Bugging Frequencies

These are "Real-World" Bugging Frequencies

Common Wireless Bugs (Low Power - Well under 35-50 mw)

 44.500 -  51.000 mhz		"Baby/Room" monitors 
 72.100 -  75.400 mhz		Hearing Assistance systems 
 54.000 - 150.000 mhz		"Kit" Bugs 
 
 98.000 - 108.000 mhz		Cheap out-of-band FM Bugs 
112.000 - 142.000 mhz		Cheap out-of-band FM Bugs 
140.000 - 160.000 mhz		Cheap out-of-band FM Bugs 
 
 60.000 - 320.000 mhz		Low Cost kit bugs 
398.000 - 406.000 mhz		DECO Bugs (398.600/605, 399.450/455, 399.025/030, 406mhz)  
 25.000 - 450.000 mhz		European/English Kit Bugs 
 
150.000 - 216.000 mhz		Typical VHF "Body Wire" & Pro-Grade Bugs 
109.000 - 140.000 mhz		Digital VHF Pro-Grade Bugs 
138.000 - 174.000 mhz		Typical "Spy Shop" & LE Cheap VHF Bugs (155-172 Popular)
140.000 - 150.000 mhz		Popular Xandi Flea power kits (143/144mhz)
150.000 - 170.000 mhz		Popular Japanese Flea power kits (under 5mw) 
 
150.000 - 220.000 mhz		Commercial Wireless Microphones
169.000 - 172.000 mhz		47 CFR 90.265 Authorization *** VERY Popular ***
174.000 - 216.000 mhz		47 CFR 2.106 (NG115) Authorization
395.000 - 410.000 mhz		German UHF Wireless Microphones (PK Electronics)
219.000 - 530.000 mhz		English UHF Wireless Microphones (300-500 popular)
470.000 - 608.000 mhz		Commercial Wireless Microphones 
730.000 - 806.000 mhz		Commercial Wireless Microphones 
 
889.000 - 960.000 mhz		Modified Cordless Phones (S/S & Hoppers) 
 
380.000 - 480.000 mhz		Video Bugs - US 
890.000 - 960.000 mhz		Video Bugs - US	(902-928 Hot) 
905.000 - 928.000 mhz		Video/Audio Consumer Products (i.e.: Recoton) 
 
1.700 -	1.930 ghz		Video Bugs - US 
2.400 -	2.500 ghz		Video Bugs - US  	*** VERY Popular *** 
5.725 -	5.850 ghz		Video Bugs - US  	*** VERY Popular ***
 
1.100 -	1.400 ghz		PAL Video Bugs	*Very Hot in England/France/etc* 
2.400 -	2.500 ghz		PAL Video Bugs	*Very Hot in England/France/etc* 
3.500 -	4.500 ghz		PAL Video Bugs	*Very Hot in England/France/etc* 

  430 -	  550 mhz		Popular French Video/Audio Bugging System
  950 -	 2500 mhz		Popular French Video/Audio Bugging System
  700 -	  900 mhz		Popular Italian Audio Bugging System

"Tactical" Bugs

225 -	400 mhz	"Throw away" bugs (10uw-300mw Beer can bugs) 
290 -	330 mhz	Micro-powered Bugs (5uw-10mw Cigarette Butt Bugs) 
 
 30 -	500 mhz	Tactical Repeaters (75mw-300mw) 
285 -	400 mhz	Tactical Repeaters (50mw-10watts) 
100 -	152 mhz	VHF Tactical Repeaters (300mw-25watts) 
135 -	174 mhz	VHF Tactical Repeaters (300mw-25watts) 

VLF and Carrier Current Type Bugs

  9khz -   490 khz   Carrier Current 47 CFR 15.219 Auth (250 microvolts)
490khz - 1.705 mhz   Lossy Cable     47 CFR 15.221 Auth (1000 microvolts)
450khz - 30.00 mhz   PLA Systems     47 CFR 15.207 Auth (30 mv@ft/30ft)

  3 -	200 khz	   300 mw        High Grade Pro Bugs (over 500$ each) 
100 -	200 khz	  50-100 mw	 Older Bugs 
120 -	200 khz	  30-50  mw	 Pre 1990 intercoms  
200 -	300 khz	  30-50  mw	 Post 1990 intercoms  
300 -	400 khz	 250-400 mw	 TELCO Line transmitters (355khz popular) 

