Hundred forty-seventh edition of the N&O column / Spooks newsletter

(Date: December 2009)

Voice stations | Morse stations | Various modes
Military stations | Utlility round-up
China update | M42 & X06: the story so far | Database update
2009 index | Clandestine Activity Survey | Logs
Index | NS NL Home

M42 & X06: the story so far..........

The Russians have quite a lot of stations that transmit coded messages on LF/MF/HF. Like all other numbers station it's hard, if not impossible, to find out if the transmissions are actually related to espionage activities. Some most probably are spy stations, some are definitely linked to governmental communications (embassy traffic etc), but I guess that the majority of the stations are military stations, either GRU related or just plain military activity (tactical nets, naval stations, etc). Most of the military stations don't have a specific Enigma code but can be cataloged under former Enigma code M32. Let's start with the list of Enigma designators for these stations. Note that Enigma deleted a number of these designators, but for clarity we will still be using them here.

• Enigma codes for alleged spy stations:
  E06, E07, E17, E20, G06, G07, G17, G19, S06, S07, V06, V07, M12, M14, S25, XP, XPA, XPH, XPL, XPM (XP.. are polytone stations)
• Enigma codes for diplomatic stations:
  M42, X06.
• Enigma codes for military stations: M18, M21(PVO), M32, M41(PVO), MX (beacons and morse channel markers), S13, S14, S28(Buzzer), S30(Pip), S32(Squeaky Wheel).

The RTTY/digital network has been monitored by a large number of dxers since the early 1980's and even before that when they were using Morse only. When we first discovered the network we didn't know who they were, so we nicknamed them "the Brotherhood". A couple of years and a lot of work later we knew that this is in fact a Soviet, now Russian, governmental network.

In the 1990's a new name was used by the dxers. According to several sources the main user of the net was SOUD, so this name replaced "the Brotherhood". Later FAPSI has been used. FAPSI is responsible for maintaining both government and presidential information system and telecommunication lines. It controls Russia's physical communications systems, including government telephone lines, high-frequency communications, and cryptography services. FAPSI initially maintained communications lines for the Russian President and security services. Basically they were and still are responsible for the actual transmissions. One of the other names that was used after FAPSI is DOSC, Department of State Communications, a name that is more appropriate then the ones used before that. To simplify it even more we now use "Russian Government/Intelligence" or just "Russian Gov.".

The first encounters in the USA with the "Brotherhood" stations were in the late 1970's when they still used high speed CW (ca 32 WPM). Most of the early CW stations (PSN, BPA, SPK, WNY, YBU) were still active in the late 1990's. "ROL" however disappeared completely. In the mid 1980's the RTTY transmissions started. The speed used was 50bd. Messages to YBU were the most common ones in those days. Also messages to PSN were monitored. The callup was slightly different from the system that is used nowadays:

VVV PSN PSN PSN 2/245 VVV PSN PSN 2/245
NW NW
NR 271 GR 135
+ 5L or 5F groups

Then in the mid 1980's they changed to the 5 group preamble that they are still using today. But the original link designators were different back then.

The WFO/MIG link was the only known 2-way link in the Americas. The station sending WFO was definitely the Cuban end. The other end has been pin pointed in the New York City area, probably the Russian UN delegacy.

In the late 1980's an European network of RTTY stations popped up, similar to the network that was active in the America's.

The master station in Europe was "RCF". Several frequency guides listed "RCF" as Ministry for Foreign Affairs in Moscow. After the disintegration of the USSR, the "RCF" callsign disappeared. The new master station was as powerful as "RCF" was and one thing is for sure: this station was located in or very near Moscow as well. The station was DFed many times and every time Moscow appeared to be the source of the signal. Whether the master station or "RCF" really was MFA Moscow is not 100% sure but it definitely was a diplo station and the net a diplo network. Whenever something hot was happening in the 1990's, like the Chechenya actions, the stations in this net were making overtime, even on Sundays, while there were normally no transmissions on Sundays. The only station that was often heard on Sundays was "BFR", which may indicate that it was possibly located in an Islamic country.

The master station still transmits online and offline encrypted messages to the other stations. There are fixed schedules for a couple of stations while others are reported less frequently. During the time that "RCF" was still in place they used a traffic list system. In the 1990's the traffic list system was replaced and each link now had one or two fixed schedules on an assigned frequency pair. The auto-broadcasts to amongst others KUL, VKX, RAU and RKD were probably just circulars or routine traffic sent to the specific networks. They were transmitted blind and therefore repeated throughout the day on a larger number of frequencies.

