Hey, kids!
Build your own inductive telephone tap!

Unlike most of the junk on the Internet, this actually works!

So it's time once again for the Science Fair and you're just plain out of ideas. You need something that is educational, based on scientific principles, and (what's most important) actually works. Of course, it doesn't hurt for the project to be unique. Only so many kids can cross-breed radishes until they're rainbow-striped, after all....

Well, I have just the solution. We're going to build an inductive telephone tap that will allow us to listen to telephone conversations nearly undetectably. In fact, we're going to learn a lot of things in carrying out this project. We'll learn how telephones work, what electrical induction is, and how the professionals find wiretapping and eavesdropping devices. There will also be plenty of opportunity for you to develop your own questions and carry out some independent research (if you know what I mean, and I think that you do.)

Ready to get to it? Well, there's "good news and bad news." You want the "good news" first? OK. This project uses only inexpensive and readily available parts. You can probably get everything you need in one quick trip to your local Radio Shack.

Now for the "bad news." Constructing this unit for the purpose of covertly intercepting telephone conversations is illegal! DO NOT misuse this highly effective device! This device is an effective training tool for learning about electronics and magnetism and its only legitimate use is for educational purposes! Do you believe me yet? OK, I thought so.


The Challenge

So, what's so difficult about tapping a telephone? Can't you just go down to Radio Shack and get a telephone recording adapter and plug it into a telephone jack? True, you can, but we also want to do it in a virtually undetectable manner, which is much harder to do. There are professionals out there who offer technical surveillance countermeasures (TSCM) services. They use a variety of techniques, some sophisticated and some quite simple, to detect and defeat attempts to wiretap and eavesdrop. To learn more about how they do this, we need to learn more about how telephone lines work.

For the present time, let's just concentrate on your home telephone service, though the equipment and techniques are often very similar when used for Big Business. Most residential telephone service is "POTS"..."plain old telephone service." A single POTS line consists of two conductors from your telephone central office or remote equipment. One wire is called "tip" and the other is called "ring." (For further research, you may want to find out where these terms originated.) When your telephone is on-hook (or "hung-up"), ring has an electrical potential of about 48 - 52 volts direct current (DC) relative to tip. This is called "battery voltage" and it originates from the telephone central office.

When you pick up your telephone handset or press the "talk" button on your cordless telephone, the telephone connects tip and ring to a coil or an electronic network that begins to draw current from the telephone line. This current draw is accompanied by a drop in voltage from 48 - 52 volts DC to less than 15 volts DC. (And do a little research on Ohm's Law, too.) This current flow is the signal for the equipment at the central office to provide you with dial-tone.

For incoming calls, the central office sends alternating current (AC) down the wires to make your telephone ring. This ringing signal is low in current (just a few milliamperes) but will often exceed 130 volts in potential. It will definitely give you a mean shock if you have it in your fingers when it rings!

If we know the electrical characteristics of a POTS line, we can make some critical measurements to see if someone has tapped the line. For example, we expect that the voltage will drop on a POTS line as we add more devices, either telephones or recording adapters, to it. A TSCM professional can often measure those voltage changes and detect poorly-designed taps, not matter where they are installed.

Some recording adapters insert into one side of the telephone line and pass the signal through the device. These devices usually either increase the electrical resistance on one side of the telephone line or increase the current passing through the telephone line. A TSCM professional can measure and compare the current draw of the telephone at several different places to ascertain if there is an unseen device somewhere on the line. Or he may "balance the line," by taking measurements which compare the overall resistance of each side of the line from the central office. Done properly, this method can detect differences in resistance of as little as a few ohms. He will typically use a test instrument like the Triplett Model 4 Telephone Loop Tester (shown below) that is capable of making fine measurements of telephone circuit voltage and loop current.

