---

9.1 About this volume

This volume surveys everything commercially available for hidden-camera detection across four tiers: cheap RF sweepers ($20–60), mid-range detectors ($60–200), professional TSCM (technical surveillance countermeasures) gear ($5,000–$20,000+), lens finders, thermal cameras, and phone apps. The organizing question is not “what does the vendor claim?” but “what does physics say this instrument can actually detect, in which camera power state, against which emission class?”

The physics foundation was established in Vols 2 and 4. Vol 2 explained how broadband RF bug detectors work — they are Schottky-diode envelope detectors that respond to RF field strength with no spectral selectivity. Vol 4 built the power-state capability matrix, mapping nine detection methods against a camera’s operating state (powered + capturing / powered standby / fully off). Vol 9 is the shopping guide that applies both: every product on the shelf gets rated against the same physics.

The single most important discipline in this volume: hype-flag recognition. The consumer anti-spy detector market is saturated with products that claim capabilities the underlying hardware physically cannot deliver. The claims appear in product titles on Amazon, on retailer spec sheets, and in professional-looking PDF brochures. This volume calls them out by name, explains exactly why the physics makes the claim false, and gives an honest rating for what each product tier genuinely does.

Posture: This volume is oriented toward defensive counter-surveillance — selecting a detector to find cameras installed by someone else. For build-our-own alternatives at every tier, see the decision guide in Vol 14.

[FIGURE SLOT — Vol 9, § 1] Group shot of a representative detector from each tier: a K18-class RF sweeper, a SpyFinder Pro lens finder, and a FLIR ONE thermal attachment, side by side for scale. Source: Photo Helper search “anti spy detector lens finder FLIR thermal camera comparison” — or vendor product pages (KJB, FLIR). Caption when filled: “Figure 9.1 — Representative detectors from three price tiers. Left: a K18-class RF sweeper ($25). Center: SpyFinder Pro SF-103P lens finder ($148). Right: FLIR ONE Gen 3 thermal attachment (~$199). All spec-sourced; bench comparison pending. Photo: courtesy of [vendor]. [License].“

---

9.2 Cheap RF Sweepers

The $20–60 “anti-spy” RF detector category — sold under the K18 label and dozens of interchangeable brand names (WishRing, Mengshen, BUWAV, HawkSpy, CORN, Sensico, and many more) — is the largest and most-marketed segment of the hidden-camera detection market. It is also the segment most aggressively misrepresented. Understanding exactly what these devices are, at the circuit level, is the prerequisite to evaluating any product claim.

9.2.1 What They Are: Broadband Power Detectors

Every device in this category is a broadband RF power detector — a circuit that measures total RF field strength in a frequency band, with no selectivity, no decoding, and no ability to distinguish one type of transmitter from another.

The core circuit is a Schottky-diode envelope detector (described in detail in the detection physics of Vol 2). The essential signal chain:

┌──────────────────────────────────────────────────────────────┐
│        K18-CLASS DETECTOR SIGNAL CHAIN                       │
├──────────────────────────────────────────────────────────────┤
│                                                              │
│  Whip/dipole                                                 │
│  antenna          ┌────────────┐    ┌──────────────────────┐ │
│  (~10–20 cm)  ──► │ Schottky   │ ──► │ RC integrator        │ │
│                   │ diode       │    │ (lowpass, τ ~10 ms)  │ │
│                   │ (rectifier) │    └──────────┬───────────┘ │
│                   └────────────┘               │              │
│                                                ▼              │
│                                    ┌───────────────────────┐  │
│                                    │ Threshold comparator  │  │
│                                    │ + LED/buzzer driver   │  │
│                                    └───────────────────────┘  │
│                                                               │
│  Optional:    ┌──────────────────────┐                        │
│  sensitivity  │ Variable gain pot    │ ──► sets comparator Vt │
│  dial         └──────────────────────┘                        │
└──────────────────────────────────────────────────────────────┘

What this circuit measures: the total rectified power of all RF signals hitting the antenna, integrated over the diode’s detection bandwidth and the RC filter’s time constant. There is no tuned filter, no mixer, no local oscillator, no frequency discrimination of any kind. The LED bar or buzzer output represents one number: “how much RF power is arriving at the antenna right now.”

The detection bandwidth of K18-class units spans roughly 1 MHz to 6 GHz on the better units, with significant sensitivity roll-off above ~3 GHz. The stated bandwidth is the diode’s theoretical limit; the useful sensitivity is much narrower and strongly antenna-dependent. The 2.4 GHz band (where both Wi-Fi cameras and analog wireless cameras operate) is typically the sweet spot because the antenna is resonantly designed for it and because the ISM band carries the most hidden-camera traffic.

Sensitivity and range: Manufacturer claims of detection to “10 meters” or “50 meters” assume a strong, nearby, continuously transmitting source in an otherwise-clean RF environment. In a real hotel room with ambient Wi-Fi and Bluetooth from neighboring rooms, a phone in your pocket, and an IoT device on the nightstand, the background RF noise floor dominates at any useful range. You must be within 1–3 meters of a transmitting camera before the signal rises meaningfully above that floor — spec-sourced, pending bench verification.^[Multiple published evaluations of K18-class detectors consistently report functional range of 1–3 m in real environments, versus 10–50 m vendor claims. The discrepancy is explained by the noise floor: in anechoic conditions, sensitivity is higher; in a furnished room with adjacent Wi-Fi APs, the noise floor is 20–30 dB higher.]

No spectrum display, no signal identification. There is no way to know, from the LED bar or buzzer pitch, whether the detected RF comes from a hidden camera, a nearby smartphone, a microwave oven, a baby monitor, or a Bluetooth speaker. The instrument tells you “RF power is present” and nothing more.

[FIGURE SLOT — Vol 9, § 2.1] Close-up photo of a K18-class anti-spy detector showing the LED bar indicator, whip antenna, and sensitivity dial, with the device being held near a USB wall charger. Source: Photo Helper search “K18 anti spy detector hidden camera detector handheld” — or vendor product page (Amazon). Caption when filled: “Figure 9.2 — A K18-class broadband RF power detector. The LED bar rises with received RF field strength, with no discrimination between a hidden camera, a smartphone, or a Wi-Fi router. Source: [vendor]. [License].“

9.2.2 What Cheap RF Sweepers Actually Catch

Given the circuit above, a K18-class detector will trigger on any sufficiently strong, nearby RF-emitting device. In the context of hidden-camera detection:

Table 1 — Given the circuit above, a K18-class detector will trigger on any sufficiently strong, nearby RF-emitting device. In the context of hidden-camera detection

Camera class	RF emission	K18 response	Conditions for response
Wi-Fi/IP camera (2.4 GHz)	Continuous beacon + uplink data	✅ Triggers if within ~1–3 m	Only if camera is actively transmitting; uplink bursts may be intermittent
Analog wireless camera (2.4 GHz)	Continuous FM-video carrier	✅ Strong trigger	Always-on carrier is the best case for a power detector; cleaner than Wi-Fi
Analog wireless camera (1.2 GHz)	Continuous FM-video carrier	⚠ Marginal	K18 antenna not optimized for 1.2 GHz; sensitivity drops
Analog wireless camera (5.8 GHz)	Continuous FM-video carrier	❌ Usually misses	5.8 GHz above practical sensitivity ceiling of most K18 units; diode sensitivity and antenna gain drop sharply
Cellular/4G camera	Burst uplink on licensed LTE bands	❌ Misses	Licensed bands (700/850/1900 MHz) see low/no K18 sensitivity; burst mode means duty cycle is too low to trigger at useful range
Bluetooth camera	BLE advertising at ~0 dBm	❌ Almost never	BLE power too low at the detection distance where a camera would be concealed
SD-only (non-emitting)	Nothing	❌ Blind	No RF emission → nothing for the diode to rectify
Wired (non-emitting)	Nothing (RF); signal on cable	❌ Blind	No RF emission

The honest single-sentence summary: A K18-class detector is useful for detecting actively transmitting 2.4 GHz Wi-Fi cameras and analog wireless cameras at close range (1–3 m) in low-ambient-RF environments. It is blind to everything else.