300hz -	30 khz	Cable TV Carrier - Hardwired microphones
30khz -300 khz	Cable TV Carrier - Coaxial Bugs

100  -	450 khz	Threat Window #1 Most CC Bugs 
3khz -	  3 mhz	Threat Window #2 Expensive "Pro-Grade" Bugs 
5khz -  32 mhz	Threat Window #3 Popular WJ Carrier Current Rcvr 
3khz -  50 mhz	Threat Window #4 Realistic Threat Window for Telephone Wire
15mhz - 70 mhz	Threat Window #5 Audio/Video "Micro-Wire" RF circuits
 
WECO Bugs "boosted/ultrasonic audio" found on Power/CATV/Telco lines 
 
64kbps  to 1.5mbps Digital Bugs	T-Carrier-Lo	(T-1 and Below) 
1.5mbps to 50mbps  Digital Bugs	T-Carrier-Hi	(T-1 and above) 
2.048mbps          Digital Bugs	Definity Circuit Pack Bug 
32mbps             Digital Bugs	TMS Channel/Backplane bridge 
Designed to transmit on CC or Microwave Spread Spectrum (2.4-6.0ghz) 

25khz - 90khz	Tape Recorder Bias Oscillators (35-45khz Common)
 7khz - 35khz	Video Camera VLF Detectable emmisions
   15.750 mhz	Common NTSC Video Camera
   15.734 mhz	CCD/PCB Video Camera (very easy to detect)
   15.625 mhz	Common Video Camera

Also, be aware of ultrasonic/audio emmisions from most VLF devices.
(Utilize a EOD/Bomb Tech Stethoscope, and Ultrasonic Spectrum Analyser)

Spread Spectrum/Hopping Bugging Frequencies

Legit Industrial Equipment (very inexpensive)
  902 mhz -   928 mhz	ISM band A (Very Popular)
 2400 mhz -  2484 mhz	ISM band B (Very Popular)
 5725 mhz -  5850 mhz	ISM band C
10500 mhz - 10550 mhz	ISM band D
24075 mhz - 24250 mhz	ISM band E

SS Amateur Radio Bands Often used for eavesdropping (very inexpensive)
    50 mhz -   54 mhz   6.00m Amateur Radio Equipment (STA)
   144 mhz -  148 mhz   2.00m Amateur Radio Equipment (STA)
   222 mhz -  225 mhz   1.25m Amateur Radio Equipment (STA)
   420 mhz -  450 mhz	 70cm Amateur Radio Equipment (47 USC 97.305)
   902 mhz -  928 mhz 	 33cm Amateur Radio Equipment (47 USC 97.305)
  1240 mhz - 1300 mhz    23cm Amateur Radio Equipment (47 USC 97.305)
  2300 mhz - 2450 mhz    13cm Amateur Radio Equipment (47 USC 97.305)
  3300 mhz - 3500 mhz     9cm Amateur Radio Equipment (47 USC 97.305)
  5650 mhz - 5925 mhz	  5cm Amateur Radio Equipment (47 USC 97.305)

SS Amateur Radio Bands Occasionally used for eavesdropping
 10.00 ghz -  10.50 ghz   3.0cm Amateur Radio Equipment (47 USC 97.305)
 24.00 ghz -  24.25 ghz   1.2cm Amateur Radio Equipment (47 USC 97.305)
 47.00 ghz -  47.20 ghz   6.0mm Amateur Radio Equipment (47 USC 97.305)

SS Amateur Radio Bands Rarely used for eavesdropping (very expensive)
 75.50 ghz -  81.00 ghz   4.0mm Amateur Radio Equipment (47 USC 97.305)
119.98 ghz - 120.02 ghz   2.5mm Amateur Radio Equipment (47 USC 97.305)
142.00 ghz - 149.00 ghz   2.0mm Amateur Radio Equipment (47 USC 97.305)
241.00 ghz - 250.00 ghz   1.0mm Amateur Radio Equipment (47 USC 97.305)
300.00 ghz - Light (3 Thz)      Amateur Radio Equipment (47 USC 97.305)

Note: Most commmon spread spectrum/hopping bugging equipment will hop at speeds
between 100 and 50,000 hops per second. Equipment is readily available that
hops even faster (100,000 to 300,000 hops per second). Dwell times
can be as small as 1us (one widely used military system uses a dwell
time of 3-5us)


Outband Equipment
ANY Television broadcast or Cable TV frequency
ANY FM radio broadcast frequency
ANY Paging or Beeper frequency
ANY Cellular Telephone frequency

820 mhz - 960 mhz Modified (902-928) Cordless Telephones
Modified Amateur Radio Equipment (can be on ANY frequency)

Keep in mind that wideband (non-ISM) Spread Spectrum/Hopping Bugs are very
difficult to detect(even if you are within a few feet). Watch for carrier
feed-through, and "Noise Floor Humps". 


