A Call to Former KL-7 and KL-47 Operators

TSEC/KL-7 © Dirk Rijmenants

The TSEC/KL-7 crypto machine was developed by the Army Security Agency (ASA) and Armed Forces Security Agency (AFSA) under the name AFSAM-7 and introduced in 1953 by the National Security Agency (NSA) into the U.S. Army and Air Force, and later also into the CIA and FBI. The machine also served in all NATO forces, their embassies and some state departments. The U.S. Navy AFSAM-47B, later known as the TSEC/KL-47, was compatible with the KL-7. The last machines  retired in the early 1980s. It's been little over 40 years ago that the last machines left the service and time is running out to document first-hand accounts on these machines.

If you are a retired signals veteran with experience on the KL-7 or the KL-47, as operator or technician, a member of a signals association or organization, or worked in the communications section of a state department that used the KL-7, then contact us through our website to document your story. The KL-7 is fully declassified, and we're not interested in classified information, we only want to preserve the cryptologic history of these Cold War icons.

Besides the United States, the KL-7 was also used by its NATO allies Australia, Belgium, Canada, Denmark, England, France, Germany, Greece, Italy, Luxemburg, the Netherlands, Norway, New Zealand, Portugal and Turkey. Outside NATO, the KL-7 was also on loan to South Korea, South Vietnam and Taiwan. If you're a signals veteran from any of these countries, a state department or embassy in the 1950s to 1980s era, then contact us, or spread the word.

Unfortunately, time is running out to document first-hand accounts, as the people involved are age seventy or older, and memories fade. Please share this request with all signals communities that might have former KL-7 or KL-47 operators and technicians. Those who share their story retain full control over the content and how it is published.

Let's preserve cryptologic history!

Visit the U.S. TSEC/KL-7 ADONIS & POLLUX webpage to learn more about the KL-7, its development, technical details and full history, including some first-hand accounts, also shown below, to get an idea of the kind of stories we hope to document. You can contact us through the contact page on our website Cipher Machines and Cryptology.

• History of the TSEC/KL-7 ADONIS & POLLUX (full history)
• KL-7 in Vietnam - COMSEC Support at Air Base Saigon
• OTT Mixers and the KL-7 at NATO in West Germany
• The KL-7 on Merchant Ships during the Falklands War 
• More SIGINT Chatter blog posts on the KL-7

Enjoy reading!

Martin Gillow's Virtual Colossus and Other Machines

The Virtual Colossus
© Image Martin Gillow

The history of crypto equipment is quite fascinating, but diving into the archives, searching for historical publications, or collecting those old machines is not everyone’s cup of tea. Luckily, we have a community, dedicated to preserving the history of old crypto equipment, research the technical details, publish their history and operational use, and bring those old crypto machines back to life, either physically, which can be quite expensive, or virtually though software simulations.

Writing software that works exactly like the real crypto machine requires extensive study of the original machine, its mechanical and/or electrical properties, and many hours to write the software that reproduces the plaintext or ciphertext exactly like the original machine. However, you could take it one step further, and make a virtual three-dimensional machine where you can manipulate all components and encrypt, decrypt or break messages, just like the wartime operators.

Martin Gillow created a website with no less than ten 3D simulations. The virtual British Colossus machine is the first ever digital computer, developed in WW2 to break the German Lorenz SZ40/42 encrypted telex, of which he also created a virtual version. There’s also the virtual Enigma machine, and the Bombe that was used by the Bletchley Park codebreakers to decrypt the German Enigma messages.

Hagelin's U.S. M-209
© Image Martin Gillow

Also the British Typex machine and the U.S. M-209, developed by the renown Swedish engineer Boris Hagelin, have their 3D version. Moreover, the collection includes the ICT 1301 ”Flossie” second-generation computer, the E.R.N.I.E electronic random number generator, and the American crib dragging machine Dragon that helped to break the Lorenz messages.

Of course, the countless hours of work by Martin to research and study those machines, and write accurate 3D versions, is just enormous, and makes this 3D collection simply unaffordable… unless you just want to preserve and share the history of old crypto machines, and make the simulations available to everyone for free. A big Thank You to Martin for creating all those virtual machines, and for being part of that small community, dedicated to preserve cryptologic history.

Make sure to scroll all the way down his main page, to find all virtual 3D simulations and read the various tutorials on how to use them. Also click the relevant "find out more" buttons to learn about each machine and its history. Visit the Virtual Colossus website.

 

Highly recommended, and no better day than D-day to share Martin's work and commemorate all codebreakers.

Ringway Manchester

Ringway Manchester

The Ringway Manchester YouTube channel is a fascinating journey into radio waves, but hard to describe, as it covers so many subjects with signals as the common theme. Lewis created hundreds of videos on various signals from across the world and explains the equipment and historical context behind them.

