We seek to understand and document all radio transmissions, legal and otherwise, as part of the radio listening hobby. We do not encourage any radio operations contrary to regulations. Always consult with the appropriate authorities if you have questions concerning what is permissable in your locale.

Author Topic: have you recognized any grouping pattern in the EAM msgs?  (Read 5431 times)

Offline [tRMZ]

  • Full Member
  • ***
  • Posts: 112
  • MI's Copper Country
    • View Profile
Hey I really like hearing these guys. I like to write down the msgs I hear when possible. .. (you kno I heard a female reading phonetics last night but I missed her code name!)

So have you identified any pattern in the msgs? For example, like the Cuban Lady reading sets of 5-characters...I know these EAM sender IDs SEEM to me to be 3-characters (like XP4, for example). Is there a consistent or alternating grouping pattern here? Have you noticed a pattern?
« Last Edit: June 08, 2018, 1637 UTC by [tRMZ] »
--------------------------------------
Upper MI's Copper Country
•Grundig Satellit 750•
•Kaito 1103• w/wire-clip EXT ant
•Uniden BC125AT•
2 •GE 3-5980A handheld CB•

(only INT stock antennas atm)

Offline Josh

  • DX Legend
  • ******
  • Posts: 3130
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #1 on: June 08, 2018, 1811 UTC »
You get to know what is normal day to day traffic after spending some time listening to them. They have a quarterly(?) exercise that might make one think ww3 has broken loose from the frantic messages, however. There's also a distinct difference between skykings and all the rest.
Conveniently located near Vincennes Indiana.

Offline [tRMZ]

  • Full Member
  • ***
  • Posts: 112
  • MI's Copper Country
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #2 on: June 08, 2018, 2015 UTC »
You get to know what is normal day to day traffic after spending some time listening to them. They have a quarterly(?) exercise that might make one think ww3 has broken loose from the frantic messages, however. There's also a distinct difference between skykings and all the rest.

Well what I mean is, is there a pattern to the characters...like with every single Cuban Lady msg they are sets of 5, and I kno that's common. Like this EAM msg I copied in February as an example:

"XFP4
msg follows:

ZCXP4 OFPOM 7LVSU WJCRF HRZXX R5RN

"again" (repeat msg)

"this is Beatrice. Out!"

See how their beginning IDs are 4-characters. That was consistent in all msgs I've heard. In this particular example, I presented the msg in groups of 5-characters (arbitrarily)...and there were 4 left over at the end. So, that's what I mean. Are the number of characters in each msg commonly divisible by 5...except for the IDs? Is there a pattern of THAT sort to the msgs? No, not particularly?

And hey! What's a "skyking", and how are they different from the rest of the guys?
« Last Edit: June 08, 2018, 2214 UTC by [tRMZ] »
--------------------------------------
Upper MI's Copper Country
•Grundig Satellit 750•
•Kaito 1103• w/wire-clip EXT ant
•Uniden BC125AT•
2 •GE 3-5980A handheld CB•

(only INT stock antennas atm)

Offline Token

  • Global Moderator
  • DX Legend
  • *****
  • Posts: 1793
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #3 on: June 08, 2018, 2310 UTC »
When you talk about numbers stations and military transmissions like EAMs, or any traffic on the HF-GCS network, much of the information is not actually known.  That does not mean people do not have a good idea how / why things happen, however most of the time there is no actual documented proof you can point to.  So be careful with any information you receive, some of it is quite good but some of it is junk, and proving either is pretty hard.

First thing you have to remember is that EAMs and Skykings are not numbers stations.  Since they are not, they probably will not have similar habits to numbers stations.  And indeed they do not.  And then you must remember that such messages, the format of them, and any confirmation of what / how they are used, is classified information, so people who actually know are probably not going to say much.  I can say that when I was active duty I occasionally sent and received messages very similar in format to EAMs (but they were not EAMs), and that is pretty much all I am going to say on the matter.

A numbers station often has fixed group sizes, for example maybe 3, 4, 5, or 6 characters per group, depending on the station.  And so this results in a character count of some multiple of this group size.  And also note that most numbers stations typically do not mix numbers and letters, they are mostly all only numbers, but when they use letters they are typically all letters.  This may all be a result of the type of encoding that is done to this traffic.  Numbers stations also typically follow specific schedules, HF-GCS traffic typically does not.

But coded HF-GCS traffic is not a numbers station, and an EAM might have any number of characters, and so it will not have specific groups.  And the HF-GCS messages mix numbers and letters, however some numbers and letters are never seen.  Why is this?  Speculation, but I believe it is because the content is different and this traffic is encoded in an entirely different way from numbers stations.  I think the smallest number I have ever heard is 8 or 10, and the largest number on the order of 250+ characters, and nothing that falls into any specific group size multiples.

