Eddy Wireless CMS-15 User manual

CMS-15
COUNTERMEASURES SET
INSTRUCTION MANUAL
The CMS-15 Countermeasures Set consists of the following instruments and
accessories:
1) TD-53 Advanced Transmitter Detector
2) P-01 Wideband RF Probe
3) P-02 Infrared Probe
4) P-03 Line Driver
5) P-04 Carrier Current/Video Camera Probe
6) TT-46 Advanced Wiretap Detector
7) Headphones
8) Various cords, adaptors and Padded Carrying Case
ABOUT THE TD-53
Size: 3.75” x 5.5” x 2”
Weight: 10 oz.
Battery: 9 volt alkaline- Use only alkaline batteries- carbon/zinc batteries will not give
satisfactory performance.
Current: 25 mA average.
Audio Output: Up to 100 mW, internal speaker or headphones.
Indicators:
METER – 10 step LED – Each step represents a 3 dB change in signal strength.
AUDIO – In the DETECT mode, an audible “click” will be heard. The clicking rate will
increase as the signal strength increases. In the VERIFY mode, audio picked up by
the bug may be heard. As the bug is approached, a high pitched squealing tone will
be heard.
Controls:
VOLUME – In addition to acting as the on/off switch, this control is used to change
the audio output level.
SENSITIVITY – Normally left in HIGH. The LOW position reduces the sensitivity by
12 dB.
MODE – In the DETECT position, a “clicking sound” will be heard in the speaker. In
VERIFY position, a squeal is heard if the probe is near a transmitting bug.
EARPHONE JACK – For non-alerting listening, use with 4 to 2,000 Ohm
headphones.
1

Probes: Several probes are available for the TD-53 that allows it to be used to locate
several different types of bugs. Currently available probes are:
P-01 - RF Probe, covers 5 MHz to 2.5 GHz.
P-02 - Infrared Probe, detects IR and laser bugs.
P-03 - Line Driver, detects hardwired microphones.
P-04 - Carrier Current and Video Camera Detector Probe.
P-01 SPECIFICATIONS
Frequency Response: Covers 5 MHz to 2.5 GHz. Most sensitive over the 30 to 170 MHz
range (this is where most of the bugs are).
GETTING STARTED
If the battery has not already been installed, install one now. Use an alkaline 9 volt battery.
To access the battery compartment, insert a flat blade screwdriver in the screwdriver slot at
the bottom edge of the front panel. The front panel will pop up. It may be necessary to
spread the sides of the case slightly. After installing the battery, replace the front panel,
pressing on its edges until it snaps into place.
Set the SENSITIVITY switch to “HIGH” and MODE switch to “DETECT”. Without the probe
plugged into the TD-53, turn the unit on. The meter should read “3” and a rapid clicking
sound will be heard. If the meter reads “2” or less, the battery is weak and should be
replaced for best performance. Turn the unit OFF.
Connect the probe by plugging it into the jack located at the hinge end of the unit. Be sure
the plug is completely seated in the jack. Now, turn the unit back ON. In low RF areas, the
meter will read “1” and a slower clicking rate will be heard. Extend the probe antenna to its
full length.
FINDING BUGS WITH THE TD-53
This section is not meant as a complete course on finding bugs, but it will give you some
idea of where to start and how to use the unit. We’ll be covering three main areas: the home
or office, telephones and vehicles.
HOME or OFFICE
Transmitters are frequently concealed in various household or office fixtures. The most
common are electric sockets or cube taps. In this configuration, normal AC power is
supplied directly to the transmitter which permits permanent installation. This means that all
lamps and appliances (radios, TV, clock, desk calculator, etc.) should be checked carefully.
Another type is the drop transmitter. These are used where quick installation is required.
Being battery operated, they have a finite operating life which requires that they be retrieved
for battery replacement or abandoned. These transmitters are often pre-concealed in
objects such as picture frames, pens, desk sets, cigarette lighters and ash trays.
Body transmitters are battery operated, usually with a higher output power than the drop
transmitter. They are designed to be carried into a target area on a person.
2

