GB2538093A

GB2538093A - Method and apparatus for detecting audio surveillance devices

Info

Publication number: GB2538093A
Application number: GB1507809.0A
Authority: GB
Inventors: Barry Stephen Andrew
Original assignee: Audiotel International Ltd
Current assignee: Audiotel International Ltd
Priority date: 2015-05-07
Filing date: 2015-05-07
Publication date: 2016-11-09
Anticipated expiration: 2035-05-07
Also published as: GB2538093B; GB201507809D0

Abstract

A transmitter detector system detects acoustically-active transmitters such as surveillance or bugging devices which receive audio signals from a local environment and transmit data corresponding to the received audio signal over an RF transmission medium. The transmitter detector 100 comprises a receiver 3 configured to detect RF transmissions and an audio output 11 configured to generate intermittent audio output signals. The intermittent audio output signals repeatedly activate and deactivate a voice actuated detector (VAD) and a discontinuous transmission (DTX) protocol in the transmitter 1. A correlation module in the detector is configured to determine a degree of correlation between quantities of data transmitted per unit time period in the detected RF transmissions and the generated intermittent audio output signals (see figure 2). The correlation module may count the number of transmit time slots used in the detected RF transmission during time periods corresponding to the intermittent audio output signals and during time periods corresponding to gaps between the audio signals.

Description

METHOD AND APPARATUS FOR DETECTING AUDIO SURVEILLANCE DEVICES

The present invention relates to counter-surveillance devices and in particular to techniques for detecting the presence of a transmitter configured to receive audio input from its local environment and to transmit data corresponding to that received audio input over an RE transmission medium.

There are many devices available today, such as mobile telephones and purpose-built bugging devices based on mobile phone technology, which can use a microphone or other acoustic transducer to pick up acoustic signals in their local environment and transmit data, e.g. packetized digital data or modulated signals, corresponding to the received acoustic signals over a cellular telephone network.

One method of attempting to detect the presence of such surveillance devices is to detect the radio energy emitted by the device on its radio link (uplink) between the device and a cellular network base station. By using a detected Received Signal Strength Indication (RSSI), assumptions can be made relating to how close the device is to a detector searching for the device. Whilst this method of detection may be a reliable method for detecting localised mobile phone transmissions, and hence for detecting the device generating such transmissions itself, it can lead to many false positive detections.

The false positive detections can be caused by the fact that a mobile phone handset output power can vary by as much as 100 times depending on its visibility of a hosting base station. A transmit power variation of 100 times can yield free space detection range variations in the region of up to 4 times. The wide dynamic range of mobile phone handset output power can lead to a situation in which a mobile phone handset which is close to a detection system but has good visibility of its relevant base station may emit a far lower transmit power than a mobile phone handset which is more remote from the detection system but has poor visibility of its relevant base station. This situation can lead to the detector system not responding to the local mobile phone handset but instead, incorrectly responding to the more remote mobile phone handset.

It would be desirable to provide a detector system which can reliably detect a mobile phone handset transmission from the immediate vicinity of the detector system and which will also not respond to a mobile phone transmission which is remote from the detector location.

According to one aspect, the present invention provides a transmitter detector comprising: a receiver configured to detect RF transmissions; an audio output configured to generate intermittent audio output signals; a correlation module configured to determine a degree of correlation between quantities of data transmitted per unit time period in the detected RF transmissions and the generated intermittent audio output signals.

The correlation module may include a transmission count module configured to count numbers of transmit time slots used in said detected RF transmissions during selected time periods. The transmission count module may be configured to count numbers of transmit time slots used during periods of time corresponding to said intermittent audio output signals and to count numbers of transmit time slots used during periods of time corresponding to gaps between said intermittent audio output signals. The correlation module may include a transmission count module configured to count numbers of discontinuous transmission periods in said detected RF transmissions during selected time periods in said detected RF transmissions. The transmission count module may be configured to count numbers of discontinuous transmissions during periods of time corresponding to said intermittent audio output signals and to count numbers of discontinuous transmissions during periods of time corresponding to gaps between said intermittent audio output signals. The correlation module may include a transmit rate count module configured to determine a first data transmit rate during periods of time corresponding to said intermittent audio output signals and to determine a second data transmit rate during periods of time corresponding to gaps between said intermittent audio signals. The correlation module may be configured to determine if the first data transmit rate exceeds the second data transmit rate. The correlation module may be configured to determine if the first data transmit rate exceeds the second data transmit rate by more than a predetermined threshold amount.

