ENIGMA 2000 Newsletter - Issue 28

May 2005
Articles, newsreports and Items of interest :enigma2000-owner@yahoogroups.com

Morse stations | Voice stations | Oddities | Polytones
ALA 1530 | Spy radio | German branch | Numbers predictions
BRIXMIS | Non-numbers news
E15 schedule | Iraqi Embassy 21 Queensgate, London SW7 (1/2)
News Items | Web sites | Contribution deadlines
Index | E2K NL Home

Voice stations

Questions are often asked concerning the use of a variety of languages within number stations. Our response to this was prompted by the help offered by HJH to the 'radio accented' German used; an original chart having been printed in Issue 12:

As this question has arisen on more than one occasion we bring you a European numerical equivalent in tabular form:

^ Some German numerals have a radio accent. The numbers in question are:

This is totally in keeping with some German armed forces stations and corresponds to our WUN, FOWER, FIFE, NINER

A tabular version that assists with the Slavic stations has been placed in that section.

Now onto the logs:

E03/E03a

Apart from the regulations concerning the reception of wireless stations within Great Britain advice on reporting intelligence matters also exists in the form of DA notices.

Whoever the messages, from E03/E03a, are aimed at ENIGMA 2000 has no wish to 'advertise' the existence of these stations to those who may not support the best interests of Great Britain, or its representatives abroad. Although we are unable to stop discussion of E03/E03a, ENIGMA 2000 will remain aloof from any such discussion and will not be including reports or analysis on E03/E03a.

NOW READ ON!

No observations on E03 or E03a here but we do offer an appraisal of Simon Fanshawe's 'Tracking the Lincolnshire Poacher: The Number Stations' from a variety of remarks made to E2k

This 28:03m long broadcast was transmitted on BBC's Radio 4 at 0930z on Saturday 23^rd April, 2005.

Unlike just about every other programme this show had a readily confirmed audience of a few hundred world wide.

It wasn't bad; “It was very basic and very historical”, said one E2k member who wished to remain Anon. Another suggested it was ok for the masses but not if you already knew about the subject.

PLondon also received a few phone calls and the general consensus amongst his callers was that the show exercised editorial licence to make the show "Curious and possibly very scary indeed.". Akin Fernandez stated from the outset that the Number Stations are, "believed to be the encrypted transmissions of secret services like MI5, CIA and MOSSAD to their agents in the field." So what about the KGB then?

"No one has been able to decode a number station as far as I know" was a little inaccurate as was Richard Norton-Taylor's mention of the one time pad as being the 'end-all' of spy transmissions.

Simon Fanshawe made the comment that enthusiasts make logs adding to Akin Fernandez, "People like you for instance?" There was no suitable reply, "It was almost therapeutic…", to that; whilst two of PLondon's callers said 'He managed to flog [sell] many copies of the Conet Project though'.

To be fair Akin Fernandez did mention Voice, Morse and 'noise' as well as schedules being constructed from the very many results received from enthusiasts.

Simon Mason also made an appearance with a historical account of the early seventies and into the present day as he loitered in a West London alleyway, wireless at the ready for a 1400z transmission from E03. He remained unscathed from comment as did Christine Large and David White.

Later in the programme US security technologist Bruce Schneier gave his opinions on the One Time Pad, "It's a manual paper and pen system", he stated as the scene moved back to Akin Fernandez who was trawling the Short Wave spectrum somewhere around 9359kHz.

Simon Fanshawe stated, with the incredibility filter removed, that they were, "On the verge of something very rare indeed". It was rare according to Akin Fernandez but to the rest of us the station that Akin found 'so wild' [or did he mean 'kind of wild'?] is classified as E07 to everyone else.

One Anon member wrote a mini appraisal with

"My initial thoughts are that the so called "specialist" who couldn't answer a question, with a straight answer, was all smoke and mirrors, to coin a phrase !

Interesting comment from the ex DWS chappie, about WRAF being used for voice transmissions. Well, I remember an article in The Times, some time in 1996 / 1997 about the FCO dropping Women ops for their Crypto Traffic. Titled something along the lines of "Hatti gives up the code".

