|
|
|
|
|
|
|
EMU DES Text Lite Philips PX-1000Cr → PX-2000 →
Although different versions of the PX-1000 were available,
we will concentrate here on the Philips versions of the PX-1000 and
PX-1000Cr,
as they feature built-in cryptographic capabilities.
It was aimed at small companies and journalists, and was also used by
the Dutch Government 2 .
Furthermore it played a role in the international fight for
Nelson Mandela's release from prison.
The image on the right shows the PX-1000Cr version.
The extension 'Cr' is used to identify the crypto-version that features
the alternative NSA algorithm.
It is shown here with its display up.
|
|
|
During the implementation of the NSA-supplied algorithm
with help from Philips,
an intermediate version of the PX-1000 – known as CALC –
was sold as a gap-fill solution. In this version, the encryption facility
had been replaced by a simple spreadsheet. At the same time, the red
CODE-button was replaced by a blue CALC-button.
In 1984, after the implementation of the NSA-supplied algorithm had been
completed, the PX-1000 was re-released as the PX-1000Cr (crypto), and
the red CODE-button was reinstated. The new product was marketed from
1985 onwards.
|
|
|
 |
-
The PX-1000 was marketed by the Consumer Electronics division of
Philips,
and not by the crypto division of Philips Usfa,
although the latter was later involved with the implementation
of an alternative algorithm.
-
For use by the Foreign Office of the Dutch Government, a special (secret)
algorithm was developed by an undisclosed Dutch agency.
-
PSTN = Public Switched Telephone Network
➤ Wikipedia
Analogue PSTN is also referred to as
Plain Old Telephone System (POTS).
-
The NSA bought 12,000 original
PX-1000 units with DES, along with 50
PXP-40 printers and 20,000 ROMs that had already been produced, for the total
sum of NLG 16.6 million (EUR 7.5 million).
-
C-mail was an early variant of E-mail, developed by Text Lite for
small businesses. It was capable of sending and receiving SMTP-based
E-mail via the command line and required a Personal Computer (PC)
with suitable hard- and software.
|
The image below shows the positions of the controls on the Philips PX-1000Cr,
which are identical to those of the standard PX-1000.
Once the batteries are fully charged, the unit is turned ON by pressing
the orange ON/STOP button in the top right corner of the keyboard.
Short messages are stored in the PX-1000's static memory, that is
retained by the internal batteries (7400 characters max.).
Longer messages could be stored on an external audio cassette recorder,
by connecting a short 3.5 mm Jack cable to the
microphone input of the recorder. They could be loaded back into the
PX-1000, by connecting the same cable to the headphones output of the
recorder and playing back the message.
Another socket is used for charging the unit.
At the bottom is the acoustic modem, which consists of a single
transducer that is used as speaker and as microphone. It is
encapsuled in a rubber gasket that should be pressed
against the earpiece or
the microphone of the telephone's handset when
sending or receiving messages.
|
|
The following encryption standards are known to have been used on the PX-1000:
|
- DES encryption (1983)
The initial version of the PX-1000, introduced in 1983, allowed text to be
encryption with the Data Encryption Standard (DES),
which was considered
extremely powerful at the time. In fact it was so powerful that the NSA
intervened and managed to get it replaced with an alternative algorithm.
This version was sold under the Text Tell
brand.
- No encryption (1984)
The intermediate version of the PX-1000, i.e. the one that was sold in between
the original PX-1000 (with DES) and the PX-1000Cr
(with the NSA algorithm),
did not feature text encryption. This version can be recognised by a blue button
at the right.
It was sold under the Text Tell
and Philips brands.
- NSA algorithm (1985)
Once DES was removed from the PX-1000, it was replaced by a stream
cipher algorithm developed by the
US National Security Agency (NSA).
Although it was promoted as a stronger-than-DES algorithm, it was
substantially weaker than DES. This version is known as the
PX-1000Cr. It was sold under the
Philips brand.
➤ NSA algorithm broken by Stef
|
The PX-1000 was fully designed and developed by
Text Lite BV in
Amsterdam (Netherlands) in 1979 and 1980.
The enclosure was designed by company shareholder Hugo Krop [10],
who was also repsonsible for the functional specification of the device.
The actual manufacturing took place at Samwell
Electronics in Taiwan, whilst Text Lite Ltd. 1 in Ireland was
responsible for the final quality assurance and packaging.
The first units appeared on the European market in 1980.
