HFU HF Underground
Loggings => Utility => Topic started by: [tRMZ] on June 08, 2018, 1554 UTC
-
Hey I really like hearing these guys. I like to write down the msgs I hear when possible. .. (you kno I heard a female reading phonetics last night but I missed her code name!)
So have you identified any pattern in the msgs? For example, like the Cuban Lady reading sets of 5-characters...I know these EAM sender IDs SEEM to me to be 3-characters (like XP4, for example). Is there a consistent or alternating grouping pattern here? Have you noticed a pattern?
-
You get to know what is normal day to day traffic after spending some time listening to them. They have a quarterly(?) exercise that might make one think ww3 has broken loose from the frantic messages, however. There's also a distinct difference between skykings and all the rest.
-
You get to know what is normal day to day traffic after spending some time listening to them. They have a quarterly(?) exercise that might make one think ww3 has broken loose from the frantic messages, however. There's also a distinct difference between skykings and all the rest.
Well what I mean is, is there a pattern to the characters...like with every single Cuban Lady msg they are sets of 5, and I kno that's common. Like this EAM msg I copied in February as an example:
"XFP4
msg follows:
ZCXP4 OFPOM 7LVSU WJCRF HRZXX R5RN
"again" (repeat msg)
"this is Beatrice. Out!"
See how their beginning IDs are 4-characters. That was consistent in all msgs I've heard. In this particular example, I presented the msg in groups of 5-characters (arbitrarily)...and there were 4 left over at the end. So, that's what I mean. Are the number of characters in each msg commonly divisible by 5...except for the IDs? Is there a pattern of THAT sort to the msgs? No, not particularly?
And hey! What's a "skyking", and how are they different from the rest of the guys?
-
When you talk about numbers stations and military transmissions like EAMs, or any traffic on the HF-GCS network, much of the information is not actually known. That does not mean people do not have a good idea how / why things happen, however most of the time there is no actual documented proof you can point to. So be careful with any information you receive, some of it is quite good but some of it is junk, and proving either is pretty hard.
First thing you have to remember is that EAMs and Skykings are not numbers stations. Since they are not, they probably will not have similar habits to numbers stations. And indeed they do not. And then you must remember that such messages, the format of them, and any confirmation of what / how they are used, is classified information, so people who actually know are probably not going to say much. I can say that when I was active duty I occasionally sent and received messages very similar in format to EAMs (but they were not EAMs), and that is pretty much all I am going to say on the matter.
A numbers station often has fixed group sizes, for example maybe 3, 4, 5, or 6 characters per group, depending on the station. And so this results in a character count of some multiple of this group size. And also note that most numbers stations typically do not mix numbers and letters, they are mostly all only numbers, but when they use letters they are typically all letters. This may all be a result of the type of encoding that is done to this traffic. Numbers stations also typically follow specific schedules, HF-GCS traffic typically does not.
But coded HF-GCS traffic is not a numbers station, and an EAM might have any number of characters, and so it will not have specific groups. And the HF-GCS messages mix numbers and letters, however some numbers and letters are never seen. Why is this? Speculation, but I believe it is because the content is different and this traffic is encoded in an entirely different way from numbers stations. I think the smallest number I have ever heard is 8 or 10, and the largest number on the order of 250+ characters, and nothing that falls into any specific group size multiples.
Recently, 24 character messages with a 6 character ID has been the most common format.
An example of one sent 0639 UTC yesterday (7 June, 2018):
ALL STATIONS, ALL STATIONS, THIS IS ROADSIGN, ROADSIGN, BREAK
SLTSGA, STANDBY, SLTSGA, STANDBY, SLTSGA, STANDBY
MESSAGE FOLLOWS
SLTSGAEBJYYK2ELUFQNIQUUEIYGUKA
I SAY AGAIN
SLTSGAEBJYYK2ELUFQNIQUUEIYGUKA
THIS IS ROADSIGN, OUT
If you break this down you see the message was from ROADSIGN (or maybe ROAD SIGN) and a callup of SLTSGA. Maybe SLTSGA identified the message as a specific kind of message, or maybe it identified a specific recipient or group of recipients.
The message itself has 30 characters, but the first 6 match the callup. So possibly the message is 24 characters, with the callup included in the presentation, making 30. But I have heard this same format used with many more, and sometimes less, characters total.
