Satellite imagery shows changes at Pankovo test site
Possible Burevestnik test
On 20 August 2022, the Russian navy posted a PRIP/Navigation warning for the area surrounding Novaya Zemlya. These warnings are always of interest as they normally highlight some sort of weapons firing or testing from the island into the Barents Sea.
The warning extended from 24 August until 9 September.
@The_Lookout_N on Twitter kindly posted the PRIP and plotted the positions. This showed most of the islands covered by the warning.
Normally a NOTAM follows these warnings should there be any kind of weapons firing and sure enough, on 27 August, a NOTAM did appear. This only covered the period up to 30 August however.
The PRIP had already got me searching for imagery for the Pankovo test site – located at 73° 6’52.60″N 53°16’28.38″E – and one of the areas I check fairly regularly for new imagery on Google Earth (not much luck there to be honest!).
Novaya Zemlya has been used for several tests in the past. Most notably, during Soviet times, for nuclear weapons testing – including the RDS-202, the most powerful thermonuclear weapon ever tested.
Pankovo is associated with the 9M730 Burevestnik (SSC-X-9 “Skyfall”) nuclear-powered cruise missile. Tests began at Pankovo in 2017, with two reported. Both are thought to have failed, though a video does exist of the November 2017 test that depicts the missile being launched and flying along the Novaya Zemlya coastline.
In August 2019, a test at the Nenoksa test facility on the White Sea resulted in an explosion that killed five Rosatom technicians. A release of radiation from this hints at the test of Burevestnik. The facility at Nenoksa has similarities to those from the 2017 tests in Pankovo.
I covered the Nenoksa site in a Janes Intelligence Review (JIR) article in October 2020.
Following the 2017 tests of Burevestnik at Pankovo, in July 2018, most of the site was dismantled, with just the old buildings used for accommodation remaining. The test area had consisted of several temporary support shelters and a retractable shelter to cover the missile. This shelter was placed on rails approximately 50 metres in length which were, themselves, placed on a concrete pad.
The dismantling of Pankovo, and the subsequent new site at Nenoksa, looked as if the tests were to continue at the White Sea site rather than at the remoter Novaya Zemlya location. The 2019 incident, however, may have made the Russians change their mind on this.
With the PRIP and NOTAM in place, I decided to download several images that covered the times in the warnings.
These currently cover 22 August 2022 to 2 September 2022.
The first NOTAM expired on 30 August, as previously stated, however new ones were published that covered 31 August to 5 September.
The imagery highlights several things.
Firstly, the test area has been changed. In 22 August imagery, the concrete launch area and rails have been removed and realigned – turning approximately 10 degrees to point further southwest. The pad also appears to have been raised. It cannot be determined whether any rails are in place.
The temporary support buildings/shelters are in place again – as is a possible retractable shelter for the missile itself. This is smaller than both the previous shelter here in 2017, and the one at Nenoksa.
Very little had changed a week later, on 28 August.
However, on 2 September 2022, a new support structure or container was located at the far end of the new concrete pad. Whether this contains a Burevestnik or other missile under test cannot be established.
With a day to go until the PRIP and NOTAM expire, it is now a case of waiting to see what transpires.
Interestingly, NATO are also about to carry out an exercise themselves – off the coast of the UK. This “SINKEX” involves several ships, though it will be run by the US Navy as the main aim of the exercise will be to test a new US targeting satellite. It is reported that several Harpoon missiles will be fired at ex Oliver Hazard Perry-class FFG USS Boone. One ship slated to fire is Royal Navy Duke (Type 23) class FFGHM HMS Westminster.
US Navy Arleigh Burke class USS Arleigh Burke paid a quick one day visit to HMNB Clyde (Faslane) on the 2nd and 3rd of September 2022 – also associated with the SINKEX.
