Roger Cravens
--------------------------
Created: 27 August 1993
Modified: 16 March 1995
Modified: 15 May 1996
The frequencies that follow are all based on hard documentation (catalogs, intel reports, technical materials, etc...). For the purpose of intelligence analysis the Source Reliability Scale should be considered A, and the Data Validity Scale should be rated as 1.
This list is updated every two or three weeks, please foward (via US Mail) any technical materials you would like to see reflected in the list.
Remember to check the entire RF spectrum, not just specific frequencies; however, keep in mind that people doing buggings like to stay clustered around certain frequencies.
Summary (this will catch 99.99% of all Non-Intell/Diplomatic RF bugs)
All TSCM Inspections should include the following frequencies: (Expect to see less than .5-25 mw maximum at the TX antenna) (Do not expect the signal to be present for more than 20uS-100uS)
To find RF transmitters a search grid of roughly 15 foot by 15 foot (the size of an average office) should be used.
All phone rooms, riser closets, demarcs, boots, etc. MUST be checked.
Remember that the microphone/camera can be hundreds of feet away from the transmitter.
Use a digital spectrum analyzer and a wideband receiver with an analog 10.7/21.4mhz SDU on the IF, dispersions of 100/200/500khz).
RF Spectrum Analysis and monitoring should take place for at least twelve solid hours during a regular sweep (72 hours or more is preferred).
To prepare for IPM the spectrum should be evaluated/monitored for at least four hours prior to the event.
Most non-gvt RF bugs will have a transmit frequency between 9khz and 6ghz.
The Spectrum Analyzer inspection must cover at least 3khz to 40 ghz
VLF Detection-Audio .3 khz to 100 khz Video Cameras &
Tape recorders
VLF Detection-RF 12 khz to 500 khz Video Cameras &
Tape recorders
VLF Detection-Audio .3 khz to 150 khz Microphone/Ultrasonic
Chirping
Carrier Current Bugs 3 khz to 50 mhz 99% Voice
Carrier Current Bugs 20 mhz to 300 mhz 99% Voice
(AC Mains Antenna)
RF Bugs-HF 3 khz to 50 mhz 99% Voice
Space RF Bugs-VHF 30 mhz to 300 mhz 10% Video/80%
Voice/10% Data
Space RF Bugs-UHF 300 mhz to 900 mhz 25% Video/60%
Voice/15% Data
RF Bugs-Microwave1 900 mhz to 3.0 ghz 70% Video/20%
Voice/10% Data
RF Bugs-Microwave2 3 ghz to 18.5 ghz 75% Video/15%
Voice/10% Data
RF Bugs-Microwave3 18.5 ghz to 40.0 ghz 75% Video/ 5%
Voice/20% Data
...and of Course Infrared! (Look for "IR Blooms")
700 - 1100nm Audio Transmitters/Lasers (CF between 880 and 950nm)
750 - 900nm Night Vision Illuminators
900 - 1710nm IR Video Illuminators
Note:
Most military/intelligence and governmental TSCM inspections look for
devices between 3khz to 220/300mhz for Carrier Current, 20khz to 40ghz
for regular free space RF radio devices, and directional microwave
devices from .3ghz to 110/120ghz.
