Homepage
Crypto
Spy radio
Burst encoders
Intercept
Covert
Index
Glossary
Cameras
Recorders
Radio
Bugs
Microphones
Dead Drop
Lock picking
Stories
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Logo (click for homepage)
IBM Selectric Bug
Operation GUNMAN - how the Soviets bugged IBM typewriters

The Selectric Bug was a sophisticated digital eavesdropping device, developed in the mid-1970s by the Soviet Union (USSR). It was built inside IBM Selectric II and III typewriters [4] and was virtually invisible and undetectable. A total of 16 devices were found inside typewriters that were in use during at least 8 years at the US Embassy in Moscow and the US Consulate in Leningrad. 1
 
The advanced digital bugging device was built inside a hollowed-out metal supporting bar that runs from left to right inside the IBM typewriter. It registered the movements of the print head (ball), by measuring small magnetic disturbances caused by the arms that control the rotation and elevation of the print ball. A typical IBM Selectric II typewriter is shown in the image on the right.

At least five different versions, or generations, of the bug were discovered by the Americans, some of which were powered by a DC battery voltage. Others were powered by the AC mains or both.
  
IBM Selectric II

Furthermore, the devices were remote controlled by the Soviets from outside the building. When the typewriter was turned ON, and the device was activated remotely, it sent its data via radio in short bursts 2 to a nearby listening post. Although there was some ambiguity in the intercepted data, the Soviets were then able to recover the typed plaintext by using the laws of probability.
 
The first Selectric bug was found after a tip from the French, who found a similar implant inside an embassy teleprinter [8]. As the US considered themselves a high-profile target, the Americans launched the covert GUNMAN project, with the aim to find any implants and respond to them.

11 tons of equipment was seized from the US embassy in Moscow and shipped back to the US for analysis by the NSA. Eventually, the implants were found in 16 IBM Selectric typewriters that were used at the US Embassy in Moscow and the US Consulate in Leningrad 1 from 1976 to 1984.
  
The US embassy in Moscow

The bug was fairly large and consisted of state-of-the-art integrated circuits and single-bit core memory. It was completely hidden inside a hollow support bracket at the bottom of the keyboard mechanism, and was invisible to the naked eye, but also to the detection equipment of the era. Only an X-ray scan could reveal the presence of the device, which is shown in the image below. It contains special components to hide its presence even from non-linear junction detectors (NLJD).

The actual bug, mounted inside one of the hollow supporting brackets.

The Selectric Bug can be seen as one of the world's first keystroke loggers. It was the first known attack by the Soviets on a plaintext device instead of a cipher machine. Modern variants of such loggers exist as software (in the same way as a computer virus) and hardware, in the latter case commonly implemented as a small device that is installed between a computer and the keyboard. Both variants are used extensively today by criminals as well as by law enforcement agencies.
 
  1. Leningrad is known today as St. Petersburg.
  2. In order to avoid detection, the data was first stored in a buffer and then sent in short high-speed data bursts in the 30, 60 or 90 MHz radio band. The frequency was chosen close to that of a TV station.

IBM Selectric II with dust cover IBM Selectric II IBM Selectric II with transparent top cover IBM Selectric II front view IBM ball-type print head (golf ball) Ball-type print head Various typefaces and fonts IBM Selectric II interior

 
The GUNMAN Project
The existence of sophisticated Soviet bugs was brought to the attention of the Americans 1 by the French intelligence service, who found a similar bug inside one of the teleprinters at their Moscow embassy in January 1983 [8]. After learning about the bug, LtG. Lincoln Faurer, the Director of the NSA (DIRNSA), sent analysts to examine the implant. The analysts found that the bug represented a major technological improvement over the Soviet's previous efforts. Due to their professional nature and the choice of components, it was thought that there should be more of them around.

As the NSA trusted neither the State Department nor the CIA to handle the matter appropriately, they developed a plan over the next few months, to remove, replace and examine all information processing and telecommunications equipment at the US embassy in Moscow. The highly secret GUNMAN project was approved by President Ronald Reagan in record time in February 1984 [2].
 