RTTY was the major system. The callups and messages can be divided into two groups: the most common one for the America's and Europe was: "4646464646464646 KUL KUL KUL KUL 1/226". Note that 46's are transmitted instead of RY's, then the callsign of the recipient and the number of messages/number of 5-letter or 5-figure groups in this message. The other one was only noted in Europe but might have been expanded by now. The transmissions start with a selcal of 6-tones (the selcal system is called Mazielka), followed by the callsign of the recipient sent in CW, then into RTTY where the preamble is handkeyed while the other system had an automated preamble. The Mazielka callup has been reported since mid 1994. The Mazielka is a selcal system that was used by the master station to wake up a station outside the normal fixed sked. It was probably only used to catch the operators attention, not to start the equipment remotely. The fact that they switched to CW after the Mazielka was a sure sign that the operator had to prepare the equipment before they could start the transmission. The use of non-error correcting RTTY systems made it practically impossible to establish a link automatically. The Mazielka was never used during the normal schedule times. Nowadays the system seems to have a more structured behavior and the system may even automatically switch on the receiving equipment because they hardly start with CW anymore. The CW operator chats that follow the messages are still there though.

We have found several clues about the preambles and QSL's of the link system that is still being used, although less frequent than in the 1990's. Let's take a closer look at the preambles. Each message starts with a preamble that consists of 5 groups, followed by the message itself. A typical preamble looks like this: 11177 00142 23687 05012 01109.

• 1^st group:
  The message identifier, stating what kind of message it is. This might also be a priority code. 11144, 11166, 11177 and 11199 are the combinations heard so far. The most common are 11177 and 11199. The latter is being used for QSL purposes.
• 2^nd group:
  The link-identifier, each link has its own id, except for stations who have a two-way link, in that case both stations have the same link-id.
• 3^rd group:
  Could be related to the key. Most of the time a 5-figure group but also "00000" was regularly noted.
• 4^th group:
  The first two digits are the date and the last three are the message number.
• 5^th group:
  The first four digits represent the number of groups in the message + 1. The extra group is most likely the key (3rd group of the preamble). The last digit is either a "1" or a "9".

After the messages have been sent, the operators sometimes have a little chat. In the America's the conversations were in often poor English while on the European side they often chatted in Cyrillic.

As I mentioned earlier, they also used QSL messages. The original messages were transmitted on other frequencies and even on other days then the day the QSL messages were sent. Note the first group of the preamble is always 11199 and the messages always started with 55555 followed by 77011, while the last groups represent the QSLed messages. A typical QSL preamble and message looks like this:

11199 00142 00000 18010 00069
55555 77011 00089 00090 00091

Various RTTY speeds were used on this net in the 1990's. The most common were Baudot 50Bd, 75Bd and 100Bd with 500Hz shift. Besides RTTY also CROWD36 and Morse have been used.

In the (recent) past many Direction Finding activities were conducted with good results. The European master station is located in the Moscow region, while the now defunct WFO/MIG link was the link between Cuba and the New York area, probably the Russian UN legation. Station GMN could have been located in or near Mexico City. Most transmissions came from either Moscow or Cuba. Only a few other locations are known. See further the callsign list at the end of this article.

Moscow sends messages to many other stations, most likely governmental stations like embassies and consulates. The transmissions from Cuba were to BAR, BPA, HZW, JMS, KAC, NDO, PSN, SPK, WFO, WNY, YBU; all unid locations except for WFO.

There is a very significant feature to the 5-letter traffic. The last group of every message is a simple substitution which indicates the date the message was composed and the group count which is always 3 less than the group count shown in the preamble. The substitution is:

For example:

11177 00148 57477 26811 00609

5LGs QKANG XOBJZ ..................... VEVXX UEORW

The last group translates to 26057 -- 26^th of the month, 57 groups.

