1 00:00:00,000 --> 00:00:03,440 If you've ever stayed in an AirBnB, I'm sure that you've wondered, 2 00:00:03,440 --> 00:00:08,240 can I sit on this toilet without worrying about some creep with a spy camera? 3 00:00:10,000 --> 00:00:15,040 There's got to be some way to know for sure. And there is. They aren't cheap. 4 00:00:15,040 --> 00:00:22,800 But this is an NLJD, a type of counter espionage device that has famously been used by the CIA 5 00:00:22,800 --> 00:00:26,240 and other intelligence agencies to detect everything from 6 00:00:26,320 --> 00:00:30,000 hidden cameras to microphones to data transceivers. 7 00:00:30,000 --> 00:00:35,600 In fact, it can detect any electronic device, even if it is switched off. 8 00:00:36,160 --> 00:00:36,720 Watch this. 9 00:00:40,640 --> 00:00:44,480 Cool, right? There's one of my cameras. 10 00:00:45,920 --> 00:00:49,600 There's another one. Freaking sick. 11 00:00:50,560 --> 00:00:55,840 Found another one. This thing is so powerful that it will cook your eyeballs 12 00:00:55,840 --> 00:00:59,840 and is literally illegal to use in Japan, Switzerland, France, Germany, 13 00:00:59,840 --> 00:01:05,120 and many other countries. So, given how difficult it can be to access Cold War 14 00:01:05,120 --> 00:01:12,960 air espionage by equipment from many of you, we also grabbed this cheap bug detector off of Amazon to see which one works better. 15 00:01:22,240 --> 00:01:25,360 Let's start with our Bayside Bug Detector from Amazon. 16 00:01:25,360 --> 00:01:30,320 It costs us only $30 and with that considered, it actually has a lot of features. 17 00:01:30,320 --> 00:01:35,600 It can blast IR to reveal cameras. It has an IR detector to find night vision cameras, 18 00:01:35,600 --> 00:01:44,160 a magnetic field detector for GPS trackers, and an RF detector to help find devices that are transmitting on Wi-Fi or Bluetooth frequencies. 19 00:01:44,160 --> 00:01:47,520 It's this last one that we hope will be the most useful for tracking down 20 00:01:47,520 --> 00:01:50,000 a hidden camera or microphone. Let's try it out. 21 00:01:50,640 --> 00:01:54,080 Let me just turn the sensitivity up a little bit and... Oh, Lordy! 22 00:01:56,000 --> 00:02:00,080 I'm not near anything! So, that's a problem. 23 00:02:01,520 --> 00:02:02,160 Shut up! 24 00:02:04,640 --> 00:02:08,800 The guides for how to use those things often instruct you to turn off any 25 00:02:08,800 --> 00:02:15,600 Wi-Fi or Bluetooth devices that are in the area. That's no problem during the Cold War, but is virtually impossible today. 26 00:02:15,600 --> 00:02:19,280 And even if I could turn off all of my neighbor's Xboxes, 27 00:02:19,360 --> 00:02:22,560 it's still going to be very susceptible to false positives. 28 00:02:22,560 --> 00:02:28,000 See, in the 80s, a light bulb transmitting RF, that would have been a dead giveaway. 29 00:02:28,000 --> 00:02:32,480 But today, it probably just means that your Airbnb host really likes RGB. 30 00:02:33,680 --> 00:02:40,880 Shut up! The final downside is that if a spy device was configured to record locally or to only 31 00:02:40,880 --> 00:02:44,560 transmit on a schedule, we would have very little hope of finding it. 32 00:02:45,200 --> 00:02:50,880 That's why the pros ignore toys like this, and instead rely on real tools like this. 33 00:02:51,600 --> 00:02:58,720 Meet the REI Orion HGO 4000, a non-linear junction detector, or NLJD. 34 00:02:59,360 --> 00:03:03,360 It's kind of like a metal detector, but specifically for electronics, 35 00:03:03,360 --> 00:03:08,000 and I'm going to show you guys how it works. But before we can do that, there are a few safety items. 36 00:03:08,640 --> 00:03:11,760 Absolutely do not point this at your head or eyes. 37 00:03:11,760 --> 00:03:16,160 It is a microwave on a stick, and it will lightly cook your eyeballs and turn them opaque. 38 00:03:16,240 --> 00:03:19,280 Not use it if there are anyone with a pacemaker or a hearing aid in, 39 00:03:19,280 --> 00:03:23,760 and also do not leave it in close proximity to any part of your body for more than five minutes in a row. 40 00:03:24,640 --> 00:03:29,200 Okay, with all of that in mind, the first mode we're going to use is search mode. 41 00:03:29,200 --> 00:03:35,760 This doesn't tell us much about what we're scanning, but by using pulses rather than continuous output, 42 00:03:35,760 --> 00:03:40,240 it allows us to use maximum scanning power without being illegal. 