Pages

12 March 2016

The Stupidly Simple Spy Messages No Computer Could Decode

by Shane Harris , March 6, 2016 
Every day, hour after hour, the world’s spies send top secret information you can easily listen in on.
When I was 10 years old, I found a shortwave radio in a crumbling old leather trunk where we kept family photos and other memorabilia. As I spun the dial, tinny, modulating noises, like the song of an electronic slide whistle, emanated from the radio’s small speaker. Staticky cracks and pops competed for airtime. The sounds swished and swirled, unintelligible and unremarkable. But then, emerging through the clamor, was a voice.
I might have run right over it with the dial, but the voice’s rhythmic, steady pacing caught me up short. It wasn’t a deejay. Nor a commercial. And he wasn’t singing. He was just speaking. The same line, over and over again.

“7…6…7…4…3.” Pause. “7…6…7…4…3.”
I don’t remember if those were the exact numbers. But they were numbers. A repeated sequence which had no obvious meaning, and was entirely devoid of context. To find him here, amidst the screeches and howls of the shortwave frequencies, was like coming upon a man standing in the middle of a forest, talking out loud to no one.
How long had he been here? Who was he talking to? He had that officious tone of the recorded telephone operators who chastised you for dialing a wrong number. “Please hang up, check the number, and dial again.” And the same distracting static I’d heard in those messages filled the background. I wasn’t sure if he was speaking live, or if he’d been recorded and set loose to play into the air.
But there was an urgency to his tone. And a purpose. As if he were talking to me. Imploring. Listen. Hear me now. 7…6…7…4…3. Did you get that? 7…6…7…4…3.

I was simultaneously terrified and captivated.
I never touched the radio again. My curiosity was suppressed by a feeling of dread that I had heard something not meant for me. But I never stopped thinking about it. The voice became a character I passed around with friends during late-night ghost stories. The Bell Witch. The Killer in the Back Seat. The Numbers Man.
I understood that the voice wasn’t an apparition or an urban legend-which made it even more compelling. But it would be another 25 years before I learned what I’d really heard on the shortwave radio. That man had been talking to someone. Not me. But someone in particular, who knew exactly what the Numbers Man was saying. I had intercepted a message to a spy.
The frequency I’d stumbled upon was broadcasting a “numbers station.” The message was almost certainly sent by the Central Intelligence Agency, which broadcast numbers over shortwave during the Cold War from a facility in Warrenton, Va., about a 10-hour drive from my home at the time in the suburbs of Nashville, Tenn. That series of seemingly random numbers was actually a coded message, which anyone with an inexpensive shortwave radio could hear, but that could only be understood by someone with the right key.

I heard the numbers in 1986, when U.S. spycraft was devoted to defeating the Soviet Union and its proxies. The message was probably intended for a U.S. intelligence officer working in an embassy in Latin America or a CIA agent in the field there. But the agency had a global network of radio broadcasts for communicating with agents in every country where it was running operations.

“Facilities with giant antenna farms…were positioned at strategic locations in the United States and abroad,” according to the 2008 book Spycraft: The Secret History of the CIA’s Spytechs, from Communism to Al Qaeda, co-written by the agency’s former director of the Office of Technical Service, which designs espionage gadgets and disguises. (A new edition contains a foreword by former CIA Director George Tenet, which is about as close to an endorsement of the contents that America’s oldest spy agency will ever get.)

Sending orders to spies over the public airwaves might seem antithetical to covert activity, but it was practically guaranteed to expose no secrets. While it was easy to find the source of the numbers-it’s very hard to hide a radio tower-a shortwave radio in the mid-’80s would have drawn no more suspicion than a laptop computer or an iPhone today. The mundane nature of the whole communication obscured its true purpose. Eventually, agents were given receivers no bigger than a packet of cigarettes, making concealment trivial, according to the authors of Spycraft.


Had I continued twirling the radio dial, I might have encountered messages intended for spies here, in the U.S., probably from Cuba. “Siete…seis…siete…cuatro…tres. ” For decades, numbers stations have been a favorite way for Cuban intelligence to make contact with their American agents. The practice didn’t fall out of fashion with the end of the Cold War. In the past 15 years, at least five Cuban spies who used numbers stations to communicate with their handlers in Havana have been sent to prison-Anna Montes, a former senior analyst at the Defense Intelligence Agency who pleaded guilty to spying for Cuba in 2002; Carlos Alvarez, a university professor in Florida, and his wife, Elsa, who admitted in 2007 to informing on Cuban exiles; and Walter Kendall Myers, a former State Department official, and his wife, Gwendolyn, who in 2009 were sentenced to life in prison after spying for the Cubans for three decades.