Common Wireless Bugs (Low Power - Well under 35-50 mw)
44.500 - 51.000 mhz "Baby/Room" monitors
72.100 - 75.400 mhz Hearing Assistance systems
54.000 - 150.000 mhz "Kit" Bugs
98.000 - 108.000 mhz Cheap out-of-band FM Bugs
112.000 - 142.000 mhz Cheap out-of-band FM Bugs
140.000 - 160.000 mhz Cheap out-of-band FM Bugs
60.000 - 320.000 mhz Low Cost kit bugs
398.000 - 406.000 mhz DECO Bugs (398.600/605, 399.450/455,
399.025/030, 406mhz)
25.000 - 450.000 mhz European/English Kit Bugs
150.000 - 216.000 mhz Typical VHF "Body Wire" & Pro-Grade Bugs
109.000 - 140.000 mhz Digital VHF Pro-Grade Bugs
138.000 - 174.000 mhz Typical "Spy Shop" & LE Cheap VHF Bugs
(155-172 Popular)
140.000 - 150.000 mhz Popular Xandi Flea power kits
(143/144mhz)
150.000 - 170.000 mhz Popular Japanese Flea power kits
(under 5mw)
150.000 - 220.000 mhz Commercial Wireless Microphones
169.000 - 172.000 mhz 47 CFR 90.265 Authorization (VERY Popular)
174.000 - 216.000 mhz 47 CFR 2.106 (NG115) Authorization
395.000 - 410.000 mhz German UHF Wireless Microphones
(PK Electronics)
219.000 - 530.000 mhz English UHF Wireless Microphones
(300-500 popular)
470.000 - 608.000 mhz Commercial Wireless Microphones
730.000 - 806.000 mhz Commercial Wireless Microphones
889.000 - 960.000 mhz Modified Cordless Phones (S/S & Hoppers)
380.000 - 480.000 mhz Video Bugs - US
890.000 - 960.000 mhz Video Bugs - US (902-928 Hot)
905.000 - 928.000 mhz Video/Audio Consumer Products
(i.e.: Recoton)
1.700 - 1.930 ghz Video Bugs - US
2.400 - 2.500 ghz Video Bugs - US *** VERY Popular ***
5.725 - 5.850 ghz Video Bugs - US *** VERY Popular ***
1.100 - 1.400 ghz PAL Video Bugs *Very Hot in
England/France/etc*
2.400 - 2.500 ghz PAL Video Bugs *Very Hot in
England/France/etc*
3.500 - 4.500 ghz PAL Video Bugs *Very Hot in
England/France/etc*
430 - 550 mhz Popular French Video/Audio Bugging System
950 - 2500 mhz Popular French Video/Audio Bugging System
700 - 900 mhz Popular Italian Audio Bugging System
"Tactical" Bugs
225 - 400 mhz "Throw away" bugs (10uw-300mw Beer can bugs)
290 - 330 mhz Micro-powered Bugs (5uw-10mw Cigarette Butt Bugs)
30 - 500 mhz Tactical Repeaters (75mw-300mw)
285 - 400 mhz Tactical Repeaters (50mw-10watts)
100 - 152 mhz VHF Tactical Repeaters (300mw-25watts)
135 - 174 mhz VHF Tactical Repeaters (300mw-25watts)
VLF and Carrier Current Type Bugs
9khz - 490 khz Carrier Current 47 CFR 15.219 Auth
(250 mv max.)
490khz - 1.705 mhz Lossy Cable 47 CFR 15.221 Auth
(1000 mv max.)
450khz - 30.00 mhz PLA Systems 47 CFR 15.207 Auth
(30 mv@ft/30ft max.)
3 - 200 khz 300 mw High Grade Pro Bugs (over 500$ each)
100 - 200 khz 50-100 mw Older Bugs
120 - 200 khz 30-50 mw Pre 1990 intercoms
200 - 300 khz 30-50 mw Post 1990 intercoms
300 - 400 khz 250-400 mw TELCO Line transmitters (355khz popular)
300hz - 30 khz Cable TV Carrier - Hardwired microphones
30khz -300 khz Cable TV Carrier - Coaxial Bugs
100 - 450 khz Threat Window #1 Most CC Bugs
3khz - 3 mhz Threat Window #2 Expensive "Pro-Grade" Bugs
5khz - 32 mhz Threat Window #3 Popular WJ Carrier Current Rcvr
3khz - 50 mhz Threat Window #4 Realistic Threat Window
for Telephone Wire
15mhz - 70 mhz Threat Window #5 Audio/Video "Micro-Wire"
RF circuits
WECO Bugs "boosted/ultrasonic audio" found on Power/CATV/Telco lines
64kbps to 1.5mbps Digital Bugs T-Carrier-Lo (T-1 and Below)
1.5mbps to 50mbps Digital Bugs T-Carrier-Hi (T-1 and above)
2.048mbps Digital Bugs Definity Circuit Pack Bug
32mbps Digital Bugs TMS Channel/Backplane bridge
Designed to transmit on CC or Microwave ISM Spread Spectrum
(2.4-6.0ghz)
VLF Devices
25khz - 90khz Tape Recorder Bias Osc-Low End (35-45khz Common)
80khz - 145khz Tape Recorder Bias Osc-Mid Range
(88.2, 96, 100khz Common)
100khz - 325khz Tape Recorder Bias Osc-Pro Grade
(100, 150, 300khz Common)
40khz - 50khz Tape Recorder DAT/Hi8
(44.1/48khz Common)
8khz - 35khz Recorder Audio Servo Noise (10-20khz Common)
7khz - 35khz Video Camera VLF Detectable emmisions
15.750 mhz Common NTSC Video Camera
15.734 mhz CCD/PCB Video Camera (very easy to detect)
15.625 mhz Common Video Camera
Also, be aware of ultrasonic/audio emmisions from most VLF devices.
