Chapters
Uncategorized

Eavesdropping on Spies: A Shortwave Story

Part One: An Open Secret

“3-9-7-1-5… 3-9-7-1-5… “

The mechanical-sounding voices methodically announces a seemingly random group of single digit numbers for minutes on end. There is no diseminable information from the numbers themselves, but clues to the provenance of the messages can be heard.

They are simple shortwave radio broadcasts that can be received on any shortwave radio. All anyone has to do to hear a transmission is know at what time to tune into a certain shortwave frequency.

These covert communications are carrying the Spymaster’s orders of the day. Transmitted from clandestine sites across the world to agents in the field, no one besides the agencies involved knows the meaning of the messages.

A small army of radio enthusiasts, known as monitors, eavesdrop on these secret communications, and try to find answers for the mysteries that surround them.

These monitors are fully aware that they will never be able to decrypt a message they intercept from one of theses numbers stations, as they are ingeniously encrypted and mathematically unbreakable.

Much remains unknown about the numbers stations, and to this day their existence is denied by agencies and governments globally. But this group of individuals aim to unshroud the mysteries surrounding the stations. Using open source data and collaborative efforts, these shortwave sleuths are unravelling a global phenomenon that transcends the worlds of technology, history and espionage.

So, who are these monitors, and what are they trying to uncover?

Part Two: The Eavesdroppers

Matt Hicks is from Georgia, USA, and has been a shortwave listener since he was a teenager in the 90s, making that him a still relatively junior member of the shortwave scene.

“I’ve been reading about number stations and listening to them for about ten years now” Matt said, but it didn’t spark much of an interest until he began digging deeper into the stations, and tuning in to stations from his native America.

“The transmissions from the States were the ones that most appealed to me, because I can hear them really well from where I live.”

The more practical side of shortwave radio is putting together a receiver that can tune in to signals more sensitively. They are often homemade, and Matt’s setup is complete with a meticulously designed array of radio equipment routed from his basement, through his garden to an antenna atop a tree.

He is an expert on all things radio, and speaks passionately about the hobby.


Numbers Stations are not newcomers on the radio waves; they have been listened to and known about since the First World War. Their escalation in use by agencies during the Cold War meant that the number of regular shortwave listeners who would unknowingly stumble upon them increased. These listeners, fixated on the mysterious, anonymous voices on their radios began logging the broadcasts. Soon, these monitors began noticing trends in the broadcasts, and were able to put together schedules of the stations they had discovered and began speculating on what they were, and where they were coming from.

These early discoveries were documented and disseminated in The Monitoring Times, a monthly publication for radio enthusiasts.

This exposure meant that more and more people began tuning in to the broadcasts, which in turn resulted in more stations and anomalies being caught, logged and disseminated. These individuals began collating their information and forming listening organisations.

The first questions that these early monitors began answering was simply why are shortwave stations being used?

To put it bluntly; shortwave can travel around the world quickly, and can be listened to inconspicuously – both important factors in espionage.

Dirk Rijmenants is a history and cryptology expert, and he says that the secret of short wave’s success is in how it bounces from the Earth’s atmosphere:

“Numbers stations are always shortwave and these signals can travel – or bounce better on the ionosphere –  around the world. Literally everyone can receive stations with an ordinary shortwave radio.”

Dirk explained how the ubiquity of shortwave radio made it perfect for espionage: “A shortwave radio is not spy gear, and can’t compromise you. You don’t have any spy gear that could give you away.”

Often, the world of espionage evokes ideas of technological developments that are hidden from the wider world, and in many ways this is entirely true. Intelligence agencies are continually developing more sophisticated devices, more robust cyber security measures and more ingenious methods of conducting their work. Indeed, these technologies often end up in the hands of the public and become ubiquitous elements of our daily lives.

The most famous spy of them all, James Bond, has an uncanny ability of getting his hands on the most exotic and fantastical gadgets that Q branch has to offer. His 55 year career has gifted him a plethora of innovative and futuristic devices, from a now ubiquitous GPS in 1964’s Goldfinger, to a precursor to Face ID in the shape of For Your Eyes Only’s 3D identigraph from 1981. His gadgetry, much like the technology developed by intelligence agencies, is continually on the cutting edge of contemporary developments, albeit with varying degrees of explosive tendencies, both intentional and otherwise.

Click on a Bond film to see what gadgetry MI6 had equipped him with.

Gantt chart maker

Yet the numbers stations are an exception to this rule. They utilise technology that has remained mostly unchanged for over 100 years, and a cipher system whose predecessor was in use as early as 57 AD.

The beauty of the system is in its simplicity and ability to leave no traces.

