Make your own free website on Tripod.com
Home

RF-SNIFFER

Komp.Type/VerdiKommentar
RF-SNIFFER

Is somebody listening to you? With the help of Raymond Maigh 's bug-detector, you could catch them out first.



Competition is fierce and pressures to succeed have never been more intense. Espionage is becoming a very real threat in businesses or professions which depend on information and ideas. And the threat is not confined to the workplace: marriage partners concerned that they might have an erring spouse are making increasing use of micro- transmitter style bugs to confirm or ease their suspicions. These bugging devices are inexpensive and readily available. They can easily be concealed in telephone power outlets, and a thousand and one other places around the home or office. The 'Sniffer' unit described here is sensitive to RF radiation over a wide spectrum, from around 100 kHz through VHF to 450 or 500 MHz, and it will help detect and locate low-power spy transmitters. Most constructors will have the parts in their spares box (and if they have to be purchased, they are not expensive) and the unit can be assembled in an evening. So, why not check out your office or home and dispel those nagging fears?

The circuit


The circuit diagram of the unit is given in figure 1 . RE signals picked up by a short telescopic aerial are rectified in a voltage-doubling circuit formed by diodes, DI and D2, and CI The esulting dc is applied to the non-inverting input of operational amplifier, CI. RF choke, L2, and the low value capacitor Cl , act as a simple high-pass filter to prevent the unit responding to low-frequency ac fields. A lower nductance RF choke, Ll can be switched into circuit to bypass low, medium, and some of the higher radio frequencies, and further restrict the response of the unit. C2 shunts residual RF to ground,'and Rl acts as a load for the voltage doubler. The gain of the amplifier is fixed by R4 and R5, which determine the level of feedback to the inverting input of the device. Resistor combination R2 and R3 null out off-set currents so that the meter pointer can be set at zero und~r no-signal conditions. Qutput from the first opamp is connected to the non- inverting input of lC2. Potentiometer R7 varies the level of feedback across this second amplifier, and enables the sensitivity of the unit to be adjusted. R9 sets the meter to read around 3V FSD, and also prevents damage to the movement in the event of the second 1C being driven into saturation. C3 smooths out any random fluctuations in the output. The dual 9V-0 9V battery supply is switched into circuit by S2A and S2B.

Components


Point contact germanium diodes should be used for DI and D2 in order to maximise the frequency response and sensitivity of the unit (they conduct at lower forward voltages than silicon diodes). Suitable miniature RF chokes are listed in the Cirkit catalogue, but Ll can be formed by winding 30 turns of 34 or 36 SWG enamelled copper wire on the body of a 0.25 watt 1megohm resistor An inexpensive signal strength or VU , meter will be suitable as an indicator These instruments usually have a sensitivity of around 200 uA, and will require shunting , or an increase in the value of R9, to give the required 3-4V full scale deflection. Meter sensitivity is not critical, and a 1 or 2 mA instrument will be satisfactory for this application with the value of R9 as shown.

Construction


Most of the components are mounted on a small printed circuit board. Figure 2 shows the component side of the board and figure 3 the copper track side. The low inductance choke L1 is wired between the telescopic aerial and S1 and the additional resistor RX, is mounted on the tags of the set zero potentiometer, R3. Provision is made on the board for either an axial or radial lead version of electrolytic capacitor C3. The use of ic holders makes it easy to check the op-amps by substitution, if necessary and Vero pins inserted at the lead-out points aid off-board wiring. The meter, telescopic aerial, PCB, potentiometers, etc., can be wired up on the bench for testing and setting up before being mounted in a small plastic case.

Setting-up and testing


If clear glass components have been used for D1 and D2, they must be shielded from light before undertaking the setting-up procedure. (The photovoltaic effect of the diode junctions is sufficient to swing the meter pointer hard over when the unit is set to high sensitivity). Make the usual checks for bridged copper tracks and bad soldered joints on the PCB, and check the orientation of the diodes, op-amps and C3. Temporarily connect the 4K7 preset in the R3 position (ie to R2 and pin 5 of IC1, with the slider to pin 4 of the IC) and set it to mid travel. Then, with the meter disconnected, switch on the power supply. Current drain from each battery should be around 2.5mA. Connect a test meter in place of the 1 mA meter movement, and switch it to read 5 or 10 mA FSD. Adjust the 4K7 pre-set to bring the pointer to zero. It is likely that the slider of the pre-set will be well off-centre. Note whether the higher resistance leg of the potentiometer goes to R2 or pin 5 of the ic. Connect the 1 K potentiometer (which is to be the actual set-zero control) in the R3 position, and wire the pre-set in series with what needs to be its high resistance leg. Set the 1 K potentiometer to mid-travel, then adjust the pre-set to bring the meter pointer to zero again. Remove the test meter and connect up the 1 mA movement to be used in the Sniffer. Check that its pointer can be brought to zero with the sensitivity control set at maximum and the slider of the 1 K set-zero at centre travel, making any necessary adjustments to the pre-set. Measure the sistance of the re-set and ubstitute a fixed resistor, RX, of the closest standard value. A number of 741 op-amps were tried in the ICI position, and offset nulling was always obtained with the 4K7 resistor, R2, connected to pin 1 of the ic. In the remote eventuality of the meter refusing to zero, connect the 4K7 pre-set directly to pin 1 of the ic (ie, short out R2). If a null is obtained with this arrangement, R2 should be connected between the potentiometer and pin 5. This setting-up procedure takes longer to describe than it does to carry out. Two amplifiers in cascade have a high gain, and the usual 10K nulling potentiometer, wired across pins 1 and 5, is impossibly critical to adjust. By making only a small portion of the potentiometer variable, the action of the nulling or set-zero control is made much more gentle. A high-quality instrumentation type op-amp with a very low input offset current could have been used for IC1 , but these devices are comparatively expensive (and less likely to be found in spares boxes), and the arrangement described above works well when the setting-up procedure has been carried out. Switch out L1 and test the Sniffer by ringing it close to a source of RF radiation. (A computer VDU or a TV receiver should drive the pointer hard over )