➤ Read the patent for the enclosure
|
-
The intellectual property rights (IP) of the firmware of the PX-1000 were
registered in Ireland, as the laws of that country offered better
protection of IP.
Furthermore, Ireland had lower tax rates [10].
|
|
From the outset, the PX-1000 was capable of sending and receiving
encrypted messages by using the DES encryption algorithm, which had
been obtained from the American Bureau of Standards for just US$ 8 [10].
By 1983 however, the US National Security Agency (NSA)
had become aware of the PX-1000 and its powerful encryption capabilities,
and got increasingly concerned with DES encryption being available
to the general public world-wide in such a small and affordable device.
|
The NSA then asked Philips Usfa to implement an
alternative algorithm
and see to it that the DES-based units were taken off the market.
Text Lite was told that the alternative algorithm was similar in
strength to DES, and their engineers were allowed to supervise the
implementation.
In the meantime, whilst the new PX-1000Cr was being developed,
the PX-1000 CALC was sold as an intermediate solution.
It did not support any encryption, but featured a calculator instead.
This version can be recognised by the blue key, marked CALC, instead
of the red CODE button.
|
|
|
The remaining stock of 12,000 'old' PX-1000 units was bought by Philips,
along with 20,000 firmware PROMs that had already been manufactured.
Philips later sold them on to the NSA 1 along with 50
PXP-40 printers,
for a total of NLG 16.6 million (more than EUR 7.5 million) [9].
➤ Analysis of the original DES implementation
|
-
Officially, the equipment was sold a company by the name of Reynolds
which is believed to be an NSA front.
|
|
In The Netherlands,
Philips Electronics
had the exclusive distribution rights of the PX-1000 and was
probably the largest customer of
Text Lite BV.
After the NSA had expressed its concern
about the use of DES, Philips Usfa
was asked to implement an alternative (NSA-supplied) algorithm.
|
At the time, Philips Usfa
was heavily involved in confidential
work for the Dutch Government and for NATO, and had a
separate division
that had specialized in cryptographic equipment.
As they had already implemented an
NSA encryption algorithm
in their Spendex 40 secure phone,
they had built a good relationship with the
NSA.
Philips Usfa then implemented the alternative algorithm
for the PX-1000, which took place at Philips' head office in
Eindhoven (Netherlands) under scrutiny of Text Lite
engineers who were concerned about possible
'backdoors'
[10].
|
|
|
The story above is corroborated by an article in the Dutch
newspaper De Volkskrant in April 1985 [14].
In this article, Text Lite director Hugo Krop explains how the PX-1000
initially featured DES, but that his British distributor was kindly asked by
GCHQ to replace DES by something else. At the same time, the Dutch
distributor (Philips) was
approached by an unnamed American security
service [NSA] with a similar request.
He also describes how Philips, on behalf of a third
party [Reynolds, an NSA or CIA front],
payed an undisclosed sum for compensation.
As an aside note, it is interesting to read in the 1985 newspaper article
[14] how Volkskrant journalist Wouter Klootwijk suggests that only criminals,
spies, diplomats and tax evaders would have a need for encrypted communication.
He also writes (translated):
|
There is a worldwide fear for eavesdropping, especially,
of course, amoungst people with bad intentions
|
Towards the end of the article he writes:
|
For normal decent people there is also a cheaper
version without encryption.
|
We wonder whether he would still say that
today (2016), in the light of the
Snowden revelations
about the NSA's worldwide mass-surveillance programs that affects nearly
everyone's (private) communications, such as e-mails, SMS-messages, Apps,
Skype conversations and webcams.
|
Please note that unlike other Philips encryption devices,
the PX-1000Cr was not a product of
Philips Crypto BV.
Instead it was marketed and sold by the ELA Group of
Philips Netherlands
as a consumer product.
According to the instruction manual of the PX-1000Cr [A],
the number of possible cryptographic keys was calculated at a mere
18,446,744,000,000,000,000 (over 18 quintillion).
It would take the fastest computer
thousands of years to break it... [A p.16].
Although this might have been the case for the original DES version, it
definitely wasn't for the modified PX-1000Cr which contained the alternative
NSA algorithm. Although the Text Lite
engineers were not able to find any backdoors at the time,
there was a strong suspicion that the cipher
had delibarately been weakened by the NSA. In 2016, a Crypto Museum
investigation team successfully isolated the NSA algorithm from the
firmware and has partly analysed its properties.
Hacker Stefan Marsiske has since analysed the algorithm and has
demonstrated its weakness.
