The Bear Net “Pirate”

The “Bear Net” of Russian Long Range Aviation has been relatively busy during the last few months, no doubt some of this due to the exercises playing out in Northern Europe by Western countries and NATO. They also tend to increase activity around the same time as USSTRATCOM have their Global Thunder exercises, one of which kicked off on the 29th October and lasted for just over one week.

Three Russian missions took place within the last two weeks, all of which travelled through the same airspace as the area covered by Exercise Trident Juncture 2019 (TRJE18) off the North coast of Norway. One flight was of a single Tu-142M, RF-34063//Red 56, that made a low pass near participating ships. I was unable to follow this flight so not received by me, the likely callsign on the CW frequencies for this was LNA1. This was intercepted being called by IWV4 on 8112 kHz at approximately the same time as the pass was being made. Images of the pass were caught by AFP correspondent P. Deshayes who was on one of the ships.

One of the other missions was of more interest than normal. The “Bear Net” is always an interesting thing to follow on HF, but when extras are produced it makes them even more fascinating. In this case it wasn’t so much what the Russian did, but what happened late on in the mission that wasn’t them.

Stepping back, we’ll go to the beginning of the day – 31st October 2018. The net was still on the autumn frequencies with ground station CW first being picked by myself sending “W” markers at 0920z on 8162 kHz. I quite often put one of the receivers on the current season ground station frequency to get any alert of possible flights heading out thanks to the markers sent every 20 minutes at H+00, H+20 and H+40. With this 0920z interception I started recording the frequency and I switched all radios to the other known frequencies – 9027 kHz for Air CW and 8033 kHz for Simplex USB voice comms – and got set up to start recording these should anything happen.

The 0940z W marker came, but interestingly when I went through the recordings later on I was able to hear a very faint G marker in the background. This had at least two operators carrying out the task as there were two distinct methods of sending. One would use the standard G every two seconds, whilst the other sent as double G’s and slightly quicker. The marker also started approximately 10 seconds earlier than the W and – guessing as it was stepped on by the W – looks to have lasted the two minutes too. You could hear it in the background between the odd W space.

At 0949z 8033 kHz became active and I started up recording on multiple SDR’s whilst using my Icom IC-R8500 as the live radio. By this time, I had also observed callsigns associated with QRA flights on my SBS so was pretty certain something was heading towards the UK.

With a few more USB calls following, but no CW traffic except for the markers I was certain the aircraft involved were Tu-160’s as they don’t use CW.

My Russian is still pretty basic (if that) so I totally rely on recordings to go through it all in slow time. I had been able to work out live that there was at least the usual STUPEN callsign along with TABLITSA; but I was also hearing another one that when going through the recordings I worked out to be KONUS – this one I hadn’t heard of before.

Going through the recordings, this mission certainly helped my knowledge of Russian numbers, or rather the methodology of how the messages are sent, as there were plenty of messages involved. The two aircraft callsigns were 16115 and 16116. These callsigns carry on in sequence to those that were used on a mission a few days earlier on the 28th with 16111, 16112 and 16114 being used by Tu-160’s and 50606 by an accompanying A-50.

In general 16115 was much harder to understand than 16116. 16116 said it all much slower and louder. STUPEN was very clear at the beginning, but faded towards the end, whilst TABLITSA may of well have been in my room, she was that loud.

Here then is the first part of my USB log:

8033 – Bear Net

0941z 16116 calls STUPEN
274 443 624

0949z 16116 calls STUPEN
458 842 156 816 443 896

0959z 16116 calls STUPEN [replies, 16116 faint]
KONUS calls 16116 and tells him to pass the message to him

1000z [16116] 303 847 023 534 734 619 822 332
[with wrong read back of group three, corrected by 16116]

1002z 16115 call KONUS
138 534 005 964 312 147 443 896

1010z 16115 call KONUS
741 534 724 619 822 180 443 594

1020z 16116 calls STUPEN
478 815 023 534 071 955 117 957 084 305

1028z 16115 calls TABLITSA, then straight away calls STUPEN
138 1?5 [error?] 138 534 540 115 ??? 251 660 033 084 316
[garbled with a possible error]

1036z 16116 calls STUPEN and TABLITSA, STUPEN replies
303 815 023 534 671 612 842 768 084 544

1039z 16115 calls TABLITSA and STUPEN, STUPEN replies
741 534 671 619 246 768 023 084 544

1048z 16115 calls STUPEN
138 534 491 236 896 443 084 635

1050z 16116 calls STUPEN
478 815 023 534 635 233 107 219 084 615

The recording below contains the 1048z and 1050z messages

1112z 16116 calls STUPEN
452 635 084 125
[repeats third number twice]

1129z STUPEN calls 16116 twice – no answer

1132z STUPEN calls 16116 twice – no answer

1133z STUPEN send message
BLIND 553 028 533 ??1

1141z 16115 calls STUPEN
741 534 360 810 719 980 447 023 038 914

1144z 16116 calls STUPEN
303 875 023 534 106 673 980 719 038 914

1148z 16115 calls STUPEN
138 537 023 534 674 400 388 521 038 496

1159z 16115 calls STUPEN
741 537 023 534 940 441 388 441 038 896

1201z 16116 calls STUPEN
478 816 023 534 717 355 637 321 038 496

1210z 16115 calls STUPEN
138 537 023 534 600 902 955 462 038 844

1213z 16116 calls STUPEN
303 815 023 534 186 117 388 117 038 896

1217z 16115 calls STUPEN
741 537 023 534 981 980 356 789 905 149

1306z 16115 calls STUPEN
138 537 023 534 540 288 810 236 905 206

1318z 16115 calls STUPEN
352 315 544 243 942

1320z 16115 calls STUPEN
[4 calls, no answer]

1322z 16115 calls STUPEN
741 537 023 534 724 284 312 816 315 555

1325z 16116 calls STUPEN
457 187 905 844

1351z 16116 calls STUPEN
457 187 315 715

Then comes the interesting part of this…… the arrival on frequency of the “Pirate”.

At 1427z an open mike became present on the frequency, in AM mode. This was fairly brief, and at 1429z the Pirate started.