In using the TD-53 to find a planted transmitter, turn the unit on and set the VOLUME so
that you can hear the “clicks”. If you are in an area of high ambient RF (from radio or TV
transmitters), you may have to set the SENSITIVITY switch to “LOW”. Walk slowly around
the room while sweeping the probe (antenna) slowly up and down from ceiling to floor. Also,
turn on the various lamps and appliances as you come to them to activate any bugs that
may be wired in.
When an RF field is detected, the meter reading and clicking rate will both increase. (If
you’re very observant, you can hear an increase in the click rate before the meter steps to
the next level.) At this time sweep the probe from side to side to get a bearing on the
transmitter direction.
Once you have an idea of the area in which the transmitter is hidden, set the MODE
switch to “VERIFY” and turn the VOLUME up. Continue sweeping the probe. As you
approach the hidden transmitter a squealing tone will be heard. (If the increasing meter
reading was due to outside sources such as TV stations, this squealing will not be heard.)
At this point, you should have a good idea of where the bug is located. Conduct a physical
search, keeping in mind the information given in previous paragraphs.
In detecting a body transmitter, your subject would probably become suspicious if you
started waving the probe is his face. So, in a situation where a body transmitter might be
present, set up the unit ahead of time so that you or an assistant can observe the meter. (Of
course, you would keep the volume turned down.) The probe can be positioned up to 25’
away from the TD-53 by using an available extension cable. (For example - the probe could
be discreetly hidden in the target room, while the TD-53 is in another room.) If the meter
reading increases when your “friend” walks into the room, you’ll know to watch what you
say.
TELEPHONE
The telephone is suspect to many different eavesdropping attacks. Probably the best
policy is to not say anything over the phone that you don’t want the whole world to know
about. And, for goodness sakes, never say anything of a confidential nature over a cordless
or cellular phone.
Two basic types of radio bugs are available that will transmit both sides of the telephone
conversation. The series tap is installed in series with the phone line and draws its power
from the phone line. It can be installed inside the phone or anywhere along the line.
The parallel tap is placed across the line at any point or inside the telephone. It is usually
battery powered with the attendant limitations of battery powered bugs.
Both types can use the phone lines as an antenna and both are generally activated when
the phone is taken off-hook. To detect phone bugs with the TD-53, set up the unit as done
previously and fully extend the probe antenna. Place a call with the phone. (If you’ll dial the
phone’s own number, you’ll get a busy signal which can activate a VOX type bug.)
3

Then, sweep around the phone and its lines while watching the meter and listening to the
click rate. If these increase, hang up the phone. If they then decrease, you’ve got a pretty
good clue that you need to do some more checking. At this point, you would conduct a
physical search of the phone and phone line.
VEHICLES
While voice bugs can be installed in a vehicle, probably the most common type is the
tracking transmitter (bumper beeper). Most of these are the burst type which means that RF
is transmitted in short bursts rather than continuously.
These transmitters can be powered either by their own battery pack or by the vehicle
battery. The ones powered by the vehicle battery can have a much higher output power
and, of course, a longer useful life. The main advantage of the battery pack unit is that it is
very easy to attach.
To check a vehicle for bugs, turn the ignition on, but don’t start the engine. (Ignition noise
will thoroughly confuse the TD-53). Sweep around, under and inside the vehicle with the
probe.
Because of the limited brightness of the indicator LEDs, it would be better to do this away
from direct sunlight, if possible. Pay particular attention to the meter. Brief flashing at the
next higher level could indicate a bumper beeper.
SUMMARY & LIMITATIONS
The best way to become proficient with the TD-53 is to practice. A reasonable and readily
available practice transmitter is a child’s 49 MHz walkie-talkie sold by Radio Shack for $10
to $20 depending on the model.
For the most effective practice, get someone to hide the transmitter for you. The person
hiding the transmitter should be reasonable. As a practical matter, a spy is not going to hide
4

