How is a TSCM Bug Sweep Conducted?

Are you being spied on? Do you need a security sweep for bugs?

Technical Surveillance Countermeasures (TSCM) is a search by specialists to locate electronic eavesdropping, video voyeurism, GPS tracking, and/or data theft devices. Security sweeps for bugs or debugging are generic terms for TSCM inspections.

Assuring personal privacy, protecting sensitive information, and keeping intellectual property where it belongs is the goal of a corporate TSCM bug sweep. This goal is expanded to include proactively identifying all types of espionage and information security vulnerabilities when applied to business environments.

The Corporate TSCM Bug Sweep Basic Steps

• Discussion, evaluation, and planning.
• A detailed visual exam of sensitive areas.
• Technical inspection of the areas.
• Information security survey..
• A post-inspection debriefing.
• A final written report documenting findings, recommendations, and due diligence.

The most commonly used corporate bug sweep procedures and instrumentation are listed in order. There are more, but like a doctor, the treatment is based on the symptoms. The exact procedures and instrumentation used will be based on your concerns, location, security goals, and what is in the environment.

The Technical Surveillance Countermeasures (TSCM) portion of the inspection process is constructed so that procedures overlap each other in effectiveness, thus automatically creating a double-check analysis strategy.

1. Before the TSCM Bug Sweep Begins

These items are discussed, in confidence:

• Suspicious incidents the client may have observed.
• The client’s security concerns.
• Their goals for a successful resolution.

During follow-up inspections, additional topics are added to the list:

• A discussion about problems or changes experienced since the last inspection.
• Implementation of previously made security recommendations.

Upon arrival, an initial orientation tour of the areas to be evaluated provides the TSCM Technical Consultants with information about

• access control,
• building construction,
• room contents,
• distances between areas,
• locations of IT/telecom rooms, etc.

All of this diagnostic information is used to plan the inspection strategy, and select the most effective test procedures to successfully resolve the concerns at hand.

2. Visual Examinations

A thorough physical examination of the bug sweep areas is conducted to discover electronic surveillance devices currently in place., It can also help and to locate any residual evidence from prior eavesdropping attempts. This phase of the inspection includes a detailed examination of:

• furniture;
• fixtures;
• Wiring;
• ductwork
• computers,
• small items within the area.

TSCM physical inspections are augmented using the latest technology: hi-resolution endoscopes, thermal imaging, Non-Linear Junction Detection (NLJD), and additional inspection tools. This is how eavesdropping devices that do not broadcast radio-frequency transmissions are discovered.

Examples of non-radio devices include:

• miniature voice recorders,
• transmitters that may be dormant, or have dead batteries,
• sound extraction using wires,
• carrier current over power lines,
• transmissions using infrared light,
• ultrasonic and laser microphones,
• covert spycams with internal SD cards,
• keystroke loggers.

These types of eavesdropping devices may be secreted in hollow walls, behind false ceilings, in or on furniture, fixtures, and other common items.

Items having a legitimate place in the room and an ongoing source of power are inspected very carefully. These include computers, power strips, radios and clocks; all are common hiding places for bugs and hidden cameras.

The newest testing procedure is an inspection of USB charging cables. These malicious USB spy cables look exactly like legitimate cables. After passing this test cables are deemed authentic. A tamper-proof security seal is affixed, identifying it as being tested and legitimate. This also helps the user detect if the tested cable was replaced with a spy cable in the future.

The most interesting part of the question, “how do bug sweeps work?” comes next.

3. Technical Examinations

Detection of Non-Radiating Devices

Surveillance devices do not have to be transmitting, or even turned on, for TSCM technicians to discover them. Non-Linear Junction Detection instrumentation can detect bugs operating in their standby mode, turned on by timers, broken, or even if their batteries are dead.

Tip: This detection technology is similar to the shoplifting detectors used at retail store exits. Just the fact that the bug contains electronic components is enough to sound the alarm.

Radio-Frequency Spectrum Analysis

Detection and demodulation of wireless surveillance (audio, video & data) is accomplished with the aid of spectrum analyzers. These are basically sensitive, computer-aided radio receivers that can receive signals anywhere along the radio-frequency spectrum. Even though only certain areas of a building may be designated for a TSCM bug sweep inspection, surrounding areas also benefit from this particular test.

Optical Spectrum Analysis

Some electronic eavesdropping devices transmit intelligence by converting sound into infrared or laser light. This invisible light can be picked up optically from a distance and converted back into sound, video or data. Television remote control units operate on the same principle. Specialized TSCM instrumentation can detect this.

Concealed Space Examination

Spaces that cannot be directly viewed are optically examined using a video camera called flexible videoscope.

Thermal / Infrared Spectrum Analysis

Minute amounts of heat are generated as electricity moves through a surveillance device’s circuitry. Thermal imaging instrumentation is used to detect active items by sensing their heat signatures. This technique can also see bugs hidden in antique furniture and other delicate items – without damaging them.