No extensive documentaries, but interesting bite-sized 5 to 15 minutes videos about shortwave listening, numbers stations, military transmitters, pirate radio, Cold War relics, clandestine radios and spies, transmitter locations and mysterious and even frightening signals, but also reviews of transceivers, receivers and handheld scanners.

Click banner to visit the YouTube channel

Visit also Lewis Ringway Facebook, RingwayManchester X (Twitter) and M3HHY Instagram, well worth following.

Below some Ringway Manchester videos that might want you to buy a shortwave receiver and start surfing the radio waves. Many more videos available at his YouTube channel. Enjoy listening!

Everything About Numbers Stations and How To Listen

 

Radio Systems At The Former Largest US Military Base In Europe

 

The Most Terrifying Shortwave Signal Ever

 

Secret Shortwave Signals That Remain An Unsolved Mystery

Mission: Impossible - Cyber Security

Cyber security is an ever-evolving battle that we can never win. The reason is simple. Virtually no one actually knows what is running on their computer at this very moment. And yes, that's a bit scary.

Gary Ruddell created a series of videos that are both entertaining and professionally made. His website provides insight in cyber security and includes articles, a newsletter and also workshops for those who are interested in a career in cyber. Here's one of his videos.

Here's Why Cyber Security is Impossible - Gary Ruddell

 

Secure communications is indeed quite complex. Luckily, there are professional firms that provide secure solutions. At least, that is what we expect them to do. However, the former Swiss firm Crypto AG had a hidden agenda, as I explained in previous posts. Garry also created a perfect introduction video about the shady adventures of that firm.

The Greatest Hack of All Time - Gary Ruddell

 

You can visit Garry's website at www.garyruddell.com to learn more about cyber security. Make sure to visit his Youtube channel to discover more videos. Highly recommended.

History of the TSEC/KL-7 Documented

TSEC/KL-7
 © Photo Dirk Rijmenants

The U.S. AFSAM-7 crypto machine, later renamed KL-7, was a 1950s marvel of technology that combined the latest cryptologic knowledge and electronics. Thanks to declassified documents we were able to compiled a fascinating history of the KL-7 that gives the reader an inside view on where and how the machine was used.

 

Although less known to the general public than the WWII German Enigma, this far more advanced rotor-based machine served three decades throughout the Cold War in nineteen countries with the military, state departments, intelligence agencies and civilians, and its history involves wars, intelligence and espionage.

Developed by ASA and later AFSA, the first machines were delivered to the U.S. military in early 1953. AFSA's successor NSA proposed to share the KL-7 crypto-principle with their NATO allies to improve their communications security and interoperability. Although initially developed for the US Army, Air Force and Navy, the machine was quickly adopted by both CIA and FBI.

Many declassified documents to reconstruct the KL-7 history.

Already in 1954, the CIA received its first AFSAM-7’s for testing. CIA's O&T Division planned the AFSAM-7 for mobile message centers and the machine was also installed in the CIA Signal Center. By 1955, all FBI offices, Quantico, the Seat of Government, the White House Signal Detachment and Air Force One were equipped with the AFSAM-7. Nice detail, several FBI documents are signed by “very truly yours, J. Edgar Hoover".

The U.S. shared the KL-7 with its NATO allies but when the Cold War turned hot in Asia they also loaned the machine to South Korea, South Vietnam and the Republic China. The latter might sound a bit weird, but the Republic of China was formed in 1912 by the anti-communist Kuomintang. After the 1949 communist takeover they fled to Taiwan, today officially still called Republic of China.

Although the KL-7 had excellent cryptographic properties and even resisted known-plaintext attacks, its design and cryptographic principle was compromised several times. The KL-47 (Navy version of KL-7) was captures by the North Koreans when they seized the U.S. SIGINT ship USS Pueblo and quite a few KL-7's also fell into the hands of the North Vietnamese, who loved to share those goodies with the Soviets.

Operating the KL-7 (center). Image NSA

Vietnam was a hard lesson, also for the KL-7. One example was operation Silver Bayonet, the famous 1965 Battle of Ia Drang (depicted in the movie We Were Soldiers). That battle revealed the danger of  poor communications security. Documents from the 101st ASA Security Detachment analysis of that battle give an interesting insight on how the KL-7 wasn’t used as it should, and why too much tactical information leaked from open unencrypted communications.

Despite some massive compromises the KL-7 remained secure, even with all technical details disclosed, as longs as the secret daily key sheets from the KL-7 were not compromised. Unfortunately, U.S. Army Warrant Officer Joseph Helmich sold KL-7 keys to the Soviet GRU and U.S. Navy communications specialist John Walker caused tremendous damage by selling KL-47 keys to the Soviets for no less than 17 years.

