Part 11 pulled the Flipper Zero apart at the firmware level, walking through custom builds, GPIO expansion, and the infrastructure that makes third-party modules actually useful in the field. That was the technical foundation. This part is where you put it to work in a context that matters: detecting signals you don't recognize, building the documentation that makes your findings credible, and understanding exactly how far your conclusions can responsibly travel.
Undocumented signals are not rare. They're everywhere. Your neighborhood is saturated with RF emissions from devices you've never configured, protocols you've never studied, and transmission schedules you've never observed. Most of them are completely mundane. Some are genuinely puzzling. A small number might warrant further investigation. The problem isn't that the signals are hard to find. The problem is that most people who find something unfamiliar immediately reach for the worst possible explanation, and that instinct destroys the very documentation quality that would let them do something useful with what they've found.
This part of the Grimoire is about discipline as much as it is about technique. The methodology here is borrowed from signals intelligence practice, regulatory complaint procedure, and scientific documentation standards. None of it is glamorous. All of it is necessary.
What 'Undocumented' Actually Means: A Taxonomy of Unknown Signals
Unknown vs. Unidentified vs. Undocumented
These three terms are not synonyms, and treating them as interchangeable is the first place documentation falls apart.
An unknown signal is any detected emission with no immediate match in your reference database. You saw something on a frequency, you don't recognize it, and you haven't looked it up yet. That's it. That's the entire category. It's a starting condition, not a finding.
An unidentified signal means you've collected data but can't yet attribute the emission to a known device or standard. You've done some work. You have frequency, approximate RSSI, maybe a modulation guess. You just don't have a match. This is where active investigation begins.
An undocumented signal is more specific: a recurring emission that doesn't appear in public spectrum allocation records or your personal RF baseline for that location. It's shown up more than once. It doesn't match anything you can find in the FCC database or ITU allocations. That's genuinely interesting. It still isn't alarming by itself.
Suspicious, Harmful, and Illegal: Three Very Different Things
A suspicious signal is an undocumented signal with anomalous characteristics that warrant further investigation. Anomalous might mean unusual timing patterns, unexpected power levels, or modulation types inconsistent with the frequency's typical use. Suspicious is a hypothesis, not a conclusion. It means "this deserves more attention," not "someone is doing something wrong."
Harmful interference is a legally specific term. It means a signal is actively degrading licensed communications in a measurable, demonstrable way. The FCC definition is precise. Declaring that a signal constitutes harmful interference requires regulatory confirmation, not an SDR reading.
Illegal transmission is a legal determination made by a licensed authority after investigation. An SDR operator cannot make this call. Neither can a Flipper Zero. Neither can this article.
Theoretical weaponized RF claims exist in a separate category entirely. They require extraordinary evidence: peer-reviewed measurement methodology, calibrated instrumentation, independent replication, and usually formal forensic process. They should be framed as hypotheses, labeled as such in every document you produce, and never presented as conclusions without that evidentiary chain behind them.
Why Language Precision Matters Before You Start Measuring
Imprecise language doesn't just make your documentation look sloppy. It actively corrupts the quality of what you're building. If you label an unidentified signal as "suspicious" in your first scan session, you've introduced a bias that will color every subsequent observation. You'll interpret ambiguous data in the direction of that label. Your notes will reflect the conclusion you reached before you had evidence, and anyone reviewing your documentation later, including a regulatory body, will see exactly that.
Terminology Discipline
Adopt these four terms as formal categories in your documentation from the start: unknown, unidentified, undocumented, suspicious. Promote a signal to the next category only when you have specific, recorded evidence that justifies the upgrade. Never skip levels.
Credibility with authorities is built slowly and lost instantly. A well-documented anomaly report from someone who used precise language throughout gets read. A report full of words like "attack" and "weapon" without supporting evidence gets filed under "concerned citizen" and goes nowhere.
