History of Non-linear junction detection.
As You can see above is the schematic of the operation of the so called “classical” non linear junction detector.
Before using a NLJD the area must first be subjected to a comprehensive "Non-Alerting" TSCM inspection. This must include a "Non-Alerting" check for any type of free space electromagnetic signals including any signals or voltages present on all conductor combinations (including telephone, AC, lighting, HVAC, IDS, and so on). The area must also be checked for thermal and IR anomalies before the usage of the NLJD (which marks the beginning of the "Alerting" stage of the TSCM service).
If you only have limited time in which to perform the TSCM Inspection then the time is best spent on other elements of the sweep such as the RF survey (and you should leave your NLJD out of the equation). However, when you have the luxury of time and your schedule permits it usage; the NLJD becomes an invaluable tool just like the portable X-Ray or thermal imager (but it is very time-consuming to use).
Proper operation involves slowly brushing or sweeping the antenna over every surface in the suspect area. The procedure is very slow and time consuming, typically involving 2-5 minutes per square yard of surface area. A small 15 * 15 foot office will typically require four hours to sweep with such an instrument. The TSCM specialist literally "paints" every surface in the area, including walls, floors, ceilings, furniture, and fixtures. If a circular polarized antenna is used the time require to sweep can be reduced by about 30%.
The area to be inspected will first be swept using a "quiet" mode of operation where the instrument is used to listen only and to observe the quieting effect which RF fields tend to create. During this period the audio output of the NLJD may be monitored with headphones to detect the sync "buzz" created by video transmitters, or the emissions from the bias oscillator in some tape records (if you get lucky).
The illuminating signal will then be activated and the NLJD used to scan the walls and surfaces from a distance of at least 6-8 feet outside of the area to be inspected. The purpose of this scan is to isolate and evaluate items creating false positives. Once these item are "cleared" they should be isolated from the area being inspected (to avoid further interference).
Once the area has been sterilized of all major "harmonic reflectors" the distance between the NLJD is reduced to 2-3 feet and repeated to further isolate and evaluate potential "hits".
Finally the distance is reduced to between two feet and actual contact with the item or area being inspected. The lowest possible signal levels are used first for the initial "contact sweeps" and the entire area checked again. The power is then increased slightly (no more the 25%) and the entire area re-swept. The power is again increased and the entire sequence repeated until full power is reached. If possible the power should be increased in as small a level as possible (10% is ideal, but 25% is practical) with multiple overlapping sweeps of the area using multiple directions.
The flat surfaces (such as walls) in the area should be swept at a rate of 3 seconds per square foot or less. Non flat surface (such as furniture) will of course be swept at a much slower rate. A "perfectly clean room" will take at least 30 minutes to check with a NLJD, with a typical small office (less then 200 square foot) taking 2-3 hours, and a medium sized office taking at least 3-4 hours. A larger executive office may easily take 6-8 hours or more often involve several days just for the NLJD inspection. (On humorous note, the TSCM specialist will actually look like he is practicing Tai Chi with a painters pole). Properly sweeping a room takes as long as applying three coats of paint to all of the walls in a room (it takes time... lots of time, and is tedious).
Since the use of a NLJD should be considered "highly alerting" the TSCM'er will be able to "thump and bump" possible metallic or corrosive targets to isolate them as false targets. Light switches, fluorescent lights, modern electronics, nails, paper clips, steel screw studs, furniture springs, and so on create the most false targets and will create a noisy and unpredictable response in the reflected signals.
Applying a small amount of physical vibration to the suspect area will disturb the crystalline structure of the corrosive or dissimilar junction and will usually cause a detectable shift in the NLJD reading. This physical vibration may be created by several commercial products including rubber mallets, orbital vibrators, low frequency ultrasonic vibrators, palm massagers, and so on. A false or corrosive hit will create a noisy signal which may be heard in the earphone, but a real threat may also cause such a crackle.
Each anomaly is then carefully documented and evaluated to determine exactly what caused the "hit" and a record of these should be maintained for future study.
Even when properly used Non Linear Junction Detectors are prone to false alarms, and may cause many hours to be expended only to find a paper clip which had been dropped into a potted plant, or two staples inside a book. On the other hand the NLJD may to used by the TSCM practitioner to develop a "sixth sense" about a area being inspected, and when combined with a portable X-ray, thermal imaging system, and borescope the instrument becomes invaluable for finding professionally installed eavesdropping devices.
The idea behind an NLJD is to flood a volume with an RF signal at a particular frequency. Normal insulators and conductors in the area won’t alter the signal. However, anything that has a nonlinear response — like a diode junction — will emit harmonics. They might be at a low level, but if you can detect the harmonics, you can identify these junctions.
Sounds simple, but the RF has to be powerful enough to get there and produce a harmonic you can detect. It also shouldn’t be so powerful that you can’t localize the volume or — extremely — that it would damage circuits. The other problem is that any dissimilar metal junction will exhibit nonlinear behavior. So in addition to bugs and cell phones, you’ll detect rusty nails and similar items.
