Homepage
Crypto
Spy radio
Burst encoders
Intercept
Index
DF
Receivers
TSCM
Antennas
Scanners
USSR
Mason
Microtel
Minilock
REI
RFT
Rohde & Schwarz
Scanlock
Telefunken
Covert
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Logo (click for homepage)
Scanlock Mark VB
Automatic bug finder

The Scanlock Mark VB is one of the first bug finders developed and built by Audiotel in the UK, shortly after the company was established in 1978. It was the successor to the Scanlock Mark 3, that was previously marketed by Technical Security Ltd. The fully analog receiver automatically searches for hidden bugs within a room, using a novel technique known as a harmonic receiver.
 
The Scanlock Mark VB measures just 33.5 x 22 x 8 cm and looks like a large transistor radio from the 1970s. All controls and a telescopic antenna are located at the front panel. It is powered by a built-in main power supply unit (PSU) or by a large internal rechargeable 16.8 V NiCd battery.

The image on the right shows the receiver in its leather carrying case. It was suitable for finding analogue radio bugs that transmit in Amplitude Modulation (AM), Frequency Modulation (FM) or that are modulated on a sub-carrier (S/C). The latter are the bugs that appear to be silent.
  
Scanlock Mark VB in operation

The Scanlock Mark VB scans the entire frequency spectrum between 10 MHz and 2 GHz in just a few seconds and will automatically lock onto the strongest signal. In areas with strong broadcast transmitters (e.g. commercial radio stations) it might be necessary to move around the room until a point is found where the bug is stronger than the broadcast station. In addition it is possible to tune the Scanlock manually, using the 10-turn frequency adjustment on the control panel.

The Scanlock Mark VB was based on the so-called staircase receiver, developed by Lee Tracey in 1962. Tracey, a former RAF sergeant and MI6 agent, started selling the first Scanlock receivers in London (UK) in 1975 through Technical Security Ltd., at the time a front operation of MI6 [8]. In 1978, Tracey left MI6 and started Audiotel International, with the intend to market the Scanlock.

The Scanlock dominated the bug tracing market in Europe from the late 1970s to the early 1980s. It also became an instant hit in the US, where it was marketed by Technical Services Agency (TSA), a company established by former CIA expert Glenn Whidden. It was used for many years for professional bug sweeping tasks and is featured in Keith Melton's book Ultimate Spy [7].

In the early 1980s, the Scanlock Mark VB was succeeded by the semi-digital Scanlock 2000, that had some extra features and a digital read-out. Nevertheless the Scanlock Mark VB remained popular in the US, not least because of the Compuscan add-on developed by TSA (see below).
 
Scanlock Mark VB in operation Scanlock Mark VB bug finder Using the Scanlock Mark VB straight up Close-up of the control panel Scanlock front panel with headpones connected Connecting an external antenna Original leather carrying case Opening the internal battery compartment

 
Controls
All controls of the Scanlock Mark VB are located at the top panel (or the front panel when it is placed horizontally). At the top left are two buttons for POWER and (battery) CHARGE, plus three indicator LEDs. To the right of these buttons is a wide field strength meter that displays the current (background) level of RF activity. The meter can also be used as a frequency indicator.

Scanlock front panel. Click to take a closer look.

Below the meter are eight push buttons that are used to select the required MODE of operation. The first three buttons are used to select the desired modulation type: AM, FM or subcarrier (S/C). The remaining buttons are for manual tuning and for using a tone when locating a bug.

To the right of the meter are sockets for connecting accessories like headphones and an external (audio) recorder. One socket carries the 2 MHz IF signal that can be used to drive an external spectrum monitor, such as the SM-2 shown below. It allows part of the spectrum to be visualized.
 
Adjusting the frequency manually Close-up of the meter and the buttons Close-up of the telescopic antenna Subcarrier adjustment, volume and manual frequency adjustment Adjusting the frequency manually Clear view of the meter and the push-buttons Connecting an external antenna Using a Magic Wand to search locally

 
Versions
  1. Basic version
    This is the intial version of the Scanlock Mark VB as it is shown at the top of this page. The 8 push-buttons at the bottom left of the control panel all have text printed on them. A red knob to the right of the push-buttons is used for manual subcarrier adjustment. This version has a built-in telescopic antenna and an odometer-style tuning knob.

  2. Modified version for COMPUSCAN
    This version is nearly identical to the above one, but was modified by TSA in the USA for use in combination with the COMPUSCAN unit (see below). A 5-pin DIN socket (for connection to the COMPUSCAN) and a switch have been added to the front panel.