Mike Delta Kilo Romeo, Mike Delta Kilo Romeo
Mike Delta Kilo Romeo, Mike Delta Kilo Romeo Standby
Mike Kilo Delta Romeo, Mike Kilo Delta Romeo, Mike Kilo Delta Romeo Standby

Note his own error or change with the callsign


Image of carrier wave and transmissions of MDKR//MKDR. The Pirate is using AM mode, but as the recording was in USB only that half was captured.

This was followed at 1431z
Mike Kilo Delta Romeo

The audio for the above is here:

At 1439z he was back but very faint, almost like it was a recording or live transmission of a Numbers Station. Shortly after this 16116 tries to call STUPEN and KONUS, getting stepped on by the Pirate who sends yet another attempt at an EAM/Numbers Station.

C78AAA5ACBCEA77D76FF33EAFAE63CF5A7AAAAFAF555A85CDBEEBBA5D6DFCCA – or something like that! It was hard to work out some of the digits due to the lack of phonetics. Each time I listen to it I get a different result!

Fake EAM/Number station message

The audio is below.

At 1446z, 16116 calls STUPEN, KONUS and TABLITSA but gets no response back.

The Pirate then attempts to jam the frequency again. First of all with an extract from a selcall system used by the Russian Ministry of Foreign Affairs given the name “Mazielka”, designated X06 in the Enigma Control list. See the end of the blog for analysis on this.

This was followed by a continuous tone at 1090 Hz for approximately 35 seconds. These are the last transmissions by the Pirate.

Again at 1459z, 16116 tries the ground stations until TABLITSA finally acknowledges his presence and a message is sent. 16116 is barely readable with me by this time, though TABLITSA was ridiculously loud.

1459z 16116 calls STUPEN
calls STUPEN
calls TABLITSA answers [very strong]
452 730 969 463

1506z 16115 calls TABLITSA
590 375 143 986 196 233

1531z 16116 [very faint] calls TABLITSA
452 859 143 168

This was the end of all contacts on USB, with the last W marker coming it at 1520z (though these then did start up again at 1640z, though much weaker).

From various OSINT feeds, the approximate route of the Tu-160’s took them out over the Barents Sea having departed Olen’ya air base in the Murmansk Oblast and heading north before turning west once out over the sea. At some stage they were intercepted by Norwegian Air Force F-16’s and were escorted to abeam Bergen/NE of the Faroe Islands before turning for home. The Russian Air Force have stated that the flight lasted for ten hours which ties in with the seven hours or so of HF traffic, with the remaining 3 hours probably within range of Russian VHF communications.

Olen’ya is a common forward operating base for LRA missions, being one of the remaining Arctic Control Group (OGA) airfields available. The base itself hosts Tu-22M-3R Backfire-C of the Russian navy. These are Tu-22M3’s that have been converted for a navy reconnaissance role though it is unknown just how many are airworthy. The base has over 30 Tu-22’s in permanent storage.

Twitter feed for записки охотника (Hunter Notes) has a rough plan of the route flown, along with his intercept of the messages sent – he has few of the earlier ones, and there’s a couple of differences between his and mine.

So, who is this Pirate? It isn’t the first time he’s been around. He was also heard in September.

On this occasion he was a little bit more direct.

Russians we are watching you
Russians we know where you are
Russians, turn around and abort your mission

And later

We will blow you out of the sky
The Russians. We have you under observations [sic], stand down

Despite having what is clearly a South East England accent, he signed off using something along the lines of:
This is the United States BC36

No doubt he is trying to gain some sort of attention, and in a way he is succeeding – me writing this blog is proof of that. But what else is he trying to achieve? Is he hoping the Russians respond? I doubt they will. Apart from anything, I expect the radio operators, having had to listen to all the noise on HF for every flight, have learnt to ignore any calls which aren’t specific to their mission.

My initial thoughts were that he isn’t a radio amateur and hasn’t worked in any other field that involves speaking on the radio. His use of poor phonetics made me wonder this. However, with access to a transceiver and associated antenna this may not be the case – and amateur radio operators tend to make up their own phonetics rather than standard ones, and he may just not know them.

That said, he must have some interest in military aviation and possibly a member of a military aviation forum. These tend to have thousands of members that have not been vetted in any way or form and quite often have threads that give notice of flights are on their way, be it with an alert of a QRA launch or actual comms received on Bear net frequencies.

Twitter, of course, is another example of information being out there for anyone to then take action on.

One thing is for sure, if caught he will find himself in trouble with UK authorities with the possibility of a two year prison sentence and a heavy fine. He will most definitely lose his radio licence should he actually have one, and have all equipment confiscated.

Lets see if he turns up again in another LRA mission.

Analysis of the Mazielka (X06) transmission

It was obvious straight away that this was a recording of X06 – in this case the sub-variant X06b.

However there was something odd about it.

X06 is a selcall system used by the the Russian Ministry of Foreign Affairs to alert outstations of an upcoming message, normally on another frequency.

The system sends out 6 tones, each lasting 333 milliseconds, making each call 2 seconds long. Each tone represents numbers 1 to 6 making a total of 720 different selcall combinations available for use.

The tones are sent on slightly different frequencies:
1 – 840 Hz
2 – 870 Hz
3 – 900 Hz
4 – 930 Hz
5 – 970 Hz
6 – 1015 Hz

The image below is taken from a X06 call I intercepted in November 2017 and decoded using go2Monitor. This shows a selcall of 116611. In this case the tones, which are still 333 ms long, sound longer but this is because the digits join on the same tone.

Whilst you can use a decoder, for X06 it is easy enough to decode using other means, such as Adobe Audition or Signals Analyzer. With these you can measure the tone frequencies and lengths.

In Adobe Audition the Pirate transmission is shown below


What is unusual is that the tones are off by 60 Hz. Whilst 1 should be at 840 Hz, here it is at approximately 900 Hz, and 6 is at 1075 Hz rather than 1015 Hz. Whether this is because the Pirate was transmitting in AM rather than USB I’m not sure. Maybe it is something to do with his original recordings. My recording is below

It is likely the long tone sent after the selcall here is the usual long tone that is sent before the standard ones. This is sent at 1090 Hz.


Looking at it using Signals Analyzer (SA) you can see that it is definitely X06. With SA you can measure more accurately the frequency and length of each tone.


