Bug sweeping & counter-espionage casework: what gets found, and what it takes to find it.

The wall socket that ran warm.

A sweep of a chief executive's office began, as Risk3 sweeps of powered fixtures do, before any panel was opened: a pass of the room with a thermal imager. A two-gang wall socket — with nothing plugged into it — showed a distinct hotspot on its centre-right side: the signature of electronics drawing power where no electronics should be. Behind the faceplate sat a GSM audio device, wired into the mains and transmitting on demand to anyone who dialled it.

The device was documented in place and recovered, and the work did not stop at the wall. Forensic reading of the SIM identified the issuing network and the identifiers counsel needed to seek records from the telco — a prepaid, pay-as-you-go SIM, bought for anonymity. Anonymity, however, is not the same as invisibility: the carrier's activation and top-up records gave counsel a thread to pull.

Related services: bug sweeping → digital investigations →

Consumer-grade hardware, professional-grade damage.

The meeting room used by a corporation's in-house legal team — the room where privilege lives — was swept as part of a first engagement. A countermeasures spectrum analyser capturing the full RF environment flagged a transmission that did not belong: a consumer-grade RF device, the kind sold openly online for the price of a taxi ride, radiating from within the room.

The find makes the point we put to every client: the threat does not need to be sophisticated to be effective. A cheap transmitter in the right room hears exactly what a state-grade device would hear. The spectrum capture was archived as evidence, the device was recovered, and the legal team's meeting rooms moved onto a scheduled re-sweep cycle.

Related service: RF spectrum & TSCM analysis →

No transmitter, no battery, no signal. Would you know what to look for?

Not every device announces itself on the spectrum. On the initial physical inspection of a meeting room — the Mark 1 eyeball and a torch, applied slowly and in the right places — a wired microphone was found set into the room's fabric. It transmitted nothing. It never would. There was no RF to find, no heat signature worth the name, nothing for a scanner bought online to detect.

The cable was tracked back through the ceiling void to the adjacent equipment area, where it terminated in a digital recorder sitting in the rack, dressed among the legitimate AV and network hardware and quietly logging every meeting. Whoever serviced that rack had access; that shortlist became the investigation. It is the case we cite when asked why a real sweep takes hours: the disciplined physical search finds what instruments alone cannot.

Related service: TSCM inspection services →

The loudspeaker with a second radio inside.

An unknown Bluetooth Low Energy identifier kept appearing near a confidential meeting room — and stayed on the air after every piece of authorised room equipment had been switched off. Bluetooth is easy to underestimate: low power, brief advertising packets, a range that seems too short to matter. But a device in a neighbouring office, a corridor or a shared ceiling void is well within reach, and it can serve as a microphone, recorder, audio relay or remote control.

Protocol-aware Bluetooth and BLE scanning logged the device's advertising packets, signal-strength measurement walked the room, and near-field probing confirmed the source: a conference loudspeaker carrying an additional Bluetooth module that appears in no manufacturer's drawing of that product. Physical comparison against a known genuine unit sealed the identification. A single broadband RF scan would likely have missed it; persistent, protocol-aware monitoring did not.

Related service: eavesdropping detection →

The pen nobody claimed.

After a sensitive negotiation concluded, a pen was found beneath a folder in the meeting room. No attendee claimed it. Ordinary stationery — except that a pen recorder is built to be exactly that: an ordinary-looking writing instrument around a microphone, a rechargeable battery, a control switch and internal flash storage, left in plain sight and treated as harmless.

Passed across the non-linear junction detector, the pen answered the way electronics answer and stationery does not. Its weight, charging connection and internal electronic response were all inconsistent with the ordinary pen it was compared against. It was deliberately preserved rather than operated — a portable X-ray confirmed the internals without the item ever being switched on — so that any subsequent evidential examination of its storage could be conducted under controlled conditions. The lesson clients remember: an effective inspection includes the apparently ordinary objects that walk into a sensitive room, not just the fabric of the room itself.

Related service: boardroom & meeting sweeps →

The 4G router under the desk that nobody ordered.