A slightly different format also shows up, for example, this message on 5 June, 2018, at 1946 UTC:
ALL STATIONS, ALL STATIONS, THIS IS DANDY DAN, DANDY DAN, BREAK
FOR 825, FOR 825
KMY2OA, STANDBY, KMY2OA, STANDBY, KMY2OA, STANDBY
MESSAGE FOLLOWS
KMY2OA5JK33WU7TCAOA443W275AOVC
I SAY AGAIN, FOR 825, FOR 825
KMY2OA5JK33WU7TCAOA443W275AOVC
THIS IS DANDY DAN, OUT
Again we see 30 characters total, and a 6 character callup, making for possibly a 24 character message plus callup / message type / recipient ID. Obviosuly though, they have a specific recipient, or group of recipients, in mind, the "FOR 825" is pretty clear.
Or maybe both cases were 30 character messages, and they just break out the first 6 as a callup out of habit, but I personally don't think that is the case.
As for what is a SKYKING, that is a point of contention. We know, from official documents and from observing habits, that a SKYKING is a higher priority message than either normal traffic or an EAM. Some documentation ties SKYKINGs to SIOP (Single Integrated Operational Plan) which is part of the control and use of nuclear weapons. But we also have good indication that SKYKINGs can be tied to other highly important platforms and uses, such as unarmed reconnaissance aircraft.
We also know that SKYKINGs are heard less frequently than other types of messages. You average day on the HF-GCS network will probably have several, if not many, EAMs. Some times you may have half a dozen, or more, in a single hour. But you can go days without a SKYKING, or you may have a dozen SKYKINGs in a single day.
And then it is a safe bet that some EAMs and SKYKINGs are fake traffic, filler messages transmitted when there is no need for them, just to prevent anyone from using traffic analysis as an indicator of force activity.
So I think it safe to say, SKYKINGs are, when real, more important messages than other HF-GCS traffic, and that is really all we know about them.
Some people think if they hear a SKYKING that means something important is happening or about to happen, but to date no one has been able to tie either EAMs or SKYKINGs to world events. For sure there have been 7+ SKYKINGs in the last 7 days and we are all still here.
T!
-
When you talk about numbers stations and military transmissions like EAMs, or any traffic on the HF-GCS network, much of the information is not actually known. That does not mean people do not have a good idea how / why things happen, however most of the time there is no actual documented proof you can point to. So be careful with any information you receive, some of it is quite good but some of it is junk, and proving either is pretty hard.
First thing you have to remember is that EAMs and Skykings are not numbers stations. Since they are not, they probably will not have similar habits to numbers stations. And indeed they do not. And then you must remember that such messages, the format of them, and any confirmation of what / how they are used, is classified information, so people who actually know are probably not going to say much. I can say that when I was active duty I occasionally sent and received messages very similar in format to EAMs (but they were not EAMs), and that is pretty much all I am going to say on the matter.
A numbers station often has fixed group sizes, for example maybe 3, 4, 5, or 6 characters per group, depending on the station. And so this results in a character count of some multiple of this group size. And also note that most numbers stations typically do not mix numbers and letters, they are mostly all only numbers, but when they use letters they are typically all letters. This may all be a result of the type of encoding that is done to this traffic. Numbers stations also typically follow specific schedules, HF-GCS traffic typically does not.
But coded HF-GCS traffic is not a numbers station, and an EAM might have any number of characters, and so it will not have specific groups. And the HF-GCS messages mix numbers and letters, however some numbers and letters are never seen. Why is this? Speculation, but I believe it is because the content is different and this traffic is encoded in an entirely different way
As for what is a SKYKING, that is a point of contention. We know, from official documents and from observing habits, that a SKYKING is a higher priority message than either normal traffic or an EAM. Some documentation ties SKYKINGs to SIOP (Single Integrated Operational Plan) which is part of the control and use of nuclear weapons. But we also have good indication that SKYKINGs can be tied to other highly important platforms and uses, such as unarmed reconnaissance aircraft.
We also know that SKYKINGs are heard less frequently than other types of messages. You average day on the HF-GCS network will probably have several, if not many, EAMs. Some times you may have half a dozen, or more, in a single hour. But you can go days without a SKYKING, or you may have a dozen SKYKINGs in a single day.
And then it is a safe bet that some EAMs and SKYKINGs are fake traffic, filler messages transmitted when there is no need for them, just to prevent anyone from using traffic analysis as an indicator of force activity.
So I think it safe to say, SKYKINGs are, when real, more important messages than other HF-GCS traffic, and that is really all we know about them.
Some people think if they hear a SKYKING that means something important is happening or about to happen, but to date no one has been able to tie either EAMs or SKYKINGs to world events. For sure there have been 7+ SKYKINGs in the last 7 days and we are all still here.
T!