a transmitter inside a refrigerator or metal file cabinet. All that steel would cut down the
radiated signal.
Just tape down the transmit button, turn the unit on and have someone hide it. Then
practice finding the transmitter using both the DETECT and VERIFY modes.
One disadvantage of the TD-53 is that the clicking (in the DETECT mode) or the squeal (in
the VERIFY mode) can alert the eavesdropper that you’re on to him. For this reason, we’ve
provided an earphone jack (located on the side of the TD-53). Just plug in a set of
earphones and you’ll be able to hear the clicking in the DETECT mode with no trouble. In
the VERIFY mode, keep the volume turned down to protect your hearing in case a feedback
squeal is set up.
P-02 INFRARED PROBE
SPECIFICATIONS:
Field of View: 40 degrees
Spectral Peak: 940 nm (infrared)
Power Source: 9 VDC furnished by TD-53
THEORY:
Light beams, especially lasers, provide an excellent method for carrying audio intelligence.
The light beam can be visible or invisible (as in infrared). They can carry conversations for
long distances with most manufacturers claiming a range of several kilometers. And
importantly, modulated light attacks are often not considered by individuals performing
countermeasures checks. This can be a fatal oversight from a security standpoint.
The P-02 is a special probe, designed for use with the TD-53 Transmitter Detector, which
allows the technician to search for sources of infrared (IR) transmissions. In the case of
amplitude modulated or pulse frequency modulated sources, the technician can actually
listen and determine whether the beam is carrying voice or other intelligence.
Light beams carrying room audio can be very narrow. They can shoot through windows
and reflect off glass, metallic and other bright surfaces. This can be readily demonstrated
with a TV remote control device (IR). Try pointing it at different surfaces around the room
and notice how the TV can be controlled by reflections from some unusual places. Narrow
light beams are very directional (line of sight) – a point the countermeasures technician
should keep in mind.
Detection:
Insert the probe plug into the probe jack on the TD-53. Turn the Volume control ON and
set to about the 10 o’clock position. With the lens end of the probe covered, the LED meter
should read between 1 and 3. If the meter reads “0”, the TD-53 battery is weak and should
be replaced.
Any number of tests can be made to verify that the unit is working. In the Detect mode,
when the probe is pointed at incandescent or fluorescent lights, the meter will read upscale
and the “click” rate will increase. In the Verify mode, a hum or buzzing sound will be heard.
5

When sweeping for IR transmitters pay particular attention to window openings –
remember that light travels in a straight line. An unmodulated beam will cause the LED
meter to read upscale and (in the Verify mode) a rushing noise will be heard in the speaker
or headphone.
A modulated beam will also cause the meter to move upscale. In addition, some type of
audio will be heard in the Verify mode. Depending on the type of modulation, you will hear
either baseband audio or some type of tone. High speed data (above an audio rate) will give
a rushing sound.
The counter measures technician who disregards IR attacks does so at his/her own peril.
P-03 LINE DRIVER PROBE
ABOUT THE P-03
Size: 2.7” x 1.7” x 1.5”
Weight: 3 oz.
Power: Supplied by TD-53, 9 volts, current limited
Current: Limited to 8 mA maximum
Input impedance: 8K Ohms
Indications:
Red LED – Lights when more than 1.4 volts AC or DC is present on the wire pair
under test.
Green LED – When the Line Driver switch is operated, this LED glows if 400 uA or
more is being drawn by the wire pair under test. The more current that is drawn, the brighter
the LED will grow.
Controls:
LINE DRIVER/OFF – This switch applies a voltage to the wire pair under test to turn
on voltage activated microphones. Never turn this switch on if the RED LED indicated a
voltage present on the wire pair. If you do, the TD-53 and/or the P-03 may be damaged.
A/B – This switch reverses the polarity of the line connections for detecting DC
voltages and for reversing the polarity of the line driver voltage to aid in detecting polarity
sensitive devices.
THEORY
A common eavesdropping attack is the concealed microphone. This is simply a
microphone, hidden in the target area, which is connected by wire to a nearby listening post
(L.P.) or radio transmitter which relays the conversation to an L.P.
To find a concealed microphone during a countermeasures sweep, either the mic itself or
the wires leading to it must be found. This requires that all suspect wires running through or
adjacent to the target area be electronically inspected for the presence of room audio.
6