As to the "Lincolnshire Poacher" being the signature tune. Apparently it was chosen by some FCO wag, who thought it all had something to do with RAF Digby....which it could, but the wrong way around !"

[PLondon mentioned that he had heard that before from another source and discounted it then – perhaps he was a little hasty].

In reply to the claims from Simon Fanshawe and Akin Fernandez that the Number Stations "believed to be the encrypted transmissions of secret services like MI5, CIA and MOSSAD to their agents in the field". Below is Para 19 taken from the Affidavit produced by an FBI agent that takes away the 'belief' and proves the matter.

"19. Further analysis of MONTES's copied Toshiba hard drive identified text consisting of a series of 150 5-number groups. The text begins, "30107 24624," and continues until 150 such groups are listed. The FBI has determined that the precise same numbers, in the precise same order, were broadcast on February 6, 1999, at AM frequency 7887 kHz, by a woman speaking Spanish, who introduced the broadcast with the words "Attencion! Attencion!" The frequency used in that February 1999 broadcast is within the frequency range of the shortwave radio observed in MONTES's residence on May 25, 2001.

Nevertheless, I learned that you entered the code communicating that you were having problems with radio reception. The code alone covers a lot, meaning that we do not know specifically what types of difficulty you are having. Given that it's only been a few days since we began the use of new systems, let's not rule out that the problem might be related to them. In that case, I'm going to repeat the necessary steps to take in order to retrieve a message.

The message then describes how the person reading the message should "write the information you send to us and the numbers of the radio messages which you receive." The message later refers to going "to a new line when you get to the group 10 of the numbers that you receive via radio," and still later gives as an "example" a series of groups of numbers: "22333 44444 77645 77647 90909 13425 76490 78399 7865498534." After some further instruction, the message states:

"Here the program deciphers the message and it retrieves the text onto the screen, asking you if the text is okay or not."

Near the conclusion of the message, there is the statement

"In this shipment you will receive the following disks: . . . 2) Disk "R1" to decipher our mailings and radio."

This excerpt tells the entire world what number stations are and gives another means to decode instead of the one time pad, using anything but a paper and pencil system.

[Plondon said he was surprised that those on the programme who claimed to possess expert knowledge did not mention the proof that exists about spies and number stations -- and its not all from Ana Belen Montes either. See next comment].

Mr Fanshawe heard that many spies were caught with radios from Mr Richard Norton – Taylor, and indeed they were. The Krogers ran a particularly powerful transmitter but others, such as Geoffrey Prime and Erwin van Haarlem, used only receivers and were the subject of witness statements where number stations were mentioned, mainly because the complainants suffered noise interference. Professor Hugh Hambledon used a tone reading device prior to his arrest, but best of all, the evidence above concerning Ana Belen Montes went so far as to state a frequency, time and date. This allowed E2k members to immediately recognise the station V02, or the Spanish Lady.

To read a bit more about Ana Belen Montes see E2k NL issue 21 [It also mentions the 'Red Avispa' group who also used similar communications from Cuba].

So in answer to your closing remarks, Mr Fanshawe, 'Who is the Spanish Lady? Does she dance to the tune of MI6 or the CIA?

In short she is nothing to do with MI6 or CIA and is most probably aligned with the Cuban Intelligence Agency, the DGI, her dulcet tones transmitted from Bauta, Cuba.

David Shayler made good comment on the use of low tech communication and use of simple codes, such as book codes. Where his expertise in this came from is anyone's guess. [Any ideas there AnonNI ;-) ].

All in all, the entire programme was interesting and entertaining. Unfortunately it also relied on editorial licence in an attempt to make it curious, mysterious and investigative, but then it wasn't really aimed at a small body of Number Monitors who would pick at it! It did misinform and we do wonder if the content was cleared for transmission by those with the power to stop it or, as DoK asks, were the researchers sufficiently knowledgeable to understand the subject. Or did Mr Fanshawe, as KW further asks, use only the Conet Project as his source material. That, according to KW, would account for the continual exposure of the audience to Akin Fernandez and the lack of accounts of recent developments in the world of numbers.

