priyom.org

KiwiSDR: locating numbers stations and field agents

Tuesday, July 25, 2017

This is the second part of a previous blog post on the worldwide KiwiSDR receiver network, make sure to check it out if you haven't!

 

When tuning through the radio bands and coming across a mysterious signal, the same questions often come to mind... What is it? What does it mean? Actually, can this cryptic signal even carry any meaning? What is its purpose?... We've all had this feeling. In the case of numbers stations, we have to resolve to giving up on deciphering the messages, but we still wonder: who is operating this? Where is it sent from, whom is it sent to? And we have to settle for small victories, stemming from meticulous pattern analysis, to lift small corners of the veil.

Sometimes, with a combination of work, enough data, smarts and a bit of luck, it is actually possible to recover some pieces of cleartext message. But this would make stories for another time: in this article, we'll focus on the location of numbers stations, and how the KiwiSDR network has been helping us to crack this.

 

The E11, S11a and F11 stations and their ancestors, who have been collectively on the air for decades, have long been considered to come from Poland. Of course there are cultural hints such as the choice of languages (S11 used to speak Polish before being replaced by S11a in Russian), or the Polish accent of the different voices; but more reliably, observations of signal strength and propagation by listeners in different locations, and even triangulation by those equipped with direction-finding gear, have pointed towards Poland.

But you don't always need your own radio equipment to research this. For many months, there was a KiwiSDR receiver located in Warsaw, the capital of Poland. Unfortunately it later went offline. But it always offered great reception of every E11 or S11a schedule. Day and night, even when propagation conditions were bad. There were some schedules that used to be always hard to hear and find, and for which we could only rely on reports from remote listeners in Siberia for example; but even these difficult schedules were suddenly always easy to receive on this Warsaw KiwiSDR! It became a go-to receiver for this family of numbers stations.

The quality of the signal was so great that it exhibited none of the variable fading that is characteristic of long-distance shortwave propagation. It even picked up signals that should not have been audible from so close at these frequencies, because of the skip zone. The likely conclusion of all this, was that this KiwiSDR receiver was so close to the transmitter site, that it picked up the ground wave, the part of the signal radiating directly along the ground from the transmitter, without bouncing on the ionosphere.

Radio propagation: sky wave, ground wave and skip zone

So this is another piece of evidence that E11, S11a and F11 indeed originate from Poland: and even, that they are transmitted from somewhere in the Warsaw area. And are most likely run by a Polish governmental agency. The next part of the investigation, which would consist of crossing Google Maps with open data sources and public procurement calls for tenders, to find out exactly which big shortwave antenna field around Warsaw could be their transmitter site, is left as an exercise to the reader.

 

Polish numbers stations are not the only ones whose ground wave you can catch. There are always a few KiwiSDR receivers available in the Moscow area: check them out on our receiver map! These often provide a good reception of Russian numbers stations from Moscow that are otherwise difficult to hear elsewhere because of bad propagation. The epitome of this could be a particular schedule of the F06 digital station, transmitting on link ID 40133. The times and frequencies on which it transmits vary through the year, but in April it transmits at midnight in Moscow on 20 MHz, which is a shockingly high frequency for nighttime. Here is a prediction, from the excellent VOACAP website, showing puzzling results about where this transmission has a chance to be heard.

VOACAP prediction for F06 ID 40133 in April

And indeed, at that time of the year, receivers in Moscow catching the ground wave from the transmitter are our only way to hear, and confirm that this elusive schedule really does transmit. So where is the recipient?

Well, where can it possibly be? We can speculate after eliminating anywhere the message can't be received, which is nearly all of the world. Propagation predictions for other months consistently confirm an arc over North Africa, ranging from Spain to the Middle East - areas unfortunately devoid of any KiwiSDR receiver; with the worst predictions narrowing the probabilities down to North Africa only. Tunisia, Libya, Egypt are all countries that have been in turmoil in the recent years following the Arab Spring, where it would make sense to have intelligence agents. But my guess would be Egypt, with its long-standing geostrategic regional role, and control over the Suez Canal, considering the challenges for Russia to secure naval access to the oceans.

 

Not all Russian numbers stations are transmitted from Moscow. Military channels like the Buzzer are transmitted from various sites across the Western and Southern Military Districts, naval morse beacons are transmitted from Russian navy bases such as Kaliningrad on the Baltic Sea, or Sevastopol in Crimea. Some numbers stations schedules of E06 or M12 for example are transmitted from the Russian Far East across the Pacific Ocean. And then, some of them are transmitted from Cuba.

As during the Cold War, the Cuban ally offers Russia a very close and strategical position to target a common main antagonist: the US. Historically, the USSR operated the big Lourdes SIGINT station in Cuba; it was closed in 2001. Unconfirmed 2014 talks to reopen it cast uncertainty on its current status, but what's clear it that Russian intelligence has continued transmitting from Cuba during that time, and still does nowadays. The weekly Monday digital F01 schedule with link ID 00117 can be heard on most KiwiSDR receivers across the US, just as strongly as HM01 Cuban intelligence broadcasts; this is only expectable as the US would be the main and most likely target.

However, there is another weekly Russian intelligence schedule based in Cuba, F01 link 00116, which is never throughout the year easy to hear from the US; and often in many states, it just can't be heard at all! Not even any receiver in the whole KiwiSDR network can offer a strong reception of it, and we've tried them all: take a look at our map, the signal propagates correctly neither to the continental US, nor Hawaii, nor eastern Asia, Europe nor even southern Brazil.

It seems clear that this one schedule in not targeted at the US, but somewhere else where we can't hear it. What more we know is that it transmits in the late afternoon on high frequencies reaching up to 21 MHz, and that the signal seems quite directional. Fitting locations would be Central America, or the northern part of South America. Is the recipient in a Russian ally country such as Venezuela or Nicaragua? Is it spying on American interests in a US-aligned country like Panama or Colombia? Are they monitoring the European spaceport at Kourou in French Guiana - from which Soyuz rockets are also launched?

Well, there again, other people during decades before us have already accomplished a lot of work tracking and trying to identify these Russian stations. Numbers & Oddities maintains a listing of historical and current link IDs, in which the link between Cuba and the Russian embassy in Nicaragua is identified as 00125, not 00116. So Nicaragua was indeed a good possibility! Just not the right one.

We can try to go further, with an interesting theory based on a 2005 Russian newspaper article about the history of signals intelligence in the USSR. It contains a list of SIGINT sites installed by the USSR around the world. In his Radio Intrigue report #114, Don Schimmel points out how the number of these sites which are located in the Americas amounts to 14, just like there have been up to 14 different stations heard in the Russian transmission network based around Cuba, back when many more links in addition to 00116 and 00117 showed regular activity. Could it be that the radio links with Cuba correspond to that set of 14 identified sites?

Most of the sites are located in the US, in Washington, New York and San Francisco. Two of them are in Central America: one in Nicaragua, as already considered above... and one in Mexico City. If this theory holds out, would it mean that the recipient of F01 link 00116 picks up his orders at the Russian embassy in Mexico?...

 

To conclusively answer all these mysteries, hopefully the future will bring us new KiwiSDR receivers in places like Belize, Mexico or Egypt (with great E25 reception on this one!) In the meantime, let's hope that Russian intelligence don't get angry at us for trying to crack this, and try to shut down the website ;-) Either way, send us your opinions and alternative theories about these recipient locations, and also your feedback about our KiwiSDR receiver map and what more you would like to see us do with it, on Twitter @priyom_org!

linkfanel, QRT