Cuban intelligence continues to send numbers into the U.S., despite the warming trend between Washington and Havana. The numbers emanate from the same building used by a Cuban news station.

For decades, the Soviets broadcast numbers into Europe, which I wouldn’t have been able to hear on my radio. But today, the Russians operate a large numbers network, both to communicate with spies-in Ukraine, for example-and to send messages to military forces. Now, those transmissions can he heard online via shortwave radios connected to the Internet.


The British are believed to have run a numbers station from a military base in Cyprus from the 1970s until 2008, probably to communicate with their spies in the Middle East and North Africa. The station announced a numbers sequence by playing a creepy, synthesized version of an English folksong, “The Lincolnshire Poacher.” I like to imagine little children being drawn near a radio expecting a delightful story hour, only to be greeted by a fiendishly chipper Englishwoman intoning, “0…2…5…8…8!”

Whatever the language, wherever the broadcast, the numbers stations all sound the same. Men and women, usually with impeccable diction, methodically rattle off codes that almost no one will comprehend. On many stations, the sequences consist of pre-recorded numbers spliced together. Others use computer-generated voices. Some numbers stations have used children, whose higher-pitched recitations might be easier to hear over the bristling shortwave frequencies.

The numbers stations have been all around us for decades, equally disturbing whether in English, Polish, or Mandarin. And they have endured, despite advances in electronic communications and encryption, because although they’re accessible to anyone, numbers stations are one of the most secure forms of clandestine communication ever devised.

I could work for the rest of my life and never decipher the message I heard years ago. Even today, the most powerful supercomputers thrumming away in vast, refrigerated rooms at the National Security Agency couldn’t break the code that protected it. That computer the FBI wants to hook up to the iPhone used by one of the San Bernardino shooters to guess its password by “brute force?” Useless against the Numbers Man’s secret message.

That’s because the message was encrypted using a simple but enormously effective key known only to two parties-the sender and the recipient.

Whomever the numbers were meant for would have been listening to the Numbers Man at the same time as me. “7…6…7…4…3.” He might write the numbers down in a row on a piece of paper. But underneath that, he’d write another row of the same length, using random numbers given to him earlier by the CIA or whatever intelligence agency was running him. These numbers were the key. Going number by number, he’d subtract row two from row one and come up with a third row. And those numbers corresponded to letters, which spelled out a message.

This is just one example of how a listener might decrypt a numbers broadcast. But in all cases, the immutable characteristic of the system is that it’s easy to use. Decoding requires no special skills. No facility with cryptography. Anyone who can listen to a series of numbers, write them down, and perform basic math can do the job. Had I known the key, at age 10, I could have spelled out the spy’s message.

But the numbers are just gibberish without that key, known in spycraft as a one-time pad. As its name suggests, it’s used only once. And that’s what makes it so secure.

A former career U.S. intelligence officer told me that the pads were distributed to agents in tiny booklets composed of dozens of pages filled with numbers. Each day, the agent would rip out one page from the booklet and discard it. The intelligence officer told me that some of the pages were designed to dissolve in water. The agent could flush it down a toilet or even drop it in a glass of water at a café. The CIA reportedly made other pad pages that turned into gum on contact with saliva. I don’t know if they were mint flavored.

Every day, a new key. Even if another spy found that day’s key, it’d be useless come midnight. And if the entire book were compromised, well, just make a new one.

It is the beautiful paradox of the numbers stations that secret messages were literally sent into the air, for anyone to hear, but could only be understood by one person. So long as the pad wasn’t compromised, the numbers station codes were unbreakable. Perfect secrecy. All out in the open.

The utility of the stations is undeniable. But so is their public appeal. Numbers stations offer the only chance for an average person to safely eavesdrop on spies, from the comfort and security of their own home.

Legions of shortwave radio enthusiasts and amateur operators have devoted uncounted hours of their lives to tracking the numbers stations. They are a subculture with a penchant for secrecy and mystery-a lot like the spies they’re chasing around the radio dial.

