Passive RFID

Passive RFID "tags" operate with an electrical current induced in the antenna by the incoming radio frequency signal providing just enough power for the CMOS integrated circuit in the tag to power up and transmit a response. Most passive tags signal by backscattering the carrier signal from the reader. This means that the antenna has to be designed to both collect power from the incoming signal and also to transmit the outbound backscatter signal. The response of a passive RFID tag is not necessarily just an ID number; the tag chip can contain non-volatile EEPROM for storing data.

The lack of an onboard power supply means that the device can be quite small: commercially available products exist that can be embedded in a sticker, or under the skin in the case of low frequency RFID tags. As of 2006, Hitachi, Ltd. has developed the smallest such passive devices called µ-Chip measuring 0.15x0.15mm (not including the antenna), and thinner than a sheet of paper (7.5 micrometers).

Active RFID

Unlike passive RFID tags, active RFID tags have their own internal power source which is used to power any ICs that generate the outgoing signal. Active tags are typically much more reliable (e.g. fewer errors) than passive tags due to the ability for active tags to conduct a "session" with a reader. Active tags, due to their onboard power supply, also transmit at higher power levels than passive tags, allowing them to be more effective in "RF challenged" environments like water (including humans/cattle, which are mostly water), metal (shipping containers, vehicles), or at longer distances. Many active tags have practical ranges of hundreds of meters, and a battery life of up to 10 years. They usually operate at 455 MHz, 2.45 GHz, or 5.8 Ghz, and they typically have a read range of 60 feet to 300 feet (20 meters to 100 meters).

Some active RFID tags include sensors such as temperature logging which have been used in concrete maturity monitoring or to monitor the temperature of perishable goods. Other sensors that have been married with active RFID include humidity, shock/vibration, light, radiation, temperature and atmospherics like ethylene. Active tags typically have much longer range (approximately 300 feet) and larger memories than passive tags, as well as the ability to store additional information sent by the transceiver. The United States Department of Defense has successfully used active tags to reduce logistics costs and improve supply chain visibility for more than 15 years. At present, the smallest active tags are about the size of a coin and sell for a few dollars.

Read more about RFID Technology at:
http://www.spychips.com
http://www.rfidjournal.com
http://www.epic.org

Size and Range

As in other categories of electronic eavesdropping, recent technology has been utilized to build miniaturized RF transmitters the size of a pencil eraser. These devices will transmit radio signals anywhere from 100 feet to five miles and with the use of repeaters, reception range is even further. The availability of these small devices is rather astonishing with several manufacturers offering pre-concealed transmitters already packaged into such objects as smoke detectors, picture frames, clocks and ashtrays.

One of the smaller commercially manufactured transmitters is the size of an aspirin tablet, including microphone and battery, with a transmitting range of 1,000 feet. Several radio transmitters are available in prepackaged electrical lamps, power receptacles and clocks. These types have the advantage of a continuous power source, supplied directly to the transmitter, which permits a permanent installation.

Modulation

All radio transmitters must modulate their basic operating frequency (carrier) to convey information to the eavesdropper's radio receiver. The eavesdropper has at his disposal a host of different modulation techniques to choose from. In addition to amplitude modulation (AM) and frequency modulation (FM), and eavesdropper could employ various other sophisticated modulation techniques including sub-carrier, pulse amplitude modulated (PAM), pulse width modulated (PWM) and pulse position modulated (PPM). Sophisticated transmission techniques could also be employed to make the signal virtually undetectable such as snuggling, frequency hopping, spread spectrum and burst transmissions.

Subcarrier

Sub-carrier modulation is one of the most popular and attractive to the eavesdropper. These devices operate by combining intercepted audio with one low frequency signal and then recombining this resulting signal with a higher frequency (carrier) signal. The resulting radio signal is very complex, and is not detectable by conventional radio receivers.

Snuggling

A popular procedure among eavesdroppers is the practice of snuggling. This is a relatively simple method of hiding a transmitter's signal. Regardless of the radio device power, frequency or modulation, an additional guard against detection can be provided by carefully setting the frequency adjacent to that of a large, high-powered radio or T.V. station. By setting the transmitter frequency in this manner, the signal cannot be detected by a field strength meter or broadband radio receiver.

Carrier Current

Another popular radio transmitting method is by carrier current. Below the A.M. commercial portion of the radio frequency spectrum is a region identified as very low frequency (VLF). A different type of audio surveillance transmitter is manufactured which operates in this region but uses the electric power lines for transmission of the signals. These F.M. modulated devices operate between 50 Khz and 300 Khz. At these frequencies, very little radio energy is radiated into free air space. What these signals will do, however, is to move along almost any wire path, including regular electric power lines and telephone lines. These transmissions are known as carrier current transmissions because of this characteristic. This is the same method of communications used by many of the wireless intercoms sold commercially.

Eavesdropping devices which use carrier currents offer two principle advantages over those which transmit through space. The signal can't typically be received anywhere along the wire between the eavesdropping device and the power source. Also, these devices are not detectable by radio receivers R.F. sensing or other debugging equipment, since they radiate little energy into free air space.

Remote Controlled

A switch receiver or remote radio controlled device can be used advantageously with any eavesdropping radio transmitter. Sophisticated remote radio units are sold through many electronic suppliers for a multitude of purposes. This device provides the eavesdropper with the ability to control the operating time of room monitoring equipment and achieve two distinct advantages. The eavesdropper can conserve battery power and reduce chances of detection by turning the transmitter on only during the time of interest.

Spectrum analyzers are sometimes used to detect the IF signal emissions radiated from the remote control receiver, as the clandestine transmitter could possibly be switched off and not transmitting. This detection method is unreliable, as the IF signal radiated from the receiver is very weak. The spectrum analyzer's antenna must be in close proximity of the clandestine receiver to detect these emissions and with hundreds of RF signals to resolve, it would be very easy to overlook a weak signal hidden within the noise. The only reliable method to detect these types of devices is with a Non-Linear Junction Detector (NLJD).