|
|
|
|
|
|
Operation GUNMAN - how the Soviets bugged IBM typewriters
The Selectric Bug was a sophisticated digital
eavesdropping device, developed in the mid-1970s
by the Soviet Union (USSR).
It was built inside IBM Selectric II and III typewriters
[4]
and was virtually invisible and undetectable.
A total of 16 devices were found inside typewriters that were in use during
at least 8 years at the US Embassy in Moscow and the US Consulate
in Leningrad. 1
|
The advanced digital bugging device was built inside a hollowed-out metal
supporting bar that runs from left to right inside the
IBM typewriter.
It registered the movements of the print head (ball),
by measuring small magnetic disturbances caused by the arms
that control the rotation and elevation of the print ball.
A typical IBM Selectric II typewriter is shown in the image on the right.
At least five different versions, or generations,
of the bug were discovered by the Americans, some of which were powered
by a DC battery voltage. Others were powered by the AC mains or both.
|
|
|
Furthermore, the devices were remote controlled by the Soviets from
outside the building. When the typewriter was turned ON, and the
bug was activated remotely, it sent its data via radio in short
bursts 2 to a nearby listening post. Although there was some
ambiguity in the intercepted data, the Soviets were then able to recover
the typed plaintext by using the laws of probability.
|
The first Selectric bug was found after a tip from the French,
who found a similar implant inside an embassy teleprinter [8].
As the US considered themselves a high-profile target,
the Americans launched the covert
GUNMAN project,
with the aim to find any implants and respond to them.
11 tons of equipment was seized from the US embassy in
Moscow and shipped back to the US for analysis by the NSA. Eventually,
the implants were found in 16 IBM Selectric typewriters that were used at
the US Embassy in Moscow and the US Consulate in Leningrad 1 from 1976
to 1984.
|
|
|
The bug was fairly large and consisted of state-of-the-art integrated
circuits and single-bit core memory. It was completely hidden inside
a hollow support bracket at the bottom of the keyboard mechanism,
and was invisible to the naked eye, but also to the detection equipment
of the era. Only an X-ray scan could reveal the presence
of the device, which is shown in the image below.
It contains special components to hide its
presence even from
non-linear junction detectors (NLJD).
The Selectric Bug can be seen as one of the world's first
keystroke loggers.
It is the first known attack by the Soviets, that targeted a plaintext device
rather than a cipher machine.
Modern keystroke loggers exist as software – similar to
a computer virus – and hardware.
In the latter case it is often a small device that is installed between a
computer and the keyboard.
Both variants are used extensively today by criminals as well as by
law enforcement agencies.
|
 |
-
Leningrad is known today as St. Petersburg.
-
In order to avoid detection, the data was first stored in a buffer and
then sent in short high-speed data bursts in the 30, 60 or 90 MHz
radio band. The frequency was chosen close to that of a TV station.
|
The existence of sophisticated Soviet bugs was brought to the attention
of the Americans 1 by the French intelligence service,
who found a similar one inside one of the
teleprinters
at their Moscow embassy in January 1983 [8].
After learning about the bug,
LtG. Lincoln Faurer, the Director of the NSA (DIRNSA),
sent analysts to examine the implant. The analysts found that
the bug represented a major technological improvement over the Soviet's
previous efforts. Due to their professional nature and the choice of
components, it was thought that there should be more of them around.
As the NSA trusted neither the State Department nor the CIA to handle
the matter appropriately, they developed a plan over the next few months,
to remove, replace and examine all information processing
and telecommunications equipment at the US embassy in Moscow.
The highly secret GUNMAN project was approved by President Ronald Reagan
in record time in February 1984 [2].
|
During the following months, a list was made of all embassy equipment
that had to be replaced. In the meantime, procedures were started
for procuring the equipment as fast as possible, without attracting
too much attention. About 40% of the equipment was purchased from the
original manufacturers, whilst approx. 60% was found at the NSA itself
and with other agencies.