In early November, whilst working on an article for Janes, I noticed a Link-11 SLEW signal on 4510 kHz (CF) that was slowly growing in reception strength. I’d been monitoring frequencies used by the Northern Fleet of the Russian navy around this one and had already spotted that Link-11 CLEW was being used on a nearby frequency, though this remained at a constant signal strength at my location. The fact that the Link-11 SLEW was getting stronger made me stop what I was doing and start concentrating on this instead.
Link-11 SLEW (Single-Tone Link-11 waveform) ,or STANAG 5511, is a NATO Standard for tactical data exchange used between multiple platforms, be it on Land, Sea or Air. Its main function is the exchange of radar information, and in HF this is particularly useful for platforms that are beyond line of sight of each other and therefore cannot use the UHF version of Link-11.
With propagation being the way it is, in theory radar data could be exchanged between platforms that are hundreds to thousands of miles apart, therefore providing a wider picture of operations to other mobile platforms and fixed land bases. This data can also be forwarded on using ground stations that receive the data and then re-transmit on another frequency and/or frequency band. However, the approximate range of an individual broadcast on HF is reported to be 300nm.
As well as radar information, electronic warfare (EW) and command data can also be transmitted, but despite the capability to transmit radar data, it is not used for ATC purposes. In the UK, Link-11 is used by both the RAF (in E-3 AWAC’s and Tactical Air Control Centres) and the Royal Navy. Primarily it is used for sharing of Maritime data. Maritime Patrol Aircraft (MPA’s) such as USN P-8’s and Canadian CP-140’s use Link-11 both as receivers and transmitters of data, so when the RAF start using their P-8’s operationally in 2020 expect this to be added to the UK list. Whilst it is a secure data system, certain parameters can be extracted for network analysis and it can be subjected to Electronic Countermeasures (ECM).
Link-11 data is correlated against any tracks already present on a receivers radar picture. If a track is there it is ignored, whilst any that are missing are added but with a different symbol to show it is not being tracked by their own equipment. As this shared data is normally beyond the range of a ships own radar systems, this can provide an early warning of possible offensive aircraft, missiles or ships that would not normally be available.
I started up go2MONITOR and linked it to my WinRadio G31 Excalibur. Using a centre frequency of 4510 kHz I ran an emission search and selected the Link-11 SLEW modulation that it found at this frequency.
It immediately started decoding as much as it could, and I noticed that three Address ID’s were in the network.
As the signal was strong, and it is normally maritime radar data that is being transmitted, I decided to have a quick look on AIS to see if there was anything showing nearby. Using AISLive I spotted that Norwegian navy Fridtjof Nansen class FFGHM Thor Heyerdahl was 18.5 nm SW of my location, just to the west of the island Ailsa Craig. Whilst it was using an incorrect name for AIS identification, its ITU callsign of LABH gave me the correct ID. This appeared to be the likely candidate for the strong Link-11 signal.
It wasn’t the best day and it was pretty murky out to sea with visibility being around 5nm – I certainly couldn’t see the Isle of Arran 11.5 nm away. I kept an eye on the AIS track for Thor Heyerdahl but it didn’t appear to be moving.
Whilst my own gear doesn’t allow me to carry out any Direction Finding (DF) I elected to utilise SDR.hu and KiwiSDR’s to see if I could get a good TDoA fix on a potential transmitter site – TDoA = Time Difference Of Arrival, also known as multilateration or MLAT. Whilst not 100% accurate, TDoA is surprisingly good and will sometimes get you to within a few kilometres of a transmission site with a strong signal.
One of my thoughts was that the signal was emanating from the UK Defence High Frequency Communications Service (DHFCS) site at either St. Eval in Cornwall or Inskip in Lancashire. With this in mind I picked relevant KiwiSDR’s that surrounded these two sites and my area and ran a TDoA.
As expected, the result showed the probable transmitter site as just over 58 kilometres from St. Eval, though the overall shape and “hot area” of the TDoA map also covered Inskip, running along the West coast of England, Wales and Scotland. It peaked exactly in line to where the Norwegian navy ship and I were located! With the fact that there were signals being received from three different sources it is highly likely this has averaged out to this plot.