➤ Analysis of the NSA algorithm
➤ Breaking the NSA algorithm
|
The PX-1000Cr was also used by some Dutch Government departments
during the 1980s.
For official government use however, the Philips software, and hence the
encryption algorithm, was replaced by a proprietary one, which
was developed by a specialized - undisclosed - agency. It contains a secret
encryption algorithm of which no details publicly known.
|
|
On 11 February 1990, black activist Nelson Mandela was released from prison,
after serving nearly 28 years of his life-time sentence.
Mandela was the leader of the South African political organization
African National Congress (ANC).
During his imprisonment, many people from all over the world fought for his
release and for the abolishment of the South African Apartheid.
|
In 1986, a secret operation led by (then) ANC intelligence officer
Mac Maharaj was mounted, to smuggle freedom fighters back into the
country and prepare Mandela for his speculated release, known as
Operation Vula [2] (Eng: commence).
The Dutch chapter of Operation Vula was led by Connie Braam,
at the time head of the Dutch anti-apartheid movement.
Her work involved finding professional makeup artists for making
disguises, a KLM stewardess acting as a courier, and last but not least,
Philips PX-1000 units that were used to exchange encrypted messages
between London, Lusaka and South-Africa.
|
|
|
On 11 February 2010, the Dutch TV program Andere Tijden, aired a
25 minute special about Operation Vula [3]. In the interview,
Connie Braam explains how she contacted an engineer who worked for
Philips at the time. He suggested the PX-1000 for secure
communication, which was subsequently used to send messages to Nelson Mandela
via Amsterdam and the hub in London.
According to Braam, the system functioned well and was used throughout
the entire operation. Tim Jenkin however, the ANC's London-based
communications expert, tells a slightly different story [7].
According to him, the system worked well, except over the bad
South-African telephone lines, for which they used another system,
based on early home computers and external modems.
The latter system was developed by Jenkin himself and needed
cryptographic keys that were distributed on floppy discs. The discs
were smuggled into South-Africa by 'Antoinette', a KLM stewardess
who had been recruted by Conny Braam. During operation Vula,
London (UK) acted as the central communications hub, with links
to South-Africa, Lusaka (Zambia), Paris (France) and Amsterdam (Netherlands).
The PX-1000 was used on the Amsterdam - London - Paris link (red),
whilst Jenkin's own system was used between Lusaka, London and
South-Africa (blue) [15].
Once in South-Africa, the messages were smuggled in and out of
Mandela's prison cell by his lawyer, using concealed compartments
in book covers. It allowed Mandela to communicate with key ANC
officials in Lusaka and lead the negotiations with the South-African
government. It also ensured that he was well-informed on the day of
his release from prison in February 1990. After the first multiracial
elections of 1994, he became South-Africa's first black president [12].
In the light of the use of the PX-1000 by a political movement
during the 1980s and 90s, it would be interesting to know what impact
the involvement of the NSA had, and which version of the PX-1000
was used for communication with Mandela; the DES one or the one
with the NSA algorithm.
➤ Find the answer here
|
On 20 April 2019, the Dutch investigative radio program Argos, aired a
one-hour special about the PX-1000, Mandela, Philips
and the NSA, in which they demonstrate how the NSA – through
Philips – managed to swap the cryptographic algorithm of the
PX-1000 for a weaker one.
Many people were interviewed during the three-year research for this broadcast,
including former Text Lite directors, former Philips personnel,
security and crypto experts and writer Marcel Metze.
Although it is uncertain whether the Dutch goverment was involved in
the NSA-operation, the
Dutch General Intelligence and Security Service AIVD
(at the time known as the BVD)
refused to release any documents related to the case,
as these could potentially harm the national security and/or the modus-operandi
of the agency. A Wiv 1 request by Argos was dismissed
[16].
➤ Broadcast NPO Radio 1 — Argos — 20 April 2019 14:00-15:00
|
|
-
Wiv = Wet op de Inlichtigen en Veiligheidsdiensten
(Intelligence and Security Act) — equivalent to the
Freedom of Information Act (FOIA) in the US.
|
|
Another documented case about the use of the PX-1000 in intelligence,
is that of American spy Clyde Lee Conrad (1948-1998), a US Army
non-commissioned officer working in Germany.
