Sixteen typewriters in the US embassy in Moscow and the US consulate in Leningrad spent as long as eight years transmitting everything typed on them straight to Soviet intelligence, and nobody in Washington knew it.
This wasn’t even the first time a hidden object had turned an American ambassador’s own office against him. In 1945, Soviet schoolchildren gave Ambassador W. Averell Harriman a carved wooden replica of the Great Seal of the United States as a gift. It hung in the ambassador’s residence for seven years, through three different ambassadors, before a security sweep in 1952 found a passive listening device sealed inside it.
The bug had no battery and no wires. It sat dormant until a beam of radio energy aimed at the residence from outside lit it up. The carving itself, with a thin diaphragm mounted behind the eagle’s beak, did the rest, turning sound waves in the room into a signal that bounced straight back out. Whoever built it had figured out how to bug a room without ever needing to plug anything in or change a battery.
US technicians dubbed the Great Seal’s listening device “The Thing.”
The United States sat on the discovery for eight years before Ambassador Henry Cabot Lodge revealed it publicly at the United Nations in 1960, using it to counter Soviet outrage over the U-2 incident.
Thirty-two years after that carving went up on an ambassador’s wall, a very similar idea showed up again inside a typewriter.
The Tip
In August 1983, a friendly foreign government found a sophisticated bug planted in its own embassy equipment and passed the discovery to the National Security Agency. NSA Director Lieutenant General Lincoln Faurer sent analysts from his research and communications security divisions to examine it. Their conclusion was blunt: if the Soviets had built something this advanced to spy on one of their allies, the United States was almost certainly a target too.
Deputy Director Walter Deeley took the next step. He proposed pulling every piece of telecommunications and information-processing equipment out of the Moscow embassy, replacing all of it, and shipping the old gear back to Fort Meade for teardown. Secretary of Defense Caspar Weinberger carried the plan to President Reagan, who signed off in February 1984.
The operation got a code name: GUNMAN.
The Swap
NSA had 100 days to find replacement equipment and get it into Moscow without alerting the people they suspected of planting the bugs in the first place. About 40 percent of the new gear was purchased fresh. The rest came from existing government stock. The embassy itself made the job harder before anyone even opened a crate: no centralized inventory existed of what equipment was where, and the hallways were very narrow, which made getting large crates in and out a logistics nightmare.
The Soviets disabled the embassy elevator after the very first day of deliveries. Whether that was suspicion or coincidence, nobody on the American side could be sure, but it meant roughly 10 tons of equipment had to be hauled up and down the stairs. Ambassador Arthur Hartman told his own staff, and presumably the Soviets listening in, that this was a routine communications upgrade.
It wasn’t.
The Find
This wasn’t the first look. In 1978, inspectors at the Moscow embassy found an unexplained antenna hidden in the building’s chimney, reason enough on its own to check the typewriters for bugs. A technician x-rayed them and found nothing. He’d aimed his search at the power structure, the start capacitor, the switch, the motor, on the assumption that any modification would show up there.
At the time, the implants were still battery-powered, so nothing about a typewriter’s power structure had actually been touched, and the search came back clean. The State Department took no further action. The bugs stayed in place for another six years.
The old equipment reached Fort Meade in stages, and NSA’s communications security division started working through it methodically: visual inspection first, then x-ray, each item compared against a known-good baseline. On the evening of Monday, July 23, 1984, eleven months after the original tip, a technician named Michael Arneson was examining one of the embassy’s IBM Selectric typewriters and noticed something that didn’t belong: an anomaly in the power switch. He decided to x-ray the whole machine, top to bottom.
The next morning, his colleagues argued about what they were actually looking at. An extra coil could mean any number of things. It could be ordinary memory circuitry. The detail that settled the argument was location: the coil connected to circuits packed into a metal bar running the full length of the machine, a spot with no legitimate reason to have any electronics at all. The discovery earned him a $5,000 bonus.
How a Typewriter Becomes a Bug
The IBM Selectric doesn’t work the way older typewriters do. Instead of individual metal arms striking the ribbon, it uses a single “typeball,” embossed with every character, that spins and tilts into position, then strikes forward to print. Six mechanical arms called “bails” control that movement, translating which key you pressed into exactly how the ball needs to rotate and tilt to print the right letter.
