Summary of Russians intercepting SR-71's

All the billions of taxpayer dollars that we sank into SR-71, only to operate it as a high-speed party crasher (ref. having it fly over dictators' palaces and parades). The Soviets, of course, knew it was coming hours in advance, without any need to have a spy in place either in USAF command or as a landscaping contractor near its air base.
Here is a rough translation of an email from a Russian communication intelligence specialist recalling the ease of detecting the SR-71. What a crude use of such a fine machinery!

"As far as the SR-71 in transit, I have none [i.e., data of my own - blog], however, several of them are over Barents Sea, for example, as Blimey 99, at 17:16 according to the the time marker. Opus 38, at 26:08, communicates through Gold 23 (KC-135), Croughton [RAF base - blog] does not hear, but we in Kaluga  - 5 AUs. One of the best ways to ID them is their mentioning of the real time GMT:
Op's normal at 34while RC-135, TR-1 и U-2 communicate in the 4-digit format: 0834.
[Other telltale signs] are of course, the pilot's voice, stifled by the high altitude pressure suit, the typical background noise of the radio, the Barents triangulation, then Baltics, and the KC-135Q modified for high altitude refueling, loitering along its [SR-71] route.
It always felt pleasantly reassuring to know that it was escorted by Mig-25, so it would never get lost or get bored.
[SR-71] always presented real danger, since in an hour that it spends over Barents Sea, it always detected all of our mobile SA launchers and could have directed a strike against them. We did not have the mobile launchers like the S-300, so we had to redeploy to other sites, and that was hours of hard work. That is why the main countermeasure against it was to guess its ETA, to turn off all the mobile systems, and leave only the fixed sites. Then the Dumb Yanks would come the next day, a different aircraft, and there were two of them at Mildenhall in England.
After the flight, this machine was not so reliable. Its speed up to 3200 and the latitude 25000 [was something]. One time it experienced a malfunction upon exiting Barents area, barely limped to Norway, the the HC-130 rescue was deployed, the helicopters. A week after it flew over to England, and ion another 2 weeks back home to Edwards [AFB], Nevada, all the while, by an unusual track - the way of SR only - not over the Atlantic, but over the [North] Pole and Canada, the way he reported through radio comm.
Let me know if anything not clear here, I will explain, just let me know the call sign and time of comm. Even though it has been 21 years, I still remember almost all."

Что касается SR-71-на перелёте нету, а так несколько штук в Баренцевом море есть, например Blimy 99, 17:16 по таймеру записи, Opus 38, 26:08, работает через Gold 23 (KC-135), его Croughton не слышит, а у нас в Калуге 5 баллов. Отличительным разведпризнаком SR-71 является упоминание текущего время Гринвича только в минутах текущего часа, т.е. Op's normal at 34, тогда как RC-135, TR-1 и U-2 в 4-х значном формате, 0834, 8 часов 34 мин. Ну и конечно сдавленный голос в высотном костюме, характерный фон радиостанции, пеленг Баренцево, потом Балтика, болтающиеся KC-135Q по его маршруту-модификация танкеров, сделанных для его заправки на большей высоте. И приятное осознание того, что летит он в компании двух МиГ-25, чтобы нескучно было и не заблудился. Он представлял реальную опасность, за 1 час нахождения в Баренцевом море вычислял все наши мобильные комплексы ПВО и мог навести на них удар. Мобилок, как С-300 тогда не было ,по-этому приходилось свёртываться и перебазироваться, а это несколько часов нелёгкой работы. По-этому в борьбе с ним главное было угадать когда прилетит ,мобильные комплексы выключались, оставались только стационарные. Тогда пиндосы прилетали на следующий день, на другом, их два в Mildenholl'е в Англии было. После полёта ТО на пару дней, машина не очень надёжная. Зато скорость до 3200 и высота 25000. Один раз сломался при выходе из Баренцево, еле допукал до Норвегии, HC-130 спасательные поднимали, вертушки. Потом через неделю перелетел в Англию, а ещё через 2 недели улетел домой в Эдвардс, Невада, причём по необычному маршруту, так летел только SR-не через Атлантику, а через полюс и Канаду., где и отмечался на связи. Кому что непонятно, спросите, укажите время записи и позывной, подскажу, всего-то 21 год прошёл, почти всё помню.

