The Bear Net “Pirate”

The “Bear Net” of Russian Long Range Aviation has been relatively busy during the last few months, no doubt some of this due to the exercises playing out in Northern Europe by Western countries and NATO. They also tend to increase activity around the same time as USSTRATCOM have their Global Thunder exercises, one of which kicked off on the 29th October and lasted for just over one week.

Three Russian missions took place within the last two weeks, all of which travelled through the same airspace as the area covered by Exercise Trident Juncture 2019 (TRJE18) off the North coast of Norway. One flight was of a single Tu-142M, RF-34063//Red 56, that made a low pass near participating ships. I was unable to follow this flight so not received by me, the likely callsign on the CW frequencies for this was LNA1. This was intercepted being called by IWV4 on 8112 kHz at approximately the same time as the pass was being made. Images of the pass were caught by AFP correspondent P. Deshayes who was on one of the ships.

One of the other missions was of more interest than normal. The “Bear Net” is always an interesting thing to follow on HF, but when extras are produced it makes them even more fascinating. In this case it wasn’t so much what the Russian did, but what happened late on in the mission that wasn’t them.

Stepping back, we’ll go to the beginning of the day – 31st October 2018. The net was still on the autumn frequencies with ground station CW first being picked by myself sending “W” markers at 0920z on 8162 kHz. I quite often put one of the receivers on the current season ground station frequency to get any alert of possible flights heading out thanks to the markers sent every 20 minutes at H+00, H+20 and H+40. With this 0920z interception I started recording the frequency and I switched all radios to the other known frequencies – 9027 kHz for Air CW and 8033 kHz for Simplex USB voice comms – and got set up to start recording these should anything happen.

The 0940z W marker came, but interestingly when I went through the recordings later on I was able to hear a very faint G marker in the background. This had at least two operators carrying out the task as there were two distinct methods of sending. One would use the standard G every two seconds, whilst the other sent as double G’s and slightly quicker. The marker also started approximately 10 seconds earlier than the W and – guessing as it was stepped on by the W – looks to have lasted the two minutes too. You could hear it in the background between the odd W space.

At 0949z 8033 kHz became active and I started up recording on multiple SDR’s whilst using my Icom IC-R8500 as the live radio. By this time, I had also observed callsigns associated with QRA flights on my SBS so was pretty certain something was heading towards the UK.

With a few more USB calls following, but no CW traffic except for the markers I was certain the aircraft involved were Tu-160’s as they don’t use CW.

My Russian is still pretty basic (if that) so I totally rely on recordings to go through it all in slow time. I had been able to work out live that there was at least the usual STUPEN callsign along with TABLITSA; but I was also hearing another one that when going through the recordings I worked out to be KONUS – this one I hadn’t heard of before.

Going through the recordings, this mission certainly helped my knowledge of Russian numbers, or rather the methodology of how the messages are sent, as there were plenty of messages involved. The two aircraft callsigns were 16115 and 16116. These callsigns carry on in sequence to those that were used on a mission a few days earlier on the 28th with 16111, 16112 and 16114 being used by Tu-160’s and 50606 by an accompanying A-50.

In general 16115 was much harder to understand than 16116. 16116 said it all much slower and louder. STUPEN was very clear at the beginning, but faded towards the end, whilst TABLITSA may of well have been in my room, she was that loud.

Here then is the first part of my USB log:

8033 – Bear Net

0941z 16116 calls STUPEN
274 443 624

0949z 16116 calls STUPEN
458 842 156 816 443 896

0959z 16116 calls STUPEN [replies, 16116 faint]
KONUS calls 16116 and tells him to pass the message to him

1000z [16116] 303 847 023 534 734 619 822 332
[with wrong read back of group three, corrected by 16116]

1002z 16115 call KONUS
138 534 005 964 312 147 443 896

1010z 16115 call KONUS
741 534 724 619 822 180 443 594

1020z 16116 calls STUPEN
478 815 023 534 071 955 117 957 084 305

1028z 16115 calls TABLITSA, then straight away calls STUPEN
138 1?5 [error?] 138 534 540 115 ??? 251 660 033 084 316
[garbled with a possible error]

1036z 16116 calls STUPEN and TABLITSA, STUPEN replies
303 815 023 534 671 612 842 768 084 544

1039z 16115 calls TABLITSA and STUPEN, STUPEN replies
741 534 671 619 246 768 023 084 544

1048z 16115 calls STUPEN
138 534 491 236 896 443 084 635

1050z 16116 calls STUPEN
478 815 023 534 635 233 107 219 084 615

The recording below contains the 1048z and 1050z messages

1112z 16116 calls STUPEN
452 635 084 125
[repeats third number twice]

1129z STUPEN calls 16116 twice – no answer

1132z STUPEN calls 16116 twice – no answer

1133z STUPEN send message
BLIND 553 028 533 ??1

1141z 16115 calls STUPEN
741 534 360 810 719 980 447 023 038 914

1144z 16116 calls STUPEN
303 875 023 534 106 673 980 719 038 914

1148z 16115 calls STUPEN
138 537 023 534 674 400 388 521 038 496

1159z 16115 calls STUPEN
741 537 023 534 940 441 388 441 038 896

1201z 16116 calls STUPEN
478 816 023 534 717 355 637 321 038 496

1210z 16115 calls STUPEN
138 537 023 534 600 902 955 462 038 844

1213z 16116 calls STUPEN
303 815 023 534 186 117 388 117 038 896

1217z 16115 calls STUPEN
741 537 023 534 981 980 356 789 905 149

1306z 16115 calls STUPEN
138 537 023 534 540 288 810 236 905 206

1318z 16115 calls STUPEN
352 315 544 243 942

1320z 16115 calls STUPEN
[4 calls, no answer]

1322z 16115 calls STUPEN
741 537 023 534 724 284 312 816 315 555

1325z 16116 calls STUPEN
457 187 905 844

1351z 16116 calls STUPEN
457 187 315 715

Then comes the interesting part of this…… the arrival on frequency of the “Pirate”.

At 1427z an open mike became present on the frequency, in AM mode. This was fairly brief, and at 1429z the Pirate started.