Message samples

A very popular one in the 1990's was the master station in Moscow that sent blind routine messages to KUL, VKX and several others at a fixed daily schedule. Note the "46" test slip instead of "RY". "KUL" is the callsign of the recipient, there are 3 messages with a total of 535 5-letter groups. (messages shortened)

464646464646464646464646464646464646464646464646464646464646
kul kul kul 3/535 kul kul kul 3/535 kul kul kul 3/535
464646464646464646464646464646464646464646464646464646464646
kul kul kul 3/535 kul kul kul 3/535 kul kul kul 3/535
464646464646464646464646464646464646464646464646464646464646
kul kul kul 3/535 kul kul kul 3/535 kul kul kul 3/535

11177 00142 33972 29181 01479

pofre xhtwl ewpxu garrv peife dfhfb sdstt bewph jxqzn uhlwo
lukhy mavla bgwmu vvhmo tzptw ssxrx ibsho joznd grdlo nmxyf
qspsi exvhm hacfj kqzfc nyldc szdqv tvwpv cnotp ozapg orijf

11177 00142 17790 29182 01459

uodkh mtauy ssfnc czanv caecr scyiv yccpi kqqhi qvvub qursm
uozjz arrir zutzn zubfy xjzpg ozydy mxgdk cgsec cerbk jvmzc
qbozz bgssz yjjky guglv avrae yfypo avjux sxfis nihoi zsgmb

11177 00142 04039 29183 02439

enqkz kjoan ryvhn vuacc tvzuz fclci zfmsg pmjkw lgqpv aabag
wqrml mdwux ptenu dwiya xsezx zeppr fomsx poclz paftk ytmyz
yydix ujdbb xqpkj flujk hbqov temvj ngfhz wynly onbmh iqdjt

qru qru sk sk

Another one on link 30022 with Ops chat at the end.

RYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRYRY

11177 30022 45013 20882 00549

KDRUG ALMIV LPTAT EACKS YBVPF LSCXG AFJII XDAHJ RQMXY JJXFV
HAJME EJKMA XMXLE ADMSE DSYHQ ZVAIZ ORANL PEBPI EHPGZ LTYFU
OSBBX DBWRM EKOOB NOZVX UPPPW ZVXHC OAETV DQJBR ABQFD TCILT

QSL 4
QRU
CFM T K S GB SK

RYRYRYYYRYRYRYRYYRYRYRYRYYRYRYYRYRYRYYRYRYRRYRRYR
QSP QSP QSP TX QSP X ZLD ZLD
11177 30022 48526 20886 03859

MIPYE KVMGG AOCHW RDJLJ FCMOO UORGV CFKYE PVSLM YMOMY CYBUU
ZYTNE RTPRB QMBUA GKAUP GEMLK HPCVN ZPQYS ODTWT OXUTC UWFWC
SINUB RYXCV RDJWC VUNLX CMCMW VHUUK ZFHAJ NYZJO GBIST PXQMA

QRU QSL 4 ALL FM OM PSE DAWWAJ MEDU TXT ES PL PBL
OKOLO 15 RUSKIH REGISTROW OK ? TQVELO RABOTATX INA 4E OV??
TKS GB SK SK

Interesting were the schedules that were transmitted. This broadcast consisted of the usual type of message plus schedules like the one below.

ILC QDG FM 4/2 TO QWK
FM 00.00 TO 13.00 QWS 10713/8118/13541
FM 13.00 TO 24.00 QWS 18053/16491/13541
QWK QDG FM 4/2 TO NEXT QWK
FM 00.00 TO 13.00 QSW 10713/8118/13541
FM 13.00 TO 24.00 QSW 18053/16491/13541

... and another one:

04.00-06.00
QRG 1 18565/16058/15683/13466/12158/11028/10328/8487/8178/7537
QRG 2 14578/11536/11134/8043/7867/7376/6888/5414/5858/5021
06.00-14.00
QRG 1 23170/22825/21860/18587/20071/18234/15683/14578/16337/12158
QRG 2 18234/18573/18617/17488/18364/13466/11028/10218/8877/7833
14.00-18.00
QRG 1 12131/15733/17488/16337/18617/16184/18308/14486/16058/11614
QRG 2 7814/10315/12188/11028/12188/11536/12131/8203/8843/5478
18.00-04.00
QRG 1 10512/10218/11068/8815/10707/8826/8487/7608/7885/5858
QRG 2 6885/6888/7376/6884/6885/6888/5836/5015/5771/4526

OK ?
WRK FM 01 11 80 KWK QUW TO NEXT QWK
ALL OK?
PSE ALL QSP TIKAS
NIL
PSE QSL
CFM
K

Interesting in this sample is the 020 sequence. The string is part of the link id of the receiving station (2nd group of the preamble) as you can see in the following sample.

020/020/020/020/020/020/...

