MOSSAD NATO Alphabet Stations (E10)
"According to Greg Mitchell in the July, 1984, issue of Popular Communications magazine, within Israel (and any territories it may occupy), the General Security Service (Sherut Bitkhon usually called Shabak) handles counter intelligence activities. A similar organisation, Sherutt Bitakhon (better known as Shin Bet)' looks after other security matters. Another group, Reshud, guards against international terrorism. Abroad, the main intelligence agency (Israel's agency that is roughly equivalent to the American CIA) is the National Security Institute (MOSSAD Ha Bitakhon Leumi). An organisation called Agaf Modi'in (usually called Aman) collects military intelligence abroad. No information is available on whether or not there are any embassy personnel around the world connected with these activities, however Israel's intelligence agencies have been noted on short-wave. Stations have been monitored with female operators (live, or automated voice recordings) reading coded 5 - Letter groups. These stations have been monitored since the mid -1970's. Transmissions primarily appear to be one-way broadcasts and are usually identified with a tactical call-sign consisting of 3 phonetic letters (such as Charlie India Oscar. or Victor Lima Bravo, etc.). sometimes followed by a suffixed digit; the suffix "1" is indicative of a test transmission; a "2" means " no message." Broadcasts are often simulcast over several frequencies by a given call-sign. - Indeed the MOSSAD link is very strong in the minds of American monitors. Larry Van Horn writing in the November 1990 issue of Monitoring Times - The Israeli MOSSAD is a world-wide operation from US military spies to the intelligence needed for the raid on Entebbe, MOSSAD agents have had a hand in each operation. No doubt the mystery 'Phonetic Alphabet' stations heard throughout the short-wave. spectrum have played a major role in getting messages out to their agents world-wide. The headquarters of the MOSSAD is located in Tel Aviv. From atop an office building in this city, signals are sent out by microwave and UHF to short-wave. transmitters located throughout Israel. (This information has never been confirmed.) Several years ago, short-wave. listener Greg Mitchell, while staying at a hotel just outside Tel Aviv, noted signals from the 'Alphabet Stations' blasting through on his short-wave. receiver. He noted up to twenty different transmissions during the hour. These transmissions consisted of long lists of letters. These letters are spoken phonetically (Alpha, Bravo, Charlie, etc.). The announcers of these broadcasts are female and probably like the U.S. numbers stations, automatic machines do the actual announcing According to Mitchell, the tapes with the messages are prepared and sent via telephone, UHF or microwave links to over 20 short-wave. transmitting sites in Israel. These transmitters range in power from 10 to 20 kW and use suppressed AM carriers or sideboard depending on where the messages are destined for. (Again this is unconfirmed.) Most call-signs can be heard on two or more frequencies simultaneously, higher frequencies being used during daylight hours. Just prior to scheduled broadcast time, one can hear the frequencies to be used keyed up using the appropriate callsign or just part of it. Single figure codes are often given after the callsign - usually a two which indicates no message (usage much like a marine DE/CQ station marker). It has been reported that 1 in the call suffix indicates a transmission for test purposes. The number may also be 0, 3 or 9 or indeed any other numbers. There also have been suffixes noted with number/letter or letter/number combinations ( e.g. - 1D and X2 ). The meaning of these calls and others are as yet unclear. When codes are given after the callsign NO MESSAGES are sent. When only the three-letter callsign is heard then a message will follow. The same messages are transmitted at exactly the same time each day, and may run for several days before they are changed. Occasionally a callsign will be transmitted continuously including a special code, ( e.g. - CIO 80886 or SYN 97144 ). Also, other Callsigns may be heard On a particular frequency as well as the expected call-sign. When these are heard they are nearly always much weaker in strength. This may be a fault at the transmitter site or is an indication, as I mentioned earlier, of various power levels and more than one transmitter site in use. Larry Van Horn wrote a good summary of the E10 stations, but again, the question of "suffix transmissions remained unanswered- Simon Mason writing in his book Secret Signals - The Euronumbers Mystery only gives the E10 stations a brief mention and refers readers to Tom Kneitel's book mentioned earlier in this feature Simon does, however. say, "apart from the 1 and 2 suffixes, other, more elaborate headings have been sent. The purpose of these is unknown". 