The transmitter detector may further include an output device configured to provide an audible or visual indication of a positive correlation if the first data transmit rate exceeds the second data transmit rate.

The receiver may be a radio receiver. The receiver may be configured to detect said RF transmissions on a cellular mobile telephone network. The receiver may be configured to detect said RF transmissions on a cable network. The receiver may be configured to detect said RF transmissions on a utility power network.

The correlation module may be configured to determine an estimate of phase delay between the generated audio output signals and data transmitted in the detected RF transmissions.

According to another aspect, the present invention provides a method of detecting the presence of a listening device in which the listening device receives audio signals from its local environment and transmits data packets corresponding to said received audio signals over an RF transmission medium, the method comprising: generating an audio output comprising intermittent audio output signals; operating a receiver to detect RF transmissions; determine a degree of correlation between quantities of data transmitted per unit time period in the detected RF transmissions and the generated intermittent audio output signals.

Determining a degree of correlation may comprise counting numbers of transmit time slots used in said detected RF transmissions during first periods of time corresponding to said intermittent audio output signals and counting numbers of transmit time slots used during second periods of time corresponding to gaps between said intermittent audio output signals and determining a difference between said numbers. Determining that a correlation exists may include determining when the number of transmit time slots used in said first periods of time exceeds the number of transmit time slots used in said second periods of time, by more than a threshold amount. Determining a degree of correlation may comprise counting a rate of discontinuous RF transmissions during first periods of time corresponding to said intermittent audio output signals and counting a rate of discontinuous RF transmissions during second periods of time corresponding to gaps between said intermittent audio output signals and determining a difference between said rates. The method may include determining that a correlation exists when the rate during said first periods of time exceeds the rate during said second periods of time, by more than a threshold amount. The RF transmission medium may comprise a cellular telephone network.

Embodiments of the present invention will now be described by way of example and with reference to the accompanying drawings in which: Figure 1 is a schematic functional block diagram of a transmitter detector suitable for detecting the presence of an eavesdropping or bugging device; Figure 2 is a schematic diagram illustrating a method of operation of the detector of figure 1; Figure 3 is a flow chart illustrating a method of detecting the presence of an eavesdropping or bugging device.

With reference to figure 1, there is described a specific implementation of a transmitter detector system 100 which can generate an alert whenever it has detected and confirmed the presence of an acoustically-active mobile phone handset or an acoustically-active mobile phone eavesdropping device 1 within acoustic range of the detector system 100.

The transmitter detector system 100 is configured to ensure selectivity for mobile phone transmissions and mobile phone-style transmissions which pose an audio eavesdropping threat while providing selectivity against mobile phone and mobile phone-style transmissions which do not pose an audio eavesdropping threat. False alerts can thereby be reduced or eliminated.

A feature of many modern transmission systems, including cellular telephone networks such as GSM or other TDMA-based mobile phone systems, is one which improves network capacity and reduces power use of the mobile device. This is known as Discontinuous Transmission (DTX). DTX is a feature whereby a mobile phone handset employs a Voice Activity Detector (VAD) to determine whether a caller is speaking or not.

If the caller is speaking, the mobile handset transmits more frequently. If the caller is silent, the mobile phone transmits less frequently. In a typical network environment, more frequent transmission corresponds to using more of the available transmission slots in the network transmission protocol. The DTX feature is generally implemented in order to maximise mobile handset battery life and to minimise interference within the mobile network cell.

