Home

Oscor Series 4 Manual.

1. payennoe XOA de 21598 D aot bor de eur 10 28062 1515 ERE RUE ERE RE ERREUR REUS REI de our ubiH papjalys eoueljleuns 1 seg 12 41 12 MOT ees ons REUS REI fs sse eer prese prse ead pres presas sss ee sees ES istae essem eese pases ELLEN NES REUS REESE ELE D
2. 86 SPECTRUM 2 8 tet 88 HARMONIC 85 0000 88 BROADBAND ENERGY 8 0044 0 0 00 0 89 TAPE RECORDER 5 90 TELEPHONE 2 6 esee sees ee 90 NON LINEAR JUNCTION 6 90 92 ACOUSTIC NOISE GENERATING 5 5 8 93 SECTION 9 STANDARD FREQUENCY 0 2222 44 93 IN eO E 95 2 97 101 STANDARD TELEVISION FREQUENCY DATA USA e eene enn 105 UM Od 107 OSCOR QUICK REFERENCE 109 REI OSC 5000 4 TABLE OF FIGURES FIGURE 1 OSCOR 3000 DELUXE FIGURE 2 MAIN PANEL FIGURE 3 ANTENNA PANEL FIGURE 4 CONNECTOR WIRING CONVENTIONS eee FIGURE 5 STORAGE COMPARTIMENT FI
3. LS Lo ws Wy souon Ageg A A Wz euoudoi ssojer y Aeng _ d 1 1 1 1 d 1 l 1l l a E 1ojd uou3 ejquiejgs 139W pieu 190 Pun Jewe2eM J z jeuy Jez jeuy 1 z jeuy IW1uoe1 SLIV3HH l esiou leyBiq le dey rewog eur nni puey UIT UON JM ede pueqpeoig 2 J uueog 06 wnyoadg SOV yal leuy eL even Ndo z M93 X09950 1Na3Wdinoa 1 191 Jeg ns 191 Uoijejeg eauej eAns ou eoueunoj1ed 1 SI 1s9q st ynom SIOQUINU Sursn pojeorpur sr eu 1eurums THREAT PRODUCT EVALUATION SUMMARY FIGURE 30 87 OSC 5000 Section 8 Other Equipment Spectrum Analyzers A spectrum analyzer is a tuned receiver It has the ability to tune to a specific frequency and receive a very narrow band of energy on either side of that frequency see page 20 Sweep Mode for further information spectrum analyzer type receiver is the preferred technology to use for countersurveillance because it provides a very accurate picture of the electromagnetic spectrum The OSC
4. Ee emer ues es c pm em es fe eme ee ee ee v p ovo d Gg OS 7 1090 10720 70 72 4 Ee es es ia ees iem iom onm on ons o io i es omn ee tt ELLEN 4440 RS RE ee ee ee ee LUN Ong 90 D Lo E E 444 OH 04002 Bng unjeds peeuds ELLEN 4440 44 44444047 Ong fouenbeu 6ng pareinpow jevbia dd LIEU IRE EETA dd Le C Laan oto 6ng euorssajosd W 2586 6 c v v v v v v 11111 SEXE E
5. Resumes previous EDIT AS automatic run SPAN OFF DEFAULT ATTN OFF GROUP Configure the Correlation process foryy automatic operation Configure the Alert outputs for automatic operation IM CORREEATION IME EET URAL METHOD ACQUIRE ANALYZE ALERT AT RESUME PASSIVE 3 Sec 30 Sec LEVEL 3 ALERT PLOT RECORDER DISPLAY MANUAL TONE VOL STYLE OUT TIME MODE RESUME OFF OFF OFF ACTIVE Correlate method may be set to PASSIVE VERIFY or ACTIVE FIGURE 21 AUTOMATIC MODE PROGRAMMING MAP To program the automatic operation of the OSCOR press the AUTO MANUAL button The following menu will appear CORRELATOR ALERT PLOT FRIENDLY LOADED PASSIVE OFF OFF 2 04 09 41 REVIEW SETUP 3 LOAD START MANUAL SIGNAL INPUTS FRNDLY AUTO RESUME FIGURE 22 AUTOMATIC MODE MAIN MENU The shaded region provides detailed information about the current correlator mode in this case PASSIVE the output conditions tone alert and plotting mode and whether or not a friendly database has been loaded in the example above the friendly database was loaded on Feb 4 at 09 41 am The bottom portion of the menu corresponds to the OSCOR function buttons The numbers represent the normal four step process to do a sweep To review the current signal database Press the button labeled REVIEW SIGNALS To review the inputs to search Press the F2 button labele
6. Press FI labeled Span Off to set all spans to OFF e Press F2 labeled DELETE to delete all user specified spans Press labeled ATTN OFF to turn the attenuator off on all spans Audio Functions The OSCOR s built in audio amplifier and audio circuitry can be used in several ways following sub sections describe these audio functions Reference Audio System For the Correlator to work properly the OSCOR must have a reference audio signal In the Correlate Mode the OSCOR constantly compares the audio arriving through the receiver system with the reference audio signal If the two audio signals are similar which means that they correlate there is a very high probability of a bugging device The Reference System provides an audio input to the Acoustic Correlator and will normally listen to the ambient sounds of the room The built in Reference Microphone is combined with a high gain automatic level control to provide signals to the Acoustic Correlator The input LED indicator lights when a sufficient input level is delivered to the Reference System Note The OSC 5000 constantly measures the acoustic level The OSCOR will prompt you to use a supplementary sound source such as a tape deck or CD player if the room sound level is too low or irregular The OSCOR can use the external reference to remotely monitor a conference room or office Use an external microphone with a long extension cable to provide reference a
7. 733 6875 733 8125 CH 57 Aud 735 1875 735 3125 CH S8 Vid 739 6875 739 8125 CH 58 Aud 7411875 7413125 cH so vid 745 6875 745 8125 CH 59 Aud 747 1875 7473125 CH 60 Vid 7516875 751 8125 CH 60 Aud 753 1875 753 3125 61 Vid 757 6875 7578125 CH 61 Aud 55 1875 59 6875 61 1875 71 6875 77 1875 81 6875 83 1875 87 6875 175 1875 179 1875 181 1875 185 6875 187 1875 191 6875 193 1875 197 6875 199 1875 203 6875 205 1875 209 6875 211 1875 215 6875 477 1875 481 6875 483 1875 487 6875 489 1875 493 6875 495 1875 499 6875 501 1875 505 6875 507 1875 511 6875 513 1875 517 6875 519 1875 523 6875 525 1875 529 6875 531 1875 535 6875 537 1875 541 6875 543 1875 547 6875 549 1875 553 6875 555 1875 559 6875 561 1875 565 6875 567 1875 571 6875 573 1875 577 6875 NIN 5 i OSC 5000 105 Index osc 5000 106 Acoustic Correlator Automatic 63 Acoustic Noise Generating Systems 94 Acoustic tile 95 Analyze Mode 29 Auto Fine Tune 32 Demodulators 31 Harmonic Frequency Analysis 33 Screen Refresh 30 Snuggle Bug Analysis 33 SubCarrier 31 Patch Cord 15 Spectrum Analysis 43 Audio
8. Demodulators The F3 button in the Sweep or Analyze Mode can select the following demodulators FM WIDE 250 kHz as used with FM Broadcast and TV sound channel e FM NARROW 15 6 kHz as used with most two way communications e SubCFM uses 250 kHz primary IF and 15 or 6 kHz secondary demodulator AM WIDE 250 kHz used for fast scanning AM NARROW 15 6 kHz used with AM Broadcast short wave CB aircraft SSB CW 6 kHz used with short wave marine amateur radio Technical Notes e DEMODULATING NARROW DEVIATION FM WITH A WIDE 250 kHz FILTER The OSCOR will sufficiently demodulate narrow deviation FM signals when operating in the wide 250 kHz bandwidth The automatic gain control will continuously adjust the audio level to the correlator or headphones for optimum results e WIDE DEVIATION FM WITH A NARROW 15 6 kHz FILTER If a narrow bandwidth filter is used on wide deviation signals over modulation of the signal profile and distorted audio will result e USE OF THE PROPER DEMODULATOR WILL RESULT IN THE BEST RECOVERED AUDIO LOWEST DISTORTION AND LOWEST NOISE Surveillance devices using FM modulation will normally produce a small percentage of AM modulation due to poor oscillator buffer design unregulated power supplies or effects of antenna reflection AM modulated devices may also contain a small percentage of FM modulation primarily due to an unstable oscillator e Receivers also respond to FM signals with AM demodulatio
9. 65 SECTION 3 PREPARING FOR A SWEEP eee ee eee ee eee tn se eee 1 0108001680 0 0 42 69 SECTION 4 CONDUCTING 8 nons so ssh sa 71 PRE LOADING SIGNALS INTO MEMORY 21 2 46 0 2 00001000 entes nnn 72 GENERATING A SIGNAL CHART OF THE AREA dinde 72 SECURE THE RE A i 73 ACTIVATING A KNOWN SOUND 5 LR SURE ds 73 SPECIAL CONSIDERATIONS FOR INFRARED AND LASER THREATS eee 74 osc 5000 3 MANUALLY SWEEPING SELECTED 75 CHECKING FOR CARRIER CURRENT 5 8 75 SETTING UP FOR AUTOMATIC 75 THE PHYSICAL 5 0 0 0 0 76 SECTION 5 MONITORING A MEETING IN 88 82 SECTION 6 TESTING TELEPHONES WITH OSCOR ecce eee 4 83 SECTION 7 SUMMARY OF OSCOR 85 0 222224 85 SECTION 8 OTHER TYPES OF
10. OSCOR OMNI SPECTRAL CORRELATOR OSC 5000 OWNER S GUIDE VER 4 0 INTERNATIONAL PROCUREMENT SERVICES OVERSEAS LTD 163 168 Brompton Road Knightsbridge London SW3 1PY UNITED KINGDOM Phone 44 020 7258 3771 Fax 44 020 7724 7925 e mail sales intpro co uk web page www intpro co uk amp www securitysearch co uk US Patents 4 399 556 5 020 137 5 241 699 osc 5000 Copyright 2001 US Patents 5020137 5241699 4 399 556 Serial Number Program Key Version Kernal Version osc 5000 TABLE OF CONTENTS TABLE OF CONTENTS eei envio FEM EH er m RE 3 OF FIGURES ceat ipM OU AVES UL EXE ACLARA DERE HA OP EVER CR En 5 SECTION 1 INTRODUCTION 6 OSCOR EQUIPMENT DESCRIPTION 2 E DE 8 VITRE Antenne PANEL EMIT 10 SV SUCM saa 11 Program 12 Storage Compartment 13 Optional Accessories and 16 OSCOR Deluxe Package of OPTIONS 16 SECTION 2 USING THE OSCON ee tet ha CHE ea pK E Fa Fe E Rega 18 SETTI
11. 609 1875 609 3125 CH 37 Vid 613 6875 613 8125 CH 37 Aud 615 1875 615 3125 CH 38 Vid 619 6875 619 8125 CH 38 Aud 6211875 6213125 cH 39 Vid 625 6875 625 8125 CH 39 Aud 627 1875 6273125 cH 40 Vid 631 6875 631 8125 CH 40 Aud 633 1875 6333125 cH 41 Vid 637 6875 637 8125 CH 41 Aud 639 1875 6393125 cH 42 Vid 643 6875 643 8125 CH 42 Aud 645 1875 6453125 cH 43 Vid 649 6875 649 8125 CH 43 Aud 6511875 6513125 CH 44 Vid 655 1875 655 3125 CH 44 Aud 657 1875 6573125 cH 45 Vid 661 6875 661 8125 CH 45 Aud 663 1875 663 3125 CH 46 Vid 667 6875 667 8125 CH 46 Aud 669 1875 669 3125 cH 47 Vid 673 6875 673 8125 CH 47 Aud 675 1875 675 3125 CH 48 Vid 679 6875 679 8125 CH 48 Aud 681 1875 6813125 cH 49 Vid 685 6875 685 8125 CH 49 Aud 687 1875 6873125 CH 50 Vid 691 6875 691 8125 50 Aud 693 1875 693 3125 cH51vid 697 6875 697 8125 CH 51 Aud 699 1875 6993125 CH 52 Vid 703 6875 703 8125 CH 52 Aud 705 1875 7053125 CH 53 Vid 709 6875 709 8125 CH 53 Aud 7111875 7113125 CH 54 Vid 715 6875 715 8125 CH 54 Aud 7171875 7173025 55 Vid 7216875 721 8125 CH 55 Aud 7231875 723 3125 CH 56 Vid 727 6875 727 8125 CH 56 Aud 7291875 7293125 CH 57 Vid
12. IF Output 17 IMAGE button 66 68 Infrared 10 48 74 Infrared Parabolic Reflector 48 Input Output 13 Inputs 21 Integration Spectrum Display 28 J Job Title 19 K Keypad 25 LD FRND 72 Load Friendly 59 Locating the Threat Infrared 48 RF 46 Tape Recorders 45 Triangulation 48 Video 67 68 Locator Probe 15 46 Loop 10 LPE 5000 Locator Probe Extension 17 M Manual Squelch Setting 58 Manually Setting the Squelch Level 58 MDC 2100 16 55 Med Hunt 58 9 MIC 5000 Miniature Microphone 17 Microphone 17 Microwave Downconverter 16 55 MiniPlug Extension Cable 15 Modulation 29 Monitoring a Meeting 83 MPA 700 Modular Phone Adaptor 17 MPC 5000 Multi Purpose Cable 17 N No Correlation 72 Noise Generating Systems 94 Non Linear Junction Detectors 93 osc 5000 108 Index OAR 5000 OSCOR Audio Recorder 17 OIF 5000 OSCOR Intermediate Frequency Output 10 7 MHZ 17 OPC 5000 OSCOR Computer Interface 16 17 ORION 94 Oscilloscope 43 OTL 5000 48 OTL 5000 OSCOR Triangulate and Locate 16 17 Outputs 61 OVM 5000 OSCOR Video Option 17 OVP 5000 OSCOR Video Patch Cord 17 67 OVS 5000 OSCOR Video Option 17 P Paper Installation 53 Parabolic Reflector 49 Peak Signal Display 27 Peak Spectrum Display 27 Phone Coupler 16 Physical Search 77 Pre Loading Friendly Signals 72 Program key 12 Programming the Auto Mode 55 R Ranging 48
13. OSCOR The default operation is to monitor the audio from the received signals To monitor the main receiver system 1 Press the EXT button to access the Audio Monitor Menu 2 Press the F1 button until the display says MONITOR RECEIVER To use the OSCOR as an audio amplifier by inputting a reference external audio source 1 Connect the external source of your choice and press the EXT button to access the Audio Monitor menu 2 Press the F1 button until the display says MONITOR REFERENCE 3 Press the F4 to choose the attenuator mode For external microphones and telephone pickups select AUTOATTN or ATTN OFF For Tape or CD inputs select AUTOATTN or ATTN ON and set the Tape or CD player in the Normal Play Mode with the volume at half level The Input Level LED should be illuminated but not constant The default for the MONITOR REFERENCE mode is ATTN ON Technical Notes e Since some music sources such as walkman machines or CD players do not have external speakers you can use the OSCOR speaker to provide the sound source e While listening to the speaker or using the headphones if you hear the reference sound source you have verified that the OSCOR is in the correct mode If there is nothing plugged into the EXT jack and the OSCOR 18 placed in the MONITOR REFERENCE Mode the speaker will have a feedback ringing because the built in microphone is being fed directly to the speaker Note It is recommended tha
14. RECALL 35 37 Receiver 20 Receivers Broadband Detectors 90 Harmonic 89 Spectrum Analyzers 89 Reference Audio 39 Refresh 30 Regional Frequency Map 96 Reset Button 19 RF Attenuator 25 RF Extension Cord 15 RS 232 13 Screen Active 63 SEEK LIMITS 24 32 Setup Inputs 57 SHIFT Functions 54 Signal 337 Deleting 37 Deleting 36 Friendly 72 Listing 52 Plots 52 Storage 34 Threat level 36 Signal Review 57 Signal Threshold 42 Signals Spurious Signal Clean up 37 Snuggle Bug 22 28 Snuggle Bug Analysis 33 Span Listing 52 Span Off 58 Speaker Monitoring Control 40 SPECT 43 Spectrum Analyzer 20 89 Spread Spectrum 27 80 Spurious Signal Clean up 37 Squelch 42 Squelch Level for automatic operation 58 Start Auto Mode 60 STORE 35 37 Subcarrier 31 Sweep Mode 20 Sweep Span Editing 38 Sweep Span Listing 52 Sweep Span Storage 37 SWEEP ANALYZE 20 29 69 Conducting 71 Environment 70 Planning 69 Scheduling 70 Securing the Area 73 Signal Chart 73 Sound Source 74 Tape Recorder 17 Controls 54 Detection 45 Detectors 91 Telephone Adaptor 17 Analyzers 91 Coupler 16 OSCOR Quick Reference Guide Index Telephone Testing 84 Carrier Current 85 Hook Switch By Pass 84 Hot Phones 84 Time Domain Reflectometry TDR 92 Voltmeters 92 Television Frequency Data 103 Threat Level 44 Locating 45 Signal Storage 34 type 70 Threat Signals 78 Time Clock 19
15. Three approaches are recommended to confirm threat existence 1 Listen to the received signal using the headphones 2 Change the environment turn up some music whistling works very well but may not be considered covert 3 Use the Correlate Confirm Mode as described below Correlate Confirm Mode The OSCOR has a built in ringer which sounds like a telephone ringing designed to maximize the correlation if an eavesdropping device is present REI OSC 5000 44 Section 2 Detecting Video Threats To use the correlator confirm ringer 1 With a signal selected in the Analyze Mode press the CORR button to enter the Correlate Mode 2 Press F4 labeled CONFIRM or the TONE button to activate a ringer tone output for positive ID The volume of the ringer tone can be adjusted as described below To set the volume of the confirm tone alert 1 With the confirm ringer ringing from the procedure above select the desired volume by pressing one of the following F1 LOW F2 MEDIUM F3 LOUD 2 To terminate the ringing press the TONE button or the F4 button labeled SILENCE The MENU button will exit the menu but will not terminate the ringer The LOUD setting for the Correlate Confirm Mode is much louder than a typical telephone and is normally used only in large conference rooms or for penetration into an adjacent room Note In some cases it is possible to have false readings from the loud mode because the ringer is so loud tha
16. within the target area and is internally coupled to the correlator reference input EXT REF input jack allows magnetic phone couplers remotely located external microphones or direct sound source inputs VOLUME SQUELCH controls audio output levels and squelch function for use when monitoring received signals POWER INPUT IEC 320 international power cord compatible 115 230 VAC switch selectable 50 60 Hz or external 12 18 VDC input CONTROL RF CABLES connects main unit and antenna array VIDEO OUTPUT provides standard video signal for use with external monitor SERIAL COMMUNICATIONS RS 232 I O port to support computer interface EXPANSION MODULE PORT supports OTL OSCOR Triangulate and Locate option and the OSCOR Microwave Downconverter MDC 2100 RECORDER OUTPUT provides option of recording received audio signals EXTERNAL SPEAKER drives larger speakers or speakers at remote locations Output is rated for 8 ohms 3 watts INTERNAL SPEAKER 3 x 5 optimized for voiceband reception will deliver high output audio for monitoring or alert tones PRINTER ACCESS allows for easy replacement of 2 in thermal paper graphic strip charts allow detailed comparisons or additions to log books Features not shown RECHARGEABLE BUILT IN BATTERY provides 2 5 hours operation per charge Built in automatic recharging system not shown Microprocessor instructs all subsystems manages memory and controls analog A D D A B
17. 10 1 10 15 11 175 114 11 65 12 05 1223 132 3 13 36 1 4 7 7 9 3 2 4 5 9 2 21 x 2 5 3 A OSC 5000 101 Section 8 Other Equipment 13 36 13 41 13 6 13 8 14 14 35 14 99 15 01 1341 13 6 13 8 14 1435 14 99 15 01 15 1 151 156 16 36 15 6 16 36 17 41 Maritime Mobile 17 41 17 55 Fixed 17 55 179 179 1803 18 03 18 02 18 052 18 068 18 068 18 168 18 168 18 78 1878 189 189 19 68 1968 198 198 1999 1999 2001 2001 2 3 136 13 41 o 1341 16 136 138 io 138 n 4 1455 3 1435 1499 3 1499 1501 3 1501 151 S 151 f 156 3 156 1636 3 1636 1741 21 1 45 Amateur 510 Amateur Satellite 145 1 85 1 1 85 1 8 6 N 2 Aero Mobile oo N N oo n 22 22 855 23 23 2 Maritime Mobile 23 2 Fixed Mobile exc aero mob 2 2 2 3 23 35 4 24 4 8 2 249 25 01 25 07 2521 25 55 25 67 26 1 26 175 275 i 28 29 7 30 005 30 01 375 3825 39 986 40 02 0 98 1 01 t2 t2 E 5 01 Std Frequency Time Signal 5 07 Fixed Mobile exc aero mob 5 21 Maritime Mobile 5 7 Radio Astronomy 26 1 26 175 Maritime Mobile 4 99 Amateur 510 Amateur Satellite 27 5 Fixed Mobile exc aero mob 28 Meteorological Aids Fixed Mob 30 005 Fixed Mobile 30 01 Fixed Mobi
18. 2V rms 220 Record Output 50mV rms with 500 Remote contact Normally Open 200mA 32V MAX Balanced Auxiliary Input 0 5V rms Nominal 600 Reference Audio Input ImV 1V rms a 3 9K Sonic Correlator 50Hz 15kHz Frequency Independent Audio Alarm 3 Level Programmable Two Tone Ringer Squelch Automatic digital or manual control over full display range Headphones Low acoustic leakage 16 output limited to 105dBA Power System AC Input 105 130 210 260V AC 50 60Hz 24W External DC Input 12 18VDC 1A max Internal Battery 12 6V 2 6 Ah 3 hour operation per charge typical Mechanical Size HxWxD 6 25 x 18 5 x 14 5 in 47 x 36 8 x 15 9 cm Weight 28 Ib 12 7kg Section 8 Other Equipment SECTION 8 OTHER TYPES OF EQUIPMENT It should also be noted that there are many things that professional sweep teams may do that require the use of other types of equipment Many people have different ideas about what should be done during a sweep This user s manual is focused primarily on the use of the OSCOR and the issues associated with the type of threats for which the OSCOR was designed Still other types of equipment and the added security benefits that can be achieved from them should not be ignored This section provides a brief and as unbiased as possible description of other types of equipment FIGURE 29 provides an objective view of the ability of certain types of equipment to address specif
19. 510 Amateur Satellite_ Amateur 510 Amateur Satellite Amateur 510 Amateur Satellite Standard Frequency Time Signal Aeronautical Fixed Broadcasting Maritime Mobile Fixed Mobile exc Aero Mobile Fixed Mobile Radio Astronomy Aeronautical Radio navigation Fixed Mobile Fixed Mobile Space Research Fixed Mobile Space Research Section 8 Other Equipment 98 117 98 136 137 138 143 6 143 65 144 146 148 149 9 150 05 156 763 156 838 174 216 220 225 267 273 322 328 35 399 00 0 00 1 406 06 1 430 440 450 460 470 512 608 614 806 890 902 928 942 2 2 BID 92 95 99 59 5 q gt Un 1215 1260 1300 1350 1400 1427 1429 1525 1535 1544 1545 1555 1559 1610 1626 1631 1634 1645 1646 1656 1660 1660 1668 1700 Un Z yi 136 137 138 143 6 143 65 144 146 148 149 9 150 05 156 763 156 838 174 216 22 22 2 27 2 3 2 35 4 6 00 5 00 15 4 4 4 4 4 B e 4 512 6 614 8 890 90 928 942 6 8 0 3 4 5 6 7 0 0 0 5 7 3 2 6 0 0 0 0 0 8 6 2 1215 1260 1300 1350 1400 1427 1429 1525 1535 1544 1545 1555 1559 1610 1626 5 1631 5 1634 5 1645 5 1646 5 1656 5 1660 1660 5 1668 4 1700 1710 OSC 5000 Maritime Mobile distress Fixed Mobile exc aero mobile Fixed Mobile Fixed Mobile Meteor Satellite Radio As
20. 815 9 04 99 9 99 10 005 10 1 10 15 11 175 Fixed Mobile exc aero Mobile 114 11 65 12 05 12 23 13 2 Maritime Mobile 2 13 36 1 4 063 Fixed Maritime Mobile 7 9 5 Amateur Fixed Mobile 4 063 4 438 Maritime Mobile 1 1 Fixed Mobile exc aero Mobile Fixed Mobile Broadcasting 765 Aeronautical Mobile 9 3 4 El 2 3 5 2 o0 Ss be a A OSC 5000 97 13 36 13 41 13 6 13 8 14 14 25 14 35 14 99 15 01 15 1 15 6 N 17 41 17 55 17 9 18 03 18 052 18 068 18 168 18 78 18 9 19 68 19 8 19 99 20 01 21 1 45 1 85 1 87 1 924 22 22 855 23 23 2 N 24 4 8 24 9 25 01 25 0 25 21 25 55 25 67 26 1 26 17 27 5 28 29 7 30 005 30 01 37 5 38 25 39 986 40 02 0 98 1 015 5 Bla N N e Uo Un 4 72 73 74 6 74 8 75 2 76 108 2 13 41 13 6 13 8 14 14 25 14 35 14 99 15 01 15 1 15 6 16 36 17 55 17 9 18 03 18 052 18 068 18 168 18 78 18 9 19 68 19 8 19 99 0 01 21 1 45 1 85 1 87 2 N 2 N N oo n 2 23 2 3 35 2 9 2 3 4 4 99 5 01 5 07 5 21 5 25 5 67 26 1 6 175 25 28 29 7 30 005 30 01 8 25 9 986 40 02 0 98 41 015 50 54 2 N 2 AR t to oo Ml Ww 74 6 74 8 75 2 76 108 117 98 OSC 5000 Maritime Mobile Maritime Mobile Amateur
21. 93 609 1875 H 37 Vid 613 6875 H 37 Aud 615 1875 615 3125 38 Via 619 6875 H 38 Aud 621 1875 H 39 Vid 625 6875 H 39 Aud 627 1875 H 40 Vid 631 6875 H 40 Aud 633 1875 H 41 Vid 637 6875 H 41 Aud 639 1875 H 42 Vid 643 6875 H 42 Aud 645 1875 H 43 Vid 649 6875 H 43 Aud 651 1875 H 44 Vid 655 1875 H 44 Aud 657 1875 H 45 Vid 661 6875 H 45 Aud 663 1875 H 46 Vid 667 6875 H 46 Aud 669 1875 H 47 Vid 673 6875 H 47 Aud 675 1875 H 48 Vid 679 6875 H 48 Aud 681 1875 H 49 Vid 685 6875 H 49 Aud 687 1875 H 50 Vid 691 6875 H 50 Aud 693 1875 H 51 Vid 607 6875 H 51 Aud 699 1875 H 52 Vid 703 6875 H 52 Aud 705 1875 H 53 Vid 709 6875 H 53 Aud 711 1875 H 54 Vid 715 6875 H 54 Aud 717 1875 55 Vid 721 6875 55 723 1875 H 56 Vid 727 6875 H 56 Aud 729 1875 H 57 Vid 733 6875 H 57 Aud 735 1875 H58 Vid 739 6875 H 58 Aud 741 1875 H 59 Vid 745 6875 H 59 Aud 747 1875 H 60 Vid 751 6875 H 60 Aud 753 1875 H 61 Vid 757 6875 H 61 Aud Q 795 1875 o 789 1875 789 3125 CH 67 Vid QIQ 579 1875 5793125 32 4 583 6875 583 8125 CH 32 Aud 585 1875 5853125 CH 33 Vid 589 6875 589 8125 CH 33 Aud 591 1875 5913125 CH 34 Vid 595 6875 595 8125 CH 34 Aud 597 1875 5973125 cH35 Vid 601 6875 601 8125 CH 35 Aud 603 1875 603 3125 CH 36 Vid 607 6875 607 8125 CH 36 Aud
22. Frequency Modulated FM signals and wide band Amplitude Modulated AM signals see page 31 Demodulators The rapid refresh rate of the display will show the dynamics of the spectrum such as modulation peaks or the on off of two way signals An individual signal can easily be viewed for amplitude and modulation peaks by narrowing the frequency span and adjusting the Frequency Display see page 23 Adjusting the Frequency Display Any signal that produces little or no modulation should also be checked with a narrower IF filter REI OSC 5000 21 Section 2 Detecting Video Threats 156 0000npz ESHT SWEEP WHIP 250 kHz FM WIDEJATTN OFFISYSTEM FIGURE 8 SWEEP MODE SCREEN DISPLAY WITH WIDE BANDWIDTH The narrow 15 kHz and 6 kHz are designed primarily for narrow band FM and AM signals These filters will indicate if two signals are hiding within a wide filter profile Each signal should be demodulated in the Analyze Mode to determine if there is correlation or room sound present SEReme 155 252b 155 245 SWEEP WHIP 15 kHz FM OFF ISYSTEN FIGURE 9 SWEEP MODE SCREEN DISPLAY WITH NARROW BANDWIDTH Figure 9 shows that upon closer inspection using a narrow bandwidth the above signal contains a snuggled transmitter Note Using narrow IF bandwidths on narrow deviation signals will reduce the system noise level and produce higher sensitivity REI OSC 5000 22 Se
23. Note The single click method provides only one click per range measurement The multiple click method integrates a maximum of 10 clicks for a very reliable measurement that filters out any extraneous noise Therefore the single click method will work well only in a very quiet room However the single click method is advantageous because it is more covert than the multiple click method The multiple click method is very noisy and may alert the eavesdropper 7 Press F2 F3 or F4 to initiate the clicking device REI OSC 5000 49 Section 2 Detecting Video Threats e Adjust the volume of the clicking with the UP DOWN buttons e Adjust the screen width with the EXPAND NARROW buttons For best accuracy the screen should be at the minimum range Narrow that still allows the audio spikes to be visible 8 Adjust the directional sound characteristics by using the parabolic reflector attached to the OTL 5000 device When the first spike on the display is maximized the OTL 5000 device is pointing in the direction of the microphone The OSCOR in this mode displays the range to the bug The spikes on the screen represent the sound of the clicking being received by the bug The multiple spikes are the echoes from the clicking The rising edge of the very first spike is the direct path to the bug and should be used for each range measurement 9 The range is measured in three positions represented by left center and right by placing the cursor at t
24. Place a sound source directly in front of each air vent in the target area Listen to all the air vents within a large area to determine potential acoustic leakage use an ALP 700 or EAR 200 REI products or a similar device e Checking that all intercom speakers function properly Intercom speakers make great microphones It is relatively easy to disconnect an intercom speaker to use it for listening purposes Unless the intercom speakers are continuously on even with very low sound they should be disconnected at the speaker or removed After the OSCOR has completed at least one pass through every input each signal that exceeds the specified squelch level will be stored in the OSCOR memory Reliability is increased with multiple passes through each input By using the data recall functions described on page 33 Data Functions STORE RECALL each of these signals can be reviewed As each signal is reviewed the threat level of friendly signals should be manually changed to Friendly It is recommended that you acquire information about the expected RF signals in your local area In the United States this information is available from the FCC FCC data is provided on page 93 SECTION 9 STANDARD FREQUENCY INFORMATION Using the Hardcopy Plots When Reviewing Signals A complete signal listing should be printed prior to reviewing the signals When each signal is reviewed and manually examined the signal can be checked off or special notes ab
25. Tone Ringer System 42 Triangulate and Locate Option 16 17 48 U Units 19 UP 24 V Video Chip Camera 65 Detection 65 Identifying 66 Locating 67 68 Separate Monitor 67 Video Option 17 Video Recording 17 67 VLF Adapter 15 Volume for Tone Ringer 42 W Whip 10 Shift Functions osc 5000 109 Silence Confirmation Tone Display Database Status SHIFT 007 Set Start up Input to current input SHIFT 008 Set Squelch Delay Time SHIFT 103 Loads Pre defined Spans in Memory 25MHz Inc FIGURE 32 SHIFT FUNCTION SHIFT 009 Manual Mode Display Privacy OSC 5000 110
