Eighth edition of the N&O column / Spooks newsletter

(Date: Wed, 2 Dec 1998 18:06:07 +0100 MET)

Golden oldie | Morse stations | Polytone XPH | Jammers
Voice stations | Transposition ciphers | Logs
Index | NS NL Home

Voice stations

English man variant

Eddy Waters found a rare English Man transmission. The transmission follows the normal structure of an English Man message, but is followed by several data bursts and a morse message. This station actually waits for feedback from the recipient!

The complete message was in English 874 874 874 901 901 54 54 -into 54 5FGs- 901 901 54 54 00000, followed by a few bursts of data and the following in morse: 7SA1 QSA 4I K -pause- R K

Besides Eddy's log, I have only seen two earlier logs for this station, both loged by Enigma's Mike.
10440 1230 UTC 14 Nov. 1998
13572 1900 UTC 23 April 1995
6915 2200 UTC 28 April 1995

Mike sez that the messages on both days were the same: 572 572 572 861 861 54 54. Ending: 861 861 54 54 00000 + data + CW.

Apparently the station has a standard group count of 54.

The question is whether this English Man is the same as E6 or not?! It is of course possible that the station has been logged many times in the recent past, but that it has been mis-reported as E6. So, I'd like to ask you to listen to the English Man transmissions very carefully.

Don't switch your radio off after '00000' but wait a minute or two and see if the data and morse part appears.

English man [E6]

Interesting info reached us via John Maky. He copied the English Man on 6865 at 0130 on 22 Nov. with "936 then 782 782 194 914 and into 5FGx2". Down at :07 w/782 782 64 64 00000. Recently these broadcasts have taken on a new twist - they use the same frequency more than twice.

The station was also on 4630 kHz at 0400 on 22 Nov. Repeating "347 then 592 592 64 64 and into 5FGx2". Down at :16 w/592 592 64 64 00000. Repeat of previous night's broadcast. When audio dropped, a second weaker broadcast could be heard on the carrier repeating 329 329 329 00000, which is a repetition of the 0415 broadcast from 22 Nov. on 9216 kHz.

Very nice catch, John!

ENIGMA's Mike found the English Man on a new frequency: 4470 kHz at 2200 UTC. Preamble 534. Ending 218 77 00000 at 2218 UTC

See also Newsletter 17.

S19 and M10

S19, the Slovak man, was on the air again on Thursday 19 Nov. Along with its morse counterpart M10.

M10 was on at 1000 on 5020 kHz
Message 111x3 52544 18 44730 20 36512 17 19782 19
S19 was on at 1300, still on 10642 kHz
Message 111x3 83674 18 57080 14 67460 16 86074 20

It seems that they are on every 4 weeks. [source Guy Denman]

See also Newsletter 22 for more about M10.

'Nancy Adam Susan' [E15]

Costas forwarded the following interesting note from the Amateur radio Intruder Watch. The German PTT agrees with the location that I mentioned recently and also pin-points this station in northern Egypt.

RegTP Konstanz (German Telecoms.) the "input"-office for the German Intruder Watch, have reported to DARC MONITORING SYSTEM Intruder Watch that they have pin-pointed the net starting at 14.00 and 17.00 UTC on 14000.0 kHz with the spoken announcements in SSB-USB "Frank Young Peter" followed by spelling scrambled messages: The station is located in the Cairo-vicinities, EGY. RegTP Konstanz have informed their headquarters in Mainz to launch an International Complaint against this offender.
Uli, DJ9KR [Coordinator DARC-MS]

See also Newsletter 9

Czech lady control transmission [S17]

Format : 555 555 555 313 313 313 05 repeated for 5 minutes
313 313 313 42 42 05 05 pozor pozor
5-figure group repeated 10x
pozor pozor
42 42 05 05
konec konec
Time : 13.55 UTC
Frequencies: 4485//5027 kHz


Hans-Friedrich Dumrese sent me his S17 findings. Thanks for the list HD! The first thing that catches the eye is that most groups start with '8' or '9'. The third figure is always '0' and finally '31' and '32' are often the last two figures.

day date time freq group
Fri 11.09.98 1355 5027 79031
Sun 13.09.98 1355 5027 82033
Sat 26.09.98 1355 5027 83036
Fri 09.10.98 1355 5027 89031 (!)
Sat 10.10.98 1355 5027 89031 (!)
Fri 16.10.98 1355 5027 83032 (!)
Sat 17.10.98 1355 5027 83032 (!)
Sun 18.10.98 1355 5027 95031
Mon 19.10.98 1355 5027 95025
Tue 20.10.98 1355 5027 82032
Wed 21.10.98 1355 5027 94032
Thu 22.10.98 1355 5027 90022
Fri 23.10.98 1355 5027 95029
Sat 24.10.98 1355 5027 82032
Sat 30.10.98     90091
Sat 31.10.98 1355 5027 87030
See also Newsletter 13.

(!) on 09+10 and 16+17 October, they transmitted the same groups. This is the first time that this has been reported.