9.2.3 The Hype Flags: Debunking Vendor Claims

Hype flag: The consumer anti-spy detector market makes claims that are physically impossible given the underlying circuit. Recognizing these patterns protects against wasted money and, more importantly, false security from a “clean sweep” with an inadequate instrument.

The following claims appear verbatim — or in close paraphrase — in Amazon listings, product titles, and printed brochures for K18-class units:

Claim: “1000 m (or 500 m / 300 m) detection range.” This is the most egregious hype claim in the category. The implied sensitivity is approximately 60–70 dB above the instrument’s actual performance in real environments. An FM-video transmitting at 10 mW at 1,000 m produces an EIRP-adjusted field strength at the receiver of roughly −95 to −110 dBm — far below the noise floor of a Schottky envelope detector that has no low-noise amplifier and no narrow-band filter. The “1000 m” figure is physically impossible and represents a marketing claim with no engineering basis.^[The free-space path loss at 2.4 GHz over 1,000 m is approximately 100 dB. A 10 mW (10 dBm) transmitter produces −90 dBm at the receive antenna under ideal free-space conditions. No K18-class diode detector operates near that sensitivity floor without a cooled LNA and narrow-band filter.] The actual functional range is 1–3 m under realistic conditions. Spec-sourced, pending bench verification.

Claim: “Detects ALL hidden cameras.” False as a physical matter. The preceding section showed that SD-only, wired, 5.8 GHz analog, and cellular cameras are all missed by the K18 circuit. The claim conflates “detects transmitting Wi-Fi cameras that happen to be nearby” with “detects all cameras.”

Claim: “All-in-one: detects cameras, GPS trackers, audio bugs, and laser.” Many K18-class units add a photodiode “laser detector” function — a separate circuit that responds to visible/near-IR light directed at it. This does not find camera lenses by retroreflection (the physics of lens retroreflection requires coaxial viewing, which the K18 form factor does not provide); it flags any ambient light source. The “magnetic detector” added to some units is a Hall sensor that triggers near permanent magnets or transformer fields; it has no camera-specific sensitivity. The “all-in-one” framing suggests comprehensive coverage; the actual coverage is “strong 2.4 GHz transmitters near a magnet in a brightly-lit room.”

Claim: “Professional grade” or “military detection technology.” A marketing assertion. The circuit is a Schottky diode, a resistor, a capacitor, and a LED driver. The same topology is used in crystal radio sets. “Professional” in the TSCM context means REI ORION NLJD class, not K18 class.

Claim: Detects 1 MHz–6.5 GHz (or 100 MHz–8 GHz). Technically, the Schottky diode can generate a small detector response at these frequencies, but sensitivity is not uniform. At 5.8 GHz, sensitivity may be 20–30 dB below what is needed to detect a typical 10 mW hidden camera at 1 m. Quoting frequency range without quoting sensitivity vs. frequency is deliberately misleading.

9.2.4 What Cheap RF Sweepers Miss

A K18-class detector is completely blind to:

1. All non-emitting cameras (SD-only and wired) — the dominant limitation, and the one an attacker exploits by selecting a non-transmitting device specifically to defeat RF-based sweepers.
2. Cameras not currently transmitting — a Wi-Fi camera in standby (motion trigger armed but not recording) sends significantly reduced traffic; if it sends no frames at a given moment, the power detector shows no signal.
3. 5.8 GHz analog wireless cameras — a large and common format for battery-operated covert cameras because 5.8 GHz achieves longer range than 2.4 GHz at equivalent power through windows and thin walls.
4. Cellular/4G cameras — bursts on licensed bands at low duty cycle; encrypted; completely indistinguishable from phone traffic even if the detector were sensitive enough.
5. Off-network cameras on isolated APs or with hidden SSIDs — the camera’s radio is still emitting, so a K18 will trigger if close enough, but it provides no information about whether the detected signal is a camera or anything else. The false-positive rate in a hotel room overwhelms any camera-specific signal.

The “clean sweep” false security trap: A person who sweeps a room with a K18 detector, observes no alarming response, and concludes “no hidden cameras” has only ruled out strongly transmitting 2.4 GHz devices within ~2 meters. They have ruled out nothing about SD-only, wired, 5.8 GHz, or cellular cameras — which may constitute the majority of covert cameras in professional installations. The clean sweep produces false security that is worse than no sweep at all.

9.2.5 Per-Brand Spec Table: K18-Class Lineup

All prices spec-sourced from Amazon listings; all performance ratings physics-derived and pending bench verification.

Table 2 — 2.5 Per-Brand Spec Table: K18-Class Lineup

Brand / Model	Stated freq range	Stated range	Form factor	Price (USD, spec-sourced)	Honest rating
K18 (generic)	1 MHz – 6.5 GHz	”50 m”	Cylindrical, whip ant.	~$20–30	Broadband power detector; 2.4 GHz bias
WishRing K18	1 MHz – 6.5 GHz	”10 m”	Rectangular, LED bar	~$25	Same circuit; claimed range misleading
HawkSpy K18	”Wide band"	"10 m”	Pen-style	~$28	Pen form factor; antenna area limited
BUWAV / Mengshen	1 MHz – 6.5 GHz	”10 m”	Flat rectangular	~$30–40	Adds rudimentary magnetic sensor
Sensico	1 MHz – 6.5 GHz	”100 m”	Rectangular, 8 LED	~$35	100 m claim physically unjustifiable
CORN Electronics K18	1 MHz – 6.5 GHz	”10 m”	Rectangular	~$30	Standard circuit; no meaningful differentiator

None of these units incorporate a low-noise amplifier, a bandpass filter, a spectrum display, or any analog-to-digital conversion. They are interchangeable at the circuit level regardless of brand premium.

---

9.3 Mid-Range Detectors

The $60–200 mid-tier sits between the K18 class and professional TSCM gear. Products in this segment include the JMDHKK K68 / K68+, the JMDHKK M8000, the Wendry series, and various OEM rebrands. They advertise meaningfully expanded detection capability. Assessing these claims requires the same physical rigor applied to the K18 class.

9.3.1 The Mid-Tier Class: JMDHKK K68 and Competitors

The JMDHKK K68+ (vendor-listed at ~$50–80 on Amazon and at jmdhkk.com, spec-sourced) is the most representative product in this tier. It adds to the K18 baseline:

• A magnetic field sensor (Hall effect) that triggers on strong static magnetic fields, useful for locating devices with ferrite transformers or permanent magnets embedded in their housing.
• Claims of detecting 2G/3G/4G GSM cellular signals (SIM-card bugs) — marketed as detecting cellular cameras.
• A wider advertised frequency response with higher sensitivity in the 1–3 GHz range.
• An OLED display on some variants, showing a rudimentary signal-strength bar vs. frequency band.

The M8000 variant adds a separate “infrared / laser detection” mode — a photodiode that responds to near-IR and visible light — and claims simultaneous lens-glint detection.