The intelligent and funny Russians monitoring of B-52, RC-135

P-3 Orion is"lumberjacky", and more quips of that sort.
Below is the translated transcript of the most interesting part of a cellphone conversation between OSNAZ sigint/elint veterans on the holy soil of their own motherland. One of my well-wishing acquaintances with the talent for comprehending Russian military lingo, has in his possession government-issued mobile-phone monitoring device and the sense of smell for good stuff: herebelow the veteran had monitored US and NATO dating back to 1986.

...during my time, U-2 flew only over the Mediterranean, from Acrotiri in Cyprus...they are not here...they sniffed Lybia together with P-3 Orion...
there was a war in 1986...our guy from GCCS latched on to 24 F-111 flying the England-Gibraltar-Mediterranean lengthwise route...

...transferred it to his op officer, who in turn forwarded it to Moscow, who said they [the US] won't have guts, but within 4 hours Libya no longer had air defenses, part of its navy and air force. They [the Russian monitors] did their job, they warned within 4 hours...
Instead of U-2 they flew TR-1 (the improved version) over West Germany, surveilled the GSVG (Formations of Soviet Forces in Germany)... from the altitude of 27000 and the speed of 700, had plenty to look at during the 5 hours...

The record has RIDDLE 26, time 0745, had the habit of talking directly to Croughton, not SKYBIRD...that day the call sign was SHAMROCK. The same day there was INLACK 83 at 10:04, frequently for a radio check, and 2-3 hours afterward followed up with an opreport of "normal" and 4-digit time stamp...

Radio exchange resembles RC-135, only with a different transmitter background...flight zone. RC-135 often hung around the Baltic, sent HARVARD and then BROTHER messages, who knows what that meant, but they always mentioned the nautical mile distance from the shore (of the USSR), while within the international airspace...

These flights were reconnaissance as well as for provocation, along borders. At the end of the tape there is this handsome guy, at 53:53, FLOME24, after broadcasting the 0810 time says five zero nautical miles off shore in international air space and continuing mission. Property-Croughton...RC-135: BOWK33 29:13 sends two 3-digit number messages, ISSUE40 at 30:32 sends 5 number messages...

All of the B-52 used call sign Muse, even during their training at Saragossa, Spain, with MUSE CONTROL as the base station, which was trackable as Croughton...the bombers used their own radio operators...According to the treaty with us [the Soviets] they could not remain in Europe permanently. Those were the happy days, they reported every broadcast...Mind you, the SR-71 at 59:13, call sign CURNEY83, the distinguishing number were two digits of 04, no time stamp, and that was the same guy speaking...

What's interesting is that Croughton can't hear him, and the GLADIOLA, the HQ comm center answers him...he always came across with echo...the most lumberjacky plane was P-3, call sign minus numbers, like NUS, loiters for 8 hours, hourly roars out alphanumerics, annoyed the heck out of us as well as his own guys, he was KRUPP (38:58), or ROME (57:18) over the Mediterranean...over the Baltic, the exchange was like that of RC-135, with HARVARD, BROTHER, and MIND and some more alphanumerics.

При мне U-2 летали только в Средиземном море с Acrotiri о. Крит, здесь их нет, вынюхивали Ливию на пару с P-3 Orion, в 86-м там война была, парень с GCCS словил 24 F-111 по маршруту Англия-Гибралтар-Сред. море поперёк, отдал оперативному, тот в Москву, там, подумали не посмеют, через 4 часа у Ливии не было ПВО, части флота, части ВВС. А предупредили почти за 4 часа, т.е. выполнили задачу разведки. Вместо U-2 летал TR-1(улучшенный) над ФРГ, за ГСВГ наблюдал, с высоты 27000 и скорости 700 за 5 часов много высматривал. В записи есть, Riddle 26, время записи 07:45, имели привычку выходить не SkyBird, а напрямую на Croughton, позывной в тот день Shemrock. И ещё один в тот же день, Inlack 83, 10:04, часто первый выход Radio check, через 2-3 часа op's normal время 4 цифры. Радиообмен похож на RC-135, но другой фон передатчика, зона полёта. RC-135 часто торчали в Балтике, давали радиограммы Harvard и сразу после Brother, почему так назывались, не знали, но в них всегда говорили в скольких морских милях от берега (СССР) находятся в международном воздушном пространстве. Такие полёты были и разведовательные и провакационные, вдоль границ. В конце плёнки есть такой красавец, 53:53, Flome24 после времени time 0810 говорит 50(five-zero) nautical miles of shore in international air space and continuing mission. Property-Croughton.RC-135: Bowk33 29:13, выдаёт две кодогруппы по 3 символа, Issue40, 30:32, выдаёт 5 кодогрупп. Все B-52 позывной Muese(на этих учениях), даже на время их нахождения на учених в Сарагосе, Испания, работала станция Muese-control, пеленговалась как Croughton, просто свои люди сидели для бомберов. По договору с нами постоянно базироваться в Европе они не могут. Докладывался каждый выход на связь, были весёлые дни. Обрати внимание на SR-71 59:13, позывной Curney 83, отличительный признак время в двух цифрах 04, без указания часа, так говорил только он. Но интересно, что Croughton его не слышит и отвечает ему ВКП ГК в Атлантике Gladiola, его всегда было слышно с эхо. Самый дуболомный самолёт-P-3, позывной слово без цифр, как у НУС, летает 8 часов, орёт каждый час буквы-цифры, доставал и нас и их, если в Сред.море, Krupp 38:58, Rome 57:16, Если в Балтике, то на RC-135 радиообмен похож, Harvard и сразу после Brother.Mind, 46:56, и ещё буквы-цифры.