The complete detailed history is found in the ‘KL-7 in Service’ section of my TSEC/KL-7 page, including many declassified documents. Dive into the spree of TOP SECRET NOFORN NSA, ASA, CIA, FBI and NATO docs. If you want to know all technical details of the KL-7 and how it is operated, then visit the KL-7 webpage.

Update: The extensive history of the TSEC/KL-7, including references to many declassified documents, is now available as download on the website. More information on the research on the KL-7 history at the blog post The First Compiled History of the KL-7.

Call to Veterans! If you operated the KL-7, we're always interested to document and publish your experiences with the machine. We're not interested in classified information, only stories about where and how you worked with the KL-7, and the machine is declassified. Since the KL-7 retired more than 40 years ago, time is running out to preserve testimonies. To get an idea of the stories we like to document, below some already published stories. You can contact us through the contact page on our website Cipher Machines and Cryptology.

• KL-7 in Vietnam - COMSEC Support at Air Base Saigon
• OTT Mixers and the KL-7 at NATO in West Germany
• The KL-7 on Merchant Ships during the Falklands War 

Enjoy reading!

Russia’s Modern Early Warning Systems

Duga-1 OTH Receiver
Source: Ingmar Runge

During the Cold War, the Soviet Union developed various early warning systems to detect the launch of  intercontinental ballistic missiles (ICBMs).

The Duga OTH (over-the-horizon) radar was a well known example. Although top secret at the time, the Duga soon got nicknamed "the woodpecker" in the West because of its characteristic repetitive tapping noise that disrupted HF utility and communications signals across the world. By the mid-1980s it became clear that the Duga's technology at the time was inadequate. More about the Duga radar in our Mysterious Cold War Signals.

With the Duga radars no longer operational, what other systems protected the Soviet Union and now Russia? The SPRN System Warning on Missile Attack (Rus. Sistema Preduprezhdeniya o Raketnom Napadenii) consist of both satellites and land-based radar.

Early Soviet Satellite Program
 

The Soviet Око program (Eng. eye) to develop early warning satellites was already initiated in the late 1960s. Its first US-K satellite Космос-520 (Eng. Cosmos) was launched in 1972. To this day, all early warning satellites are designated Космос, followed by a three or four-digit number.

This first generation US-K Managed Satellite Continental (Rus. Upravlyayemyy Sputnik Kontinental'nyy) was placed in a highly elliptical Molniya orbit.  The similar US-KS Managed Satellite Continental Stationary (Rus. Upravlyayemyy Sputnik Kontinental'nyy Statsionarnyy) was placed in geosynchronous orbit. More on orbits in the further reading links.

US-K and US-KS Satellite

The first 13 US-K satellites, launched between 1972 and 1979, were very unreliable and short-lived. The following US-K and US-KS satellites were launched from 1979, with the first combat ready in 1982. In total, 86 US-K and 7 US-KS satellites were launched between 1972 and 2010. The large number of satellites was due to their limited lifespan, on average 2 to 4 years, largely determined by their liquid-fuel reserve for the orbit correction engines.

They carried a stabilized infrared telescope with 50 cm mirror to detect missile exhaust heat, and were also equipped with multiple smaller telescopes. They didn't always work flawlessly, with dangerous consequences, as you can read in our 3 Seconds from World War 3.

Second Generation Око-1 with Issues

The second generation satellites from the Око-1 program launched between 1991 and 2012 eight US-KMO Managed Satellite Control Ocean Seas (Rus. Upravlyayemyy Sputnik Kontrol' Morey Okeanov) in a geosynchronous orbit, with an expected lifespan of 5 to 7 years, which they never lived up to.

US-KMO Satellite
Source: Novosti Kosmonavtik

The US-KMO had a 100 cm mirror and could also detect submarine-launched ballistic missiles (SLBMs). However, they proved very unreliable to detect such missile launches and several failed after a few months.  They are no longer operational since 2014. Only two older US-KS satellites remained in orbit.

 

The Unified Space System

From 2015 on, the US-КMO satellites were gradually replaced by the new generation Tundra satellites (Тундра), part of the EKS Unified Space System - Detection and Combat Control (Rus. Edinoy Kosmicheskoy Sistemy - Obnaruzheniya i Boyevogo Upravleniya), also known as Kupol (Купол).

 

A this moment, five Tundra satellites are in a Molniya orbit, despite the satellite's name suggesting the highly elliptical geosynchronous Tundra orbit (taking a full sidereal day) which has a closed figure 8 ground track with a small fast loop and a large slow loop (apogee dwell). Tundra's large slow loop provides very long coverage of the designated area, requiring only two satellites for continuous cover, versus three with Molniya orbit (half a sidereal day). The Molniya orbit might be chosen because it requires less launch energy than a Tundra orbit (a sidereal day is one Earth rotation of 23h 56m 04s).