One of the first Non-Linear Junction Detectors (NLJD), introduced in 1990, shortly after they acquired Security Research Ltd. from Cray Defence Group in 1989. The Broom can detect radio bugs, even if they are not switched on, by searching for the P-N junctions that are present in all electronic semiconductors, such as diodes and transistors. It was invented by WWII SOE veteran Charles Bovill who initially used it to find corrosion on airplanes.
The property of a non-linear junction (NLJ) is that, when a high-frequency signal is aimed at it, it reflects harmonic frequencies of the input frequency. By monitoring the 2nd harmonic frequency, the presence of a NLJ can be proven.
The Broom ECM has a built-in transmitter with extensive filtering, in order to guarantee that it only transmits the base frequency of 888 MHz. A separate built-in receiver is used to look for the 2nd harmonic of 888 MHz, i.e. 1.776 GHz. Again, extensive filtering is needed to allow only the 1.766 GHz signal to be seen by the receiver.
The Broom ECM was battery powered and consisted of two parts: the main unit and a broom-type TX/RX antenna. By displaying the strength of the received signal on the LED bar at the front panel of the main unit, the operator can determine the presence of a non-linear junction. This might indicate the presence of electronic components, such as a diodes, transistor, ICs (chips), etc.
A drawback of this method is that some naturally formed crystalline structures, such as a rusty nail that got stuck somewhere inside a wall, can also reflect the 2nd harmonic of the base frequency. The operator therefore has consider that possibility as well. He wouldn't be the first to needlessly knock down a wall... One should always use other types of bug detectors as well.
The Broom ECM was succeeded in 1995 by the SuperBroom that did not suffer from this problem. By looking at the ratio between the 2nd and the 3rd harmonic of the base frequency, the operator can tell the difference between a semiconductor (i.e. an electronic part) and a natural structure.
he Broom was invented by Charles Bovill, an electronics engineer and WWII SOE veteran. It was based on Bovill's wartime work on a non-linear junction detector that was used to find corroded parts on airplanes. In 1972, shortly after he became technical director at Allen International Ltd. in Westminster (London, UK), he started marketing the device as the bug finder we know today.
Alan International Ltd. had specialized in the development and sales of spy gadgets, such as bugs, disguised microphones, etc. and even supplied the Q-type gadgets for the James Bond movies for many years. The company had an office and a showroom above a bedding shop in Westminster (London, UK).
On 1 October 1973, the company escaped a bomb attack, when a man tried to plant five pounds of explosives. Luckily, Bovill's colleague Lee Tracey, who was currently testing one of the company's spy camera products, detected the suspicious figure and the bomb didn't go off.
The police suspected the IRA, who was afraid that other inventions of Bovill, such as the Photic Drive, might be used against them.
After Allen International went bankrupt in 1974, marketing of the Broom was taken over by Security Research Ltd. of Guildford (UK), another company that was part of CDI Holdings. According to Lee Tracey, these companies were all front operations of MI6 .
The image on the right was taken from the book Weapons & Equipment of Counter-Terrorism by Michael Dewar . It was probably taken in 1975 and shows the original Broom as it was sold by Security Research Ltd. Although the receiver has changed over the years, the telescopic broom stick with antenna at the end is still the same.
In 1999, at the age 88, Bovill demonstrated his invention in the Channel 4 documentary The Walls Have Ears that is now available on YouTube. It shows Bovill in the shed behind his house, where he worked on other inventions after his retirement. Bovill passed away two years later.
In some literature the Russians are credited for inventing the Non-Linear Junction Detector (NLJD), as they came up with an equivalent device around the same time as Charles Bovill did in 1972. However, as Bovill already used the NLJD during WWII to find corroded parts on airplaines, we assume that he is the original inventor. It is quite possible though, that the Russians invented it completely independently, or that they had information about Bovill's secret wartime work.
If the distance between the NLJD and the target is equal to ~ the wavelength of the transmit frequency then there is a nuii effect in the RF transmit signal. This reduces the detection sensitivity associated with that specific range and frequency. Usualy this effect is not a problem because the user is constantly moving the NLJD and therefore the range to the target is constantly changing. Target Dependence on Frequency It is often observed that NLJD's perform differently for different targets. This is because detection range is dependent on frequency. Consider a cellular phone as a potential target. If an NLJD operates at a frequency that is within the operational band of the cellular phone, then the detection range of the phone will be large, however, if the NLJD operates at a frequency range that is outside of the operational band of the cellular phone, then the built-in filters within the phone will attenuate the NLJD signal and the detection range will be greatly reduced.
Frequency Interference
If the NLJD is operating on a frequency that may also be occupied by another transmitter, the NLJD may have very erratic and unreliable readings. As more wireless devices are being assigned to more frequencies, the performance of these limited NLJD units can suffer. NLJD should be frequency agile and automatically search for quiet channels on which to operate to avoid frequency interference from other devices.
