Category Archives: Numbers Stations

Numbers station HM01…and Ana Montes

Downloads-001Wednesday morning, I suppose I had number stations on the brain.  It was no surprise, as I had just watched The Numbers Station the previous night.  Nonetheless, I experienced a rather strange coincidence:  I was reading an intriguing article about Ana Montes, “one of the most damaging spies in U.S. history,” when my shortwave radio–parked on 5,855 kHz–suddenly began to fire out an eerie series of numbers and data bursts from the Cuban numbers station, HM01.  It was, unquestionably, the perfect accompaniment to the words I was reading.

A reader sent Montes’ story–written by Jim Popkin for The Washington Post Magazine–which made for fascinating reading. And as I read the account of Ana Montes’ rise in the ranks of the DIA, while simultaneously becoming one of Cuba’s most important spies, I remembered that it was actually Montes’ case that reader Dirk Rijmenants’ referred to in his paper, and that we posted earlier this year.

A "cheat sheet" provided by Cuban intelligence that Ana Montes used to help her encrypt and decrypt messages to and from her handlers. (Source: FBI)

A “cheat sheet” provided by Cuban intelligence that
Ana Montes used to help her encrypt and decrypt
messages to and from her handlers. (Source: FBI)

Popkin’s account of Ana Montes’ life, character, promotions within the Defense and Intelligence Agency, and the sequence of events that led to her FBI investigation and imprisonment, are the stuff of spy novels. And of course, he  mentions numbers stations:

[Montes’] tradecraft was classic. In Havana, agents with the Cuban intelligence service taught Montes how to slip packages to agents innocuously, how to communicate safely in code and how to disappear if needed.[…]

Montes got most of her orders the same way spies have since the Cold War: through numeric messages transmitted anonymously over shortwave radio. She would tune a Sony radio to AM frequency 7887 kHz, then wait for the “numbers station” broadcast to begin. A female voice would cut through the otherworldly static, declaring, “Atención! Atención!” then spew out 150 numbers into the night. “Tres-cero-uno-cero-siete, dos-cuatro-seis-dos-cuatro,” the voice would drone. Montes would key the digits into her computer, and a Cuban-installed decryption program would convert the numbers into Spanish-language text.[…]

On a side note, as Rijmenants points out, using a computer to decipher a numbers station was both unnecessary and risky.

The story continues:

Ana Montes

Ana Montes

[…]On May 25, 2001, [an FBI team] slipped inside Apartment 20. Montes was out of town with Corneretto [her boyfriend], and the FBI searched her closets and laundry bins, paged through shelves of neatly stacked books and photographed personal papers. They spotted a cardboard box in the bedroom and carefully opened it. Inside was a Sony shortwave radio. Good start, Lapp thought. Next, techs found a Toshiba laptop. They copied the hard drive, shut down the computer and were gone.[…]The documents, which Montes had tried to delete, included instructions on how to translate numbers-station broadcasts and other Spy 101 tips.[…][…]Later that day, an FBI evidence team scoured Montes’s apartment for hours. Hidden in the lining of a notebook they found the handwritten cipher Montes used to encrypt and decrypt messages, scribbled shortwave radio frequencies and the address of a museum in Puerto Vallarta, Mexico, where she was meant to run in an emergency. The crib sheets were written on water-soluble disappearing paper.[…]

The story Popkin recounts, though, paints the picture of a very complex operative. One who, until discovered, was very successful at her craft.  She pulled the wool over the eyes of the DIA and spied for the Cuban government for many years.

The story is complex, and Popkins’ account somehow maneuvers through the twists and turns.

If you want to experience what I did–if a little less coincidentally–click here to read Popkin’s full article, and meanwhile play this recording I made of the Cuban numbers station HM01, below:

Note that the year Montes listened to the Cuban numbers station on 7,887 kHz, it only contained numbers–unlike the recording here of HM01 (Hybrid Mode 01) which contains both voice and RDFT data bursts (which you can also decode, but not necessarily decipher).