At Gunter's Space Page more details on the US-K, UK-KS, US-KMO and Tundra satellites. The US-K was carried in orbit with the Molniya-M launcher, both US-KS and US-KMO with the Proton-K launcher, and the Tundra with Soyuz-2-1b Fregat. The contractor for most of the satellites is Kometa Corporation (translation), previously known as TsNII Kometa. The Tundra is manufactured by RKK Energia.

Today's Early Warning Radar

The Russian Federation also revived the long-distance early warning capabilities to track ballistic missiles with a new generation of radar, called 77Ya6 Voronezh (Rus. 77Я6 Воронеж). The NIIDAR scientific research institute initiated its research for early warning radar in the late 1970s.

The Voronezh  is a line-of-sight phased array radar, a fixed antenna that directs its radar beam electronically. There are five different types. The Voronezh-M (VHF), DM (UHF), VP (high-power VHF), SM (SHF) and MSM (dual VHF-SHF). They have a range up to 6000 km (3728 mi) and can track 500 targets simultaneously. The first Voronezh on actual combat duty operates since 2009. Meanwhile, seven of ten planned radars are operational across Russia.

Voronezh-M Radar in Lekhtusi, Leningrad region (source Russian Army)

The Voronezh is  the first radar of VZG High Factory Readiness (Rus. Vysokoy Zavodskoy Gotovnosti). Its factory-made modular structures allow fast construction, between one and two years. More technical information and many detailed images of the Voronezh radar at Military Russia blog (translation) and at New Defense Order (translation).

One Voronezh-DM radar is located near Pionersky, a city in the Kaliningrad oblast. This is a quite unique but smartly chosen location, as Kaliningrad is today completely surrounded by Poland and Lithuania, two EU countries that are also NATO members.

Kaliningrad was previously the East Prussian city Königsberg, part of Germany. After the Second World War, Kaliningrad became part of the Soviet Union and the Kaliningrad oblast became an administrative part of the Russian Federation in 1991. This required special travel arrangements for the inhabitants, enclosed between Poland and Lithuania. An early warning system for nuclear missiles inside the territory of the main adversary? That's as close as it gets!

 

 
50 лет назад создана система предупреждения о ракетном нападении (archived)
Missile attack warning system created 50 years ago
(auto-translate available)

на новой суперсовременной РЛС семейства Воронеж
State-of-the-art radar of Voronezh family (auto-translate available)

Further Reading and Technical Details

Satellites and Orbits

• Око program (translation) at Command and Measurement Complex.
• Tundra satellite at Space Review history and tech details sensors Tundra and predecessors US-K and US-KMO.
• Tundra Satellites (translation) at Defense New Order Strategy. 
• Russia’s Soyuz-2-1b launche of 4th Tundra at NASA Spaceflight.com
• Orbit types video from NSSI explains the geostationary orbit and the highly elliptical Molniya orbit with the equator's perturbation acceleration effect.
• Catalog of Earth Satellite Orbits at NASA's Earth Observatory.
• Siderial Day Neil deGrasse Tyson explains the duration of Earth's rotation.
  

Early Warning Systems

• Ground and space echelons of SPRN with various radars and satellites at Top War.
  
• Forewarned Means Protected (translation) 50 years OTH radar and Missile Warning System, from the Armed Forces Red Star newspaper.
  
• Russia's NC3 and Early Warning Systems L. Ryabikhin.
• ESKOiBU system (translation)  Unified Space Detection and Combat Control System, Defense New Order Strategy. 

         Satellite Manufacturers

• History of Kometa Corporation (translation) including links to their first generation and second generation satellites. See also as history of TsNII Kometa.
• RKK Energia Rocket and Space Corporation and its rocket and space history.

More Related on This Blog

• Mysterious Cold War Signals with a detailed description of the Duga phased array over-the-horizon radar.
• 3 Seconds from World War 3 The story of a Soviet satellite that mistakenly triggered a missile warning.
• Dead Hand Revealed How the Soviets could still execute a retaliatory nuclear strike, even if a U.S. strike was detected too late.
• US Strategic Intelligence on the USSR and miscalculation of Soviet aggressiveness during the Cold War.

Tracking Cold War Signals

Adcock four element antenna array
WWII Naval direction finding station
(source: Frontline Ulster)

The Cold War was also a war of signals. This battle comprised chatter over radio, Morse, data and technical signals. Eavesdropping on enemy communications and analyzing their technical signals was a vital part of that battle. However, to know where those signals came from was just as important.

Directional antennas find the bearing of a signal. Early simple loop antennas had to be turned mechanically to find the signal bearing. With two or more such antennas on different locations, the target is located at the crossing of those bearings, but it was a cumbersome task. Later, double loop antennas and Adcock antenna arrays with four elements improved performance, but many more special  direction finding (DF) antennas were built to locate signals, and some were quite extraordinary.