The transmitter detector system 100 described herein recognises that this feature can be exploited to confirm whether a mobile phone transmission or a mobile phone-style transmission is being generated in response to a locally generated noise.

The detector system 100 may generate an audio tone which is periodically switched ON and OFF. Whilst the generated audio tone is ON, it will be picked up by a microphone embedded in the mobile phone handset or mobile phone eavesdropping device and, via the DTX feature, the audio tone will force the mobile phone handset or mobile phone eavesdropping device to transmit on the mobile phone uplink more frequently. Whilst the generated audio tone is OFF, the microphone embedded in the mobile phone handset or mobile phone eavesdropping device will only pick up the acoustic ambient in the immediate vicinity and therefore, again via the DTX feature, the absence of the audio tone will result in the mobile phone handset or mobile phone eavesdropping device transmitting on the mobile phone uplink less frequently. The amount of radio activity on the uplink from the mobile phone handset or mobile phone eavesdropping device can be correlated with the presence or absence of the generated audio tone. In this way, it is possible to robustly and reliably detect and confirm mobile phone transmissions and transmissions from mobile phone-style eavesdropping devices that pose an audio eavesdropping threat, i.e. those that are within earshot or acoustic range of the detector system. It is also possible to discount similar transmissions from mobile phone devices which are outside the acoustic range of the detector 100, since such devices will not increase and decrease the number of transmissions in a way which correlates with the generated audio tone.

Referring in more detail to figure 1, the acoustically-active transmitter 1, e.g. a target mobile phone handset or mobile phone-based audio eavesdropping device, is configured in use to emit a radio signal on the mobile phone uplink 13. The radio signal is captured by the detector system antenna 2 and passed to the detector system radio receiver 3. The radio receiver 3 notifies the detector system micro-processor 7 via a Received Signal Strength Indication (RSSI) 15 that a radio signal is present on the mobile systems uplink 13. After a predetermined time (preferably chosen to eliminate transient mobile uplink signals created by the likes of periodic location updates or SMS communications), the system micro-processor 7 may initiate a confirmation sequence. The confirmation sequence can be used to minimise false alarms by confirming that the target device 1 is within acoustic range of the detector system 100 and thereby presents a credible audio eavesdropping threat.

At the start of the confirmation sequence, the micro-processor 7 enables an audio output generator 8 via an audio switch 9. This thereby presents an audio signal to an audio power amplifier 10 for amplification prior to an acoustic stimulus signal (audio tone) 14 being generated by a detection system loudspeaker 11. This audio tone can be picked up by the acoustically active transmitter 1, which will transmit data corresponding to the received audio signal via the uplink 13.

At this stage, the output of the detector system radio receiver 3 can be passed through a demodulation / detector stage 4 which can be used to generate a signal which is used to determine the amount of radio activity on the mobile phone uplink 13.

In the arrangement shown, an Amplitude Modulation (AM) detector in detector 4 is used to generate a pulse for each time slot transmitted on the uplink 13. The amount of activity on the uplink 13 can be measured by counting pulses from the AM detector 4 during an acoustic tone 'ON' period by counter 5, and by counting pulses from the AM detector during an acoustic tone 'OFF' period by counter 6. The micro-processor 7 can then be used to compare the count values from counters 5 and 6 to determine whether or not a correlation exists between the generated audio tone 14, and the amount of radio activity on the mobile uplink 13. If the correlation threshold is exceeded, then an alarm will be indicated by the detector system 100 using an audio visual alert output 12 of the detector system 100.

Referring to figure 2, during the tone 'ON' period 20, more radio activity is generated on the uplink 13 as illustrated by the number of data packet transmissions 25 per unit time. Hence, more activity is detected by demodulator / detector 4. This results in an 'ON' count value being registered in the 'ON' period counter 5 which can then be stored in the micro-processor 7. During the tone 'OFF' period 21, less frequent radio activity is generated on the uplink 13 as indicated by fewer data packets 25, and hence less activity is detected by the demodulator / detector 4. This results in an 'OFF' count value being registered in the 'OFF' period counter 6 which can then be stored in the micro-processor 7.