Wow! Hey first of all I want to make it clear that I don't assume any relation to world events and HFGCS transmissions or Cuban Lady or any numbers station. That's not an issue with me; I only mention it now bcuz I noticed you told me that a few times. I'm sure lots of ppl do assume a relation, but I don't. I kno a great many confidential msgs of all types are dummy msgs, or "fillers" as you put it. That's what I would do if I were in charge: send a bunch of dummy msgs. In different languages. Just be aware I don't interpret world events thru the EAM or any #s station.
But funny you should mention 24-character msg with a 6-character callup. I just copied this msg:
KMKFMB
"msg follows"
KMKFMB A3O4 O2VT 6RAS FM5B SPIU PPPE
"This is Locksmith. Out!"
So I just noticed that; I was gonna post it here and then I saw your msg.
"They're not numbers stations." ← okay that's good advice for me. I should not expect the HFGCS to be like a #s station. That's pretty much answered my question about these guys. "They're not encoded in the same way". THAT is the answer to my question...more or less
But...how can I tell if I'm hearing a SkyKing vs. typical EAM?
I like these guys. I get a kick out of em. Thnx
-
But...how can I tell if I'm hearing a SkyKing vs. typical EAM?
They'll say "Skyking" in the message. Check youtube for examples (search for "EAM Skyking").
-
In general, today, SKYKING transmissions will follow the basic format of:
SKYKING, SKYKING, DO NOT ANSWER
HEARTBREAKER
TIME, 57, AUTHENTICATION, MIKE ALFA
I SAY AGAIN
SKYKING, SKYKING, DO NOT ANSWER
HEARTBREAKER
TIME, 57, AUTHENTICATION, MIKE ALFA
THIS IS KEG NAIL, OUT
In the past, and sometimes today, the format has been / is slightly different, but you get the general idea.
In the above case HEARTBREAKER is the message, it is a code word that has some meaning to someone. The combination of the TIME and AUTHENTICATION are ways for the recipient to confirm the message is valid. KEG NAIL is the rotating callsign of whoever sent the message.
T!
-
Just chiming in to say that was an outstanding write-up on the nature of EAMs and military traffic, in general. It makes perfect sense that one cannot truly find a pattern in the transmissions of those messages. If a definite pattern was noted, I'd call it a general failure of our military/intelligence services. So it makes sense that there would be "bogus" transmissions sent at random times. In a side note, I've lost count at the number of emails that I receive from people who swear that an increase in EAM traffic means that WW3 is imminent. ;)
Curt / W9SPY
-
In a side note, I've lost count at the number of emails that I receive from people who swear that an increase in EAM traffic means that WW3 is imminent. ;)
Curt / W9SPY
I like to say that as long as it doesn't spell out WING ATTACK PLAN R, we're probably OK.
-
In a side note, I've lost count at the number of emails that I receive from people who swear that an increase in EAM traffic means that WW3 is imminent. ;)
Curt / W9SPY
I like to say that as long as it doesn't spell out WING ATTACK PLAN R, we're probably OK.
WW3 has been imminent since the end of WW2! ;)
But you might actually know the answer to this question--
The only weird feeling I got about that type of thing was, I had been listening to the Cuban Lady ya kno cuz obviously everyone knows about her...anyway so I would sumtimes copy the msgs and sometimes I would notice a slight pattern, not in detail like you guys do...but anyway it really SEEMED to me...it might have been a misconception but after the "re-embargo" I thought, Wow! These msgs seem like they are a LOT longer/bigger, like a longer duration and containing more numbers. Any truth to that? I'm sure like 50% of that Cuban Lady stuff is dummy msgs anyway and she gets boring but I got the distinct impression the LENGTH of the msgs in increased after the re-embargo
-
And then you must remember that such messages, the format of them, and any confirmation of what / how they are used, is classified information, so people who actually know are probably not going to say much. I can say that when I was active duty I occasionally sent and received messages very similar in format to EAMs (but they were not EAMs), and that is pretty much all I am going to say on the matter.
Oh no! Now you guys are all thinking I'm a North Korean spy! :o
LOLLAPALOOZA!
I SAY AGAIN-
LOLLAPALOOZA!
Ha ;) jk but u kno I never listened for em around 06:00z...I've heard a lot like 23:00z...14:00z...I'll monitor around 06:00z more often. I fall asleep early!
THIS IS CORN COB NIBBLER.
CORN COB NIBBLER, OUT! ;D ;D
-
WW3 has been imminent since the end of WW2! ;)
But you might actually know the answer to this question--
The only weird feeling I got about that type of thing was, I had been listening to the Cuban Lady ya kno cuz obviously everyone knows about her...anyway so I would sumtimes copy the msgs and sometimes I would notice a slight pattern, not in detail like you guys do...but anyway it really SEEMED to me...it might have been a misconception but after the "re-embargo" I thought, Wow! These msgs seem like they are a LOT longer/bigger, like a longer duration and containing more numbers. Any truth to that? I'm sure like 50% of that Cuban Lady stuff is dummy msgs anyway and she gets boring but I got the distinct impression the LENGTH of the msgs in increased after the re-embargo
I can't say that I've noticed any particular pattern o any kind, regardless of the news.
