Click for homepage
LOUDAUTO
Audio-based RF retro reflector - under construction

LOUDAUTO is the codename or cryptonym of a covert listening device (bug), developed around 2007 by the US National Security Agency (NSA) as part of their ANT product portfolio. The device is an audio-based RF retro reflector that should be activited (illuminated) by a strong continuous wave (CW) 1 GHz 1 radio frequency (RF) signal, beamed at it from a nearby listening post (LP).

Although the device is activated by an external illumination signal, it should also be powered by local 3V DC source – typically provided by two button cells – from which it draws just 15µA. In this respect, it is a semi-passive element (SPE).

Room audio is picked up and amplified by a Knowles miniature microphone, that modulates the re-radiated illumination signal by means of Pulse Position Modulation (PPM). The re-emitted signal is received at the listening post – typically by a CTX-4000 or PHOTOANGLO system – and further processed by means of
COTS
equipment.
  

LOUDAUTO is part of the ANGRYNEIGHBOR family of radar retro-reflectors. In this context, the term radar refers to the continuous wave activation beam from the listening post, that operates in the 1-2 GHz frequency band. The processing and demodulation of the returned signal is typically done by means of a commercial spectrum analyser, such as the Rohde & Schwarz FSH-series, that has been enhanced with FM demodulating capabilities. In many respects, LOUDAUTO can be seen as a further development of the CIA's EASY CHAIR passive elements, combined with later active bugging devices, like the SRT-52 and SRT-56, which also used Pulse Position Modulation (PPM).

Information about LOUDAUTO was first published in an internal Top Secret (TS) NSA document on 1 August 2007, that was available to the so-called five eyes countries (FVEY) 2 only. Although it was scheduled for declassification on 1 August 2032 (25 years after its inception), it was revealed to the public in 2013 as part of the Snowden revalations. According to a product datasheet of 7 April 2009, the price of a single LOUDAUTO device was just US$ 30. According to that document, the end processing — presumably the demodulation — was still under development in 2009 [1].

  1. The device should be activated with an RF signal at a frequency between 1 GHz and 2 GHz.
  2. USA, Canada, UK, Australia and New-Zealand.

Block diagram
The diagram below provides an educated guess of how the LOUDAUTO device probably works. At the left is a standard subminiature microphone with built-in pre-amplifier, made by Knowles. The analogue signal from the microphone is fed to the input of a Pulse Position Modulator (PPM), which might have been implemented in software in a small industry-standard AVR controller.


The microphone and the PPM modulator are powered by a local 3V DC source, rather than by DC power derived from the activation beam. This means that the activation beam can be far less strong than with the CIA's EASYCHAIR devices, where energy from the activation beam was used to power the entire circuit. In that respect it can be seen as a battery-assisted passive element, or semi-passive element, similar to the battery aided variant of the EASYCHAIR Mark III-A.


References
  1. IC off the Record, The NSA Toolbox: ANT Product Catalogue
    29-30 December 2013.

  2. Brian Benchoff, Homebrew NSA Bugs
    Hackaday.com website. 10 July 2014.

  3. GBPPR Vision #27: Overview of NSA's LOUDAUTO Radar Retro-Reflector
    YouTube user GBPPR2. 30 May 2014.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Thursday 07 November 2019. Last changed: Thursday, 07 November 2019 - 20:25 CET.
Click for homepage