I first played around with this stuff back in the 1980s. One of the local hams sold me a Stoddart NM-20A for the then princely sum of $50. I later picked up an NM-30A.
First time I played with it, I thought "holy shit." The thing would pick up colorburst and CPU signals at surprisingly and scary long distances. As a bonus, it also served as a pretty good shortwave receiver.
Many years later, I recall hearing on one of my receivers a local radio station on a frequency that it shouldn't have been heard on. I became really concerned when I heard the same music downstairs. A little sleuthing later and I discovered I was hearing the fifth harmonic of the cheap China-made boombox's LO. Not only was I hearing the LO, but the filtering was so poor that it was bleeding the received station's audio back into the LO.
I haven't screwed around with this sort of thing in many years, don't trust my recall, and only Odin himself knows where my original notes are. Time to fire up some test equipment in the lab and do proper research. I suspect with the continued cheapening of electronics, that the research might prove to be even more interesting.
For now, here is something written by a fellow hobbyist from England, back in 1990.
RECEIVER HUNTING USING THE 'I.F.' PRINCIPLE
By Nigel Ballard
28 Maxwell Road, Winton, Bournemouth,
Dorset, BH9 1DL, England.
5 August 1990
Firstly, what is an 'I.F.'? Well, incoming signals to any modern radio
are mixed with a fixed internal signal , these are produced by a circuit
known as a local oscillator. Your incoming signal mixes with the fixed
internal signal and produces an Intermediate Frequency, or I.F.
The I.F. frequency always operates above or below the incoming
frequency. If the incoming occurred at the exact same frequency
as your receivers I.F., then your receiver would find this an impossible
signal to detect. As an example, many cheaper receivers have the all
important first I.F. at 10.7MHz, if you had a bug operating in your room on that exact frequency, then your average receiver would not aware of it's existence. This is not a BIRDIE in the classical sense, more a non-usable frequency. A normal Birdie is simply a dead channel caused by internally generated noise in the rf circuits. This 10.7MHz frequency is not blanked by internal noise, but simply dead because it falls on the same frequency that the I.F. operates on.
The I.F. frequency is thus generated, not by adding them together, but
by taking one from the other. The resultant freq is known as the first
I.F. frequency. Dependent on the radio type, and where in the spectrum
you are monitoring, the Local Oscillator may be operating above or below the received signal. Although we need to know the frequency of the radio's first I.F., it is the Local Oscillator's output we are interested in.
I'M RECEIVING, BUT I'M ALSO TRANSMITTING....SAY WHAT!
You don't have to have vast experience of TEMPEST and the like, to know that any piece of equipment that is turned on and uses crystal
controlled or ceramically resonated circuits, generates spurious output. Put an antenna on to this piece of supposedly dormant equipment, and you now have unwanted radiations, in effect when your radio or scanner is switched on and connected to an antenna, you are constantly transmitting a signal, small it may be, but it is there! And if an amateur like me can receive them at up to 50 feet, then how far can the pro's get! 'BULLSHIT' you say!
If I shoot the breeze in general terms for a while, just to convince you
that your Bearcat (example) scanner sat in your bedroom listening on one specific frequency, COULD be a dead giveaway to the authorities.
You don't need to convince the forces of both east and west that this
principle of detection works, they have been using it and trying to
defeat it in their own radio's for years and years.
In the UK, all handhelds used by the Police walking the beat are between 451.00 and 453.00MHz NFM, no ifs or buts, that's the band limits that they all operate in (London is excluded from this). Suppose you knew that the first I.F. of the latest Motorola radio's they used were 24MHz. Now suppose you came across an officer who just refused to key his radio up so that you could scan the 451 to 453 area with your scanner. Not daunted by this, you set your scanner to scan 24MHz below this band, i.e. 427.00 to 429.00MHz. Getting as close to your target as possible with a reasonable scanner using an external antenna tuned to this band, you proceed to tune over his L.O. output. If his radio is switched on, and he is NOT currently transmitting, as soon as you tune over his L.O. your scanner will stop on a weak but constant low tone. If your target then transmits the tone will disappear, as the L.O. can only be picked up in receive. Make a note of the L.O., say it was 428.500, add the original I.F. shift of 24MHz and hey presto you now have the EXACT frequency he is sat on. I make it 452.500. It is now a simple case of sitting on that spot until he decides to talk.
Well get a friend with a h/held to let you try it out. All you need is
the radio's first I.F.. Remember in a previous article I told you to
collect all the leaflets on PMR radio's you could, well most of the
catalogues will tell you the first I.F. of each and every radio they
sell. Pretty sneaky eh!
BACK TO THE MILITARY
Why do you think that our lot have a pre-occupation in getting hold of
the latest radio's from their lot. Well firstly there is the overall
capability of the radio. Then there is the RADIO SIGNATURE, each and every type of radio ever produced, gives a unique if not slight, radio signature, the right equipment can tell the exact model of radio
transmitting. Further analysis by computer can even tell a particular
radio from another radio of the exact same type and model. Very handy if the net is encrypted, thus no voice patterns can be analysed. Military producers go to great lengths to try and set all radio's up as close together as possible, thus reducing the possibility of radio
The radio analyst's Then connect a standard combat antenna to the radio and see how far away they can detect the L.O., the better the radio, the more it will have been suppressed. And of course, the first I.F. is recorded and passed around to the specialist units whose job it is to work out where the enemy is listening.
Just as an antenna increases it's TX output and RX input as you increase the gain. The same applies to the L.O. output. Take any Russian embassy, our boys will not be far away with the most sensitive receivers known to man. Not just hunting for their next transmission, that's child's play with spectrum analysers and panadaptors. The trick now is to find out WHAT they are listening to. Don't be fooled by all those antenna's on embassy roofs, it's 50% talking and 50% listening to domestic traffic. And I don't necessarily mean distant military exercises, they have their own FERRET SATS for that, I mean the Senator that's a bit too descriptive on his car phone etc etc. And please don't think the Russians are the bad boys, no sir, we do it just as much and just as well, if not a little better. Western monitoring technology being what it is!
BACK TO THE BASICS
The cheaper the radio, the greater the chances that the L.O. omissions
will be greater. Some domestic scanners put out a horrendous signal that can be detected streets away. So in future don't think that just because you're not transmitting, that no one can tell who, or on what frequency you are monitoring, because they CAN!
THE DOWN SIDE
Ever read those dear BOB letters in the back of MT? "Dear Bob, why when cellular is on 800MHz does My ****** scanner also pick them up on 900Mhz?" The answer always comes back, "well fred, it's the old low I.F. giving false images" The rule of thumb is, the higher the first I.F., the greater the change of your receiver filtering out the false images, overloading and general crud found in cheapo scanners.
Once again that's about it. I could have gone much deeper into this subject, but I value my freedom too much. If you have an inquisitive nature, then try and think of some other ways this principle could be put to good use.
BEST REGARDS Nigel.
p.s. To those of you not in the know, TEMPEST is the military term used to describe case emissions from both civilian and military equipment used in the armed services. Take an ordinary computer, it's emissions can be picked up blocks away. In step's a tempest specialist. Case's are sprayed with nickel and coated in foil. All wires are screened. All cables are wrapped around ferrite rings. VDU screens have transluscent conductive film glued to them. Peripherals, especially printers get similar treatment, including soundproofing, this is because just like the unique signature made my a radio,
printers, especially dot matrix types are a real give-away. Finally,
the equipment is run through a series of stringent TEMPEST approval trials. If it passes then the military can buy it, and the specialist company has a license to print money.
Remember, security Doesn't come cheap!