Link-11 SLEW with go2MONITOR

In early November, whilst working on an article for Jane’s, I noticed a Link-11 SLEW signal on 4510 kHz (CF) that was slowly growing in reception strength. I’d been monitoring frequencies used by the Northern Fleet of the Russian navy around this one and had already spotted that Link-11 CLEW was being used on a nearby frequency, though this remained at a constant signal strength at my location. The fact that the Link-11 SLEW was getting stronger made me stop what I was doing and start concentrating on this instead.

AirSpy HF+ Discovery SDR with SDRConsole operating software. Link-11 SLEW signal in Receiver 1, and the weaker Link-11 CLEW signal in Receiver 3. Whilst there a two SLEW signals showing, there is just one, with the left hand one being produced by the strong signal. You can see the weaker transmissions from a receiving station between the stronger ones on the correct frequency, but not on the “reflection”.

Link-11 SLEW (Single-Tone Link-11 waveform) ,or STANAG 5511, is a NATO Standard for tactical data exchange used between multiple platforms, be it on Land, Sea or Air. Its main function is the exchange of radar information, and in HF this is particularly useful for platforms that are beyond line of sight of each other and therefore cannot use the UHF version of Link-11.

With propagation being the way it is, in theory radar data could be exchanged between platforms that are hundreds to thousands of miles apart, therefore providing a wider picture of operations to other mobile platforms and fixed land bases. This data can also be forwarded on using ground stations that receive the data and then re-transmit on another frequency and/or frequency band. However, the approximate range of an individual broadcast on HF is reported to be 300nm.

As well as radar information, electronic warfare (EW) and command data can also be transmitted, but despite the capability to transmit radar data, it is not used for ATC purposes. In the UK, Link-11 is used by both the RAF (in E-3 AWAC’s and Tactical Air Control Centres) and the Royal Navy. Primarily it is used for sharing of Maritime data. Maritime Patrol Aircraft (MPA’s) such as USN P-8’s and Canadian CP-140’s use Link-11 both as receivers and transmitters of data, so when the RAF start using their P-8’s operationally in 2020 expect this to be added to the UK list. Whilst it is a secure data system, certain parameters can be extracted for network analysis and it can be subjected to Electronic Countermeasures (ECM).

Link-11 data is correlated against any tracks already present on a receivers radar picture. If a track is there it is ignored, whilst any that are missing are added but with a different symbol to show it is not being tracked by their own equipment. As this shared data is normally beyond the range of a ships own radar systems, this can provide an early warning of possible offensive aircraft, missiles or ships that would not normally be available.

I started up go2MONITOR and linked it to my WinRadio G31 Excalibur. Using a centre frequency of 4510 kHz I ran an emission search and selected the Link-11 SLEW modulation that it found at this frequency.

It immediately started decoding as much as it could, and I noticed that three Address ID’s were in the network.

go2MONITOR in action just after starting it up. Note, three ID’s in the network – 2_o, 30_o and 71_o

As the signal was strong, and it is normally maritime radar data that is being transmitted, I decided to have a quick look on AIS to see if there was anything showing nearby. Using AISLive I spotted that Norwegian navy Fridtjof Nansen class FFGHM Thor Heyerdahl was 18.5 nm SW of my location, just to the west of the island Ailsa Craig. Whilst it was using an incorrect name for AIS identification, its ITU callsign of LABH gave me the correct ID. This appeared to be the likely candidate for the strong Link-11 signal.

Position of Thor Heyerdahl from my AIS receiver using AISLive software

It wasn’t the best day and it was pretty murky out to sea with visibility being around 5nm – I certainly couldn’t see the Isle of Arran 11.5 nm away. I kept an eye on the AIS track for Thor Heyerdahl but it didn’t appear to be moving.

Whilst my own gear doesn’t allow me to carry out any Direction Finding (DF) I elected to utilise SDR.hu and KiwiSDR’s to see if I could get a good TDoA fix on a potential transmitter site – TDoA = Time Difference Of Arrival, also known as multilateration or MLAT. Whilst not 100% accurate, TDoA is surprisingly good and will sometimes get you to within a few kilometres of a transmission site with a strong signal.

One of my thoughts was that the signal was emanating from the UK Defence High Frequency Communications Service (DHFCS) site at either St. Eval in Cornwall or Inskip in Lancashire. With this in mind I picked relevant KiwiSDR’s that surrounded these two sites and my area and ran a TDoA.

St. Eval transmitter site at 50°28’43.0″N 4°59’58.0″W
Inskip transmitter site at 53°49’26.6″N 2°50’14.1″W

As expected, the result showed the probable transmitter site as just over 58 kilometres from St. Eval, though the overall shape and “hot area” of the TDoA map also covered Inskip, running along the West coast of England, Wales and Scotland. It peaked exactly in line to where the Norwegian navy ship and I were located! With the fact that there were signals being received from three different sources it is highly likely this has averaged out to this plot.

TDoA result showing the likely transmitter site at 50.60N 4.20W. Note the elongated “hot spot” which denotes the area that the transmitter site is likely to be situated.

Just after 10am the weather cleared allowing me to see a US Navy Arleigh Burke class DDGHM between myself and Arran. This added an extra ship to the equation, and also tied in with the TDoA hot spot. Things were getting even more interesting!

Link-11 SLEW at its strongest which also coincided with USS Gridley being its closest to my location.

Thor Heyerdahl still hadn’t moved according to AISLive but the Arleigh Burke was clearly heading in to the Royal Navy base at Faslane. With my Bearcat UBC-800T scanning the maritime frequencies it wasn’t long before “Warship 101” called up for Clyde pilot information along with an estimate for Ashton Buoy of 1300z. Warship 101 tied up with Arleigh Burke USS Gridley.

The Link-11 SLEW signal was considerably weaker at the time USS Gridley was at Ashton Buoy.

As USS Gridley progressed towards Faslane, the signal started to get weaker. Ashton Buoy is where most ships inbound for Faslane meet the pilot and tugs, taking up to another 30 minutes to get from there to alongside at the base – a journey of about 8.5nm.

At 1328z the Link-11 SLEW signal ended which coincided with the time that USS Gridley approached alongside at Faslane. It would be at about this time that most of the radar systems used on the ship would have been powered down so data was no longer available for transmission, therefore the Link-11 network was not required any further and it was disconnected.

The Link-11 SLEW signal disappeared at 1328z
Some images of USS Gridley arriving into Faslane taken by good friend Dougie Coull

So, was this Link-11 SLEW connected to USS Gridley? And was the ship also the NCS of the network? I think the answer is yes to both, and I’ll explain a couple of things that leads me to this conclusion. But first…………….

Link-11 SLEW Technical details

Using Upper Side Band (USB) in HF, a single waveform is generated in a PSK-8 modulated, 1800 Hz tone. The symbol rate is 2400 Bd and the user data rate is 1800 bps. Link-11 SLEW is an improved version of the older Link-11 CLEW modulation and due to enhanced error detection and correction is a more robust method of sending data. This makes it more likely that transmissions are received correctly the first time. Moreover, an adaptive system is used to counter any multipath signals the receiving unit may experience due to HF propagation.

The waveform transmission consists of an acquisition preamble followed by two or more fields, each of which is followed by a reinsertion probe. The field after the preamble is a header field containing information that is used by the CDS (Combat Data System) and an encryptor. If a network Participating Unit (PU) has any data, for instance track data, this follows the reinsertion probe. Finally, an end-of-message (EOM) is sent followed by a reinsertion probe.

The header is made up of 33 data bits and 12 error detection bits (CRC – Cyclic Redundancy Check). The 45 bit sequence is encoded with a 1/2 rate error correction code therefore giving a 90 bit field. The header contains information on the transmission type used, Picket/Participating Unit (PU) address, KG-40 Message Indicator, the NCS/Picket designation and a spare field.

Broken down, each piece of information is made up as follows:

The transmission type indicates the format of the transmission – 0 for a NCS (Network Control) Interrogation Message (NCS IM); 1 for a NCS Interrogation with Message (NCS IWM) or a Picket reply.

The address contains either the address of the next Picket or that of the Picket that initiated the call.

