Printer Friendly

Keeping conversations confidential.

WHILE GOVERNMENTS HAVE recognized that their sensitive information may be vulnerable to acoustical surveillance and have taken steps to counter it, industry has not. Countereavesdropping precautions must be taken to protect sensitive spoken information.

Sometimes this information is discussed before it has been written down. If the data has already been documented, those who seek it may not be able to obtain the documents in time to be of use, so acoustical surveillance is used. To counter the threat, security managers, many of whom are acoustical novices, need to know how to design speech security into a room without having to learn the intricacies of acoustical engineering.

General guidance is provided in CIA directive DCID 1/21. While it is insufficient, it is a good starting point. The Department of Defense (DoD) has implemented that document as Defense Intelligence Agency Manual 50-3 (DIAM 50-3). Chapter twelve of that manual provides guidance on how to protect conversations within sensitive compartmented information facilities (SCIF), such as rooms, computers, and telephones.

The amount of speech security needed is determined by the expected effort of the eavesdropper and several acoustical factors. These factors can be summarized in one sentence: Conversations are intelligible to the eavesdropper when the sound level of speech heard at the eavesdropping point is higher than the background sound level there. A professional designing rooms for speech security, therefore, must take into consideration the following information:

* The category of eavesdropper.

* The highest level of voices within the room. These can be natural, amplified, or recorded voices.

* The eavesdropping locations. The likely locations for eavesdropping depends on the category of eavesdropper.

* The attenuation of voice levels from the speaker's position in the room to the eavesdropping locations. This reduction can be provided by sound absorption in the room, walls, doors, or other structural components.

* The level of background sound at the eavesdropping locations. Not only must the actual background sound be considered but also the capability of the eavesdropper to artificially reduce that background sound.

Following is a look at the guidance provided by chapter twelve of DIAM 50-3, after which the short-comings will be considered, along with a practical approach security managers can use to design a room for speech security.

Eavesdropper. When discussing the category of eavesdropper, DIAM 50-3 states that the "systems are designed to protect against being inadvertently overheard by the casual passerby, not to protect against deliberate interception of audio." In private industry, however, not all eavesdroppers are simply passing by.

Acoustical eavesdroppers can be divided into four categories. A category I eavesdropper inadvertently hears important information as he or she passes by a partially open door.

A category II eavesdropper is an amateur with no particular skills or equipment. He or she will almost always use his or her ear as the listening device and may attempt to listen through an air duct, a wall, or by lifting a ceiling tile.

A category III eavesdropper is a professional surveillance person or company. He or she is skilled in the art of acoustical surveillance, has access to sophisticated devices, and knows how to use them. He or she may also have the skills to make equipment.

A category IV eavesdropper is from a government agency, either domestic or foreign. He or she usually has the financial resources to hire the most talented people and purchase custom-made and highly sophisticated devices, most of which are not available on the commercial market.

Chapter twelve of DIAM 50-3 only discusses category I listeners. The authors presume that the facility containing the room to be secured already has a high degree of physical protection and that the personnel in the vicinity have been investigated and are considered reliable.

Neither of these conditions can be generally applied to commercial or industrial settings. The manual alludes to category III or IV eavesdroppers when it refers to filtering electrical power supplies, filtering audio wiring that extends beyond the periphery of the room, and other high-technology methods, but the room design criteria in the manual only work against category I listeners.

Voice levels. The manual refers only indirectly to voice levels in its discussion of an auditorium with sound reinforcement. No reference is made to other types of rooms or amplified speech. Mandatory upper limits for voice levels or methods of voice level control are not discussed.

Eavesdropping locations. The document lists many, but not all, locations for potential eavesdropping, such as walls, doors, windows, air ducts, and electrical wires that penetrate the periphery of the room, but it does not provide guidelines for protecting these locations.

Voice attenuation. The provisions in chapter twelve are based on sound transmission class (STC), which is a rating system used to rate the construction components of a room, such as walls and doors, but not the finished room itself.(*) This rating system is published by the American Society for Testing Materials (ASTM) as ASTM E413-87.

The testing method given in chapter twelve of DIAM 50-3 rates the sound loss of the walls after construction in accordance with procedures published as ASTM E336-90. It is not a test of the entire room, which it should be, nor is it a test of any room components, such as ducts.

While STC generally relates to the privacy of speech, the method of calculating it allows for deficiencies that permit the performance of the component to be actually less than stated. If the accepted deficiencies occur at frequencies where speech can be easily understood, speech security is compromised.

Since this factor is only one of several that contribute to speech security, a measurement of STC is not conclusive to the overall speech security in the room. Further, STC only addresses the airborne sound heard by a person on the far side of the wall, not vibration transmitted speech or listening devices in the walls, windows, or ducts. Thus STC is applicable only to category I listeners.

Background sound levels. To address background sound levels, the 1990 update to the DIA manual added several important sections about sound masking. Sound masking is a way to cover up the conversations to be protected. A conversation is masked by sounds or vibrations emitted at likely eavesdropping points by a special sound system installed entirely within the room to be secured.

