Radiated Signals Protocol
by James M. Atkinson, Granite Island Group
http://www.tscm.com/
The TSCM survey will include a detailed inventory and evaluation of
all electro-magnetic energy present in the area being inspected. This
inventory will include the use of both spectrum analyzers and search
receivers, but may also include various broad-band diode detectors
and related systems. However, only calibrated laboratory grade
instruments shall be used to support the determination that an
eavesdropping is not present, with non-calibrated systems being used
solely as an aid to the calibrated systems.
The search for a radiating signal will involve establishing a search
area that is not greater than 512 cubic feet of space, or 64 square
feet of floor space in an 8 foot wide, by 8 foot deep, by 8 foot high
area. The search area shall extend to at least 6 feet beyond all
walls, windows and doors surrounding the area being checked. In the
event that there is a false ceiling or high ceiling (above 8 feet)
present, the area above 7 feet shall be considered a separate area
for the purposes of this search. All raised floors deeper then 6
inches, or wall thicker then 6 inches shall be considered a separate
area and inspected independent from the surrounding area.
A comprehensive Radio Frequency Spectrum Analysis will be conducted
between the frequencies of 30 Hz and 110 GHz for the detection of
clandestine transmitters utilizing conducted or radiated
transmissions paths. Frequencies above 110 GHz shall be performed at
the discretion of the TSCM specialist.
All signals that presented energy above an displayed average noise
floor (DANL) of less than or equal to -160 dBm (1 Hz BW) will
inventoried and evaluated for the presence of any hostile
intelligence, eavesdropping devices, compromising signals, or related
emissions. Special attention will be paid to any signal which had
energy present in any area, surfaces, or conducted paths in excess of
-135 dBm (1 kHz BW). Analysis is signals weaker then -160/-135 dBm
shall be at the discretion of the TSCM specialist.
Signals which appear above the defined minimally detectable signal
level shall be maintained in an ACCESS, RAPHAEL, or similar database
program which is capable of multi-dimensional analysis, mapping, or
imaging of the RF spectrum. The database being used shall be
populated in advance of the sweep project with all known transmitters
operating (or suspected to be operating) within a 5 mile radius of
the project location for transmitters operating with less then 100
watts of power. For all transmitters operating in excess of 100 watts
this radius shall be increased to 30 miles, and for all transmitters
operating above 1 KW this radius shall be increased to 75 miles. The
radius for the inventory of all signals above 2 GHz shall be 200
miles irrespective of the transmitter output power. For the purpose
of power level definitions the output power shall be high higher of
the output of the power amplified, or the effective radiated power,
whichever is higher. This database shall include those signals which
are known or suspected to be in use by eavesdroppers, and
eavesdropping devices, or which have been historically exploited or
utilized by those in the espionage profession.
An immediate high threat indicator shall be used for every known
"house" frequency or band known to be used by the top worldwide
equipment manufactures for eavesdropping equipment for non-free
oscillating devices. A high threat indicator shall also be mapped
into the database at each point where a eavesdropper operated remote
control device has been historcically found, or is suspected to operate.
Active pre-amplification will be used on all transducers and antennas
to overcome the noise figures of all instruments and cables losses to
ensure accurate and highly sensitive measurements. This active
pre-amplification will resulted in signals being detected involving a
noise floor below -160 dBm. Specialized filters will be applied to
each band being measured to overcome inter-modulation products, and
to further isolate the frequency being measured.
Based on the initial signals inventory, a set of band pass filter
shall be prepared or tuned prior to the start of the on site segment
of the project to assist in isolating overly strong signals which may
interfere with making sensitive measurements.
Signals will be gathered with both wide band antennas, and resonant,
or quasi resonant antennas. In the case of the later the instruments
will automatically track, tune, and adjust the antenna to resonance
as the measurement is being made. This will insure that the antenna
is at or close to resonance at the proper electrical point, and that
an extraordinarily high level of sensitivity and isolation of the
signal is achieved. Various resolution bandwidths between 1 Hz and
above 200 MHz will applied to all signals to allow further signal
analysis. Peak hold, quasi peak detection, and other functions will
be used to detect the presence of spread spectrum, frequency hopping,
or other signals, which may be covert in nature and used for
eavesdropping. Space Domain Analysis, Doppler shift, and pseudo
Doppler shift methods will be utilized to determine the source of all
RF energy that presents a signal above -160 dBm.
All signals which presented a signature of a rasterized, chirped,
hopped, burst, or repetitive nature wil evaluated via raster analysis
and identification. For the duration of the entire project a wide
band observation of the spectrum between 9 kHz and 12.4 GHz shall be
maintained at all times. This shall be in the form of a real-time
spectrogram or rising raster where the observed RF spectrum appears
as frequency on the X axis, time on the Y axis, and amplitude on the
Z axis. The time axis shall refresh or retrace at least once every 5
uS so that the raster "climbs" or collects a full range of
frequencies at least every 5 uS. Multiple instruments may be used at
the discretion of the TSCM specialist, but every effort should be
made to observe the spectrum in at least 3 GHz segments. Each 3 GHz
of spectrum shall create a data set of at least 65,536 sample points
with a bandwidth filter of not greater then 200 kHz per point. Each
datapoint shall consist of at least 12 bits of data for each sample.