Dirk explained that numbers stations, even if they are dated and low-tech, are still relevant and useful today for this very reason. He said that online “we can trace and read everything” that gets sent digitally, and using a phone causes the same problem: “Communicating digitally without leaving a trace, forget it. I pick up the phone, the connection is traceable from the moment it rings.”

This notion of simplicity and untraceability also applies to the way in which the coded messages from numbers stations are encrypted.

The system is known as a One-Time Pad, and it is one of the simplest of all ciphers, as it can be used by practically anyone. The other great benefit of the one-time pad is that it is mathematically unbreakable, as Dirk explained:


One TIme Pad

“One-time pad is a system proven unbreakable, if properly used! You only need a pencil and paper, no spy gear.”

There is only one other piece of equipment needed, and that is the one-time pad itself. It is often a small pad of paper with rows of numbers. Each page is one individual cipher key, and it is what the agent would use to decrypt the incoming broadcast. So long as these keys are kept hidden, then the message is impossible to decipher.

“Of course, you need a set or booklet of one-time pads” says Dirk, “but that can be tiny, easily hidden, and doesn’t have to be stored at home.”

.


There have, however, been cases of spies being caught and found with one-time pads hidden around their homes.

Czech spy Václav Jelínek was arrested in his London flat on 22 April 1988, while in the process of receiving coded messages by radio. British Special Branch found one time pads hidden in Jelinek’s soap bar.

He was sentenced ten years imprisonment.


The pad itself comes in many forms and variations, but is most often a sheet of paper, on which a string of random numbers is arranged in groups or five. The size of the pad depends on delivery and concealment methods, but they were often produced to be extremely small and easy to conceal.

To ensure secrecy, ingenious methods of concealing them were devised, including on the back of postage stamps, hidden on microfilm or placed within inconspicuous objects such as a walnut.


There is however, a decline in people taking up radio as a hobby, and instead turning to online services.

“As to the state of shortwave, it’s a dying hobby.” says Hicks, “Now that technology has advanced to such a state that we have software defined receivers that allow us to hunt signals effortlessly, the world has moved on from such expensive endeavors as running a half-million watt transmitter to broadcast information that’s found on the internet. It’s bittersweet”

Similarly, some of the early numbers stations experts have begun retiring their projects, with whole websites full of information, data and resources removed from the web at a click of a button.

To Hicks, this is an important piece of under-recognised history that we are losing touch with: “Stories like the ones from the late Havana Moon (from The Monitoring Times) are forgotten. The audio recordings exist only on the hard drives of the enthusiasts that downloaded them, and important artifacts from a time when we very nearly wiped out humanity with nuclear weapons is lost.”

Hicks is one of the many passionate and knowledgeable radio enthusiasts who share their expertise with anyone who shows interest, and who disseminate their findings online for the benefit of others. The nature of catching numbers stations broadcasts means that the more listeners there are, the more is likely to be found, and larger datasets help to identify patterns and produce more comprehensive logs.

Because of this, there are a number of organisations whose aim is to gather, interpret and share information about numbers stations.

The oldest of these is ENIGMA. Active between 1993 to 2013, they were responsible for the naming system used for the numbers stations, as well as a physical newsletter they would send out to enthusiasts. They have been succeeded by ENIGMA 2000, who’s monthly digital newsletters are some of the most detailed and comprehensive reports on numbers stations, as well as other similar broadcasts. Their rigid membership system and often overwhelming levels of information can be off-putting for a newcomer.

On the other end of the spectrum, priyom.org is a website that aims to make as much information about numbers stations available online as possible, and is responsible for some of the most accessible and illuminating information. It has a modern, more digital approach to investigating numbers stations, and relies of members submitting their findings for the wider community to scrutinise.

Tom Hetmer is an IT developer from Prague, Czechia, and an original priyom.org member. He described the site as being ” based on open-source ideas” which attracted a lot of people in their early twenties, “some of them with a background in hacking, IT and electronics.”

“It was people who are used to that kind of culture.” Hetmer said, although this would sometimes result in a “chaotic environment, full of trolling.”

The young, hacker culture encouraged them to think differently about their project and the stations. “I’d like to think more stuff actually got done. There weren’t any barriers in place and it all was done in the open.”

These newer enthusiasts, with completely different sets of skills, have turned their minds to attempting to work out exactly where numbers stations are. Using geolocation.

Part Three: Proving the unprovable

Locating where the station is being transmitted from adds another level of evidence to the monitors theory. It is not the simplest of endeavors however, with only fragments of verifiable information available, these stations are still, of course, state secrets. As such, it is the domain of internet sleuths, who trowel through archives, maps and databases, looking for the fragments of information needed to pinpoint a location.

