Fifth edition of the N&O column / Spooks newsletter

(Date: Tue, 25 Aug 1998 23:23:48 +0200)

Morse Stations | Two Letter Stations | Cherry Ripe | The Counting Station | Simple Substitution | Jamming | Logs
Index | NS NL Home


Two Letter Stations

by Simon Mason

In his book 'Secret Signals', Simon wrote about the then very active stations PN, DFD21, DCF37 and the other 'two letter stations'. PN, DFD21 and DCF37 no longer exist, but there are a couple of 'two letter stations' still active. These stations and frequencies are mentioned at the end of these station profiles.

Note: I have omitted the original frequency lists. -Ary-

Papa November

Here is a case of "where to begin?" There are over 80 callsigns on nearly 40 different frequencies, all of which indicates a very big set-up. I can recall hearing these transmissions in the early 1970's and they certainly date back further than that. I remember tuning into a station in 1971 and being almost hypnotised by the strange interval signal (it is a different one now). It consisted of a female voice repeating "Papa November" over and over continuously with a sort of snake charmer's flute playing in the background. This went on for five minutes, after which a woman would start sending messages in five figure groups.

When I started to actively listen to number stations this was one of the first I studied. It is unique in that it broadcasts on four frequencies at the same time, but not simultaneously. By this I mean that there is a time lag between the four frequencies. It is as though four different machines are started, one after the other. Until 1989 real female voices were used, that is, a woman would be giving a list of German five figure numbers and she would sit down and read the whole thing out into a tape recorder. The tape could then be transmitted at the appropriate time. At the time of eventual conversion to a voice synthesiser machine, four different women were being employed in the mind-numbing career of number reading. More about them later.

The frequencies used are 2707, 5015, 7404 and 11108. The choice of freqs is interesting as it insures that at least one will be propagated at any given time. As it happens, the schedule is designed to give a wide geo graphic coverage. The station transmits every day, even on Christmas, at 0000, 0030, 0600, 0630, 1200, 1230, 1800 and 1830. The transmissions on the hour are in the AM mode, whereas the broadcasts on the half hour are all in upper sideband.

These data suggest that maybe a world-wide operation is in force. After all, a station that transmits on four frequencies every six hours using both AM and USB is trying to get its messages through at any cost. On the whole this operation is very professional. The broadcasts begin precisely on the hour or half hour and very few mistakes are made. It is not totally perfect however. Here are two errors that have been noted:

Anyway, back to Papa November: as shown, the station is pivotal to what ever agency operates it and the format it uses reflects this.

This is unique amongst number stations. A 3 figure identifier is used, followed by a group count. The difference is in the daily workings of the station. Papa November has allocated to it a series of 3 figure identifiers which are specific to the station and are not used by any of the other stations in the network. After the callsign is sent a woman sends out the list of identifiers/group count, like this:

PN 1800 25 JUL91: 824 4 695 13 771 11 372 12 525 10 717 8

824, for example, is the identifier and 4 is the number of groups. This is said as "824 824 4 gruppen, 695 695 13 gruppen", etc. Alter the last heading the message for 824 would be sent which, in this case, is four groups of five figures, e.g. "12334, 12334, 89856, 89856, 29964, 29964, 13277, 13277 ende. Achtung! 695 695 13 gruppen" and so on.

Now, this represents one transmission (at 1800 on 25 July, 1991). The next day a new message may have appeared. It will take the first place on the rota of messages, like this:

(new message) 543 12 824 4 695 13 771 11 372 12 524 10

Note also that the last message on the previous day's rota has dropped off the bottom. If we look at the rota for several days the picture becomes clearer:

SUN

MON

TUE

WED

THU

FRI

SAT

SUN

997 11 717 12 233 17 622 10 117 11 697 9 335 12 477 12
524 8 977 11 717 12 233 17 622 10 117 11 697 9 335 12
543 11 524 8 997 11 717 12 233 17 622 10 117 11 697 9
771 22 543 11 524 8 997 11 717 12 233 17 622 10 117 11
825 7 771 22 543 11 524 8 997 11 717 12 233 17 622 10
372 16 825 7 771 22 543 11 524 8 997 11 717 12 233 17
543 11 543 11 543 11 543 11                

New messages appear daily and the old ones are discarded. This is not always the case, however. Notice the message 543 11. It is stuck on the bottom of the rota for a few days, perhaps for as long as three weeks. Also, message 233 17 joins it at the end. This sort of thing is a regular occurrence. Presumably the message is retained on the rota until the agent contacts the senders to say that the message has been copied. Then the heading will finally disappear from the rota. Certain identifiers have a tendency to stay around for a long time. For example, 543 messages can stay on a rota for several weeks. Maybe agent 543 or whomever cannot acknowledge easily so the message has to be repeated over a period of time.