From 1974 until his arrest on 23 August 1988, Conrad sold top secret
classified NATO information to Hungary, which at that time was still part
of the Warsaw Pact. The information eventually landed
in the hands of the Soviet Union (USSR)
and appeared to be extremely damaging for NATO [24].
|
In his book Traitors amoung us, former US Army counterintelligence
officer Stuart A. Herrington gives a thrilling and informative account of this
case, which was one of the most damaging and delicate cases ever committed
against the United States. Conrad provided the Hungarians with detailed plans
of NATO movements and storage locations of nuclear weapons, that would
have been most valuable in case of a war between the
Warsaw Pact/Soviet Union and NATO [25].
The Hungarians had provided Conrad with a Textlite PX-1000 pocket
telex, that he could use to send them encrypted messages,
'immune from interception and decryption'.
All he had to do, is type the message into the device,
encrypt it, dial a phone number in Budapest (Hungary), hold the PX-1000
in front of the telephone's handset and send the message as a burst. 1
Observed by counterintelligence officers of the US Army, CIA and
FBI, Conrad was arrested in his Bosenheim home by the German Criminal Police (BKA) on 23 August 1988. In 1990, a German court sentenced him to life
imprisonment [24].
|
|
|
Conrad was one of only five American spies 2 thought to have earned
US$ 1 million or more with his spying activities. Most of these revenues were
never recovered. Investigators believe that the money was stashed abroad and
that Conrad's wife had access to it,
but were unable to prove this. Conrad died of a heart attack at the
age of 50 on 8 January 1998 in Diez prison (Germany) [24].
From the book [25] it is unclear exactly when Conrad received his PX-1000
from the Hungarians, and whether it was the earlier DES-based version
or the one with the backdoored NSA algorithm.
|
-
In the book, the PX-1000 is described as a
data-encryption-burst-transmitter-receiver that could send a message
in a microsecond. In reality the transmission took several seconds, as the
device has an acoustic modem that transmits the message at a speed of 600 or
1200 baud.
-
The others being Aldrich Ames, Larry Wu-Tai Chin, Robert Hanssen and
John Walker.
|
The PX-1000 was supplied in the commercial carton packaging shown in
the image on the right. It contains the PX-1000 in
leatherette storage case, a mains power adapter,
two cables, and operating instructions.
The packaging was provided by manufacturer Text-Lite, but was printed
with the name of the supplier — Philips in this case. A list of features
is printed on the carton.
|
|
|
The bare PX-1000, without the mains adapter, could be carried
in the tight-fit leatherette storage case shown in the image
on the right. The interior is pre-shaped
for the body of the PX-1000 and is covered with a velvet-like lining.
The case is closed with a zipper.
With most surviving PX-1000 units, the artificial leather of the
storage case has completely or partially decomposed.
|
|
|
Inside the storage case is the PX-1000 portable telex.
It measures 225 x 85 x 29 mm and weights just 450 grams,
batteries included.
All that is needed to operate the device, is to open the hinged
top lid and press the ON button. Further instruction are in the
manual.
➤ Different versions of the PX-1000
➤ Look inside the device
|
|
|
The PX-1000 is powered by internal NiCd batteries that should be
charged regularly by means of the mains power adapter shown in the
image on the right. Depending on the country in which the PX-1000
was sold, it came with a continental adapter,
or with the universal adapter shown here.
At the end of the 12V line is a 3-pin 3.5 mm jack that should be connected
to the socket at the left side of the device.
➤ Pinout of the adapter socket
|
|
|
|
|
Alternative printer cable
|
|
|
Apart from the PXP-40 printer shown above, it was also
possible to use virtually any other printer with a serial RS232
interface. For this purpose, the short cable shown here was
supplied with the device.
Instructions for connecting it to the 25-pin DB25/S receptacle
of the printer, are provided in the manual, along with
instructions on how to alter the ASCII table, should that be
necessary.
➤ Wiring of this cable
|
|
|
Text in the internal memory of the PX-1000 could be saved to an
(analogue) tape cassette recorder, using the cable shown in the
image on the right.
Likewise, the recorded message could be transferred from the cassette
to the internal memory of the PX-1000.
The cable has a 3-contact plug that should be connected to the PX-1000,
and a 2-contact plug for the input or output of the cassette recorder.
|
|
|
Several different versions of the PX-1000 are known to exist. They were
sold under a variety of brand names, but this was not a simple matter of
rebadging the product, as there are some significant differences between the
various versions. In order to obtain the firmware version number of the
PX-1000, use the following key combination whilst the device is switched on:
In the initial version (1983), the copyright message can be
read by pressing the LIST/PRINT and ON/STOP keys simultaneously.
In later versions, the above combination is used.