Lewis Bush is a London based photographer and writer whose book, Shadows of the State, documents and exposes number station broadcast sites from across the world. His work aims to gather the vast, and often disjointed information available online and present people with the imagery of what is supposed to remain hidden.

His project was sparked by intrigue, and began with “a half-wasted afternoon” searching through what could be found online about the stations, and listening to their recordings.

“I spent that time basically trying to see how locatable the sites were, and in that afternoon I found three, although they were the easiest.” But it wasn’t until three or four years later that the project really took off, and so Lewis began a “scaled-up” incarnation of his project. This time, rather than a single afternoon, Lewis spent four years hunting down the location of these broadcast sites.

“It’s the intrigue, the desire to know more about them” that Lewis said fuelled the four-year long pursuit of the broadcasts.

“In the end, I found around 30 of the stations.”

But Lewis is not a typical numbers station monitor. Unlike many others who have ventured to investigate the broadcasts, he does not have a background in shortwave radio, and so his investigations also involved citing the help, expertise and resources of the shortwave enthusiasts and monitoring groups.

“The radio elements weren’t all that interesting to me, although I had to get into that as the people I was talking to were from the shortwave community. Many of the conversations were unintelligible, and so I had to go off and learn all of it… The jargon… the technical jargon…”

Lewis is not wrong in the slightest. Shortwave radio has a reputation for being riddled with acronyms, initialisms and terminology, partly due to the technicalities of the medium, yet also because of the protocols and lingo synonymous with radio communications. It is undeniably daunting.

Yet the biggest challenge, Lewis explained, was in dealing with a subject where there is no guarantee of something being 100% verifiable. In the clandestine world of numbers stations, official recognition of their existence is all but non-existent. In the UK, a Freedom of Information Request on the topic will result in nothing more than an abrupt “Ofcom has no knowledge or records of any numbers station in the UK.”

“In the end, the biggest challenge became an important part of the project. I’m very upfront about it in the book, nothing is 100 percent verifiable. With a subject like this where the information is very scarce, and what is available has often very dubious reliability, you can never say to have 100 percent reliability. I could never even say I’m 99 percent certain about any of the sites I tracked, so it’s a balance of probabilities.”

Lewis would ask himself: “with the knowledge that this kind of publically available data is unreliable, how confident can I be?” but he also found that there were “smoking guns”to be found, something that made him certain that “Yes! This was the right location.” This however is an exception to the rule.

The widespread availability of satellite imagery through services such as Google Maps has given the public a tool, that only a couple of decades ago, would have been the stuff of intelligence agencies dreams. The ability to see the vast majority of the world from above gives anyone the ability to view a location from anywhere in the world.

Buildings, radio towers and aerials, intended to be hidden from the public’s eye, can now be scrutinised by prying internet detectives from thousands of miles away, resulting in more of the broadcast sites, relay stations and other pieces of infrastructure being discovered.

As Bush recounts, “I’d sometimes turn to Google Maps and satellite mapping, and that was often the clincher. I’d start with a rough indication, like information saying the signal is coming from within a few miles of a certain town, then I’d take a look at that area, often of several square miles, and see if there’s anything plausible. Then, I’d scrutinise what I’d found to see if there are any signs of things like a radio transmitter.”

“A lot of the sites I was looking at were built in the 50’s and 60’s, designed to be remote and hard to look into from ground level. They were built with the thought of what people had access to in that era, but 60 years later we have access to satellite imagery that is far superior to anything that intelligence agencies had during that time.”

“When we use satellite maps, very few people are aware of the history and ideologies that come preloaded into a satellite image.”

UVB-76 is not a numbers station by definition, but it’s role and operation falls into the remit of the monitors’ work.

It transmits an intermittent buzzing tone continually, and can be heard 24 hours a day at 4625 and 4810 kHz. Sometimes, the buzzer signal is interrupted and a voice transmission in Russian takes place.

Theories to its purpose suggest that UVB-76 served as a tool of the former Soviet Union’s “Dead Hand” doomsday device. Should The Buzzer have fallen silent due to a preemptive US nuclear attack, then the pre-programmed system would launch a wave of nuclear missiles at the US in retaliation. Others say it is measuring the ionosphere, or simply used to maintain control over those certain frequencies.

Voice messages were thought to be very rare, until 2010 when listeners reported increased activity of the station, spurring on further monitoring and allowing listeners to “catch” more of the messages which would have otherwise gone unnoticed. Some of these monitors went on to form priyom.org.

It’s location was pinpointed by priyom.org users to a site north of St.Petersburg.

