If you look closely at the spectral plot displayed on the smartphone, you’ll notice some higher-order IMD by-products, at 4 kHz and beyond, as well as several other frequencies. Interestingly, although we could hear the 7-kHz tones during the experiment, we couldn’t hear the 4-kHz tones recorded by the smartphone. We suspect that the 4-kHz tones partly resulted from secondary IMD within the microphone itself. In other words, the microphone was hearing an acoustic illusion that we couldn’t hear.

For fun, we also experimented with using an ultrasonic carrier to eavesdrop on a room. In this kind of setup, a spy places a microphone to pick up speech and then uses the relatively low-frequency audio signal to modulate the amplitude of the carrier wave. The carrier wave then gets picked up by an ultrasonic-capable sensor located some distance away and demodulated to recover the original audio. In our experiments, we selected a song to stand in for the audio signal recorded by an eavesdropping microphone: Rick Astley’s 1980s hit “Never Gonna Give You Up.” We amplitude modulated the song on a 32-kHz ultrasonic carrier. When we introduced a 25-kHz sine wave to interfere with this covert ultrasonic channel, IMD in the air produced a 7-kHz audible tone with ripples associated with the tones of the song, which was then picked up by the recording device. The computer played the song after software demodulation.

This video shows the results of our “rickroll” covert ops…