I wonder why they keep using a dedicated numbers station instead of embedding the code in a regular radio broadcast on a traditional channel? I'm sure that even before LLMs one could find a way to create a story where certain numbers / code words would be embedded without altering the underlying story too much. And they could probably get BBC / whatever station to air it. It would be a bit less inconspicuous to listen to BBC than to a dedicated numbers station, even if the message would be undecryptable either way.
Shortwave propagates better and also its just a one time pad being distributed so embedding doesn't matter as much as long as the one time pad is longer than the intended message to send. There is no way to decrypt it because once you encrypt a message using a one time pad it is impossible to decrypt without the exact one time pad that it was encrypted with.
I can't find it immediately, but I've read about something even sneakier than this. A standard broadcast station was modified such that its carrier signal was modulated by a PSK signal. The intended listener would use e.g., a PSK-31 modem to listen to the carrier signal and would be able to obtain the encoded digital data. Everyday listeners would hear the regular broadcast. The station involved _might_ have been a BBC station, but I don't recall.
who's to say they aren't doing both? They may not even be sending anything over the number station; these stations will continue on a schedule even when there is nothing to say and nobody is listening because it makes it harder to eek out a foothold in the event of a weakness in the encryption.
Seems to me like coordinating with an entity outside of the spooks' control, such as the BBC, would give more opportunities for leaks. It would also reveal some information about who is controlling the signal--someone with some kind of relationship with the broadcaster.
Sure, but that would be a benefit, I would think. Most old cars come with an AM/FM radio, most cheap phones now have FM (? I don't know about AM, don't think so) and so on. So it would be more inconspicuous to listen to a regular radio than to a special station on special hardware. You don't even have to broadcast from EU, you could probably purchase some Radio Quatar Classical Rock or something :)
Shortwave radio is more challenging than you might imagine.
Near to the transmitter it's received by ground wave, further it's scattered off the ionosphere. In-between it's undetectable due to the skip zone. This might also explain why Amelia Earhart went missing [1]
Coverage is obtained from multipath and reflections. Leading to variable strength and timing. Not as bad as DXing on HF with low power but much harder than you might imagine.
Fine for someone to transcribe some numbers but useless for people trying to identify sources.
So locally you get an apparent direction to the source which is clearly not the source.
Add to that the complex local terrain and a well placed number stations can be very difficult to locate with precision.
Edit: unrelated but interesting there are some mysteries in HF transmission including long delayed echoes where a signal takes far longer than reasonable to travel out and back over several seconds [0] which given its travelling light milliseconds is a conundrum.
My father regailed tales of his college years where it was a game to have a HAM radio operator start broadcasting and to have teams try to find where they were hiding, first.
More challenging? Not really. It does require multiple boots on the ground to do it.
Two receivers of the same signal may not be from the same proximate source. One could from the original antenna the other from a reflection. Both could be reflected but by different reflectors. Even if the proximate source was the same for both the receivers, triangulation might yield the location of a virtual image of the original source.
BTW I am just going by geometry and may be way off because radiowaves behave quite differently compared to visible light.
One might need effectively the inverse of beamforming to nail it.
As a HAM who takes part in fox hunting I can assure you when we do it within 100miles of a target transmitting a continuous signal it's very different to the task of triangulating a number stations.
You also said if you can receive the signal you can triangulate it. Really? Because I know people who've had voice communicating bouncing off aurora. Not to mention moon bounce with digital modes.
If anyone is interested in further reading, this group are the world's leading experts on number stations (outside of intelligence services of course). They've done a detailed article on the new station, including recordings, technical mishaps, and analysis of why they believe the station is CIA run. https://priyom.org/number-stations/other/v32
> Considering the topical interest in this station, the Priyom team shares its further expertise regarding V32's attribution, beyond being transmitted from a US military facility. While this remains unconfirmed speculation, and not facts, a prime candidate for the operator of this station would be the CIA. Contrary to popular belief, US intelligence has not entirely moved away from numbers stations. Sources in the intelligence community indicate that the CIA provides extra training about numbers stations and one-time pads to clandestine agents assigned to locations with a very hostile operating environment, such as Iran or North Korea: it is envisioned as a last-resort means of communication with high-value sources. So according to this, numbers stations are actually still an institutional part of the CIA playbook. The war in Iran, and the Internet blackout installed by the regime, fulfill the very circumstances for which the CIA would have planned this.
> We already know that the CIA has a significant presence in Iran and involvement in the war, having provided crucial intelligence tracking Iranian leaders that enabled the assassination strikes that kickstarted the war. They most probably have had a network of infiltrated assets already in place and organized, ready to be reached through a numbers station if need be right when the war started - which makes the CIA a candidate for running V32 consistent with a legitimate intelligence operation. However, what we've observed from V32's operations - technical quirks and shifting formats - suggest that the technical deployment of the numbers station and shortwave transmissions themselves may have been a little rushed by the circumstances.
> Another noteworthy feature of V32 is how all its transmissions take place on the same frequency. Most other numbers stations in general are comprehensive operations targeting many different recipients in different countries, and making use of many different transmission times and frequencies suited to the particular signal propagation needs corresponding to all those areas. In contrast, the fact that V32 always uses a single, same frequency, at always two given times of the day, would be consistent with an operation that only needs to target a single geographical area: Iran.
