Homepage
Crypto
Index
Glossary
Enigma
Hagelin
Fialka
Nema
Voice
Hand
OTP
EMU
Mixers
Phones
FILL
Codebooks
Algorithms
USA
USSR
UK
Germany
Yugoslavia
Ascom
AT&T
Bosch
Datotek
Gretag
HELL
ITT
Motorola
Mils
OMI
Philips
Racal
Siemens
STK
Tadiran
Telsy
Teltron
Transvertex
TST
Spy radio
Burst encoders
Intercept
Covert
Radio
PC
Telex
Telephones
People
Agencies
Manufacturers
• • • Donate • • •
Kits
Shop
News
Events
Wanted
Contact
About
Links
   Click for homepage
Datotek DV-505
Voice privacy system

The DV-505 was secure voice system, developed around 1974 by Datotek in Dallas (Texas, USA). Although the device is often advertised as a voice encryption system, it was in fact 'just' a voice scrambler. The device is known to have been used in Argentina at the time of the Falkland War of 1982, and is reported to have been broken by GCHQ, possibly with help from the US NSA [2].

The portable device is housed in an aluminium Halliburton transport case, with a grey plastic carrying handle at center of the top lid. Controls and connections are located behind the top lid, as shown in the image on the right, with a red handset prominently visible at the lower edge.

The DV-505 features a 5-band frequency and time voice scrambler (F/T) with a continuously changing rolling code key generator 1 that has two million key combinations per key-family. In addition 16,000,000 key families are available, selectable by means of an internal module [3].
  
Datotek DV-505

The key generator has a very long cryptographic period 2 and is based on multiple non-linear feedback shift registers 3 (NLFSR). As a result, it is very difficult to predict its sequence. When used in combination with a real digital voice encryption system, it would have been very difficult to break the cipher. Voice scramblers however, are inherently unsafe, as the transmitted signal consists of a series of short (transposed) audio samples that still bear the properties of human speech. As a result, voice scramblers offer very limited security and were never very popular.

The advantage of a voice scrambler is that it does not use more bandwidth than the plain text voice channel, which means that it can be used with existing narrow band equipment, such as a short wave radio set. A similar and compatible device, known as the DV-505ATR, was available for airborne applications. Many third world countries in Africa and South America, used voice scramblers like the DV-505 for many years, often advised and subsidised by the American Government. Needless to say that such systems were easily broken by the American agencies.

  1. The key generator is identical to the one used in Datotek's teleprinter encryption device DC-105. Its operation is described in US Patent 3,781,473 by George Goode and Kenneth Branscome of Datotek.
  2. A long cryptographic period means that it takes a long time before the key sequence repeats itself.
  3. The use of multiple Feedback Shift Registers (FSR) with non-linear combining logic (NLFSR) in encryption systems and key generators, was very common, even in 1974, and was used by many other manufacturers well before it was claimed by Datotek in US Patent 3,781,473.

Halliburton case with lid in place Datotek DV-505 Front view with handset on-hook Front view with handset off-hook Handset with push-to-talk (PTT) switch Hook switch Connections and fuses KEY storage compartment
A
×
A
1 / 8
Halliburton case with lid in place
A
2 / 8
Datotek DV-505
A
3 / 8
Front view with handset on-hook
A
4 / 8
Front view with handset off-hook
A
5 / 8
Handset with push-to-talk (PTT) switch
A
6 / 8
Hook switch
A
7 / 8
Connections and fuses
A
8 / 8
KEY storage compartment

Features
The diagram below shows the front panel of the DV-505, which holds the controls, a red handset and all connections. Power and communication lines (e.g. telephone or radio) are connected to the two military sockets at the top centre. The unit is switched ON with the power switch at the left centre. A valid encryption KEY should be installed in the (locked) KEY compartment at the left.


Once a connection is establed (externally), the handset is lifted from the cable and the parties can begin their conversation. In half-duplex mode (e.g. when using a two-way shortwave radio), the push-to-talk switch (PTT) in the handset's grip is used to toggle between transmit and receive. If necessary, the built-in speaker can be turned ON to allow others to listen to the conversation as well. Once the conversation is started (in clear), the CLEAR/PRIVATE switch at the right is placed in the PVT position in order to enable the scrambler, whilst a red LED indicates a 'safe' channel.