All Spread Spectrum devices are detectable


Once Spread Spectrum/Hopping Bugs have been located (on the RF spectrum) all
that can be done is to locate the sourse of the emission... it is virtually
impossible to demodulate a SS signal unless you have access to the key.

Also, a 500mw ISM device can easily have an effective range of over 20 miles. 

Look for spectral anomalies (humps) on the Spectrum Analyzer, and back up 
with a Compressive receiver.

Commonly Used Law Enforcement Bugging Frequencies

37.000 - 952 mhz FCC Surveillance Blanket Authorization

47 CFR 90.19 "Physical surveillance, stakeouts, raids..." 
Straight AM/FM, FM-Subcarrier, SSB, Spread Spectrum, and Hoppers. 
If encrypted, it usually uses in-band voice inversion or DES. 
(Normally well under 2 watts... most under 35-150mw) 

148 - 174 mhz 
135 - 250 mhz Out-band Wireless Microphone 
174 - 216 mhz In-band Wireless Microphone 
350 - 440 mhz Common Video Freqs 
380 - 930 mhz Wide Band Hoppers 
806 - 824 mhz 
851 - 869 mhz 
905 - 930 mhz Popular Audio/Video Band 

1.4 -  1.5 ghz Common Video Freqs
1.7 -  1.9 ghz Common Video Freqs (1.710 - 1.755 REAL Popular at 1/10 watt) 
2.4 -  2.5 ghz Common Video Freqs (2.400 - 2.450 REAL Popular)
5.7 -  5.9 ghz Common Video Freqs (5.725 - 5.850 REAL Popular)
8.5 - 10.8 ghz Common Video Freqs


173.075 - LOJACK Auto tracking system beacon (200ms burst every second)

Police Speed Enforcement Radar
10.450 -  10.600 ghz X-Band
11.488 -  11.628 ghz RD Detector
22.976 -  23.256 ghz RD Detector-2nd Harmonic
24.050 -  24.250 ghz X-Band
33.400 -  36.000 ghz Ka-Band  
 700nm -  1100nm Laser Threat  
  

Electronic Article Suveillance/Anti-Shoplifting Systems
 8.10mhz -  9.30mhz Checkpoint (Hi-Q Tags) 8.2mhz Common
57.75khz - 58.75khz Sensormatic (Magnetic) Books, CDs, and Tapes
 915mhz and 1830mhz Knogo (Microwave Resonant) Adhesive Labels


 25 -  50 mhz "Bumper Beepers" (38 - 47 mhz very popular)
135 - 170 mhz "Bumper Beepers" (150-170 mhz very popular)
450 - 512 mhz "Bumper Beepers"
903 - 904 mhz "Bumper Beepers"
904 - 912 mhz "Bumper Beepers" 
918 - 926 mhz "Bumper Beepers"
926 - 927 mhz "Bumper Beepers"

WARNING:
The area between 900 mhz and 6 ghz is EXTREMELY DANGEROUS as 
the eavesdropping equipment in that range is inexpensive, low power, 
and highly directional. 

Additionally, most TSCM people will not check frequencies above 1.0/1.5 ghz or 
3 ghz (because the equipment is too expensive for them to buy). 

I have seen surveillance video tapes of TSCM inspections where the video 
cameras (Watec), microphones (Sony), and microwave RF transmitters (AID -
2.4ghz) were never detected by the inspectors (using 1ghz AVCOM Spectrum
Analyzers).