Here you can see the two tones (actually 6). The total time for the selcall is 2.040 seconds with 1 marked at 896 Hz and 6 at 1074 Hz


Measuring the length of an individual tone (though actually 3 joined together) gives a length just over 1 second or 3 tones at 333 ms each


Finally, measuring the space between each call gives us 1.312 seconds which is the correct spacing for X06

The sub-variant of X06b is designated due to its format of six tones sounding like two. It is thought this is a test transmission.

Finally, just to confirm my theory, I ran a looped sound file through go2Monitor with the result confirming the selcall as 111666


February’s Blackjacks

After a couple of days of teasing us with the standard “W” markers in CW, on the 17th February the Russian Air Force (Военно-воздушные cилы России [BBC России]) carried out a Long Range Aviation mission using two Tu-160 Blackjacks.

I was able to monitor nearly the whole mission on HF (both in CW and Voice USB), with a small amount on UHF (though no Russian Air to Air voice comms were received on VHF/UHF) and following some investigation into my data along with other logs and reports from the internet and friends, I can now compile a rough idea of the routing they took on their journey to the English Channel and back again.

The first reception I had that showed a mission was taking place was at around 0830z when a standard 3 figure group message was sent by IWV4 but unfortunately I was just setting up my gear and so missed it to write down. Further “W” markers took place at the usual every 20 minute schedule of 0840z and 0900z, with IWV4 sending another message at 0903z to the aircraft. This call gave us the CW callsign for the aircraft, probably the IL-78 Midas4YMA

Russian Air Force TU-160 Blackjack RF-94104 “Alexander Golovanov” © Crown copyright 2016

As is standard, the early part of the mission was relatively quiet on CW with markers only, though there was one unusual thing that took place around 0920z. Firstly there was no 0920z “W” (this only happened one other time for the whole day at 1600z – the 20 mins schedule was kept going solidly otherwise) and secondly, at 0922z, there was a sending of data on the frequency. The first eight minutes was a carrier tone centred exactly on 8112; with the full data commencing at 0930z continuing until 0943z. Unfortunately, the CW recording I had for the day got corrupted so I wasn’t able to analyse the signal to at least try and determine what type it may have been. Of course, it could have been coincidence as we all know that many of the frequencies used by the Russians are shared, but this does seem almost too good a coincidence. One thing is noteworthy in recent missions, and that is the big reduction in CW messages over the large increase of voice messages – are the Russians trying out a new data messaging system for their Long Range Aviation fleet?

8112 continued in the usual manner for most of the morning, with the occasional message or “radio check” [QSA] but there wasn’t much else. The Winter CW frequency for the aircraft side of the “Bear Net” had always alluded us and was in fact the only missing frequency we had for the whole net, so it was just the ground side of the duplex network that I was receiving. I had 8990 down as a back-up frequency for their voice comms and I was monitoring this frequency on my Icom IC-R8500 in USB mode, with all the remaining Winter frequencies on the Titan SDR Pro. I was also using the Titan to monitor most of the Oceanic frequencies in case they were coming this way, something useful to do as this can sometimes give away the rough position of the Russians. Because of this set-up I had the SDR monitoring the Oceanic frequencies in the 8MHz range. The bandwidth I’d allocated also incorporated 8990 and it was during a QSA check at 1205z from IWV4 on 8112 that I noticed a faint trace of CW on the frequency! I quickly changed the mode on the Icom to CW and caught the end – “QSA3” – nothing else followed, but it looked like I had found the Winter CW airborne frequency for the “Bear Net”. But, I had to be sure.

Russian Air Force TU-160 Blackjack RF-94101 “Paval Taran” © Crown copyright 2016

Up until now there had been zero voice comms on 8131, the primary Winter voice frequency, but not too long after the 1205z QSA check on CW the first call came with 44732 calling KATOLIK followed by a call to BALANS after not much luck with KATOLIK. There was one more call after this on 8112 before this frequency went to markers only, but there was a reply on 8990 confirming that this was the Winter CW frequency for the aircraft. The complete 8112/8990 transcript can be found in PDF format in my full CW log

Going from various reports, the Northern QRA had not launched so this led me to believe that the Russian aircraft were not coming in the direction of the UK, but when I noticed on my SBS that the Tanker was travelling north from Brize Norton, then I wondered if they were. The only comms I had was from the Tanker with Swanwick Mil so I presume (and with no logs showing anything from Lossiemouth) that a long range track of the Blackjacks was taking place.

Certainly, on Oceanic warnings were being passed about the “unknown” traffic heading south and it’s from this information that I’ve been able to roughly guess their initial routing, down through the Shetland Island and Faeroe Island gap to near ERAKA, before tracking south along the 10W line – like I say, a rough guess, but going on previous routes this won’t be far out. They probably got to around the NIBOG area before tracking SW to go around Ireland, before heading in again towards Lands End and the English Channel.

Voice comms on HF with BALANS was pretty continuous by this stage, with three potential callsigns heard. Two would have been the Blackjacks, 44731 and 44732, with a third more than likely the support IL-78 Midas tanker that remained clear up to the north and so was much weaker with me – I think it was 60991 but was too weak to tell, with only the readback from BALANS copied.

At about 1505z it was reported that two Typhoons from Coningsby that had launched about an hour before, and had been holding in ARA10W, had joined up with the “unknowns” and these were identified as Tu-160 Blackjacks. The comms were again picked up by Kyle, and the Typhoons gave full details including the tailcodes, with the lead aircraft being RF-94101, the second RF-94104. The Russians name their Tu-160’s and these are given “Paval Taran” and “Alexander Golovanov” respectively.

By coincidence, at 1510z, 44732 calls BALANS with a message starting 502. I always suspect that they send messages out when they’re intercepted and I expect this was one of those messages. It could well have been that they were entering the Channel though, it’s hard to tell, but certainly for the whole time they were in that area, the messages sent began with 502. Around 1600z the French QRA also joined up and from images produced by the MOD, these were shown to be a single Rafale and a single Mirage 2000C – callsigns noted on Fighter Control as MASTIFF01 and MARAUD03.

Russian Air Force TU-160 Blackjack RF-94104 with a French Air Force Rafale and Mirage 2000C © Crown copyright 2016

From there the Blackjacks turned around and I expect pretty much followed the same route back. I could certainly tell that they were near to me later on, they were ridiculously loud on HF.

Below then is a copy of my voice logs, along with the recordings I made. A good test of my recently installed Wellbrook Loop that I’d finally been able to put up on the mast just the week before, after having it for nearly three months! Scottish weather!!

