WEBVTT 00:00:00.000 --> 00:00:03.440 If you've ever stayed in an AirBnB, I'm sure that you've wondered, 00:00:03.440 --> 00:00:08.240 can I sit on this toilet without worrying about some creep with a spy camera? 00:00:10.000 --> 00:00:15.040 There's got to be some way to know for sure. And there is. They aren't cheap. 00:00:15.040 --> 00:00:22.800 But this is an NLJD, a type of counter espionage device that has famously been used by the CIA 00:00:22.800 --> 00:00:26.240 and other intelligence agencies to detect everything from 00:00:26.320 --> 00:00:30.000 hidden cameras to microphones to data transceivers. 00:00:30.000 --> 00:00:35.600 In fact, it can detect any electronic device, even if it is switched off. 00:00:36.160 --> 00:00:36.720 Watch this. 00:00:40.640 --> 00:00:44.480 Cool, right? There's one of my cameras. 00:00:45.920 --> 00:00:49.600 There's another one. Freaking sick. 00:00:50.560 --> 00:00:55.840 Found another one. This thing is so powerful that it will cook your eyeballs 00:00:55.840 --> 00:00:59.840 and is literally illegal to use in Japan, Switzerland, France, Germany, 00:00:59.840 --> 00:01:05.120 and many other countries. So, given how difficult it can be to access Cold War 00:01:05.120 --> 00:01:12.960 air espionage by equipment from many of you, we also grabbed this cheap bug detector off of Amazon to see which one works better. 00:01:22.240 --> 00:01:25.360 Let's start with our Bayside Bug Detector from Amazon. 00:01:25.360 --> 00:01:30.320 It costs us only $30 and with that considered, it actually has a lot of features. 00:01:30.320 --> 00:01:35.600 It can blast IR to reveal cameras. It has an IR detector to find night vision cameras, 00:01:35.600 --> 00:01:44.160 a magnetic field detector for GPS trackers, and an RF detector to help find devices that are transmitting on Wi-Fi or Bluetooth frequencies. 00:01:44.160 --> 00:01:47.520 It's this last one that we hope will be the most useful for tracking down 00:01:47.520 --> 00:01:50.000 a hidden camera or microphone. Let's try it out. 00:01:50.640 --> 00:01:54.080 Let me just turn the sensitivity up a little bit and... Oh, Lordy! 00:01:56.000 --> 00:02:00.080 I'm not near anything! So, that's a problem. 00:02:01.520 --> 00:02:02.160 Shut up! 00:02:04.640 --> 00:02:08.800 The guides for how to use those things often instruct you to turn off any 00:02:08.800 --> 00:02:15.600 Wi-Fi or Bluetooth devices that are in the area. That's no problem during the Cold War, but is virtually impossible today. 00:02:15.600 --> 00:02:19.280 And even if I could turn off all of my neighbor's Xboxes, 00:02:19.360 --> 00:02:22.560 it's still going to be very susceptible to false positives. 00:02:22.560 --> 00:02:28.000 See, in the 80s, a light bulb transmitting RF, that would have been a dead giveaway. 00:02:28.000 --> 00:02:32.480 But today, it probably just means that your Airbnb host really likes RGB. 00:02:33.680 --> 00:02:40.880 Shut up! The final downside is that if a spy device was configured to record locally or to only 00:02:40.880 --> 00:02:44.560 transmit on a schedule, we would have very little hope of finding it. 00:02:45.200 --> 00:02:50.880 That's why the pros ignore toys like this, and instead rely on real tools like this. 00:02:51.600 --> 00:02:58.720 Meet the REI Orion HGO 4000, a non-linear junction detector, or NLJD. 00:02:59.360 --> 00:03:03.360 It's kind of like a metal detector, but specifically for electronics, 00:03:03.360 --> 00:03:08.000 and I'm going to show you guys how it works. But before we can do that, there are a few safety items. 00:03:08.640 --> 00:03:11.760 Absolutely do not point this at your head or eyes. 00:03:11.760 --> 00:03:16.160 It is a microwave on a stick, and it will lightly cook your eyeballs and turn them opaque. 