'Langley Pierce' sets out with good intention in his book." Intercepting Numbers Stations, to explain the purpose of E10 "suffix" transmissions but falls short of a full explanation. Mr Pierce' makes the following statements on the subject in section 5 - Decoding Special Codes. "CIOTlBlBl4ZlIZ55 decodes to 1, 1, 14, 11 and 55 The exact purpose of individual letters is unknown, although the letter N has had high precedence traffic associated with it. And the meaning of individual number codes are as equally mysterious. Over the years a variety of these special codes have been aired, each more exotic than its predecessor. I would now like to analyse point by point the facts previously stated in the articles mentioned above. Is it Israel ? This would seem the most obvious question. Certainly the earliest reports suggest that Israel is the source of the E1O stations. American monitors seem convinced and now prefer to refer to the station as simply 'MOSSAD' in logs and features. Information received by ENIGMA in 1993 from two independent sources suggests that some of these transmissions do originate from Israel. In May 1994 ENIGMA's own Mike Chace visited the Greek Islands (see issue 6.). Mike wrote - "The MOSSAD stations provided some useful base line signals as they are assumed to be transmitted from Israel. Sure enough, all day round, no matter what the frequency, EZI, YHF, CIO and co. provided MASSIVE signals. As an illustration, the midday EZI transmission on 17410 and 19715 kHz are pretty poorly received in the UK. Over at the holiday QTH, these signals were very strong with just a foot of the set's internal whip antenna extended!. So strong in fact, that the mains hum on the transmitter could be heard. * Could this suggest possible ground wave from Cyprus ? And in January 1996 following the publication of John Griffith's article "Radio by Numbers" in Short-wave. Magazine, ENIGMA received an anonymous letter from London which clearly stated that transmissions from E10 stations were of Middle East origin, notably Israel. Some time ago reports began to circulate about an E10 transmission on 8127 kHz with the familiar call VLB. Transmissions from the Medium Wave station Galei Zahal, the Israeli Defence Forces Radio Station were breaking through onto VLB transmissions and could be clearly heard when the VLB message ended but the VLB transmitter remained keyed. Cross modulation from the powerful HF transmitter was the probable cause of the short lived problem. Before closing on the location information I will give a quick mention to a small point which was raised at the 1994 'Monitoring Times' Numbers Station Convention (see review in ENIGMA 10). Under E10 station locations in Israel & Cyprus were discussed. It is also possible that other 'friendly' countries transmit E10 messages. The suggestion of a 'friendly' country also relaying number station messages is not as far fetched as it may sound. Who would have ever thought that Radio Free Europe would transmit from the Czech Republic or the American run Radio Free Asia would send over Russia's Far East transmitters ! Why not number stations working hand in hand ? A South African connection ? ENIGMA has monitors in South Africa and Zimbabwe who regularly supply reception reports. A common theme (and some bizarre signal strength readings) runs through reports received. CIO EZI KPA VLB & YHF all seem to reach Southern Africa with very high signal strengths on frequencies ranging from as low as 2 MHz up to 11 MHz. Southern Africa is over twice the geographical distance from Israel as the UK is from the same point. The quality of reception of transmissions in the 4 & 5 MHz band at similar signal strengths contrast with the rather indifferent signal strengths monitored in the UK. By comparison other European number stations certainly do not reach this part of the world.Little is known about the South African Security Services, the main organisation was the now infamous BOSS (Bureau of State Security) which, under the leadership of General Hendrick Van der Bergh, had their headquarters in Pretoria. Rhodesian Intelligence was known as CIO-Central Intelligence Office-coincidence ! They were extremely active in the struggle to uphold the Apartheid system. even to the point of sending parcel bombs to Black Activists, bugging and sometimes ransacking the offices of various Anti-Apartheid groups in London - including Amnesty International whose offices they burgled. They were also responsible for the systematic de-stabilising and general undermining of Black workers' unions. P.W. Botha disbanded BOSS in 1978 and removed Van der Bergh from his post, replacing BOSS with the NIS (National