The real Bolshoi ballet of antennas

I am absolutely fascinated by Russians' obsession with radio snooping. That mean that Russia must be bristling with antennas.
Kitty corner from the Leningrad (Saint Petersburg) Metro's Line 3 terminal station Primorskaya, the there is an office building with this Swan Lake of antennas. The location is great - it looks out over the Gulf of Finland


On Veshnyakovskaya st., bldg. 9, section 2 there is this farm.
You could understand the location of Leningrad tracking antennas. But what foreign traffic :-) is there to monitor in the heartland, in Moscow? Maybe Russians know better - in Butovo they do have one of many tracking stations for monitoring foreign radars(???).
The wind speed-looking device is not for measuring wind speed . The real name for it is HE314A1.


It is BKAS (БКАС), active in the 150-3700 MHz range, vertical polarization.
My fdriends have also reported that the same type of natenna farm is found on the roof of the building at Bolshaya Olenya Street, 15A (55°48'30"N 37°41'26"E), which is the Radio Tracking Center co-located with the Central Design Institute of Communications No. 17, a. k. a. the military unit (В/ч) 25801.

This is most likely a R&S Doppler triangulation antenna, seen on the roof the both buildings is R&S PA055, that has 16 vertical concentric dipoles, and covers the 20-1000 Mhz range.

The second photo also shows this skirt-like antenna between the parabola and the umbrella-shaped antennas. The famous R&S HK014, for receiving omnidirectionally anything in the 80-1600 Mhz range:

Interesting NSA-like spectra of signals caught over Leningrad

There are two predictable channels, all active this weekend, understandably as Russia got all hot and bothered and rattled sabres at Poland.

In the second screenshot, the Wave application in the Skip One Sample mode shed some light on the high rate transmission session.

The Code300 equipment have been useless. Note the characteristic flower pattern of the SK material. A while later a directional info0matiuon has been obtained, placing the source of the signals somewhere in the environs of the Kirov shipyards, aimed at Russian cruisers scurrying around in the Baltic just east of Poland.

A little bit of Russian diplograms across the Baltic during the Georgian fray

Just to be cheeky, hereunder I bring you a sample of a Russian Diplomatic message sent this Saturday most likely either from an antenna farm in northern Russia, or from a Slava-class cruiser based in Kaliningrad westwards to an embassy in Copenhagen or London.

Their are still using the true and tried 20-tone MFSK.
Here is the transmission decoded:

33333333333YYYYYYYYYYYYYYYYYYYYYYYY3YYYYYYYYRRRRRRRRYYYYYYYY RRYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYRRRRRRRRYYYYYYYYYYYYYYYYYYYY3YYYYYYYYYYYS9
block sync
44444444444444444444
block sync
825 825 825 1 825 825 825 1 825 825 825 1 S9S9S9S9S9S9S9S9S99S9S9S9S9S9S9
block sync
44444444444444444444
block sync
4MMMMMMMMMMMMMMMMMMM 01853 03163 29583 62608 85848 20890 32229 47135 33407 01770 17829 29581 45886 18313 64193 84251 03877 14691 85520 51668 51392 97315 92028 58289 97780 86264 57560 26044 56769 76566 71984 78741 96125 82152 92638 18078 80783 12147 82868 94553 00621 94296 11650 04592 05130 05154 30534 14159 15260 64338 11984 67929 77386 73687 77328 81014 75848 43731 69507 83252 17342 71045 68924 65525
block sync
99481 76088 79303 0M871 25937 10116 72734 07113 02604 26174 70409 28835 20009 94220 29759 32628 57604 26642 95017 00115 92616 89331 70493 19462 18539 99399 08531 22668 28656 34746 19424 34051 05205 36361 55293 42453 81253 59983 79552 32527 87120 93334 03071 37980 89417 59675 09082 71198 60251 23574 49641 12374 97985 37176 01615 59203 00971 42814 93426985912 91039 16372 84963 09709
block sync
40051 20229 01134 87393 63119 79089 92815 76114 32335 14460 08450 53790 14615 18880 33373 39165 61725 05102 28457 98259 795M3 91277 30424 83432 07990 96001 68014 41459 25815 92978 49783 94985 01336 45337 17339 73020 77269 33542++++++++++++++++++3333333333

