|
|
|
|
|
|
|
Ascom Crypto AG Crypto Voice CRYPTOVOX →
The crypto-version of the SE-660 is compatible with the crypto-version
of the handheld SE-160,
and can be recognised by the letter 'C' at the end of the model number.
It is also compatible with Crypto AG's
CRYPTOVOX SE-580 portable radio.
The radio has the same form factor as a common consumer car radio, and
can therefore be fitted easily in the dashboard of a car in the slot
that is normally reserved for the car stereo. If such a slot is not
available, the SE-660 can also be used with detached front panel,
in which case the actual radio is mounted in the trunk of the car.
|
|
|
|
The SE-660 was a very popular two-way radio with police forces in Europe,
in the years prior to the introduction of digital communication systems
like TetraNet. 1
It was used in particular by special intervention teams and for VIP
protection, not least because of its excellent audio quality and its
high-grade digital encryption. In the Netherlands, the SE-660-C was used
by several special police departments, often alongside the
handheld crypto-capable SE-160-C radio.
The price of a single crypto-enabled SE-660-C unit in 1997 was NLG 9195
(approx. EUR 4180) [3].
It has meanwhile been confirmed that in most cases the encryption unit
was backdoored [4][5][6].
|
-
In the Netherlands, TetreNet is known as C2000.
➤ Wikipedia
|
All controls of the SE-660 are at the front panel, that has the same size
as a regular car stereo, allowing it to be integrated in the most vehicles
without any adapters or special mounts. In addition it was possible to use
the radio with detached front panel, by using the BG-660 kit.
At the top right is a small plastic lid, behind which is a socket for a
special codeplug, that could (optionally) be used to protect the radio
against unauthorised use. As far as we know, the codeplug was only
used by the German Police. At the bottom right is an 8-pin RJ-45 socket
to which peripherals can be connected, such as the microphone and the
HC-3400 crypto key entry device.
The ON/OFF button at the top left - commonly printed with the name 1
of the manufacturer – also acts as the shift-key. When it is pressed briefly,
the rightmost symbol of the display lights up and all buttons
have a different (shift) function. Shift-mode is cancelled automatically after
three seconds. Keeping the ON/OFF/SHIFT button depressed for two seconds turns the radio off.
The display of the SE-660 has a multi-colour backlight. When in crypto-mode,
the display will be green when receiving a compatible secure signal that is
encrypted with the same key. Signals that are encrypted with a different key
will be ignored. When receiving a standard analogue signal, the display
turns red, indicating that the conversation is non-secure. This is very
useful if, say, a policeman presses his red distress button, after which
the voice signal is no longer encrypted. 2
The symbols at the top edge of the display have the following meaning:
|
- Receive
- Transmit
- Speaker on (tone squelch off)
- Call waiting
- Battery empty
|
- Scanning
- Encrypted
- Keypad locked
- Crypto default
- Shift (additional features)
|
-
In most cases this button carries the brand name ASCOM
or BOSCH.
-
Note that when CTCSS is used, the programmed CTCSS frequency has to match
the CTCSS frequency of the received signal, in order to hear the conversation.
|
|
The following models of the SE-160 are currently known:
|
|
In addition to the model (see above), different version and variants
of the SE-660 were available. Check the model number to see
which features are available on your radio. The following versions are known:
|
- Standard
This is the standard version of the SE-660. Although it features digital
frequency control by means of a programmable synthesizer, it is only suitable
for analogue (voice) communication. Data communication can be added as an
option.
- Crypto
This version is suitable for analogue (clear) voice communication, as well
as digitally encrypted speech and (optionally) data. It features the
Crypto AG (Hagelin) HC-3400 embedded encryptor, that is implemented as a
chip on the control board of the radio.
- Digital
This version is suitable for digital voice communication, like P-25.
At present, no further information is available about this version.
- Trunking
This version made especially for Trunking Radio networks, such as
Actionet, SpeedCom, RegioNet, Chekker and Traxys. It is based on the same
hardware as the standard version, but the firmware and the font panel
are different.
|
|
The crypto-variant of the SE-660 is suitable for secure voice communication
with other HC-3400 compatible radios, such as the
SE-160-C handheld radio.
