This operator is believed to be a main Russian intelligence agency. It runs several quite active numbers stations: E07, V07, M12, XPA, XPA2 and XPB.

Binding characteristics

The 000 in call-ups for null messages, and 000 000 outro, are features unique to this operator. Its early digital MFSK stations were built around direct translations of the analog format, using a small set of tones with a one-to-one mapping to represent digits and pauses, with a few added control characters. For example, both XP and XPA feature direct representations of the characteristic intro of analog stations of this operator. This was later dropped in XPA2, but digital characteristics such as synchronization elements still allow us to tie together the various later evolutions of these modes, as they can be compared in this working study document.

Around 2007, XPA and M12 were noted to have interchanged some of their schedules^[1]. In 2013, an E07 schedule was converted into an XPA2 schedule, using the same time slots and frequencies. This E07 schedule featured long messages frequently overrunning the 20-minute time slots and throwing off the repeat transmissions; the rationale for its conversion to XPA2, with a higher bandwidth, could have been to accomodate this heavy traffic. Similarly, in October 2020, two high-traffic analog schedules were converted to digital: one M12 to XPA, and one E07 to XPA2; both keeping the same time slots but receiving new frequency sets.

Some tests from this operator, sometimes even as a linear, continuous test session on a single known test frequency, mixed a succession of analog E07 or M12 modes, classic XPA or XPA2 digital modes, and different newer experimental digital modes (such as on November 16th or 22nd, 2022, on 11431 kHz and 10256 kHz respectively); or a succession of E07, V07 and even S07 voices (such as on October 28th, 2022 on 9142 kHz).

Some of the transmissions of this operator also share a very characteristic TX noise. It can be heard before the transmission starts, and more typically after it ends, for a few seconds before the transmitter is turned off. This shutdown sequence sounds in a very characteristic way, and is an operational feature shared across several stations of this operator.

X06b is transmitted roughly one hour before scheduled transmissions of the different stations of this operator, including daily schedules of latest experimental modes: it cycles briefly between the different frequencies of the upcoming schedule.

SVR hypothesis

As the civilian Foreign Intelligence Service of Russia, SVR is a prime candidate for a Russian numbers station operator. Details of the spying case in which Andreas and Heidrun Anschlag were arrested and identified as SVR agents, allow us to draw a possible link with the XPA station.

In the early morning of Tuesday, October 18th, 2011, the German police raided the home of the Anschlags. They found Heidrun Anschlag in the act sitting at her shortwave radio receiver to get her orders from Moscow. The media give the time of the raid as 06:30 a.m. local time in Germany^[2], corresponding to 04:30 UTC. Media sources also relate that the Anschlags would communicate by radio with Moscow "every Tuesday at 6"^[3], or again "always on Tuesdays and Thursdays"^[4]. This apparent schedule would be the basis to match it against a known numbers station schedule: and indeed, at the time there was an XPA schedule sending on Tuesdays and Thursdays at 04:40, 05:00 and 05:20 UTC - which would shift an hour ahead for the period from November to March inclusive, as would be expected with DST for a recipient located in Europe. The time given for the raid was 06:30, so it would be possible that the police caught Heidrun Anschlag sitting with everything ready for a 06:40 transmission 10 minutes before it started; or it's also imaginable that this timing given by the media was only approximate, and that the police really timed their entry to 06:40 with the purpose to catch her red-handed receiving the transmission.

Furthermore, technical details indicate that the radio receiver was plugged into a computer, and that decoding software was used^[5], which is consistent with a numbers station using a digital mode. It was also mentioned that the transmission was "accompanied by a special identification tune"^[2], which could be a layman's way to report about the sounds made by a slow MFSK digital mode like XPA.

This XPA schedule is a good, coincidental match considering not only this, but also its following demise and shutdown. Until the arrest, it showed steady activity, and had even seen increased traffic in the two months leading to it - when, reportedly, SVR was trying to set up an exfiltration plan with its agents. On the Tuesday of the arrest, it was sending a message. On the following Thursday, it sent a null - as could be expected. Curiously enough, the following week, it sent two new messages, one on Tuesday and one on Thursday; there can be several ways to interpret and explain this. None of this arrest-time activity followed the common (though not systematic) habit of repeating new Tuesday messages on the following Thursday. Then after these events, this schedule never sent any traffic ever again: only null messages, during 7 months on, with the last transmission on June 7th, 2012; then the schedule stopped transmitting at all and disappeared for good. This would be consistent following the (enforced) termination of the recipients' assignment.

These clues linking this XPA schedule to this couple of SVR agents seem compelling. Paul Beaumont from ENIGMA 2000 declared that this XPA schedule was "almost certainly that used by the two German spies arrested on 18th October, 2011"^[6]. This leads us to give consideration to the hypothesis coming as an implication of this, that SVR could be the operator behind XPA, and this family of stations.