Models
  • DV-505
    Standard version
  • DV-505R
    Rackmount version
  • DV-505ATR
    Aircraft version
Variants
Although all DV-505 units are more or less identical, there are some small (cosmetic) manufacturing differences [5]. The following variations have been recorded:

  • Front panel language (English or Spanish)
  • Speaker and fan cover (aluminium panel or perforated grid)
  • Datotek badge (Dallas Texas USA, or Buenos Aires Argentina)
  • Portable or rackmount
KEY setting
The DV-505 features a five-band frequency and time (F/T) domain voice scrambler. For the time domain this means that speech is sampled and stored in a temporary memory, which is divided into a finite number of time segments that are then mixed (scrambled) in an ever changing order.

Furthermore, the audio signal is split into five sharply-separated frequency bands, that are also mixed in an ever changing order. The order in which the frequency and time components are mixed, is determined by an internal generator that produces a pseudo-random KEY stream.

The KEY-generator is initialised by means of 7 thumbwheel switches that are hidden behind a locked panel at the bottom left of the control panel. Each of the thumbwheels can be set from 0 to 7, giving a total of 2,097,152 combinations for each of the 16 million possible key families. 1
  
KEY-setting compartment with cover

The 8th thumbwheel at the far right has three settings (A-C). The function of this setting is currently unknown. The oval hole below the thumbwheels — used to accomodate the lock — gives access to the recessed AC voltage selector, that offers a choice between 115V and 250V AC. Note the tamper switch that is located to the right of the oval hole. Opening the compartment whilst the system is in use, is detected by this switch and will abort abort the current session.

  1. Each device has a single fixed key family, which is determined by an internally installed module.

KEY storage compartment KEY-setting compartment with cover KEY-setting consisting of 7 digits (0-7) and one letter (A-C). Note the tamper switch at the bottom right. KEY-setting thumb switches and tamper switch Voltage selector hidden below the KEY setting
B
×
B
1 / 5
KEY storage compartment
B
2 / 5
KEY-setting compartment with cover
B
3 / 5
KEY-setting consisting of 7 digits (0-7) and one letter (A-C). Note the tamper switch at the bottom right.
B
4 / 5
KEY-setting thumb switches and tamper switch
B
5 / 5
Voltage selector hidden below the KEY setting

Compromise
According to Wayne Madsen in [2], the DV-505 was used by the Argentine Armed Forces at the time of the Falkland War in 1982. The system had reportedly been broken by GCHQ, the British Intelligence Service, probably with help from the United States National Security Agency (NSA).

In his book [2] Madsen suggests that the NSA had made a secret deal with manufacturer Datotek, similar to the deal they made with Swiss crypto manufacturer Boris Hagelin/Crypto AG. The latter offered the NSA a way in by means of a built-in weakness of the cryptographic algorithm. Such a weakness is also known as a backdoor. Although it is perfectly possible that Datotek provided the NSA with a hidden backdoor, it seems very unlikely in this case. The DV-505 is just a 5-band rolling-code voice scrambler which, like any voice scrambler system, is inherently insecure.

Voice scramblers are known to have been broken with simple methods as early as WWII, by the Allied codebreakers as well as by the Germans. In 1974, GCHQ was perfectly capable of breaking a voice scrambler like the DV-505 on its own, without help from the NSA or the manufacturer.


Interior
The DV-505 is housed in a typical Halliburton aluminium transport case of the 1970s, and is extremely heavy. With 19 kg, it can hardly be called a portable device. Nevertheless, it was transportable and was intended for field use, with a special variant available for airborne use.

The device consists of a heavy metal frame with and integrated control panel, that is located behind the top lid of the carrying case. The interior of the device can only be accessed by unscrewing the two multi-turn tubular locks at each of the short sides of the control panel.

Once the two locks are removed, the front panel — with the entire chassis — can be lifted from the aluminium case. The chassis holds a heavy power supply unit (PSU) that is mounted at the left side, as shown in the image on the right. It is built around two heavy 115/250V transformers.
  
PSU (at left hand side)

The PSU occupies about a quarter of the available space, whilst the center half of the chassis holds 8 large PCBs that can be removed from the rear. The right quarter of the chassis holds eight metal enclosures, each of which probably contains a highly accurate audio filter.

DV-505 removed from its case Rear/left view Left side of the chassis with PSU up View of PCBs and filter units PSU (at left hand side) Detail of PCB at the right hand side Detail of PCB at the right hand side (near speaker) Filter units
C
×
C
1 / 8
DV-505 removed from its case
C
2 / 8
Rear/left view
C
3 / 8
Left side of the chassis with PSU up
C
4 / 8
View of PCBs and filter units
C
5 / 8
PSU (at left hand side)
C
6 / 8
Detail of PCB at the right hand side
C
7 / 8
Detail of PCB at the right hand side (near speaker)
C
8 / 8
Filter units

Restoration
When we received the DV-505, it was in excellent condition. But when cleaning the device, we discovered some minor issues that needed fixing. Although we are determined to restore every item in our collection to working condition, this is not yet possible for the DV-505, as the mains wiring can not be thaced. The cable is missing and the socket is embedded in a metal enclosure.