GETTING STARTED
On the P-03, set the LINE DRIVER/OFF switch to OFF. The A/B switch can be in either
position. Plug the P-03 into the probe jack on the top end of the TD-53. Plug the
headphones into the headphone jack on the side of the TD-53.
FINDING MICROPHONES
Detection of a concealed microphone and the L.P. to which it is connected can be a
tedious procedure, but is not technically difficult. Once audio is recovered on a wire pair, the
wire must be physically traced until both ends are found. Keep in mind that wires leading to
any loudspeaker in the target area (i.e. part of an intercom or Music system) can be
exploited by an eavesdropper. The reason is that loudspeakers can act just like
microphones. Use the following procedures to search for hidden microphones.
1. Turn on a sound source in the target room such as a radio. Next, turn on the
TD-53 and set the MODE switch to “VERIFY”. Ignore any indications on the LED meter.
Make sure the DRIVER switch on the P-03 is “OFF”.
2. Connect to P-03 alligator clips to the wires to be tested. If necessary, scrape
just enough insulation off the wires to expose them for the alligator clips. After the tests are
completed, cover the scraped areas with the electrical tape. NOTE: We DO NOT
recommend that you perform any tests with this equipment on AC power wiring.
3. Operate the A/B switch to both positions. If the red LED on the P-03 comes on
in either position, a DC voltage is present on the wire pair. If the LED is on in both positions,
an AC voltage is present. If a voltage is indicated, use standard safety procedures when
7

working with the wire pair. CAUTION: If either an AC or DC voltage is indicated, DO NOT
operate the DRIVER switch to the “LINE DRIVER” position.
4. Turn up the TD-53 Volume control to a comfortable level and listen for room
audio. If the line was “dry” (no voltage present), turn on the LINE DRIVER switch to apply
voltage to the wire pair. Also operate the A/B switch to both positions and listen for room
audio. Shield the green LED from room light and observe it for any glow of light. If you see
any light from this LED that means that current is flowing in the wire pair and a listening
device could be connected to the wires. The brighter the light, the more current that is
flowing.
5. Perform the above checks on any other suspicious wire pairs in the target
area.
6. FEEDBACK MODE for locating hidden microphones: Set up the test as
above, but don’t use the headphones. Turn up the Volume on the TD-53 to about the 3
o’clock position. If a hidden microphone is nearby, a feedback squeal will be set up in the
TD-53 speaker.
Once feedback is encountered, the hidden microphone can be located by reducing
the volume and pointing the speaker at different locations in the room.
NOTE: You should be aware that using the feedback mode to locate a hidden
microphone can alert the L.P. that the mic has been located.
7. A complete check of the target room would also include listening for room
audio on any telephone wires present. The reason for this is that a telephone can be
modified through a technique known as “hook switch bypass”. When so modified, the
telephone acts as a microphone and intercepts all room conversations and passes them
down the phone line even while the phone is hung up. If room audio is heard on the phone
line, the telephone should be checked for the hookswitch bypass attack.
P-04
CARRIER CURRENT/VIDEO CAMERA PROBE
ABOUT THE P-04
Size: 7.3” x 2.25” x 1.3”
Weight: 8 oz.
Power: Supplied byTD-53 and by internal 9 volt battery – replace with alkaline type –
Eveready 522 or equal. Current drain is 9 mA.
Frequency Range: 10 KHz and 50 KHz to 600 KHz in two ranges.
Antenna: Permanently attached Very Low Frequency (VLF). Indicators: Red LED – Lights
only when probe is plugged into TD-53 and Range switch is in the 10-130 position or 50-600
position.
Controls:
Range – 3 position switch – selects either 10-130 KHz, OFF or 50-600 KHz.
8

