Update about FAPSI stations

Although the following article was not published in the N&O column but in the 'Digital Review' column, I just had to include it here because this is the rewritten and updated article about the FAPSI stations published in the WUN newsletter from June 1997.

[Back to list]

• Russian diplo/intelligence [SOUD update 20-6-1997]
• Network specifics - modes, freqs, link ID's and callsigns
• Russian Civil Railway Authority
• Abbreviations
• Acknowledgements
• Research / sources

Russian diplo/intelligence [SOUD update 20-6-1997]

We introduced you to the 'Brotherhood/SOUD' network via a special edition of the WUN newsletter in March 1995. Lots of updates have been published since that date -mostly new schedules and stations- and numerous logs have popped up with various id's, such as BROTHERHOOD, SOUD, DoSC and lately also SVR and FAPSI. As SOUD doesn't exist anymore, I think it is time for a major update. For those of you who are unfamiliar with this network, I suggest that you catch up with the story by reading WUN newsletters vol.1 nos.3 and 6 first. This update starts with a short who-is-who in Russian intelligence, followed by network specifics.

As you probably all know, the KGB does not exist anymore but most of its former directorates are still alive and kicking in one form or another. While KGB (Committee of State Security) and its military counterpart GRU controlled nearly the complete intelligence system in the old days, a number of the new agencies come now under various ministries. A large part of the state security tasks are now handled by the FSB (formerly FSK and successor to the KGB).

The Federal Agency for Government Communications and Information (FAPSI), comprised of the former KGB 8th Chief Directorate and 16th Directorate, controls the country's communications networks and runs most electronic intelligence functions in Russia. According to a decree dated April 3, 1995, FAPSI is empowered to monitor and register all electronic financial and securities transactions in Russia, and to monitor other electronic communications, including private Internet access.

The SVR is the foreign intelligence service who was known as CSR till December 1991 and became part of the Ministry of Security (MB) under the new name 'SVR'. MB was in existence from 1991 to 1993 and was the initial successor to the KGB. In December 1993, SVR became an independent agency. The SVR has offices in Russian embassies, consulates and trade establishments throughout the world.

The Russian Federal Security Service (FSB), responsible for internal Russian law and order AND counterintelligence activities. Originally the Federal Counterintelligence Service (FSK), the FSB was established in 1991 by President Boris Jeltsin as one of the successors to the KGB. The FSK was subordinate to the short-lived MB but became an independent agency in 1993 under the new name 'FSB'.

The Russian Presidential Security Service (PSB), formerly the 9th Chief Directorate of the KGB, was established as an independent government agency in December 1993. In addition to providing security for Russian top officials and the guards for the Kremlin, the PSB supervises top-level government communications, operates and protects underground command centres, maintains the special underground train system that connects key government facilities in the Moscow area, and protects other strategic facilities, and executive aircraft and special trains. Those trains are an interesting item for us as well as the Russian Civil Railway Authority is also on SW. Leadership communications are carried out from the trains when a Soviet/Russian leader travels by train. The train was popular by President Brezhnev, who never flew except when he absolutely had to and then only outside the borders - and always used these trains. The trains are mostly used for their strategic rocket forces, a lot of which is rail-mounted.

FAPSI is in fact the agency who is responsible for state communications and signals security. The agency was also one of the former KGB directorates, handling Federal communications and was responsible for the encryption of the government's messages; tasks they still carry out today. The agency operates a HF/satellite network, for both SIGINT purposes and transmission of government and intelligence traffic. Like the KGB in the old days, FAPSI works closely together with the GRU, Russia's military intelligence organisation. They even share the SIGINT facilities around the world, lots of them located in embassies and consulates. In 1993 Russia closed a contract with Vietnam to ensure the continuing use of the SIGINT facilities in Cam Ranh Bay. In 1994 the Russians came to an agreement with the Latvian government, which gives them the right to use the SIGINT station in Skrunda till 1998. Russia's largest SIGINT facility abroad is the one in Lourdes (Cuba). Most of the RTTY and numbers transmissions heard in North America originate from various transmitter sites in Cuba. There are also SIGINT/tx facilities in Nicaragua.

