Homepage
Crypto
Spy radio
Burst encoders
Intercept
Index
DF
Receivers
TSCM
Antennas
Scanners
USSR
Mason
Microtel
Minilock
REI
RFT
Rohde & Schwarz
Scanlock
Telefunken
Covert
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Logo (click for homepage)
OSCOR 5000
Advanced bug finder - wanted item

The OSCOR 5000E is a highly advanced and fully automatic bug tracer, also known as Enhanced Omni-Spectral Correlator, developed and built by Research Electronic International (REI) in Algood (TN, USA) around 1998. The unit is a microprocessor controlled counter surveillance system that detects RF bugs in the 10kHz - 3GHz range, with an optional extension to the 3 - 21 GHz range.
 
The device is housed inside a sturdy black briefcase from within it is operated. It not only protects against RF (radio) bugs, but can also find mains carrier bugs and infra-red bugs.

The bottom half of the case contains the actual TSCM receiver, whilst the accessories are stored inside the top half. A hinged panel contains an impressive array of antennas and acts as the lid of the accessories compartment when in transit. The image on the right shows a typical OSCOR 5000 unit with its antennas up, ready for use. It can be powered from the internal battery.

Alternatively, the OSCOR can be powered from the AC mains, using the built-in power supply unit (PSU), in which case it can run indefinitely. In practice, AC-operation was recommended.

The device can autonomously monitor (scan) the Audio, RF and IR spectrum, and will try to correlate any picked-up sound with the current sound in the room. It can also be controlled manually using the built-in LCD display. In addition, the graphical results from a sweep job can be printed with the built-in thermal printer.
  
OSCOR ready for use (sloped setup)

The OSCOR 5000 was state-of-the-art for many years and was used by law-enforcement and intelligence agencies worldwide. Use of the device outside the United States had to be approved by the US Government. The basic device had a price tag of US$ 18,200, whilst a deluxe version was available for US$ 21,500. The optional 21 GHz downconverter (MDC-2100) was available for an additional US$ 9,850. The device can demodulate AM, FM, wideband AM and FM, subcarrier, CW and SSB signals and optionally also PAL, SECAM and NTSC TV signals. The intercepted audio could be recorded onto a tape cassette, using the supplied Olympus pocket memo recorder. 1

In 2009, the OSCOR 5000 was succeeded by the much improved OSCOR Blue, which is smaller, faster and covers a wider frequency range (24 GHz). As the OSCOR Blue is listed on the United States Munitions List (USML), potential customers require a special ITAR export licence. 2 It is therefore only available to US Government-approved law-enforcement and ingelligence agencies. To bypass export restrictions, the nearly identical OSCOR Green was introduced in 2011.
 
  1. The memo recorder was omitted when tape-based recording systems became obsolete around 2000.
  2. ITAR = International Traffic in Arms Regulations. Items on the United States Munitions List (USML) require an export license under the ITAR, which is controlled by the Directorate of Defense Trade Controls (DDTC) of the US Department of State.

OSCOR in briefcase OSCOR ready for use OSCOR ready for use (sloped setup) OSCOR - complete unit with antenna panel up OSCOR in briefcase - open OSCOR receiver Accessories Active antenna and IR receiver up Key (EPROM)

 
Controls
The diagram below shows the OSCOR 5000 ready for use. Everything you need for a sweep job is present in the case and the unit is constructed in such a way that it can be operated from within it, either on the built-in battery, or powered by the mains. After opening the case, the accessory compartement is folded towards the rear and the antenna panel (which acts as a lid for the accessory compartment) can be erected. It is kept in position by a spring at the right. The actual receiver is mounted in the bottom half of the case, which is placed horizontally on the table.

Alternatively, the suitcase can be placed in a sloped position, using the two extendable feet at the rear (recommended), in which case a metal bracket (at the right) is needed to keep the antenna panel at the top vertically aligned. Note that the active antenna (left) and the IR receiver have to be extended completely for proper operation of the unit. The power button is at the bottom left.