The spectrogram and inventory shall take place for at least 72
continuous hours (3 days) prior to the actual TSCM service being
initiated, then shall take place for the duration of the TSCM
activity, but at least 72 additional hours (3 days) in additional to
the first 72 hours. The entire spectrum (to at least 12 GHz) will be
observed via a passive spectrogram for 3 days (72 hours) or more
prior to any TSCM activity from a number of positions ( at least
three positions) outside of the targeted facility, but within a three
mile radius (15,000 feet), but not closer then 1,500 feet, and
certainly not close enough to be detectable by the eavesdropper.
Whenever possible a laboratory grade passive, fixed spectrogram
system shall be introduced into the facility far in advance of any
TSCM service, and used to maintain a full time long term watch on the
RF spectrum (30 Hz to 110 GHz) and shall be used to supplement the
external spectrograms.
All normal TSCM services shall involve a project of 10 work days, or
two weeks in duration, whichever is longer. The spectrogram shall be
started at least three days before this time, and shall continue,
uninterrupted for the full duration of the TSCM service so that a
minimum of 408 hours of spectrum surveillance and logging is
completed prior to any opinion being rendered as to the existence or
absence or any hostile devices or activities, or before the TSCM team
departs the location being evaluated.
In an optimal scenario a full time, long term, permanent spectrogram
system shall be installed into the area to be protected, with
antenna's being scattered inside the area of greatest concern, and
disguised as harmless structural elements or furnishings. An
identical, but mobile version of the fixed system shall then be
duplicated and installed into at least one completely mobile vehicle,
capable of completely standalone off-site operation for three days
(72 hours). When possible, three or more external systems shall be
operated in parallel outside of the area of concern, plus a fixed
system inside the area to be inspected.
Once the areas external to the site to be inspected have been
monitored for at least 72 hours (three days) a man portable system
shall be brought into the area to be inspected, or a portion of the
permanently installed spectrogram system shall be allocated for
portable use in the area to be inspected in detail. The area to be
inspected shall them be divided into cubes, not to exceed 512 cubic
feet each (8 ft x 8 ft x 8 ft) and the antenna for the spectrogram
system left in the center of each of these areas for at least 15
minutes or more to map out all RF energy in the area being inspected.
Each cube shall be monitored for a minimum of 15 minutes, or 450,000
sweeps between 9 kHz to 12 GHz, whichever is highest.
Special care shall be taken with measurements below 500 kHz to ensure
that the antenna being used is optimal for the frequency being
measured, with high nickel and cobalt/low iron devices being used to
ensure that the antenna is either at resonance or near resonance at
the frequency begin measured. Further, all surfaces in the area being
inspected shall be evaluated by placing a swept tuned nickle/cobalt
antenna in moving contact or near contact with the wall, floor,
surface, or linear surface area for at least 15 seconds per linear
meter, with a 30 percent overlap on each pass. A single pass or
multi-antenna cluster shall be used at resonance for 60 Hz, a second
for (swept) voice band between 300 Hz and 3000 Hz, third for (fixed)
15 or 15.734 kHz, and a fourth (fixed) for 32.767 kHz. A swept
broadband 25 kHz to 400 kHz probe shall be used in addition to four
band specific probes. These probes shall first be used in the
horizontal plane, then the vertical orientation, and then in a
diagonal orientation with a 30 percent overlap on each pass.
All raw data from each of these positions shall then be combined into
a central project database, and each signal evaluated on an
individual basis prior to any opinion being rendered. All operator or
equipment errors shall be so noted in the database, but such data
shall not be discarded, deleted, or otherwise removed from the data set.
Non linear junction detectors, remote controls, burst stimulators,
nor any other radiating device shall be used until the first 400
hours of monitoring has been completed, and an initial opinion has
been formally rendered regarding the results of the passive
monitoring segment of the project. Once the active RF segment of the
project has been entered great care will need to be taken ensure that
the stimulus signals are accurately captured and annotated in the
spectrogram and spectral database and correlated to the response signals.
Every effort shall be made to utilize laboratory grade COTS test
equipment for all measurements, and all equipment shall be in current
calibration, and confirmed to be fully operation prior to each
project, and then again confirmed to be fully functional every 4
hours or less. Cable lengths shall be as short as possible, and great
care shall be taken to maintain the cables away from any signal
source that may create in interfering signal.
All equipment shall be allowed to "warm-up" for at least 30 minutes
prior to being used for measurement, and when possible shall be
locked to a disciplined common time reference shared by all equipment
on site, and phase locked to the time base to enhance all
measurements. All equipment shall be brought to ambient room
temperature either by leaving the equipment in the room to passively
reach room temperature, or a forced air, or pad may be used. Once
room temperature is reach, only then shall the warm-up period or 30
minutes begin. Care shall be taken not to operate the equipment
outside of the manufactures specifications for calibrated
measurements either in the temperature or humidity ranges.
All measurements shall be repeated on two or more independent, but
identical instruments, and when possible operated by two different
controllers or TSCM specialists. Any significant deviation between
measurement results shall be immediatly resolved, and all
measurements repeated three times. At no time shall the measurements
be discarded, even in the event of a wide deviation in the datasets.
----------------------------------------------------------------------------------------------------
James M. Atkinson Phone: (978) 546-3803
Granite Island Group Fax: (978) 546-9467
127 Eastern Avenue #291 Web:
http://www.tscm.com/
Gloucester, MA 01931-8008 E-mail: mailto:jm..._at_tscm.com
----------------------------------------------------------------------------------------------------
World Class, Professional, Ethical, and Competent Bug Sweeps, and
Wiretap Detection using Sophisticated Laboratory Grade Test Equipment.
----------------------- Copyright 2006, Granite Island Group
-------------------------
Received on Sat Mar 02 2024 - 00:57:24 CST