The KG-40 Message Indicator (MI) contains a number sequence generated by a KG-40AR cryptographic device. Synchronization is achieved when the receiver acquires the correct MI. For a NCS IM this will be made up of zeros as no message or data is actually sent.

The NCS/Picket designation identifies whether the current transmission originates from the NCS or PU: 0 = NCS; 1 = PU

Following on from the header, the SLEW data field consists of 48 information data bits along with 12 error detection and correction bits, themselves encoded with 2/3 rate error correction. This creates a 90 bit data field. 

The EOM indicates the end of the transmission and is also a 90 bit field. There are no error detection or correction bits. Depending on the unit that is transmitting, a different sequence is sent – NCS = 0’s; PU = 1’s

Analysis

There is a specific order of transmissions which takes place for data to be exchanged.

Ordinarily the NCS sends data that creates the network, synchronizing things such as platform clocks etc. Each PU is called by the NCS and any data that a PU has is then sent, or the NCS sends data, or both. This is a very simple explanation of how data is exchanged but if you monitor a SLEW network you’ll see the exchanges take place rapidly. Except for the message itself which is encrypted, go2MONITOR will decode all the relevant information for you for analysis. This means that you don’t need to look at each raw data burst as sent to calculate whether it was a PU reply or NCS IWM, the decoder will do this for you.

At this point I need to say that Link-11 decoding is only available in the Mil version of go2MONITOR so doesn’t come as standard. Should you be interested in Link-11 decoding yourself then you would need to go for the full go2MONITOR package to enable this.

As previously mentioned, the data itself is encrypted but it is possible to try to calculate who is who within the network, and the analysis of the header information in particular will give you a good clue if you already know of potential PU’s that could be on the frequency.

In this case we already have four possible PU’s:

  1. USS Gridley
  2. Thor Heyerdahl
  3. St. Eval transmitter site
  4. Inskip transmitter site

It later transpired that Thor Heyerdahl had gone into Belfast Harbour for repairs so this practically cancelled out this ship as the NCS though it could still be a PU. Moreover, Thor Heyerdahl and USS Gridley were part of the same NATO squadron at that time which meant it was highly likely they were on the same network. This left us with three choices for the NCS, but still four for the network.

Here, I’d cancel out Inskip completely as both the NCS and a PU as the TDoA appeared to give a stronger indication to St. Eval – that left us with three in the network.

The pure fact that the strength of the major signal increased as USS Gridley got closer to my location, then slowly faded as she went further away added to my theory of her being the NCS. This was practically confirmed when the signal stopped on arrival to Faslane. Throughout the monitoring period he other signals on the frequency remained at the same strength.

Based on this, this meant that the strong signal was USS Gridley using ID Address 2_o.

Let’s take a look at one the previous screenshots, but this time with annotations explaining a number of points.

Firstly, we need to look for the NCS. The easiest way to do this is to look at the NCS/Picket Designation and find transmissions that are a zero, combined with a Message Type that indicates it is a NCS IWM. Here, there is just one transmission and that emanates from Address ID 2_o – the long one that includes a data message.

We next need to find NCS/Picket Designation transmissions that still have a zero – therefore coming from the NCS – but that have a Message Type that show it to be a NCS IM. These are calls from the NCS to any PU’s that are on the network looking to see if they have any “traffic” or messages.

Because of this there should be numerous messages of this type, and if you notice none have an ID address of 2_o. However, all of these messages are actually coming from 2_o as the ID address shown in a NCS IM is that of the PU being called rather than who it is from.

Any reply messages from PU’s will show as a NCS IWM/PU Reply transmission, but importantly the NCS/PU designation will be a one – showing it isn’t the NCS. Here there is one data reply from 71_o. You’ll notice that in the “reflection” there isn’t any transmission, unlike the ones from 2_o.

Moreover, though not shown here as the messages were off screen and not captured in the screen grab, you can see that one of the PU’s sent another reply message. As I was able to look at the complete message history I was able to see that this was also from 71_o – and 2_o either replied to this or sent further data.

There are two fainter transmissions which were not captured by go2MONITOR. These were from a PU, and must have been 30_o as there are no transmissions at all in the sequence that are from this ID address.

We now have a quandry. Who was 30_o and who was 71_o?

Data is definitely being sent by 71_o so to me this is more likely to be a ship rather than a transmitter site – but – a strong TDoA signal pointing at St. Eval makes it look like 71_o is this location instead.

Now though, we need to think outside the box a bit and realise that I’m looking at two different sources of radio reception. The TDoA receivers I selected were nowhere near my location as I’d selected KiwiSDR’s that surrounded St. Eval. This meant the signal that was weak with me could have been strong with these, therefore giving the result above.

If I base the fact that I think USS Gridley is 2_o due to strength, then I must presume the same with 71_o and call this as Thor Heyerdahl as this is the second strongest signal. I can also say that having gone through the four and a half hours of Link-11 SLEW transmissions available that 30_o never sent a single data transmission – or rather, not one that was received by me.

Full four and a half hours of Link-11 SLEW as shown in the go2MONITOR results page. You can see other areas (in red) that I was decoding at the same same. By selecting an area in the results page you can access the data as decoded, saved into files. I could have further enhanced this and carried out a full audio recording for further analysis, but I didn’t on this occasion.

Here then is my conclusion:

  1. USS Gridley = 2_o and the NCS
  2. Thor Heyerdahl = 71_o
  3. St. Eval transmitter site = 30_o

Of course, we’ll never really know, but I hope this shows some of the extra things you can do with go2MONITOR and that it isn’t just a decoder. It really can add further interest to your radio monitoring if you’re an amateur; and if you’re a professional with a full plethora of gear, direction finders, receiver networks etc. then you really can start getting some interesting results in SIGINT gathering with this software – and highly likely be able to pinpoint exactly who was who in this scenario.

Now, how do I get some Direction Finders set up near me….Hmmmmmm??

Exercise Joint Warrior 192

Sunday the 6th of October 2019 sees the start of Exercise Joint Warrior 192.

Royal Navy Type 23 Duke class FFGHM HMS Sutherland (F 81) went into Faslane, here passing the Cloch lighthouse near Gourock.

Taking part primarily to the North West of Britain, mainly off the coast of Scotland, the exercise brings together a number of navies and ground forces for two weeks of training.

Despite media headlines such as “Joint Warrior 19(2) features 17 countries, 75 aircraft, 50 naval vessels and 12,000 troops” this isn’t the JW of old. It is one of the smallest, if not the smallest, in participant numbers since the exercises started and the headlines are completely incorrect – in fact most of the headlines use stock Royal Navy media notices that cover all JW exercises.

In reality, JW 192 has 16 ships, will not really go over 30 aircraft at any one time and feature nowhere near 12,000 troops. Rumours have it that the exercise would have been cancelled had not the French elements insisted on it taking place. Unfortunately, media outlets have misinterpreted some of the RN notices as ships from other countries – such as Japan – participating, when in fact the countries have sent a number of officers to observe or be trained in the handling of exercises.

This JW has coincided with other NATO exercises – Dynamic Mariner/Flotex-19 for example -which are taking place in far sunnier climes, so the draw of the rough seas and bad weather of Western Scotland was not so great on this occasion. And with NATO forces spread out on real world tasks, the number of ships, aircraft and personnel required to cover all of these exercises is low.

The weather has already taken its toll with some of the first few days activities cancelled due to high sea states. Whilst you could argue that surely they should be able to “fight” no matter what the weather, in reality in the real world, operations do get delayed because of this. For exercises though, safety must come first. However, MPA activity is taking place with at least three flights up at the time of writing on Monday 7th October.

One saving grace for the number of ships and personnel that are taking part is the fact that Exercise Griffin Strike is shoehorned into JW192. Griffin Strike is a training exercise for the Combined Joint Expeditionary Force (CJEF) involving the UK and France and which is due to become fully implemented in 2020. Griffin Strike will contain the Amphibious part of JW192.

