The Typewriters That Came In From The Cold

August 5, 2015 11:20 AM

In 1983, the US got a tip-off that the Soviets had designed a new breed of hard-to-find bug, capable of relaying information from office equipment. The Moscow Embassy had more than ten tons of gear, all of which was immediately suspect. It had to be fixed, and now. Problem one: how do you replace it all? Problem two: how do you get the old stuff back? Problem three: what on earth were they looking for? What they found surprised them! A tale of bureaucracy, secrecy, narrow corridors and IBM Selectrics that weren't quite what they seemed. (SL NSA PDF)
posted by Devonian (35 comments total)

This is awesome! The story also makes reference to the The Thing, a bug hidden inside a wooden Great Seal of the United States presented by Soviet schoolchildren that hung for years at the ambassador's office.

The Thing was created by Léon Theremin, by the way. Of the woooo-woooo sound fame.
posted by blahblahblah at 11:42 AM on August 5, 2015 [17 favorites]

(SL NSA PDF)

Known insecure format from untrustable intelligence agency? Thank goodness for office computers! Worth the intrusion risk for Selectric hacks.
posted by Ogre Lawless at 11:44 AM on August 5, 2015 [6 favorites]

"As a totalitarian society, the Soviet Union valued eavesdropping, and thus developed ingenious methods to accomplish it." -- The NSA.

The irony! It burns!
posted by Naberius at 11:53 AM on August 5, 2015 [42 favorites]

That must be a misprint on page eleven. No way the halls of the embassy are only 36 inches wide.
posted by dr_dank at 11:59 AM on August 5, 2015 [1 favorite]

I recall, way back in the late 70's, the glorious IBM Selectric. The letters were so clear and sharp, compared to previous wholly manual typewriters. The reason was that the ink came from a tape instead of a fabric ribbon. Of course, the document you typed was forever captured in the tape, which remained in the Selectric until it ran out and was changed. Clearly, this was a security breach. I later saw that you could buy fabric ribbon cartridges for the Selectric, listed specifically for secure applications.

I wonder how long it took to figure out that that was needed?
posted by Midnight Skulker at 11:59 AM on August 5, 2015 [3 favorites]

That must be a misprint on page eleven. No way the halls of the embassy are only 36 inches wide.

"Look, look. Look, this is what I was asked to build. Eighteen inches. Right here, it specified eighteen inches. I was given this napkin, I mean..."
posted by teponaztli at 12:12 PM on August 5, 2015 [13 favorites]

Next week on The Americans...
posted by Fizz at 12:26 PM on August 5, 2015 [3 favorites]

What Arneson had found was a sophisticated bug implanted in a structural metal
bar that ran the length ofthe machine undercarriage. It consisted of sensing devices that
picked up tiny fluctuations in current caused by the typewriter ball rotating as it selected
the next letter to be typed. It drew its power by bleeding the power line

Won't someone please Kickstarter this? USB out would be fine but bluetooth would probably be best...
posted by Ogre Lawless at 12:33 PM on August 5, 2015 [3 favorites]

"During the early 1960s, U.S. officials discovered that the Soviets were bombarding the Moscow embassy with microwaves to tap telephones and interfere with telephone and cable traffic." (1985 Washington Post)

At this point, what bugs me is how fucking old I'm getting because I remember that article.
posted by clavdivs at 12:35 PM on August 5, 2015 [6 favorites]

It's like The Soul of a New Machine, except for spooks.
posted by infinitewindow at 12:35 PM on August 5, 2015

'Soul of the Machine' (Ayers Rock)
posted by clavdivs at 12:41 PM on August 5, 2015

I recall, way back in the late 70's, the glorious IBM Selectric.

The coolest part was that the body of the typewriter was carved from a Sisyphian boulder and it was hand delivered by Hercules (or equivalent).
posted by srboisvert at 12:42 PM on August 5, 2015 [2 favorites]

Reminds me of the remote monitor viewing hack via the power oscillations.. (Man, finding the right google keywords was ugly -- van eck phreaking)

All that said, TFA is full of "gee look how well all these different orgs works together" and "wow, look at how fast this bureaucracy moved on this issue" rah-rah bullshit.. Wow. I could grow acres of corn on that manure.
posted by k5.user at 1:02 PM on August 5, 2015

My dad was an IBM Technician at ███████ in 19██ and worked on these, especially the model ██. He said if you ever dropped one it was gone.
posted by randomkeystrike at 1:15 PM on August 5, 2015 [6 favorites]

If you're wondering, the "friendly government whose own embassy had been the target of a similar eavesdropping operation" is France.