The European Numbers Information Gathering Monitoring Association, which goes by the acronym ENIGMA-a delightfully cheeky choice if you know your cryptography history-has compiled what numbers trackers consider the most authoritative list of active and now-silent stations around the world. New discoveries lead off a newsletter, published every two months, that’s now on its 93rd issue.

In its January newsletter, ENIGMA reported at least one new numbers station may have been discovered broadcasting from Asia, possibly in Korean. This month, the group came upon a station operating in Siberia that may be new or could be connected to an earlier known station, perhaps one used by Russian military forces.

ENIGMA’s watchers chronicle every intelligible detail about a station, including the frequency on which it broadcasts, the dates and times it was heard, and the quality of the transmission. The group also tracks a variant of the numbers stations that transmit in Morse code, and notes the rhythm and precision of the sender: “Fare, med-fast;” “Strong, slow;” “Irregular with long pauses;” “Errors noted.”

It’s worth noting that this is exactly what eavesdroppers working for signals intelligence agencies, such as the National Security Agency, have done for decades. Today, they’re tracking computer hackers and compiling dossiers of their various signatures and tell-tale techniques. The work is the same, hunting based on electronic signature.

The trackers’ obsessiveness and attention to detail is inspiring, though slightly puzzling when you consider that, as ENIGMA has put it, “the number of past stations now greatly outnumber[s] the active stations.” Who exactly are they tracking this stuff for?

It’s possible that intelligence agencies, including NSA, are reading ENIGMA’s list to keep track of new numbers stations popping onto the scene. But I found that the numbers trackers are generally, and genuinely, doing this for each other. There’s an infectious intrigue about the stations, and the quest to discern them is tinged with just enough suspicion to keep things exciting without getting paranoid.

To listen in on the stations, at a safe distance, is to share a secret, albeit an open one. You can plunge into an underworld but know that, at any moment, you can come back up for air. You can move among spooks with no risk of being caught. Indeed, they know you’re listening, but that you can’t understand a thing. It is voyeurism crossed with immersion. The particular thrill is unrivaled, in my experience, by the greatest spy movies and novels.

“Wow, exciting, James Bond on the radio!!” That’s how Ary Boender, who runs the website Numbers & Oddities, also known as the “Spooks Newsletter,” described his reaction after learning about the voice he’d first heard on a shortwave radio he bought in 1978. “I stumbled over a couple of numbers stations, the East and West German ones,” he told me. “I had no idea what it was, but it was so different from all the other stations. … I found out that there were radio clubs and magazines about the hobby and became a member of several clubs.”

Boender’s site is now one of the must-reads for numbers trackers. He keeps close watch on which countries are still using the stations, and which have abandoned them. And while the U.S., the United Kingdom, and Israel have stopped, he said, they are vibrant elsewhere, a testament to the durability of the system.

Numbers stations have been located in Ukraine, transmitting in Russian and English. Poland operates a large number, in both Polish and English. Egypt has a network, in English and Arabic. Taiwan broadcasts in Mandarin into mainland China. China, in turn, runs its own numbers networks, and many of them are used for military purposes, such as communicating with deployed forces. South Korea and North Korea each run numbers stations, presumably to communicate with spies in each other’s countries, though it’ s possible that each is trying to convince the other that’s what it’s up to. Some numbers stations are believed to be set up only to confuse an adversary and give the appearance that his country must be crawling with spies, thus diverting time and money to hunting them. Such is the case with one station that has operated out of Taiwan and whose daily message, loosely translated, begins, “Good morning! Here is your encrypted message!” The site has been labeled a ruse.

And just because the U.S., the U.K., and Israel are no longer using shortwave numbers stations doesn’t mean they’re out of the business of sending encrypted messages to spies. “They probably switched to either digital modes or satellite,” Boender said.

And then there’s Russia, which, in the pantheon of numbers broadcasters, occupies its own, special place. “Russia is the most active country,” Boender said, transmitting in Russian, English, Spanish, German, Morse code, “and a host of digital modes.” Numbers stations were a staple of Cold War espionage and remain a fixture of intelligence and military communications. And that makes the country irresistible to numbers trackers.

Just what it is it about numbers stations that continues to captivate Russian military and intelligence forces, the trackers aren’t really sure. During the Cold War, the country built up its radio broadcasting infrastructure and perhaps sees no reason to invest in a replacement, especially when the current system is essentially impenetrable.