00:03:16.240 --> 00:03:19.280 Not use it if there are anyone with a pacemaker or a hearing aid in, 00:03:19.280 --> 00:03:23.760 and also do not leave it in close proximity to any part of your body for more than five minutes in a row. 00:03:24.640 --> 00:03:29.200 Okay, with all of that in mind, the first mode we're going to use is search mode. 00:03:29.200 --> 00:03:35.760 This doesn't tell us much about what we're scanning, but by using pulses rather than continuous output, 00:03:35.760 --> 00:03:40.240 it allows us to use maximum scanning power without being illegal. 00:03:40.240 --> 00:03:44.080 You see, the FCC won't let me be, or let me be me. 00:03:44.080 --> 00:03:47.600 If me wants to output more than 3.3 watts of RF radiation, 00:03:47.600 --> 00:03:54.080 but they only specify average power, and search mode operates at only a 6% duty cycle, 00:03:54.080 --> 00:03:59.440 meaning that our peak power can be much higher without stepping into the illegal realm. 00:03:59.440 --> 00:04:04.080 So what we're looking for then is a high second harmonic response, 00:04:04.080 --> 00:04:08.720 which is this red line here, since that is the signature of a transistor. 00:04:08.720 --> 00:04:12.800 We're also looking at the third harmonic here on this yellow line, 00:04:12.800 --> 00:04:18.560 which might be an electronic device, but is more likely a rusty nail in a wall. 00:04:18.560 --> 00:04:22.640 So let's give these VHSs a little scan here. 00:04:26.000 --> 00:04:30.720 Haha! Oh, do you see that? It changed over to semiconductor. 00:04:30.720 --> 00:04:33.760 So there could be an integrated circuit hidden right here, 00:04:33.760 --> 00:04:41.440 and to show you guys that it won't pick up a false positive, I can scan this circuitry hoodie from LTTstore.com and see that no, 00:04:41.440 --> 00:04:44.080 in fact, these circuits are just screen printed on. 00:04:45.120 --> 00:04:48.880 So let's go ahead and change our mode to listen. 00:04:48.880 --> 00:04:54.800 Now, instead of bouncing around both bars, I can narrow in on just the second harmonic that I'm looking for, 00:04:54.800 --> 00:04:59.760 and I can actually hear in my headphones, bunch of static, bunch of static, bunch of static, 00:05:01.680 --> 00:05:07.600 and nothing. So what's in here then? Could it be a hidden Arduino? 00:05:08.000 --> 00:05:16.320 Oh! Yes, it could. And the coolest part is that it is completely unpowered and not transmitting anything, 00:05:16.320 --> 00:05:21.840 but our nonlinear junction detector didn't care. It was able to easily find it anyway. 00:05:24.320 --> 00:05:30.560 So the only question I have now then is, how in the Sam Hill does a microwave blaster find electronics? 00:05:31.120 --> 00:05:37.920 Well, originally it didn't. The nonlinear junction detector was invented during World War II by Charles Bowville 00:05:37.920 --> 00:05:40.800 to find corrosion under the paint of planes. 00:05:41.440 --> 00:05:47.440 But before long they realized, hey, it was also really good for tracking down spy devices. 00:05:48.080 --> 00:05:52.880 As you can imagine though, as quickly as the nonlinear junction detector became popular, 00:05:52.880 --> 00:06:00.000 so did methods to defeat it. The CIA, for instance, spent a bunch of time and money creating the SRT-107, 00:06:00.080 --> 00:06:07.600 a special microphone that has filters built in that will shunt the signal of an NLJD to ground, rendering it ineffective. 00:06:08.160 --> 00:06:14.240 Meanwhile, the Russians developed a different plan. When they were mixing the concrete for the US Embassy in Moscow, 00:06:14.240 --> 00:06:17.760 they hucked a bunch of dead electronics into the mix 00:06:17.760 --> 00:06:22.640 so that there would be no way for the Americans to tell the real bugs from the false positives. 00:06:23.600 --> 00:06:27.120 Very cool history or lesson Linus, but none of that answers the question. 00:06:27.680 --> 00:06:31.120 How in the Sam Hill does a microwave blaster find electronics? 00:06:31.680 --> 00:06:35.200 Okay, okay. To understand how the detector works though, 00:06:35.200 --> 00:06:38.560 we first need to understand what a nonlinear junction is. 00:06:39.200 --> 00:06:43.120 The nonlinearity that we're talking about is on the current voltage curve. 