The NSA was able to obtain just 50 IBM Selectric typewriters
of the 250 that were needed. IBM had limited stock and 220V
models 2 were not available from any European distributor either.
|
|
|
As a result it was decided to replace only the typewriters
that were used in the most sensitive areas of the embassy.
All equipment was tested prior to shipment and both the devices
and their packaging were provided with tamper-evident measures,
to ensure that they were not examined or modified by anyone while on route.
During the transport to Moscow, via Dover Air Force Base and a
warehouse in Frankfurt (Germany),
the shipment was constantly guarded by US personnel.
|
The entire operation was carried out with the utmost secrecy,
to avoid alarming the Russians. Even at the NSA itself, it was
only known to the people that were directly involved.
The cargo was delivered in batches to the US embassy in Moscow
in the spring, which was not unusual.
At the embassy, all equipment had to be carried up to the attic
by hand, as the Russians had shut down the elevator after the first
day of the arrival of the equipment, for 'preventive maintenance'. 3
This involved carrying 10 tons of equipment into the building
as well as 11 tons out of it. From the attic is was then distributed
over the various offices over the course of the next 10 days.
The image on the right shows the rear side of the US embassy in
Moscow at the time of the GUNMAN Project. From here the equipment
was unloaded.
After the equipment, that was seized from the embassy, had been delivered
back at the NSA – again shipped in tamper-evident packaging – the
long and tedious process of examining each individual
piece of equipment was started. All accountable equipment was
searched for bugs with the highest priority in a separate building.
|
|
|
Examples of accountable items are the
cipher machines that were used
for highly confidential and top secret communication between the embassy
and the State Department back in the US. Such machines were normally
placed inside a shielded room that was heavily guarded by US Marines.
|
Although it was unlikely that the accountable
cipher machines had been bugged
by the Soviets, they were put under scrutiny and every single circuit
board was removed and x-rayed. The image on the right shows one of the
x-ray machines that were used for this job. At the far right, an American
KW-7 cipher machine
is just visible and one of its circuit boards
(with the red and yellow parts) is currently under the camera.
The non-accountable items were handled by a separate team with less priority.
Again, each item was x-rayed and the resulting images were compared with known
standards. As an incentive - probably demonstrating his own impatience -
the leader of the team, Walter Deely, offered a US$ 5,000 bonus for the
first person to find an eavesdropping device. Then, on the evening of
Monday 23 July 1984, technician Michael (Mike) Arneson
noticed an anomaly in the power switch of an IBM Selectric typewriter
and decided to x-ray the whole machine from top to bottom [3].
|
|
|
To his great surprise, he noticed a large number of electronic circuits
around the keyboard area and immediately knew he had stumbled upon a bug.
But he had to wait until the next day, before this could be confirmed
by his colleagues. Consequently, the $5,000 bonus was his.
The image below shows part of the original x-ray that showed the bug
inside the aluminium support bar.
The six black dots at the lower right in the x-ray, are the magnetometers
that picked up the movements of the six modified latch interposers
of the keyboard. A full description of how this worked is given below.
The black rectangle at the far right is probably the input filter at which
the power is fed to the device, via an isolated mounting screw entering
the device from the right.
|
The power for the device (approx. 12V DC) was bleeded from
the AC mains power line, through a bleeding unit that was
built inside the existing power switch. This was the anomaly that
Mike Arneson described as a 'ghostly grey' item and that had
triggered him to further x-ray the rest of the machine.
The image on the right shows a cut-away version of the modified
power switch.
The actual bleeding unit is a small foil capacitor which the
Russians made especially for this case. This solution is used today to avoid
the use of transformers in low-cost domestic equipment. 4
|
|
|
After the discovery, the other IBM Selectric
typewriters were checked with the highest priority.
Of the 44 machines that had been returned from the embassy in Moscow,
6 contained implants.
The bugs were subsequently reverse-engineered by the NSA, and the personnel
of other agencies was trained on how to recognize the bugs in the field.
As a result, 7 more typewriters in the embassy in Moscow and 3 in
the consulate in Leningrad appered to have implants.