The Spectrum Baseline: Why You Cannot Identify Anomalies Without a Normal
Establishing Your Environmental RF Baseline
You cannot identify an anomaly in an environment you haven't characterized. This isn't a philosophical point. It's a practical one. If you don't know what your house looks like on a spectrum scan at 2 AM on a Tuesday, you have no basis for claiming that what you see at 2 AM on a Wednesday is unusual.
Baseline documentation is the non-negotiable prerequisite for everything else in this part of the Grimoire.
Start with a sweep across the Sub-GHz bands your Flipper Zero covers and across 2.4 GHz. Do this at multiple times of day: early morning before devices wake up, midday when usage peaks, late evening, and overnight. Each time window will look different, and you need all of them.
Log every signal you can identify. Wi-Fi routers across 2.4 GHz and 5 GHz. Bluetooth devices pairing and advertising. Smart meters transmitting on 915 MHz. Baby monitors, garage door openers, cordless phones, wireless doorbells. Microwave ovens produce significant 2.4 GHz interference when running. Your neighbor's Z-Wave network. All of it goes in the log.
For each signal, record: frequency, approximate RSSI, modulation type where you can determine it, and time of observation. Note the identified source if you can confirm it. Add any relevant context in a notes column.
Use the Flipper Zero's frequency analyzer for continuous Sub-GHz monitoring and the Sub-GHz scan mode for structured sweeps. The frequency analyzer shows you real-time activity across the band. The scan mode lets you step through frequencies methodically and log what you find.
What a Clean Baseline Log Looks Like
Your baseline table should have at minimum these columns: timestamp, frequency in MHz, RSSI in dBm, modulation type, identified source, and notes. Every row gets a timestamp. No exceptions. Memory is not a documentation tool.
A clean baseline isn't a baseline with no signals. It's a baseline where every signal has been accounted for. Dense is fine. Unaccounted-for is the problem.
Baseline Drift and Seasonal Variation
Baselines aren't permanent. A new neighbor moves in with a mesh Wi-Fi system and suddenly you have three new SSIDs and a dozen new BLE advertisements in your scan. Seasonal HVAC cycling changes which devices are active and when. Holiday lighting, particularly older LED strings with cheap controllers, introduces interference across multiple ISM bands.
Rebuild Your Baseline When Conditions Change
Any significant change to your RF environment, new devices, new neighbors, structural changes to the building, or seasonal shifts in device usage, requires a baseline rebuild before you resume anomaly hunting. Comparing new observations to an outdated baseline produces false positives.
Treat your baseline as a living document. Date every version. Note what changed and why.
What the Flipper Zero Can Realistically Detect
Sub-GHz Capabilities and Limits
The Flipper Zero's Sub-GHz module uses a CC1101 transceiver. It's a capable chip for the price point, but it has defined boundaries. The CC1101 covers approximately 300 MHz to 928 MHz, with sensitivity that varies across that range. It's well-suited for detecting garage openers, key fobs, smart meters, weather sensors, and similar consumer ISM band devices.
What it is not is a spectrum analyzer. The resolution bandwidth is constrained. The dynamic range is limited compared to dedicated instruments. You can detect that something is transmitting on a frequency, and you can get a rough RSSI reading. You cannot perform the kind of fine-grained spectral analysis that would let you characterize a signal's modulation with high confidence or distinguish between two signals on adjacent frequencies with precision.
External antennas improve things. A directional antenna, connected via the Flipper Zero's SMA connector on compatible hardware configurations, lets you compare signal strength from different physical orientations. That directionality data is useful for narrowing down where a signal is coming from. It doesn't replace a proper directional finding setup, but it gives you more than an omnidirectional reading alone.
2.4 GHz, Wi-Fi, and BLE Presence Detection
The NRF24L01 module handles 2.4 GHz. Through this, the Flipper Zero can detect Wi-Fi SSIDs, identify BLE advertisement packets, and observe 2.4 GHz activity generally. This is presence detection, not deep analysis. You can see that a device is advertising. You can't decode arbitrary proprietary protocols or perform packet-level forensics without additional tooling.