Recently, 24 character messages with a 6 character ID has been the most common format.

An example of one sent 0639 UTC yesterday (7 June, 2018):

ALL STATIONS, ALL STATIONS, THIS IS ROADSIGN, ROADSIGN, BREAK
SLTSGA, STANDBY, SLTSGA, STANDBY, SLTSGA, STANDBY
MESSAGE FOLLOWS
SLTSGAEBJYYK2ELUFQNIQUUEIYGUKA
I SAY AGAIN
SLTSGAEBJYYK2ELUFQNIQUUEIYGUKA
THIS IS ROADSIGN, OUT

If you break this down you see the message was from ROADSIGN (or maybe ROAD SIGN) and a callup of SLTSGA.  Maybe SLTSGA identified the message as a specific kind of message, or maybe it identified a specific recipient or group of recipients.

The message itself has 30 characters, but the first 6 match the callup.  So possibly the message is 24 characters, with the callup included in the presentation, making 30.  But I have heard this same format used with many more, and sometimes less, characters total.

A slightly different format also shows up, for example, this message on 5 June, 2018, at 1946 UTC:
ALL STATIONS, ALL STATIONS, THIS IS DANDY DAN, DANDY DAN, BREAK
FOR 825, FOR 825
KMY2OA, STANDBY, KMY2OA, STANDBY, KMY2OA, STANDBY
MESSAGE FOLLOWS
KMY2OA5JK33WU7TCAOA443W275AOVC
I SAY AGAIN, FOR 825, FOR 825
KMY2OA5JK33WU7TCAOA443W275AOVC
THIS IS DANDY DAN, OUT

Again we see 30 characters total, and a 6 character callup, making for possibly a 24 character message plus callup / message type / recipient ID.  Obviosuly though, they have a specific recipient, or group of recipients, in mind, the "FOR 825" is pretty clear.

Or maybe both cases were 30 character messages, and they just break out the first 6 as a callup out of habit, but I personally don't think that is the case.

As for what is a SKYKING, that is a point of contention.  We know, from official documents and from observing habits, that a SKYKING is a higher priority message than either normal traffic or an EAM.  Some documentation ties SKYKINGs to SIOP (Single Integrated Operational Plan) which is part of the control and use of nuclear weapons.  But we also have good indication that SKYKINGs can be tied to other highly important platforms and uses, such as unarmed reconnaissance aircraft.

We also know that SKYKINGs are heard less frequently than other types of messages.  You average day on the HF-GCS network will probably have several, if not many, EAMs.  Some times you may have half a dozen, or more, in a single hour.  But you can go days without a SKYKING, or you may have a dozen SKYKINGs in a single day.

And then it is a safe bet that some EAMs and SKYKINGs are fake traffic, filler messages transmitted when there is no need for them, just to prevent anyone from using traffic analysis as an indicator of force activity.

So I think it safe to say, SKYKINGs are, when real, more important messages than other HF-GCS traffic, and that is really all we know about them.

Some people think if they hear a SKYKING that means something important is happening or about to happen, but to date no one has been able to tie either EAMs or SKYKINGs to world events.  For sure there have been 7+ SKYKINGs in the last 7 days and we are all still here.

T!
T!
Mojave Desert, California USA

Offline [tRMZ]

  • Full Member
  • ***
  • Posts: 112
  • MI's Copper Country
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #4 on: June 09, 2018, 2100 UTC »
When you talk about numbers stations and military transmissions like EAMs, or any traffic on the HF-GCS network, much of the information is not actually known.  That does not mean people do not have a good idea how / why things happen, however most of the time there is no actual documented proof you can point to.  So be careful with any information you receive, some of it is quite good but some of it is junk, and proving either is pretty hard.

First thing you have to remember is that EAMs and Skykings are not numbers stations.  Since they are not, they probably will not have similar habits to numbers stations.  And indeed they do not.  And then you must remember that such messages, the format of them, and any confirmation of what / how they are used, is classified information, so people who actually know are probably not going to say much.  I can say that when I was active duty I occasionally sent and received messages very similar in format to EAMs (but they were not EAMs), and that is pretty much all I am going to say on the matter.

A numbers station often has fixed group sizes, for example maybe 3, 4, 5, or 6 characters per group, depending on the station.  And so this results in a character count of some multiple of this group size.  And also note that most numbers stations typically do not mix numbers and letters, they are mostly all only numbers, but when they use letters they are typically all letters.  This may all be a result of the type of encoding that is done to this traffic.  Numbers stations also typically follow specific schedules, HF-GCS traffic typically does not.