There are no visiting fighter aircraft from other countries, but there are the usual Maritime Patrol Aircraft (MPA) consisting of 2 x US Navy P-8’s, 2 x Canadian CP-140’s and 2 x French Navy Atlantique ATL2’s. These are operating out of Prestwick again, likely doing the usual 4 hours “on-station” missions. This means that there will likely only ever be two or three airborne at any one time with a 1 hour or so transit each end of the flight. Callsigns so far have been OCTOPUS** and SUNFISH**(FNY), DINKUM** (RCAF), GROMMET** and DRAGON** (USN).

My friend, Rob Banks, captured most of the MPA participants on October 4th.

Also out of Prestwick will be mixed Royal Navy and Royal Air Force Hawks, along with Cobham Aviation Dassault Falcon 20’s acting as enemy aircraft. For information on how the Falcon 20’s operate read my previous blog on monitoring Joint Warrior.

There will be other aircraft movements of course, with RAF Typhoons playing their part. Also expected are E3’s of both the RAF and NATO fleets, RAF Sentinel and Rivet Joint aircraft providing ISTAR support and Air to Air refuelling from RAF Voyagers and C130’s. I would also expect F-35’s from 617 Sqn at Marham to be involved in some form, though I can’t confirm this for sure. These will all be operating from their home bases.

The aviation side of the exercise is capped off with plenty of helicopters operating from both land and sea, with Chinooks operating from Lossiemouth and most ships providing one or two various types. I was able to watch one Chinook, ONSLAUGHT01, practising a deck landing on RFA Lyme Bay (using callsign 4QW) to the front of my house in the Firth of Clyde. Lyme Bay later tweeted the event.

The most disappointing aspect of the exercise is the maritime part. The ships are sparse in numbers in comparison to previous exercises, with a light participation by the Royal Navy. The RN is providing Amphibious Assault Ship HMS Albion, possibly using her Landing Craft Utility (LCU) Mk.10 class vessels operated by the Royal Marines. Albion is the current RN flagship. Also taking part is Duke (Type 23) class FFGHM HMS Sutherland and a small number of Minesweepers and Minehunters.

Royal Navy Albion class LPD HMS Albion (L14) approaching Faslane

**Edit: RFA Lyme Bay is now also confirmed as part of the exercise. RFA Argus and RFA Tidesurge are also now confirmed.

France has also sent a Amphibious Assault Ship in the form of FS Tonnerre, a Mistral class LHDM. Tonnerre can embark 450 fully kitted troops and 60 armoured vehicles or 13 main battle tanks, along with Landing craft and up to 16 helicopters. No helicopters were observed on deck as she arrived at the Greenock area on Friday 4th October 2019 – it is not known whether they, if any, were on the hanger deck. The same goes for APC’s/MBT’s on the lower decks.

French Navy Mistral-class Amphibious Assault Ship FS Tonnerre (L9014)

Modified Georges Leygues class FFGHM FS La-Motte-Picquet arrived into Glasgow on the afternoon of 2nd October along with Éridan (Tripartite) class minehunter FS Cephee going into Faslane earlier in the morning.

French Navy Modified Georges Leygues-class DDGHM La Motte-Picquet (D645) arriving into Glasgow

The German Navy has sent a single ship – the Berlin (Type 702) class replenishment ship FGS Berlin – whilst the US Navy, who normally send a number of frigates and cruisers, have only sent Military Sealift Command Lewis and Clark class dry cargo/ammunition ship USNS William McLean.

German Navy FGS Berlin (A1411) arrived early, on a very murky morning.

Finally, Danish Navy Iver Huitfeldt class FFGHM HDMS Iver Huitfeldt is also participating, but due to other tasks is heading straight to the exercise area rather than going to Faslane for the pre-exercise briefings.

US Military Sealift Command Lewis and Clark class USNS William McLean (T-AKE12)

For submarine participants, Norwegian Type 210 (Ula) class SSK Utsira is one of the MPA targets. She arrived earlier in the week and departed on Sunday 6th October as the exercise began.

Also, an Astute class SSN of the Royal Navy departed Faslane on friday 4th. Though not confirmed, again it is highly likely to be taking part in some form or other.

Unknown Astute class SSN departs Faslane

As well as areas in and around Scotland, it is highly likely there will be the usual missions around the Spadeadam Electronic Warfare Tactics range and possibly areas out over the North Sea. GPS jamming also normally takes place as part of the exercise, normally out in danger areas situated to the NW, over the sea.

There should be Maritime Gunnery firing off the west coast of Scotland. Timings and areas are normally reported via the Royal Navy’s Gunfacts service either by a recorded telephone message and on NAVTEX at 0620 and 1820 UTC. Coastguards also broadcast the details at 0710, 0810, 1910 and 2010 UTC. If you happen to be in the area where gunnery is taking place then the duty broadcast ship sends out details at 0800 and 1400 local, or 1 hour before firing, by making a call on Maritime channel 16 and then the appropriate broadcast frequency for the area.

The navy also provides SUBFACTS warnings on submarine operations on the same telephone hotline and NAVTEX.

NOTAMs will also be available that provide warnings on most of the activities taking place. A good place to look for these is on the NATS AIS NOTAM page.

The amount of frequencies used for the exercise is huge, and near impossible to list. However, there is a list of VHF/UHF and HF frequencies on my Monitoring Joint Warrior Exercises blog from 2014. Despite being 5 years old, the HF freqs tend to be the same especially those used by the MPA’s when communicating with Northwood (Callsign MKL).

Noticeable so far has been the fact that the P8’s and CP140’s have both been out on their frequencies by 1.5 to 2.0 kHz when calling MKL on 6697 kHz (primary freq) and 4620 kHz.

The VHF/UHF frequencies won’t have changed that much either, but as most of the exercise is at sea, and generally out of range of most of us, it is hard to gather them all. Certainly the standard Swanwick Mil, A2A and TAD’s will be used, so if you have these you’re bound to get something.

The Bear Net “Pirate”

The “Bear Net” of Russian Long Range Aviation has been relatively busy during the last few months, no doubt some of this due to the exercises playing out in Northern Europe by Western countries and NATO. They also tend to increase activity around the same time as USSTRATCOM have their Global Thunder exercises, one of which kicked off on the 29th October and lasted for just over one week.

Three Russian missions took place within the last two weeks, all of which travelled through the same airspace as the area covered by Exercise Trident Juncture 2019 (TRJE18) off the North coast of Norway. One flight was of a single Tu-142M, RF-34063//Red 56, that made a low pass near participating ships. I was unable to follow this flight so not received by me, the likely callsign on the CW frequencies for this was LNA1. This was intercepted being called by IWV4 on 8112 kHz at approximately the same time as the pass was being made. Images of the pass were caught by AFP correspondent P. Deshayes who was on one of the ships.

One of the other missions was of more interest than normal. The “Bear Net” is always an interesting thing to follow on HF, but when extras are produced it makes them even more fascinating. In this case it wasn’t so much what the Russian did, but what happened late on in the mission that wasn’t them.

Stepping back, we’ll go to the beginning of the day – 31st October 2018. The net was still on the autumn frequencies with ground station CW first being picked by myself sending “W” markers at 0920z on 8162 kHz. I quite often put one of the receivers on the current season ground station frequency to get any alert of possible flights heading out thanks to the markers sent every 20 minutes at H+00, H+20 and H+40. With this 0920z interception I started recording the frequency and I switched all radios to the other known frequencies – 9027 kHz for Air CW and 8033 kHz for Simplex USB voice comms – and got set up to start recording these should anything happen.

The 0940z W marker came, but interestingly when I went through the recordings later on I was able to hear a very faint G marker in the background. This had at least two operators carrying out the task as there were two distinct methods of sending. One would use the standard G every two seconds, whilst the other sent as double G’s and slightly quicker. The marker also started approximately 10 seconds earlier than the W and – guessing as it was stepped on by the W – looks to have lasted the two minutes too. You could hear it in the background between the odd W space.

At 0949z 8033 kHz became active and I started up recording on multiple SDR’s whilst using my Icom IC-R8500 as the live radio. By this time, I had also observed callsigns associated with QRA flights on my SBS so was pretty certain something was heading towards the UK.

With a few more USB calls following, but no CW traffic except for the markers I was certain the aircraft involved were Tu-160’s as they don’t use CW.