Again, this is a decoded transmission, not unbuttoned, (not deciphered). Of course, they are using a one-time pad, (note the 5-digit groups)

Also worthy of note is the S6 and S9 number station-like S code, which is associated with the Russian Man numbers station known for saying funny and innocent things in English.

OSNAZ (ОСНАЗ) SIGINT center in Cuba

The following photos are of the OSNAZ regiment (в/ч) 54234-В, Lourdes. More detailed shots of the installation interior and the men to follow as they (gradually) become available.





The white building in the center of the photo below is the main monitoring center. Here the enlisted servicemen manned short-wave communication. Equipment repair shack is to the left. The antenna farm is in the background. The main antenna could be rotated to fine-tune the reception.

Russians reactivating their SIGINT sites?- another secret list

I just played with the idea of sending out our spybot again, just for the heck of it. It came back with this wild and cool, NSA-grade material. Some of the bot returns is in a confusing encoding that would not paste here intact. I translated wherever I could, with the help of our good old military adviser. This center does not seem to be on the list, nor this radar site is associated with anything herebelow.

The bot reports of GRU units seem to be poised for activation, relocation or inventory.

The (!) GUDOK (ГУДОК), 215- or (в/ч) 34608 th regiment
309 ЦРПУ ОСНАЗ (the central radio transmitting center)
250 ОРТП ОСНАЗ ГСВГ г. Штендаль (the OSNAZ unit in the city of Stendahl)
GRU's БП630 and the 16th KGB directorate (управления КГБ). Some of our specialists says this is not ОсНаз, but a special СС service (специальная служба).
The following regiment numbers:
в/ч 51952 (in Nerastannoye, near Moscow, Chekhov region - Нерастанное, Московская обл., Чеховский р-н)
В/ч 61519 in Novosibirsk region, Новосибирск обл.
в/ч 61615 in Rustavi (Georgia?)Рустави (Гардабани)
в/ч 61330 Odessa, Ukraine г. Одесса, п.Акаржа/ Аккарже, and Ovidiopol (Овидиополь-2)
в/ч 61608 Tzaritzino, (Царицыно)

The data groups below is a result of the bot having converted a table to text, a la MS Windows.
The order of the data - the number of the communication center, the name of the communication center, the locale, military outpost/regiment/detachment number, the channels (ТЛГ/ЗАС/Титан)/frequencies, and activity notes.

215 GUDOK, Moscow reg., Klimovsk, 34608; 210,230,255,285,280 (training only), 220, 200, 205, 265, 260, 245;
210 SHIPUN, Petersburg reg., Gatchina, Tayvorovo, 41480; 215, 230,255
230 GRANULATZIA, Murmansk reg., Kildinstroy, 34630 215,255,210
255 JUMPER, Komi, Vorkuta, 34575; 215,210,285
285 TELEGA, Krasnoyarsk reg., Tiksi, 14145; 215, 255, 240, 220
280 NATRIT, Chukotka, Beringovsky, 51595; Channel for training, alternatively for the use by ZVEZDA
220 NAVESKA, Khabarovsk reg., Sergeyevka, 48260; 215, 240, 285
200 SPOLOKH, ex-NARCOTIC,Irkutsk reg., Oyek, 51870; 215, 220, 205, 240
205 GEOTHERMIA, Kazakhstan, Alma-Ata reg., Shengeldy, 48253 (86621); 215,200. 265
265 BEDRENNYY, Turkmenia, Ashkhabad reg., Geok-Tepe, 34639; 215,260,205
260 RAVNYY, Georgia, Gardebani, Kajory, 51868; 215, 265, 245,
245 PRIBORKA, Ukraine, Odessa, 42028; 215, 260, 210,
408 LAYBA, (ех LASTIC), Ryazan reg., Spassk-Ryazansky, 02565 Reserved for deployment during maneuvers at the range
240 GAZOMETR, Yakutia, 71300; 220-200-205
??? ARCHA., Kaluga reg., Tarus, 34080; Krug facility. Classified
270 BARCA, Cuba, Lourdes POBox 247, 54234;
??? SHATROVYY, Azerbayjan, Akstafa, ZVEZDA-controlled
??? TREZUBETZ, Moscow reg., Shchelkovo, 51428 The ZVEZDA center
??? ??? Petersburg reg., Pavlovsk, 86622 OSNAZ training untis
AVRORA (Аврора), Moscow, The УС ГРУ ГШ Center
OASIS, Kaluga, Echelon 2, KOMETA air defense-controlled

