|
|
|
|
|
|
|
Bugs Securitate
Wired room monitoring bug
Securitate bug 1 is a miniature wired
covert listening device (bug), developed in the late 1970s,
and used during the
Cold War by the secret police of
the Socialist Republic of Romania
— the Securitate —
for overhearing conversations in a room.
It uses the analogue telephone line
as its power supply and for transport of its audio signal.
The device shown here, was discovered in the walls of a Romanian
institution, several years after the fall of the repressive communist
regime.
|
The image on the right shows the device next to a match.
It measures 46 x 9 x 8 mm and weights 6 grams. It is housed in
a silver-plated enclosure that consists of two shells. The upper shell
has a small hole close to one end, that is protruded by the sound
port of a subminiature microphone.
At the other end are three wires 2 by which the device is connected to the
telephone line. Two wires are for connection to the A and B wires of an
analogue telephone line, whilst the third one should be connected to ground
to avoid hum. It is directly soldered to one of the case shells.
|
|
|
The device itself could be hidden inside the wall socket of the telephone,
or behind a plastered wall, in such a way that the microphone was able to
pick up any sound in the room.
The highly sensitive subminiature microphone was made by
US manufacturer Knowles,
and is also found in hearing aids of the era.
Ironically, the development of these microphones had been funded for many
years by the US
Central Intelligence Agency (CIA),
especially for use inside American bugs.
It is currently unknown where the bug was manufactured, but it is likely that
it was made in a former Eastern Bloc country, such as Bulgaria, Hungary, East
Germany (DDR) or Romania itself, despite the fact that it is entirely made
with Western components. The device shows similarity to
contemporary bugs,
like Bodil (Bulgaria), Botond
(Hungary) and 33014 (East Germany),
but is far less sophisticated.
If you have additional information about this kind of bugs,
please contact us.
|
 |
-
As the offical name and/or designator of this bug is currently unknown,
we have nicknamed it 'Securitate', after the repressive
Cold War
secret police agency of Romania, who alledgedly exploited it.
-
Originally there were two black wires and a white one, but these were
worn out, and were replaced by black, yellow and blue wires as part of
the restoration by Crypto Museum in May 2020.
|
The diagram below shows the properties of the device. It is housed in a
silver-plated brass case that consists of two halves, held together
by a piece of cellotape. The device has no controls and is enabled by
supplying 48V DC to the blue and yellow wires, typically from
a free telephone line.
Inside the device
is a two-stage audio amplifier, of which the output is fed back to the
telephone line. This signal was then picked up by a Securitate listening
post near the telephone exchange. This is illustrated in the diagram below.
As soon as the subscriber line is occupied — the user has lifted the
handset from the cradle (off-hook) — the line voltage drops and the
device is disabled.
This system has several advantages. The device does not interfere with
a regular telephone call — it is disabled — and
can therefore not be discovered accidentally. Furthermore, room audio
and telephone conversations could be recorded at the listening post
without additional means.
|
During the Cold War, Romania was a communist
country under strong influence of the
Soviet Union (USSR).
Like the other countries of the Eastern Block,
it had a repressive secret police agency that spied on its
citizens. It was known as the
Securitate
and was omni-present [2].
The history of the Securitate dates back to the beginning of the
Cold War.
It was founded on 30 August 1948, with help from the Soviet
Ministry of Internal Affairs (MVD). 1
It was initially known as the
General Directorate for the Security of the People (DGSP),
and later also as
Departamentul Securităţii Statului (DSS),
but it was generally known by the public as
Securitate.
At its height, it had 11,000 agents and 500,000 informers on a population of 22 million [2].
Under the regime of Nicolae Ceauşescu, the Securitate was one of the most
brutal secret police forces in the world.
The Securitate was responsible for the arrests, torture and deaths of thousands
of people. Like its sister organisations in other East European countries,
such as the Stasi (DDR),
the StB (Czechoslovakia)
and ÁVH (Hungaria), it kept
files on dissidents, placed them under surveillance and tapped their telephone
lines. The latter was the responsibility of General Directorate for Technical Operations,
that had been established in 1954 with help from the Soviet intelligence services.