26. all signals that have a LOW CORR and have a history of less than 5 encounters This mode is used to eliminate detected noises that are not associated with real signals 6 Press Fl to confirm the deletion process 05 Sweep Span Storage The OSCOR has 6 pre programmed input frequency spans covering the available range of the electromagnetic spectrum Up to 31 additional frequency spans may be added to the memory for rapid manual recall of stored span or for use in the Automatic Mode see page 57 Editing or Creating a Frequency Span for Automatic Operation These stored alternative frequency spans can be recalled and or modified in the Manual Mode using the normal STORE RECALL functions For your convenience the OSCOR is pre programmed with these standard inputs and their associated frequency spans To display the list of stored sweep spans 1 Place the OSCOR in the Sweep Mode using the SWEEP ANALYZE button Press the RECALL button to display the sweep span list In this mode the Rotary Dial or the UP DOWN buttons can be used to select a specific sweep span The RECALL button toggles between the Sweep Span List Mode and the normal frequency spectrum view The following is a description of the sweep span list Select with Rotary Dial Down amp UP Keys SCAN INPUT DMD FREQUENCY RANGE ATN OFF RF LOOP AM 10 0 2 510 OFF MED RF WhipL AM 500 0KHz 5 500MHz OFF MED RE Wh
27. and the VLF probe attachment the telephone lines can be tested for carrier current transmitters All conductor combinations should be tested using a procedure outlined on page 75 Checking For Carrier Current Threats All phone lines in the target environment should be tested To test telephone lines for carrier current 1 Connect the VLF adapter see page 15 VLF Adapter to the AC power cord 2 Connect the blue Modular Phone Adapter see page 17 Modular Phone Adapter in line with the telephone 3 Select the AC VLF input with the OSCOR the Sweep Mode 4 Tune to each signal that occurs and analyze it for threat potential 5 Test each combination of conductors for carrier current signals Testing Telephones for RF Transmitters There are types of RF transmitting telephone bugs that are only activated when the telephone is off the hook Therefore it is necessary to test the telephone for this type of RF transmitter when the phone is both on and off the hook To Test the Telephone for an RF transmitter 1 Place the telephone very near the OSCOR unit it also works well to wrap the telephone cord that connects the handset and the base unit around the OSCOR whip antenna 2 Putthe OSCOR in the Sweep Mode see page 20 Spectrum Analyzer Functions 3 Compare the Frequency Spectrum with the phone in the off hook position to the Frequency Spectrum in the on hook position It may be useful to generate plots of these two configurations and
28. attenuator will reduce sensitivity by 20 dB The attenuation is being applied to receive signals prior to amplification in the Antenna Panel pre amplifiers To turn on the RF attenuator In the Sweep or Analyze Mode press the F4 button labeled ATTN OFF on the Display The F4 button toggles the attenuator mode to on or off Note The OSCOR also has a built in audio attenuator that is used to protect the audio circuitry from high power audio inputs see page 41 Audio Attenuator Note The OSCOR attenuator does not affect the operation of the MDC 2100 Alternate RF Spectrum Display Modes The OSCOR provides several different ways to view the RF spectrum in the sweep mode These display modes are defined below e Real time Spectrum Display Provides the most recent view of the RF spectrum according to the OSCOR receiver This data is not stored in RAM memory and is only displayed as the data is measured e Friendly Spectrum Display This is an image that is stored in RAM memory This image of the frequency spectrum should only be taken at a location that is known to be free of bugging devices e Peak Spectrum Display This is an image that is stored in RAM memory This image is continuously updated based on peak values measured from the Real time frequency data e Integration Spectrum Display This is a spectrum display mode developed by integrating the spectrum data from the Real time frequency spectrum This image is not stored i
29. back down the line to the TDR unit The time delay between the transmitted pulse and the received pulse is directly proportional to the distance of the flow change from the TDR unit A flow change can be anything from a very sharp bend in the telephone wire to a punch down block in the phone room within a large building TDRs are used primarily by telephone and cable companies to verify the integrity of the phone or cable lines but they are also useful for countersurveillance If your phone is tapped the tap will result in a reflection and can be detected by the TDR There are many varied opinions about the usefulness of such a device Some people swear by them but others believe they are too labor intensive In the right hands a TDR can be a very effective tool Unfortunately most people do not have the skill patience and dedication to use one properly For example for a telephone system with 6 conductors one basic test for a single phone is to remove all conductors from the central block associated with that phone it may be quite a chore to locate these conductors By shorting and or opening several combinations of pairs of conductors a TDR plot of the tip and ring conductors as well as at least one other pair of conductors can be generated You can determine if there is a flow difference in the tip and ring pair of REI OSC 5000 91 Section 8 Other Equipment conductors versus another pair of conductors to try to establish whethe
30. compare the plots see page 51 Sweep Plots Frequency Spectrum Plots and page 72 Generating a Signal Chart of the Area 4 Any signal that appears only in the off hook position should be further analyzed using the Analyze Mode REI OSC 5000 84 Section 7 OSCOR Specifications SECTION 7 SUMMARY OF OSCOR SPECIFICATIONS RF System RF Receiver Type Quad Conversion Super Heterodyne with 3 phase locked loop synthesizers RF Frequency Coverage 10kHz 3GHz Tuning Resolution 100Hz Sensitivity 0 8uV typical with 15kHz Bandwidth 15dBm MAX Demodulators AM FM Wide FM Narrow FM SC SSB CW IF Bandwidth 250kHz 15kHz 6kHz Attenuators 0 20dB at active whip Discone and VLF MF input Dynamic Range 90dB Subcarrier Tuning Range 15kHz 250kHz Antenna Types Balanced Loop 10kHz 500kHz 35 45kHz Narrow Active Whip 500kHz 1500MHz Discone 1500MHz 3000MHz Infrared Detector 10kHz 5MHz 850 1070nM AC Carrier Current 10kHz SMHz Balanced Across Power Line Control System 8 16 Bit Microcontroller 128 512K Optional Static RAM Memory Optical Encoder 128 Pulse Rev with variable count ratio Program Key 64K Byte ROM Display 128 x 256 Segment Graphics Supertwist LCD Printer 192 Dot Per Line Graphics on 2 wide thermal paper osc 5000 Audio System Frequency Response 50Hz 15kHz Voiceband Filter 300Hz 3000Hz 18dB Octave AGC Dynamic Range 60dB Output Power 3W 4 Headphone Output 0
31. in RAM memory This data is referred to as the Friendly RF spectrum display data This Friendly data is then utilized to compare to the Real time frequency data to quickly identify signals that are unique to one environment The Friendly Spectrum display data is automatically loaded when the Load Friendly operation is executed Also the Friendly RF Spectrum data can be captured without running the automatic mode using the procedure outlined below To Load the Friendly spectrum data 1 Ensure that the OSCOR is in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Press the F4 button labeled MANAGE IMAGES 4 Press the F4 button labeled Capture Span as Friendly To Display the Friendly spectrum data 1 Ensure that the OSCOR is in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Press the button repeatedly until the label reads PRIMARY FRIENDLY or press the F2 button repeatedly until the label reads DOT IMG FRIENDLY You may also capture friendly from the Auto Mode Loading Friendly To Clear the Friendly spectrum data 1 Ensure that the OSCOR is in the Sweep Mode Press the MENU button labeled CONFIG Press the F4 button labeled MANAGE IMAGES Press the button labeled Clear Comparison Span Memory FRIENDLY REI OSC 5000 26 Section 2 Detecting Video Threats 5 Press the button labeled DELETE to confirm deletion Peak Spectrum Display Ma
32. interest for a particular location Any signals that warrant closer inspection can be marked for attention when setting up prior sweeps When comparing plots of the same area from different dates new signals stand out quickly and should be cause for suspicion Signals that are known to be FRIENDLY can also be noted For further information on the advantages of this approach see page 72 Generating a Signal Chart of the Area REI OSC 5000 51 Section 2 Detecting Video Threats To generate a plot of the frequency spectrum in the Sweep Mode 1 With the desired frequency span displayed press the PLOT button to display the Plot Width Menu 2 Select the plot width using buttons F2 and F4 3 Press the button labeled PLOT to execute the plot 4 A plot be canceled by pressing MENU Sweep Span Listing The OSCOR can also print the sweep spans stored in memory This listing will always include the default sweep spans that are permanently stored in memory To plot a listing of the stored sweep spans 1 Place the OSCOR in the Sweep Mode using the SWEEP ANALYZE button 2 Press the RECALL button to display the sweep span list The RECALL button toggles the unit between the sweep span list and the frequency spectrum view 3 Press the PLOT button 4 A plot may be canceled by pressing MENU Analyze Mode and Correlate Mode Plots To generate a plot of the Analyze Mode or the Correlate Mode When the desired mode
33. is displayed press the PLOT button The plotting process be canceled by pressing MENU Signal Listing Another useful plot is the signal listing All the signals stored in the OSCOR database can be plotted see page 34 Signal Storage signals are plotted in ascending frequency order Information about each signal may include threat level time and date detected frequency antenna input bandwidth used and demodulator selected Whether lists are created in Automatic or Manual Mode their appearance will be similar In Automatic Mode the type of signal list and their order are determined by the setup see page 62 REI OSC 5000 52 Section 2 Detecting Video Threats Auto Plotting of Threat Signals To plot a signal list 1 Place the OSCOR in the Analyze Mode by pressing the SWEEP ANALYZE button 2 Press the RECALL button to display the signal list The RECALL button toggles the unit between the signal list and the Analyze Mode spectrum view 3 Press the PLOT button to print the list that is displayed on the screen using the print format specified under the CONFIG sub menu MENU button After pressing the MENU button adjust the print format using the button Use button to filter the list printing only specific threat levels ie FRIENDLY LOW THREATS THREATS Note Only the signals that are displayed in the recall mode will be printed The signal database can be filtered so that only a certain threat l
34. search process The threat level of any signal can be manually edited Signals classified as DECLARE are signals that have been evaluated and declared to be threats Declared threats are also ignored in the Automatic Sweep Mode The OSCOR signal storage is an easy way to reduce the time required of the automatic sweep process For example if all local radio and TV stations are entered as friendly signals they will be ignored in subsequent automatic sweeps unless their power level changes by greater than 496 see page 72 Pre Loading Signals into Memory The following is an example of a signal list REI OSC 5000 34 Section 2 Detecting Video Threats ALL STORED SIGNALS TIME THRT PK DATE RF FM 66 0345MHZ 08 38 715 FRIENDLY 14 RF FMW 93 6950MHz 08 41 715 FRIENDLY 13 RF FMW 117 6050MHz 08 41 715 FRIENDLY 10 RF FMW 169 2650MHz 10 41 7 15 4 4 21 MODIFY THREAT LEVEL DELETE SETUP RAISE LOWER FRIENDLY SIGNAL MENU FIGURE 13 EXAMPLE SIGNAL LIST SCREEN DISPLAY The first three columns specify the type of input the frequency and the type of demodulation of the stored signal such as FMW FM wide which is used for FM broadcast and TV channel sound or FM FM narrow which is used by most two way communications see page 31 Demodulators for more information fourth column specifies the date and time fifth column labele
35. signals the effectiveness of these devices is drastically reduced because there are so many signals that are received simultaneously Furthermore most inexpensive broadband detectors are only effective over a very small portion of the RF spectrum and do not provide the ability to listen to the transmitted signal The CPM 700 is effective from 15 kHz to 3 GHZ and has several probes available for testing carrier current infrared and magnetic leakage tape recorders The CPM 700 also contains an audio amplifier that allows the user to listen to the signal and to perform some phone testing similar to the OSCOR testing described on page 83 Testing Telephones with OSCOR For an adequate broadband detector expect to pay between 1 500 to 2 500 One great advantage of the broadband detector is that it is not affected by frequency hopping bugs and is very effective against spread spectrum Many professional sweep teams use a REI OSC 5000 89 Section 8 Other Equipment spectrum analyzer type device to locate the frequency of a threat and then used a broadband energy detector to physically locate the threat Tape Recorder Detectors There are a few products on the market that have a tape recorder detection capability but the ability to detect a tape recorder is greatly dependent on the design of the tape recorder Most high quality tape recorders contain a device called a bias oscillator which generates a magnet field used to produce high qualit
36. signals by integrating the frequency display to minimize the interference from the modulation The Integration Spectrum Display OSC 5000 27 Section 2 Detecting Video Threats is a real time frequency display function that is not stored in the OSCOR memory Anytime the frequency display is altered in any way from using the EXPAND NARROW keys or the UP DOWN keys the integration data is completely reset To Display the Integration spectrum data 1 Ensure that the OSCOR is in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Press the button repeatedly until the label reads PRIMARY INTEGRAT or press the F2 button repeatedly until the label reads DOT IMG INTEGRAT To reset the Integration spectrum data 1 Ensure that the OSCOR is in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Press the F4 button labeled MANAGE IMAGES 4 Press the button labeled Reset Integrat IMAGE Note The Integration spectrum data is also automatically reset when the frequency display is altered Difference Spectrum Display The OSCOR provides the ability to compare two different display modes This mode is particularly useful for comparing a Friendly frequency spectrum to the Real time frequency spectrum Using this display mode signals that are unique to the sweep environment are quickly identified providing a very rapid method of detection for some bugging devices However this mode may also
37. start frequency is indicated with a left arrow The stop frequency is indicated with a right arrow gt The frequency span is indicated with two arrows 9 The tuning frequency is indicated with no arrows 9 The cursor frequency is indicated with large numbers Note In the Sweep Mode the tuning frequency will be continuously changing as the receiver sweeps the frequency span In the Analyze Mode the tuning frequency will be continuously changing only if the cursor frequency is below the squelch level Rotary Dial The Rotary Dial allows smooth and accurate placement of the tuning cursor and will jump to the next frequency span when the cursor reaches a screen end limit Entering the desired frequency directly on the keypad can also move the cursor REI OSC 5000 23 Section 2 Detecting Video Threats Note The Rotary Dial is a digitally controlled optical encoder programmed with a variable rate It will adjust its step size according to rotational speed The cursor can be positioned over any signal to identify its frequency or to select that frequency in the Analyze Mode EXPAND and NARROW The displayed frequency span can be adjusted by using the EXPAND and NARROW buttons Each push of these buttons increases or decreases the Frequency Display by a pre defined increment these increments vary depending on the current location but usually nearly double or half the frequency Pressing SHIFT then EXPAND key
38. that works well as a bugging device has a fundamental frequency of 155 MHz but also radiates at 165 MHz 175 MHz and 185 MHz Harmonic signals increase the probability of detecting a transmitter because when the OSCOR is scanning in the Automatic Mode harmonics provide additional opportunities to detect a single transmitter If you have multiple threats detected examine the relationship between the frequencies to determine whether the additional signals are harmonic or multiplier frequencies Spread Spectrum As technology continues to advance spread spectrum technology is becoming more common in commercial products This technique takes a strong signal and spreads the transmitted energy over a wide frequency spectrum making the transmitter more elusive Rather than seeing a large signal resembling the Washington Monument the signal resembles a low plateau that can stretch for miles To the casual observer the Washington Monument is more easily noticeable than the plateau Furthermore spread spectrum signals are digitally coded and unless you have a spread spectrum receiver with the proper digital code locked in synchronization with the transmitter it is impossible to decipher the information being transmitted Due to the method of digital encoding in the spread spectrum signal there may appear to be multiple low level signals that are frequency hopping If you are unsure if the signal is a threat try the procedures described on page
39. the LED Displays the WhipLo Wired Digital Very weak signals in the RF Loop and WhipLo Low Phones Digital phones may have a control system that operates at several kilohertz or megahertz FIGURE 29 UNINTENTIONAL RADIATOR PROBABILITY REI OSC 5000 81 Section 5 Monitoring a Meeting SECTION 5 MONITORING A MEETING IN PROGRESS It is relatively easy for someone to carry an eavesdropping device into a meeting Most bugging devices on the market today can be turned on only when needed and easily carried in a coat pocket portfolio or briefcase One of the unique features of the OSCOR is its ability to monitor a meeting in progress from a remote location The OSCOR works on the following principle if the audio information on a transmitted signal IR RF or carrier current is identical to the sounds in the environment under test referred to as the reference sound source then an eavesdropping transmitter is present In normal operation the OSCOR has a built in microphone that serves as the reference sound source However an external microphone may be plugged into the unit for remote observation The OSCOR can be placed in a room adjacent to the target environment A microphone is placed in the target environment with an extension cable leading to the OSCOR the microphone extension may be run over the wall in the case of drop ceiling under the door or even through the wall The OSCOR will function as if it were located in the ta
40. to the REMOTE output and REMOTE input of the tape recorder To set the recorder to a ready condition Press the RECORD and PLAY buttons simultaneously on the tape recorder This will prepare the recorder to run when the unit s REMOTE output jack gives an ALARM see page 62 Auto Tape Recording of Threat Signals To manually record 1 Press the TAPE button An illuminated LED and the rotation of the micro cassette reels indicate recording 2 To stop recording press the TAPE button again Note To reduce high and low frequency noise all recordings utilize a band filtered response The voice band filter is toggled on and off by pressing the filter button OSCOR Automatic Mode Operation In the Automatic Mode the OSCOR will scan all programmed inputs and frequency bands If friendly signals have already been stored in the OSCOR either by uploading the information from a PC or with the procedure on page 72 Pre Loading Signals into Memory This procedure greatly speeds up the automatic search process because the when the OSCOR is programmed to search for bugging devices the signals labeled as FRIENDLY will be ignored unless their power level changes by greater than 4 Otherwise each signal detected is stored in the internal signal database and analyzed for threat correlation see page 63 Correlate Acoustic Correlator System Automatic The Quick Reference Guide on page 109 at the end of the manual provides a map of th
41. unstable tuning oscillators requiring constant adjustment The OSCOR however contains a digitally synthesized receiver quad conversion super heterodyne with 3 phase locked loop synthesizers designed specifically for the OSCOR Various intermediate frequency bandwidths and demodulators allow the OSCOR to resolve wide or narrow bandwidth signals including subcarrier audio The SWEEP ANALYZE button located just below the Rotary Dial alternates between swept spectrum Sweep Mode and demodulated analyze Analyze Mode modes In this screen the following functions are available F1 sequentially steps through all the available sweep spans and input devices on the antenna array and will automatically select the IF bandwidth and demodulator for optimum scanning speed and recovered audio see Figure 6 This button will toggle through the entire default sweep spans as well as any spans that have been stored see page 37 Sweep Span Storage F2 selects the intermediate frequency bandwidth in a sequential step function and is combined with the wide and narrow band demodulators Available bandwidths 250 kHz 15 kHz 6 kHz see Figure 6 F3 selects the appropriate demodulator for audio monitoring or correlating Available demodulation schemes include AM FM FM Subcarrier SSB CW The subcarrier demodulator utilizes a wide 250 kHz primary IF and then performs a second narrow band demodulation of 15 kHz and 6kHz Note Since the Sweep Mode doe
42. will force the screen to jump to the maximum frequency display The SHIFT key followed by the NARROW key will move the frequency display toward the minimum very quickly but may sometimes require a repetition in order to reach the minimum display Wide spans will show multiple signals frequency placement and amplitude Stronger signals signals with harmonic multiples see page 79 Transmitter Harmonics or signals that are out of band can be easily identified A typical medium span view allows easier separation of each signal when selecting one to view in the Analyze Mode close up narrow span will clearly show each individual signal and its modulation To narrow in on a signal Use the Rotary Dial and the NARROW button to focus on the signal while decreasing the frequency span of the display UP and DOWN Similar in function to the Rotary Dial the UP and DOWN buttons will immediately jump to the next higher or lower frequency span Frequency Display Window These buttons are also used for tuning the subcarrier system see page 31 Tuning Subcarrier Pressing SHIFT followed by UP or DOWN will jump one half screen The UP and DOWN buttons are also used to scroll through the input lists and signal database lists see page 34 Data Functions STORE RECALL SEEK LIMITS The SEEK LIMITS button uses the automatic tuning function to automatically adjust the signal being received and analyzed Press SHIFT then SEE
43. 2 line and block provide a short description of threat signals that are encountered signals are plotted as they are detected Information about each threat includes threat level time and date detected frequency and bandwidth used and input and demodulator selected This plotting method provides a quick hardcopy of the necessary signal information and requires very little paper or plotting time Experiment with these methods to view the various results However the 2 line method provides the most information on the least amount of paper The plot style chart provides a graph of each threat signal encountered This mode requires additional paper and increases plotting time but it provides more information about the signal To toggle between the plot style 1 line 2 line block and chart modes 1 Enter the Automatic Mode Output Configuration Menu as described on page 60 2 Press the F2 button labeled PLOT STYLE under the Outputs Menu to toggle the plotting options through the options of 1 Line 2 Line BLOCK CHART and OFF Auto Tape Recording of Threat Signals Using this option the OSCOR will provide a timed tape recording of each received signal exceeding the specified threat level Refer to page 54 Tape Recorder Controls for more information about the tape recorder To activate or deactivate the Auto Tape Recording Mode 1 Enter the Automatic Mode Output Configuration Menu as described on page 60 2 Press the F3 butto
44. 3 ft for tape recorders that do not have shielded bias oscillators and 2 to 6 ft for most body wires Telephone Analyzers Most telephone analyzers fall into one of two categories voltage analyzers and time domain reflectometry analyzers There are many ways to tap a phone that are practically undetectable so the most important thing to remember is to respect the telephone Here are a few tips for any business that has information to protect 1 If there is no reason to have a telephone in a conference room during a meeting then remove it 2 Do not discuss sensitive information over the telephone unless it is absolutely necessary 3 Ifa great deal of important business is being conducted over the telephone lines invest in a secure phone system The best secure phone system is called a STU III Secure Telecom Unit however these types of phones fall under munitions control and require an export license 4 If business partners are often away from a secure phone use a portable scrambling device such as REI s Scrambler REI OSC 5000 90 Section 8 Other Equipment Voltage Analyzer Voltmeters There are many telephone analyzers on the market and yet most of them do basically the same thing Except for the time domain reflectometry described below It is a phone analyzer primarily with a voltmeter witch includes switching functions designed to perform various types of tests Phone analyzers may provide convenience when testing p
45. 5 547 6875 549 1875 553 6875 555 1875 559 6875 561 1875 565 6875 567 1875 571 6875 573 1875 577 6875 Stop MHz 55 3125 59 8125 61 3125 65 812 67 312 71 812 71 312 81 812 83 3125 87 8125 175 3125 179 3125 181 3125 185 8125 187 3125 191 8125 193 3125 197 8125 199 3125 203 8125 205 3125 209 8125 11 3125 15 8125 471 3125 481 8125 483 3125 487 8125 489 3125 493 8125 495 3125 499 8125 501 3125 505 8125 507 3125 511 8125 513 3125 517 825 519 3125 523 8125 525 3125 529 8125 531 3125 535 8125 537 3125 541 8125 543 3125 547 8125 549 3125 553 8125 555 3125 559 8125 561 3125 565 8125 567 3125 571 8125 573 3125 577 8125 H 2 Vid H 2 Aud H 3 Vid H 3 Aud H 4 Vid H 4 Aud H 5 Vid H 5 Aud H 6 Vid H 6 Aud H 7 Vid H 7 Aud H 8 Vid H 8 Aud H 9 Vid H 9 Aud H 10 Vid H 10 Aud H 11 Vid H 11 Aud H 12 Vid H 12 Aud H 13 Vid H 13 Aud H 15 Vid H 15 Aud H 16 Vid H 16 Aud H 17 Vid H 17 Aud H 18 Vid H 18 Aud H 19 Vid H 19 Aud H 20 Vid H 20 Aud H 21 Vid H 21 Aud H 22 Vid H 22 Aud H 23 Vid H 23 Aud H 24 Vid H 24 Aud H 25 Vid H 25 Aud H 26 Vid H 26 Aud H 27 Vid H 27 Aud H 28 Vid H 28 Aud H 29 Vid H 29 Aud H 30 Vid H 30 Aud H 31 Vid H 31 Aud 591 1875 H 34 Vid 595 6875 H 34 Aud 597 1875 H 35 Vid 601 6875 H 35 Aud 603 1875 H 36 Vid 607 6875 H 36 Aud 93 o 3 Un Un