After switching the unit ON (button at the bottom left) it briefly shows a welcome message, after which it is ready for use. Autonomous scanning can be started almost instantly and requires no further setup. It is recommended to make a scan outside the target area first, in order to register any friendly signals. These signals are then ignored when sweeping the target room. Note that a special program key (EPROM) has to be present. It is inserted into a slot to the left of the display.
 
OSCOR in briefcase - open OSCOR in briefcase - open Briefcase - rear view OSCOR 5000 LCD display Printer ON/OFF and MODE selector Opening the antenna panel pane Antenna panel fixated at the right angle
Spring hinge

 
Program key
In order to protect the OSCOR 5000 against unauthorised use, a special program key is supplied with the kit. The key, which is shown in the image on the right, contains an EPROM and has to be inserted into a slot to the left of the LCD display. Without this key, the unit can not be operated.   
Key (EPROM)

 
Key (EPROM) Inserting the program key Program key (EPROM)

 
Antennas
Although the OSCOR can be used with external antennas, it will usually be sufficient to use the three RF antennas that are built inside the antenna panel at the top. Depending on the frequency range monitored by the receiver, the most appropriate antenna will be selected automatically.
 
The image on the right shows the antennas that are mounted inside the top lid of the accessory compartment. At the left is the non-resonant active telescopic antenna that is used for the frequency range from 500 kHz to 1.5 GHz. It has a built-in pre-amplifier with a 20dB gain. For the lower frequencies between 10 kHz and 500 kHz, the square loop antenna at the center is used.

To the right of the active whip antenna is a so-called discone antenna 1 that covers the SHF frequencies between 1.5 and 3 GHz. A panel at the bottom right shows the selected antenna.
  
Active antenna and IR receiver up

For the best results, the telescopic antenna (left) has to be fully extended when in use. Once a bug has been identified, an RF hand probe with a short telescopic antenna can be connected to the receiver instead of the active antenna (by means of a long coaxial cable) to locate the bug.
 
In addition to RF (radio) bugs, the OSCOR can also pickup any infrared (IR) bugs in the room. For this, the IR receiver (at the right) has to be fully extended (upwards), so that the red tip has free 360° 'vision'. The IR detector covers 850 to 1070 nm and demodulates any IR signal that is modulated between 10 kHz and 5 MHz, making it suitable for virtually any type of IR bug around.

Another popular type of bug is the so-called power line bug or mains carrier transmitter. These bugs modulate their signal with a very low frequency (VLF) directly onto the mains network.
  
IR detector

The OSCOR's mains inlet has a built-in detector for such bugs. Although the device can be powered for several hours from the built-in battery, it is recommended to power it from the local AC mains wall socket, so that it can automatically check the mains network for VLF bugs.
 
  1. The name Discone is a contraction of Disc and Cone, the two components from which the antenna is constructed. Discone antennas generally have a large bandwidth [2].

Active antenna and IR receiver up IR detector IR detector Antenna indicator panel

 
Accessories
The OSCOR 5000 comes with many accessories, all of which are stored inside the top half of the briefcase, with the antenna panel acting as a cover to keep the items in place when transporting the unit. Although the set of accessories changed over time, the following items were issued:
 
Headphones Tape cassette memo recorder Olympus Video monitor (LCD) RF Coupler RF probe with telescopic antenna External microphone with cable
Mic
Cigarette lighter plug with 12V DC power cable Acoustic 'clicker' for locating a bug within a room
Mains coupling cable Telephone and network breakout box Modular jack cable for connection to telephone or IP network

 
Headphones
The OSCOR normally delivers its demodulated audio directly to the built-in speaker, which is located to the rear right, to the left of the mini printer. When sweeping a room however, it is recommended to use the supplied headphones instead of the speaker, so that an eavesdropper is not made aware of the current sweeping job.

A suitable pair of headphones is supplied with the kit and is usually stored inside the accessory compartment. Any similar headphones or ear­piece with a 3 mm jack can also be used.
  