[This piece does not reflect the views of ENIGMA 2000 or its Editors - Thanks to all the correspondents who contactesd us to give their personal views].

E05

We recently received some information regarding this apparently defunct station. It reads,

"The E05 sent by the Frankfurt transmitter has stopped activity. They have changed to new equipment and built new antennae![It's not news, more like history!]

What the most people don't know is that these sites are not operated by CIA. That's absolutly wrong as these sites are all operated by the Army Security Agency or ASA, as it is better known."

[Tnx Anonde]

E06

The English Man continues in March with the weekly Sunday schedule, call 690, 1830z 6860kHz and 1930z 5405kHz.

There has been some March Saturday activity at 1330z on 16183kHz calling 791 but no repeat found an hour later. Not heard on 12/03 [PoSW].

RNGB's logs reflect E06 April activity as:

Two additional logs from PoSW:

PoSW was prompted to write:

"The only regular weekly schedule of which I am aware is the Sunday 1830z + 1930z with call "690" - remains the same each month - which ran in 2004 and is still on in 2005. An E06 transmission was logged on the last Saturday in February and on the first Saturday in March at or just after 1330z which suggested that the Saturday afternoon E06 schedules which were common at one time had returned but I have been unable to find a 1330z E06 since."

PoSW sent a full set of logs to E2k but lack of space prevents us from including. [Thanks PoSW].

One last one from Simon Mason:

E07

To start an eagle eyed reader has notified us of an error that crept into the E07 column last time:
'Page 14 Monday + Wednesday Schedule, 26-Jan-05 should have had the time 2100z not 2000z'

[Tnx]

To start the column correctly, PoSW states that the E07 English Man continues to use the same frequency schedules as in previous years with the exception of the Sunday + Wednesday starting at 1700z in the summertime which has to be searched for in the first week of each month. Low levels of modulation resulting in difficult to hear audio continue to be a feature of E07 but on two occasions in mid-March the Sunday + Wednesday E07 came up with really deep, broadcast quality modulation - but it didn't last.

AnonUK sent the early evening Wednesday schedule [as heard 02/03, first wed of March 2005]

• 1820z heard by E on 13/03; remarked 'Good reception for once'.
• 1840z 13/03 via E = 906 576 118]

IW sent in the Wednesday schedule [as heard 02/03, first wed of March 2005]:

IW remarked on the high level of QRM that obviated his hearing the full message

• 2120z 14/03 418 no message E

PoSW sent a full range of E07 logs and makes this comment for the Mon/Wed schedules:

Monday and Wednesday Schedule
[note Voice of Greece comment]

Gert offred his finding:

Thurs Sched tnx to HFD:

RNGBs log shows April Schedules:

Report at end of month [04] from HFD also featured the April freqs

E10

From the pen of Bob we bring observations abd analysis from our E10 desk:

Frequencies and calls heard

Mar 05

Comments

• During the period from the 6/3 to the 9/3 SYN2 & VLB2 and I suspect CIO2 also, though CIO2 was not always audible, went into extended transmissions lasting over one to three hours and on the 7/3 were heard continuos for eight hours On the 09/03 at 2047hrs the sudden change in the signal strength of SYN2 from boomig thru to just readable was unexpected Both VLB2 ans SYN2 have been at good strength for a number of weeks now, CIO2 has been very difficult to pick out through the backround noise, and on a number of occasions not at all, this could be said of KPA2 & MIW2 as well.
• One of the lesser heard calls FDUN was picked up at 2045hrs on the 12th of March on freq 6210 a 3mins transmission but no message