German Wartime Research

The Wullenweber antenna array
(source: FGCRT)

Significant progress was made during the Second World War by Dr. Hans Rindfleisch, who invented the Circularly Disposed Antenna Array (CDAA). Rindfleisch also headed the Communications Research Command of the German Navy, and together with Telefunken they developed his antenna array under the codename Wullenweber.

The first Wullenweber, build in Skibsby in northern Denmark, was designed as high-frequency direction finding (HF/DF) antenna array and operated in the 6-20 MHz range. The above drawing shows, at the top, the view of the antenna array and the reflector screen wires behind them (click image to enlarge)

 

First Wullenweber at Skibsby site
(source unknown)

The antenna consisted of 40 vertical radiator elements, each supported by a wooden structure and placed in a large circle, 120 m (392 ft) in diameter. Inside that circle was a reflector screen of wires, supported by 40 poles and arranged in a smaller circle, 105 m (344 ft) in diameter.

The Foundation for German communication and related technologies (main page) has a description of the Wullenwever (original spelling), including German Naval research on Wullenwever (pdf p11-20) and the Landsberg-Lech conference (pdf) with technical details and several photos of  the Skibsby Wullenweber site.

German Technology in Soviet Hands

Many German scientists were rounded up by US and Soviet forces in the final days of the war. Both were interested in this new CDAA technology, but the Soviets were the first to start building them in 1951 with assistance of German scientists.

The Soviets eventually build 31 CDAA's of various types and called them KRUG. They were placed in Russia, Warsaw Pact countries, Mongolia, Cuba, Vietnam and Burma. These KRUG stations tracked radio communications of US and NATO reconnaissance aircraft and nuclear bombers. GlobalSecurity has info and photos on Soviet KRUG antenna arrays.

The Global U.S. Antenna Network

One of the German antenna researchers was moved to the United States to assists in the development of a CDAA. The US version of the Wullenweber was the AN/FLR-9 antenna, nicknamed "Elephant Cage". The first was built in 1962 at the RAF Chicksands base in the UK, leased by the US Air Force.

FLR-9 at USASA Field Station Augsburg, Germany (source: US Air Force ISR)

The huge FLR-9 antenna had an outer diameter of 440 m (1,443 ft) and height 37 m (121 ft). A network of eight FLR-9 was constructed in Alaska, England, Germany, Italy, Japan, Philippines, Turkey and Thailand. This network could accurately locate HF signals anywhere on Earth, to track enemy airplanes, ships or ground based transmitters, but also to follow own or friendly targets.

The US Naval Security Group operated the AN/FRD-10, also a Wullenweber antenna but smaller than the FLR-9. Its outer diameter was 263 m (863 ft). A network of sixteen FRD-10's was located at coastal lines of the Pacific and Atlantic on US mainland and Alaska, Hawai, Puerto Rico, Canada,  Panama, Japan, Spain and Scotland.

More about the Wullenweber

FLR stands for Fixed Countermeasures Receiving. FRD stands for Fixed Radio Direction-finder (see JETDS designations). More about the FLR-9 on FAS and Freedom Through Vigilance Association (USAFSS). Navy Radio has details of the AN/FRD-10. There's a report on the dismantling of the AN/FLR-9 at Misawa air base in Japan and the decommissioning of Joint Base Elmendorf-Richardson in Alaska (video). See also locations of AN/FLR-9 antenna system at the Station Hypo website.

More on WWII direction finding at the RSS Secret Listeners website and on Frontline Ulster's WWII Aircraft Direction Finding in the UK.

The NSA video below explains the history and purpose of the FLR-9.

The Last Elephant Cage

 
The American Forces Network Pacific gave a look inside Misawa’s FLR-9, build in 1962. The antenna was demolished in 2014.

FLR-9 AFN Misawa

More on Signals

Many different signals were sent, received and analyzed during the Cold War. Below some posts on this blog about Signals Intelligence (SIGINT), but there's much more to discover...

• Mysterious Cold War signals Fascinating signals revealed
• Field Station Berlin ASA/NSA listening post
• Russia’s Modern Early Warning Systems
  
• Electronic Intelligence at NSA History of  ELINT
• More posts about signals intelligence...

Visit also the Cold War Signals page about the battle over radio waves on our website

James Hall – The Spy Inside Field Station Berlin

James W Hall III

James Hall was a U.S. Army signals intelligence analyst, stationed at Field Station Berlin from 1982 to 1985. Although less known to the general public, he became one of the most prolific and most damaging spies of the Cold War.

The listening station on top of Teufelsberg intercepted and analyzed East German and Soviet signals (SIGINT) and electronic intelligence (ELINT) during the Cold War, from radio communications, microwave links, satellite transmissions to different types of technical signals. Initially operated by the U.S. Army Security Agency (ASA), the Army Intelligence and Security Command (INSCOM) took over in 1977 and the National Security Agency (NSA) provided most of the personnel.

