"Receiver Hunting" And Similar Stories

A couple of days ago, I stumbled across a post on Western Rifle Shooters Association called Receiver Hunting.  Sounded right up my alley so I took the link to Outland Tek Musings. 

In case you didn't read this or don't know what it's talking about it concerns locating receivers by searching for their spurious radio emissions, in particular, the local oscillator.  I'll define that in a minute.  Saying you'll tune for an LO assumes a standard architecture for the radios you're interested in finding.  That's not as good an assumption as it was as recently as 10 years ago, but we're talking going from being almost absolute certainty to 95% of receivers out there.   It's still a good assumption just not a dead giveaway. 

In the earliest days of radio, about a hundred years ago, it was common to try to tune all the circuits in a radio to the radio frequency you wanted to tune in, and amplify the signal from the several millionths of a volt (microvolts) at the antenna to closer to 1 volt to drive headphones or a speaker.  This architecture was called Tuned Radio Frequency or TRF because that's what it was doing!  Every stage that could be tuned was tuned to the same frequency, and changing stations was laborious.  In my career, I saw exactly one modern use for a TRF design, but I've heard they're in some remote controls. 

The architecture allowed listening to radio stations (this was before broadcasting) but was hard to make work over wide frequency ranges.  First, there were a couple of adjustments to tune any frequency, not just one.  Second, almost every amplifier (vacuum tube) available had less amplification as the user tried to tune higher in frequency.  Edwin Armstrong, the closest to a real "father of modern radios" that I can think of, developed what he called the superheterodyne approach to receiver design. 

The approach embodied a couple of very important ideas.  First, it moved some of the amplification (engineers call that gain) to a fixed frequency, and split the gain up into two or more frequencies.  This makes it less likely for weak signals from elsewhere in the radio to leak into an earlier stage and cause problems (you've probably been around a PA or other amplifier that squeals with feedback?  Same principle, different frequencies).  Second, it introduced the concept of having one section, often one component, that tuned to change frequency.  To do so, Armstrong introduced an oscillator into the radio and a component that multiplied the two signals by each other.  Because it was inside the radio, he called it a local oscillator, or LO, as in local to the radio.  Due to the weirdness of trigonometry, when two sine waves are multiplied, you create the sum and difference of the two.  Either the sum or difference is filtered out to become the Intermediate Frequency (IF), the other is effectively discarded. 

Over the years, the technologies for the parts have changed, but the architecture has stayed almost exactly the same.  While I don't have one of those ubiquitous Baofeng Chinesium radios, a standard architecture would work like this, for the amateur 2 meter band.

• RF amplifier - tunes 144 to 148 MHz with filtering that drops the undesired signals as you get farther from the desired band (that is, they offer more protection as the frequency goes farther above or below where the radio is tuned)
• IF Filter would be at 21.4 MHz, where very good crystal filters are now readily available
• Local Oscillator would tune RF+IF or 144.000 + 21.400 MHz or 165.400 MHz to 169.400 MHz 

Getting back to the original story, what Outland Tek Musings was saying was that even if you're not transmitting intentionally, your receiver's local oscillator is running.  By tuning for your LO, an adversary could know (1) someone is there and then, by making a reasonable assumption like this architecture (or by more intelligence gathering) an adversary could find your local oscillator and know what frequency you're listening to.  Which means what frequency they should listen to in order to intercept your communications.

How strong is it going to be?  Not very.  It's going to vary with the quality of the radio because the things that make the LO weaker are (1) the mixer, (2) the amount that leaks (backwards) through the RF amplifier and (3) how well the filter knocks down the LO.  Given an LO putting out 5 to 7 milliwatts,  the LO is likely to be under 250 microwatts.  In a good radio, it can be rather low.  I wouldn't doubt it could be heard from more than a few houses away, perhaps a few hundred feet.

To be honest, my reaction to the post on Outland Tek Musings was mild surprise that it wasn't widely known, and that's really "my bad".  I've been hanging around with too many other Radio Graybeards.  Experienced radio monitoring hobbyists know this.  The idea has even been commercialized as a way of determining what channels TV viewers were tuned to because all TVs used the same IFs and LOs.  That's right, a competitor to the Nielsen ratings did this (1970s IIRC).

Today there are architectures that don't have local oscillators and are immune to this sort of monitoring.  These are called direct sampling radios, and are Software Defined Radios (radios in which some or most of the functions usually done in tuned circuits are done in software).  For VHF and UHF, this is still rather pricey in the ham radio world, but they are available in high dollar commercial radios.  For HF, there are low cost, hobbyist radios. 

Are you wondering "what's up with this?  What are you really getting at?"  This topic is something that I consider in my home field.  I've designed radios like this for lots of years.  It makes me wonder what folks would like to know about in the wide world of radio.  Perhaps I can post something regularly.  Let me know in comments, or email to SiGraybeard at Gmail.