Headphones

 
Recorder
When the OSCOR 5000 was introduced in the late 1990s, tape-based recording devices were still a popular means of recording audio. For this reason, the device was supplied with a so-called memo recorder that is shown in the image on the right. In this case it is an Olympus S724 Pearlcorder that uses small tape cassettes.

The recorder was used for registering any suspicious intercepted signals, so that they could be analysed later. When tape-based recorders became obsolete in the early 2000s, the Pearlcorder was omitted from the later kits.
  
Audio recorder

 
Video monitor
Apart from narrowband and wideband audio signals, the OSCOR 5000 is also suitable for the reception of analogue video signals in the common TV standards PAL, SECAM and NTSC.

In the kit featured here, two small LCD monitors are supplied: one for the PAL/SECAM standard (50 Hz) and one for the NTSC stanard (60 Hz). In later versions of the kit a single multi-standard LCD monitor was supplied.
  
LCD video monitor

 
RF Probe
By default, the OSCOR's built-in antennas are used to detect any bugs. Once the presence of a bug has been confirmed however, it might be difficult to find it. And this is where the small hand-held RF probe can be very useful.

It is connected instead of the active telscopic antenna, by means of a long coaxial cable. The operator then moves the probe around the room like a magic wand in order to find the maximum field strength, shortening the probes small telescopic antenna as he homes in.
  
RF Probe antenna

 
Microphone
One of the special features of the OSCOR 5000 is that it can correlate any sound picked up from an RF signal, with the current sound in the room. This way, an active radio bug can be identified immediately. For this feature, the built-in microphone at the right center is used.

If necessary, the external microphone shown on the right can be used as an alternative. It can be placed, say, near a conversation that takes place in the room. When te external microphone is used, the internal one is disconnected.
  
External microphone

 
Audio coupler
A simple audio coupler is supplied to check low-voltage lines, such as analogue telephone lines, for VLF bugs.

When checking telephone and computer network lines, it is advised to use the audio coupler in combination with the network breakout unit below.
  
Audio coupler

 
Sonar
The sonar is part of REI's patented aucoustic bug locating method. It consists of the small clicker that is shown in the image on the right. It is used in combination with the correlation micro­phones. By following the instructions on the LCD display, the OSCOR will point you in the right direction within the room, much like a sonar.

Note that this feature will only work if the audio from the transmitter (bug) can be demodulated by the OSCOR. It does not work with digital, recording or burst transmission bugs.
  
Close-up of sonar unit

 
Cigarette cable
The OSCOR 5000 can be powered by any of three sources: either from the internal battery, from the AC mains (recommended) or, in the event of a mobile application, from the cigarette lighter socket of a vehicle.

The image on the right shows the 12V DC cigarette lighter cable that is supplied with the kit. The smaller plug should be inserted into the 12 VDC socket of the OSCOR, to the right of the AC mains socket.
  
Cigarette lighter cable (for use in car)

 
Mains coupler
When the system is powered by its internal battery, it is still possible to check a mains power line for VLF bugs, by using the Mains Coupler shown here.   
Mains coupler

 
Network breakout
When checking the wiring of a telephone set or a computer network for carrier and RF bugs, this small breakout unit can be useful. It can be connected between the device and the existing cable (using the short modular cable below).

Each of the contact pins of the modular jack sockets is connected to one of the contact strips at the circumference (numbered 1 thru 8). The OSCOR may then be connected to any wire pair by means of crocodile clips.
  
Phone/Network breakout unit

 
Network cable
This set of jumper cables consists of a short RJ12 cable and a short RJ45 cable that can be used in combination with the breakout box above for minitoring the wiring of a telephone extension or a personal computer (PC).

Depending on the type of connector on the device, the appropriate jumber cable should be used. The RJ45 sockets (at either side of the breakout box) accepts both RJ12 and RJ45 plugs.
  
