Acoustic Espionage: Fiber Optic Eavesdropping

Summary: The COAES attack presented at NDSS 2026 shows that ordinary fiber optic cables running to buildings can turn into microphones that pick up ambient sound. In this article, I explain the physical principle of the attack (micro-bending, Rayleigh scattering, DAS), the coiling setup that increases sensitivity, the measured success rates, and why conventional anti-eavesdropping countermeasures do not work.

Scientific Analysis of the Acoustic Eavesdropping Attack via Telecom Fiber Optic Cables (COAES) A new cybersecurity threat has emerged, showing that modern fiber optic communication networks—the very cables we use for data transmission—can also function as an unwanted "microphone array." This threat was announced to the public at the NDSS (Network and Distributed System Security) Symposium held in 2026. Here is a scientific examination of this new and covert threat:

Principle of Operation: Acoustic Side Channel

The attack is based on the inherent sensitivity of optical fibers to sound waves in the external environment. When sound waves strike a fiber optic cable, the microscopic pressure fluctuations they create cause physical deformations in the fiber's geometry known as "micro-bending." These micro-bendings momentarily change the refractive index and the optical path length of the light traveling inside the fiber.

Attackers send laser pulses through a commercial Distributed Acoustic Sensing (DAS) system connected to one end of the fiber, analyze the backscattered Rayleigh scattering signals, and reconstruct the original sound wave from these phase shifts.

Method for Increasing Sensitivity: Coiling

A standard FTTH (Fiber to the Home) cable is not sensitive enough to detect sound in the air. To increase sensitivity, researchers developed a setup called a "Sensory Receptor."

This setup is based on the principle of tightly winding the excess portion of the cable around a 65 mm diameter PET (polyethylene terephthalate) cylinder (making a coil). This winding concentrates the incoming acoustic pressure on the fiber, greatly increasing the efficiency of the mechanical-optical conversion.

Performance and Results of the Attack

This system was tested in controlled laboratory and real office environments, yielding surprising results:

• High Success Rate: In tests conducted at a distance of 2 meters, the Word Error Rate (WER) remained below 20%. This means that AI speech recognition models were able to successfully transcribe more than 80% of the spoken content.

• Precise Localization: The system was able to determine the location of a speaker in a room with an average error margin of 77 cm.

• Real-World Scenario: In a test conducted on a 50-meter cable line in an office environment, the WER dropped to only 9%.

Evading Conventional Detection Methods

What makes this attack particularly dangerous is its "covert" nature. Because the system operates passively, it is largely unaffected by traditional security and surveillance countermeasures (TSCM):

• Concealment from RF Detectors: Because the attack emits no electromagnetic radiation (RF), RF scanners that sweep an environment for hidden bugging devices cannot see this threat.

• Immunity to Ultrasonic Jammers: Ultrasonic jammers used to neutralize hidden microphones in an environment have no effect on this system. The fiber itself is a giant sensor that does not need a microphone. In tests, no degradation in system performance was observed even when a jammer was placed right next to the fiber.

Scientific Basis and Laboratory Evidence

The physical principle behind this attack rests on one of the cornerstones of fiber optic sensor technology. In a laboratory experiment, guitar music played through a speaker was observed to cause measurable State of Polarization (SoP) changes on nearby long fiber optic spools.

These detectable SoP changes are a direct result of the birefringence effect that sound induces within the fiber, and they prove the feasibility of the attack.

Attack Vector and Impact Report

COAES (COVERT ACOUSTIC EAVESDROPPING ATTACK) PARAMETERS · NDSS 2026 Symposium

• Physical Transformation Chain: Acoustic Wave -> Micro-bending -> Refractive Index Change -> Rayleigh Scattering -> Signal Reconstruction (Acoustic Side Channel)
• Sensory Receptor (Coiling): 15 meters of fiber cable is wound around a cylinder to concentrate acoustic pressure and maximize mechanical-optical efficiency. (PET Cylinder (65mm))
• DETECTABILITY: Zero RF Emission · Full immunity to jammers
• EAVESDROPPING RANGE: 50 Meter Line · 77 cm localization accuracy
• ACCURACY RATE: 91% Transcription · WER only 9%

These findings show that not only cybersecurity walls but also physical layer security and even in-office acoustic privacy need to be redefined.

My reading

• The threat is real and measured: In an office environment, the word error rate over a 50-meter line dropped to as low as 9%, and the speaker's location was found with an average error of 77 cm.
• Classic countermeasures remain blind: Because the attack emits no RF at all, scanners do not see it; ultrasonic jammers are also ineffective because the fiber itself is the sensor.
• Physical layer security must be rethought: How the fiber cable passes through the room and how the excess is coiled up are now part of acoustic privacy.