For this purpose, the standard control board (CPU) of the SE-660 has been
replaced by one that contains the embedded HC-34xx chip.
|
The HC-3400 is made by Crypto AG (Hagelin)
in Zug (Switzerland),
and provides professional high-grade speech encryption with an excellent
voice quality. The data is protected by a 128-bit key that can be generated
with the so-called
Key Entry Device KED-3400,
also from Crypto AG.
Alternatively, keys can be entered manually as 32 hexadecimal digits.
In addition to single keys, the device also supports the 3-KEY strategy, in
which a past, present and future keys are used.
The same KED key entry device and the same keys can be used for the
SE-160 handheld radio.
|
|
|
In addition to speech, the radio can also be used for data transmission,
by adding the optional LP-660 serial interface board. When placed in the
crypto-capable version of the SE-660, the serial data can also be
encrypted by the HC-3400 controller.
➤ More about the KED-3400
|
The SE-660 is powered directly from the 12V (13.8V) DC voltage of a
car battery, which is connected to the
4-pin socket at the rear.
A suitable cable with a 4-pin female plug
was provided with the radio.
The plug is identical to the 4-pin plug that was used to power the
harddisc drives of the 1990s.
Two wires are used for 12V (red) and 0V (black). The two remaining
(green) wires are used for the connection of an external loudspeaker.
|
|
|
The SE-660 came with a standard handheld microphone, such as the
MI-660 shown in the image on the right. The microphone is fitted with
an 8-pin modular RJ-45 plug at the end of the spiral cable, that
mates with the RJ-45 socket on the front panel of the radio.
Alternatively, it can be fitted to the detached front panel
in case the BG-660 extension kit is used (see below).
|
|
|
When the SE-660 can not be fitted in a slot on the dashbord of
the car, it is possible to convert it into a remote controlled radio.
This is done by removing the front panel and replacing it with a so-called
control head. The
detached control panel is then
fitted to a long inter-connection cable
that is connected to a multi-pin socket on
the control head. Note that different (incompatible) versions of the
front panel exist. The front panel of a VHF version, does not work on an
UHF unit and vice versa. 1
|
|
|
-
Test at Crypto Museum with an SE-660-459-2-C and an SE-660-169-2-C.
|
The SE-660 can be extended with an (optional) interface that is installed
in the empty space at the bottom of the radio. The board measures 93 x 52 mm,
and is connected to the unsused red 20-pin socket on the power board, by means
of a short 20-way ribbon cable. 1
The interface to the outside world consists of a
9-pin sub-D female socket and a 15-pin sub-D male socket,
that protrude 2 the
pre-cast holes at the rear.
The 9-pin socket provides an RS-232 serial
port and allows the connection of a data processing device,
such as a message terminal.
|
|
|
-
There are at least two different types of interface.
Both are shown in the image above.
-
Note that the holes for the connectors are normally covered by a metal
panel, that has to be removed first.
|
|
Programming of the frequencies and features of the SE-660 radio
is fully under control of the Interactive Parameter Programming software
IPP-660, in combination with a special programming cable, of which one side
connects to the 8-pin RJ-45 socket at the front of the SE-660, and the
other side to the parallel port of a standard DOS PC. The cable provides
an I2C interface.
|
Especially for Ascom dealers and service centres, Ascom developed the
PAG-660 test box, shown in the image on the right. The box has a fixed
cable with a modular RJ-45 jack at the end, that can be fitted directly
to the socket at the front.
At the rear side of the box is a 9-pin sub-D socket to which the programming
cable can be connected. The programming cable should be connected to the
parallel port of an old DOS PC that runs the IPP-660 programming software.
Once installed between the PC and the radio, the software can be used
to program all features.
|
|
|
The PAG-660 has several switches for direct control of some functions
of the SE-660, such as the squelch, the push-to-talk switch (PTT), the
microphone and the speaker. It has a small built-in speaker, and a socket
for a microphone at the rear. At the rear are also some test sockets.
|
|
The SE-660 is extremely well-built. It is based on a die-cast aluminium
frame with compartments at the top and bottom. All electronic
circuit boards are mounted either at the top or at the bottom of the frame.
The frame is enclosed in two blue case shells that are simply clicked in place.
|
Getting access to the interior, requires no more that a screwdriver.