Mike Delta Kilo Romeo, Mike Delta Kilo Romeo
Mike Delta Kilo Romeo, Mike Delta Kilo Romeo Standby
Mike Kilo Delta Romeo, Mike Kilo Delta Romeo, Mike Kilo Delta Romeo Standby

Note his own error or change with the callsign

MDKR//MKDR

Image of carrier wave and transmissions of MDKR//MKDR. The Pirate is using AM mode, but as the recording was in USB only that half was captured.

This was followed at 1431z
Mike Kilo Delta Romeo
56822166095499102

The audio for the above is here:

At 1439z he was back but very faint, almost like it was a recording or live transmission of a Numbers Station. Shortly after this 16116 tries to call STUPEN and KONUS, getting stepped on by the Pirate who sends yet another attempt at an EAM/Numbers Station.

C78AAA5ACBCEA77D76FF33EAFAE63CF5A7AAAAFAF555A85CDBEEBBA5D6DFCCA – or something like that! It was hard to work out some of the digits due to the lack of phonetics. Each time I listen to it I get a different result!

Fake EAM/Number station message

The audio is below.

At 1446z, 16116 calls STUPEN, KONUS and TABLITSA but gets no response back.

The Pirate then attempts to jam the frequency again. First of all with an extract from a selcall system used by the Russian Ministry of Foreign Affairs given the name “Mazielka”, designated X06 in the Enigma Control list. See the end of the blog for analysis on this.

This was followed by a continuous tone at 1090 Hz for approximately 35 seconds. These are the last transmissions by the Pirate.

Again at 1459z, 16116 tries the ground stations until TABLITSA finally acknowledges his presence and a message is sent. 16116 is barely readable with me by this time, though TABLITSA was ridiculously loud.

1459z 16116 calls STUPEN
calls TABLITSA
calls STUPEN
calls TABLITSA answers [very strong]
452 730 969 463

1506z 16115 calls TABLITSA
590 375 143 986 196 233

1531z 16116 [very faint] calls TABLITSA
452 859 143 168

This was the end of all contacts on USB, with the last W marker coming it at 1520z (though these then did start up again at 1640z, though much weaker).

From various OSINT feeds, the approximate route of the Tu-160’s took them out over the Barents Sea having departed Olen’ya air base in the Murmansk Oblast and heading north before turning west once out over the sea. At some stage they were intercepted by Norwegian Air Force F-16’s and were escorted to abeam Bergen/NE of the Faroe Islands before turning for home. The Russian Air Force have stated that the flight lasted for ten hours which ties in with the seven hours or so of HF traffic, with the remaining 3 hours probably within range of Russian VHF communications.

Olen’ya is a common forward operating base for LRA missions, being one of the remaining Arctic Control Group (OGA) airfields available. The base itself hosts Tu-22M-3R Backfire-C of the Russian navy. These are Tu-22M3’s that have been converted for a navy reconnaissance role though it is unknown just how many are airworthy. The base has over 30 Tu-22’s in permanent storage.

Twitter feed for записки охотника (Hunter Notes) has a rough plan of the route flown, along with his intercept of the messages sent – he has few of the earlier ones, and there’s a couple of differences between his and mine.

So, who is this Pirate? It isn’t the first time he’s been around. He was also heard in September.

On this occasion he was a little bit more direct.

Russians we are watching you
Russians we know where you are
Russians, turn around and abort your mission

And later

We will blow you out of the sky
The Russians. We have you under observations [sic], stand down

Despite having what is clearly a South East England accent, he signed off using something along the lines of:
This is the United States BC36

No doubt he is trying to gain some sort of attention, and in a way he is succeeding – me writing this blog is proof of that. But what else is he trying to achieve? Is he hoping the Russians respond? I doubt they will. Apart from anything, I expect the radio operators, having had to listen to all the noise on HF for every flight, have learnt to ignore any calls which aren’t specific to their mission.

My initial thoughts were that he isn’t a radio amateur and hasn’t worked in any other field that involves speaking on the radio. His use of poor phonetics made me wonder this. However, with access to a transceiver and associated antenna this may not be the case – and amateur radio operators tend to make up their own phonetics rather than standard ones, and he may just not know them.

That said, he must have some interest in military aviation and possibly a member of a military aviation forum. These tend to have thousands of members that have not been vetted in any way or form and quite often have threads that give notice of flights are on their way, be it with an alert of a QRA launch or actual comms received on Bear net frequencies.

Twitter, of course, is another example of information being out there for anyone to then take action on.

One thing is for sure, if caught he will find himself in trouble with UK authorities with the possibility of a two year prison sentence and a heavy fine. He will most definitely lose his radio licence should he actually have one, and have all equipment confiscated.

Lets see if he turns up again in another LRA mission.

Analysis of the Mazielka (X06) transmission

It was obvious straight away that this was a recording of X06 – in this case the sub-variant X06b.

However there was something odd about it.

X06 is a selcall system used by the the Russian Ministry of Foreign Affairs to alert outstations of an upcoming message, normally on another frequency.

The system sends out 6 tones, each lasting 333 milliseconds, making each call 2 seconds long. Each tone represents numbers 1 to 6 making a total of 720 different selcall combinations available for use.

The tones are sent on slightly different frequencies:
1 – 840 Hz
2 – 870 Hz
3 – 900 Hz
4 – 930 Hz
5 – 970 Hz
6 – 1015 Hz

The image below is taken from a X06 call I intercepted in November 2017 and decoded using go2Monitor. This shows a selcall of 116611. In this case the tones, which are still 333 ms long, sound longer but this is because the digits join on the same tone.

Whilst you can use a decoder, for X06 it is easy enough to decode using other means, such as Adobe Audition or Signals Analyzer. With these you can measure the tone frequencies and lengths.

In Adobe Audition the Pirate transmission is shown below

Pirate_003Pirate_003a

What is unusual is that the tones are off by 60 Hz. Whilst 1 should be at 840 Hz, here it is at approximately 900 Hz, and 6 is at 1075 Hz rather than 1015 Hz. Whether this is because the Pirate was transmitting in AM rather than USB I’m not sure. Maybe it is something to do with his original recordings. My recording is below

It is likely the long tone sent after the selcall here is the usual long tone that is sent before the standard ones. This is sent at 1090 Hz.

