Homepage
Crypto
Spy radio
Burst encoders
Intercept
Covert
Index
Glossary
Cameras
Recorders
Radio
Bugs
Microphones
Concealments
Lock picking
Stories
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Click for homepage
← Easy Chair
  
CIA
NRP
  
SRT-52
Covert listening device with TP audio masking

SRT-52 was a covert listening device (bug), developed in 1964 by the Dutch Radar Laboratory (NRP) for the US Central Intelligence Agency (CIA), as part of a long-term research contract under the name Easy Chair. The device features the Triple Pulse (TP) advanced audio masking scheme. The SRT-52 was part of the SRS-52 family of devices, that also included the SRR-52 receiver.
 
The SRT-52 consisted of two or three cylindrical modules that contained the actual transmitter, the audio masking unit (also known as the video encoder) and an optional power supply unit (PSU). The latter could also be replaced by a set of Mercury batteries for short-term operation.

The transmitter is adjusted at the factory to a spot frequency in the 265-315 MHz 1 range. The image on the right shows a typical SRT-52 set, as used by the CIA. The units can be identified by their typical blue hamerite exterior, although the varnish on some may have faded into green.
  
SRT-52 transmitter consisting of an SRK-29 RF unit, an SWE-52 video coder and an UWP-52 power supply unit

The SRT-52 is very similar to the SRT-56, which was developed around the same time, but uses a different frequency range and a different audio masking scheme. Development of the SRT-52 was started in 1964, with the first prototypes of the transmitter available in May 1967 [A]. The device was in production from 1969 to 1971, after which its TP audio masking scheme was abandoned.
 
  1. At the request of the CIA, some SRT-52 devices could be tuned somewhat outside this range. In addition, it was also possible to use the RF unit of the SRT-56, which provided the 315 - 385 MHz range.

SRT-52 transmitter consisting of an SRK-29 RF unit, an SWE-52 video coder and an UWP-52 power supply unit SRT-52 set Complete SRT-52 kit, with cables and antenna SRT-52 with Sleevex antenna Video encoder connector Video encoder connector SRK-145
×
1 / 7
SRT-52 transmitter consisting of an SRK-29 RF unit, an SWE-52 video coder and an UWP-52 power supply unit
2 / 7
SRT-52 set
3 / 7
Complete SRT-52 kit, with cables and antenna
4 / 7
SRT-52 with Sleevex antenna
5 / 7
Video encoder connector
6 / 7
Video encoder connector
7 / 7
SRK-145

Setup
The individual modules are housed in a cylindrical brass enclosure with a diameter of 26 mm and a length of approx. 65 mm. The modules could be hidden inside a hole of 1 1/8", that was drilled inside, say, a wooden piece of furniture or a window pane. All parts are connected by means of high-quality 6-pin Socapex plugs to a central connector that is part of the video coder's wiring. One side of this central connector is marked SRT, whilst the other side carries the marking UWP.


The image above shows all parts of an SRT-52 target element, except for the microphone, which had to be connected to one of the BNC plugs. If space was limited, the microphone could also be soldered directly to the white teflon coax cable. The small red connectors at the bottom are used for selecting the operating voltage of the transmitter, resulting in a peak output power of either 100 mW or 400 mW, subject to the distance between the bug and the listening post (LP).

 
Versions
  • Standard version (290 MHz)
    The standard version of the SRT-52 operates in the 300 MHz band. In a minimum configuration, it consists of an SRK-29 transmitter and an SWE-52 video coder. When necessary, the SRT-52 could be made to work somewhat outside its frequency range.

  • Alternative version (350 MHz)
    In situations where a higher frequency was required, for example when the SRT-52 caused interference in the reception of TV signals, the electrically compatible SRK-35 RF unit of the SRT-56 was used. It supported a frequency range of 315 to 285 MHz.

  • High-band version (1500 MHz)
    In 1971, the CIA decided to move the operating frequency of their bugs from 300 MHz to the 1500 MHz band. In the SRT-52 this was done by swapping the SRK-29 RF unit for an SRK-145, and replacing the Sleevex antenna by an SRN-58 plexiglass antenna.