Per-product comparison table (mid-tier):

Table 3 — Per-product comparison table (mid-tier):

Model	Key additions over K18	Claimed frequency	Price (spec-sourced)	New capability (honest)
JMDHKK K68	Magnetic sensor; 4G claim	1 MHz – 6.5 GHz	~$50–65	Magnetic sensor corroborates; RF still power-detector class
JMDHKK K68+	Rechargeable LiPo; OLED readout	1 MHz – 6.5 GHz	~$60–80	OLED shows band, not spectrum; no selectivity added
JMDHKK M8000 bundle	K68+ + IR photodiode attachment	Per above	~$80–100 (bundle)	IR photodiode is not a coaxial lens finder; false-positive-heavy
Wendry-class	Longer whip; louder buzzer	Varies	~$40–70	No meaningful circuit upgrade
SpyFinder ProMax kit	RF sweeper + SF-103P combined kit	RF: ~1 MHz–6 GHz	~$250–350	Kit value: RF (power det.) + real lens finder (see §5)

9.3.2 What the Step Up Actually Buys

Magnetic sensor (Hall effect): A genuine, useful addition for corroboration. Cameras with iron-core power transformers or mounted on a ferrite backing will create a detectable static field. The Hall sensor triggers when within ~5–10 cm of a ferrous object or strong magnet. This is a secondary detection cue, not a primary camera-finding technique — but it costs little to include and does add a signal the K18 lacks. A camera in a picture frame with a magnetic wall mount, or a camera built into a power strip with a transformer, may produce a magnetic signature a pure RF detector misses.

Cellular/4G detection claim: This is the most significant hype flag in the mid-tier. The K68 claims to detect “2G/3G/4G SIM-card bugs.” In practice:

• GSM 2G uplink bursts occur at 900/1800 MHz in TDMA frames lasting 577 µs with a duty cycle of 1/8 (12.5%) in idle mode — too short and too low duty cycle for a broadband power detector to trigger reliably at useful range.
• LTE 4G operates in licensed bands at sub-frame intervals of 1 ms; uplink is further duty-cycled by power control and traffic. Detecting a specific LTE uplink frame from a covert camera in a room full of background LTE traffic from phones and infrastructure is not achievable with an envelope detector.
• The claim that the K68 can distinguish a “SIM-card bug camera” from “my phone also generating LTE traffic” is physically unjustifiable.

The OLED display: The OLED on the K68+ shows a segmented bar or a two-band (RF1/RF2) level display. It does not show a waterfall or spectrum trace. Frequency selectivity is absent; the display is a UI improvement over a LED bar but does not add signal-processing capability.

9.3.3 Honest Assessment of the Mid Tier

┌─────────────────────────────────────────────────────────────────┐
│  MID-TIER vs CHEAP TIER: WHAT ACTUALLY CHANGED                  │
├─────────────────────────────────┬───────────────────────────────┤
│ Genuine improvement             │ Marketing claim only          │
├─────────────────────────────────┼───────────────────────────────┤
│ Magnetic Hall sensor            │ "4G / cellular detection"     │
│ (corroborating cue; real)       │ (envelope det. can't do this) │
├─────────────────────────────────┼───────────────────────────────┤
│ Better UI (OLED vs LED bar)     │ "Wider frequency response"    │
│                                 │ (sensitivity unchanged)        │
├─────────────────────────────────┼───────────────────────────────┤
│ Rechargeable battery            │ "Detects more camera types"   │
│ (usability improvement)         │ (same diode, same blindspots) │
├─────────────────────────────────┼───────────────────────────────┤
│ Longer whip antenna             │ "IR/laser detection"          │
│ (marginally better 2.4 GHz)     │ (photodiode ≠ lens finder)    │
└─────────────────────────────────┴───────────────────────────────┘

The mid-tier is worth choosing over the K18 class if the magnetic sensor adds value to your threat model (wired cameras in magnetic mounts) or if the OLED readout reduces false-positive confusion in high-RF environments. At no point does the mid-tier cross the threshold into genuine spectrum analysis. The fundamental limitation — no frequency selectivity, no ability to distinguish a camera from a phone from a router — is unchanged. The mid-tier is still blind to all non-emitting cameras.

---

9.4 Pro TSCM Gear

The professional TSCM (technical surveillance countermeasures) market is a distinct product class. These instruments are built by specialized manufacturers (Research Electronics International, JJN Digital, Granite Island Group, ComSec LLC), sold to corporate security, government, law enforcement, and licensed private investigators, and priced in the $5,000–$25,000+ range. They deliver capabilities the consumer market cannot approach.

[FIGURE SLOT — Vol 9, § 4] Photo of the REI ORION 2.4 HX NLJD in use: a technician holding the detection wand near a wall, with the control unit showing the harmonic-ratio display. Source: Photo Helper search “REI ORION NLJD non linear junction detector wand” — or REI USA vendor page (reiusa.net). Caption when filled: “Figure 9.3 — REI ORION 2.4 HX Non-Linear Junction Detector in use. The wand transmits a 2.4 GHz excitation and receives at the 2nd (4.8 GHz) and 3rd (7.2 GHz) harmonics. The harmonic ratio distinguishes semiconductor junctions from passive intermodulation (‘rusty bolt’). Photo: courtesy of Research Electronics International. [License].“

9.4.1 REI ORION 2.4 HX and 900 HX NLJD

Manufacturer: Research Electronics International (REI), Oak Ridge, Tennessee — the reference-standard TSCM equipment manufacturer for non-linear junction detection.^[REI has been the canonical NLJD manufacturer in the TSCM community since the OSCAR series in the 1980s; the ORION product line is the current generation. reiusa.net/nljd/.]

How it works: A non-linear junction detector (NLJD) transmits a single-frequency CW signal (the excitation), then listens for energy returned at the second harmonic (2× the excitation) and third harmonic (3× the excitation). Semiconductor junctions — diodes, transistors, ICs — are inherently non-linear: their I-V curve is exponential, not linear, so they produce harmonic distortion when illuminated by an RF field. A camera that is fully powered off still contains semiconductor junctions (its CMOS sensor, its voltage regulator, its memory chips), and those junctions still return harmonic energy when interrogated by the NLJD. This is the only active electronic method that works on a powered-off camera.

ORION 2.4 HX specifications (spec-sourced from reiusa.net):

Table 4 — ORION 2.4 HX specifications (spec-sourced from reiusa.net):

Parameter	Value
Excitation frequency	2.4 GHz
2nd harmonic receive	4.8 GHz
3rd harmonic receive	7.2 GHz
Harmonic display	Simultaneous 2nd + 3rd, ratio visible
Wand	Directional antenna; magnetic dipole coupling for close-proximity work
Control unit	Belt-mounted; LED + audio simultaneous output
Price (spec-sourced)	~$10,000–$15,000 USD (quote-required; varies by configuration)

ORION 900 HX: Operates at 900 MHz excitation (1800 MHz second harmonic / 2700 MHz third harmonic). The lower frequency provides deeper material penetration — 900 MHz propagates through dense plaster walls, wooden furniture, and composite materials more effectively than 2.4 GHz. The tradeoff is spatial resolution: at 900 MHz the detection beam is wider and localization is less precise. The 900 HX is preferred for sweeping walls and dense construction; the 2.4 HX for locating a device within a fixture or object.

ORION HX Deluxe: Combines both 2.4 HX and 900 HX antenna sets in one package, allowing the operator to switch between frequencies for material penetration vs. localization precision.

False-positive rejection: the harmonic ratio. A classic false positive for any NLJD is the “rusty bolt effect” — passive intermodulation (PIM) from corroded metal-to-metal contacts, oxidized screws, or dissimilar-metal junctions in wall hardware. PIM also produces harmonic energy, but the ratio of the 2nd harmonic to the 3rd harmonic differs systematically between a semiconductor junction (typically 2nd >> 3rd, ratio ~10–20 dB) and a PIM source (typically 3rd >> 2nd or comparable). The ORION displays both simultaneously and the operator uses the ratio to discriminate. The tap test provides a second discriminator: a true semiconductor junction responds to RF alone; a PIM-producing mechanical contact changes its response when physically tapped.

The powered-off capability in context: An attacker who knows a sweep is imminent can power down their camera — switch it off, remove the battery — to defeat every detection method except NLJD, X-ray, and physical search. At ~$15k, the ORION is beyond personal/traveler budgets but is the appropriate tool for a professional sweep of a room where an adversary with advance knowledge of the sweep timing might have pre-emptively powered down devices.