46. 78 Suspicious Signals REI OSC 5000 79 Section 4 Sweep Conduction The only way to recognize a spread spectrum transmitter with the OSCOR is to use the Sweep Mode and scan the entire frequency spectrum examining various frequency spans Look for a long low elevation rather than a brief steep spike If a spread spectrum signal is suspected it might not be an eavesdropping device Many satellite systems and secure communication systems use spread spectrum technology Frequency Hopping Another new type of elusive eavesdropping device 15 the frequency hopping device As the name implies frequency hopping bugs are designed to transmit on one frequency for a very short period of time 5 to 100 milliseconds and then change frequency to an apparently random new frequency These frequency hoppers will hop to several different frequency channels within a well defined bandwidth In the Automatic Mode the OSCOR will have a difficult time detecting frequency hopping bugs because the signal usually changes frequencies before the correlation analysis can confirm a threat However Peak Display Mode helps detect the frequency hopping threat see page 27 Peak Spectrum Display If a frequency hopping signal is found in the frequency spectrum it is very difficult to determine the physical location of the transmitter because the OSCOR receiver is unable to lock on the rapidly moving signal The following procedure is recommended To locate and d
47. DEO To select a video format NTSC PAL or SECAM press the F1 button To select a positive or negative synch pulse press the F2 button To turn off the monitor press the F4 button labeled OFF S ho Note The video monitor should be turned off when not in use to conserve battery power Always turn off the video monitors from the OSCOR keypad using the method described above not using the monitor switch on the monitor itself Summary of Video Detection A video transmitter is suspected under the following conditions 1 There is not an audio signal 4 5 MHz or 6 MHz above the video signal This applies to the video threat with no audio or a threat that does not conform to the normal TV audio video format 2 The received frequency does not correspond to local TV stations or is not in the normal video frequency band 3 The Video Optional Upgrade provides the video image and you recognize the environment Once a video transmitter is detected the OSCOR locator probe can be used to locate the video transmitter using the same method as an audio transmitter or by simply studying the picture REI OSC 5000 66 Section 2 Detecting Video Threats Using a Separate Video Monitor A separate video monitor may be connected to the OSCOR for the purpose of providing an improved video image display or for video recording This is accomplished using the video patch cord OVP 5000 The location of the OVP is described in sect
48. FF ACTIVE FIGURE 26 AUTOMATIC MODE OUTPUTS MENU Automatic Mode Audible Alert Using this option the OSCOR will provide an audible alert when a threat is detected in the Automatic Mode A signal is classified as a threat when its level exceeds the threat level threshold see page 63 Correlate Acoustic Correlator System Automatic To turn on the Automatic Mode audible alert 1 Enter the Automatic Mode Output Configuration Menu as described on page 60 2 Press the button labeled ALERT TONE VOL under the Automatic Mode Outputs Configuration Menu to toggle the audible alert between OFF LOW MED amp LOUD The red LED over the TONE button being illuminated indicates the activation of the audible alert The volume of the tone alert can also be set without entering the Automatic Mode Configuration Menu by using the procedure described on page 42 Tone Ringer System In the Automatic Mode the alert tone will ring for approximately 3 seconds for each single threat that exceeds the threat level threshold REI OSC 5000 61 Section 2 Detecting Video Threats Auto Plotting of Threat Signals Using this option the OSCOR provides printed information about each threat signal exceeding the specified threat level There are four options for plot styles to choose from when the feature is activated You may choose from these choices 1 line 2 line block and chart The signal listing methods of 1 line
49. GURE 6 ACCESSORIES AND CONNECTOR TRAY FIGURE 7 SWEEP MODE SCREEN ntn nas FIGURE 8 SWEEP MODE SCREEN DISPLAY WITH WIDE BANDWIDTH FIGURE 10 INPUT FREQUENCY DEMODULATOR AND BANDWIDTH osc 5000 5 FIGURE 9 SWEEP MODE SCREEN DISPLAY WITH NARROW BANDWIDTH FIGURE 11 ANALYZE MODE SCREEN 29 059 9 FIGURE 12 SCREEN LABELS FOR DEMODULATIONS ees FIGURE 13 EXAMPLE SIGNAL LIST SCREEN DISPLAY es FIGURE 14 SIGNAL LIST MENU 250 FIGURE 15 SWEEP SPAN LIST SCREEN DISPLAY ees FIGURE 16 CORRELATOR SCREEN DISPLAY ees FIGURE 17 THREAT LEVEL CLASSIFICATIONS ees FIGURE 18 LOCATING CAPABILITY DIRECTIONAL FIGURE 19 CURSOR LOCATION FOR OTL ette FIGURE 20 POSITIONS FOR RANGE MEASUREMENTS es FIGURE 21 AUTOMATIC MODE PROGRAMMING tees FIGURE 22 AUTOMATIC MODE MAIN MENU ceret FIGURE 23 PRE PROGRAMMED STANDARD INPUTS es FIGURE 24 AUTOMATIC MODE LOAD FRIENDLY MENU FIGURE 25 AUTOMATIC MODE START MENU ees FIGURE 26 AUTOMATIC MODE OUTPUTS MENU cte FIGURE 27 AUTOMATIC MODE CORRELATOR SETUP FIGURE 28 VIDEO SIGNAL WITH NEGATIVE SYNCH PULSE FIGURE 29 UNINTENTIONAL RADIA
50. ION 6 TESTING TELEPHONES WITH OSCOR The OSCOR s primary function was not to be a telephone analyzer see page 90 Telephone Analyzers However it does have some basic telephone analysis capabilities that are not present in most telephone analyzers Testing for Hot Phones or Hook Switch By Pass Bugs The Balanced Audio Coupler provides a balanced and isolated connection for testing telephone fax or data lines or unknown wiring or cables This coupler and patch cord are used with the OSCOR s built in audio amplifier to extract line audio They can also be used for direct correlator reference as used in testing for telecom hot mikes hook switch bypass infinity bugs and electronic triggers Any suspicious wiring can also be tested for microphones by monitoring through the system s reference circuit and listening to the headphones To use the OSCOR to test for audio content on any pair of conductors 1 Connect the Balanced Audio Coupler BAC 5000 to the audio patch cord 2 Plug the other end of the audio patch cord into the EXT REF jack in the audio panel 3 Press the EXT button in the AUDIO panel 4 Press the button labeled MONITOR RECEIVER until the display label reads MONITOR REFERENCE 5 Connect the alligator clips on the Balanced Audio Coupler BAC 5000 to the desired pair of conductors Note For phone lines all combinations of the conductors should be tested REI provides a coupling device that provides acc
51. K LIMITS to scan to the next higher frequency signal while operating in the Analyze mode Direct Frequency Entry Rather than using the Rotary Dial with the EXPAND NARROW and UP DOWN buttons a frequency can be entered directly from the keypad If the OSCOR is receiving RF the OSCOR will immediately jump to the required input antenna and appropriate frequency window to view the desired frequency REI OSC 5000 24 Section 2 Detecting Video Threats To enter a frequency directly using the keypad megahertz 1 Type the desired frequency press ENTER In kilohertz 1 in the desired frequency 2 Press the k MHz button to change the units mode to kilohertz then press ENTER Receiver Attenuator Since the OSCOR is a highly sensitive receiver it is possible for very strong signals to have an overloading effect on the Antenna Pre amplifiers Receiver overload is evidenced by strong signals such as FM broadcast radio stations appearing at harmonic frequencies The transmitter is not actually radiating these harmonic signals they are being generated in the receiver as a result of an overloaded RF circuit However most harmonic signals especially those from bugging devices are a result of an impure transmitter oscillator To determine the cause of the harmonic signal see page 79 Transmitter Harmonics the built in attenuator should be turned on to reduce or eliminate in most cases the RF overload The RF
52. NG UP THE SYSTEM sc EE EEEa vis iU E lad M D Ese E EEE EEA 18 OSCOR MANUAL MODE OPERATION 452 d Ao Ry Ra a EUR ERR 20 Sweep Mode Spectrum Analyzer Fd ee I REO e br rr ee ad hv 20 Alternate RF Spectrum Display Modes ri tds 25 EE 28 Data Functions GTOREAREGAEL 34 TNNT 39 Oscilloscope Analysis Audio Spectrum Analysis Screen sss 43 Acoustic Correlator System RP Fed ERE 43 Locating the V 45 Sip Chart Plotter aont edd eie Etude bn M RDUM a 21 Miscellaneous 0 00000000 54 OSCOR 222 26 Roa 55 SIENAI REVIEW abe ea eater tendo 57 Setup EIAS RNC 57 Load Friendly ENAN E 59 Start Auto 60 OTT CITROEN 60 Correlate Acoustic Correlator System Automatic esee 63 VIDEO THREATS sistent cutie ud E Ea don da
53. OR is fundamentally spectrum analyzer designed specifically for countersurveillance Spectrum analyzers were historically developed for the testing design and development of electronic products The best spectrum analyzers are very expensive heavy and bulky yet have a high degree of sensitivity and accuracy A top of the line digitally controlled spectrum analyzer from Hewlett Packard or Tektronics may have a sensitivity of 118dBm 15 kHz bandwidth and may cost as much as 50 000 to 100 000 The OSCOR has a sensitivity of 113dBm 15 kHz bandwidth Countersurveillance sweeps do not typically require a spectrum analyzer of this quality If the signal is so low that an OSCOR cannot detect it then it is practically impossible for most surveillance receivers to pick up the signal There are less expensive spectrum analyzers on the market for as low as 2 000 Spectrum analyzers in this class are typically free running analog in nature and require a great deal of manual control while tuning and listening to individual signals due to a drift problem Most spectrum analyzers do not come with built in demodulators audio amplifiers to analyze signals or antennas Also most spectrum analyzers do not have the ability to monitor an environment in an Automatic Mode store and recall signals or create prints from a built in plotter Harmonic Receivers A harmonic receiver is similar to a spectrum analyzer in that it sweeps over a frequenc
54. PUT RECORDER SPEAKER EXPANSION DELUXE FOAM LINCLUDED WITH THE PURCHASE OF MOST OPTIONS FIGURE 6 ACCESSORIES AND CONNECTOR TRAY SERIAL COMMUNICATION Low Leakage Headphones The headphones have been designed to limit the audible emissions when worn properly and used at moderate volume levels When using the headphones make sure both earpieces are close against your ears since it is possible for a highly sensitive audio surveillance device to hear the headphones a feedback is possible Audio Patch Cord 4 ft 1 22 M REI OSC 5000 14 Section 2 Detecting Video Threats The Audio Patch Cord with 3 5 mm male to male connectors is used with the Balanced Audio Coupler Mini Microphone Direct Tape or CD inputs to the EXT REF input Miniplug Extension Cable 12 ft 3 66 M The Miniplug Extension with 3 5 mm male to female connectors is used as a headphone extension when monitoring a detected device s audio It also allows the Loop Antenna to be used apart from the Antenna Array panel Placed remotely in an area such as an individual s chair couch or nearby table it can screen for tape recorders or video cameras and can be used with the mini microphone RF Extension 12 ft 3 66 M The RF extension with male to male BNC connectors used with the headphone extension allows connection of the Locator Probe for pinpointing the location of a detected surveillance device Locator Probe The Locator
55. Probe allows the OSCOR to find signals identified as surveillance devices The probe provides a localized signal strength input that the OSCOR converts to a variable frequency tone a higher tone implies closer proximity The telescoping antenna and the squelch control adjustment provide additional flexibility for narrowing the search area See page 45 Locating the Threat VLF Adapter The adapter takes advantage of OSCOR s ability to detect carrier current devices on the AC line through its own supply By disconnecting the AC power and running OSCOR on its internal DC supply the AC power cord by way of the VLF adapter can be connected to any wire or cable that is suspected of containing carrier current transmissions Likely candidates for closer inspection include telephone fax and data lines MATV CATV intercom thermostat etc Note Make sure to check and select the correct voltage in the OSCOR connector tray Balanced Audio Coupler BAC 5000 The Balanced Audio Coupler provides a balanced and isolated connection for testing telephone fax data lines or unknown wiring or cables The coupler and patch cord can extract line audio or can be used for direct correlator reference as used in testing for telecom hot mikes hook switch bypass electronic triggers etc Any suspicious wiring can also be tested for microphones by monitoring it through the system s reference circuit and listening to the headphones See page 83 Test
56. Rotary Dial or the UP DOWN buttons to select various signals in the database Editing Signals REI OSC 5000 35 Section 2 Detecting Video Threats The Signal Listing Mode has two menus to control signal database functions The first menu provides the basic functions to act on individual signals see figure13 The second menu lists functions that affect the entire list LIST ALL ALERT AT PLOT AS DELETE EDIT SIGNALS LEVEL 3 LINE SIGNALS MENU FIGURE 14 SIGNAL LIST MENU 2 9 To change the threat level of a signal stored in the database 1 Usethe RECALL button in the Analyze Mode to access the signal list 2 Select the desired signal using the Rotary Dial or the UP DOWN buttons 3 Select the appropriate menu using the MENU button see Figure 13 4 Select the desired threat level using the FI and F2 buttons and F2 toggle up and down through the available threat levels FRND 1 2 3 4 5 DECLARE Press to immediately change the level to a FRIENDLY signal To delete a signal stored in the database Use the RECALL button in the Analyze Mode to access the signal list 2 Select the desired signal using the Rotary Dial or the UP DOWN buttons 3 Press the F4 button labeled DELETE SIGNAL 4 Press the FI button labeled DELETE CONFIRM to delete a single signal Press MENU labeled CANCEL to cancel the deletion process D Filtering the Signal List The signal database can be filtered to v
57. TOR PROBABILITY FIGURE 30 THREAT PRODUCT EVALUATION SUMMARY c FIGURE 31 REGIONAL FREQUENCY ALLOCATION MAP ces FIGURE 32 SHIFT FUNCTION tete tentent Section 1 Equipment Description SECTION 1 INTRODUCTION FIGURE 1 OSCOR 5000 DELUXE PACKAGE This manual provides an overview and background information of the utility and diverse operations of the OSCOR 5000 and step by step instructions on how to perform the various functions It is arranged so that as you read through the sections you will learn to perform the individual functions of which the OSCOR is capable Then you will learn how to use the functions together to search for transmitting devices In order to become familiar with all of the available functions and programs of the OSCOR this manual should be read and studied thoroughly The fastest way to become familiar with the OSCOR is to follow the step by step instructions while reading the manual The sections are organized in a manner designed to aid learning Do not attempt to memorize all of the step by step procedures These are provided as a guide to assist you in learning to control the available OSCOR functions Once you have a good understanding of the functionality you can develop procedures to customize the OSCOR operation to your specific needs and security issues Notes e Due to the related nature of many functions you will find some d
58. TY 2 In the Security Set up Menu press the F4 button labeled CHANGE ACCESS PASSWORD 3 Enter the desired password and press ENTER Note The Security Set up Menu allows you to F1 Lock Unlock Automatic operation F2 Lock Unlock access to the signal database F3 Lock Unlock COM Port Reset Button A Reset button is built into the OSCOR connector tray This Reset button is a small white button on the right side of the connector tray By disconnecting the OSCOR from AC power and pressing this button for 10 seconds the OSCOR firmware will be completely reset to all factory defaults and all memory will be erased This button is used if the unit has locked up or is not functioning normally due to an unforeseen programming condition REI OSC 5000 19 Section 2 Detecting Video Threats OSCOR Manual Mode Operation The OSCOR can detect eavesdropping devices in many different ways This section provides an overview of OSCOR functions and explains how to control these functions manually Most of the functions in this section can also be automatically controlled so that the OSCOR can operate in a stand alone configuration see page 55 OSCOR Automatic Mode Operation Sweep Mode Spectrum Analyzer Functions The OSCOR receiver surpasses other test equipment by combining fast and accurate frequency acquisition with high sensitivity Most spectrum analyzers of similar cost are analog resulting in inaccurate frequency readouts due to
59. Tape Recorder 17 Auto Fine Tune 32 Automatic Mode 55 76 1 Signal Review 57 2 Setup Inputs 57 3 Load Friendly 59 4 START AUTO 60 Manual Squelch 58 Auto Plotting 62 Auto Record 62 Bandwidths 21 body bug 69 83 Broadband Energy Detectors 90 Burst Bugs 27 Carrier Current 10 75 Cigarette Lighter Adaptor 17 CLA 700 Cigarette Lighter Adaptor 17 Computer Interface 16 17 Conducting a sweep 71 Connector Tray 13 5000 Index Correlate Plots 52 Correlator Automatic 63 Manual 43 Correlator Mode Active 65 LD FRND 72 Passive 64 Verify 64 Cursor 32 Data Functions 34 Database 34 Database Listing 52 Date 19 DC Power 12 Deep Dig 58 Demodulation 29 Difference Spectrum Display 28 Direct Frequency Input 25 Discone 10 Display Freeze 54 Display Mode 63 Double Demodulation 31 DOWN 24 E Expansion Port 13 EXT Button 40 EXT REF 40 Extension Cable 17 F False Alarms 81 Fastskim 58 Filter Audio 41 FM 31 Freeze Screen 54 Frequency Display 23 Hopping 80 Ranges 23 57 Frequency Allocations FCC database 96 Frequency Analysis 33 Frequency Data Region 1 97 Region 2 99 Region 3 101 Regional Map 96 Frequency Expansion see MDC 2100 16 Frequency Hopping 27 Frequency Span Storage 37 Friendly 72 Friendly RF Spectrum 26 Harmonic Frequency Analysis 33 Harmonic Receivers 89 Harmonics 79 Headphones 15 42
60. abeled CONFIG 2 Press the F3 button labeled FREEZE 3 To un freeze press any key Tape Recorder Controls Pressing the TAPE button activates and deactivates the tape recorder Recordings provide evidence of OSCOR s received audio and can be useful in documenting evidence of surveillance devices The record outputs have two plugs one plug provides audio to the recorder s microphone input and the second provides a contact closure to remotely start the recorder s motor The OSCOR can also be configured for remote recording in Automatic Mode see page 62 Auto Tape Recording of Threat Signals Note REI provides a recommended optional tape recorder for recording of received audio signals There are many tape recorders that will work equally well for this option However the tape recorder offered by REI does not contain a bias oscillator Therefore it does not interfere with normal OSCOR operation in the tape recorder detection mode It also contains a remote jack for external control If you use a tape recorder not supplied by REI the recorder must have a remote jack for on off motor control Normally a smaller 2 5mm sub mini phone jack is used REI OSC 5000 54 Section 2 Detecting Video Threats To connect a recorder to OSCOR s outputs 1 Plug a 3 5mm miniature phone plug patch cord into the RECORD output jack and the MICROPHONE input of the tape recorder 2 For remote start stop operation connect a 2 5mm patch cord
61. ain panel Note Use care when removing or installing the program key Be sure to touch the unit s front panel to prevent electrostatic discharge to the key or socket After key removal press the OFF button and then follow screen prompts when using AUTO or MANUAL operation All stored information and settings are deleted when the program key is replaced Note To ensure desired information is retained leave the program key inserted in the OSCOR after the power is off Also in case of program error the key may be used as a system reset Remove the key and re insert then follow screen prompts for setup REI OSC 5000 12 Section 2 Detecting Video Threats Connector Tray Input Output Jacks The I O jacks provided in the connector tray offer a wide degree of flexibility for future options CONTROL RF CABLES connect the main unit and the ANTENNA ARRAY The easily removed BNC connectors provide easy input of specialized RF probes or cables VLF MF provides input for 10 kHz to 5 MHz HF UHF provides input for 5 MHz to 3 GHz VIDEO OUTPUT Optional provides a video output for viewing video signals See page 65 Detecting Video Threats SERIAL COMMUNICATIONS RS 232 I O PORT connects with IBM or equivalent PC computer for control or database storage Can also be used with MODEM TELECOM remote operation EXPANSION PORT interfaces with OTL option and the MDC Microwave downconverter options RECORDER OUTPUT allows the use of mic
62. arry it around the perimeter of the building while scanning for IR threats On sunny days the OSCOR IR probe should be shaded from direct sunlight or bright reflections to prevent overload from the Sun direct sunlight will not damage the IR detector OSCOR Triangulate and Locate Option The OSCOR Triangulate and Locate Option OTL 5000 is designed to locate a microphone associated with an eavesdropping device While the OSCOR locator probe see page 46 Locating RF Threats 500KHz to 21GHz is designed to locate the transmitter antenna the OTL 5000 option uses sonic ranging to locate the microphone The OTL 5000 program is built into the OSCOR 2 0 software as well as all upcoming versions The OTL 5000 hardware includes a piezo clicking device and a parabolic acoustic reflector that plugs into the OSCOR expansion port When the OTL 5000 hardware is plugged into the OSCOR the software recognizes the connection and provides access to the Triangulate and Locate software routines The OTL 5000 device uses the speed of sound to calculate the range from the eavesdropping microphone to three independent OTL 5000 positions The location of the eavesdropping REI OSC 5000 48 Section 2 Detecting Video Threats microphone can be determined using basic triangulation equations and these measurements in a manner similar to the U S Global Positioning system Note The OSCOR is not covert in this mode since the OTL 5000 emits a clicking sound to
63. as analyzed This option is only available if the Friendly signals have been previously started Press the button labeled CAPTURE SPANS to capture the Friendly frequency spectrum data only This action will not store any signals in the database however it will store a friendly frequency spectrum in memory This function is very useful when comparing the frequency spectrum of adjacent rooms or when comparing the frequency spectrum of the outside of a building with the inside of a building see section 26 Friendly Spectrum Display REI OSC 5000 59 Section 2 Detecting Video Threats Press the F4 button to delete all the Friendly signal database and Friendly frequency spectrum data WARNING The load friendly process should never be executed in the target sweep environment to prevent accidentally loading a bugging signal as a friendly signal Start Auto Mode Pressing the F4 button in the Automatic mode main menu screen brings up a menu to program the automatic mode outputs and correlation process as well as to start the automatic scanning CORRELATOR ALERT PLOT FRIENDLY LOADED PASSIVE OFF OFF 2 04 09 41 CONFIG CONFIG RUN OUTPUT CORR START RESUME MENU FIGURE 25 AUTOMATIC MODE START MENU In this mode the OSCOR will evaluate every detected non friendly signal for correlation This mode is used in the target sweep environment specifically to look for bug
64. ats Demodulators 2 Move to another location in the room and try again The position for each range measurement is referenced to the expansion port connection The range measurements should be made in the same plane To do this 1 Hold the clicking device with the parabolic reflective surface facing away from the user 2 Take the range measurements as described here Left position stretch the OTL 5000 device directly left over the AC power connector until the cable is parallel to the OSCOR main panel Right position stretch the OTL 5000 device directly right over the OSC 5000 printer paper until the cable is parallel to the OSCOR main panel Center position stretch the OTL 5000 device directly vertical until the cable is perpendicular to the OSCOR main panel Center Position Left Position Right Position FIGURE 20 POSITIONS FOR RANGE MEASUREMENTS Strip Chart Plotter The strip chart plotter can record the standards the procedures and setup information for a given sweep Technicians can make notes on the printouts before entering them into a logbook In this manner a sweep history of a location is available to provide faster preparation and data collection during follow up sweeps Note Video monitors are automatically shut off when the printer is being used Sweep Plots Frequency Spectrum Plots Setting a wide frequency span in the Sweep Mode provides a complete illustration of the spectrum of
65. bout the ORION non linear junction detector REI OSC 5000 92 Section 8 Other Equipment Acoustic Noise Generating Systems The basic goal with noise masking is to fill the environment with audio noise to interfere with eavesdropping microphones The problem is that in order to communicate in a noise filled environment the occupants must raise their voices over the noise This often defeats the purpose of having the noise masking system However noise masking systems are effective 1f they mask the environment external to the immediate conversation For example if you are having a conversation with people in close proximity it is feasible to place a noise generator on the desk to defeat any bugging device or tape recorder that may be in the desk Similarly if you have several noise generators it is feasible to sit in a tight circle and place the noise generators outside the circle so that the noise generators are placed between the conversation and any potential bug locations These noise generators may be placed above ceiling tiles in walls on windows to defeat LASER threats in heating and cooling vents or in any location in which acoustic leakage exists REI manufactures two noise masking products One product ANG 2000 Acoustic Noise Generator is a perimeter noise masking system designed to provide perimeter protection from acoustic leakage This system is purchased with transducers or omni directional speakers The transd