This will display a copyright message, consisting of the name of the
manufacturer, the year and a version number. Globally speaking, there were
three versions, but there are variants with additional features.
Many thanks to Cees Jansen for explaining the differences [1].
|
- Text Tell PX-1000
The standard version was a simple text terminal,
that allowed messages to be entered, stored and transmitted over a standard
analogue telephone line PSTN.
It had built-in encryption and decryption based on the
Data Encryption Standard (DES) [13].
It was developed in 1980 and can be recognized by its
red MODE-button.
Please note that this version is different
from the Philips variants listed below.
Firmware (ROM): COPYRIGHT TEXT LITE 1983
- Text Tell PX-1000 CALC E
In this version, the text encryption/decryption feature has been dropped
in favour of an arithmetic calculator.
It can be recognized by a blue MODE-button.
The packaging was modified by sticking an adhesive label over part of the text,
but the image of the PX-1000 with the red button, remained on the
outer sleeve of the box.
Firmware (EPROM): COPYRIGHT 1984 WEST-TEC PX CALC E
- Philips PX-1000
This was basically a rebatched version of the standard
Text Tell PX-1000 CACL E with the built-in
arithmetic calculator (identical to the one above).
The only difference is the
Philips logo on the
product and the packaging.
Firmware (EPROM): COPYRIGHT 1984 WEST-TEC PX CALC E
- Philips PX-1000Cr
This was the Philips implementation of the
cryptographic version of
the PX-1000. The arithmetic calculator was dropped again in favour of
a new encryption algorithm that had been supplied by the NSA.
It was not compatible with the earlier DES-based PX-1000.
Firmware (EPROM): COPYRIGHT 1984 WEST-TEC PX V2
- Philips PX-1000 C-mail version
This was an adapted version of the standard PX-1000 that allowed messages
to be sent via Cmail; an early protocol to read SMTP-based e-mail via the
command-line.
There were at least two variants, both in EPROM
one of which had a crypto fuction:
- Calculator COPYRIGHT 1985 WEST-TEC PX CALC H
- Crypto COPYRIGHT 1985 WEST-TEC PX CRYPTO I
- Dutch Government version
For use by the Dutch government, a special version of the Philips PX-1000Cr
was used. It contained an improved (secret) encryption algorithm,
which was not developed by Philips, but by an undisclosed
government agency in The Netherlands.
- TextLite PX-1000 C and PX-1000 F
This version was made in 1993 by TextLite Ireland, long after the Dutch
operation had been dissolved. It contains a 32KB EPROM (rather than 8KB)
marked PX-1000/F, and supports encrypted text via telephone, a V.23 modem,
a calculator, C-mail via telephone, Hamming parity error correction,
sending records of a form, storing text on tape, PXP-40
and other printers [18][19]. The following variants are known
(all in EPROM):
- PX-1000 C COPYRIGHT 1987 WEST-TEC 1100/B2/
- PX-1000 C COPYRIGHT 1988 WEST-TEC 1000F/C1/▋▋▋▋▋▋▋
- PX-1000 F COPYRIGHT TEXTLITE 1993 CRYPT/C
- Russian version
In 2023, a strange variant of the PX-1000
surfaced which was clearly intended for the
Russian market.
➤ More
|
|
PX-1000 variants were also sold by other companies as rebatched
products, for example:
|
|
|
PX COPYRIGHT TEXT LITE 1983 (ROM, original version) COPYRIGHT 1984 WEST-TEC PX CALC E (EPROM, temporary version) COPYRIGHT 1984 WEST-TEC PX V2 (EPROM, new version) COPYRIGHT 1985 WEST-TEC PC CRYPTO G (EPROM, new version) COPYRIGHT 1985 WEST-TEC PX CALC H (EPROM, C-mail version) COPYRIGHT 1985 WEST-TEC PX CRYPTO I (C-mail with crypto) COPYRIGHT 1985 WEST-TEC PX CALC I (engineering sample) COPYRIGHT 1986 WEST-TEC PX-1200 CALC A (Siemens) COPYRIGHT 1986 WEST-TEC PX-1200 CRYPT A (PX-1200E) COPYRIGHT 1986 WEST-TEC PX CRYPT KD (Ericsson) COPYRIGHT 1987 WEST-TEC PX-1100 CRYPT A (development version) COPYRIGHT 1987 WEST-TEC 1100/B2/ COPYRIGHT 1988 WEST-TEC 1000F/C1/▋▋▋▋▋▋▋ 2 COPYRIGHT 1988 WEST-TEC PX1000S/A (Commex, Teli Contact version) COPYRIGHT TEXTLITE 1993 CRYPT/C 1
|
|
-
This was found in a PX-1000C, manufactured by TextLite Ireland, long
after the Dutch operation was dissolved. It has a 32KB EPROM
(instead of 8KB) which is marked PX-1000F [18].