But a lot of what the trackers are hearing on the airwaves can’t be properly called numbers stations. They are “military stations,” using the same encryption techniques as their spy brethren, but to communicate with the armed forces, not with undercover spies.

That has done nothing to blunt the passion for keeping tabs on the Russian transmissions. Indeed, when one of the most famous military stations suddenly stopped broadcasting in 2010, it sent off an existential panic in the tracker community, which at the time had mushroomed on the Internet.

The station, sometimes known as UVB-76, but more commonly called “The Buzzer,” is the most unnerving I’ve ever encountered. For most of its existence, which has been traced back to an original airdate in 1976, it has transmitted a short, high-pitched buzz, every few seconds. It buzzes 24 hours a day. No numbers. No apparent message. Just an unceasing buzz pulsing through the air.

Occasionally, voices have been heard on the station. Sometimes calling out Russian names in the same rhythmic fashion used to read numbers. But then, it’s back to buzzing. A few times, listeners have heard conversations, though some of those are believed to have been transmitted by mistake-two different groups were trying to broadcast on the same frequency at once. (This happens in Cuba, as well, where the famous number station HM01, still beaming strong into the U.S. out of the same facility as Radio Havana, occasionally transmits the news.)

Why The Buzzer buzzes has been a perennial cause of speculation. During the Cold War, a theory took hold that the station was part of a Soviet “dead hand” system that would automatically unleash the country’s nuclear arsenal on the U.S. and Europe if the Soviet leadership had been killed in a first strike by the Americans. So, in June 2010, when The Buzzer inexplicably stopped buzzing, its followers were thrown into a panic, believing that the station must have been knocked offline in the first strike, which meant that the dead hand was about to unleash global apocalypse.

“The Internet went mad,” said Stefan Meyers, who runs Priyom.org, a site devoted to tracking numbers stations that lets people listen to live broadcasts. Once people saw they hadn’t been incinerated, Meyers and others became obsessed with the station and learning its real purpose. They studied the buzz. Its frequency. Its duration. “It got a lot of analysis by people who are very good at signals analysis,” Meyer told me. “You’d be amazed at the skills of people in the ham [amateur radio] community.”

Their conclusion? The buzz itself carries no message at all. “It’s a channel marker,” Meyers said. A kind of beacon that tells people they’ve landed on the right station and to wait for a message. The buzz itself is likely the product of a simple circuit board set up to make the noise. Sometimes, you can hear the pitch change, and the buzzer slow down, as the electrical system powering it falters.

No dead hand. No armageddon plot. Just a crappy electrical system and a broadcast that occasionally gets interrupted when Boris or Natasha talk on the wrong frequency.

“Some poor, horrible, unlucky person gets to sit listening to that all day until the message comes up,” Meyers said.

And yet, exposed as a run-of-the-mill military station, the fascination with the station hasn’t abated. “The mystery is indeed the buzz. It triggers people’s fantasy, but it does not contain any intelligence,” Boender said.

On the occasions when the station does transmit messages, it’s used as part of the communications apparatus for Russia’s Western Military District, which includes Moscow. In 2011, the Buzzer was replaced by a recording of “Swan Lake.” That coincided with military movements in the Moscow area, Meyers said. So, though it’s not transmitting to spies, the Buzzer does have some role in Russian military operations, which guarantees it will be the subject of endless attention.

When I approached the numbers trackers, it was with some trepidation. I didn’t want to lose that mix of awe and fear that I remembered so strongly from childhood, and I worried that a community of obsessive-compulsive radio freaks would show me too much, and demystify what had been, for me, a kind of real-life ghost story that I couldn’t stand to think was merely a bunch of meaningless buzzes and robotic voices, talking to nobody, for no reason.

Instead, I found a group of people motivated by a sense of wonder at a thing they desperately want to understand, but know they never fully can. And reassured that, menacing though a global apparatus for communicating secret messages and military orders might be, it does exist and can be sensed.

“Isn’t it nice to have something really weird that actually is a real thing?” Meyers told me.

His and the other trackers’ enthusiasm is that of a 10-year-old kid unwittingly stepping into the middle of a spy’s conversation. We know we’re not supposed to be there. That this world doesn’t fully include us. And yet, by its own brilliant, elegant design, it cannot exclude us, either. We get to listen in, even as we’re forced to sit on the edges of the discussion, never quite sure what’s being said, or why. We are content to be bewildered.

No comments:

Post a Comment