During the following months, a list was made of all embassy equipment that had to be replaced. In the meantime, procedures were started for procuring the equipment as fast as possible, without attracting too much attention. About 40% of the equipment was purchased from the original manufacturers, whilst approx. 60% was found at the NSA itself and with other agencies.

The NSA was able to obtain just 50 IBM Selectric typewriters of the 250 that were needed, as IBM had limited stock and 220V models 2 were not available from any European distributor either.
  
The US embassy in Moscow

As a result it was decided to replace only the typewriters that were used in the most sensitive areas of the embassy. All equipment was tested prior to shipment and both the devices and their packaging were provided with tamper-evident measures, to ensure that they were not examined or modified by anyone while on route. During the transport to Moscow, via Dover Air Force Base and a warehouse in Frankfurt (Germany), the shipment was constantly guarded by US personnel.
 
The entire operation was carried out with the utmost secrecy, to avoid alarming the Russians. Even at the NSA itself, it was only known to the people that were directly involved. The cargo was delivered in batches to the US embassy in Moscow in the spring, which was not unusual.

At the embassy, all equipment had to be carried up to the attic by hand, as the Russians had shut down the elevator after the first day of the arrival of the equipment, for 'preventive maintenance'. 3 This involved carrying 10 tons of equipment into the building as well as 11 tons out of it. From the attic is was then distributed over the various offices over the course of the next 10 days. The image on the right shows the rear side of the US embassy in Moscow at the time of the GUNMAN Project. From here the equipment was unloaded.

After the equipment, that was seized from the embassy, had been delivered back at the NSA, again shipped in tamper-evident packaging, the long and tedious process of examining each individual piece of equipment was started. All accountable equipment was searched for bugs with the highest priority in a separate building.
  
Rear view of the US embassy in Moscow at the time of the GUNMAN project [1].

Examples of accountable items are the cipher machines that were used for highly confidential and top secret communication between the embassy and the State Department back in the US. Such machines were normally placed inside a shielded room that was heavily guarded by US Marines.
 
Although it was unlikely that the accountable cipher machines had been bugged by the Soviets, they were put under scrutiny and every single circuit board was removed and x-rayed. The image on the right shows one of the x-ray machines that were used for this job. At the right, an American KW-7 cipher machine is just visible and one of its circuit boards (with the red and yellow parts) is currently under the camera.

The non-accountable items were handled by a separate team with less priority. Again, each item was x-rayed and the resulting images were compared with known standards. As an incentive - probably demonstrating his own impatience - the leader of the team, Walter Deely, offered a US$ 5,000 bonus for the first person to find an eavesdropping device. Then, on the evening of Monday 23 July 1984, technician Michael (Mike) Arneson noticed an anomaly in the power switch of an IBM Selectric typewriter and decided to x-ray the whole machine from top to bottom [3].
  

To his great surprise, he noticed a large number of electronic circuits around the keyboard area and immediately knew he had stumbled upon a bug, but he had to wait until the next day, before this could be confirmed by his colleagues. Consequently, the $5,000 bonus was his. The image below shows part of the original x-ray that showed the bug inside the aluminium support bar.

part of an original x-ray of the bug, made by the NSA.

The six black dots at the lower right in the x-ray, are the magnetometers that picked up the movements of the six modified latch interposers of the keyboard. A full description of how this worked is given below. The black rectangle at the far right is probably the input filter at which the power is fed to the device, via an isolated mounting screw entering the device from the right.
 
The power for the device (approx. 12V DC) was bleeded from the AC mains power line, through a bleeding unit that was built inside the existing power switch. This was the anomaly that Mike Arneson described as a 'ghostly grey' item and that had triggered him to further x-ray the rest of the machine. The image on the right shows a cut-away version of the modified power switch.

The actual bleeding unit is a small foil capacitor which was made by the Russians especially for this purpose. This solution is also used to avoid transformers in low-cost domestic equipment. 4
  
Cut-away of the original modified switch [2]. Original NSA image digitally enhanced by Crypto Museum.