Pirate_004Pirate_004a

Looking at it using Signals Analyzer (SA) you can see that it is definitely X06. With SA you can measure more accurately the frequency and length of each tone.

X06_005

Here you can see the two tones (actually 6). The total time for the selcall is 2.040 seconds with 1 marked at 896 Hz and 6 at 1074 Hz

X06_006

Measuring the length of an individual tone (though actually 3 joined together) gives a length just over 1 second or 3 tones at 333 ms each

X06_007

Finally, measuring the space between each call gives us 1.312 seconds which is the correct spacing for X06

The sub-variant of X06b is designated due to its format of six tones sounding like two. It is thought this is a test transmission.

Finally, just to confirm my theory, I ran a looped sound file through go2Monitor with the result confirming the selcall as 111666

X06_004

Advertisements

Monitoring the Russian Navy Northern Fleet in CW

I have realised that I haven’t posted an article that I wrote for The Spectrum Monitor, published in October 2016, on monitoring the Russian navy Northern Fleet. Here it is its entirety, with a few extras. A French translation of the article is available at the bottom of the page.october20161

A brief history of the Northern Fleet

The Russian Northern Fleet has to be my favourite one of all the fleets for monitoring in CW mode. I suspect the main reason goes back to my childhood days, during the heat of the Cold War, when we were constantly warned about Russian submarines leaving the frozen north to wipe out the Western world with a nuclear strike from the deep. The Cold War days are long gone now, but the Northern Fleet (NF) continues to exist, be it in a much reduced way. However, things are afoot, and it seems as if the Russians may well be starting to build up their forces again in the frozen North.

In the 1950’s, when the first ballistic missile submarines were brought into service, the Northern fleet went from being the least funded of the fleets to the most funded. The direct access to the Barents Sea and North Atlantic meant that bases in the Kola Peninsula could let out SSBN’s almost undetected – something the submarine bases at that time in the Baltic would not, and still cannot, manage.

The Northern Fleet covers not only the Northern Coast of Russia, but also the White Sea, Barents Sea, Kara Sea and the Arctic. The main base is at Severomorsk with an additional base at Severodvinsk covering the White Sea. As well as these there are numerous outposts and smaller bases used by all vessels of the NF, including Submarines.

Severomorsk became the fleet’s headquarters at the end of 1956, taking over from Polyarny in the Kola Bay, but expansion throughout the whole area was rapid, effectively making the entire region one large base with many of the areas being “closed” towns. The bastion strategy was created to protect the ballistic missile fleet, most of which operated in the Arctic region, close to home, it was only the older class of missile boats that ran the risk of passing through the GIUK gap for the Eastern shores of the USA. With modern SSBN’s being created at a fast rate, these boats were built with the ability to launch their weapons whilst still in harbour – they actually didn’t need to go anywhere to bring about their death and destruction. The large destroyers and cruisers were created to protect the region, whilst the aircraft carriers, or aircraft carrying cruisers as they are known, were also constructed to defend the bastion areas from western submarine activity. Unlike US Carrier groups, the Kutzetsov-class aircraft carriers operated as a regional defender rather than a strike group leader, and because of this they only carried interceptor aircraft. It is only now that the single carrier remaining is being given an aircraft strike capability, though this hasn’t been entirely successful in the recent operations in the Mediterranean.

Webcams are a great source of information and can help in identifying either callsigns of ships or at least a potential build up in traffic. Here, Sierra II-class SSN “Pskov” departs Severodvinsk for trials of what is believed to be a sonar system. The required permanent attachments (only recently added) can just be made out on the bow of the boat

The bastions that were created weren’t totally impenetrable, We now have post-Cold War stories emerging of various missions by British and United States submarines that managed to infiltrate the protected waters. Collisions in 1992 and 1993 of Russian and United States submarines in the Kola bay highlight this very fact, though by this time the fall of the Soviet Union had already taken place, and the NF was in a big decline capability wise.

Just over an hour later after the departure of “Pskov”, Zvezdochka-class support ship “Zvezdochka” heads into the White Sea and was captured on the webcam. This ship uses the callsign RMNN on the CW networks.

Funding seemed endless for the Russian forces during the Cold War years, but with the end of the USSR, came the end of the funding. The NF no doubt felt the blow the most as the majority of the fleet were intended to act as a deterrent to the forces of the west and no longer were there these threats. Submarines and ships lay rotting in harbour, the carriers were decommissioned and the many outlying bases were abandoned. Nowhere else, from satellite imagery, shows more the effects of the fall of the Soviet Union navy than the ruins of remote outposts, small naval bases, SAM sites and wrecks of the NF that are scattered along the whole of the coast of Northern Russia. If you have quite a few hours to kill, going to Google Earth/Google maps and scouring the coastline will bring you to places where you can only imagine what it was like to live there, though many are still lightly populated. Google Earth’s linking to the photo website Panoramio brings you even closer to these locations with places such as Goryachiye Ruchyi and its images of a Primorye-class Intelligence ship wrecked on the shore (69°10’31.87″N 33°28’29.90″E) or the near abandoned submarine servicing base at Gremikha (Ostrovnoy), a “Closed city” complex on the shore of the Barents Sea (68° 3’54.14″N 39°27’30.64″E).

In its current form, the NF is still the largest in the Russian navy, consisting of approximately 80 warships, half of which are submarines. There is around this number again in service ships, tugs, Icebreakers etc. However, despite being the largest fleet, it isn’t the most modern! Most of the ships in the fleet are approaching the end of their career, having been upgraded on numerous occasions. The actual readiness of most of the ships is unknown but utilising the historical imagery facility in Google Earth shows that many of the ships have not moved for months, even years. They move from pier to pier, but this will be to make a landing area available for a serviceable ship and the move will unlikely to have been under the ships own steam. A good example is Kirov-class Battle Cruiser Pytor Velikiy which is either alongside or moored in the Severomorsk bay when analysing images from the last year or so. This ship is almost definitely waiting on its sister ship Admiral Nakhimov completing a substantial modernisation programme at Severodvinsk before having the same work carried out. Using Google Earth you can follow Admiral Nakhimov’s refit with the historical function at position 64°34’34.16″N 39°48’53.78″E, though it is very noticeable that the ship has been in Severodvinsk since 2003!