Intelligence Service), but they made international news in 1983 with the abortive attempt to overthrow the Seychelles Government. The group involved in the affair was led by one Colonel Michael Hoar. The South African Government remained tight-lipped about the whole thing, admitting to the press that only one of Hoar's men, Martin Dolinchoek, was actually a member of the NIS. The NIS are renowned for their use of prolonged interrogations, beatings and torture, and were allegedly responsible for 300 deaths in detention between 1980 and 1982. What has become of the MIS in the post-apartheid South Africa is unclear, but it is almost certainly the case that Nelson Mandela has restructured the Intelligence Services as he has done with the Armed Forces in the country. They probably all employ the same methods as before, but now it's just to different ends. Rest assured, however, that the South African Intelligence Services, in whichever guise they may adopt, are, as always, a force to be reckoned with. Some 42 km South of Johannesburg at Mayerton, there is a huge transmitting station which belongs to the SABC (South African Broadcasting Corporation). It is used far various internal broadcast stations and was home to the old "Radio RSA" - at present it is also carrying transmissions from Radio Kudirat an anti-government propaganda station opposed to the present Nigerian Government (this is using a 250 kW unit), As the SABC is a Government concern, it stands to reason that the site may also be used for 'other purposes' than broadcast output. Indeed rumours of a South African based numbers station operating on 5990 kHz USB have continued to circulate, The suggestion that Israel & South Africa may 'cooperate' is not such a bizarre idea. Size & Structure It seems like a good time to take a step back from looking at the E10 stations. Rather like the old saying 'you can't see the wood for the trees'. The problem with E10 stations is that they all seem to be thrown together, the truth is that there are three distinct family members which each seem to have a separate purpose. More on this shortly. As I said at the start of this feature it is difficult to know just when the beginning was. The earliest comprehensive list appeared in Tom Knietel's book. At that time the following callsigns were reported to be active. ART CIO EZI GBZ GPO JSR KPA MIW NDP PCD SYN ULX VLB YHF ART CIO EZI JSR KPA MIW PCD SYN ULX VLB & YHF all seem to have remained stable in terms of the three letter identifications used. GPO which was a very active station at one time seems to have ended but new callsign FTJ seems to have taken its place. Several other call-signs have also appeared between 1984 and the present day. These are OEM TMS and ZWL. To be absolutely honest the whole of the archives information is something of a minefield, mainly due to poor logging techniques and inaccurate and spurious information which has crept into various other publications over the years So where do we go from here? Well I must admit that 'Langley Pierce had the right idea when he tackled the subject in his book, he concentrated on just two callsigns and headed everything else special broadcasts - - However I am not going to follow this route and at the risk of producing a long article intend to give you all the known facts - A little earlier I mentioned the habit of throwing all the callsigns together under one heading, So now I would like to break the stations down into the three headings. Before doing so I feel it is worth mentioning that I am dealing with the present operating position - Going back to some of those unconfirmed callsigns will likely confuse both you and me. The following is based on monitored information received from ENIGMA readers and our own efforts Three station types. 3) Non traffic stations. These stations are somewhat more difficult to pin down and do not seem to send any standard traffic messages. They also do not appear to have a set schedule and finding them is more a matter of luck than of judgement. Having now identified the 3 types of station it is possible to move onto traffic analysis. This is perhaps the most enlightening part of the mystery. Type 1 stations are the 'bread & butter' of the communications system, sending out a seemingly endless number of rota style messages. It is not possible to ascertain whether traffic is sent for individuals or groups but messages do stay on the system for a period of time and would appear to be repeated until such time that HQ is satisfied that they have been received. Type 2 stations do not send regular traffic and are prone to long periods of idling followed by bursts of activity The purpose of CIO and its sister station MIW are of course unknown but monitoring would suggest that these two stations arc some type of general alert system