-
Watch Crimson Tide...good movie.
The numbers and letters of the actual message have no pattern, that's the whole idea. They are generated from a random character generator.
The character string is coded into a response on the receive side. If the receive side gets an exact match string of characters they execute that pre-programmed response. Like launch your stuff here or there..or it means valid orders to follow, or its just an exercise message.
There are other safeguards beyond just a code match, but I think that is how works high level. I suspect if you crunch the numbers on that code...with the number of alpha and numeric possibilities...that it would be many trillions to one that some unauthorized person could transmit a code that the receive side would respond to falsely....or that we could ever make any sense of it.
Maybe one could speculate that the longer the message string the more sensitive the receive side message...but that would only be speculation.
-
The call signs are more than likely different bases or aircraft using a rotating schedule of callsigns (I recall they used the names of different bands, heard PINK FLOYD, etc.) as callsigns - then FRESHMAN and LINEBACKER. There are definite themes to the pool of callsigns that they rotate through.
The reference to Wing Attack Plan R (and Dr. Strangelove in general) is actually somewhat accurate. The use of authentication is a major plot point in that film - and in Crimson Tide too! (remember the CRM-114 discriminator - ignored all radio traffic except traffic that had the correct three letter coded prefix - that happened to be O P E [precious bodily fluids, purity of essence etc.]?) - the use of authentication is extremely important with "in the clear" networks such as HF-GCS...it wouldn't be too difficult to create imitation traffic on that network but without the correct authentication codes it would be obvious to all concerned that that traffic was fake (spoofing attempt).
As mentioned, it is highly likely that a large amount of traffic heard on 4724 USB, 6712 USB, 6739 USB, 8992 USB, 11175 USB, 13200 USB and 15016 USB is likely "filler" traffic - since the EAMs use the One Time Pad method encryption the only possible way to glean information from listening to them is through traffic analysis...which can be mitigated by simply having huge amounts of "dummy" traffic mixed in with the actual messages.
The HM01 network likely has large amounts of dummy messages, or nearly meaningless messages ("Happy International Women's Day!", things like that). It's on a schedule after all. There's probably huge amounts of transmissions that say something to the effect of "nothing to report". But, as is the case with traffic analysis, a sudden drop off in activity could be just as important of an indicator as an increase in activity.
-
Yesterday there were messages coming from "Lame Duck." The op hesitated a couple of times during the reading of characters, and in one message he didn't say how many characters the message contained, which they usually do at the start. That made me believe it was just training, possibly that airman's first day on the mic.
-
The training messages have been noted on other frequencies as well, some of which are in the 67xx-69xx kHz range, including 6855 USB if I remember correctly.
-
When you hear that eam, think of these guys;
https://www.youtube.com/watch?v=IZXUC-nnDIc
-
There are additional message types sent on hfgcs and other National Command Authority nets to consider;
NEAM: Non Emergency Action Message
This Routine Priority message promulgates official doctrine on the acquisition and consumption of Ovaltine.
EIM: Emergency Inaction Message
This Routine Priority message promulgates official doctrine on the adjustment of seating for optimal comfort inside a given Missile Wing Command Capsule, SSB/SSBN CIC, and Airborne Command Post.
Example message traffic;
"For station RECLINER, for station RECLINER, break, SIERRA INDIA TANGO, I say again, for station RECLINER, for station RECLINER, break, SIERRA INDIA TANGO, this is LAZY BOY, LAZY BOY, out"
EAM: Emerging Artist Message
This Flash Priority message type promulgates official information regarding new artists in a given recipients local music scene.
https://www.youtube.com/watch?v=Yi3Eu4wptn0
-
a sudden drop off in activity could be just as important of an indicator as an increase in activity.
« Last Edit: June 20, 2018, 1226 UTC by R4002
Truer words have never been spoken, well done R4002. ;D
Josh, your magnificent analysis has, until now, not been as widely lauded as it deserves. I particularly like this:
"EAM: Emerging Artist Message
This Flash Priority message type promulgates official information regarding new artists in a given recipients local music scene."
If only the EAM's were so interesting... Still, mega points to Josh for a new approach to the football field of traffic analysis, which will surely reach new points as the pundits fathom Germany's World Cup defeat. LOL and cheers!