April 05

Comments

• Jochen Schafer reports that YHF1 was heard on 9202 at 2000hrs UTC, unfortunately I deleted the email before I had made note of the date.
• 07/04 at 1945hrs & 2045hrs, once again SYN2 was not heard on its 6930 freq nor was I able to hear on any other known freq, though its companion VLB2 (6370) continued to boom thru. CIO2 continues to be very weak or not received at all.
  (See March Comments)
• Once again SYN2 & VLB2 increased the activity level with 1 hour extended transmissions on the 10th, 11th & 12th this could indicate further long calls and possible callsign changes as on previous occasions, worth monitoring.
• Confirming what I thought might happen, Ary Boender picked up CIO25 on 6912 & 4165, VLB20A on 6370 & 3220? and SYN72 on 4015, 3640 and 6930 on the 13th April at1735hrs (Many thanks Ary)
• More lesser heard stations logged for April were FDUM, FDUZ & HNCS

[Tnx Bob]

©BMLongfield 27/04/05

E11

Note March changes:

E11b

E15

We print the past schedule [as issue 22] but please read on:

And the phonetics used in station idents:

Our first E15 log of March from MoK:

From Manolis in Crete:

The quality of the TX was really bad.

Manolis also advised us that Greek pirates use LSB mode in 5 kHz steps, local daytime on 6.6-6.8kHz. Common frequencies 6745kHz or 6765kHz. He also advised, "While waiting for a TX to start, spin your receiver's dial wheel as much you can! You never know!"

Manolis followed up the same day with more E15 observations [using USB]:

Sound samples of both added to our Samples file – thanks Manolis! Then we receive this from the Island of Crete:

[Tnx Manolis]

MoK enters the E15 affray with some surprising observations:

This TX was strong, peaked S5, for first 30 secs then dropped smoothly down to "no reading" and just above noise floor in 10 secs, exactly as one would expect from a swinging beam, but why use a steerable for a small coverage area !!. At end of TX mic was blown into and tapped a few times.

whole of this just above noise floor.

Null repeats on this sked appear to be a standard feature now.

The YL is back on air, last personal logging I have of her on this sked is 19/06/95. This was an appallingly bad sig virtually on the noise, one would not catch this during a routine "band scan", it's hard work and I had to use filtered "cans" to pull anything out, and had the wife to "power down" the whole house except the direct feed to the "radio room". This also now changes the details given in the Issue 27 write-up as it's no longer only an OM and the ID/tuning sig was only for 1 min, not 5, I cannot confirm if the rest of the TX followed the known mssg format. We print, it changes - Sods Law.

something there but u/r under a weak carrier about 100Hz HF which started at 13.57z, so weak it would not lock the "syncro" but killed the TX.

[Tnx Mike]

For 16/03 Manolis in Crete sent the following log:

[Tnx Manolis - this poses some questions indeed]!

[Tnx MoK]

For 19/03 Sal ibn Hari writes,

"While listening to 11MHz around 1300z today I hear very weak sound, not loud enough to identify it because lots QRM but itEnglish worse than mine! Then I read on spooks that somebody also hear but says is E15,

1100kHz 1300z 19/03 BEC fair sigs.

I don't remember what American sent to spooks but the reciever was in Sweden -is this a valid way of doing things I ask?"

[Tamaam,Sal. Shukri]

Well Sal has a point, however there is little difference to an Embassy of a foreign power having a wideband receiver and active antenna in the loft and sending its results to its home country via an encrypted satellite, or, internet link.

From MOK:

Manolis writes,

'I did a little searching trying to determine a schedule for E15. Here are my findings:

Thursday 10 March – Tuesday 22 March 2005.

Notes:

• Frequencies are in kHz, mode is USB.
• Dashes means "nothing found".
• Most of the transmissions started late, but some as early as 10 minutes.
• As a consequence of the above, since I wasn't monitoring continuously, there is always a possibility I lost some transmissions.

FULL AND UP TO DATE VERSION OF THIS CHART IN "E15: An attempt to establish an up to date schedule" – with an full explanation – can be downloaded from the Files section of ENIGMA 2000 http://groups.yahoo.com/group/enigma2000

Furthermore, Manolis and Mike of Kent were both aware of harmonic relationships :

IMPORTANT NOTE:

In the known E15 schedule the 1200z frequency (17503 kHz) is a harmonic of 5834 kHz (3x5834 = 17502).'