But coded HF-GCS traffic is not a numbers station, and an EAM might have any number of characters, and so it will not have specific groups.  And the HF-GCS messages mix numbers and letters, however some numbers and letters are never seen.  Why is this?  Speculation, but I believe it is because the content is different and this traffic is encoded in an entirely different way

As for what is a SKYKING, that is a point of contention.  We know, from official documents and from observing habits, that a SKYKING is a higher priority message than either normal traffic or an EAM.  Some documentation ties SKYKINGs to SIOP (Single Integrated Operational Plan) which is part of the control and use of nuclear weapons.  But we also have good indication that SKYKINGs can be tied to other highly important platforms and uses, such as unarmed reconnaissance aircraft.

We also know that SKYKINGs are heard less frequently than other types of messages.  You average day on the HF-GCS network will probably have several, if not many, EAMs.  Some times you may have half a dozen, or more, in a single hour.  But you can go days without a SKYKING, or you may have a dozen SKYKINGs in a single day.

And then it is a safe bet that some EAMs and SKYKINGs are fake traffic, filler messages transmitted when there is no need for them, just to prevent anyone from using traffic analysis as an indicator of force activity.

So I think it safe to say, SKYKINGs are, when real, more important messages than other HF-GCS traffic, and that is really all we know about them.

Some people think if they hear a SKYKING that means something important is happening or about to happen, but to date no one has been able to tie either EAMs or SKYKINGs to world events.  For sure there have been 7+ SKYKINGs in the last 7 days and we are all still here.

T!

Wow! Hey first of all I want to make it clear that I don't assume any relation to world events and  HFGCS transmissions or Cuban Lady or any numbers station. That's not an issue with me; I only mention it now bcuz I noticed you told me that a few times. I'm sure lots of ppl do assume a relation, but I don't. I kno a great many confidential msgs of all types are dummy msgs, or "fillers" as you put it. That's what I would do if I were in charge: send a bunch of dummy msgs. In different languages. Just be aware I don't interpret world events thru the EAM or any #s station.

But funny you should mention 24-character msg with a 6-character callup. I just copied this msg:

KMKFMB

"msg follows"

KMKFMB A3O4 O2VT 6RAS FM5B SPIU PPPE

"This is Locksmith. Out!"

So I just noticed that; I was gonna post it here and then I saw your msg.

"They're not numbers stations." ← okay that's good advice for me. I should not expect the HFGCS to be like a #s station. That's pretty much answered  my question about these guys. "They're not encoded in the same way". THAT is the answer to my question...more or less

But...how can I tell if I'm hearing a SkyKing vs. typical EAM?

I like these guys. I get a kick out of em. Thnx
« Last Edit: June 09, 2018, 2106 UTC by [tRMZ] »
--------------------------------------
Upper MI's Copper Country
•Grundig Satellit 750•
•Kaito 1103• w/wire-clip EXT ant
•Uniden BC125AT•
2 •GE 3-5980A handheld CB•

(only INT stock antennas atm)

Offline MDK2

  • DX Legend
  • ******
  • Posts: 3636
  • Denver, CO
    • View Profile
    • My radio reception videos
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #5 on: June 09, 2018, 2223 UTC »
But...how can I tell if I'm hearing a SkyKing vs. typical EAM?

They'll say "Skyking" in the message. Check youtube for examples (search for "EAM Skyking").
Denver, CO.
SDRPlay RSP2pro, Icom IC-7100, Grundig Satellit 750, Realistic DX-300, Tecsun PL-600.
W6LVP active loop, 20m dipole, homebrewed mag loops.
eQSLs appreciated wickerjennie at gmail

Offline Token

  • Global Moderator
  • DX Legend
  • *****
  • Posts: 1793
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #6 on: June 10, 2018, 0119 UTC »
In general, today, SKYKING transmissions will follow the basic format of:

SKYKING, SKYKING, DO NOT ANSWER
HEARTBREAKER
TIME, 57, AUTHENTICATION, MIKE ALFA
I SAY AGAIN
SKYKING, SKYKING, DO NOT ANSWER
HEARTBREAKER
TIME, 57, AUTHENTICATION, MIKE ALFA
THIS IS KEG NAIL, OUT

In the past, and sometimes today, the format has been / is slightly different, but you get the general idea.

In the above case HEARTBREAKER is the message, it is a code word that has some meaning to someone.  The combination of the TIME and AUTHENTICATION are ways for the recipient to confirm the message is valid.  KEG NAIL is the rotating callsign of whoever sent the message.