Activity breakdown

The main formats of this operator are E07, M12, and XPA2. The number of schedules has experienced steady growth since the mid 2010s. XPA has seen some decline in favor of its XPA2 evolution, and E07 might now be past its peak.

The activity of this operator is almost entirely based in European Russia, however it's hard to tell whether schedules are targeted at Europe, the Middle East, North America, or elsewhere: given the high power levels used, transmissions can usually be received easily in many places, even despite bad conditions.

This operator also shows a substantial activity using a number of advanced digital modes, which are believed to be at least partly experimental, are not yet understood or even fully inventoried, and are still under study: a basic overview of them can be found in this working study chart. For example, one of those that first appeared in 2014, and reappeared in 2016 with a slightly evolved format, was only observed transmitting on a regular schedule in 2018, and thus then received the XPB designator.

Location

Atlantic operations appear to be based in Moscow.

Pacific operations, comprised of two M12 schedules and the single V07 schedule, are believed to be based in Khabarovsk. This is supported by:

• an extremely powerful signal on receivers in Khabarovsk, exhibiting transmitter noise and artifacts
• the audio of Radio Vostok Rossii, a Russian commercial radio station based in Khabarovsk and broadcasting on 765 AM and 103.7 FM, being heard through crosstalk:
  • in V07, as an AM signal with a carrier centered at +3 kHz within the USB transmission, since December 2017
  • in M12, modulating the ICW carrier in AM
  • in the habitual tune-up procedure in the 10 minutes before scheduled transmissions, faintly modulating test carriers in AM
  The presence and strength of this crosstalk is variable, and the exact mechanism through which it takes place is unknown.

The station heard through the crosstalk was identified as Radio Vostok Rossii in 2018, following the appearance in December 2017 of the conspicuous, continuous +3 kHz crosstalk in V07. Faint modulation of tune-up test carriers has been noticed for years before that, carrying audio that could possibly have been Radio Vostok Rossii then too, without being able to determine what it was at the time. In 2013, Pacific transmissions were estimated to originate from the Kamchatka Peninsula; it is unknown whether this was mere inaccuracy for an origin already in Khabarovsk, or whether the appearance of crosstalk in V07 in 2017 would coincide with some change in the transmission facilities, for example a relocation to Khabarovsk.

See also this blog post.

Test frequencies

Traditionally, this operator used 10250 and 10256 kHz to run test transmissions, of both analog and digital formats - including experimental digital modems not used for regular broadcasts. More recently, it has instead been observed running tests on temporarily scheduled cycles using 5-, 10- or 20-minute repeats, and many different other frequencies. In addition to 10256 kHz, main recurring alternative test frequencies include 9142, 11431 and 12192 kHz. The test ID 687 has been used with analog formats and XPA (which still carries an analog-style ID). Sometimes alternate voice samples are used and maybe tried out: new V07 samples, female E07 voice, V07f French language mode, or even classic E06 voice samples (which E07 used prior to February 2001).

Operation quirks

This operator is very professional and seldom makes operation mistakes, compared to other agencies. Its transmissions can generally be received at high power levels, or fair levels even in bad conditions. In case of an accidental broadcast interruption, the procedure is to retransmit the broadcast intro for one minute, and then continue sending the message from several groups before the interruption.

Modulation types used are ICW for Morse and USB for voice and digital stations. Since late 2000s, new non-Morse schedules of this operator have been increasingly set up using USB mode, rather than AM. The last AM mode production schedule disappeared at the end of August 2018; although the use of AM has still appeared in test transmisssions in October 2022. In AM mode, the modulation and thus audio level are often desperately weak compared to a very strong carrier, compromising the reception of the message despite excellent signal levels.

The voice samples used to be pitched up by one semitone and slightly sped up; this ceased for USB mode broadcasts in 2013, and for AM mode broadcasts in March 2018.

References

1. ENIGMA 2000 Active Stations List v1.3 (September 2017), p. 19 [accessed September 22nd, 2018]
2. Cold-War Style Spying: Russian Couple's Arrest Could Mar Diplomatic Ties - Der Spiegel [accessed September 1st, 2017]
3. Russische Spionage: Agententhriller von historischer Dimension - Die Welt [accessed September 1st, 2017]
4. Agenten-Paar: Gibt es einen Austausch? - Schwarzwälder Bote [accessed September 1st, 2017]
5. Trial of Russian Spies in Germany Strains Diplomatic Relations - Der Spiegel [accessed September 1st, 2017]
6. ENIGMA 2000 Newsletter #68 (January 2012), pp. 2, 45-46 [accessed September 22nd, 2018]