NOTE – These recordings are copyrighted to me. It has been noted that other recordings have ended up on YouTube, uploaded by a third party. Should this happen with my recordings, further action will be taken


1216z 44732 calls KATOLIK

1217z 44732 calls KATOLIK [KATOLIK very faint]

1218z 44732 calls KATOLIK, BALANS replies

1220z BALANS passes message 130 525

1222z BALANS calls 44731 numerous times
– Note, contains all of the above

1226z 44732 answers, BALANS passes message 130 525

1232z 44732 calls BALANS with message [too faint to copy]

[messages continue until 1245z, all too faint, multiple callsigns]

1302z 44732 calls BALANS with message 157 133 796 290 525 853

1306z BALANS and 60991[?] 532 598 757 706 057 162 363 395

1318z BALANS passes message 727 to 44732

1356z 44732 calls BALANS with message 197 077 950 525 305

1510z 44732 calls BALANS with message 502 549 447 360 981 848 842 366 215 492 481

1551z 44732 calls BALANS with message 502 956 447 339 822 532 842 942 563 592 339

1612z 44732 calls BALANS with message 502 411 447 132 196 010 565 564 978

1641z 44732 calls BALANS with message 926 429 564 695 525 447

1745z 44731 called by BALANS

1750z BALANS calls 44731 with message 861 408 850

1826z 44732 calls BALANS with message 976 170 408 953 525 055


Approximate routing of the Tu-160 Blackjacks

One final thing to note – on exactly the same day in 2015 (day of the year, not actual date, so the third Wednesday in February) the Russians carried out almost the same flight, going down the West coast of Ireland. Further information on that mission, including HF recordings, can be found in Bear Hunting – part two

Bet you a few quid they’ll be back same day next year 😉

Bear Hunting – part two

Well it appears I may have been wrong about the previous mission in January by the Russian Bears and their routing down the English Channel – though there is still no hard evidence this did happen. But, for now then I will accept that it did unless proven otherwise.

On February the 18th the Russians carried out another flight down the west coast of Ireland, outside any sovereign airspace and this time causing less disruption than in January. That isn’t to say there wasn’t some traffic information given by Shanwick and Shannon about unknown traffic.

Kyle, aged 15, a member of a closed forum I’m in, was able to pick up some good comms from the Typhoons, including confirmation of the tail numbers of the two Bears:
Lead aircraft = RF-94130 (24 Red)
Second aircraft = RF-94116 (28 [Red])

Personally I didn’t get much but what I do have is available here:

NOTE – These recordings are copyrighted to me. It has been noticed that other recordings have ended up on YouTube, uploaded by a third party. Should this happen with my recordings, further action will be taken

8131Khz – 1744z 51131 calls BALANS with message
531 027 103 572 874 960 825 069 068 549 290

1747z KATOLIK calls 51131 for the message too

8131kHz – 1805z 51131 calls BALANS with message
531 640 103 931 345 097 830 872

Note that the first and third groups are the same in both messages. I’m still working on a possible decode for these messages


A couple of things.

Firstly, I noticed that if you collate the first six numbers of the above messages they could well be Lat/Long positions.

5310.27N (0)1032.02W
5316.40N (0)1039.31W

Putting that into Bing Maps you get:

It is known that the Bears flew approximately 10 to 15 miles off the coast of Ireland and this does tie in quite nicely with that. However, this doesn’t run with other messages received unfortunately. But, I’ll keep plugging away any further messages to see if there is a crack for some of them.

On to the second update.

I must have put my Excalibur on to record when I got back from work on the 19th but then forgot about it. Whilst deleting the backlog of recordings I noticed there was one I hadn’t listened to and quickly discovered I’d captured some further messages on this day too. Here’s the recording, with a transcription below (thanks to Ron for checking (and correcting) my Russian translation):

8131 – Bear Net

1502z BALANS calls 69341 and 69342

1503z [aircraft passes message, not heard]

1504z BALANS reads back
636 804 856 444 517 803

1505z BALANS reads back
809 698 525 048 517 326

1506z BALANS reads back
207 201 617 371 151 667 613

1510z BALANS reads back
891 804 707 677 517 211
[lots of error change messages with grp1 becoming 575, grp3 606]

1514z BALANS reads back
293 301 604 252 503 933 630
[lots of error change messages with grp2 becoming 201, grp4 952]

Bear Hunting


After this weeks flight of two Tu-95MSM “Bears” off the South West coast of the UK, I thought it would be a good time to release the article I produced for The Spectrum Monitor in October 2014. The article covers not only information on the Tu-95 and Tu-160 “Blackjack” but also on how to monitor these flights. There’s also some additional information that I’ve discovered I’d left out of the article plus some recordings from this weeks mission.

With regards to the flight this week, it certainly caused quite a stir, making it onto the major national news channels. There was lots of speculation that they flew all the way along the English Channel causing lots of disruption to Civil flights into and out of the UK; also lots of rubbish spoken about what ATC can and can’t see. Though I can’t comment much, I will say I don’t believe the Bears flew all the way along the channel, instead I think they went no further than to the SW of the UK. From the playbacks I’ve seen on FR24, it looks like most of the disruption was caused by the tanking of the Typhoons by the A.330 – this area has been available for tanking for many years.

To answer the question about whether the aircraft can be seen on radar because they are not using transponders – well yes of course they can. It’s just there’s no associated height information, (which isn’t always there even if aircraft do use transponders)and of course it makes it harder to track. But, there are primary radar returns that’s for sure. Where I think people are getting confused is when the Bears are flying north/south across the Atlantic tracks in Shanwick’s airspace. Here they can not be seen as they are outside the range of radar, but by this time they would have been met up by Typhoons which gives all the relevant information about height etc over the radio . I hope this clears that up.

Anyway, on to the article

Bear Hunting

When I say Bear hunting, I’m not referring to tracking furry creatures around the countryside using sophisticated radio devices as aides, finally getting into the position for a kill or photograph. No, I’m referring to the monitoring of the Russian Air Force Strategic Bomber networks on HF.

Although in general the monitoring is referred to as “Bear hunting” and the frequencies monitored are in the widely used term, “Bear Net”, this is an incorrect name as it is not always Tupolev Tu-95 “Bears” that we are hearing.