Tip: In addition to the above procedures, TSCM specialists may employ other specialized tests, based on the unique needs of a case.

Internet of Things Exam

The Internet of Things (IoT) has introduced many not-so-obvious attack points into businesses. From printers to VoIP phones to AV presentation equipment, all are taken into consideration during the TSCM inspection process.

Hard-wired Communications Examination

• Visual inspection of system components and connecting pathways.
• Frequency Domain Reflectometery (FDR) Analysis of the wiring paths.
• Carrier Current analysis of wiring.
• Audio leakage analysis.
• Electrical characteristics analysis.
• Wireless Communications Examinations
• Wi-Fi security and compliance analysis.
• Cordless telephone vulnerabilities.
• Cordless headsets, keyboard and mice.
• Wireless presenter’s microphones.
• Other wireless communications (Bluetooth, FM, analog, etc.)

Wi-Fi Security and Compliance Audit

When people search the internet to learn, How is a TSCM Bug Sweep Conducted? Wi-Fi inspection and analysis may come as a surprise.

A Wi-Fi security and compliance audit is an essential element of most TSCM inspections. It detects Wi-Fi reliant audio and video covert surveillance, and rogue network intrusion devices. Additionally, this test can detect compliance issues.

Tip: Just one loophole… Hackers are in. Data is out, and “You are out of compliance.”

This test helps detect eavesdropping, data siphoning and government penalties due to compliance lapses.

Although a Wi-Fi inspection is part of a TSCM bug sweep inspection, it may also be ordered separately when Wi-Fi security and compliance are the sole concerns.

Some privacy laws and directives which may impact your Wi-Fi usage include:

• Sarbanes-Oxley Act – U.S. Public Companies
• HIPAA – Health Insurance Portability and Accountability Act
• GLBA – Gramm-Leach-Bliley Financial Services Modernization Act
• PCI-DSS – Payment Card Industry Data Security Standard
• FISMA – Federal Information Security Management Act
• DoD 8100.2 – Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense Global Information Grid
• ISO 27001 – Information Security Management

Tamper Detection

TSCM Technical Consultants use customized security seals to seal phones and other objects upon completion of an inspection. Items previously inspected and sealed will re-examined during future inspections to verify seal integrity. The seal numbers are recorded in the written report.

Between inspections clients are encouraged to visually examine these seals themselves. A damaged or missing seal may indicate tampering. A missing seal may also indicate the object being sealed was replaced, possibly with a pre-bugged, identical looking item. Either condition is a suspicious incident.

Acoustical Ducting Evaluation
This phase of the inspection evaluates the possibility of sound migration—sometimes a surprising cause of information loss. Ductwork, open ceiling plenums, common walls / ceilings / floors can conduct sound in unexpected ways. Remediation recommendations help clients prevent this type of unnecessary information loss.

4. Information Security Survey

As part of the inspection process general security efforts already in place are observed to assess appropriateness and current effectiveness. This is important because security policies and hardware can quietly decay over time. Examples include:

• CCTV, locks, alarms.
• Employee compliance with good information security practices.
• Access control.
• Security officer efficiency.
• Potential for abusing in-place technologies.
• Security policies (in place, or needed).
• General security and safety observations are also made.

This element of the inspection provides clients with cost-effective recommendations for improvements, repairs, upgrades, and additions, as necessary.

Tip: Make sure your TSCM specialist does not sell, or profit in any way, from products and services they recommend. You need to be sure the recommendations are in your best interest, not their’s.

5. On-Site Debriefing

An immediate debriefing may be held to discuss the results of the inspection. Urgent security issues, and future protection strategies are discussed at this time.

6. The Written Report

A written counterespionage report should be rendered to document your TSCM security inspection, and due diligence. The report may also contain recommendations requiring your immediate attention.

Tip: Maintain a cautious attitude, and safeguard the report. It discusses security strategies which are not for general dissemination. It documents your proactive stance and due diligence on information security—a legal prerequisite for protection in court.

We hope this answers your question, How is a TSCM Bug Sweep conducted? If there is anything you don’t quite understand, or have additional questions, please let us know here.

###

You may also want to read…

• What are the Benefits of Conducting a TSCM Bug Sweep?

• How Can You Tell if You, or a Room, is Bugged?

• How Much Do TSCM Bug Sweeps Cost?

###

Murray Associates is an independent security consulting firm, providing eavesdropping detection and counterespionage services to business, government and at-risk individuals.

Headquartered in the New York metropolitan area, a Murray Associates team can assist you quickly, anywhere in the United States, and internationally.

EXTRAS:
• More security tips, spy and privacy news at spybusters.blogspot.com. Sign up for the free email version.
• Concerned about Spy Cameras? Learn how to detect hidden cameras.