Swedish Rhapsody [G2/M4]

The following info was provided by Guy Denman:

The G2/M4 station is having some major changes just lately, it has gone from having a large number of skeds to having very few. Most of these seem to be during the day. M4 Is now only on the second week of the month on Monday, Wednesday and Thursday at the following times and frequencies: 1000 on 7250, 1200 on 8188, and 1300 on 5748. The same IDs and message sent all week.

Another really major change occurred recently. I heard G2 on Monday same times as last Month, 1000 on 6200, 1200 on 8188, and 1300 on 6507. All transmissions were on SSB with 3 playings of the Swedish Rhapsody, then a count 1 to 0. IDs were 65069 12876 49906.

An English transmission was heard at 1000 on 6200 with a 1-0 count. Each figure was repeated 5 times this for 5 minutes. There was no SR tune. It then went on to the same IDs as Monday 65069 12786 49906 each repeated twice, the whole repeated 3 times. Then without a pause 65069 twice then 100x5F, no pause at the end 12876 twice 100x5F then 49906 twice 100x5F. No ending. There were no attention or end as in G2, and no pauses anywhere. The voice sounds very much like E5 the counting station.

More about M04 in Newsletter 30.

The counting station [E5/V5]

by Chris Smolinski

"The CIA, a training center, nuclear war, a woman named Cynthia, and an old farm..."

An interesting mix, certainly! What do they all have in common? Why a Spy Numbers Stations, of course.

Many of us are familiar with The Counting Station (TCS, ENIGMA E5/V5). This station is also referred to as Cynthia (CynthIA), and that is the nickname given to the woman's voice who calls out the digits. This is the numbers station that most believe to be associated with the US Central Intelligence Agency (CIA). Transmissions from this station have been heard for years. Originally, the transmissions were of four figure (4FG) groups, they then changed over to using the 3/2FG format, which is a five figure group with a slight pause between the third and fourth digits.

The original technique used to produce the audio for TCS is rather interesting. The message to be sent was punched on a 5 bit (baudot) teletype tape. This tape was fed into a device that played a mylar cylinder that had a number of audio tracks recorded on it - the same basic technique as is still used today to store the soundtrack of a movie. This device selected one of the audio tracks, which consisted of the digits 0-9, and other words like "count" and "end". This audio was fed to the transmitter. Presumably other numbers stations used similar systems. In fact, listeners used to report hearing clicks between the digits, perhaps this is the machine switching over between tracks.

Then in 1985 a change was made. A computer was introduced that had digitized audio recordings. As before, messages could be entered via teletype tape, or they could be typed in on a keyboard. A schedule of transmissions could be set up, and the system was automated.

Interestingly, some people have reported numbers stations sending strings of "46464646". This of course is the numeric equivalent of the codes for RYRYRYRY, which is a common RTTY test message. It's possible that someone fed a test tape into the computer, rather than the correct message tape.

And on Friday, Novmeber 6, 1998, at 0200 UTC TCS was heard sending a message to ID "000". The first five groups of the message were: 000 00 987 65 432 10 987 65 432 10

Then seemingly random numbers followed. An interesting test message. The message length was 215, which is a fairly common length. Some believe that messages with this count are all test messages.

And where are Counting Station broadcasts transmitted from? Well, from signal reports it appears that numerous sites worldwide are used. It is known that some transmissions originate from the USA - right outside of Washington, DC in fact. They come from a site in rural Virginia, about an hours drive southwest of Washington. Originally, it was thought that they came from a military base called "Vint Hill Farms", near Warrenton, Virgina. As it turns out, while Vint Hill was used for intelligence purpose, it was as an interception site, for training, and equipment design and testing, not for spy numbers transmitting. Vint Hill Farms has since been closed down.

They are tranmitted from Site C of the "Warrenton Traing Center" (WTC). What is the Warrenton Training Center? Well, the little sign outside the gate says it is part of the National Communication System (NCS).

Officially, the NCS is an agency which facilitates communications between various parts of the US government. It was founded in 1962, after the Cuban Missile Crisis. In particular, it is supposed to make sure that the government continues to have communications in the event of a nuclear war.

In reality, many believe the NCS is purely a cover for the CIA. There are some official exercises and programs that claim to show participation with the NCS, but the CIA is really running the show. One of the many parts of the NCS is the Warrenton Training Center, a collection of four sites in rural Virginia, near the town of Warrenton. These sites are referred to by letter, A through D.

I've driven around the perimeter of these sites. It's just a short drive from Washington, and if you're ever in the area, you should give it a try. All of the sites are just off of state routes, so you don't have to drive on too many back country roads.

Station A is a small facility used for meetings and conferences.

Station B is the primary training facility for the Office of Communication. This consists of basic training in morse code, radio theory, and so on. Training for the Department of State is also conducted at this site. (The close cooperation between diplomatic and intelligence branches of governments of course goes back thousands of years).

Station C is the transmitter site. This site houses the shortwave transmitters and antennas. It has a microwave link to Station D.

