|
|
|
|
|
|
|
← Easy Chair CIA NRP
The SRT-107 consists of a fairly large cylindrical transmitter and a partly
transparent SRN-58 antenna.
The two parts are connected via a 25 cm fixed
coaxial cable. A power source and a suitable microphone should be connected
to the flying lead with a 5-pin connector at the end.
Contrary to early Easy Chair bugs,
the SRT-107 is a so-called active target element (ATE),
which means that it is powered locally from batteries,
the mains or via a telephone line.
The device operates in the 1500 MHz band
and features a very sophisticated novel
audio masking scheme.
|
|
|
The unit is powered by an external 5.2V DC source and consumes typically
6.5 mA when in full operation. Yet it delivers an output power of 200 mW, due
to the fact that it uses Pulse Position Modulation (PPM). Speech information
is masked
by using a noise generator to randomly
reject some of the pulses,
as a result of which the transmitter appears to be producing random noise.
|
The diagram below shows a typical SRT-107 unit, without an external microphone.
At the right is the actual transmitter which is housed in a hermetically
sealed brass cylinder, that is covered in a strong (green) two-component epoxy
paint. Inside the cylinder is a fairly large RF section plus six so-called cordwoord modules that contain the electronic circuits. At the bottom of the
cylinder is an endplate with three hermetic glass feedthroughs to which the
cables are connected. In order to protect the internal circuits against
corrosion, the cylinder has been filled with dry nitrogen.
At the top is the SRN-58 antenna
which is connected to the transmitter by means of a fixed 25 cm long
teflon coax cable. It consists of two brass pipes that form an end-fed
1/2λ dipole with vertical polarization. The antenna is cast in a
solid 26 mm thick transparent epoxy cylinder. The dimensions of the antenna
have been compensated for the dielectric effects (εr)
of the cylinder.
A flying lead is provided for connection of a power source and an external
microphone. At the end of the flying lead is a 5-pin quick-release connector
for testing and installation.
The unit is powered by a 5.2V DC source and consumes approx.
6.5 mA when in full operation. It provides a peak output power of 200 mW.
A recommended miniature microphone is the Knowles 1501.
|
|
A complete setup typically consists of the following parts:
|
This is further illustrated in the diagram below. At the left is the
SRT-107 transmitter with its fixed SRN-58 antenna. In the example it is
powered by batteries. The transmitter could be further extended by adding
an (optional) receiver module so that it can be ON/OFF controlled remotely.
At the Listening Post (LP), the signal from the SRN-55 antenna is first
converted from 1300 MHz to 300 MHz and then fed to an SRR-56 or
SRR-91A receiver, which is capable of recovering the
masked audio. The output
of the receiver is typically fed to a pair of headphones or a recorder.
|
|
A typical SRT-107 transmitter consists of one or more of the following items:
|
The transmitter is housed in a 148 mm long cylindrical enclosure
with a diameter of 26 mm. It consists of an SRK-145 RF unit and an SWE-56
video encoder, and is in fact the integrated variant of the high-band
version of the SRT-56.
The difference with the SRT-56 however, is that the SRT-107 has a built-in
isolator [5], which reduces the transmitter's pulling factor,
and minimizes the chance of detection by means of a
non-linear junction detector (NLJD).
➤ Look inside the SRT-107
|
|
|
Although the SRT-107 is suitable for virtually any type of dynamic microphone,
it was often used in combination with the small
Knowles 1501 reluctance microphone,
which measures just 10 x 10 x 5 mm. This might seem rather
large by today's standards, but was really state-of-the-art at the time.
The microphone has a frequency range of 400 to 3500 Hz and was also used
in military devices, such as headsets, at the time.
The Knowles 1501 is also known as BA-1501 and by its National Stock Number
NSN 5965-00-015-7408.
|
|
|
The SRT-107 transmitter comes with a fixed 1500 MHz SRN-58 antenna that is
embedded in a plexiglass stick. The stick has the same width as the
transmitter itself so that it can be fitted inside the same concealment
in a 1 1/8' hole.
The antenna is suitable for the entire 1300 to 1600 MHz range and its
dimension have been compensated for the dielectric effects of its
plexiglass enclosure.
➤ More information
|
|
|
Each SRT-107 transmitter was supplied with a test cable that consists
of a 6-pin Socapex plug with a teflon coaxial lead plus a read and a black
wire. The test cable can be used to check the transmitter in a prescribed
test setup, but also for connecting it to an alternative
power source.
