The man leaned over his creation, carefully assembling the tiny pieces. This was the hardest part, placing a thin silver plated diaphragm over the internal chamber. The diaphragm had to be strong enough to support itself, yet flexible enough to be affected by the slightest sound. One false move, and the device would be ruined.

The man in this semi-fictional vignette was Lev Sergeyevich Termen, better known in the western world as Léon Theremin. You know Theremin for the musical instrument which bears his name. In the spy business though, he is known as the creator of one of the most successful clandestine listening devices ever used against the American government.

In 1920, while working on his dielectric measurement device, Theremin noticed that an audio oscillator changed frequency when he moved his hand near the circuit. The Theremin was born. In November of 1920 Léon gave his first public concert with the instrument. He began touring with it in the late 1920’s and in 1928, he brought the Theremin to the United States. He set up a lab in New York and worked with RCA to produce the instrument.

In 1938, with the Nazi threat growing stronger, Theremin returned to Russia.

Upon arrival in Leningrad, Theremin was imprisoned, suspected of crimes against the state. He found himself working in a laboratory for the state department. This was not an unusual situation. Aircraft designer Andrei Tupolev and missile designer Sergei Korolyov were two of many others who faced a similar fate.
It was during this time as a prisoner that Theremin designed his listening device.

A group of 10 to 15 year old boys from the Young Pioneer Organization of the Soviet Union arrived at the US embassy carrying a hand carved great seal of the United States of America.

The seal was given as a gesture of friendship between the US and Soviet Union. Harriman hung the plaque in the study of his residence, Spaso House.

The device, later known as “The Thing”, would not be discovered until 1952 — roughly seven years later.

The discovery of the great seal listening device is an interesting one. British broadcasters reported hearing American voices on the their radios in the vicinity of the American embassy. No Americans were transmitting though, which meant there had to be a bug. Numerous sweeps were performed, all of which turned up nothing.

Powering up his equipment, Bezjian began a sweep of the building. With his receiver tuned to 1.8GHz, he heard the bug’s audio, and quickly isolated the source in the great seal.

Close inspection of the carving found it had been hollowed out, and a strange device placed behind the eagle’s beak. No batteries or wires were evident, and the device was not powered through the nail which had been hanging the seal.

The great seal bug quickly became known as “The Thing”. It was a passive resonant cavity device, containing no batteries or other power source. It consisted of an antenna and a small cylinder.

Passive resonant cavities had been explored before, both in the US and abroad, but this is the first time we know of that was used for clandestine purposes. In his book Spycatcher, British operative Peter Wright claims that the US came to him for help determining how the device worked.

Regardless of who figured out the device, the method of operation is devilishly simple. The Soviets would sit outside the embassy, either in another building or in a van. From this remote location they would aim a radio transmitter at the great seal. The bug inside would receive this signal and transmit voices in the room on a second, higher frequency. It did all of this with no standard internal components. No resistors, no tubes, no traditional capacitors, or the like. There were capacitive properties to the mechanism. For instance, a capacitor is formed between the diaphragm and the tuning peg of the device.

While bugs of this type have fallen out of favor, the idea of “illuminating” a device with an external transmitter lives on. Check out [Elliot’s] description of the RageMaster bug from the ANT catalog here. Resonant cavities have found common use as well. Every microwave oven or radar system with a magnetron uses one.

http://hackaday.com/2015/10/19/tempest-a-tin-foil-hat-for-your-electronics-and-their-secrets/

Inspired by the contents of the leaked NSA ANT catalog, the NSA Playset project has produced an array of gadgets with capabilities similar to those employed by the spooks.

http://www.nsaplayset.org/

Back in 2013, the NSA ANT Catalog was leaked. This document contained a list of devices that are available to the NSA to carry out surveillance.

[Michael Ossmann] took a look at this, and realized that a lot of their tools were similar to devices the open source hardware community had built. Based on that, he gave a talk on The NSA Playset at Toorcamp 2014. This covered how one might implement these devices using open hardware.

This is a small video series hosted on YouTube aimed at experimenters and hackers covering topics related to amateur radio, homebrew electronics, test equipment, and other similar interests.

LOUDAUTO is an audio-based RF retro-reflector. It provides room audio from a targeted space using radar and basic demodulation and audio post-processing.

LOUDAUTO’s current design maximizes the gain of the Knowles EK/EY-series microphone. This makes it extremely useful for picking up room audio. It can pick up speech at a standard, office volume from over 20 feet away. Note that concealments may reduce this distance.

It uses very little power, approximately 15 µA at 3.0 VDC. So little, in fact, that battery self-discharge (internal resistance) is more of an issue for serviceable lifetime than the power draw from this unit. The simplicity of the design allows the form factor to be tailored for specific operational requirements. All components are Commercial Off-the-Shelf (COTS) and so are non-attributable to NSA.

Room audio is picked up by the microphone and converted into an analog electrical signal. This signal is used to Pulse-Position Modulate (PPM) a low-frequency square wave carrier signal running at around 100 kHz. This square wave is used to bias a microwave FET (Field Effect Transistor) on and off. When the unit is illuminated with an unmodulated Continuous Wave (CW) signal from a remote radar unit (CTX4000/PHOTOANGLO), the illuminating signal is Amplitude Modulated (AM) with the PPM square wave.

General overview of the NSA’s LOUDAUTO audio-based RF retro-reflector.

Thanks to [Edward Snowden] we have a huge, publicly available catalog of the very, very interesting electronic eavesdropping tools the NSA uses. Everything from incredibly complex ARM/FPGA/Flash modules smaller than a penny to machines that can install backdoors in Windows systems from a distance of eight miles are available to the nation’s spooks, and now, the sufficiently equipped electronic hobbyist can build their own.

[GBPPR2] has been going through the NSA’s ANT catalog in recent months, building some of the simpler radio-based bugs. The bug linked to above goes by the codename LOUDAUTO, and it’s a relatively simple (and cheap) radar retro-reflector that allows anyone with the hardware to illuminate a simple circuit to get audio back.

Also on [GBPPR2]‘s build list is RAGEMASTER, a device that fits inside a VGA cable and allows a single VGA color channel to be viewed remotely.