Homepage
Crypto
Spy radio
Burst encoders
Intercept
Covert
Index
Glossary
Cameras
Recorders
Radio
Bugs
Microphones
Dead Drop
Lock picking
Spy cases
Radio
PC
Telex
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Logo (click for homepage)
SRT-107
Covert listening device with audio masking

SRT-107 was a sophisticated covert listening device (bug), developed in 1974 by the Dutch Radar Laboratory (NRP) for the US Central Intelligence Agency (CIA), as part of a long-term research project under the name Easy Chair. This battery powered device is extremely difficult to detect.
 
The SRT-107 consists of a fairly large cylindrical transmitter and a partly transparent SRN-58 antenna. The two parts are connected via a 25 cm fixed coaxial cable. A power source and a suitable microphone should be connected to the flying lead with a 5-pin connector at the end.

Contrary to early Easy Chair bugs, the SRT-107 is a so-called active target element (ATE), which means that it is powered locally from batteries, the mains or via a telephone line. The device operates in the 1500 MHz band and features sophisticated masking of speech modulation.
  
SRT-107 transmitter

The unit is powered by an external 5.2V DC source and consumes typically 6.5 mA when in full operation. Yet it delivers an output power of 200 mW, due to the fact that it uses Pulse Position Modulation (PPM). Speech information is masked by using a noise generator to randomly reject some of the pulses, as a result of which the transmitter appears to be producing random noise.
 
SRT-107 transmitter STR-10 transmitter with SRN-58 antenna SRT-107 transmitter Fixed SRN-58 antenna Cables cast in epoxy for strain release Quick-release connector

 
Features
The diagram below shows a typical SRT-107 unit, without an external microphone. At the right is the actual transmitter which is housed in a hermetically sealed brass cylinder, that is covered in a strong (green) two-component epoxy paint. Inside the cylinder is a fairly large RF section plus six so-called cordwoord modules that contain the electronic circuits. At the bottom of the cylinder is an endplate with three hermetic glass feedthroughs to which the cables are connected. In order to protect the internal circuits against corrosion, the cylinder has been filled with dry nitrogen.


At the top is the SRN-58 antenna which is connected to the transmitter by means of a fixed 25 cm long teflon coax cable. It consists of two brass pipes that form an end-fed 1/2λ dipole with vertical polarization. The antenna is cast in a solid 26 mm thick transparent epoxy cylinder. The dimensions of the antenna have been compensated for the dielectric effects (εr) of the cylinder.

A flying lead is provided for connection of a power source and an external microphone. At the end of the flying lead is a 5-pin quick-release connector for testing and installation. The unit is powered by a 5.2V DC source and consumes approx. 6.5 mA when in full operation. It provides a peak output power of 200 mW. A recommended miniature microphone is the Knowles 1501.
 
Complete setup
A complete setup typically consists of the following parts:
 
This is further illustrated in the diagram below. At the left is the SRT-107 transmitter with its fixed SRN-58 antenna. In the example it is powered by batteries. The transmitter could be further extended by adding an (optional) receiver module so that it can be ON/OFF controlled remotely.


At the Listening Post (LP), the signal from the SRN-55 antenna is first converted from 1300 MHz to 300 MHz and then fed to an SRR-56 or SRR-91A receiver, which is capable of recovering the masked audio. The output of the receiver is typically fed to a pair of headphones or a recorder.
 
Microphone
Although the SRT-107 is suitable for virtually any type of dynamic microphone, it was commonly used in combination with a Knowles 1501 miniature element, which measures 10 x 10 x 5 mm. This might seem rather large by today's standards, but was really state-of-the-art at the time.

The microphone has a frequency range of 400 to 3500 Hz and was also used in military applications, such as headsets, at the time. The Knowles 1501 is also known as BA-1501 and by its National Stock Number NSN 5965-00-015-7408.
 
Antenna   SRN-58
The SRT-107 transmitter comes with a fixed 1500 MHz SRN-58 antenna that is embedded in a plexiglass stick. The stick has the same width as the transmitter itself so that it can be fitted inside the same concealment in a 1 1/8' hole.

The antenna is suitable for the entire 1300 to 1600 MHz range and its dimension have been compensated for the dielectric effects of its plexiglass enclosure.