Given its strategic importance and secretive mission, the well-guarded Field Station Berlin was an important target of both the Russian state security service KGB and the East German foreign intelligence service HVA (Hauptverwaltung Aufklärung).

Field Station Berlin on top of Teufelsberg (source: INSCOM)

James Hall was 17 when he joined the U.S. Army in 1976. He was trained as a signals specialist and his first assignment was in 1977 to Det J in Schneeberg, a U.S. listening station in West Germany near the Czech border. The Schneeberg station was a detachment of the 326th ASA Company in Augsburg. In 1981 he was transferred to Berlin.

From Secrets to Cash

Working at Field Station Berlin, Hall realized he could make a lot of money by selling top secret information. In 1982 he dropped a letter in the Soviet consulate mailbox, offering his services to the Soviets. After a first covert meeting with his KGB contact, Hall started his spying career to increase his low pay, but wasn't quite happy with the cumbersome KGB tradecraft and complex agent communications schemes.

Auto Craft Shop
Source: Berlin Brigade (archived)

Already in 1979, the HVA had recruited walk-in Huseyin Yildirim, a Turkish national who proved valuable in 1980 when he started working as mechanic in the Auto Craft Shop inside U.S. Andrews Barracks Berlin. Yildirim was a very skilled mechanic, nicknamed "Der Meister" (the master) by the Army personnel, but he was even more skilled in profiling people and making money fast.

Yildirim, codename BLITZ, was the ideal man to approach people who worked at the SIGINT station and serviced their car in the Auto Craft Shop. In 1984, Sergeant Hall then 27 years old,  got acquainted with Yildirim and proved to be an extremely valuable source for the HVA. Hall now had an additional and easier source of income.

Operating under the codename PAUL, Hall sold huge amounts of highly classified information to both KGB and their HVA counterpart. Yildirim served as middleman between Hall and HVA agents, and as his courier and paymaster.

Crown Jewels for Sale

Hall compromised ELINT systems to locate and identify enemy aircraft, missiles and vehicles, revealed NSA's SIGINT targets and several top secret programs, including TROJAN, a worldwide intelligence collection and dissemination system, and CANOPY WING, the electronic warfare plans to disrupt and mislead crucial Soviet command and missile communications in the event of a war against the Eastern Bloc.

He also sold the complete National SIGINT Requirements List (NSRL) to the KGB and HVA. The crown jewels and holy grail in one. The massive 4258-page NSRL was a catalog of all NSA activities, their list of targets, and the U.S. government wishlist of intelligence and enemy capabilities they were interested in.

Hall was reassigned in 1985 to 513th Military Intelligence Brigade in Fort Monmouth, New Jersey. The KGB took over running Hall during his stay in the United States because the HVA had no agents over there. Due to Hall's problem with elaborate precautions and using dead drops, his spying was temporarily halted.

Huseyin Yildirim's entry pass
for U.S. military installations

Hall transferred back to Germany in 1986, this time to 302nd Military Intelligence Battalion (205th MI Group) in Frankfurt where he worked as chief of the SIGINT and EW (electronic warfare) section.

He resumed passing large amounts of classified SIGINT information to the HVA through his trusted courier Yildirim. Hall meticulously copied classified documents during his working hours or smuggled them out to photocopy them.

When Hall applied for an appointment as warrant officer, he was subjected to a routine background investigation. A supervising officer complained that Hall apparently spent more money than his wages could afford, but Hall told him that a deceased aunt left him a large trust of which he received $ 30,000 annually.

Hall was reassigned in 1987 to Fort Stewart, Georgia. After completing his training as warrant officer, he was assigned to the G-2 (military intelligence staff) of the 24th Infantry Division in early 1988. As a warrant officer, he now had even greater access to classified material. Yildirim had also moved to the United States in 1987, but the tide had turned for both men.

Defector vs Traitor

East German professor Manfred Severin, who was hired by the Stasi as interpreter for Hall, defected in 1988 and offered his services to the CIA. His information lead to the identification of Hall, who was put under surveillance by the FBI and Army counterintelligence for several months. The FBI moved Severin in December to Savannah, close to Fort Stewart. Severin contacted Hall to arrange a meeting with a KGB agent in a hotel. On 20 December, Hall was introduced to an FBI agent, posing as KGB agent Vladimir.

FBI mugshot

During that meeting, videotaped by the FBI, Hall believed he was talking to a genuine Soviet contact. He explained to “Vladimir” that he made a lot of money by selling secrets and bragged about his work as an agent. The FBI agent assured him that Moscow pays better than the East Germans, and Hall handed over several top secret documents in exchange for $60.000. When Hall walked out the hotel he was arrested. Yildirim was arrested one day later in Tampa.