As the Socapex connectors are sexless, the test cable can be connected
directly to the Socapex connector of the transmitter, without the chance of
connecting it the wrong way around.
|
|
|
Detection and discovery of the bug is possible, but is not evident.
As far as we know, there are no commercially available
surveillance receivers that can readily
demodulate an RP-masked signal. Furthermore, existing bug tracers like the
Scanlock
do not lock onto its signal at all.
Finding and locating the bug is possible with a portable spectrum analyzer,
such as the
Rohde & Schwarz FSH-3,
and with a modern monitoring receiver like
the R&S PR-100 shown on the right.
➤ Read the full story
|
|
|
|
Despite the fact that the SRT-107 is difficult to detect, it seems likely
that eventually the Russians were able to intercept and locate them.
At a press conference in Washington on 10 April 1987, the Soviets presented
a range of bugging devices that had been found during the past week [2].
|
The image on the right shows the press meeting that day, on which
the Soviets had made a real showcase from a variety of bugging devices that
had so far never before been seen by the public. On the wall behind the table
were several large panels with the actual devices and photographs of the
buildings in which they had been found.
Soviet spokesmen explained to the assembled press that these were bugging
devices that had recently be found in the walls of their buildings in the US,
and that they had most likely been planted there by the
Central Intelligence Agency.
|
|
|
At the bottom of the second panel, highlighted here with a red circle, are
four cylindrical devices that are interconnected by a bunch of wires.
Crypto Museum has meanwhile established that this is the
high-band version of the SRT-56,
which is in fact the predecessor of the SRT-107.
➤ Read the full analysis
|
The basic operation of the SRT-107 is explained in the block diagram below.
At the far left is the microphone pre-amplifier which has a built-in Automatic
Gain Control (AGC) and dynamic range compressor. The output of the amplifier
is fed to the so-called video-coder. At the far right is the RF
oscillator/transmitter which is ON/OFF controlled by the output pulses
of the video encoder.
At the center is the video-coder which is responsible for
masking the audio signal.
It starts with a Pulse Position Modulator (PPM) in which the signal
from the audio amplifier is used to modulate the phase of the trigger pulses
provided by the clock oscillator. A noise generator is used to
randomly reject pulses from the resulting pulse-train, which results in a
randomly varying output pulse rate, that resembles a noise pattern, similar
to the background noise of a radio channel.
A pulse shaper is present to ensure that the output pulses are of uniform
length and amplitude, before they are passed on to the keyer/booster, which
turns the RF oscillator ON and OFF at the pulse rate. The booster converts
the +5.2V DC supply into -20V pulses, allowing the transmitter to produce
a peak power of 200 mW. Due to the noise-resembling pulse pattern,
the transmitter produces a masked signal
that will defeat demodulation in a non-compatible intercept receiver.
Although the transmitter's RF oscillator is properly matched to the
SRN-58 antenna,
in practice there will always be reflections of some kind.
This the case for example, when the antenna is positioned close to a metal
object and a significant amount of the energy is returned to the transmitter
where it must be dissipated. In reaction to this, the transmitter will
consume more power in order to overcome the returned energy.
This may potentially damage the transmitter.
In transmitters like the SRT-107,
this is solved by inserting an
isolator
between the output of the
transmitter and the antenna. An isolator is in fact a 3-port
circulator of which the return port is connected to ground, as illustrated
in the diagram above [5]. In a circulator, the energy is always delivered to
the next port. The energy from the transmitter (1) is delivered at the antenna
(2), but the energy returned from the antenna (2) is delivered at port (3)
which is connected to ground.
|
A second – probably more important – reason for using an isolator in
the antenna line of the SRT-107, is its fuction as a
counter-countermeasure.
Because it absorbs any power that is injected (via the antenna) into the
device, it defeats a
Non-Linear Junction Detector (NLJD)
— a device that is used by TSCM experts to find any electronic device,
regardless of whether it is powered or not.
➤ More about non-linear junction detectors
|
|
The interior of the SRT-107 is not easily accessible, as the
entire unit is mounted inside a hermetically sealed brass cylinder that is
covered in a strong two-component expoxy paint. Furthermore, the circuits
inside the nitrogen-filled cylinder are covered in a conformal coating.
|
Inside the cylinder are six small circular cordwood 1
building blocks, plus a larger one that contains the RF section (the actual
transmitter).
Each of the cordwood structures
consist of two circular epoxy PCBs with
electronic components fitted inbetween. They are similar in design to the
so-called FLYBALL modules
that were used by the NSA during the 1950s
in cipher machines like the KW-7,
KG-13
and HY-2.