This recording of the Cuban numbers station HM01 was recorded on April 24, 2013, at 10:00 UTC on 5,855 kHz in AM. Click here to download the recording as an MP3.

Again, click here to read Jim Popkin’s full story of Ana Montes on The Washington Post Magazine website.

Spread the radio love

No-Spoiler Review: “The Numbers Station” with John Cusack and Malin Akerman (no spoilers)

The-Numbers-Station-PosterThe following is a no-spoiler review, as I assume many of you may be waiting for the film to hit the big screen, and I wouldn’t want to reveal any cinematic surprises.

We first mentioned The Numbers Station back in late 2011 –and admittedly, I was eager to see public attention drawn to this public-yet-covert shortwave communications medium that’s still in existence today. Indeed, it’s no wonder that a numbers station became the subject of a film; the subject is truly mysterious. Only a few days ago, while describing numbers stations to a visiting friend who had never heard of them, I played a recording of a numbers station that I made last year–her initial response upon hearing the recording was, in her words, that she experienced “chills” running up her spine.

But what is a numbers station?

Numbers stations, for those of you not familiar with them, are shortwave radio broadcasts that contain only strings of what seem to be random numbers.  In truth, these numbers are encrypted messages for operatives in the field (otherwise known as secret agents). The operatives tune in the station with a simple shortwave radio, then decode the message with a one-time decryption key.  Once the message has been deciphered, the message pads are immediately burnt or destroyed (or, at least, they’re meant to be…).  Oddly, even though this is a very public communication which anyone with a shortwave radio can hear, only one or two individuals will likely ever decode the message.  Such messages have been known to exist in a variety of languages at least since the time of the Cold War, but strangely did not conclude with the Cold War’s supposed end–they are ongoing even today. (Click here to check out our other numbers station posts.)

John Cusack as Emerson (Photo: Image Entertainment)

John Cusack as Emerson (Photo: Image Entertainment)

The Movie

In the movie The Numbers Station, John Cusack’s character, Emerson, is a seasoned field operative–a “black-ops” agent–who faces a life-changing dilemma in the field which places his career in jeopardy.  In an attempt to give Emerson some time to reconcile his emotions, his leader (Liam Cunningham) assigns him to what should be a simple, routine assignment: to protect Catherine (Malin Akerman), a cryptologist who broadcasts at a rural remote numbers station in the UK.

Things go terribly wrong when the station is compromised and Cusack finds himself again facing the same dilemma that sent him to this assignment in the first place: whether to  “retire” his asset (namely, Catherine) in order to fulfill his duty, by cutting off loose ends? Or will his conscience–and tenuous friendship with Catherine–take him in another direction? It’s a difficult ethical dilemma, one Emerson has been attempting to avoid.

Malin Ackerman as Catherine (Photo: Image Entertainment)

Malin Akerman as Catherine (Photo: Image Entertainment)

I’ve seen a number of John Cusack films over the years, and while he’s an extraordinary talent, The Numbers Station unfortunately doesn’t quite allow us to see his full range as an actor simply because his character, Emerson, is stoic and quite introspective. But the chemistry between Emerson and Catherine is complex and tense, and one can’t help but believe he cares deeply for her.

On the action front, The Numbers Station is a much greater success:  pacing is good, with a few moments to collect your breath; still, there’s always looming conflict. The bulk of the film is set in a dimly lit, underground bunker-come-numbers station, and there are actually very few shoot-’em-out scenes, yet the tension and suspense are constant.

I won’t comment on how the plot resolves, but I can say that if you like dark films with tension, moral decisions, action, and intrigue, this is well worth watching.  I enjoyed it.

Moreover, if you love shortwave radio, and are intrigued by numbers stations, you will be pleased to discover that this film treats the concept with due respect and more accuracy than I would have anticipated.

(Photo: Image Entertainment)

(Photo: Image Entertainment)

How accurate is The Numbers Station?