The Russian Strategic Air Force is officially known as the Long-range Aviation Command and is made up of two heavy bomber divisions. The aircraft types used are Tupolev Tu-95MS “Bear H” and Tupolev Tu-160 “Blackjack” along with the non-Nuclear bomber, Tupolev Tu-22M3 “Backfire C” which is split into four divisions. As well as the bombers themselves, there’s also other types of aircraft used to help support the missions; these being Ilyushin IL-78M “Midas” air to air refuelling tankers, and Beriev A-50 or A-50U “Mainstay” AWACS – these types being based on Ilyushin IL-76 transport airframes.

A Quick Reaction Alert (QRA) Typhoon F2 from Number XI Squadron at RAF Coningsby is pictured escorting a Russian Bear-H aircraft over the North Atlantic Ocean. QRA procedures entail aircraft being held at continuous ground readiness, so that they can take off within minutes - without pre-warning - to provide air defence. (Photo courtesy of UK Ministry of Defence Crown Copyright Photo Service ©2008 Crown Copyright
A Quick Reaction Alert (QRA) Typhoon F2 from Number XI Squadron at RAF Coningsby is pictured escorting a Russian Bear-H aircraft over the North Atlantic Ocean.
QRA procedures entail aircraft being held at continuous ground readiness, so that they can take off within minutes – without pre-warning – to provide air defence. (Photo courtesy of UK Ministry of Defence Crown Copyright Photo Service ©2008 Crown Copyright

It is also presumed that other types are used in the missions, such as Ilyushin IL-76VKP and Ilyushin Il-86VKP “Maxdome” Command Posts (much like the role carried out by E-4Bs National Airborne Operations Centre aircraft used by the USAF) and even Ilyushin IL-38 “May” maritime patrol aircraft used by the Russian Navy (the USN P-3 equivalent). In general though, these types aren’t heard by those that monitor the frequencies regularly, especially the IL-76VKPs and IL-86VKPs as their statuses are not widely known, and their believed running costs make them almost too expensive to fly. The Russian Navy participation in exercises must take place, much like the combined exercises that the US Forces carry out – bombing missions/exercises supported by USN E-6Bs for instance.

There are other variants of the “Bears”, these being Tu-142MK’s and Tu-142MR’s (“Bear F/Bear J” respectively) but these are operated by the Russian Navy with Bear F’s used for Anti-Submarine Warfare, equipped with different radar fits and weapons systems designed specifically for Sub hunting; whilst Bear J’s are VLF communication airframes much like USN E-6B’s. There’s every possibility these do take part in some of the exercises we hear.

Getting back to the Air Force Bombers themselves, as previously mentioned above, there are two Strategic Divisions. These are the 6950th Guards Air Base at Engels Air Force base in the Saratov Oblast region of Russia; and the 6952nd Air Base at Ukrainka in the Amurskaya Oblast region. If you have Google Earth I’ve uploaded a kmz file showing their locations.

The bases are then divided into Regiments with the Engels base containing the 121st Guards regiment flying Tu-160s and the 184th regiment flying Tu-95MS’s. Ukrainka is made up of the 79th and 182nd regiments, both flying the Tu-95MS. Because of START, the numbers of each type flying are known, with 55 Tu-95MS’s and 11 Tu-160’s available to the Russian Air Force, but again, the full status of each airframe is somewhat hazy, even in the modern world of information technology available on the internet – there’s certainly many more photos of these types available to view online than there ever was available before the invention of the internet. The split of numbers between each regiment is again unknown, but Satellite images show up to 18 Tu-95’s at Ukrainka on the bombers apron.

With the breakup of the Soviet Union, aircraft of the Russian Air Force became popular targets for air show participants. The International Air Tattoo at Fairford, UK got the first bite in 1993 when Russia sent one Tu-95 and IL-78 refueller for the static display. In 1994 they did even better with a Russian Navy Tu-142M “Bear F” in the static and this Russian Air Force Tu-95MS “Bear H”, 23 black, in the flying display. © Tony Roper
With the breakup of the Soviet Union, aircraft of the Russian Air Force became popular targets for air show participants. The International Air Tattoo at Fairford, UK got the first bite in 1993 when Russia sent one Tu-95 and IL-78 refueller for the static display. In 1994 they did even better with a Russian Navy Tu-142M “Bear F” in the static and this Russian Air Force Tu-95MS “Bear H”, 23 black, in the flying display. © Tony Roper

Engels is almost certainly supported by IL-78 tankers either based at Engels itself, or from the Ryazan Air Force base which has the 203rd regiment based there. Ryazan is also a training and maintenance facility for the bombers. Ukrainka possibly has its own regiment of IL-78’s, but details on these are unknown at this time, it could even be another deployment of Ryazan tankers.

The Tu-95MS’s have a crew of seven, and can carry up to 16 Air Launched Cruise Missiles (ALCM), both Nuclear and conventional. Crew members comprise of:
Two pilots, radio operator, nav/defensive operator, flight engineer, bomber/nav and rear tail gunner. There’s also a spare seat for observers. The aircraft operate between 25,000ft and 38,000ft and can fly at speeds of 500kts (Mach 0.83) at the lower level. Unrefuelled they have a range of 3,455 miles, increasing to 4,480 miles with one refuel. They have however carried out multiple refuels extending this range even further. The most unique feature of the aircraft has to be the four Samara Kuznetsov NK-12MP turboprops each with eight-blade contra-rotating propellers – they make a very distinct sound

The aircraft themselves are split into three variants:
Tu-95MS-H6 and Tu-95MS-H16, referring to the number of cruise missiles the aircraft can carry. The main six missiles are on a rotary launcher inside the aircraft, with the H16 types having the ability to hold a further 10 missiles on pylons on the wings. For START purposes though, the H16’s are to be converted down to H6 standard only, if they haven’t been so already. The third variant is the Tu-95MSM which is an upgraded version designed to carry new type of ALCM.

The number of each variant is, as usual as its Russia, not fully known, but it is presumed most, if not all, are now of the Tu-95MSM designation, probably going from the H16 variant to this directly instead of downgrading to the H6 and then up again. The Tu-95MSM can be distinguished by the fact it is carrying eight of a new type of ALCM on pylons under the wings as these missiles are too long to fit in the internal weapons bay. Of course, they still have the option of using the internal rotary launcher and older ALCM’s if required.

