Project GUNMAN was a United States National Security Agency (NSA) counterintelligence operation, authorised in 1984, that discovered and analysed Soviet eavesdropping implants hidden in IBM Selectric typewriters used at the U.S. embassy in Moscow and the US consulate in Leningrad. Sixteen bugged machines were found, all shipped to the Soviet Union between 1976 to 1984. The implants have been described as the first form of keylogger.
Soviet technical penetration of the U.S. diplomatic premises was well documented by the early 1980s and the US embassy building under construction in Moscow from 1979 was later found to be full of bugs and rejected. In 1983, French authorities reportedly alerted the U.S. to a bug found in the teleprinter, causing concern that Soviet devices could be present in other equipment.
The project is credited to Walter J. Deeley, the NSA's deputy director for communication security. President Ronald Reagan signed the authorisation in February 1984 on a memorandum prepared by John Poindexter. Knowledge of the project was held tight within the government even after approval. The plan involved replacing embassy equipment in Moscow and examining the removed mechanics in the United States. Because 220 Volt IBM Selectrics were in short supply, the NSA could obtain only 50 of the roughly 250 replacements needed, so the most sensitive machines were prioritised.
On 23 July 1984, NSA technician Michael Anderson noticed an anomaly in the power switch of an IBM Selectric while examining it at Fort Meade, and decided to X-ray the whole machine. The images showed am unexpected additional component and the NSA went on to find bugs in 16 typewriters in total.
the devices were concealed in a hollowed-out metal support bar, the "comb support" running across the typewriter. They detected a small magnetic disturbances caused by the mechanism that rotates the tilts, the typeball, and so could identify which character was struck. Variants had custom integrated circuits and small amount of core memory, and some were battery powered while others drew power from the typewriter. They transmitted bursts short bursts at 30, 60 or 90MHz to antennas hidden in the embassy structure, which relayed the signal to listening posts outside. According to Maneki, the typewriters bugs marked a new level of sophistication because they were electrometrical and for the first time captured written plaintext before encryption.
The NSA's analysis of the find continued after 1984 and fed into a wider assessment of Soviet access to U.S. embassy equipment. Maneki's study, first published in 2012, drew wider attention after coverage in October 2015. Commentators have cited the episode as an example supply-chain hardware compromise and a precursor of modern keylogging.