While those who write about numbers stations have presumably never worked for one, there’s an existing body of knowledge out there built on thousands of hours of listening, cataloging stations and even court documents from cases involving spies.  This gives us a fairly accurate idea of the true nature of numbers stations.

Likely inaccuracies

  • Though it is possible, I have never heard of a numbers station which has a live voice behind the microphone, reading numbers; these would most likely be advance-recorded or computer generated.
  • In the film, Malin Akerman’s character, Catherine, only seems to read a string of numbers for a matter of seconds, not minutes; in reality, this would take much more time.
  • I heard no preamble of numbers to ID the correct decipher key.

And yet…likely accuracies

  • In the film, under standard operating conditions, no one at the station knows the nature of the messages being broadcast–this reflects a probable fact about such stations.
  • The numbers station is located in a rural and remote part of the UK, a convincing setting for a numbers station (though some may broadcast from major broadcasting sites).
  • Once the station has been compromised, Cusack’s character explains in some detail how numbers stations work on the operative’s end; this description is very true to what is known or believed of actual numbers stations.

So, should you see it?

I anticipate that most any shortwave radio enthusiast will enjoy The Numbers Station. As a non-movie-reviewer–in other words, as a regular joe public movie-goer–I give it 8 stars out of 10.  Go ahead!

Click here for show times and on-demand viewing.

If you’ve seen The Numbers Station, please comment below.

Videos: The Numbers Station Trailer and Featurettes

The official trailer:

Video Clip 1: The Assignment

Video Clip 2: We need that cypher

Featurette

Spread the radio love

North Korean numbers station detected; possible submarine instructions?

The website Intellihub.com features an Op Ed piece regarding a recently detected numbers station supposedly originating from North Korea. The station, reported by a ham radio operator, is in single-side band and adjacent to the Voice of Korea.

Below is an excerpt from this Op Ed piece; note my comments following:
NorthKoreaMap

(Source: Intellihub.com)

Within hours of South Korean news sources breaking a story that several Sang-Ho class submarines had disappeared from their North Korean bases, a ham radio operator named Tim, picked up a “numbers station” broadcasting on the same frequency as “The Voice of Korea” propaganda station. [check out our recent post]  What makes this even more interesting is that at the tail end of the numbers transmission there was a long duration digital transmission as well.

So what makes this number station significant is the proximity in timing to the disappearance of the San-Ho class submarines, as well as the digital transmission.

[…]What is more significant is the digital signal at the end of the transmission.  Digital transmissions such as this one may indicate the presence of a burst transmission which contains a compressed and encrypted message bound for some covert force, somewhere.  Typically a burst transmission is used to minimize the download time at the end point to prevent discovery.  The unusual part of this potential burst transmission is being attached to a numbers station as well as the length and the power of the broadcast.  Normal burst transmissions are in the one second to two second range.  This transmission was in the 10 to 15 second range which is almost unheard of, unless the end point is a submarine.

[…]The ham operator who picked up this particular transmission was located in the Midwest of the United States, and he reported the transmission was received 4 by 5 indicating a significant power was used to send the transmission.  That level of power coupled with the length and possible submarine end point opens up a new and alarming tangent to this escalating conflict. It is important to point out that the numbers are being read in Spanish but that is typically done to confuse the original source of the transmission.  In this case the transmission was detected on a upper side band of the AM range used by the Voice of Korea so while the numbers are Spanish the transmission does appear to originate in North Korea.  That fact coupled with the missing submarines seems to provide evidence of the nature of the transmission despite being in Spanish.  Its also important to note that the numbers being in Spanish could also be used to employ a different set of codes in the operatives code books.

Short digital bursts, as they describe, are not necessarily that uncommon since the Cuban numbers station,HM01, has been doing this for years.  (Indeed, perhaps North Korea got a little help from Havana?) You can hear audio from HM01 here and here and learn how to decode RDFT (HM01’s digital mode) here.