In total, 16 Soviet bugs were discovered in twelve IBM Selectric II
and four IBM Selectric III typewriters in 1984 [2].
|
|
-
The NSA report [1][2] does not disclose the foreign ally who found the
initial bug, nor in what kind of device it was found. It only states
that it was not found inside a typewriter. Alexander Korolkov states
in [8] that it was found by the French inside a teleprinter at their
Moscow embassy.
-
As the AC mains voltage in the US (110V/60Hz) is different from the
voltage used in the Soviet Union and in the rest of Europe (220V/50Hz),
US distributors generally only had 110V/60Hz models in stock.
-
Due to the adversarial nature of the relationship between the US and the
Soviet Union, the Soviets often played games with the Americans by
shutting down utilities such as water or electricity.
-
Bleeding circuits are commonly used today in low-cost domestic appliances,
such as coffee machines and toasters, to avoid the use of expensive
transformers. They drive a microcontroller directly from the mains.
|
When the operator presses a key, the print head
of the IBM Selectric is rotated and tilted in such a way that the
correct letter appears on the paper.
The golf-ball-shaped head
has four rows of 22 characters each (or 24 on the later Selectric III).
The combination of elevation and rotation angle is unique for each letter on
the print head.
One half of the type ball is used for the lower case characters,
whilst the other half contains the upper case or shifted characters,
as shown here:
The system has 4 possible tilt levels; one for each row of 22 characters
on the print head. When in shift mode, the print head is rotated by
180°, so that the other hemisphere is in front. For the character immediately
in front of the platen, the head does not have to rotate. For the remaining
10 characters, the print head has to rotate between 1 and 5 steps in the
positive direction or in the negative direction.
Tilt and rotation are controlled by
digitally encoded mechanical arms.
The diagram above shows how this works. When a key (blue) is pushed down,
its keylever (yellow) pushes down a so-called
interposer (orange)
that is coded with a unique set of 7 lugs (or gaps) at the bottom.
The interposers are different for each key.
Once the key is down, the interposer is pushed forward and each lug (when
present) pushes one of the 7 selector bails (violet) forward.
Six of the bails directly control the movement of the print head. The 7th
bail is for special features, such as Shift, Carriage Return and Backspace.
It is not intercepted by the Soviet bug.
Each of the 6 activated selector bails then moves its corresponding
latch interposer (red) forward as well, which has a direct effect
on the tilt or rotation of the print head. The latch interposers
were replaced by the Soviets by identically shaped ones that were made
of non-magnetizable metal, with a very strong magnet
in the font tip (green). The Soviets replaced the comb support bar
by a modified one which housed the bug.
Working through the aluminium casing of the modified support bar,
these magnetic tips actuated the 6 magnetometers 1 inside the bug.
The data from the 6 magnetometers (i.e. 6 bits) was somehow
digitally compressed
2 into 4-bit words and then stored in a magnetic-core buffer
that could hold up to 8 such 4-bit data words. Once the buffer was full,
the data was sent by a low-power transmitter at high speed (burst)
to a nearby listening post. The simplified block diagram above is an
educated guess of how the bug might have worked, based on the rather
limited descriptions found in the NSA report [2].
|
|
-
It is currently unknown what kind of magnetometer was used in the Soviet
bug. Although it is entirely possible that a semiconductor HALL element
was used, it is more likely that a fluxgate-type magnetometer was used,
constructed from small ferro-magnetic coils [5].
-
It is unknown why and how the data was compressed from 6 to 4 bits,
and the NSA report [2] is very vague on this point. It is possible
that the Soviets used 4-bit logic and had to spread the 6-bit data over
more than one 4-bit data word, but it is more likely that they used
frequency analysis (see below).
|
As explained above, the tilt and rotation of the print head (ball) is
controlled by the presence or absence of the lugs on the interposer that
is mounted below each key of the keyboard. Although there are 8 possible
lugs on the interposer, only 6 are used to control the position of the
print head: T1, T2, R1, R2, R2A and R5. The 6 lugs control the position
of 6 bails, which in turn control the position of the 6 latch
interposers. The position of these latch interposers directly
controls the tilt and rotation of the print head. Their position is also
monitored by the Soviet implant.
