TUCoPS :: Hardware Hacks

TUCoPS :: Hardware Hacks :: tdr.htm
Time Domain Reflectometry - How bugs are detected remotely

TSCM - Time Domain Reflectometry (TDR) Analysis TDR - Time Domain Reflectometry Analysis

Time Domain Reflectometry is the analysis of a conductor (wire, cable, or fiber optic) by sending a pulsed signal into the conductor, and then examining the reflection of that pulse.

By examining the polarity, amplitude, frequencies and other electrical signatures of all reflections; tampering or bugs may be precisely located.

Any device or wire attached will cause a detectable anomaly, the TSCM technician will then perform a physical inspection at the location of the anomaly.

TDR analysis will usually NOT detect capacitively isolated devices or inductive taps. In the case of capacitively isolated device or inductive tap, the TDR sweep is always supplemented by a detailed high frequency cross talk evaluation and a detailed physical inspection.

Keep in mind that no piece of test equipment (including TDRs) can locate bugs, all they can do is give the TSCM technician a clue where to investigate further.

The only thing on Earth that can detect a bug are the eyes and hands of a well educated TSCM technician. The TDR only tells the TSCM technician where to look, NOT what's located there.

There are no magical bug detectors in this business, just fools who buy them. BEWARE, BEWARE, BEWARE

Left: Signal Generator Pulse injected into cable
Right: Echo Received from Pulse (Reflection)

The delay between the initial pulse and the reflected pulse indicate the length of the cable (or the location of an anomaly). The delay is divide by the speed of light, and multiplied by the proper velocity of propagation (based on the capacitance of one foot of cable), and then divide the result by two. On a ten mile section of cable a resolution of one tenth of an inch or better is typical (512,000 point TDR).

Left: 30ft Segment of Cable
Right: 150ft Segment of Cable

Examine the area between the cursors (vertical lines)...

The first is a 30 foot segment of cable running between an office building and the pole. This anomaly was caused by a tape recorder installed into a pedestal behind the building.

The second is a 150 foot segment of telephone line, the minor ripples indicate points where the cable was bent or secured to a pole. The large spike indicates a loading coil downline (around 500 foot away).

Left: Clean Open on Cable - Notice Polarity of Spike
Right: Dead Short on Cable - Notice Polarity of Spike

The polarity and intensity of the spike indicates the resistive value of the anomaly, and give the TSCM technician an idea of what to look for when he examines the anomaly. For example it could be a split/re-split tap, a direct T-Split, CO tap, parasitic bug, and so on... or just a sloppy installation of legitimate equipment by the phone company.

Left: Regular Loading Coil on Wire
Right: Bugged Loading Coil on Wire - Notice that the bug causes virtually no change in the trace... (Loading Coils prevent the TDR pulse from passing).

Time Domain Reflectometry will not locate a bug on a loading coil, only a visual inspection of the junction point and loading coil can identify them. The TDR is used to tell the TSCM inspector where to look, nothing more, it is not a magical black box.

Note: Most law enforcement (and corporate) wiretaps are installed by installing a capacitively isolated device (or slave) at or behind a loading coil (typically 1-2 miles or more away from the target).

Law Enforcement capacitively isolated slave device advertised as undetectable, located using Near-End/Far-End High Frequency Cross-Talk TDR analysis.