Audio masking
To hide the RF carrier and its modulation from regular surveillance receivers, professional bugs often use a special technique that is known as audio masking. The SRT-52 uses a sophisticated masking scheme based on Pulse Position Modulation (PPM), known as Triple Pulse (TP) masking.


This masking scheme is characterised by an AM carrier with a rather large bandwidth (~ 7 MHz) and a multitude of sidebands at either side, caused by the short square-wave pulses, as shown in the diagram above. There are currently no known commercially available surveillance receivers that can readily demodulate an RP-masked signal. Most receivers won't even lock onto the signal.

 More about TP audio masking

 
Receiver
The audio signal transmitted by the SRT-52 is masked with Triple Pulse (TP) audio masking, which defeats all known commercially available surveillance receivers. It's signal can only be demodulated successfully on a TP-compatible receiver, such as the SRR-52 featured below.
 
The SRR-52 was released in January 1969, and covers 240 to 330 MHz in one contiguous range. It has a built-in decoder for recovering the TP-masked signals. As far as we currently know, it is the only receiver that supports TP signals.

In 1972, most of the existing SRR-52 receivers were retrofitted with a modification that made it compatible with the RP audio masking scheme used by the SRT-56 and the DP scheme used by the SRT-91. Furthermore, its frequency range was extended so that it included the SRT-56 frequency band and part of the SRT-91 band.
  
SRR-52 surveillance receiver

The image above shows the SRR-52-M, which is the modified version of the SRR-52. The receiver was built in 1968 and was retrofitted with the modification in 1972, which resulted in an upgrade of the front panel as well. The bright part is the upgraded section, whilst the rest has colourized.

 More about the SRR-52 receiver

 
Countermeasures
Detection and discovery of the bug is possible, but is not evident. As far as we know, there are no commercially available surveillance receivers that can readily demodulate a TP-masked signal. Furthermore, existing bug tracers like the Scanlock do not lock onto its signal at all.

Finding and locating the bug is possible with a portable spectrum analyzer, such as the Rohde & Schwarz FSH-3, and with a modern monitoring receiver like the R&S PR-100 shown on the right.

 Read the full story
  
PR-100 portable monitoring receiver and HE-300 anenna

 
Parts
A complete SRT-52 transmitter consists of one or more of the following items:
 
RF-unit (transmitter)
RF
Video coder (audio masking unit) Power Supply Unit
PSU
Dynamic microphone
Mic
Sleevex antenna Alternative RF-unit (transmitter) for the 1500 MHz band Plexiglass antenna for the 1500 MHz band
RF unit   SRK-29
This is the SRK-29 transmitter 1 that operates on a fixed frequency between 265 and 315 MHz, driven by a pulse shaper, that in turn is driven by extremely short pulses from the video encoder. The pulse shaper ensures that all pulses are of the same amplitude and length (approx. 0.5 µs).

The RF unit is powered by a DC source between +5V and +12V, and consumes between 1.5 and 5.5 mA. It produces a peak output power of 100 to 400 mW. It can be driven by an SWE-52, SWE-56 or SWE-56-C video coder. In 1971, it was replaced by the SRK-145 for use at 1500 MHz.

 Look inside the SRK-29
  
SRK-29 transmitter (RF unit)

 
  1. In SRK-29, the suffix 29 indicates the center of its frequency range, i.e. 290 MHz.

Video encoder   SWE-52
This is the part that converts the analogue audio signal into a masked Pulse Position Modulation (PPM) signal, using the Triple Pulse (TP) audio masking scheme, also known as the 52 scheme.

In this scheme, the audio signal from a dynamic microphone is sampled and converted into a noise-controlled random sequence of pulses that drive the transmitter. Without the video encoder, the RF unit does not transmit a signal.

 More about Triple Pulse audio masking
 Look inside the SWE-52 video encoder
  
SWE-52 video encoder

 
Power supply unit   UWP-52
In situations were the SRT-52 could be powered from the mains, the UWP-52 1 power supply unit (PSU) could be used. Like the RF unit, it is housed in a cylindrical brass enclosure, and is cast in epoxy. Inside the cylinder is a miniature toroid transformer that is suitable for 110V and 220V AC mains networks.

Powering a bug from the mains, virtually gives it an endless life, but increases the chance of discovery. For this reason a QRR-25 switch receiver was sometimes added to the setup.