00:06:43.680 --> 00:06:48.560 For something like a resistor or a wire, you get a simple straight line like this. 00:06:48.560 --> 00:06:53.280 More voltage equals more current, which you probably know as Ohm's Law. 00:06:53.280 --> 00:06:56.400 When you have two dissimilar materials touching though, 00:06:56.400 --> 00:07:01.840 like say for example, this brass and the oxidized brass that has formed around it, 00:07:01.840 --> 00:07:06.160 we'll get some nonlinearity on the current voltage graph that looks something like this. 00:07:06.880 --> 00:07:12.960 And here's the fun part. Basically, every semiconductor is also a nonlinear junction 00:07:12.960 --> 00:07:15.280 because semiconductors contain diodes. 00:07:16.000 --> 00:07:23.200 Diodes are typically made out of silicon, with one side having small amounts of antimony added to it called N-type material, 00:07:23.200 --> 00:07:28.320 and the other side having a small amount of boron added called a P-type material. 00:07:28.320 --> 00:07:33.680 An N-type has free electrons, while a P-type has holes that simulate a positive charge. 00:07:34.320 --> 00:07:40.000 Since one area has an excess of electrons, and the other has an excess of places for electrons to go, 00:07:40.560 --> 00:07:45.120 naturally some of the electrons will diffuse from the N-side over to the P-side, 00:07:45.120 --> 00:07:50.240 leaving what's called the depletion region in the center. Add power to the diode in the correct direction, 00:07:50.240 --> 00:07:53.920 and once you have enough voltage to overcome the depletion region in the center, 00:07:53.920 --> 00:07:56.800 about 0.6 volts for silicon, current will flow. 00:07:57.520 --> 00:08:01.520 Reverse the direction of the battery though, and the depletion region will get larger, 00:08:01.520 --> 00:08:05.040 preventing the flow of electricity and making a diode what it is, 00:08:05.040 --> 00:08:08.800 a device that only allows electricity to flow in one direction. 00:08:08.800 --> 00:08:12.240 All of this results in a current voltage graph that looks like this. 00:08:13.200 --> 00:08:18.320 Pretty nonlinear, right? To detect this nonlinear junction then, 00:08:18.320 --> 00:08:21.120 all we need to do is run some power through the device. 00:08:21.840 --> 00:08:27.040 Any sort of RF radiation will induce a bit of current in a wire or a piece of metal that's 00:08:27.040 --> 00:08:30.960 nearby, like this little wire that we hooked up to our oscilloscope. 00:08:30.960 --> 00:08:31.840 And as you can see, 00:08:34.240 --> 00:08:38.480 all I have to do is put this here, and I end up with a sine wave. 00:08:39.280 --> 00:08:46.800 And since this wire is a linear conductor, it will simply re-radiate out that signal like the sine wave we originally generated. 00:08:47.760 --> 00:08:50.960 If the signal goes through a nonlinear junction though, 00:08:50.960 --> 00:08:54.000 the re-radiated signal will have additional components, 00:08:54.000 --> 00:08:58.400 and that allows us to tell the difference between a diode and a rusty nail, 00:08:58.400 --> 00:09:02.480 because of the dramatic difference in how they react to a voltage 00:09:02.480 --> 00:09:06.400 or a current applied to their circuits. Now that we've got the oscilloscope hooked up, 00:09:06.400 --> 00:09:12.240 we can see how the different modes operate. This particular one is Search Continuous, 00:09:12.240 --> 00:09:15.840 where you can see that it's basically just firing out RF 00:09:15.840 --> 00:09:19.040 at a variety of amplitudes and frequencies 00:09:19.040 --> 00:09:24.720 to see if it can elicit some kind of response. It's throwing spaghetti at the wall to see what sticks. 00:09:24.720 --> 00:09:30.160 If we switch over to Listen mode, things start to look a little bit more stable, 00:09:30.160 --> 00:09:33.200 but we don't get the real picture until we zoom way out. 00:09:34.000 --> 00:09:37.440 That right there is the pulses we were talking about, 00:09:37.440 --> 00:09:41.360 where it's blasting with higher power on exactly the frequency 00:09:41.360 --> 00:09:46.960 to find exactly what we're looking for, and then chilling out so that I don't get a knock on the door. 00:09:47.920 --> 00:09:50.480 There is one thing that kind of ate at us though. 