9.4.2 REI MESA 2.0 Spectrum Analyzer

What it is: The REI MESA 2.0 (Mobility Enhanced Spectrum Analyzer) is a dedicated TSCM spectrum analyzer designed to be operated by field technicians with TSCM training rather than RF engineering expertise.^[REI MESA 2.0 review: execsecurity.com/news/rei-mesa/. MESA 2.0 product page: reiusa.net/rf-detection.] It covers 10 kHz to 6 GHz with a display optimized for TSCM workflows: SmartBars™ mode (color-coded by signal type), Mobile Bands mode (LTE/UMTS band identification), and Wi-Fi/Bluetooth mode.

Price (spec-sourced): ~$13,000 (Basic kit) to ~$16,000 (Deluxe kit with additional antennas and carrying case). Quote-required from REI.

What MESA provides over consumer RF detectors:

Table 5 — What MESA provides over consumer RF detectors:

Capability	K18 class	JMDHKK K68	REI MESA 2.0
Frequency coverage	1 MHz–6.5 GHz (nominal)	1 MHz–6.5 GHz (nominal)	10 kHz–6 GHz (calibrated)
Spectrum display	None	Segmented bar	Full calibrated sweep
Signal type identification	None	None	SmartBars by emission type
LTE/UMTS band recognition	No	Claimed only	Yes (Mobile Bands mode)
Signal recording	No	No	Yes
Sensitivity	Schottky-diode noise floor	Same	Calibrated, > 60 dB better than consumer
REI antenna compatibility	No	No	Auto-recognized
Trained-operator requirement	No	No	Recommended

The MESA does what the K18 claims to do: genuine spectrum analysis with frequency resolution, sensitivity calibration, and signal-type discrimination. The operator can identify an FM-video analog carrier from a 2.4 GHz hidden camera, distinguish it from ambient Wi-Fi, log the signal, and triangulate the source. The MESA is not an NLJD — it detects only actively transmitting devices, making it complementary to (not a replacement for) the ORION.

9.4.3 JJN Digital Mid-Pro Detectors

JJN Digital (Chinese TSCM equipment manufacturer) occupies the mid-professional segment between consumer K18-class gear and REI pricing. JJN detectors include combined RF + magnetic + field-strength units priced in the $300–$2,000 range, targeting small security firms and advanced enthusiasts. Performance is intermediate: better sensitivity and frequency response than K18 class, genuine spectrum display on higher-end units, without the calibrated TSCM software and support ecosystem of REI. Not independently bench-verified in this deep dive; rated spec-sourced from vendor pages and community TSCM forum comparisons.

Key JJN models to be aware of:

Table 6 — Key JJN models to be aware of

Model	Primary feature	Approx. price	Honest note
JJN DD1206	RF + magnetic combo	~$40–80	Consumer class despite pro branding; same diode circuit
JJN J006 / J007	Wide-band RF + display	~$150–300	Improved sensitivity; no NLJD capability
JJN / generic “Pro TSCM”	Combined RF+NLJD claims	~$300–800	Exercise caution: “NLJD” in this price range is not a calibrated harmonic-ratio instrument

Caution — the “$300 NLJD” trap: Products marketed as NLJDs below approximately $5,000 rarely implement calibrated 2nd/3rd harmonic ratio discrimination. A unit that simply measures “how much 2nd harmonic is present” without the ratio against the 3rd harmonic cannot reliably distinguish a semiconductor junction from passive intermodulation. The REI ORION price reflects the engineering required to do this correctly.

9.4.4 Lockhart Conducted-Signal Detector

The Lockhart conducted-signal detector (ComSec LLC, komcept) occupies a specialized niche: detecting RF signals carried on building power lines and coaxial cables — the powerline-video carrier (PLC) technique used by some wired surveillance systems. These systems modulate an analog or digital video signal onto the 120/240 VAC power line between a camera (with a PLC transmitter) and a receiver elsewhere in the building, allowing wiring-free camera deployment on existing electrical circuits.^[ComSec LLC conducted-signal detectors: comsecllc.com. PLC video products: 7inova, Mistral, Bortox.]

What it detects:

• Analog video carriers injected onto AC power lines (BPL/PLC-video systems)
• Audio surveillance signals on power lines or telephone wiring
• Carrier-current eavesdropping devices

What it does not detect:

• Wireless cameras of any class
• Standard coaxial CCTV (the camera and recorder are already physically connected; no carrier is “injected” onto the power line)
• SD-only cameras (nothing to inject)

The Lockhart conductor is a specialized tool for the wired-specific track covered in Vol 6 §5. It is not a general-purpose camera detector. A professional TSCM sweep includes a conducted-signal sweep of all power, phone, and coax lines in the space.

Price: ~$1,500–$5,000 (spec-sourced; quote-required from ComSec LLC).

9.4.5 What Pro Gear Actually Buys You

Professional TSCM gear unlocks three capabilities the consumer market physically cannot deliver:

┌──────────────────────────────────────────────────────────────────┐
│  WHAT PRO TIER UNLOCKS OVER CONSUMER TIER                        │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│  1. NLJD (ORION): The ONLY active electronic method that works   │
│     when the camera is fully powered off. No other instrument    │
│     in any consumer or mid tier achieves this.                   │
│                                                                  │
│  2. Calibrated spectrum analysis (MESA): True spectral           │
│     resolution with sensitivity calibration, allowing signal-    │
│     type discrimination (camera carrier vs Wi-Fi vs LTE).        │
│     Consumer power detectors cannot do this at all.              │
│                                                                  │
│  3. Conducted-signal sweep (Lockhart): Detecting video/audio     │
│     signals on power lines, phone lines, and coax. Inaccessible │
│     at any consumer price.                                       │
│                                                                  │
│  What pro gear does NOT buy: detection of SD-only cameras        │
│  (only optics, NLJD/powered-off mode, X-ray, physical).         │
│  Even a $20,000 sweep cannot rule out a non-emitting SD-only    │
│  camera without NLJD or optical/physical methods applied.        │
└──────────────────────────────────────────────────────────────────┘

The pro tier is not magic. It buys the three capabilities above — a decisive capability expansion — but it does not produce a different outcome against SD-only cameras without NLJD, and it does not produce a different outcome against a camera the operator fails to physically locate even after the instrument flags a response. The “instruments point, humans confirm” principle (Vol 4 §2.2) applies at all budget levels.

---

9.5 Lens Finders

Lens finders are the one consumer-market detector category that operates on a fundamentally different physical principle from RF detectors — and because of that different principle, they are the most important non-RF tool in any sweep. A lens finder can detect an SD-only camera that is completely powered off. Vol 4 §5 covers the retroreflection physics in full; this section surveys the commercial products.

9.5.1 The Retroreflection Principle

Every camera lens — regardless of whether the camera is transmitting, powered, or even has a battery installed — retroreflects light back toward its source due to the converging optic of the lens elements. The effect is the same reason a cat’s eye or a bicycle reflector glows when illuminated from a car headlight: the lens focuses incoming light to a back focal point, and the CMOS sensor’s reflective surface (or a deliberately retroreflective element) sends a portion of that light back along the original path.

The coaxial illumination requirement: For the retroreflected spot to be visible to the observer, the illumination source (the ring of LEDs) must be coaxial with the viewer’s eye (or the viewing port). If the illumination is offset from the line of sight, the retroreflected spot misses the viewer’s eye. This is why a $30 K18 with a random “laser pointer” does not work as a lens finder — the geometry is wrong — and why a dedicated lens finder has a ring of LEDs surrounding a central viewing hole.

The complete physics treatment is in Vol 4 §5.1, including the corner-retroreflection model, spectral-ratio/polarization discrimination research, and the LAPD SenSys 2021 ToF+ML result.

