Signs Your Office Is Bugged: Which Ones Actually Mean Anything

Search this question and you will find the same five or six warning signs repeated almost word for word. Very few of those pages say where the claims come from, and several of them describe effects that stopped being diagnostic when telephone networks went digital. This guide takes each one, gives the actual mechanism, and says plainly whether it tells you anything.

Electronic eavesdropping in an office means a device or a piece of software capturing conversation or images without the consent of the people in the room. It falls into three classes that behave very differently. A planted radio transmitter emits a signal and can in principle be found by a radio search. A passive recorder stores to internal memory and emits nothing at all, so there is no signal to find. A compromised endpoint, such as a laptop, a desk phone or a video conferencing codec, uses a microphone that is already in the room and sends audio out inside ordinary encrypted network traffic. Technical surveillance countermeasures (TSCM) is the discipline of searching for the first two. The third is a cybersecurity problem, and no radio sweep will find it.

Which classic signs survive scrutiny

Why clicks and static are not evidence of a tap

The clicking telephone belongs to an era of physical bridging taps on analogue copper lines. Interception today is carried out inside the operator's network by reconfiguring equipment there, which means nothing is added to your line, your handset or your room for you to hear. In India that activity sits under the Telecommunications Act 2023, with the Telecommunications (Procedures and Safeguards for Lawful Interception of Messages) Rules, 2024 made under section 20, and an interception order runs for a limited period before it must be renewed. None of that machinery touches your office.

The noises people actually hear have documented causes. Microsoft's own call quality guidance for Teams attributes robotic or garbled audio to jitter once it rises past roughly 30 milliseconds, and gaps, clipped syllables and choppy speech to packet loss from congestion or a failing link. Echo it attributes to the microphone picking up the loudspeaker again, which is why a headset usually cures it. A click or a burst of static is telling you about your network and the acoustics of the room (Microsoft Learn).

Does *#21# show whether your phone is tapped?

No. That string is a supplementary service code defined in the GSM standards, specifically the man machine interface codes in 3GPP TS 22.030. The interrogation form asks the network about a given service, and service code 21 is call forwarding unconditional, the setting that sends every incoming call somewhere else. Dialling it returns the status of call forwarding and nothing else.

It has no relationship to interception, which is not implemented as call forwarding and is designed not to be visible to the subscriber. The code circulates because the response looks technical and alarming to someone who has not seen one before. If it reports that forwarding is active, the useful conclusion is that someone may have set up call forwarding on the account, which is worth sorting out with the operator, and is a different problem.

The one sign with real physics behind it, and why it has faded

The buzz that a mobile phone produces in nearby speakers is a genuine, well documented effect. Texas Instruments describes the mechanism in its application note on time division multiple access noise: a GSM transmitter can draw more than an amp, pulsing at a repetition rate of 217 hertz with a pulse width of about half a millisecond, and that envelope is rectified by semiconductor junctions in nearby audio circuits, which makes it audible (TI application note).

So the effect is real. The inference drawn from it is not. That buzz is the signature of 2G burst transmission, and it is produced identically by any ordinary 2G capable handset in the room, including the ones belonging to the people in the meeting. Newer uplinks do not have the same abrupt on and off envelope, so the effect has largely receded with the networks that caused it. Hearing it tells you a 2G class transmitter is near your cabling. It does not distinguish a covert device from a colleague's old phone, and its absence tells you nothing at all about Wi-Fi, Bluetooth, or anything that is recording without transmitting.

Why detector apps on a phone cannot do this

The limitation here is architectural rather than a question of app quality. Android's sensor framework exposes motion sensors, environmental sensors and position sensors, and there is no sensor type for radio frequency spectrum and no interface that hands an application raw spectrum (Android developer documentation). The radios in a phone are tuned receivers for particular standards, so they can list Wi-Fi networks and Bluetooth advertisements, which is a network scan rather than a search of the airwaves. A transmitter that does not speak a protocol the phone implements is invisible to it.

The sensor these apps usually fall back on is the magnetometer, which measures the ambient geomagnetic field in microtesla and exists to make a compass work. It responds to screws, hinges, desk frames and speaker magnets at close range, which is why such apps alarm almost continuously in a furnished office. The camera is no better placed, because camera modules carry an infrared cut filter, and covert illuminators commonly sit at a wavelength chosen to be invisible.

There is credible research in this direction, and it is worth knowing how narrow it is. Work presented at ACM SenSys in 2021 used the time of flight sensor on a phone to detect the retro-reflection from a camera lens, reporting detection of 88.9 per cent of hidden cameras against 46.0 per cent for the naked eye in a study with 379 participants. That result needs a time of flight sensor, finds camera lenses only, says nothing whatever about microphones, and is a research prototype rather than anything in an app store.

What actually changes the risk: who had access to the room

A device has to be placed. Placement needs opportunity, which is why an unexplained opportunity is a real change in your risk while a symptom almost always has a duller explanation. Access events have the further advantage of being checkable against records, which symptoms are not: visitor logs, work orders, access control data and camera footage either show something or they do not.

The events worth taking seriously are mundane. Contractors or technicians left unsupervised in sensitive rooms, including electrical, air conditioning, audio visual and cleaning work after hours. Fit out or maintenance work that opens ceilings, walls, power or data runs, which is the one routine reason for anyone to be inside the building fabric. Visitors left alone in a boardroom, including during a break. New mains powered objects nobody ordered, and fittings or faceplates that have moved. Keys and access cards that were never returned, and the escort rule waived once as a favour.