The rearmost lug (CK) is reserved for special applications of the
typewriter, which leaves us with 6 lugs that control the movement
of the print head. Five lugs (T1, T2, R1, R2 and R2A) use
negative logic, whilt the remaining one (R5) uses
positive logic.
Lugs T1 and T2 control the tilt,
allowing 4 different vertical positions by using the
binary combinations (00, 01, 10 and 11), like this:
|
|
Lugs
|
Tilt
|
|
Lugs
|
Tilt
|
|
|
|
-
|
3
|
|
T2
|
1
|
|
T1
|
2
|
|
T1 + T2
|
0
|
|
Rotation of the print head is slightly more complex and is
controlled by the leftmost four lugs: R1, R2, R2A and R5.
R1 rotates the head by 1 step in the positive direction. R2 and R2A
each rotate the head by 2 steps, whilst R5
rotates it 5 steps in the negative direction (i.e. -5).
|
|
Lugs
|
Rotation
|
|
Lugs
|
Rotation
|
|
|
|
-
|
+5
|
|
R5
|
0 1
|
|
R1
|
+4
|
|
R1 + R5
|
-1
|
|
R2
|
+3
|
|
R2 + R5
|
-2
|
|
R1 + R2
|
+2
|
|
R1 + R2 + R5
|
-3
|
|
R2 + R2A
|
+1
|
|
R2 + R2A + R5
|
-4
|
|
R1 + R2 + R2A
|
0
|
|
R1 + R2 + R2A + R5
|
-5
|
|
-
This combination is redundant (i.e. the same as the one at the bottom left).
Lug R5 is never used on its own.
|
Note that the bug can only record a character when at least one of the 6 bits
is true. As a result, the implant can not read the character with binary code
000000. Furthermore, the bug can not 'see' any of the special
keys, like Shift, Space, Backspace, Tab and Carriage Return.
Note that the home position of the 6 latch interposers does not
correspond to the home position of the print head, as 5 of the 6 interposers
use negative logic. As a result, the hyphen (-) can
not be sensed.
As it doesn't know when Shift
is depressed, the characters at the upper case
hemisphere of the print head will be mapped onto those of the lower
case hemisphere. Luckily, the upper case characters are at the same relative
position on the print head as the lower case ones, just rotated by 180°.
Although this will produce some ambiguity in the output,
the text will still be readable.
The complete letter mapping is shown above. Note that the hyphen and
underscore 1 will be omitted as these correspond to the default position
of the interposers. In practice this means that all text will be in lower case,
that the hyphen is missing, that interpunction characters may be different
and that all special functions, such as space and backspace,
are omitted. An example:
Meeting with "Jerry" at Tulip Hotel (room A-23) on 24 November at 10:00
↓
meetingwith'jerry'attuliphotel8rooma239on24novemberat10/00
This is not the whole story however. According to the NSA report, the
Russians compressed the 6-bit data into a 4-bit frequency select word.
Although the report doesn't explain what they mean by this, we can make a few
educated guesses. The reason for compressing it into 4-bits, was probably
the fact that the Russians only had access to 4-bit digital technology
at the time.
The problem with 4 bits however, is that each data word
has just 16 possible combinations (24).
By examining the frequency of letters in the English language,
we see that some letters are used more often than others.
If we assign a unique binary combination to the 9 most frequently used
letters, and group the others, e.g. as shown in the rightmost histogram above,
we need just 15 binary combinations, leaving one for the joint use of
interpunction characters. If numbers are also needed, more characters
could be grouped to free up additional binary combinations,
or they could be mapped on top of the letters. In the example below,
we have only used letters:
Although this method of grouping will lead to ambiguity
in the recovered data, it will generally be possible to 'guess' which
character of a particular group was used, based on probability theory.