T!
« Last Edit: June 11, 2018, 1214 UTC by Token »
T!
Mojave Desert, California USA

Offline Strange Beacons

  • Full Member
  • ***
  • Posts: 216
  • Seattle, WA
    • View Profile
    • Strange Beacons Website
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #7 on: June 10, 2018, 1528 UTC »
Just chiming in to say that was an outstanding write-up on the nature of EAMs and military traffic, in general. It makes perfect sense that one cannot truly find a pattern in the transmissions of those messages. If a definite pattern was noted, I'd call it a general failure of our military/intelligence services. So it makes sense that there would be "bogus" transmissions sent at random times. In a side note, I've lost count at the number of emails that I receive from people who swear that an increase in EAM traffic means that WW3 is imminent.  ;)

Curt / W9SPY

Offline MDK2

  • DX Legend
  • ******
  • Posts: 3636
  • Denver, CO
    • View Profile
    • My radio reception videos
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #8 on: June 11, 2018, 0608 UTC »
In a side note, I've lost count at the number of emails that I receive from people who swear that an increase in EAM traffic means that WW3 is imminent.  ;)

Curt / W9SPY

I like to say that as long as it doesn't spell out WING ATTACK PLAN R, we're probably OK.
Denver, CO.
SDRPlay RSP2pro, Icom IC-7100, Grundig Satellit 750, Realistic DX-300, Tecsun PL-600.
W6LVP active loop, 20m dipole, homebrewed mag loops.
eQSLs appreciated wickerjennie at gmail

Offline [tRMZ]

  • Full Member
  • ***
  • Posts: 112
  • MI's Copper Country
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #9 on: June 14, 2018, 1640 UTC »
In a side note, I've lost count at the number of emails that I receive from people who swear that an increase in EAM traffic means that WW3 is imminent.  ;)
Curt / W9SPY

I like to say that as long as it doesn't spell out WING ATTACK PLAN R, we're probably OK.

WW3 has been imminent since the end of WW2!  ;)

But you might actually know the answer to this question--

The only weird feeling I got about that type of thing was, I had been listening to the Cuban Lady ya kno cuz obviously everyone knows about her...anyway so I would sumtimes copy the msgs and sometimes I would notice a slight pattern, not in detail like you guys do...but anyway it really SEEMED to me...it might have been a misconception but after the "re-embargo" I thought,  Wow! These msgs seem like they are a LOT longer/bigger, like a longer duration and containing more numbers. Any truth to that? I'm sure like 50% of that Cuban Lady stuff is dummy msgs anyway and she gets boring but I got the distinct impression the LENGTH of the msgs in increased after the re-embargo
« Last Edit: June 14, 2018, 1830 UTC by [tRMZ] »
--------------------------------------
Upper MI's Copper Country
•Grundig Satellit 750•
•Kaito 1103• w/wire-clip EXT ant
•Uniden BC125AT•
2 •GE 3-5980A handheld CB•

(only INT stock antennas atm)

Offline [tRMZ]

  • Full Member
  • ***
  • Posts: 112
  • MI's Copper Country
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #10 on: June 14, 2018, 1825 UTC »
And then you must remember that such messages, the format of them, and any confirmation of what / how they are used, is classified information, so people who actually know are probably not going to say much.  I can say that when I was active duty I occasionally sent and received messages very similar in format to EAMs (but they were not EAMs), and that is pretty much all I am going to say on the matter.

Oh no! Now you guys are all thinking I'm a North Korean spy! :o

LOLLAPALOOZA!
 I SAY AGAIN-
LOLLAPALOOZA!

Ha  ;) jk but u kno I never listened for em around 06:00z...I've heard a lot like 23:00z...14:00z...I'll monitor around 06:00z more often. I fall asleep early!

THIS IS CORN COB NIBBLER.
CORN COB NIBBLER, OUT!  ;D  ;D
« Last Edit: June 14, 2018, 1833 UTC by [tRMZ] »
--------------------------------------
Upper MI's Copper Country
•Grundig Satellit 750•
•Kaito 1103• w/wire-clip EXT ant
•Uniden BC125AT•
2 •GE 3-5980A handheld CB•

(only INT stock antennas atm)

Offline MDK2

  • DX Legend
  • ******
  • Posts: 3636
  • Denver, CO
    • View Profile
    • My radio reception videos
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #11 on: June 14, 2018, 2238 UTC »
WW3 has been imminent since the end of WW2!  ;)