BLE advertisement detection is genuinely useful for baseline work. Most smart home devices advertise periodically, and changes in that advertising pattern can be meaningful data points.
Repetition Patterns and RSSI Trends as Clues
Two of the most useful things you can track with the Flipper Zero are repetition patterns and RSSI trends over time. A signal that appears every 30 seconds is behaving differently from one that appears randomly. A signal whose RSSI increases over several days without any change in your known devices is worth noting.
RSSI monitoring as a proxy for environmental change is underused. Correlating RSSI spikes with observed device failures or connectivity drops in your home network gives you a starting point for causation hypotheses. It doesn't confirm causation. It generates a hypothesis worth testing.
What the Flipper Zero Cannot Prove Alone
The Limits of Single-Instrument Evidence
Let's be direct about this, because the temptation to over-interpret is real and the consequences of doing so are significant.
The Flipper Zero cannot determine transmitter intent. A signal that looks unusual to you might be a legally operating device you've never encountered. Intent is a legal and contextual determination that requires far more than an RSSI reading.
It cannot identify the source identity of an unlabeled transmission. You can narrow down possibilities through frequency, modulation, and timing. You cannot confirm who is transmitting without additional investigative steps that go well beyond what any single handheld tool can accomplish.
It cannot measure health effects. Power density measurement requires calibrated equipment, traceable methodology, and expertise in RF exposure standards. The Flipper Zero measures signal presence and approximate strength. Those are not the same thing as a health impact assessment.
On Claims of Signal Weaponization
The Flipper Zero cannot confirm that a signal has been weaponized or is being used to cause deliberate harm. That determination requires forensic RF analysis, independent expert verification, and in most cases formal legal process. Document what you observe. Do not characterize it beyond what your evidence supports.
Why Intent, Identity, and Health Effects Require More Than RSSI
It cannot pinpoint transmitter location without directional antenna arrays and a triangulation methodology involving multiple measurement positions. A single directional antenna reading gives you a bearing. A bearing is not a location.
It cannot confirm a legal violation. That is a regulatory determination made by the FCC or equivalent authority after their own investigation. Your documentation can support their investigation. It cannot replace it.
"A single unexplained reading is a question. Repeatable, multi-instrument confirmation is the beginning of an answer."
The Danger of Jumping to Conclusions
The cognitive trap here is confirmation bias. You find a signal you can't explain. You have a pre-existing concern about your RF environment. The unexplained signal feels like confirmation. It isn't. It's a data point that doesn't yet fit your reference database.
Documentation quality is what separates useful evidence from dismissed anecdote. A report that says "I found a signal I couldn't identify and here is six weeks of timestamped, multi-session data showing its characteristics and recurrence pattern" gets taken seriously. A report that says "I found a signal and I believe it is being used against me" without supporting methodology does not. The difference isn't the signal. It's the discipline you brought to recording it.
Practical Detection Methodology: From First Observation to Documented Pattern
Step One: Establish Baseline Before Hunting Anomalies
This was covered in depth in the baseline section above, and it bears repeating as a procedural rule: you do not begin anomaly hunting until you have a documented baseline. A minimum viable baseline covers multiple time windows across at least three days. A solid baseline covers two weeks and includes weekend patterns, which often differ significantly from weekday patterns due to occupancy and device usage changes.
Do not skip this step because you already found something interesting. Especially then.
Step Two: Identify and Log Recurring Unknowns
A signal that appears once is an observation. A signal that appears in multiple independent scan sessions on the same frequency is a recurring unknown, and that's the category worth investigating.
For each recurring unknown, your log entry must include: frequency in MHz, RSSI in dBm, modulation type if you can determine it, time of day, duration of transmission, and any observable pattern. Does it appear on a schedule? Does it appear in response to something? Does it appear only during certain hours? All of that goes in the notes column with timestamps.