Traffic analysis is easy with this station as the number of messages changes considerably. Sometimes there may be only five messages, at other times perhaps ten. Here is a selection of headings and group counts sent over the last few years. Perhaps the changes in traffic relate to events in the real world.

Note: The three figure number is the addressee, the one or two figures after the addressee is the group count.

21 MAR 90

16 APR 90

16 MAY 90

21 JUN 90

19 AUG 90

2 DEC 90

683 6 706 8 853 6 351 7 269 10 352 15
462 11 321 15 307 35 974 9 564 8 563 14
383 7 178 2 923 10 156 12 133 6 868 12
318 12 084 6 321 9 064 18 620 9 935 11
096 8 464 11 243 12 541 13 713 7 736 7
484 11 997 8 582 7 572 13        
948 5 563 4 494 8            
825 23 688 16                
307 19 825 10                

Note how the traffic varies. Also, some of the messages consist solely of two-five figure groups. For 20 APR 91 the traffic for addressee 484 was only 48285 and 36187. It is difficult to imagine what the purpose of such a brief message might be.

Addressees: Here are all of the addresses used by Papa November. The number of different addressees will give some idea of the scale of this station compared to other stations in the same organisation.

007 018 040 046 052 057 064 078 084 092 096      
109 112 126 133 144 156 160 174 178 179 181 197    
212 217 219 220 231 233 238 243 269 275 280 293    
307 312 318 321 337 348 351 352 367 372 376 383 399  
406 422 438 448 462 464 468 479 484 487 491 494    
525 535 541 543 544 552 563 564 569 572 581 585 587 595
602 616 620 637 657 669 678 683 687 688 690 695    
706 713 717 725 736 749 765 771 799          
805 809 825 843 849 853 868 877 881 887 891      
905 916 923 927 935 948 965 966 974 994 997      

Of course Papa November is not listed in any available frequency list and its callsign is not issued by any telecommunications authority. However, there are two numbers stations, indeed, the only ones, that have, on the face of it, legitimate callsigns and these are discussed next.

See also Newsletter 58.

DFC37 and DFD2I

These stations are on two frequencies; 3370 for DFC37 and 4010 for DFD21. They are, to all intents and purposes, the same station. However, as will be shown, the history of these stations goes back to at least the early 1970's, as does that of Papa November. The interval signal in those days was a complete musical scale of ten descending notes, after which a woman said "Hier ist DFC37" or "Hier ist DFD21". When they were converted to auto-voice in 1988 the interval signal was changed to electronic tones followed by a woman with "Delta Foxtrot Charlie Drie Sieben" or "Delta Foxtrot Delta Svo Eins".

Schedule:

DFC37 3370 1500 1800
DFD21 4010 1500 2200

 

Messages begin on the hour in the AM mode and are repeated on the half hour in single sideband.

The stations have their own addressees unique to them and not used by Papa November or the other two letter stations. Here is a typical day's broadcast:

DFC37

DFD21

1500 036 236 450 A 1500 698 154 C
1600 387 400 832 B 1600 413 356 D
1700 698 154 C 1700 036 236 450 A
1800 413 356 D 1800 387 400 632 B
1900 036 236 450 A 1900 698 154 C
2000 387 400 832 B 2000 413 356 D
2100 698 154 C 2100 036 450 236 A
2200 413 356 D 2200 387 400 832 B

As noted, broadcasts are repeated in upper sideband on the half hour. I have added the letters A, B, C and D to indicate identical messages, that is, message "A" on DFC37 at 1500 is the same as on DFD21 at 2100, etc. You can see that they really are the same station and that, on any particular day, there are four opportunities in the AM mode and four in USB for addressees to receive their traffic.