9.5.2 SpyFinder Pro and SF-103P

Manufacturer: KJB Security Products (Mini Gadgets); model SF-103P, marketed as SpyFinder Pro.^[Product pages: kjbsecurity.com/shop/counter-surveillance/lens-finders/spy-finder-pro; bhphotovideo.com/c/product/1428752-REG; internationalspyshop.com/product/sf-103p-spy-finder-pro/.]

Price (web-verified): ~$148 USD (KJB Security, B&H Photo, multiple resellers). Available also on eBay in the $120–$160 range.

Operating principle: An array of high-brightness red LEDs arranged in a ring around a central viewing port. The operator holds the device at eye level, activates the LED ring, and looks through the viewport while slowly scanning the room. A camera lens retroreflects the red LED illumination as a bright, distinctive glint visible through the viewport. The glint appears to “blink” as the operator moves the device — the retroreflective spot’s brightness changes sharply with alignment angle.

Specification table (SF-103P, spec-sourced from vendor pages):

Table 7 — Specification table (SF-103P, spec-sourced from vendor pages):

Parameter	Value
Light source	Array of high-intensity red LEDs
Detection range (stated)	2–45 feet (0.6–14 m)
Power	2× AAA batteries (included)
Battery life	~20 hours continuous
Form factor	Handheld, ~10 × 6 × 2 cm
Weight	~80 g with batteries
Wired camera detection	Yes (lens is present even if no electronics)
Wireless camera detection	Yes (same reason)
Powered-off camera detection	Yes (lens is passive)
Non-camera false positives	Yes (see §5.3)

Why the range claim deserves hedging: The “45 feet” detection range assumes a large-aperture camera lens (e.g., a 16 mm or larger camera module with a pinhole aperture at the wide end). For the small-aperture pinhole lenses used in covert cameras (aperture diameter 0.5–3 mm), the retroreflected spot is significantly weaker and may only be visible at 2–4 meters in ambient room lighting. Spec-sourced, pending bench verification against actual covert camera hardware.

Also available: The SpyFinder ProMax kit (~$250–$350) bundles the SF-103P lens finder with a K18-class RF sweeper. The lens finder is the genuine value in the kit; the RF sweeper is K18-class with the same limitations documented in §2.

[FIGURE SLOT — Vol 9, § 5.2] Photo of the SpyFinder Pro SF-103P being held at eye level, showing the red LED ring illuminating a suspected object, with the viewing port visible on the device face. Source: Photo Helper search “SpyFinder Pro SF-103P hidden camera lens finder detector red LED” — or vendor product page (KJB Security, kjbsecurity.com). Caption when filled: “Figure 9.4 — SpyFinder Pro SF-103P in use. The red LED ring provides coaxial illumination; the central viewport lets the operator see the retroreflected glint from any camera lens in the field of view. Photo: courtesy of KJB Security Products. [License].“

9.5.3 Operational Discipline and Limits

False-positive profile of lens finders: Retroreflection is a property of any curved specular surface, not only camera lenses. In a typical hotel room or bedroom, the following objects produce glints that require physical investigation:

Table 8 — False-positive profile of lens finders: Retroreflection is a property of any curved specular surface, not only camera lenses. In a typical hotel room or bedroom, the following objects produce glints that require physical investigation

Object	Glint cause	Discrimination cue
Eyeglasses (on nightstand)	Curved lens elements	No camera housing; obvious when inspected
Decorative glass bottles	Curved glass surface	Shape incompatible with camera form
Mirror edges	Specular flat surface	Different reflection geometry; flat appearance
Metal screws / fasteners	Rounded screw head	Tiny spot; probe with light source; no aperture depth
Picture frame glass	Flat specular	Corner retroreflection only at specific angles; wide angular pattern
Actual pinhole camera	Camera lens	Distinctive sharp, centered, depth-recessed glint at multiple angles; sustained as operator moves

The trained operator learns the difference between the sharp, directionally stable, depth-recessed glint of a real camera lens versus the softer, angularly broad, surface-level reflection of household objects. Every glint must be physically investigated. A glint ruled out by inspection contributes to confidence; a glint not investigated leaves a gap.

Darkness operation: Lens finders work in ambient light, but performance improves with reduced ambient illumination. Operate in partial darkness (close curtains, dim lights) to increase contrast between the glint and the background. IR-wavelength finders (IR LED ring, usually 850–940 nm) are invisible to the naked eye, which reduces false-positive confusion from visible-spectrum reflections, but requires viewing through a camera or viewer with IR sensitivity.

The phone-flashlight substitute: A phone flash at eye level, with the operator using the phone’s front camera as the viewing port, approximately replicates the coaxial-illumination geometry. This is a free technique that finds many of the same glints as a dedicated lens finder. Its limitations: the flash coverage angle is narrower, the alignment is less precise, and phone camera dynamic range compresses the glint. It is a valid first-pass technique for travelers who did not bring a dedicated finder — but inferior to the SF-103P at range.

---

9.6 Thermal

Thermal cameras detect infrared radiation emitted by objects whose temperature differs from the ambient background. A powered hidden camera — especially one with a CMOS image sensor, voltage regulator, and Wi-Fi module — generates measurable heat that a FLIR-class thermal camera can detect. Vol 4 §9 covers the HeatDeCam research (ACM CCS 2022, >95% classification accuracy with FLIR ONE + ML) and the defeat mechanisms in full; this section surveys the commercial products.

9.6.1 FLIR ONE Gen 3 and Edge Pro

FLIR ONE Gen 3:

FLIR Systems (now part of Teledyne FLIR) produces the ONE Gen 3 as a smartphone-attached thermal camera.^[FLIR ONE Gen 3: flir.com/products/flir-one-gen-3/. Walmart listing: walmart.com/ip/FLIR-ONE-Gen-3-Android-USB-C.] It attaches via USB-C or Lightning and pairs with the FLIR ONE app.

Table 9 — 6.1 FLIR ONE Gen 3 and Edge Pro

Parameter	Value
Thermal resolution	80 × 60 pixels (LEPTON thermal sensor)
Visual camera	1440 × 1080 (for MSX image enhancement overlay)
Thermal sensitivity (NETD)	< 150 mK (< 0.15 °C)
Temperature range	−20 °C to +120 °C
MSX enhancement	Blends thermal + visible for detail
Price (web-verified)	~$199–$249 USD (Walmart, Amazon, flir.com)
Power	Charges from phone; built-in LiPo

FLIR ONE Pro: Higher-sensitivity version with NETD < 70 mK, temperature range to +400 °C, and a 160 × 120 thermal sensor. Price ~$399 USD.

FLIR Edge Pro: Wireless (Bluetooth) attachment that connects without a physical cable, allowing use from any angle without tethering the phone to the attachment. Price ~$499+ USD.

[FIGURE SLOT — Vol 9, § 6.1] Photo of a FLIR ONE Gen 3 attached to a smartphone, showing a thermal image of a room with a warm hotspot overlaid on the visible image where a powered electronic device is hidden. Source: Photo Helper search “FLIR ONE Gen 3 thermal imaging hidden camera warm spot” — or FLIR vendor product page (flir.com). Caption when filled: “Figure 9.5 — FLIR ONE Gen 3 attached to a smartphone, showing MSX-enhanced thermal image. A hidden powered camera module (center, orange hotspot) is visible against the cooler room background. Photo: courtesy of Teledyne FLIR. [License].“

9.6.2 Triage Role and Defeat Mechanisms

What thermal actually buys in a camera sweep:

Thermal is a triage tool, not a definitive camera-finding instrument. Its role is to quickly scan a room for thermal anomalies — objects that are warmer than expected given the ambient temperature — and flag those anomalies for physical investigation. A powered hidden camera module will typically run 5–15 °C above ambient at the surface of its enclosure, depending on power consumption and the thermal path through the housing material.