In the late 1970s or early 1980s, the device featured here, was planted
by the Securitate in the one of the walls of an unnamed Romanian institution,
where it was connected to the (analogue) telephone line. It was not intended
for tapping the telephone line — that could be done in the exchange anyway — but
for overhearing conversations in the room. It was powered by the DC voltage
that was present on the telephone line, and delivered its audio signal to
the Securitate listening post via the same line.
At least two of these bugs were planted in the institution.
|
|
-
Until 1946 known as NKVD.
Forerunner of the KGB.
|
After the revolution of December 1989
– that led to the end of the Socialist Republic of Romania –
many of the state-owned institutions were
privatised, but only very few eventually managed to survive.
Between 1997 and 2000
— in the days before mobile phones became mainstream —
a person working at the forementioned institution asked a friend to make
a device for recording telephone conversions, as there were regular disputes
about instructions that had been given.
The friend came up with a simple solution in which he used a portable
voice actuated dictation machine (voice recorder) of which the external
microphone input was connected directly to the telephone line by means of
a separation transformer. It did not require any modification of the
telephone set, and would automatically start recording when it picked up
an audio signal (voice).
A few days after the installation, the dictation machine appeared
to record not only the telephone conversations, but any
conversation in the room. Initially it was thought that perhaps the
internal microphone of the recorder had not been disconnected properly, but after
the microphone was removed completely, it appeared that it still recorded
all conversations in the room, and not just the telephone calls.
It then began to dawn that perhaps there was a hidden 'bug' in the room.
After following the telephone cables and cutting through several brick walls,
the bug was finally discovered and removed from the telephone line.
It made the personnel of the institution pretty nervous, and gave them the
impression that everything they said was being overheard.
People started whispering and turned up the volume of the radio
when serious matters were discussed.
Further investigation revealed that there was one more bug in the building:
in the office of the general manager. Rather than removing that bug from the
plastered wall, the line was simply cut at both ends, and replaced by a new one.
The affected institution no longer exists today [3].
|
It is currently unknown which company or country produced the bug, but it is
likely that it was made by, or on behalf of, the
Securitate itself, or at least
by a sister organisation from one of the former Eastern Block countries, despite
the fact that it is entirely built with Western components.
The miniature resistors and the ceramic capacitors are all made by
Philips,
whilst the electret microphone is from the American manufacturer
Knowles.
The two miniature BC123 transistors were made by
Siemens in Germany, and
the remaining components were made by various other Western manufacturers.
None of the parts are made in Eastern Europe. The
big capacitor on the top surface of the PCB,
gives us a clue when the
bug may have been manufactured. As its date code is 08 78 (week 8 of 1978),
it was made after this date, probably late 1978 or early 1979.
There are various reasons why the device does not contain any
East European parts: (1) miniature parts were not available in Eastern
Europe at the time, or were hard to obtain, (2) to hide the true origin
of the device, and (3) to blame Western intelligence agencies
when it was discovered.
|
The device first appeared on a Romanian internet forum in February 2020,
where it was described by the person who alledgedly found it in the walls
of the forementioned (undisclosed) institution. He also offered it for sale.
The story above is largely based on his description on the forum [3].
The device was eventually purchased by a forum participant
– Silviu Groza – who subsequently donated it to Crypto Museum
in May 2020 [1].
We are most grateful for this, as it is one of the rare ocassions
in which not only the device has survived, but also some of its history.
It is also unique in the sense that it is the first
covert listening device (bug)
that we have come across, that transmits a plain audio signal over a regular
telephone line, without using subcarrier modulation.
|
The Securitate bug is a simple yet very effective device. When
installed properly, it will be very difficult to discover it. As it
is disabled automatically when the telephone line is occupied, it
will not be noticed by the calling participants.