Using the Sniffer


A measure of skill and experience is needed to use the instrument and interpret the comparative scale readings, and it is a good idea to try out the unit at home before embarking on a search and-destroy' mission. This is not the place to describe the circuitry of eavesdropping bugs. Sufficient to say that simple versions of these micro-transmitters operate within, or close to, the VHF FM broadcast band and radiate about as much RF power as a single bipolar transistor, eg a BC108, wired as an LC tuned oscillator, and connected to a short aerial. A bug of this kind will drive the indicator pointer hard over at distances of three or four metres. More exotic bugs tend to operate at higher frequencies (450mHz and above) where the Sniffer is less sensitive. Nevertheless, the unit will give a clear indication of the radiation when its aerial is in reasonably close proximity to the transmitter. With the low inductance RF choke LI switched out of circuit, the unit will respond to frequencies down to 100kHz or so, and the meter pointer will be deflected by signals radiated from broadcast transmitters operating in the Long and Medium wave bands. These broadcast RF fields are intensified by house wiring and metal objects (eg bed springs and the silvering on mirrors), and the sensitivity control on the Sniffer has to be turned down so that any low frequency transmissions within the building can be identified. Adjusting the set zero control to cancel out steady background radiation can also be of assistance. Micro-transmitters used for eavesdropping invariably radiate at VHF and above, and the Sniffer should normally be operated with L1 switched into circuit to make it insensitive to troublesome lower frequencies. Notwithstanding this, personal computers, VDUs and TV receivers are best disconnected from the mains supply while carrying out a search. Some bugs are designed to be activated for a set period by a telephone call to the room or office. Put a call through from a neighbouring room, or otherwise arrange for the phone to ring, before commencing the search. Similarly, bugs can be installed to transmit only when a telephone call is being received, and a connection should be made to the speaking clock' during the course of the survey. Sweep the Sniffer aerial over light fittings, suspended ceilings, desks and other furniture, pictures, wall clocks and the like. Try and imagine where you would conceal a bug if you were putting the room under surveillance. Chances are, great minds think alike. Here's hoping you were being paranoid after all!

How it works


The RF voltage developed across one or both of the input inductors is converted to dc and doubled by the action of C1, D1 and D2. The charge developed across C1 when the RF voltage swings negative is added to the positive voltage swing. Operational amplifiers IC1 and lC2, are both connected in the non-inverting, closed-loop mode, with feedback applied to their inverting inputs. The negative feedback is derived from a potential divider across the output of each device. With this arrangement, the gain of ICl is given by R4+ R5 R5, and is approximately 214. Inserting potentiometer R7 into the lower leg of IC2's feedback network enables the gain of this stage to be varied between 21 and 304. The overall gain of the unit ranges, therefore, between approximately 4500 and 65000 times. Op-amps are not perfect, and there is inevitably a slight imbalance within the differential input circuitry under quiescent (no signal) conditions. When this small offset current is amplified to the extent possible with this circuit, it will drive the output stage into saturation, and provision has to be made for cancelling it out. Potentiometer R3 connected to the nulling circuitry within ICI, performs this function. With the gain available, the adjustment of the offset nulling or set-zero control is extremely critical. Resistors are accordingly placed in series with the potentiometer to reduce the control voltage across its track. By this means its action is limited to the critical nulling region , and the meter pointer can be brought to zero without difficulty Offset nulling is not required for lC2. The nulling provisions centred on IC1 balance the entire circuit by placing the necessary ompensating voltage on the input pin of lC2. Series resistor R9 sets the meter to read around 3V FSD. The output impedance of the 741 is very low in this circuit, andthe ic can accordingly supply sufficient current to damage a sensitive meter movement. Increase R9 or fit a shunt if a meter with a lower ESD than 1 mA is used). Inexpensive meters are not likely to have much electro magnetic damping, and high value capacitor C3 is wired across the meter to prevent sudden output changes causing wild pointer swings.