|
|
|
|
|
|
|
TSCM Audiotel 2000 → ← Mark 3
Automatic bug finder
The Scanlock Mark VB is one of the first
bug finders developed and built
by Audiotel in the UK, shortly after the company was established
in 1978. It was the successor to the Scanlock Mark 3,
that was previously
marketed by Technical Security Ltd.
The fully analog receiver automatically searches for
hidden bugs
within a room, using a novel technique known as a harmonic receiver.
|
The Scanlock Mark VB scans the entire frequency spectrum between 10 MHz
and 2 GHz in just a few seconds and will automatically lock onto the strongest
signal. In areas with strong broadcast transmitters (e.g. commercial radio
stations) it might be necessary to
move around the room until a point is
found where the bug is stronger than the broadcast station. In addition it
is possible to tune the Scanlock manually, using the
10-turn frequency adjustment on the control panel.
The Scanlock Mark VB was based on the so-called
staircase receiver,
developed by Lee Tracey
in 1962. Tracey, a former RAF sergeant and MI6 agent,
started selling the first Scanlock receivers in London (UK) in 1975 through
Technical Security Ltd., at the time a front operation of MI6 [4].
In 1978, Tracey left MI6 and started
Audiotel International,
with the intend to market the Scanlock.
The Scanlock dominated the bug tracing market in Europe from the
late 1970s to the early 1980s. It also became an instant hit in the US,
where it was marketed by
Technical Services Agency (TSA),
a company established by former CIA expert
Glenn Whidden.
It was used for many years
for professional bug sweeping tasks and is featured in Keith Melton's book Ultimate Spy [3].
In the early 1980s, the Scanlock Mark VB was succeeded by the semi-digital
Scanlock 2000, that had some extra features and a digital
read-out. Nevertheless the Scanlock Mark VB remained popular in the US,
not least because of the Compuscan add-on developed by
TSA
(see below).
|
All controls of the Scanlock Mark VB are located at the top panel
(or the front panel when it is placed horizontally). At the top left are
two buttons for POWER and (battery) CHARGE, plus three indicator LEDs.
To the right of these buttons is a
wide field strength meter that displays
the current (background) level of RF activity. The meter can also be used
as a frequency indicator.
Below the meter are eight push buttons
that are used to select the
required MODE of operation. The first three buttons are used to select
the desired modulation type: AM, FM or subcarrier (S/C). The remaining
buttons are for manual tuning and for using a tone when locating a bug.
To the right of the meter are sockets for connecting accessories like
headphones and an external (audio) recorder. One socket carries
the 2 MHz IF signal that can be used to drive an external spectrum monitor,
such as the SM-2 shown below. It allows part of the spectrum to be visualized.
|
- Basic version
This is the intial version of the Scanlock Mark VB as it is
shown at the top of this page. The 8 push-buttons at the bottom left
of the control panel all have text printed on them. A red knob
to the right of the push-buttons is used for manual subcarrier adjustment.
This version has a built-in telescopic antenna and an odometer-style
tuning knob.
- Modified version for COMPUSCAN
This version is nearly identical to the above one, but was modified by
TSA
in the USA for use in combination with the
COMPUSCAN unit
(see below).
A 5-pin DIN socket (for connection to the COMPUSCAN)
and a switch have been added to the front panel.
Furthermore,
the red knob is no longer used for subcarrier adjustment but
for fine tuning, as indicated by a new label below the knob.
This version was built around 1980.
It no longer has a built-in telescopic antenna,
but has instead an N-socket at the right and a more common
multi-turn tuning knob.
- COMPUSCAN-ready version
Once COMPUSCAN
had become a successful add-on, also in the UK,
the DIN socket and the extra switch were nicely integrated with the rest
of the controls on the front panel.
The layout of the control panel was changed slightly
and the push-buttons no longer have text printed on them. Instead
the text was silk-screened on the panel below the switches.
The red knob is replaced for a black one marked FINE TUNING
and has been swapped with the volume control so that it is now
aside the TUNING control.
