[SOLVED] RF Emission from Piezoelectric Buzzer

[FvM]

There is a third "IC" UTC1062 underneath inside the little metal "box".

Yes, the telephone audio IC. You get a good idea of the complete telephone circuit by combining the three datasheets. The UTC1062 datasheet also shows which circuit parts should be unpowered in on-hook state.

What is the real problem?

No problem, just a suspicion, see post #32.

 

[EricaS]

The third IC is HM91710AP

 

[Vbase]

Ok I see what you mean.
The chip is UTC31002.
**broken link removed**

I will measure later.

There is a third "IC" UTC1062 underneath inside the little metal "box".

Is it a wireless phone?
Small metal box is normally RF transmitter.

 

[Audioguru]

www.datasheetarchive.com and the link in post #39 shows that the UTC31002e IC is the ringer oscillator-driver.
The UTC1062 IC under the metal box is the handset mic preamp, handset earphone amplifier and sidetone suppression IC and I guess is using the box as an RF and audio shield.
The HM91710AP IC is the dialler iC and uses the crystal beside it for accurate DTMF tones.

The "buzzer" is not mechanical, it is a piezo transducer. I wonder why it has an "after-market" one from Radio Shack (modified with a built-in radio transmitter)????

 

[betwixt]

Putting paranoia to one side - have you considered it would be easier for someone to plant a bug in the handset than in the phone body?

Brian.

 

[EricaS]

Putting paranoia to one side - have you considered it would be easier for someone to plant a bug in the handset than in the phone body?

Brian.

Well the aim here is not to be found, if someone simply opened the headset they would find the extraneous components. Then the game is up.

What's going on here is a good use of science to exploit the telephone to their advantage.

That way during a TSCM sweep it wouldn't be found.

- - - Updated - - -

Is it a wireless phone?
Small metal box is normally RF transmitter.

No its not a wireless phone.
The metal box encloses one IC.

 

[betwixt]

Well the aim here is not to be found, if someone simply opened the headset they would find the extraneous components. Then the game is up.

What's going on here is a good use of science to exploit the telephone to their advantage.

That way during a TSCM sweep it wouldn't be found.

Not sure I follow you there. what is the difference between opening the handset and opening the phone body? If it was bugged the same 'science' would be used in both locations. Why do you think TSCM would distinguish between body and handset?

You have not answered one of my earlier questions:
Do you think it is ONLY your telephone conversations that are being monitored or do you think the phone is working like a bug all the time, regardless of whether the handset is on or off hook?

Brian.

 

[tggzzz]

Some background:
I've inspected about 70 of these phones (at the office and a department store)

There's a very similar discussion petering out at https://www.eevblog.com/forum/projects/telephone-eavesdropping/msg667512/#msg667512
in which "Erica" states

I work for a high security government facility. This is were these phones are being used. I am not in the US.
These phones are being used to monitor what the employees are saying in the offices. I believe its being done by a malicious source and is not known by executive management.​

Curiously many of the posts have been removed by "Erica"; from memory the first post was very similar to the first post in this thread. Certainly "Erica" became ratty when I pointed out the similarity: https://www.eevblog.com/forum/projects/telephone-eavesdropping/msg669528/#msg669528

You will, no doubt, draw your own conclusions.

 

[Vbase]

There's a very similar discussion petering out at https://www.eevblog.com/forum/projects/telephone-eavesdropping/msg667512/#msg667512
in which "Erica" states

I work for a high security government facility. This is were these phones are being used. I am not in the US.
These phones are being used to monitor what the employees are saying in the offices. I believe its being done by a malicious source and is not known by executive management.​

Curiously many of the posts have been removed by "Erica"; from memory the first post was very similar to the first post in this thread. Certainly "Erica" became ratty when I pointed out the similarity: https://www.eevblog.com/forum/projects/telephone-eavesdropping/msg669528/#msg669528

You will, no doubt, draw your own conclusions.

I also pointed out to EricaS the doubts I have in the story but she insisted that she is telling the truth. I also noticed that she never sleeps, she posts 24 hours a day, it is hard to believe that 'Erica' is one person.
I don't see any harm in her threads.
This must be the can of worms that Edward Snowden had opened.

 

[EricaS]

Not sure I follow you there. what is the difference between opening the handset and opening the phone body? If it was bugged the same 'science' would be used in both locations. Why do you think TSCM would distinguish between body and handset?
Brian.

The phone is practically unaltered. I've read alot of books on TSCM and I've tried virtually all of the evaluation methods. We have regular TSCM sweeps and I think they are not aware of this method. They erroneously conclude that there is no problem with the telephone because it's unaltered.

You have not answered one of my earlier questions:
Do you think it is ONLY your telephone conversations that are being monitored or do you think the phone is working like a bug all the time, regardless of whether the handset is on or off hook?

Telephone conversations can be recorded anywhere along the line (all you need is access to the line). They don't have to bug the telephone. Besides who really uses the telephone anymore?
In this case the telephone is being used to transmit all room audio - whats being said in the office when the phone is on-hook.

- - - Updated - - -

There's a very similar discussion petering out at https://www.eevblog.com/forum/projects/telephone-eavesdropping/msg667512/#msg667512
in which "Erica" states

I work for a high security government facility. This is were these phones are being used. I am not in the US.
These phones are being used to monitor what the employees are saying in the offices. I believe its being done by a malicious source and is not known by executive management.​

Curiously many of the posts have been removed by "Erica"; from memory the first post was very similar to the first post in this thread. Certainly "Erica" became ratty when I pointed out the similarity: https://www.eevblog.com/forum/projects/telephone-eavesdropping/msg669528/#msg669528

You will, no doubt, draw your own conclusions.

Are you insane?
Why did you do this?