Just after 10am the weather cleared allowing me to see a US Navy Arleigh Burke class DDGHM between myself and Arran. This added an extra ship to the equation, and also tied in with the TDoA hot spot. Things were getting even more interesting!
Thor Heyerdahl still hadn’t moved according to AISLive but the Arleigh Burke was clearly heading in to the Royal Navy base at Faslane. With my Bearcat UBC-800T scanning the maritime frequencies it wasn’t long before “Warship 101” called up for Clyde pilot information along with an estimate for Ashton Buoy of 1300z. Warship 101 tied up with Arleigh Burke USS Gridley.
As USS Gridley progressed towards Faslane, the signal started to get weaker. Ashton Buoy is where most ships inbound for Faslane meet the pilot and tugs, taking up to another 30 minutes to get from there to alongside at the base – a journey of about 8.5nm.
At 1328z the Link-11 SLEW signal ended which coincided with the time that USS Gridley approached alongside at Faslane. It would be at about this time that most of the radar systems used on the ship would have been powered down so data was no longer available for transmission, therefore the Link-11 network was not required any further and it was disconnected.
So, was this Link-11 SLEW connected to USS Gridley? And was the ship also the NCS of the network? I think the answer is yes to both, and I’ll explain a couple of things that leads me to this conclusion. But first…………….
Link-11 SLEW Technical details
Using Upper Side Band (USB) in HF, a single waveform is generated in a PSK-8 modulated, 1800 Hz tone. The symbol rate is 2400 Bd and the user data rate is 1800 bps. Link-11 SLEW is an improved version of the older Link-11 CLEW modulation and due to enhanced error detection and correction is a more robust method of sending data. This makes it more likely that transmissions are received correctly the first time. Moreover, an adaptive system is used to counter any multipath signals the receiving unit may experience due to HF propagation.
The waveform transmission consists of an acquisition preamble followed by two or more fields, each of which is followed by a reinsertion probe. The field after the preamble is a header field containing information that is used by the CDS (Combat Data System) and an encryptor. If a network Participating Unit (PU) has any data, for instance track data, this follows the reinsertion probe. Finally, an end-of-message (EOM) is sent followed by a reinsertion probe.
The header is made up of 33 data bits and 12 error detection bits (CRC – Cyclic Redundancy Check). The 45 bit sequence is encoded with a 1/2 rate error correction code therefore giving a 90 bit field. The header contains information on the transmission type used, Picket/Participating Unit (PU) address, KG-40 Message Indicator, the NCS/Picket designation and a spare field.
Broken down, each piece of information is made up as follows:
The transmission type indicates the format of the transmission – 0 for a NCS (Network Control) Interrogation Message (NCS IM); 1 for a NCS Interrogation with Message (NCS IWM) or a Picket reply.
The address contains either the address of the next Picket or that of the Picket that initiated the call.
The KG-40 Message Indicator (MI) contains a number sequence generated by a KG-40AR cryptographic device. Synchronization is achieved when the receiver acquires the correct MI. For a NCS IM this will be made up of zeros as no message or data is actually sent.
The NCS/Picketdesignation identifies whether the current transmission originates from the NCS or PU: 0 = NCS; 1 = PU
Following on from the header, the SLEW data field consists of 48 information data bits along with 12 error detection and correction bits, themselves encoded with 2/3 rate error correction. This creates a 90 bit data field.
The EOM indicates the end of the transmission and is also a 90 bit field. There are no error detection or correction bits. Depending on the unit that is transmitting, a different sequence is sent – NCS = 0’s; PU = 1’s
There is a specific order of transmissions which takes place for data to be exchanged.
Ordinarily the NCS sends data that creates the network, synchronizing things such as platform clocks etc. Each PU is called by the NCS and any data that a PU has is then sent, or the NCS sends data, or both. This is a very simple explanation of how data is exchanged but if you monitor a SLEW network you’ll see the exchanges take place rapidly. Except for the message itself which is encrypted, go2MONITOR will decode all the relevant information for you for analysis. This means that you don’t need to look at each raw data burst as sent to calculate whether it was a PU reply or NCS IWM, the decoder will do this for you.