For example: in the intercept above, the bigram CU (1) is more likely to
occur than UC. Likewise, the bigram TU (2) is more common than TC,
leaving us with positions (3) and (4) to try manually.
In practice this might have been implemented as a manual or a (partially)
automated process.
|
|
-
Although, the head has to rotate 180° from its home position to print
the underscore '_' (which is opposite the hyphen '-'), this is regarded as 'no
movement', as the tilt and rotate interposers do not move.
The 180° rotation, caused by pressing the Shift key, is
controlled by a separate bail that is not monitored by the bug.
|
The IBM Selectric is built on a sturdy die-cast aluminium frame. The
image below shows the bottom of the machine with the frame clearly
visible at the lower half.
Towards the front is the keyboard, mounted in between two side panels.
As part of the structure, an aluminium support bar is mounted between
the two side panels. It holds the guide combs for the key interposers.
In the image above, the key interposers are clearly visible, running
vertically in the keyboard section. At the left half of the keyboard section
are the 6 latch interposers that form the binary representation of
the pressed key. The latch interposers control the arms of a so-called
Wiffletree mechanism [6],
which in turn controls the rotation and tilt of the print head.
The front tips of the 6 latch interposers are supported by a
black guide mounted on the support bar, as shown here:
The Russians replaced the short black support comb (mounted on the aluminium
bar) by a non-magnetizable one. They also replaced the 6 latch interposers
by identical ones that had a highly magnetized tip that protrudes the guide
comb. The aluminium support bar, on which the various combs are mounted, was
replaced by the Russians by a hollowed-out one that contains the bug.
The images above show the actual bug, mounted inside the hollowed-out support
bar made by the Russians, plus a partial x-ray of the device, made by by
the NSA when it was discovered. The six circular spots at the lower
edge of the x-ray are the magnetometers which are precisely aligned
with the magnetic tips of the latch interposers. The transmitter is
probably at the far left.
The image above shows the the 6 latch interposers with the x-ray
superimposed over the left side of the aluminium support bar. It clearly
shows the position of the 6 magnetometers close to the magnetized tips of the
latch interposers. As the black support comb was also replaced -
by an aluminium one -
the magnetometers could 'see' the magnetized tips through the aluminium.
As soon as a latch interposer is activated,
it engages the associated (invisible) magnetometer.
The Russians must have put a lot of work into producing these bugs.
The modified support bar could not be distinguised from the original one,
not even by a trained IBM service engineer, and the bug consists of
custom-made integrated circuits (ICs) that were sophisticated for the era [2].
This means that it is very likely that they were also planted inside the
IBM Selectric typewriters used by other embassies, although so far we
have not seen any evidence to support this.
|
|
The Russians made the following modifications to the IBM Selectric typewriters:
|
- Modified aluminium comb support bar with bug.
- 6 latch interposers replaced by non-magnetizable ones with strong magnet in the tip.
- Modified power switch (on some versions).
- Additional spring lug and screw (left side).
- Coaxial screw (on some versions).
|
The bugs were probably planted inside the IBM Selectric typewriters when
the machines were in transit (perhaps in Poland or Moscow itself)
awaiting customs inspection prior to their delivery to the US embassy
in Moscow.
As a general rule, equipment for handling classified information
had to be shipped through special courier channels, but some
unaccountable equipment, such as the typewriters, were sent via
regular channels in a batch of office furniture.
The KGB could easily have identified candidate typewriters by finding
those with Tempest modifications [3].
It would have taken a trained technician approx. 30 minutes to modify the
machine. Including unpacking and repacking, it would have taken them
less than one hour, which is not unrealistic.
According to NSA and FBI reports [2], the US had taken no precautions
against this, such as the use of tamper-evident packaging,
nor could they produce the full (service) history of each device,
as such records were destroyed routinely after 2 years.
The bugs went undetected for several reasons. First of all, because they
transmitted their data in very short bursts, which could hardly be
picked up. Secondly, because their radio frequency was very close to
that of a local TV station. The most important reason however, was the fact
that the Americans were using outdated
TSCM equipment 1
from the 1950s,
which was known to the Russians.