-
Found in a PX-1000 F, which has an EPROM marked PX1000 VIP [21].
|
PLEASE HELP —
At present we don't have any further information about the
Russian version of the PX-1000. If you known what this variant
was used for and/or what the purpose of the additional PCB is,
please contact us. Any further information would be
much appreciated.
In the same way as the firmware version can be read (see above),
it is possible to test the memory of the device. Use the following
key combination whilst the device is running. If there are no
memory problems found, the display will show 'MEMORY OK'.
|
|
|
Built-in self test
ZEROIZE
|
|
|
In software version V2 and later (i.e. from 1984 onwards) some additional
self-test facilities have been built into the PX-1000. Below is an overview
of the key combinations that should be used to activate the self-test.
Hold down ON/STOP, then press the letter key, then release ON/STOP.
This key combination is equivalent to a cold start of the PX-1000.
The device behaves like it is switched on for the first time.
Text memory is cleared and a copyright messages displays the software version,
whilst the device performs a self-test. For crypto-aware users, this
key combination can also be used as a ZEROIZE function.
The following responses are possible:
|
- One beep and one LED flash
All tests OK.
- Two beeps and two LED flashes
RAM test was successful, but the LCD is faulty.
- Three beeps and three LED flashes
The unit tries to write and then read back each memory location,
including the locations needed by the program itself. This error indicates
that it does not read back what it has written to some (or all) memory locations.
|
When activated, the key combination D + ON/STOP causes the LCD to be cleared,
whilst the modem transmits a continuous mark/space signal at 1200 baud
without a header. This signal can be useful when adjusting the
input signal with potentiometer P2 on the logic board of another unit.
The signal can be stopped again by pressing the ON/STOP key.
This key combination causes the display to be cleared, whilst the modem
transmits a continuous mark signal for 10 seconds, followed by a
10 second space signal, each time without a header. It can be used
to check the quality of the modem output (i.e. amplitude and frequency).
The signal can be stopped again by pressing the ON/STOP key.
This test performs a WRITE/READ operation on each location of the
text area (in RAM). If the test is successfully conpleted, the text
'MEMORY OK' will appear on the display. If one or more memory locations
are faulty, the display will show 'MEMORY ERROR'.
In addition, the 1988 version of the firmware (e.g. TELI Contact)
supports the following key combinations. It is possible that some of these
combinations can also be used on other versions.
|
|
The PX-1000 was extremely well built for its time. It was also very compact and
light weight, which made it ideal for portable applications. It was among the
first devices to use an advanced microcontroller with integrated memory and I/O:
the Hitachi HD6303RP.
|
The image on the right shows the PCB inside the PX-1000. The small
circuit board is very well layed out and carries the
processor (in DP-40 packaging) right at the center.
The controller is compatible with the Motorola 6800 series,
and has a built-in serial interface (SCI), parallel I/O,
timers and 128 bytes of RAM.
Memory is further extended by using a HM6264 external static RAM (right).
This adds 8KB of RAM to the design, 7.4KB of which is available for storing
the text messages.
The software is stored in an 8KB EPROM (left of the RAM).
|
|
|
The modem of the PX-1000 is implemented as so-called
thick film circuit.
It consists of a number of SMD components (transistors, diodes)
and vapor deposited resistors, on a white ceramic substrate. It has two
rows of pins, one at either side, for connection to the motherboard.
In the image above, the thick film circuit is located on the left half of the PCB.
A separate audio pre-amplifier (Toshiba TA7330P),
with automatic level control (ALC), is present to the left of the thick
film circuit, in between the two potentiometers [6].
|
|
Inside the PX-1000 are 5 Varta 170 DK NiCd battery cells. As each NiCd cell
has a nominal voltage of 1.2V, the PX-1000 is normally powered by 6V DC.
As the PX-1000 was built somewhere around 1985, the NiCd batteries of most
of the surviving devices will have died by now. Furthermore, NiCd batteries
have the tendency to start leaking after so many years, causing permanent
damage to the interior of the PX-1000. This is clearly visible below.
|
If you want to bring an old PX-1000 back to life, you first need to remove
the old batteries and clean the interior. Next, you'll need to examine any
damage caused by the leaking batteries and repair that if possible.
