Homepage
Crypto
Spy radio
Burst encoders
Intercept
Covert
Index
Glossary
Cameras
Recorders
Radio
Bugs
Microphones
Dead Drop
Lock picking
Stories
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Logo (click for homepage)
← Easy Chair
  
CIA
NRP
  
SRT-107
Covert listening device with RP audio masking

SRT-107 was a sophisticated covert listening device (bug), developed in 1973 by the Dutch Radar Laboratory (NRP) for the US Central Intelligence Agency (CIA), as part of a long-term research project under the name Easy Chair. This battery powered device is extremely difficult to detect.
 
The SRT-107 consists of a fairly large cylindrical transmitter and a partly transparent SRN-58 antenna. The two parts are connected via a 25 cm fixed coaxial cable. A power source and a suitable microphone should be connected to the flying lead with a 5-pin connector at the end.

Contrary to early Easy Chair bugs, the SRT-107 is a so-called active target element (ATE), which means that it is powered locally from batteries, the mains or via a telephone line. The device operates in the 1500 MHz band and features a very sophisticated novel audio masking scheme.
  
SRT-107 transmitter

The unit is powered by an external 5.2V DC source and consumes typically 6.5 mA when in full operation. Yet it delivers an output power of 200 mW, due to the fact that it uses Pulse Position Modulation (PPM). Speech information is masked by using a noise generator to randomly reject some of the pulses, as a result of which the transmitter appears to be producing random noise.
 
SRT-107 transmitter STR-10 transmitter with SRN-58 antenna SRT-107 transmitter Fixed SRN-58 antenna Cables cast in epoxy for strain release Quick-release connector

 
Features
The diagram below shows a typical SRT-107 unit, without an external microphone. At the right is the actual transmitter which is housed in a hermetically sealed brass cylinder, that is covered in a strong (green) two-component epoxy paint. Inside the cylinder is a fairly large RF section plus six so-called cordwoord modules that contain the electronic circuits. At the bottom of the cylinder is an endplate with three hermetic glass feedthroughs to which the cables are connected. In order to protect the internal circuits against corrosion, the cylinder has been filled with dry nitrogen.


At the top is the SRN-58 antenna which is connected to the transmitter by means of a fixed 25 cm long teflon coax cable. It consists of two brass pipes that form an end-fed 1/2λ dipole with vertical polarization. The antenna is cast in a solid 26 mm thick transparent epoxy cylinder. The dimensions of the antenna have been compensated for the dielectric effects (εr) of the cylinder.

A flying lead is provided for connection of a power source and an external microphone. At the end of the flying lead is a 5-pin quick-release connector for testing and installation. The unit is powered by a 5.2V DC source and consumes approx. 6.5 mA when in full operation. It provides a peak output power of 200 mW. A recommended miniature microphone is the Knowles 1501.
 
Complete setup
A complete setup typically consists of the following parts:
 
This is further illustrated in the diagram below. At the left is the SRT-107 transmitter with its fixed SRN-58 antenna. In the example it is powered by batteries. The transmitter could be further extended by adding an (optional) receiver module so that it can be ON/OFF controlled remotely.


At the Listening Post (LP), the signal from the SRN-55 antenna is first converted from 1300 MHz to 300 MHz and then fed to an SRR-56 or SRR-91A receiver, which is capable of recovering the masked audio. The output of the receiver is typically fed to a pair of headphones or a recorder.

 
Receivers
Along with the SRT-56 bug, the SRR-56 receiver was developed. It was suitable for the reception of DP-masked bugs. When used in combination with the SRR-145, it can also be used for the reception of the SRT-107.

Some time later, the existing SSR-52 receivers were modified to make them suitable for the reception of DP-masked bugs as well. The image on the right shows the SRR-145 and the SRR-52.

 More about the SRR-52
 More about the SRR-145
  
SRR-52 receiver with SRR-145 down-converter on top

 
Signals from the SRT-107 can be received and demodulated with the following receivers:
 
Surveilance receiver SRR-52 Surveilance receiver SRR-56 Surveilance receiver SRR-91 Surveilance receiver SRR-90-A Surveilance receiver SRR-90-B SRR-145 down-converter

 
Parts
A typical SRT-107 transmitter consists of one or more of the following items:
 
SRT-107 transmitter with built-in video encoder Microphone
Mic
SRN-58 Test cable

 
Transmitter   SRT-107
The transmitter is housed in a 148 mm long cylindrical enclosure with a diameter of 26 mm. It consists of an SRK-145 RF unit and an SWE-56 video encoder, and is in fact the integrated variant of the high-band version of the SRT-56.

The difference with the SRT-56 however, is that the SRT-107 has a built-in isolator [5], which reduces the transmitter's pulling factor, and minimizes the chance of detection by means of a non-linear junction detector (NLJD).

 Look inside the SRT-107
  
SRT-107 transmitter

 
Microphone   Knowles 1501
Although the SRT-107 is suitable for virtually any type of dynamic microphone, it was often used in combination with the small Knowles 1501 reluctance microphone, which measures just 10 x 10 x 5 mm. This might seem rather large by today's standards, but was really state-of-the-art at the time.