Although the Americans did use a
non-linear junction detector (NLJD),
which is capable of finding electronic circuits even if
they are not switched on, the Russians knew this as well, and had taken
extra measures to hide the Selectric Bug from NLJDs like the British
Audiotel Broom.
Around the time the bugs were discovered, in 1985, stories surfaced in the
press that the signals from the typewriter bugs were picked up by antennas
hidden inside the embassy walls, or that they used the machine's power cord
to send the data to the KGB via the mains network.
Although the NSA report [2]
does not state how and where the signals were picked up, these theories
seem highly unlikely as the building was thoroughly inspected and the mains
lines were filtered.
|
|
-
TSCM = Technical Surveillance and Counter Measures.
|
Depending on the version of the bug, it used radio frequencies in
the 30, 60 or 90 MHz band. In all cases it operated in the same frequency
band as a local TV station, using a frequency very close to the actual
(strong) TV signal, so that it was hardly detectable by someone monitoring
the spectrum. The diagram below shows how this might have been done.
The signal is on the air very briefly and can barely be distinguised
from the TV-signal's Frequency Modulated (FM) carrier.
|
Since some of the bugs were DC powered, and the Russians wanted to avoid
their detection, a low-power burst transmitter was used. Although part of
the typewriter's linkage was used as an antenna, the transmitting range
was limited by the fact that the entire machine is housed inside a heavy
die-cast aluminium enclosure. This means that the listening post must have
been in the immediate vicinity of the embassy or, in fact, near the
room in which the typewriter was located.
It is likely that the earlier versions of the bug had an even shorter range,
which might account for the (passive) antenna system that was found in one
of the chimneys in the south wing of the US embassy in Moscow in 1978 [3].
The antenna was cut for 60 and 90 MHz but appeared to have no function.
It should have caused all alarm bells to go off at the time, but was
misinterpreted.
The batteries inside the earlier DC powered bugs, were dated 1976 and 1979,
indicating that they probably used the passive antenna system in the chimney,
to relay the signal to the nearby Soviet listening post. It is possible
that the output power of the later AC-versions was improved
so that data was delivered directly at the listening post
without the need for additional antennas.
In 1978, the typewriters at the embassy in Moscow were examined by a TSCM
technician, but as he assumed any bugs to be linked to the power line, he
only x-rayed the power structure of the machines (i.e. the power cord, the
power switch and the start capacitor). As at that time the bugs were still
DC-powered, the power switch wasn't modified and the technician found
nothing [2].
|
The Russians kept improving and upgrading their implants throughout the years.
After reverse-engineering the implants, the NSA was able to identify five
different versions or generations of the bug [2]. Three types
were powered by batteries (DC) and contained 8, 9 or 10 mercury cells.
The image below shows an early type of the bug,
with the batteries clearly visible at the top right.
The two other types were powered from the AC mains and had sensors to determine
whether the typewriter was turned ON or OFF. Some of the units also had a
modified ON/OFF switch with a separate transformer that powered the implant
directly. Other implants had a special coaxial screw with a spring and lug,
allowing another metal part of the typewriter to be used as antenna.
Later battery-powered versions had a test point underneath an end screw at
one of the side panels.
After removing the screw and inserting an isolated probe, it was possible
to measure the battery voltage and determine whether the the device still
had sufficient power for operation.
Depending on the version, the devices worked in the 30, 60 or 90 MHz
frequency band, with their frequency always chosen to be close to an
existing (strong) TV station. As a result, the short weak data burst
was hardly noticable in the 'noise' of the FM modulated SECAM TV carrier,
and would certainly be missed by the spectrum analyzers that were used
by the Americans at the time.
|
|
Supply date
|
Qty
|
Selectric
|
Version
|
Power
|
Remark
|
|
|
|
October 1976
|
1
|
II
|
1
|
DC
|
|
|
April 1977
|
2
|
II
|
1
|
DC
|
|
|
November 1977
|
1
|
II
|
2
|
AC
|
|
|
February 1982
|
5
|
II
|
3
|
AC
|
more advanced
|
|
January 1984
|
4
|
III
|
5
|
AC
|
more advanced
|
|
|
Supply date
|
Qty
|
Selectric
|
Version
|
Power
|
Remark
|
|
|
|
April 1977
|
2
|
II
|
1
|
DC
|
|
|
March 1982
|
1
|
II
|
4
|
DC
|
more advanced
|
|
Although electric typewriters were already being built before WWII,
it was only from the early 1960s onwards that they became mainstream
in offices.