Soviet intelligence swapped the stock bails for near-identical replacements, each one carrying a small magnet, and packed the actual electronics into a modified support bar running the length of the machine.
It’s a genuinely elegant piece of engineering. Every keystroke still moved a bail exactly the way it was supposed to, so the typewriter typed normally and felt normal to whoever was using it. But every keystroke also produced a distinct magnetic signature as the bugged bail moved, and a sensor inside the implant picked that signature up.
The bug converted each keystroke into a short digital code and held onto it in a tiny internal memory, a miniaturized component NSA’s own engineers hadn’t seen before in a device of that era. Once it had collected a handful of characters, the implant burst-transmitted the whole batch by radio to a nearby listening post, tuned to the same frequencies used by Soviet television broadcasts, so the traffic would look like ordinary background noise to anyone scanning for it. The Soviets could switch individual bugs on and off from a distance whenever they wanted.
It wasn’t perfect surveillance. Any key that didn’t move the type ball, the space bar, tab, shift, backspace, produced no magnetic signature and left no trace for the sensor to pick up. The hyphen sat at the ball’s resting position and was invisible for the same reason. Whoever was reading the intercepted traffic in Moscow had to reconstruct entire documents around those gaps, guessing at word breaks and punctuation the same way NSA’s own analysts later had to when they reverse-engineered the recovered data.
How Many, How Long
Once NSA knew what to look for, the scale of it came into focus fast. Sixteen implants turned up across twelve Selectric II and four Selectric III typewriters, spread between the Moscow embassy and the Leningrad consulate. Of the 44 typewriters shipped back from Moscow for inspection, six were carrying bugs. Seven more implants were found in other embassy machines and three in Leningrad’s.
The bugs weren’t all the same generation. The earliest, battery-powered version had been planted in October 1976. Later versions ran on AC power and were more advanced, with the last known installation dated January 1984, just months before the whole scheme came apart. Stretched end to end, that’s roughly eight years of American embassy correspondence, cable traffic, and internal memos typed on machines that were quietly reporting every keystroke to the other side.
NSA later confirmed the implants had been installed while the typewriters were still in Soviet customs custody, before they ever reached the embassy. Nobody on the inside had to be recruited. The compromise happened before the machines were even unboxed.
Eight years is a long time to be overheard.
Finding the first bug didn’t end the search, it started a much bigger one. About 25 people, most of them from NSA’s communications security and research divisions, spent months going through every piece of returned equipment, six days a week. They x-rayed each item against known-good baselines using a small portable unit, and the volume of film they burned through says something on its own: roughly 10,000 sheets of Polaroid film, at a time when Polaroid was manufacturing only about 3,000 sheets a year across its entire commercial output.
What Changed Afterward
Reagan signed National Security Decision Directive 145 on September 17, 1984, less than two months after the first bug was confirmed, making the NSA director the national manager for US government telecommunications and information-systems security and creating a steering group of senior officials from State, Treasury, Defense, Justice, the Office of Management and Budget, and the CIA to keep the problem from getting compartmentalized away again.
Congress appropriated 35 million dollars toward embassy security improvements in 1986, and by 1988 the department had built a dedicated facility just to inspect and package plaintext-processing equipment before it ever left the country.
Inside NSA, the old communications security office was renamed Information Security in 1985, a name change that reflected a real shift: the agency’s job now included protecting information itself, not just the channels it traveled through. A new Technical Security Engineering Center opened in 1986 to coordinate equipment fabrication security, and by 1989 NSA had a standalone division devoted entirely to anti-tamper technology, training other agencies to spot exactly the modification that had gone unnoticed inside those typewriters for years.
The tamper-evident holographic and prism seals that still show up on secure government equipment today trace back, in part, to programs GUNMAN kicked off. Getting the CIA, FBI, and State Department to actually share what each of them knew about the problem, though, remained a slower fight than any single piece of hardware.
Schneier on Security and other outlets covering the case since have called it the world’s first keylogger, arriving roughly a decade before anyone used that word. The device captured keystrokes, turned them into digital data, and sent that data somewhere else without the person typing ever knowing.