This reminds me of UVB-76[0], a shortwave military radio in Russia. It would be interesting know why they're using this method to communicate covertly rather than beaming down messages to a phone via satellite or something. I'm not an expert on radios, though, so maybe it's not as clunky as I'm imagining where an undercover asset is hauling around bulky equipment.
Like the article says, satellite messages can be traced while radio is broadcast to everyone so it's impossible to find out who's listening. Shortwave radios are also cheap and widespread, so it's easy to get one anywhere in the world and if your house gets searched, it won't be suspicious if you have one.
> Shortwave radios are also cheap and widespread, so it's easy to get one anywhere in the world
I always hear this in discussions about number stations, but I don't think this is true in the US. In fact, I don't think I've ever seen a general consumer "shortwave radio". Unless the regular AM band counts, which seems to be medium wave.
It’s simple, reliable, and effective. Shortwave receivers can be made fairly compact. They’re also very prevalent in most countries (every ham transciever), so there’s nothing suspicious to pack. People find numbers stations interesting, so they are often streamed online. One time pads have their logistical shortcomings, but are still the best encryption possible. The OTP can be compromised in known, visible ways, where a phone has myriad invisible ways to be compromised.
Phones usually contain the hardware for radio too, so making sure agents have some set of models for that doesn't sound bad. Even if you had to use a dedicated one having a radio at home isn't that conspicuous? Or in a car, etc
perhaps they're not directed at deeply embedded lone spies with radios in their attics, but at 'military assets' which as a matter of course can receive these transmissions on a designated schedule.
Better source: https://www.rferl.org/a/mystery-numbers-station-persian-sign...
I've been off put by WIRE recently. Thanks for this.
I wonder why they keep using a dedicated numbers station instead of embedding the code in a regular radio broadcast on a traditional channel? I'm sure that even before LLMs one could find a way to create a story where certain numbers / code words would be embedded without altering the underlying story too much. And they could probably get BBC / whatever station to air it. It would be a bit less inconspicuous to listen to BBC than to a dedicated numbers station, even if the message would be undecryptable either way.
Shortwave propagates better and also its just a one time pad being distributed so embedding doesn't matter as much as long as the one time pad is longer than the intended message to send. There is no way to decrypt it because once you encrypt a message using a one time pad it is impossible to decrypt without the exact one time pad that it was encrypted with.
I can't find it immediately, but I've read about something even sneakier than this. A standard broadcast station was modified such that its carrier signal was modulated by a PSK signal. The intended listener would use e.g., a PSK-31 modem to listen to the carrier signal and would be able to obtain the encoded digital data. Everyday listeners would hear the regular broadcast. The station involved _might_ have been a BBC station, but I don't recall.
who's to say they aren't doing both? They may not even be sending anything over the number station; these stations will continue on a schedule even when there is nothing to say and nobody is listening because it makes it harder to eek out a foothold in the event of a weakness in the encryption.
Seems to me like coordinating with an entity outside of the spooks' control, such as the BBC, would give more opportunities for leaks. It would also reveal some information about who is controlling the signal--someone with some kind of relationship with the broadcaster.
regular AM/FM stations are not broadcasting on shortwave bands
Sure, but that would be a benefit, I would think. Most old cars come with an AM/FM radio, most cheap phones now have FM (? I don't know about AM, don't think so) and so on. So it would be more inconspicuous to listen to a regular radio than to a special station on special hardware. You don't even have to broadcast from EU, you could probably purchase some Radio Quatar Classical Rock or something :)
There are still quite a few shortwave radio stations broadcasting.
"We don't need NATO." But we do need our bases in Germany plz.
https://archive.is/20260323190952/https://www.wired.com/stor...
https://priyom.org/number-stations/other/v32
Does this move around geographically ? Triangulating broadcast location is a well understood craft.
Shortwave radio is more challenging than you might imagine.
Near to the transmitter it's received by ground wave, further it's scattered off the ionosphere. In-between it's undetectable due to the skip zone. This might also explain why Amelia Earhart went missing [1]
Coverage is obtained from multipath and reflections. Leading to variable strength and timing. Not as bad as DXing on HF with low power but much harder than you might imagine.
Fine for someone to transcribe some numbers but useless for people trying to identify sources.
So locally you get an apparent direction to the source which is clearly not the source.
Add to that the complex local terrain and a well placed number stations can be very difficult to locate with precision.
Edit: unrelated but interesting there are some mysteries in HF transmission including long delayed echoes where a signal takes far longer than reasonable to travel out and back over several seconds [0] which given its travelling light milliseconds is a conundrum.
[0] https://en.wikipedia.org/wiki/Long_delayed_echo
[1] https://youtu.be/zTDFhWWPZ4Q?si=Ib8jfbdNP-sLHM0B
My father regailed tales of his college years where it was a game to have a HAM radio operator start broadcasting and to have teams try to find where they were hiding, first.
More challenging? Not really. It does require multiple boots on the ground to do it.