But you might actually know the answer to this question--

The only weird feeling I got about that type of thing was, I had been listening to the Cuban Lady ya kno cuz obviously everyone knows about her...anyway so I would sumtimes copy the msgs and sometimes I would notice a slight pattern, not in detail like you guys do...but anyway it really SEEMED to me...it might have been a misconception but after the "re-embargo" I thought,  Wow! These msgs seem like they are a LOT longer/bigger, like a longer duration and containing more numbers. Any truth to that? I'm sure like 50% of that Cuban Lady stuff is dummy msgs anyway and she gets boring but I got the distinct impression the LENGTH of the msgs in increased after the re-embargo

I can't say that I've noticed any particular pattern o any kind, regardless of the news.
Denver, CO.
SDRPlay RSP2pro, Icom IC-7100, Grundig Satellit 750, Realistic DX-300, Tecsun PL-600.
W6LVP active loop, 20m dipole, homebrewed mag loops.
eQSLs appreciated wickerjennie at gmail

Offline PRO2006

  • Sr. Member
  • ****
  • Posts: 344
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #12 on: June 14, 2018, 2354 UTC »
Watch Crimson Tide...good movie.

The numbers and letters of the actual message have no pattern, that's the whole idea. They are generated from a random character generator.

The character string is coded into a response on the receive side. If the receive side gets an exact match string of characters they execute that pre-programmed response. Like launch your stuff here or there..or it means valid orders to follow, or its just an exercise message.

There are other safeguards beyond just a code match, but I think that is how works high level. I suspect if you crunch the numbers on that code...with the number of alpha and numeric possibilities...that it would be many trillions to one that some unauthorized person could transmit a code that the receive side would respond to falsely....or that we could ever make any sense of it.

Maybe one could speculate that the longer the message string the more sensitive the receive side message...but that would only be speculation.
« Last Edit: June 15, 2018, 0224 UTC by PRO2006 »
SDR, PL-880, Alpha Delta DX-SWL Sloper, Southern Colorado

Offline R4002

  • DX Legend
  • ******
  • Posts: 2507
    • View Profile
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #13 on: June 20, 2018, 1220 UTC »
The call signs are more than likely different bases or aircraft using a rotating schedule of callsigns (I recall they used the names of different bands, heard PINK FLOYD, etc.) as callsigns - then FRESHMAN and LINEBACKER.  There are definite themes to the pool of callsigns that they rotate through. 

The reference to Wing Attack Plan R (and Dr. Strangelove in general) is actually somewhat accurate.  The use of authentication is a major plot point in that film - and in Crimson Tide too! (remember the CRM-114 discriminator - ignored all radio traffic except traffic that had the correct three letter coded prefix - that happened to be O P E [precious bodily fluids, purity of essence etc.]?) - the use of authentication is extremely important with "in the clear" networks such as HF-GCS...it wouldn't be too difficult to create imitation traffic on that network but without the correct authentication codes it would be obvious to all concerned that that traffic was fake (spoofing attempt). 

As mentioned, it is highly likely that a large amount of traffic heard on 4724 USB, 6712 USB, 6739 USB, 8992 USB, 11175 USB, 13200 USB and 15016 USB is likely "filler" traffic - since the EAMs use the One Time Pad method encryption the only possible way to glean information from listening to them is through traffic analysis...which can be mitigated by simply having huge amounts of "dummy" traffic mixed in with the actual messages. 

The HM01 network likely has large amounts of dummy messages, or nearly meaningless messages ("Happy International Women's Day!", things like that).  It's on a schedule after all.  There's probably huge amounts of transmissions that say something to the effect of "nothing to report".  But, as is the case with traffic analysis, a sudden drop off in activity could be just as important of an indicator as an increase in activity.
« Last Edit: June 20, 2018, 1226 UTC by R4002 »
U.S. East Coast, various HF/VHF/UHF radios/scanners/receivers

Offline MDK2

  • DX Legend
  • ******
  • Posts: 3636
  • Denver, CO
    • View Profile
    • My radio reception videos
Re: have you recognized any grouping pattern in the EAM msgs?
« Reply #14 on: June 20, 2018, 1320 UTC »
Yesterday there were messages coming from "Lame Duck." The op hesitated a couple of times during the reading of characters, and in one message he didn't say how many characters the message contained, which they usually do at the start. That made me believe it was just training, possibly that airman's first day on the mic.
Denver, CO.
SDRPlay RSP2pro, Icom IC-7100, Grundig Satellit 750, Realistic DX-300, Tecsun PL-600.
W6LVP active loop, 20m dipole, homebrewed mag loops.
eQSLs appreciated wickerjennie at gmail