My Russian is still pretty basic (if that) so I totally rely on recordings to go through it all in slow time. I had been able to work out live that there was at least the usual STUPEN callsign along with TABLITSA; but I was also hearing another one that when going through the recordings I worked out to be KONUS – this one I hadn’t heard of before.

Going through the recordings, this mission certainly helped my knowledge of Russian numbers, or rather the methodology of how the messages are sent, as there were plenty of messages involved. The two aircraft callsigns were 16115 and 16116. These callsigns carry on in sequence to those that were used on a mission a few days earlier on the 28th with 16111, 16112 and 16114 being used by Tu-160’s and 50606 by an accompanying A-50.

In general 16115 was much harder to understand than 16116. 16116 said it all much slower and louder. STUPEN was very clear at the beginning, but faded towards the end, whilst TABLITSA may of well have been in my room, she was that loud.

Here then is the first part of my USB log:

8033 – Bear Net

0941z 16116 calls STUPEN
274 443 624

0949z 16116 calls STUPEN
458 842 156 816 443 896

0959z 16116 calls STUPEN [replies, 16116 faint]
KONUS calls 16116 and tells him to pass the message to him

1000z [16116] 303 847 023 534 734 619 822 332
[with wrong read back of group three, corrected by 16116]

1002z 16115 call KONUS
138 534 005 964 312 147 443 896

1010z 16115 call KONUS
741 534 724 619 822 180 443 594

1020z 16116 calls STUPEN
478 815 023 534 071 955 117 957 084 305

1028z 16115 calls TABLITSA, then straight away calls STUPEN
138 1?5 [error?] 138 534 540 115 ??? 251 660 033 084 316
[garbled with a possible error]

1036z 16116 calls STUPEN and TABLITSA, STUPEN replies
303 815 023 534 671 612 842 768 084 544

1039z 16115 calls TABLITSA and STUPEN, STUPEN replies
741 534 671 619 246 768 023 084 544

1048z 16115 calls STUPEN
138 534 491 236 896 443 084 635

1050z 16116 calls STUPEN
478 815 023 534 635 233 107 219 084 615

The recording below contains the 1048z and 1050z messages

1112z 16116 calls STUPEN
452 635 084 125
[repeats third number twice]

1129z STUPEN calls 16116 twice – no answer

1132z STUPEN calls 16116 twice – no answer

1133z STUPEN send message
BLIND 553 028 533 ??1

1141z 16115 calls STUPEN
741 534 360 810 719 980 447 023 038 914

1144z 16116 calls STUPEN
303 875 023 534 106 673 980 719 038 914

1148z 16115 calls STUPEN
138 537 023 534 674 400 388 521 038 496

1159z 16115 calls STUPEN
741 537 023 534 940 441 388 441 038 896

1201z 16116 calls STUPEN
478 816 023 534 717 355 637 321 038 496

1210z 16115 calls STUPEN
138 537 023 534 600 902 955 462 038 844

1213z 16116 calls STUPEN
303 815 023 534 186 117 388 117 038 896

1217z 16115 calls STUPEN
741 537 023 534 981 980 356 789 905 149

1306z 16115 calls STUPEN
138 537 023 534 540 288 810 236 905 206

1318z 16115 calls STUPEN
352 315 544 243 942

1320z 16115 calls STUPEN
[4 calls, no answer]

1322z 16115 calls STUPEN
741 537 023 534 724 284 312 816 315 555

1325z 16116 calls STUPEN
457 187 905 844

1351z 16116 calls STUPEN
457 187 315 715

Then comes the interesting part of this…… the arrival on frequency of the “Pirate”.

At 1427z an open mike became present on the frequency, in AM mode. This was fairly brief, and at 1429z the Pirate started.

Mike Delta Kilo Romeo, Mike Delta Kilo Romeo
Mike Delta Kilo Romeo, Mike Delta Kilo Romeo Standby
Mike Kilo Delta Romeo, Mike Kilo Delta Romeo, Mike Kilo Delta Romeo Standby

Note his own error or change with the callsign

MDKR//MKDR

Image of carrier wave and transmissions of MDKR//MKDR. The Pirate is using AM mode, but as the recording was in USB only that half was captured.

This was followed at 1431z
Mike Kilo Delta Romeo
56822166095499102

The audio for the above is here:

At 1439z he was back but very faint, almost like it was a recording or live transmission of a Numbers Station. Shortly after this 16116 tries to call STUPEN and KONUS, getting stepped on by the Pirate who sends yet another attempt at an EAM/Numbers Station.

C78AAA5ACBCEA77D76FF33EAFAE63CF5A7AAAAFAF555A85CDBEEBBA5D6DFCCA – or something like that! It was hard to work out some of the digits due to the lack of phonetics. Each time I listen to it I get a different result!

Fake EAM/Number station message

The audio is below.

At 1446z, 16116 calls STUPEN, KONUS and TABLITSA but gets no response back.

The Pirate then attempts to jam the frequency again. First of all with an extract from a selcall system used by the Russian Ministry of Foreign Affairs given the name “Mazielka”, designated X06 in the Enigma Control list. See the end of the blog for analysis on this.

This was followed by a continuous tone at 1090 Hz for approximately 35 seconds. These are the last transmissions by the Pirate.

Again at 1459z, 16116 tries the ground stations until TABLITSA finally acknowledges his presence and a message is sent. 16116 is barely readable with me by this time, though TABLITSA was ridiculously loud.

1459z 16116 calls STUPEN
calls TABLITSA
calls STUPEN
calls TABLITSA answers [very strong]
452 730 969 463

1506z 16115 calls TABLITSA
590 375 143 986 196 233

1531z 16116 [very faint] calls TABLITSA
452 859 143 168

This was the end of all contacts on USB, with the last W marker coming it at 1520z (though these then did start up again at 1640z, though much weaker).

From various OSINT feeds, the approximate route of the Tu-160’s took them out over the Barents Sea having departed Olen’ya air base in the Murmansk Oblast and heading north before turning west once out over the sea. At some stage they were intercepted by Norwegian Air Force F-16’s and were escorted to abeam Bergen/NE of the Faroe Islands before turning for home. The Russian Air Force have stated that the flight lasted for ten hours which ties in with the seven hours or so of HF traffic, with the remaining 3 hours probably within range of Russian VHF communications.

Olen’ya is a common forward operating base for LRA missions, being one of the remaining Arctic Control Group (OGA) airfields available. The base itself hosts Tu-22M-3R Backfire-C of the Russian navy. These are Tu-22M3’s that have been converted for a navy reconnaissance role though it is unknown just how many are airworthy. The base has over 30 Tu-22’s in permanent storage.

Twitter feed for записки охотника (Hunter Notes) has a rough plan of the route flown, along with his intercept of the messages sent – he has few of the earlier ones, and there’s a couple of differences between his and mine.

So, who is this Pirate? It isn’t the first time he’s been around. He was also heard in September.

On this occasion he was a little bit more direct.

Russians we are watching you
Russians we know where you are
Russians, turn around and abort your mission

And later

We will blow you out of the sky
The Russians. We have you under observations [sic], stand down

Despite having what is clearly a South East England accent, he signed off using something along the lines of:
This is the United States BC36

No doubt he is trying to gain some sort of attention, and in a way he is succeeding – me writing this blog is proof of that. But what else is he trying to achieve? Is he hoping the Russians respond? I doubt they will. Apart from anything, I expect the radio operators, having had to listen to all the noise on HF for every flight, have learnt to ignore any calls which aren’t specific to their mission.

My initial thoughts were that he isn’t a radio amateur and hasn’t worked in any other field that involves speaking on the radio. His use of poor phonetics made me wonder this. However, with access to a transceiver and associated antenna this may not be the case – and amateur radio operators tend to make up their own phonetics rather than standard ones, and he may just not know them.

That said, he must have some interest in military aviation and possibly a member of a military aviation forum. These tend to have thousands of members that have not been vetted in any way or form and quite often have threads that give notice of flights are on their way, be it with an alert of a QRA launch or actual comms received on Bear net frequencies.