more of the related data de-tabulated, seems to indicate the current, pre-activation status of some of the above and other installations:

47 ОРПУ Irkutsk Оёк) в/ч 51870 - передан в "Звезду"
50-й ОРПУ (Тикси-1 Морская,) в/ч 14145 "Телега"
99-й ОРПУ (Якутск)
309-й ЦРПУ ОБКЗ (Климовск Школьная,50 в/г «Гривна») в/ч 34608 "Гудок" сф 51г (51-73гг в/ч 71513 )
789-й ОРПУ (Спасск-Рязанский Войкова,2 + п.Панино - полигон) в/ч 02565 "Ластик" сф 42г 811-й ОРПУ (Мурманск п.Кильдинстрой Разина,8) в/ч 34630
902-й ОРПУ (п.Беринговский) - передан в "Звезду"
-й ОРПУ (Дисдорф, ГДР) в/ч 33947 "Горка" - расформирован
-й ОРПУ в/ч 34635 "Грануляция"
-й ОРПУ (Гатчина п.Тайворово) в/ч 41480 -"Звезда"
-й ОРПУ (Одесса п.Верхний Дальник) в/ч 42028 "Приборка" - передан в СБУ Украины
-й ОРПУ (Торенс, Куба) в/ч 54234 "Тростник" - выведен в Гатчину, оперативно вх. в состав "Звезда"
-й ОРПУ "Охрана"
-й ОРПУ "Оазис"
-й ОРПУ (Воркута) "Джемпер"
-й ОРПУ (Ашхабад п.Геок-Тепе) - расформирован
-й ОРПУ (Алма-Ата п.Талгар) - передан КЗ
-й ОРПУ (ГДР) "Низина" -
-й ОРПУ (ГДР) "Марион" -
-й ОРПУ (Монголия) "Горизонт" - в состав "Звезда"
-й ОРПУ (Камрань, Вьетнам) "Восток" - принадлежал ВМФ,
-й ОРПУ (Рангун, Бирма) " " - "Звезда", расформирован
101-й уч.ОРТП ОсНаз (Павловск Обороны,1) в/ч 86622 расф 98г

***

and this bonus is the Russkies' record of having intercepted a radio transmissions from a B-52 returning from the Max 2007 airshow:
28.08.07., 6761 кГц ,
18:36 Tuff 01 -> Quid 82 "I'm looking contact with Quid 80"
18:40 Tuff 01 -> Quid 80 "Arsp. time 17:00z, altitude 280, frequency 264,125"
11175 кГц
18:50 Tuff 01 -> Croughton "Dep.: Moscow 13:30z, ETA: Barksdale 02:30z"

***
well, what do you say? I am not that impressed... because I am jaded. Putin asleep at the wheel? Would you like the bot to get his credit card numbers, or his Football briefcase combination? Does a Yankee White carry this for him? Inquiring minds want to know.

Recce of French Embassy

The joke from a late-night show that seems to be appropriate for this post - "an ad on Ebay: French rifle, never fired, dropped once."

Most people don't think much about what the French are up to, but they are not behind the leading militaries of the world, and the same is true in the sense of their electronic warfare and intelligence.

Our man in Moscow (not the one that contributed here, nor here)- I know it sounds corny - has been lucky to gain a vantage point from where he succeeded to take a digital look at the French Embassy in Moscow. Don't ever underestimate the French.


