis and monitoring should take place for at least twelve solid hours during a regular sweep (72 hours or more is preferred). To prepare for IPM the spectrum should be evaluated/monitored for at least four hours prior to the event. Most non-gvt RF bugs will have a transmit frequency between 9khz and 6ghz. The Spectrum Analyzer inspection must cover at least 3khz to 40 ghz VLF Detection-Audio .3 khz to 100 khz Video Cameras & Tape recorders VLF Detection-RF 12 khz to 500 khz Video Cameras & Tape recorders VLF Detection-Audio .3 khz to 150 khz Microphone/Ultrasonic Chirping Carrier Current Bugs 3 khz to 50 mhz 99% Voice RF Bugs-HF 3 khz to 50 mhz 99% Voice Space RF Bugs-VHF 30 mhz to 300 mhz 10% Video/80% Voice/10% Data Space RF Bugs-UHF 300 mhz to 900 mhz 25% Video/60% Voice/15% Data RF Bugs-Microwave1 900 mhz to 3.0 ghz 70% Video/20% Voice/10% Data RF Bugs-Microwave2 3 ghz to 18.5 ghz 75% Video/15% Voice/10% Data RF Bugs-Microwave3 18.5 ghz to 40.0 ghz 75% Video/ 5% Voice/20% Data ...and of Course Infrared! (Look for "IR Blooms") 700 1100nm Audio Transmitters/Lasers (CF between 880 and 950nm) 750 900nm Night Vision Illuminators 900 1710nm IR Video Illuminators Note: Most military/intelligence and governmental TSCM inspections look for devices between 3khz to 50mhz for Carrier Current, 20khz to 40ghz for regular free space RF radio devices, and directional microwave devices from .5ghz to 120ghz.
James M. Atkinson "...Shaken, not Stirred..."
TSCM.COM
127 Eastern Avenue #291
Gloucester, MA 01931-8008
URL: http://www.tscm.com/ E-Mail: jmatk@tscm.com
Back to table of contents