Homepage
Crypto
Spy radio
Burst encoders
Intercept
Index
DF
Receivers
TSCM
Antennas
Scanners
USSR
Mason
Microtel
Minilock
REI
RFT
Rohde & Schwarz
Scanlock
Telefunken
Covert
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Logo (click for homepage)
Scanlock 2000
Automatic bug finder

Scanlock 2000 was a TSCM receiver (bug finder), developed and built by Audiotel Ltd. in Corby (UK) in 1984 as the successor to the highly acclaimed Scanlock Mark VB. It is based on the same design but features a wider frequency range and simplified controls. Furthermore it had a digital readout and a LED-based field strength meter. The design was based on the original Scanlock, invented by Lee Tracey in the early 1960s. It was succeeded in 1990 by the Scanlock ECM.
 
The unit is housed in a metal case and measures 33.5 x 22 x 8 cm, the same as its predecessor. It looks like an ordinary portable transistor radio and was usually delivered in a leather carrying bag with a spare battery in a compartment at the bottom. It could also be used outside the case on the shoulder, as it has its own carrying strap.

All controls and connections are located at the front panel, except for the mains power socket that is located at the right side. The unit can be powered from the mains or by the built in 16.8V NiCd battery that is charged from the mains.
  
Scanlock 2000 with antenna

Compared to its predecessor, the Scanlock Mark VB, it had a better build quality with double-sided PCBs, a fully metal case (the Mark VB had plastic side panels), a simplified control panel, a wider frequency range (up to 4 GHz) and the ability to find power line bugs (mains carrier). The built-in telescopic antenna has been replaced by a N-type socket, which has helped expanding the frequency range. Apart from these differences the main principle has been left unchanged.

The Scanlock 2000 can scan the entire frequency range between 10 MHz and 4 GHz in just a few seconds and will automatically lock onto the strongest signal. When a bug is turned on, the Scanlock will lock virtually instantly if the bug is within its range. In areas with strong broadcast transmitters it might be necessary to move around the room in order to find bugs that appear to be weaker than the broadcast station(s). In addition it is possible to tune the Scanlock manually, using the 10-turn frequency adjustment on the control panel, and the LCD as an indicator.

Strangely, the Scanlock 2000 is lacking a connector for the COMPUSCAN, something that was present on later versions of the Scanlock Mark VB. For that reason, the Scanlock Mark VB was kept in production for the US market for several more years, whilst the Scanlock 2000 was the mainstream product on the European market. It was replaced in 1990 by the Scanlock ECM.
 
Scanlock 2000 with antenna Scanlock 2000 with carrying strap All controls and connections on a single panel Antenna socket (N-connector) Connections and adjustments Manual tuning MODE selectors (push-buttons) Field strength indicator (LED bar) and LCD

 
Controls
All controls of the Scanlock 2000 are at the front panel (or the top panel when it is used in the upright position). At the left are eight Digitast push-buttons that are used to select the current mode of operation and the type of modulation. Each MODE-switch has its own red LED. To the right of these buttons is a field strength meter consisting of green, yellow and red LEDs, and a digital tuning indicator. Note that this display doesn not shows the current frequency (as it wouldn't make sense anyway), but rather a number that is related to the internal tuning voltage.


The right half of the control panel contains the connections and the manual adjustments. At the top right is the N-socket for connection of a telescopic antenna, or an external antenna connected via a coax cable. The switches at the bottom right are for power and charging.
 
Modes of operation
The Scanlock ECM can be used in a variety of modes and with various types of modulation, depending on the type of bug, the method of searching and the time available to do the sweep. The following modes are available:
 
  • Automatic mode
    In this mode, the Scanlock searches fully automatically for bugs in the room and locks itself onto the strongest signal that it finds, with a lock sensitivity of 1mV up to 2 GHz and a somewhat reduced sensitivity between 2 and 4 GHz. In earas with strong broadcast transmitters, it may be necessary to move the receiver around the room whilst searching.

  • Manual mode
    When searching for bugs with an extremely low RF output signal, or in areas with strong broadcasting stations or other sources of interference, it might be useful to conduct a manual search. In manual mode, the Scanlock has a typical sensitivity of -70 dBm up to 2 GHz. In this mode, the frequency can be adjusted by turning the multi-turn knob (with the built-in counter). Furthermore the meter can be used as a frequency indicator.

  • Soundwave mode
    In this mode, the Scanlock emits a continuous (audible) tone, that changes to an intermittent tone when the receiver detects itself (i.e. if it is heared through the bug). This mode should be used as a last resort, as it is likely to alert the eavesdropping party of the fact that a bug-sweep is taking place.

  • Locate mode
    When the LOCATE button is depressed, the Scanlock provides an audible tone with a pitch that is proportional to the strength of the acquired signal. Starting off with a low frequency ticking sound, the pitch gets higher when approaching the bug. In this mode, the use of a pair of headphones is advised, as otherwise the eavesdropping party might become aware of the fact that a bug-sweep is taking place.