You would have thought that this group is just a regular planar spike, but the upturned direction of the whips and the Rode & Shwarz HF dipole with an attenuator testify to its unexpected use.


this is a look from a yet different (I could only wonder) vantage point:

and these thistle whips - according to additional sources, whatever you may call these spikey finials, they have been known to radiate the most exotically encrypted traffic (some of which, unbuttoned, we will publish soon) you could pick up in this city. Note the magnetic antenna to the right of the R & S rig:



and here the gentlemen from France (remember Saturday Night Live's Coneheads? "We're from France!") have installed what might look like an average TV antenna, except - remember not to underestimate the French! - the rig and the microwave minisaucer further to the right are all aimed at the Russian Defense Ministry building.



beside being an average rooftop, they surely had to have the modest suite of satellite dishes.

and this standalone dish is accompanied by an interesting and shy Yagi-esque rig and a satcom disguised as a barstool:


as a collateral lesson from this recce exercise we have learned to appreciate the French taste for stylish rooftop radio shacks.

Next posts:
Centerfolds of KGB and other communication centers in Byelorussia, the land where communism never died
The candid shots of Russian listening outpost on Cuba, the site which has never ceased to operate.

Airport, Mooonscape and Diplograms

In this post:

PICTURESQUE RECCE EXERCISE
SLANT IMAGERY OF RUSSIA'S NOVA TERRA
DIPLOMATIC TELEGRAM ANALYSIS

We have been away, but not idle. We have met a bunch of interesting people, one of them is a former Tu-154 pilot who now flies for a discount airline. We call him Captain Alex, and he likes to take pictures in flight, from his pilot's seat. Here are some of the pictures that also serve us a breathtaking material for recce exercise.

Vnukovo Int'l Airport this winter.
The newly built, partially underground railroad spur serving the passenger terminal is visible to a knowledgeable analyst. The Russkies feel the bulge in the petrowallets, hence they feel that they can built some more megalomaniac projects to the airport.

Captain Alex took the picture and self-censored himself at that. The famous 06-24 runway is cut off below the photograph, because it serves the Government Terminal. Captain Alexey, however, was flying high and fast when he took the pictures below:



We can see the Government Terminal as the grey, black and brightly lit rectangular area towards the far (24) end of the 06-24 runway, below the T-juntion of the highways.

SLANT IMAGERY OF RUSSIA'S NOVA TERRA

Novaya Zemlya, that is. A high-level official who is actually in charge of declassifying DOD materials, has released the following imagery on condition that no other details would be divulged. The material has been declassified, but still has the stuck-in-limbo FOUO (for offficial use inly) markings.
Thus a special recognaissance platform that still remains classified is capable of obtaining imagery at extreme slant angles. That means the method is equivalent to a person shooting landscape phtographs from the ground level. Here is an image inside Severnyy, a Russian outpost on the lunar landscape ravaged by catastrophic nuclear explosions. The angles are marked on satellite map for visualizing the orientation of elements in the photograph.

What are these Russkies up to nowadays? What goof-ups can they suprise us with over there?


DIPLOMATIC TELEGRAM ANALYSIS

A certain someone sent in this telegram, fully confinced that it is a Russian code-word or other type of code text.

It is sufficient to have studied comparative analysis of Slavic languages to spot Bulgarian suffixed articles ( -te, -to) at the end of the nouns. As far as we know, no other Slavic country uses Latin X to represent the "sh" sound. Our contributor is an avid ham radio operator who claims this was a RTTY message sent in an easily decodable diplomatic format. Note the year. We have some really recent material, but are being very careful with what we release.

Good luck to us all, and happy new moon month.

The stolen Russian intelligence

Military and government professionals know how the importance of keeping classified information within secure environment. The transgression could cost someone his career, or the indelible, unforgettable wound on his consciousness that thousands hours of work and government's priceless  intelligence gathered through painstaking effort has  fallen into the hands of unsuspecting at best, uncleared civilian. The lesson learned by a Russian SIGINT professional is related below in its original, contributed by a radio amateur.

The SIGINT specialist had a keepsake tape made for him of the best moments from Russian radio surveillance of US Strategic Command and other sorties. On the way home, he could not stand the temptation to let an accidental fellow traveller listen to the tape and later on stealing the tape. The story is heartbreaking, to say the least.