Twitter, of course, is another example of information being out there for anyone to then take action on.

One thing is for sure, if caught he will find himself in trouble with UK authorities with the possibility of a two year prison sentence and a heavy fine. He will most definitely lose his radio licence should he actually have one, and have all equipment confiscated.

Lets see if he turns up again in another LRA mission.

Analysis of the Mazielka (X06) transmission

It was obvious straight away that this was a recording of X06 – in this case the sub-variant X06b.

However there was something odd about it.

X06 is a selcall system used by the the Russian Ministry of Foreign Affairs to alert outstations of an upcoming message, normally on another frequency.

The system sends out 6 tones, each lasting 333 milliseconds, making each call 2 seconds long. Each tone represents numbers 1 to 6 making a total of 720 different selcall combinations available for use.

The tones are sent on slightly different frequencies:
1 – 840 Hz
2 – 870 Hz
3 – 900 Hz
4 – 930 Hz
5 – 970 Hz
6 – 1015 Hz

The image below is taken from a X06 call I intercepted in November 2017 and decoded using go2Monitor. This shows a selcall of 116611. In this case the tones, which are still 333 ms long, sound longer but this is because the digits join on the same tone.

Whilst you can use a decoder, for X06 it is easy enough to decode using other means, such as Adobe Audition or Signals Analyzer. With these you can measure the tone frequencies and lengths.

In Adobe Audition the Pirate transmission is shown below

Pirate_003Pirate_003a

What is unusual is that the tones are off by 60 Hz. Whilst 1 should be at 840 Hz, here it is at approximately 900 Hz, and 6 is at 1075 Hz rather than 1015 Hz. Whether this is because the Pirate was transmitting in AM rather than USB I’m not sure. Maybe it is something to do with his original recordings. My recording is below

It is likely the long tone sent after the selcall here is the usual long tone that is sent before the standard ones. This is sent at 1090 Hz.

Pirate_004Pirate_004a

Looking at it using Signals Analyzer (SA) you can see that it is definitely X06. With SA you can measure more accurately the frequency and length of each tone.

X06_005

Here you can see the two tones (actually 6). The total time for the selcall is 2.040 seconds with 1 marked at 896 Hz and 6 at 1074 Hz

X06_006

Measuring the length of an individual tone (though actually 3 joined together) gives a length just over 1 second or 3 tones at 333 ms each

X06_007

Finally, measuring the space between each call gives us 1.312 seconds which is the correct spacing for X06

The sub-variant of X06b is designated due to its format of six tones sounding like two. It is thought this is a test transmission.

Finally, just to confirm my theory, I ran a looped sound file through go2Monitor with the result confirming the selcall as 111666

X06_004

An updated AIS system

Back in March I blogged about my AIS system, in particular about the LNA4ALL and how it coped with the low signal reception of my homemade antenna.

Things went really well until one day the reception dropped out completely.

A quick test of the system showed that something had gone wrong with one of the pieces of equipment though at the time I was unsure whether it was the antenna, the LNA or the NASA Engine AIS decoder.

As I was due to go away for a short while I decided to tell all the relevant websites that I feed (IHS AISLive, MarineTraffic and VesselFinder) that my system would be offline until further notice due to a technical fault, and that as soon as I’d worked out the issue that I’d get it fixed and back online.

The guys at MarineTraffic were very quick in getting in contact with me and offered to help with a new decoder as long as I didn’t mind being a beta tester for the equipment and some of their new software. I was very happy to agree to their offer.

The decoder they organised for me was a new Comar Systems SLR350ni Intelligent AIS Decoder and it arrived with me about ten days after I agreed to their offer.

The main thing that really appealed to me about this decoder was the fact that it links directly to your home network either by WiFi or hardwired using RJ45 Ethernet cable. This meant that I could install the decoder remotely, nearer to the antenna and out of my radio shack, but have full control of it from my main PC. The decoder itself is interfaced to a Raspberry Pi™ 3 computer, comes with aforementioned WiFi and Ethernet connectivity, 4 USB ports and an HDMI connector for a monitor display. It can be used in any AIS setup and is a dual channelled parallel receiver.

Installation was simple. Within 15 minutes the decoder was connected to my home-made antenna and we were receiving data – and at a much faster rate than the NASA due to the dual channel capability.

The MarineTraffic part of the agreement included some new software that they are testing, which includes the capability of sending received raw AIS data to five feeds such as AISLive. Any of these decoders obtained using MarineTraffic come with their host settings hardwired in so any data received through it is automatically sent to them – you don’t have to do anything to send data to MarineTraffic, just attach an antenna, connect it to your network and switch it on – that’s it.

In the new software there is a page where you can add other host iP addresses and port details. Doing this means a couple of things:

1 – You no longer need to use other software such as ShipPlotter or Neal Arundale’s NmeaRouter/AisDecoder software to forward on the data.
2 – You don’t actually need a PC connected directly to the Comar decoder.

The second point is interesting as it means you no longer need to have a PC running 24/7 to feed any of the AIS data to whichever sites you want. This is a bonus if you currently switch off your computers when you go on holiday or are away from home for a while. It still means you can provide the data whilst you are away.

Personally I have the following set up:
MarineTraffic (hardwired)
AISLive (iP host)
VesselFinder (iP host)
ShipPlotter (internal network address)
AIS Decoder (internal network address)

Using the ShipPlotter software still means I can get a better picture of what I am receiving, range of reception etc.; whilst using the AIS Decoder software means I can look at any of the messages sent in greater detail.

I have to say that I am very impressed so far, and highly recommend the Comar decoder. It is available from numerous online shops, but if you are going to feed MarineTraffic you may as well get it from their site, currently priced at €379.00. Doing this means it already comes pre-programmed to send to MarineTraffic.

A new antenna too

I had gotten round to testing all the equipment to see what the cause of the original loss of reception was and it turned out to be the LNA4ALL. This was a shame as I had new objectives for the LNA with regards to the reception of weather satellites so it means I’ll have to get a new one. Luckily I don’t need to replace the whole thing, just the circuit board, so it will be much cheaper – but a pain none the less, especially if I have the same issues with UK Customs that I had previously. The likely cause of the failure was an Electrostatic Discharge of some sort or other. There had been some Lightning storms nearby over the previous days and it could well have been this that had done it – strange though as my equipment is very well protected from this happening. The area I live in is prone to power surges and power cuts – the joys of living in a remote area in Scotland, still backwards in many things the rest of the UK take for granted.

With the loss of the LNA, this drastically reduced the range of my home-made antenna and so I decided it was time to buy a new one. I’d toyed with building a better one but in the end I just couldn’t be bothered and so I went for a Metz AIS antenna, bought from the Salty John website. Great service from them meant it arrived within 48 hours and so when it came to installing the Comar decoder I also rigged up the antenna in the loft space next to my home-made one at the same time.

If I have one complaint about the Metz, it’s that it doesn’t come with any form of protection for the co-ax connection area. This is especially strange as it is designed specifically for boats and would therefore be exposed to wet/salty conditions all the time. Add to that that the threaded area is over an inch long, much longer than what you would get with a UHF connector, this makes it a weak area for the lifetime of the antenna. If you were to install it outside (which is the general recommendation for AIS reception) then you would need to cover it in self-amalgamating tape and check it regularly to ensure it is still working. Not perfect if you need to climb up on the roof of your property.

One other option would be to use the tightening nuts supplied to fix some plastic or aluminium tubing around the connection, but again this is some extra hassle which could have been remedied by Metz themselves.

As it is, I seem to be getting great coverage from the Metz from it’s position in the loft, though I may still add a LNA4ALL to boost it even more.

With the antennas side by side I was able to run some quick comparisons between the two. The images below show the Spectrum analysis using my Rigol gear.

From the images you can see that with my messing around of the home-made antenna I had over trimmed it to be tuned to 180MHz rather than the required 162MHz. At 162MHz it measured in at 9.3dB which wasn’t even worth calculating the VSWR, whilst at 180MHz its VSWR was 1.23:1

In comparison the Metz antenna, which is a half-wave whip antenna, came in nicely at 83.6MHz with a measurement of 30.15dB/VSWR 1.07:1. Metz communications specify less than 1.2:1 VSWR so this is spot on.