Finally, you need to find a suitable replacement for the batteries.
One possibility is to bring the wires out, and feed the PX-1000 with an
external 6V DC power supply.
A better solution however, is to replace the 5 cells by the newer
Varta V250H NiMH cells.
These cells have been designed especially to replace the old 170DK NiCd
cells.
|
|
|
Replacing the cells is a clean solution that doesn't require any
modifications to the PX-1000 itself. One has to bear in mind though,
that the replaced batteries should be used (discharged) and charged
regularly, in order to keep them healthy. This also applies to
the PXP-40 printer.
|
The image on the right shows what happens to the interior of the PXP-40
printer, once the batteries start leaking. In this case, the swollen batteries
have caused permament damage to the printer mechanism. The leaking batteries
have also caused corrosion to the main PCB.
The PXP-40 is powered by 7.2V. The 6 NiCd cells of 1.2V each, are bound
together as a pack, positioned aside the printing mechanism on top of the
PCB. They pack is connected to the main PCB by 2 wires that also keep it
in place. The batteries are easily replaced.
|
|
|
Bringing a PXP-40 printer back to life, might be a bit more work than getting
a PX-1000 to work. As the batteries are located aside the printing mechnism,
the cog wheels are easily damaged by the swollen batteries. Carefully cleaning
and reparing of the broken parts may be necessary to bring it back to life.
Leaking batteries may also cause secundary damage to the PCB. As a result
of the swollen batteries, the cog wheel mechanism can be blocked, causing
excessive currents in the motor driving electronics. This may cause a
56 ohm safety resistor on the PCB to break.
|
|
The PX-1000 was supplied with its own transit case, a mains power adapter
and a manual, stored in a rectangular carton box with a photograph of
the device on the sleeve. Inside the box was a polystyrene placeholder
with a layer of dark blue artificial velvet (see below).
|
The packaging could be tailored for each reseller,
but always contained the TEXT TELL logo.
There were small differences in the typeface
and in the text printed on the carton.
The image on the right shows the packaging of the Philips
PX-1000Cr. It contains the Philips brand name in the
top right corner and the TEXT TELL logo at the bottom.
Other (but similar) cartons can be found in the thumbnails below.
|
|
|
On the left side of the device is a socket for a 3.5 mm stereo jack, that can
be used for connection of a power adapter (which also charges the internal
NiCd batteries) or a printer. The wiring is as follows:
|
Device Portable telex Purpose Sending (encrypted) messages over an analogue telephone line Manufactuer Text Lite Reseller Philips, Siemens, Ericsson, Alcatel, others Model PX-1000 Years 1983-1990 Users Worldwide Encryption DES, NSA, none (depending on version) Display Single line monochrome LCD, 40 characters 5 × 7 pixels Memory 7400 characters Modem Simplex FSK CCITT V.23 mode 1, 600 baud Speed 300, 600 or 1200 baud Tones 1300 Hz (mark), 1700 Hz (space) Format 7E2 (7 data bits, even parity, 2 stop bits) Serial 1200 baud, 1E7, ±5V (±12V tolerant) Power 12V DC via external adapter Current < 30mA (< 50mA when modem is in use) Standby < 150µA Batteries Internal 6V (5 x 1.2V NiCd cell) Charging 50mA fast (< 2mA trickle charge) Life > 5 hours Temperature -10°V to +40°C (storage -25°C to +55°C) Humidity 0 to 95% Dimensions 225 × 85 × 29 mm Weight 450 g
|
|
The Text-Tell PX-1000 was available under various brand names,
including the following:
|
Our call for documentation of the PX-1000 in mid-2011 has generated a new flow
of information about this device. The original user instructions were found
rather quickly, but we were really surprised when we received the original
service manual and the circuit diagrams. We have now made them available for
download below in the hope that they may prove useful when repairing a broken
PX-1000. Many thanks to all who have contributed.
If you like the information presented here, please consider making a
donation to Crypto Museum.
- PX-1000 Brochure
8-Page full-colour brochure (Dutch).
Philips Nederland BV. Undated, probably 1985.
- PX-1000 Handleiding
User Manual for PX-1000 and PX-1000Cr (Dutch).
Philips Nederland BV, April 1985. 29 pages (A5).
- PX-1000 Operating Instructions
User Manual for the original PX-1000 (English).
Text Tell Ltd, 1985. 19 pages (A5).