A restricted project office had been established for a commercially sensitive restructuring programme, with a clear policy: no independent wireless connections. A cellular signal survey during the technical inspection found an unexplained 4G signal originating inside the project area — traced to a small cellular router installed beneath a workstation, introduced by an external contractor who wanted internet access while waiting for corporate network credentials.

The router was not a covert listening device, and that is precisely the point. It was an undocumented communications route bypassing every control the organisation had built — monitoring, filtering, access management — and several project devices had already joined it automatically using previously stored credentials. An eavesdropper could not have designed a better back door than the one convenience installed.

Related service: Cyber TSCM network audit →

The conference table that was always live.

The boardroom's own table microphones — legitimate, installed, invoiced — turned out to be the device. A countermeasures spectrum analyser identified a continuous wireless carrier leaving the room at a strength consistent with reception well beyond the building line, persisting when the conference system showed itself as off. The thermal imager agreed: the table's microphone modules were warm at rest, permanently energised and permanently transmitting whatever the room said.

Nothing had been "planted". The system had been configured — by error or by intent — to self-bug the room it served, and anyone with the right receiver nearby could listen. The audio chain was re-engineered with hard power switching, transmission was confined, and the client's most sensitive sessions moved under in-conference monitoring, where the spectrum is watched while the meeting is actually under way.

Related service: TSCM inspection services →

The charger that charged phones and recorded rooms.

A USB charger is the perfect host: permanent mains power for concealed electronics, while it keeps charging telephones exactly as expected. In a confidential project room, wireless monitoring caught intermittent Wi-Fi activity that coincided with sound in the room — the first thread. Set against a known genuine unit, one charger's electrical consumption, weight and heat pattern under the thermal imager were all subtly wrong for the product it pretended to be.

Controlled examination found a microphone, internal storage and a Wi-Fi module built in alongside the genuine power-supply components — record locally, exfiltrate wirelessly. The lesson we attach to this case: a functioning charger is not automatically a legitimate charger. Comparison against known equipment reveals small differences that matter enormously.

Related service: bug detection →

The desk clock that watched the whiteboard.

An unfamiliar digital clock had appeared in a restricted project room — helpful, unremarkable, and facing the whiteboard where the deal structure was drawn every morning. A Wi-Fi protocol analyser flagged the first thread: a previously unknown device on the air, associating with the office network; checks on the network side confirmed a session with an external cloud service that no inventory could explain.

The optical pass settled it. Swept with the Shearwater Comet lens detector, the clock's dark display panel answered with the tell-tale retro-reflection of a lens behind the plastic. Physical examination confirmed a miniature camera and Wi-Fi module wired alongside the genuine clock electronics, streaming to a cloud application controlled from a mobile phone. The clock was seized, the account details passed to the investigation, and the client added a rule that has outlived the engagement: nothing new enters the room without being put on the record.

Related service: hidden camera detection →

The mirror that faced the wrong way.

A private interview room carried a decorative mirrored panel, positioned — once you thought about it — squarely facing the principal seating position. The optical sweep answered the question the furniture layout asked. Worked across the panel, the Shearwater Comet lens detector returned a retro-reflection from behind the partially reflective surface: a lens, looking back through the mirror.

A borescope through the adjoining service void confirmed the installation: a miniature camera with an optical opening behind the two-way surface, recording to local storage. No transmitter, no Wi-Fi session, no network trail — nothing any wireless tool would ever have seen. The camera was preserved for evidential examination under counsel's direction, and reflective surfaces facing seating positions joined the standard optical search pattern for every interview and meeting room we inspect.

Related services: hidden camera detection → sweeps for hidden cameras →

The loudspeaker that was two tiles out of place.

The sweep of an executive office included a step that finds what electronics cannot: comparing the room against its own installation drawings. One ceiling speaker sat two tiles away from where the as-built plans put it — directly above the CEO's desk — and additional cabling ran from it towards a remote services area that the drawings knew nothing about.

A conventional moving-coil loudspeaker wired in reverse is a microphone. A cable tracer and time-domain reflectometer measured the run and mapped the undocumented extension; an audio line analyser on the pair confirmed live room audio leaving the office down the cable. The run was severed and documented end to end, and drawing-verification — does this room match its own paperwork? — became a fixed stage of every sweep for that client.