With satellite imagery available to the public getting better all the time, the use of Google Earth can help identify ships that are active by using the historical imagery function and noting any movement. Here, with just a small amount of work, I’ve been able to identify the ships in port at Severomorsk, including naming two if the ships. Taking notes of what is where on which dates helps with the analysis.

The main Severomorsk region is made up of seven bases, shipyards and nuclear waste facilities, including the submarine bases at Polyarny and Gadzhiyevo. Further to the North, and the frozen (and unfrozen now) Arctic are more bases, shipyards and nuclear facilities. Following the coast round to the White Sea, there are the base and shipyards of Severodvinsk and many other smaller ports and bases. It is this region of the NF that has generated many of the unknown CW callsigns that we have for the fleet.

The White Sea in itself can be classed as a big military testing area. Not only are trials carried out for new ships that have been built at Severodvinsk, it is also used for testing of ships out of maintenance, testing of new equipment such as sonar; and it is used heavily in weapons trials, including cruise missile testing. There is what is believed to be a weapons range at the entrance to the White Sea from the Barents, on the Eastern shore at Chizha (67° 4’12.71″N 44°18’17.18″E – the area surrounded by hundreds of craters, some of which are actually natural from meteorites) and to the West of Severodvinsk is the missile testing launch facility of Nyonoksa (64°38’44.78″N 39°13’21.78″E). Here they oversee the testing of cruise missiles, but from land based launchers.

The bigger missile tests, those from SSBN submarines, generally take place in the Barents Sea, with launch ranges set up when required in the areas between Murmansk and the White Sea. Most of these will point to the NE where the missiles will head for the Kura missile range.

Severomorsk also has webcams. Here the two images show how you can roughly log arrivals and departures of certain ships. In this image various ships can be seen including a Borey-class SSBN highlighted by the arrow. This is likely to be "Vladimir Monomakh" which left Severomorsk for its new base at Vilyuchinsk in the Pacific on the 15th of August. In the image below, captured just two hours later, the only Russian Aircraft Carrier, Kuznetsov-class “Admiral Kuznetsov” has arrived in port. This was undergoing pre-deployment maintenance and trials before she headed to the Mediterranean. You’ll also notice that the Borey has drifted around making it harder to identify from this angle.

Severomorsk also has webcams. Here the two images show how you can roughly log arrivals and departures of certain ships. In this image various ships can be seen including a Borey-class SSBN highlighted by the arrow. This is likely to be “Vladimir Monomakh” which left Severomorsk for its new base at Vilyuchinsk in the Pacific on the 15th of August. In the image below, captured just two hours later, the only Russian Aircraft Carrier, Kuznetsov-class “Admiral Kuznetsov” has arrived in port. This was undergoing pre-deployment maintenance and trials before she headed to Mediterranean. You’ll also notice that the Borey has drifted around making it harder to identify from this angle.

 

Monitoring the Northern Fleet

Whilst operating within the NF area of operations (AOP), instead of using the standard frequencies of 8345kHz and 12464kHz, the ships use a pool of frequencies in a regional network system. There are a large number of frequencies in this pool, seemingly all within a seasonal schedule system as used by other Russian forces networks. The interesting thing is that even though they do stick to the set frequencies available to use within a set period of dates, the selection of which frequency to use would appear to be random, though I doubt for a moment that it is.

Frequencies that have been used by the Northern Fleet in CW mode, downloadable in PDF format.

As there are so many frequencies available to the NF, the radio operators would need to monitor all of them for any calls that are made – this would be huge task. The theory is that within each season grouping there is an additional frequency network schedule that is either transmitted in a coded format, or it is in a document, which then tells both ends which frequencies to use on specific dates. In general, all the ships on the same day will use the same frequency so whatever system they use, it definitely works.

Sent out by Severomorsk (RIT) to callsign RLO, a collective callsign for all ships operating in the NF, “RADIOPROGNOZ” messages seem to be one of the main methods used by the NF to assist with this, an example of which is below.

RLO DE RIT QTC 110 34 1 0057 110 =
RADIO PROGNOZ
01024 03003 30000
00001 00006 30009
00002 00006 30010
00005 00006 40010
00006 00006 40012
00102 00006 30009
00001 00612 40009
00002 00612 40010
00005 00612 50012
00006 00612 50013
00102 00612 40010 =

In Cyrillic, RADIOPROGNOZ is actually радиопрогноз, and translated into English this means Radio Forecast, literally it is Radio Prognosis. Luckily, there’s plenty of documentation available that confirms that радиопрогноз refers to propagation, including the Great Soviet (and Russian) Encyclopaedia which states: Pадиопрогноз – forecast radio conditions on shortwave (as translated).

In the above RadioPrognoz example, if you ignore the first line of the message for now, it is clear that the first column is numbered regions and the second column is times (ignore first zero, it is a spacer, so 00006 = midnight to 6am). As far as I can find online there has only been a few messages logged by an amateur that refers to the afternoon (has column two with groups of 01218 and 01824), the majority have been morning ones only, but this is probably down to monitoring habits more than anything. Column three then refers to the MUF, Frequency range or frequency channel number in some way or other, and my thoughts are that the first number is possibly the lower frequency available, the other figure is the higher one, with spacer zeros in-between.

So, this would be helpful in determining what frequency or frequencies to monitor you’d think? Well, unfortunately not. Most of the frequencies used by the NF are in the 4MHz range which as you can see is pretty much covered by the propagation prediction. I can honestly say that it is still a bit of guesswork at the moment.

Going back to the first three groups, the first one refers to the date the forecast covers, in the case of the example it is 01024 = 01 (day) 02 (month of year) 4 (year without the first digit) or 1st Feb 2014. Not sure on the other two groups, but possibly average previous MUF numbers, solar activity etc. The zeros could well just be spacers like the rest of the message.

One final note on this is that as far as I’m aware, no other fleet uses RadioPrognoz messages.

Severomorsk, NE of Murmansk, is really one large military base made up of numerous small ones. The main base is at Severomorsk (which in itself also has two airfields), with Kola Bay being used for the Submarine fleets and small patrol boats used to defend the whole area. Polyarny is where you’ll find the Patrol Submarines and ships, with Gadzhiyevo being the home of the larger Submarines, including the SSBN’s.