    Furthermore, the red knob is no longer used for subcarrier adjustment but for fine tuning, as indicated by a new label below the knob. This version was built around 1980. It no longer has a built-in telescopic antenna, but has instead an N-socket at the right and a more common multi-turn tuning knob.

  3. COMPUSCAN-ready version
    Once COMPUSCAN had become a successful add-on, also in the UK, the DIN socket and the extra switch were nicely integrated with the rest of the controls on the front panel. The layout of the control panel was changed slightly and the push-buttons no longer have text printed on them. Instead the text was silk-screened on the panel below the switches.


    The red knob is replaced for a black one marked FINE TUNING and has been swapped with the volume control so that it is now aside the TUNING control. This version is known as Scanlock Mark 5B (note that the Roman V has been replaced by '5' on the serial number label). The LED and the jack socket that were previously marked 'LOCK' are now marked 'SQUELCH', which makes more sense as it is linked to the squelch activity (treshold).

Modes of operation
The Scanlock Mark VB can be used in a variety of modes and with various types of modulation, depending on the type of bug, the method of searching and the time available to do the sweep. The following modes are available:
 
  • Automatic mode
    In this mode, the Scanlock searches fully automatically for bugs in the room and locks itself onto the strongest signal that it finds, with a lock sensitivity of 1mV up to 1.5 GHz and a somewhat reduced sensitivity between 1.5 and 2 GHz. In earas with strong broadcast transmitters, it may be necessary to move the receiver around the room whilst searching.

  • Manual mode
    When searching for bugs with an extremely low RF output signal, or in areas with strong broadcasting stations or other sources of interference, it might be useful to conduct a manual search. In manual mode, the Scanlock has a typical sensitivity of -70 dBm up to 1 GHz. In this mode, the frequency can be adjusted by turning the multi-turn knob (with the built-in counter). Furthermore the meter can be used as a frequency indicator.

  • Soundwave mode
    In this mode, the Scanlock emits a continuous (audible) tone, that changes to an intermittent tone when the receiver detects itself (i.e. if it is heared through the bug). This mode should be used as a last resort, as it is likely to alert the eavesdropping party of the fact that a bug-sweep is taking place.

  • Locate mode
    When the LOCATE button is depressed, the Scanlock provides an audible tone with a pitch that is proportional to the strength of the acquired signal. Starting off with a low frequency ticking sound, the pitch gets higher when approaching the bug. In this mode, the use of a pair of headphones is advised, as otherwise the eavesdropping party might become aware of the fact that a bug-sweep is taking place.

Modulation types
The Scanlock Mark VB is suitable for reception of the following types of modulation:
 
  • AM
    This is for bugs that use Amplitude Modulation (AM). Not many bugs are of this type. It is generally used with low-frequency transmitters (below 80 MHz).

  • FM
    This is for the most common type of bugs that use Frequency Modulation (FM). These bugs generally operate at frequencies from 80 MHz onwards. Most of the cheaper commercial and homemade bugs are of this type.

  • NB (Narrow band)
    This mode is suitable for the reception of Narrow Band FM signals. It is only available from the Issue 3 version onwards (i.e. the Compuscan-ready models) and replaces the Manual Subcarrier adjustment described below.

  • Automatic subcarrier (S/C)
    With some of the more sophisticated bugs, the audio is modulated onto a non-audible subcarrier. As a result, the bug appears to be sending a silent carrier, whereas in fact it carries all of the sound it picks up in a room. In this mode, the Scanlock will adjust itself automatically to the required subcarrier frequency.

  • Manual subcarrier (S/C MAN)
    By pressing the red button (S/C MAN), the automatic subcarrier adjustement is turned off. Instead the user can adjust the subcarrier frequency manually with the red knob to the right of the push buttons. This mode is only available on early models of the Scanlock Mark VB. On later models, it has been replaced by the NB mode (Narrow Band).


 
Searching for bugs
Operation of the Scanlock Mark VB is remarkably simple. All you need to do when first scanning a room for potential bugs (sweeping) is to ensure that all buttons are up (out) when the unit is switched on. Next press the FM button to search for the most common type of FM bugs. The Scanlock will now automatically lock onto the strongest signal in its vicinity, as illustrated below:


With the receiver in location A, the Scanlock will probably lock immediately onto a strong broadcast station that is nearby. Such broadcast stations are generally much stronger than a potential bug in the room. When the Scanlock is moved around the room however, it will continue to scan and lock onto the strongest signal. When the receiver is in location B it will intermittently switch between the broadcast station and the bug, but when it is moved closer to the bug (C) the RF signal from the bug will be stronger than the broadcast station and the bug will be heard.
 