[Tnx Manolis]

Further received logs:

MoK writes,

11.00z, 18.000kHz under a massive OTH type sig which fired up at 10.59z spanning 17991 - 18015kHz, peak sig level slowly sweeping and at times appeared to have an embedded XSW. Underlying sine wave having 300ms cycle.

Had to go to CW setting with 200Hz filter to initially confirm E15 voice,then periods of improvement as OTH swept past.

Then,

As a result of some detective work by Manolis we have received a splendid piece from him which answers many questions about this station.

See 'E15: An attempt to establish an up to date schedule' an additional publication from ENIGMA 2000 written by Manolis Petrakis, available with this newsletter from the ENIGMA 2000 Group site.

E17

No reports

E17z

No reports

E23

Best frequency is usually 8188kHz. 3 weekly cycle starting on the first Monday of the Month. [See E23 entry in NL24].

Transmits Monday Wednesday and Thursday:

E25

[From the E25 desk}

ID's used with messages so far:
222 275 440 555 730 780 835 (arabic) and 906

ID's used with control messages so far:
200 209 227 272 276 557 785 788 830 837 905 909

Frequency known so far
9450 kHz

Types of messages heard so far:

Null messages.

Instead of calling 000 or so it is calling "280" for several minutes. For example:

275 275 275 for 5 minutes
Message message message
280 280 280 for 5 minutes
End of message / end of transmission

Also noted a couple of times without ID/msg(x3)/eom/oet.

Control messages (= E25a)

For example: "785 58" or "905 22 23" repeated for several minutes.

Transmission with message
Usually starts with a 3 fig call, followed by "message message message".
A message of more 4fig groups follows, mostly between 8 and 20 groups.
"repeat repeat repeat" and the message in full is repeated.
Ending with "end of message end of transmission".

Just like E10, it ends with the same words. A coincidence or perhaps a joke from the Master?

Callup lasts several minutes. Interestingly is that almost every callup uses what seems two different voices. Or a tape is used and the operator is playing with the speed resulting in a lower voice when the tape is played at a lower speed. Some E2k members feel the tape is replaced after a few minutes by a live voice.

All three types of messages can start with eastern music, not every time though.

In short for the period March and April 2005:

March :

April

In detail:

A brief look at the traffic from E25

By IW.

If you are a member of the E2K mailing list then you can't but notice the increase in loggings of this station, which appears to have become a lot more active in recent months. I saw that the station only ever sends short messages (the longest message logged so far only consisted of 22 groups of 4 figure numbers) unusual for a station of interest to E2K monitors which normally send much longer messages presumably encrypted using a one time pad. Then Manolis Petrakis noticed that in some traffic he had logged from this station that the 3^rd and the final number group were the same. This is most unusual and I decided to look back at other E25 traffic to see if there were any other unusual characteristics in this stations traffic.

To do this I looked through past editions of the E2K NL for past loggings of E25 then copied the traffic into the table (opposite). If you look at the table on each line (left to right) you will see a line number followed by the date of transmission (in standard British day/month/year form) followed by 4 figure groups of the actual message.

A quick look at this traffic shows some interesting oddities ..

• The first 3 messages share the same first group (1774) this despite there being more than 1 year between the transmission of the 1^st and the 2^nd message.
• As Manlois discovered many of the messages have same 3^rd and final groups. But not all the messages have this feature. You can see that this isn't the case with messages 1,2,3,8,15,18 and 21.
• The final digit of the 2^nd group is either 0 or 1 except in the case of messages 2 and 15.
• The final digit of the 3^rd group is 0 except in the case of messages 15 and 21. In both cases these messages don't have the same 3^rd and final groups either.
• Messages 11 and 12 have the same 7^th group (6613) despite being sent nearly a month apart.