The Tu-160’s have a crew of four comprising of two pilots, and one bomber/nav and a comms/nav operator. They have variable geometry wings that can be manually swept back as speed increases, the maximum speed being Mach 2.05 at 40,000ft. They normally cruise at about Mach 0.9 or 518kts at high altitude but they are fully capable of flying low level down to 250ft. The Tu-160 carries its weapons in two separate internal weapons bays, each with six missiles on rotary launchers

Weapons wise, both aircraft types are primarily intended to carry ALCM’s. A recently new ALCM has been designated the Kh-101/Kh-102, the latter having a nuclear warhead. The Kh-101 has a 400kg HE warhead designed to penetrate hardened shelters and has a range of around 5,000km at a speed of about 700kmh. They are reported to be accurate to 12 – 20m from this range. It is believed that an upgrade to the Tu-160s started in 2006 gave them the ability to use Kh-101/Kh-102’s.

An underside view of 23 black whilst it performed a flypast. The Kutnetsov NK-12MP turboprops with the eight-blade contra-rotating propellers are clearly discernible here. The airframes themselves have hardly changed since this was taken in 1994. © Tony Roper
An underside view of 23 black whilst it performed a flypast. The Kutnetsov NK-12MP turboprops with the eight-blade contra-rotating propellers are clearly discernible here. The airframes themselves have hardly changed since this was taken in 1994. © Tony Roper

By far the greatest number of ALCMs available for both aircraft types are Kh-55/Kh-555 (NATO AS-15 “Kent”). There are a few sub types available but for simplicity, the Kh-55 (AS-15A and B) types have nuclear warheads, whilst the Kh-555 (AS-15C) is a conventional weapon with a 410kg HE warhead. Ranges vary from 2,000km to 3,500km. There are over 700 Kh-55 ALCM’s still in existence according to reports. The long term plan was reportedly to be 500 nuclear armed ALCM’s in the inventory made up from both Kh-55 “Kent B” and Kh-102 types.

Monitoring the “Bears”

In all references to “Bears” it could actually mean either the Tu-95s or Tu-160s but it’s just easier to generalise the term to save space. More often than not they are Tu-95s though as there’s a greater number of these aircraft in the fleet.

The Bear networks use both CW and USB for communication; CW is Duplex with ground stations on one frequency and the aircraft on another; whilst in USB mode the networks are simplex. The frequencies are contained in the table provided, but as you’ll see there’s still one missing; in fact it was only recently that I discovered the summer air frequency used – until this time it was not known by the many that monitor the Bears (well no-one else had published it anyway). No doubt there are more frequencies used as, as you can see, there are secondary ground frequencies in other seasons.

The Russian Military in general use a seasonal system for selecting their frequencies and for the Bear net these haven’t changed over the last few years.

Spring 1/3 – 5/5
CW GroundCW Air
8029 kHz Primary8170 kHz
5620 kHz
8090 kHz
5606 kHzNavy Bear Net
Summer 6/5 – 31/8
CW GroundCW Air
8895 kHz Primary9128 kHz
8909 kHz Primary
5606 kHzNavy Bear Net
8884 kHzPacific
Autumn 1/9 – 31/10
CW GroundCW Air
8162 kHz Primary9027 kHz
8033 kHz Primary
5606 kHzNavy Bear Net
Winter 1/11 – 28/2
CW GroundCW Air
8112 kHz Primary8990 kHz
8131 kHz Primary
5606 kHzNavy Bear Net

**New information**

I also have VHF/UHF Air to Air frequencies that the Bears have used in the past that I forgot to put in the article:

As well as HF, they also use VHF/UHF for normal transmissions to ATC, Air to Air etc. These HF networks are solely for communicating with presumably HQ Moscow and other strategic agencies, their homebase for instance. It’s even possibly transmissions to radar sites or an equivalent to the Mainsail or “Skymaster” calls made by USAF bombers.

Usually the first sign that the Bears are up is the activation of Marker Beacons on the CW networks. Every 20 minutes, lasting for two minutes, a single letter will be repeated by CW. It is always on the H+00, H+20 and H+40 and normally hand sent. The marker most commonly heard is “W” and this is almost certainly Moscow and the Strategic (or Long-Range Aviation) headquarters. Another is “G” which is believed to be Ukrainka. Engels probably has a marker but it is unknown, but various other markers noted include “Q”, “R” and “Z”.

This photo of Tu-95 Bear-A “12 black” was taken in 1985 by my friend who I served with in the RAF, Dave Hedges. Not much has changed to the aircraft externally since then. He had blagged a trip on a VC-10 that was planned to do a routine Air to Air refuel with Buccaneer aircraft, when the aircraft was suddenly re-tasked mid refuel. It transpired the VC-10 was to refuel a F-4 Phantom that had been scrambled to intercept two Bears that were heading towards the UK through the Faroes-Iceland gap. Dutch fighters also escorting the Bears had to RTB due to lack of fuel so the VC-10 joined the Phantom in stewarding them away from the UK. One thing he still remembers is that “the noise and vibration from the Kuznetsov engines with their contra-rotating propellers was astonishing”. © Dave Hedges
This photo of Tu-95 Bear-A “12 black” was taken by my friend who I served with in the RAF, Dave Hedges, in 1985. Not much has changed to the aircraft externally since then. He had blagged a trip on a VC-10 that was planned to do a routine Air to Air refuel with Buccaneer aircraft, when the aircraft was suddenly re-tasked mid refuel. It transpired the VC-10 was to refuel a F-4 Phantom that had been scrambled to intercept two Bears that were heading towards the UK through the Faroes-Iceland gap. Dutch fighters also escorting the Bears had to RTB due to lack of fuel so the VC-10 joined the Phantom in stewarding them away from the UK. One thing he still remembers is that “the noise and vibration from the Kuznetsov engines with their contra-rotating propellers was astonishing”. © Dave Hedges

The Naval Bears also use a Marker system, with Moscow using “C” and Arkhangelsk/Severomorsk using “S” , but it’s just as possible they also use the very same network here. Without visual identification of the aircraft you just don’t know who you’re listening too, but more on that later.

The purpose of the markers is so that the aircrew can check their radio equipment, and also confirm they are able to receive the appropriate unit they need to communicate with. If there are two markers on the go at the same time, as recently with both G and W, the one that isn’t Moscow seems to start about a minute earlier so that there’s a slight overlap. On USB there are no markers. I always wonder which is the primary method of communication here, as CW from the ground certainly has a better range, well for me anyway. Moscow “W” is normally very loud, though as usual propagation plays its part sometimes.

