Finding Hidden Transmitters

By: By Steve Thomas, Anritsu Co.
( 1 Nov 2007 )

Some transmitters are not intended to be found. In the popular press they are called "bugs" and they can take on many forms. Other transmitters aren't supposed to be transmitters at all, such as FAX machines, microwave ovens and public address systems. If your job is to find and eliminate, or at least mediate, such transmitters, there are several things that can be done to simplify the job of tracking down the offending transmitter.

If you are lucky, the interfering transmitter will be on the air for long periods of time, making it relatively easy to track it down—though this is not a good situation for those people who want to use the communications channel that is experiencing interference. More likely, the interfering transmitter will come on the air sporadically with no particular pattern that you've noticed. It is strongly suggested to keep thorough notes of the episodes of interference, including time of day, day of the week, apparent direction to the interferer, amplitude of the signal and anything else that stands out, since there may be patterns that are not initially obvious.

You may end up noticing, for example, that the interference mostly occurs during normal work hours or that interference peaks during the early morning, lunch time and late afternoon. Perhaps the interference occurs mostly at night. If you don't want to spend your time staring at a spectrum analyzer screen hoping to see the interferer, there are tools available that will do the staring for you. With certain tools, such as certain handheld spectrum analyzers, you can set up a limit line such as the one shown in Figure 1 and automatically record only sweeps that exceed the limit line. As a result, only interesting measurements will appear, each one date and time stamped to help discern time and frequency patterns.

Unintended radiators are sometimes difficult to track down, but at least there will not be any effort to hide them. The FAX machine with a noisy radiating motor will be sitting right out in plain sight; this will not be the case with hidden transmitters. Usually, there will have been significant effort expended to make it difficult to detect the signal and find the hardware once the transmitter has been detected.

LOOKING FOR "HUGGERS"
One common trick is to hide the transmitted signal by placing it close to a large signal. These emitters are called "huggers" since they hug the large signal. To be able to detect this sort of hidden transmitter, you need a spectrum analyzer or other receiver with very good phase noise. The typical handheld spectrum analyzer will not be very useful for this work since the phase noise is not sufficient to do the job. See Figure 2 for a measurement of the same hugger with a typical handheld spectrum analyzer. The hugger signal simply can't be detected.

Other approaches to make a signal difficult to detect include using spread spectrum to spread the signal across a wide chunk of spectrum and transmitting information in short bursts. When done properly, a spread spectrum signal looks like noise and can be very hard to spot. Set a spectrum analyzer to detect the peak signal at each measurement point and then use maximum hold to build a profile of a spectrum section. Also, use a fairly narrow resolution bandwidth to lower the noise floor to provide the best chance of having the spread spectrum signal rise above the noise floor.

To give this idea a try with more predictable signals, look at Wi-Fi signals in the 2.4 GHz band—try a 2.437 GHz center frequency with a span of 66 MHz to capture the whole 802.11(b) spectrum. Note that attempting to average this sort of signal does no good since the average includes mostly noise. If you do this, you will see a small signal pop above the average of the noise floor then quickly get dragged down into the noise.

With the proper setup, you may end up seeing what looks like a small rise in the noise floor. If this appears, disconnect the antenna and restart the measurement to make sure what you are seeing is being received through the antenna and not some strange artifact in the instrument. Attach a directional antenna and find the signal's direction. If the signal is originating in the area of interest, investigate further. However, do not dismiss the signal too quickly. The installer of the hidden transmitter may have located the antenna far away from the area being monitored in order to make it harder to detect when sweeping an area for bugs. Burst transmissions may be captured by using a spectrogram view of the radio spectrum. This can be done in a couple of ways. If the instrument you are using has built-in spectrogram capability, it can be used to monitor the spectrum. Look for signals that come on the air for a very short period of time.

Another way to do this task is to have the instrument save measurements that exceed the amplitude set by a limit line. Set the limit line slightly above the normal RF environment so only signals that are not normally there will be saved when they occur. It is only necessary to examine a limited number of sweeps in this manner. In both cases, set the resolution bandwidth as wide as practical to minimize sweep time while still having sufficient sensitivity to detect signals of interest.

SOFTWARE TOOLS HELP
Software tools also allow you to take a file full of saved spectrum analyzer sweeps and turn them into a spectrogram after the fact (see Figure 3). The instrument does the work to capture signals of interest, and you examine the spectrogram and other signal views to extract patterns and information that may otherwise be too hard to notice. By being able to view only traces that contain interesting signals, the boredom of needing to stare at a screen for hours while looking for a signal that may not even exist is eliminated.

The difficult part is finding the part of the spectrum that needs to be investigated. Unfortunately, there is no easy answer to this one. As a starting point, do a broadband sweep to look for large unexplained signals in the area where you believe a hidden transmitter may be located. Demodulate the suspect signals to determine if they contain modulation of interest. Some investigators look at relatively narrow chunks of spectrum—say 10 to 20 MHz wide—at a time, so the resolution bandwidth can be set to a narrow value for good sensitivity. Then, step through the spectrum and take measurements to look for signals that don't belong. Do a maximum hold measurement and let the instrument complete several sweeps for each portion of the spectrum. You will have a better chance of catching a burst transmitter. After this is done, look closely at each AM broadcast signal in the neighborhood to determine if transmitters are hidden near them.

How do you find the part of the spectrum to investigate? If you are looking for huggers, look close to AM broadcast stations. In Figure 4, you can see that there is an area very close to the carrier on a broadcast signal where there are no modulation sidebands. For this particular signal, the area ±35 Hz from the carrier is about 70 dB down from the carrier—a perfect place to hide a hugger that is modulated using very narrow band FM. Which antenna should be used for these searches depends on the frequency ranges being investigated. If you are looking in the AM broadcast band, you can get the best sensitivity using a multi-turn loop antenna, although that may be more antenna than is really needed for the job. A scanner whip antenna is a good choice because it is light and can be attached directly to a hand-held spectrum analyzer. Certain scanner whip antennas use telescopes to cover a wide range of frequencies. For higher frequencies up to the microwave region, the whip will work if the signals are strong. However a small log-periodic antenna may be a better choice since it covers a very wide frequency range. The broadest of the antennas shown above covers 600 MHz to 20 GHz and is smaller than a sheet of paper.

CONCLUSION
Although tracking down interferers is never easy, by using some of the tricks of the trade the search can be fruitful and very satisfying when you find the cause of interference or silence a hidden transmitter.


About the Author
Steve Thomas is a product manager for the Anritsu Co. in Morgan Hill, Calif. He currently works in the Field Solutions Business Unit of its Microwave Measurement Division.

Click here for Illustrations:

Figure 1, Figure 2, Figure 3, Figure 4, Figure 5