Antenna
The Scanlock Mark VB has its own built-in telescopic antenna that is located at the far right of the control panel. When used for automatic bug finding, the telescopic antenna needs to be pulled-up completely. When the receiver is placed horizontally, the antenna needs to be straight up.
 
When not in use, the antenna can be pushed all the way in, until only the tip is visible. Inside the receiver, the antenna is completely shielded so that it can not pick up any spurious signals.

It is now possible to use an external antenna, by installing a special cylindrical adapter over the telescopic antenna. One end of the adapter is hollow and has a spring contact inside. At the other end is a common BNC socket. The adapter is installed by placing the hollow end over the tip of the telescopic antenna and screwing the cylinder into the threaded antenna base.
  
Connecting an external antenna

An external antenna can now be connected to the BNC socket at the top of the adapter. This can be useful for continuously monitoring a room where, say, a meeting is taking place, from an adjacent room without disturbing the attendees. It can also be used to connect a smaller - less sensitive - antenna, such as a magic wand, to search for bugs whilst walking around the room.

Scanlock Mark VB used here with an external 'magic wand' antenna

 
Close-up of the control panel Close-up of the telescopic antenna External antenna adapter Hollow part of the antenna adapter BNC socket at the other end Placing the antenna adapter over the telescopic antenna External antenna adapter installed over the telescopic antenna Connecting an external antenna

 
Power Supply
The Scanlock Mark VB can be powered from two different sources: directly from the 110 or 220 V AC mains, using the built-in power supply unit (PSU), or by the built-in rechargeable 16.8V NiCd battery. At the right side is a socket that accepts a Euro-style mains cable, plus a fuse holder.
 
The battery is 22 x 44 x 293 mm and consists of 14 NiCd cells of 1.2V each, delivering a total of 16.8V and 1.2 Ah. They should be charged for 14 hours with 120 mA. When fully charged, the battery allows 5 to 6 hours of uninterrupted use.

The battery compartment is located below the mains socket, at the bottom of the receiver. It is accessible through a flap in the leather carrying case. After pulling up the door to the battery compartment, it will jump out automatically. A spare battery can be stored in a compartment at the bottom of the leather carrying case.
  
Opening the internal battery compartment

Powering the surviving Scanlock Mark VB receivers from their internal batteries today, will not be easy. Most of these old NiCd cells will be worn out by now or will have started leaking, and it will be difficult (if not impossible) to find suitable replacements. Nevertheless it should be possible to construct a (mechanical) equivalent from modern NiMH or Li-ION cells in a plastic holder.
 
Mains power cord connected Fuse and voltage selector Opening the flap in the carrying case Opening the internal battery compartment Spare battery stored in the bottom of the case Two Scanlock NiCd batteries Broken battery Fully oxidized battery

 
Accessories and add-ons
The Scanlock Mark VB was supplied with a number of accessories, such as a leather carrying case, a spare battery, headphones and an adapter for connecting an external antenna or 'magic wand'. In addition, the US distributor of the Scanlock, Technical Services Agency (TSA), introduced a number of interesting add-ons developed by former CIA technical export Glenn Whidden.
 
Spectrum Monitor
In order to visualize a small section of the frequency spectrum, it was possible to connect an external Panoramic Display or Spectrum Monitor to the scanlock, via the 2MHz IF socket at the front panel. It makes it possible to find small low power bugs operating at a frequency very close to a strong broadcast station.

A suitable Spectrum Monitor (SM-1 and later the SM-2) was developed by Glenn Whidden of TSA.

 More information
  
Glenn Whidden's SM-2 Spectrum Monitor. Click for further information.

 
COMPUSCAN
The COMPUSCAN is a device that can be used in tandem with the Scanlock VB. The operator takes the Scanlock and the COMPUSCAN out to a safe zone, and records the activity on all frequencies, assuming there are no bugs in the safe area.

He would then return to the target site and scan only the frequencies that were not recorded by the Compuscan. This way, one could search only for signals that were different.

 More information
  
Glenn Whidden's COMPUSCAN add-on. Click for further information.

 
Headphones
The Scanlock Mark VB has an internal speaker through which the audio from the intercepted bug can be heared. As this might alert a potential eavesdropping party, it might be better to use a properly isolated pair of headphones, or a small pair of earphones, such as the ones shown here.

The headphones can be connected to the 3.5 mm (mono) jack socket on the control panel.
  
Standard pair of headphones

 
Magic Wand
Although the Scanlock was commonly used with the built-in telescopic antenna, it was also possible to use an external device, such as the so-called 'Magic Wand'. This was a smaller antenna that could be used to search locally, for example by moving around the room.