(Utilize a EOD/Bomb Tech Stethoscope, and Ultrasonic Spectrum
Analyser)
Commonly Used Law Enforcement Bugging Frequencies
37.000 - 952 mhz FCC Surveillance Blanket Authorization
47 CFR 90.19 "Physical surveillance, stakeouts, raids..."
Straight AM/FM, FM-Subcarrier, SSB, Spread Spectrum, and Hoppers.
If encrypted, it usually uses in-band voice inversion or DES.
(Normally well under 2 watts... most under 35-150mw)
148 - 174 mhz
135 - 250 mhz Out-band Wireless Microphone
174 - 216 mhz In-band Wireless Microphone
350 - 440 mhz Common Video Freqs
380 - 930 mhz Wide Band Hoppers
806 - 824 mhz
851 - 869 mhz
905 - 930 mhz Popular Audio/Video Band
1.4 - 1.5 ghz Common Video Freqs
1.7 - 1.9 ghz Common Video Freqs (1.710 - 1.755 REAL Popular
at 1/10 watt)
2.4 - 2.5 ghz Common Video Freqs (2.400 - 2.450 REAL Popular)
5.7 - 5.9 ghz Common Video Freqs (5.725 - 5.850 REAL Popular)
8.5 - 10.8 ghz Common Video Freqs
AID - Westinghouse/Audio Intelligence Devices, Inc. Bug Freqs
150 mhz - 174 mhz Standard/Primary Band (Most Popular)
135 mhz - 150 mhz Special Order/Secondary Band
216 mhz - 220 mhz Special Order
400 mhz - 470 mhz UHF Repeaters
36 mhz - 39 mhz Very Low Power WFM (.5mw - 50mw)
***Very Dangerous***
80 khz - 200 khz "Line Carrier" Microphone Systems
***Very Dangerous***
1700mhz - 1900mhz 25-250mw Video and audio bugs
(Mostly DEA/DOJ stuff)
2450mhz - 2484mhz 25-250mw Video and audio bugs
If the signal is "scrambled" it is nothing more than simple voice
inversion, a circuit to "de-scramble" costs around $20.
Note: AID devices are often re-tuned for outband channels... so be
careful.
The area of spectrum from 35mhz to 500mhz is the primary threat,
500mhz to 3ghz is the secondary threat, a "line carrier" threat is from 30khz
to 750khz.
If the person planting the bug suspects that a TSCM may be conducted
then AID suggests a frequency between 30mhz to 50mhz, sensitivity of
rcvr should be better than .18uv/-122dbm.
Also, keep in mind that AID devices are frequently used for illegal
buggings, so be familiar with what their realistic specs are, expect
power outputs under 50mw, and expect to see the AC power circuits
being used as the antennae.
Security Research Bugs
145 mhz - 175 mhz FAST-II-L Computer Bug - 1, 3, 10, 30, 100mw
170 mhz - 204 mhz FAST-II-H Computer Bug - 1, 3, 10, 30, 100mw
60 khz - 200 khz "Line Carrier" Microphone Systems
***Very Dangerous***
1.1 ghz - 1.4 ghz 250mw Lynx Video/Audio Bugs (L-Band)
2.5 ghz - 2.6 ghz 250mw Lynx Video/Audio Bugs
3.8 ghz - 4.2 ghz 250mw Lynx Video/Audio Bugs
Note1: LYNX video bugs and cameras are frequently built into old
bricks, wooden joists, logs, gate posts and such... VERY, VERY Dangerous and
easily concealed.
Note2: Most Security Research Bugs utilize fixed frequency inversion
to protect against detection, the most commonly used frequency is a
1.862khz inversion point.