As with Papa November, DFC37 and DFD21 have unique three figure identifiers. These are:

002 012 020 036 044 047 062 065 069 074 079 083 085 094 095
107 114 116 117 121 129 130 134 147 154 157        
204 211 225 229 236 237 251 259 261 273 278 291 295    
316 323 330 336 354 356 387 397              
400 411 413 414 423 426 428 431 435 450 471 483 490    
619 623 641 644 651 680                  
735 784 792                        
811 817 821 823 827 832 840 846 851 852 867 872 880 890  
904 914 925 934 991                    

Because DFC37 and DFD21 have seemingly legal callsigns you would expect them to appear in such utility station lists as the Guide to Utility Stations by Klingenfuss and the Confidential Frequency List compiled by Geoffrey Halligay. And, indeed, they do! You might think that this is a breakthrough - two numbers stations listed in these publications, with the operator's identity exposed and transmitter locations listed. Unfortunately, the inclusion of these stations does nothing to explain the mysteries. Indeed, the opposite is true. Their inclusion only adds to the intrigue. Take the Klingenfuss Guide first. According to this book DFC37 and DFD21 are operated by the Deutsche Bundespost (the German Post Office). Fair enough. Far-fetched though the idea may be, let's suppose that a company as technically advanced as the DP has a use for a station sending numbers; the telecommunications equivalent of talking drums or smoke signals. We already know that Papa November and the other two letter stations are part of the same organisation as DFC37 and DFD21. Here is the proof:

Now, of course, although DFC37 and DFD21 are proper callsigns, allocated to Germany, Papa November, Papa Zulu, Charlie November and all the rest are not. An organisation such as Deutsche Bundespost would not, I think, operate these illegal callsigns. The Confidential Frequency List states that DFC37 and DFD21 are part of an "internal net" and places the trans mitter site at Frankfurt, Germany. Intrigued by this, I wrote to the Deutsche Bundespost but received no reply. I next wrote to Herr Klingen fuss and asked why he listed DFC37 and DFD21 but did not list PN, etc. His reply didn't really answer the question:

«Sorry but we do not monitor these 'number stations' for several reasons, e.g. - Since several decades nobody has ever succeeded in the exact location and purpose of these stations. - Nobody has ever been able to contact such a station or to get a verification for reception, etc. - All what especially those SWLs from America, etc. write and state about these stations are presumptions, guesses and nonsense. From our point of view, monitoring these stations is a waste of time and you get more from reading Bracknell Meteo's Teleprinter coded weather during 24 hours than from monitoring these number stations' for 24 seconds. Consequently, we cannot answer your questions because Klingenfuss Publications considers to give facts and not guesses.»

But is it therefore a fact that DFC37 and DFD21 are operated by the Deutsche Bundespost? Almost certainly not. It would be interesting to know were, exactly, these callsigns are registered, if, indeed, they are. As mentioned earlier, before automation four distinct female operators were employed in reading out the numbers. They had their own characteristics and delivery styles. One even sounded as though she had a Welsh accent. It became possible to know when certain women were on vacation or perhaps ill. One could often hear them pausing to swallow or take a deep breath, but to their credit I never heard them cough. They were mystery ladies and I tried to imagine them outside the work environment -would anyone else have the slightest idea what they did for a living? What would they say if anyone asked? In one way their voices live on. The voice synthesiser now in use is modelled on one of the real voices. This woman's voice must have been "sampled" before technology made she and her colleagues unnecessary. Imagine being able to switch on a radio and hear your own synthesised, disembodied voice coming out of the speaker!

See also Newsletter 58.

Two-Letter German

As we have seen, Papa November uses four frequencies and DFC37/DFD21 use one each. The other members of this set-up use many frequencies in the 2.0 to 30 MHz range. There are many different callsigns, each of which has its own three figure id, although nowhere near as many as PN. The format is similar to Papa November. The woman repeats two letters from the international phonetic alphabet four times, after which random electronic tones are played for a few seconds. This goes on for five minutes after which the woman gives the three figure identifier and then the group count.

Example: "Yankee Sierra" 4x, electronic tones (5 min repeated), "635 635 27 gruppen. 516 516 78 gruppen. Achtung, 635 63527 gruppen." Into five figure text.

There are at least 40 different frequencies used by these stations. Here is a complete list of all the stations noted on these frequencies, along with the three figure identifiers they use:

AB 804, 299, 531
AL 043, 969, 023
AM 119, 791
AO 142, 113
AU 600, 349, 244, 385, 006, 554, 691
BE 558, 903
BI 191, 721
BJ 358, 591, 152, 879
BU 608, 073, 492
CD 059
CI** 444, 555, 666
CN 158, 430
CT 884*, 465, 223, 286, 032
DB 038, 329, 848
DF 281, 718
DO 167 (English)
DT 809, 015, 503
EG 472, 795, 267
EL 928, 510, 063
ER 573, 885
FB 009, 382, 653, 361
FP 081
FS 099, 361, 816
GC 082, 808, 334
GZ 628, 803, 285
HK 393, 621
HS 639
IT 139, 525
JB 606, 995, 239
JD 534, 802
JO Unknown
JU 271, 667, 499
JW 521, 081, 123
KR 737, 171
KW 884, 091, 908
LA 873, 355, 363
LD 482, 677, 146
LE 633, 910, 262
LG 224, 484, 761
LU 998, 031, 456
MH 013, 255, 604
MN 628
NU 264, 599, 368
NZ 202, 649, 955
OK 319, 617, 812
PB 917, 263, 709
PG 217, 424, 732
PJ Unknown
PL 855, 131, 679
PT 118, 551
PZ 143, 625, 374
QL 410, 028
RK 104, 702 (English)
RO 941, 098, 660
SB 527, 962
ST 481, 755
TE 460, 103
TP 004, 975, 738, 696
UF 234, 655, 049
UG Unknown
UI 443, 778
UL 137, 781, 218
VB 088, 415, 697
VO 141, 283, 507
WL 115, 522, 026
WP 989, 716
XL 381, 427, 610
YB 042, 979, 676
YS 635, 516, 027, 907
ZB 589, 926, 203
ZG 763, 405
ZO 209, 391, 475, 681
ZP 505, 125, 703
ZT 250, 863

* All traffic for this identifier starts with either a 1 or a 0, e.g. 01222, 19988. This applies to 884 only, the others use random five figures.

** CI seems to have been a test broadcast. Its distinctive identifiers point to this and it was heard only once, during the changeover to voice machine.

There are, strangely enough, one or two English language versions of these stations. Those noted so far are "Romeo Kilo", "Juliet Oscar" and "Delta Oscar". The woman announcer on these says "Message for 167, 167 88 groups. Attention!", and then goes into the five figure message. The English variant, apart from being very seldom heard (at least in Europe), is unusually faint and distant-sounding, as though the transmitter site is not on the European continent. The woman's voice has an oriental accent, not German at all. This may suggest that the activities of the organisation behind this station have a world-wide involvement. My own theory is this: DFC37 and DFD21 are aimed at personnel in Western Europe. The times of the broadcasts (afternoons and evenings in Europe), the frequencies used (3370 and 4010) and the large number of addresses seem to back this up. These signals are not readily heard outside of Europe so this would seem to be the case. The traffic is fairly substantial; each addressee has between 20 and 50 five figure groups in each message.

Papa November would seem to be a general alert broadcast. The low five figure group counts (2 to 20) mean little information can be sent to the agent. The message would seem to be on the nature of "Pick up a message at (place)" or "Tune into a broadcast at..." The real info would be sent by all the other two letter stations world-wide as their group counts are always about 100 groups in total.

The suggestion of a world-wide operation is backed up by the frequencies used. 19295 at 1400 is not a combination meant to be heard in Europe. Also, certain stations never appear below about 10 MHz, while others keep below 10 MHz. This would suggest that "Bravo Uniform", for example, which never appears below 10 MHz is meant for agents outside Europe. Similarly, Yankee Sierra", which never broadcasts above 8 MHz, is meant for agents closer to Europe.

The 2 letter stations have been heard at every hour and half hour during the 24 hours in a day. The vast majority broadcast between 1800-2000, suggesting that the recipients of the messages are located mainly in Europe.

Still active in 1998

The next six stations have been heard on the following times/freqs:

English stations (E16)

EH 1530 UTC 19295       Wed, Fri, Sat
1600 UTC 19295 20240 20350   Wed, Fri, Sat
BL 0800 UTC 12092 12210 12314 13890  
  2000 UTC 11108 11545 11617    
AU ???? UTC 4821//4888        
MD 0800 UTC 12210 19292      
  0900 UTC 12092 12314 13775 13890 16414
  1330 UTC 11545 12092 16220    
  1400 UTC 11545 13775 16414    
See also Newsletter 10.

German stations (G16)

GK Sunday 1930 UTC, Jan 3262, Feb 4888, March 5732, April 7404, May 7404, June 8063, July 9325, Aug 7404, Sept 6853, Oct 5770, Nov 4888, Dec 3228

Also noted on weekdays at 1930, 2000, 2030, 2100, 2130, 2200, 2230 on 3262, 4543, 4594, 4821, 4888, 5015, 5182, 5284, 5732, 5770, 6853, 7404, 7858, 8063, 8173, 9040, 9325, and 10177

WL 1000 UTC 12092 13890 19755 20240
  1900 UTC 10177 14622    
  1930 UTC 7404 13890    
See also Newsletter 10.

Morse Stations | Two Letter Stations | Cherry Ripe | The Counting Station | Simple Substitution | Jamming | Logs
Index | NS NL Home

---