Defeat mechanisms — when thermal fails:

Table 10 — Defeat mechanisms — when thermal fails:

Defeat mechanism	Effect
Thermal insulation in housing	Camera installed inside a thick-walled object (ceramic figurine, plaster-covered bracket). Surface temperature increase may be < 1 °C, below NETD of consumer thermal camera
Low-power sensor	Modern 2 MP Wi-Fi cameras can operate at < 500 mW total power. Temperature rise at the surface may be 1–3 °C, marginal for 80×60 px thermal sensors
Nearby warm electronics	A power strip, laptop, or charger creates thermal hot-spots that mask the camera signal in the same region
Camera not powered	SD-only camera in standby; powered-off wired camera; any non-emitting camera that is not currently powered produces no thermal signature above ambient
Thermal equilibrium	A camera running continuously will reach thermal equilibrium with its surroundings after several hours. The temperature delta above ambient stabilizes and may be small compared to sensor NETD
Airflow / ventilation	Room AC or ventilation obscures local thermal anomalies

The 80×60 px limitation: The FLIR ONE Gen 3 produces a 80×60 pixel thermal image. At a scan distance of 3 meters, each pixel covers approximately 3.5 × 3.5 cm of the scene. A pinhole camera module measuring 15 × 15 mm may occupy fewer than one pixel and be below the thermal detector’s spatial resolution. The FLIR ONE Pro at 160 × 120 provides 4× more resolution but still has this limitation at range.

Practical role: Thermal is most useful for a fast first-pass sweep of a room, looking for gross thermal anomalies — a smoke detector that is warmer than expected, a USB charger with unusual heat distribution, an object that should be unpowered but is warm. It flags candidates for the lens finder and physical inspection. It is not a primary camera detector and should not be relied upon as a sole method.

9.6.3 Professional Thermal Gear

Professional TSCM-grade thermal cameras (FLIR E-series: E6-XT at ~$2,500; E85 at ~$8,000+; T-series at $10,000+) offer significantly higher thermal sensitivity (NETD < 40 mK) and spatial resolution (320 × 240 to 640 × 480) than the FLIR ONE. The academic HeatDeCam system (Vol 4 §9.1) achieved >95% classification accuracy using a FLIR ONE paired with a trained ML classifier — the ML layer compensates for the low resolution by learning the spatial signature of typical camera-module heat patterns. That research result is not a shipping product, but it establishes that consumer thermal gear is sufficient for ML-assisted classification; the FLIR ONE is the baseline, not a limitation per se.

At higher FLIR E-series resolution, thermal is a more reliable primary triage tool. Professional TSCM sweeps typically include a 320 × 240 or higher thermal scan as a standard sweep phase. This is outside the traveler’s practical budget and is the domain of professional TSCM firms.

---

9.7 Phone Apps

Phone apps occupy the cheapest tier of the detection market. Most require no additional hardware; a few integrate with a phone accessory (FLIR ONE, etc.). Their honest value ranges from “genuinely useful as a first pass” (Fing) to “actively misleading” (most “Hidden Camera Detector” magnetic apps).

9.7.1 Fing: Network Scanner

What it is: Fing (iOS and Android, free tier with paid “Fingbox” premium) is a network scanner that discovers all devices on a connected Wi-Fi network, identifies them by MAC address / OUI / mDNS hostname, and displays manufacturer, IP address, and device type.^[Fing app: fing.com/app. Hidden camera feature: help.fing.com/hc/en-us/articles/10207452605724-Find-Hidden-Cameras.]

What it does in a camera sweep:

• Joins the room’s Wi-Fi network (or the camera’s AP, if you know the SSID) and runs an ARP + mDNS + SSDP discovery scan.
• Lists all network clients with their MAC address vendor (OUI lookup) and any advertised hostname.
• Flags devices whose vendor / name suggests camera or IoT camera brands (Hikvision, Dahua, Wyze, Reolink, Eufy, TP-Link Tapo, Amcrest, etc.).

What it does not do:

• It cannot detect cameras that are not on the same network as your phone. A camera on the host’s network (your Airbnb’s router) is visible only if you join that network. A camera on its own AP or a cellular-only camera is invisible to Fing.
• It cannot detect SD-only or wired cameras.
• It does not perform traffic-rate/motion-correlation analysis — it is a device-discovery tool, not a traffic-analysis tool.

Honest value: Fing is the fastest, most useful free network tool for a traveler with only a phone. Joining the room’s Wi-Fi and running Fing is a reasonable 2-minute first-pass that catches any naively installed Wi-Fi camera on the property network. It is complementary to (not a substitute for) a dedicated detector or lens finder.

9.7.2 Hidden Camera Detector Apps

A large category of apps on iOS and Android markets themselves as “Hidden Camera Detectors” by using the phone’s magnetometer to detect magnetic field anomalies. The UI typically shows a compass needle or field-strength bar that rises near magnetic objects.

What these apps detect: The phone magnetometer measures static and low-frequency magnetic fields from permanent magnets, ferromagnetic metal, and transformer cores. A camera with an iron-core power transformer or a magnetic mounting bracket will register. Most cameras do not have strong magnetic signatures; the magnetometer is not a camera-specific sensor.

The misleading claim: Many of these apps are branded as “99% accurate” or “finds all hidden cameras.” The magnetometer is unrelated to camera detection in any specific sense — it detects magnetic fields from any source, including a coil in a phone charger, a laptop magnetic latch, or a decorative metal object. The false-positive rate in a typical room is high; the true positive rate against cameras specifically (especially non-magnetic SD-only cameras) is low.

The IR “camera finder” claim: Some apps claim to use the phone’s front-facing camera to detect IR from night-vision LEDs. This is a genuine technique (see Vol 4 §6 — IR-emitter spotting), but most phone front cameras have a partial IR-cut filter that reduces but does not eliminate IR sensitivity. The app simply displays the front camera feed and relies on the user to recognize a bright glowing spot. There is no image processing; the app is a camera viewer. The technique is valid; the marketing as a sophisticated detection tool is not.

9.7.3 Glint Finder

Platform: Android (available via APK; not consistently on the Play Store as of authoring).^[Glint Finder Android: glint-finder-hidden-camera.en.softonic.com; workshop512 developer. Available on Aptoide.]

What it does: Glint Finder activates the phone’s rear flashlight (LED flash) and toggles it on/off while displaying the camera feed. When the flash is on, the retroreflected glint from a camera lens appears as a bright spot; when the flash is off, the spot disappears. The toggling effect makes the glint stand out against the static background.

Honest value: Glint Finder implements the same optical principle as the SpyFinder Pro (coaxial illumination → retroreflection → detection) but with worse geometry. The phone flash is not coaxial with the camera sensor — the flash LED is offset by 2–5 cm from the lens center — which reduces the retroreflective coupling compared to the ring-LED design of the SF-103P. At very close range (< 1 m) and for large-aperture camera lenses, Glint Finder can produce a visible glint. At normal sweep distances (2–5 m) and for pinhole apertures, detection probability drops significantly compared to a dedicated lens finder.

The free argument: Glint Finder is free, requires no additional hardware, and is better than nothing as an optical technique. A traveler without a SF-103P should use it. A traveler with a SF-103P should use the SF-103P for its superior geometry.

9.7.4 Honest Assessment: Apps Are a Baseline, Not a Sweep

The “apps only” trap is the consumer equivalent of the “K18 only” trap. An app-only sweep — Fing on the Wi-Fi network, magnetometer wave around the room, Glint Finder from the doorway — takes 5–10 minutes and produces a result. That result rules out: naively installed Wi-Fi cameras on the property network, cameras with strong magnetic signatures, and large-aperture cameras at close range with favorable geometry. It does not rule out: cameras on a separate network, cameras with no network, cameras with non-magnetic housings, small-aperture pinhole cameras at sweep distances, or any SD-only, wired, or cellular camera.