 More about the PSU
  
UWP-52 mains PSU

 
  1. The UPW-52 is identical to the UWP-56 PSU of the SRT-56 transmitter.

Batteries
In situations where it was not possible to power the SRT-52 from the mains, a series of stacked long-life Mercury cells was sometimes used. Although this reduces the operational life of the bug, it make it's installation a lot easier.

Mercury cells use a reaction between mercuric oxide and zinc electrodes in alkaline electrolite, and deliver 1.35V per cell [2]. When using four stacked cells, the battery provides 5.4V, which remains practically constant during discharge. Due to the presence of toxic elements, mercury batteries are now banned in most countries [2].
  

 
Microphone
Although the SRT-52 can be used with virtually any type of sensitive dynamic microphone, it was commonly used in combination with a Knowles BA-1501 or BA-1502 element.

Measuring just 10 x 10 x 5 mm, it was one of the smallest dynamic microphones available. It has an excellent dynamic behaviour and a good frequency response curve, and was commonly used in military equipment for many years.

 More information
  
Knowles BA-1501

 
Antenna
The SRT-52 was commonly used in combination with a so-called Sleevex antenna, which was also developed by the NRP. Made from a piece of rigid coax cable, Sleevex antennas were available for a variety of frequency ranges.

Furthermore, different types of Sleevex antennas were available for embedding in a variety of environments, such as wood and concrete.

 More information
  
Yellow Sleevex antenna

 
High-band version   SRK-145
In 1971, following a series of studies into the use of the higher frequency bands for covert listening devices, the SRK-145 RF unit was introduced as an alternative for the existing SRK-29 units. It is somewhat shorter than the existing ones, and is normally painted in the same colour as the SRT-52. The one shown here is a laboratory model, which is why it is beige.

The SRK-145 works on a spot frequency in the 1300 - 1600 MHz band and requires the use of the SRN-58 antenna instead of the Sleevex.

 Look inside the SRK-145
  
SRK-145

 
Plexiglass antenna
When the SRK-145 high-band RF unit was used, the Sleevex antenna had to be swapped for the small end-fed vertical dipole shown in the image on the right. The antenna is fore-shorted and is embedded in a plexiglass (perspex) stick that has the same diameter as the SRT-52 modules.

The plexiglass SRN-58 antenna was also used with the high-band version of the SRT-56 and with the later integrated SRT-107 transmitter.

 More information
  
SRN-58 sleeve antenna for 1500 MHz

 
RF unit with cables and connectors SWE-52 video encoder Power supply unit 1500 MHz RF unit (SRK-145) SRK-145 Collection of Sleevex antennas
×
1 / 6
RF unit with cables and connectors
2 / 6
SWE-52 video encoder
3 / 6
Power supply unit
4 / 6
1500 MHz RF unit (SRK-145)
5 / 6
SRK-145
6 / 6
Collection of Sleevex antennas

Interior
Showing the interior of the SRT-52 is difficult, as all of its modules were soldered hermetically. Further­more, the video encoder and the PSU are fully cast in black epoxy, making it impossible to show the interior. Nevertheless we are able to show the interior of some laboratory models below.
 
The standard RF unit SRK-29 is the only module of the set, that is not cast in expoxy, because of the dielectric effects of the material on the RF components. Furthermore, it has to be possible to adjust the transmission frequency from the outside of the case. Instead, the components are protected against moist by a conformal coating.

The image on the right shows the interior of the RF unit of an SRT-52. At the centre is the main oscillator, built around a TR1062 transistor. The transistor is directly coupled to the tuned circuit that determines the bug's operating frequency.
  
Inside the RF unit

The oscillator is keyed by a pulse-shaper that is located at the top of the unit (assuming that the wiring is at the bottom), and is built around a 2N3866 transistor. It is driven by the modulated pulses from the video encoder, and shapes them so that they are of equal length and amplitude.
 
The most complex part of the SRT-52 is without doubt the video coder. It converts the sound that is picked up by the microphone, into a series of seemingly random pulses that are used to key the RF unit. This is known as audio masking.

The video encoder is housed in a brass cylinder, roughly the same size as the transmitter, and contains five electronic circuit blocks, known as cordwood structures. The entire unit is cast in an elastic substance and is fixated inside the brass cylinder at both ends with a strong black epoxy, due to which the SWE-52 cannnot be serviced.
  