On the front panel, the speaker ON/OFF switch was broken, and the coloured text of the CLEAR PRIVATE selector had faded, up to the point when the green letters PVT were hardly readable.

The image on the right shows the affected part of the front panel after restoration. The speaker switch has been replaced by an identical one and the engraved letters have been repainted here. However, replacing the switch required access to the interior of the unit, which was not possible because the chassis was locked in the aluminium carrying case and the original keys were missing.
  
Restored speaker switch and repainted text

As drilling the locks out was not considered an option, we called in the help of our good friend and lock-picker Walter Belgers, who opened both chassis locks in less than an hour. Once the case was unlocked, we were able to replace the speaker switch. The lid over the KEY-setting switches was also locked with a tubular lock, but this one offered far more resistance. It is likely to be a more secure variant, probably featuring mushroom shaped pins. We have not yet been able to pick this lock, but with a trick we were able to remove it from the rear of the front panel.

Broken speaker switch and faded text engraving Speaker switch and text engraving after restoration KEY storage compartment KEY-setting compartment with cover Two large bolts with tubular locks removed Two bolts with tubular locks Looking into the key-way
D
×
D
1 / 7
Broken speaker switch and faded text engraving
D
2 / 7
Speaker switch and text engraving after restoration
D
3 / 7
KEY storage compartment
D
4 / 7
KEY-setting compartment with cover
D
5 / 7
Two large bolts with tubular locks removed
D
6 / 7
Two bolts with tubular locks
D
7 / 7
Looking into the key-way

Connections
Power socket
The mains power (115V AC or 250V AC) should be connected to the male 10-pin military socket on the front panel. At present, the wiring of this socket is unknown.

  1. ?
  2. ?
  3. ?
  4. ?
  5. ?
  6. ?
  7. ?
  8. ?
  9. ?
  10. ?
Interface socket
A military 26-pin female socket is available on the front panel, for connection to the line, telephone or radio. At present, the wiring of this socket is unknown.

  • A
    ?
  • B
    ?
  • C
    ?
  • D
    ?
  • E
    ?
  • F
    ?
  • G
    ?
  • H
    ?
  • J
    ?
  • K
    ?
  • L
    ?
  • M
    ?
  • N
    ?
  • P
    ?
  • Q
    ?
  • R
    ?
  • S
    ?
  • T
    ?
  • U
    ?
  • V
    ?
  • W
    ?
  • X
    ?
  • Y
    ?
  • Z
    ?
  • a
    ?
  • b
    ?
Related patents
According to the model/serial number tag on one of the surviving Datotek DV-505 units, the following US patents are applicable to this device:

  1. US 3,781,473
    Random digital code generator
  2. US 3,886,313
    Voice security method and system
  3. US 4,013,837
    Voice security method and system
  4. US 4,020,285
    Voice security method and system
In particular the first patent (US 3,781,473) is an interesting one, as it describes the use of multiple non-linear feedback shift registers (NLFSR), which were already used in abundance by other many crypto manufacturers at the time, and should therefore be considered prior art.


Help wanted
At present, no further information about the DV-505 is available to us. As the company (Datotek) no longer exists, it is very difficult to find information about them or any of their products. If you can provide additional information, please contact us. Also, if you have the operator's manual of the DV-505, we would like to hear from you. We are currently looking for the following items:

  • Manual (user instructions)
  • Service documentation
  • Sales brochures
  • Power cable
  • Interface cable
References
  1. Richard P., Datotek DV-505 - THANKS !
    Received November 2017.

  2. Wayne Madsen, National Security Agency Surveillance
    Reflections and Revelations 2001-2013.
    2013. ISBN: 978-1-304-27213-3. Page 46.

  3. George Sugar, Voice Privacy Equipment for Law Enforcement Communication Systems
    US Department of Justice. LESP-RPT-0204.00. May 1974. Page 16.

  4. The Australian Computer Journal, Datotek Data and Voice Security Systems
    Volume 7, No. 2, July 1975. Page v.

  5. Jerry Proc and contributors, Datotek DV-505
    Retrieved October 2017.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Saturday 04 November 2017. Last changed: Thursday, 09 November 2017 - 20:25 CET.
Click for homepage