Read the full opinion article on Intellihub.com.

Thanks to Dan for the tip!

Spread the radio love

Rijmenants’ paper sheds light on Cuban numbers stations

WFL_015I’m always amazed by the remarkable talents and extraordinary knowledge of SWLing Post readers. Dirk Rijmenants recently commented on one of our Cuban spy numbers station postings:

[T]hanks for your work on this fascinating blog.

I have additional information on how and who used these Cuban numbers stations. I composed a paper based on FBI and court documents. “Cuban Agent Communications” can by found in the Papers section of my website.

Here’s the direct link (pdf):
https://www.ciphermachinesandcryptology.com/papers/cuban_agent_communications.pdf

Have fun reading!

Dirk Rijmenants
Cipher Machines & Cryptology

I’ve read Dirk’s paper, which does, indeed, shed light on the process of receiving and decoding numbers. Most of all, it exposes the vulnerability and fallacy of using anything other than one-time decryption keys and single-use pads. Why? Most of what the FBI has learned about Cuban numbers came from laptops that were used to help decrypt coded messages–an unnecessary procedure when numbers can simply be decoded on note pads that can then be burnt or destroyed.

But don’t take my word for it–download and read Dirk’s paper Cuban Agent Communications” by clicking here. Also, be sure to check out Dirk’s blog and cryptology website; I’ve bookmarked both.

Thanks for sharing your findings, Dirk!

Spread the radio love

David Goren’s numbers station installation audio

DG-Performance-ShortwaveTwo months ago, I posted that David Goren, talented radio producer and shortwave radio artist, created a Numbers Station installation in the Secret Wars exhibition at the Proteus Gowanus gallery in Brooklyn, NY.

David has recently published the audio that accompanies his installation.

Take note that this is not a radio documentary–rather, it’s an expansion of his original piece, and part of his sound installation at Proteus Gowanus.  Enjoy:

Spread the radio love

Even numbers stations make mistakes

WFL_015On February 5th, 2013, the Cuban numbers station widely known as HM01 struggled to maintain its composure following an awkward studio error.

In this particular case, I started recording a few seconds prior to the carrier, at which point you’ll hear a couple of minutes of “dead air” (silence). The broadcast starts around 2:25, cutting into the middle of a data burst; the station then goes silent before it comes back on at 5:15 with numbers, then abruptly stops. At 6:15 the station restarts the numbers broadcast in earnest.

Download the MP3 of the full recording by clicking here, or listen via the embedded player below:

Click here to view the Archive.org with original audio files.

Spread the radio love

How to decode that RDFT in numbers station HM01? Roland explains

DIGTRXA few weeks ago, I published a post with a recording of the Cuban numbers station HM01, a “Hybrid Mode” numbers station which interchangeably broadcasts both voice and a digital mode called RDFT with each transmission. I had suggested using an application called “DIGTRX” to decode the data bursts.

I then received  a comment on that post from the author of the DIGTRX program himself, Roland. He has actually created a page in English which describes in detail how to decode the RDFT in HM01.  Note that this page was originally in Roland’s native Portugese, and he kindly translates it into English for us: http://www.qsl.net/py4zbz/eni.htm

[While this means that we can decode the transmissions, it doesn’t mean we can necessarily decipher them, however.  At least, not yet.]

Imagine that a spy numbers station is using an application you, yourself, authored to send coded messages. What are the odds?  This apparently happened to Roland, when he discovered that HM01 was, in fact, using his application DIGTRX. What?!?

Actually, it makes sense to me that numbers stations would use DIGTRX. After all, it’s open source. Operatives in the field can download the application without raising awareness. If it were a proprietary application, either commercially or of their own design, it would add to the complication of downloading and using it (on both ends). As you’ll read in Roland’s tutorial, HM01 has built in robust redundancies by using RDFT and DIGTRX. Very interesting.

Thanks, Roland, for sharing!

Spread the radio love