Passive Resonant Cavity & "Spycatcher" Technical Surveillance Devices

         

Excerpt from the National Security Agency Website

On August 4, 1945, Soviet school children gave a carving of the Great Seal of the United States to U.S. Ambassador Averell Harriman.  It hung in the ambassador's Moscow residential office until 1952 when the State Department discovered that it was 'bugged.'

The microphone hidden inside was passive and only activated when the Soviets wanted it to be.  They shot radio waves from a van parked outside into the ambassador's office and could then detect the changes of the microphone's diaphragm inside the resonant cavity.  When Soviets turned off the radio waves it was virtually impossible to detect the hidden 'bug.'  The Soviets were able to eavesdrop on the U.S. ambassador's conversations for six years.

(High-resolution photo of the passive resonant cavity display at the NSA Museum from Austin Mills.)

Excerpt from Spycatcher by Peter Wright

... Taylor and I divided up the technical work.  The Post Office pressed ahead with research into infrared detection.  I began using the resources of the Services Electronics Research Laboratory to develop new microphones and look into ways of getting sound reflections from office furniture.  I was already familiar with the technical principles of resonance from my antisubmarine work.  When sound waves impact with a taut surface such as a window or a filing cabinet, thousands of harmonics are created.  The knack is to detect the point at which there is a minimum distortion so that the sound waves can be picked up as intelligible speech.

    One day in 1951 I received a telephone call from Taylor.  He sounded distinctly agitated.

    "We've been beaten to it," he said breathlessly.  "Can we meet this afternoon?"

    I met him later that day on a park bench opposite the Foreign Office.  He described how the British Air Attache in our Embassy in Moscow had been listening to the WHF receiver in his office which he used to monitor Russian military aircraft traffic.  Suddenly he heard the British Air Attache coming over his receiver loud and clear.  Realizing the Attache was being bugged in some way, he promptly reported the matter.  Taylor and I discussed what type of microphone might be involved and he arranged for a Diplomatic Wireless Service engineer named Don Bailey to investigate.  I briefed Bailey before he left for Moscow on how best to detect the device.  For the first time I began to realize just how bereft British Intelligence was of technical expertise.  They did not even posses the correct instruments, and I had to lend Bailey my own.  A thorough search was made of the Embassy but nothing was ever found.  The Russians had clearly been warned and turned the device off.

    From questioning Bailey on his return it was clear to me that this was not a normal radio microphone, as there were strong radio signals which were plain carriers present when the device was operating.  I speculated that the Russians, like us, were experimenting with some kind of resonance device.  Within six months I was proved right.  Taylor summoned me down to St. James's Park for another urgent meeting.

    He told me that the U.S. State Department sweepers had been routinely "sanitizing" the American Ambassador's office in Moscow in preparation for a visit by the U.S. Secretary of State.  They used a standard tunable signal generator to generate what is known as the "howl round effect," similar to the noise made when a radio station talks to someone on the telephone while his home radio or television is switched on.  The "howl round" detected a small device lodged in the Great Seal of the United States on the wall behind the Ambassador's desk.

    The howl frequency was 1800 MH, and the Americans had assumed that the operating frequency for the device must be the same.  But tests showed that the device was unstable and insensitive when operating at this frequency.  In desperation the Americans turned to the British for help in solving the riddle of how "the Thing," as it was called, worked.

    Brundrett arranged for me to have a new, secure laboratory in a field at Great Baddow, and the Thing was solemnly brought up by Taylor and two Americans.  The device was wrapped in cotton wool inside a small wooden box that looked as if it had once held chess pieces.  It was about eight inches long, with an aerial on top which fed into a cavity.  Inside the cavity was a metal mushroom with a flat top which could be adjusted to give a variable capacity.  Behind the mushrooms was a thin gossamer diaphragm, to receive the speech, which appeared to have been pierced.  The Americans sheepishly explained that one of their scientists had accidently put his finger through it.

    The crisis could not have come at a worse time for me.  The antisubmarine-detection system was approaching its crucial trials and demanded long hours of attention.  But every night and each weekend I made my way across the fields at the back of the Marconi building to my deserted Nissen hut.  I worked flat out for ten weeks to solve the mystery.

    First I had to repair the diaphragm.  The Thing bore the hallmarks of a piece of equipment which the Russians had rushed into service, presumably to ensure it was installed before the Secretary of State's visit.  They clearly had some kind of microscopic jig to install the diaphragm, because each time I used tweezers the thin film tore.  Eventually, through trial and error, I managed to lay the diaphragm on first and clamp it on afterward.  It wasn't perfect, but it worked.