As the original Magic Wand is missing from our Scanlock, an alternative one is shown in the image on the right. It was taken from a CPM-700 bug finder.
  
Using a Magic Wand to search locally

 
Block diagram
The Scanlock Mark VB is based on Lee Tracey's design of the locking staircase receiver of 1962. As the Mark VB was the first locking receiver of this type that was commercially marketed successfully, it is generally referred to as the original Scanlock, using the following principle:


There is no preselection other than a filter that allows only frequencies above 10 MHz to pass by. The 10 MHz output of the first local oscillator is fed to a so-called comb generator. This is effectively a non-linear junction (i.e. a diode) that causes harmonics of the fundamental frequency to be generated. It produces signals at 10 MHz, 20 MHz, 30 MHz, 40 MHz, etc.

The output of the comb generator is then mixed directly with the antenna signal, resulting in many frequency segments of 10 MHz each, being superimposed on top of each other. The problem of sweeping the entire spectrum between 10 MHz and 4 GHz has now been reduced to sweeping just a single small segement of 10 MHz, by sweeping all superimposed segments simultaneously. By using a sweeping oscillator in the 2nd IF stage, the resulting 10 MHz segments can be swept in less than a second. The receiver locks onto the strongest signal found.

At the output of the 2nd IF stage, a 2 MHz signal is available for further processing. It is fed to the three demodulators (AM, FM and SC), and is also available on a connector at the front of the receiver, to allow the connection of a panoramic display, such as the SM-2 Spectrum Monitor.

In Sound Wave mode (S/W), the speaker produces a continuous 1800 Hz tone. The output of all demodulators (AM, FM, and SC) is checked for this tone by applying it to a sharp 1800 Hz filter. When this particular frequency is detected, the tone is changed into an intermitted one.

Note that frequencies below 10 MHz are not covered by this receiver. Although it is unlikely that bugs operate below 10 MHz, it is possible to use these low frequencies, e.g. when using them as a carrier. The later Scanlock 2000 contained a extra detector to find mains carrier bugs (MC) and the Scanlock ECM even had a separate VLF receiver to cover the 10 kHz to 10 MHz section.
 
Interior
The interior of the Scanlock can be accessed by taking it out of the leather carrying case and removing two screws from the top cover. This allows the top panel to be removed, but it might be necessary to loosen the plastic side panels somewhat first as they may block the top panel.
 
Inside the receiver are two large PCBs, holding the main receiver and the PSU, plus two smaller PCBs for the controls and connections. The first PCB that is visible after removing the top panel is the power supply unit (PSU) which also contains a sophisticated circuit for charging the battery.

The receiver itself (i.e. the main board) is located at the bottom of the case and can only be accessed properly after removing the PSU board. The image on the right shows a close-up of the first mixer of the receiver. Note that the entire unit is built from first class components.
  
Close-up photograph of the mixer section

All PCBs are single sided, suggesting it was a low-volume in-house built product. One has to bear in mind however, that this device was conceived in the late 1970s, when double sided PCBs were not yet commonly available. Also note that the text has been removed from all of the ICs. This was commonly done in those day to prevent a potential competitor from copying the design.
 
Scanlock Mark VB with the top panel removed Rear side of the PSU board Top view of the interior Power supply and battery charger Main board (after removing the PSU) Close-up photograph of the mixer section Another detail of the main board Main board and inter-connections

 
Restoration
Updated 26 January 2014

We have received a Scanlock Mark VB issue 3, which is the COMPUSCAN-ready version, complete with a working COMPUSCAN unit. Unfortunately, the Scanlock has been 'demilitarized' by people who didn't know that this was never a classified item. In the process of 'demilitarization', most ICs have been removed from their sockets and all wiring has been cut and removed. Some of the components have simply been ripped from the PCBs. One IC has been desoldered from the board.


The PSU board is broken into pieces, probably to get access to the main board below it, and even from this board the ICs have been removed. All wires to and from the front panel controls have been cut and removed whenever possible. Luckily, the special TSA Compuscan modification board is still present. It is our goal to restore this unit and, if possible, bring it back to life again.
 
All wires to the front panel cut Wires cut from front panel Bottom view of the front panel PCB TSA Compuscan interface board Damaged PSU board PSU transistors broken off IC's removed from the main board. One IC (at the right) has even been desoldered. Power wires from the transformer cut

Unfortunately, the original circuit diagram of the Scanlock Mark VB is not officially available. At the time it was considered confidential (by the manufacturer) and today the manufacturer no longer has the original circuit diagrams in their archives. Another problem is that in the early days of the Scanlock, the text was often removed from the ICs in order to make it difficult to reverse engineer the design. The diagrams below shows the location of each IC and socket (SK).