At this point I need to say that Link-11 decoding is only available in the Mil version of go2MONITOR so doesn’t come as standard. Should you be interested in Link-11 decoding yourself then you would need to go for the full go2MONITOR package to enable this.
As previously mentioned, the data itself is encrypted but it is possible to try to calculate who is who within the network, and the analysis of the header information in particular will give you a good clue if you already know of potential PU’s that could be on the frequency.
In this case we already have four possible PU’s:
St. Eval transmitter site
Inskip transmitter site
It later transpired that Thor Heyerdahl had gone into Belfast Harbour for repairs so this practically cancelled out this ship as the NCS though it could still be a PU. Moreover, Thor Heyerdahl and USS Gridley were part of the same NATO squadron at that time which meant it was highly likely they were on the same network. This left us with three choices for the NCS, but still four for the network.
Here, I’d cancel out Inskip completely as both the NCS and a PU as the TDoA appeared to give a stronger indication to St. Eval – that left us with three in the network.
The pure fact that the strength of the major signal increased as USS Gridley got closer to my location, then slowly faded as she went further away added to my theory of her being the NCS. This was practically confirmed when the signal stopped on arrival to Faslane. Throughout the monitoring period he other signals on the frequency remained at the same strength.
Based on this, this meant that the strong signal was USS Gridley using ID Address 2_o.
Let’s take a look at one the previous screenshots, but this time with annotations explaining a number of points.
Firstly, we need to look for the NCS. The easiest way to do this is to look at the NCS/Picket Designation and find transmissions that are a zero, combined with a Message Type that indicates it is a NCS IWM. Here, there is just one transmission and that emanates from Address ID 2_o – the long one that includes a data message.
We next need to find NCS/Picket Designation transmissions that still have a zero – therefore coming from the NCS – but that have a Message Type that show it to be a NCS IM. These are calls from the NCS to any PU’s that are on the network looking to see if they have any “traffic” or messages.
Because of this there should be numerous messages of this type, and if you notice none have an ID address of 2_o. However, all of these messages are actually coming from 2_o as the ID address shown in a NCS IM is that of the PU being called rather than who it is from.
Any reply messages from PU’s will show as a NCS IWM/PU Reply transmission, but importantly the NCS/PU designation will be a one – showing it isn’t the NCS. Here there is one data reply from 71_o. You’ll notice that in the “reflection” there isn’t any transmission, unlike the ones from 2_o.
Moreover, though not shown here as the messages were off screen and not captured in the screen grab, you can see that one of the PU’s sent another reply message. As I was able to look at the complete message history I was able to see that this was also from 71_o – and 2_o either replied to this or sent further data.
There are two fainter transmissions which were not captured by go2MONITOR. These were from a PU, and must have been 30_o as there are no transmissions at all in the sequence that are from this ID address.
We now have a quandry. Who was 30_o and who was 71_o?
Data is definitely being sent by 71_o so to me this is more likely to be a ship rather than a transmitter site – but – a strong TDoA signal pointing at St. Eval makes it look like 71_o is this location instead.
Now though, we need to think outside the box a bit and realise that I’m looking at two different sources of radio reception. The TDoA receivers I selected were nowhere near my location as I’d selected KiwiSDR’s that surrounded St. Eval. This meant the signal that was weak with me could have been strong with these, therefore giving the result above.
If I base the fact that I think USS Gridley is 2_o due to strength, then I must presume the same with 71_o and call this as Thor Heyerdahl as this is the second strongest signal. I can also say that having gone through the four and a half hours of Link-11 SLEW transmissions available that 30_o never sent a single data transmission – or rather, not one that was received by me.