From Time's The Moscow Bug Hunt, which chiefly focuses on the Marine Spy Scandal:

In late 1983 French intelligence had told the NSA that a Soviet bug had been found in a coding machine at the French embassy in Moscow. The French warned that the Soviets might also have bugged communications at the U.S. embassy.

posted by zamboni at 1:25 PM on August 5, 2015 [8 favorites]

Anybody have any idea what the redacted sections on p.2 (page 6 of the PDF) are all about? It seems to pertain to a US ally who discovered similar bugs before the US did, and then passed the word along. Makes you wonder how much longer the bugs would have stayed in place had it not been for the un-named government, who apparently was doing a much better job of countersurveillance than the US was...

All that said, TFA is full of "gee look how well all these different orgs works together"

Really? That's not my read. I mean, you have to go between the lines a little bit, because governmentese, but on p.3, in the paragraphs beginning "General Faurer..." and following onto p.4, they basically describe how relations between NSA and State, and NSA and CIA, were so poor that the Director of the NSA went directly to the President, via Weinberger, in order to basically get approval for what NSA wanted to do; only after securing authorization from Reagan himself did they go and brief CIA and State. I'd imagine that those briefings must have been... unpleasant for the Secretary of State and the CIA Director.

Also, whenever they're pointing out 'hey wow these two departments worked really well together!' (e.g. "This type of collaboration was very effective but a very unusual phenomenon in the 1980s...", p.4), I think it's hard to interpret that in any way other than a dryly-put "normally we are fucking terrible at this, but for once we didn't suck! Hooray!"

Oh, and did anyone else think that "Bob Surprise" (p.7) sounds like the worst spy alias ever?
posted by Kadin2048 at 1:38 PM on August 5, 2015 [1 favorite]

By my reading of this, the modification involved replacing the iron typewriter ball with a non-ferrous ball which had a magnet offset from its center. With that in place, a magnetometer circuit in the body of the typewriter could sense the sequence of two rotations that the ball made just before striking the page. That circuit burst-transmitted the timings of these rotations in the VHF band (hiding itself in the background noise of broadcast TV). It did not transmit presses of the space bar because those didn't move the ball.

I LIKE IT.
posted by rlk at 1:46 PM on August 5, 2015 [5 favorites]

Yeah, the article is full of NSA self-regard, but still amazing.
zamboni: Thanks for clearing up who the friendly power was. Now can you (or anyone) fill in the redacted reason that CIA was not allowed to do the investigation? Sounds like some serious screwup, maybe to do with Iran?
Reading between the lines, the competition between the NSA and CIA, makes State sound like a bumbling little puppy, quarreled over by competing siblings.
posted by CCBC at 1:53 PM on August 5, 2015

Reminds me of the remote monitor viewing hack via the power oscillations
That was the purpose of the Security Motor.

tape instead of a fabric ribbon. Of course, the document you typed was forever captured in the tape, which remained in the Selectric until it ran out and was changed.
-that's why the ribbons went into burn bags.

If this was in the article, I missed it...
How did these devices get installed? We let 'cleaners' into the office at night?
posted by MtDewd at 1:59 PM on August 5, 2015

The KGB techs installed them on typewriters that weren't sent via diplomatic channels. How'd they know which ones to target? The ones for the embassy were TEMPEST hardened.
posted by zamboni at 2:04 PM on August 5, 2015 [1 favorite]

The project, called Gunman, involved the removal of eleven tons of electronic equipment from the Moscow embassy - teletypes, printers, computers, crypto devices, copiers - almost anything that plugged into a wall socket. Every piece of equipment had to be replaced with the same or an upgraded model on a one-for-one swap-out. NSA's cover story was that the equipment was being shipped back to the States for an OSHA inspection.

I realize our government has a reputation for bloated bureaucracy, but a cover story that we had to replace and ship eleven tons of electronic equipment across the ocean for an OSHA inspection is so nonsensical they might as well have just not bothered making something up.

The real question is why the State Department continued to ignore the Soviet eavesdropping threat for decades after The Thing and allowed Soviet nationals unfettered access to embassy equipment.
posted by zachlipton at 2:29 PM on August 5, 2015

Hardcore Analogue Key Logger FTW.
posted by jefflowrey at 2:32 PM on August 5, 2015

For those interested, here's a nice little YT video from "engineerguy" about the cool and innovate design of the Selectric: IBM Selectric Typewriter & its digital to analogue converter.
posted by Ivan Fyodorovich at 2:38 PM on August 5, 2015 [1 favorite]

I don't think that's quite fair, Zachlipton The typewriters that got targeted were the exception, I'm sure in part because they were considered practically impossible to bug. Most equipment came in through secure channels, there were regular (albeit not always effective) bug sweeps before The Thing was found and they were stepped up afterwards, and there was no 'unfettered access' to Soviet nationals within the embassy. The degree of sophistication of the Gunman bugs was necessary precisely because the high level of countermeasures.