43 00:03:40,240 --> 00:03:44,080 You see, the FCC won't let me be, or let me be me. 44 00:03:44,080 --> 00:03:47,600 If me wants to output more than 3.3 watts of RF radiation, 45 00:03:47,600 --> 00:03:54,080 but they only specify average power, and search mode operates at only a 6% duty cycle, 46 00:03:54,080 --> 00:03:59,440 meaning that our peak power can be much higher without stepping into the illegal realm. 47 00:03:59,440 --> 00:04:04,080 So what we're looking for then is a high second harmonic response, 48 00:04:04,080 --> 00:04:08,720 which is this red line here, since that is the signature of a transistor. 49 00:04:08,720 --> 00:04:12,800 We're also looking at the third harmonic here on this yellow line, 50 00:04:12,800 --> 00:04:18,560 which might be an electronic device, but is more likely a rusty nail in a wall. 51 00:04:18,560 --> 00:04:22,640 So let's give these VHSs a little scan here. 52 00:04:26,000 --> 00:04:30,720 Haha! Oh, do you see that? It changed over to semiconductor. 53 00:04:30,720 --> 00:04:33,760 So there could be an integrated circuit hidden right here, 54 00:04:33,760 --> 00:04:41,440 and to show you guys that it won't pick up a false positive, I can scan this circuitry hoodie from LTTstore.com and see that no, 55 00:04:41,440 --> 00:04:44,080 in fact, these circuits are just screen printed on. 56 00:04:45,120 --> 00:04:48,880 So let's go ahead and change our mode to listen. 57 00:04:48,880 --> 00:04:54,800 Now, instead of bouncing around both bars, I can narrow in on just the second harmonic that I'm looking for, 58 00:04:54,800 --> 00:04:59,760 and I can actually hear in my headphones, bunch of static, bunch of static, bunch of static, 59 00:05:01,680 --> 00:05:07,600 and nothing. So what's in here then? Could it be a hidden Arduino? 60 00:05:08,000 --> 00:05:16,320 Oh! Yes, it could. And the coolest part is that it is completely unpowered and not transmitting anything, 61 00:05:16,320 --> 00:05:21,840 but our nonlinear junction detector didn't care. It was able to easily find it anyway. 62 00:05:24,320 --> 00:05:30,560 So the only question I have now then is, how in the Sam Hill does a microwave blaster find electronics? 63 00:05:31,120 --> 00:05:37,920 Well, originally it didn't. The nonlinear junction detector was invented during World War II by Charles Bowville 64 00:05:37,920 --> 00:05:40,800 to find corrosion under the paint of planes. 65 00:05:41,440 --> 00:05:47,440 But before long they realized, hey, it was also really good for tracking down spy devices. 66 00:05:48,080 --> 00:05:52,880 As you can imagine though, as quickly as the nonlinear junction detector became popular, 67 00:05:52,880 --> 00:06:00,000 so did methods to defeat it. The CIA, for instance, spent a bunch of time and money creating the SRT-107, 68 00:06:00,080 --> 00:06:07,600 a special microphone that has filters built in that will shunt the signal of an NLJD to ground, rendering it ineffective. 69 00:06:08,160 --> 00:06:14,240 Meanwhile, the Russians developed a different plan. When they were mixing the concrete for the US Embassy in Moscow, 70 00:06:14,240 --> 00:06:17,760 they hucked a bunch of dead electronics into the mix 71 00:06:17,760 --> 00:06:22,640 so that there would be no way for the Americans to tell the real bugs from the false positives. 72 00:06:23,600 --> 00:06:27,120 Very cool history or lesson Linus, but none of that answers the question. 73 00:06:27,680 --> 00:06:31,120 How in the Sam Hill does a microwave blaster find electronics? 74 00:06:31,680 --> 00:06:35,200 Okay, okay. To understand how the detector works though, 75 00:06:35,200 --> 00:06:38,560 we first need to understand what a nonlinear junction is. 76 00:06:39,200 --> 00:06:43,120 The nonlinearity that we're talking about is on the current voltage curve. 