Phone apps comparison table:

Table 11 — Phone apps comparison table:

App	Detection method	What it genuinely catches	What it misses	Cost
Fing	Wi-Fi network scan + OUI	Wi-Fi cameras on the same network; vendor identification	Cameras on other networks; all non-RF	Free / premium
Magnetometer apps	Phone hall sensor	Strongly magnetic devices	Most cameras; any non-magnetic device	Free
IR camera viewer	Phone front camera (partial IR)	Active night-vision IR LEDs in darkness	No IR LEDs; powered off; any non-IR cam	Free
Glint Finder	Phone flash retroreflection	Large-aperture lenses at < 1–2 m	Pinhole cameras at distance; powered-off (works but limited geometry)	Free
RTSP scanner (various)	RTSP port scan on network	IP cameras with RTSP on joined network	All non-networked cameras	Free / paid

---

9.8 The What-It-Actually-Catches Matrix

This is the load-bearing table of Vol 9. Every detector class surveyed above is rated against every emission class from Vol 1’s taxonomy, in every power state from Vol 4’s power-state capability matrix. The goal is a single artifact that supports the buy decision. For the detailed per-method physics behind each cell, cross-reference Vol 4 §4 (the power-state matrix) and Vol 2 §5 (what RF cannot catch).

9.8.1 Reading the Matrix

Columns: The emission class and power state of the camera being swept for.

• Wi-Fi/IP (active): Camera joined to a network, actively streaming or sending heartbeats.
• Wi-Fi/IP (idle/standby): Camera joined to a network but in low-activity standby.
• Analog wireless (2.4 GHz): Camera with continuous FM-video carrier on 2.4 GHz.
• Analog wireless (5.8 GHz): Camera with continuous FM-video carrier on 5.8 GHz.
• Cellular/4G: Camera with SIM card, bursty LTE uplink.
• SD-only, powered on: Non-emitting camera with no radio, currently recording.
• SD-only, powered off: Non-emitting camera, de-powered.
• Wired (powered): Wired IP/analog camera, recording to NVR.

Note on wired (off): A wired camera with the NVR powered down follows the same detection rules as a non-emitting camera — optical retroreflection (lens, passive, always works), NLJD (semiconductor junctions, power-state agnostic), and physical search are the applicable methods. This state is not a separate matrix column because the wired-off and SD-only-off cases are physically identical from a detection standpoint (see Vol 4’s non-emitting matrix).

Rating key:

Table 12 — Rating key:

Rating	Meaning
✅ Works	This method reliably detects this camera class in this state; false-positive rate manageable
⚠ Marginal	Detection is physically possible but requires favorable conditions (close range, low ambient noise, etc.)
❌ Blind	The underlying physics makes detection impossible or false-positive rate unacceptably high regardless of conditions
—	Not applicable to this scenario

All performance ratings are spec-sourced pending bench verification as stated in the project-wide provenance note.

9.8.2 The Matrix

Table 13 — 8.2 The Matrix

Detector	Wi-Fi/IP (active)	Wi-Fi/IP (idle)	Analog 2.4 GHz	Analog 5.8 GHz	Cellular/4G	SD-only (on)	SD-only (off)	Wired (powered)	Price tier
K18-class RF sweeper	⚠ Marginal (1–3 m, high noise floor)	❌ Usually blind	✅ At 1–3 m (carrier always-on)	❌ Above practical sens. ceiling	❌ LTE burst undetectable	❌ No RF	❌ No RF	❌ No RF	$20–60
JMDHKK K68+ (mid-tier)	⚠ Marginal, slightly better sens.	❌ Usually blind	✅ At 1–3 m	❌ Above ceiling	❌ LTE claim unverified	❌ No RF	❌ No RF	⚠ Magnetic if transformer present	$60–120
REI MESA 2.0 (spectrum)	✅ Calibrated; frequency-selective	✅ Detects beacon frames	✅ Demodulates carrier, confirms	✅ If 6 GHz version	⚠ LTE bands, band-specific	❌ No RF	❌ No RF	⚠ PLC add-on required	$13,000–16,000
REI ORION 2.4 HX (NLJD)^[The NLJD physically detects semiconductor junctions in ALL camera classes and power states. The ”—” cells are “not the right tool for this emission niche,” not “physically incapable” — an NLJD will respond to a transmitting Wi-Fi camera’s PCB, but the ORION’s designed use case is non-emitting and powered-off detection; for transmitting cameras the RF/spectrum methods are more diagnostic.]	—	—	—	—	—	✅ Semiconductor junctions	✅ THE powered-off method	✅ Junctions in wired cam	$10,000–15,000
REI ORION 900 HX (NLJD)	—	—	—	—	—	✅ Deeper penetration	✅ Deeper penetration	✅ Through walls	$10,000–15,000
Lockhart conducted-det.	—	—	—	—	—	❌	❌	⚠ PLC video on power line only	$1,500–5,000
SpyFinder Pro SF-103P	✅ Lens present	✅ Lens present	✅ Lens present	✅ Lens present	✅ Lens present	✅ Lens present	✅ Lens is passive — works!	✅ Lens present	~$148
FLIR ONE Gen 3 (thermal)	✅ Sensor module heat	⚠ Marginal (low load)	✅ Transmitter heat	✅ Transmitter heat	⚠ Burst mode; marginal	✅ Sensor heat (if powered)	❌ No heat generation	✅ Electronics heat	~$199–249
Fing (network app)	✅ On same network	✅ Beacon visible	❌ Not on IP network	❌	❌	❌	❌	⚠ Wired IP cam if PoE + on network	Free / ~$100/yr premium
Magnetometer app	❌ Not magnetic	❌	❌	❌	❌	⚠ If transformer present	⚠ Ferrous enclosure	⚠ Transformer only	Free
Glint Finder app	✅ Lens present (close range)	✅	✅	✅	✅	✅ Lens passive	✅ Lens passive	✅ Lens present	Free

Critical observations from the matrix:

1. The SpyFinder Pro is the only consumer-tier product with ✅ ratings across all camera classes and both power states. This is because retroreflection is a passive, physical property of every camera lens — it does not require the camera to be powered, transmitting, or even have its battery connected.

2. The REI ORION is the only detector that reliably catches a fully powered-off camera with active electronics confirmation (NLJD harmonic response). The SpyFinder catches the lens; the ORION catches the semiconductor junctions — together they cover the powered-off case definitively.

3. Every RF detector in the consumer and mid-tier is blind to SD-only and wired cameras — the two classes most commonly used in professional hostile surveillance because they are specifically chosen to defeat RF-based sweeps.

4. Fing covers the Wi-Fi/IP camera case better than any RF sweeper, with lower false-positive rate and device identification, as long as the camera is on the same network as your phone.

5. The “no all-in-one catches everything” principle holds at every price point. The combination of a lens finder (SpyFinder Pro, ~$148), a network scanner (Fing, free), and a thermal camera (FLIR ONE, ~$199) covers the most ground for a personal/travel budget. NLJD requires professional pricing for the powered-off case.

9.8.3 Price vs Capability Chart

The chart shows the number of camera-class/power-state cells from the matrix covered at each price tier (out of 8 possible cells). A ✅ = 1 point; ⚠ = 0.5 point; ❌ = 0 points. Higher bars = more camera-class/power-state coverage.

