[sci.electronics] Short Wave Numbers "Racket"

wwg@brambo.UUCP (Warren W. Gay) (02/11/89)

There are a number of illegal short wave broadcasts that are apparently
difficult to track down (as to location).  These broadcasts consist 
entirely of numbers (as far as I have heard at least).

My question to the net (particularly to the sci.crypt experts) is 
simply what type of encryption schemes are employed by these "air
pirates"? The one station I've recently heard (its been a while
though), transmitted numbers of a fixed length of about 5 or 6 
digits each (in morse code).  These numbers obviously mean 
something to somebody :-)

I have no cipher expertise but this has me somewhat intrigued.  Anybody
care to shed more light on this subject?

73s de VE3WWG (Warren)..............LSI represents Large Scale Investment,
.................transistors are "discrete", but tubes are just plain fun.
................Bramalea Software Systems Inc...!utgpu!telly \ !brambo!wwg
...................!{uunet!mnetor, watmath!utai}!lsuc!ncrcan /

parnass@ihuxz.ATT.COM (Bob Parnass, AJ9S) (02/12/89)

In article <439@brambo.UUCP>, wwg@brambo.UUCP (Warren W. Gay) writes:
> There are a number of illegal short wave broadcasts that are apparently
> difficult to track down (as to location).  These broadcasts consist 
> entirely of numbers (as far as I have heard at least).
 

   Numbers stations may be  found  on  several  frequencies,
   with  both  males and females speaking in many languages.
   Some are in Morse Code.

   They  remain  the  subject  of  debate  among  SWLs,  and
   attempts  by  hobbyists  to break the coded messages have
   been unsuccessful.  One prevailing theory  is  that  they
   are  "spy"  stations,  sending  orders  to  operatives in
   foreign countries.  Another theory is that they are asso-
   ciated  with  smuggling  activities,  like  ordering, and
   arranging for drug deliveries.

   I agree with the "spy" theory.  Monitoring Times reported
   a  few years ago how an SWL traced down the source of one
   numbers  station.   Using  a  Kenwood   R2000   shortwave
   receiver  in  his car, the SWL found the signals eminated
   from a U.S. Government facility in Warrenton, VA,  opera-
   ted by an arm of the intelligence community.

   The FCC won't talk much about these signals,  but  I  bet
   you  dollars  to donuts that the NSA, USN, CIA, etc. know
   exactly what their purpose  is,  and  monitor  them  (and
   operate some) closely.  At the very least, our government
   knows the geographic locations of these transmitters.

   Not all numbers stations are in the  same  "business."  A
   few  of  the CW stations actually identify with call let-
   ters.  The  U.S.  FEMA  organization  (Federal  Emergency
   Management  Agency),  operates  several stations and con-
   ducts periodic tests of its communications systems, which
   would  be  pressed  into  service  in the event of a war.
   Their crypto transmissions make for good code practice.


   3.1130    WGY912____US: FEMA, wkg "Sunbath", also id'd as "Bluegrass", refer
                       red to this freq as "bravo uniform" (odd, this is a USAF
                        SAC freq), xmsns every 15 minutes, usb, 02/10/87 @0305Z
                       [Mt Weather, VA] (B. Parnass)

   3.3797    WGY908____US: FEMA, slow speed encrypted cw 10/18/84, 0437Z
                       [Denver, CO] (B. Parnass)

             WGY912____US: FEMA, slow speed encrypted cw, purported to be a VIP
                        relocation site in times of emergency, 11/25/86 @0208Z
                       [Mt Weather, VA] (B. Parnass)

   4.7810    WGY912____US: FEMA, slow speed encrypted cw in 5 character groups,
                        purported to be a VIP relocation site in times of emerg
                       ency, 11/11/85 @0139Z
                       [Mt Weather, VA] (B. Parnass)

   5.1680    call?_____unidentified: several minutes of slow, encrypted cw in 5
                        figure groups, sounds similar to FEMA broadcasts but wi
                       thout station id, 10/30/85 @0230Z
                       [location?] (B. Parnass)

   6.8500    call?_____unidentified: 5 figure coded groups in slow cw, msg bega
                       n with "ATU ATU", similar to FEMA xmsns, cw, 03/28/86
                       [location?] (B. Parnass)

   9.1218    WGY912____US: FEMA, slow speed encrypted cw in 5 character groups,
                        purported to be a VIP relocation site in times of emerg
                       ency, 04/06/86 @1502Z
                       [Mt Weather, VA] (B. Parnass)

  10.4940    call?_____US: FEMA, net, test transmission ended at 1930z, usb
                       [location?] (others)

  10.8707    WGY912____US: FEMA, slow speed encrypted cw in 5 character groups,
                        purported to be a VIP relocation site in times of emerg
                       ency, 12/25/86 @1640Z
                       [Mt Weather, VA] (B. Parnass)