After the discovery, the other IBM Selectric typewriters were checked with the highest priority. Of the 44 machines that had been returned from the embassy in Moscow, 6 contained implants. The bugs were subsequently reverse-engineered by the NSA, and the personnel of other agencies was trained on how to recognize the bugs in the field. As a result, 7 more typewriters in the embassy in Moscow and 3 in the consulate in Leningrad appered to have implants. In total, 16 Soviet bugs were discovered in twelve IBM Selectric II and four IBM Selectric III typewriters in 1984 [2].
 
  1. The NSA report [1][2] does not disclose the foreign ally who found the initial bug and in what kind of equipment it was found. It only states that it was not found inside a typewriter. In [8] however, Alexander Korolkov states that the French found it inside a teleprinter at their Moscow embassy.
  2. As the AC mains voltage in the US (110V/60Hz) is different from the voltage used in the Soviet Union and in the rest of Europe (220V/50Hz), US distributors generally only had 110V/60Hz models in stock.
  3. Due to the adversarial nature of the relationship between the US and the Soviet Union, the Soviets often played games with the Americans by shutting down utilities such as water or electricity.
  4. Bleeding circuits are commonly used today in low-cost domestic appliances, such as coffee machines and toasters, to avoid the use of high-cost transformers and drive a microcontroller directly from the mains.

How it works
When the operator presses a key, the print head of the IBM Selectric is rotated and tilted in such a way that the correct letter appears on the paper. The golf-ball-shaped head has four rows of 22 characters each (or 24 on the later Selectric III). The combination of elevation and rotation angle is unique for each letter on the print head. One half of the type ball is used for the lower case characters, whilst the other half contains the upper case or shifted characters, as shown here:


The system has 4 possible tilt levels; one for each row of 22 characters on the print head. When in shift mode, the print head is rotated by 180°, so that the other hemisphere is in front. For the character immediately in front of the platen, the head does not have to rotate. For the remaining 10 characters, the print head has to rotate between 1 and 5 steps in the positive direction or in the negative direction. Tilt and rotation are controlled by digitally encoded mechanical arms.


The diagram above shows how this works. When a key (blue) is pushed down, its keylever (yellow) pushes down a so-called interposer (orange) that is coded with a unique set of 7 lugs (or gaps) at the bottom. The interposers are different for each key. Once the key is down, the interposer is pushed forward and each lug (when present) pushes one of the 7 selector bails (violet) forward. Six of the bails directly control the movement of the print head. The 7th bail is for special features, such as Shift, Carriage Return and Backspace. It is not intercepted by the Soviet bug.

Each of the 6 activated selector bails then moves its corresponding latch interposer (red) forward as well, which has a direct effect on the tilt or rotation of the print head. The latch interposers were replaced by the Soviets by identically shaped ones that were made of non-magnetizable metal, with a very strong magnet in the font tip (green). The Soviets replaced the comb support bar by a modified one which housed the bug. Working through the aluminium casing of the modified support bar, these magnetic tips actuated the 6 magnetometers 1 inside the bug.


The data from the 6 magnetometers (i.e. 6 bits) was somehow digitally compressed 2 into 4-bit words and then stored in a magnetic-core buffer that could hold up to 8 such 4-bit data words. Once the buffer was full, the data was sent by a low-power transmitter at high speed (burst) to a nearby listening post. The simplified block diagram above is an educated guess of how the bug might have worked, based on the rather limited descriptions found in the NSA report [2].
 
  1. It is currently unknown what kind of magnetometer was used in the Soviet bug. Although it is entirely possible that a semiconductor HALL element was used, it is more likely that a fluxgate-type magnetometer was used, constructed from small ferro-magnetic coils [5].
  2. It is unknown why and how the data was compressed from 6 to 4 bits, and the NSA report [2] is very vague on this point. It is possible that the Soviets used 4-bit logic and had to spread the 6-bit data over more than one 4-bit data word, but it is more likely that they used frequency analysis (see below).

