Forensics and industry experts have cast doubt on an alleged National Security Agency capability to locate whistle blowers appearing in televised interviews based on how the captured background hum of electrical devices affects energy grids.
Divining information from
electrified wires is a known technique: Network Frequency Analysis
(ENF) is used to prove video and audio streams have not been tampered
The technique works by analysing the nearly inaudible 50 Hertz
energy hum generated by power grids which is inadvertently captured by
most audio recording devices. Investigators could strip away layers of
audio until the bare hum remains. That hum can then be scrutinised for
ENF analysis became topical this week when German outlet Heute.de
reported an un-named former NSA staffer claimed the agency has used it
to determine the physical location where a recording of TV interviews
took place by matching captured energy hums with those previously
recorded across the grid.
NSA operatives could therefore guess at a whistleblower's location.
Technology to conduct ENF is not exotic. Bandpass filters can detect variations in the 50Hz hum which would detect dips and rises as small as 0.001 Hz over 10 seconds.
That it is possible to geolocate variations in grid hum, which Heute.de reports the NSA and CIA can do, is more novel.
But experts are dubious the reports are correct.
me start by saying that in principle it could well be possible to use
ENF to determine the location a recording was made as well as the time
it was made," Philip Harrison, an ENF forensics veteran of 18 years
based in London told The Register.
"It's possible that
there are some other aspects of the signal that vary by location that
haven't been discovered yet, or perhaps the NSA have discovered them."
Harrison had performed ENF to verify audio recording presented as evidence in court showing that a undercover police recording of an illegal weapons deal had not been tampered with. In 2010, ENF was used in a high profile murder case
in the UK. Blighty's Metropolitan Police Service have stockpiled a
comprehensive database of electrical grid frequencies since 2005 to help
with further cases.
Vulture South contacted Harrison and
others about the ex-NSA agent's claims. Harrison saw three problems that
were likely intractable for anyone other than the seemingly superhuman
hackers at the NSA.
"Firstly," Harrison said, "the NSA would need to know over what geographic area the specific type of variation occurred".
Research published last month by the University of Porto, Portugal, (Real-Time Monitoring of ENF and THD Quality Parameters of the Electrical Grid in Portugal)
examined local variation in the nation's power grid. It found
fundamental differences in the structure of the harmonics of the 50 Hz
which could be detected because Total Harmonic Distortion was strongly
affected by local factors and had as a result little geographical
That research considered only a handful of locations
meaning it was unclear how the features could vary between sub-stations
or power stations, Harrison said. The NSA could know of other signal
aspects that varied according to location, but that was speculative.
second problem was the need to log ENF values and the secret signal
sauce that allowed location to be determined. "This could mean hundreds
or thousands of logging devices in a country if you want to be able to
locate a recording accurately," he said.
The problem was a
prodigious one because of the huge amount of frequency variation in
local power grids. All manner of electrical devices could cause a dip or
spike in neighbouring networks.
"You would need a tap on every
one of thousands of transformers," said Ian Appleby, a former veteran of
the Australian energy and defence sectors who maintained a
comprehensive knowledge of electronics, but not of ENF. "In the
industrial area where I used to be, my UPS (uninterruptible power
supply) would freak out when nearby commercial places shut down causing a
spike in frequency."
He doubted the feasibility of mapping a whole power grid considering these immense variables.
A third problem relates to the hit and miss process of extracting the relevant data from captured recordings.
my experience of casework this is the hardest part," Harrison said.
"It's not always easy to get out the variation in 50 Hz since it is at
such a low level in the signal, let alone trying to get more information
out about the harmonics or some other aspect of the signal."
"So while it might be able to work in principle, actually applying it to a real-world recording could be a lot harder."
audio and video equipment used to record whistle blowers could be
identified, according to NSW-based Brian Stokes who had a background in
the field but not ENF. He and other engineers agreed with Appleby's
"The possibilities of characterising the recording
equipment such as microphone, input amplifier, etcetera are rather good,
but the likelihood of determining the geographical location of the
recording based upon artifacts of the mains supply, given the levels of
filtration in DC supply design, sounds improbable."
If the NSA did have the technology, it was bad news for whistleblowers. The Heute.de
source said they could nail a whistle blower in less than three weeks,
even faster if they spoke at a monitored journalist's favourite haunt