The microphone has a frequency range of 400 to 3500 Hz and was also used in military devices, such as headsets, at the time. The Knowles 1501 is also known as BA-1501 and by its National Stock Number NSN 5965-00-015-7408.
  
Knowles BA-1501

 
Antenna   SRN-58
The SRT-107 transmitter comes with a fixed 1500 MHz SRN-58 antenna that is embedded in a plexiglass stick. The stick has the same width as the transmitter itself so that it can be fitted inside the same concealment in a 1 1/8' hole.

The antenna is suitable for the entire 1300 to 1600 MHz range and its dimension have been compensated for the dielectric effects of its plexiglass enclosure.

 More information
  
SRN-58

 
Test cable
Each SRT-107 transmitter was supplied with a test cable that consists of a 6-pin Socapex plug with a teflon coaxial lead plus a read and a black wire. The test cable can be used to check the transmitter in a prescribed test setup, but also for connecting it to an alternative power source.

As the Socapex connectors are sexless, the test cable can be connected directly to the Socapex connector of the transmitter, without the chance of connecting it the wrong way around.
  
Test cable

 
Countermeasures
Detection and discovery of the bug is possible, but is not evident. As far as we know, there are no commercially available surveillance receivers that can readily demodulate an RP-masked signal. Furthermore, existing bug tracers like the Scanlock do not lock onto its signal at all.

Finding and locating the bug is possible with a portable spectrum analyzer, such as the Rohde & Schwarz FSH-3, and with a modern monitoring receiver like the R&S PR-100 shown on the right.

 Read the full story
  
PR-100 portable monitoring receiver and HE-300 anenna

 
Discovery by the Soviets
Despite the fact that the SRT-107 is difficult to detect, it seems likely that eventually the Russians were able to intercept and locate them. At a press conference in Washington on 10 April 1987, the Soviets presented a range of bugging devices that had been found during the past week [2].
 
The image on the right shows the press meeting that day, on which the Soviets had made a real showcase from a variety of bugging devices that had so far never before been seen by the public. On the wall behind the table were several large panels with the actual devices and photographs of the buildings in which they had been found.

Soviet spokesmen explained to the assembled press that these were bugging devices that had recently be found in the walls of their buildings in the US, and that they had most likely been planted there by the Central Intelligence Agency.
  

At the bottom of the second panel, highlighted here with a red circle, are four cylindrical devices that are interconnected by a bunch of wires. Crypto Museum has meanwhile established that this is the high-band version of the SRT-56, which is in fact the predecessor of the SRT-107.

 Read the full analysis

 
Block diagram
The basic operation of the SRT-107 is explained in the block diagram below. At the far left is the microphone pre-amplifier which has a built-in Automatic Gain Control (AGC) and dynamic range compressor. The output of the amplifier is fed to the so-called video-coder. At the far right is the RF oscillator/transmitter which is ON/OFF controlled by the output pulses of the video encoder.


At the center is the video-coder which is responsible for masking the audio signal. It starts with a Pulse Position Modulator (PPM) in which the signal from the audio amplifier is used to modulate the phase of the trigger pulses provided by the clock oscillator. A noise generator is used to randomly reject pulses from the resulting pulse-train, which results in a randomly varying output pulse rate, that resembles a noise pattern, similar to the background noise of a radio channel.

A pulse shaper is present to ensure that the output pulses are of uniform length and amplitude, before they are passed on to the keyer/booster, which turns the RF oscillator ON and OFF at the pulse rate. The booster converts the +5.2V DC supply into -20V pulses, allowing the transmitter to produce a peak power of 200 mW. Due to the noise-resembling pulse pattern, the transmitter produces a masked signal that will defeat demodulation in a non-compatible intercept receiver.

Although the transmitter's RF oscillator is properly matched to the SRN-58 antenna, in practice there will always be reflections of some kind. This the case for example, when the antenna is positioned close to a metal object and a significant amount of the energy is returned to the transmitter where it must be dissipated. In reaction to this, the transmitter will consume more power in order to overcome the returned energy. This may potentially damage the transmitter.


In transmitters like the SRT-107, this is solved by inserting an isolator between the output of the transmitter and the antenna. An isolator is in fact a 3-port circulator of which the return port is connected to ground, as illustrated in the diagram above [5]. In a circulator, the energy is always delivered to the next port. The energy from the transmitter (1) is delivered at the antenna (2), but the energy returned from the antenna (2) is delivered at port (3) which is connected to ground.
 
Interior
The interior of the SRT-107 is not easily accessible, as the entire unit is mounted inside a hermetically sealed brass cylinder that is covered in a strong two-component expoxy paint. Furthermore, the circuits inside the nitrogen-filled cylinder are covered in a conformal coating.
 
Inside the cylinder are six small circular cord­wood 1 building blocks, plus a larger one that contains the RF section (the actual transmitter).

Each of the cordwood structures consist of two circular epoxy PCBs with electronic components fitted inbetween. They are similar in design to the so-called FLYBALL modules that were used by the NSA during the 1950s in cipher machines like the KW-7, KG-13 and HY-2. The image on the right shows the RF section (right) and one of the cordwood modules (left). The remaining five cordwood structures are not shown in the image.
  