77 00:06:43,680 --> 00:06:48,560 For something like a resistor or a wire, you get a simple straight line like this. 78 00:06:48,560 --> 00:06:53,280 More voltage equals more current, which you probably know as Ohm's Law. 79 00:06:53,280 --> 00:06:56,400 When you have two dissimilar materials touching though, 80 00:06:56,400 --> 00:07:01,840 like say for example, this brass and the oxidized brass that has formed around it, 81 00:07:01,840 --> 00:07:06,160 we'll get some nonlinearity on the current voltage graph that looks something like this. 82 00:07:06,880 --> 00:07:12,960 And here's the fun part. Basically, every semiconductor is also a nonlinear junction 83 00:07:12,960 --> 00:07:15,280 because semiconductors contain diodes. 84 00:07:16,000 --> 00:07:23,200 Diodes are typically made out of silicon, with one side having small amounts of antimony added to it called N-type material, 85 00:07:23,200 --> 00:07:28,320 and the other side having a small amount of boron added called a P-type material. 86 00:07:28,320 --> 00:07:33,680 An N-type has free electrons, while a P-type has holes that simulate a positive charge. 87 00:07:34,320 --> 00:07:40,000 Since one area has an excess of electrons, and the other has an excess of places for electrons to go, 88 00:07:40,560 --> 00:07:45,120 naturally some of the electrons will diffuse from the N-side over to the P-side, 89 00:07:45,120 --> 00:07:50,240 leaving what's called the depletion region in the center. Add power to the diode in the correct direction, 90 00:07:50,240 --> 00:07:53,920 and once you have enough voltage to overcome the depletion region in the center, 91 00:07:53,920 --> 00:07:56,800 about 0.6 volts for silicon, current will flow. 92 00:07:57,520 --> 00:08:01,520 Reverse the direction of the battery though, and the depletion region will get larger, 93 00:08:01,520 --> 00:08:05,040 preventing the flow of electricity and making a diode what it is, 94 00:08:05,040 --> 00:08:08,800 a device that only allows electricity to flow in one direction. 95 00:08:08,800 --> 00:08:12,240 All of this results in a current voltage graph that looks like this. 96 00:08:13,200 --> 00:08:18,320 Pretty nonlinear, right? To detect this nonlinear junction then, 97 00:08:18,320 --> 00:08:21,120 all we need to do is run some power through the device. 98 00:08:21,840 --> 00:08:27,040 Any sort of RF radiation will induce a bit of current in a wire or a piece of metal that's 99 00:08:27,040 --> 00:08:30,960 nearby, like this little wire that we hooked up to our oscilloscope. 100 00:08:30,960 --> 00:08:31,840 And as you can see, 101 00:08:34,240 --> 00:08:38,480 all I have to do is put this here, and I end up with a sine wave. 102 00:08:39,280 --> 00:08:46,800 And since this wire is a linear conductor, it will simply re-radiate out that signal like the sine wave we originally generated. 103 00:08:47,760 --> 00:08:50,960 If the signal goes through a nonlinear junction though, 104 00:08:50,960 --> 00:08:54,000 the re-radiated signal will have additional components, 105 00:08:54,000 --> 00:08:58,400 and that allows us to tell the difference between a diode and a rusty nail, 106 00:08:58,400 --> 00:09:02,480 because of the dramatic difference in how they react to a voltage 107 00:09:02,480 --> 00:09:06,400 or a current applied to their circuits. Now that we've got the oscilloscope hooked up, 108 00:09:06,400 --> 00:09:12,240 we can see how the different modes operate. This particular one is Search Continuous, 109 00:09:12,240 --> 00:09:15,840 where you can see that it's basically just firing out RF 110 00:09:15,840 --> 00:09:19,040 at a variety of amplitudes and frequencies 111 00:09:19,040 --> 00:09:24,720 to see if it can elicit some kind of response. It's throwing spaghetti at the wall to see what sticks. 112 00:09:24,720 --> 00:09:30,160 If we switch over to Listen mode, things start to look a little bit more stable, 113 00:09:30,160 --> 00:09:33,200 but we don't get the real picture until we zoom way out. 114 00:09:34,000 --> 00:09:37,440 That right there is the pulses we were talking about, 115 00:09:37,440 --> 00:09:41,360 where it's blasting with higher power on exactly the frequency 116 00:09:41,360 --> 00:09:46,960 to find exactly what we're looking for, and then chilling out so that I don't get a knock on the door. 117 00:09:47,920 --> 00:09:50,480 There is one thing that kind of ate at us though. 