Two Indian cases make the point better than any list. In the most prominent Indian corporate espionage prosecution, reported in February 2015, documents were taken from ministry offices in Delhi by junior officials using duplicate keys at night and passed on through intermediaries. There was no device at all: it was access, key control and paper. And in May 2026 a junior revenue assistant at a district rural development agency office in Jagatsinghpur, Odisha was arrested after a camera he had placed in the women's washroom fell while an employee was using it; the office's own camera records then corroborated his movements (Odisha Post). An insider with ordinary access, discovered by accident and by records, not by any of the classic signs.

When a leak really is evidence

Information surfacing where it should not is the one lay indicator with genuine weight, and it is only as strong as the fact that leaked. A generic outcome, such as a competitor pricing just under you, is weak evidence because it can be modelled from the market. An arbitrary and specific detail is strong: a verbatim phrase, a number that was wrong in the room and wrong again outside it, a named internal objection, a date that was never written down. The question to ask is whether the detail could have been guessed, inferred or reconstructed. If it could, it is not evidence.

There is a statistical trap here that deserves naming. Stefan Axelsson's work on the base rate fallacy in intrusion detection, published in ACM Transactions on Information and System Security in 2000, showed that when the underlying event is rare, even a detector with a low false alarm rate produces alerts that are overwhelmingly false, because the result depends on how rare the event is and not on the detector's sensitivity alone. Covert devices in a given office are rare and coincidences are common. Once somebody suspects a bug, every click and flicker gets recruited as confirmation, so a suspicion assembled from a stack of individually weak signs is weaker than it feels, not stronger.

Before reaching for the device explanation, rule out the ones that are usually likelier. Insider disclosure, including by people on their way out. Inference from public signals such as filings, hiring and vendor movement. Carelessness in lifts, cabs, airport lounges and open plan floors. Document and email leaks, forwards and misdirected mail. Shared calendars, which are chronically underrated: a meeting title, an attendee list and a room booking are often visible far beyond the people in the room, and they give away the existence, timing and participants of a confidential discussion without any device. Third parties who legitimately hold the fact, such as counsel, bankers and auditors. And a participant simply recording on the phone in front of them, which is not bugging and which no sweep will ever find.

The cautionary example is a senior one. In 2010 the then Finance Minister asked for an inquiry into adhesive found at sixteen points across his office suite in North Block. The Intelligence Bureau examined the rooms and concluded the substance was chewing gum, noting that there was no groove or cavity at the points concerned and that at one of them the adhesive carried a coat of paint, indicating it had been there for months (DNA India, June 2011). The most senior office in the country, a real suspicion, national technical capability brought to bear, and the answer was mundane.

The threat a modern office is more likely to face

MITRE's ATT&CK knowledge base records audio capture as an observed technique in which an adversary uses the microphone, webcam or call application already on a machine, through ordinary operating system and application interfaces, writing audio to disk and sending it out later. MITRE's own note on it is worth quoting: this kind of technique cannot easily be mitigated with preventive controls, because it abuses features the system is supposed to have (MITRE ATT&CK T1123).

Set that against a planted transmitter. The laptop or room codec is already in the room, already has a microphone, already has mains power and a network path out, and has a legitimate reason to be there. A planted transmitter needs covert installation, a power source and an emission that can be found. The cheaper option for an adversary is usually the equipment you installed yourself, and a radio sweep does not detect it, because the traffic leaving the building looks like all the other encrypted traffic.

What a sweep can and cannot establish

A sweep reports what was found in the areas accessed, by the methods used, under the conditions present, at the time of the visit. It cannot establish a negative, and the distance between those two statements is where most misunderstandings live. Specifically, it cannot establish that a recorder storing to internal memory is absent, because such a device emits nothing to detect. It cannot establish that a device which was not transmitting during the visit is absent, since voice activated and remotely triggered devices are silent most of the time. It says nothing about areas that were not accessed, about a compromised laptop or cloud account, or about a participant recording the meeting. And it cannot keep the room clean after the team leaves.

That last point has an official statement behind it. The United States Department of Defense instruction governing its own countermeasures programme defines a survey as a thorough visual, electronic and physical examination, three modalities precisely because an electronic search alone is not sufficient, and it records that surveys of facilities with open access have proven counterproductive by giving occupants a false sense of security. A sweep of a room that anyone can walk into is worth less than fixing who can walk into it.

So the sentence to keep hold of is this: a sweep that found no signals is not the same statement as a room with nothing in it. Any firm willing to blur those two is selling reassurance rather than a result. Our national guide covers what a sweep involves in more detail, the guide to hidden cameras covers the checks worth doing yourself, and the guide to corporate espionage sets out what Indian law actually protects when information leaves a company.

If you think you have found something

Safety comes before evidence. If anyone is in immediate danger, call 112. Otherwise, leave the object where it is: do not pull it apart, unplug it or take it away, because handling it destroys the thing that would make it useful later. Photograph it in position, note where it was, and write down who has had access to that room and when.

A suspected offence is a matter for the local police. Cyber complaints, including the publication of private images, can be filed at cybercrime.gov.in. It is worth knowing that 1930 is the helpline for urgent financial cyber fraud rather than a general number for this situation, which is a common mix up. If the room may still be live, make these arrangements from a different phone in a different place, and tell only the people who have to approve access.

Frequently asked questions