 More information
  
SRN-58

 
Detection
Despite the fact that the SRT-107 is difficult to detect, it seems likely that eventually the Russians were able to intercept and locate them. At a press conference in Washington on 10 April 1987, the Soviets presented a range of bugging devices that had been found during the past week in the walls of their Washington Embassy, claiming they had been planted there by the Americans.
 
The photograph on the right [1] was taken at the press conference and shows two Russian experts behind a table, explaining to the press what they had found. On the wall behind them are several panels with photographs and real samples of the equipment that was said to be planted by the US.

At the bottom of the second panel, highlighted here with a red circle, are four cylindrical devices that are interconnected by a bunch of wires. It is very likely that this is one of the predecessors of the SRT-107. In any case it is an obsolete device that could not have been planted there recently.
  

In seems likely that the Soviets wanted to amplify their claim by exposing all types of bugs that had been found in their walls over the years. The image quality is too low to determine the actual model of the bug, but luckily a close-up appeared in a television newscast that evening [3].
 
The image on the right was taken from that news­cast. At the far right we clearly recognise the SRN-58 antenna, which was typical for many SRT transmitters used by the CIA. To the left of the antenna is a long cylinder which probably contains four long-life Mercury battery cells.

The smaller black cylinder (second from the left) contains the RF transmitter, whilst the leftmost one is probably the video coder that masks the audio modulation. In the SRT-107 these two modules were combined. It is also possible, that the leftmost module contains a receiver that was used to turn the transmitter ON and OFF at will.
  

Either way, it proves that the NRP-built CIA bugs were known to the Soviets in 1987, and also that they had been used by the Americans against the Soviets in Washington at some point. However, if that was the case, they were installed there many years earlier, as by the time of the press conference this particular model, and many of its successors, were no longer in production.
 
Block diagram
The basic operation of the SRT-107 is explained in the block diagram below. At the far left is the microphone pre-amplifier which has a built-in Automatic Gain Control (AGC) and dynamic range compressor. The output of the amplifier is fed to the so-called video-coder. At the far right is the RF oscillator/transmitter which is ON/OFF controlled by the output pulses of the video-coder.


At the center is the video-coder which is responsible for masking the audio signal. It starts with a Pulse Position Modulator (PPM) in which the signal from the audio amplifier is used to modulate the phase of the trigger pulses provided by the clock oscillator. A noise generator is used to randomly reject pulses from the resulting pulse-train, which results in a randomly varying output pulse rate, that resembles a noise pattern, similar to the background noise of a radio channel.

A pulse shaper is present to ensure that the output pulses are of uniform length and amplitude, before they are passed on to the keyer/booster, which turns the RF oscillator ON and OFF at the pulse rate. The booster converts the +5.2V DC supply into -20V pulses, allowing the transmitter to produce a peak power of 200 mW. Due to the noise-resembling pulse pattern, the transmitter produces a masked signal that will defeat demodulation in a non-compatible intercept receiver.

Although the transmitter's RF oscillator is properly matched to the SRN-58 antenna, in practice there will always be reflections of some kind. This the case for example, when the antenna is positioned close to a metal object and a significant amount of the energy is returned to the transmitter where it must be dissipated. In reaction to this, the transmitter will consume more power in order to overcome the returned energy. This may potentially damage the transmitter.


In transmitters like the SRT-107, this is solved by inserting an isolator between the output of the transmitter and the antenna. An isolator is in fact a 3-port circulator of which the return port is connected to ground, as illustrated in the diagram above [5]. In a circulator, the energy is always delivered to the next port. The energy from the transmitter (1) is delivered at the antenna (2), but the energy returned from the antenna (2) is delivered at port (3) which is connected to ground.
 
Interior
The interior of the SRT-107 is not easily accessible, as the entire unit is mounted inside a hermetically sealed brass cylinder that is covered in a strong two-component expoxy paint. Furthermore, the circuits inside the nitrogen-filled cylinder are covered in a conformal coating.
 
Inside the cylinder are six small circular cord­wood 1 building blocks, plus a larger one that contains the RF section (the actual transmitter).

