Nineteenth edition of the N&O column / Spooks newsletter

(Date: Wed, 3 Nov 1999 00:07:49 +0100)

Korean & Chinese stations | Morse stations | Voice stations
Various modes | Logs
Index | NS NL Home

Various modes

XPH

Last month I included Bruce Allen's analysis. Bruce contacted me for a lengthy and rather technical additional comment. Interesting stuff Bruce. Thanks! Ok, over to Bruce in his own words.........

"I have to give credit and make a correction. Valeriano Martin [in N&O #10] pointed out to me that the tone I assigned to `A` appeared to be used to double up ... i.e. 12344 would be the one tone, the two tone, the three tone, the four tone and the `A`.

The only question becomes does it double the number before or the one after. i.e. 527A3 could be either 52773 or 52733. If there is traffic with an A at the start of the 5 group it must double the next number, if it ever falls at the end it must double the previous. I have limited traffic to compare due to my bad reception site. I am designing a micro controller that would take a audio input and send serial data.

The other thing I am pursuing is that all the signals have strong 100, 150, and sometimes 200 Hz bands. Based on the assumption that this is 50Hz power bleed through this gives rise to several areas of investigation.

First it gives a 'benchmark' to compare the tones against. From this can be derived which transmitter send the msg. I have noticed a couple of modulation anomalies that are repeatable and not on all transmissions.

This give rise to the other us of a benchmark freq. It's phase shift noise can be analyzed and corrected. This is assumed to be mostly atmospheric in nature and therefore affects all the tones equally. Then you go looking in the tones for unaccounted for phase shifts and assume they are one of two cases:

1. Mechanical - some component phaseshifts 305 Hz 22 degrees and 500 Hz 17 degrees. This is the aggregate phase shift and is rarely the same on two different TX. It is easily identified because it is always the same - i.e. 22 degrees on every 305 Hz tone.
2. Everything else ... meaning intentional phase shifted tones carrying data. This is called sub-channelling. It is usually phase compared with onsite freq. standards. For instance a cesium standard outputs 5 MHz and the tones are compared the phase data is regenerated.

I suspect this because when I FFT an aggregate of 1 tone I see anomalies in the sidebands that appears that at least one of those occurrences is phase shifted. The overall shape of the envelope reminds me of a QPSK signal. Why do this? Well one of the old uses of sub-channeling was the row / column order. It was used with one time pads. [If the development of 1 times doesn't interest you, skip this section] The pads were 10x10 giving 100 character squares. each row and column had a 'key number' The Early pad were numbered 1,2,3......,0. To decode you took took 2 numbers and applied them first one to row second to column and at the intersection was the character. Then problem was that if a pad feel in the wrong hands the messages were all compromised. If you scramble the order of the key numbers {486012593 for instance} each use of the pad you had a more secure (in theory) system. The Germans {I think} used a two transmission method. The first message was the content message. The column key was similar. But no pad was needed to decode it. If my memory serves me right, the system was something like take the date number (i.e. 15 Oct. 1999 would use just the 15) and add it to the first two numbers of the message. You then counted off that many numbers from the start and that was row 1 #. The number in the cor- responding position in the next group was the row 2 #, until you had 20 numbers. The drawback was 2 transmission which double the exposure of the agent. The next development was to place the keys and message on top of each other (sub channeling). The first method was to leave a longer pause between numbers ... 1 5 3 7 45. The first time this happened the agent would write 7 in the first row. The pause would be sent with every occurrence of 7 from then on, just to through off analysis. This would continue until all the row digits were sent. Then the first row number was sent WITHOUT the pause. This signaled a switch to column numbers. The same processed followed. Finally the whole message was decoded.

If my theory holds then we may be able to get a new set of data from each transmission. If not, its been great fun fiddling with it anyway.

I am currently writing a Forth program to decode, identify anomalies into groups, and log phase changes vs time.

<Bruce Allen>

FAPSI RTTY intercepts

*) most likely the operator chose a wrong speed as normally 75bd is used on this link. I haven't seen any of these stations using this speed before.

Korean & Chinese stations | Morse stations | Voice stations
Various modes | Logs
Index | NS NL Home