Tune – Tunes through both of the above ranges from low to high.
THEORY
Carrier Current Transmitters, marketed as “wireless intercoms” and “wireless room
monitors”, consist of a transmitter and sensitive microphone which intercepts room
conversations and sends them along the power lines to a receiver. Very little signal radiates
away from the power line. That is why a countermeasures sweep should include an
examination of power lines in the target room with a tune-able carrier current detector.
Most carrier current devices fall in the frequency range of 30 KHz to 500 KHz. The popular
wireless intercoms sold in electronics stores are usually set to operate between 150 KHz
and 300 KHz. The P-04 covers a wider frequency range than this to catch devices whose
operating frequency has been modified by the eavesdropper.
The P-04 can also be used to detect video cameras. These cameras have a horizontal
oscillator – most operate at 15.75 KHz- that radiates a signal that can be picked up and
detected by the P-04.
GETTING STARTED
If a battery has not already been installed, go ahead and install one now. Use Eveready
522 (alkaline) or equal. The battery compartment is accessed by using a flat blade
screwdriver and separating the top cover from the bottom cover. Connect the battery to the
battery snap and place in the holder. Reinstall the cover.
The P-04 Range switch should be “OFF”. Plug the P-04 cable into the probe jack on the
top end of the TD-53. If you plan to use the headphones, go ahead and plug them into the
TD-53 headphone jack.
FINDING CARRIER CURRENT DEVICES
Use the following procedures to check for carrier current devices on AC power lines:
1. Turn on a sound source in the target room such as a radio. Next turn on the
TD-53 and set the MODE switch to “verify” and the SENSITIVITY switch to “high”.
2. Ignore any reading on the TD-53 LED meter. Set the P-04 RANGE switch to
“10-130” and the TUNE control to “Min”. The power on LED on the P-04 should be on.
3. Turn on all appliances, lights, etc. that normally operate in the target room.
Position the P-04 antenna next to the line cord for all of the above appliances or lamps.
Remember that you are trying to pick up a low level signal that may be traveling along the
AC power lines. If the signal is there, it will also be present on any line cords that are
plugged in.
4. Slowly tune Range control from “Min” to “Max” and back again while listening
for the sound source.
5. Switch Range switch to “50-600” and repeat step 4.
9

6. If you hear the sound source through the TD-53 in either of the above steps,
there is a carrier current device operating on the line and you should try to locate it. To do
so, try unplugging appliances and lamps one at a time. If the sound goes away once the
cord is pulled on an item, you have located the transmitter. It could also be concealed
behind a switch plate or wall outlet. If so, you will have to search with the P-04 probe. As
you get closer to the device, the sound will become louder.
7. Carrier current transmitters are associated with power line attacks. You should
be aware, however, that telephone lines and other wire pairs can also be used. To check
these other wire pairs, simply place the P-04 antenna next to the pairs you want to check
and repeat steps 4 and 5 above.
8. For a complete check of the target room, repeat the above steps at several
different locations in the room. This will cover the possibility of two different power line feeds
to the same room.
10

FINDING VIDEO CAMERAS
To locate hidden video cameras with the P-04 use the following steps:
1. Turn on the TD-53, set the MODE switch to “Verify” and the SENSITIVITY
switch to “High”. Ignore any readings on the TD-53 LED meter. Set the P-04 RANGE switch
to “10-130” ad the TUNE control to “V”. The power on LED on the P-04 should be on. For
best results, we recommend the use of headphones with the TD-53.
2. Because they use the same horizontal frequency as video cameras, any
televisions in the area should be turned off. Otherwise, you will get false indications from the
TV.
3. Walk slowly around the room while sweeping the P-04 slowly up and down
from ceiling to floor.
4. If there is an operating video camera in the room, you will hear a low pitched
tone. As you get nearer the camera, the tone will get louder. When you are very close to the
camera (1 to 2 ft.), the pitch of the tone will change to a higher frequency.
The VLF antenna on the P-04 is directional with maximum signal pick up off the end of the
antenna. This directional characteristic can help you pinpoint the location of the video
camera. When you are receiving the tone, simply turn the P-04 so that the antenna faces
different directions. The direction of strongest pickup indicates the camera direction which
will either be from the front or the back. If the signal gets stronger as you move forward,
then the camera is to the front. Otherwise, it’s behind you.
11