  PRICE vs COVERAGE SCORE (out of 8 possible camera-class/power-state scenarios)
  
  Score  0         1         2         3         4         5         6         7         8
         │         │         │         │         │         │         │         │         │
  K18    ████                                                                              ~1.5  ($25)
  RF sweeper

  K68+   ████▌                                                                             ~1.7  ($70)
  mid-RF

  Fing   ██▌                                                                               ~1.0  (free)
  network only
  (same-net Wi-Fi only; scores high there, zero elsewhere)

  Glint  ██████████████████████████████████████████████████████████████████████████████   ~7.5  (free)
  Finder (close-range; all classes)

  SpyFi  ████████████████████████████████████████████████████████████████████████████████ ~8.0  ($148)
  Finder Pro (all camera classes, all power states)

  FLIR   █████████████████████████████████████████                                         ~4.5  ($199)
  ONE Gen3 (powered cameras only)

  MESA   ████████████████████████████████████████████████                                  ~5.0  ($14,000)
  2.0 RF (transmitting cameras only, but spectrally selective)

  ORION  ██████████████████████████████████████████████████████████████████                ~7.0  ($13,000)
  NLJD (all states incl. powered off; misses wired-on-cable)

  Fing + SpyFinder + FLIR ONE (combined) ──────────────────────────────────────────────── ~9.5/10.0 effective ($347 combined)

  ORION + SpyFinder + MESA (combined) ─────────────────────────────────────────────────── ~10/10 (~$28,000)

Key insight from the chart: The SpyFinder Pro at $148 achieves near-perfect coverage of all camera classes in all power states — the highest single-product score at any price point — because the underlying physics (lens retroreflection) is class-agnostic and power-state-agnostic. The ORION NLJD at $13,000+ achieves comparable breadth through a completely different physical principle. The $13,000 premium buys electronic confirmation vs the ORION (junctions vs lens) and deeper material penetration.

9.8.4 Buy-Decision Guidance

The buy decision maps to threat model, budget, and whether owned gear already covers some cells. For the complete buy-vs-build comparison, see the decision guide in Vol 14.

For a traveler / Airbnb guest (phone + 1 accessory):

Table 14 — For a traveler / Airbnb guest (phone + 1 accessory):

Budget	Primary tool	Secondary	Coverage
$0 (phone only)	Fing (Wi-Fi scan)	Glint Finder + front-cam IR	Wi-Fi cameras on network; lens at close range
$50–100	SpyFinder Pro (~$100 used / ~$148 new)	Fing on phone	Lens: all camera classes; Wi-Fi: joined network
$200–400	SpyFinder Pro + FLIR ONE Gen 3	Fing on phone	Adds thermal triage for powered electronics
$500+	SpyFinder Pro + FLIR ONE + K68 or RF sweep	Fing	Near-complete for personal threat model

For a small security firm (basic TSCM):

Table 15 — For a small security firm (basic TSCM):

Asset	Coverage
REI ORION 2.4 HX + 900 HX	Non-emitting; powered-off; through-wall
REI MESA 2.0	Calibrated spectrum; cellular/LTE band analysis
FLIR E85 (320 × 240 thermal)	High-sensitivity thermal triage
SpyFinder Pro (or trained borescope)	Lens confirmation; wired camera confirmation
Lockhart conducted-signal	PLC video on building power lines

The no-all-in-one principle: No single product — at any price — covers all camera emission classes in all power states. The SpyFinder Pro comes closest as a single consumer-tier instrument, but provides no electronic confirmation, no spectrum display, and no conducted-line coverage. A complete sweep always layers at least two complementary detection principles. The choice is which two (or three), calibrated to the threat model and budget.

---

9.9 Resources

Commercial products (web-verified)

• K18-class RF sweepers — Amazon search “K18 anti spy detector”: amazon.com/k18-rf-detector/s?k=k18+rf+detector. Multiple brands; prices $20–$60. Read vendor claims against the physical analysis in §2.
• JMDHKK K68 / K68+ — jmdhkk.com/products/k68-hidden-camera-detectors and Amazon: amazon.com/stores/JMDHKK/K18AntiSpyDetector. Prices ~$50–$80 for K68+.
• SpyFinder Pro SF-103P — KJB Security Products: kjbsecurity.com/shop/counter-surveillance/lens-finders/spy-finder-pro. ~$148. Also at B&H Photo: bhphotovideo.com/c/product/1428752-REG, internationalspyshop.com/product/sf-103p-spy-finder-pro/.
• REI ORION 2.4 HX NLJD — reiusa.net/nljd/orion-2-4-hx-nljd/. Price quote-required (~$10,000–$15,000 spec-sourced). Also at KJB Security: kjbsecurity.com.
• REI ORION 900 HX — reiusa.net/nljd/orion-900-hx-nljd/. Companion to the 2.4 HX for material penetration.
• REI ORION HX Deluxe — reiusa.net/nljd/orion-hx-deluxe-nljd/. Both antenna sets.
• REI MESA 2.0 — reiusa.net/rf-detection/. ~$13,000–$16,000 spec-sourced. Review: execsecurity.com/news/rei-mesa/.
• FLIR ONE Gen 3 — flir.com/products/flir-one-gen-3/. ~$199–$249.
• FLIR ONE Pro — flir.com/products/flir-one-pro/. ~$399.
• FLIR Edge Pro — flir.com/products/flir-edge-pro/. ~$499+. Wireless attachment.
• Lockhart conducted-signal detector — ComSec LLC: comsecllc.com/tscm-equipment/. Price quote-required.

Phone apps

• Fing — fing.com/app. Free (basic network scan); Fingbox hardware + premium subscription optional. Hidden camera feature documented at help.fing.com.
• Glint Finder — workshop512 developer. APK at glint-finder-hidden-camera.en.softonic.com and Aptoide.
• Hidden Camera Detector (iOS) — multiple vendors in App Store; evaluate by reading the detection method (magnetometer-only apps are limited; apps using the camera + flash for retroreflection are more useful).

Academic papers cited in this volume (physics from Vols 2 and 4)

• HeatDeCam — Yu, Li, Chang, Fong, Liu, Zhang, “HeatDeCam: Detecting Hidden Spy Cameras via Thermal Emissions,” ACM CCS 2022. The thermal-classification result (>95%) that established FLIR ONE as a viable hidden-camera detection platform. Vol 4 §9.
• LAPD — Sami, Tan, Sun, Han, “LAPD: Hidden Spy Camera Detection using Smartphone ToF,” ACM SenSys 2021. ToF + deep learning lens retroreflection; 88.9% detection, 16.7% FP, short range. Vol 4 §5.3.

TSCM industry references

• REI USA — reiusa.net. The canonical NLJD and spectrum-analysis instrument manufacturer for the North American TSCM market.
• ComSec LLC — comsecllc.com. Conducted-signal detection and professional TSCM training.
• Murray Associates (counterespionage.com) — TSCM practitioner perspective on commercial detector reality; context for calibrating vendor claims.
• Cryptomuseum ORION 2.4 entry — cryptomuseum.com/df/rei/orion/2_4/ — historical and technical reference on the ORION product line.

Cross-series pointers

• Vol 2 — RF & spectrum physics (why broadband power detectors work the way they do; the detector-type comparison table).
• Vol 4 §4 — the power-state capability matrix (the organizing framework this volume’s matrix derives from; cite the stable anchor #4-the-power-state-capability-matrix).
• Vol 4 §5 — optical lens retroreflection physics (why the SpyFinder Pro works on powered-off cameras; LAPD ToF result; spectral-ratio/polarization patents).
• Vol 4 §7 — NLJD physics in full (harmonic ratio, tap test, false-positive rejection — the underlying science for the ORION coverage in §4.1).
• Vol 6 §5 — the wired-specific track (cable tracing, TDR, PoE/LAN scan, PLC carrier detection — the Lockhart context).
• Vol 12 — the room-sweep playbook (how to sequence the instruments surveyed in this volume into a defensible sweep protocol).
• Vol 14 — the buy-vs-build decision guide (uses the matrix in §8 as its primary input; which commercial tier vs DIY build wins for each threat model and budget).

---

This is Volume 9 of a fifteen-volume series. Next: Vol 10 surveys every DIY and open-source hidden-camera detection project — ESP32 Marauder’s Wi-Fi scan base, the Nyan Box 20+-brand fingerprint database, GitHub camera-detector repos, and the research reference implementations (LAPD, CamRadar, EM Eye, HeatDeCam) — rated by license, maturity, and fork-worthiness.