The risk of supply chain espionage: a near-undetectable keylogger

In 1984 the NSA removed eleven tons of equipment from the American embassy in Moscow. The problem, hidden eavesdropping devices, turned out to have been purchased eight years earlier.

It began with a tip from a partner service, which the year before had found something in equipment at its own embassy in Moscow. The NSA sent analysts, and they were taken aback: technically this was generations ahead of anything they knew from the Soviets. And made so well that it could not possibly be the only one.

On presidential orders, everything capable of processing information was replaced with equipment from a controlled supply chain, sealed and transported under close supervision. At Fort Meade it was all dismantled and x-rayed.

Months of nothing, until technician Michael Arneson noticed a shadow in the on/off switch of an IBM Selectric typewriter. He decided to x-ray the machine from top to bottom. What he found was not an eavesdropping device that had been put inside the typewriter, but one that was part of it.

The Soviets had replaced the metal support bar under the keyboard with an identical-looking hollowed-out version with electronics inside. Six mechanical levers had been replaced with identical ones carrying a strong magnet in the tip. Sensors in the bar read which lever moved. The unique combinations of tilt and rotation made every typed character recoverable.

A keylogger, entirely in hardware. The data went into a buffer and was sent out in short bursts as soon as the device was activated from outside. The frequency sat close to that of a local television station, so the transmission barely stood out. The device was built so that even an NLJD, an instrument that finds powered-down electronics (semiconductors), was misled.

Sixteen machines, in use for eight years. Found in the end, but only through examination at exceptional depth: emptying a building and x-raying its contents piece by piece, eight thousand kilometres away.

Good examination does not start with the question of how deep you can search, but which attack you are trying to rule out and where in the chain it can take place. Against an actor that infiltrates the supply chain, this level of depth may be necessary. That does not mean every organisation should have equipment examined this way. The required depth follows from the threat profile. How much uncertainty is acceptable is a board decision.

Making that trade-off explicit in advance prevents both overkill and false assurance. Examination can establish that something has been compromised, but it cannot undo what happened before.

If you examine what comes in and what stands inside, one question remains open: what happened before the front door?