The Bears normally start the communications with Moscow, and I would say it’s likely to be an airborne or status message. But there is no way of telling as the messages are coded. Be it using CW or USB the aircraft always send messages containing groups of three numbers. Ordinarily there doesn’t appear to be a pattern to the numbers as such but they obviously have a meaning, examples of CW messages are:

1244z KFE4 DE KL3U QTC = 728 988 046 927 579 274 780 545 419 069 009
1321z KL3U = 871 988 990 084 158 304 182 397

These messages are from an excursion to the edge of UK airspace on the 19th August this year. Interestingly, I also picked them up on the 20th August 2013, also the third Tuesday of August – coincidence? To breakdown the message above, KFE4 is the ground station, KL3U is the Bear flight. There’s a possibility that the ground station callsign “travels” along with the flight, with a different ground station taking over the callsign to give complete radio coverage. This is just another theory though.

Now we all have our own ideas about the numbers and to be honest I just don’t know the true answer as to what they could possibly mean. I would expect them to be position or progress reports, status reports even. Interestingly, in this mission there were multiple messages starting with 728 or 871, and every time a message began with these numbers the second number group matched:

1153z KFE4 DE KL3U QTC = 728 577 046 025 084 920 423 545 091 804 895
1211z KFE4 DE KL3U QTC = 871 577 990 396 743 406 287 753

You may also notice that comparing the message examples, the third group is the same with regards to the first group; 728 is 046, 871 is 990. This repeats throughout the messages of this mission.

To confuse things slightly though, there is a third first group involved with KL3U, this is 558:
1301z KFE4 DE KL3U QTC = 558 130 422 295 396 246

558 messages never matched any of the second group numbers to 728 and 871, and the third group is never the same.

The messages starting 558 are more in line with the other missions I’ve logged which look totally random. There also messages that are short from an aircraft which are then an hour later at the beginning of a longer message from the ground station, such as these sent in March this year:
1612z P9DL = 710 282 073 633
1728z TRL5 = 710 282 073 633 276 040 795 197 136 802 777 539 643 709

It wasn’t until writing this article that I noticed there’s actually a forth first group in the recent mission, 732, which matches the same format as 558. So, as you can see, there’s random and there’s fixed message types. I do enjoy trying to crack these codes, something I managed to achieve in January when I analysed messages from IL-76 transporters ferrying equipment to Syria as part of the Chemical weapons removal. This can be read in my blog from that time.

Part of me thinks that each first group is a separate aircraft within the formation but there are a couple of things that cancel that theory out. Firstly, this pattern doesn’t follow in previous missions and secondly, the keying was almost certainly done by the same person due to the “fingerprint” of the CW. However, as with most formation flights of any Air Force, it could well be that only one aircraft is sending messages for all aircraft in the formation, the lead aircraft for example. The Russian Navy does this when there is a group of ships travelling together, with quite often one ship sending messages for all. It is generally believed that the air callsigns are individual aircraft as there have definitely been other missions were more than one callsign has been in contact with the ground – but were these in fact other airborne assets and not the bomber flight?

The aircraft callsigns seem to be tactical and change every time whilst the ground callsigns appear to be fixed with the same ones being used each season, examples being:
TRL5 – spring
TV6P, IZ2J and KFE4 – summer
4ASU, QZ6Y and PUO7 – autumn
IWV4 – winter

It is always a better monitoring experience if you can pick up both CW Air and Ground so that you can get both sides of the “conversation”, but this isn’t always the case, with just the ground audible. The transmitters on the aircraft are not big, and they are not powerful so it is hard to pick them up. Of course, if they happen to head over towards the UK then they do get very clear indeed, as happened recently when at least two Bears flew close to the Shetland Islands off the NE coast of Scotland.

Another side view of 23 black as it taxies in. The rear tail gun is clearly visible here and if compared to Dave’s picture from the 80’s you’ll see a slight change. The glass observation bubbles under the tailplane which were used by the tail gunner have been removed, as has the second gun positioned on the underneath of the aircraft just before the tail (slightly harder to see in Dave’s picture). The gun itself is also a different model. © Tony Roper
Another side view of 23 black as it taxies in. The rear tail gun is clearly visible here and if compared to Dave’s picture from the 80’s you’ll see a slight change. The glass observation bubbles under the tailplane which were used by the tail gunner have been removed, as has the second gun positioned on the underneath of the aircraft just before the tail (slightly harder to see in Dave’s picture). The gun itself is also a different model. © Tony Roper

Hearing both sides of the R/T isn’t a problem on USB as it’s a simplex network, but range of aircraft from the reception point and propagation will of course play a part in this. Your knowledge of the Russian language though is going to be main hindrance in any monitoring. Usually the ground station is very much stronger, much like the CW network.

Russian is hard enough as it is, but when you’re listening in on HF to something where the crew themselves have to wear headsets with additional noise defence fitted to the earpieces, you can just imagine what it sounds like. To put it another way, you can normally tell you are listening to a Tu-95 and not a Tu-160 because you can actually hear the turbine engines in the background! And the crew are normally shouting down the mic. To add to the difficulty of working out the messages there’s the way the numbers are said. Some say them in singles – Dva Vosem Dva (282); but then other crew members will say them as long numbers, two hundred and eighty two for example which in Russian is “dvesti vosem’desyat dva”. Luckily, you’ll normally get a second chance at the numbers as the ground controllers will read them back, often in both methods as described. I know numbers in Russian, and I really struggle, especially in the non-singular method. A recording is normally necessary to get it right – if possible.

As I’ve already stated, the message formats are the same, three figure groups. But there is a difference in callsigns. For starters the aircraft use a different call to the CW one, comprising of five numbers, 50271 for example. These numbers are logged differently by some people, 50-271 for the previous example. This is because of the way the callsigns are sent: “Fifty, two hundred and seventy one”. But I think this is wrong, and there’s possible photographic evidence that points towards the numbers being a five figure group. There’s a link to the photo evidence at the end of this report.