This version is known as Scanlock Mark 5B (note that the Roman V
has been replaced by '5' on the serial number label). The LED
and the jack socket that were previously marked 'LOCK' are now
marked 'SQUELCH', which makes more sense as it is linked
to the squelch activity (treshold).
|
|
The Scanlock Mark VB can be used in a variety of modes and with
various types of modulation,
depending on the type of bug, the method of searching
and the time available to do the sweep. The following modes are available:
|
- Automatic mode
In this mode, the Scanlock searches fully automatically for bugs in the
room and locks itself onto the strongest signal that it finds, with a lock
sensitivity of 1mV up to 1.5 GHz and a somewhat reduced sensitivity between
1.5 and 2 GHz. In earas with strong broadcast transmitters, it may be necessary
to move the receiver around the room whilst searching.
- Manual mode
When searching for bugs with an extremely low RF output signal, or in areas
with strong broadcasting stations or other sources of interference, it might be
useful to conduct a manual search. In manual mode, the Scanlock has a typical
sensitivity of -70 dBm up to 1 GHz. In this mode, the frequency can be adjusted
by turning the multi-turn knob
(with the built-in counter).
Furthermore the meter can be used as a frequency indicator.
- Soundwave mode
In this mode, the Scanlock emits a continuous (audible) tone, that changes
to an intermittent tone when the receiver detects itself (i.e. if it
is heared through the bug).
This mode should be used as a last resort, as it is likely to alert the
eavesdropping party of the fact that a bug-sweep is taking place.
- Locate mode
When the LOCATE button is depressed, the Scanlock provides an audible
tone with a pitch that is proportional to the strength of the acquired
signal. Starting off with a low frequency ticking sound, the pitch gets
higher when approaching the bug. In this mode, the use of a pair of
headphones is advised, as otherwise the eavesdropping party might become
aware of the fact that a bug-sweep is taking place.
|
|
The Scanlock Mark VB is suitable for reception of the following types
of modulation:
|
- AM
This is for bugs that use Amplitude Modulation (AM).
Not many bugs are of this type. It is generally used with low-frequency
transmitters (below 80 MHz).
- FM
This is for the most common type of bugs that use
Frequency Modulation (FM). These bugs generally operate at frequencies
from 80 MHz onwards. Most of the cheaper commercial and homemade bugs
are of this type.
- NB (Narrow band)
This mode is suitable for the reception of Narrow Band FM signals.
It is only available from the Issue 3 version onwards (i.e. the
Compuscan-ready models) and replaces the Manual Subcarrier adjustment
described below.
- Automatic subcarrier (S/C)
With some of the more sophisticated bugs, the audio is
modulated onto a non-audible subcarrier.
This technique is known as
audio masking.
As a result, the bug appears to be sending a
silent carrier, whereas in fact it carries all of the sound it picks up
in a room. In this mode, the Scanlock adjusts itself automatically
to the required subcarrier frequency.
➤ More information
- Manual subcarrier (S/C MAN)
By pressing the red button (S/C MAN), the automatic subcarrier adjustement
is turned off. Instead the user can adjust the subcarrier frequency manually
with the red knob to the right of the push buttons. This mode is only
available on early models of the Scanlock Mark VB. On later models, it
has been replaced by the NB mode (Narrow Band).
|
Operation of the Scanlock Mark VB is remarkably simple. All you need to do
when first scanning a room for potential bugs (sweeping) is to ensure that
all buttons are up (out) when the unit is switched on. Next press the FM
button to search for the most common type of FM bugs. The Scanlock will now
automatically lock onto the strongest signal in its vicinity, as illustrated
below:
With the receiver in location A, the Scanlock will probably lock immediately
onto a strong broadcast station that is nearby. Such broadcast stations are
generally much stronger than a potential bug in the room. When the Scanlock
is moved around the room however, it will continue to scan and lock onto
the strongest signal. When the receiver is in location B it will
intermittently switch between the broadcast station and the bug, but when
it is moved closer to the bug (C) the RF signal from the bug will be
stronger than the broadcast station and the bug will be heard.
|
When not in use, the antenna can be pushed all the way in, until only
the tip is visible. Inside the receiver, the antenna is completely shielded
so that it can not pick up any spurious signals.
It is now possible to use an external antenna, by installing a special
cylindrical adapter over the telescopic antenna.
One end of the adapter is hollow and has a spring contact inside. At the other end is a common
BNC socket.