66. can be readily seen from Figures 7 and 8 on page 21 in the section on Receiver Bandwidths Therefore the OSCOR has a special function designed specifically for identifying the presence of these types of snuggled transmitters This function which is accessed through the Analyze mode takes the OSCOR into its narrowest operational bandwidth and then begins the frequency display integration function This process insures that the modulation effect of the signal will be integrated out of the spectrum display so that snuggled transmitters can easily be seen in the spectrum To access the Snuggle Bug Analysis 1 Ensure that the OSCOR is in the Analyze mode and that the desired signal is locked 2 Press the MENU button labeled CONFIG 3 Press the F3 button labeled SNUGGLE START This will change the Analyze display to a narrow band 6 kHz and integrate the frequency spectrum If a snuggle bug exist an additional signal will appear in the spectrum To turn off the snuggle analysis and return to the original Analyze mode bandwidth parameters Press the MENU button labeled CONFIG Harmonic Frequency Analysis The Analyze Mode has a feature that provides the capability to quickly tune to harmonic frequencies or sub harmonic frequencies of a signal being analyzed This is a very useful feature when analyzing a signal from a potential bugging device because most RF bugging devices have transmitters that produce many harmonics The Frequenc
67. ce Research N N 2170 Fixed Mobile Fixed Mobile Mobile Satellite 2290 Space Research N a ojojo N 1260 Radio location Radio nav Sat 1300 N N 1350 Aero Radio navigation 35 690 0 00 N 142 1 52 1 53 1 54 t2 E oo N N 1427 Earth Exploration Satellite 142 1429 Space Oper Fixed Mob N N 21 OSC 5000 96 Section 8 Other Equipment Region 2 Data Start Stop MHz MHz Classification 0 505 0 51 Maritime Mobile 0 525 Mobile Aero Radio navigation l 0 535 1 70 1 85 Fixed Mob Radio loc amp nav Aero 8 Amateur Fixed Mob 2 Fixed Mobile 2 2 8 0 Maritime Mobile 2 107 2 17 Fixed Mobile N 2 1735 1905 Mobile distress and calling 2 1905 194 Maritime Mobile 2 Fixed Mobile 2 5 Fixed Mobile Broadcasting E 2 505 2 85 Fixed Mobile 3 155 Aeronautical Mobile 3 155 Fixed Mobile exc aero Mobile 3 34 Aeronautical Mobile 3 75 3 335 3 75 173 Maritime Mobile 2 495 505 Standard Frequency Time Signal 4 65 4 75 4 85 4 995 4 995 5 005 Standard Frequency Time Signal 5 06 Fixed Broadcasting 5 45 5 73 Fixed Mobile exc aero Mobile Aeronautical Mobile 3 9 2 5 2 5 95 6 525 Maritime Mobile 6 525 6 765 Fixed Land Mobile 4 4 7 7 2277 1271 8 1 195
68. check the most common video frequencies 900 930 MHz 2 4GHz 5 7GHz Activate a known sound source see page 73 Activating a Known Sound Source Manually check RF loop input Manually check infrared input see page 74 Special Considerations for Infrared and Laser Threats Manually check discone input for signals between 1 5GHz and 3 0GHz Manually check for signals above 3GHz using the MDC 2100 if you have this option Manually check electrical outlets using power cord AC VLF for carrier current see page 75 Checking For Carrier Current Threats Compare the stored Friendly frequency spectrum with the realtime frequency spectrum In this manner it may be possible to quickly identify any unique RF signals Set up the OSCOR in the Automatic Mode to search the WhipLo and WhipHi Frequency inputs Check desired settings and activate Auto Mode Perform a physical search while the OSCOR runs in Automatic Mode Review all signals detected in automatic sweep Designate all known friendly signals as FRIENDLY Any unidentifiable signals should be checked for sub carrier and video content Review all Friendly signals for the presence of Snuggly bugs Note If you have the OSCOR PC Interface software the signal database should be permanently stored on computer disk for future comparison Then every signal should be labeled as either a DECLARE meaning declared threat or a FRIENDLY Use the triangulate and locate option or the locator probe t
69. ction 2 Detecting Video Threats The following table presents the combinations of F1 Inputs Frequencies F2 Bandwidth and F3 Demodulators available FM FM SC AM SSB _ S we Tape Loop 32 5 kHz 45 kHz 6 6 6 Infrared 10 kHz 5 MHz 250 15 6 250 15 6 250 15 6 AC VLF 10 kHz 5 MHz 250 15 6 250 15 6 250 15 6 RF Loop 10 kHz 510 kHz 250 15 6 250 15 6 250 15 6 Whip Low 500kHz 5 5 MHz 250 15 6 250 15 6 250 15 6 Whip High 5 MHz 1 5 GHz 250 15 6 250 15 6 250 15 6 Discone 1 5 GHz 3 GHz 250 15 6 250 15 6 250 15 6 Microwave 3 GHz 21 GHz 250 15 6 250 15 6 250 15 6 Downconverter FIGURE 10 INPUT FREQUENCY DEMODULATOR AND BANDWIDTH COMBINATIONS Bold indicates default IF bandwidths and demodulators used in Automatic Mode These IF bandwidths are designed for the majority of signals within the specified frequency range not available in Automatic Mode the frequency range refers to the modulated frequencies that are scanned The infrared sensor is designed to support wavelengths 850 1070 nM Adjusting the Frequency Display The frequency controls are similar in design to most high quality spectrum and network analyzers They were designed for speed and ease of use In both the Sweep Mode and the Analyze Mode the Frequency Display indicates both start and stop frequencies as well as the frequency span sweep frequency and cursor frequency The frequency parameters are indicated using arrows on the screen The
70. curity personnel and are meant to serve as both effective deterrents and effective sweeps When the OSCOR is not being used in a dedicated sweep it can be placed in an inconspicuous location and allowed to run continuously in the Automatic Mode Each week the OSCOR memory should be reviewed and cleared after each stored signal is manually reviewed Planning for a Sweep It is important to remember that if your environment is being monitored your eavesdropper may be aware of your suspicions Sweep teams rarely find bugging devices but they often find evidence that bugging devices have been present If an eavesdropper is aware of an upcoming sweep the sweep team will probably not find any bugs but the eavesdropping may continue Sweeps can fail for many different reasons e The eavesdropper finds out about the scheduled sweep e The sweep is discussed over a bugged phone e The sweep is posted on a company calendar e The eavesdropper observes the sweep team arrival The sweep is performed after hours but the eavesdropping equipment is activated only during business hours The sweep equipment is the wrong equipment or is not used properly There are many bug detectors on the market that are merely toys with lights and knobs and not all expensive equipment will necessarily meet your specific needs The sweep team is careless or poorly trained e sweep is conducted prior to a meeting but someone wears a body bug or tape record
71. d NARROW covers 32 5 45 kHz for tape recorder detection 4 INFRARED DETECTOR when extended the IR DETECTOR will observe a 360 view and detect IR energy with a wavelength of 850 1050 nM and modulation of 15 kHz to 5 MHz STATUS INDICATORS shows the antenna currently selected 6 AC VLF not shown in picture AC power cord also called AC VLF probe tests the AC power supply for carrier transmitters The AC VLF probe can test any pair of conductors for carrier current provided the voltage level is less than 250 volts 7 MICROWAVE DOWNCONVERER Provides observation of frequencies from 3 GHz to 21 GHz CA WARNING The ACTIVE WHIP ANTENNA and DISCONE contain circuitry that can be damaged by electrostatic discharge If electrostatic conditions exist be sure to touch the OSCOR main chassis before touching the WHIP or DISCONE WARNING The AC VLF probe is designed to handle voltage levels up to 250 volts Do not exceed this limit or the unit may be damaged If this limit is exceeded and your unit is damaged return it to REI or your dealer for repair An internal breaker must be replaced osc 5000 10 Section 2 Detecting Video Threats Power System Power is obtained in one of three ways 1 AC mains power of 115 230 2 Internal Rechargeable 12 VDC Battery 3 External 12 18 VDC input Note Whenever possible it is best to use AC power to keep the battery charged and to allow the AC VLF to scan for carri
72. d SETUP INPUTS To load a friendly database Press the F3 button labeled LOAD FRNDLY To start the automatic mode and search for bugging devices Press the F4 button labeled START AUTO REI OSC 5000 56 Section 2 Detecting Video Threats To return to the Automatic mode programming screen after reviewing either the signal list or the input list press the AUTO MANUAL button To stop the automatic operation press the AUTO MANUAL button Signal Review Pressing the F1 button labeled REVIEW SIGNALS is the same as pressing the RECALL button when in the Analyze mode This allows the user to quickly review the signal database before starting any automatic mode programming To return to the Automatic Mode programming screen press the AUTO MANUAL button Setup Inputs Pressing the F2 button is the same as pressing the RECALL button when in the Sweep mode This allows the user to edit and quickly review the available inputs for automatic searching To return to the Automatic mode programming screen press the AUTO MANUAL button Editing or Creating a Frequency Span for Automatic Operation Unless otherwise specified the frequency range scanned for each input is the default span noted in Figure 16 However alternative frequency spans can be scanned in the same input band This allows the user to program multiple frequency windows within the same input device The OSCOR has 6 pre programmed input frequency spans that incl
73. d Thrt Pk indicates the threat level of the stored signal These values may be labeled with numeric values of 1 to 5 FRIENDLY for friendly signals or DECLARE to indicate that the user has declared the signal as a threat The number to the left of the colon indicates the average threat level the number to the right of the colon indicates the peak threat level e The last column on the list labeled indicates the number of times the signal was detected in the Automatic Mode This number is useful for determining if a signal has only intermittent transmission Note Having friendly signals stored in memory is very advantageous when conducting sweeps requiring fast results see page 72 Pre Loading Signals into Memory For example when using the OSCOR to monitor a meeting in progress see page 82 MONITORING A MEETING IN PROGRESS it is imperative that the Automatic Mode sweep through the frequency spectrum as quickly as possible To manually store a signal 1 In the Analyze Mode select the signal with the cursor and adjust the tuning to lock onto the desired signal 2 Press the STORE button to store the signal into memory Adjust the desired threat level using the and F2 buttons 4 Press F4 labeled LIST in this menu to bring up the signal list same as pressing RECALL m To recall stored signals 1 Press the RECALL button to toggle between the normal Analyze Mode and the Signal List Mode 2 Use the
74. d be investigated Generating a Signal Chart of the Area REI OSC 5000 72 Section 4 Sweep Conduction Before entering the target building print a plot of the ambient RF environment outside the building During the sweep these plots can be compared to plots of signals detected inside the building A known signal such as a radio station or TV station can be labeled directly on the chart for reference Once inside the building similar plots can be made in each area of interest These plots can be overlaid and held up to a light source for a quick visual inspection of the signals within the building Note Most bugging devices are RF devices ranging from 5 MHz to 3 GHz Comparing the Strip Chart plots provides several benefits 1 A quick overview of the environment 2 Immediate indications of anything out of the ordinary 3 A plot that can be kept in a logbook and used for later comparisons However there are many RF signals that transmit intermittently such as pagers cellular phones police band radios and aircraft radios This method is not reliable for detecting these kinds of signals To generate a wide sweep frequency plot of the environment 1 Set up the sweep for the frequencies of interest see page 57 Editing or Creating a Frequency Span for Automatic Operation 2 Press the PLOT button to bring up the Plot Menu see page 51 Strip Chart Plotter 3 Select the width of the strip chart for maximum plot length press t
75. des extension for the Locator Probe REI OSC 5000 16 Section 2 Detecting Video Threats Miniature Microphone MIC 5000 This may be used with the standard OSCOR cables to provide a remote microphone input OSCOR Multiple Purpose Cable MPC 5000 A 12 ft cable with 3 5mm male and 3 5mm female connectors that extend the Loop Antenna range or connect the OSCOR Balanced Audio Coupler and MIC 5000 Modular Phone Adapter MPA 700 The MPA provides easy access to telephone conductors for testing The universal connector works for 2 4 6 amp 8 conductor telephone systems See page 83 Testing Telephones with OSCOR Cigarette Lighter Adapter CLA 700 The Cigarette Light Adapter provides DC input to power the OSCOR from an automobile cigarette lighter OSCOR Intermediate Frequency Output OIF 5000 The Intermediate Frequency Output provides an IF output of 10 7 MHz for detailed signal analysis OSCOR must be sent to REI for installation REI OSC 5000 17 Section 2 Detecting Video Threats SECTION 2 USING THE OSCOR The OSCOR is designed to operate either manually or in a stand alone automatic configuration constantly monitoring the environment for the evidence of eavesdropping devices REI wanted to create a product that provides portable cost effective Countersurveillance equipment capable of operating independently with minimum preparation required While this section describes how to set up the OSCOR and perf
76. dphones Note To prevent accidental audio output while operating in the Automatic Mode the speaker is automatically turned off unless it is being used to provide a sound source The headphones are operational in the Automatic Mode REI OSC 5000 41 Section 2 Detecting Video Threats Headphones The headphones automatically transfer the speaker output to the headphones The headphones used with the OSC 5000 have been custom designed for low acoustic leakage and high quality Note Do not operate the headphone volume higher than necessary It is possible for a highly sensitive audio surveillance device to hear your headphones a feedback is possible Squelch Signal Threshold The squelch control will move the position of the squelch baseline on the display and the trip point of the squelch circuit In the Sweep and Analyze Modes the squelch level is indicated on the screen by a horizontal dotted line This squelch line has several applications Sets the signal threshold when using seek to next signal function in the Analyze Mode In the Analyze Mode only signals above the squelch threshold will be demodulated to produce audio output Sets the signal threshold when using the locator probe In this mode the OSCOR generates an audible tone where the pitch corresponds to the strength above the squelch threshold of the signal This is used to find an RF transmitter or an IR threat when using the parabolic audio reflector that is pa
77. e automatic mode programming menus It is highly recommended that this map be referenced when studying this portion of the manual Provided below is a small version of this guide REI OSC 5000 55 Section 2 Detecting Video Threats Automatic Mode Set up Menus RESEARCH ELECTRONICS INTL CORRELATOR ALERT FRIENDLY LOADED PASSIVE OFF 2 04 09 41 REVIEW SETUP LOAD START MANUAL SIGNAL INPUTS FRNDLY AUTO RESUME ALL STORED SIGNALS TIME DATE THRT PK FM 66 0345MHZ 08 38 7 15 FRIENDLY Load Friendly Programming Menu FMW 90 8950MHz 08 41 7 15 FRIENDLY FMW 93 6950MHz 08 41 7 15 FRIENDLY FMW 117 6050MHz 08 41 7 15 FRIENDLY FMW 1692650 2 1041745 44 LOAD FRIENDLY CAPTURE ALL DATA START RESUME SPANS DELETE us MODIFY THREAT LEVEL DELETE 0 RAISELOWER 2 FRIENDLY SIGNAL Resumes previous Load friendly attempt Friendly RF Spectrum Capture for Display Comparison Select with Rotary Dial Down amp Keys SCAN INPUT MD FREQUENCY RANGE OFF RF LOOP 10 0KHz 510 0KHz MED RF WhipL 500 0KHz 5 500 2 MED RF WhipH 5 000MHz 1505 00MHz 1 CONFIG 2 CONFIG 3 RUN AUTOMODE OFF RF DISC 1505 00MHz 3005 00MHz OUTPUT CORR START RESUME OFF __ INFRARED 10 0KHz 5 010MHz AC VLE 10 0KHz 5 010MHz Automatic Mode Programming menu
78. e F1 button to select the sweep span status 4 Press the F3 button to select whether or not to sweep the span with or without the attenuator Note it is recommended that the Attenuator is not used because it automatically decreases the detection sensitivity of the received signals To manually set the squelch level for automatic operation 1 In the Sweep Span List Display select the desired input using the UP DOWN buttons or the Rotary Dial Press until the Input label indicates ManSqlch or Man Press the RECALL button to display the frequency spectrum Use the squelch knob to set the dotted line at the desired squelch level Press F2 labeled Set Sqlc to set the squelch level A dashed line should appear at the desired squelch level 6 Press the F3 button to return to the Input list mode Mm SS To delete or reset the sweep span Inputs 1 In the sweep span list display Press F4 labeled RESET DELETE 2 In the Reset Delete Menu REI OSC 5000 58 Section 2 Detecting Video Threats Resets a single span to the factory default F2 Resets all spans to factory defaults F3 Erases all manually stored spans but retains default inputs F4 Sets all spans to Span Off Note Sweep time 15 largely dependent on the number of signals in the ambient environment and the settings on the Correlate Mode see page 63 Correlate Acoustic Correlator System Automatic The Deep Dig Mode is the most reliable me
79. e user installable and simple to replace GRAPHIC LCD DISPLAY displays 128 x 256 pixel contrast controllable images that are easy to read in direct sunlight STORE RECALL stores threat signals friendly signals and sweep spans or direct tuning in the memory and is user controllable ALARM CONTROL TONE selects silent or ringer alert and TAPE controls the power of the tape recorder for threat activated alarm PLOTTER CONTROL PLOT prints displayed information or Threat Level Listings FEED advances printer paper AUDIO MONITOR FILTER selects voiceband filter 300 3000 Hz to reduce monitored noise EXT external sound source allows listening to or correlating through the system input through patch cords or add on modules AUDIO ANALYSIS CORR activates acoustic correlator for audio pattern matching SPECT displays real time audio wave shapes for analysis ROTARY DIAL OPTICAL ENCODER allows precise frequency selection EXPAND NARROW expands or narrows displayed frequency span SWEEP ANALYZE allows instant jump between receiver swept spectrum profiles and demodulated signal analysis SEEK LIMITS seeks to next signal LIMITS reserved for future use DOWN UP changes screen to a higher or lower frequency span or tunes subcarrier osc 5000 8 14 15 16 17 18 19 20 21 22 23 24 Section 1 Equipment Description REFERENCE MICROPHONE receives acoustic stimulus
80. eats Battery Battery operation will typically last for 2 5 hours depending on internal loading A Low Battery warning will appear on the display when the battery power level is at approximately 1096 If the unit continues to operate after the Low Battery warning appears the unit will automatically shut off before the battery is fully discharged to prevent RAM memory loss Note For optimum data retention and maximum battery life do not store in a discharged Low Battery condition Charge as soon as possible Battery charging is automatic Whenever the AC power cord is plugged in and the unit has been turned on the unit will select FULL CHARGE and then FLOAT when charging is completed Charging time is highly dependent upon operating load and depth of discharge Typical charging time is approximately 4 6 hours Charging a completely drained battery may require a 12 16 hour overnight charge External DC Power When connected to an external 12 18 VDC source unit operation will be normal but the battery will only partially charge External 12 18 VDC is best used for field operations when extended operation is required and no AC power is available Contact REI or your dealer for a 12 VDC cigarette lighter plug or DC power cord Program Key The user installable PLUG IN PROGRAM KEY contains operating software and allows easy program updates or new software installation This program key is located on the far left of the m
81. eillance devices The root of successful countersurveillance is the physical search Necessary tools typically include e Screwdrivers complete set of Phillips and flathead e Digital multi meter with a 40MegOhm or higher range Pocketknife REI OSC 5000 76 Section 4 Sweep Conduction e Pliers e Wire strippers e Wire cutters e Ultraviolet pen and light note 1 e Small flex head flashlight e Flashlight e Inspection mirrors dental mirror e 8 piano wire probe note 2 e Small hand held metal detector note 3 e Wire tracer note 4 e Extra extension cords cables Lightweight ladder e Jump suit for working in dirty areas e Contact microphone and amplifier to test for acoustic leakage recommend REI EAR 200 or ALP 700 e Camera or video camera to record evidence Note 1 An ultraviolet pen can be used to mark the screw positions for all electrical outlets computers and telephones During later inspections an ultraviolet light can be used to verify whether anyone has tampered with the electrical equipment Note 2 The 8 in piano wire probe is a long piece of very thin metal that may be inserted into furniture fabric to look for devices in cushions Note 3 A small hand held metal detector small enough to fit in a briefcase is used to search drapes hanging pictures furniture pads bookcases and other items of d cor Note 4 A wire tracer is a device with a transmitter connected to a pair of conductor
82. eiver that will receive video signals transmitted on a RF frequency This can be demonstrated by tuning the OSCOR to local TV stations in the United States the video signal 15 4 5 MHz 6 MHz for some formats below the audio signal High quality video transmitters typically contain an audio signal in the same format as a TV signal but the signal will be located outside normal TV band frequencies Since the OSCOR is designed to detect audio bugs in the Automatic Mode the OSCOR will detect a video audio signal by locking in on the audio portion However if a video transmitter exists that does not contain an audio transmitter the OSCOR will analyze the video signal for audio information Since there is no audio information to be correlated with the ambient environment the OSCOR will not automatically classify a video transmitter as a threat The operator can manually check the detected signal and view the transmitted video signals Note Covert detection of video transmitters is difficult because the spy can view the sweep team in action To conduct covert video transmitter detection the OSCOR should be placed in a room adjacent to the suspect environment This will allow the high sensitivity receiver to acquire the transmitter without being caught by it If you recognize the picture or even see yourself there is a video transmitter present REI OSC 5000 65 Section 2 Detecting Video Threats Identifying a Video Si
83. er into the meeting REI OSC 5000 69 Section 2 Detecting Video Threats Scheduling Do not discuss the sweep on any phone or within the building of the target environment As few people as necessary should be notified of an upcoming sweep When scheduling a professional sweep the contractor should be contacted using phones outside the target area It is very important to understand the qualifications capabilities and limitations of the contracted personnel Time of Sweep If possible the sweep should be conducted during business hours in conference rooms and corporate offices when bugs are more likely to be active For offices and rooms that are accessible to all employees it is recommended that the sweep be conducted in the evenings or on weekends A sweep should be performed as soon as possible after the sweep team has been contacted in order to minimize the possibility of personnel finding out about the planned sweep Environment Setup Since some devices may be controlled remotely conducting a fictitious yet plausible meeting can prompt the eavesdropper to activate all devices If the meeting is advertised as very important with outside executives attending the eavesdropper may even heighten the level of surveillance office equipment coffeepots computers lights copiers fax etc should be turned on to activate any potential bugs If the sweep will occur during normal working hours the sweep personnel should be dres
84. er current eavesdropping devices AC Power The internal AC power supply actively monitors the voltage level of the Mains Input The green LED labeled AC will show when there is sufficient power The LED will remain off if insufficient voltage and or internal overloads are detected To prepare the unit 1 Set the Voltage Selector switch to your particular Line Voltage of 115 or 230 VAC 50 or 60 Hz 2 Connect the power plug to an operational AC outlet and observe that the green AC LED is illuminated The AC power receptacle is a worldwide IEC 320 standard and will accept right angle style power cables for most countries If the appropriate cord or adapter is not readily available the cord provided can be fitted with another plug Observe the wiring conventions for the connector of your choice and follow the color assignments of the USA Canada power cord supplied with the OSC 5000 Although the use of earth ground is always preferable it is not essential that your power system provide that connection Contact REI or your dealer with your particular power requirements Color coding of conductors black line white neutral green ground FIGURE 4 CONNECTOR WIRING CONVENTIONS Note Battery charging and other internal functions are automatic WARNING Be sure the voltage selector switch is set to the proper input voltage before operation REI OSC 5000 11 Section 2 Detecting Video Thr
85. ess to all lines in modular phone connectors that contain 2 to 8 conductors 6 Adjust the volume control on the OSCOR unit With the phone on the hook there should be no audio on the conductors at all unless the phone system is digital In this case the phone may have digital signals that will sound very much like noise on the line You can unplug the phone from the wall outlet to verify that digital sound disappears when the phone is unplugged With the phone plugged back into the wall and on the hook rap lightly on the phone i e strike the phone gently with a pencil If any audio content is heard this implies that the phone contains a hook switch bypass hot speaker for speakerphones hot earpiece or hot mike hot means that the device is active when the phone is hung up within the phone There are some types of phones that are active even with the phone hung up many speakerphone models have this problem This type of phone is a natural threat and should be replaced With the phone off the hook and the audio coupler connected to the tip and ring conductors you should hear the dial tone and any audio from the telephone mouthpiece For analog or hybrid systems a hybrid system uses analog for the normal tip and ring signals but power and digital controls on the remaining 2 to 6 conductors REI OSC 5000 83 Section 6 Testing the Telephone Testing the Telephone Lines for Carrier Current Using the AC VLF cord the power cord