The ground stations also have voice callsigns as opposed to the four digit call in CW. In a way this is understandable as some of the callsigns are long and would be hard to do quickly in CW. Again though, the ground callsigns are fixed and never change, they’re not even seasonally split as far we can tell. Callsigns heard include:
ADRIS – new callsign for the recent flight
SHPORA – believed to be Rostov-na-Donu though not proven

The location of the other callsigns is unknown, but BALANS and NABOR are called the most and it seems likely one of them is Moscow or Long Range HQ.

Now here’s the strange thing. The actual message format is the same as I’ve already said, and yet when CW and USB have been sent at the same time, no doubt from the same aircraft formation, the actual message is different. As an example here’s two messages sent at exactly the same time, 0212z on the 20th August 2013:
CW: TV6P = 161 179 985 027 614 591 089 C = (this is a read back from the ground station TV6P)
USB: 30977 calls Medyanka – 527 268 987 627 805 893 206 591 093

Except for the penultimate group (591), no other number is the same, but there are similarities. At the end of the day though, these messages are being sent by Strategic Nuclear bombers, they are probably exactly what would be sent should the unthinkable happen and the aircraft are dispatched for real. The messages are not supposed to be decoded, and if I was able to I’d be a very rich man thanks to NATO. Liken them to the equally unbreakable EAM messages sent by the HF-GCS network if you like.

Of note in USB mode is that there are a lot of relay messages from one aircraft to another, something that I haven’t found in CW mode. This is probably down to CW having a better chance of getting through noise and propagation than voice transmissions. Sometimes, though, CW messages are sent blind.

More often than not the aircraft actually head east these days, especially those from Ukrainka. In the Cold War this wasn’t the case and the Bears made regular trips to Europe skirting around the northern parts, not entering any sovereign airspace, and even heading into the North Atlantic region. If they did this, it would cause all sorts of trouble as they don’t declare themselves to Shanwick Oceanic and normally just cut south across all the Oceanic tracks. The only method of knowing where they are here is via long range radar (which as you can imagine aren’t pointing out over the Atlantic as there’s not much threat to the UK from that direction) or via an “escort” of RAF fighter aircraft. These flights to the Atlantic are increasing again, sometimes going as far south as Portugal and beyond.

Most nations have a QRA (Quick Reaction/Alert) capability and in Northern Europe they used to get launched regularly but this died down when the Soviet Union fell. Russia had a lack of funds for a very long time and its military fell by the wayside; until Putin’s recent reprisal of it all. In the last few years, Bear missions have increased from practically none a year to two a month, especially recently. Sometimes it’s two a week to Europe or Pacific regions, or maybe one to Europe and one to the Pacific at the same time. Either way, they are getting more and more frequent again.

QRA aircraft will launch from the various countries along the route and intercept the Bears in “free” airspace, take some pictures, note down the aircraft identities (reporting this back directly to the Air Defence Controllers), wave and generally ensure the aircraft do not enter sovereign airspace. If the Bears continue skirting the edges of various other countries, then the current escorting QRA will hand over to the next country along the way. It takes a lot of resources to carry out the QRA task, with fighter crews being on immediate standby at their bases, 24/7, along with at least one air-refuelling tanker required to sustain the flights here in the UK. Should it be a long task, another flight of fighters will get airborne to take over whilst the first pair get a refuel. There is no messing around here though, the fighters that go up to meet the Bears are fully armed and make sure the Russian crews are aware of this fact by showing them.

Obviously, the intercepts are also monitored here in the UK and Europe but I’m not at liberty to say frequencies used due to the very nature of the missions. One thing this monitoring does provide though is the identity of the Russian aircraft, because as I mentioned earlier, the intercept aircraft report back the type and tail numbers of the Bears.

Of note from a recent intercept by RAF fighters, at the time the lead Typhoon reported flying in formation with the lead Bear, a message was sent on CW. Was this a message being sent back home that they had met up with the UK Air Defence?

For those of you that like to follow any QRA action using ADSB data, you must realise that there is a flaw in doing this, especially when reporting live on Twitter.

Whilst occasionally the fighters can be tracked, normally it is the tanker that is providing ADSB data. Without going into any specific details here, the tanker could be anything from 30 to 100 nm away from the Bears!! So, posting continuous Tweets that “the Bears are here” is completely misleading and quite often leads to huge speculation and, to be honest, complete rubbish from media outlets that state “our airspace was entered by Russian Bombers” after reading these bulls**t Tweets. Think about what you are Tweeting and the consequences of your actions – most of the time you are complete wrong and you haven’t a clue where they are!

Finally, it is also worth noting that CW isn’t always received even though there’s plenty of traffic on USB. The markers will still be being sent every 20 minutes, but there’ll be no actual traffic. I’ve not known it to be the other way round with CW only and no USB.

Two approximate routes routinely taken by “Bear” flights towards the UK. The route to the west of the country causes no end of trouble as the route cuts south, and then north again, straight through the Atlantic Oceanic tracks which is a non-radar environment. They also cut south between the UK and Norway, down towards Dutch airspace Map features courtesy of
Two approximate routes routinely taken by “Bear” flights towards the UK. The route to the west of the UK causes no real problems despite many stories to the contrary. At the levels the Bears fly at, they are normally well under the Atlantic Oceanic tracks. The two routes to the North of the UK are quite often linked to make a short cut across to the West of Ireland between the Shetlands and Faroe Islands. They also cut south between the UK and Norway, down towards Dutch airspace
Map features courtesy of

Recordings from the flights on the 28th January 2015

NOTE – These recordings are copyrighted to me. It has been noticed that other recordings have ended up on YouTube, uploaded by a third party. Should this happen with my recordings, further action will be taken

8131kHz 1058z – Callsigns believed to be 72181 and 72182 calling BALANS, ADRIS, KATOLIK and GEOLOG. Aircraft types are still unknown at this time but possibly the IL-78 refuellers. They call each other and chat about not getting through to any station.

8131kHz 1130z – Callsign 72186 makes calls initially with no luck, then calls 72182 and asks them to try the ground stations, which they do, also with no joy

8131kHz 1224z – Callsign 72181 calls initially followed by 72182 calling 72181. After a brief conversation 72182 tries BALANS getting through (very faint on this recording).72181 then tries BALANS again and gets through with following coded message 949 867 069 473 250 197 518. BALANS doesn’t get the message and 72181 tries two more times but BALANS doesn’t get the message clearly. Note – to cut down the length of the recording the faint BALANS transmissions are cut out