portland independent media center  
images audio video
promoted newswire article reposts united states

actions & protests | police / legal | technology

Consumer Spookware vs. Your Castle

This is a repost of a 2600 article. I'm transcribing it here because I feel it deserves a wider audience, I feel that people here need to hear this information, nobody has made it available online yet, and I can't find any copyrights on it, so it's fair game. Anything writen [in bold face between brackets] is me; everything else is wideband dreamer's (a.k.a. dark spectrum). BTW I can't remember what I dreamed last night; I think the government is sucking my dreams out of my head.
It's been a long day. You slaved for hours under the baleful glare of your employer's closed-circuit spycams. You ran errands on city streets, in a mall, and at an ATM - more spycams. Then you visited with some friends at a wild party. Everyone there seemed to be flashing camera phones. Who knows how many wireless cameras and microphones were planted or where. But now you're home and you can finally feel that you have some privacy and security. After all, you've got bars on your windows, high=quality door locks, and an alarm system. You're surrounded by a protective shield of drywall, structural timber, and bricks. You swept the house for wireless surprise packages just last week. Still, you can't help asking yourself: are there any chinks in your armor?

You bet there are. Not just chinks, but big, gaping holes: clothes dryer exhaust vents and air exchanger vents. Stove vents, chimneys, and sump drains. Bathroom fan ducts, soil stacks, and sewer lines. Most of them are big enough to drive a truck through (a stripped-down 1:24 scale R/C truck that is). You might be asking yourself "Ducts? Vents? Has this guy been playing too much Half-Life?" but in fact each of those external interfaces constitutes a vulnerability. Some of them are already borderline exploitable with consumer spookware available at the nearest big-box store. I'll give you a few examples later on, but first a short history lesson.

This article describes the next phase in the ongoing erosion of your physical privacy. Phase One started over a decade ago with "Big Brother" spycams watching out for you. They were installed in public places, places of work, and some not-so-public places. You didn't like the spycams but eventually got used to them. After all, you like to feel safe from unknown threats and you certainly don't want to pay the cost of someone else's shoplifting or any coworkers slacking off on the job. You often hear about abuses such as covert spycams in changing rooms but in today's highly charged post-911 environment there's not much point in complaining. Nobody will listen.

Phase Two started just a few years ago, as continuing advances in wireless technology and miniaturization started placing tiny - but highly effective - multimedia devices in the hands of ordinary consumers. This new batch of users didn't need any large outlays of cash or any special training and some of them didn't feel that they should be constrained by privacy laws or any nothing of propriety. This led to spycams being placed in all sorts of odd, intrusive places like residential bathrooms, clock radios, fake smoke detectors, and even the tops of shoes. Just google "spycam" and you'll see that there is a thriving industry based on this concept. In case you aren't aware of how pervasive or how capable spycams are these days, a good introduction is Marc Roessler's article "How to Find Hidden Cameras" at http://www.tentacle.franken.de/papers/hiddencams.pdf.

Modern technology created these possibilities but has yet to offer any inexpensive, easy to use countermeasures. Miniature radio frequency (RF) detectors are available from a few companies. For example, P3 International sells an inexpensive unit that they describe as a wireless camera detector. It certainly does work as advertised but isn't effective in all circumstances. For example, try using it in an area with wireless speakers or close to a switch-mode power converter. More capable devices have been available for some time from companies like Optoelectronics but of course they cost more and require some expertise to use properly.

Camera phones are the most recent privacy threat. They're difficult to avoid due to their portability, tiny lens, and widespread use. Cell phone detectors are one solution but they're not cheap, and in any reasonably busy area they'll get nonstop false hits from ordinary cell phone usage. You could just nuke all calls with a cell phone jammer but that's kind of risky in the USA and the many other countries where such devices are outlawed.

Enough history. Let's review what we have so far. Phase One was "Big Brother's" spycams in public places. Phase Two saw the introduction of other people's audio and video spookware in their shared places. The progression should be obvious. The next phase will bring common criminals' spookware into your own private places. The required wireless and multimedia products are already available and the robotics platforms aren't too far behind.