Triplett Model 4 Telephone Loop Tester

Another test instrument used by the TSCM professional might be a time domain reflectometer (TDR). A TDR sends a short high-frequency pulse down the conductors of a cable. It then measures the impedance characteristics of the cable generated by reflected energy. This method is very good at finding parallel taps, series taps, splices, cable faults, and even locations where the cable conductors have been twisted apart from each other. (You may be surprised to learn that the impedance of a cable is actually a function of the spacing of the conductors, so separating the conductors significantly changes the cable impedance at that point.) A typical TDR is the Tektronix Model 1503C (shown below). This model also has an RS-232 serial interface to allow a computer to capture the test data for further analysis or comparison.

Tektronix Model 1503C Time Domain Reflectometer

And while it might be low-tech, a simple physical search to locate wiretaps can be very effective. A TSCM professional will examine cables and connectors to ascertain if there are any signs that devices have been attached and then removed. He may look for the tell-tale signs of a "bed of nails" alligator clip, which leaves tiny holes in the insulation where it was attached.

One technique that will certainly be used will be radio-frequency (RF) spectrum analysis, which is intended to locate wiretapping devices that broadcast the audio to a remote listening post using a small RF transmitter. Many of these transmitters are powered directly from the telephone line, making them easy to detect by measuring the voltage and loop current. However, it is more reliable to use a wideband RF spectrum analyzer. A typical portable unit, the AVCOM PSA65A Spectrum Analyzer, is shown below. The spectrum analyzer will provide a visual representation of RF energy from near-field sources and will attempt to demodulate the signal for the TSCM investigator. A spectrum analyzer is most effective against transmitters which broadcast continuous, analog radio signals.

AVCOM Model PS65A Spectrum Analyzer

OK, let's summarize what we've learned so far. We want to avoid wiretapping techniques that:

(1) significantly alter the electrical characteristics of the telephone circuit,

(2) change the impedance characteristics of the cable or attach directly to the conductors,

(3) leave physical evidence of attachment to the cable, or

(4) broadcast RF energy that can be detected by spectrum analysis.


The Inductive Tap

Fortunately, there is a technique that meets most of our requirements. It is the inductive tap (shown below). The inductive tap takes advantage of the fact that an electric current passing through a conductor generates a magnetic field. Changes in the magnetic field, under the right conditions, can "induce" (hence, "inductive") current flow in another nearby conductor. The induced current in the second conductor will vary as the original current, providing us with a "duplicate" signal. Since the signal is induced magnetically, no direct connection to the original conductor is required.

Inductive Telephone Tap

The tap is designed to be used in several different ways. It can be connected to a local tape recorder, which works very well if the recorder has a VOX circuit. It can be connected to a small amplifier or line driver to retransmit the signal to another listening post over copper conductors. It can even be connected to a radio transmitter for retransmission of the audio, You must, however, give consideration to the possibility that the method of retransmission might be more subject to discovery than the tap itself.


Constructing the Tap


OK, let's get down to business. You will need to collect your parts and materials. Here's what you'll need:

(1) Ferrite split core assembly (Radio Shack Part No. 900-7043, Radio Shack No. 273-105, Amida Part No. 2X-43-251P2, or equivalent)
(75') Enamelled 28 AWG magnetic coil wire (Radio Shack Part No. 278-1345 or equivalent)
(1) 1/8" mini-plug cable with tinned ends (Radio Shack Part No. 42-2434 or equivalent)
Misc. heat-shrink tubing, electrical tape, and tie-wraps

Once you've assembled your parts and materials, you're ready to begin. Follow these illustrated steps:

Fig. 1 shows what your ferrite split core should look like. Yours may be round, but it is important that it open at one side. (That's the "split" part.) Figure out how to open your unit and move on to the next step.

Fig. 2 shows what your ferrite split core should look like when it's open. Go ahead and open the unit and go on to the next step. Don't lose the horseshoe-shaped piece or you'll have to go buy another core.


Carefully wind about 100 turns of magnetic coil wire around the side of the core that doesn't open. Fig. 3 shows what it should look like. Remember, it's going to be awfully hard to do this if you haven't opened your core. The exact number of turns is not very critical...if you get 75 turns, you've got enough for it to work. Trim the ends of the coil wire, leaving about 6" of each to work with.