This confirmation sequence can be repeated several times to further minimise false alarms before the difference between the 'ON' count values and the 'OFF' count values are compared according to a pre-determined correlation threshold. The correlation threshold may be selected according to various possible strategies to minimise false alarms.

A suitable output device 12 may be provided for outputting an audible and/or visual indication that the correlation threshold has been exceeded and that the presence of a target device 1 within acoustic range of the detector 100 has been confirmed.

The transmitter detector system described in connection with figures 1 and 2 can be adapted in a number of ways.

In a general aspect, the transmitter detector 100 of figure 1 provides a correlation module configured to determine a degree of correlation between: (a) quantities of data transmitted per unit time period in detected RF transmissions; and (b) intermittent audio signals generated by the audio output of the transmitter detector 100. The correlation module may be exemplified by the microprocessor 7 and counters 5, 6. The counter 5 exemplifies a transmission count module which is configured to count numbers of transmit time slots 25 used in RF transmissions during selected time periods 20 which correspond to the periods of time during which the intermittent audio output signals are generated. The counter 6 exemplifies a transmission count module which is configured to count numbers of transmit time slots 25 used in RF transmissions during selected time periods 21 which correspond to gaps between the audio output signals. Both of these counts are indicative of a quantity of data transmitted per unit time within the specified periods.

In another example, the transmission count module may count a number of discontinuous transmissions during the selected time periods, e.g. where the transmission protocol need not be limited to predetermined time slots. These counts would also be indicative of a quantity of data transmitted per unit time. The transmission count module may count a number of discontinuous transmissions and a duration of each transmission to determine a quantity of data transmitted per unit time.

More generally, the correlation module may determine a first data transmission rate during periods of time 20 corresponding to the intermittent audio output signals and a second data transmission rate during periods of time 21 corresponding to gaps between the intermittent audio signals. The data transmission rate may correspond to a number of fixed time slots used per unit time, or a number of discontinuous transmission periods per unit time (where the transmission periods may be of variable size), or an amount of data transmitted generally during the relevant time period.

The correlation module exemplified by microprocessor 7 and counters 5, 6 may generally determine whether the count or count rate in 'ON' periods 20 exceeds the count or count rate in 'OFF' periods 21. The correlation module may determine whether the count or count rate in 'ON' periods 20 exceeds the count or count rate in 'OFF' periods 21 by more than a predetermined threshold to avoid false positives from noise and normal variability in transmissions.

In a general aspect, the transmitter detector 100 of figure 1 provides a receiver which is configured to detect RF transmissions. The receiver may be exemplified by the antenna 2, radio receiver 3 and demodulator! detector 4 which are configured to receive signals from an acoustically active transmitter 1 which transmits on a cellular radio network or other radio network. More generally, the acoustically active transmitter 1 could be a device which transmits RF signals over a different type of network such as a cable network, e.g. a utility power line. Such bugging devices may, for example, be concealed in utility power outlets. In such a circumstance, the receiver may be any suitable device capable of receiving RF data transmissions over a network and determining a quantity of data transmitted per unit time in the RF transmissions. In such a case, the receiver could be any suitable device for connection to the cable network (e.g. utility power network) and to detect RF data signals modulated thereon.

The transmitter detector as described above may generally be adapted to serve as a detector for any acoustically-active device which transmits on a transmission channel of a communications medium where there is a discernible change in the quantity of data transmitted when an audio signal is received by the transmitter for onward transmission via RF modulation on the transmission channel.