86. etermine the threat potential of a frequency hopping signal 1 Determine the frequency hopping spectrum using the method described on page 27 Peak Spectrum Display 2 Allow the OSCOR to sweep the frequency span for several minutes in the target environment to establish a well defined frequency spectrum of the hopping signal 3 Press the PLOT button to print the frequency spectrum and label the plot with the physical location or room in which it was produced 4 Take the OSCOR to several other locations within the building as well as outside the building and repeat steps 2 and 3 5 Compare the signal strength of each signal by overlaying the various plots and holding them up to a light source Using this method you can determine if the signal is originating from within the building or from outside If the signal is stronger outside the building than any of the inside locations the signal is probably not an eavesdropping device within the building 6 Ifthe signal strength is stronger inside the building localize on the room containing the strongest signal using the plots and use a Broadband field strength meter to find the physical location of the transmitter see page 89 Broadband Energy Detectors For this kind of threat a good physical search is imperative Unintentional Radiators Many things that are not designed to be radiators can cause false readings Most unintentional radiators have very little range and are easy to identi
87. evel can be viewed plotted or deleted To change the type of signal listing 1 Place the OSCOR in the Analyze Mode by pressing the SWEEP ANALYZE button 2 Press the RECALL button which toggles the unit between the signal list and the spectrum view 3 Press the MENU button labeled CONFIG to enter the Listing Configuration Menu 4 Press the button to toggle between 1 LINE 2 LINE and BLOCKLIST Paper Installation To properly install the printer paper With the unit s power on remove the printer cover Load a roll of paper onto the paper tray observing the direction of the roll Lay the paper and bail in the power cord tray with a few inches of paper off the roll Insert the paper into the slot just below the metal plate at the back of the printer Press and hold the FEED button until paper is seen at the cutting surface Place the paper and bail in the paper tray and press FEED again to ensure alignment and to take up any remaining slack 7 Tear off the excess paper and replace the printer cover ES Po Note Each press of the FEED button advances the paper one line whereas pressing SHIFT followed by FEED reverses the paper one line WARNING Do not attempt to plot without paper loaded The paper prevents the printer head from overheating Do not try to load paper using the PLOT button instead of the FEED button This could result in a paper jam or damaged printer The head must be in the parked po
88. fy by one of several methods Since unintentional radiators have little power the radiated signal should be very localized The location of the radiator may be found using the locator probe It is also easy to REI OSC 5000 80 Section 4 Sweep Conduction turn off various pieces of equipment in the environment to determine if a signal stops Some examples of unintentional radiators the expected signal and their likelihood are provided in FIGURE 28 Note There are many intentional radiators such as cordless phones cellular phones baby monitors any kind of advertised wireless systems intercoms walkie talkies remote control devices etc It is important to become familiar with the normal transmitters in your environment to increase sweep efficiency possibly in the WhipLo Loop antenna input and possibly in the WhipLo Computers Potential harmonic signal appearing on the RF Loop Moderate antenna WhipLo and even the Whip High antenna These signals are typically due to the various clock speeds in the computer system and may have a digital sound Radio Tuners Low strength signals in the same frequency band as Moderate Stereos the radio FM WhipHi AM WhipLo and may radiate at lower frequencies Since radios contain a tuned oscillator that is used to demodulate the received signal this internal oscillator may re radiate a similar signal at 455 kHz or 10 7 MHz above or below the normal frequency display system pulsing
89. ge over which the AFT function is performed Pressing SHIFT and SEEK LIMITS will invoke the automatic seek to next signal function The Squelch knob in the audio panel is used to set the signal threshold level The squelch threshold is identified by a horizontal dotted line across the graphs in both the sweep and analyze modes Cursor Indicators The cursor controlled with the Rotary Dial indicates the status of the signal at the specified location The cursor has three different shapes W Indicates that the signal is above the squelch level but that the demodulator circuit has not locked onto a signal W Indicates that the demodulator has locked onto a signal Indicates that the signal is below the squelch level REI OSC 5000 32 Section 2 Detecting Video Threats Snuggle Bug Analysis The Analyze Mode has a feature that provides the capability to quickly analyze a signal for the presence of a snuggled transmitter A snuggled bug is typically a narrow band RF transmitter that tuned very close to frequency of an existing wide band signal such as an FM radio station By tuning the snuggled signal very close to the center frequency of the wide band ambient signal the snuggled signal is essentially masked by the demodulation of the ambient signal Therefore visual inspection of the ambient signal using a spectrum analyzer in a wide band bandwidth mode does not easily reveal the presence of the snuggled transmitter This effect
90. ging devices Note Signals that are labeled as FRIENDLY are ignored unless the signal strength level has deviated by more than 5 e Press the F1 button to enter the output configuration menu e Press the F2 button to enter the Correlator configuration menu e Press the button to start the automatic mode from the beginning of the input list This process will start at the beginning frequency of the first listed input e Press the F4 button to start the automatic mode by resuming at the last frequency that was analyzed This option is only available if the automatic process has been previously interrupted The sections below provide detailed explanation about the Outputs Configuration menu and the Correlator Configuration menu Outputs Provides for setup of output devices Audible Alert provides an audible ring when a threat is detected Autoplot automatically plots a running threat listing or sweep plot Autotape records the threat audio signal for a specified time interval e Screen ACTIVE or BLANKED screen activity can be hidden during Automatic Mode operation to make the unit less conspicuous REI OSC 5000 60 Section 2 Detecting Video Threats To enter the Outputs Set Up Menu From the CONFIGURE AUTO Menu Press the button labeled OUTPUTS CORRELATOR ALERT PLOT FRIENDLY LOADED PASSIVE OFF OFF 2 04 09 41 ALERT PLOT RECORDER DISPLAY MANUAL TONE VOL STYLE OUT TIME MODE RESUME OFF OFF O
91. gnal Video signals have a distinctive vibrating sound when received by the OSCOR audio receiver and can be identified even without the OSCOR video option This vibrating sound is due to the video synch pulse within the video signal A video signal with moving images will have changing audio pitch due to moving images or a change of picture images A still image such as an empty room will have a constant vibrating sound To locate a video signal 1 Select the signal of interest using the normal Sweep Mode 2 Press the SWEEP ANALYZE button to toggle to the Analyze Mode Try the available demodulators and listen for the vibrating synch pulse Note One method of identifying a video signal is to test the room by listening to the audio sound of the video signal while turning the lights on and off If the audio pitch of the vibrating audio changes significantly when the lights are turned on or off this indicates that the video signal is responding to the changing light level of the room and the video signal is associated with the room To locate the video signal turn the lights off and use a focused high intensity flashlight to scan the room When the flashlight is pointed directly at the video camera the audio pitch of the video signal will significantly change Using the OSCOR Video Demodulation To use the Video imaging option Tune onto the signal of interest in the Analyze Mode Press the IMAGE button Press the F2 button labeled VI
92. gnal while trying the AM and FM demodulation schemes F3 It should be noted that the SPECT button provides access to the OSCOR audio oscilloscope and while viewing a video signal the oscilloscope function will provide a visual representation of the synchronization pulses and video scan data In this manner you can visually identify the polarity of the synch pulse as either positive or negative TEES 919 2500nuz 1 mSec 010 25 mSec PEAK OFF ITRIG FREEZE EXIT FIGURE 28 VIDEO SIGNAL WITH NEGATIVE SYNCH PULSE OSCOR 2 4GHz Video Search Option Since there are so many 2 4GHz video transmitters commercially available the OSCOR has a built in function that accesses the 2 4GHz video band with a minimum number of REI OSC 5000 67 Section 2 Detecting Video Threats Keystrokes This function automatically tunes the OSCOR to 2 450MHz Once this function is executed you can quickly look for signals in this region of the frequency spectrum by utilizing the EXPAND and NARROW buttons To rapidly look for signals in the 2 4GHz frequency band Press the IMAGE button Press the F2 button labeled VIDEO Press the button labeled 2 4 GHz Press the SWEEP ANALYZE button to go the SWEEP mode Use the rotary dial and the EXPAND NARROW buttons to search the spectrum SS Po Technical Note Some video cameras emit a low power magnetic field at 15 kHz In this case the OSCOR l
93. he F4 button until maximum extent is reached 4 Press the button to plot Secure the Area Once the sweep is in progress do not let employees wander into the sweep area For sweeps performed during working hours an employee perhaps a receptionist should be stationed outside of the target area to prevent intrusions The employee does not have to be aware of the sweep but should be informed that an important meeting is in progress and that no one is to be disturbed for any reason Once inside the target area close all drapes and doors inside the area Activating a Known Sound Source Activate a typical sound source of a work environment such as elevator music or easy listening Music should be at a volume slightly louder than typical background music Most buildings have an intercom system or speaker system that may be used to flood the environment with a sound REI OSC 5000 73 Section 4 Sweep Conduction Note If a radio or TV signal has not been pre loaded as a friendly signal the OSCOR will provide a false threat warning when the signal is detected because the audio signal will correlate with the sound source The sound source provides many benefits It masks the noises associated with testing and inspection sweep activities t provides a good reference sound source for OSCOR to perform threat correlation It may activate sound controlled devices e Ifa built in speaker system is used to flood a
94. he rising edge of the first spike using the Rotary Dial The range measurement is locked into memory by pressing F2 F3 or F4 for each respective range measurement The range measurement is based on the location of the cursor when pressing F2 F3 or F4 RANGING i 19 17 19 34 0 fit R OHGING 27 ft CLICK RIGHT AUTO SET FIGURE T CURSOR LOCATION FOR OTL 10 After all measurements have been made press the MENU button labeled LOCATE to view the position of the microphone The positions indicated on the screen are referenced to the OSCOR connector tray expansion port connector The accuracy of the triangulated position may vary depending on the consistency of the range measurements and the position of the eavesdropping device Technical Note It is very important to hold the clicking device in the correct position while making measurements Position errors of only a few inches at the clicking device may result in errors of several feet when locating a bugging device Technical Note If the above method results in only very small spikes or no spikes at all but the signal provides confirmed demodulated audio try the following Adjust the range of the screen to its maximum value 60 ft 18 meters 1 Try different bandwidths and demodulators see pages 21 Receiver Bandwidths and 31 REI OSC 5000 50 Section 2 Detecting Video Thre
95. he volume control to an acceptable level You should hear a buzzing sound Adjust the squelch level indicated by a horizontal dotted line to the very peak of the signal When the squelch level is adjusted properly the buzzing sound will have a very low frequency pitch and may intermittently stop 6 Walk around the room while listening to the pitch of the buzzing sound As the locator probe is brought into the vicinity of the transmitter the frequency of the buzzing sound will increase with the signal strength SS PS Note As you near the signal source it may be necessary to adjust the squelch level It may also be helpful to collapse the locator probe antenna to reduce the antenna gain when zeroing in on the threat location Note It is important to remember that if the OSCOR speaker is used to broadcast the locator buzzing sound the unit is not covert Anyone using an eavesdropping device can hear the locator buzz To use the locator probe in a covert mode the headphones can be used with the mini plug patch cord This patch cord is on the same cord winder as the locator probe patch cord REI OSC 5000 47 Section 2 Detecting Video Threats Locating Infrared Threat Signals There is not a separate locator probe for locating infrared threats It is important to note that infrared signals must be in line of sight between the OSCOR detector and either the infrared transmitter or a reflection from the transmitter The OSCOR i
96. hones but a simple voltmeter can also perform everything needed for standard tests The basic procedure is to measure the on hook voltage level which should be approximately 50 to 54 volts and the off hook voltage which should be 4 to 12 volts Using the actual measurements achieved from these readings several things can be determined For example if the off hook voltage level measured in suspect environment is 6 5 volts but the off hook voltage of the same type of phone in the office next door is 7 5 volts there is cause for suspicion of a phone bug Furthermore using the voltmeter and a balanced set of resistors the flow of the phone line can be measured The basic goal when using any type of phone analyzer equipment is to try to determine if the phone line is tapped somewhere between the telephone and the central office This text will not go into all of the different kinds of measurements or tests that can be performed using a voltmeter or basic analog telephone analyzer This type of information is well publicized and feel free to contact REI for further information Time Domain Reflectometry TDR A time domain reflectometer TDR is a device that checks the integrity of the phone line This device works similarly to a radar system the TDR is connected to any pair of phone line conductors and transmits a very short voltage pulse This pulse travels down the telephone line and every change in the flow produces a reflection that travels
97. ic threats If you have further questions about equipment please contact REI If we do not manufacture the type of equipment that you are interested in we will be happy to recommend a supplier REI OSC 5000 86 Section 8 Other Equipment yjqedeo euo pue Ayiqedeo Husa eouepeduur surejuoo JezAjeue euoudeje au seuinssy Jejeui surejuoo yey uorjeoo e ui peoejd Jou 51 eu ey z Jeuejeu JojonpuooiuJes yey uoneoo peoejd Jo jejeuu Aq papjalys jou si jeu seuinssy deews uuoped jejdepe jeroeds e seu 1 payloads jou Jo JeujeuM uo i ng Jo dies IV 10H youmsyooH D aot a a pv p ovo ee E 6ng jueuin
98. ied Span Off the frequency span will not be swept in the Automatic Mode FastSkim the frequency span will be swept at a very fast pace because the squelch threshold is set relatively high and only the stronger signals will be detected MedHunt the frequency span will be swept at a moderate pace and medium strength signals will be detected Deep Dig the frequency span will be swept at slow pace because the squelch level is set very low and even very weak signals are analyzed This mode may also detect many false signals that are nothing more than deceptive noise signals ManSqulch sets the squelch level manually It is important to note that most bugging signals will be somewhat powerful if you are in the room in which the bug is located Therefore most bugs can be found using FastSkim or MedHunt Therefore if you use MedHunt the unit first makes a pass using FastSkim in hopes that bug is reasonably strong signal and you will find the bug very fast For the same reason if you use Deep Dig the unit automatically goes through FastSkim and MedHunt first to quickly find the bugs before the unit gets into the long and slow process of Deep Dig To select the sweep inputs 1 From the CONFIGURE AUTO Menu press the F2 button labeled SETUP INPUTS This sweep span display screen is identical to the sweep span screen described on page 37 Sweep Span Storage 2 Use the UP DOWN buttons to select the desired sweep span 3 Press th
99. iew plot or delete only a certain signal classification Signals are classified according to the following criteria which will become more apparent later in the manual FRIENDLY Signals common to the ambient environment and posing no threat e NO CORR Signals that have been stored with no classification or correlation e LOW CORR Signals with a correlation level below the threat level threshold THREATS Signals with a correlation level exceeding the threat level threshold DECLARED Signals that the user has evaluated and flagged as known threat signals To filter the signal list 1 Press the RECALL button the Analyze Mode to display the signal list 2 Select the appropriate menu using the MENU button see Figure 14 3 Press the button labeled LIST ALL to select the desired filter criteria The button cycles through the various available combinations SIGNALS FRIENDLY NO CORR LOW CORR THREATS amp DECLARED REI OSC 5000 36 Section 2 Detecting Video Threats To delete a filtered signal list or Clean up Spurious Signals Use the RECALL button in the Analyze Mode to access the signal list Select the appropriate menu using the MENU button see Figure 14 Press the F1 button labeled LIST ALL to select the desired filter criteria Press the F4 button labeled DELETE Press the F2 button labeled DELETE to delete the displayed signal list or Press F4 labeled SPURIOUS CLEAN UP to delete
100. iew the complete list of saved Sweep Span parameters To Enable or Disable the selected input for automatic operation press F1 see page 57 Editing or Creating a Frequency Span for Automatic Operation To delete a programmed sweep span from memory 1 Display the Sweep Span list using the SWEEP ANALYZE button and the RECALL button if it is not already in the Sweep Mode 2 Use the Rotary Dial or the UP DOWN buttons to select the desired sweep span 3 Press F2 labeled DELETE 4 Press Fl to confirm the deletion To edit an individual Sweep Span 1 Display the Sweep Span list using the SWEEP ANALYZE button and the RECALL button if it is not already in the Sweep Mode Press Fl to turn an individual span off Press F2 to delete an individual span followed by pressing to confirm the deletion Press to toggle the Attenuator setting for an individual span To delete all programmed sweep spans from memory REI OSC 5000 38 Section 2 Detecting Video Threats 1 Display the Sweep Span list using the SWEEP ANALYZE button the RECALL button if it is not already in the Sweep Mode Press F4 labeled EDIT AS GROUP to display Press F4 labeled ALL USER DELETE 4 Press Fl to confirm the deletion Reset the Sweep Spans to defaults 1 Display the Sweep Span list using the SWEEP ANALYZE button and the RECALL button if it is not already in the Sweep Mode 2 Press F4 labeled EDIT AS GROUP
101. ile Radio Astronomy Radiiolocation Space Operation Fixed Mobile Maritime Mobile Satellite Aero Radio navigation Earth Exploration Satellite Land Mobile Satellite Meteorological Aids Fixed Meteorological Satellite Fixed Mobile Aero Radio navigation Fixed Mobile Mobile Satellite Mobile Satellite Fixed Mobile Radio Astronomy Fixed Mobile Space Research Radio Astronomy Land Mobile Sat Fixed Mobile Broadcasting Sat Fixed Fixed Satellite Space Operation Fixed Mobile Mobile Satellite Aero Mobile Satellite Land Mobile Satellite 103 Section 8 Other Equipment Section 8 Other Equipment 2690 2700 Earth Exploration Satellite 2700 2900 Aero Radio navigation 2900 3100 osc 5000 104 Section 8 Other Equipment Standard Television Frequency Data USA 579 1875 579 3125 CH 22 Vid 583 6875 583 8125 CH 32 Aud 585 1875 585 3125 CH 33 Vid 759 1875 759 3125 CH 62 Vid 589 6875 589 8125 CH 33 Aud 771 1875 783 1875 e Start MHz 55 1875 59 6875 61 1875 65 687 67 187 71 687 77 187 81 6875 83 187 87 687 75 1875 79 1875 81 1875 85 6875 87 1875 91 6875 93 1875 97 6875 99 1875 203 687 205 1875 209 6875 211 1875 215 6875 477 1875 481 6875 483 1875 487 6875 489 1875 493 6875 495 1875 499 6875 501 1875 505 6875 507 1875 511 6875 513 1875 517 687 519 1875 523 6875 525 1875 529 6875 531 1875 535 6875 537 1875 541 6875 543 187
102. ile exc aero mobile 24 2489 ixed Land Mobile 24 89 24 99 Amateur 510 Amateur Satellite Mobi obi i 6 8 6 Meteorological Aids Fixed Mobile 28 Amateur Amateur Satellite 5 Aero Mobile 30 005 Fixed Mobile Fixed Aero Mobile Land Mobile 117 975 1 Aeronautical Mobile 1 lal i O a 95 Section 8 Other Equipment 136 137 138 144 146 149 9 150 05 174 223 230 235 1 267 273 Fixed Mobile Space Operation 3 Fixed Mobile 3 PIT BIO 27 22 28 35 99 Blu gie 00 0 00 15 Meteorological Aids 406 Meteorological Aids ale 406 1 Mobile Satellite Fixed Mobile exc aero mobile 406 4 1 790 960 Fixed Mobile Broadcasting 121 126 130 135 140 Fixed Broadcasting 1400 Fixed Mobile Radio location 1 62 1 646 Maritime Mobile Satellite 1 64 1 647 Mobile Satellite 1 54 1 55 1 559 Land Mobile Satellite 1 55 1 610 Aero Radio nav Radio nav Sat 1 61 1 627 Aero Radio nav Mobile Sat 1 64 1 657 Aeronautical Mobile Satellite 1 65 1 660 Land Mobile Satellite 1 66 1 661 Radio Astronomy Land Mob Sat 1 661 1 668 Radio Astronomy Space Research 1 555 Aeronautical Mobile Satellite 1 66 oo 167 170 171 198 amp ejejejie pel SI Kon ojojo BK al nfo r 2025 Fixed Mobile 2120 Fixed Mobile Spa
103. ing Telephones with OSCOR WARNING Before attempting to connect the Balanced Audio Coupler to an unknown wire or cable you must first determine if it carries a hazardous voltage The coupler should not be connected to voltages greater than 250 volts Unit damage or personal injury may result REI OSC 5000 15 Section 2 Detecting Video Threats Optional Accessories and Upgrades This section describes optional accessories currently available for the OSCOR OSCOR Personal Computer Interface OPC 5000 The OPC provides computer interface with the OSCOR using a direct serial communications cable The software allows the user to store signal lists sweep information and sweep span settings and the information can be transferred back and forth between the PC and the OSCOR Plus the software lets the user create reports graphs and charts from the stored information OSCOR Microwave Downconverter MDC 2100 The OSCOR Microwave Downconverter option MDC 2100 expands the OSCOR s frequency range limit to 21 GHz The term Downconverter means that the MDC 2100 takes higher frequency signals and converts their transmit frequency down into the operational frequency range of the OSCOR spectrum analyzer Microwave signals tend to be directional so the MDC 2100 features a high gain directional antenna array The MDC 2100 is compatible with the OPC Interface and the OTL locator options It can function in the sweep analyze and correlation m
104. ing and the nails are slightly oxidized they will produce harmonics or if plated screws are used in a steel studded wall harmonics will be produced However since true semiconductor devices produce a higher second harmonic a high quality NLJD minimizes false alarms Furthermore any device that already contains electronics such as a telephone or clock radio will always give a semiconductor junction reading There is no way to detect a bug in equipment that already contains electronic components The greatest advantage of the NLJD is that it will function whether the eavesdropping device is turned on or not It will find tape recorders chip cameras and bugs It allows the user to rapidly scan walls bookcases and ceilings without any demolition The typical range on an NLJD is about 6 in to 3 ft 5 to 70 cm REI has recently added a non linear junction detector to its list of products The ORION is a lightweight single body device that incorporates the latest advancements in design Other NLJDs have multiple pieces to carry and cords that must be attached but the ORION is contained in one unit with only one cable that is stored on an internal automatic winder It uses only one polarized antenna which reduces the search time while providing greater reliability and it uses a standard type camcorder battery that is rechargeable Other NLJDs cost more than 20 000 but the ORION costs considerably less Contact REI or your dealer to learn more a
105. ion Storage Compartment and Accessories Figure 6 Page 13 This patch cord allows received video signals to be fed directly into an alternative video monitor or a video recorder Video output is provided in a standard RCA plug Analyzing Video Signal Formats and Modulation While the OSCOR video system is designed to specifically demodulate standard video formats such as NTSC PAL and SECAM there are common modified video formats that may also be demodulated using the OSCOR For example it is very common for video transmitters to adhere to the NTSC standard with the exception that the video signal is FM modulated instead of AM modulated In this case tune the OSCOR receiver away from the main peak of the video signal use the rotary dial to move the cursor to the left or right of the main peak of the signal In this manner you can typically receive enough AM modulation content from the video signal to display the video image However it should be noted that the picture quality will suffer but the main goal is to verify the existence of the threat and not to provide beautiful video quality Also it is very common for the video synchronization pulse to be inverted in order to confuse the normal video demodulation process However the user can select the desired video synchronization pulse polarity using the main OSCOR video control menu Further it is very useful to press the SPECT button when analyzing a video signal and observing the received si
106. ipH FMW 5 000MHz 1505 00MHz OFF OFF RF DISC FMW 1505 00MHz 3005 00MHz OFF OFF INFRARED FM 10 0KHz 5 010MHz OFF OFF AC VLF FM 10 0KHz 5 010MHz OFF EDIT SELECTED SPAN EDIT AS EDIT SPANOFF DEFAULT ATTN OFF GROUP EXIT FIGURE 15 SWEEP SPAN LIST SCREEN DISPLAY e first column of the Sweep Span list screen displays the enable status for Automatic Mode operation For further details on Automatic Mode operation see page 57 Setup Inputs REI OSC 5000 37 Section 2 Detecting Video Threats e The second column indicates the antenna being used as an input source e The third column indicates the type of modulation The W indicates wide band modulation e fourth column indicates the Frequency range of the span e The last column indicates whether the sweep span has been programmed to used the attenuator OFF indicates that the attenuator is not in use for automatic operation Note The default menu has options that apply to editing a single sweep span However there is also a menu to edit all of the sweep span inputs These procedures are described below To Store a Sweep Span in memory 1 In the Sweep Mode choose the desired sweep input frequency span demodulator and bandwidth using the Frequency Display controls 2 Press the STORE button to save the span in memory 3 Press F3 button labeled EDIT to v