A Simple Example: Burglary

Let's start with clothes dryer exhaust vents. As a general rule, they feed directly through the exterior wall into living space. How convenient. They're four inches in diameter which is large enough to accommodate all kinds of gear, and they're located low down on the ground floor (nobody wants to run upstairs or downstairs to do the laundry) which means that they're easy to access from the outside. It doesn't take any space-age told to remove the outside vent cap, separate or cut off the duct feed, and then rock the dryer away from the wall. This deconstruction activity is likely to tick off Fifi big time but she doesn't know how to dial 911 and the alarm system's motion detector around the corner is clueless to the big happenings in the laundry area. If Fifi proves to be too much of a nuisance or if the clothes dryer is too difficult to muscle out of the way then a good alternate route is provided by the air exchanger. It has input and output ducts which are four inches or larger and typically lead to an unmonitored basement area.

Once the duct has been cleared the next step would be to shove through a Robots 'R Us BurglarBot and while it's unfolding, retreat to a more comfortable position to prepare for some leisurely remote-controlled burglary. Just like Fifi, the BurglarBot is too small to trigger motion detectors but large enough to climb stairs and jump onto countertops.

Okay, so there's no such thing as a BurglarBot. The best a burglar can do right now with off-the-shelf consumer gear is strip down a small R/C truck, strap a penlight, wireless camera, and a custom gripper onto it, and hope that the homeowners keep their jewelry and other valuables on the floor. Not much of a payoff for a criminal act. But if you consider industrial equipment, there will soon be many more options available. Google "ventilation duct robot" and pay particular attention to the so-called micro units. You'll see that there are already several small, versatile robotic platforms for sale. Once they've been shrunk by another factor or two, the addition of a telescoping arm will transform them into real security threats. As always, there's much better stuff cooking in research labs. It's usually aimed at defense or rescue applications but might some day find its way into your house. For example, the University of Minnesota;s Digital Technology Center is developing reconnaissance robots the size of a soda can (google "COTS Scout") that can easily fit sideways through a clothes dryer duct. They can jump up stairways. They can assemble and transmit complete 360 degree panoramas of each room. Cool. SUNY's robo rat (google "robo-rat abc") looks even more dangerous: a cyborg that could eventually become a well-trained burglary tool.

Don't think that clothes dryer ducts are the only vulnerability. There are many other ventilation pathways into a house. Most of them are constrained by flooring, joists, and drywall, and are terminated by well-anchored equipment. But that doesn't make them much more secure. A determined burglar could easily reach into the hole in the exterior wall and cut through the ceiling drywall.

Internal Interfaces

A separate concern: these other pathways lead to more active areas of the house which means that they're vulnerable to privacy intrusions. To better understand the possibilities you can start by examining one of your own bathroom fans. You'll need a stepladder and a Phillips screwdriver. The fan's grille is probably held in place by spring clips. Carefully pry it away from the ceiling - you'll notice that it doesn't take much strength to do that - and then release the clips to remove it. If the interior of the housing has an outlet and an electrical cord then the blower assembly is removable. Unplug it and loosen or remove any metal screws holding it in place. You'll see that the blower assembly doesn't provide much of a sound barrier. In fact, it probably has openings below the fan blades that are wide enough to accept a thin surface-mount circuit board. Look up inside the fan housing and you'll see that it has an exhaust port which leads to ductwork. There might be a light-weight spring-loaded damper just outside the exhaust port but it's not going to stop any kind of miniature robot and it's often too poorly sealed to provide any barrier to sound waves. In a quiet house, a microphone placed just beyond a poorly sealed damper can pick up conversations in the adjoining room, assuming that the bathroom door is open most of the time. Looking down the road a few years, consider a miniature "urban reconnaissance robot" that has reached the exhaust port and wedged itself in place. From there, it could fish a small cluster of three miniature cameras between the fan blades and the grille. Each camera would have its field of vision partly obscured by the grille but all it takes is some fancy image processing to blend the three signals into an unobstructed view down from the ceiling. And you thought your bathroom was a private place. Note that a robot this size is closer to reality than you might think: take a look at Robomotes (just google it), a tiny robotics research platform.

External Interfaces

So how hard is it to gain access to the fan's exhaust port? To answer that question you'd have to go outside and study some external vents - preferably the ones on your own house. You'll get into less trouble that way, plus you should have an easier time figuring out which rooms the vents lead to. Bring a flashlight. If you're the self-conscious type then you might feel strange while snooping around your house's external ventilation interfaces. You shouldn't. It happens to be a perfectly natural thing to do since it can provide answers to many questions that plague a typical homeowner. Questions like: "Why isn't my bathroom fan pulling air out?", "Where is that horrible stench coming from?", or "Why is there smoke coming out of my clothes dryer vent?" Choose a suitable concern in advance so that you're ready in case one of your neighbors starts asking nosey questions.