Whatever the gaps in the process, you can't really say the threat was ignored.
posted by Devonian at 2:40 PM on August 5, 2015

you have to go between the lines a little bit

It's seemed pretty explicit to me. They say directly that "regulations between NSA and State were poor" and that they were afraid the CIA would "mishandle" things because of [redacted], which id's presumably something the CIA had botched in the past but it's still secret.
posted by CheeseDigestsAll at 2:52 PM on August 5, 2015 [1 favorite]

My mother was a professional typist ('professional typist'! how quaint that now sounds) and I learned to touch-type on her IBM Selectric III. (I still miss the comforting purr of the machine, so different from the reproachful silence of my PC.) She never switched to computers, and still, aged 75, keeps her Selectric in working order.

Her typewriter repairman ('typewriter repairman'! another quaint old occupation) no longer does repairs (he's now in his 80s) but still keeps a stock of spare parts. He once told me, before he retired, that he only had two customers left: my mother and the US Embassy. Apparently, having put so much effort into spy-proofing their typewriters, the US State Department just couldn't bear to part with them.
posted by verstegan at 3:11 PM on August 5, 2015 [7 favorites]

Does anybody know who the [redacted] Soviet Western ally was who tipped off the US to the bug?
posted by clawsoon at 3:19 PM on August 5, 2015

clawsoon - see zamboni above: France.
posted by wotsac at 3:23 PM on August 5, 2015 [1 favorite]

Does anybody know who the [redacted] Soviet Western ally was who tipped off the US to the bug?

Yes, it was [expurgée].
posted by Doroteo Arango II at 3:23 PM on August 5, 2015 [11 favorites]

Does anybody know who the [redacted] Soviet Western ally was who tipped off the US to the bug?

Désolé, je ne sais quoi.

(la troisième, c'est la charme)
posted by Artful Codger at 3:30 PM on August 5, 2015 [1 favorite]

+rlk: I don't think the ball was modified---rather, the document refers to bails (see p12 col 2 para 2---also called interpose latches) and their (mechanical) expression of a binary code, which could be stored and transmitted. Based on the excellent video Ivan Fyodorovich shared (and that I came in to mention), I suspect these bails are some of the linkage components in the whiffletree mechanism that controls the tilt and rotation of the ball.
posted by tss at 4:33 PM on August 5, 2015 [2 favorites]

I especially like the detail where someone decided they only had to do a few x-rays of the machines, which if followed would have meant they would have missed the bugs.
posted by drezdn at 4:49 PM on August 5, 2015 [1 favorite]

That's my understanding too. By detecting the position of the bails that controlled the ball position, presumably by picking up induced pulses as the magnets moved by strategically positioned coils in "the modified comb support bar", the digital code of each character typed could be loaded into memory and later squirted out over the radio link when the memory was full.

As the documents says, it's not perfect and won't get you everything, but it's enough to recreate the document.

It's an exceptionally clever design, and what's just as significant is that it seems to be the first time the security services realised how advanced the Soviets were at making chips. (You'd certainly never guess from the IT capabilities that were known.) One of the reasons the NSA took the reported threat from the French so seriously was that when they looked at the details of that particular intrusion, they realised there had to be an industrial base somewhere that would be making a lot more of that kind of thing. But it seems typical of Soviet high technology that such places existed in isolation and were guarded jealously by their sponsors just as much from rivals within the system as from the West, so there were many barriers to making efficient use of such ingenuity. It certainly keeps it safe from the outside world, but it doesn't do much for the rest of your industry.

We have the same syndrome, of course, but to a much lesser extent.

I think.
posted by Devonian at 5:21 PM on August 5, 2015 [4 favorites]

Midnight Skulker: "I wonder how long it took to figure out that that was needed?"

My mother briefly worked in the typing pool at the State Department in the early 70s, and they had to remove and lock their typewriter ribbons in a safe every night, under guard. And she did not type anything requiring any clearances, just office memo stuff. I think she said ribbons had to be burned for disposal. Failing to lock up your ribbon (they were audited every night) or -- God forbid -- throwing one in the trash was a fireable offense.
posted by Eyebrows McGee at 5:30 PM on August 5, 2015 [1 favorite]

I would love to read a similar report from the Soviet side about the making of this bug. (I can dream, can't I?)
posted by clawsoon at 7:11 AM on August 6, 2015