107. is type of sweep Note When sweeping for infrared signals outside a building the Correlate Mode can not be used accurately unless the sound source from within the building can be fed into the OSCOR audio input This can be accomplished by using a portable radio or walkman and a common radio station as the sound source As long as the same music within the building is patched directly into the OSCOR the Correlate Mode will function normally Note When used outside the building the OSCOR is not in a covert mode Note It is not practical to search for infrared signals outside high rise buildings even though they may be received from adjacent high rise buildings However infrared is easily diffracted by windows and may still be detected within the target environment REI OSC 5000 74 Section 4 Sweep Conduction Manually Sweeping Selected Inputs When performing a sweep several inputs are easily searched using manual operation There are very few friendly signals that exist in some inputs such as infrared RF Loop and AC VLF Rather than allowing the OSCOR to search these inputs it is faster to select these inputs in the Manual Sweep Mode and manually tune to any signals for verification Note The above recommendation only applies when performing a dedicated sweep If the OSCOR is being used in a monitoring function and checked only once a day then all inputs should be activated for sweeping Note Be sure that no computer monitor
108. itivity of the correlator and alert system are adjusted by setting the threat level threshold It is recommended that the threat level be set to 3 or 4 To clear an alert message and the flashing LED alert indicator Press the TONE button The alarm LED indicator should change from a flashing mode to a constant illumination when the tone is activated or no illumination when the tone is not activated Passive Correlation In the Passive Mode of correlation the OSCOR is completely covert and relies on passive sounds in the environment for correlation To increase the speed and accuracy of the correlation when operating in the Passive Mode the OSCOR will systematically tune to each signal and perform two types of correlation e A short term Acquire screen is the primary method of identifying a signal containing correlation by detecting peaks within the screen s scan time This Acquire function 15 usually performed for a relatively short period of time and relies on the peak of the correlation window If the threat level does not exceed the specified threshold during the Acquire time the system classifies it as a threat level 1 and continues scanning e If a correlation peak exceeding the threat level threshold is detected in the primary Acquire screen the system will immediately enter a 10 30 or 60 second analyze screen to perform statistical analysis of the function vs time In this Correlation Analyze Mode the threat level indica
109. l form The most common types of modulation are AM Amplitude Modulation and FM Frequency Modulation To enter the Analyze Mode Press the SWEEP ANALYZE button located just below the Rotary Dial This button toggles between the Sweep Mode and demodulated Analyze Mode You can listen to the signal indicated by the cursor by entering the Analyze Mode and adjusting the volume control The menu for the function keys in the Analyze Mode is identical to the Sweep Mode 58225042 55 750 B84 4900nuz 2 Lock 153 1 UDE FIGURE 11 ANALYZE MODE SCREEN DISPLAY The Analyze display screen contains two plots The plot on the left half of the screen is the frequency spectrum Since the Analyze Mode is not a frequency sweeping process the graph of the signal profile is not refreshed and the tuning frequency is equal to the cursor frequency However if the signal level at the cursor is below the squelch threshold the Analyze Mode will function like the Sweep Mode with the screen constantly being updated and the tuning frequency constantly changing If the signal level exceeds the squelch level the Frequency Display can be refreshed by several methods e toggle to the Sweep Mode and back to Analyze Mode e expand or narrow the frequency span e manually scan the cursor across the screen using the Rotary Dial or program the Frequency Display to periodically refresh itself To program the Analyze Mode to auto
110. le Space Research 37 5 Fixed Mobile 261 26 175 275 28 297 30 005 3001 375 4002 4L015 za 68 748 752 87 100 108 117 975 138 1 8 25 9 986 0 02 0 98 D 41 015 44 47 74 8 752 87 100 100 108 108 117975 117975 137 137 138 138 144 Fixed Mobile Space Research Ape A n 99 Un 74 8 3 2 87 5 55 Fixed Mobile exc aero mob 29 7 Amateur Amateur Satellite 221 yii OSC 5000 102 144 146 148 149 9 150 5 153 56 763 56 838 174 223 230 ele N Un 267 273 322 2 3 9 00 00 1 401 406 406 1 410 430 440 450 460 470 585 610 Wr oo Mo BRI a El Un 1215 1260 1300 1350 1400 1427 1429 1525 1535 1544 1545 1555 1559 1626 1631 1645 1646 1656 1660 1660 1668 1700 1710 1980 2010 2025 2120 2200 2290 2300 2500 2535 2655 A 146 148 149 9 150 5 153 56 763 56 838 174 23 30 2 2 235 267 273 322 28 6 35 4 99 9 00 5 400 15 401 406 06 1 410 3 4 5 6 B 430 440 450 460 470 7 585 610 1215 1260 1300 1350 1400 1427 1429 1525 1535 1544 1545 1555 1559 1626 5 1631 5 1645 5 1646 5 1656 5 1660 1660 5 1668 4 1700 1710 1980 2010 2025 2120 2200 2290 2300 2500 2535 2655 2690 OSC 5000 Fixed Mobile Mobile Satellite Fixed Mob
111. locks Power Management System controls each operating subsystem independently to reduce operating power and extend battery life Autio Automatic Gain Control provided in main receiver and reference channels to continuously adjust audio value to optimum levels High Performance Receiver sensitive quad conversion receiver controlled by three phase locked loop synthesizers Frequency range 10 kHz 3 GHz 21 GHz is optional Multiple IF filters used throughout allow tight selectivity in all bandwidth selections Input Attenuators selected when high RF or Audio levels are encountered osc 5000 9 Section 1 Equipment Description Antenna Panel FIGURE 3 ANTENNA PANEL The OSCOR antenna panel provides an integrated package of probes that are automatically selected based on the operating frequency The OSCOR central processor controls the automatic switching hence manual antenna selection is not required for operation 1 ACTIVE WHIP ANTENNA GaAs FET preamplifier and telescoping whip provide high sensitivity and wide 0 5 1500 MHz frequency coverage 2 DISCONE ANTENNA mounted in a fixed position the DISCONE covers a 1500 3000 MHz frequency range 3 BALANCED LOOP ANTENNA contains an active amplifier with a remote controlled NARROW BAND tape mode for detection of tape recorders The LOOP ANTENNA can also be removed from the antenna array panel and placed at a remote location WIDE MODE covers from 10 500 kHz an
112. make range measurements The parabolic reflector that comes with the OTL 5000 provides the ability to point the clicking hardware at various locations to determine the location of the microphone The piezo device should point into the reflector the hole pointing into the curve of the reflector to provide a directional sound source The OSCOR should be placed in a corner of the room or test environment with the operator facing into the room The triangulation equations are only designed to provide accurate results on the exterior side of the antenna panel as described below Since the method relies on sonic ranging the most accurate results are achieved when the eavesdropping device is in line of sight to the OSCOR and on the exterior side of the deployed antenna panel OTL 5000 can only locate eavesdropping devices on this side of the OSCOR FIGURE 18 LOCATING CAPABILITY DIRECTIONAL DIAGRAM To use the OTL 5000 to locate a microphone Plug the OSCOR Triangulate amp Locate device OTL 5000 into the expansion port Select the transmitter frequency with the cursor in the Analyze Mode Listen to the signal to confirm lock on the signal Press the THREAT Button to bring up the Location Menu Press F2 labeled Tri Locate to bring up the OTL 5000 Menu this menu will only appear when the OTL is plugged in 6 Press F1 to select either a single click labeled SINGLE or multiple clicks labeled AUTO Technical
113. matically refresh 1 In the Analyze Mode press MENU button labeled CONFIG 2 Press the F1 button labeled REFRESH OFF 3 Type the desired number of seconds for periodic refresh and press ENTER To cancel the refresh repeat steps 1 3 and enter 0 for the desired number of seconds REI OSC 5000 29 Section 2 Detecting Video Threats The graph on the right half of the screen 1s an oscilloscope view of the demodulated signal also see page 43 Oscilloscope Analysis Audio Spectrum Analysis Screen This graph may be changed to display the OSCOR phase correlator results To change the analyze mode deviation graph to a correlate graph 1 In the Analyze Mode press MENU button labeled CONFIG 2 Press the F2 button labeled DETAIL SOURCE Pressing F2 in this menu will toggle the graph between the time display and the correlate display Depending on the demodulator selected the time display graph is labeled as follows Screen Label FM or FM Wide AM or AM Wide Amplitude FIGURE 12 SCREEN LABELS FOR DEMODULATIONS The center of the Analyze Screen displays the following information Relative signal strength e Signal Lock status when the OSCOR tunes to the center of a signal the AFC Audio Frequency Circuit will prevent signal drift e Battery voltage display Battery voltage display is an optional display that must be selected using the System Set Up Menu REI OSC 5000 30 Section 2 Detecting Video Threats
114. n labeled RECORDER TIME OUT under the Outputs Menu to activate or deactivate the Automatic Recording Mode 3 Enter the number of minutes that you wish to record of each threat signal Entering a number of 0 will default the OSCOR to 6 minutes Note The tape recorder must be properly plugged into the OSCOR unit with the 2 5mm REMOTE jack connected to the tape recorder remote control jack and the 3 5mm OUT jack plugged into the tape recorder microphone input REI OSC 5000 62 Section 2 Detecting Video Threats Display Mode During automatic operation other personnel may encounter the OSCOR It is recommended that the OSCOR screen be de activated so that a casual observer will not know what the OSCOR is doing To de activate the screen during automatic operation 1 Enter the Automatic Mode Output Configuration Menu as described on page 60 2 Press the F4 button labeled DISPLAY MODE to toggle the Screen Display Mode With the screen in the Blanked Mode and the Automatic Mode activated the screen will remain blank until the AUTO MANUAL button is pressed to stop the Automatic Mode Correlate Acoustic Correlator System Automatic Options at this level allow the user to change the threat level threshold correlation method acquire time and analyze time For an overview of the acoustic correlator system refer to page 43 Acoustic Correlator System Manual The correlator operation is configured for the Automatic Mode using
115. n RAM memory and is completely reset whenever the frequency display window is altered in any way REI OSC 5000 25 Section 2 Detecting Video Threats e Difference Spectrum Display This display mode displays the difference between any two of the spectrum display modes described above This mode is particularly useful for comparing a Friendly frequency spectrum to the Real time frequency spectrum Using this display mode signals that are unique to the sweep environment are quickly identified providing a very rapid method of detection for some bugging devices The Friendly and Peak Spectrum display modes are stored in RAM memory in the OSCOR This data is retained in OSCOR memory even if the unit is turned off This data is only reset if the OSCOR memory reset or if the individual memory buffer is reset This procedure 1s further described later in this section Technical Note The Friendly and Peak spectrum data only applies to the basic OSCOR frequency spectrum TheMDC 2100 does not support the Friendly and Peak spectrum display data The paragraphs below describe these display modes in greater detail Friendly Spectrum Display Prior to conducting a sweep it is highly recommended that the OSCOR be taken out of the sweep environment run in a load friendly mode This mode will be described in much greater detail later in the manual However when the Load Friendly is executed the OSCOR first stores the RF frequency spectrum
116. n due to slope detection against the IF filter skirts and phase group delay in the filter systems When receiving AM signals with FM demodulators the imperfect limiting action of an FM IF demodulator will allow a small percentage of AM to also be detected Tuning Subcarrier Subcarrier demodulation is a means of decoding a second piggy backed signal carried on a normal transmitted radio signal This is sometimes referred to as double demodulation Subcarrier signals are most commonly used for background music and nationwide digital pagers These frequencies normally fall between 50 120 kHz When a subcarrier signal is suspected you may perform a second demodulation by activating the FM SC demodulator indicated on the display as SubC FM Many commercial FM radio stations and TV sound channels have subcarrier signals that typically contain MUZAK elevator music paging systems or news stations To activate the Subcarrier demodulator 1 In the Analyze Mode select the 250 kHz bandwidth using the F2 button 2 Activate the Subcarrier tuner by using the F3 button 3 Select the Subcarrier bandwidth using the F2 button after the Subcarrier demodulator has been selected The second demodulator bandwidth can be either 15 kHz or 6 kHz REI OSC 5000 31 Section 2 Detecting Video Threats 4 Once the subcarrier demodulator has been activated the subcarrier signal must be tuned Use the Rotary Dial to tune to the main signal on
117. n entire area several offices a floor of a building or an entire building the OSCOR will correlate on threats that may be located anywhere in the area as long as the bug s transmitted signal is of sufficient strength In other words with a known sound source flooding the building the OSCOR can sweep many rooms at once Ifthe known sound source is fed directly into the OSCOR using the external reference input jack then the correlation sensitivity is increased which further increases the OSCOR detection range Special Considerations for Infrared and Laser Threats Since infrared signals can not be transmitted through walls infrared bugging devices are typically placed near windows or outside the building with a wired microphone in the building For this reason the OSCOR should be placed near a window when sweeping for infrared threats The drapes or mini blinds should be closed to make sure no one observes your activities If the windows are large it may be necessary to move the OSCOR to several locations when sweeping for infrared signals If there is an infrared transmitter in the room of interest some of the infrared signal will be reflected off the window which provides additional opportunity for detection The OSCOR should also be taken outside during the night to prevent the sun from interfering with the OSCOR infrared detector and 20 to 30 ft away from all windows All window coverings within the building should be opened for th
118. n the Automatic Mode see page 63 Correlate Acoustic Correlator System Automatic To enter the Correlate Mode 1 Select the desired signal in the Analyze Mode 2 Press the CORR button to enter the Correlate Mode Press CORR again or the SWEEP ANALYZE to return to the Analyze Mode REI OSC 5000 43 Section 2 Detecting Video Threats wwe 155 9825 Tete SIGNAL AUDIO REFERNCE CORREL F amp 01 54 ATE WHIP HIFE 15 kHz FM CONFIRM CONFIG FIGURE 16 CORRELATOR SCREEN DISPLAY The Correlator Screen will provide a visual graph of sound pattern matching vs time When the two signals have a high degree of correlation the graph level will increase The bar graph at the right of the screen indicates an average of the correlation The threat level corresponds to the amount of correlation and is based on a scale of 1 to 5 The following table contains recommended conclusions based on the threat level Threat Level Slight Correlation Highly Probable threat Highly Probable threat FIGURE 17 THREAT LEVEL CLASSIFICATIONS No Correlation does not necessarily mean that the signal is not a threat it only means that the signal does not acoustically correlate with the selected form of demodulation Signals or video that are scrambled digitally modulated spread spectrum or frequency hopping will not correlate so it is important to try to identify each signal
119. nalyzed If the frequency is manually tuned the menus do not update unless the menu is exited and returned to the Frequency analysis Data Functions STORE RECALL OSCOR has two types of information that can be stored for recall Signal information and Frequency Sweep Span information The Signal storage capabilities can store information for up to 7 168 signals this assumes that your OSCOR has the extra memory option All OSCORs sold after 1 March 2000 contain the extra memory included in the unit This information includes input source RF Carrier Current or Infrared frequency demodulator time date of the last threat upgrade and history of threat detection s how many times this signal has been analyzed in the Automatic Mode The Sweep Span storage can store up to 31 sweep spans These can be used to recall a desired frequency band or to program the Automatic Mode to sweep multiple frequency spans and bandwidths using the same input Signal Storage The OSCOR has a built in database used to store selected signals With OSCOR in the Automatic Mode each detected signal is stored in the OSCOR memory for later recall Moreover the OSCOR has user controllable memory storage or recall functions allowing specific signals to be entered or deleted manually Manually entered signals can be classified with a specified threat level Signals that are stored as FRIENDLY signals are ignored in the Automatic Mode to increase the speed of the
120. nfrared detector is omni directional it has a 360 degree viewing angle therefore a simple method for determining the direction of the transmitter is to block the various angles of the detector until the signal stops To locate an infrared transmitter 1 Ifyou demodulate the audio from the infrared signal use the OTL device to locate the microphone following the previously described process 2 Place the OSCOR in the Sweep Mode 3 Narrow in on the signal of interest using the Rotary Dial and the EXPAND NARROW buttons Place the OSCOR in the Analyze Mode Press the THREAT button and then F1 to turn on the locator probe function Adjust the volume so that you can hear the locator tone Adjust the squelch level so that the squelch is just above the signal level and the tone is silenced 7 Place the OTL parabolic reflector on the infrared detector see page 16 OSCOR Triangulate and Locate Option 8 Rotate the parabolic reflector until the locator tone is at a maximum This is the direction of the infrared transmitter Note There is no need to check for infrared transmitters in rooms without windows For rooms with windows the OSCOR should be placed directly in front of the window to detect any IR transmitters that may be transmitting through it Infrared transmitters can also be placed outside a building and aimed away from it To defend against this type of threat it is necessary to take the OSCOR unit outside and c
121. ny RF signals are sporadic in nature which means they only transmit at random times and are therefore very difficult to detect These types of signals include pagers cellular phones police and aircraft radios etc Also certain types of very sophisticated bugs are quite elusive For example bugs that do not stay on the same frequency for very long or only transmit at certain intervals are very difficult to locate These signals may be Frequency Hopping Spread Spectrum or Burst Bugs see page 79 Spread Spectrum and page 80 Frequency Hopping For this reason the OSCOR was designed with a Peak Signal Display Mode In this mode the OSCOR will display the peak signal that occurs at each frequency as it continuously scans The Peak Signal function combines the peak signal from each continuous sweep Therefore if the OSCOR 15 allowed to sweep across the spectrum for several minutes the envelope of all transmissions will be recorded After a period of time the envelope of a frequency hopping bug or a burst bug will be displayed This operation should be performed periodically with the Frequency Display set to approximately 100 MHz Allowing the OSCOR to run for 5 to 10 minutes in each window will be plenty of time to establish a complete Peak Signal Profile and acquire sporadic signals To Display the Peak Signal spectrum 1 Establish the frequency span of interest in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Press the F1 but
122. o Quickly pre load friendly signals 1 Place the OSCOR at least 1 mile 1 5km from the target environment 2 Bring up the Automatic Mode Configuration Menu by pressing AUTO MANUAL 3 Review the signal list by pressing F1 Ensure that the database is empty and return to the Automatic Mode Configuration Menu by pressing the AUTO MANUAL button 4 In the Automatic Mode Configuration Menu press F2 and select the inputs and method of search Fast Med Deep and Man See Page 57 Editing or Creating a Frequency Span for Automatic Operation Use the AUTO MANUAL button to return 5 In the Automatic Mode Configuration Menu press F3 to access the Load Friendly menu 6 Press the F1 button labeled START to start the load friendly process The screen will indicate that the process has started WARNING If the OSCOR is placed too close to the target environment when pre loading the friendly signals it is possible to detect and store an eavesdropping transmitter as a friendly signal It is therefore highly recommended that each signal be manually inspected for verification and that the OSCOR be at least 1 mile 7 5 km from the building when pre loading the memory This procedure should be exercised with caution or not used at all Technical Note There are many intermittent signals that are only detected occasionally such as a digital pager or a cellular phone system These signals should not be cause for immediate alarm but they shoul
123. o locate confirmed threats Do not remove threats The proper authorities those who will determine the proper course of action should conduct this procedure Allow the OSCOR to continue monitoring your environment after all signal verification is completed REI OSC 5000 71 Section 4 Sweep Conduction Pre Loading Signals into Memory The Load Friendly automatic operation will store every signal encountered as a friendly signal see page 59 This should be done at least 1 mile 1 5 km from the building to prevent accidentally storing a threat as a friendly signal If the OSCOR is placed far from the target environment every signal encountered in the Automatic Mode must be normal to the ambient environment and is stored as a friendly signal Once inside the target environment the OSCOR 1 run in Automatic Mode with the Correlate method set to either PASSIVE VERIFY or ACTIVE The friendly signals will be ignored and the OSCOR will scan quickly detecting any new signals which should be cause for suspicion These new signals can be identified by using the SORT SELECT functions built into the signal listing screen see page 52 Signal Listing If you have the OSCOR Personal Computer Interface accessory load the friendly signals once then store them in your personal computer For future sweeps download the stored signals from your PC to the OSCOR This is faster and easier than loading signals at safe distances before every sweep T
124. obile Amateur 510 Fixed Mobile 19 68 19 68 Maritime Mobile 19 99 Maritime Mobile 1741 17 55 Aeronautical Mobile 17 55 18 03 Aero Mobile Fixed Broadcasting 19 99 20 01 Standard Freq Time Signal Fixed Maritime Mobile 20 01 Fixed Mobile 2 21 85 Aero Mobile 21 21 924 2 2 2 Aero Mobile 22 228555 Maritime Mobile Fixed Aero Mobile Land Mobile Fixed Land Mobile Broadcasting 4 995 5 005 Standard Freq Time Signal Fixed Broadcasting Fixed Mobile exc aero mobile Fixed Aero Mobile Land Mobile 2 5 22 22 855 Fixed Mobile exc aero mobile 23 35 Aero Fixed Aero Mobile Aero Mobile 2 24 F Maritime Mobile i 2 Fixed Land Mobile 6 765 Aero Mobile u Fixed Land Mobile 25 07 25 21 Maritime Mobile Amateur 510 Amateur Satellite Broadcasting Maritime Mobile 261 26 175 Maritime Mobile 4 Amateur 510 Amateur Satellite 1 4 85 s D D 3 D 2 26 175 Fixed Mobile exc aero mobile 5 9 995 30 005 30 01 Fixed Mobile Space Research 9 995 10 005 Standard Freq Time Signal i Fixed Mobile 10 005 10 1 Aero Mobile 25 01 25 07 Fixed e exc aero mobile 8 8 3 25 67 8 0 95 99 Broadcasting 99 3001 68 Fixed Mobile 68 748 Fixed Mobile exc aero mobile 748 18 068 18 168 Amateur 510 Amateur Satellite 1 74 8 Aero Radio navigation Broadcasting 10 15 11 175 114 11 65 12 05 2 8 3 obi i Fixed Mob
125. odes and includes a tripod which provides the stability needed to securely point the downconverter antenna array and a swivel neck for easy positioning OSCOR Deluxe Package of OPTIONS OSCOR Triangulate and Locate Option OTL 5000 This option utilizes a patented ranging process REI maintains exclusive patent rights to Glenn Whidden s patent 4 399 556 to triangulate on the location of eavesdropping device This option does not require return to REI for installation See page 48 OSCOR Triangulate and Locate Option OSCOR Video Option OVM 5000 This allows the OSCOR to provide viewing of video signals and can be used for detection of covert surveillance cameras It supports NTSC PAL and SECAM and includes a video demodulator circuit board which must be installed in the OSCOR main unit and two video monitors that fit inside the OSCOR Storage Compartment It includes OVP 5000 See page 65 Detecting Video Threats OSCOR Video Patch Cord 5000 This patch cord allows received video signals to be fed directly into an alternative video monitor or a video recorder Video output is provided in a standard RCA plug OSCOR Audio Recorder and Cables OAR 5000 An audio micro cassette recorder connects directly into the connector tray to use the OSCOR audio recorder functions Locator Probe Extension Cable LPE 5000 This BNC cable is identical to the locator probe cable It comes with a barrel connector and provi
126. oop antenna may be removed from the antenna panel and used as a locator probe The success of this approach depends on the design of the video camera For cameras that are well shielded it is improbable that this method will detect the transmitter REI OSC 5000 68 Section 2 Detecting Video Threats SECTION 3 PREPARING FOR A SWEEP Each individual must choose the thoroughness desired in a sweep We recommend that highly trained professional sweep teams perform two to four thorough sweeps a year for most organizations professional sweep should include taking apart all phones and electrical outlets for inspection testing carrier current and all phone lines inspecting all crawl spaces and ceiling spaces for suspicious wiring and checking all speaker intercom system wiring When contracting a professional sweep team as few people as possible should be aware of the sweep schedule This will decrease the likelihood of a spy learning of the sweep However it should be well publicized that random sweeps are performed An internal eavesdropping threat is greatly reduced when personnel know that regular sweeps are conducted Furthermore organizations should perform mini sweeps at least once a week and before and after important meetings These should include physical inspection of all office spaces and easily accessible wiring and use of the OSCOR the Automatic Mode for a RF sweep of the environment These can be performed by in house se