In total, Hall had received an estimated $300.000 from the East German and Russian agents, which was actually a bargain for the HVA and KGB. His flood of documents enabled the Eastern Bloc to take countermeasures, prevent eavesdropping and adapt their strategy. An NSA official estimated that Hill caused $3 billion worth of damage to the United States.

 

Hall and Yildirim to Court

On 9 March 1989, James Hall was court-martialed and sentenced to 40 years in prison for espionage. Huseyin Yildirim was convicted on 20 July 1989 for conspiring with Hall and carrying classified intelligence to East Bloc agents. He was sentenced to life.

Hall served 22 years in Leavenworth military prison and was released in 2011. Yildirim was released after 14 years in a secret 2003 prisoner exchange with Turkey, under the condition that he would serve his sentence in Turkey. The Turkish government however immediately set him free for humanitarian reasons.

The New York Times archived the 1989 investigation of James Hall and a report on Hall's trial. Smithsonian Magazine brings the story of FBI agent Dimitry Droujinsky who posed as KGB agent Vladimir (mid-page, after Robert Lipka case). The book Seduced by Secrets - Inside the Stasi's Spy-Tech World by Kristie Macrakis has 14 detailed pages on James Hall. You can also read about James Hall at the DOD PERSEREC website.

Der Spiegel published three interviews with James Hall. Hunt for the Stasi Superstar (translation) and many photos of the FBI arrest, the follow-up interviews The Treasure from Teufelsberg (translation) and The Scope of NSA Surveillance Surprised Me (in English) with former Stasi agent Klaus Eichne. Huseyin Yildirim's side of the story was published on the 6941st Guard Battalion Berlin website (you can select your language).

The Stasi archives contained a steel container with copies of 13088 classified documents, marked Top Secret and Top Secret Umbra, sold by James Hall to the HVA. After the reunification of Germany, these documents were returned to the U.S. government, as explained in Der Spiegel's Destruction of Traces in the Office (translation).

Related Info on this Blog

More about Teufelsberg in the Field Station Berlin. The damage Hall inflicted on U.S. military and intelligence was comparable to the betrayal by John Walker, a US Navy communications specialist, who was preceded by Joseph Helmich. Both sold technical details and key lists of crypto machines.

Some argued that personnel with low income and access to highly classified documents, like James Hall, might be tempted to sell secrets for cash. However, even people with high income committed espionage, out of greed or financial problems. Besides money, the other incentives to spy are ideology (Ana Montes), compromise (Romeo spies and Swallows) and ego (Robert Hansen). 

Visit the Cold War Signals page on the website for information on signals intelligence. US Army Border Operations provides more on other intelligence operations in Germany with links to Det J Schneeberg, including many photos of the listening station.

There are several posts on legendary HVA chief Markus Wolf. In a German documentary (subtitles available), Markus Wolf talks about James Hall. Jump directly to Part 2 segment at 21:16 (enable CC Subtitles with Settings > Subtitles > Auto-translate > English).

There's also a documentary, Deckname Blitz, about Huseyin Yildirim and the James Hall spy case, which includes video footage of the actual meeting between the covert FBI agent and Hall (at 36:00). The documentary is in German, but no subtitles.

Deckname Blitz - Der Spion vom Teufelsberg

U.S. COMSEC History - Additional Releases

The National Security Agency (NSA) just published an update of the 2007 release of the David Boad lectures on communications security (see my old post). Many blank pages of the old version are now unredacted and show newly released information on various crypto systems, such as the TSEC/KL-7, KW-7, KW-26, KW-37 and one-time pad systems.

After the 2011 FOIA releases of the KL-7 operating instructions, I'm happy to see another bit of information on that pretty crypto machine ooze out of Fort Meade. More on the KL-7 at my website (including an accurate simulation). Of course there's much more to discover in the wonderful David Boak lectures. The unredacted version available in A History of U.S. Communications Security (Volumes I and II) 

The GUNMAN Project

Foreign embassies have always been very attractive intelligence targets. Embassy staff and personnel often handle classified information. One way to obtain such sensitive information is by HUMINT (human intelligence) from embassy personnel. Another - covert - method is SIGINT (signals intelligence) by wiretapping or advanced listening devices, commonly known as bugs.

A most spectacular case of electronic espionage occurred in the 1980s, at the height of the Cold War, when it was discovered that Soviet intelligence had successfully implanted very sophisticated bugs in a large number of electronic typewriters at the U.S. embassy in Moscow.

From Tip to Operation

It all started in August 1983, when a friendly government informed U.S. intelligence that they found a curious bug, implanted in equipment at their embassy. In response, the U.S. National Security Agency (NSA) sent communications security experts to their ally to examine the bug. Its technology proved to be very sophisticated. The efforts, required to develop such technology, were of such a scale that NSA was convinced that this was not a single case.