Surveillance Satellite (TK-Keyhole) Frequencies
Note: Mostly Wideband Spread Spectrum/LPI channels

 420mhz -  450mhz 
 1.2ghz -  1.4ghz
 1.7ghz -  1.9ghz (1.76-1.84 real active)
 1.9ghz -  2.2ghz (2.115 real active)
 4.9ghz -  5.0ghz  
 7.5ghz -  8.3ghz  
10.6ghz - 12.6ghz (11.7-12.2 active)
23.6ghz - 24.0ghz
25.5ghz - 25.7ghz
22.8ghz - 33.5ghz
42.5ghz - 47.0ghz
50.3ghz - 52.4ghz
78.0ghz - 85.5ghz
86.3ghz - 98.3ghz (86-92 real active)




Commonly Used by Federal Agencies for Bugs, Wireless Microphones,
and Body Wires (also 138-220 mhz, and 399-420 mhz, under 25-50 mw).

149.3500, 165.9125, 167.3375, 167.3425, 167.4875, 168.0115, 
169.2000, 169.4450, 169.5050, 170.2450, 170.3050, 171.0450,
171.1050, 171.4500, 171.6000, 171.7500, 171.8450, 171.8500,
171.9050, 172.0000, 172.2000, 172.2125, 172.2375, 172.2625,
172.2875, 172.3125, 172.3375, 172.3625, 172.3875, 172.5500
173.3375 

169.445, 169.505, 170.245, 170.305, 171.045, 171.105, 171.845, 171.905

 27.5750 Customs Low Power <  5	watts
 27.5850 Customs Low Power <  5	watts
163.1000 Customs Low Power < 30	watts
418.5750 Customs Low Power < 30	watts

 40.1200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
 40.1700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
 40.2200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
 40.2700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"

164.9125 FBI Surveillance 
165.9125 ATF F5	Surveillance
166.2875 ATF
170.4125 ATF
407.8000 Secret Service
406.2750 Secret Service
408.5000 Secret Service
408.9750 Secret Service
 
172.2000 DOJ/DEA CH.1
171.6000 DOJ/DEA CH.2 
418.0500 DEA Low Power
418.0750 DEA Low Power
418.5750 DEA Low Power
418.7500 DEA
418.6750 DEA
418.9000 DEA F2 CINDY (416.325) Surveillance
418.7500 DEA F3 GAIL Surveillance/Strike Force
418.6750 DEA F4 EMILY (416.325) Surveillance

407.8000 CIA, State Department
408.0500 Federal Shared
408.5750 Federal Shared
409.4000 Federal Shared

960-1215mhz Spread Spectrum Systems (Wideband)

Generally Recognized Federal Bug/Spy Bands
Primary   - 25-50mhz, 135-175mhz, 225-440mhz, 1710-1950mhz, 8.3-12.5ghz
Secondary - 890mhz-5.50ghz, 7.0-9.5ghz, 10-39.6ghz

Also, Wide Band Frequency Hopping centered on various UHF-TV channels
(ie: 510 or 670 mhz with a hopping width of +/- 25 mhz)

Keep in mind that the federal government can use virtually any
frequency between DC and light.

Band Width Resolution and Filters

Examine the spectrum with the following BW resolutions/filters:

Utilize all BW resolutions/filters between 5hz - 200mhz (depending on band being checked)

Note: A programmable digital spectrum analyzer should be used!
(1/3/5/10/15/20/25/30/50/75/100/150/200... Sequence is prefered)

  BW Res    - Usage/Primary Function
100/200 mhz - Resonate Cavity Bugging Devices/SIGINT Devices 
125/35/8mhz - Resonate Cavity Bugging Devices/SIGINT Devices
 
50/20/10mhz - Diplomatic/Intelligence Microwave Bugs 
40/20/10mhz - Diplomatic/Intelligence Microwave Bugs
 
13/16/20mhz - Microwave Wideband  
11/12/13mhz - Microwave Wideband  
.5/1/2/5mhz - Microwave Wideband (Burst Bugs) 
18/26/36mhz - Satellite Wideband (Video) 
2/4/6/8 mhz - Microwave Wideband (Video) 
3/6/12 mhz  - Microwave Wideband (Video) - Common 
.5/1/3 mhz  - Microwave Wideband (Video/Burst/Pulse) 

1.5/.75 khz - Frequency Hopping Bugs - VERY Common 
.4/.2/.1khz - Frequency Hopping Bugs - VERY Common 
3.2/6.4 khz - Frequency Hopping Bugs - VERY Common 
10/20/25khz - Frequency Hopping Bugs - VERY Common 
 50/75  khz - Frequency Hopping Bugs - VERY Common 
100/250 khz - Frequency Hopping Bugs 
300/500 khz - Frequency Hopping Bugs 
1/2/4/8 mhz - Frequency Hopping Bugs 