118 00:09:51,120 --> 00:09:56,160 Typically the current that an RF signal will induce in a wire is very small. 119 00:09:56,160 --> 00:10:04,480 Like we're talking on the order of millivolts, but since a silicon diode won't allow any current to flow until about 0.6 volts, 120 00:10:05,040 --> 00:10:07,840 how the heck is this thing able to detect anything? 121 00:10:08,640 --> 00:10:12,480 Well, the answer is simple. By making it very, very powerful, 122 00:10:13,040 --> 00:10:19,200 we saw over one volt in our wire that we stuck next to this thing, 123 00:10:19,200 --> 00:10:23,520 because again guys, it's basically a microwave on a stick. 124 00:10:24,560 --> 00:10:27,840 Very cool. So, conclusion then. 125 00:10:28,400 --> 00:10:32,320 If you want to be confident that no one is spying on you, should you run out and get one of these? 126 00:10:33,040 --> 00:10:35,600 Well, there are actually a couple problems. 127 00:10:36,560 --> 00:10:41,360 Big problems. Like, you might imagine this thing works like in a video game, right? 128 00:10:41,360 --> 00:10:44,640 You press up on the D-pad, it enters detective mode, 129 00:10:44,640 --> 00:10:47,120 and it highlights all the key objects in the room. 130 00:10:47,760 --> 00:10:56,240 But not so much. The recommended scanning rate is about one square foot every three seconds. 131 00:10:56,240 --> 00:10:59,440 And that's for flat surfaces. 132 00:10:59,440 --> 00:11:04,720 So, a typical small office could easily take two to three hours 133 00:11:04,720 --> 00:11:10,080 to scan properly, while an executive office could take more like an entire day. 134 00:11:10,080 --> 00:11:14,880 It is a long and tedious process that, as a general rule of thumb, 135 00:11:14,880 --> 00:11:20,080 takes about as long as applying three coats of paint to every wall in a room. 136 00:11:20,960 --> 00:11:24,560 Another problem? They are eye-wateringly expensive. 137 00:11:25,120 --> 00:11:29,920 A questionable AliExpress unit starts at about $10,000, 138 00:11:29,920 --> 00:11:33,920 with name brand ones like this landing closer to $15,000. 139 00:11:33,920 --> 00:11:38,240 That's actually one of the reasons that this project took so long to get off the ground. 140 00:11:38,240 --> 00:11:43,200 We had to wait to snag an older unit on eBay, which still cost us a couple of grand. 141 00:11:43,920 --> 00:11:47,920 That is still a lot of money for non-spy agency folks. 142 00:11:48,720 --> 00:11:56,160 But I think the biggest problem, though, is that an NLJD can't detect the most likely way that someone's going to bug you. 143 00:11:56,800 --> 00:12:01,840 Outside of an Airbnb, the chances that someone's going to go to the effort of hiding electronics 144 00:12:01,840 --> 00:12:06,880 to spy on you are fleetingly small, not because no one wants to spy on you, 145 00:12:06,880 --> 00:12:12,560 but because these days, everyone has a camera and a microphone on them at all times, 146 00:12:12,560 --> 00:12:18,400 sometimes more than one. Why would I bother physically breaking into your place to plant a device 147 00:12:18,400 --> 00:12:22,720 when I could just remotely access a device you are already carrying with you 148 00:12:22,720 --> 00:12:25,600 from the other side of the planet without ever leaving my chair? 149 00:12:26,240 --> 00:12:30,960 So if you're concerned about cameras in your Airbnb, that's totally valid. 150 00:12:31,440 --> 00:12:36,080 But the best countermeasure is just to look around for anything suspicious. 151 00:12:36,080 --> 00:12:40,320 We're going to link to a couple of decent guides that we found on searching for spy equipment, 152 00:12:40,320 --> 00:12:44,880 just like how I'm spying this segue to our sponsor. 153 00:12:46,000 --> 00:12:48,560 It's over there. You can't see, but it's there. Look, I can detect it. 154 00:12:49,840 --> 00:12:54,240 If you guys enjoyed this video, why don't you check out our Wi-Fi cracking van video? 155 00:12:54,240 --> 00:12:58,720 That one is honestly a lot scarier than hidden cameras and microphones.