NSA realized that such bugs were most likely also implanted in U.S. embassy equipment. This triggered a secret operation codenamed GUNMAN. The first part of the operation was to remove all equipment from the U.S. embassy in Moscow and check it for bugs. This comprised all crypto and communications equipment, computers, printers and much more. However, Soviet intelligence was to be kept ignorant of the operation.

U.S. Embassy in Moscow 1983

The transport of the equipment proved quite a logistic challenge. No less than eleven tons of all kinds of equipment had to be shipped from Russia back to NSA in the United States and replaced by new equipment. All this had to be done in complete secrecy. New techniques and procedures had to be devised to make sure that the new equipment, some ten tons, wasn't again tampered with by the Soviets and at the same time they had to keep their own embassy personnel ignorant of the real reasons for the exchange of equipment. It took them five months.

Searching for Bugs

All recovered equipment was stacked at Fort Meade. The next part of GUNMAN was to carefully inspect and x-ray each single item. All crypto gear soon proved clean. It took them until July 1984, eleven months after the tip-off, to discover the first bug in a non-crypto device, an IBM Selectric typewriter. It was an extra coil inside a power switch that caught the attention of a technician. X-rays revealed an electronic bug, hidden inside a metal bar. Eventually, they found bugs in sixteen Selectric type II and type III typewriters.



IBM Selectric II Typewrite

NSA technicians started the complex task of reverse-engineering the bugs. They turned out much more sophisticated than the specialists could ever have imagine. Metal cams were replaced by a non-ferromagnetic version that contained strong little magnets. These magnets caused magnetic disturbances when keys were depressed on the keyboard. The magnetic changes were picked up by the electronics, analyzed  and converted into a digital signal. The electronics were hidden completely invisible and sealed into a hollow support bar.

Ingenious High-Tech

The signal was compressed into four-bit frequency selecting words. Up to eight four-bit characters could be stored in a circuit with tiny one-bit core memories. Only when the memory was filled completely (at irregular intervals due to the typist's tempo) the data was sent in a very short burst transmission to a nearby listening post. The burst frequency range was selected deliberately in the same frequency band as Soviet television stations to hide the burst noise. The implants could be turned off remotely to avoid detection when security technicians would sweep the embassy for bugs.

The NSA technicians found several different versions of the bug. Some operated on batteries and others were powered by the AC mains. Some bugs activated a beacon to monitor whether a typewriter was turned on. The technicians were stunned by the technology used and the cleverness of the design to avoid detection by technical teams.

NSA director General Faurer was quoted in 1986: "I think people tend to fall into the trap of being disdainful too often of their adversaries. Recently, we tended to think that in technical matters we were ahead of the Soviet Union, for example in computers, aircraft engines, cars. In recent years, we have encountered surprise after surprise and are more respectful."

That quote says it all. The case had a major impact on all intelligence agencies and many lessons were learned. A damage assessment proved impossible because the whereabouts of the typewriters during all those years were never put on record. They do know that from 1976 to 1984, Soviet intelligence used these bugs to collect sensitive plaintext information, typed on typewriters in the U.S. embassy in Moscow and the U.S. consulate in Leningrad.

Learning Lessons and Adapt

Now came the final part of the GUNMAN project: awareness and prevention. New procedures were implemented for secure shipping of equipment, technologies were developed to make equipment tamper proof and new guidelines were written on how to handle classified information. Over a period of seven years, special GUNMAN briefings were given to various government agencies and the intelligence community.

COMSEC (communications security) was renamed into INFOSEC (information security) to emphazise that security is not merely a case of using secure communications equipment but rather the secure handling of critical information on whatever type of secure or insecure equipment that might process plaintext information. The lessons learned in 1984 are still applied in protecting information that is handled inside embassies and other critical buildings all over the world.

However, this story is also relevant to all of us. Our computers have numerous unknown processes running at the background, multi-functional printer-scanners and various mobile devices are constantly connected to the Internet. We store and process all kinds of confidential information on these new technologies but hardly realize that they are easily turned into bugs. This doesn't even require the implant of sophisticated hardware anymore, as in the GUNMAN case, but only a quick reprogramming of internal software or hidden spyware.

The old school spy equipment has evolved into digital spyware. An evolution quite dangerous when people constantly use these modern media without thinking about the possible consequences. Secrets can leak in most unexpected ways, as the GUNMAN case has shown!

Read NSA's Learning From the Enemy: The GUNMAN Project (alternative link) for a detailed account. NSA also covered it in American Cryptology During The Cold War ch26, p401 (pdf p141). (alternative link) The Crypto Museum's IBM Selectric Bug web page contains excellent technical and historical information on the GUNMAN case.