All other messages found within the NF networks are those found elsewhere, including of course the FM-13 weather reports. Unfortunately, these are not as useful as they are when ships are operating outside of their AOR. As a lot of the ships tend to stick within the NF region there is little way of tying up the callsigns to the ships. Some of the ones we have been able to tie-up are the long range Hydrographic ships which leave the area frequently. Quite often their missions are given news space on official Russian navy webpages and newspapers, and with some investigation work most have been worked out. Some of the other larger ships have also been tied up including Udaloy-class Destroyer Vice Admiral Kulakov (CW callsign RGR35), with the others generally being tankers and support ships.

In one of my first TSM articles (Monitoring the Russian Navy – Part One) I mentioned callsign RMMA and how we worked out that this was Vishnya-class Intelligence ship Viktor Leonov of the NF, so if you are able to find that article then you can see how hard and how long it takes to sometimes work out which callsign belongs to which ship. Sometimes callsigns do fall into your lap though, such as NF Survey/Research Ship Yantar that has a callsign RMM91. This ship actually uses its CW callsign as its AIS identification callsign and can be fully tracked using any online AIS monitoring website. At the time of writing (18th Sept at 1330z) the ship is about 180nm east of Malta, heading east, and its destination is eventually Novorossiysk. Yauza, a cargo ship, was also tied up using AIS plots when an unknown callsign on CW was moored off the SE of England to wait to transit the English Channel. I took a quick look in the area using MarineTraffic and found the ship immediately. Just good luck really.

Not many ships in the Russian navy use AIS, but you will find that some of their smaller tugs are starting to have the systems installed. These ships are not CW fitted I doubt due to their operations, but they can be an indication of possible activity of larger when you see them moving. Tie these movements up to some areas that have webcams and you can get some interesting results.

I personally split my NF callsigns up into two regions. One that operates in all areas of the NF AOP, and another that operates in the majority within the White Sea. It’s not 100% accurate as the ships do move around, but there are some obvious ones that only ever stay in the White Sea. They are very active in this area, especially when it is the summer/autumn periods (when the White Sea isn’t frozen over) and especially when there are exercises and trials taking place. Ships seem to station themselves close to the same locations quite often and my guess is that they are guard ships closing off the whole of the area when tests are taking place. Because they rarely leave the White Sea, of all the callsigns that have been heard only one has been tied up – RMNN which is rescue tug Zvezdochka.

This image shows the areas in the White Sea that many FM-13 messages refer to, especially during weapons trials.

It is because of this rarity of leaving the White Sea that I find the NF fleet frequencies the most interesting. And, as I’ve said earlier, they can be extremely busy. One of the busiest weeks was down to the testing of a Bulava missile that was launched from a new Borey-class SSBN in 2013. Unlike most tests for SSBN launches which take place from the Barents Sea, this was from the White Sea because it was just a test of the submarines launcher system and not the actual missile. Because of this test there were around ten ships operating in the area for support and security, with around 30 FM-13 messages and others sent in a day.

Although it is fairly unlikely we will ever tie-up most of these NF callsigns, it is the challenge of analysis and intelligence gathering on what they could be that is the most fun part.

The main transmitter site for Severomorsk is the West of the city, NW of the main airfield on a hill overlooking the bay. Here is almost definitely the HF site (CW callsign RIT) and probably a VLF site. There are also numerous other transmitter and radar sites dotted around the whole area.

French translation of the article provided by Andre

Monitoring the Russian Navy – Part One

As I normally do, a few months after publication in The Spectrum Monitor, here’s one of my articles that was published in the February edition.

Monitoring the Russian Navy – Part One

Amur Class Floating Workshop PM-138 (ПМ-138) passes through the Bosporus. This uses the callsign RBIZ (РБИЗ) on the CW networks. PM-138 is part of the Black Sea Fleet and normally carries out a six month rotation off Tartus, Syria, with the Amur Class PM-56 (ПМ-56), callsign RIR98 (РИР98) - Photo by

Amur Class Floating Workshop PM-138 (ПМ-138) passes through the Bosporus. This uses the callsign RBIZ (РБИЗ) on the CW networks. PM-138 is part of the Black Sea Fleet and normally carries out a six month rotation off Tartus, Syria, with the Amur Class PM-56 (ПМ-56), callsign RIR98 (РИР98) – Photo by Yörük Işık

As I said in one of my first articles for TSM, I only really got back into HF monitoring because of my move to Scotland and treating myself to a desktop radio for listening to VHF/UHF. I decided to push the boat out and get an Icom IC-R8500 as I’d always fancied one and the specifications, as we all know, are top notch. I also thought that as I was going to be working in the same room as Shanwick Oceanic that I would get something that would let me listen to them, I used to love listening to Shanwick. Of course, I soon discovered a lot had changed on the Ocean and the HF got put aside for a while.

It was whilst reading through a Military aviation forum that I noticed that a couple of guys had been monitoring the Russian navy using CW, and that what they had been tracking was possibly the Kiev Class Aircraft Carrier Admiral Kuznetsov and its carrier group. Well, I found this fascinating and started listening to the same frequencies they had listed to see if my makeshift antenna could get anything – and sure enough it did.

Since I was a kid I’d been interested in Russian military hardware, after I’d been given a book called “The Soviet War Machine” to read when visiting my grandparents. Even though it was library book, I took it away on a long-term loan and read it hundreds of times, sucking in as much knowledge as possible. There was something about the design and ruggedness of all their equipment that intrigued me, and man, their Submarines were awesome!!

When I joined the RAF years later, my interest in the Russians changed from the navy to the Air Force and Nuclear threat that I was now (in theory) facing. And from then, up until the moment I found out about monitoring the Russian navy on CW, I didn’t really think much about the navy again. Now I was really interested and I wanted to learn more about this side of monitoring.

Through the UDXF Yahoo group I found lots more logs and frequencies; and then I discovered Fritz Nusser’s great website at http://www.astrosol.ch/. Fritz unfortunately died in July 2014 and so did his website (the domain name now used by Asics trainers!!), but the information held there was nothing but brilliant – frequencies, callsigns, examples of messages, the navy bases and the ships in the different fleets. It was the perfect site for a beginner, which I most certainly was.