The 1990 update refers to masking devices that emit vibrations as well as sound to protect against higher category eavesdroppers. The document suggests locations for masking devices and a performance criterion but also refers to a cover music system as an alternative approach. Unfortunately, music alone is not adequate for masking. It is only effective when used in conjunction with masking. By allowing a cover music system the government is incorrectly leading people to believe that it is sufficient.

The federal manual addresses all the factors pertinent to speech security but not in a comprehensive manner or in a way that permits a person relatively unskilled in acoustics to achieve speech security with a cost-effective room design. This is not surprising since acoustics is shrouded in mythology; the jargon used makes the material seem technically complex, and security professionals are not trained in the subject.

To understand the current guidelines' weaknesses, the five factors must be reanalyzed from the room designer's viewpoint. The results can then be integrated into a design method that could be used as a basis for a revised federal manual or applied to industry.

Category of eavesdropper. The category of eavesdropper is a decision made by the security professional or room user based on a threat analysis. Before assigning a category, a security professional should take into account the restrictions on access to the areas surrounding the room to be protected, such as video surveillance or intrusion detection. Also, the category assigned may be different for different components of the room. For example, a room with windows facing a public space may need to be protected from category III or IV listeners, while the interior walls may only need to be protected from category I listeners.

Voice levels. The voice levels that the room might contain depend on the audio equipment to be installed in the room and must be taken into account.

Eavesdropping locations. The security professional, room user, or room designer can predict likely eavesdropping locations based on the category of eavesdropper.

Voice level attenuation. Since the STC rating is available for the most commonly used construction assemblies, its use is retained, and the deficiencies noted here are accommodated by correction factors. The STC rating is restricted to wall construction, and most walls have penetrations, such as doors or windows.

The design procedure must provide a correction factor that accounts for the performance degradation associated with these wall penetrations. This is a variable under control of the room designer. This will become clear in the example below.

Background sound levels. If sound masking is used, the background sound level can be controlled by the room designer, otherwise it is an unknown that can only be estimated. A good design procedure provides guidance on where masking may be used and how it must be measured.

This aspect of acoustical counter-measures has the greatest degree of technical complexity and requires acoustical equipment. If measurements are made in accordance with the noise criterion (NC) rating method, a correction factor must be used to adjust the result to one that relates to speech security. Since the background levels should be measured at the eavesdropping locations, a correction factor may be needed for those locations where it cannot be measured, such as inside an air duct.

The capability of the eavesdropper to artificially reduce that background sound must also be considered. Category III or IV listeners may use phased array microphones, adaptive filters, or correlation techniques to recover conversations buried in background sound. This signal recovery has the same effect as lowering the background sound level. The design process should provide a correction factor that reduces the value of the background sound level used for overall room security.

THE DESIGNER CAN ACTUALLY CONTROL only two items directly--the sound attenuation and, if sound masking is used, the background sound level. A verification procedure is needed to establish the validity of a design. The following test, which is often used, is not adequate: Room designer: "Can you hear me, Joe?" Joe: "No." Room designer: "Good!"

It is necessary, but not sufficient, to make an STC measurement as discussed in DIAM 50-3. Only a direct measurement and calculation of speech intelligibility in a completed room is sufficient verification.

As with all technical security countermeasures, technical expertise is required. However, with the two-step design method suggested below, a security manager can get a good idea of his or her design requirements.

The first step protects against category I and II eavesdroppers, and the second step protects against the higher category eavesdroppers. This procedure is currently being written but is not yet complete. When it is published all the tables and worksheets discussed below will be available to security managers. An example situation will be used to help illustrate the procedure.
Figure 2
Incomplete Worksheet
Positive factors Negative factors
Sound transmission class -- Normal voice 62
Background level NC -- Voice correction --
 Wall STC correction --
 STC reduction --
 Background correction --
Total -- Total --

Company A has decided that some of its conversations are so sensitive that its personnel must not be overheard under any circumstances. The security manager is asked to secure a room in the executive area so those sensitive conversations can be held without threat of acoustical surveillance. The room to be secured has an outside wall with windows, and it must be capable of containing audio and video presentations.

The first step is to protect against inadvertent or amateur eavesdropping by people in the executive office area. It is presumed that those admitted into this area are trustworthy but perhaps curious. This protection can be provided by controlling the construction of the three interior walls of the room. The procedure begins with the completion of the worksheet shown in Figure 2 for each of the walls to be protected. The data entered into the worksheet is derived from a set of accompanying correction tables. The user need not be experienced or knowledgeable in acoustics to complete this step.

The positive factors listed in Figure 2 are under the designer's control, while the negative factors generally are not. The negative factors are found in the supplementary tables. The values used for the example problems are typical of those found in normal room construction.

A sample Voice Level Correction Table is shown in Figure 3 to indicate the type of information contained in each table. The table tabulates corrections for voice levels other than conversational. For audio and video presentations the value in the table is ten; ten should then be entered into the voice correction line in the worksheet. This means that the sound system is 10 decibels higher than the normal conversational voice. If the sound system is professionally designed, the room designers should limit the level to this amount.