Video cameras can be concealed in any number of places by using a pinhole lens.
These cameras are very small and can be hidden almost anywhere and in almost anything.
he TT-46 can detect both serie ched directly to the
on premises telephone line. It can also be
b
st single and two line phone
sy ed
on to the telephone instrument so that the carbon
microphone (transmitter) or dynamic earphone (receiver) will pick up room sounds and
p
tr
P – Usually a radio transmitter. Obtains power from the telephone line to
series (inline with one wire). Generally has a DC
re
tests can be done in any order, the manual lays out the most efficient procedure.
nstall a battery in the TT-46 (alkaline o eady been installed. To
access the battery compartment, insert a small
sl
rs: red/green and black/yellow. These four wires give six
p
TT-46 GENERAL INFORMATION
T s and parallel wiretaps that are atta
used to detect hookswitch bypasses that may
e installed inside the telephone.
It can detect series taps of 10 ohms or more and parallel taps with a resistance of 65
megohms or less. In a four wire cable (used with mo
stems) it can check all six possible wire combinations for taps or other tampering. List
below are definitions for several terms used in this manual.
BUG – Clandestine listening device.
HOOKSWITCH BYPASS – Modificati
ass them down the phone line to a listening post even with the phone hung up. Turns
the telephone into a bug.
PARALLEL TAP – Connected across both wires of a pair. Usually used to activate a
tape recorder. DC resistance ranges from 10 to 35 megohms. May also be a radio
ansmitter, in which case, a separate battery would be required for powering the
transmitter.
SERIES TA
which it is attached. It is installed in
sistance of 70 to 300 ohms. And although rare it can also be used to activate a tape
recorder.
WIRETAP – Clandestine interception of a telephone conversation. Operates when the
telephone is in use.
We recommend that you perform the tests in the order given in the manual. While the
USING THE TT-46
I nly) if one has not alr
flat blade screwdriver in the screwdriver
ot at the bottom of the face panel and pry up. The front panel will pop off. After
installing the battery, replace the front panel, pressing on its edges until it snaps into
place.
The telephone cable generally used as inside wiring for single and two line service has
four wires arranged in two pai
ossible pair combinations that should be checked (r/g, r/y, r/b, g/y, g/b and y/b). Through
the use of the various switches on the TT-46, you will be able to test all six combinations
for both series and parallel taps and other forms of tampering.
12

The following is a description of the functions of the switches and indicators on
the TT-46. Please refer to your unit for their locations.
MODE: Selects the type of test to be performed from the four below.
PARALLEL: Checks for taps and bugs wired across the pair. Can detect
resistances of 65 megohms or less.
SERIES: Checks for taps and bugs wired inline. Detects resistances of 10 ohms
or more.
VERIFY: Lets you listen to a wire pair for the presence of room audio.
DRIVER: Applies a voltage to a wire pair to turn on a voltage operated device
such as a FET microphone.
TEST 1/TEST 2: Reverses the connection to the pair under test. Useful for
detecting certain polarity sensitive devices.
PAIR: Selects one of six combinations for testing. All tests should be applied to
all pairs.
VOLUME: Combination switch/volume control for the audio amplifier used in the
Verify and Driver tests.
13

PARALLEL LED: Glows red if the Parallel test detects 65 megohms or less.
Glows green if the test is OK.
SERIES LED: Glows red if the Series test detects 10 ohms or more. Glows
green if the test is OK.
PUSH TO TEST: Use to apply the test to a wire pair in the Parallel, Series and
Driver tests. It has no function in the Verify test mode.
Connect the test cable by plugging it into the 5-pin jack located at the hinge end
of the unit. Be sure the plug is completely seated in the jack.
PARALLEL TAP TEST
1. Disconnect the inside wiring at the protector block or Telephone Network
Interface (TNI). The protector or TNI can be located inside or outside the
building and is the point of separation between the inside wiring and the
phone company line. Make a note of the wire colors and connections so
you can reconnect them properly when you are finished. With the TNI
simply unplug the modular plug to disconnect the inside wiring from the
phone line.
2. Disconnect all telephones, answering machines, etc.
3. Set the TT-46 switches as follows: Pair to “R-G” Volume to “OFF” Mode to
“parallel” and Test to “Test 1”. Connect the unit to the inside wiring at any
convenient point. If your building does not use modular jacks, it will be
necessary to connect the TT-46 using the coupler and cord with alligator
clips. Connect color to color, i.e., red to red, etc.
4. Push and hold down the PUSH TO TEST (PTT) button. The Parallel LED
should glow green. While continuing to hold down the PTT button, rotate
the Pair switch through all six positions. Then release the PTT switch.
If the Parallel LED flashed red briefly, some additional tests are necessary.
Here’s why - 100 feet of inside wiring has about .002 uF of stray capacitance
between any two wires. This stray capacitance could cause the LED to briefly
flash red.
To check for the presence of a capacitively coupled parallel wiretap, press
and hold down the PTT switch again. Rotate the Pair switch through all six
positions from R-G to Y-B and back again four times without releasing the
PTT switch. If any of the pair combinations still flash red, that is an indication
of a capacitively coupled tap.
Using this test method, the stray wiring capacitance is charged by the test
set and that charge will remain for a period of time, but a capacitively coupled
tap will discharge between rotations of the pair switch, causing the LED to
flash red.
5. Do the same tests as #4 above with the Test switch in the Test 2 position.
6. Leave the TT-46 and inside wiring set up for the Parallel test and perform
the Verify test.
14