Well, now a few years down the line I hope I’m pretty good at what I know, though I can honestly say there are guys out there whose knowledge still amazes me – Trond Jacobsen from Norway for starters. What I’d like to do here though is show you how you can listen in on the Russian navy on CW, and amazingly, be able to track their positions.

The Basics

First of all, I need to show you how the navy is divided up. It is split up into five fleets:
The Northern Fleet (NF) – HQ at Severomorsk
The Baltic Fleet (BF) – HQ at Kaliningrad
The Black Sea Fleet (BSF) – HQ at Sevastopol
The Caspian Flotilla (CF) – HQ at Astrakhan
The Pacific Fleet (PF) – HQ at Vladivostok

The Northern Fleet has recently been incorporated into a new Arctic Joint Strategic Command structure but still operates under its own command system, and it is by far the largest fleet in the navy. Within these fleets there are a large number of submarines and ships, around 265 in total with another 60 or 70 on order, divided between numerous bases within the fleets.

A close up of the antennas on Ropucha Class Amphibious Landing Ship “Novocherkassk” (Ножосхеркасск), callsign RFH71 (РФН71) – Photo by Yörük Işık

Each HQ has a CW callsign, as does each base and then each major ship. We haven’t found any evidence that smaller vessels, and by this I mean harbour tugs etc., have a CW callsign, and the same goes for Submarines. The tugs will be because they rarely leave the harbour area so would be within normal VHF/UHF range of the base; the submarines have other methods of contacting home though there’s no doubt they use VLF/HF for communications, just like the USN boats with EAM’s. I will say though that we also have a huge amount of unidentified callsigns and that these could in fact be tugs, submarines and such like. The likelihood is though, that most of these are smaller missile boats etc. that also rarely leave the confines of the waters they patrol – and also could be Border Guard ships that also use the same radio networks (they also don’t leave their home waters). There’s also the AGI’s or Intelligence Collection ships that use CW but don’t give away their positions, well most of the time anyway – more on this later. As well as the five fleets, there’s also of course Moscow to think of, and the actual Russian navy high command at St. Petersburg. These too make and receive calls and each has their own callsign.

My Russian Navy Callsigns page here on my blog lists all the CW callsigns that have been found, and if tied up, to which ship/base they belong to. It’s not complete, and there are still some changes that need to be made to it as some of the callsigns aren’t necessarily navy – more investigation and time is required on this front.

I will list the HQ callsigns here though:
Moscow = RIW
National Defence Control Centre, St. Petersburg = RAA
Severomorsk = RIT
Kaliningrad = RMP
Sevastopol = RCV
Astrakhan = RJD52
Vladivostok = RJS

To confuse matters though, St. Petersburg for instance, has a base callsign too – RJC66. This is the actual naval station as opposed to the HQ. And there’s also another callsign associated with Moscow, RJE56, which is the actual transmitter site which sends/receives calls – possibly when RIW (and RAA) are off-line – and these also tend to be between land units only, not to/from ships. RAA also only tends to send/receive to/from HQ’s with messages then forwarded on to ships (and vice versa). It’s not uncommon for bases to have multiple callsigns.

You’ll notice that all the callsigns start with an R which is common for the navy, the ships also beginning with the letter R. But there’s also some other elements within the Russian networks that start with this letter, and it’s because of this that confusion arises as to exactly what is navy and what isn’t – the naval (air) network also uses R as the first letter for instance. Each callsign is either three, four or five digits but there is no correlation between the callsigns and the base or ship name; and the ships don’t have a callsign that links into the base they’re stationed at – ships based at Sevastopol don’t start with RCV for instance. They are totally random.

So, that’s the basic callsigns completed – or is it?

You see, what we’ve done here, and what’s happened for many a long time, is that the CW has been “westernised”, turned into Latin Morse. But the Russians don’t use Latin Morse, they use Cyrillic Morse. Now, this doesn’t really matter that much as I’m “western” so I can use this system for callsigns, but it does throw up some problems when it comes to messages – again, something I’ll get onto later in another article.

If you don’t know Cyrillic CW, and I don’t, I still need to look it up each time (I still don’t know Latin CW 100% and have to check with a list most of the time) there’s a Wikipedia page with it on that I use. But effectively to make the callsigns “proper” they should be given their Russian ones – RIW is actually РИВ, RAA is РАА and RCV is РЦЖ as examples.

But, and here’s the interesting thing, the Russians use CW Q and Z codes! And to be honest I’m not sure whether they translate the Q code into Cyrillic or if they use the codes as normal – QSL for instance. Either way, they use these codes and they have also created some of their own.

For now though we’ll use Latin CW for all the associated callsigns and messages

Ropucha Class Amphibious Landing Ship “Yamal” (Ямал), callsign RHV42 (РХЖ42), highlights the problems with using Latin Russian versus Cyrillic Russian. A direct translation of the ships name would be Ämal if it was used as the CW callsign. Knowledge of Russian alphabets certainly helps with monitoring the Russians – photo by Photo by Yörük Işık

How to track the ships

I’ll list some of the frequencies required later on, but the best place to start is to monitor 12464 kHz during the day from 0600z to 1800z; and 8345 kHz overnight from 1800z to 0600z. This isn’t always the case as propagation has its way sometimes and the ships will try the other frequency, but these are the primary ship frequencies to start with and their associated times of use. The Russians work in the majority using a duplex system with the HQ’s using their own frequencies to transmit on. Whilst all of the HQ’s will have an operator listening out on the primary ship frequencies, the ships will be listening to their HQ frequency (frequencies) only. The only other frequency the ships will be listening to is that that has been allocated to RIW for that day in case Moscow wants to get in contact with them, or for flash messages. Some of the ships ignore their home base and send direct to Moscow, and then sometimes if a ships HQ doesn’t answer them they’ll try another to relay on the message for them. I want to cover message types and methods in greater detail in another article so for this one I’m going to concentrate on the message type that allows us to pinpoint the location of the ships.

So how do we do it? It’s actually quite easy, and the Russians use another western method to give us this information. For some reason they use the same code used by NOAA for Marine Surface Weather Observations, the FM-13-X-SHIP. Whether these reports are sent on to NOAA or not, we don’t know, but I doubt it. The Russians have their own Hydrographic units as you’ll see in a moment or by looking at my callsign list and we can only presume that they use this code as it’s already there and they don’t have to think up their own method.