Insert the screwdriver into one of the small gaps at the side, and bend
out the case shell. Do this at both sides to remove the shells.
The interior should now be visible.
The RF parts (i.e. the actual radio) are at the top side of the frame.
They are usually covered by metal shielding panels that are easily
removed. In the images below, these shielding panels have been removed
in order to shows the RF parts. Most of the transceiver is not immediately
visible as it is shielded by solder-fixed metal panels.
|
|
|
The bottom side of the frame holds the internal power supply unit (PSU)
and the control board, or central processing unit (CPU).
The CPU is additionally shielded by means of a
die-cast aluminium panel,
that is held in place by four crews at the corners.
Remove these to access the CPU board.
|
Depending on the model, version and variant of the radio,
different CPU boards are used.
The image on the right shows the CPU board of the crypto-capable
version of the SE-660 on which the large HC-3400 encryption chip,
made by Crypto AG,
is clearly visible at the bottom right.
The board has components on both sides. The top side
holds the HC-3453 crypto chip. Note that on non-crypto radios, it contains
far less components. The bottom side
of the board holds the actual (customised) Hitachi microcontroller,
memory, flash storage and additional glue logic.
|
|
|
|
The CPU board is connected to the PSU board by means of a ribbon cable,
and also to the RF unit at the other side of the frame, via a 16-pin
header. The radio can optionally be expanded with a
serial interface board
that can be fitted in the empty space between the CPU and the rear panel.
|
|
At the bottom right of the front panel is an 8-pin RJ-45 socket
for connection of the microphone, a handset, a programming device
or a key loader. The diagram below shows the pinout when
looking into the socket from the front of the radio.
|
- Ground
- Microphone
- Speaker
- PTT
- Hook switch 1
- ZCL (I2C Clock)
- ZDA (I2C Data)
- 12V(+) switched
|
|
-
Inside the handheld microphone is a reed switch.
|
|
At the rear side of the radio is a 4-pin socket for connection of the
12V DC supply voltage and the speaker. This 4-pin socket is identical to the
ones that were formerly used on IDE disc drives. Below is the pinout of
this socket, when looking into the socket from the rear side of the radio.
|
- Speaker green
- Speaker green
- Ground (-) black
- +12V (+) red
|
|
|
|
Interface 9-pin sub-D
option
|
|
|
- Relay contact (n.o.) 1,2
- Serial RX data
- Serial TX data
- Relay contact (common) 1
- Ground
- not used
- IO-1
- IO-2
- Relay contact (n.c.) 1,3
|
-
The Dutch Police used the relay for a Mute circuit.
-
n.o. = Normally open (will be closed when the relay is activated)
-
n.c. = Normally closed (will be opened when the relay is activated)
|
|
|
Interface 15-pin sub-D
option
|
|
|
- Microphone (2)
- Microphone (3)
- Ground
- PTT (2)
- PTT (3)
- TX audio out
- TX audio in
- RX audio out
- RX audio in
- IO-3 (squelch)
- IO-4
- IO-5
- Speaker
- Hook switch
- +12V (1A max.)
|
The model number is printed on a label at the side of the radio and always
starts with the model number: SE 660. The meaning of the remaining parts
is given in the diagram below, based on the model number of the radio that is
featured on this page. It is constructed as follows [2]:
Use the tables below to decode the actual digits found at the side of the
radio. In our case, the radio covers the 425 to 450 MHz band (45)
with a channel spacing of 20/25 kHz (2).
It has an output power of 15 Watts (9) and features
build-in voice encryption (C).