Key interposer
As explained above, the tilt and rotation of the print head (ball) is controlled by the presence or absence of the lugs on the interposer that is mounted below each key of the keyboard. Although there are 8 possible lugs on the interposer, only 6 are used to control the position of the print head: T1, T2, R1, R2, R2A and R5. The 6 lugs control the position of 6 bails, which in turn control the position of the 6 latch interposers. The position of these latch interposers directly controls the tilt and rotation of the print head. Their position is also monitored by the Soviet implant.


The rearmost lug (CK) is reserved for special applications of the typewriter, which leaves us with 6 lugs that control the movement of the print head. Five lugs (T1, T2, R1, R2 and R2A) use negative logic, whilt the remaining one (R5) uses positive logic. Lugs T1 and T2 control the tilt, allowing 4 different vertical positions by using the binary combinations (00, 01, 10 and 11), like this:
 
Lugs Tilt Lugs Tilt
- 3 T2 1
T1 2 T1 + T2 0

Rotation of the print head is slightly more complex and is controlled by the leftmost four lugs: R1, R2, R2A and R5. R1 rotates the head by 1 step in the positive direction. R2 and R2A each rotate the head by 2 steps, whilst R5 rotates it 5 steps in the negative direction (i.e. -5).
 
Lugs Rotation Lugs Rotation
- +5  R5   0  1
R1 +4 R1 + R5 -1
R2 +3 R2 + R5 -2
R1 + R2 +2 R1 + R2 + R5 -3
R2 + R2A +1 R2 + R2A + R5 -4
R1 + R2 + R2A 0 R1 + R2 + R2A + R5 -5
  1. This combination is redundant (i.e. the same as the one at the bottom left). Lug R5 is never used on its own.

 
Missing characters
Note that the bug can only record a character when at least one of the 6 bits is true. As a result, the implant can not read the character with binary code 000000. Furthermore, the bug can not 'see' any of the special keys, like Shift, Space, Backspace, Tab and Carriage Return. Note that the home position of the 6 latch interposers does not correspond to the home position of the print head, as 5 of the 6 interposers use negative logic. As a result, the hyphen (-) can not be sensed.

As it doesn't know when Shift is depressed, the characters at the upper case hemisphere of the print head will be mapped onto those of the lower case hemisphere. Luckily, the upper case characters are at the same relative position on the print head as the lower case ones, just rotated by 180°. Although this will produce some ambiguity in the output, the text will still be readable.


The complete letter mapping is shown above. Note that the hyphen and underscore 1 will be omitted as these correspond to the default position of the interposers. In practice this means that all text will be in lower case, that the hyphen is missing, that interpunction characters may be different and that all special functions, such as space and backspace, are omitted. An example:
Meeting with "Jerry" at Tulip Hotel (room A-23) on 24 November at 10:00meetingwith'jerry'attuliphotel8rooma239on24novemberat10/00
This is not the whole story however. According to the NSA report, the Russians compressed the 6-bit data into a 4-bit frequency select word. Although the report doesn't explain what they mean by this, we can make a few educated guesses. The reason for compressing it into 4-bits, was probably the fact that the Russians only had access to 4-bit digital technology at the time. The problem with 4 bits however, is that each data word has just 16 possible combinations (24).


By examining the frequency of letters in the English language, we see that some letters are used more often than others. If we assign a unique binary combination to the 9 most frequently used letters, and group the others, e.g. as shown in the rightmost histogram above, we need just 15 binary combinations, leaving one for the joint use of interpunction characters. If numbers are also needed, more characters could be grouped to free up additional binary combinations, or they could be mapped on top of the letters. In the example below, we have only used letters:


Although this method of grouping will lead to ambiguity in the recovered data, it will generally be possible to 'guess' which character of a particular group was used, based on probability theory. For example: in the intercept above, the bigram CU (1) is more likely to occur than UC. Likewise, the bigram TU (2) is more common than TC, leaving us with positions (3) and (4) to try manually. In practice this might have been implemented as a manual or a (partially) automated process.
 