Each of the cordwood structures consist of two circular epoxy PCBs with electronic components fitted inbetween. They are similar in design to the so-called FLYBALL modules that were used by the NSA during the 1950s in cipher machines like the KW-7, KG-13 and HY-2. The image on the right shows the RF section (right) and one of the cordwood modules (left). The remaining five cordwood structures are not shown in the image.
  
Part of the interior of an SRT transmitter

The cordwood structures are connected together by means of flexible and rigid wires between them. Together they form the complete circuit of the SRT-107. The RF section is built around an HP 35831B microwave transistor that was introduced in 1971 as a military OEM component [4].
 
It forms a free-running oscillator that is pulse-driven by the video coder. At the far right is a rather large isolator that is responsible for an optimum matching to the externanal SRN-58 antenna [5]. It also makes the device insensitive to the so-called hand effect 2 , which makes it therefore more difficult to detect its presence.

The image on the right shows the rear side of the RF section, where two capacitive trimmers are visible: a larger one that is used for setting the transmission frequency, and a smaller one for adjusting the optimum antenna loading.
  
Two trimmers at the rear side of the RF section

The bottom of the entire structure consists of a metal disc with 3 hermetic glass feedthroughs, to which the external wires are soldered. After placing the construction inside the outer cylinder, the edges of the disc are soldered hermetically. Through a small hole in the metal disc, the cylinder is later filled (under vacuum) with dry nitrogen, after which the small hole is soldered as well.
 
  1. In a cordwood construction, the electronic components are mounted vertically between two parallel panels or printed circuit boards (PCBs).  Wikipedia
  2. In a free-running oscillator, the resonant frequency will vary when it is aproached by, say, a hand. This so-called hand-effect was often used to locate listening devices (bugs) by observing the frequency shift on a spectrum analyser whilst moving the hand over the suspected area.

Part of the interior of an SRT transmitter Part of the interior with the RF section at the right Rear side of the RF section RF section, with the isolator at the right Two trimmers at the rear side of the RF section Close-up of the first cordwood module Another view of the first cordwood module STR-107 transmitter and part of the interior

 
Technical specifications
  • Supply
    +5.2V DC (max. 6V)
  • Current
    Typically 6.5 mA (max. 8 mA)
  • Frequency
    1300 - 1600 MHz (factory set)
  • Grid
    30 MHz (1305 - 1335 ... 1515 - 1545 MHz)
  • Accuracy
    ± 7.5 MHz at 5.2V DC and 25C
  • Drift
    < 10 MHz (0°C - 60 C)
  • Output
    +24 dBm ±1.5dB peak (~200 mW)
  • Modulation
    Pulse (ON/OFF)
  • Pulse width
    0.5 ± 0.1 S
  • Duty cycle
    1.2 ± 0.35 %
  • Sensitivity
    500 µV RMS into 4000 Ω
  • Response
    300 - 5000 Hz (-3dB)
  • Antenna
    Shortened asymmetrically fed ½λ dipole in dielectric material
  • Impedance
    50 Ω
  • VSWR
    < 2.5 (various environments, air - concrete)
  • Pattern
    Doughnut pattern, vertical polarization
  • Gain
    0 dB omnidirectional
Glossary
ATE   Active Target Element
Active bugging device that has its own power source. Some ATEs can be controlled remotely and some have full masking of its audio signal.

LP   Listening Post

PPM   Pulse Position Modulation

SRT   Surveillance Radio Transmitter
Common abbreviation used by the CIA to identify surveillance transmitters (bugs). Often used as part of the model number.

SRR   Surveillance Radio Receiver
Common abbreviation used by the CIA to identify surveillance receivers. Often used as part of the model number.

Documentation
  1. Operation and Test manual for SRT-107 Transmitter
    July 1974. Confidential. #CM302454

References
  1. Anonymous, SRT-107 transmitter with audio masking
    September 2016.

  2. Newsweek, The Battle of the Bugs
    20 April 1987.

  3. CBS Evening News
    Thursday 9 April 1987.

  4. Hewlett Packard Components, OEM Prices
    November 1971. Page 3.

  5. Wikipedia, Circulator
    Retrieved January 2017.

Further information

Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Sunday 01 January 2017. Last changed: Wednesday, 11 January 2017 - 07:53 CET.
Click for homepage