The IBM Selectric typewriter [4] was invented in 1961 and dominated the
professional office market for the next 20 years. It used a novel principle
with a removable print head (the 'ball') that allowed the use of various
typefaces.
The first IBM Selectric was introduced on 31 July 1961 and used a type ball
with 88 characters divided over 4 rows. It was followed in 1971
by the improved Selectric II, shown in the image above.
After this, the old Selectric was commonly called Selectric I.
It used the
same 88 character print head. The Selectric II was followed in 1973 by the
Correcting Selectric II which, as the name suggests, had a text correction
facility. In the early 1980s, it was succeeded by the Selectric III,
which featured a 96 character print head. This was the last machine with
a golf ball made by IBM.
|
|
Below are a couple of videos that may help to get a better understanding
of how the IBM Selectric works. The first video demonstrates how
Whiffletree mechanisms (also known as Wippletree) [6]
are used to rotate and tilt the ball-type print head
by means of mechanically binary coded bits.
|
The next video is rather slow pace and is part of a series of training
videos that were issued by IBM in the late 1970s.
They were used by service personnel and repairmen to get a proper
understanding of this highly complex electromechanical machine
and its systems of interposers [9].
|
For those of you who own an IBM Selectric and want to know how to
quikly diassemble it, here is a step-by-step guide on how to take
it apart, made by Fran Blance, who also gives some useful tips on
proper maintenance and restoration of the machine [10].
|
|
|
Other websites on this subject
|
|
|
- Sharon A. Maneki, Learning from the Enemy: The GUNMAN Project
National Security Agency (NSA), 2012. Retrieved October 2015.
- Sharon A. Maneki, Learning from the Enemy: The GUNMAN Project
United States Cryptologic History, Series VI, Volume 13.
NSA, 8 January 2007. 1
- Thomas R. Johnson, American Cryptology during the Cold War, 1945-1989, Volume IV
NSA. Book IV: Cryptologic Rebirth, 1981-1989. 24 February 1998. pp. 402-406. 2
- Wikipedia, IBM Selectric typewriter
Retrieved October 2015.
- Wikipedia, Magnetometer
Retrieved October 2015.
- Wikipedia, Whippletree (mechanism)
Also known as 'Whiffletree'. Retrieved October 2015.
- Wikipedia, Letter frequency
Retrieved October 2015.
- Alexander Korolkov, Big ears of the USSR: The top 5 Soviet wiretaps during the Cold War
Russia Beyond the Headlines (website). 30 January 2015. Retrieved October 2015.
- User 'Daderot', Image of IBM Selectric II and photograph of bug
Via Wikipedia. Retrieved October 2015.
- Joachim Doebers, Selectric Repair 10 3A Input: Keyboard
Los Angeles (CA, USA), 1978. Via YouTube user 'Brian Brumfield'. Retrieved October 2015.
- Fran Blance, How to take apart and service the IBM Selectric II Typewriter
Via YouTube. Retrieved October 2015.
|
|
-
Partly declassified by NSA on 12 January 2011 (EO 13526).
-
Approved for release by NSA on 14 January 2011, FIOA Case #54492.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Wednesday 14 October 2015. Last changed: Friday, 08 April 2022 - 16:16 CET.
|
|
|
|
|
|
| | |
![Rear view of the US embassy in Moscow at the time of the GUNMAN project [1].](img/moscow.jpg)
![Cut-away of the original modified switch [2]. Original NSA image digitally enhanced by Crypto Museum.](img/switch.jpg)