Presumably doing it locally within a known few mile radius is different from nation-scale broadcast areas bounced from god-knows-where?
If you can receive a shortwave signal, you can triangulate the source.
Reflections will pose a problem though.
Two receivers of the same signal may not be from the same proximate source. One could from the original antenna the other from a reflection. Both could be reflected but by different reflectors. Even if the proximate source was the same for both the receivers, triangulation might yield the location of a virtual image of the original source.
BTW I am just going by geometry and may be way off because radiowaves behave quite differently compared to visible light.
One might need effectively the inverse of beamforming to nail it.
Exactly I have friends who have had voice contacts reflecting off aurora at VHF
That made my day. Thanks for the laughs.
This seems to be a common treasure hunt game conducted by HAM clubs.
That was it. Treasure hunt.
Also known as fox hunting.
As a HAM who takes part in fox hunting I can assure you when we do it within 100miles of a target transmitting a continuous signal it's very different to the task of triangulating a number stations.
You also said if you can receive the signal you can triangulate it. Really? Because I know people who've had voice communicating bouncing off aurora. Not to mention moon bounce with digital modes.
Thanks that was quite illuminating. I knew about ionospheric reflections to be a problem but not the others.
N 48.690438° E 9.086693°
If anyone is interested in further reading, this group are the world's leading experts on number stations (outside of intelligence services of course). They've done a detailed article on the new station, including recordings, technical mishaps, and analysis of why they believe the station is CIA run. https://priyom.org/number-stations/other/v32
> Considering the topical interest in this station, the Priyom team shares its further expertise regarding V32's attribution, beyond being transmitted from a US military facility. While this remains unconfirmed speculation, and not facts, a prime candidate for the operator of this station would be the CIA. Contrary to popular belief, US intelligence has not entirely moved away from numbers stations. Sources in the intelligence community indicate that the CIA provides extra training about numbers stations and one-time pads to clandestine agents assigned to locations with a very hostile operating environment, such as Iran or North Korea: it is envisioned as a last-resort means of communication with high-value sources. So according to this, numbers stations are actually still an institutional part of the CIA playbook. The war in Iran, and the Internet blackout installed by the regime, fulfill the very circumstances for which the CIA would have planned this.
> We already know that the CIA has a significant presence in Iran and involvement in the war, having provided crucial intelligence tracking Iranian leaders that enabled the assassination strikes that kickstarted the war. They most probably have had a network of infiltrated assets already in place and organized, ready to be reached through a numbers station if need be right when the war started - which makes the CIA a candidate for running V32 consistent with a legitimate intelligence operation. However, what we've observed from V32's operations - technical quirks and shifting formats - suggest that the technical deployment of the numbers station and shortwave transmissions themselves may have been a little rushed by the circumstances.
> Another noteworthy feature of V32 is how all its transmissions take place on the same frequency. Most other numbers stations in general are comprehensive operations targeting many different recipients in different countries, and making use of many different transmission times and frequencies suited to the particular signal propagation needs corresponding to all those areas. In contrast, the fact that V32 always uses a single, same frequency, at always two given times of the day, would be consistent with an operation that only needs to target a single geographical area: Iran.
Sounds like a CIA numbers station transmitting info to agents on the ground.
This reminds me of UVB-76[0], a shortwave military radio in Russia. It would be interesting know why they're using this method to communicate covertly rather than beaming down messages to a phone via satellite or something. I'm not an expert on radios, though, so maybe it's not as clunky as I'm imagining where an undercover asset is hauling around bulky equipment.
0: https://en.wikipedia.org/wiki/UVB-76
Like the article says, satellite messages can be traced while radio is broadcast to everyone so it's impossible to find out who's listening. Shortwave radios are also cheap and widespread, so it's easy to get one anywhere in the world and if your house gets searched, it won't be suspicious if you have one.
Satellite unicast receivers also can't be located. Iridium pagers were (maybe still are?) a thing, for example.
However, carrying one of these is probably highly suspicious compared to a world band radio receiver.
> Shortwave radios are also cheap and widespread, so it's easy to get one anywhere in the world
I always hear this in discussions about number stations, but I don't think this is true in the US. In fact, I don't think I've ever seen a general consumer "shortwave radio". Unless the regular AM band counts, which seems to be medium wave.
def a niche consumer item these days. but pretty easy to make your own.
It’s simple, reliable, and effective. Shortwave receivers can be made fairly compact. They’re also very prevalent in most countries (every ham transciever), so there’s nothing suspicious to pack. People find numbers stations interesting, so they are often streamed online. One time pads have their logistical shortcomings, but are still the best encryption possible. The OTP can be compromised in known, visible ways, where a phone has myriad invisible ways to be compromised.
Phones usually contain the hardware for radio too, so making sure agents have some set of models for that doesn't sound bad. Even if you had to use a dedicated one having a radio at home isn't that conspicuous? Or in a car, etc
a consumer phone usually would only have an FM receiver
perhaps they're not directed at deeply embedded lone spies with radios in their attics, but at 'military assets' which as a matter of course can receive these transmissions on a designated schedule.