SWE-52 video coder (TP audio masking)

For this photograph, we've removed the enclosure from a broken SWE-52 video encoder, so that we can see how it is constructed internally. The five cordwood circuit blocks are clearly visible and are separated by isolated discs, that have cut-outs for the wirings. A long blank wire, running over the full length of the assembly, provides ground (0V) to each of the cordwood modules.
 
The power supply unit (PSU) was initially much longer than the RF unit and the video encoder, but was later redesigned to fit inside the same size enclosure. As the entire PSU is cast in black epoxy, we are unable to show its contents, but from the documentation, its circuits are known.

At the heart of the PSU is a miniature toroid transformer that is connected directly to the mains network. It has separate windings for 110V and 220V AC. It was probably made by the Radio Corporation of America, especially for the UWP-52. It came with an individual test sheet.
  
Miniature toroid transformer

The transformer had to be this small in order to be fitted inside a standard brass cylinder that has an inner diameter of 25 mm. The rest of the PSU's circuit is placed on a single cordwood module.
 
Like the PSU, the battery provides two voltages, in order to allow adjustment of the transmitter's output power between 100 mW and 400 mW.

In 1971, new frequencies in the 1500 MHz band were allocated for covert listening devices, and the SRK-145 module was developed to replace the standard SRK-29 transmitter. The image on the right shows a lab model of the new SRK-145. Due to the higher frequency, the tuned circuit is smaller, as a result of which the entire unit is shorter. The cordwood structure at the right provides the -20V oscillator keying voltage.
  
Inside the SRK-145

The 1500 MHz RF unit was also used as a replacement for the 350 MHz RF-unit of the SRT-56, where it was combined with the SWE-56 video coder. It was later used as the basis for the design of the SRT-107 transmitter, in which the RF unit was integrated with the SWE-56 video coder.
 
Inside the RF unit RF Unit - interior RF unit - interior RF unit - bottom end Transistor detail Tuning section detail Tuning shaft PSU wiring
Miniature toroid transformer Miniature transformer SWE-52 video coder (TP audio masking) Side view SWE-52 SWE-52 video encoder (TP) Inside the SRK-145 Tuned circuit of the SRK-145
-20V keyer for the oscillator Two cordwood structures of an SWE-52 PSU
×
1 / 18
Inside the RF unit
2 / 18
RF Unit - interior
3 / 18
RF unit - interior
4 / 18
RF unit - bottom end
5 / 18
Transistor detail
6 / 18
Tuning section detail
7 / 18
Tuning shaft
8 / 18
PSU wiring
9 / 18
Miniature toroid transformer
10 / 18
Miniature transformer
11 / 18
SWE-52 video coder (TP audio masking)
12 / 18
Side view
13 / 18
SWE-52
14 / 18
SWE-52 video encoder (TP)
15 / 18
Inside the SRK-145
16 / 18
Tuned circuit of the SRK-145
17 / 18
-20V keyer for the oscillator
18 / 18
Two cordwood structures of an SWE-52 PSU

Documentation
  1. Manual for SRT-52 and UWP-52 prototype equipment
    CM302489/A, May 1967.

  2. Operating Manual for SRS-52 Equipment
    CM302489/B, October 1968.

  3. Technical Manual for SRS-52 Equipment
    CM302489/C, October 1968.

  4. Operating Manual for SRS-52 Equipment
    CM302489/D, December 1968.

  5. Technical Manual for SRS-52 Equipment
    CM302489/E, December 1968.

  6. Operating Manual for SRS-52 Equipment
    CM302489/F, January 1969.

  7. Technical Manual for SRS-52 Equipment
    CM302489/G, January 1969.

  8. Operating Manual for SRS-52 Equipment
    CM302489/H, October 1969.

  9. Technical Manual for SRS-52 Equipment
    CM302489/I, October 1969.

References
  1. NRP/CIA, Collection of documents related to SRS-52
    Crypto Museum Archive, CM302489 (see above).

  2. Wikipedia, Mercury battery
    Retrieved, April 2017.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Monday 10 April 2017. Last changed: Monday, 12 June 2017 - 18:23 CET.
Click for homepage