Here then is my conclusion:
USS Gridley = 2_o and the NCS
Thor Heyerdahl = 71_o
St. Eval transmitter site = 30_o
Of course, we’ll never really know, but I hope this shows some of the extra things you can do with go2MONITOR and that it isn’t just a decoder. It really can add further interest to your radio monitoring if you’re an amateur; and if you’re a professional with a full plethora of gear, direction finders, receiver networks etc. then you really can start getting some interesting results in SIGINT gathering with this software – and highly likely be able to pinpoint exactly who was who in this scenario.
Now, how do I get some Direction Finders set up near me….Hmmmmmm??
Sunday the 6th of October 2019 sees the start of Exercise Joint Warrior 192.
Taking part primarily to the North West of Britain, mainly off the coast of Scotland, the exercise brings together a number of navies and ground forces for two weeks of training.
Despite media headlines such as “Joint Warrior 19(2) features 17 countries, 75 aircraft, 50 naval vessels and 12,000 troops” this isn’t the JW of old. It is one of the smallest, if not the smallest, in participant numbers since the exercises started and the headlines are completely incorrect – in fact most of the headlines use stock Royal Navy media notices that cover all JW exercises.
In reality, JW 192 has 16 ships, will not really go over 30 aircraft at any one time and feature nowhere near 12,000 troops. Rumours have it that the exercise would have been cancelled had not the French elements insisted on it taking place. Unfortunately, media outlets have misinterpreted some of the RN notices as ships from other countries – such as Japan – participating, when in fact the countries have sent a number of officers to observe or be trained in the handling of exercises.
This JW has coincided with other NATO exercises – Dynamic Mariner/Flotex-19 for example -which are taking place in far sunnier climes, so the draw of the rough seas and bad weather of Western Scotland was not so great on this occasion. And with NATO forces spread out on real world tasks, the number of ships, aircraft and personnel required to cover all of these exercises is low.
The weather has already taken its toll with some of the first few days activities cancelled due to high sea states. Whilst you could argue that surely they should be able to “fight” no matter what the weather, in reality in the real world, operations do get delayed because of this. For exercises though, safety must come first. However, MPA activity is taking place with at least three flights up at the time of writing on Monday 7th October.
One saving grace for the number of ships and personnel that are taking part is the fact that Exercise Griffin Strike is shoehorned into JW192. Griffin Strike is a training exercise for the Combined Joint Expeditionary Force (CJEF) involving the UK and France and which is due to become fully implemented in 2020. Griffin Strike will contain the Amphibious part of JW192.
There are no visiting fighter aircraft from other countries, but there are the usual Maritime Patrol Aircraft (MPA) consisting of 2 x US Navy P-8’s, 2 x Canadian CP-140’s and 2 x French Navy Atlantique ATL2’s. These are operating out of Prestwick again, likely doing the usual 4 hours “on-station” missions. This means that there will likely only ever be two or three airborne at any one time with a 1 hour or so transit each end of the flight. Callsigns so far have been OCTOPUS** and SUNFISH**(FNY), DINKUM** (RCAF), GROMMET** and DRAGON** (USN).
Also out of Prestwick will be mixed Royal Navy and Royal Air Force Hawks, along with Cobham Aviation Dassault Falcon 20’s acting as enemy aircraft. For information on how the Falcon 20’s operate read my previous blog on monitoring Joint Warrior.
There will be other aircraft movements of course, with RAF Typhoons playing their part. Also expected are E3’s of both the RAF and NATO fleets, RAF Sentinel and Rivet Joint aircraft providing ISTAR support and Air to Air refuelling from RAF Voyagers and C130’s. I would also expect F-35’s from 617 Sqn at Marham to be involved in some form, though I can’t confirm this for sure. These will all be operating from their home bases.
The aviation side of the exercise is capped off with plenty of helicopters operating from both land and sea, with Chinooks operating from Lossiemouth and most ships providing one or two various types. I was able to watch one Chinook, ONSLAUGHT01, practising a deck landing on RFA Lyme Bay (using callsign 4QW) to the front of my house in the Firth of Clyde. Lyme Bay later tweeted the event.