If you’re not familiar with the FM-13 code then here’s a link that will take you to the 150 page PDF file on their website. Below though is an example message sent by RKB91 (РКБ91) – Altay Class Tanker “Kola”:

RKB91 605 16 22 1000 605 = SML FOR RJH45 RJD38 =
22061 99572 10081 41598 43408 10004 40110 51024 70202 8////
22252 00140 22012 = + RKB91

What we have here is a combination of both the Russian navy signal method (line 1) followed by the FM-13 code, ending with the Russian message system again. To decode the first line:
RKB91 = callsign
605 = message number
16 = number of groups in message
22 = date
1000 = Moscow time (this was sent at 0600z, but there’s now a three hour time difference between Moscow and UTC)
605 = repeat of message number
SML = Message priority, in this case SML stands for Samolet (fighter jet) – normal priority
FOR = for
RJH45 RJD38 = Hydrographic station callsigns

The next two lines are the FM-13 message giving the weather at the site of the observation. The link to the codebook will give you further information, but the parts we are most interested in are the first three groups:
22061 = 22 (date), 06 (0600z) 1 (1st FM-13 message of the hour)
99572 = 99 (latitude), 572 (57.2N)
10081 = 10 (Longitude – East), 081 (08.1)
The final group we’re interested in is:
22252 = 222 (heading speed), 5 (heading SW), 2 (6 to10kts)

The last number group and the callsign repeat is part of the Russian message system again – 22012 confirming that there’s 12 groups of numbers in the message and the date, in this case the 22nd.

From this then the message translates to an observation position of – 57.2N 08.1E heading SW @ 6-10kts, just off the North Western coast of Denmark. The position can be viewed here on Bing maps

The Bosporus is a busy channel. Here USN Arleigh Burke Class Destroyer USS Ross heads west, whilst Novocherkassk heads east towards the Black Sea - Photo by Yörük Işık

The Bosporus is a busy channel. Here USN Arleigh Burke Class Destroyer USS Ross heads west, whilst Novocherkassk heads east towards the Black Sea – Photo by Yörük Işık

Most of the messages we receive are of course from the Eastern Longitude and Northern Hemisphere, but we do get the odd one from the Western Longitude, in which case in the example above it would have read 70081. I am yet to receive anything from the Southern Hemisphere but if I were to then the first number would be either a 5 (for Western Latitude, Southern Hemisphere) or a 3 (for Eastern Latitude in the south).

Prior to the FM-13 message RKB91 would have called Kaliningrad to establish the connection, and these go like this:
VVV RMP RMP RMP DE RKB91 RKB91 QSA? QTC

So as you can see, they do use Q codes.

With regards to the Hydrographic stations, we don’t know exactly where they are, but we have rough idea. We’re pretty certain that RJH45 is the main one in Moscow. The second callsign in the example above is probably a regional Hydrographic station for the Baltic region, or a collective for all ships of the Baltic Fleet.

Finally, the messages are normally sent every six hours – 0600z, 1200z, 1800z and 0000z. There are certain times where ships send every three hours. As you can imagine, when it’s busy the frequencies can get a bit chaotic as the calls tend to step all over one another.

I said I didn’t know CW that well, and I don’t really. But you do get use to the patterns of the callsigns, in particular the HQ’s. And you also get used to the radio operators and their speed/way of sending the messages. On one occasion we were able to work out the shift pattern of one ship by the changes in the operator methods.

One other quirk to the Russian CW is the short zero. To save time, instead of five dah’s, they will only send one (T), though this is normally in context and is noticeable whether it should be a zero or a T. Not every operator will do this and they’ll send the zero correctly.

Callsign Tie-Ups

So, we have the callsigns for the bases tied up (well some of them) but how do we get the ships? This is down to a couple of methods, the first being the Russian navy themselves. The Russian navy has a very active website and they regularly post movements of their ships and where they’ve docked. You only need to keep an eye on these reports and tie-up arrival/departure dates with any unidentified callsigns to get a pretty good match up.

The second method is down to online photos, blogs and media such as twitter. There’s numerous different websites that promote photos of ships, sites like Marinetraffic.com, shipspotting.com and shipais.com. These all have dates when the photos were taken. A great blog for getting the Black Sea fleet has to be Bosporus Naval News which not only shows photos taken by locals (including some of those in this article by Yörük Işık) but also lists dates when Naval vessels, not just Russian, pass through the Bosporus.

With all these different methods you can find out what callsign belongs to which ship. It’s not easy, and it can take some time, especially if the ships don’t send many FM-13 reports. Of course, we’re not always right at first. In some cases the ships are in a flotilla, and only one ship out of the group will send a report. In this case you haven’t a clue which one you’re listening to, unless you’ve already tied one from the flotilla up previously. Recently we caught a new callsign, RJC20, going through the Bosporus so we waited for some pictures to emerge only to discover that two ships had gone through together, with only one sending reports. For a short while we thought it had to be Sorum Class Sea-going Tug “MB-31” as this was seemingly the escort ship to Dergach Class Missile Patrol Boat “Samum”; it’s normally the case that in a group the tug or tanker escort would do the FM-13 reports. Further into the reports, going on for a month or so, it still looked like the RJC20 belonged to MB-31 until new information came to light that Samum was taking part in the anniversary of the Battle of Navarino memorial flotilla off Pilos in Greece, the exact location of RJC20. It only took another week or so for RJC20 to return to the Black Sea and Samum was captured on “film” again whilst reports were given that MB-31 was escorting another ship off Malta. So this confirmed that RJC20 was Samum – or did it? On the 28th of March RJC20 plotted through the Bosporus again, and this time only MB-31 went westbound. Eventually then, this tied up RJC20. So you see it’s all about patience and almost a bit of Intelligence investigative skills that make this hobby work – its good fun.