SOUD was an alliance of the intelligence agencies of the Communist block and its databases were accessible by all members of the former block. The members of SOUD were the Soviet Union, Bulgaria, Hungary, Poland, Czechoslovakia, Mongolia, Cuba, East Germany and Vietnam. After the collapse of the block also SOUD's days were numbered. One of the main computer centres was in East Germany, and after East and West Germany reunited, the Stasi archives were soon in the hands of the BND, the West German intelligence agency. Nevertheless, it is believed that SOUD stayed in business for at least a couple of years but now as a Russian enterprise, possibly with the help of a few friendly nations like Romania, Vietnam and Cuba. As most of the traffic was between diplomatic establishments, the assumption was made that a major part of the traffic was now diplo traffic (a large portion probably always was, even in the early days!) In the spring of 1996, I was informed that SOUD was definitely out of business but no-one could tell me exactly who was now in control of the network. Although I haven't got a written statement from Boris in Moscow, it is safe to assume that most of the traffic nowadays is diplo material and SVR traffic, transmitted by FAPSI.

So, how shall we call the players on this net from now on? Although the major part of the traffic most probably originates from diplo sources and SVR, my personal vote goes to FAPSI as they are responsible for all comms from and to the embassies/consulates/MFA/SVR/FSB. GRU uses the same SIGINT facilities as FAPSI does, but seem to use mainly satellites for their communications. I think we shouldn't use the other reported names anymore. Someone asked me once if the 'Brotherhood' was the same as the American 'White Supremacy' organisation. The answer is a big -NO-. In the early days, when we didn't know who was using the net, we called them 'the Brotherhood', which was just our internal nickname for the net. Heck, I didn't even know there was another one :-)

Another name we should not use anymore is of course SOUD. Finally we've got 'DoSC', the Department of State Communications, but isn't that the same as FAPSI? It is of course up to you how you want to call this net in your logs. From now on, I will refer to them as FAPSI though. When it comes to the numbers stations transmitting from Cuba, I suggest we'll call them 'SVR'.

Right, that was a lot of intel talk. Because I received quite a lot of questions about the subject, I thought it would be a good thing to explain in a nutshell who KGB's successors are. Now then, I think it is wrong to put too much stress on the intelligence side of the network, so let's focus on the diplo traffic. 'Ok, but why switch to diplo and why is a new intelligence net like SOUD unlikely?', you may ask. Let's look at some of the facts so far.

• All links begin or end either in Cuba or near Moscow, while the other side of the links are mostly diplomatic and trade establishments like embassies and consulates. Part of the traffic will consist of intel/ military related nature but most of the traffic is -and probably always was- standard Russian embassy traffic! Since all messages basically look the same, it is however impossible to differentiate between diplo, intel or military related embassy traffic.
• Most of the calls from the early days are still around. (UDZ21, KUA, RPO, EWZ42, JUA, WQL, etc....) meaning that we have still the same players on the net.
• Some that seem to have disappeared have changed to another mode (CW --> Baudot --> Crowd36) like FQX and KUA
• RCF no longer uses RCF as a call but is still around as a transmitter site, using a different call on each circuit.
• The way of operating is very similar to other Eastern European DIPLO networks (like the Bulgarians, Yugoslav, Czech and Slovak).
• All links end either in Cuba or in the vicinity of Moscow.
• QSF messages during important Russian holidays. If this were to be a multinational intel operation, they probably wouldn't have taken these holidays so seriously. Even the Israeli<->German link works 365 days per week, ignoring the Jewish sabbath and other even more important events.
• If you count all existing FAPSI links, you would probably end up having all the world collaborating with the Russian Intelligence to feed SOUD.
• Good operator discipline - fine, not much different to the Bulgarians and the YUG DIPLO operators.
• Rarely any chat traffic but when chat traffic, then always in Russian, using 3rd shift cyrillic. Wouldn't be so if it was an international operation.
• Always 500 Hz shift! In other multinational operations, the operators never adjust the shift to hide their identity!
  Moscow RK2 500Hz <--> Tel Aviv M4W 340 Hz
  Warsaw SNG202 500Hz <--> Bucharest YPM69 400 Hz
  Rome WJI 850 Hz <--> Tel Aviv 340 Hz
  Germany 190 Hz <--> Tel Aviv 340 Hz
  etc.....
  Have you ever noticed a station belonging to the FAPSI net using a shift other than 500 Hz ?
• Occasionally we caught long Russian chats, mentioning the diplomatic pouch and lots of personal stuff. Personal stuff like this would never be allowed on a net used purely for intel purposes.
• If our network were to be intel only..... then where are the Russian diplos? Every Russian embassy has HF antennae but not every one seems to have SAT-equipment....
• After the collapse of the Warsaw Pact an international intel net as SOUD should have reduced traffic, but it didn't! Links should have vanished, but they didn't, in fact we have as many as in the early days, if not more.
• Circular traffic (KUL, VKX, RAU, ... traffic) can be noted on YUG, BUL, CZE, SVK diplo nets in a very similar manner. The only difference is, that our bunch encrypts all the time!
• A typical DIPLO characteristic is the use of different modes, depending on the level of flexibility and security you want on a specific link. What modes can be noticed on FAPSI transmitter sites? Standard Baudot F1B-75/100/200 + CROWD36 (on- and offline encrypted) + IRA-ARQ on the Moscow - Cuba link and to some extent 12-channel PSK traffic alternating with online encrypted Crowd36. It seems that links to the very important embassies are being established using online encrypted Crowd36.

