Observore
A passive counter-surveillance detector for nine ESP32 boards — headless sensors that report to your network, and touchscreen ones that report to your hand. It sits in one place, learns what is normally there, and tells you what is new.
Flash it from your browserObservore v0.14.0 is released and MIT-licensed. Nine board profiles now, all shipping. The newest work: a device learns the furniture of a room over days and takes weight off the score for it, drones give up their operator's position, each class of finding can be switched off on its own, and nodes can warn each other — off by default, because a detector that transmits can be found. An existing device installs the update from its own console or its own screen.
The Problem
Everything watching you announces itself — to anyone listening
Body cameras, licence-plate readers, IP cameras, trackers and drones all broadcast, unencrypted, by design. The information is there in the air around your home or your office. What is missing is anything that listens to it continuously and tells you when the pattern changes.
Observore is that listener, on hardware that costs less than a meal out. It learns the normal radio furniture of a place, then reports the new arrivals — and it does the listening without ever transmitting, so the things it notices never notice it.
Zero TX
No probe requests, no scan requests, while patrolling
9 boards
Headless sensors and touchscreen displays
209
Surveillance vendor prefixes from the IEEE registry
No cloud
The log lives on the device and on your LAN
Features
A detector that does not announce itself
Observer and omnivore: it eats surveillance signals. Everything below runs on a single board you can hold between two fingers.
Passive While Patrolling
BLE scanning emits no SCAN_REQ, the Wi-Fi access-point scan sends no probe requests, and the sniffer is receive-only. Nothing it observes can observe it back, because nothing leaves the radio.
Three Detection Phases
Continuous BLE passive scan for trackers, body cameras, smart glasses and Remote ID drones; a ~10 s Wi-Fi scan for camera and ALPR vendor APs; and a ~5 s promiscuous sniff across channels 1–13 for Remote ID beacons, hidden access points and deauthentication floods.
Five Kinds of Evidence
209 surveillance vendor prefixes from the IEEE registry; payload signatures (Find My, Tile, SmartTag, Fast Pair, ASTM F3411 Remote ID, Flipper Zero); behaviour, meaning what a device did rather than what it claims; name, SSID and WPS keywords; and persistence. The UI names which one fired, so you can judge a hit rather than trust it.
Equipment That Transmits
Eight deauthentication frames naming one address inside ten seconds is a flood — scored as an act, alongside body cameras and plate readers. Hunter gear (a Flipper, a pwnagotchi, a Pineapple) scores lower, because a tool present is capability where a flood is something being done.
Where the Pilot Is Standing
A drone complying with ASTM F3411 broadcasts its position, its serial number and — the part that surprises people — the location of its operator, in clear, because regulation requires it. Observore decodes it and leads with the operator, since that is the one thing you could not work out by looking up.
The Follower Heuristic
An unidentified Bluetooth device still around after five minutes is listed as following you — and the whole class together cannot move the verdict past clear. A follower in a house is usually the neighbours, and a warning that is always on is not a warning.
Tailing — The Claim Persistence Cannot Make
A follower that was beside you while you were somewhere else. A journey counts when the access points around you fade or drop away; a device promotes only if it was still there, strongly, at the far end. It alerts on its own, and it needs the accelerometer only the round board carries.
The Score Is What Is Here Now
The score is the sum of what is present right now, worked out when asked. Six names an act — a camera recording, a plate reader reading, a flood knocking devices off a network. Three names a capability. No quantity of unidentified devices can push an identified one over the line.
A Verdict You Can Read Across the Room
Clear winks once every five seconds, caution pulses once a second, alert flutters. Boards with a pixel add colour on top of the rhythm rather than sitting lit — a device meant to sit unattended should not be a beacon itself.
Screens That Need No Browser
On a Cheap Yellow Display the findings are on the glass, and touch does the rest: set a baseline, tap a finding to ignore it, join a Wi-Fi network by typing the password on the panel, read the console's address, and install an update. The backlight dims itself to the room it is in.
A Watch Face as a Disguise
The round AMOLED board can show the time instead of a list of everybody's Bluetooth addresses, because a device glanced at in a pocket should not advertise what it is doing. The threat level reaches the wearer as the colour of the hour markers and nothing else.
Baseline What Is Already Yours
Press Set baseline once it has settled in and everything currently in range becomes known — which is why a good install is a quiet one. Protected classes are silenced by address alone, so quieting your own Flipper never quiets a stranger's.
It Learns the Furniture
A stationary device keeps a census of what is always around it — the doorbell, the printer, your own phones — counted in days rather than sightings: three distinct days inside sixteen. Household devices lose weight on the score; a protected class never does, and the band says how many it quieted.
Run Only the Classes You Want
Watching a car park for trackers means no use for fleet telematics. Each class can be switched off, and off means keep seeing, stop reporting — so switching one back on shows what has been there all along. A device with monitors off never says clear as though it had looked: the count travels with the verdict everywhere it goes.