  • Power line mode
    When pressing the MC button, the Scanlock 2000 is capable of detecting power line bugs (mains carrier bugs). For this it is necessary that the Scanlock 2000 is powered by the mains that is checked, as it uses its own power connection as 'antenna'. If there are any power line intercoms or PLC modems in the building, you will probably hear them immediately. In this mode, the rest of the Scanlock receiver is unused and the field strength meter will be off. Note that an MC check has to be carried out on all wall sockets, as some of them may be powered from a different phase.

Modulation types
The Scanlock 2000 is suitable for reception of the following types of modulation:
 
  • AM
    This is for bugs that use Amplitude Modulation (AM). Not many bugs are of this type. It is generally used with low-frequency transmitters (below 80 MHz).

  • FM
    This is for the most common type of bugs that use Frequency Modulation (FM). These bugs generally operate at frequencies from 80 MHz onwards. Most of the cheaper commercial and homemade bugs are of this type.

  • Subcarrier (SC)
    With some of the more sophisticated bugs, the audio is modulated onto a non-audible subcarrier. As a result, the bug appears to be sending a silent carrier, whereas in fact it carries all of the sound it picks up in a room. In this mode, the Scanlock will adjust itself automatically to the required subcarrier frequency.  More information

  • Mains Carrier (MC)
    This setting checks the incoming mains power supply for so-called power line bugs. In this mode the entire receiver is bypassed and the field strength meter is not used either.

Searching for radio bugs
Operation of the Scanlock 2000 is remarkably simple. All you need to do when first scanning a room for potential bugs (sweeping) is to turn on the receiver and select FM to search for the most common type of FM radio bugs. The Scanlock will now automatically lock onto the strongest signal in its vicinity, as illustrated below:


With the receiver in location A, the Scanlock will probably lock immediately onto a strong broadcast station that is nearby. Such broadcast stations are generally much stronger than a potential bug in the room. When the Scanlock is moved around the room however, it will continue to scan and lock onto the strongest signal. When the receiver is in location B it will intermittently switch between the broadcast station and the bug, but when it is moved closer to the bug (C) the RF signal from the bug will be stronger than the broadcast station and the bug will be heard.
 
Searching for power line bugs
The Scanlock 2000 can also be used for finding power line bugs. Such bugs use the mains power line as their transmission medium and generally operate between 25 kHz and 260 kHz. Especially for these type of bugs, Scanlock 2000 has a built-in Mains Carrier (MC) demodulator. For this to work, the Scanlock 2000 has be powered from the mains, rather than from the internal batteries. Searching requires all wall sockets to be checked. Let us consider the following example:

Example of a power line bug hidden in a room

In this case, a power line bug is mounted inside a wall socket at the bottom right (A). As this wall socket is connected to the R-phase of the house's mains network, it can not be detected from the wall socket at location B, which is connected to the T-phase. Wall socket C however, will yield a positive detection as it is connected to the same phase as the bug.
 
Power Supply
The Scanlock 2000 can be powered from two different sources: directly from the 110 or 220 V AC mains, using the built-in power supply unit (PSU), or by the built-in rechargeable 16.8V NiCd battery. At the right side is a socket that accepts a Euro-style mains cable, plus a fuse holder.
 
The battery is 22 x 44 x 293 mm and consists of 14 NiCd cells of 1.2V each, delivering a total of 16.8V and 1.2 Ah. They should be charged for 14 hours with 120 mA. When fully charged, the battery allows 5 to 6 hours of uninterrupted use.

The battery compartment is located below the mains socket, at the bottom of the receiver. It is accessible through a flap in the leather carrying case. After removing the panel of the battery compartment, the battery can be removed. A spare battery can be stored in a compartment at the bottom of the leather carrying case.
  
Inserting the battery

Powering the surviving Scanlock 2000 receivers from their internal batteries today, will not be easy. Most of these old NiCd cells will be worn out by now or will have started leaking, and it will be difficult (if not impossible) to find suitable replacements. Nevertheless it should be possible to construct a (mechanical) equivalent from modern NiMH or Li-ION cells in a plastic holder.
 
Scanlock 2000 operated from the mains Mains power socket Connected to the mains Inserting the battery Battery half-way in the battery compartment Two Scanlock NiCd batteries Broken battery Fully oxidized battery

 
Accessories and add-ons
The Scanlock 2000 was usually supplied with a number of accessories, such as a leather carrying case, a spare battery, a pair of headphones, an external telescopic antenna and a so-called 'Magic Wand'. In addition, some third party accessories could be used as well. Some examples:
 
Spectrum Monitor
In order to visualize a small section of the frequency spectrum, it was possible to connect an external Panoramic Display or Spectrum Monitor to the scanlock, via the 2MHz IF socket at the front panel. It makes it possible to find small low power bugs operating at a frequency very close to a strong broadcast station.

A suitable Spectrum Monitor (SM-1 and later the SM-2) was developed by Glenn Whidden of TSA.

 More information
  
Glenn Whidden's SM-2 Spectrum Monitor. Click for further information.