Don't rely on memory. Don't rely on informal notes that live in a chat app or a text file with no timestamps. Preserve raw capture files from the Flipper Zero with their original file timestamps intact. Those files are your primary evidence. Notes are supplementary.
Step Three: Multi-Location Testing and Directionality Comparison
Once you have a recurring unknown, test it from multiple physical positions. Inside the building at different rooms. Outside at different points around the perimeter. Note the RSSI at each position with the same bearing and compare.
If you have a directional antenna, use it to compare signal strength from different orientations at the same position. Record the bearing and the RSSI delta between your strongest and weakest readings. This gives you a rough propagation direction. It's not triangulation, but it's more information than a single omnidirectional reading.
Step Four: Eliminate Known Sources Systematically
Before escalating a signal's classification, work through your known household sources methodically. Power down devices one at a time while monitoring the frequency in question. If the signal disappears when you shut off a specific device, you've found your source. Log the result either way.
This step catches a significant number of "mysterious" signals that turn out to be a device the occupant forgot about, a neighbor's equipment bleeding through a shared wall, or a device operating in an unexpected frequency range due to a firmware update or hardware fault.
Step Five: Sustained Observation and Correlation Logging
Transient signals are not anomalies. A signal that appears twice and then never again is interesting but not actionable. Persistent anomalies are what warrant escalation, and persistence requires time to establish.
Observe over days and weeks. Look for correlation between signal appearances and other events: connectivity drops in your home network, device failures, behavioral anomalies in electronics that don
Theory Section: Malicious and Unauthorized RF Use. Hypothesis, Not Conclusion
Part 11 gave you the instruments and the methodology to detect signals you didn't put there. This section is about what to do when you find one, and how to think clearly about what it might mean.
What Malicious RF Use Actually Looks Like in Documented Cases
Malicious RF use is not a conspiracy theory. It's a documented, prosecuted, measurable category of crime. GPS jammers are illegal in most jurisdictions and are regularly seized from commercial vehicles whose drivers use them to defeat fleet tracking. Cellular jammers have been found in prisons, in restaurants, and in the hands of individuals attempting to prevent emergency calls. Wi-Fi deauthentication attacks are a well-understood exploit in the 802.11 protocol stack, used in documented cases of targeted network disruption. RFID skimming has resulted in real financial fraud, real prosecutions, and a real consumer market for shielded wallets.
These are not fringe claims. They are cases with court records.
RF-based stalking is also documented. Consumer devices, including modified Bluetooth trackers and covert cellular transmitters, have been used in harassment and stalking cases that have resulted in criminal charges. The signals are measurable. The devices are recoverable. The evidence is admissible.
The Spectrum of Claims: Jamming, Spoofing, and Beyond
Beyond the well-documented cases, there's a wider spectrum of claims. Some are technically plausible and under active investigation by researchers. Others are contested. A few are not currently supportable by available evidence.
Spoofing sits near the documented end. GPS spoofing, for instance, has been observed in geopolitical contexts, with ships reporting false positions in areas of known interference. Academic research and government aviation safety programs treat it as a real and growing threat.
Further along the spectrum are claims about directed energy effects on biological systems. This is not a category to dismiss reflexively. Government research programs have explored RF and microwave effects on human physiology. Patents exist. Peer-reviewed papers exist. The Havana Syndrome investigations, whatever their ultimate conclusion, represent a serious institutional acknowledgment that RF-adjacent effects on human health are worth studying.
None of that constitutes proof that any specific person is being targeted by such a system. It constitutes a basis for forming hypotheses.
Fringe Claims and the Obligation to Require Evidence
Some claims go further: behavioral manipulation via ambient RF, consciousness-affecting transmissions, coordinated targeting of private individuals using classified technology. These claims circulate widely in certain communities. They cause real distress to real people.
The obligation here is not to mock those claims. It's to require evidence before accepting them, and to insist on the same evidentiary standards that apply to every other empirical question.