  1. Although, the head has to rotate 180° from its home position to print the underscore '_' (which is opposite the hyphen '-'), this is regarded as 'no movement', as the tilt and rotate interposers do not move. The 180° rotation, caused by pressing the Shift key, is controlled by a separate bail that is not monitored by the bug.

Position of the bug
The IBM Selectric is built on a sturdy die-case aluminium frame. The image below shows the bottom of the machine with the frame clearly visible at the lower half. Towards the front is the keyboard, mounted in between two side panels. As part of the structure, an aluminium support bar is mounted between the two side panels. It holds the guide combs for the key interposers.


In the image above, the key interposers are clearly visible, running vertically in the keyboard section. At the left half of the keyboard section are the 6 latch interposers that form the binary representation of the pressed key. The latch interposers control the arms of a so-called Wiffletree mechanism [6], which in turn controls the rotation and tilt of the print head. The front tips of the 6 latch interposers are supported by a black guide mounted on the support bar, as shown here:


The Russians replaced the short black support comb (mounted on the aluminium bar) by a non-magnetizable one. They also replaced the 6 latch interposers by identical ones that had a highly magnetized tip that protrudes the guide comb. The aluminium support bar, on which the various combs are mounted, was replaced by the Russians by a hollowed-out one that contains the bug.

The actual bug, mounted inside one of the hollow supporting brackets.



The images above show the actual bug, mounted inside the hollowed-out support bar made by the Russians, plus a partial x-ray of the device, made by by the NSA when it was discovered. The six circular spots at the lower edge of the x-ray are the magnetometers which are precisely aligned with the magnetic tips of the latch interposers. The transmitter is probably at the far left.


The image above shows the the 6 latch interposers with the x-ray superimposed over the left side of the aluminium support bar. It clearly shows the position of the 6 magnetometers close to the magnetized tips of the latch interposers. As the black support comb was also replaced - by an aluminium one - the magnetometers could 'see' the magnetized tips through the aluminium. As soon as a latch interposer is activated, it engages the associated (invisible) magnetometer.

The Russians must have put a lot of work into producing these bugs. The modified support bar could not be distinguised from the original one, not even by a trained IBM service engineer, and the bug consists of custom-made integrated circuits (ICs) that were sophisticated for the era [2]. This means that it is very likely that they were also planted inside the IBM Selectric typewriters used by other embassies, although at present we have no information to support this claim.
 
IBM Selectric II interior Interior - front view Interior - bottom view Close-up bottom view of the keyboard section Close-up of the latch interposers One of the latch interposers engaged Left side mounting of the bar Right side mounting of the bar

 
Modifications
The Russians made the following modifications to the IBM Selectric typewriters:
 
  • Modified aluminium comb support bar with bug.
  • 6 latch interposers replaced by non-magnetizable ones with strong magnet in the tip.
  • Modified power switch (on some versions).
  • Additional spring lug and screw (left side).
  • Coaxial screw (on some versions).
Planting the bug
The bugs were probably planted inside the IBM Selectric typewriters when the machines were in transit (perhaps in Poland or Moscow itself) awaiting customs inspection prior to their delivery to the US embassy in Moscow. As a general rule, equipment for handling classified information had to be shipped through special courier channels, but some unaccountable equipment, such as the typewriters, were sent via regular channels in a batch of office furniture. The KGB could easily have identified candidate typewriters by finding those with Tempest modifications [3].

It would have taken a trained technician approx. 30 minutes to modify the machine. Including unpacking and repacking, it would have taken them less than one hour, which is not unrealistic. According to NSA and FBI reports [2], the U.S. had taken no precautions against this, such as tamper-evident packaging, nor could they produce the full (service) history of each device as such records were destroyed routinely every 2 years.

The bugs went undetected for several reasons. First of all, because they transmitted their data in very short bursts, which could hardly be picked up. Secondly, because their radio frequency was very close to that of a local TV station. The most important reason however, was the fact that the Americans were using outdated TSCM equipment 1 from the 1950s, which was known to the Russians. Although the Americans did use a non-linear junction detector (NLJD), which is capable of finding electronic circuits even if they are not switched on, the Russians knew this as well, and had taken extra measures to hide the Selectric Bug from NLJDs, such as the Audiotel Broom.