You'll soon see that vent caps are often located in unexposed, out of the way places and so covert access is possible. They aren't considered to be particularly attractive so you usually don't see them in front of the house where they might at least be protected by motion-activated lighting. Instead, they're on side walls or rear walls, possibly even further obscured by a foundation planting such as a conical cedar which of course provides cover for intruders.

There are two basic types of vent cap: louvered and hooded. Louvered caps are flush to the exterior wall and typically have four plastic louvers that swing out when the vent is expelling air. To inspect their ductwork all you have to do is raise two of the louvers and shine your torch in. Almost all ducts are three to six inches in diameter. Simple arithmetic (yup - divide by four) gives you some idea what you can stuff into there without damaging the louvers. They're flexible when in horizontal position so if you raise two of them you can get extra clearance at the center. Some specific examples: a four inch louvered cap is large enough to slide in a small FRS radio, a small Pocket PC or a AA battery pack. With some care, you could even squeeze in a mini PenCam. A six inch louvered ven can accept a D-cell battery pack, a Nomad Jukebox 3, and enough portable communications equipment to set up a remote-control command post.

Hooded vent caps are covered by an angled hood which protrudes from the exterior wall. They have a swing out damper to prevent back drafts and to keep pests out. They might also have a separate removable pest guard held in place by hooks or snaps. Hoods that enclose a large volume can accommodate larger objects than an equal-size louvered cap but even the big ones are extremely awkward to look into. Standard flashlights don't fit (since you need to shine them straight in) and the wimpy ones that do fit don't provide enough lighting, as well as the compact disposable units with three side-by-side batteries. Unless you have a really odd-shaped head, the next challenge is to actually look inside. It's possible to position your head under the hood and use a small mirror but I wouldn't recommend it. Interpretation of a tiny reversed image while juggling a damper, mirror, and flashlight is not a skill that you want to acquire. What you need is a small video device which can be inserted and interactively positioned, e.g., a PC camera.

If you live in a town house or some other multi-family building then don't forget to check for bathroom exhaust ducts which might pass through the attic to the shared (and hence insecure) rooftop. But don't actually go up on the roof. It's dangerous, and besides you can see more by going up into the attic. Just watch out for protruding nails and don't step through the ceiling. If there is ductwork up there you'll see that it's the flexible metal type and it follows a smooth curve from the fan housing up to the vent. Rooftop vents are the easiest ones to snake equipment into since their ducts usually don't have any sharp bends and also because gravity does most of the work. That makes them soft targets but not necessarily high value ones: what goes on in the bathroom itself isn't of much interest and an upstairs bathroom typically borders on high-traffic areas rather than discussion areas. These are just generalizations - your house might be different.

Two Privacy Intrusions

So where in your house would you go to place a sensitive, confidential phone call? Assume it's about something really big: your strategy for the next football game, a plot to overthrow the mayor, or maybe the next release of your network snuffer (spelling intentional). That kind of deep thinking requires lots of beer or soda pop and other good stuff. So the kitchen is the perfect place. If it has a central island counter, the kind with a cook top and integrated surface downdraft vent, then you might place the call from that countertop. Well, if that's the case then there could be a microphone literally right under your nose. Open up a cabinet door near the vent and you'll probably see a honking big six-inch duct coming out of the floor. The microphone would be right there where it meets the integrated blower. Stove ducts are required - by code - to be composed of rigid metal ductwork. It's stiff so it won't have any sags or bulges that are difficult to fish through. Since it's smooth there aren't many ridges to catch incoming or outgoing gear onto, although you do have to watch out for exposed sheet metal screws. Last but not least, downdraft vents need more pull than the overhead types so the ductwork has to be at least six inches in diameter. So downdraft vents are another soft target, as long as the duct isn't blocked by a remote blower or a pop-up snorkel vent grille.

Maybe you don't like to use the kitchen for sensitive calls because too many family members hang out there (your parents, your kid sister, your own kids, whatever). Then the basement might be a better location even though it's less well equipped. But if it has a bathroom bordering on the main area and that bathroom has an exhaust fan, then it might be less private than you think. You probably noticed its vent cap during your outside tour. It's located low on the ground so it's easy to access. But the ductwork consists of flexible metal tubing. It's corrugated, has lots of sags and bulges, and is thin and easy to damage: very difficult to fish equipment into. If it has any bends or if it runs for longer than ten feet then it's probably immune to the simple method that I'll describe in this article. But who knows - you might dream up more effective techniques.


