RF-SNIFFER
RF-SNIFFER
Is somebody listening to you? With the help of Raymond Maigh 's bug-detector, you could
catch them out first.
Competition is fierce and pressures to succeed have never been more intense. Espionage is
becoming a very real threat in businesses or professions which depend on information and
ideas. And the threat is not confined to the workplace: marriage partners concerned that they
might have an erring spouse are making increasing use of micro- transmitter style bugs to
confirm or ease their suspicions. These bugging devices are inexpensive and readily
available. They can easily be concealed in telephone power outlets, and a thousand and one
other places around the home or office. The 'Sniffer' unit described here is sensitive to RF
radiation over a wide spectrum, from around 100 kHz through VHF to 450 or 500 MHz, and it
will help detect and locate low-power spy transmitters. Most constructors will have the parts in their spares box (and if they have to be purchased, they are not expensive) and the unit can be assembled in an evening. So, why not check out your office or home and dispel those
nagging fears?
The circuit
The circuit diagram of the unit is given in figure 1 . RE signals picked up by a short telescopic
aerial are rectified in a voltage-doubling circuit formed by diodes, DI and D2, and CI The
esulting dc is applied to the non-inverting input of operational amplifier, CI. RF choke, L2, and
the low value capacitor Cl , act as a simple high-pass filter to prevent the unit responding to
low-frequency ac fields. A lower nductance RF choke, Ll can be switched into circuit to bypass low, medium, and some of the higher radio frequencies, and further restrict the response of the unit. C2 shunts residual RF to ground,'and Rl acts as a load for the voltage doubler. The gain of the amplifier is fixed by R4 and R5, which determine the level of feedback to the inverting input of the device. Resistor combination R2 and R3 null out off-set currents so that the meter pointer can be set at zero und~r no-signal conditions. Qutput from the first opamp is connected to the non- inverting input of lC2. Potentiometer R7 varies the level of feedback across this second amplifier, and enables the sensitivity of the unit to be adjusted. R9 sets the meter to read around 3V FSD, and also prevents damage to the movement in the event of the second 1C being driven into saturation. C3 smooths out any random fluctuations in the output. The dual 9V-0 9V battery supply is switched into circuit by S2A and S2B.
Components
Point contact germanium diodes should be used for DI and D2 in order to maximise the
frequency response and sensitivity of the unit (they conduct at lower forward voltages than
silicon diodes). Suitable miniature RF chokes are listed in the Cirkit catalogue, but Ll can be
formed by winding 30 turns of 34 or 36 SWG enamelled copper wire on the body of a 0.25 watt 1megohm resistor An inexpensive signal strength or VU , meter will be suitable as an indicator These instruments usually have a sensitivity of around 200 uA, and will require shunting , or an increase in the value of R9, to give the required 3-4V full scale deflection. Meter sensitivity is not critical, and a 1 or 2 mA instrument will be satisfactory for this application with the value of R9 as shown.
Construction
Most of the components are mounted on a small printed circuit board. Figure 2 shows the
component side of the board and figure 3 the copper track side. The low inductance choke L1 is wired between the telescopic aerial and S1 and the additional resistor RX, is mounted on the tags of the set zero potentiometer, R3. Provision is made on the board for either an axial or radial lead version of electrolytic capacitor C3. The use of ic holders makes it easy to check the op-amps by substitution, if necessary and Vero pins inserted at the lead-out points aid off-board wiring. The meter, telescopic aerial, PCB, potentiometers, etc., can be wired up on the bench for testing and setting up before being mounted in a small plastic case.
Setting-up and testing
If clear glass components have been used for D1 and D2, they must be shielded from light
before undertaking the setting-up procedure. (The photovoltaic effect of the diode junctions is
sufficient to swing the meter pointer hard over when the unit is set to high sensitivity). Make the usual checks for bridged copper tracks and bad soldered joints on the PCB, and check the
orientation of the diodes, op-amps and C3. Temporarily connect the 4K7 preset in the R3
position (ie to R2 and pin 5 of IC1, with the slider to pin 4 of the IC) and set it to mid travel.