Nodes That Warn Each Other
Several nodes see more than one does, so a node can pass on its heaviest finding to its neighbours — signed with a household key, from a fresh random address, at an interval that is itself randomised. Transmitting is off by default and absent rather than disabled: a detector that announces itself can be found.
Five Ways to Be Told
The headless boards push to Gotify, ntfy, Pushover, a JSON webhook (Home Assistant, n8n, Node-RED) or Telegram. Findings are queued during patrol and flushed on the next uplink as one digest, ordered by what warrants attention. Tokens are write-only — no endpoint reads them back.
A Console on Your Own Network
The log, the findings, the evidence behind each one, and every setting are served from the device itself — over its own access point when you hold the button, or over your LAN once it has joined. Nothing is uploaded to anyone's cloud, because there isn't one.
Flash It From a Browser
A Web Serial flasher installs the build for the board you plug in — no toolchain. It writes firmware without touching stored configuration, so an upgrade keeps your mute rules, credentials, and console password.
Updates Over the Air, With Rollback
It checks once a day, inside an uplink window it was going to open anyway, against the same manifest the web flasher uses. A new version is mentioned once and installs when you ask — never on the device's own initiative, because a device that is updating is not a device that is watching.
Dual-Band on the ESP32-C5
On a C5 the sniffer covers 25 channels of 5 GHz across UNII-1, 2A, 2C and 3, a slice per cycle, on top of full 2.4 GHz coverage every cycle. DFS channels included — the radar rules govern transmitting, and this radio only listens.
On the Bench
Hardware, not renders
Every board here is one that has been run, carried and soaked. The readings on the glass are real air in an ordinary house.
How It Works
Ten minutes to a working detector
Pick a Board, Flash It
A headless sensor — the XIAO S3, either C5, the C6 — reports to your network. A Cheap Yellow Display reports to your hand. Plug it into a Chromium-based browser over USB and the flasher installs the matching build.
Give It Your Network
Hold the button and join the device's own access point, or, on a board with a screen, pick the network and type the password on the glass. The console then lives on your LAN, and the screen will tell you where.
Set a Baseline and Walk Away
Let it patrol where it will live, then mark everything in range as known. After that, expect quiet — a silent detector is the normal state, and the heartbeat on the log tells you it is still watching.
The web flasher needs a Chromium-based desktop browser — Chrome, Edge, Opera, or Brave 1.69 and later. Firefox and Safari do not implement Web Serial, and no mobile browser does. Building it yourself needs ESP-IDF v5.5.5 or later. From v0.7.0 onward a device installs later releases itself, from its own console or its own screen.
What it catches — and what it will miss
A detector you cannot calibrate your trust in is worse than none. Both lists ship in the README, and the second one is the more important of the two.
What it catches
- Body cameras and licence-plate readers by vendor prefix — scored as an act
- Deauthentication floods: eight frames naming one address inside ten seconds
- Hunter gear — a Flipper Zero, a pwnagotchi, a WiFi Pineapple
- Bluetooth trackers: Apple Find My, Tile, Galaxy SmartTag, Google Fast Pair
- IP and vendor cameras by OUI, SSID keyword, and WPS model string
- Remote ID drone beacons over BLE and over Wi-Fi — decoded down to the operator's position
- Hidden and non-broadcasting access points, via the promiscuous sniff
- Devices that keep reappearing — and, on the round board, ones that came with you
- Your own gear, labelled benign; peer detectors, fixtures and earbuds weighted down
- The furniture of a room, learned over days and taken off the score for you
Read this before trusting it
- Address rotation is followed for Bluetooth, by kind rather than individual — and not yet for Wi-Fi
- Absence of evidence is not evidence of absence — a clear reading means nothing was detected
- Wired cameras and cellular ALPR units with the radio off are invisible to it
- On anything but an ESP32-C5, 5 GHz devices are invisible to it
- A deauth flood names the address it was sent as — a victim, not a culprit
- A vendor prefix identifies a manufacturer, not a purpose — a doorbell is not surveillance
- Some signatures are inferred from public reporting; treat those hits as leads
- The console is authenticated but not encrypted — that cookie crosses your LAN in the clear
- A device installing an update is not detecting, which is why it never updates unasked
- A quiet screen means nothing announced itself — a drone that wants to be unseen sends no Remote ID
- The census dampens rather than silences, because one advert shape can describe a population
- Mesh warning is off by default: a node that transmits can be found by direction-finding
- Delivery is verified end to end for three of the five notification providers
Technology
Small hardware, unglamorous engineering
Native ESP-IDF, tables generated from the registry rather than maintained by hand, and a parser that assumes every frame it reads is hostile.
A note on the law
Observore is a receiver. It observes broadcasts that are, by design, transmitted publicly and unencrypted. It does not deauthenticate, inject, jam, associate, crack, or interfere with anything. Passive reception of broadcast frames is lawful in most jurisdictions, but “most” is not “all”, and what you do with a log is a separate question from how you gathered it. Check your local law.
Find out what is watching the room
Observore is open source and free to build, from Forged in Feathers Technology. Plug in a board and it is running in about ten minutes.