The adapter is installed by placing
the hollow end over the tip of the telescopic antenna and screwing the
cylinder into the threaded antenna base.
|
|
|
An external antenna can now be
connected to the BNC socket at the top of
the adapter. This can be useful for continuously monitoring a room where,
say, a meeting is taking place, from an adjacent room without disturbing
the attendees. It can also be used to connect a smaller - less sensitive -
antenna, such as a magic wand, to search for bugs whilst walking around
the room.
|
|
The Scanlock Mark VB can be powered from two different sources:
directly from the 110 or 220 V AC mains,
using the built-in power supply unit (PSU), or by
the built-in rechargeable 16.8V NiCd battery. At the right side is a socket
that accepts a Euro-style mains cable,
plus a fuse holder.
|
The battery is 22 x 44 x 293 mm and consists of 14 NiCd cells of 1.2V each,
delivering a total of 16.8V and 1.2 Ah. They should be charged for 14 hours
with 120 mA. When fully charged, the battery allows 5 to 6 hours of
uninterrupted use.
The battery compartment is located below the mains socket, at the bottom
of the receiver. It is accessible through a
flap in the leather carrying case.
After pulling up the door
to the battery compartment, it will jump out
automatically. A spare battery
can be stored in a compartment at the
bottom of the leather carrying case.
|
|
|
|
Powering the surviving Scanlock Mark VB receivers from their
internal batteries
today, will not be easy. Most of these old NiCd cells will be
worn out by now
or will have started leaking,
and it will be difficult (if not impossible) to
find suitable replacements. Nevertheless it should be possible to construct
a (mechanical) equivalent from modern NiMH or Li-ION cells in a plastic holder.
|
|
The Scanlock Mark VB was supplied with a number of accessories, such as a
leather carrying case, a spare battery, headphones and an
adapter for connecting an external antenna or 'magic wand'.
In addition, the US distributor of the Scanlock,
Technical Services Agency (TSA),
introduced a number of interesting add-ons developed by
former CIA technical export Glenn Whidden.
|
In order to visualize a small section of the frequency spectrum,
it was possible to connect an external Panoramic Display or
Spectrum Monitor to the scanlock, via the 2MHz IF socket at the
front panel. It makes it possible to find small low power bugs
operating at a frequency very close to a strong broadcast station.
A suitable Spectrum Monitor (SM-1 and later the SM-2) was developed
by Glenn Whidden of
TSA.
➤ More information
|
|
|
The COMPUSCAN is a device that can be used in tandem with the Scanlock VB.
The operator takes the Scanlock and the COMPUSCAN out to a safe zone,
and records the activity on all frequencies, assuming there
are no bugs in the safe area.
He would then return to the target site and scan only the frequencies that
were not recorded by the Compuscan. This way, one could search only for
signals that were different.
➤ More information
|
|
|
The Scanlock Mark VB has an internal speaker through which the audio
from the intercepted bug can be heared. As this might alert a potential
eavesdropping party, it might be better to use a properly isolated pair
of headphones, or a small pair of earphones, such as the ones shown here.
The headphones can be connected to the 3.5 mm (mono) jack socket on the
control panel.
|
|
|
Although the Scanlock was commonly used with the built-in telescopic
antenna, it was also possible to use an external device, such as
the so-called 'Magic Wand'. This was a smaller antenna that could be
used to search locally, for example by moving around the room.
As the original Magic Wand is missing from our Scanlock, an alternative
one is shown in the image on the right. It was taken from a
CPM-700 bug finder.
|
|
|
The Scanlock Mark VB is based on
Lee Tracey's design of the locking
staircase receiver of 1962. As the Mark VB was the first locking receiver
of this type that was commercially marketed successfully, it is generally
referred to as the original Scanlock, using the following principle:
There is no preselection other than a filter that allows only frequencies
above 10 MHz to pass by. The 10 MHz output of the first local oscillator
is fed to a so-called comb generator. This is effectively a non-linear
junction (i.e. a diode) that causes harmonics of the fundamental frequency
to be generated. It produces signals at 10 MHz, 20 MHz, 30 MHz,
40 MHz, etc.
The output of the comb generator is then mixed directly with the antenna
signal, resulting in many frequency segments of 10 MHz each, being superimposed
on top of each other. The problem of sweeping the entire spectrum between
10 MHz and 4 GHz has now been reduced to sweeping just a single small segement
of 10 MHz, by sweeping all superimposed or stacked segments simultaneously.
