Steganography hid the message by concealment — buried in a carrier. This channel hides it by range: the signal sits in plain spectral sight, just above the ceiling of your ears. You can't hear it, but every microphone in the room still can. Covert by physiology, not by disguise — and that's exactly why the speakers and mics already in your devices make a working secret network.
the hearing line
Human hearing runs roughly 20 Hz to 20 kHz, and the ceiling sinks with age — a teenager may reach 19–20 kHz, an older adult 14–16 kHz. The exploitable band is 17–20 kHz ("near-ultrasonic"): high enough that most people can't hear it, low enough that ordinary phone and laptop speakers and mics still produce and capture it. True ultrasound (>20 kHz) needs special hardware. The whole channel lives in that narrow strip between what your ear quit hearing and what your microphone hasn't.
① the lineage
note. the audio spotlight (parametric array) is credited to J. Pompei at MIT and, commercially, Woody Norris's HyperSonic Sound — late 1990s; dates approximate.
② find your own ceiling
a tone you can lose
15.0 kHz
Drag upward while it plays. Somewhere — your age and your speakers decide where — it vanishes for you. A microphone wouldn't lose it. (Your browser caps synthesis near 22 kHz, so the true ceiling is even higher than you can test here.)
③ a byte you (probably) can't hear
Set 8 bits. Transmit plays them as near-ultrasonic tone-bursts — 18.0 kHz for a 0, 19.5 kHz for a 1 — riding the very edge of hearing. Then receive: a machine reads the spectrum of each burst and recovers your byte, whether or not you heard a thing.
set 8 bits, then transmit & receive
④ the four uses of the inaudible
audio spotlightA parametric array beams ultrasound that the air itself demodulates into audible sound — but only in a narrow cone. One person hears a voice; the seat beside them hears silence.delivery · directional
covert meshHanspach & Goetz turned laptop speakers and mics into an inaudible network — multi-hop, even a keylogger over the air. Defeats firewalls because no one monitors the room's acoustics.networking · exfiltration
cross-device trackingA TV ad or web page emits an ultrasonic beacon; an app on your phone silently hears it and links your devices — and your identity. SilverPush's exposure drew an FTC warning.surveillance · uXDT
data-over-soundThe friendly cousin: Chirp / Google Tones pair devices or pass a token by chirping a code any nearby mic can decode — no Bluetooth, no network.pairing · benign
⑤ the limits — and the catch for attribution
This channel is loud and obvious to anything that looks above 18 kHz — so it's covert only against ears, never against analysis. Air swallows high frequencies fast (short range), the band is narrow (low bit-rate), and consumer gear rolls off near the ceiling. The clean countermeasure is the bluntest one: a low-pass filter on input and output kills the whole channel. For attribution, ultrasonic is the wrong tool — it doesn't bind to your work, it broadcasts presence into a room. Its real lesson is the inverse of a watermark: not "prove this is mine" but "know what's listening." As an auditor, the move is to watch the 18–22 kHz band, not hide in it.
what's authentic. Galton's 1876 whistle, the Hanspach–Goetz covert mesh (≈19 m, ≈20 bit/s, 2013), and SilverPush ultrasonic cross-device tracking are real and sourced. the FSK demo above genuinely transmits 8 bits as near-ultrasonic tones and recovers them by Goertzel spectral analysis — verified across random trials, not faked.
honest frame. whether you actually hear the tones depends entirely on your age, your ears, and your speakers — many laptop speakers can't even emit 19 kHz, and the browser's sample rate caps synthesis near 22 kHz, so this can't reach true ultrasound. real ultrasonic systems use dedicated transducers. and unlike the steg watermark, nothing here proves authorship — it's a presence channel, not a provenance one.
PAPER II · ULTRASONIC — above the hearing linenext ▸ III · ACOUSTIC SIDE CHANNELS — read the leak