-
Thank you but I hardly deserve any credit. What motivated me was watching a few of the eam - related vids on youtube and becoming very depressed, so I made up some new acronyms for eam for fun.
https://www.youtube.com/watch?v=HWZXinRwCaE
https://www.youtube.com/watch?v=7VG2aJyIFrA
-
Maybe more music-themed callsigns in use. Wait for "GROUND CONTROL calling MAJOR TOM" on 11175 USB
-
Hey Token and all. A comment or possibly more accurately a question. I have copied literally hundreds of both EAM's and Sky King messages over the years. It's not uncommon that while monitoring the actual message, I can also detect what I would describe as "crew chatter" and "engine noise". Sometimes when this occurs, I can locate an airborne E4B or an E6B over CONUS.
I guess the question is, Am I actually hearing "crew chatter" / "engine noise" or something else? Also, if in fact the message was transmitted by an airborne a/c is it safe to assume the platform is an E4B or E6B. Just a quick note, I am assuming if the EAM/Sky King is being transmitted by an a/c, the a/c is not going to be visible on any radar / plane spotter sites.
Thanks in Advance.
-
E4B and E6B can "inject traffic" directly into the net once they've authenticated and entered the net via their organic hf/uhf/shf gear. You'll often hear crew chatter and background noise on hfgcs, regardless if it's traffic from aircraft or ground stations.
-
11175 USB 1855Z 16SEP18
SULW2Q standby
SULW2Q standby, message follows SULW2Q7KQN26D7B7FG2ZWMLLVZPJT
GOODRICH out
-
The call signs are more than likely different bases or aircraft using a rotating schedule of callsigns (I recall they used the names of different bands, heard PINK FLOYD, etc.) as callsigns - then FRESHMAN and LINEBACKER. There are definite themes to the pool of callsigns that they rotate through.
The reference to Wing Attack Plan R (and Dr. Strangelove in general) is actually somewhat accurate. The use of authentication is a major plot point in that film - and in Crimson Tide too! (remember the CRM-114 discriminator - ignored all radio traffic except traffic that had the correct three letter coded prefix - that happened to be O P E [precious bodily fluids, purity of essence etc.]?) - the use of authentication is extremely important with "in the clear" networks such as HF-GCS...it wouldn't be too difficult to create imitation traffic on that network but without the correct authentication codes it would be obvious to all concerned that that traffic was fake (spoofing attempt).
As mentioned, it is highly likely that a large amount of traffic heard on 4724 USB, 6712 USB, 6739 USB, 8992 USB, 11175 USB, 13200 USB and 15016 USB is likely "filler" traffic - since the EAMs use the One Time Pad method encryption the only possible way to glean information from listening to them is through traffic analysis...which can be mitigated by simply having huge amounts of "dummy" traffic mixed in with the actual messages.
Haha man I had a roommate for 5 yrs. ..he was my parents' age and he was a retired attorney. Man he LOVED Dr. Strangelove..."our precious bodily fluids, Mandrake!"
I didn't really get too into that film but no offense I'm not hostile to it!
But EAMs are "one-time pad" encryptions? You think they change their "pad" every day, or week, or what?
I just figured it was a different method of encryption. Anyhow...I've been back listening to em more again lately.
You think there's actual significance to a 33-character msg or 36-character msg...cuz I'm counting usually like 30 characters (including callsign) and I've never heard them specify until recently, but NOT for the 30-character ones; so, it caught my attention. You think they're more/less significant? Or for different purpose? I defer to your judgement!
Yeah like I always say...the best way to manage this kinda s**t...is to constantly send dummy msgs. Yup. I also think if I was in charge we'd alternate the language of voiced numbers stations. Since you only gotta know how to count to 10.
Heck I'd use different languages for EAMs and coded word-msgs. Yup. Inundate the air with poppycock. Clearly a sound logical tactic :-)
But above all we must protect our bodily fluids!! ;-)
-----------
9/25/2018
(18:33z) 8992U
U7THBO stand by
U7THBO stand by
U7THBO stand by
MESSAGE OF 36 CHARACTERS FOLLOWS:
U7THBO
H6VPVMFGJMS3GNWDAPVSZNTI73HOQS
I SAY AGAIN... (rpt msg)
THIS IS TRAM SIX (←?). OUT!
------------
9/25/2018
(18:43z) 8992U
VDXVVI stand by
VDXVVI stand by
VDXVVI stand by
MESSAGE FOLLOWS:
VDXVVI
KJIMSLBCOQEXFGHQGKKXJNT4
I SAY AGAIN... (rpt msg)
THIS IS TRAM SIX(←?). OUT!