and may serve to communicate more blanket information in the of both traffic messages and special message strings Certainly in the case of both callsigns, when traffic does occur it is not unknown for a single message to be transmitted continuously for 24 hours per day non-stop. Type 3 stations are perhaps even more incomprehensible in nature and could best be described as inverted version of type 1 stations. Type 3 stations have never been heard to send traffic messages. Moreover they appear without warning arid send peculiar message strings consisting of additional letters and numbers added to a repeating call sign before disappearing into the wilderness until discovered again by a bit of chance tuning. Just before we move on to message strings, it may well be worth writing a few lines about the phonetic code system. Some time ago we received a report that the system used was called Aroflex, a crypto system of 5 Letter groups developed by Siemens for NATO wide use. Any further information on this would be appreciated. It would seem unlikely that all field agents decrypt their messages by hand and some in less sensitive situations would probably use equipment similar to the Gretacoder DH-26 hand held .encryption unit. The equipment's algorithm assures maximum security with 10 to the power of 52 user selected code combinations. It is of course the case that any agent found with such equipment in their possession would be presumed guilty of clandestine activity. Such equipment uses the triple key principle An elementary key is the first secret element and is periodically changed by the user himself. A Combiner key is the second and independent secret element. It determines the encryption algorithm and may be reprogrammed on longer terms. An auxiliary key generated automatically by a random generator for each new synchronisation eliminates the need for a frequent change to the elementary key without impairing the cryptological security. Not only would these be used to decrypt an incoming message but such units also have a Message Key which is used to generate the mathematical programme to encipher a message ready for sending back to H.Q. These messages can then be sent on to the intended recipient by any transmission medium without fear of compromise. Intermediate intervention is not a concern. Only the recipient with another DH-20 and knowledge of the unique code can decipher the message. So far so good, we have identified the three types of station and given a broad outline of their operating characteristics. So just what can we learn from traffic analysis ? Back again to the three types of stations, I'm afraid. We are now heading into a black hole - if I could answer some of my own questions I would probably get a job at GCHQ but I regret to say that much of I-tie following is 'calculated guesswork. Type 1 & 2 High & Low Traffic Stations. Most readers will be familiar with the well known suffix numbers e.g. VLB 1 VLB2 & VLB3 etc. It would seem to he the case that these numbers do not, as previously mentioned, indicate no-message' or 'test transmission' but are in fact a shorter version of the more common stutter groups (11111,22222,33333 etc.) used by many other number stations to convey a fixed response. Example only: These are not now in fact believed to be messages as such, not at least of something to be decoded . They do not convey something along the lines of Meet Cazab at the Research Station Clearly this would take the form of a very brief burst message which would be transmitted at low power by the field operative. High gain antennas, diversity reception and very high quality receiving equipment situated in an electrically quiet area would process the weak a signals which are then usually automatically decrypted. The need to send out long strings of options such as CIO 13 B22 A14 P25 R39 M11 would be required in the event that it was not possible for the field agent to transmit at a particular time We can presume that strings of options are sent until such time as an incoming message has been successfully received. The only station which seems to buck the trend is SYN which is prone to sending number strings such as SYN 7Z 9180500 or SYN 81. The purpose of these is unknown. Type 3 Non-traffic stations. These are even more difficult understand. Non traffic stations, as we previously mentioned, are never heard to send messages as such. Traffic examples consist of the 3 Letter Callsign repeated over and over; this is more often than not followed by further letters or several numbers. Some of these callsigns are so rare that literally years can go by without even a mention. TMS is a good example of this. The station was noted recently but prior to this the last log in the late 1980s
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