 
Headphones
The Scanlock 2000 has an internal speaker through which the audio from the intercepted bug can be heared. As this might alert a potential eavesdropping party, it might be better to use a properly isolated pair of headphones, or a small pair of earphones, such as the ones shown here.

The headphones can be connected to the 3.5 mm (mono) jack socket on the control panel.
  
Standard pair of headphones

 
Magic Wand
Although the Scanlock was commonly used with the built-in telescopic antenna, it was also possible to use an external device, such as the so-called 'Magic Wand'. This was a smaller antenna that could be used to search locally, for example by moving around the room.

As the original Magic Wand is missing from our Scanlock, an alternative one is shown in the image on the right. It was taken from a CPM-700 bug finder.
  
Using a Magic Wand to search locally

 
Power line bug
For training purposes, Audiotel created the simple MCX Power Line Bug, that is shown in the image on the right. It consists of a small PCB that is powered from the mains. A sensitive microphone picks any sound, and the modulator injects the signal back onto the mains.

 More information
  
Interior of the SL-MCX power line bug

 
Block diagram
The Scanlock 2000 is largely based on the design of the Scanlock Mark VB. Despite the digitast buttons and the digital readout on the control panel, the Scanlock 2000 is a fully analog device. In order to understand its operation, we need to consider the block diagram below:

Scanlock 2000 block diagram

There is no preselection other than a filter that allows only frequencies above 10 MHz to pass by. The 10 MHz output of the first local oscillator is fed to a so-called comb generator. This is effectively a non-linear junction (i.e. a diode) that causes harmonics of the fundamental frequency to be generated. It produces signals at 10 MHz, 20 MHz, 30 MHz, 40 MHz, etc.

The output of the comb generator is then mixed directly with the antenna signal, resulting in many frequency segments of 10 MHz each, being superimposed on top of each other. The problem of sweeping the entire spectrum between 10 MHz and 4 GHz has now been reduced to sweeping just a single small segement of 10 MHz, by sweeping all superimposed segments simultaneously. By using a sweeping oscillator in the 2nd IF stage, the resulting 10 MHz segments can be swept in less than a second. The receiver locks onto the strongest signal found.

At the output of the 2nd IF stage, a 2 MHz signal is available for further processing. It is fed to the three demodulators (AM, FM and SC), and is also available on a connector at the front of the receiver, to allow the connection of a panoramic display, such as the SM-2 Spectrum Monitor.

In Sound Wave mode (S/W), the speaker produces a continuous 1800 Hz tone. The output of all demodulators (AM, FM, SC and MC) is checked for this tone by applying it to a sharp 1800 Hz filter. When this particular frequency is detected, the tone is changed into an intermitted one.

Compared to the earlier Scanlock Mark VB, has an additional detector for finding mains carrier bugs (MC). Such bugs generally use an LF signal (e.g. 120 kHz) to carry the audio signal over a pair of mains wires. The MC decoder is connected directly to the mains. This method has its drawbacks as it only checks the Live and Neutral wires of the mains and not the Earth. Furthermore it can not be used to check other types of cables, such as telephone lines. These problems were overcome in the later Scanlock ECM, which had a separate receiver for frequencies below 10 MHz and used an external LF interface for the 3-wire mains and other types of cables.
 
Interior
The interior of the Scanlock 2000 can be accessed by removing the top panel that is held in place by four bolts at the top and one at the right side. The Power Supply Unit (PSU) is mounted on the inside of the top panel and is wired to the rest of the receiver, so care has to be taken here.
 
The main board of the Scanlock is mounted at the bottom of the case. The professionally made double sided PCB has all components mounted on the top side. It is shown in the image on the right. The circuit in the upper right corner is the first mixer that produces the 0-10 MHz signal.

The PSU is on a separate board mounted on the inside of the top panel, together with the mains transformer and the battery charge circuit. The front panel consists of two sandwiched PCBs that are connected to the main board and the PCB by means of three removable (socketed) flatcables.
  
Main OCB mounted at the bottom

Compared to the earlier Scanlock Mark VB, the construction of the case and the PCBs of the Scanlock 2000 is much better, although the design of the circuit and its operation is nearly identical. Furthermore, the text is no longer removed from the ICs as a copy protection.
 
Scanlock 2000 interior Power Supply Unit Main OCB mounted at the bottom Main board (top view) Close-up of the first mixer Empty socket in the corner of the main board Speaker, mounted at the left side panel

 
Documentation
  1. Audiotel Ltd, Scanlock 2000 Operator's Manual
    September 1984. Issue 3.

  2. Audiotel Ltd, Scanlock 2000 Operator's Manual
    Copyright 1984. Issue 3. December 1988.

  3. Technical Services Agency, Inc., Spectrum Monitor SM-1 Operating Manual
    The TSA Spectrum Monitor for use with the Mk Vb Scanlock. 1980.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 28 March 2012. Last changed: Wednesday, 12 April 2017 - 09:45 CET.
Click for homepage