Part of the interior of an SRT transmitter

The cordwood structures are connected together by means of flexible and rigid wires between them. Together they form the complete circuit of the SRT-107. The RF section is built around an HP 35831B microwave transistor that was introduced in 1971 as a military OEM component [4].
 
It forms a free-running oscillator that is pulse-driven by the video coder. At the far right is a rather large isolator that is responsible for an optimum matching to the externanal SRN-58 antenna [5]. It also makes the device insensitive to the so-called hand effect 2 , which makes it therefore more difficult to detect its presence.

The image on the right shows the rear side of the RF section, where two capacitive trimmers are visible: a larger one that is used for setting the transmission frequency, and a smaller one for adjusting the optimum antenna loading.
  
Two trimmers at the rear side of the RF section

The bottom of the entire structure consists of a metal disc with 3 hermetic glass feedthroughs, to which the external wires are soldered. After placing the construction inside the outer cylinder, the edges of the disc are soldered hermetically. Through a small hole in the metal disc, the cylinder is later filled (under vacuum) with dry nitrogen, after which the small hole is soldered as well.
 
  1. In a cordwood construction, the electronic components are mounted vertically between two parallel panels or printed circuit boards (PCBs).  Wikipedia
  2. In a free-running oscillator, the resonant frequency will vary when it is aproached by, say, a hand. This so-called hand-effect was often used to locate listening devices (bugs) by observing the frequency shift on a spectrum analyser whilst moving the hand over the suspected area.

Part of the interior of an SRT transmitter Part of the interior with the RF section at the right Rear side of the RF section RF section, with the isolator at the right Two trimmers at the rear side of the RF section Close-up of the first cordwood module Another view of the first cordwood module STR-107 transmitter and part of the interior

 
Manufacturing
Manufacturing of the SRT-107 was a precision task. First of all, the six cordwood modules and the RF-unit had to be built by hand. Once they were assembled, they were mounted together in a frame, for frequency adjustment, calibration, component matching and even customisation.
 
After the assembled unit had passed all tests, it was mounted inside a brass cylinder that was soldered hermetically. A small opening in the bottom was temporarily left open, so that the device could be filled with dry nitrogen under vacuum, using the device shown in the image.

The hole was then closed permanently, after which the complete device was potted in a strong green two-component epoxy. This was done to protect the device from moist and oxidation, enabling it to work for many months or even years, if it was not discovered of course.
  
Vacuum cylinder

 
Vacuum cylinder Vacuum cylinder Lock Shaft in the upper position Shaft in the lower position

 
Technical specifications
  • Supply
    +5.2V DC (max. 6V)
  • Current
    Typically 6.5 mA (max. 8 mA)
  • Frequency
    1300 - 1600 MHz (factory set)
  • Grid
    30 MHz (1305 - 1335 ... 1515 - 1545 MHz)
  • Accuracy
    ± 7.5 MHz at 5.2V DC and 25C
  • Drift
    < 10 MHz (0°C - 60 C)
  • Output
    +24 dBm ±1.5dB peak (~200 mW)
  • Modulation
    Pulse (ON/OFF)
  • Pulse width
    0.5 ± 0.1 S
  • Duty cycle
    1.2 ± 0.35 %
  • Sensitivity
    500 µV RMS into 4000 Ω
  • Response
    300 - 5000 Hz (-3dB)
  • Antenna
    Shortened asymmetrically fed ½λ dipole in dielectric material
  • Impedance
    50 Ω
  • VSWR
    < 2.5 (various environments, air - concrete)
  • Pattern
    Doughnut pattern, vertical polarization
  • Gain
    0 dB omnidirectional
Glossary
ATE   Active Target Element
Active bugging device that has its own power source. Some ATEs can be controlled remotely and some have full masking of its audio signal. Also known as TE.

LP   Listening Post

PPM   Pulse Position Modulation

RP   Rejected Pulse
Audio masking scheme based on the random rejection of pulses produced by a Pulse Position Modulator. This masking scheme is used in the SRT-56 and the SRT-107.
 More

SRT   Surveillance Radio Transmitter
Common abbreviation used by the CIA to identify surveillance transmitters (bugs). Often used as part of the model number.

SRR   Surveillance Radio Receiver
Common abbreviation used by the CIA to identify surveillance receivers. Often used as part of the model number.

TA   Target Area
Generic name for the object under surveillance.

TE   Target Element
Generic name for a bugging device, installed in the Target Area (TA).

Documentation
  1. Operation and Test manual for SRT-107 Transmitter
    July 1974. Confidential. #CM302454

References
  1. Anonymous, SRT-107 transmitter with audio masking
    September 2016.

  2. Newsweek, The Battle of the Bugs
    20 April 1987.

  3. CBS Evening News
    Thursday 9 April 1987.

  4. Hewlett Packard Components, OEM Prices
    November 1971. Page 3.

  5. Wikipedia, Circulator
    Retrieved January 2017.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Sunday 01 January 2017. Last changed: Saturday, 13 May 2017 - 07:20 CET.
Click for homepage