- PX-1000 and PXP-40 Service Manual
Full circuit description of version H. 61 pages (A4).
- PX-1000 Circuit Diagrams
Version F and H. 4 pages, A3 size, B/W. 1985.
- Two PX-1000 brochures (off-site)
Text Lite PX-1000 (English), Philips PX-1000 (Dutch).
- C-Mail instructions
Undated. 1
- PX-1000 C and PX-1000 F operating instructions
Undated, but probably 1993. 1
- PX-1000 DES-version data format
Karsten Hansky, 12 October 2016 [19].
- Robotron Magazin, Textlite PX1000 - ein universelles Kommunicationsgerät für jeden
Robotron Business Systems, August 1991. 4 pages. 1
- Teli - The Contact - Technical manual
Operating instructions for the TELI version of the PX-1000 (English).
Teli Plc, Basingstoke (UK). Undated.
➤ Warranty card
- PXP-40 Operating Instructions
Text Tell, Undated.
|
|
-
Document kindly provided by Karsten Hansky [19].
|
-
This version features DES encryption instead of the
NSA algorithm [22].
|
- Cees Jansen, Interview
Former cryptographer at Philips Usfa/Crypto.
Crypto Museum, August 2011.
- Noseweek, Zuma, SARS and Kebble: The Political Agenda
Issue 69. 1 July 2005.
- Andere Tijden, The Making of Nelson Mandela.
TV program by NPS, VPRO. 11 February 2010. 25'24" (Dutch).
- WayBack Machine, www.texttell.com
Internet archive, showing the state of the Text Tell website in 2001.
- Hitachi, HD6303RP microprocessor datasheet
Date unknown.
- Toshiba, TA7330P pre-amplifier datasheet
Pre-amplifier with ALC circuit for mini/micro cassette tape recorder.
- Tim Jenkin, Talking to Vula
The story of the Secret Underground Communications Network of Operation Vula.
ANC website. ANC's Montly Journal Mayibuye, May 1995 - October 1995.
- US Patent D282164, Portable Telex case or the like
Filed 17 Oct 1983 on behalf of Text Lite BV. Granted 14 Jan 1986.
- Onkruit, De klanten van Philips Crypto
The customers of Philips Crypto (Dutch). June 1992. 2
- Hugo Krop, Personal correspondence and interview
Former technical director of Text Lite BV.
Crypto Museum, 25 August 2013, 15 December 2013.
- Conny Braam, Operatie Vula
1992, Dutch. ISBN 978-9029083362. p. 66.
Reprinted 2006, Dutch. ISBN 978-9045700465.
English version 'Operation Vula', April 2005, ISBN 978-1919931708.
- Wikipedia, Nelson Mandela
Retrieved November 2013.
`` `
- Wikipedia, Data Encryption Standard
Retrieved January 2016.
- Wouter Klootwijk, Kleinste schrijfmachine, snelste postbode
Volkskrant, Newspaper (Dutch). 27 April 1985. 1
- Tim Jenkin, Personal communication and interview
Crypto Museum, 28 May 2018.
- Argos, Philips, TextLite en Amerikaanse Spionage
NPO Radio 1 broadcast, Saturday 20 April 2019, 14:00-15:00 (Dutch).
- Huub Jaspers en Marcel Metze, Versleuteld, maar niet voor Amerika
De Groene Amsterdammer 143/32, 7 August 2019.
- Daniel Kula, Personal correspondence
October 2014.
- Karsten Hansky, Personal correspondence
August 2016.
- Axel Ehrich, Personal correspondence
9 February 2018.
- Jonathan Andersson, Personal correspondence
30 May 2021.
- Jörg Drobick, Personal correspondence
May — August 2020.
- Frank Gnegel, PX-1000 in the collection of Museum für Kommunikation
Frankfurt (Germany). Personal correspondence, January 2022.
- Wikipedia, Clyde Lee Conrad
Visited 5 November 2023.
- Stuart A. Herrington, Traitors amoung us
ISBN 978-0-15-601117-4. 1999. Pages 230-232, 236.
|
|
-
Reproduced by kind permission from the publisher.
-
Documents stolen by activist Kees Koning after breaking into
the offices of Philips Usfa.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Friday 22 April 2011. Last changed: Saturday, 17 August 2024 - 07:15 CET.
|
|
|
|
|
|
![Clyde Lee Conrad in 1965. Photograph obtained from Wikipedia [24].](img/conrad_1965_large.jpg)