The image on the right shows the RF section (right) and one of the cordwood
modules (left). The remaining five cordwood structures are not shown
in the image.
|
|
|
The cordwood structures are connected together by means of flexible and rigid
wires between them. Together they form the complete circuit of the SRT-107.
The RF section
is built around an HP 35831B microwave transistor that was
introduced in 1971 as a military OEM component [4].
|
It forms a free-running
oscillator that is pulse-driven by the video coder.
At the far right is a rather large isolator
that is responsible for an optimum matching to the externanal
SRN-58 antenna [5].
It also makes the device insensitive to the so-called hand effect 2 ,
which makes it therefore more difficult to detect its presence.
The image on the right shows the rear side of the RF section, where two
capacitive trimmers are visible: a larger one
that is used for setting the transmission frequency, and a smaller one
for adjusting the optimum antenna loading.
|
|
|
The bottom of the entire structure consists of a
metal disc with 3 hermetic glass feedthroughs,
to which the external wires are soldered.
After placing the construction inside the outer cylinder, the edges
of the disc are soldered hermetically. Through a small hole in the metal disc,
the cylinder is later filled (under vacuum) with dry nitrogen, after which
the small hole is soldered as well.
|
-
In a cordwood construction, the electronic components are mounted vertically
between two parallel panels or printed circuit boards (PCBs).
➤ Wikipedia
-
In a free-running oscillator, the resonant frequency will vary when it is
aproached by, say, a hand. This so-called hand-effect was often used
to locate listening devices (bugs) by observing the frequency shift on a
spectrum analyser whilst moving the hand over the suspected area.
|
|
Manufacturing of the SRT-107 was a precision task. First of all, the six
cordwood modules and the RF-unit had to be built by hand. Once they were
assembled, they were mounted together in a frame, for frequency adjustment,
calibration, component matching and even customisation.
|
After the assembled
unit had passed all tests, it was mounted inside a brass cylinder that was
soldered hermetically. A small opening in the bottom was temporarily left
open, so that the device could be filled with dry nitrogen under vacuum, using
the device shown in the image.
The hole was then closed permanently, after which the complete device was
potted in a strong green two-component epoxy. This was done to protect the
device from moist and oxidation, enabling it to work for many months or even
years, if it was not discovered of course.
|
|
|
|
The image above shows the original vacuum cylinder that was used at the
NRP during the manufacturing process of the SRT-107. The device can hold
up to six SRT-107 units.
|
Supply +5.2V DC (max. 6V) Current Typically 6.5 mA (max. 8 mA) Frequency 1300 - 1600 MHz (factory set) Grid 30 MHz (1305 - 1335 ... 1515 - 1545 MHz) Accuracy ± 7.5 MHz at 5.2V DC and 25°C Drift < 10 MHz (0°C - 60 °C) Output +24 dBm ±1.5dB peak (~200 mW) Modulation Pulse (ON/OFF) Pulse width 0.5 ± 0.1 µS Duty cycle 1.2 ± 0.35 % Sensitivity 500 µV RMS into 4000 Ω Response 300 - 5000 Hz (-3dB) Antenna Shortened asymmetrically fed ½λ dipole in dielectric material Impedance 50 Ω VSWR < 2.5 (various environments, air - concrete) Pattern Doughnut pattern, vertical polarization Gain 0 dB omnidirectional
|
|
ATE
|
|
Active Target Element
Active bugging device that has its own power source.
Some ATEs can be controlled remotely and some have full
masking of its audio signal.
Also known as TE.
|
|
LP
|
|
Listening Post
|
|
PPM
|
|
Pulse Position Modulation
|
|
RP
|
|
Rejected Pulse
Audio masking scheme
based on the random rejection of pulses produced
by a Pulse Position Modulator. This masking scheme is used in the
SRT-56 and the SRT-107.
➤ More
|
|
SRT
|
|
Surveillance Radio Transmitter
Common abbreviation used by the CIA to identify surveillance transmitters
(bugs). Often used as part of the model number.
|
|
SRR
|
|
Surveillance Radio Receiver
Common abbreviation used by the CIA to identify surveillance receivers.
Often used as part of the model number.
|
|
TA
|
|
Target Area
Generic name for the object under surveillance.
|
|
TE
|
|
Target Element
Generic name for a bugging device, installed in the Target Area (TA).
|
- Operation and Test manual for SRT-107 Transmitter
July 1974. Confidential. #CM302454
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Sunday 01 January 2017. Last changed: Monday, 22 March 2021 - 16:05 CET.
|
 |
|
|
|