The most disappointing aspect of the exercise is the maritime part. The ships are sparse in numbers in comparison to previous exercises, with a light participation by the Royal Navy. The RN is providing Amphibious Assault Ship HMS Albion, possibly using her Landing Craft Utility (LCU) Mk.10 class vessels operated by the Royal Marines. Albion is the current RN flagship. Also taking part is Duke (Type 23) class FFGHM HMS Sutherland and a small number of Minesweepers and Minehunters.
**Edit: RFA Lyme Bay is now also confirmed as part of the exercise. RFA Argus and RFA Tidesurge are also now confirmed.
France has also sent a Amphibious Assault Ship in the form of FS Tonnerre, a Mistral class LHDM. Tonnerre can embark 450 fully kitted troops and 60 armoured vehicles or 13 main battle tanks, along with Landing craft and up to 16 helicopters. No helicopters were observed on deck as she arrived at the Greenock area on Friday 4th October 2019 – it is not known whether they, if any, were on the hanger deck. The same goes for APC’s/MBT’s on the lower decks.
Modified Georges Leygues class FFGHM FS La-Motte-Picquet arrived into Glasgow on the afternoon of 2nd October along with Éridan (Tripartite) class minehunter FS Cephee going into Faslane earlier in the morning.
The German Navy has sent a single ship – the Berlin (Type 702) class replenishment ship FGS Berlin – whilst the US Navy, who normally send a number of frigates and cruisers, have only sent Military Sealift Command Lewis and Clark class dry cargo/ammunition ship USNS William McLean.
Finally, Danish Navy Iver Huitfeldt class FFGHM HDMS Iver Huitfeldt is also participating, but due to other tasks is heading straight to the exercise area rather than going to Faslane for the pre-exercise briefings.
For submarine participants, Norwegian Type 210 (Ula) class SSK Utsira is one of the MPA targets. She arrived earlier in the week and departed on Sunday 6th October as the exercise began.
Also, an Astute class SSN of the Royal Navy departed Faslane on friday 4th. Though not confirmed, again it is highly likely to be taking part in some form or other.
As well as areas in and around Scotland, it is highly likely there will be the usual missions around the Spadeadam Electronic Warfare Tactics range and possibly areas out over the North Sea. GPS jamming also normally takes place as part of the exercise, normally out in danger areas situated to the NW, over the sea.
There should be Maritime Gunnery firing off the west coast of Scotland. Timings and areas are normally reported via the Royal Navy’s Gunfacts service either by a recorded telephone message and on NAVTEX at 0620 and 1820 UTC. Coastguards also broadcast the details at 0710, 0810, 1910 and 2010 UTC. If you happen to be in the area where gunnery is taking place then the duty broadcast ship sends out details at 0800 and 1400 local, or 1 hour before firing, by making a call on Maritime channel 16 and then the appropriate broadcast frequency for the area.
The navy also provides SUBFACTS warnings on submarine operations on the same telephone hotline and NAVTEX.
NOTAMs will also be available that provide warnings on most of the activities taking place. A good place to look for these is on the NATS AIS NOTAM page.
The amount of frequencies used for the exercise is huge, and near impossible to list. However, there is a list of VHF/UHF and HF frequencies on my Monitoring Joint Warrior Exercises blog from 2014. Despite being 5 years old, the HF freqs tend to be the same especially those used by the MPA’s when communicating with Northwood (Callsign MKL).
Noticeable so far has been the fact that the P8’s and CP140’s have both been out on their frequencies by 1.5 to 2.0 kHz when calling MKL on 6697 kHz (primary freq) and 4620 kHz.
The VHF/UHF frequencies won’t have changed that much either, but as most of the exercise is at sea, and generally out of range of most of us, it is hard to gather them all. Certainly the standard Swanwick Mil, A2A and TAD’s will be used, so if you have these you’re bound to get something.