ROP ROP ROP QTC ROP ROP ROP QTC ROP ROP ROP QTC ROP ROP ROP QTC
464646464646464646464646464646464646464646464646464646464646464
ROP ROP ROP QTC ROP ROP ROP QTC ROP ROP ROP QTC ROP ROP ROP QTC

11100 00020 00000 08054 02509

27833 01104 63436 19719 53579 56352 44915 87962 06845 66774
08172 39128 67689 64831 43175 29567 12263 93971 41622 57472
63803 26725 86758 80800 41765 19295 50804 41638 21354 54607
11358 05577 19058 07959 29971 78276 07074 17987 73607 02775
...

QSL messages always had 11199 as the first group in the preamble, and began with 55555. A startling message was sent by YBU. Here is the entire message.

11199 00148 00000 20269 01759

55555 77011 99641 99749 99736 99719 99726 99667 99635 99749
99736 99710 99750 99736 99751 99762 99640 99607 99749 99736
99748 99749 99736 44326 99736 99612 99721 99736 99705 99736
99678 99736 99688 99744 99641 99744 99641 99635 99696 99696
99641 99655 44326 99736 99607 99704 99737 99688 99744 99641
99744 99750 99750 99696 99641 99768 99655 44326 99736 99704
99664 99751 99688 99744 99641 99744 99750 99750 99696 99750
99635 99655 44326 99607 99751 99698 99737 99639 99744 99750
99721 99688 99721 99641 99750 99744 99750 99641 99636 99744
99736 99711 99649 99736 99635 99696 99736 99656 99736 99635
99641 99736 99749 99750 99749 99736 99719 99756 99740 99736
99687 99736 99612 99721 99736 99705 99736 99678 99749 99677
99736 99612 99736 99649 99635 99696 99736 99683 99696 99696
99639 99696 99750 99681 99736 99656 99736 99765 99635 99639
99765 99721 99681 99655 99736 99612 99736 99649 99635 99641
99683 99750 99768 99639 99750 99636 99681 99749 99765 99749
99736 99724 99742 99736 99725 99640 99647 99751 99676 99775
99747 99601 99747 99749

Analysis shows that starting at the third group, this message uses a trinomial (3-digit) code. When sent as 5F groups, the first two digits of each 5F group are nulls. All of the code groups begin with either a 6 or a 7 except for the one group (repeated three times in the message) which uses 44 as the nulls.

Nowadays, in 2009, some of the old preambles and message formats are still being used:

• 11100 80104 00000 12453 05009
  followed by 5FGs or 5LGs.
• URG URG URG 2/400 URG URG URG 2/400 11100 00102 00000 02411 02509
  followed by 5FGs or 5LGs.
• RAU RAU RAU 464646464646464646464646464646464646

With the introduction of new systems the formats changed. There are quite a few different formats now. I am not sure if each type is linked to a specific user (i.e. diplo, military, intelligence). Messages nowadays consist of 5LGs, 5FGs, 17FGs, 18FGs or 20FGs.

On CROWD36 channels headers like these are quite common:

• RXJZM ITQVB JHSMXV LGET
• DJNFCKGZYPAOBG RMLAWWALMR E SIU
• VNWGZXYDLU VCXRMWSDABHZJ
• VGPLCRI12(@7 VGPLCRI12(@7
• RNCTLHPOGMV DCWOX

Other formats on non CROWD36 channels.

• Multifigure groups e.g. 422140226144418178=

Three samples of RTTY messages sent in 2009.

Marker 

00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
00000++++++++++162)5761 00000++++++++++162)5761
...
00000++++++++++162)5761 00000++++++++++162

• Message on 4560 kHz, 31-10-2009, 1750 UTC

RYRYRYRYRYRYRYRYRYRYRY

198 156 31 1750
73180 40992 98051 58069 80201 68409 58713 89297 26241 99557
76528 75368 74678 97693 74598 40849 68646 54922 70646 35357
36273 87156 95581 45166 42509 61996 76635 27585 54722 95446
64710 66507 14245 78429 10678 72612 31074 19011 20276 76609
43898 11293 42308 89005 12646 66900 69839 24801 35737 70007 =50=
51399 43734 39289 98313 83903 0198 88489 14578 45716 67715
48349 25122 04176 36264 10127 18147 34828 41296 14735 41465
67926 65006 02816 21589 27608 60975 81692 67287 93440 80624
51420 68558 39010 84931 57098 26938 27256 39833 59635 78108
67224 18759 42171 92717 61938 60730 94317 66366 02072 57464 =100=
41431 34688 85102 67915 11079 74466 64654 83704 53911 76726
59687 93853 61113 02731 78253 22283 45619 58829 35478 36496
56361 76637 17226 19848 74554 97006 83566 61417 68745 84721
31251 71859 13375 31602 92401 51900 87644 86452 50088 87071
45158 22053 67001 59857 18431 76454 85724 19760 12959 42041 =150=
67757 47207 70508 00774 63509 72251 06349 29070 30432 33983
03611 75398 31134 27498 91334 13482 28532 97745 00565 58101
86459 73935 76279 20557 68420 83615 81382 16210 30493 78543
06479 32154 -
1800