    Next I measured the length of the aerial to try to gauge the way it resonated.  It did appear that 1800 MH was the correct frequency.  But when I set the device up and made noises at it with an audio-signal generator, it was - just as the Americans had described - impossible to tune effectively.  But after four weekends I realized that we all been thinking about the Thing upside down.  We had all assumed that the metal plate needed to be opened right out to increase resonance, when in fact the closer the plate was to the mushroom the great the sensitivity.  I tightened the plate right up and tuned the radiating signal down to 800 megacycles.  The Thing began to emit a high-pitched tone.  I rang my father up in a state of great excitement.

    "I've got the Thing working!"

    "I know," he said, "and the howl is breaking my eardrums!"

    I arranaged to demonstrate the Thing to Taylor, and he traveled up with Colonel Cumming, Hugh Winterborn and the two American sweepers.  My father came along too, bringing another self-taught Marconi scientist named R. J. Kemp, who was now thier Head of Research.  I had installed the device against the far wall of the hut and rigged up another monitor in the adjoining room so that the rounds of the audio generator could be heard as if operationally.

    I turned the dials to 800 and began to explain the mystery.  The Americans looked aghast at the simplicity of it all.  Cumming and Winterborn were smug.  This was just after the calamity of the Burgess and Maclean affair.  The defection to the Soviet Union of these two well-born Foreign Office diplomats in 1951 caused outrage in the USA, and any small way in which British superiority could be demonstrated was, I soon realized, of crucial importance to them.  Kemp was very flattering, rightly judging that it would only be a matter of time before Marconi got a contract to develop one themselves.

....

    Within eighteen months we were ready to demonstrate the first prototype, which was given the code name SATYR.  Kemp and I presented ourselves at the front door of MI5 headquarters at Leconfield House.  Hugh Winterborn met us and took us up to a spartan office on the fifth floor and introduced a tall, hunched man wearing a pin-striped suit and a lopsided smile.

    "My name is Roger Hollis," he said, standing up from behind his desk and shaking my hand stiffly.  "I am afraid the Director General cannot be with us today for this demonstration, so I am standing in as his deputy."

    Hollis did not encourage small talk.  His empty desk betrayed a man who believed in the swift dispatch of business.  I showed him the equipment without delay.  It comprised a suitcase filled with radio equipment for operating SATYR, and two aerials disguised as ordinary umbrellas which folded out to make a receiver and transmitter dish.  We set SATYR up in a MI5 flat on South Audley Street with the umbrellas in Hollis' office.  The test worked prefectly.  We heard everything from test speech to the turn of the key in the door.

    "Wonderful, Peter," Hollis kept on saying, as we listened to the test.  "It's black magic."

Excerpt from Marty Kaiser's Website

One type of free-space transmitter, a type that has no battery, is the so-called "resonant cavity" transmitter.  The Great Seal of the United States in the Moscow Embassy concealed such a device.  As has been reported extensively in the media, a wooden wall plaque was presented as a gift along with the suggestion of mounting it on the wall behind the Ambassador's desk.  Many may recall the photograph of Ambassador Lodge pointing to a "bug" concealed in the back of the plaque.  The embarrassment caused by the detection of this transmitter motivated the intelligence community to spring into action and devices similar to it soon evolved.

The resonant cavity transmitter is an amazingly simple device technically known as a passive radiator;, i.e., one that lacks an internal source of energy.  In constructing this device, a layer of thin metalized material was stretched across a closed metal tube.  The specific size of the tube determined its resonant frequency.  A wire "tail", which functions as an antenna, is attached to the base of the cavity.  The cavity was then flooded with a beam of radio frequency energy from an external source (usually in the microwave region, 1 GHz and up).  The size of the cavity and the length of its antenna are carefully calculated so that a harmonic (multiple) of the inbound radio frequency energy that bathes the cavity is rebroadcast.  The metalized diaphragm acts as a transducer, and the audio range energy modulates the returned radio frequency signal that, in turn, is picked up by a receiver in the nearby listening post.  Do not assume these devices are the sole providence of Federal level agencies.

Excerpts from The Art of High-Tech Snooping, Time Magazine, April 20, 1987

... Moreover, inspections of the new U.S. embassy building now under construction have turned up plenty of signs of bugs: cables seemingly unconnected to anything, odd indentations in wall panels, steel reinforcing rods so arranged as to convert structural pillars into antennas.

....

... For a long time American experts have worried about mysterious low-level microwaves that have apparently been beamed at the embassy building.  One explanation involves a possible type of snooping that does not require hidden transmitters in the building.  Mysterious cavities along with configurations of steel rods and wire mesh have been found in the walls of the new embassy complex.  It is theoretically possible that the microwaves could somehow pick up the reverberations that emanate from within the walls of a building; a computer would then analyze those reverberations.