By using a sweeping oscillator in the 2nd IF stage, the resulting 10 MHz
segments can be swept in less than a second. The receiver locks onto the
strongest signal found.
At the output of the 2nd IF stage, a 2 MHz signal is available for further
processing. It is fed to the three demodulators (AM, FM and SC), and is
also available on a connector at the front of the receiver, to allow the
connection of a panoramic display, such as the
SM-2 Spectrum Monitor.
In Sound Wave mode (S/W), the speaker produces a continuous 1800 Hz
tone. The output of all demodulators (AM, FM, and SC) is checked
for this tone by applying it to a sharp 1800 Hz filter. When this
particular frequency is detected, the tone is changed into an
intermitted one.
Note that frequencies below 10 MHz are not covered by this receiver.
Although it is unlikely that bugs operate below 10 MHz,
it is possible to use these low frequencies, e.g. when using them as a
carrier. The later Scanlock 2000
contained a extra detector to find
mains carrier bugs (MC) and the Scanlock ECM
even had a separate VLF receiver to cover the 10 kHz to 10 MHz section.
|
|
The interior of the Scanlock can be accessed by taking it out of the
leather carrying case and removing two screws from the top cover.
This allows the top panel to be removed,
but it might be necessary to loosen the plastic side panels somewhat
first as they may block the top panel.
|
Inside the receiver are two large PCBs, holding the main receiver
and the PSU, plus two smaller PCBs for the controls and connections.
The first PCB that is visible after removing the top panel is
the power supply unit (PSU) which also contains a sophisticated
circuit for charging the battery.
The receiver itself (i.e. the main board) is located at the bottom
of the case and can only be accessed properly after removing the
PSU board. The image on the right shows a close-up of the first
mixer of the receiver. Note that the entire unit is built from
first class components.
|
|
|
All PCBs are single sided, suggesting it was a low-volume
in-house built product. One has to bear in mind however, that this
device was conceived in the late 1970s, when double sided PCBs were
not yet commonly available. Also note that the text has been removed
from all of the ICs. This was commonly done in those day to prevent
a potential competitor from copying the design.
|
Updated 26 January 2014
In January 2014 we acquired a Scanlock Mark VB issue 3
— the COMPUSCAN-ready version — complete with a working
COMPUSCAN unit.
Unfortunately, the Scanlock was 'demilitarized' by people who
didn't know that this device was unclassified. In the process
of 'demilitarization', most ICs have been removed from their sockets
and all wiring has been cut and removed. Some components were simply
ripped from the PCBs, and IC has been desoldered from the board.
The PSU board is broken into pieces,
probably to get access to the
main board
below it, and even from this board the ICs have been removed.
All wires to and from the front panel controls
have been cut and
removed whenever possible. Luckily, the special
TSA Compuscan modification board
was still present. It is our goal to restore this unit and, if possible,
bring it back to life again.
|
Unfortunately, the original circuit diagram of the Scanlock Mark VB
is not officially available. At the time it was considered confidential
(by the manufacturer) and today the manufacturer no longer has the
original circuit diagrams in their archives. Another problem is that
in the early days of the Scanlock, the text was often removed from the
ICs in order to make it difficult to reverse engineer the design.
The diagrams below shows the location of each IC and socket (SK).
Fortunately, we have in the meantime received part of the original circuit
diagram of the main board and the PSU [H]. These sheets
were hand-drawn and were found in the US in 2012. They were probably made by
the original designer of the device.
At present we only have sheet 1 to 3, whilst sheet 4 remains missing.
For this reason, we have not been able to put the corresponding IC numbers
on all of the ICs in the diagram below. The ICs of sheet 4 are therefore
marked A-D.
IC-A (CD 4046) is present in the issue 1 and issue 2 version, but is missing
from the later issue 3 version. Its position is still present on the main
board (which apparently wasn't changed) but was not assembled. Furthermore,
C55 (10 nF) has been cut-out from issue 3 boards. They are both marked in
yellow in the drawing above. All ICs are usually socketed and are numbered
as shown in the table below.