This wide variety of modes is not unusual and can be seen on many other diplo nets as well.

Network specifics - modes, freqs, link ID's and callsigns

Modes

Crowd36 40/10 bd 32 tones (+ selcall system)
12-channel PSK
IRA-ARQ 110.2 bd / 500 Hz shift
IRA-ARQ 300.5 bd / 500 Hz shift
Baudot 50 bd / 500 Hz shift
Baudot 75 bd / 500 Hz shift
Baudot 100 bd / 500 Hz shift
Baudot 200 bd / 500 Hz shift
Mazielka 6-tone selcall system

4-letter combinations have been noted on the Crowd36 links. These sequences most probably are used to trigger the computers on the receiving side. The following sequences were copied: VDAA, VDAG, VDBA, VDBE, VDCB, VDCE, VDCF, VDEA, VDFB, VDGB. So far they have been noted when...

• changing from 40Bd to 10Bd
• changing from 10Bd to 40Bd
• shutting down the link
• they are often sent in the middle of an ongoing transmission

Numbers transmissions and 'our' network

One of the monitors sent me his very interesting findings as you can read hereafter. 14747 and 14787 kHz seem to be quite interesting places. Here are the relevant quotes from the reports:

........the testing that has been taking place the least several months on 14747. The use of this frequency is strange. It's almost like it's programed as a test freq. I have seen tests of virtually every mode and service on this freq in the last few months. This morning at 1550Z (12-12-'96) I tuned to this freq and heard the mark tone but I though I heard voice on it. I switched to AM mode and, to my surprise, there was a mechanical male voice counting in English like so:
one, one, one, one, one, two, two, two, two, two, three, three, three, three, three four, four, four, four, four on up through nine. Then instead of zero, a word that very distinctly sounded like "VEEL" pronounced like the english word "veal" (as in the meat) and rhyming with the word "reel". There was much clicking, buzzing and occassional distortion - like the operator was adjusting the audio output of the numbers generator. There were frequent long pauses interspersed with number combinations like one, one, or four, five, and frequently "veel, one; veel one" After a while it settled down to repeated counts of "one, two, three, one, two three" This went on for another 5 minutes or so. And then came Spanish numbers. Pretty much the same routine, but now a male in Spanish: "uno, dos, tres, quatro" and so on up to "cero." Sometimes just long counts of "uno, uno, uno, uno, uno" Now interestingly enough, the Spanish numbers stop and I hear a female voice repeating in English "five, two, nine; five two nine; five two nine. Then a series of clicks, clacks and a a long period (maybe 20 minutes) of what sounds like heavy 60 Hz hum. Then back to male English repeating "one, two, three; one, two, three." And underneath the male voice I hear a female voice repeating the "five, two, nine" routine again and what sounds like audio feedback. The station abruptly goes down at 1659Z. Maybe they can't afford a dummy load, or didn't know they were actually on the air or just didn't care, but these guys were certainly adjusting their numbers transmissions' audio."