You just don't see these oddities in the traffic of other numbers stations. So what do they mean ? Well I'm no expert but these messages look to me to be far to short to be encrypted using a one time pad. Other signs of this not being one time pad traffic are the shared 1^st and 3^rd groups in many of the messages and the repeated numbers. Another way of encrypting messages is with a machine cipher an electronic equivalent of the famous WW2 German Enigma machine. However once again the messages seem to short and the repeated groups in several of messages can only be explained by the fact that the encryption key isn't being changed between messages. This is rather a basic mistake to make and would make it much easier for someone to break the encryption and decode the message.

So what could these messages be ? Well the only options that seem to make any sense to me are that these are simple status or activation messages (i.e 3^rd Army go on the alert and 4^th Brigade can stand down) encrypted using a hand cipher. Or another option is that these are encoded weather messages. However why these are being sent by a numbers type station is a mystery when they could be more efficiently sent by morse or by some other more modern data transmission method.

So I'm not convinced that this is what the messages are. All I can say is that the traffic from this station is highly unusual and closer examination appears to bring up more questions than answers.

Thanks I.W for your superb investigation.

In the event of a repeat incursion into Arabic numerals by this station we bring you the simple cardinals in tabular form:

For numerals compounded by tens see page 25 Issue 27 where Arabic numerals were discussed in some detail.

Jörg Eberhardt made comment on our last E25 column and sent a log too, "While I was reading the article on E25 in the new newsletter (really interesting, thank you) I tried again to receive this station. This time it worked. The BC was very strong but E25 was audible." [Tnx Jörg]

On 09/03 X writes, I Heard E25 yesterday and today, tue 8th and wed 9th, with a long message, starting 12.28 UTC.

Music, the regular one, lasting 5 minutes.
555 (5 min)
Message (x3)
9427 9261 2110 7933 5315
7902 5390 8745 7450 2083
4788 6287 0738 3721 7027
2110
Repeat (x3)
--- rpt of msg ---
EOM / EOT

Carrier stayed on and at 12.40 heard it calling "785 52" for 3 minutes.

On thu 10/03/05 X heard E25 again with a message, starting at 12.30utc with music. I was a repeat of tue 8 and wed 9th.

This time without the control message at the end of the message for 555.

From MoK we receive:

Sat 12/3/05, 9450 kHz, AM

,

The initial 906 call up was a VERY slow repeat and sounded as if there was another call up, down on the noise floor, being "interleaved" with it which would have then given a normal speed.

Sun 13/3/05, 9450kHz, heard by MPetrakis and X

The msg appeared slightly faster than usual in this TX with hardly a pause between groups,unless it's my imagination.

Plondon also managed to receive E25. He heard it on Thursday 17th march at 12.33z and writes:

Poor condx, only heard "x3x". He had a better reception at 13 .31z when he heard a E25a control message "909 21".

CAcuff heard E25a on mon march 21st at 13.33z on a Dxtuner site in Sweden and writes:

"It was around 13.33 UTC when I started to hear a weak OM who sounded like he was reading numbers. There was no music intro, it just went straight into the callup. The callup was either 925 21 or 905 21 repeated about 23 times".

This catch was later that day confirmed by X who heard it calling "905 21".

Well done guys!

Tuesday march 22th E25 appeared with a message, heard by TomH (via an internet tuner in Sweden).

222
Message message message
3521 8190 8110 2075 3592 7299 5039 6144 8110
Repeat repeat repeat
--- rpt of msg ---
End of message / End of transmission.

He also writes:

"It was definately a live announcer because sometimes his trhoat sounded like it had to be cleared… The spacing between each "222" group changed in terms of timing".

Nice work Tom!

This same message was heard by X who heard it Tuesday the 22nd at 13.45 UTC with the same message of 9 groups.

Both CAcuff (via a dx tuner in Sweden) and MPetrakis heard E25 on Wednesday march 23rd.

CAcuff writes:

"fair to strong signal strength, about S7-S9. 18 grp msg. Carrier never went down, it was on during the 6-minute intermission between transmissions".

Another sending from E25 was noted on thu march 25th by X, TomH(via dxtuner