Excerpt from Bugging the Bedroom, Esquire Magazine, May 1966

... It's an automobile spotlight.  But inside: a Doppler radar microphone hooked up to the car's radio.  The car is parked miles away from your house, but in line of sight of your window.  A narrow band signal is bounced off the windowpane, which vibrates as you talk inside.  The driver hears what you say.

Excerpt from Moscow Station, by Ronald Kessler

In September 1952, near the end of [George] Kennan's brief tour, two technicians arrived from Washington to check further for bugs.  Having found nothing, they asked the ambassador if he would go through the motions of dictating to his secretary in the den.  Perhaps the sound of his voice would activate the bugs.  As he later reported:

I dronded on with the dictation [as] the technicians circulated through other parts of the building.  Suddenly, one of them appeared in the doorway of the study and implored me, by signs and whispers, to "keep on, keep on."  He then disappeared again but soon returned, accompanied by his colleague, and began to move about the room in which we were working.  Centering his attention finally on a corner of the room where there was a radio set on the table, just below a round wooden Great Seal of the United States that hung on the wall, he removed the seal, took up a mason's hammer, and began to hack to pieces the brick wall where the seal had been.  When this failed to satisfy him, he turned these destructive attentions on the seal itself.

In the seal the technicians found a cavity resonator that modulated microwaves beamed at it from the building across the street.  By converting the reflected beams back into sound waves, the Soviets could reproduce every sound in Kennan's office.

The day after finding the bug, Kennan noticed that his Soviet servants were unusually quiet, even hostile.  The tranquil mood of Spaso House had been shattered.  The thought of offending them weighed on him.  Perhaps, he thought, he should not have assisted the technicians after all.

Excerpt from The Age of Electronic Messages, by John Truxal

In the late 1960s, officials at the U.S. embassy in Moscow suddenly learned that the Russians had been using ingenious technology to listen to conversations in the ambassador's office.  On the office wall there was a plaque representing the American eagle.  The Russians had secretly hollowed out a cavity in the plaque and covered the front of the cavity with a membrane in such a way that it would not be noticed from inside the room.

Across the street, the Russians had a high-frequency radio with the beam focused on the cavity in the eagle.  Using the principle of resonance, they were able to listen to conversations with no "bug" or microphone in the ambassador's office, and indeed, no obvious way for the Americans to discover that the eavesdropping was going on.

....

Let us return to the opening paragraph of this chapter, where we mentioned the American eagle in the ambassador's office of the U.S. embassy in Moscow.  How did that system use resonance?

The below figure shows that the important parts were the cavity and the diaphragm.  The cavity was simply an empty space lined with metal.  This cavity was resonant for radio signals beamed at it.  The longer the distance D from the front of the cavity to the back, the lower the resonant frequency.

This resonance depending on size is just like sound signals resonating in organ pipes.  The long pipes resonate at low frequencies, the short at high frequencies.  A crystal glass partly filled with water acts the same way: the more water, the smaller the air cavity above the water, and the higher the frequency.  Thus, the cavity in the eagle was a resonant system, with the resonanting frequency measuring D.

From across the street, the Russians beamed toward the eagle a radio signal with many different frequency components.  The echo coming back to them was strongest at the resonant frequency of the cavity.

During conversation in the ambassador's office, the speech sounds are really changes in air pressure. When

  1. air pressure rose, then
  2. the diaphragm in the figure was pushed to the right, and
  3. the resonant frequency of the cavity increased (smaller D), and
  4. the radio echo that the Russians picked up across the street was at a higher frequency.

Thus, the frequency of the echo received across the street directly measured the changes in air pressure or sound in the room.  The Russians could listen to the conversation, but the only indication that the Americans had of this very elegant bugging was an extra, very weak radio signal, which probably could not be easily detected unless the frequency was known.

Excerpt from Spycraft, by Robert Wallace and H. Keith Melton

Differing significantly in design and function from any piece of covert listening equipment previously known, the device was constructed of precision-tooled steel and comprised a long pencil-thin antenna with a short cylindrical top.  Agency engineers could not understand exactly how it worked.  The stand-alone unit, apparently, did not require a battery or an other visible power source.  It had no wires or tubes, nothing that identified the device as a piece of electronic equipment.  If the oddly shaped length of metal was tranmitting conversation, then how was it doing it?