The only way to discover it on a (suspicuous) telephone line
(apart from a visual inspection of the line),
is to connect an audio amplifier in parallel (which was how this bug
was found) or by using a non-linear wire-line bug detector,
such as the Orchidea-2 shown on the right.
➤ More information
|
|
|
|
The device is housed in a
silver-plated metal enclosure
that measures just
46 × 9 × 8 mm. It consists of two high precision manufactured shells, that
fit tightly together. Judging from the discolouration of the silver-plated
body, the two halves were previously held together by a piece of cellotape,
which might have been removed by the finder after its discovery in the
late 1990s.
|
Inside the enclosure
is a double-sided epoxy-based printed circuit board (PCB),
that measures 42 x 7 mm and has components on
both sides. At one end are the
wires to the telephone line. At the other end is a
Knowles miniature electret microphone,
embedded in a cutout of the PCB.
All of the electronic components are made by by Western manufacturers:
the microphone is from Knowles (USA),
resistors and ceramic capacitors are from
Philips (Netherlands) and the miniature
transistors are made by Siemens (Germany).
The rest was made by various Western companies.
|
|
|
|
It is possible that suitable miniature parts were not available from local
manufacturers at the time, but it is also possible that Western parts were
chosen deliberately to hide the true origin of the device. The image above
shows the bottom side of the PCB, with a large black 1N... rectifier diode
at the center. The
two miniature BC123 transistors
are to the left and in front of this diode.
|
Below is the circuit diagram of the device, which is built around two
BC123
miniature low-noise LF transistors, introduced by the German manufacturer
Siemens in 1970 [A].
They were made especially for use in miniature electronic devices
like hearing aids. At the far left is the electret microphone, made by US
manufacturer Knowles.
The signal from the microphone is amplified in the 2-stage
audio amplifier (2 x BC123), and is then injected back into the telephone line.
At the far right are the (a) and (b) wires from the telephone line.
The device is polarity-sensitive, and has to be connected the right way around.
The 20V zener diode protects the second BC123 when the phone rings
(60-100V AC). The function of the 0.66µF capacitor is to short out the
22k resistor for AC signals (audio). In this configuration, T2 acts as
a current source. The two 1µF capacitors – that were clearly added later –
deliver the audio directly back to the telephone line.
The device is powered by the 48V DC voltage 1 that is present on a line when
it is in rest (i.e. when the handset is on-hook). As soon as the
handset is picked up, this voltage drops to 6-10V DC and the device is
disabled. This ensures that the subscribers will not accidentally overhear the
audio signal from the bug during a telephone call.
The circuit is far less sophisticated than that of contemporary line-carrier
bugs, such as the East German 33014
and the Bulgarian Bodil, which used subcarrier modulation
to hide the bug's audio signal, and were extremely difficult to detect.
However, that fact that it was not discovered until 2000, proves that it
was just as effective.
➤ See how the East-German Stasi used bugs over telephone lines
|
|
-
The exact DC voltage on an unoccupied (analogue) telephones line differs
per country and sometimes even per exchange. It was commonly between 30 and 60V DC.
|
When we received the bug featured on this page, the wiring was about to
break. The isolation of the wires had become stiff over time, and the solder
joints at the cable-end of the device were about to separate, probably due
to frequent handling in the years after the bug was discovered.
It was therefore decided to replace the wires with modern pliant ones.
The white wire was replaced by a yellow one, black became blue, and a black
wire was soldered to the case shell (ground).
After connecting the device to a simulated telephone line, using the
above circuit, it appeared to be in full working condition. The microphone
is very sensitive and the (external) audio amplifier produces a clear
high-fidelity audio signal, with very good legibility,
without replacing any parts.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Saturday 02 May 2020. Last changed: Saturday, 09 May 2020 - 05:48 CET.
|
|
|
|
|
![Covert listening device of the Securitate. Kindly donated by Silviu Groza [1].](img/303400/017/full.jpg)