Next, the security manager should consult the STC Correction Table. It tabulates corrections that account for the difference between the STC rating and the rating based on speech intelligibility and the difference between laboratory tests and field tests. Published laboratory tests are better than field tests because the manufacturer takes great care to eliminate any sound leaks from one room to another. The correction factor must account for this.

The security manager then must consult the STC Reduction Table. It tabulates corrections that account for penetrations through the partition for which the STC is provided. It includes, for instance, various door constructions, windows, and partial height walls. In the example room, the walls go up to the structural ceiling, the air is ducted, and there is one door. The door is assigned a value of eight. This number represents a well-fitted, solid, core door with a floor sweep. This means that the presence of a door further degrades the performance rating of the wall by eight points.

At this point the security manager should consult the Background Correction Table. Since the standard background sound ratings, such as NC, do not have the proper weighting at each frequency to accurately assess speech intelligibility, a correction factor must be applied to account for this difference.

Assuming the security manager has decided to use sound masking, the value is zero because the sound masking spectrum is generally set to have the proper frequency weighting for speech intelligibility.

Conversely, background sound created by typical air-conditioning systems has little sound energy at higher frequencies where speech can be understood most easily. Air conditioning does have energy at low frequencies. That feature makes it appear loud but, in fact, an air conditioning system alone contributes little to masking conversations.

For this example, the negative factors add up to eighty-seven. This means the positive total must be eighty-seven or more. The security manager has chosen a wall construction that has an STC rating of forty-five, so a sound level of forty-two is required in the areas surrounding the room to achieve a total of eighty-seven. There are wall constructions that meet the rating of forty-five, and a background level of forty-two is an acceptable noise level for open areas and in many closed offices. One of the values of using sound masking, as seen here, is that the designer has two variables to work with, so he or she can trade off costs between them.
Figure 3
Sample Voice Level Correction Table
Voice effort Correction
Whisper -6
Conversational voice, telephone use 0
Raised, stressed, or projected voice +6
Loud voices, speakerphones, or +10

Wall construction is more expensive than masking, so the higher the sound-masking level, the lower the total cost. Sound masking, however, has an upper limit of acceptability that depends on the use of the surrounding rooms, so it cannot be set arbitrarily loud. If the total of the negative factors is high, the design might be unacceptably expensive. This makes the value of the worksheet approach more apparent. It lets the designer see his or her options.
Figure 4
Completed Worksheet
Positive factors Negative factors
Sound transmission class 45 Normal voice 62
Background level NC 42 Voice correction 10
 Wall STC correction 7
 STC reduction 8
 Background correction 0
Total 87 Total 87

For the example situation, prohibiting sound reinforcement of sensitive conversations would reduce the total to seventy-seven, which would mean significant construction savings. Another obvious strength of the worksheet approach is that the designer does not need to know what a decibel is or what each of the quantities used in the table really represent. The worksheet does have a weakness: Not all of the practical variations of room design have correction factors that are acceptably accurate. For example, when an old building is rehabilitated, sound leaks can be created by partially demolished old construction.

Once countermeasures for lower category eavesdroppers have been developed, protection against professional eavesdroppers needs to be addressed, if necessary. Design options include such items as the use of high STC doors, sound masking, and isolators. Isolators are devices that permit audio signals to enter a secure room but prevent any audio signal generated within that room from being carried out.

Of course, operational considerations, such as sweeps, can also serve to limit acoustical surveillance, but these techniques are beyond the scope of this article. The choice of protection depends on the category of eavesdropper and his or her ability to gain access to likely listening locations.

To secure the example room, the security manager has chosen to provide strict control on making recordings to avoid the possibility of the conversations being carried out on magnetic media. He or she has also decided to modify the playback equipment to limit the sound levels generated. This is a cost-effective procedure in that the wall construction can now be made lighter and less expensive. The security manager has also decided to place sound masking on the windows to preclude eavesdropping with laser microphones.

Although the information for each of the steps within the design method described here is available, it has not been collected into a form that can be readily used by security professionals to help with the design of a room for speech security. As more concern is shown for speech security, the effort to collate the existing information will be made, and the design method will be complete. Then good speech security can be routinely built into a facility.

* Richard C. Roth, "The Rocky Road to Speech Security," Security Management, (September 1987): 107.

Robert C. Chanaud, PhD, is president of Secure Sound, Inc., in Roswell, Georgia.
COPYRIGHT 1993 American Society for Industrial Security
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 1993 Gale, Cengage Learning. All rights reserved.

Article Details
Printer friendly Cite/link Email Feedback
Title Annotation:Physical Security
Author:Chanaud, Robert C.
Publication:Security Management
Date:Mar 1, 1993
Previous Article:An investment in asset protection.
Next Article:The art of planning.

Related Articles
Trial of the trade secret.
Cell phones and client confidentiality.
When does privilege provide protection? Attorney-client privilege can help protect corporate information, but security managers should be aware of...
A giant HIPAA: new guidelines reach far beyond health care industry. (2003 Technology & Business Resource Guide: Privacy Protection).
Few limitations on eavesdropping.
Who's listening? Electronic eavesdroppers have many ways to pick up your private conversations. Find out how to catch them.
Test for VoIP security.

Terms of use | Copyright © 2016 Farlex, Inc. | Feedback | For webmasters