Station D is where the messages actually originate. There is also a microwave tower in Tysons Corner, Virgina, which acts as a link between the Warrenton stations and CIA headquarters. There is also an under-ground fiber optic line that runs from the Warrenton sites back to Washington DC.

The messages sent consist of both real "live" and dummy traffic. The purpose of course of dummy traffic is to make it difficult to determine when the agent is actually receiving messages. Usually, a simple system is used to let the agent know when a message is real or not. This usually consists of a code, such as if the middle digit is odd, the message is dummy. This lets the agent immediately know that the message isn't real. The same message is repeated several times on different frequencies over several days, all according to a set schedule. This is to allow an agent to receive messages he may have missed. Short messages are padded with extra groups to bring them up to a minimum level.

Schedules are arranged with the agents during meetings with their case officer.

If you'd like to try for a Counting Station QSL card, you may want to give this address a shot. No one ever has received one, and no one probably will. You might even get your name in a CIA file for trying...

Warrenton Traing Center
Station D
Bx 261
VA 22186
Do not worry much about that. If you are a regular Spooks hunter having made any e-mail list or newsgroup message on this topic, your name is most likely already on several files. ;)

And who's voice is Cynthia's? Well, sorry to disappoint you, it isn't anyone's voice. The voice is totally synthetic. Cynthia truly is a robot.

Below is the latest version of the excellent schedule of Counting Station transmissions, maintained by Bob Roehrig.

Counting stations by time/freq

0000 4640.0 X X X X X X   EE //5046
0000 5046.0 X X X X X X   EE //4640
0100 15478.0     X   X     SS //16050
0100 16050.0     X   X     SS //15478
0300 12300.5   X       X   SS //14421
0300 14421.0   X       X   SS //12300.5
0900 11580.0           X X EE //14655
0900 14448.0             X EE //15822
0900 14655.0           X X EE //11580
0900 15822.0             X EE //14448
1100 14432.0         ?     EE  
1100 16086.0   X   X       EE //21811
1100 21811.0   X   X       EE //16086
1200 10223.0     X     X   EE //13518
1200 13518.0     X     X   EE //10223
1200 13906.0     X     X   EE //15732
1200 15732.0     X     X   EE //13906
1300 10529.0   X     X     EE //14739
1300 13518.0           X   EE //14739
1300 14739.0           X   EE //13518
1300 14739.0   X     X     EE //10529
1400 15833.0       X   X   EE  
1500 7600.0   X     X     EE //10597
1500 10597.0   X     X     EE //7600
1700 10423.0       ?       EE //12197
1700 12197.0       ?       EE //10423
1700 13450.0 X     X X   X EE //14448
1700 13874.0   X X         EE //15822
1700 14448.0 X     X X   X EE //13450
1700 15822.0   X X         EE //13874
1800 11072.0 X         X   EE //13444
1800 13444.0 X         X   EE //11072
1800 13450.0     X         EE //14448
1800 14448.0     X         EE //13450
1900 10527.0         X     EE //12197
1900 11491.0     X     X   EE //13450
1900 12197.0         X     EE //10527
1900 13450.0 X   X         EE //14448
1900 13450.0     X     X   EE //11491
1900 14448.0 X   X         EE //13450
2000 10423.0 X     X       EE //12197
2000 10527.0         X   X EE //12197
2000 12197.0 X     X       EE //10423
2000 12197.0         X   X EE //10527
2100 10263.0     X       X EE //12150
2100 10583.0   ?       ?   EE //12175
2100 12150.0     X       X EE //10263
2100 12175.0   ?       ?   EE //10583
2200 8125.0     X       X EE //10423
2200 10423.0     X       X EE //8125
2200 11440.0     ?   ?     EE //13988
2200 13988.0     ?   ?     EE //11440

John Maky noticed a remarkable series of _what looks like_ test transmissions on 4670//5238 at 0200 UTC. Here's the breakdown...

Atencion [V2]

John also found a number of new times/freqs for V2 'Atencion'.

7854 0100 Sunday 10/18/98
6768 0100 Saturday 10/31/98
7681 0200 Tuesdays 11/4/98
9024 0200 (old version) Tuesdays (11/4/98)
6782 0300 Friday 11/6/98
4174 0300 Monday

Talking about V2....... Bob Roehrig heard the following on Monday Nov 8 at 0400 UTC. In his own words..........

  1. Caught M8 CW station on 7680 and heard Spanish numbers faintly in the background (had the receiver in USB).
  2. Went looking for any V2 stations and heard one on 6768 “ thinking that it sounded a lot like what I heard on 7680, so I switched on receiver #2 and tuned it back to 7680. Well, it turns out that on 7681 LSB was // transmission to the AM V2 on 6768. This was definitely LSB - no carrier. I have never heard any // V2 transmissions before.
More about V2 to be found in Newsletter 14.


Schedule for November:

06.00 UTC 10233 kHz
06.20 UTC 12133 kHz
06.40 UTC 13533 kHz
More about V7 to be found in Newsletter 14.

Golden oldie | Morse stations | Polytone XPH | Jammers
Voice stations | Transposition ciphers | Logs
Index | NS NL Home