Насчет пеленга я не знаю, какими антеннами они работали. На пеленгаторе сидело три срочника (обычно дембеля), так что им этот пеленг был до одного места. Обычно на рядовые самолеты (транспортники REACH, то есть С-130, С-5, С-7), заправщики и тому подобное пеленг был никому не нужен. И в таких случаях мое общение с пеленгаторами выглядело так:
Я сижу на посту, решаю от скуки взять транспортник на ГКСС. Слушаю, что он дает информацию, что примерно прибывает на Гейленкирхен через 2 часа, на борту 10 тонн груза, просит погоду. Даю команду на пеленг: "Работает 9011". Пеленгатор тут же спрашивает: "А что там за самолет то?". Я отвечаю, что транспортник. Он после этого тут же забивает на пеленг совершенно. После прослушивания я спрашиваю:"Ну что, пеленг давай". Меня просят сообщить, что же я там услышал. Я говорю, что он летит в Германию, прибывает через пару часиков. После этого пеленгатор отвечает:"Ну запиши там 230 градусов". Это так происходило чаще всего. Если самолет посерьезней, то они что то старались изобразить, и даже иногда получалось. Но каким образом они это делали и какие антенны использовали я к сожалению не знаю.
Что же касается позывных, то их основные типы были известны, то есть какой самолет под какими позывными летает. А вот предполагаемые частоты и позывной на отдельные случаи обычно почти всегда приходит по ориентировке. Что же касается содержания радиообмена, то не всегда (исключительно на собственном опыте) можно определить тип самолета, так как военные самолеты, выходящие на ИКАО ничего не говорят, а всего лишь дают три точки своих координат и уровень полета и все. И даже на ГКСС не всегда удается понять, что за самолет, так как на моей памяти бомберы, запрашивавшие канал связи со своей авиабазой обычно никакой информации туда не давали, просто говорили расчетное время прибытия и давали Operations normal, то есть, что полет проходит нормально. А подтверждение тому, что это бомбер я обычно получал, когда оператор сам их просил назвать тип самолета и они говорили его. На ИКАО я однажды по ориентировке ждал перегон тактики 07.06.97. С Европы на континент гнали стаю F-15. Называлось все это движение Coronet East 135. Работали они на частоте ИКАО с ЦУП Нью-Йорк на 13306. Постоянно выходили заправщики КС-135 под позывными BLUE 71,72,74,82,84. Давали координаты и высоту полета, ну как обычно, причем эшелон периодически опускался до 210-230 для дозаправки. Шли они по точкам 43n 43w, 44n, 45w, 44n, 50w. Потом у одного из заправщиком состоялся разговор с оператором Нью-Йорка, где пилот сообщил, что они Коронет Ист 135, причем проспеллировал название, и сообщил позывные тактики, то есть истребителей. Выглядело это так:" New York this is Blue 71. We are Coronet East 135. We have Mazda 31, Mazda 32, Mazda 33, Mazda 34, Mazda 35 and Mazda 36". Все это он еще раз проспеллировал и дал очередные координаты. То есть в принципе если бы не ориентировка, то я бы, не зная, что все это значит, даже и значения этому бы не придал. В основном конечно все заранее известно по ориентировкам, но для меня и был главный интерес, когда заранее зная какую то информацию, находишь самое явное ее подтверждение.
Насчет поста, то я не знаю, как же сделать так, чтобы меня все же взяли. У меня ведь из моей части остались подтверждения допуска и тому подобное. Но я думаю, что это покажет разговор с командиром части.
Самое интересное, что самые волнительные моменты, причем записанные при идеальной слышимости (ну это было качество почти как в студии, почти полное отсутствие шумов и ясные, четкие голоса), причем на кассете было все: бомберы, разведчики, АВАКС, причем не просто выходы на связь, а разные интересные моменты, так вот, такую кассету, выстраданную за полгода (ведь не всегда такая идеальная слышимость и разговоры необычные) я вез на память домой. И вот в поезде из Улан-Удэ с нами ехал дембель какой-то танкист, что ли. Мы ему дали на плейере послушать, он был отрясен, хоть и не знал английского, и вероятно попросту ее спи...дил, чтобы в своей родной деревне девкам давать слушать и рассказывать байки, каким он был отважным танкистом-радиоразведчиком. Он у меня еще в поезде спрашивал, нет ли еще такой кассеты, а то бы подарили ему. Я даже и подумать не мог, что она ему так в душу запала. До сих пор вспоминаю, сердце кровью обливается, в прямом смысле. Мы на дембель сравнивали, у кого самые интересные записи и по качеству слышимости. Так вот эта кассета лидировала тогда с огромным отрывом. С каким бы безмерным удовольствием я бы ее сейчас выложил вам, друзья!!!! Качество ее было просто студийным, поверьте на слово! Какая же сволочь этот танкист...

(source) You wish you could relearn Russian again.

