37 comments

[ 4.0 ms ] story [ 48.9 ms ] thread
This reminds me of UVB-76[0], a shortwave military radio in Russia. It would be interesting know why they're using this method to communicate covertly rather than beaming down messages to a phone via satellite or something. I'm not an expert on radios, though, so maybe it's not as clunky as I'm imagining where an undercover asset is hauling around bulky equipment.

0: https://en.wikipedia.org/wiki/UVB-76

Does this move around geographically ? Triangulating broadcast location is a well understood craft.
The broadcast locations aren't really secret, and don't need to be.
N 48.690438° E 9.086693°
Street View nearby reveals this sign at the edge of the Street View area: "Forstarbeiter und Militär Frei," which means "Forestry Workers and Military [are free to enter]". The red circle around the sign implies that everyone else is forbidden to enter. So, it's some kind of military installation.
Sounds like a CIA numbers station transmitting info to agents on the ground.
I wonder why they keep using a dedicated numbers station instead of embedding the code in a regular radio broadcast on a traditional channel? I'm sure that even before LLMs one could find a way to create a story where certain numbers / code words would be embedded without altering the underlying story too much. And they could probably get BBC / whatever station to air it. It would be a bit less inconspicuous to listen to BBC than to a dedicated numbers station, even if the message would be undecryptable either way.
I can't find it immediately, but I've read about something even sneakier than this. A standard broadcast station was modified such that its carrier signal was modulated by a PSK signal. The intended listener would use e.g., a PSK-31 modem to listen to the carrier signal and would be able to obtain the encoded digital data. Everyday listeners would hear the regular broadcast. The station involved _might_ have been a BBC station, but I don't recall.
who's to say they aren't doing both? They may not even be sending anything over the number station; these stations will continue on a schedule even when there is nothing to say and nobody is listening because it makes it harder to eek out a foothold in the event of a weakness in the encryption.
Shortwave propagates better and also its just a one time pad being distributed so embedding doesn't matter as much as long as the one time pad is longer than the intended message to send. There is no way to decrypt it because once you encrypt a message using a one time pad it is impossible to decrypt without the exact one time pad that it was encrypted with.
I think you're massively overestimating the amount of control the US has over news broadcasters.
I think they do this, too.

However, the numbers stations transmissions are never a big secret. They're intentionally powerful so someone can pick them up on simple equipment without raising suspicion. A person can modify an off-the-shelf AM radio to pick up shortwave, for example, even in an oppressive regime.

It's a one-time pad, so the encryption is unbreakable.

Well, it's unbreakable if you do everything right.
> "I'm sure that even before LLMs one could find a way to create a story where certain numbers / code words would be embedded without altering the underlying story too much."

It's called steganography, and it's a centuries if not millennia old technique.

The previous time that the US and UK overthrew Iran's government (https://en.wikipedia.org/wiki/1953_Iranian_coup_d'%C3%A9tat), they used the BBC in that way.

  Roosevelt told the Shah that he was in Iran on behalf of the American and British secret services, and that this would be confirmed by a code word the Shah would be able to hear on the BBC the next night. Churchill had arranged that the BBC would end its broadcast day by saying not 'it is now midnight' as usual, but 'it is now exactly midnight'
Because you can drive intel analysts crazy with this one weird trick. They know you can't decrypt one time pads, but they can't resist checking for entropy and trying to match it to known OTPs they may have acquired through intelligence channels. Running and programming the shortwave transmitter is dirt cheap; tying up some of opponents' SIGINT resources on a wild goose chase is good value for money.
It doesn't matter that it's conspicuous if it's also unbreakable. It's a simple system that's worked since World War 1, why bother changing it?
because it's purpose is not to transmit any message, but make it look like there are traitors in Iran working for CIA
This was done extensively during ww2 iirc
"We don't need NATO." But we do need our bases in Germany plz.
These two don't have to be related per se, but it sure helps with maintaining a healthy mutually beneficial military relationship.
If anyone is interested in further reading, this group are the world's leading experts on number stations (outside of intelligence services of course). They've done a detailed article on the new station, including recordings, technical mishaps, and analysis of why they believe the station is CIA run. https://priyom.org/number-stations/other/v32

> Considering the topical interest in this station, the Priyom team shares its further expertise regarding V32's attribution, beyond being transmitted from a US military facility. While this remains unconfirmed speculation, and not facts, a prime candidate for the operator of this station would be the CIA. Contrary to popular belief, US intelligence has not entirely moved away from numbers stations. Sources in the intelligence community indicate that the CIA provides extra training about numbers stations and one-time pads to clandestine agents assigned to locations with a very hostile operating environment, such as Iran or North Korea: it is envisioned as a last-resort means of communication with high-value sources. So according to this, numbers stations are actually still an institutional part of the CIA playbook. The war in Iran, and the Internet blackout installed by the regime, fulfill the very circumstances for which the CIA would have planned this.

> We already know that the CIA has a significant presence in Iran and involvement in the war, having provided crucial intelligence tracking Iranian leaders that enabled the assassination strikes that kickstarted the war. They most probably have had a network of infiltrated assets already in place and organized, ready to be reached through a numbers station if need be right when the war started - which makes the CIA a candidate for running V32 consistent with a legitimate intelligence operation. However, what we've observed from V32's operations - technical quirks and shifting formats - suggest that the technical deployment of the numbers station and shortwave transmissions themselves may have been a little rushed by the circumstances.

> Another noteworthy feature of V32 is how all its transmissions take place on the same frequency. Most other numbers stations in general are comprehensive operations targeting many different recipients in different countries, and making use of many different transmission times and frequencies suited to the particular signal propagation needs corresponding to all those areas. In contrast, the fact that V32 always uses a single, same frequency, at always two given times of the day, would be consistent with an operation that only needs to target a single geographical area: Iran.

Thanks for the link, really interesting!

   For intelligence agencies,
   it is important to 
   communicate with their
   spies to gather intelligence,” 
   says John Sipher, a former
   US intelligence officer
Is Sipher really his name. Nominative determinism strikes again.

Sifr is also a valid word both in Farsi, I think. An Ironic and cruel pun.

Interesting. Some sort of sync signal?
> Fernandez, who more than two decades ago published a four-CD audio compendium of hundreds of recordings from around the world called the Conet Project. It's considered the Bible for numbers-station enthusiasts.

The Conet Project is an interesting listen -- very analogue, Cold War-ish, and a bit sinister. Seems to be available on the Internet Archive at https://archive.org/details/The-Conet-Project

Cannot believe they didn't write the frequencies. Incompetents.
So one slightly fascinating bit of number station / espionage radio lore is "RAFTER" an MI5 scheme cooked up by Peter Wright to detect the _receiver_ of the radio using emissions from the internals of the radio set (superhet mixing iirc)

https://en.wikipedia.org/wiki/Operation_RAFTER