Another example: on Feb.7, 1997 a carrier came up on 14787 around 1515Z. Steady carrier for about 5 min. Then FSK vvvvv's. Then 75bd 4646464646's. Then 100bd 4646464's followed by a carrier. The 300.05 bd data (I assume was IRA-ARQ). Then about 30 minutes of adjusting voice generation equipment again in both Spanish and English. Then on to CW "989 20" repeated then on to 20 group text with lots of 12345's in it (obviously test tfc). Then turns keyer speed up to about 45 WPM and more test CW. Finishes with 989 TTTTT (real typical ex-KGB style, right?). Finally goes down at 1807Z.

Several times recently, on 14787 after the carrier was on for a while, I heard some "noise" slightly off freq. On tuning exactly 1.75 kHz higher I found a digital signal with following characteristics: 292.75bd 185Hz shift ACF=10. The strange thing is this signal is directly "coupled" with the carrier on 14787. When the carrier on 14787 went down so did the digital 1.75 kHz higher. I don't think it is a mixing product. It's too strong (same signal strength as the carrier below) and very pure. I have heard this on three different occasions now, and always only after the carrier comes up on 14787 for a few minutes first. Almost like the carrier is a "pilot" signal.............

Frequencies / call signs / link id's

The following list contains actual monitoring results of the past two years. First however a list of call signs / links that haven't been reported during the past few years. They may pop up one of these days; you'll never know........

80031, ACD, BLA, BNV, BXL, CMU, DMA, DPL, DSG, EWZ 40, FJN, FRU, GLK, KDN, LSG, NDO, NMZ, OBX, OTD, OWR, PSN, PTF, RCF, RCX 81, RFA, RKG, RKM, RMM, RQO, RSS, RXX, RZJ, SCJ, TRP, UDZ 27, WKL, WNK

Most transmissions come from either Moscow or Cuba. Only a few other locations are known.

Note: station RCF (Moscow) still exists but uses nowadays other call signs; a different one on each link.

Other transmissions from Moscow were to CAZ, DKR, EWZ 42, FQX, GOD, JUA, KRN, KUL, NOB, NQX, RAD, RAU, RJA, RKD, RPO, RSZ, UDZ 21, UGO, VKX, VTX; all unid locations.

Note: JSC and POU were both copied on link 00190. It is however not clear whether POU replaced JSC or that JSC and POU are both ends of this link.

Other transmissions from Cuba were to BAR, BPA, HZW, JMS, KAC, NDO, PSN, SPK, WNY, YBU; all unid locations.

Russian Civil Railway Authority

Mode: '81-81' 40.5bd / 500 Hz

Freqs: 12184 (logged between 08.30-09.30 UTC), 14985, 16315 kHz (both logged between 07.30-08.30 UTC)

Abbreviations

SOUD - Sisteme Objedinennowo Utschotja Dannych o protiwnike

System of mutual gathering of data about the enemy

MB - Ministertsvo Bezopasnosti

Ministry of Security

KGB - Komitet Gosudarstvennaya Bezopasnosti

Committee of State Security

FSB - Federalnaya Sluzhba Bezopasnosti

Federal Security Service
(Formerly known as 'FSK' Federalnaya Sluzhba Kontrazvedky
-the Federal Counterintelligence Service-)

GRU - Glavnoye Razvedyvatelnoye Upravlenie

Military Intelligence

SVR - Sluzhba Vneshnoi Razvedky

Foreign Intelligence Service

FAPSI - Federalnoe Agentstvo Pravitelstvennoy svyazi i informatsii

Federal Agency for Government Communications and Information

CSR - Centralnaya Sluzhbza Razvedky

Central Intelligence Bureau

PSB - Prezidentskaya Sluzhba Bezopasnosti

Presidential Security Service

Acknowledgements

Info, skeds, logs and comments were supplied by a number of dedicated and long time 'Brotherhood/SOUD' monitors and WUN members. Thank you all for your input. I couldn't have done it without your help!

Research / sources

Various articles and documents from:

• Defense Intelligence Agency, Washington
• Radio Free Europe / Radio Liberty Inc.
• Russian Reform Monitor
• OMRI Open Media Research Institute
• US Army Foreign Military Studies Office
• FAS Federation of American Scientists
• Intelligence Watch Report
• Prof. Desmond Ball ('Soviet SIGINT')
• Bodo Wegmann ('Russische Foederation')
• Dr Marian Leighton ('From KGB to MFA')
• N.Polmar & T.B.Allen ('Spy Book - the Encyclopedia of Espionage')
• Russian Presidential Decree no.334
• Russian Presidential Edict no.1203