Phone/Network cable

 

 
Interior
The entire OSCOR TSCM receiver is housed inside the bottom half of the plastic briefcase. It is mounted in a metal frame that is kept in place by four twist locks: two at the front and two at the rear. The twist locks can be release with a screwdriver. Rotate the head 90° counter clockwise.
 
After the four locks have been released, the entire frame can be lifted from the case, but it might be necessary to bend out the front of the case somewhat with the help of a screwdriver.

Once the frame has been removed from the case, it can be placed upside down on top of the accessory compartment, for easier access. The various sub-systems are easily identified, as shown in the diagram above this section. The actual receiver is covered by a heavy metal cover that is held in place by 6 bolts. Removing this cover is not easy and may require some force.
  
Detail

With the metal cover out of the way, the receiver board is exposed. It consists of several sub-circuits that are easily recognised. The RF section, the synthesizers and the Voltage Controlled Oscillators (VCOs) are shielded, whilst the VLF, IF and AF circuits are not. There are quite a few modifications to the board and the shielding, and some components are glued-in, propably to improve the receiver's performance and stability. This is fairly normal for this kind of equipment.

Another feature, that was common practice in the TSCM trade of the 1980s and 90s, is that the text has been removed from most of the Integrated Circuits (ICs). This was done to protect the design and avoid it being copied by the competition. Although it does indeed obscure certain design features, a trained technician should be able to 'guess' which components were used.
 
Unlocking the interior Removing the interior from the case Interior Interior (cover removed) Printer interior Battery PSU Sub board
Detail Receiver board Synthesizers Synthesizers VLF and IF section Sub board Close-up of one of the VCOs Detail

 
Options
  • MDC-2100
    Downconverter 3 to 21 GHZ
  • OPC-5000
    OSCOR PC software
  • OIF-5000
    IF output interface (10.7 MHz)
Software versions
  • 2001
    4.0
  • 2002
    Video upgrade
  • 2004
    5.0
Related patents
  • US 4,399,556
  • US 5,020,137
  • US 5,241,699
  • US 6,397,154
  • US 7,058,530
Technical specifications
  • Audio
    50 Hz - 15 kHz
  • RF
    10 kHz - 3 GHz
  • IR
    850 - 1070 nm
Audio demodulators
  • WFM
    FM wideband
  • NFM
    FM narrowband
  • WAM
    AM wideband
  • NAM
    AM narrowband
  • SC
    Sub-carrier
  • SSB
    Single sideband
IF bandwidth
  • Audio
    250 kHz, 15 kHz and 6 kHz
  • Video
    10 MHz
Video formats
  • NTSC, PAL or SECAM video standard
  • + or - sync
  • AM or FM demodulation
Antennas and inputs
  • Whip antenna
    500 kHz - 1,505 MHz (active, telescopic)
  • Discone antenna
    1.5 - 3 GHz
  • Loop antenna
    10 - 500 kHz
  • Infrared detector
    360°, 850 - 1070 nm (modulation 10 kHz - 5 MHz)
  • Status indicators
    LEDs showing selected antenna
  • AC VLF
    AC current probe integrated with AC mains input
  • 20dB pre-amplifier
    Built-in
Documentation
  1. OSCOR Brochure
    REI, 2010. 6 pages full-colour.

  2. OSCOR 5000E Owners Guide - version 4.0
    REI, 2001.

  3. OSCOR 5000E Owners Guide - version 5.0 (revision 2)
    REI, 2005.

  4. OSCOR 5000E Owners Guide - version 5.0 (revision 5.1)
    REI, Date unknown, but probably 2012.

  5. MDC-900 and MDC-2100 Owners Guide - version 4
    27 February 2008.

References
  1. REI, OSCOR 5000E, Enhanced Omni-Spectral Correlator
    REI website. Retrieved November 2015.

  2. Wikipedia, Discone antenna
    Retrieved November 2015.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Sunday 29 November 2015. Last changed: Monday, 22 February 2016 - 16:05 CET.
Click for homepage