(Note the separators after 50 groups)

...
=80139 2286217115ØØØØØ113)5814Ø +++++++++++++++18
=8Ø51 6Ø96484Ø386264588 =8612 23627Ø91387691793
=82Ø3 55Ø516135165595148=82Ø4 4671Ø694573197773
=8195 683Ø872Ø47ØØØ9391 =8986 148923816Ø3972134
=8217 83652522622347658 =8ØØ8 273716344979282115
=8169 6734482598182Ø533 =8511Ø 65Ø6987464593Ø1117
=84911 756181549743948163=84312 577545925229427138
=87513 4553365569417Ø86Ø =85414 5555543Ø2282781153
=76815 5491767Ø1Ø2849578 =86Ø16 Ø67682Ø77Ø8331411Ø
=82Ø17 8576Ø325487175847 =86Ø18 53Ø455561266Ø641Ø
=85819 654Ø72497167851132=86Ø2Ø ØØ728125413357453
=8Ø921 478385812979Ø19148=82222 997117615698ØØ3117
=85323 945118964757373153=87124 13796981776Ø61432
=89525 7Ø8Ø32975Ø58Ø94123=82326 239396234497688145
=87827 3772Ø9445452Ø53149=83528 752169586926225152
=85329 Ø7387876277526449 =8263Ø 545552445554856154
=85231 869Ø4Ø91479Ø661116=89332 96959Ø81342295799
=86133 2552ØØ32188328Ø119=84234 6173677973764741Ø6
=83635 Ø6996Ø65ØØØ49621 =79436 355386794215297122
=85537 184866Ø36218Ø5562 =8Ø838 615169639475Ø4884
=8Ø139 2286217115ØØØØØ113)5814Ø +++++++++++++++18
=8Ø51 6Ø96484Ø386264588 =8612 23627Ø91387691793
=82Ø3 55Ø516135165595148=82Ø4 4671Ø694573197773
=8195 683Ø872Ø47ØØØ9391 =8986 148923816Ø3972134
=8217 83652522622347658
...
=86133 2552ØØ32188328Ø119=84234 6173677973764741Ø6
=83635 Ø6996Ø65ØØØ49621Ø =79436 355386794215297122
=85537 184866Ø36218Ø5562 =8Ø838 615169639475Ø4884
=8Ø139 2286217115ØØØØØ113)5814Ø +++++++++++++++18
(s/off)

Modes

The governmental transmissions that we monitor are a mixture of intelligence, diplomatic and military stations. During the past 10 years a host of digital modes have been used by the Russians. In the past most of the transmissions were in AM, USB, CW and RTTY. The first CROWD36 logs are from late 1999 and after that all the modes that are mentioned hereafter were introduced.

We still can listen to voice and morse numbers stations but the majority of the other transmissions are in modern digital modes, heavily encrypted. The Enigma designator for the majority of the digital stations was M42. Enigma 2000 deleted this designator but N&O will still be using it. The polytone stations however are not catalogued under M42 but under XP and the Mazielka has X06 as designator.

M42 / X06 have been using a lot of frequencies during the past 10 years. This list is most definitely not complete. The mazielka calls are sometimes heard on the same frequencies as M42.

M42 frequencies

Mazielka (X06) frequencies

Mazielka tone sequences heard so far

Note that the usual sequence consists of six tones. Sometimes a two-tone variant can be heard. Other variants are probably errors.

Two-tone sequence: 121212

Six-tone sequences:

Link id's and callsigns.

I'd like to thank all the people who have been monitoring these stations during the past decades, especially the former WUN members and members of the UDXF, Spooks, ENIGMA 2000, and anonymous dxers who were so kind to share their logs with us.

Voice stations | Morse stations | Various modes
Military stations | Utlility round-up
China update | M42 & X06: the story so far | Database update
2009 index | Clandestine Activity Survey | Logs
Index | NS NL Home