- - - Updated - - -

I don't see any harm in her threads.
This must be the can of worms that Edward Snowden had opened.

This is a legitimate request.

 

[D.A.(Tony)Stewart]

Maybe it is activated with a Radar Pulse to behave like passive RFID with Analog modulation.

 

[betwixt]

Let me get this straight, it's an office environment, someone somewhere is eavesdropping at any or all of the time and you suspect the problem is a telephone ringer!

If that is the scenario, a microphone inside a plastic resonant holder, fixed to the underside of a telephone body, facing down at a desk from a distance of say 5mm would be one of the least probable monitoring places. It's a bog standard POTS phone so it can't draw power from the line unless it is off hook so the power source has to be external but there are no other wired connections.

Look at it this way, I was was a spy (and I'm not by the way!) I could hide probably 20 different types of surveillence devices in an office without them being noticed, one thing I would not do is dismantle a telephone and fit an expensive and inefficient modified ringer unit and then try to hide a microwave transmitter and receiver within a few metres of it.

Have you considered someone might be hiding a conventional wired micrphone somewhere? It would give far better clarity, not need a power source and wouldn't emit any radio signal.

Brian.

 

[EricaS]

Maybe it is activated with a Radar Pulse to behave like passive RFID with Analog modulation.

I actually pondered upon that for some time.
I thought it may be similar to the Great Seal Bug.
In that case the phone need not be connected to the line. Its a passive technique.

In this case the phone must be connected to the line to draw power - it can't work otherwise. So whatever generates the RF is inside the phone.

- - - Updated - - -

one thing I would not do is dismantle a telephone and fit an expensive and inefficient modified ringer unit and then try to hide a microwave transmitter and receiver within a few metres of it.

The phone comes standard with that ringer.

 

[tggzzz]

Are you insane?
Why did you do this?

So as to help quite a few people judge what topics are worthy of their consideration. Their lives are short, decreasing at 86400s on most days.

I'm content to leave others to judge sanity.

Sorry I couldn't include the context to those comments. For reasons best known to themselves, this BB's owners have decided to prevent that!

- - - Updated - - -

I also pointed out to EricaS the doubts I have in the story but she insisted that she is telling the truth. I also noticed that she never sleeps, she posts 24 hours a day, it is hard to believe that 'Erica' is one person.
I don't see any harm in her threads.
This must be the can of worms that Edward Snowden had opened.

I hadn't bothered to do an FFT or scattergraph of the posting times :grin:

The threads are harmless, except in the minor sense that people spend their (remaining) life trying to help.

As for Snowden; paranoia existed before his "revelations". All that's happened is that the tinfoil hat's brigade has an enlarged vocabulary, which brings us back to the previous sentence.

 

[EricaS]

What is acting as the antenna here?
Can the piezo diaphragm in the cavity by itself emit RF if a carrier wave is inputted via the positive or negative wiring? Or must there be an antenna?

I measured the ringer IC for voltage. Its very low about 50 to 100 mV.

 

[betwixt]

Can the piezo diaphragm in the cavity by itself emit RF if a carrier wave is inputted via the positive or negative wiring? Or must there be an antenna?

No, No, No and No.

The piezo CAN NOT GENERATE RF BY ITSELF. Even if you put RF on it's wires from elsewhere, and there is clearly no method of doing that, it would not radiate a modulated signal. From an RF aspect, the piezo element looks like nothing more than a capacitor of about 1nF.

As I have repeatedly stated, to use it as a passive cavity resonator would give terrible quality and need a highly focussed microwave beam to energize it and a high gain antenna to receive the incredibly tiny signal it would re-radiate. Have you spotted the two large dish antennas pointed at your phone from different angles, inside the room with nothing obstructing their path to the phone. If you haven't, either it isn't being used as a passive radiator or you seriously need the sevices of an optician.

Brian.

 

[Vbase]

This is a legitimate request.

About your request:
Several people told you that office phones are different, they have an option for the admin to listen to the sound in your office when the phone is on the hook. The description of the inside of your phone supports that possibility too.
Several people told you that the idea of the buzzer sending the sound in the room is not likely to be the case.
We offer to help you to open your phone and add a switch to the microphone and another switch to the buzzer. You can switch those off when you don't use the phone. You can also wrap the buzzer with foil. When you do that your boss will assume that you are quiet.
If you get caught your boss will fire you but immediately you will be hired by the CIA.

You are very good at running the thread and answering so many people at the same time. If you were as good in engineering as you are in running this thread your problem could have been solved by now.
I don't mind if you go on for a long time. I find it amusing to follow.

 

[betwixt]

About your request:
Several people told you that office phones are different, they have an option for the admin to listen to the sound in your office when the phone is on the hook. The description of the inside of your phone supports that possibility too.

I have worked on office telecoms equipment, this is a standard analog POTS phone. The ones in which the microphone can be switched on remotely work quite differently and have a digital interface. Even then, only diagnostic equipment has the capability of remote controlling the line, a switchboard operator would not be capable. There are none of the necesary digital interfacing components on the PCB shown but it is clear it has a normal analog line with ringer isolation, line seizing circuit and DTMF dialer.

There is a special type of analog phone which allows remote handsfree control, intended for infirm people who can establish a call using a pendant but the international specifications say it has to be done by sending DTMF tones down the line from a call center and it only works with the phone off hook, the tones are also audible over the loudspeaker. I can't see this phone even having a handsfree facility.

Brian.

 

[Audioguru]

So as to help quite a few people judge what topics are worthy of their consideration. Their lives are short, decreasing at 86400s on most days.

I wish you didn't remind me that my remaining days, hours, minutes and seconds of my life are running out since I am 70 years old. I hope I live well for another 20 years.

 

[betwixt]

Don't worry Audioguru, that still leaves you 631,152,000 seconds to go. :-D

Brian.