173.075 - LOJACK Auto tracking system beacon (200ms burst every
second)
Police Speed Enforcement Radar
10.450 - 10.600 ghz X-Band
11.488 - 11.628 ghz RD Detector
22.976 - 23.256 ghz RD Detector-2nd Harmonic
24.050 - 24.250 ghz X-Band
33.400 - 36.000 ghz Ka-Band
700nm - 1100nm Laser Threat
Electronic Article Suveillance/Anti-Shoplifting Systems
8.10mhz - 9.30mhz Checkpoint (Hi-Q Tags) 8.2mhz Common
57.75khz - 58.75khz Sensormatic (Magnetic) Books, CDs, and Tapes
915mhz and 1830mhz Knogo (Microwave Resonant) Adhesive Labels
25 - 50 mhz "Bumper Beepers" (38 - 47 mhz very popular)
135 - 170 mhz "Bumper Beepers" (150-170 mhz very popular)
450 - 512 mhz "Bumper Beepers"
903 - 904 mhz "Bumper Beepers"
904 - 912 mhz "Bumper Beepers"
918 - 926 mhz "Bumper Beepers"
926 - 927 mhz "Bumper Beepers"
WARNING:
The area between 900 mhz and 6 ghz is ** EXTREMELY DANGEROUS ** as the
eavesdropping equipment in that range is inexpensive, low power, and
highly directional.
Additionally, most TSCM people will not check frequencies above
1.0/1.5 ghz or 3 ghz (because the equipment is too expensive for them to buy).
I have seen surveillance video tapes of TSCM inspections where the
video cameras (Watec), microphones (Sony), and microwave RF transmitters
(AID - 2.4ghz) were never detected by the inspectors (using 1ghz AVCOM
Spectrum Analyzers).
Surveillance Satellite (TK-Keyhole) Frequencies
Note: Mostly Wideband Spread Spectrum/LPI channels
420mhz - 450mhz
1.2ghz - 1.4ghz
1.7ghz - 1.9ghz (1.76-1.84 real active)
1.9ghz - 2.2ghz (2.115 real active)
4.9ghz - 5.0ghz
7.5ghz - 8.3ghz
10.6ghz - 12.6ghz (11.7-12.2 active)
17.8ghz - 21.2ghz (SIGINT Birds)
23.6ghz - 24.0ghz
25.5ghz - 25.7ghz
22.8ghz - 33.5ghz (30-31ghz SIGINT Birds)
42.5ghz - 47.0ghz
50.3ghz - 52.4ghz
78.0ghz - 85.5ghz
86.3ghz - 98.3ghz (86-92 real active)
Note: Can be anywhere between 20ghz and 110ghz, mostly spread spectrum
Commonly Used by Federal Agencies for Bugs, Wireless Microphones, and
Body Wires (also 138-220 mhz, and 399-420 mhz, under 25-50 mw).
149.3500, 165.9125, 167.3375, 167.3425, 167.4875, 168.0115,
169.2000, 169.4450, 169.5050, 170.2450, 170.3050, 171.0450,
171.1050, 171.4500, 171.6000, 171.7500, 171.8450, 171.8500,
171.9050, 172.0000, 172.2000, 172.2125, 172.2375, 172.2625,
172.2875, 172.3125, 172.3375, 172.3625, 172.3875, 172.5500
173.3375
169.445, 169.505, 170.245, 170.305, 171.045, 171.105, 171.845, 171.905
27.5750 Customs Low Power < 5 watts
27.5850 Customs Low Power < 5 watts
163.1000 Customs Low Power < 30 watts
418.5750 Customs Low Power < 30 watts
40.1200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
40.1700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
40.2200 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
40.2700 Federal Shared Mobile Locator Tranmitters "Bumper Beepers"
164.9125 FBI Surveillance
165.9125 ATF F5 Surveillance
166.2875 ATF
170.4125 ATF
407.8000 Secret Service
406.2750 Secret Service
408.5000 Secret Service
408.9750 Secret Service
172.2000 DOJ/DEA CH.1
171.6000 DOJ/DEA CH.2
418.0500 DEA Low Power
418.0750 DEA Low Power
418.5750 DEA Low Power
418.7500 DEA
418.6750 DEA
418.9000 DEA F2 CINDY (416.325) Surveillance
418.7500 DEA F3 GAIL Surveillance/Strike Force
418.6750 DEA F4 EMILY (416.325) Surveillance
407.8000 CIA, State Department
408.0500 Federal Shared
408.5750 Federal Shared
409.4000 Federal Shared
960-1215mhz Spread Spectrum Systems (Wideband)
Generally Recognized Federal Bug/Spy Bands
Primary - 25-50mhz, 135-175mhz, 225-440mhz, 1710-1950mhz, 8.3-12.5ghz
Secondary - 890mhz-5.50ghz, 7.0-9.5ghz, 10-39.6ghz
Also, Wide Band Frequency Hopping centered on various UHF-TV channels
(ie: 510 or 670 mhz with a hopping width of +/- 25 mhz)
Keep in mind that the federal government can use virtually any
frequency between DC and light.