00:09:51.120 --> 00:09:56.160 Typically the current that an RF signal will induce in a wire is very small. 00:09:56.160 --> 00:10:04.480 Like we're talking on the order of millivolts, but since a silicon diode won't allow any current to flow until about 0.6 volts, 00:10:05.040 --> 00:10:07.840 how the heck is this thing able to detect anything? 00:10:08.640 --> 00:10:12.480 Well, the answer is simple. By making it very, very powerful, 00:10:13.040 --> 00:10:19.200 we saw over one volt in our wire that we stuck next to this thing, 00:10:19.200 --> 00:10:23.520 because again guys, it's basically a microwave on a stick. 00:10:24.560 --> 00:10:27.840 Very cool. So, conclusion then. 00:10:28.400 --> 00:10:32.320 If you want to be confident that no one is spying on you, should you run out and get one of these? 00:10:33.040 --> 00:10:35.600 Well, there are actually a couple problems. 00:10:36.560 --> 00:10:41.360 Big problems. Like, you might imagine this thing works like in a video game, right? 00:10:41.360 --> 00:10:44.640 You press up on the D-pad, it enters detective mode, 00:10:44.640 --> 00:10:47.120 and it highlights all the key objects in the room. 00:10:47.760 --> 00:10:56.240 But not so much. The recommended scanning rate is about one square foot every three seconds. 00:10:56.240 --> 00:10:59.440 And that's for flat surfaces. 00:10:59.440 --> 00:11:04.720 So, a typical small office could easily take two to three hours 00:11:04.720 --> 00:11:10.080 to scan properly, while an executive office could take more like an entire day. 00:11:10.080 --> 00:11:14.880 It is a long and tedious process that, as a general rule of thumb, 00:11:14.880 --> 00:11:20.080 takes about as long as applying three coats of paint to every wall in a room. 00:11:20.960 --> 00:11:24.560 Another problem? They are eye-wateringly expensive. 00:11:25.120 --> 00:11:29.920 A questionable AliExpress unit starts at about $10,000, 00:11:29.920 --> 00:11:33.920 with name brand ones like this landing closer to $15,000. 00:11:33.920 --> 00:11:38.240 That's actually one of the reasons that this project took so long to get off the ground. 00:11:38.240 --> 00:11:43.200 We had to wait to snag an older unit on eBay, which still cost us a couple of grand. 00:11:43.920 --> 00:11:47.920 That is still a lot of money for non-spy agency folks. 00:11:48.720 --> 00:11:56.160 But I think the biggest problem, though, is that an NLJD can't detect the most likely way that someone's going to bug you. 00:11:56.800 --> 00:12:01.840 Outside of an Airbnb, the chances that someone's going to go to the effort of hiding electronics 00:12:01.840 --> 00:12:06.880 to spy on you are fleetingly small, not because no one wants to spy on you, 00:12:06.880 --> 00:12:12.560 but because these days, everyone has a camera and a microphone on them at all times, 00:12:12.560 --> 00:12:18.400 sometimes more than one. Why would I bother physically breaking into your place to plant a device 00:12:18.400 --> 00:12:22.720 when I could just remotely access a device you are already carrying with you 00:12:22.720 --> 00:12:25.600 from the other side of the planet without ever leaving my chair? 00:12:26.240 --> 00:12:30.960 So if you're concerned about cameras in your Airbnb, that's totally valid. 00:12:31.440 --> 00:12:36.080 But the best countermeasure is just to look around for anything suspicious. 00:12:36.080 --> 00:12:40.320 We're going to link to a couple of decent guides that we found on searching for spy equipment, 00:12:40.320 --> 00:12:44.880 just like how I'm spying this segue to our sponsor. 00:12:46.000 --> 00:12:48.560 It's over there. You can't see, but it's there. Look, I can detect it. 00:12:49.840 --> 00:12:54.240 If you guys enjoyed this video, why don't you check out our Wi-Fi cracking van video? 00:12:54.240 --> 00:12:58.720 That one is honestly a lot scarier than hidden cameras and microphones.