Section 97.113 of FCC rules describes prohibited amateur radio transmissions: https://www.w5yi.org/page.php?id=121

While it doesn't call out encryption by name it more broadly prohibits "messages encoded for the purpose of obscuring their meaning." I take that to include both encryption and obfuscation methods like steganography.

See: Direct Sequence Spread Spectrum. It is possible to communicate below the perceived noise floor of a narrowband signal using much more bandwidth than is actually required for the transmission and intended channel conditions. You can basically encode your data across a much wider range of code points which directly modulate the broadband signal. This generates in RF terms what any unawares outside observer would describe as "broadband noise". E.g. WiFi communicates in 20MHz channels, a DSSS solution could use 100-1000 MHz channels (albeit at a MUCH lower baud). Most use/scanning/jamming/licensing of the airwaves is done in a narrowband context, so this is a sort of strategic way to get around these constraints.

If done properly and using a sequence that only you understand, it is possible to become completely invisible to interception for most practical situations. Someone with RF monitoring equipment could determine the source of broadband emissions, but without actually investigating the design of the physical transmitter they wouldn't ever know conclusively what is happening. This is why the FCC requires you publish the algorithm of the PRNG which modulates the data into the final DSSS signal. If you never do this and take decent measures to ensure your sequence appears as pure noise (simply encrypting your payload would do this), there is little anyone could hope to do to discover your presence if they were listening in the middle.

While I have heard of its use, it seems making a convincing 'carrier' may be more difficult than it seems with the limited bandwidth, and monitoring. But I may be wrong. In relation to the law it seems to violate the 'open public use' provision, but I am ignorant of the fine print. I do know the fcc is unreasonably good at finding and prosecuting illegal transmissions, but will stop short of incriminating myself or others.

someone has to figure out there's a hidden message first. much like using a 'non-type-accepted' radio. on the internet no one knows you're a dog.