Then, with the meter disconnected, switch on the power supply. Current drain from each
battery should be around 2.5mA. Connect a test meter in place of the 1 mA meter movement,
and switch it to read 5 or 10 mA FSD. Adjust the 4K7 pre-set to bring the pointer to zero. It is
likely that the slider of the pre-set will be well off-centre. Note whether the higher resistance
leg of the potentiometer goes to R2 or pin 5 of the ic. Connect the 1 K potentiometer (which is
to be the actual set-zero control) in the R3 position, and wire the pre-set in series with what
needs to be its high resistance leg. Set the 1 K potentiometer to mid-travel, then adjust the
pre-set to bring the meter pointer to zero again. Remove the test meter and connect up the 1
mA movement to be used in the Sniffer. Check that its pointer can be brought to zero with the
sensitivity control set at maximum and the slider of the 1 K set-zero at centre travel, making
any necessary adjustments to the pre-set. Measure the sistance of the re-set and ubstitute a fixed resistor, RX, of the closest standard value. A number of 741 op-amps were tried in the
ICI position, and offset nulling was always obtained with the 4K7 resistor, R2, connected to pin 1 of the ic. In the remote eventuality of the meter refusing to zero, connect the 4K7 pre-set directly to pin 1 of the ic (ie, short out R2). If a null is obtained with this arrangement, R2 should be connected between the potentiometer and pin 5. This setting-up procedure takes longer to describe than it does to carry out. Two amplifiers in cascade have a high gain, and the usual 10K nulling potentiometer, wired across pins 1 and 5, is impossibly critical to adjust. By making only a small portion of the potentiometer variable, the action of the nulling or set-zero control is made much more gentle. A high-quality instrumentation type op-amp with a very low input offset current could have been used for IC1 , but these devices are comparatively expensive (and less likely to be found in spares boxes), and the arrangement described above works well when the setting-up procedure has been carried out. Switch out L1 and test the Sniffer by ringing it close to a source of RF radiation. (A computer VDU or a TV receiver should drive the pointer hard over )
Using the Sniffer
A measure of skill and experience is needed to use the instrument and interpret the
comparative scale readings, and it is a good idea to try out the unit at home before embarking on a search and-destroy' mission. This is not the place to describe the circuitry of
eavesdropping bugs. Sufficient to say that simple versions of these micro-transmitters operate within, or close to, the VHF FM broadcast band and radiate about as much RF power as a single bipolar transistor, eg a BC108, wired as an LC tuned oscillator, and connected to a short aerial. A bug of this kind will drive the indicator pointer hard over at distances of three or four metres. More exotic bugs tend to operate at higher frequencies (450mHz and above)
where the Sniffer is less sensitive. Nevertheless, the unit will give a clear indication of
the radiation when its aerial is in reasonably close proximity to the transmitter. With the low
inductance RF choke LI switched out of circuit, the unit will respond to frequencies down to
100kHz or so, and the meter pointer will be deflected by signals radiated from broadcast
transmitters operating in the Long and Medium wave bands. These broadcast RF fields are
intensified by house wiring and metal objects (eg bed springs and the silvering on mirrors), and the sensitivity control on the Sniffer has to be turned down so that any low frequency
transmissions within the building can be identified. Adjusting the set zero control to cancel out
steady background radiation can also be of assistance. Micro-transmitters used for
eavesdropping invariably radiate at VHF and above, and the Sniffer should normally be
operated with L1 switched into circuit to make it insensitive to troublesome lower frequencies.
Notwithstanding this, personal computers, VDUs and TV receivers are best disconnected from the mains supply while carrying out a search. Some bugs are designed to be activated for a set period by a telephone call to the room or office. Put a call through from a neighbouring room, or otherwise arrange for the phone to ring, before commencing the search. Similarly, bugs can be installed to transmit only when a telephone call is being received, and a connection should be made to the speaking clock' during the course of the survey. Sweep the Sniffer aerial over light fittings, suspended ceilings, desks and other furniture, pictures, wall clocks and the like. Try and imagine where you would conceal a bug if
you were putting the room under surveillance. Chances are, great minds think alike.
Here's hoping you were being paranoid after all!
How it works
The RF voltage developed across one or both of the input inductors is converted to dc and
doubled by the action of C1, D1 and D2. The charge developed across C1 when the RF
voltage swings negative is added to the positive voltage swing. Operational amplifiers IC1 and
lC2, are both connected in the non-inverting, closed-loop mode, with feedback applied
to their inverting inputs. The negative feedback is derived from a potential divider across the
output of each device. With this arrangement, the gain of ICl is given by R4+ R5 R5, and is
approximately 214. Inserting potentiometer R7 into the lower leg of IC2's feedback network
enables the gain of this stage to be varied between 21 and 304. The overall gain of the unit
ranges, therefore, between approximately 4500 and 65000 times. Op-amps are not perfect,
and there is inevitably a slight imbalance within the differential input circuitry under quiescent
(no signal) conditions. When this small offset current is amplified to the extent possible with this circuit, it will drive the output stage into saturation, and provision has to be made for cancelling it out. Potentiometer R3 connected to the nulling circuitry within ICI, performs this function. With the gain available, the adjustment of the offset nulling or set-zero control is extremely critical. Resistors are accordingly placed in series with the potentiometer to reduce the control voltage across its track. By this means its action is limited to the critical nulling region , and the meter pointer can be brought to zero without difficulty Offset nulling is not required for lC2. The nulling provisions centred on IC1 balance the entire circuit by placing the necessary ompensating voltage on the input pin of lC2. Series resistor R9 sets the meter to read around 3V FSD. The output impedance of the 741 is very low in this circuit, andthe ic can accordingly supply sufficient current to damage a sensitive meter movement. Increase R9 or fit a shunt if a meter with a lower ESD than 1 mA is used). Inexpensive meters are not likely to have much electro magnetic damping, and high value capacitor C3 is wired across the meter to prevent sudden output changes causing wild pointer swings.