WIRE PAIR VERIFY TEST
In this test mode you will check the inside wiring for room audio that could
be present if a microphone is attached to one of the wire pairs. Technically,
this would not be a wiretap, but a bug. However, the result is the same – your
confidential information is passed on to a listening post.
1. Set the Mode switch to “Verify” the Pair switch to “R-G” and turn on the
Volume to about midrange.
2. Move the Pair switch through all six positions while listening to the audio
output. It’s a good idea to play a radio or TV in the target room while doing
a sweep. This gives you a known sound source, it will also turn on sound
activated bugs. If you hear room audio or a feedback squeal from the test
set, it is an indication that a microphone is attached to one of the wire pairs.
3. Leave the TT-46 connected and perform the Driver test.
WIRE PAIR DRIVER TEST
In this test you will apply voltage to each pair to turn on voltage operated
devices such as FET (Field Effect Transistor) microphones. Again, these are
not wiretaps, but bugs.
1. Turn the Mode switch to “Driver” the Pair switch to “R-G” Test switch to
“Test 1” and the Volume to midrange.
2. Press the PTT switch and listen for room audio or feedback squeal.
Release the PTT switch and move the Pair switch to the next position.
3. Do step 2 for each position of the Pair switch. When all six pairs have
been checked, return the Pair switch to the R-G position.
4. Set the Test switch to Test 2 and repeat steps 2 and 3.
5. Disconnect the TT-46 and return the inside wiring to its normal condition or
go on to the Series test described next. If you got an indication of a parallel
tap or bug, go to the pages on locating wiretaps.
SERIES TAP TEST
In this test, you will be checking each wire pair for a series (in line) tap.
Follow the steps listed below.
1. At the protector block or TNI make sure the inside wires are disconnected
from the phone line as discussed earlier and short all four lines together.
This can be done by connecting all four wires to the same binding post and
tightening the nut or screw.
2. Set the TT-46 switches as follows: Mode to “Series” Test to “Test 1” Pair to
“R-G” Volume to “Off”. Connect the TT-46 in turn to each inside wiring
connection point. It is important to run the test at each jack so that each leg
or branch is tested. This was not necessary in the Parallel test since all
branches or legs are automatically tested in parallel.
15