With the new set up things have definitely improved. I also ran a quick test using AISDecoder to see how many messages the two antennas fed to the Comar, be it in a very basic manner of waiting till there was some ships being picked up, running the software with one antenna for a minute, noting how many messages were received and then swapping to the other antenna for the same length of time. In theory it is a reasonable test as the ships won’t have travelled far in that time, but not 100% perfect. Regardless, the Metz was able to pick up 19 messages in its minute test, whilst my home-made antenna only managed three! The test was carried out in less than five minutes.

In conclusion, whilst it has been a pain to lose the LNA4ALL, it has turned out better in the end for my AIS station. Statistically my data feed has improved no end for AISLive and MarineTraffic; and having gone away twice now since installation I have still been able to provide 24/7 coverage where I would normally have switched the whole system off.

Area coverage provided to MarineTraffic since the new installation. Fitting a LNA4ALL in the future should make this even better.

ShipPlotter example with the new installation. The bold plots are being received by my station and show 4673 messages received by 1032z. The image below shows the same but at 1753z and a message number of 28135. This averages out at about 52 messages a minute, though it was a busy time with lots of fishing boats in the area.

NOTES:

Following a couple of questions regarding the Comar decoder I’d like to add that it doesn’t have to be connected to the Internet or a Network to work. It can be used “locally” using the USB connections direct to a PC.

Also, you do not NEED to feed MarineTraffic if you don’t want to. If you don’t want to do this then buy a unit from another supplier which won’t have the files installed.

Fighting Ships 2017/2018

In the last month or so the latest edition of Jane’s Fighting Ships has been released. It’s available from the IHS online shop for the usual eye-watering price of £984.

One thing to note is that older editions of the yearbook are also available on the IHS website at much cheaper prices.

This is the last edition that Commodore Stephen Saunders RN will be the chief editor of, as he has decided to retire from the role after 17 years. Having been a contributor of JFS for the last five of those years it will be sad to see him go.

From now on there will be a multi-team of editors that will compile both the yearbook and the on-line version. I will be remaining a contributor, and will hopefully be getting more involved than I am already.

There could well be complications regarding contributing data and photographs and I suggest that if you do either of these then to contact the team at IHS as soon as possible. There is a strong likelihood that contracts will need to drawn up with regards to copyright usage of whatever you send in. The email address for the yearbook is JanesFightingShips@ihsmarkit.com

In the meantime, I wish Stephen all the best in his retirement – he’s done a great job editing the yearbook over the last 17 years.

Liman follow-up

Well, it’s a couple of days now since my blog on the Liman incident went live. I’ve had some great feed back on my coverage.

There has however been one individual that has not liked it so much. This is Steffan Watkins, owner of the blog Vessel of Interest. Mr Watkins was one of the unnamed characters I referred to in the Liman blog. He is widely regarded as a conspiracy theorist, and even has to go to the extent of denying it on his own blog. Whether he is or isn’t is irrelevant really.

Interestingly, a recent piece of work I was asked to do for Jane’s Intelligence Review magazine was to analyse an image of Russian navy Vishnya-class AGI Viktor Leonov to try and work out the various intelligence gathering systems that may be on board via all the different antennas visible. The actual article was written by Mr Watkins.

Now, up until this stage I really didn’t pay much attention to anything Mr Watkins wrote, mainly because what he wrote was aiming towards being the aforementioned conspiracy theories. But, he kind of came through with an interesting article – though it was nothing I didn’t know, as a group of us have been following Viktor Leonov for a few years now.

So, why hasn’t he enjoyed my blog? Well, I suggest you read it and see what he has come up with, and then come back here where I’ll answer his “questions”.

Hopefully, then you have read his blog on Liman now.

Firstly, lets talk about the “expert” part. He seems to think that I am condescending towards others from my comments. I am fully open to ideas and theories if there is evidence to back these ideas up and people also listen to what is being presented to them. In this case he did neither. And my references to things such as the Heather Sea evidence is clear – the ship wasn’t involved, it never was and yet people were still saying it was (not Mr Watkins I hasten to add, he hadn’t looked into anything outside the bubble of Liman). It was a quick and easy search through AIS history to see that it wasn’t, and yet people weren’t doing this. My reference to not being an expert is correct. I have no qualifications in the field of Radio Communications, I do not have an amateur radio licence and such like. I do not have a degree or a masters or any other diploma in the theories of radio – therefore I am not an expert. In ATC we have engineers that are experts in that – I wouldn’t dare tell them their job, just like they wouldn’t tell me how to keep aircraft apart. This is the reference I am making to being an expert.

He also mentions banter on twitter. There was no such thing, certainly not in my eyes. I’ve been around banter for decades – in the forces you need to be able to take it, and give it – and it is actually worse in the world of ATC. I can recognise banter when I see it. He also mentions an exchange of ideas. Yes there were exchanges of ideas, but he really wasn’t coming up with anything of substance. Instead, from his comments, he gave a picture that there was a conspiracy behind the incident – there had to be something because of the nature of the ship involved – an Intelligence Gatherer.

He actually says this in his blog:
Any ship could have an accident while at sea, in the fog, early in the morning. But, this wasn’t “any” ship; just by being a Russian Navy AGI (a “Spy Ship”) it makes me +1 suspicious. There is no good rational basis for that suspicion, except it’s a Russian Navy AGI, it definitely has sensitive gear aboard, and having it sink leaves a gap in whatever task it was doing, on the deployment it was on.

Why does this receive an extra degree of suspicion? Oh, that’s right, there’s no rational explanation, it’s just suspicious.

I wonder what Mr Watkins reactions were to the collision between a French Navy SSBN and a Royal Navy SSBN in the middle of the Atlantic in 2009. Holy shit, the French are at it again, trying to sink our navy 🙂

He refers to the fact that surely the Youzar Sif. H must have been able to have seen the Liman on radar:
The Liman was not a “stealth” ship, and as far as I understand, should have shown up on the navigational radar of the Youzarsif H; isn’t that why navigational radar exists?
Well, if two of the most expensive vessels in the sea, with some of the most sophisticated sonar and listening equipment ever made managed to thump into each other in the wide open Atlantic, then it is perfectly feasible for two ships to hit each other in thick fog in one of the busiest shipping lanes on the planet.

And it doesn’t even have to be in thick fog or underwater – ships hit each other. His Canadian navy had such an incident in 2013 in perfectly good weather when they were approaching each other.

Or there’s the Turkish Coast guard patrol boat that was hit in broad daylight, in the middle of the Bosporus, by a 158ft long Bulk carrier in August last year

Further about the radar he stated:
They were in thick fog, only navigating by instruments, and didn’t see a ship directly in front of them on radar?
Isn’t that weird?
I don’t think it reflects well on the Youzarsif H’s crew, unless the operations of the Liman were causing issues for the radar of the Youzarsif H. Yes, that’s wild speculation, because it makes no sense how a ship doesn’t notice a giant hulk of floating steel in front of it on radar. Make up your own crazy theory! It’s better than what we have now, which is nothing.

None of us know what radar system Youzar Sif. H has in place. I’ve been on quite a few ships in my time, civil and military – and of course I work with radar all the time. You get plenty of radar returns or “primaries” which you don’t know what they are, and you do your best to avoid them if you are not sure, but you have to make an assessment as what you think is a ship/aircraft and what is just weather (or a wind farm in a lot of ATC cases these days). The image here shows just a basic ships radar image, a modern one at that, so actually could be much better than the one on Youzar Sif. H – we won’t ever know I expect. Other radars are available of course, with more detail, but if Mr Watkins can work out what is what in this image then well done.

The next statement he produces is:
There have been no reports regarding who ran into who; or if it was a mutual effort. The news media is making it sound like they were both moving and collided in the fog. I’m not sure that’s correct.
He produces a list of things that could have happened – yes all obvious – but then doesn’t actual state why he thinks the news media are incorrect?? So why do you think this Mr Watkins?

