If you've ever stayed in an AirBnB, I'm sure that you've wondered,
can I sit on this toilet without worrying about some creep with a spy camera?
There's got to be some way to know for sure. And there is. They aren't cheap.
But this is an NLJD, a type of counter espionage device that has famously been used by the CIA
and other intelligence agencies to detect everything from
hidden cameras to microphones to data transceivers.
In fact, it can detect any electronic device, even if it is switched off.
Watch this.
Cool, right? There's one of my cameras.
There's another one. Freaking sick.
Found another one. This thing is so powerful that it will cook your eyeballs
and is literally illegal to use in Japan, Switzerland, France, Germany,
and many other countries. So, given how difficult it can be to access Cold War
air espionage by equipment from many of you, we also grabbed this cheap bug detector off of Amazon to see which one works better.
Let's start with our Bayside Bug Detector from Amazon.
It costs us only $30 and with that considered, it actually has a lot of features.
It can blast IR to reveal cameras. It has an IR detector to find night vision cameras,
a magnetic field detector for GPS trackers, and an RF detector to help find devices that are transmitting on Wi-Fi or Bluetooth frequencies.
It's this last one that we hope will be the most useful for tracking down
a hidden camera or microphone. Let's try it out.
Let me just turn the sensitivity up a little bit and... Oh, Lordy!
I'm not near anything! So, that's a problem.
Shut up!
The guides for how to use those things often instruct you to turn off any
Wi-Fi or Bluetooth devices that are in the area. That's no problem during the Cold War, but is virtually impossible today.
And even if I could turn off all of my neighbor's Xboxes,
it's still going to be very susceptible to false positives.
See, in the 80s, a light bulb transmitting RF, that would have been a dead giveaway.
But today, it probably just means that your Airbnb host really likes RGB.
Shut up! The final downside is that if a spy device was configured to record locally or to only
transmit on a schedule, we would have very little hope of finding it.
That's why the pros ignore toys like this, and instead rely on real tools like this.
Meet the REI Orion HGO 4000, a non-linear junction detector, or NLJD.
It's kind of like a metal detector, but specifically for electronics,
and I'm going to show you guys how it works. But before we can do that, there are a few safety items.
Absolutely do not point this at your head or eyes.
It is a microwave on a stick, and it will lightly cook your eyeballs and turn them opaque.
Not use it if there are anyone with a pacemaker or a hearing aid in,
and also do not leave it in close proximity to any part of your body for more than five minutes in a row.
Okay, with all of that in mind, the first mode we're going to use is search mode.
This doesn't tell us much about what we're scanning, but by using pulses rather than continuous output,
it allows us to use maximum scanning power without being illegal.
You see, the FCC won't let me be, or let me be me.
If me wants to output more than 3.3 watts of RF radiation,
but they only specify average power, and search mode operates at only a 6% duty cycle,
meaning that our peak power can be much higher without stepping into the illegal realm.
So what we're looking for then is a high second harmonic response,
which is this red line here, since that is the signature of a transistor.
We're also looking at the third harmonic here on this yellow line,
which might be an electronic device, but is more likely a rusty nail in a wall.
So let's give these VHSs a little scan here.
Haha! Oh, do you see that? It changed over to semiconductor.
So there could be an integrated circuit hidden right here,
and to show you guys that it won't pick up a false positive, I can scan this circuitry hoodie from LTTstore.com and see that no,
in fact, these circuits are just screen printed on.
So let's go ahead and change our mode to listen.
Now, instead of bouncing around both bars, I can narrow in on just the second harmonic that I'm looking for,
and I can actually hear in my headphones, bunch of static, bunch of static, bunch of static,
and nothing. So what's in here then? Could it be a hidden Arduino?
Oh! Yes, it could. And the coolest part is that it is completely unpowered and not transmitting anything,
but our nonlinear junction detector didn't care. It was able to easily find it anyway.
So the only question I have now then is, how in the Sam Hill does a microwave blaster find electronics?
Well, originally it didn't. The nonlinear junction detector was invented during World War II by Charles Bowville
to find corrosion under the paint of planes.
But before long they realized, hey, it was also really good for tracking down spy devices.
As you can imagine though, as quickly as the nonlinear junction detector became popular,
so did methods to defeat it. The CIA, for instance, spent a bunch of time and money creating the SRT-107,
a special microphone that has filters built in that will shunt the signal of an NLJD to ground, rendering it ineffective.
Meanwhile, the Russians developed a different plan. When they were mixing the concrete for the US Embassy in Moscow,
they hucked a bunch of dead electronics into the mix
so that there would be no way for the Americans to tell the real bugs from the false positives.
Very cool history or lesson Linus, but none of that answers the question.
How in the Sam Hill does a microwave blaster find electronics?
