Eavesdropping using microwaves

At last, you think that you have a secure room for conversations. No windows to bounce laser beams off as a means to eavesdrop. The doors are sealed and air tight. But don’t rest too easy. Now there’s a new way of snooping using Gigahertz waves.

The interception of audible sound through a barrier is of great interest to various governmental agencies, especially law enforcement. The ability to clandestinely listen to conversations can provide important information about crime. It also raises important privacy issues.

One method of intercepting sound is to place a microphone close to the source of the sound. Sound is essentially a pressure wave and the microphone detects sound by detecting fluctuations in pressure associated with the pressure wave. Traditional sound control relies on creating a physical seal so that pressure waves can’t escape from the secure room. When practiced to a high degree of competence, sound control can frustrate even the most sensitive microphones available by attenuating the target sounds so that they are of a similar magnitude to the noise floor of the listening system.

Now a new invention promises to detect vibrations of objects, including slight vibrations caused by sound pressure waves, through walls. Pressure waves striking an object cause it to vibrate in a manner that can be correlated with the pressure waves.

Reflected electromagnetic signals can be used to detect audible sound. Electromagnetic radiation reflected by a vibrating object includes an amplitude modulated component that represents the object's vibrations. The new audio interception method works by illuminating an object with an RF beam that does not include any amplitude modulation. Reflections of the RF beam include amplitude modulation that provide information about vibrations or movements of the object. Audio information can be extracted from the amplitude modulated information and used to reproduce any sound pressure waves striking the object. Interestingly enough, the object can be something as unlikely as a piece of clothing. Thus, something as intensely personal as your heart beat can be intercepted by refelcted RF waves in addition to audio sounds.


Figure 1 Microwaves are reflected off an indivdual to intercept speech through barriers like walls and doors.



Figure 2 Microwaves are reflected off an object to intercept speech through barriers like walls and doors. Refelected RF is modulated by vibrations in the object making the extraction of sound practical.


While higher frequencies have advantages in beam dispersion, they have drawbacks as well. The higher frequencies have a reduced ability to penetrate barriers such as walls which limits their usefulness.

Figure 3 illustrates a sound interception system that includes an antenna coupled via a directional coupler to an RF oscillator and an RF detector. The RF detector is connected to a digital signal processor which drives a speaker or recorder. An RF oscillator and the antenna illuminates an object with an electromagnetic beam. The object then reflects a portion of the incident electromagnetic signal, which in turn is received by the antenna. The amplitude of the reflected signal is modulated if the object is vibrating. Information can then be extracted from the signal generated by the antenna and the RF detector by a digital signal processor.


Figure 3 A complete sound interception system is surprisingly simple. Major components are readily available off the shelf.



The sound interception system includes a synthesized RF oscillator connected to an amplifier which also is connected to an oscillator and a lock-in amplifier. The output of the amplifier is connected to an antenna using a directional coupler. The directional coupler is amplified and fed to a mixer. An RF oscillator provides a reference output to the mixer. The output of the mixer is bandpass filtered and the output subsequently fed to a diode detector. The output of the diode detector provides the input to a lock-in amplifier, the output of which is provided to a data acquisition computer. The data acquisition computer may include a speaker to allow realtime monitoring of the intercepted audio source.

Gigahertz audio snooping has the potential of miniaturization. The RF components of sound detection systems can be fabricated using MMIC technology resulting in an area at least as small as several square inches. The RF circuitry can be combined with digital signal processing boards or field programmable gate arrays to perform the required signal processing functions. The antenna can be constructed using a planar integrated-circuit antenna, such as a microstrip patch array. For example, an antenna designed for use with a 30 GHz RF signal can be constructed using a patch-array antenna that is approximately 4 inches on a side. Such an antenna produces a transmitted beam approximately 3 feet wide at a distance of 26 feet. A 3-foot wide beam is typically sufficient to localize a single person or an adjacent reflecting surface. For situations where the antenna size is not important, a larger array can be used. The effective range of a beam scales approximately with the antenna size and transmitted power. In addition, use of higher frequencies allows for reduced antenna size. Higher frequencies, typically, do not penetrate barriers as effectively as lower frequencies. Reflected signals can be very weak, but microwave amplifiers can be designed and built with a noise level of only 0.1 pW for a 20 MHz bandwidth. Frequencies near 100 GHz, produce a narrow-beam, of approximately 1 degree wide, for an antenna with a 4-inch aperture.

Whether it’s a hidden microphone, LASER light reflected off a window, or a gighertz audio snooping system, audio privacy is an ever-more-difficult to ensure commodity.