127. opping device If a signal is unique to a building it is important to determine the signal origin If the signal appears to be stronger in one office use the locator probe to locate the signal s origin This method of comparing signal strength is similar to the method described on page 72 Pre Loading Signals into Memory Transmitter Harmonics Most RF bugging devices are designed to transmit at a single primary frequency also called the fundamental frequency However due to size and cost constraints most RF bugging devices do not contain a sufficient amount of filtering and therefore will radiate at several harmonically related frequencies These recurrent signals are typically at some multiple of the fundamental frequency For example a bug that is radiating at 110 MHz may also radiate at 220 MHz 330 MHz 440 MHz or 550 MHz The signal strength of each successive harmonic signal will normally decrease with increased frequency and eventually diminish completely With the OSCOR scanning in the Automatic Mode each harmonic signal will be detected as a new threat If the harmonic is stable and accurate OSCOR s automatic software will calculate and label the presence of the harmonic H1 H2 etc Some transmitting devices containing a lower frequency oscillator and multiplier generate sub harmonics at frequencies multiples of the internal oscillator not fundamental frequency For example one wireless microphone on the commercial market
128. orm manual and automatic operations the upcoming section entitled SECTION 4 CONDUCTING A SWEEP that begins on page 71 provides recommended guidelines for using the OSCOR to perform a sweep In either the Automatic or Manual Mode the basic detection approach of the OSCOR consists of four steps Operational Step OSCOR Mode Identification of the signal using SWEEP spectrum analyzer sweep functions Analyzing the Signal ANALYZE Classifying the Signal CORRELATION Locating the Signal Triangulate Mode or Locator Probe In the Automatic Mode the OSCOR will continuously scan all selected inputs automatically seek to each received signal analyze each signal for audio information and perform audio correlation to evaluate the threat In contrast the Manual Mode allows full user control of the system for detailed study or verification of suspicious signals The Manual operation is made easy by specialized functions such as automatic switching of antenna array elements seek to next signal capability and one touch toggle between Sweep Mode Analyze Mode and Correlate Mode Setting up the System Each OSCOR unit comes from the factory configured for most standard operations Most users will never have the need to access this menu except for setting the internal clock and setting up security protection This menu addresses the following options e Manual control of the battery charging function and display of cu
129. out the signals can be documented on the plot A wide plot of the frequency spectrum 15 useful for identifying and documenting signals when reviewing the database Suspicious Signals Any signals that are not readily identified as friendly should be further examined by testing for subcarrier or video content as described on pages 31 Tuning Subcarrier and 65 Detecting Video Threats If a signal is still a mystery try using the SPECT button see page 43 Oscilloscope Analysis Audio Spectrum Analysis Screen to visually inspect the variations in the signal There are digital signals such as digital pagers messaging systems and satellite communications that do not contain audio information These signals will have a characteristic digital sound that may sound either like noise or you may be able to hear digital tones when listening in the Analyze Mode If a signal is encountered that cannot be identified using any of the methods described above you may want to consider moving the OSCOR to several different locations throughout the building to see if the signal strength changes Generating plots of the signal in different locations is a useful way to compare signal strength REI OSC 5000 78 Section 4 Sweep Conduction Also the OSCOR can be taken outside 300 ft from the building to investigate the signal strength in the outside environment If the signal is still strong then the signal is common to the environment and probably not an eavesdr
130. p antennas that switch automatically All equipment folds into a highly durable attach style case High Sensitivity Digital Synthesized Receiver scans for audio 50 Hz 15 kHz radio frequency 10 kHz 3 GHz and infrared 850 1070 nM signals Audio Analyze Mode demodulates a received signal to audio and provides audio signal lock to support correlation Acoustic Correlator uses passive sound pattern matching to automatically detect a listening device e Strip Chart Plotter provides a graph of threat lists and all available signal analysis screens It also provides a hard copy of important data for future reference e Signal Database allows for the storage and recall of all detected signals Threat Location System aids with rapid threat recovery e Video Demodulators and Monitors allows viewing of covert video transmitters Computer Interface creates permanent database records and reports of signal information Computer interface also provides the capability to remotely control the OSCOR via modems osc 5000 7 Section 1 Equipment Description OSCOR Equipment Description This section provides an overview of the equipment and features of the OSCOR It does not cover OSCOR operation Main Panel NOK 10 11 12 13 FIGURE 2 MAIN PANEL POWER MODE turns on the unit and toggles the Auto and Manual Modes PROGRAM KEY allows easy software upgrades The plug in keys ar
131. plugged into the jack labeled HF UHF 3 Connect one end of the coaxial cable to the appropriate antenna connection in the connector tray and the other end to the locator probe To set up the locator probe hardware for signals from 3GHz to 21 GHz You must have the MDC 2100 option for this procedure 1 Connect the MDC 2100 into the expansion port located on the OSCOR main panel 2 Press to toggle between the various antennas of the DownConverter 3 Place the OSCOR in the Analyze mode and select the desired signal Press the THREAT button to bring up the Threat Locator Menu 4 Press the FI button labeled Probeoff to turn on the locator function 5 Adjust the volume control to an acceptable level You should hear a buzzing sound 6 Adjust the squelch level indicated by a horizontal dotted line to the very peak of the signal When the squelch level is adjusted properly the buzzing sound will have a very low frequency pitch and may intermittently stop 7 Walk around the room while listening to the pitch of the buzzing sound As the locator probe is brought into the vicinity of the transmitter the frequency of the buzzing sound will increase with the signal strength To use the RF locator probe to locate an RF threat Select the signal of interest using the cursor in the Analyze Mode Press the THREAT button to bring up the Threat Locator Menu Press the F1 button labeled Probeoff to turn on the locator function Adjust t
132. prove to be very useful when trying to determine the location of transmitter within an environment You may wish to compare the RF spectrum of one room to another room It is also useful when looking for snuggle bugs and comparing the real time spectrum with the integrated spectrum To Display the Integration spectrum data 1 Ensure that the OSCOR is in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Utilize the and F2 buttons to select the two display modes that you wish to compare 4 Press the button labeled DIFFERNC to turn on the Difference mode Note There must be two images selected using the F1 and F2 buttons to access the difference mode Also you may turn on the difference mode exclusively using the F3 button and pressing until the label reads DIFFERNC ONLY Analyze Mode The Analyze Mode changes the operation from a sweep function to a single frequency signal analysis Specify the frequency of interest with the cursor controlled with the Rotary Dial or the numeric keypad The Analyze Mode will demodulate a signal to audio display a refreshed signal profile and indicate specific conditions prior to correlation REI OSC 5000 28 Section 2 Detecting Video Threats Technical Note Modulation is the process of converting a normal signal to a radio frequency suitable for transmission demodulation is the process of converting a transmitted signal from its modulated form back to its original signa
133. r a tap exists Nonetheless there are ways to tap a phone that result in practically no reflection Non Linear Junction Detectors A Non Linear Junction Detector NLJD is a device designed to detect the semiconductor junction which is a non linear junction that resides in diodes and transistors The typical NLJD consists of a transmitter a receiver and a wand that contains a radiating antenna and a receiving antenna When a semiconductor device is radiated with a 900 MHz signal the semiconductor device will resonate and radiate harmonics at 1800 MHz but not at 2700 MHz The presence of a high second harmonic indicates the presence of a semiconductor junction The presence of harmonics at 2700 MHz but not at 1800 MHZ indicates a metal junction that is not associated with semiconductor devices Since all junctions either metal or semiconductor are not perfect semiconductor junctions will have a low level third harmonic and metal junctions will have a low level second harmonic Therefore the sensitivity and accuracy of the Non Linear Junction Detector are critical Note The second harmonic is defined as two times the fundamental frequency for a fundamental frequency of 900 MHz the second harmonic is defined to be 1800 MHz and the third harmonic is 2700 MHz The disadvantage of an NLJD is that it is sometimes difficult to distinguish a semiconductor junction from a corrosive metal junction For example if two nails within a wall are touch
134. rget environment During the meeting the OSCOR can be locked in a closet running in the Automatic Mode printing and storing all threats for later review or a security person may use the OSCOR in Manual or Automatic Mode to watch for transmitters during the meeting When monitoring a meeting in progress you want to detect a threat very quickly The following suggestions should speed up the detection process The Automatic signal detection method should be set to either FASTSKIM or MED HUNT someone is wearing a body bug it will probably be relatively high power in order to ensure that a strong signal is being received at the remote listening or recording post Setting the OSCOR at a higher squelch threshold level FASTSKIM or MED HUNT will speed up the automatic search process known signals should be stored the memory as friendly signals by first allowing the OSCOR to run in the Automatic Mode long enough to complete sweeping all inputs Manually the user should review each signal using the recall functions and tag all known signals as friendly see page 78 Suspicious Signals or use the procedure described on page 72 Pre Loading Signals into Memory The Whip Hi and Discone should be the only input scanned while monitoring a meeting in progress This frequency band will cover most all body bugs and will minimize the time spent scanning the entire set of inputs REI OSC 5000 82 Section 6 Testing the Telephone SECT
135. ro cassette recorder to record received audio for later review or proof of an eavesdropping device OIF 5000 Interface special option that provides 10 7 MHz IF output Storage Compartment and Accessories FIGURE 5 STORAGE COMPARTMENT The built in accessory storage area contains specific locations for connectors and accessories The above photo illustrates the standard product placement determined by size and weight osc 5000 13 Section 2 Detecting Video Threats If you desire to add other items or change the location of items you must consider the following e Heavy items should be placed toward the bottom to prevent an unbalanced condition tems protruding too far above the die cut foam may damage the elements on the antenna array WARNING Antenna Array damage can occur if packaged improperly Be sure to replace each item as suggested above Do not force when closing Note The storage compartment shown might be different from others due to the standard and or optional accessories chosen Please contact REI or your dealer for a current list of available accessories See page 14 for placement of accessories in the storage compartment The OSCOR accessories described in this section will all fit inside the OSCOR storage compartment The figure below illustrates the placement of these accessories ICABLE GUARD CUT AWAY VIEW ANTENNA VLFIMF HF UHF VIDEO EXTERNAL CONTROL INPUT INPUT OUT
136. rrent mode e Custom menu Set clock Set units metric English e Specify job name e Establish password access control e Resetting the OSCOR using the Reset Button REI OSC 5000 18 Section 2 Detecting Video Threats To turn on the OSCOR press the AUTO MANUAL button located near the bottom left of the main panel The System Set Up Menu can be entered from the Sweep Mode the Analyze Mode or the Correlate Mode by pressing the MENU button twice To perform these functions To set the clock set date and time 1 In the System Set up Menu press the F4 button labeled CONFIG CUSTOM 2 In the Master Config Menu press the button labeled REALTIME CLOCK 3 Under Time of Day Press F1 to set the time and F2 to toggle the time format 12 24 hour 4 Press F4 to set the date To change the units 1 Inthe System Set up Menu press the F4 button labeled CUSTOM 2 Press the F3 button labeled DISPLAY OPTIONS 3 In the Custom Config Menu press the F3 button labeled UNITS METRIC ENGLISH the units will toggle between METRIC and ENGLISH To specify a Job Title to label all plots associated with a job 1 In the System Set up Menu press the F4 button labeled CUSTOM 2 In the Custom Config Menu press the F2 button labeled EDIT JOB TITLE and follow on screen instructions for labeling To establish password access to the OSCOR unit 1 In the System Set up Menu press the button labeled PASSWORD SECURI
137. rt of the OTL See page 45 Locating the Threat Adjusts the delay time from 0 1 to 99 seconds using the MENU button to access the Squelch Menu Tone Ringer System The OSCOR has a built in ringing system designed to mimic a telephone ringer This ringer can be used for several functions e To provide a reliable sound source to confirm threats when using the Correlator Mode manually see page 44 Correlate Confirm Mode e To provide an audible alert in the Automatic Mode see page 61 Automatic Mode Audible Alert e To provide a sound source for the Verify and Active correlate methods in the Automatic Mode see page 63 Correlate Acoustic Correlator System Automatic There are three volume levels for the tone ringer system LOW MEDIUM and LOUD To set the volume of the tone ringer system 1 Press the TONE button this will automatically turn on the ringer to allow you to monitor the volume and open a Tone Alert Volume Menu 2 Select the desired volume by pressing labeled LOW F2 labeled MEDIUM F3 labeled LOUD To stop the ringing REI OSC 5000 42 Section 2 Detecting Video Threats Press the TONE button or the F4 button labeled SILENCE The MENU button will exit the menu but will not terminate the ringer Oscilloscope Analysis Audio Spectrum Analysis Screen The SPECT button in the audio panel switches the display to the Audio Spectrum Analysis Screen This is an oscilloscope style di
138. s and a receiver used to trace the conductors The most common model is called the Fox and Hound wire tracer This may be used to trace any suspected wires to discover its function The physical search should include but does not have to be limited to Taking apart all electrical outlets to search for carrier current or RF transmitters Investigating all hollow objects especially if AC powered such as lamps clocks and calculators Taking apart all phones and fax machines if possible to look for any suspicious wiring or modifications Opening computer printer and fax machine cabinets to search for suspicious wiring or circuitry Checking all window drapes carefully for devices hidden in seams use metal detector Searching through all drawers in desks or filing cabinets Checking all baseboards for suspicious wiring or tampering Also check along the carpet edge Searching behind all hanging pictures use metal detector Searching behind all bookshelves books and bindings use metal detector Identifying and verifying all wiring associated with computers lamps clocks radios speakers and telephones Removing any unused wiring that may present an opportunity to an eavesdropper OSC 5000 77 Section 4 Sweep Conduction Looking above all ceiling tiles and identifying all wiring in the ceiling space e Identifying all wiring under crawl spaces e Checking the sound transfer through heating and cooling vents
139. s are turned on when testing the RF Loop antenna The loop antenna will pick up and display several harmonic signals from a video monitor Checking For Carrier Current Threats Check every outlet for carrier currents using the AC VLF probe the OSCOR power cord An extension cord is a useful tool for this procedure Even within the same room electrical outlets may be on different circuits and may not transmit carrier current if the building is large and the electrical circuits are transformer coupled Each electrical outlet should be taken apart for inspection The OSCOR AC power cord can also be used to test for carrier current signals on any pair of conductors less than 250 volts using the VLF adapter probe in the OSCOR case This is a 6 in cable assembly with alligator clips on one end and a female power socket on the other Before testing an unidentified pair of power conductors a voltmeter should be used to measure the voltage across the conductors If this voltage exceeds 250 volts do not test with the OSCOR If the voltage exceeds 120V switch the OSCOR power switch to 230V to provide extra protection against over voltage To test miscellaneous conductors for Carrier Current 1 Besure the conductor voltage does not exceed 250V using a voltmeter 2 Place the OSCOR in the Sweep Mode with the AC VLF input displayed 3 Press SHIFT then EXPAND to ensure that the maximum frequency window is displayed 4 Visually inspect the display for
140. s not lock in on any single frequency the demodulators are only important in the Analyze Mode see page 31 Demodulators F4 switches the 20dB RF Attenuator see page 25 Receiver Attenuator on or off at the active whip and VLF MF input MENU provides access to mode configuration and system setup REI OSC 5000 20 Section 2 Detecting Video Threats fmm 97 8000 1565 Gom SWEEP WHIP HiF 250 kHz JFM WIDE ATTN OFF ICONFIG FIGURE 7 SWEEP MODE SCREEN DISPLAY Receiver Bandwidths The OSCOR receiver is designed to receive three different Intermediate Frequency IF bandwidths The IF bandwidth refers to the frequency window that is received when the receiver is tuned to a specific frequency For example normal FM radio stations have a regulated bandwidth of 200 kHz This means that a radio station at 98 MHz actually deviates from 97 9 MHz to 98 1 MHz Note 1 000 kHz 1 MHz Therefore when the OSCOR is tuned to a frequency of 98 MHz and the IF bandwidth is 250 kHz the OSCOR is actually receiving everything from 97 875 MHz to 98 125 MHz The OSCOR bandwidth of 250 kHz provides adequate bandwidth for the normal radio signal with some margin to accommodate tuning inaccuracies The various bandwidths that are available with the OSCOR are designed for standard types of audio modulation Using a wide 250 kHz IF bandwidth will allow the tuning synthesizer to operate at its maximum speed This IF bandwidth is designed primarily for
141. sed as typical employees or business colleagues The sweep equipment is more effective if it is easily transported and disguised Understanding Threat Type Beforehand try to determine if the threat is internal or external An internal threat is more common but tend to be less sophisticated An External threat typically relies on inside help in planting devices and stealing company information Also try to discover the purpose of the threat and the cost of confidential information Understanding the type of threat can provide additional insight into the type and sophistication of the surveillance devices REI OSC 5000 70 Section 4 Sweep Conduction SECTION 4 CONDUCTING A SWEEP This section provides a general guide for conducting sweeps however the methods outlined are not the only ways the OSCOR may be used This section is not intended to be comprehensive instead it presents possible methods and procedures that may enhance the effectiveness and efficiency of a sweep Suggested procedure for a dedicated sweep 1 At a significant distance from the target building run the OSCOR in Automatic Mode with the correlation method set to LD FRND see page 72 Pre Loading Signals into Memory Note If you have generated and stored friendly signals using the OSCOR PC Interface 10 11 12 13 14 15 software instead of this step simply download the stored signal from your Before entering the target room manually
142. selected using the F1 button Press the THREAT button to bring up the Threat Locator Menu Press the F1 button labeled Probeoff to turn on the locator function Adjust the volume control to an acceptable level Adjust the squelch level indicated by a horizontal dotted line to just above the noise threshold at 40 kHz With the loop antenna manually sweep over any object that may contain a tape recorder The loop antenna needs to be within about 3 ft for good signal reception NAMA Note Not all models of tape recorders contain a bias oscillator therefore some models of tape recorders may not be detected by these means see page 90 Tape Recorder Detectors To locate Low Frequency RF 1 Remove the loop antenna from the antenna panel using the two thumbscrews on the panel 2 Patch the separated loop antenna to the antenna panel using the 12ft 3 5mm patch cord located in the cord tray Tune the cursor to the signal of interest and place the OSCOR in the Analyze Mode Press the THREAT button to bring up the Threat Locator Menu Press the F1 button labeled Probeoff to turn on the locator function Adjust the volume control to an acceptable level You should hear a buzzing sound Adjust the squelch level indicated by a horizontal dotted line to the very peak of the signal If the squelch level is adjusted properly the buzzing sound will have a very low frequency pitch and may occasionally stop 8 Walk around
143. signals Tune to any signals of interest and evaluate the signals for threat potential WARNING Exposing the AC VLF probe to an excessive voltage more than 450 volts DC may cause damage to the power circuit Setting Up For Automatic Operation At the beginning of a sweep the OSCOR should be placed in Automatic Mode and allowed to operate for at least two passes This section provides some recommended approaches for REI OSC 5000 75 Section 4 Sweep Conduction operating the OSCOR in the Automatic Mode when performing a sweep While the OSCOR is in the Automatic Mode a physical search of the area can be performed to increase sweep efficiency Using the OSCOR in this manner provides two important functions 1 Allsignals will be stored in OSCOR memory and can be reviewed manually 2 Any eavesdropping transmitters should be found during this initial sweep of the RF spectrum Notes The recommended inputs in automatic scanning for most environments in a dedicated sweep are the WhipLo and WhipHi For a recommended procedure for sweeping the other inputs see page 75 Manually Sweeping Selected Inputs The Whip and Discone antennas cover from 500 kHz to 3 GHz which easily encompasses the majority of the expected threats In order to use the OSCOR in a covert mode the correlate method should either be PASSIVE or VERIFY see page 63 Correlate Acoustic Correlator System Automatic The Passive Mode is completely covert but
144. since it relies only on the ambient sounds in the environment it is necessary to use a sound source for good correlation The Verify method of correlation relies on passive sound pattern matching to detect a threat If a signal achieves a sufficient threat level using the passive sound pattern matching then a ringer is sounded and correlation analysis is repeated to verify the threat level This ringer provides a more reliable means of performing correlation and it is still somewhat covert since the ringer is designed to sound like a telephone ringer and should not be activated often e When performing a dedicated sweep it is important not to overlook any signals The search level should not be set to FASTSKIM The MED HUNT level is recommended To ensure that all potential threats are identified the threat level should be set to 3 The threat level is set low to ensure that potential threats are not ignored The Autoplot List Mode should be activated to provide a hard copy of all potential threats The Autoplot Chart is also useful when reviewing potential threat signals but plotting the full graphical chart does take additional time and paper of the important information is stored in the normal threat listing The Physical Search The best countersurveillance equipment will always be the human eye While the OSCOR is operating in the Automatic Mode the best way to spend your time is physically searching the environment for surv
145. sition to provide a gap for the paper Note Thermal paper should be stored in a dark room at an average temperature less than 25 degrees Celsius and a relative humidity less than 65 Under these conditions new paper remains usable and printouts in a logbook remain legible for at least 5 years For optimum print quality and thermal head life use SEIKO part No TP201 211 25C 57 5 mm X 25 M thermal paper or contact REI REI OSC 5000 53 Section 2 Detecting Video Threats Miscellaneous Functions SHIFT Functions The SHIFT button provides access to a variety of functions that are seldom required but sometimes useful These functions have been added at the request of various users throughout the history of the OSCOR These functions are listed in table in the quick reference guide at the back of the manual Note To use the shift functions press the SHIFT button release it and then press the next desired button OSCOR accepts only one command at a time therefore pressing both buttons at once will not provide the desired result Freeze Screen There are many cases when you may wish to freeze the OSCOR display In most of the normal operation modes sweep oscilloscope analysis etc this may be performed by one of the following methods To freeze the OSCOR Display 1 Press the SHIFT button 2 Press the IMAGE button 3 To un freeze press any key To freeze the OSCOR Display in many modes 1 Press the MENU button l