He then mentions jamming of the AIS frequencies, but thankfully seems to have realised that this wasn’t the case. At the time of the “banter” he wasn’t stating that though:
See, there you go down the rabbit hole again. I’m wondering if the AGI screwed itself by engaging in EW in the same frequency range as AIS. 161.975/162.025 MHz range, within the usual Marine VHF band, right? Might explain the sketchy AIS coverage immediately prior.
Firstly, I’m still not sure what he’s referring to with EW. Early Warning?? Electronic Warfare?? Neither of which Liman is equipped for. And, secondly I went into great depths, the best I could at the time (see later) to try to explain the likely reason for the sketchy AIS coverage – all of which he kind of brushed aside for his more extreme likelihoods. Here, again he gives the air of being a conspiracy theorist.

We now get on to my favourite part of his blog:
•The Youzarsif H’s AIS signal was being received by terrestrial based AIS receivers, which Mr Roper described in his blog post with excruciating detail. The signal was very spotty before the collision, and crystal clear after the collision. This is the thing that really draws my eye and triggers my curiosity; it is the basis for much of my suspicion regarding this event. On the day Mr. Roper and I were discussing this he specifically dismissed my speculation that the issue could be related to the sender and insisted the gap in reception must be related to the receiver, or environmental conditions.
“This totally depends on the receiver not the sender! The receiver may have been off.”
-Tony Roper, 6:29 PM EST, May 4 2017
I tried to convey that my interest was less with the gap before the collision, and more with the immediate change to the signal quality (seemingly crystal clear reception) instantaneously after the collision, which Mr Roper had no explanation for at the time. It seems after reflection, he now theorizes the sender, may have had their antenna(s) facing away (blocked by the ship’s superstructure?) from the shore-based receiver when travelling Southbound (toward the Liman) and immediately after the collision turned around and faced their AIS antenna(s) toward the shore-based AIS-T receiver. This is fantastic speculation, and would explain how the signal went from terrible, to perfect, immediately, while other ships in the area had AIS-T signal all along.

Firstly, by excruciating detail I’m guessing Mr Watkins didn’t understand it. You must forgive me for trying to explain how something works instead of just giving less than half information on how something works. If he thinks my information was excruciating then maybe he should read the Propagation pages in the ARRL handbook which is spread over 30 pages. Or maybe he should go to websites such as:
Make more miles on VHF
HF Propagation tools
Or one of the many pages by Tomas Hood on propagation
It is obviously a fault of mine to make something interesting for the reader, that will hopefully teach them something.

I said above that at the time I did my best to try to explain to Mr Watkins what may have happened. This he seems to have thrown back in my face, alluding that I may have changed my mind on my original thoughts. I didn’t dismiss his thoughts but pointed out that there may have been a break in coverage. The interesting thing is the quote he has used, taken at 6:29PM EST. This was actually 23:59PM UK time, I was in a hotel room, 450 miles away from my computers and AIS systems. Maybe Mr Watkins has presumed that the rest of the planet is running at the same time as Canada, and that we were all glued to our PC’s? I made the best assessment at the time – and you know what, I wasn’t far wrong in the theory of coverage, as I proved in the blog.

He says I have “reflected” and changed my mind. No, I haven’t Mr Watkins. It’s a combination of both sender and receiver. I didn’t reflect. What I did was, on getting home, do some further analysis. Something Mr Watkins has quite clearly not done. He can only produce the same data on the what Youzar Sif. H did both before and after the incident. He still hasn’t come up with anything else – yet he has the nerve to criticise my analysis.

Come on Mr Watkins, show us some workings out. Do some actual analysis.

Here’s something for you. Data taken today from the same region.

The image below shows the tracks for various ships and their plots as received on AISLive

Holy crap – how do we explain all those gaps in the plots especially the ones on the rough route Youzar Sif. H took?? How the hell does the furthest ship away from any receivers have the best plot history?? Hmmmm, please do tell Mr Watkins. Maybe the Russians are jamming the area from outer space? Maybe there’s another AGI there?? Or maybe there’s just a poor area of reception.

The picture below shows the same area, at the very same time, but this time taken from MarineTraffic.

I’ve purposefully highlighted Reina as it is also highlighted in the AISLive image. The red ship to at the bottom is also on the AISLive image as the fully tracked ship. But what is that? MSC Eleonora is showing here, but isn’t on AISLive – what the hell?? How does that happen?? Please explain with all your worldly knowledge Mr Watkins.

Here’s some extra data for you, just so that you realise that AIS receivers aren’t on all the time (mine was off whilst 450 miles away for the weekend by the way). The three receiver examples that I used for the blog have the following averages for receiver availability over the last two months:
Istanbul = 93.3%
Burgas = 98.9%
Elena = 97.95%
So, not available all the time then.

He ends the large waffle with:
Can we prove this theory with the available data? Well, it’s certainly not as clear as I would like it to be. It is still crystal clear that immediately after the collision the AIS transmissions went from random times between successful transmissions to a steady stream at 3-4 minutes

The following day, still in the hotel 450 miles away from all my gear, I sent Mr Watkins roughly the same as the above showing a plot of another ship with the same loss of coverage. That obviously wasn’t enough evidence to make it “crystal clear”. I then produced my blog with further evidence – including an example of Youzar Sif. H with a loss of 14 hours of coverage – which again obviously wasn’t “crystal clear”, but was in fact excruciatingly full of too much detail for Mr Watkins. I have now produced the above which explains – yet again – that there are gaps in the coverage, yet other ships somehow have a better plot history. I suspect though, that all this will be far too foggy for Mr Watkins and he still will not be able to see anything clearly – except for a conspiracy.

Quick LNA4ALL test

Despite the best efforts of the Royal Mail service, I have been able to get my hands on a Low Noise Amplifier created by Adam at LNA4ALL. The Royal Mail showed just how useless it is, when the parcel arrived here in the UK in just 11 hours from Croatia on February the 14th, but then not getting delivered to me until March the 14th – yes, one month! There is no surprise that courier companies such as DPD and Hermes are getting more business than the Royal Mail – they are bloody useless.

Anyway, the reason for the purchase is for a later review on an AIS dongle that I will be testing, but which has unfortunately been possibly damaged before getting to me.

So, as I had some time to spare I thought I’d run a quick test on how the LNA performs against the claims that is shown on the LNA4ALL website. For the test I used a quickly built 12v to 5v PSU that was connected to a Maplin bench PSU and also a Rigol DP711 Linear DC PSU where I could ensure a precise power input. As it was, it was good that I used the DP711 because my quick PSU was only chucking out 1.2v at connection to the LNA4ALL, despite an unconnected output of 5v – some work needed there I think.

Despite this lower power the LNA4ALL still worked with just the 1.2v input, though the results where not as good.

Other equipment used were a Rigol DSG815 Signal Generator and a Rigol DSA1030 Spectrum Analyser (no longer available), along with various Mini-Circuits shielded test cables. The Rigol equipment I purchased from Telonic Instruments Ltd last year.

Below then is a table that contains all the relevant data. As you’ll see the Gain claim is pretty much spot on with some being over. Just a couple of frequencies are below that which is claimed, especially at 28 MHz.

LNA4ALL Frequency data

A couple of things to note.

Firstly, somehow I managed to miss testing 1296 MHz. I obviously didn’t put it in the table in Excel before I started 🙂 Also, the DSG815 only goes up to 1.5 GHz so I couldn’t test above that.

Secondly I ran a test for the AIS centre frequency of 162 MHz, for which there was no comparison to the LNA4ALL data. A gain of over 24dB though shows that the LNA would be perfect for those of you with AIS receivers that may want to get better reception. To prove the theory I compared the LNA reception against data without it connected to the NASA Engine AIS receiver that I currently use. In ShipPlotter I average a max range of around 15nm without the LNA, but with it connected this increased to around 22nm. The number of messages received also tripled as it was able to dig out the weaker signals.

The NASA Engine isn’t a bad receiver, but it is a frequency hopper rather than a dual monitor, and so it changes between the two AIS frequencies every 30 seconds (161.975 MHz and 162.025 MHz). I suspect a dual monitor would give better message numbers and range.