The tune at the start of the recording is The Lincolnshire Poacher, an English folk song, followed the automated and articulate voice of a woman speaking in an English accent. This station, one of the most well known, has been designated as E03 Lincolnshire Poacher. Five times a day, seven days a week, she recites the series of numbers for around 45 minutes before signing off and vanishing back into the static of the radio. Her voice was broadcast by British intelligence agencies during the Cold War from a RAF Akritori in Cyprus as well as other sites across the world. She was last heard in the summer of 2008. Many similar stations simply disappear from the air once their task has been completed.

She was tracked to RAF Akrotiri by shortwave listeners using the process of elimination based on signal strength to uncover where the messages were being broadcast from.

It is believed to have been transmitted from an annexe building within the air force base.

E05 Cynthia was an American numbers station broadcast from Warrenton, Virginia, as well as other locations across the world.

Heard since the 70’s, Cynthia was one of many English language stations utilised by the CIA, hence Cynthia‘s cryptic name. The voice employed was very professional in its work, having an obvious American accent.

She is one of the better know numbers stations in the US, owing to the good level of reception American listeners had, and her broadcasts were one of the most logged and scrutinised. Speculation about her location circulated amongst monitoring groups.

Rumours of her whereabouts reached Matt Hicks in Atlanta.

Part Four: Contact

In the summer of 2019, Matt was sent to the northeastern corner of the state of Virginia, to a suburb of Washington D.C. for work. He decided to drive the eight hour journey to allow him to see some sites on his travels.

When he arrived in D.C., Matt opened Google Maps to find somewhere to eat: “I noticed the town of Warrenton was not far to the south of where I was staying, then I remembered reading numerous times how the alleged location of the mysterious “Cynthia” station was traced back to the area surrounding the nearby town.”

Acting on his hunch, Matt tried to find as much information online about the rumoured broadcast site.

“I visited several websites that had been once good resources, but were now abandoned and no longer hosted, or hosted dead links to files that no longer existed.”

From what he could find, Matt was able to ascertain that at the site was near the intersection of two remote, unnamed country roads, and to make matters worse, his phone was struggling to get data this far into the countryside.

“After numerous wrong turns, I found the road I was searching for. I followed it in the direction of the road that intersects it, which was where I was told the site was situated. Much of the land was flat, with occasional wooded areas.”

“When I saw an opening in the woods to my left, it appeared to open to a large, clear plot of land. I couldn’t help but notice this clearing was on the other side of a very old, rusty chain link fence, with several rows of equally rusty barbed wire. It stood out, as most fences in the area were simple wooden fences that divided farms. I slowed down and immediately saw a small group of buildings, with no markings or indication of what purpose they served.”

“There was a metal tower, supported by guy-lines, no more than 100 feet in height. On top of the tower was a directional antenna, which looked very much like aerials seen on the roofs of many homes belonging to radio amateurs for long-range high frequency communications. It clearly was mounted on a small electric motor, capable of rotating the directional antenna. Also in the field were four similar metal towers, all with metal cables stretched between them.”

“At this point, I noticed the main front gate, a sign that indicated this was a US Army facility, and a guard shack equipped with modern CCTV cameras. On the other side of the main road leading into the facility, past the main gate, were four additional towers, identical to the four seen on the other side, again, with cable stretched between them.”

Amidst all of the details Matt was trying to comprehend, he managed to take some photos of the facility whilst driving past.

Still, Matt understands that even by seeing a supposed broadcast site with his own eyes that it is not absolute proof that it was a numbers station.

” It may not have even been used for transmitting, instead possibly functioning as receiving antennas for signals intelligence training. The site may also be staffed to this day, merely as a backup “just in case” facility, but I can’t say for sure. What I do know, is that this was the most interesting business trip I had ever taken.”

Matt’s journey encapsulates the vast scope of mystery and intrigue that surrounds the numbers stations and those who listen to them and it was the investigative, collaborative work of the monitoring groups that offered the clues to find the broadcast site of the station.

The dedication of these individuals, to investigate something which is supposed to remain hidden, is sometimes incomprehensible. There are no sure answers in the world of the numbers stations – they are deniable, illusive and unbreakable.

Matt will never know the meaning of the Cynthia broadcasts that travelled from Virginia, through the atmosphere to Georgia and the homemade antenna atop his tree, down the cable through his garden and into his basement, where he would sit, and listen, and question.

As Hicks speculates, “There is something appealing to a problem that has no answers, it makes you think about the ways we question things, and the ways we can investigate these kinds of problems. If there were comprehensive answers to all the numbers station questions, then I don’t think anyone would be interested.”

Be the first to leave a comment!

Leave a Reply

Your email address will not be published. Required fields are marked *