Spread Spectrum/Hopping Bugging Frequencies
Legit Industrial Equipment (very inexpensive)
902 mhz - 928 mhz ISM band A (Very Popular)
2400 mhz - 2484 mhz ISM band B (Very Popular)
5725 mhz - 5850 mhz ISM band C
10500 mhz - 10550 mhz ISM band D
24075 mhz - 24250 mhz ISM band E
SS Amateur Radio Bands Often used for eavesdropping (very inexpensive)
50 mhz - 54 mhz 6.00m Amateur Radio Equipment (STA)
144 mhz - 148 mhz 2.00m Amateur Radio Equipment (STA)
222 mhz - 225 mhz 1.25m Amateur Radio Equipment (STA)
420 mhz - 450 mhz 70cm Amateur Radio Equipment (47 USC 97.305)
902 mhz - 928 mhz 33cm Amateur Radio Equipment (47 USC 97.305)
1240 mhz - 1300 mhz 23cm Amateur Radio Equipment (47 USC 97.305)
2300 mhz - 2450 mhz 13cm Amateur Radio Equipment (47 USC 97.305)
3300 mhz - 3500 mhz 9cm Amateur Radio Equipment (47 USC 97.305)
5650 mhz - 5925 mhz 5cm Amateur Radio Equipment (47 USC 97.305)
SS Amateur Radio Bands Occasionally used for eavesdropping
10.00 ghz - 10.50 ghz 3.0cm Amateur Radio Equipment (47 USC 97.305)
24.00 ghz - 24.25 ghz 1.2cm Amateur Radio Equipment (47 USC 97.305)
47.00 ghz - 47.20 ghz 6.0mm Amateur Radio Equipment (47 USC 97.305)
SS Amateur Radio Bands Rarely used for eavesdropping (very expensive)
75.50 ghz - 81.00 ghz 4.0mm Amateur Radio Equipment (47 USC 97.305)
119.98 ghz - 120.02 ghz 2.5mm Amateur Radio Equipment (47 USC 97.305)
142.00 ghz - 149.00 ghz 2.0mm Amateur Radio Equipment (47 USC 97.305)
241.00 ghz - 250.00 ghz 1.0mm Amateur Radio Equipment (47 USC 97.305)
300.00 ghz - Light (3 Thz) Amateur Radio Equipment (47 USC 97.305)
Note: Most commmon spread spectrum/hopping bugging equipment will hop at
speeds between 100 and 50,000 hops per second. Equipment is readily
available that hops even faster (100,000 to 300,000 hops per second).
Dwell times can be as small as 1us (one widely used military system uses
a dwell time of 3-5us)
Outband Equipment
ANY Television broadcast or Cable TV frequency
ANY FM radio broadcast frequency
ANY Paging or Beeper frequency
ANY Cellular Telephone frequency
820 mhz - 960 mhz Modified (902-928) Cordless Telephones
Modified Amateur Radio Equipment (can be on ANY frequency)
Keep in mind that wideband (non-ISM) Spread Spectrum/Hopping Bugs are very
difficult to detect(even if you are within a few feet). Watch for carrier
feed-through, and "Noise Floor Humps".
All Spread Spectrum devices are detectable
Once Spread Spectrum/Hopping Bugs have been located (on the RF spectrum)
all that can be done is to locate the sourse of the emission... it is
virtually impossible to demodulate a SS signal unless you have access to
the key.
Also, a 500mw ISM device can easily have an effective range of over 20
miles.
Look for spectral anomalies (humps) on the Spectrum Analyzer, and back
up with a Compressive receiver.
Note: In the early 80's I spent considerable time working with
diplomatic spread spectrum bugging devices operating on frequencies
between 20ghz and 56 ghz, using a 3ghz window.
Band Width Resolution and Filters
Examine the spectrum with the following BW resolutions/filters:
Utilize all BW resolutions/filters between 5hz - 200mhz (depending on
band being checked)
For frequencies between 9khz and 7ghz I generally prefer to start with a
3mhz IFBW for a "moving" sweep, and to monitor the (wideband
spectragram). This makes the energy easy to spot, but tough to identify.
The IFBW is then modified until it is roughly 85% of the signal
bandwidth, the results are then sent through a vector analyser for
identification.