"The Thing," as it was soon dubbed, bounced among the Agency's lab, the FBI, and private contractors for evaluation and reverse engineering.  No one could offer anything beyond an educated guess to how The Thing worked, and somewhere in its travels from lab to lab it was damaged from either improper handling or shipping.

The Thing was eventually sent to Peter Wright, the principal scientist for MI5, the British intelligence service responsible for counterintelligence operations.  Wright worked for more than two months to solve the mystery before eventually coaxing it into operation.  He dubbed it a "passive cavity resonator."  The Thing, as Wright discovered, worked by reflecting radio waves, then picking those echoes up with a radio receiver.

To operate the device, the NKVD aimed a continuous 800 MHz radio signal at the seal from a listening post in the building across from Spaso House.  The Thing's thin diaphragm at the top, which Wright had repaired, vibrated with the sound of a voice.  Those vibrations were carried by an interior tuning post to the antenna.  Then, as the vibrations hit the antenna, they altered the reflected radio signal that bounced back to the listening post.  The Thing did not require internal power in the same way a mirror does not require power to reflect light.  The radio transmitter and receiver, code named LOSS (or REINDEER by the Russian techs), were a marvel of signal processing, considering the technology available at the time.

According to Wright's own account, once he understood the principle and made the device work, he took another eighteen months to create a similar system for British intelligence.  Called Satyr, his device featured aerials - transmitter and receiver - disguised as two proper British umbrellas.  Satyr proved to be a great success and Wright called it "black magic."  Then, as he observed, "the Americans promptly ordered twelve sets and rather cheekily copied the drawings and made twenty more."  The American version of the device, according to Wright, was called Easy Chair (also called Mark2 and Mark3).

"The Thing" Block Diagram

From H. Keith Melton's CIA Special Weapons & Equipment

[thing]

[block]

This is how I believe "the Thing" works.  It doesn't follow the description from Peter Wright exactly, but his book does contain numerous (intentional?) technical errors.

A Continuous Wave (CW) RF carrier of around 800 MHz is transmitted to the cavity bug via a highly directional parabolic antenna.  This RF carrier needs to be extremely clean, with all the harmonics and spurs surpressed 80+ dBc.

The 800 MHz RF carrier enters the cavity via the 1/4-wavelength antenna probe (9.375 cm, in this case).  The high-Q, silver plated cavity is "tuned" via the adjustable "mushroom" (a 1/4-wavelength shorted stub) to parallel-resonante at an odd-harmonic frequency (3 times higher or 2400 MHz) than the transmitted RF carrier.  The use of higher frequencies will allow for a physically smaller cavity.  Also, a RF carrier which is 3 times higher can share an antenna which is for a frequency 3 times lower, due to the way the current is distributed in the antenna - or at least that's what I think.

But in this resonant cavity, one of the cavity's ends is replaced with a thin metal diaphragm.  The diaphragm may be made from metallized mylar, very thin copper sheet, or even gold leaf.  When sound waves hit this diaphragm, the cavity's resonant frequency will change ever so slightly.  This audio signal then frequency modulates the new, higher frequency return signal.

3456 MHz Resonant Cavity Band Pass Filter

This is an example of a resonant cavity Band Pass Filter (BPF) using copper pipe end-caps and brass tuning screws.  Try replacing the PC board with a metal diaphragm, taking the RF output, as a 1/4-wave (6.5 cm) whip antenna, from a side wall, flooding it with a 1150 MHz CW RF carrier and monitoring 3450 MHz.  It might work.

[3400_filter]

Schematic

Experimental starting schematic for a homebrew Resonant Cavity Bug.  I don't have the proper test equipment or a machine shop to verify if it works, but it can be used as a starting block.

The output impedance, Zo, of this cavity is near the standard 50 Ohms.  It is based on the following equation:

D1 = Cavity Diameter Outside
D2 = Cavity Diameter Inside (stub)
Zo = Characteristic (or surge) Impedance in Ohms
---

Zo = 138 * log10 (D1 / D2)

Zo = 138 * 1og10 (0.875 / 0.375)

Zo = 50.78 Ohms

To be effective, the tuning disc or slug must be placed near a high-voltage point (quarter-wavelength point) along the cavity.

A loose coupling (greater than or equal to 0.10") will have a higher insertion loss, but sharper bandpass (resonance).  Tighter coupling (approx. 0.05") will have a lower insertion loss, but wider bandpass.

In theory, to tune this device, you'll need to connect it to a RF signal generator operating at the frequency you wish to receive then adjust the cavity's tuning screw.  An example is next.  The '?'s mean that I have no idea if this is the correct procedure.

