Click for homepage
Telsec 02
Two dimensional voice scrambler

TELSEC-02 was a frequency and time domain (F/T) voice scrambler for use on narrowband FM radio circuits, developed in 1987 by Teltron in München (Germany) especially for use with car phones on the analogue German C-Netz network [1]. It was also used by the Dutch police, during the high profile kidnapping case of Ahold manager Gerrit Jan Heijn, in September 1987 [2][3].

The unit measures 182 x 125 x 38 mm and weights 710 grams. It has a metal rail at either side, allowing it to be mounted in a cradle when fitting it under the dashboard of a car. At the rear is a DB25 socket for connection to the radio telephone set. The unit must be programmed with an encryption key that is held on a key card.

The device was intended for use with analogue mobile (car) phones, such as the German 450 MHz C-Netz [1], for which the existing 20 kHz bandwidth was sufficient. It offered a reasonable protection against the occasional interceptor.
  
Telsec 02 with key card installed

On 9 September 1987, top manager Gerrit Jan Heijn was kidnapped in front of his own house in Bloemendaal (Netherlands) by Ferdi Elsas [2]. His grandfather was Albert Heijn, who founded the family business, and his brother, also named Albert Heijn, was the founder of the Ahold empire.

An unemployed engineer, Elsas held a grudge against his former business partners, and was planning to have them killed, for which he needed a lot of money. He wanted to gain this money by kidnapping Heijn for randsom [3].

Although he murdered Heijn on the evening of the kidnapping, he successfully pretended that Heijn was still alive for a long time, for which he had saved Heijn's glasses and his cut-off little finger. During the following months, Elsas asked for a randsom and communicated with Heijn's family via coded messages in the newspaper.
  
Ferdi Elsas - kidnapper and murderer of Gerrit Jan Heijn - during the reconstruction of the case shortly after his arrest in April 1988. Copyright unknown [5].

As the police did not have a proper secure communication system with national coverage at the time, it was decided to use car phones on the Dutch ATF-2 network. ATF-2 provided national coverage with automatic hand-over, but was not protected against eavesdropping in any way.

Anyone with a (computer) scanner that covered the 450 MHz band was able to eavesdrop on any conversation that took place on the network, and it was known to the police that scanner listeners, hobbyist and probably the press as well, were continuously scanning the waves for material.

Luckily, Teltron had just completed the design of the TELSEC 02 and had carried out the first tests on the German C-Netz [1], which was similar to the Dutch ATF-2. Two sets were flown in with the highest priority and were connected to the modified handset of a Nokia RD-59 car phone. 1
  
Telsec 02 connected to a Nokia Mobira RD-59

The images above show one of the actual sets that was used in the months after the kidnapping and the handover of the randsom. Although voice scramblers are inherently insecure, the TELSEC 02 was considered sufficiently secure for this purpose as it kept out (un)intentional listeners like the press. In fact, during the 1988 Carnahan Conference on Electronic Crime Countermeasures of the IEEE in Montral (Canada), the device was considered inexpensive and extremely effective [4].

  1. In the Netherlands known as CARVOX 2453.

Telsec 02 with key card installed Rear side Telsec 02 connected to a Nokia Mobira RD-59 Telsec 02 with modified handset of the Noia RD-59 Front panel Ferdi Elsas during the reconstruction at the murder scene [6] Ferdi Elsas during the reconstruction at Heijn's house [6] Ferdi Elsas and the Heijn family communicated through coded ads in the newspaper [6]
A
×
A
1 / 8
Telsec 02 with key card installed
A
2 / 8
Rear side
A
3 / 8
Telsec 02 connected to a Nokia Mobira RD-59
A
4 / 8
Telsec 02 with modified handset of the Noia RD-59
A
5 / 8
Front panel
A
6 / 8
Ferdi Elsas during the reconstruction at the murder scene [6]
A
7 / 8
Ferdi Elsas during the reconstruction at Heijn's house [6]
A
8 / 8
Ferdi Elsas and the Heijn family communicated through coded ads in the newspaper [6]

Features
The diagram below shows the complete setup of the Telsec 02, as it was used in the Gerrit Jan Heijn kidnapping case. At the top left is the actual encryption unit (scrambler), with the keycard on top. This card, which has a magnetic strip, should be inserted into the slot at the front panel.


All connections (power, audio input and audio output) are available on a 25-pin DB25 socket that is wired to the connector of the handset, which has been modified for this purpose. The black connector is fitted to the handset socket of the phone. The radio telephone itself is not modified.


Interior
The Telsec 02 is housed in a strong aluminium case with enforced profiles at the sides. It consists of a frame – that holds the PCBs, the front and the rear panel – and two metal U-shaped shells, one at the top and one at the bottom. The shells are held in place by four recessed screws each.

After removing the two case shells, the interior is exposed as shown in the image on the right. In­side the frame is one large PCB that covers the entire bottom, a smaller PCB that is fitted on top of the large one, and an Omron card reader.

The large PCB hold a Z80 microprocessor with 2KB of static RAM and an 8KB EPROM that holds the firmware. This card also holds four large filters and a series of five ICL7621 operational amplifiers. It also holds a large ASIC that was custom-made for Teltron. The daughter card holds eight TSG8511 switched-capacitor filters.
  
Interior

A standard Omron cardreader is fitted to the main board. It contains a head that can read the information on the magnetic strip of the key card whilst it is being inserted. Judging from the date code on the ASIC – which was produced in week 4 of 1987 – the Telsec 02 was developed during the first half of 1987. This means that it was just ready before the Gerrit Jan Heijn case.

Interior Sub-board and card reader removed Main board Bottom view of the PCB Sub-board Card reader Custom chip (made in week 4 of 1987)
B
×
B
1 / 7
Interior
B
2 / 7
Sub-board and card reader removed
B
3 / 7
Main board
B
4 / 7
Bottom view of the PCB
B
5 / 7
Sub-board
B
6 / 7
Card reader
B
7 / 7
Custom chip (made in week 4 of 1987)

Datasheets
  1. Z80 microprocessor
    User Mnaual. ZILOG, 2016.

  2. ICL7621 Operational amplifier
    Renesas, Rev. 5.00, 4 March 2010.

  3. TSG8511 switched-capacitor filter
    SGS-Thomson, March 1989.
References
  1. Wikipedia, C-Netz
    Retrieved May 2019.

  2. Wikipedia, Gerrit Jan Heijn
    Retrieved May 2019.

  3. Wikipedia, Moord op Gerrit Jan Heijn
    Murder of Gerrit Jan Heijn (Dutch). Retrieved May 2019.

  4. E.T. Smith, Security of Mobile Telephone Networks
    Proceedings, 1988 Carnahan Conference on Security Technology: Electronic Crime Countermeasure, pp. 63-64. Retrieved May 2019.

  5. Photograph of Ferdi Elsas during the reconstruction of the case, in front of Heijn's house
    in Bloemendaal (Netherlands) shortly after his arrest in April 1988.
    Copyright unknown. Retrieved May 2019.

  6. Algemeen Nederlands Persburo, Small ads: Johan-aan-Maria
    ANP Archive. 21 December 1987. Retriebed June 2019.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 12 June 2019. Last changed: Thursday, 13 June 2019 - 07:24 CET.
Click for homepage