3. At each connection point, push and release the PTT switch for each
position on the Pair switch. Before leaving one connection point for the
next, repeat the tests with the Test switch in the Test 2 position.
4. For each pair, the Series LED should glow green when the PTT switch is
pressed. If it is red for any of the tests, this means the loop resistance is
over 10 ohms and is an indication of a series tap.
5. Return the inside wiring at the protector block or TNI to its normal condition
(reconnect each wire to its proper place). Reconnect your telephones,
answering machines, etc. to return your system to normal.
HOOKSWITCH BYPASS TEST
VERIFY MODE
This test lets you check your telephone for hookswitch bypass tampering.
In this test, you will use the dual modular coupler. Phones without modular
plugs can be tested using the in-line coupler and modular cord with alligator
clips.
1. On the TT-46 set the switches as follows: Mode to “Verify” Test to “Test 1”
Pair to “R-G” and Volume to midrange.
2. Unplug the telephone to be tested from its wall jack and plug the dual
coupler into the jack in its place. Then plug the phone into one jack of the
dual coupler and the TT-46 into the other jack.
3. Lightly tap the phone housing with a pen or pencil. If you hear the tapping
in the TT-46 speaker, it is an indication that the phone is capable of
transmitting room audio down the line when the phone is hung up. You may
also hear a feedback squeal, depending on the sensitivity of the hookswitch
bypass.
4. Rotate the Pair switch through all six positions while repeating step 3.
5. Turn off the TT-46, remove the dual coupler and reconnect the phone to its
wall jack. If you have other phones, answering machines, etc., they should
be checked in the same manner as outlined above. If your telephone does
not have a modular plug, it can be tested in the same manner as above, but
you will have to open the connector block or jack where the phone is
connected and use the modular coupler and cord with alligator clips to make
your connections. Be sure to connect red to red, etc.
HOOKSWITCH BYPASS TEST
DRIVER MODE
This test lets you check your phones for hookswitch bypass
tampering without having the phone connected to an active line.
1. On the TT-46 set the switches as follows: Mode to “Driver” Test to “Test 1”
Pair to “R-G” and the Volume to midrange.
2. Plug the phone into one jack of the dual coupler and the TT-46 into the
other dual coupler jack.
16

3. Press the PTT switch while lightly tapping the phone housing with a pen or
pencil. If you hear the tapping in the TT-46 speaker, it is an indication that
the phone is “hot on hook”. Release the PTT switch.
4. Rotate the Pair switch through all six positions while repeating step 3.
5. Place the test switch in the “Test 2” position and repeat steps 3 and 4.
LOCATING WIRETAPS AND
WHAT TO DO IF YOU FIND ONE
All of the wiretaps can be located by close physical inspection of the inside
wiring. Remember, if someone installed it, you’ll be able to find it.
Note that series taps can be made very small. A favorite way to disguise
one is to wrap it with tape so it looks like a wire splice or connection.
There are two basic ways phone systems are wired. In the loop method,
each phone is connected at different points to the same wire run. In the
branch method, a separate wire pair is run to each phone location from the
TNI.
When performing the Parallel test, all the wiring is tested at one time,
regardless of the wiring method used.
In the Series test, if the test was made at point D in the Loop Wiring method,
the entire loop would be checked with one test. But, if you only checked at
point C, the wiring from C to D would not be tested. So, it is important for you
to know the wiring plan before you start testing.
If you find one tap, don’t stop looking – there may be others. A common
technique of people planting taps is to place one that can easily be found in
the hopes that you won’t look for any more after finding the first one. If you
find one tap, it would be a good idea to retest the inside wiring to be sure no
others are present.
17

The hookswitch bypass can also be found by examination of the phone.
The bypass will consist of one or more resistors, capacitors or diodes, usually
connected to either the hookswitch assembly or network. Look for anything in
the phone that doesn’t “fit in” or that seems out of place. Since phones are
relatively inexpensive, you may want to replace a suspicious phone with a
new one.
If you find a tap, then what? Your first impulse will probably be to rip it out –
but stop and think before you do that. It may be worth while to try to
determine who planted it and use the tap to feed them false information.
Another reason for leaving the tap in place is so that you can get law
enforcements help in prosecuting whoever placed the illegal tap. Most law
enforcement departments do not have the manpower to help if you just
suspect a tap, but if you have the physical evidence they should be willing to
investigate. Remember, wiretapping is a Federal crime as well as a violation
in most states.
LIMITATIONS
While the TT-46 will detect the most common on-premises wiretaps and
hookswitch bypasses, there are some it won’t detect. These include drop-in
transmitters, bypasses activated by high voltage and inductive taps that don’t
have a physical connection to the phone or line. In addition to the drop-in
transmitter, other series RF (radio) transmitter taps can be installed inside the
telephone however; they can all be located with the TD-53 RF detector.
Of course, the TT-46 does not detect off-premises wiretaps such as court
ordered taps that are connected down line or at the central phone office.
18