priyom.org

Russian 7

Operating agency Unknown

Enigma family IB
Country Russia

Russian (icon)

Operational detail pages
Active stations E07, V07, M12, XPA, XPA2, DP01
Inactive stations G07, S07, XPH, XP

This operator is believed to be a main Russian intelligence agency. It runs several quite active numbers stations, such as E07, M12 or XPA2.

Binding characteristics

The 000 in call-ups for null messages, and 000 000 outro, are features unique to this operator. Its early digital MFSK stations were built around direct translations of the analog format, using a small set of tones with a one-to-one mapping to represent digits and pauses, with a few added control characters. For example XPA features a direct representation of the characteristic intro of analog stations of this operator. This was later dropped in XPA2, but digital characteristics such as synchronization elements still allow us to tie together the various later evolutions of these modes, as they can be compared in this working study document.

Around 2007, XPA and M12 were noted to have interchanged some of their schedules[1]. In 2013, an E07 schedule sending on Tuesdays and Fridays was converted into an XPA2 schedule, using the same time slots and frequencies. This E07 schedule featured long messages frequently overruning the 20-minute time slots and throwing off the repeat transmissions; the rationale for its conversion to XPA2, with a higher bandwidth, could have been to accomodate this heavy traffic.

Some of the transmissions of this operator also share a very characteristic TX noise. It can be heard before the transmission starts, and more typically after it ends, for a few seconds before the transmitter is turned off. This shutdown sequence sounds in a very characteristic way, and is an operational feature shared across several stations of this operator.

SVR hypothesis

As the civilian Foreign Intelligence Service of Russia, SVR is a prime candidate for a Russian numbers station operator. Details of the spying case in which Andreas and Heidrun Anschlag were arrested and identified as SVR agents, allow us to draw a possible link with the XPA station.

In the early morning of Tuesday, October 18th, 2011, the German police raided the home of the Anschlags. They found Heidrun Anschlag in the act sitting at her shortwave radio receiver to get her orders from Moscow. The media give the time of the raid as 6:30 a.m. local time in Germany[2], corresponding to 0430z. Media sources also relate that the Anschlags would communicate by radio with Moscow "every Tuesday at 6"[3], or again "always on Tuesdays and Thursdays"[4]. This apparent schedule would be the basis to match it against a known numbers station schedule: and indeed, at the time there was an XPA schedule sending on Tuesdays and Thursdays at 0440z, 0500z and 0520z. The time given for the raid was 0430z, so it would be possible that the police caught Heidrun Anschlag sitting with everything ready for a 0440z transmission 10 minutes before it started; or it's also imaginable that this timing given by the media was only approximate, and that the police really timed their entry to 0440z with the purpose to catch her red-handed receiving the transmission.

Furthermore, technical details indicate that the radio receiver was plugged into a computer, and that decoding software was used[5], which is consistent with a numbers station using a digital mode. It was also mentioned that the transmission was "accompanied by a special identification tune"[2], which could be a layman's way to report about the sounds made by a slow MFSK, polytone station like XPA.

This XPA schedule is a good, coincidental match considering not only this, but also its following demise and shutdown. Until the arrest, it showed steady activity, and had even seen increased traffic in the two months leading to it - when, reportedly, SVR was trying to set up an exfiltration plan with its agents. On the Tuesday of the arrest, it was sending a message. On the following Thursday, it sent a null - as could be expected. Curiously enough, the following week, it sent two new messages, one on Tuesday and one on Thursday; there can be several ways to interpret and explain this. None of this arrest-time activity followed the common (though not systematic) habit of repeating new Tuesday messages on the following Thursday. Then after these events, this schedule never sent any traffic ever again: only null messages, during 7 months on, with the last transmission on June 7th, 2012; then the schedule stopped transmitting at all and disappeared for good. This would be consistent following the (enforced) termination of the recipients' assignment.

These clues linking this XPA schedule to this couple of SVR agents seem compelling. Paul Beaumont from ENIGMA 2000 declared that this XPA schedule was "almost certainly that used by the two German spies arrested on 18th October, 2011"[6]. This leads us to give consideration to the hypothesis coming as an implication of this, that SVR could be the operator behind XPA, and this family of stations.

Activity breakdown

This operator still heavily relies on classic analog formats, with E07 and M12. Their activity is not on the decline: both stations received new schedules in 2016. XPA is down to only one schedule and might be on the way out, possibly considered legacy in favor of its XPA2 evolution.

Breakdown of Russian 7 schedule statistics

The activity of this operator is primilarly based on the Atlantic side of Russia, however it's hard to tell whether schedules are targeted at Europe, the US, or somewhere else: given the high power levels used, transmissions can usually be received easily in many places, even despite bad conditions. The only schedule of V07 is still actively maintained, having received a new voice and new time slots in the summer 2017; it is likely aimed at Latin America.

This operator shows a substantial activity using a number of advanced digital modes, which are believed to be at least partly experimental, are not yet understood or even fully inventoried, and are still under study: a basic overview of them can be found in this working study chart.

Test frequencies

This operator sometimes runs test transmissions, of both its analog and digital formats, on 10250 or 10256 kHz. Digital formats also include experimental modems not used for regular broadcasts, like DP01. Additionally, it seems to regularly tinker with varied experimental digital modes, on many different other frequencies.

Operation quirks

This operator is very professional and seldom makes operation mistakes, compared to other agencies. Its transmissions can generally be received at high power levels, or fair levels even in bad conditions. Modulation types used are ICW for morse and USB for digital stations, while voice stations use either AM or USB. AM transmissions exhibit two quirks: the voice samples are sped up - with their pitch correspondingly increased - by 10%; and the modulation and thus audio level are often desperately weak compared to a very strong carrier, compromising the reception of the message despite excellent signal levels.

References

  1. ENIGMA 2000 Active Stations List v1.3 (September 2017), p. 19 [accessed September 19th, 2017]
  2. Cold-War Style Spying: Russian Couple's Arrest Could Mar Diplomatic Ties - Der Spiegel [accessed September 1st, 2017]
  3. Russische Spionage: Agententhriller von historischer Dimension - Die Welt [accessed September 1st, 2017]
  4. Agenten-Paar: Gibt es einen Austausch? - Schwarzwälder Bote [accessed September 1st, 2017]
  5. Trial of Russian Spies in Germany Strains Diplomatic Relations - Der Spiegel [accessed September 1st, 2017]
  6. ENIGMA 2000 Newsletter #68 (January 2012), pp. 2, 45-46 [accessed September 1st, 2017]
Your browser is out-of-date!

Update your browser to view this website correctly. Update my browser now

×