Click the type number of the IC to view the datasheet (when available).
|
|
IC
|
Type
|
Description
|
Equivalent
|
*
|
|
|
|
1
|
LM3900
|
Quad Norton OpAmp
|
|
|
|
2
|
CA3146
|
High-Voltage Transistor Array (5 transistors)
|
|
|
|
3
|
CD4060
|
14-stage ripple-carry binary counter, oscillator
|
HEF4060
|
|
|
4
|
?
|
|
|
|
|
5
|
CA3089
|
FM IF Amplifier, Quadrature detector, Squelch, Meter
|
NTE788
|
1
|
|
6
|
SN74LS74
|
Dual D flip-flop
|
|
|
|
7
|
LM3900
|
Quad Norton OpAmp
|
|
|
|
8
|
LM3900
|
Quad Norton OpAmp
|
|
|
|
9
|
LM3900
|
Quad Norton OpAmp
|
|
|
|
10
|
CA2111A
|
FM IF Amplifier, Quadrature detector
|
NTE708
|
2
|
|
11
|
NE531
|
High slew rate OpAmp
|
|
|
|
12
|
MC14011
|
Quad 2-input NAND Gate
|
HEF4011
|
|
|
13
|
LM3900
|
Quad Norton OpAmp
|
|
|
|
A
|
CD4046
|
PLL
|
HEF4046
|
3
|
|
B
|
NE555
|
Timer
|
|
|
|
C
|
CA741
|
OpAmp
|
µA741
|
|
|
D
|
LM384
|
Audio Power Amplifier
|
|
|
|
 |
-
The CA3089 (IC5) is no longer in production by the original manufacturer,
but suitable equivalents are available from after-market manufacturers
such as the NTE Electronics NTE788 or the Sylvania ECG788.
-
The CA2111A (IC10) is no longer in production by the original manufacturer,
but suitable equivalents are available from after-market manufacturers
such as the NTE Electronics NTE788 or the Sylvania ECG708.
-
The CD4046 (IC3)is present in the early Scanlock Mark VB units (issue 1
and 2), but is not assembled in the later issue 3 version (i.e. the
COMPUSCAN-ready version.
|
|
The sockets (SK) are numbered as follows:
|
- AC
- AC
- Battery - (GND)
- Battery
Regulated Power (distribution) - ?
- Front panel 1 (cable assembly A)
- Front panel 2 (cable assembly B)
- ?
- Antenna (input to main board)
- 2 MHz IF (from main board to front panel)
- Phones (front)
- Lock remote (front) (relay switched squelch output)
- Recorder (front)
- 2 MHz IF output (front) for Spectrum Monitor
|
- Scanlock Mark VB, Quick Start Operating Instructions
Audiotel, Date unknown.
- Scanlock Mark VB, Operating Instructions Manual
Audiotel, Technical Services Agency, Inc., January 1985.
- Scanlock Mark VB, Field Service Manual
Audiotel, Technical Services Agency, Inc., August 1980.
- Scanlock Mark VB Handbook
Technical Services Agency, date unknown.
- Compuscan - Operating Instructions
Technical Services Agency, Inc., December 1983.
- Spectrum Monitor SM-1 Operating Manual
Technical Services Agency, Inc., 1980.
- The Scanlock Handbook - Scanlock Mark V B
Technical Services Agency, Inc., October 1980.
- Scanlock Mark VB circuit diagram
Glenn Whidden, Date unknown.
|
- Glenn H Whidden, CCP, Counter-Eavesdropping Defence
Description of the use of the TSA Spectrum Monitor with the Scanlock VB.
Assets Protection, Volume 5, Number 4, 1980. p.20-23.
- Channel 4, The Walls Have Ears
Fascinating Channel 4 documentary about The Spying Game - The Walls have Ears.
1999. Via YouTube. Interviews Glenn Whidden,
Lee Tracey,
Charles Bovill
and others.
- H. Keith Melton, Ultimate Spy
ISBN: 0-7513-4791-4. 1996-2002. p. 129.
- Lee Tracey, Interview and personal correspondence
Crypto Museum. 23 May 2013.
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Friday 14 August 2009. Last changed: Tuesday, 02 May 2023 - 06:33 CET.
|
|
|
|
|
|