Set a RF signal generator to output a low power (100 mW?) RF signal at 2700 MHz with a FM modulation tone of 1000 Hz and 3000 Hz deviation?.  Connect this to the cavity's SMA antenna jack.  Adjust the Fine Tune screw until the cavity starts to 'howl.'?  That is, when the cavity reaches the proper resonant frequency (2700 MHz) the diaphragm should turn into a speaker, and you'll hear the modulating 1000 Hz audio tone.  Or at least I think so.

To use the bug, illuminate the cavity with a very strong & clean 900 MHz? CW RF carrier and receive the "resonanated" FM audio at 2700 MHz.  I think that might work.  Otherwise, illuminate it with a very strong & clean 2700 MHz CW RF carrier and try to recover the audio as a doppler shift (mix the outgoing frequency with the incoming frequency in a diode mixer?).

Since the cavity's antenna jack is at 50 Ohms, standard antennas can be used for easier testing.

[thing]

Paper Thin Bug?

A highly experimental idea is to use a Piezo speaker as a microphone and variable capacitance.  Combined with a small surface-mount inductor/capacitor tuned network and antenna, a theoretically "paper thin" bug is produced.

There are, however, numerous "bugs" to work out with this type of design though.  Piezo speakers have a fairly high capacitance (the one in the picture measured 0.067 µF @ 300 kHz).  When used in a passive-tuned circuit, this will result it a very low illuminating frequency.

[piezo]

[piezo]

Imagine using a circuit trace repair pen to "draw" the inductive and antenna elements.  This type of "bug" would be as thin as paper.

Scenes from the movie The Recruit.

Updates

Further experimentation with homebrew microwave interferometer surveillance devices is proving to be very successful.  Microwave interferometers work by emitting an RF carrier and mixing the reflected (returned) signal with the initial RF carrier.  The Intermediate Frequency (IF) output is the difference in phase of the two signals.  If the reflector surface (say, a filing cabinet) is modulated by nearby audio, the returned RF carrier will also be modulated with that audio.  While the concept may sound complicated, most of the hardware you need (for experimenting) is found inside an automatic door opener.

Everyday automatic door openers utilize a 10 GHz "Gunnplexer" to generate this Doppler effect, which is used to detect the approaching people.  The IF output is a low frequency sine wave which is further amplified and rectified to control the door opening relay.

[gunn]

[gunn1]

The beauty in using a microwave interferometer for surveillance work is the fact there is no need to plant any type of resonant cavity device.  Everyday objects can become the "resonator."  Peter Wright's Spycatcher also mentions MI5 used to develop specially-shaped everyday common objects like ashtrays, sculptures, ornaments, etc. to become resonators.  This enhanced the strength and audio quality of the reflected signal.

With the onslaught of vehicle radar systems, easily obtainable Gunnplexers operating at around 77 GHz are becoming available.  At this high of frequency, and with a good parabolic dish, the RF beamwidth will be very narrow.  This makes receiving doppler audio reflections off individual objects - or even directly from a person's larynx - possible.

Sample Audio

This is an audio capture from a GBPPR microwave interferometer technical surveillance device aimed at a human larynx.

The words spoken are - "Testing Testing 1 2 3"

Sample Audio #1  (55k MP3)

Here are some good millimeter wave RF application notes by QuinStar Technology.  Be sure to "read between the lines."    ;)

And here is something you don't see everyday...  A patent application explaining everything in exquisite detail.

This version appears to use a microwave interferometer consisting of a 20 GHz RF oscillator with an imposed 1 kHz audio modulation tone.  The reflected 20 GHz signal is amplified, band-pass filtered, and downconverted to a 1 GHz IF.  A simple diode detector demodulates the final IF signal for the final intelligence audio output.  The 1 kHz modulation tone allows a "lock-in" amplifier to be used during the final audio demodulation stage.  A lock-in amplifier tracks the phase of the input 1 kHz modulation tone and attempts to extract that same tone during the receive stage.  This allows one to extract audio intelligence from any interfering noise.  The Analog Devices AD630 datasheet contains an example lock-in amplifier schematic and sample oscilloscope photos.  "Real world" models would most likely use a circulator for the antenna port to prevent the transmit stage from overloading the receive stage.  The reflected audio would contain both amplitude and frequency (phase) variations.  The "2nd Harmonic Mixer" on the receive stage implies the local oscillator frequency is either 9.5 or 10.5 GHz to generate the 1 GHz IF.  The synthesized TX and LO signals probably shared the same reference clock source to maintain phase correlation to their respective frequencies.

Here is a fantastic email post by James M. Atkinson on the TSCM-L mailing list which describes operating similar devices in several real-world scenarios.

Notes

Return to Homebrew Military & Espionage Electronics Page