Now that you know where the soft spots are, the next step is to actually try planting a microphone to measure its pickup range and see how vulnerable your place is. There are all kinds of esoteric equipment out there but I'll focus on standard consumer stuff so that maybe you can choose from your existing treasure trove.

Let's start with the mic. There are three important things to remember. First of all, you're trying to pick up far-field signals so don't use a noise-canceling mic. Secondly, choose an omni directional unit since its orientation will be hard to control. Thirdly, use a wired mic since they're small, can't be picked up by RF detectors, and also because the wire makes it less likely that you'll lose the @#$* thing deep inside a duct run.

If you're testing with a PC then a small multimedia mic is fine, otherwise use either a tie-clip mic or a lapel mic. The classic tie-clip design's tiny mic and separate battery box make it ideal for covert recording in public (it can even be fitted into the top of a disposable pen) but the small size reduces sensitivity a bit and the separate battery box is yet another bulge that might get caught on a sheet metal screw or whatever. Lapel mics are more compact as a whole because they integrate the battery box to the microphone housing but they're also more likely to have a modern right-angle plug which is less than ideal - you'll see why soon enough.

The recorder should be placed just inside the vent cap so that the cap's louvers can be fully closed to block outside noise sources. The mic's wire probably won't be long enough so use a headphone extension cable but make sure it's shielded and is a straight cable, not the coiled type. Get the minimum length you need - shorter is better. Headphone cables have three conductors so they're perfect for stereo mics or PC mics and are also usable with the mono mics used by the most portable audio gear. I hope you know not to plug a PC mic into audio gear or vice versa - they aren't compatible.


Even if you succeed in positioning the mic right next to the fan's exhaust port, its location guarantees that the signal will be muffled and reverberant. So the ideal recorder would have continuously adjustable microphone sensitivity that you can crank up to an abnormally high level. It would also have digital outputs so that the audio can be uploaded for further amplification and more sophisticated enhancement, and of course it needs a jack for an external microphone. All portable datacorders and some minidisk recorders have those features. They're good test tools but don't have enough recording capacity for real-life surveillance applications. Another possibility is an MP3 recorder with a line in jack but it would need a preamp to raise the mic input to line levels. I don't know of any small off-the-shelf preamps so you might have to build your own: look for "audio preamp" at sites like discovercircuits.com. Keep away from phono preamps - they-re special-purpose devices that were used in the last century when music was recorded on vinyl. Note that the Nomad Jukebox 3 has a line in jack, or google "line music recorder" to find a smaller unit. Try to get a model that can record enough raw audio without compressing it.

You might think that a pocket memo recorder would be perfect for the job. For example, the Olympus DS-330 Digital Voice Recorder is the size of a cigarette lighter, lightweight, all-digital, and has a jack for an external microphone. In standard playback mode it can record two hours and thirty-five minutes which is more than enough for acoustic testing. But it doesn't have enough dynamic ranger for most surveillance applications it only has two sensitivity levels, and its aggressive compression algorithm reduces low-level speech into low-level incomprehensible babble. So it's only useful in ideal conditions: fans that have no exhaust port dampers and are close to the target area. An extra preamp stage might help.

A notebook PC makes an excellent recorder - see my article "Microphone Laptops, and Supertaps" in [2600 magazine volume]20:[issue]2. Configure it for 16 bits and either 8 kHz or 16 kHz. A Pocket PC or PDA is even better, as long as it has a jack for an external microphone. Just use whatever you have - even a boom box with a cassette recorder is good enough for exploratory tests. But remember that a real intruder will probably have better equipment than you do. Don't assume that battery life is a serious constraint. It's easy to hook up external battery packs. A homebrew microphone cable could supply endless power to replace the mic's tiny button cell and as an added bonus it could supply a higher voltage to boost the mic's sensitivity a few dB.

Installing the Microphone

The ideal microphone delivery device would be some sort of robotic "duct rat". You probably don't have one lying around in your toolbox so you'll have to find some way to fish the mic into position. It might be harder than you expect. Take interior measurements first so that you'll know how far the mic has to be inserted. If the vent cap is hooded don't just fish blindly assuming that the ductwork is all in a straight line. The location of the vent cap is constrained by clearances to the ground and to windows so the duct might need a downwards twisting dive to get lined up between the joists.