Figure 3 illustrates a method of operation. Intermittent audio output signals 14 are generated (box 31) by the transmitter detector 100. These intermittent audio output signals 14 will activate and deactivate a voice activity detector in the acoustically-active transmitter 1, which in turn will influence a discontinuous transmission feature (e.g. DTX) in the acoustically-active transmitter 1. The detector 100 captures / detects RF transmissions from the transmitter 1 (box 32) during a period! sequence of the intermittent audio output signals. The detector 100 determines a quantity, e.g. rate, of data transmission transmitted during period of audio output (box 33). This quantity or rate may be referred to as Dory. The detector 100 also determines a quantity, e.g. rate, of data transmission transmitted during gaps between audio output (box 34). This quantity or rate may be referred to as DOFF. The detector 100 calculates a difference between DON and DOFF (box 35) and compares this against a threshold value (box 36). This threshold could be zero, such that detection occurs when the transmission rate DON is greater than DOFF.

More preferably, however, a positive threshold could be used. The threshold is preferably set at a level to avoid false positives. If the comparison is positive as testing in box 36, and indication is given of detection of an acoustically active transmitter 1 within acoustic range (box 37). If the comparison is not positive, no indication of a detected device is given, or a detected transmitting device is classified as not in acoustic range (box 38).

The detector 100 may operate with a continuous loop of the process shown in figure 3.

In a further feature, the transmitter detector may be configured to determine an estimate of the distance between the transmitter detector and the target acoustically-active transmitter 1. The 'time of flight' of the acoustic signals 20 from a transmitter detector system 100 to the target acoustically-active transmitter 1 may generally be assumed to be of the order of 330-350 m/s. Thus, there will be a small delay between activation of the acoustic output signals 20, and the transmitter in device 1 seeking to transmit data packets corresponding to the received audio signals over the RF transmission medium. If the delays introduced by the data packet transmission system of the transmitter 1 are small relative to the 'time of flight' delay, then a phase shift between the pattern of intermittent audio output signals and the corresponding pattern of data rate changes in the RF transmissions may be used to determine an approximate distance between the transmitter detector 100 and the transmitter 1. For example, in the cellular telephone network transmission system, there may be data frames of the order of 4 ms in duration, whereas a time of flight of the acoustic signals may be of the order of, e.g. 10-15 ms for a distance of 3 to 5 metres. The correlation module may be configured to assess the phase delay for a series of intermittent audio output signals and corresponding changes in the data rate on the RF transmissions to provide an estimate of this distance. This may assist in the operator of the device 100 in locating the transmitter 1. In this arrangement, it will be recognised that the changes in count rate of time slots used, or the changes in data packet transmission rate, corresponding to the switching of 'ON' periods and 'OFF' periods of the audio output signals will be slightly time shifted.

Various other refinements to the system described above can be made.

For example, the audio output generator 8 may be configured to generate an acoustic signal or audio tone 14 which is optimised for triggering activation of a DTX voice activity detector. This may comprise generating a tone that has a significant or major proportion of its spectral energy at around 1 kHz.

The audio output generator 8 may be configured to generate an acoustic signal or audio tone 14 which is 'covert' in the sense that it is unlikely or less likely to attract the attention of an person listening to the eavesdropping transmissions 13 of the bugging device 1. Such a 'covert' acoustic signal 14 may be a commonplace sound. For example, a 'covert' acoustic signal 14 may comprise a mobile phone ring tone, which may particularly be a discontinuous mobile phone ring tone. A discontinuous ring tone may inherently provide a required 'intermittent audio output signal'. Other common background noises for the environment in which the detector is working may be used as 'covert' audio tones, e.g. a simulated telephone conversation as heard from one end, thereby also providing an intermittent audio output signal.

The audio output generator 8 may be configured to generate precise patterns of intermittent output signals or pseudo-random signals, optimised to determine correlation or non-correlation with a transmitted RE signal with maximum precision and/or with minimum time.

Any suitable pattern or cycle of intermittent audio output signals that is useful in discerning changes in the rate of detected RF data transmissions may be used. In an example, intermittent audio output signals of approximately 1 second in duration and with 1 second gaps between audio pulses may be used. A sequence of 5-10 audio pulses, e.g. over a period of approximately 10-20 seconds may be used.