Around the time the bugs were discovered, in 1985, stories surfaced in the press that the signals from the typewriter bugs were picked up by antennas hidden inside the embassy walls, or that they used the machine's power cord to send the data to the KGB via the mains network. Although the NSA report [2] does not state how and where the signals were picked up, these theories seem highly unlikely as the building was thoroughly inspected and the mains lines were filtered.
 
  1. TSCM = Technical Surveillance and Counter Measures.

Radio frequency
Depending on the version of the bug, it used radio frequencies in the 30, 60 or 90 MHz band. In all cases it operated in the same frequency band as a local TV station, using a frequency very close to the actual (strong) TV signal, so that it was hardly detectable by someone monitoring the spectrum. The diagram below shows how this might have been done. The signal is on the air very briefly and can barely be distinguised from the TV-signal's Frequency Modulated (FM) carrier.


 
Missed clues
Since some of the bugs were DC powered, and the Russians wanted to avoid their detection, a low-power burst transmitter was used. Although part of the typewriter's linkage was used as an antenna, the transmitting range was limited by the fact that the entire machine is housed inside a heavy die-cast aluminium enclosure. This means that the listening post must have been in the immediate vicinity of the embassy or, better, the actual office in which the typewriter was used.

It is likely that they earlier versions of the bug had an even shorter range, which might account for the (passive) antenna system that was found in one of the chimneys in the south wing of the US embassy in Moscow in 1978 [3]. The antenna was cut for 60 and 90 MHz but appeared to have no function. It should have caused all alarm bells to go off at the time, but was misinterpreted.

The batteries inside the earlier DC powered bugs, were dated 1976 and 1979, indicating that they probably used the passive antenna system in the chimney, to relay the signal to the nearby Soviet listening post. It is possible that the antenna and the output power of the later AC-versions was improved so that data was delivered directly at the listening post without needing extra antennas.

In 1978, the typewriters at the embassy in Moscow were examined by a TSCM technician, but as he assumed any bugs to be linked to the power line, he only x-rayed the power structure of the machines (i.e. the power cord, the power switch and the start capacitor). As at that time the bugs were still DC-powered, the power switch wasn't modified and the technician found nothing [2].
 
Versions
The Russians kept improving and upgrading their implants throughout the years. After reverse-engineering the implants, the NSA was able to identify five different versions or generations of the bug [2]. Three types were powered by batteries (DC) and contained 8, 9 or 10 batteries. The image below shows an early type of the bug, with the batteries clearly visible at the top right.

Early DC-powered version of the bug

The two other types were powered from the AC mains and had sensors to determine whether the typewriter was turned ON or OFF. Some of the units also had a modified ON/OFF switch with a separate transformer that powered the implant directly. Other implants had a special coaxial screw with a spring and lug, allowing another metal part of the typewriter to be used as antenna.

Later AC-powered version of the bug

Later battery-powered versions had a test point underneath an end screw at one of the side panels. After removing the screw and inserting an isolated probe, it was possible to measure the battery voltage and determine whether the the device still had sufficient power for operation.

Depending on the version, the devices worked in the 30, 60 or 90 MHz frequency band, with their frequency always chosen to be close to an existing (strong) TV station. As a result, the short weak data burst was hardly noticable in the 'noise' of the FM modulated SECAM TV carrier, and would certainly be missed by the spectrum analyzers that were used by the Americans at the time.
 
Moscow
Supply date Qty Selectric Version Power Remark
October 1976 1 II 1 DC  
April 1977 2 II 1 DC  
November 1977 1 II 2 AC  
February 1982 5 II 3 AC more advanced
January 1984 4 III 5 AC more advanced

 
Leningrad
Supply date Qty Selectric Version Power Remark
April 1977 2 II 1 DC  
March 1982 1 II 4 DC more advanced

 
IBM Selectric
Although electric typewriters were already being built before WWII, it was only from the early 1960s onwards that they became mainstream in offices. The IBM Selectric typewriter [4] was invented in 1961 and dominated the professional office market for the next 20 years. It used a novel principle with a removable print head (the 'ball') that allowed the use of various typefaces.