If you can't find a rectangular split core, a cylindrical one will work just fine. Here's Radio Shack Part. No. 273-105. Open the core and make the windings from end to end on one half of the core. Electrically, the wire that we will be tapping does not know if the split core is rectangular, toroidal, or cylindrical in shape. The basic principles of operation remain the same.

Using a knife or fine grit sandpaper, remove the enamel from the last 1/2" of each end of the magnet coil wire. It's easy to nick the wire and break it, so take great care. (This is why you left yourself about 6" to work with.) If you are going to use heat-shrink tubing to insulate the solder joint (see the next step), this is the time to slip the tubing on each wire. Next, solder the ends of the miniature phone plug cable to the magnetic coil wire as shown if Fig. 4. Don't overheat the wire or it will get brittle and snap off. Just get a good electrical connection.

Insulate the solder joints with heat-shrink tubing (glad you read ahead, right?) or with electrical tape. Secure the cable to the tap using tape or tie wraps. You should now have a durable assembly that can be opened at one side. To use the unit, you slip one conductor of the telephone circuit through the split core. DO NOT put both conductors through the split core! It will not work if you do this!

Now, what could be simpler than that? The whole process should take you only a few minutes. Once you've finished, you should be able to open the split core and put it around one conductor of a telephone line. In a standard four-wire telephone cable, the two conductors used for the telephone circuit are usually red ("ring") and green ("tip".) The yellow and black conductors may be used for a second telephone circuit.

Radio Shack Mini Audio Amplifier

Once you've put the unit on a telephone line, you should be able to connect it to an amplifier or recorder and get excellent audio quality. I use an inexpensive Radio Shack mini audio amplifier (Radio Shack Part No. 277-1008), which works great. You will not hear any audio until the telephone goes off-hook. Also, you must have your tap installed between the telephone(s) in use and the telephone service connection. In other words, current has to flow through your tap before it works. You cannot hook it up to an unused telephone jack and get any results.


How Does It Work?

The operation of the tap is simple. It's up to you, the budding junior scientist, to fill in the gaps, research the theory, and come up with hypotheses which you can test.

When electric current passes through a conductor, it creates a magnetic field around the conductor. The nature of the magnetic field can be described by what is called the "Left Hand Rule." If you hold a conductor in your left hand so that the current is passing in the direction your thumb is pointing, the magnetic field will surround the conductor in the direction of your curled fingers. When we install the ferrite split core around the conductor, it becomes magnetized in the direction of the magnetic field. (And the better the alignment of the core with the field, the stronger the magnetic effect.) The core becomes a big circular magnet.

A changing magnetic field will, in turn, create an electric current in a conductor that passes through it. When we wrapped the magnetic coil wire around one side of the ferrite core, we effectively multiplied the strength of the current flow induced in the wire by the magnetic field. As current flows through the telephone circuit conductor, it reverses direction, and the magnetic field it creates, corresponding with the audio signal coming over the telephone. The changing magnetic field induces a corresponding electrical signal in the coil wire and we amplify it to be listened to or recorded.

Some questions for thought:

1. Will more windings of the coil wire change the signal level we get from the tap? How? Can we predict an increase or decrease?

2. Will we get any audio signal from direct current (DC) flow through the tap? Why or why not? Is this independent of voltage?

3. What happens if you put both telephone circuit conductors through the tap? Why?

4. Why is it safer to use this method than to connect directly to the telephone circuit conductors?

5. What is a "punchdown block"? Why might one provide a good location to install your tap? Are they used in homes?

6. What are ferrite cores of this type normally used for? What is their principle of operation?

If you were able to answer #6 above, then you have probably figured out that a good TDR operator can locate an inductive tap. The tap's construction has a significant effect on the impedance of the cable, since the conductors must be separated slightly to allow for installation of the tap. Also, the tap has measurable "impedance", or a resistance to alternating current (AC) signals, though it has little effect on DC signals. A TDR uses a very high-frequency pulse, which does not pass through the tap very well and leaves a signature on the TDR screen. Fortunately, not many operators look for this type of signature, so you're probably OK.

Thanks for tuning in and good luck on your science project!

Return to the Unterzuber.com web page.