Other embodiments are intentionally within the scope of the accompanying claims.

Claims

CLAIMS1. A transmitter detector comprising: a receiver configured to detect RF transmissions; an audio output configured to generate intermittent audio output signals; a correlation module configured to determine a degree of correlation between quantities of data transmitted per unit time period in the detected RF transmissions and the generated intermittent audio output signals.
2. The transmitter detector of claim 1 in which the correlation module includes a transmission count module configured to count numbers of transmit time slots used in said detected RF transmissions during selected time periods.
3. The transmitter detector of claim 2 in which the transmission count module is configured to count numbers of transmit time slots used during periods of time corresponding to said intermittent audio output signals and to count numbers of transmit time slots used during periods of time corresponding to gaps between said intermittent audio output signals.
4. The transmitter detector of claim 1 in which the correlation module includes a transmission count module configured to count numbers of discontinuous transmission periods in said detected RF transmissions during selected time periods in said detected RF transmissions.
5. The transmitter detector of claim 4 in which the transmission count module is configured to count numbers of discontinuous transmissions during periods of time corresponding to said intermittent audio output signals and to count numbers of discontinuous transmissions during periods of time corresponding to gaps between said intermittent audio output signals.
6. The transmitter detector of claim 1 in which the correlation module includes a transmit rate count module configured to determine a first data transmit rate during periods of time corresponding to said intermittent audio output signals and to determine a second data transmit rate during periods of time corresponding to gaps between said intermittent audio signals.
7. The transmitter detector of claim 6 in which the correlation module is configured to determine if the first data transmit rate exceeds the second data transmit rate.
8. The transmitter detector of clam 7 in which the correlation module is configured to determine if the first data transmit rate exceeds the second data transmit rate by more than a predetermined threshold amount.
9. The transmitter detector of claim 7 or claim 8 further including an output device configured to provide an audible or visual indication of a positive correlation if the first data transmit rate exceeds the second data transmit rate.
10. The transmitter detector of claim 1 in which the receiver is a radio receiver.
11. The transmitter detector of claim 10 in which the receiver is configured to detect said RF transmissions on a cellular mobile telephone network.
12. The transmitter detector of claim 1 in which the receiver is configured to detect said RF transmissions on a cable network.
13. The transmitter detector of claim 12 in which the receiver is configured to detect said RF transmissions on a utility power network.
14. The transmitter detector of claim 1 in which the correlation module is configured to determine an estimate of phase delay between the generated audio output signals and data transmitted in the detected RF transmissions.
15. A method of detecting the presence of a listening device in which the listening device receives audio signals from its local environment and transmits data packets corresponding to said received audio signals over an RF transmission medium, the method comprising: generating an audio output comprising intermittent audio output signals; operating a receiver to detect RF transmissions; determine a degree of correlation between quantities of data transmitted per unit time period in the detected RF transmissions and the generated intermittent audio output signals.
16. The method of claim 15 in which determining a degree of correlation comprises counting numbers of transmit time slots used in said detected RF transmissions during first periods of time corresponding to said intermittent audio output signals and counting numbers of transmit time slots used during second periods of time corresponding to gaps between said intermittent audio output signals and determining a difference between said numbers.
17. The method of claim 16 further including determining that a correlation exists when the number of transmit time slots used in said first periods of time exceeds the number of transmit time slots used in said second periods of time, by more than a threshold amount. 15
18. The method of claim 15 in which determining a degree of correlation comprises counting a rate of discontinuous RF transmissions during first periods of time corresponding to said intermittent audio output signals and counting a rate of discontinuous RF transmissions during second periods of time corresponding to gaps between said intermittent audio output signals and determining a difference between said rates.
19. The method of claim 18 further including determining that a correlation exists when the rate during said first periods of time exceeds the rate during said second periods of time, by more than a threshold amount.
20. The method of claim 15 in which the RF transmission medium comprises a cellular telephone network.
21. A transmitter detector substantially as described herein with reference to the accompanying drawings.