Russian Radio Surveillance Center

One of our Moscow-touring friends who also happen to have an admirable college education and a sharp eye for all things hi-tech, secret and Russian, has stumbled on (surely one of many) Russian Federal radio surveillance center, for decades having been tucked next to Butovo, a quaint village next to Moscow. The giant city by now has swallowed up this village and given it a subway station, but the pictures disclose an intriguing side of the Russian heartland.

As one would expect from similar outpost anywhere in the world, the most exciting, government secrecy, hi-tech installations usually occupy a non-descript, humble, pastoral house just like this



Just when our friendly photographer had finished taking the pictures, he was approached by a serious looking but polite plain-clothes officer-type, and asked for ID. Speaking perfect Russian, but having a foreign passport, our photog seemed to have placed the officer into an uncomfortable predicament, which was resolved by our photog offering to erase the pictures from the Flash card. Herein lies a comment on the IQ of Russian well-dressed gentlemanly perimeter guards. He accepted the offer smilingly and bid our photog farewell, the images safe in the camera's memory.

And just to show that this is not your average ham radio club, feast your eyes on what must be a Western-import, most probably Thomson, interferometric tracking array, adapted to one of those numerous, Russkie-ingenuous radio spectrum snooping ideas. Birch trees look Pasternak-esque, don't they?


Could anyone name this if it was an abstract sculpture at the Burning Man festival?

Numbers stations, CPU signals, Russian poker

The numbers station have been outdated. The new smart and wily kid on the block is actually the old cyphertext. Not only does the text look innocent, having been encrypted with NORVA, but it also serves as a vehicle for unrelated, second purpose messaging.

Thus, a message in NORVA

LITTLE JENNY TAKES SAWFLY LINE LEAF RISES SUNNY DAY

Besides conveying a message the likes of

DO NOT SEND DATA CHANNEL BRAVO KEEP GOLF OPEN

The secondary meaning of the NORVA is

573917739

which could stand for anything, unrelated to the plaintext.

@@@@@@@

The new methods of the side-channel attack are the CRT diffuse visible light scan (link to PDF), CPU’s HLT state pickup, HD head seek scan.

It is also possible to distinguish various behaviors of CPU and memory operations. This is observed for artificial cases, like cycles of various CPU instructions, as well as for real-life cases, like RSA decryption.

A low-frequency acoustic source yield information on a much faster CPU in two ways. When the CPU is working on a long operation, it creates a characteristic acoustic spectral signature. Second, the temporal information about the length of each operation is obtained, and this can be used to launch a timing attack, especially when a cryptomaster can affect the input to the operation.

The valuable acoustic information lies above 10KHz, whereas typical noises, including computer fan noise, are found at lower frequencies and can thus be filtered out by proper equipment. In a task-switching systems, different tasks can be distinguished by their different acoustic spectra. When several computers are present, they can be told apart by their unique acoustic signatures, since these are dictated by the hardware, the component temperatures, and other environmental conditions. Very similar to working submarine passive sonar. Here is when SALWISS comes in handy.

The CPU instruction that is the least difficult to detect is the 80x86 HLT instruction. This instruction puts the CPU into a low-power sleep phase until the next hardware interrupt. Modern CPUs temporarily shut down many of the on-chip circuits, thereby significantly lowering power consumption and altering acoustic emissions for relatively long time. The difference between active computation, which never involves HLT instructions, and an idle CPU, where the kernel executes HLT instructions in its idle state, is very distinct. If the only program open is a cryptographic application, then this already suffices to detect the moment the program wakes up for input and when it finishes its cryptographic tasks, and this information can be used to launch timing attacks. There are, of course, other, subtler acoustic cues that carry detailed information.

***********

I hope more of you knew of Alexander Zaporozhsky. He is the one who helped CIA to bust Hansen. The Russians outsmarted Langley by letting Zaporozhsky visit Moscow unencumbered, building up his feeling of a secure status quo. His last visit was a result of his own yearning to come, entirely oblivious to the intensive operation culminating with his arrival in Moscow for the last time, putting an end to his cushy life in a Maryland suburb.

It seems (hoping against hope that it is no more than “seems”) that while the US security organizations are preoccupied with politically correct policies reflecting the views of new world order, grand new democracies and nation building, Russia, now rid of ideologies that used to guide USSR and KGB till the point of bankruptcy, has succeeded in streamlining its security operations into a no-nonsense, low-profile, mean, lean spying machine.

Nobody got lucky with the original NORVA message (see below).