146. splay of the input waveform It allows visual inspection of received audio and can be helpful when identifying video and digital transmissions In this mode high frequency digital signals may have very little signal level due to the limited sampling frequency of the OSCOR microprocessor To enter the Audio Spectrum Analysis Screen press the SPECT button To configure the Audio Spectrum Analysis Screen 1 In the Audio Spectrum Analysis Mode press the MENU button labeled CONFIG 2 Press F1 to toggle the Peak Audio Level Display mode 3 Press F2 to access the Video Control Menu 4 Press F3 to toggle the trigger mode The trigger mode is similar to the trigger control on an oscilloscope Press F4 to freeze the screen Use the EXPAND NARROW buttons to control the time spectrum of the display Use the UP DOWN buttons to control the vertical display size NAM Acoustic Correlator System Manual The acoustic correlator system allows the OSCOR to recognize a signal as an eavesdropping device It compares complex sound patterns arriving from the reference audio system and received audio channels In a typical environment there are many passive sounds such as talking music and air conditioner When OSCOR hears the same acoustic information on both the reference and the received channels the threat level increases The correlator can be used in either the Manual or Automatic Mode of operation To prepare the correlator system for use i
147. t it vibrates the receiver unit at acoustic frequencies and modulates a false signal into the receiver Correlator Configuration Pressing the MENU button labeled CONFIG enters the Manual Correlator Menu In this menu the following options are available e Press and F2 to adjust the Correlator Screen scan time The available times range from 3 to 60 seconds Press the F4 button to freeze the correlation screen Locating the Threat Once a signal has been identified as an eavesdropping device or a video transmitter the next step is to locate the threat signal Locating Magnetic Tape Recorders and Low Frequency RF 10 kHz 500 kHz Low frequency magnetic signals emitted from tape recorders are typically very low powered The OSCOR has two modes of operation for the loop antenna the RF Loop mode 10 kHz to 500 kHz and the Tape Rec mode Loop antenna tuned for 32 5 kHz 45 kHz to pick up the bias oscillator within the tape recorder see page 90 Tape Recorder Detectors Note The Tape Rec Mode is only available when operating in the Manual Mode REI OSC 5000 45 Section 2 Detecting Video Threats To locate a tape recorder 1 Remove the loop antenna from the antenna panel using the two thumbscrews on the panel 2 Patch the separated loop antenna to the antenna panel using the 12ft 3 5mm patch cord located in the cord tray 3 Place the OSCOR in the Analyze Mode using the SWEEP ANALYZE button with the TAPE REC input
148. t the AUTOATTN not be used in conjunction with Automatic Mode operation because it slows down the automatic operation ATTN ON is the recommended setting Note When connecting external sources that do not have their own speakers be sure the volume on the OSCOR loudspeaker is loud enough to be detected by any eavesdropping device that may be in the room Note The headphones must be unplugged to patch an external sound source through the OSCOR speaker see page 42 Headphones REI OSC 5000 40 Section 2 Detecting Video Threats Audio Attenautor The Audio monitoring system has a built in audio attenuator which is used to prevent the audio circuitry from being overloaded by strong audio inputs primarily from the EXT REF jack The audio attenuator control has three modes of operation ATTN ON and ATTN OFF Audio Filter The Filter selects either a wide frequency audio response 20 Hz 15 kHz or voice band filter 300 Hz to 3000 Hz and will reduce many types of audio interference The audio filter affects the speaker and headphone outputs only The FILTER button on the keypad controls this filter To toggle the audio filter mode press the FILTER button This button toggles the audio filter on or off which is indicated in the center left of the top of the display as SPEAKER FILTER ON or SPEAKER FILTER OFF Volume Control The volume control increases or decreases received or monitored audio levels to the internal speaker or hea
149. tes the average of the threat correlation over the specified time window This average threat level is stored in memory along with other signal information Verify Correlation In the Verify Mode the correlation process functions exactly like the Passive Mode with an additional ringer tone to ensure that the threat signal is real In the Verify Mode the OSCOR provides an audible ringer tone at the completion of the passive correlation for an additional correlation check Since the ringer tone is used internally as the reference audio the correlator sensitivity is further increased improving threat detection and providing confirmation that an eavesdropping device exists Note Since this mode provides an audible tone it may not be considered covert by some standards However the tone is designed to sound like a telephone ringer and in most situations the ringer tone will be broadcast only a few times during a sweep Active Correlation In the Active Correlation Mode there is no Acquire and Analyze using passive operation Instead the OSCOR broadcasts an audible tone for 3 seconds during the correlation process of each signal This mode of operation is definitely not covert but it is very reliable and fast since it uses a known signal for correlation and needs only 3 seconds to study each signal REI OSC 5000 64 Section 2 Detecting Video Threats Detecting Video Threats When the OSCOR was developed the threat of covert video s
150. the Automatic Mode Set Up Menu Note With the OSCOR in the Automatic Mode each signal detected is stored in the OSCOR memory To enter the Correlator Set Up Menu 1 From the CONFIGURE AUTO Menu press the F4 button labeled 4 START AUTO 2 Press the F2 button labeled CONFIG CORR CORRELATOR FRIENDLY LOADED PASSIVE 2 04 09 41 CONFIRM CORRELATION TIME THREAT MANUAL METHOD ACQUIRE ANALYZE ALERT AT RESUME PASSIVE 3 Sec 30 Sec LEVEL 3 FIGURE 27 AUTOMATIC MODE CORRELATOR SETUP MENU In this menu the following buttons perform the indicated functions F1 toggles the Correlate method between LD FRND PASSIVE VERIFY and ACTIVE These methods are described in detail in the following sub sections F2 toggles the Correlate ACQUIRE time window between 3 5 and 10 seconds F3 toggles the ANALYZE time window between 10 30 and 60 seconds F4 toggles through the available threat alert thresholds 2 3 4 or 5 Note The ACQUIRE function is only applicable to the PASSIVE and VERIFY methods of correlation Note The ANALYZE function time selection is only applicable to the PASSIVE and VERIFY methods of correlation When a threat signal is detected in the Automatic Mode of operation and the threat level exceeds the specified level the alarm system is activated This OSC 5000 63 Section 2 Detecting Video Threats alarm system activates the output options specified in Outputs on page 60 The sens
151. the profile screen 5 Use the UP DOWN buttons to tune the subcarrier receiver between 10 kHz and 250 kHz The signal line within the subcarrier screen will show the actual level of a subcarrier and centering will be indicated by a gt LOCKK lt condition Note The lock function will only work when the subcarrier tuning is within the bandwidth of 15 or 6 kHz Note For very low frequencies 10 35 kHz many FM radio stations may bleed through to the sub carrier demodulator It should be obvious if the bleed is coming from the main radio signal by toggling to the FM demodulator and comparing the audio content to the sub carrier demodulator Auto Fine Tune SEEK LIMITS button located below the SWEEP ANALYZE button performs an automatic fine tune AFT operation This is a particularly useful mode when manually tuning a signal because the OSCOR will automatically lock on a signal and if the signal drifts in frequency the AFT function will track the signal The AFT function is identified on the ANALYZE screen by the LOCK indicator between the two graphs If the AFT function has been activated the LOCK indicator is replaced with the following gt gt lt lt this indicates that the AFT function is turned on and active The AFT function is turned off immediately when the rotary dial or any other controls are activated that affect frequency control Also vertical dotted lines on the screen will indicate the frequency ran
152. the room while listening to the pitch of the buzzing sound As the locator probe is brought in the vicinity of the transmitter the frequency of the buzzing sound will increase with the signal strength NAMAM Note It is important to remember that if the OSCOR speaker is used to broadcast the buzzing sound the unit is not covert Anyone using an eavesdropping device could hear the locator buzz To use the loop antenna in a covert mode the headphones can be used in conjunction with the loop antenna Locating RF Threats 500KHz to 21GHz The RF locating system works on the principle that as the receiving antenna is moved closer to the signal transmitter the signal strength will increase Since it is impracticable to move the OSCOR unit around the room the OSCOR case contains a locator probe antenna and coaxial cable designed specifically for this purpose The OSCOR must be in the Analyze Mode since the locator probe uses signal strength to locate the signal see page 28 Analyze Mode REI OSC 5000 46 Section 2 Detecting Video Threats To set up the locator probe hardware for signals from 10KHz to 3GHz 1 Remove the coaxial cable with BNC connectors on both ends from the storage compartment 2 Disconnect either the VLF MF or HF UHF antenna connections from the connector tray Select the connection based on the signal frequency Frequencies below 5 MHz should be plugged into the jack labeled VLF MF Frequencies above 5 MHz should be
153. thod of detecting low power signals but it has the slowest sweep time and may detect false signals bumps in the noise If the OSCOR is to be used for a very thorough sweep the Deep Dig Mode should be used However most bugs that have sufficient power to reach a receiving station within 50 yards approximately 50m are of sufficient power to be easily detected by the MedHunt Mode Load Friendl Pressing the F3 button in the Automatic mode main menu screen brings up a menu to build a Friendly signal database In this mode the OSCOR will store every signal that is detected as a Friendly signal This mode is to be used away from the target sweep environment so that the OSCOR can be pre loaded with the majority of the ambient environment signals Note When the automatic mode is run in the normal mode searching for bugs signals that are labeled as Friendly are ignored unless the signal strength level has deviated by more than 5 CORRELATOR PLOT FRIENDLY LOADED PASSIVE OFF OFF 2 04 09 41 LOAD FRIENDLY CAPTURE ALL DATA EXIT START RESUME SPANS DELETE EDIT FIGURE 24 AUTOMATIC MODE LOAD FRIENDLY MENU To Start the Load Friendly process Press the button to start the automatic loading of Friendly signals This process will start at the beginning frequency of the first listed input Press the F2 button to start the automatic loading of Friendly signals by resuming at the last frequency that w
154. to the OSCOR PC Interface Software database Utilities These Utilities will allow you to automatically classify signals based on the standard frequency information alone Note This classification information should only be used as a guide for classifying friendly signals It does not correctly classify threatening signals REI OSC 5000 93 Section 8 Other Equipment POR EE te EES ENS AN ENT PEE x d i y 5 A RUN ACE cum OW TRI E Nt Sai AY iS LOGAN RA REND NNNM NS 51 NS BAG 5 2 8 22 222 The shaded represents the Tropical Zone as defined in Nos 406 to 410 and 411 FIGURE 31 REGIONAL FREQUENCY ALLOCATION MAP 94 OSC 5000 Section 8 Other Equipment Region 1 Data Start Stop Reg MHz MHz Classification 1 635 Maritime Mob Fixed Land Mob i 14 99 15 01 Standard Freq Time Signal 2 045 Fixed Mobile 2 045 Maritime Mob Fixed Land Mob 15 01 Aero Mobile 2 6 Maritime Mobile 3 2 1905 Mobile distress and calling 16 36 16 36 17 41 Maritime Mobile N N Un N DIE EN 2 Maritime Mobile 94 2 498 Fixed Mobile exc aero mobile Standard Freq Time Signal Un m Fixed Mobile Maritime Mobile Mari Radio nav 18 03 18 052 Fixed Mobile 18 052 18 068 Fixed Space Research Aero Mobile Fixed Mobile exc aero mobile 16 168 18 78 Fixed Mobile exc aero mobile 18 78 Maritime M
155. ton repeatedly until the label reads PRIMARY or press the F2 button repeatedly until the label reads DOT IMG To Clear the Peak spectrum data 1 Ensure that the OSCOR is in the Sweep Mode 2 Press the MENU button labeled CONFIG 3 Press the F4 button labeled MANAGE IMAGES 4 Press the F2 button labeled Clear Comparison Span Memory PEAK 5 Press the button labeled DELETE to confirm deletion The peak display spectrum is continuously stored and updated in the unit Therefore it is important to Clear the Comparison Span Memory for analysis in each environment or to compare different rooms in the same environment This is significantly different from previous versions of the software Previous versions of the software reset the peak display data whenever the frequency display was altered in any way Integration Spectrum Display Most RF signals utilize a modulation technique that results in the frequency spectrum of the signal modulating significantly in real time This is obvious when looking at a FM modulated signal with a high speed analog spectrum analyzer Furthermore FM signals provide an excellent opportunity to hide a snuggle bug in the sides or skirts of the signal as described previously in this manual see page 21 Receiver Bandwidths While most snuggled transmitters can be easily viewed using the narrow bandwidths the OSCOR software provides an improved way of viewing these
156. tput information 3 Because harmonic receivers have the appearance of being scanning receivers people use them in the center of a room rather than walking around the room attempting to place the receiver close to a threat transmission The theory behind a harmonic receiver is good for countersurveillance However the design is greatly dependent on how much folding and scanning is actually done It is the opinion of the engineers at REI that harmonic receivers should not be used for countersurveillance unless the actual scanning frequency is greater than 200 MHz There are several harmonic receivers on the market including the Scanlock by Audiotel and the Ranger by Datong of these harmonic receivers a narrow scan range below 25MHz Broadband Energy Detectors A broadband energy detector is basically an electromagnetic field strength meter It is not a frequency tuned device but its performance may vary over a wide range of frequencies For example the CPM 700 designed and sold by RET has the ability to receive signals up to 3 GHZ However this unit receives all signals at once from 100 kHz to 3 GHz The strongest signal will display the predominate response Most inexpensive bug detection equipment falls into this category Broadband devices are easy to use inexpensive and effective for medium to high power bugs in controlled environments However in a big city environment with many high power radiating
157. tronomy Broadcasting Fixed Mobile Fixed Mobile exc Aero mobile Fixed Amateur Mobile Fixed Mobile Radio location Fixed Mobile Broadcasting Space Operation Fixed Mobile Broadcasting Fixed Mobile Maritime Land Mobile Satellite Aero Radio navigation Earth Exploration Satellite Radio Astron Space Research Meteorological Aids Fixed Meteorological Satellite Fixed Mobile exc Aero mobile Radio location Radio nav Sat Section 8 Other Equipment 99 Section 8 Other Equipment 1710 1930 2 2025 2120 Fixed Mobile Space Research 2 220 2200 Fixed Mobile Mobile Satellite 2 2200 2290 FixedSpaceRes Space Op 2 2290 2300 Fixed Mob Space Research 2 2483 5 2700 2700 2900 Aeronautical Radio navigation N osc 5000 100 Section 8 Other Equipment Region 3 Data Start Stop MHz MHz Classification 0 5265 0 535 1 6065 1 8 18 2 2 2065 107 2 17 1735 1905 2 1 8 2 10 N 194 2 3 495 505 2 85 3 155 3 155 Fixed Mobile exc aero Mob 7 3 2 1 3 34 roadcasti 3 5 3 9 3 95 i 4 4003 4 438 4 65 4 75 4 85 4 995 5 005 5 06 5 45 5 48 5 73 5 95 6 2 525 765 7 71 7 73 4 Fixed Broadcasting 7 71 73 81 FixedLandMobile 81 i 8195 8 195 Fixed Maritime Mobile Fixed Mobile Broadcasting 8 195 815 Maritime Mobile oo 9 04 9 5 99 9995 10 005
158. ucers are mounted on all walls and windows and the omni directional speaker is designed to be placed above ceiling tiles A single noise generator unit is used to drive the transducers and the speakers creating a noised perimeter surrounding the environment This approach avoids filling the environment with noise that will disrupt normal communication This system defeats bugs that may be in walls or above ceiling tiles but may not adequately defeat bugging devices that are inside the room A second product PNG 200 Portable Noise Generator is a pocketsize audio noise generator that be used for environment noise or mounted to walls and windows in a similar fashion to the ANG 2000 A kit of eight PNG 200 s is the size of a briefcase and can be quickly installed in a room with no tools or mounting hardware required Technical Note Many people feel secure when they have acoustic tile in their ceiling It should be noted that acoustic tile does not prevent sound from penetrating into the ceiling space it actually does just the opposite Acoustic tile allows sound to pass up into the ceiling space but prevents sound from coming back down into the room This provides better acoustics for the room but makes the ceiling tile an ideal location for bugging devices SECTION 9 STANDARD FREQUENCY INFORMATION This section provides information about the FCC published standard database frequency allocations All of this information is built in
159. ude the available range of the electromagnetic spectrum The bandwidths used for automatic operation are covered in Figure 9 Up to 100 additional frequency spans may be in memory Additional span or input parameters are described in detail on page 37 Sweep Span Storage These stored additional frequency spans can be recalled and or modified in the Manual Mode using the normal STORE RECALL functions The following chart shows the pre programmed default inputs and their associated frequency ranges Labeled Input Default Frequency Range RF LOOP 10 kHz 510 kHz WHIP LoF 500 kHz 5 5 MHz FIGURE 23 PRE PROGRAMMED STANDARD INPUTS The AC VLF Mode checks the power cord for carrier current signal The AC power cord can be plugged into outlets to check the AC power or the power cord may be used with the AC VLF adapter to check any unknown pair of wires see page 14 REI OSC 5000 57 Section 2 Detecting Video Threats infrared detector receives wavelengths between 850 1050 nm This covers the majority of available infrared transmitters The Automatic Mode operation contains an automatic squelch level setting The far left column of the sweep span list screen displays the automatic squelch level status for Automatic Mode operation The available selections are Span Off FastSkim MedHunt Deep Dig and ManSqulch These selections control whether the sweep span will be swept and how deep the search will be appl
160. udio to the correlator while the OSCOR is in another location see page 82 MONITORING A MEETING IN PROGRESS Speaker Monitoring Control The EXT button provides control of input to the OSCOR speaker Using this button the speaker can be configured to monitor the main audio from the receiver this is the default the reference audio system from either the built in OSCOR microphone or using an external reference sound source or sound from an external source These features allow the OSCOR s built in audio amplifier to be used for miscellaneous audio testing REI OSC 5000 39 Section 2 Detecting Video Threats The OSCOR can also use the external reference to directly feed a known sound source such as a tape deck or CD player into the correlator Plug an external source into the EXT REF input using a patch cord to automatically by pass the reference microphone and feed the external signal directly into the correlator system Once the external source is plugged in the OSCOR speaker can be used to output the reference signal The EXT REF jack is used to provide an input for an external reference sound source such as a remote microphone a music source tape deck or CD player or an intercom system see page 73 Activating a Known Sound Source Moreover you can plug the Balanced Audio Coupler using the Audio Patch Cord into the EXT REF input and connect it to the earpiece to listen to the normal phone sounds see page 83 Testing Telephone with
161. uplication of descriptions and instructions All instructions are printed in talics e Bolded words in instructions represent the button to push e Please pay close attention to the special Note Technical Note and WARNING cited throughout the manual osc 5000 6 Section 1 Equipment Description REI has developed the OSCOR with the following goals in mind Professional sweep teams need the best equipment available for reliable results but this equipment should be portable People with information protection needs should be able to own Countersurveillance equipment to use at their discretion Equipment should be a complete comprehensive package that is easy to utilize cost effective capable of monitoring the environment 24 hours a day and does not require extensive training With these needs in mind our developers have created the OSCOR 5000 Omni Spectral Correlator the most advanced Countersurveillance detection system on the market today The OSCOR is the only product that provides automatic reliable and cost effective protection for your business environment 24 hours a day The OSCOR is designed to detect major types of audio and video transmitters including RF carrier current and infrared The OSCOR Advantages Portable and Programmable continuously scans all bands and silently detects eavesdropping equipment Complete Package of Sweep Equipment includes a complete set of swee
162. urveillance was small due to limited availability and utility of such devices However in the past few years the chip camera has become a readily available commercial product These products may have a lens 1 32 in in diameter and may be hidden in walls lamps pictures etc The usefulness of covert video surveillance depends primarily on the type of information being acquired For example video cameras are used to gather information that requires physical observation evidence of burglary drug use sexual harassment or misconduct Nonetheless video cameras may be used for industrial espionage to observe presentations of marketing plans new product designs or personnel conduct The OSCOR Deluxe Package ODP 5000 includes a video demodulation capability with built in monitors This option allows the user to view the video image associated with any transmitted video signal By providing the camera s view the video threat is identified It is important to note that the demodulation formats are designed for the standard modulation formats AM for NTSC There are some video transmissions that use the scan rates and synch pulse but a different modulation method FM versus AM If the modulation method is non standard the OSCOR will usually be able to display the image but the quality will suffer significantly depending on the transmission Video Technical Background The OSCOR unit consists of a high sensitivity digitally synthesized rec
163. y band and can create a plot of the signal amplitudes as a function of frequency However a harmonic receiver operates on the principle that a large portion of the frequency spectrum maybe several Giga Hertz can be electronically folded into a narrow frequency spectrum maybe 20 MHZ It is this narrow frequency spectrum that is scanned for signals This approach works very well if the folded frequency spectrum is very wide maybe 100 MHz Advantages 1 It scans a very large frequency spectrum very rapidly 2 It has better sensitivity than a broadband receiver does see the next section in a low signal environment because it is a tuned receiver 3 Itis very effective when carried around the environment and placed in close proximity to all surfaces that may contain threatening signals REI OSC 5000 88 Section 8 Other Equipment Disadvantages 1 Due to the signal folding effect a signal common to the environment may fold top of a threat signal and completely mask it from detection The folding effect tends to multiply common signals in the environment Therefore in a high signal environment the harmonic receiver may not perform as well as a broadband receiver The probability of detecting a signal depends greatly on the location the number and the strength of the signals in the ambient environment 2 It is difficult to get an accurate frequency reading of the signal Most harmonic receivers do not provide a frequency ou
164. y analysis function also provides the ability to inspect the LO image in the OSCOR The LO image is a false image that is generated internally by a Local Oscillator in the OSCOR This LO image only impacts the WhipHi and Discone antenna inputs and the basic result is that if a very strong signal exist in one input it is possible for this signal to also occur in the other input at a significantly reduced level For example a very strong signal exists at 98 5MHz it is possible for a false image to occur at 1598 5MHz in the Discone input This image is not of significant concern except that it can cause some confusion when analyzing signals in the Discone frequency band To access the Harmonic Frequency Analysis 1 Ensure that the OSCOR is in the Analyze mode and that the desired signal is selected 2 Press the MENU button labeled CONFIG 3 Press the F4 button labeled FREQ ANALYSIS REI OSC 5000 33 Section 2 Detecting Video Threats 4 Us the FI F4 keys to perform various frequency analyses Press to return to the original signal Press F2 to tune directly to the first sub harmonic of the original signal Press to tune to the next harmonic of the original signal Press F4 to view the LO image of the original signal if in the WhipHI the LO image original signal 1500MHz if in the Discone the LO image original signal 1500MHz Note the frequency analysis menu is linked to a particular frequency being a
165. y recordings The magnetic field that is generated by the bias oscillator produces a weak signal at approximately 40 kHz For additional information see page 45 Locating Magnetic Tape Recorders and Low Frequency RF 10 kHz 500 kHz For the best devices on the market including the OSCOR the range for tape recorder detection is not much greater that 3 to 4 ft 1m However there are many microcassette recorders being produced in Asia that do not contain bias oscillators and are basically undetectable Tape recorders without bias oscillators do not produce high quality recordings and are not very effective for surveillance use But there are high quality tape recorders being produced specifically for surveillance They contain bias oscillators that are well shielded and are almost undetectable The simple fact 1s that tape recorders are a difficult problem and there are limited solutions Even with all the disclaimers provided above REI offers a product called the TRD 800 that is designed to detect tape recorders as well as RF transmitters The TRD contains a broadband detection circuit that is very effective against body wires This unit is smaller than a cigarette pack with an antenna that is designed to be worn on your wrist The concept is that when you shake hands with someone you are scanning them for an active tape recorder or body wire If a device is detected the TRD 800 will silently vibrate This unit has a range of approximately 1 to

Oscor Series 4 Manual.

Contents

Download Pdf Manuals

Related Search

Related Contents