2 November 2005. James Atkinson adds:

Here are the angles from atop the GUMC, building D in Arlington, VA / Washington DC that an eavesdropper can use to listen in on the French Chancery and Hillandale Mansion just behind (or to the north of) the Chancery. The area around the Chancery are part of the Hillandale development, which is a gated neighborhood where more then one intelligence agency, and  several well-heeled public servants have a significant piece of real estate.

At the most northern point of the green-vinyl-covered chain-link fence to the north of the French Chancery the tree stumps and squirrel's nest made out of epoxy resin also make for an interesting eavesdropping situation -- which during very cold and dry weather are fairly difficult to keep hidden.

Cryptome would appreciate receiving photos of the tree stumps and squirrel's nest. Send to jya-at-cryptome.net.

2 November 2005

This message is from the TSCM-L mail list which covers technical surveillance and its countermeasures. James Atkinson, a TSCM professsional, operates the list. More on the topic below at his web site: http://www.tscm.com

The  message thread is a new US patent application 2005/0220310 (Patent Office) for "Technique and Device for Through-the-Wall Audio Surveillance," October 5, 2005.

A PDF version (URL provided by H).

http://gbppr.trighost.org/mil/cavity/20050220310.pdf


To: TSCM-L@yahoogroups.com
From: "James M. Atkinson" <jmatk-x-tscm.com>
Date: Mon, 31 Oct 2005 16:35:55 -0500
Subject: Re: [TSCM-L] Re: "through-the-wall audio surveillance system" patent

The patent is nothing special, and this "special" method of  eavesdropping has been around for a number of years, and certainly  before the early to mid 70's.

In fact the 2010A Doppler Stethoscope made by Marty Kaiser was an excellent example of this, and you could retrieve extremely clear audio by using it and bouncing the 10 GHz signal off the metallic content of a certificate or even a piece of paper hanging on the wall. The key was to find something in the room that with light-weight enough to move with room vibration such as curtains, paper, pictures, etc, and then to "illuminate" it with signal that had a wavelength that was six times or more the thickness of the thing that was moving.

In practical usage, a diploma or certificate hanging on an executives wall could be turned into an excellent eavesdropping device. So could a few sheets of paper left laying on a table -- anything that was light enough to move or vibrate with room air. A glass vase with a thin wall also works, and does lamps and other fixtures that are not a heavy solid mass.

A low frequency can be used, but you will start developing less than desirable results with low frequencies, and will receive better results with frequencies even higher that 10 GHz. Above 33 GHz you can actually start using the water in the air as the microphone, and you will have profound success with doing this when you get over 50-60 GHz.

At 10 GHz you only need a few mW of power to do this successfully from a few feet away, and 100 mW can allow an eavesdropper to be a fairly respectable distance from the target. Some police radar guns will also let you do this with with  minor mod where you simply point the radar gun and use it like a highly directional microphone that can shoot through walls. Prison escape teams have been using these for years to listen for escapees in the woods, or hiding in corn fields without actually entering the woods.

One of the more humorous eavesdropping vulnerabilities on Embassy Row in Washington, DC are the X-Band alarm sensors that all the embassies install in their more sensitive rooms, but which they neglect to turn off during sensitive/classified discussions their diplomats are having. An eavesdropper can simply tune in the frequency of the X-Band (or K-Band) alarm sensor and listen in to classified discussions. Even when they turn these sensors off during meetings, there is still enough loose items on the walls to provide a wealth of vibrating surfaces that a microwave signal can bounce off of.

With this is mind the TSCM specialist needs to always search for any signal with could be a source of illumination, and pay extremely close attention to any signal present in the area being inspected, but which may of may not be originating within the area being inspected and may provide a reflection of an external signal above a dangerous threshold.

An example of this is building D of the Georgetown University Medical Center (GUMC) complex which is only a short distance south of a diplomatic facility [France (map)].  Merely being near and above a nearby diplomatic facility isn't the biggest problem by itself, but because this diplomatic location is saturated with RF energy between 10 and 15 GHz it becomes extraordinarily easy for an eavesdropper to listen in to diplomats talking about classified matters.

While the GUMC is not the optimal location for a listening post the mechanical room on the roof provides a cozy place for diplomatic mischief of an electronic variety. Let's not even talk about the "special species of trees" that grow in the parkway to the north of the facility, or the rather large [FBI] "burrowing creatures" just to the east.

Don't start getting spun up about acoustic masking either, because it is not going to be of much value as it is generally only effective against solid masses of building materials, and not light-weight pieces of paper or metal hung on a wall. Transducers mounted on glass may make the glass in the window vibrate, but it is not going to do much to that photograph which is mounted on the wall on the other side of the room.

The higher the frequency used for illumination the more dangerous this situation becomes, and when the eavesdropper can gain the high ground near the target he owns the facility on which he is running the technical surveillance. Frequencies used for local non-hostile microwave communications and satellite uplinks can be exploited as the illumination signal, so all the eavesdropper has to do is focus one antenna on the source of the illumination signal, and a second on the target, and then dial-up a delay and phase correction.

If you want to hear an earful of classified information leaking out of the Chancery, then spend some time on the roof of building D at GUMC with your dish pointed a little to the north to hear about the which wine goes best with fish between discussions on diplomatic manuvering. ;-)

-jma

----------------------------------------------------------------------------------------------------

We Expertly Hunt Real Spies, Real Eavesdroppers, and Real Wiretappers.

----------------------------------------------------------------------------------------------------

  James M. Atkinson                              Phone:  (978) 546-3803
  Granite Island Group                   Fax:      (978) 546-9467
  127 Eastern Avenue #291                        Web:    http://www.tscm.com/
  Gloucester, MA 01931-8008              Email:  mailto:jmatk-x-tscm.com

----------------------------------------------------------------------------------------------------

   World Class, Professional, Ethical, and Competent Bug Sweeps, and
Wiretap Detection using Sophisticated Laboratory Grade Test Equipment.

----------------------------------------------------------------------------------------------------

========================================================

         TSCM-L Technical Security Mailing List

    "In a multitude of counselors there is strength"

   Come, my friends,
   'Tis not too late to seek a newer world.
   Push off, and sitting well in order smite
   The sounding furrows; for my purpose holds
   To sail beyond the sunset, and the baths
   Of all the western stars, until I die.

- Tennyson, "Ulysses"

=================================================== TSKS

Yahoo! Groups Links

<*> To visit your group on the web, go to: http://groups.yahoo.com/group/TSCM-L/

<*> To unsubscribe from this group, send an email to: TSCM-L-unsubscribe@yahoogroups.com