SE-660-459-2-C.
|
04 33-45 MHz 05 45-58 MHz 08 68-88 MHz 14 132-148 MHz 16 146-174 MHz 20 173-224 MHz 21 205-207 MHz 33 300-344 MHz 42 400-425 MHz 43 400-440 MHz 45 425-450 MHz 46 430-470 MHz 47 450-470 MHz 92 892-980 MHz
|
0 Driver only 1 1 W 2 2.5 W 5 5 W 6 6W 7 10 W 8 15 W 9 25 W
|
1 12.5 kHz 2 20/25 kHz 3 25 kHz 5 50 kHz
|
S Standard E SBB 1 with keyboard C Crypto D Digital T Trunking X Eplosion safe variant (EEX)
|
CT Crypto Trunking DT Digital Trunking EC SBB 1 with keyboard and Crypto ET SBB 1 with keyboard and Trunking TX Trunking and EEx (147-156 MHz) Seco Standard and low-grade Teco Trunking and low-grade TXeco Trunking and Ex and low-grade
|
-
SBB = Schweizerische Bundesbahnen (Swiss Federal Railways).
|
SE-660-459-2-C 425-450 MHz, 25 W, 20/25 kHz, Crypto SE-660-169-2-C 146-174 MHz, 25 W, 20/25 kHz, Crypto
|
|
The SE-660, and in particular the crypto-enabled SE-660-C, was used
in the Netherlands by several special police departments and security
organisations, including the ones listed below. Note that some of
these organisations have meanwhile been renamed, merged or disssolved.
|
|
KLPD
|
|
Korps Landelijke Politiediensten
National Police Services.
|
|
LRT
|
|
Landelijk Recherche Team
National Police Investigation Team.
|
|
NR
|
|
Nationale Recherche
National Police Investigation Team.
|
|
CRI
|
|
Centrale Recherche Informatiedienst
Central Investigation Intelligence Service.
|
|
KTR
|
|
Kern Teams Recherche
Core Investigation Teams.
|
|
DKDB
|
|
Divisie Koninklijke en Diplomatieke Beveiliging
Division Protection Royal Family and Diplomatic Missions.
Part of the KLPD.
|
|
DTOO
|
|
Dienst Technische Operationele Ondersteuning
Technical Operationsl Support Service. Part of the KLPD.
|
|
BSB
|
|
Brigade Special Beveiligingsopdrachten
Special Protection Branch. Department of the Dutch Military Police
(Konklijke Marchaussee) taksed with the protection of VIPs.
|
|
DNB
|
|
De Nederlandse Bank
Dutch National Bank.
|
|
NS
|
|
Nederlandse Spoorwegen
Dutch National Railways.
|
|
VNT
|
|
VN-Tribunaal
United Nations Tribunal Court.
|
On 24 October 2020, the Dutch investigative
VPRO radio program Argos
revealed that the Ascom SE-660 devices that had been sold to the Dutch
police in the early 1990s,
contained a so-called backdoor.
This means that the cryptographic algorithm – from
Crypto AG –
had been weakened in such a way, that the radio traffic became readable
to the US
National Security Agency (NSA) [4][5].
Until the late 1980s, special enforcement teams of
the Dutch police had used open
– unencrypted – radio channels for their communication,
which could be received by anyone with a scanner.
After a series of major incidents, such as the kidnapping of brewer
Freddy Heineken (1983), the kidnapping and death of top manager
Gerrit Jan Heijn (1987) and the kidnapping and death of Army Colonel
van der Kieft (1989), it was decided that special law
enforcement units should get radios with the best possible encryption.
In the latter case, the Colonel had been killed by a shot from the swat team,
which was later attributed to the lack of reliable and secret communication.
The SE-660 radios were not only used by the Dutch Police, but also by
special units of the Dutch Army (in foreign operations),
criminal investigations teams, VIP protection teams, the Dutch Bank,
the UN Tribunal and many other special services throughout The Netherlands.
Unknown to the Dutch Government however, the company that
supplied the encryption – the Swiss Crypto AG –
was secretly owned by the
German BND
and the American CIA as part of
Operation RUBICON [6].
Argos has now revealed that the situation led to a
conflict between the BND and the CIA – the BND didn't want to
provide insecure equipment to the Dutch – but that in the end the
Americans won the argument.
In the broadcast, former Crypto AG employee
Jürg Spöerndli, confirms
the supply of backdoored equipment
to the Netherlands.
➤ VPRO Argos broadcast of 24 October 2020 (in Dutch language)
➤ VPRO long-read with background information (in Dutch language)
|
Ascom SE-660 ← actual manufacturer - Bosch SE-660
- Motorola SE-660
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Saturday 24 June 2017. Last changed: Wednesday, 08 June 2022 - 06:59 CET.
|
 |
|
|
|