Okay, okay. To understand how the detector works though,
we first need to understand what a nonlinear junction is.
The nonlinearity that we're talking about is on the current voltage curve.
For something like a resistor or a wire, you get a simple straight line like this.
More voltage equals more current, which you probably know as Ohm's Law.
When you have two dissimilar materials touching though,
like say for example, this brass and the oxidized brass that has formed around it,
we'll get some nonlinearity on the current voltage graph that looks something like this.
And here's the fun part. Basically, every semiconductor is also a nonlinear junction
because semiconductors contain diodes.
Diodes are typically made out of silicon, with one side having small amounts of antimony added to it called N-type material,
and the other side having a small amount of boron added called a P-type material.
An N-type has free electrons, while a P-type has holes that simulate a positive charge.
Since one area has an excess of electrons, and the other has an excess of places for electrons to go,
naturally some of the electrons will diffuse from the N-side over to the P-side,
leaving what's called the depletion region in the center. Add power to the diode in the correct direction,
and once you have enough voltage to overcome the depletion region in the center,
about 0.6 volts for silicon, current will flow.
Reverse the direction of the battery though, and the depletion region will get larger,
preventing the flow of electricity and making a diode what it is,
a device that only allows electricity to flow in one direction.
All of this results in a current voltage graph that looks like this.
Pretty nonlinear, right? To detect this nonlinear junction then,
all we need to do is run some power through the device.
Any sort of RF radiation will induce a bit of current in a wire or a piece of metal that's
nearby, like this little wire that we hooked up to our oscilloscope.
And as you can see,
all I have to do is put this here, and I end up with a sine wave.
And since this wire is a linear conductor, it will simply re-radiate out that signal like the sine wave we originally generated.
If the signal goes through a nonlinear junction though,
the re-radiated signal will have additional components,
and that allows us to tell the difference between a diode and a rusty nail,
because of the dramatic difference in how they react to a voltage
or a current applied to their circuits. Now that we've got the oscilloscope hooked up,
we can see how the different modes operate. This particular one is Search Continuous,
where you can see that it's basically just firing out RF
at a variety of amplitudes and frequencies
to see if it can elicit some kind of response. It's throwing spaghetti at the wall to see what sticks.
If we switch over to Listen mode, things start to look a little bit more stable,
but we don't get the real picture until we zoom way out.
That right there is the pulses we were talking about,
where it's blasting with higher power on exactly the frequency
to find exactly what we're looking for, and then chilling out so that I don't get a knock on the door.
There is one thing that kind of ate at us though.
Typically the current that an RF signal will induce in a wire is very small.
Like we're talking on the order of millivolts, but since a silicon diode won't allow any current to flow until about 0.6 volts,
how the heck is this thing able to detect anything?
Well, the answer is simple. By making it very, very powerful,
we saw over one volt in our wire that we stuck next to this thing,
because again guys, it's basically a microwave on a stick.
Very cool. So, conclusion then.
If you want to be confident that no one is spying on you, should you run out and get one of these?
Well, there are actually a couple problems.
Big problems. Like, you might imagine this thing works like in a video game, right?
You press up on the D-pad, it enters detective mode,
and it highlights all the key objects in the room.
But not so much. The recommended scanning rate is about one square foot every three seconds.
And that's for flat surfaces.
So, a typical small office could easily take two to three hours
to scan properly, while an executive office could take more like an entire day.
It is a long and tedious process that, as a general rule of thumb,
takes about as long as applying three coats of paint to every wall in a room.
Another problem? They are eye-wateringly expensive.
A questionable AliExpress unit starts at about $10,000,
with name brand ones like this landing closer to $15,000.
That's actually one of the reasons that this project took so long to get off the ground.
We had to wait to snag an older unit on eBay, which still cost us a couple of grand.
That is still a lot of money for non-spy agency folks.
But I think the biggest problem, though, is that an NLJD can't detect the most likely way that someone's going to bug you.
Outside of an Airbnb, the chances that someone's going to go to the effort of hiding electronics
to spy on you are fleetingly small, not because no one wants to spy on you,
but because these days, everyone has a camera and a microphone on them at all times,
sometimes more than one. Why would I bother physically breaking into your place to plant a device
when I could just remotely access a device you are already carrying with you
from the other side of the planet without ever leaving my chair?
So if you're concerned about cameras in your Airbnb, that's totally valid.
But the best countermeasure is just to look around for anything suspicious.
We're going to link to a couple of decent guides that we found on searching for spy equipment,
just like how I'm spying this segue to our sponsor.
It's over there. You can't see, but it's there. Look, I can detect it.
If you guys enjoyed this video, why don't you check out our Wi-Fi cracking van video?
That one is honestly a lot scarier than hidden cameras and microphones.