Patents and academic papers are starting points for hypothesis formation. They are not proof of active deployment. A research program studying microwave effects on rat tissue in a controlled laboratory setting does not confirm that a neighbor is beaming signals through a wall. The gap between those two things is enormous, and disciplined thinkers hold that gap open.
Arming People to Recognize, Document, and Report. Not to Conclude
The goal of this section is not to validate or invalidate any specific claim. It's to give people who believe they are experiencing RF interference the tools to investigate it properly.
Why Methodology Protects the Investigator
Prolonged unexplained experiences can create confirmation bias loops. When you're already convinced something is happening, every anomaly becomes evidence. Disciplined documentation is protective for the investigator, not just useful for authorities. A log that records negative findings alongside positive ones is a log that can be trusted. A log that only records anomalies is a record of attention, not of signal.
Regulatory agencies and law enforcement take documented, evidence-graded RF interference complaints seriously. An FCC interference complaint supported by timestamped capture files, instrument specifications, and a clear methodology description will receive a different response than a phone call describing symptoms without measurements. That's not a bureaucratic obstacle. It's how evidence-based institutions are supposed to work, and it's a feature, not a bug.
The measurement process is what separates signal from noise. That principle applies to radio waves and to reasoning.
Defensive Posture: Practical Hardening Against RF Interference
Knowing what's in your RF environment is half the work. Reducing your exposure to interference, and your vulnerability to RF-based attacks, is the other half.
Physical Mitigation: Shielding, Grounding, and Ferrite Chokes
RF shielding is appropriate in specific contexts. Server rooms housing sensitive equipment, laboratory environments requiring controlled RF conditions, and enclosures for precision measurement instruments all benefit from proper shielding. For most residential users, full shielding is neither practical nor necessary. A Faraday cage for your living room is not a proportional response to an uncharacterized anomaly on a scan log.
What is practical: proper equipment grounding. Ungrounded equipment is more susceptible to both conducted interference traveling along power lines and radiated interference coupling into cables. A correctly grounded rack or workbench is a first-line defense that costs almost nothing and pays off consistently.
Ferrite chokes are small, inexpensive, and underused. Clipped onto power supply cables, USB lines, and audio cables, they suppress high-frequency noise that would otherwise travel along the conductor and corrupt sensitive measurements or introduce interference into connected equipment. If you're doing serious RF work with the Flipper Zero or any external SDR, ferrite chokes on your USB connection to the host computer are worth adding.
Switching power supplies are a known interference source. The switching frequency and its harmonics show up across a wide range of spectrum. Replacing a cheap switching supply with a linear supply, or with a higher-quality unit that meets stricter conducted emissions standards, measurably reduces the noise floor in your environment.
Device and Network Hardening
Move wireless devices away from interference sources. This sounds obvious, but co-channel crowding in dense residential environments is a genuine problem, and thoughtful placement reduces it. Where wireless is not required, use wired connections. Every device that communicates over Ethernet instead of Wi-Fi is one fewer transmitter in your environment and one fewer potential attack surface.
Network segmentation matters. IoT devices running deprecated firmware on protocols with known vulnerabilities should not share a network segment with devices you care about. A separate VLAN or a dedicated SSID for smart home hardware contains both interference risk and security risk. This is standard practice in professional environments and is increasingly accessible to home users through consumer routers with VLAN support.
Upgrade outdated wireless devices that use deprecated protocols. WEP and early WPA implementations are not just security liabilities. They're interference sources and spoofing targets.
Environmental Optimization and Source Elimination
Proportionality Is a Discipline
Defensive measures should match the documented threat level. Before adding shielding, segmentation, or hardware changes, work through the elimination process: power down devices one at a time, rescan, and rule out known sources. Most unexplained signals have mundane explanations. Find those first.