All IFBWs available on the analyser are also cycled through and the
results overlayed into a matrix, a little vector analysis is applied,
and the channel parameters are easily extracted.
To handle the microwave bands IFBWs between 10khz and 200mhz should be
used.
Real World Example:
Frequency Hopping bug, randomly hops between 630mhz and 700mhz, a IFBW
of 70mhz will allow the activity to be easily identified, but a narrower
IFBW will make it much more difficult.
Hint: A programmable digital spectrum analyzer should be used!
(1/3/5/10/15/20/25/30/50/75/100/150/200... Sequence is prefered)
BW Res - Usage/Primary Function
100/200 mhz - Resonate Cavity Bugging Devices/SIGINT Devices
125/35/8mhz - Resonate Cavity Bugging Devices/SIGINT Devices
50/20/10mhz - Diplomatic/Intelligence Microwave Bugs
40/20/10mhz - Diplomatic/Intelligence Microwave Bugs
13/16/20mhz - Microwave Wideband
11/12/13mhz - Microwave Wideband
.5/1/2/5mhz - Microwave Wideband (Burst Bugs)
18/26/36mhz - Satellite Wideband (Video)
2/4/6/8 mhz - Microwave Wideband (Video)
3/6/12 mhz - Microwave Wideband (Video) - Common
.5/1/3 mhz - Microwave Wideband (Video/Burst/Pulse)
1.5/.75 khz - Frequency Hopping Bugs - VERY Common
.4/.2/.1khz - Frequency Hopping Bugs - VERY Common
3.2/6.4 khz - Frequency Hopping Bugs - VERY Common
10/20/25khz - Frequency Hopping Bugs - VERY Common
50/75 khz - Frequency Hopping Bugs - VERY Common
100/250 khz - Frequency Hopping Bugs
300/500 khz - Frequency Hopping Bugs
1/2/4/8 mhz - Frequency Hopping Bugs
300/250 khz - Regular Wide Band Broadcast FM
150 khz - Narrowband Broadcast FM Audio, Television Audio
280 khz - Narrowband Broadcast FM Audio, Television Audio
200/150 khz - Commercial Wireless Microphone - High Grade
150/100 khz - Commercial Wireless Microphone - Concert/Broadcast Grade
58/77/84khz - Commercial Wireless Microphone - Typical Body Wire
50/60/75khz - Commercial Wireless Microphone - Typical police device
8/25/50 khz - European/Japanese Industrial Bugging Devices
50/30 khz - Wideband FM two-way communications (ie: Cellular Telephone)
16/15/6khz - Normal FM two-way communications
3/6/8/12khz - Narrowband Commercial - Voice
1/3.2/6khz - Narrowband (Marine, HF, etc...)
120/9/1 khz - Narrowband (Bias Osc./Video Cameras/SIGINT)
30/750/500hz- Narrowband (Bias Osc./Video Cameras/SIGINT)
56/75/100hz - Narrowband (Bias Osc./Video Cameras/SIGINT)
30/150/200hz- Narrowband (Bias Osc./Video Cameras/SIGINT)
250/300 hz - Narrowband (Bias Osc./Video Cameras/SIGINT)
300/250 hz - Narrowband OOK/FSK/Data, etc...
300/250 hz - Narrowband OOK/FSK/Data, etc...
Subcarrier Detection:
10 - 500 khz - Most Commonly Used Subcarriers
30 - 150 khz - Typical Broadcast FM Subcarrier (FMSubC)
19/27/38 khz - Typical Stereo Broadcast FM Subcarrier (FMSubC)
67 khz - Typical Musicast/Musak Broadcast FM
Subcarrier (FMSubC)
2 - 10 mhz - Audio Subcarriers often used with Video
(4.2-8 mhz common)
5khz - 950khz - Realistic Subcarrier Threat (Audio)
1mhz - 15 mhz - Realistic Subcarrier Threat (Video)
Final Note
Beware of people in the TSCM industry who try to convince you that bugs
don't operate above 1ghz or 3ghz, the folks who push this line are utter
frauds, and are playing games with you.
Several "hole-in-the-wall" TSCM schools sell equipment (at highly
inflated prices) and actively attempt to mislead students that all they
have to do is spend $3000 to $5000 in equipment to enter the TSCM
field.
Of course, these are the same crackpots who try to make you believe that
they are the only electrical engineer, ex-CIA, ex FBI, etc... in the
TSCM business.