IBM Selectric II (1971-1981)

The first IBM Selectric was introduced on 31 July 1961 and used a type ball with 88 characters divided over 4 rows. It was followed in 1971 by the improved Selectric II, shown in the image above. After this, the old Selectric was commonly called Selectric I. It used the same 88 character print head. The Selectric II was followed in 1973 by the Correcting Selectric II which, as the name suggests, had a text correction facility. In the early 1980s, it was succeeded by the Selectric III, which featured a 96 character print head. This was the last machine with a golf ball made by IBM.
 
IBM Selectric II with dust cover IBM Selectric II IBM Selectric II with transparent top cover IBM Selectric II front view IBM ball-type print head (golf ball) Ball-type print head Various typefaces and fonts IBM Selectric II interior

 
Instructional videos
Below are a couple of videos that may help to get a better understanding of how the IBM Selectric works. The first video demonstrates how Whiffletree mechanisms (also known as Wippletree) [6] are used to rotate and tilt the ball-type print head by means of mechanically binary coded bits.
 

The next video is rather slow pace and is part of a series of training videos that were issued by IBM in the late 1970s. They were used by service personnel and repairmen to get a proper under­standing of this highly complex electromechanical machine and its systems of interposers [9].
 

For those of you who own an IBM Selectric and want to know how to quikly diassemble it, here is a step-by-step guide on how to take it apart, made by Fran Blance, who also gives some useful tips on proper maintenance and restoration of the machine [10].
 

 
Other websites on this subject

Documentation
  1. IBM, Correcting Selectric III and Selectric III Typewriters Operating Instructions
    © Copyright IBM, 1979, 1985.

  2. IBM, Customer Engineering Manual of Instruction
    Selectric I/O Keyboard Printer. 1964. More useful documentation and manuals here...

  3. R.L. Summers, Troubleshooting the IBM Selectric Typewriter
    Santa Ana. California, USA. 1976, revision 1981.

References
  1. Sharon A. Maneki, Learning from the Enemy: The GUNMAN Project
    National Security Agency (NSA), 2012. Retrieved October 2015.

  2. Sharon A. Maneki, Learning from the Enemy: The GUNMAN Project
    United States Cryptologic History, Series VI, Volume 13. NSA, 8 January 2007. 1

  3. Thomas R. Johnson, American Cryptology during the Cold War, 1945-1989, Volume IV
    NSA. Book IV: Cryptologic Rebirth, 1981-1989. 24 February 1998. pp. 402-406. 2

  4. Wikipedia, IBM Selectric typewriter
    Retrieved October 2015.

  5. Wikipedia, Magnetometer
    Retrieved October 2015.

  6. Wikipedia, Whippletree (mechanism)
    Also known as 'Whiffletree'. Retrieved October 2015.

  7. Wikipedia, Letter frequency
    Retrieved October 2015.

  8. Alexander Korolkov, Big ears of the USSR: The top 5 Soviet wiretaps during the Cold War
    Russia Beyond the Headlines (website). 30 January 2015. Retrieved October 2015.

  9. User 'Daderot', Image of IBM Selectric II and photograph of bug
    Via Wikipedia. Retrieved October 2015.

  10. Joachim Doebers, Selectric Repair 10 3A Input: Keyboard
    Los Angeles (CA, USA), 1978. Via YouTube user 'Brian Brumfield'. Retrieved October 2015.

  11. Fran Blance, How to take apart and service the IBM Selectric II Typewriter
    Via YouTube. Retrieved October 2015.

  1. Partly declassified by NSA on 12 January 2011 (EO 13526).
  2. Approved for release by NSA on 14 January 2011, FIOA Case #54492.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 14 October 2015. Last changed: Wednesday, 22 June 2016 - 06:00 CET.
Click for homepage