Keep an ongoing RF environment diary. Changes in your baseline are only detectable if you have a baseline to compare against. A log entry that reads "2026-05-10, 433.92 MHz, RSSI -72 dBm, intermittent, source unknown" is useful data. The same observation made six months later with no prior record is just a number.
Documentation Standards: Building a File That Authorities Will Take Seriously
Good documentation is the difference between a complaint that gets investigated and one that gets filed and forgotten. The standards here are not bureaucratic formalities. They're what makes your evidence legible to someone who wasn't there.
What to Capture and How to Label It
Every capture file should follow a consistent naming convention: date-time-frequency-location-instrument. An example looks like this: 20260510-1423-433920kHz-kitchen-flipper-zero.csv. That filename tells a reviewer when, where, what frequency, and what instrument without opening the file.
Do not edit raw capture files. Create annotated copies for analysis and preserve the originals in a separate folder that you treat as read-only. Metadata integrity matters. If a raw file shows signs of modification, its evidentiary value drops.
Document negative findings. "Signal not observed at this location on this date during a 30-minute scan session" is useful data. A log that only records anomalies looks like a record of confirmation bias. A log that records everything looks like a methodology.
Chain of Custody for Digital RF Evidence
A complete documentation package includes: a cover summary written in plain language, a chronological log of all scan sessions, raw capture files with unmodified metadata, instrument specifications including firmware version and antenna configuration, a methodology description explaining scan parameters and duration, and professional review if you've been able to obtain it.
Chain of Custody Basics
For each capture session, record who collected the data, what instrument was used, what firmware version was running, what antenna was attached, and what settings were active. This is not excessive. It's the minimum a technically competent reviewer needs to assess whether your results are reproducible.
Formatting a Report for FCC or Law Enforcement Submission
The FCC's public guidance on reporting harmful interference is worth reading before you file anything. The agency asks for specific information: the nature of the interference, the frequencies affected, the dates and times of occurrence, the geographic location, and the equipment involved.
"Harmful interference complaints should include as much technical detail as possible, including the frequencies affected, the type of interference observed, and the impact on licensed operations. Complaints without supporting technical information are more difficult to investigate."
That standard applies equally to law enforcement. RF harassment cases require the same evidentiary quality as other electronic crime investigations. A well-formatted report with timestamped captures, instrument specs, and a clear methodology gives investigators something to work with. A narrative description of symptoms without measurements gives them very little.
Your Part 12 Action Checklist: From Unknown Signal to Documented Evidence
Work through these in order if you can. The baseline scan tasks build on each other, and the documentation infrastructure you set up now will make every future scan session more useful. The checklist is not a one-time exercise. It's a starting point for an ongoing practice.
What Comes Next: Part 13 Preview and Series Closing Notes
Bridging to the Final Part of the Grimoire
Part 12 established something specific: a disciplined, evidence-graded framework for approaching undocumented RF signals without tipping into either dismissal or speculation. You now have a way to think about unknown signals that doesn't require you to conclude anything prematurely. That's harder than it sounds, and it's more useful than any single piece of hardware in this series.
Part 13 is the capstone. It takes everything built across the Grimoire, the reconnaissance techniques, the signal classification methodology, the documentation standards, the defensive posture principles, and integrates them into a complete operational workflow. Not a checklist you run once. A repeatable process you can apply whether you're troubleshooting a smart home, conducting a formal RF audit, or building a case file for a regulatory complaint.
What This Series Has Built
The core principle has been consistent from Part 1 forward: measurement is the antidote to both ignorance and paranoia. The electromagnetic environment is genuinely complex. It's sometimes contested. It's occasionally adversarial. The right response to that complexity is not fear and it's not dismissal. It's documentation, methodology, and professional escalation when the evidence warrants it.
If you've followed the full series, take some time before Part 13 to review your accumulated scan logs and notes. Identify what questions remain unanswered. The skills here transfer directly: the same methodology that helps you identify a rogue signal in a residential environment applies at professional scale.
Part 13 lands soon. Don't skip the log in the meantime.
