London Met Police lab uses "electrical network frequency analysis" (ENF) | Hacker News Reader

London Met Police lab uses "electrical network frequency analysis" (ENF)

theregister.co.uk

50 pointsableal25 comments

Here's a white-paper with more detail about the technology.

http://www.diamondcut.com/Downloads/AppNote4DiamondCut.pdf

The author describes a case-work example where he compares an analyzed audio file to ENF data from the power company (?) about the building and can prove it wasn't recorded on the claimed date and there were multiple deletions.

Seems like a suitable countermeasure would be a localized source of randomized ENF (say a Zener diode in cascade overload in a low-freq oscillator), but the coupling would be sufficiently different as to highlight the deliberate attempt at ENF obfuscation.

As the U.S. has essentially 5 power grids, they would need a more detailed database too. Still, fascinating stuff.

Random ENF would not work, since you could filter it out and look only at the 60 hz +- a few ppm signal. You need a random source that is very very close to 60 hz, but just slightly different.

But that might not be enough - the original signal is still there, and it's much stronger than your noise. The frequency is still powering your power supply, and still causing a 60 hz variation in the voltage.

You would need to isolate the power supply completely, or run it entirely through your noise adder. It would work best if you could add the noise to the DC output of the power supply.

"You need a random source close to 60hz" Correct. I specified a Zener diode source coupled to an oscillator.

This would provide the signal noise filtering and phase-locked-loop (e.g. the necessary +- ppm signal power spectral distribution control).

Given propagation losses, my ENF signal doesn't have to be nearly as powerful--merely more closely coupled to the device(s) being "shielded".

Also, I think a so-called fast-switching DC-to-DC converter would provide the necessary isolation. Plenty are being manufactured now that isolate down to 40Hz, but outside of the audiophile realm, that quality of filtering isn't typically used for low-power applications.

Seems like a suitable countermeasure would be a localized source of randomized ENF (say a Zener diode in cascade overload in a low-freq oscillator),

I think we have our new line of CSI dialogue right here.

Followed closely by "I think this case just had -- [puts on sunglasses] a shocking new development."

On a similar note, I've been meaning to run an FFT on some classic rock tracks and see if I can tell by the hum and harmonics whether they were recorded in the US (60 Hz) or the UK 50 Hz).

It's a clever idea, but I can think of a few ideas that might make it less effective.

Keep in mind, the story is from The Register. Not all the details can be taken at face value.

Old magnetic cassette and VHS tapes didn't keep time accurately enough to extract reliable data, but now we can analyse even cheap voice recorders.

Hmm... It's been my experience that even miniDV cameras and digital audio recorders can have significant variations in their recording speed over time, which would have to be detected and corrected in order for this technique to work. I once tried to use a laptop with a USB audio interface to record audio and a DV camera for video, but could never sync up the audio and video because the video rate was fluctuating up and down. If I synced up the beginning and end of a clip, the middle would be off by up to half a second.

Though there are techniques to detect and compensate for these variations (some of which were used to restore the wire recordings of Woody Guthrie released as The Live Wire), I'm not convinced the minute variations in the mains supply would survive.

Possible countermeasure: narrow notch filters on every harmonic of the mains frequency plus a high-pass filter, or adaptive noise filtering (such as used by noise reduction audio plugins). Get those hums down into the single-bit levels and you'd need a huge sample size to extract any useful signal.

Any statisticians want to comment on how much data would be required to conclusively identify time, place, and edits?

Edit: another question: could it be possible to detect sample rate jitter caused by periodic variations in the voltage supplied to the sample rate clock generator, even after the noise is filtered out? Could it be counteracted by randomly resampling sections of the audio up or down by a few Hz?

A lot of "forensic science" doesn't seem very scientific at at all. This though, is really easy to test. All we need is a few independent organizations to send in recordings and get a timestamp back.

My initial response was "Damn, I'm running everying off a UPS from now on" until I read this:

Battery-powered devices are not immune to to ENF analysis, as grid frequency variations can be induced in their recordings from a distance.

I'm slightly skeptical of that, but if it's true, it's pretty impressive.

I had the same response, but then I thought "wait, I don't do any covert and sketchy surveillance, this doesn't affect me".

Can you think of any privacy concerns with this technology?

"Damn, I'm running everything off a UPS from now on, and in a faraday cage if it's not far away enough from a mains line."

John Varley's 1984 novella "Press Enter _" (Hugo winner 1985), had something along those lines, if memory serves.

Faraday cages don't block low frequency magnetic fields. You would also need some mu-metal.

As a side note http://www.science-products.com/Products/CatalogA/Filters+Di... claims to be able to get rid of the signal.

There wasn't a good explanation in the article. Anyone want to break it down for the layman? I get that the power company can record variances in load and time stamp them, but how does that signature have anything related to a recording made on a battery powered device?

Not load.

Frequency.

Basically the entire US hums at 60 hz. (There are about 7 independent grids each humming separately.)

The grid is kept very synchronized, so the 60 hz is the same at every house. But the 60 hz is not exact, it changes slightly up/down. But when it changes, it changes everywhere.

So what they do is record the slight variation in the 60 hz hum, and keep it long term. (Like it's 59.9992 then 60.0001, etc, etc.)

The effect of the 60 hz, is to have a slight wobble in the DC voltage made by a power supply. This wobble then translates into a background noise in recordings.

Then compare the exact frequency of the hum to your long term recording and look for a match.

Even on a battery operated device the hum could still be there, because the local power line makes a slight electric/magnetic field, which is picked up.

So, with a long enough record of the wobble at hand, could we tell the exact moment any recording ever made was made, much like Dendrochronology?

And also locate the recording, due to the independent grids?

Only if you have a record of the frequency changes.

The article says that in London they have a record going back 5 years.

Is there any such record in the US? I have no idea. I don't think there would be - till this idea came up there was no reason to make such a record.

so basically anything ever recorded with or near something on the grid has detectable background noise?

Looking at the math I don't see how they could make any sensible conclusions about a 4 minute sample of audio. That's only 160 data points and if the variations are in as small a range as you propose...

Even if they can only differentiate two states (say, below and above 60 Hz) 2^160 is a pretty large number so I don't think that would be a problem, unless I'm missing something.

I too am a layman on this topic, but here goes:

When you make a recording in most environments, because of power lines and equipment nearby there will be a mains hum in the recording at about 60Hz. This is true even if the recording device is battery-powered because it's in an environment with mains-powered devices.

But the characteristics of this mains hum will change slightly over time depending on the load of the power grid (Edit: It appears this isn't correct; see ars' comment). So apparently what they're doing is recording the power usage over time in one place, and correlating it with changes in the hum in recordings. Since they're attached to the same power grid, the variations should be similar at the two locations.

If the changes line up, then the recording was probably taken at that time. Similarly, if it lines up with time T=X for part of the recording, then to time T=X+10sec later in the recording, you know that about 10 seconds of audio were edited out.

Again, this is my interpretation, and I welcome corrections.

I predict that in a few years there will be commercial softwares to determine the date of an audio file, or if the cheating husband was indeed in the country he pretends, shortly followed by softwares to remove that information. There's a market there.

Some buildings have their own conditioned power; should be immune. After this, probably most federal buildings!

A better defense would be to have a device that introduces random frequency variations into the building's power so it doesn't correlate with the power grid anymore.

Interestingly, the original signal would still be there, and perhaps vulnerable to statistical analysis?

Reply on news.ycombinator.com