2013 was the 70th Anniversary of the Battle of the Atlantic and an event was held at Liverpool docks. One of the ships that participated was Udaloy Class Destroyer, Vitse Admiral Kulakov. I was unable to attend but one of the Russian CW monitors, Roger Hutchinson, did manage it and was able to take the tour around the ship. I’m not jealous at all. Here’s one of the many photos he took showing the huge amount of antennas on board this destroyer, which uses the callsign RGR35 (PГР35). As well as all the antennas you can see the 30mm AK-630 6 barrelled gun used for air-defence (of which there are four on board) and its associated “Bass Tilt” Fire Control radar on the structure to its right. There’s seven other radars shown here with another 8 or 9 out of shot – photo Roger Hutchinson

2013 was the 70th Anniversary of the Battle of the Atlantic and an event was held at Liverpool docks. One of the ships that participated was Udaloy Class Destroyer, Vitse Admiral Kulakov. I was unable to attend but one of the Russian CW monitors, Roger Hutchinson, did manage it and was able to take the tour around the ship. I’m not jealous at all. Here’s one of the many photos he took showing the huge amount of antennas on board this destroyer, which uses the callsign RGR35 (PГР35). As well as all the antennas you can see the 30mm AK-630 6 barrelled gun used for air-defence (of which there are four on board) and its associated “Bass Tilt” Fire Control radar on the structure to its right. There’s seven other radars shown here with another 8 or 9 out of shot – photo Roger Hutchinson

Earlier I mentioned the AGI ships. These don’t send FM-13 reports at all, and generally only contact Moscow (RIW) with other message types. This then makes it practically impossible to tie up the callsigns – unless the Russian navy happen to help you out. Callsign RMMA has foxed us for well over two years at least, appearing every now and again, and in fact being one of the very first callsigns that I logged. It always has very strong signals to the UK initially which meant it was in the vicinity of the Northern or Baltic fleet home bases, the North Sea or Eastern Atlantic. It would fade eventually as the distance from here increased, but with the usual propagation affects that sometimes brought it booming in.

In September 2012, a Russian navy ship had been spotted off Cape Canaveral where there were two scheduled launches for the beginning of October. There was also a planned launch of a Trident II D5 from a Royal Navy submarine later on in October. At that time there was an unidentified callsign, RJQ84, operating in that area so at first we thought this would be an AGI of some sort, though sending FM-13 messages was unusual. Then RMMA and RJQ84 sent messages to each other, saying to use VHF radios to communicate. This meant they were close to one another and so we thought maybe RJQ84 was an escort ship to the AGI, RMMA. At the end of September RJQ84 headed for Jacksonville, I seem to remember because of a hurricane hitting the area, and reports followed that a Rescue tug had arrived in port, this turning out to be Sliva Class “Vikr”. A few days later other reports announced that Vishnya Class AGI “Viktor Leonov” had suddenly arrived in Havana. And RMMA had disappeared from sending messages. Was RMMA Viktor Leonov? We never got any solid proof and so I left it pencilled in on my list.

RMMA has cropped up since then but with no news of Viktor Leonov there was nothing to go on. So why is this relevant now you say? Well, RMMA turned up about a month ago (December 2014 at time of writing the article), very strong then fading, again no FM-13 reports. On the 22nd of January Tom spotted a news report that Viktor Leonov had again docked at Havana on the 20th, the day that RMMA went off station. This coincidence was too much and RMMA is now logged as Viktor Leonov.

Frequencies

This is a hard one really. Those of us that monitor the Russian navy have discovered hundreds of frequencies that they use; a file on UDXF lists 578 currently in use. To get you started though here’s a few of the more active frequencies:
8345 Ship night primary (duplex)
12464 Ship day primary (duplex)
11000 Moscow (duplex) c/s RIW
14556 Moscow (duplex) c/s RIW
11155 Severomorsk (duplex) c/s RIT
8120 Navy HQ St. Petersburg (simplex) c/s RAA
4079 Kaliningrad (duplex) c/s RMP
8348 Pacific Fleet ship primary (duplex)
5411 Vladivostok (duplex) c/s RJS
3395.5 Sevastopol (simplex) c/s RCV
19201 Sevastopol (weather/nav warnings) c/s RCV
4635 White Sea area ships calling Severodvinsk (duplex)
4376.5 White Sea area ships calling Severodvinsk (duplex)

WinRadio Excalibur memory list for the Russian Navy CW network, whilst monitoring one of the Severodvinsk frequencies, RJD99 (РЙД99). Note also the repeated transmission on 4625, the famous Russian enigma net “The Buzzer”

WinRadio Excalibur memory list for the Russian Navy CW network, whilst monitoring one of the Severodvinsk frequencies, RJD99 (РЙД99). Note also the repeated transmission on 4625, the famous Russian enigma net “The Buzzer”

The White Sea frequencies are always interesting ones to monitor. On quite a few occasions we’ve caught a build of ships before an exercise or launches of nuclear/cruise missile tests from submarines. Most here remain unidentified as they haven’t left the White Sea, or certainly haven’t gone far from it.

I would say, for the West coast of America the best bet is to listen in on the Pacific/Vladivostok frequencies, but this doesn’t mean the others are out of range. We have recently followed Akademik Krylov Class Survey/Research Ship “Admiral Vladimirskiy” (RHO62) on a round the world tour where here in the UK we were able to pick it up on the Pacific primary of 8348 kHz, as well as getting it on 8345 kHz. In fact it used 8345 more than anything in the later stages of being in the Pacific where we able to catch it on the west coast of Costa Rica and going through the Panama Canal. RHO62 is due to go out on another voyage at the end of this year, this time to the Antarctic.

One last tip – always record the frequency, unless you’re super good at CW; and even then, always record the frequency. Sometimes I wonder whether the radio operators are trying to beat the world record for the fastest message sent by Morse code.

Well, I hope you may have found this interesting. Monitoring the Russian navy can be challenging and it has the added element of lots of investigation and research to make it work fully, but that is the fun part. Through this new “hobby” I renewed my interest in Russian military hardware, deciding to buy a Jane’s Fighting Ships a few years ago so that I knew exactly what the ships looked like that I was listening to. Because of this I got to know the editor of the yearbook and I now provide photos as well as carrying out research on the Russian navy for inclusion within the book.

There is still a huge amount to cover and my next article on the Russian navy will be on other message types you may hear when listening in. So until then, do svidaniya i spasibo (до свидания и спасибо)