300/250 khz - Regular Wide Band Broadcast FM 
   150 khz  - Narrowband Broadcast FM Audio, Television Audio 
   280 khz  - Narrowband Broadcast FM Audio, Television Audio 

200/150 khz - Commercial Wireless Microphone - High Grade 
150/100 khz - Commercial Wireless Microphone - Concert/Broadcast Grade 
58/77/84khz - Commercial Wireless Microphone - Typical Body Wire 
50/60/75khz - Commercial Wireless Microphone - Typical police device 
8/25/50 khz - European/Japanese Industrial Bugging Devices 

50/30 khz   - Wideband FM two-way communications (ie: Cellular Telephone) 
16/15/6khz  - Normal FM two-way communications 
3/6/8/12khz - Narrowband Commercial - Voice 
1/3.2/6khz  - Narrowband (Marine, HF, etc...) 

120/9/1 khz - Narrowband (Bias Osc./Video Cameras/SIGINT) 
30/750/500hz- Narrowband (Bias Osc./Video Cameras/SIGINT) 
56/75/100hz - Narrowband (Bias Osc./Video Cameras/SIGINT) 
30/150/200hz- Narrowband (Bias Osc./Video Cameras/SIGINT) 
 250/300 hz - Narrowband (Bias Osc./Video Cameras/SIGINT) 

300/250 hz  - Narrowband OOK/FSK/Data, etc... 
300/250 hz  - Narrowband OOK/FSK/Data, etc... 

Subcarrier Detection:

 10 - 500 khz - Most Commonly Used Subcarriers 
 30 - 150 khz - Typical Broadcast FM Subcarrier (FMSubC)
 19/27/38 khz - Typical Stereo Broadcast FM Subcarrier (FMSubC)
       67 khz - Typical Musicast/Musak Broadcast FM Subcarrier (FMSubC)

   2 - 10 mhz - Audio Subcarriers often used with Video (4.2-8 mhz common)

5khz - 950khz - Realistic Subcarrier Threat (Audio)
1mhz - 15 mhz - Realistic Subcarrier Threat (Video)

Summary (this will catch 99.99% of all Non-Diplomatic RF bugs)

All TSCM Inspections should include the following frequencies:
(Expect to see less than 10-35 mw maximum at the TX antenna)
(Do not expect the signal to be present for more than 20uS-100uS)

To find RF transmitters a search grid of 15 foot by 15 foot (or less) should be used.

Also, all phone rooms, riser closets, demarcs, boots, etc. MUST be checked.

Remember that the microphone/camera can be hundreds of feet away from the transmitter.

Use a digital spectrum analyzer and a wideband receiver with an analog
10.7/21.4mhz SDU on the IF, dispersions of 100/200/500khz).

RF Spectrum Analysis and monitoring should take place for at least twelve
solid hours during a regular sweep (72 hours or more is preferred).

To prepare for IPM the spectrum should be evaluated/monitored for at
least four hours prior to the event.

Most non-gvt RF bugs will have a transmit frequency between 9khz and 6ghz.

The Spectrum Analyzer inspection must cover at least 9khz to 40 ghz

VLF Detection-Audio    .3 khz to 100 khz   Video Cameras & Tape recorders
VLF Detection-RF       12 khz to 500 khz   Video Cameras & Tape recorders
VLF Detection-Audio    .3 khz to 150 khz   Microphone/Ultrasonic Chirping 

Carrier Current Bugs    3 khz to  50 mhz   99% Voice 
 
RF Bugs-HF              3 khz to  50 mhz   99% Voice 
Space RF Bugs-VHF      30 mhz to 300 mhz   10% Video/80% Voice/10% Data
Space RF Bugs-UHF     300 mhz to 900 mhz   25% Video/60% Voice/15% Data
 
RF Bugs-Microwave1    900 mhz to  3.0 ghz  70% Video/20% Voice/10% Data 
RF Bugs-Microwave2      3 ghz to 18.5 ghz  75% Video/15% Voice/10% Data
RF Bugs-Microwave3   18.5 ghz to 40.0 ghz  75% Video/ 5% Voice/20% Data
 
...and of Course Infrared! (Look for "IR Blooms")
 
700 - 1100nm Audio Transmitters/Lasers (CF between 880 and 950nm)
750 -  900nm Night Vision Illuminators  
900 - 1710nm IR Video Illuminators  

Return