Fortunately, we have in the meantime received part of the original circuit diagram of the main board and the PSU [12]. These sheets were hand-drawn and were found in the US in 2012. They were probably made by the original designer of the device. At present we only have sheet 1 to 3, whilst sheet 4 remains missing. For this reason, we have not been able to put the corresponding IC numbers on all of the ICs in the diagram below. The ICs of sheet 4 are therefore marked A-D.


IC-A (CD 4046) is present in the issue 1 and issue 2 version, but is missing from the later issue 3 version. It's position is still present on the main board (which apparently wasn't changed) but it is not assembled. Furthermore, C55 (10 nF) has been cut-out from issue 3 boards. They are both marked in yellow in the drawing above. All ICs are usually socketed and are numbered as follows:
 
IC Type Description Equivalent *
1 LM3900 Quad Norton OpAmp    
2 CA3146 High-Voltage Transistor Array (5 transistors)    
3 CD4060 14-stage ripple-carry binary counter, oscillator HEF4060  
4 ?      
5 CA3089 FM IF Amplifier, Quadrature detector, Squelch, Meter NTE788 1  
6 SN74LS74 Dual D flip-flop    
7 LM3900 Quad Norton OpAmp    
8 LM3900 Quad Norton OpAmp    
9 LM3900 Quad Norton OpAmp    
10 CA2111A FM IF Amplifier, Quadrature detector NTE708
11 NE531 High slew rate OpAmp    
12 MC14011 Quad 2-input NAND Gate HEF4011  
13 LM3900 Quad Norton OpAmp    
A CD4046 PLL HEF4046 3
B NE555 Timer    
C CA741 OpAmp µA741  
D LM384 Audio Power Amplifier    

 
  1. The CA3089 is no longer in production by the original manufacturer, but suitable equivalents are available from after-market manufacturers such as the NTE Electronics NTE788 or the Sylvania ECG788.
  2. The CA2111A is no longer in production by the original manufacturer, but suitable equivalents are available from after-market manufacturers such as the NTE Electronics NTE788 or the Sylvania ECG708.
  3. The CD4046 is present in the early Scanlock Mark VB units (issue 1 and 2), but is not mounted in the later issue 3 version (i.e. the COMPUSCAN-ready version.

The sockets (SK) are numbered as follows:
 
  1. AC
  2. AC
  3. Battery - (GND)
  4. Battery +
  5. Regulated Power (distribution)
  6. ?
  7. Front panel 1 (cable assembly A)
  8. Front panel 2 (cable assembly B)
  9. ?
  10. Antenna (input to main board)
  11. 2 MHz IF (from main board to front panel)
  12. Phones (front)
  13. Lock remote (front) (relay switched squelch output)
  14. Recorder (front)
  15. 2 MHz IF output (front) for Spectrum Monitor
References
  1. Technical Services Agency, Scanlock Mark VB Handbook
    Date unknown.

  2. Technical Services Agency, Inc., Compuscan - Operating Instructions
    The TSA Compuscan for use with Mk Vb Scanlock. December 1983.

  3. Technical Services Agency, Inc., Spectrum Monitor SM-1 Operating Manual
    The TSA Spectrum Monitor for use with the Mk Vb Scanlock. 1980.

  4. Glenn H Whidden, CCP, Counter-Eavesdropping Defence
    Description of the use of the TSA Spectrum Monitor with the Scanlock VB.
    Assets Protection, Volume 5, Number 4, 1980. p.20-23.

  5. Channel 4, The Walls Have Ears
    Fascinating Channel 4 documentary about The Spying Game - The Walls have Ears.
    1999. Via YouTube. Interviews Glenn Whidden, Lee Tracey, Charles Bovill and others.

  6. Technical Services Agency, Inc., The Scanlock Handbook - Scanlock Mark V B
    October 1980.

  7. H. Keith Melton, Ultimate Spy
    ISBN: 0-7513-4791-4. 1996-2002. p. 129.

  8. Lee Tracey, Interview and personal correspondence
    Crypto Museum. 23 May 2013.

  9. Audiotel, Scanlock Mark VB, Quick Start Operating Instructions
    Date unknown.

  10. Audiotel, Scanlock Mark VB, Operating Instructions Manual
    Technical Services Agency, Inc., January 1985.

  11. Audiotel, Scanlock Mark VB, Field Service Manual
    Technical Services Agency, Inc., August 1980.

  12. Glenn Whidden, Scanlock Mark VB circuit diagram
    Date unknown.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Last changed: Tuesday, 18 March 2014 - 12:47 CET.
Click for homepage