LOUDAUTO - ANT Product Data (NSA)
LOUDAUTO is an audio-based RF retro-reflector. It provides room audio from a targeted space using radar and basic demodulation and audio post-processing.
LOUDAUTO's current design maximizes the gain of the Knowles EK/EY-series microphone. This makes it extremely useful for picking up room audio. It can pick up speech at a standard, office volume from over 20 feet away. Note that concealments may reduce this distance.
It uses very little power, approximately 15 µA at 3.0 VDC. So little, in fact, that battery self-discharge (internal resistance) is more of an issue for serviceable lifetime than the power draw from this unit. The simplicity of the design allows the form factor to be tailored for specific operational requirements. All components are Commercial Off-the-Shelf (COTS) and so are non-attributable to NSA.
Concept of Operation
Room audio is picked up by the microphone and converted into an analog electrical signal. This signal is used to Pulse-Position Modulate (PPM) a low-frequency square wave carrier signal running at around 100 kHz. This square wave is used to bias a microwave FET (Field Effect Transistor) on and off. When the unit is illuminated with an unmodulated Continuous Wave (CW) signal from a remote radar unit (CTX4000/PHOTOANGLO), the illuminating signal is Amplitude Modulated (AM) with the PPM square wave.
This signal is re-radiated (backscatter), where it is then picked up by the receive section of radar. It's then processed as a 100 kHz Frequency Modulated (FM) subcarrier to recover the room audio. Processing is currently performed by COTS equipment with FM demodulation capability (Rohde & Schwarz FSH-series portable spectrum analyzers, AOR/Icom receivers, etc.)
LOUDAUTO is part of the ANGRYNEIGHBOR family of radar retro-reflectors.
Pictures & Construction Notes
Overview of the LM567-based pulse-position modulator board used for these LOUDAUTO experiments.
A CD4069 hex inverter is used to buffer the output (pin 5) of the LM567 pulse train generator.
The modulation input is via the RCA jack.
The PPM pulse train output is via the SMA jack.
The real LOUDAUTO devices most likely use an Atmel tinyAVR-series microcontroller to generate and modulate the PPM waveform.
Alternate view of the experimental LOUDAUTO pulse-position modulator board.
The modulation input should be around 200 mVp-p minimum and low-pass filtered to prevent aliasing.
The LM567 is set via the 10 kohm resistor and 1000 pF capacitor to produce a pulse train at around 100 kHz.
Normally, the modulation input would be from a standard Knowles microphone. You may want to add a small preamplifier (20 dB or so) on the output of the microphone.
The modulation input doesn't necessarily have to be in the "speech band." Quality electret microphones will also detect subsonic (and ultrasonic) vibrations. This could be handy for extracting intelligence from mechanical devices, such as crypto rotors or a lock's wheel pack.
Connecting the LOUDAUTO modulator board to the Fujitsu FHX35LG FET modulator board used in the TAWDRYYARD experiments.
To demodulate the received (backscatter) signal, you'll need a receiver capable of tuning to the 100 kHz (or whatever) subcarrier frequency the pulse-position modulator is using.
This can be done directly with a spectrum analyzer or a communications receiver with standard wideband FM demodulation capabilities.
Above-left is the GBPPR VLF Converter from GBPPR 'Zine, Issue #101. This converts 1 - 500 kHz to 10.001 - 10.500 MHz.
Also shown above is an AOR AR8000 communications receiver, capable of a wide tuning frequency range and both wide and narrowband FM demodulation.
This communications receiver would be connected directly to the I or Q outputs from the CTX4000/PHOTOANGLO illumination radar unit.
Oscilloscope view of the unmodulated LM567 pulse train.
It's 5 volt peak-to-peak at around 106 kHz.
Oscilloscope view of the LM567 pulse train being modulated with a 1 kHz sine wave at around 500 mVp-p.
This pulse train would then be used to toggle the gate of the FET modulator to generate the backscatter signal.
GBPPR Vision #27: Overview of the NSA's LOUDAUTO Radar Retro-Reflector (YouTube)
- GBPPR LOUDAUTO Experiments - Pulse-Position Modulator LM567-based modulator