If you want your test to be realistic then you'll have to use unobtrusive equipment to insert the mic - I doubt that an intruder would go skulking around your neighborhood armed with duct cleaning brushes. Try to find something smaller. Whatever you do, don't use an electrician's fish tape - they're much too stiff and are sure to damage unseen flexible connections, the damper, or the fan blades. A metal tape measure is safer and is a lot more convenient to carry around. A slim, lockable 16-foot unit with a removable belt clip is a good choice since you can insert it into the vent cap once the mic had been positioned. Go to a larger size if you need more stiffness or length but then you might have to leave it outside the vent cap and the louvers won't be fully closed.

Attach the microphone with masking tape so that it will be easy to release once you're done. It you're using a lapel mic then tape it facing down just beyond the end of the measuring tape. If you're using a tie-clip mic then let the mic element extend an extra half-inch so it can hang downwards. Use plastic-coated 18 gauge wire to fasten a small plastic cat toy (the kind that comes with a bell inside) over the end of the measuring tape. The cat toy provides a protective cage for the mic and prevents the metal tab at the end of the tape from catching on things. [I think a ping-pong ball might work better since the "bars" of the cat-toy "cage" might catch on sheet metal screw heads, etc, (plus the jingling of the cat-toy can be heard from inside the house LOL!) but then again it might dampen the mic's sensitivity] Don't forget to turn on the mic. If it has a separate battery box then tape the box into the curve of the measuring tape. Position it to protect the on/off switch or if that can't be done then cover the switch with a piece of masking tape. [Another good idea would be to position the unit so that the switch's "on" position is pointed toward you. That way, most any rubbing while the unit is traveling away from you through the duct is going push the switch toward the "on" position, which isn't a problem, and it doesn't matter if the switch gets turned off while you are pulling the unit back out. You should still tape the switch just in case, though.] You also need to tape down the joint to the extension cable and that's when you'll realize that an old-fashioned straight microphone plug is more appropriate than the newer right-angle ones.

Pay out the measuring tape from a distance of two or three feet so that you can accurately gauge perpendicularity. Measuring tapes are only flexible in a single plane. If you're fishing into a rigid duct that has a vertical bend further in (typical of downdraft vents) or flexible duct with vertical sags then orient the tape as though you were measuring a floor. If you're fishing into flexible duct which zigzags within it's 16 inches of joist space then hold the tape measure sideways. Let the tape pull in the mic wire. If the wire stops pulling in it means the tap has gotten folded over itself which isn't good. Reel it back in and try again.

Once you've got the mic in place you can congratulate yourself: you planted a mic deep within the bowels of your house and set up a recorder in a weatherproof, easily accessible location. You did all this from the outside without being detected by the alarm system. But before patting yourself on the back too hard you should check if the setup is effective. Go to the target area and place a telephone call or speak as though you were in a meeting. If the pickup isn't what you expected then remove the blower assembly and check where the mic actually is. It could be in the middle of nowhere, right on top of a particularly noisy A/C duct.


So that's it for Duct Fishing 101. You might be wondering about the other vulnerabilities I mentioned earlier, like chimney and sewer lines. Well sorry but I'm not about to put my equipment in those places so you're on your own. But if you're expecting robots to come bursting out of your toilet like the creature in Alligator (1980) then forget it - that won't be happening for the next decade or so.

If you're like most people then you don't leave your valuables on the floor, and you don't hold secret meetings that anyone in their right mind would be interested in. So you won't lose any sleep over this article. If you wake up late one night to the sound of someone's voice coming out of a nearby bathroom fan, don't be too alarmed - it's just some doofus who's decided to sacrifice a cheap FRS radio for a practical joke. But be more wary if you wake up to strange, inhuman noises radiating from the ceiling. Pulsed, high-pitched whirring sounds characteristic of step monitors or precision servomotors, maybe even miniature high-speed cutters. By then it will be too late. Maybe you should go look at those ducts right now...[Whew! Finished! That fucker took awhile to type up!]

It is Very Possible i think 28.Jan.2007 20:32

Jim L. james.lakosky@yahoo.com

IF THIS HAPPENS NOT ONLY WILL ARE LOCATIONS AND PLACES be known BUT WE (MEANING PUBLIC)WILL ALSO BE HEARD, IF I remember right , 1984 orwell , and some move i forget movie title , movie was about how T.V. ( telvision) controlled the public. A teenager in the movie ( public had to wear a spcecial hat or anntena when watching T.V.) took his hat off when he was with his friend , FREE THOUGHT BECAME LIKE A DRUG TO FEAR , CAUSE PUBLIC WAS ALWAYS TOLD WHAT TO THINK , A SKOCK OR SOMETHING KEEP THE PUBLIC FORCED OR ENCOURGED TO WEAR THE HAT.