  14.8868    WGY912____US: FEMA, slow speed encrypted cw in 5 character groups,
                        purported to be a VIP relocation site in times of emerg
                       ency, 10/21/85 @1735Z
                       [Mt Weather, VA] (B. Parnass)

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Bob Parnass AJ9S,  AT&T Bell Laboratories  -  att!ihuxz!parnass - (312)979-5414

usenet@cps3xx.UUCP (Usenet file owner) (02/12/89)

In article <439@brambo.UUCP> wwg@brambo.UUCP (Warren W. Gay) writes:
>There are a number of illegal short wave broadcasts that are apparently
>difficult to track down (as to location).  These broadcasts consist 
>entirely of numbers (as far as I have heard at least).
>
>My question to the net (particularly to the sci.crypt experts) is 
>simply what type of encryption schemes are employed by these "air
>pirates"? The one station I've recently heard (its been a while

In the past year or two _Cryptologia_ magazine had a short review
of a book on these radio stations.  Apparently the book lists
their frequencies and makes some guesses as to what the stations
are about.  As I recall from the review, however, no one really
seems to have a very good idea of what's going on, let alone the
specific enciphering algorithms used by these unknown persons.

riordanmr@clvax1.cl.msu.edu

mn@atari.UUCP (Mike Nowicki) (02/14/89)

   These 'numbers' stations, mostly in Spanish are rumored to be signals sent
to spies in foreign countries. Some of their signals have been traced to the
east coast of N. America and some to Cuba or thereabouts. General opinion is
that they are CIA or NSA operated but no one who really knows is talking!
  Others like the N. Korean on 8.030 Mgz or the Russian numbers station on
7.422 are also believed to be operated by some government for communications
with operatives or to make the target country think they are!

  Anyone with a broad band ham tranceiver could modify it and send out
similar transmissions. The FCC knows about these spy stations and if you call
to complain about them stepping on your QSO in the ham bands they will come
back and tell you it was an international SW broadcaster tuning up or some
sort of bullshit.

  These stations have been operating for many years, some of them hourly for
over 5 years. I did a computer analysis of 3 of these types of stations and
found that strings of 3 or 4 letter or number pop up quite often and might
signify use of a lookup pad code where for example, "1AC" can be looked up
in your handy dandy copy of Popular Spy Code monthly, and find out it means
"get photo of". These codes are impossible to decode because of the one to
one relationship of strings to phrases.

  Pop Communiations has articles on these number stations almost monthly.

                    73!

                 Michael Nowicki
                 Atari Corp.



Views are my own, who cares anyway?

smb@ulysses.homer.nj.att.com (Steven M. Bellovin) (02/15/89)

In article <1349@atari.UUCP>, mn@atari.UUCP (Mike Nowicki) writes:
> I did a computer analysis of 3 of these types of stations and
> found that strings of 3 or 4 letter or number pop up quite often and might
> signify use of a lookup pad code where for example, "1AC" can be looked up
> in your handy dandy copy of Popular Spy Code monthly, and find out it means
> "get photo of". These codes are impossible to decode because of the one to
> one relationship of strings to phrases.

It sounds like you may be describing a code, as opposed to a cipher.
Codes, especially superenciphered codes, are much more difficult to
crack than ciphers, but it's been done many times in the past.  For
example, the course of both World Wars was significantly affected by
cracked codes (as well as cracked ciphers).  During World War I, the
British solution of the so-called Zimmerman Telegram was a major factor
in the entry of the U.S. into the war; during World War II, the U.S.
was reading the Japanese naval code.  (This is distinct from PURPLE,
the top-level Japanese machine cipher.)  As usual, see Kahn for details.

Mind you, I don't know that those messages really are code, but if they
are cracking them is not impossible, especially under reasonably favorable
circumstances (probably texts, etc.)

bgun@trwind.UUCP (Bill Gunshannon) (03/11/89)

In article <2982@nunki.usc.edu>, guncer@sal56.usc.edu (Selim Guncer) writes:
> In article <885@jato.Jpl.Nasa.Gov> morris@jade.Jpl.Nasa.Gov (Mike Morris) writes:
> >In article <439@brambo.UUCP> wwg@brambo.UUCP (Warren W. Gay) writes:
> >>There are a number of illegal short wave broadcasts that are apparently
> >>difficult to track down (as to location).  These broadcasts consist 
> >>entirely of numbers (as far as I have heard at least).
> >>

My only question is What makes it illegal???

Just because you don't understand it doesn't make it illegal.

As a communicator in the ARMY (for more years than I care to count) I sent
thousands of messages that consisted of code groups.  I certainly hope 
what I was doing wasn't illegal. :-)

bill gunshannon
KB3YV

bgun@trwind.ind.TRW.COM