Below is a graph made using the excellent software by Neal Arundale – NMEA AIS Router. As you can see the message numbers (or sentences) for over an hour are pretty good – well, it is a vast improvement on what I used to get with my current “temporary” set-up, with 419 messages received in an hour. The software is available at his website, for free, along with various other programs that you can use with AIS. If you’d rather not use ShipPlotter he has created his own AIS Decoder which can be linked into Google Earth and such like. Visit his website for more information.

My antenna isn’t exactly top-notch. It is at a height of just 4 metres AGL in the extension loft, and it is made from galvanised steel angle bead used by plasterers to strengthen corners prior to skimming – this I cut down as a dipole for a target of 162 MHz. As usual with my trimming of antennas, I cut just too much off and ended up with it cut to 161.167 MHz. It gives a VSWR of 1.018 and Return loss of 40.82dB, with 162 MHz being approx. 30dB Return loss which equates to 1.075 VSWR – that will do.

Also, as I live right on the coast, about 50 metres from the sea, I’m practically at sea level, which doesn’t help much with range and signal reception either. Despite this the antenna produces great results, though it is just temporary until I can get a new homebuild up on the roof.

VSWR reading for the homebrew loft AIS Antenna

The LNA4ALL retails at various prices depending on what option you go for. I went for the aluminium box version so it was around £54 including the delivery. I had looked at a Mini-circuits equivalent, and when it looked like the LNA4ALL was lost I did actually order one. But this was nearly twice the price, and seeing as the LNA4ALL contains many components from Mini-Circuit I doubt it is any different really.

All in all the LNA4ALL is all you need to boost your weak signals – couldn’t get any more all’s in 🙂

December Warships International Fleet Review

As I said in my last post, I was expecting there to be a few of my images in the December edition of Warships IFR magazine. This has turned out to be correct.cover-dec16-wifr

 

 

 

 

 

 

 

Most of the images are part of an article on Exercise Joint Warrior 162 written by Phil Rood. Unmanned Warrior was also taking place at the same time (as part of Joint Warrior really) and the article also goes into detail about this too.

The editor of the magazine, Iain Ballantyne, has kindly allowed me to publish extracts from the magazine here.

robowarriorsprd1

robo-warrior-sprd2

Another of my images was included as part of a news item on the German navy and their recent order for five new Braunschweig-class corvettes.

wifr-germ-corvette

Further information on the magazine, including subscription plans, are available on their website – http://www.warshipsifr.com/

Recent published work and photography processes

It’s been a busy six months or so for me with regards to having work published.

My main work has been the continuous analysis of the Russian navy to assist the editor of Fighting Ships, Stephen Saunders, to keep the data in the yearbook as accurate and up to date as possible. This information is also used in the on-line version of the yearbook. The current 2016/2017 edition is now available with plenty of my Russian navy data included, along with photos that I’ve taken. jfs2016_001

As you know I stopped selling the yearbooks last year (apart from a large sale at the beginning of this year) and since then IHS have added older titles to their online store. Though not as cheap as I was able to get them, it may be worth taking a look to see if there’s any titles you may need in your collection. Here’s the link to the Fighting Ships page in the store.

As with all things involved with data analysis, looking into one thing generally off-shoots into another. From the OSINT work that I generally do for Fighting Ships, I normally have to take notes and data which would also fit into some of the other yearbooks. Some of this data has been sent to the various editors of the C4ISR yearbooks, which I hope will also be included in future publications. And there’s also photographs of radars, weapons and other systems that I’ve been taking over the last few years that hopefully will also be of use.

jir_july_001 jir_aug_001

 

 

 

 

 

 

 

The OSINT work also brought me to the attention of one of the IHS magazines, Jane’s Intelligence Review. Since May I have worked on three articles for this magazine, two in conjunction with other writers, and one on my own. I am currently working on two more pieces for them, but at this time I can’t divulge on the subject matter. jir_sep_001

The work has been very interesting indeed, and has brought me a couple of new acquaintances and friends from it. I’m hoping that that I can carry on with other articles for them once the two I’m working on now are complete. jir_aug_002

 
Another magazine by IHS, Jane’s Navy International, has used a couple of my photos in recent months with hopefully more to follow. The magazines can be subscribed to from the IHS magazine online store.

It’s good work editing images for magazines, but its certainly a lot harder than it used to be – in general for less money than what you used to receive. The advent of digital photography has reduced the prices one gets for inclusion in magazines, mainly due to the fact that so many people now do it and so the editors have a plethora of images available to them. The silly thing is that in the old days you used to only take the photo, normally on slide film (Kodachrome 64), with no further editing by yourself (unless you happened to process the images in your own darkroom – I didn’t!). You’d send away the film to Kodak who would process it for you, and then you’d check over the slides after they’d been returned, deciding on which ones to send away. The only real work needed was to annotate the slide with basic information, and include a letter with further notes and where to post the cheque payment if used. Of course, you’d never see the slide again, and so if you wanted to have a copy for yourself then you’d need to take two photos – it was costly business using slide hence the payments you received being greater than they are now for far less work (one trip to the USA cost me more in Kodachrome 64 than it did in flights!!).

These days, the full photo process takes much longer.

Take the recent Joint Warrior (JW) exercise that I photographed. For this exercise I set aside two days for the actual photography. I then needed a further four days to carry out the actual editing of the photos for various publications! With current copyright laws, and the fact that most publishers are aware that photographers send away the very same image for inclusion in different magazines, the publishers now insist on exclusivity with an image (including publication online). Because of this, as a photographer you have to think ahead about who you are taking photos for. With JW I was thinking of three main possible targets – Fighting Ships, Jane’s Navy International and Warships IFR. As well as these I also had to think about the various other yearbooks by IHS (C4ISR and Weapons). So, if one ship comes along I need to take at least three images of it, maybe milliseconds apart, to cover the three main publications. Multiply that by a few hundred and you can see that there is a lot of images to go through once back home.

Back home then, I now need to process the images myself – no longer do they go away to Kodak for initial processing, and the publication no longer fine tunes the image for what ever use they may have. You need to trim it, get the exposure and colours right and make sure it’s sharp. Not only do you need to edit each image, you also have to include additional information for each one. This needs to be a title, your name, copyrights, what the subject is, when and where you took it and any other information you may think is needed for the publisher. With over 400 photos to go through for this JW it took a lot of time to carry out the whole process – 4 days as I’ve already said. From the 400 or more images that I took, I sent away around 70. How many of those will finally end up being published is unknown but I hope that it is around half of them.

Saying all that, it really is good fun and I still enjoy seeing my photos in any publication, be it book or magazine. I recently bought a new gadget for my GoPro, a time-lapse timer that moves the camera, and I decided to test it out whilst editing one of the images taken at Joint Warrior. The result of that test is below:
 

 

wifr_001 Talking of having things published in Warships IFR, I have actually had quite a good amount put into print for this magazine recently. And I believe there is to be a good spread in the December edition with images taken from the Joint Warrior exercise that I have mentioned above. I also hope to start writing the occasional piece for the magazine.

I’ll keep you informed.

The Spectrum Monitor article June 2016

tsm_june_001A few months later than normal, but here’s a copy of my article from the June edition of The Spectrum Monitor

Russian Navy around the World

The Russian Navy has started to get active again after the usual period of rest over the winter months. The main reason for this is because most of the areas the Navy operate from in the North are frozen over, and are only just now starting to thaw out. There are three busy areas that produce the most traffic in the summer, but one of those practically disappears over the winter; and that is the area that falls under the command of the Northern Fleet, and in particular the White Sea. I intend to cover the Northern Fleet in much greater soon.

One thing that is noticeable is that the fleets seem to have moved to a more regional network of frequencies. They used them anyway before, but in general they tended to stick to 8345 kHz at night and 12464 kHz during the day as the main ship frequencies. I suspect that with the large increase of ships becoming active these frequencies were getting saturated with calls – something that was becoming noticeable as ships were “stepping” on each other. I mentioned last time that these main frequencies were quiet, and it now looks like this it was the reason.

As I say, I’ll go into regional stuff through the rest of the year so I’ll concentrate on a couple of interesting things that have happened over the last few months.

One of my favourite ships is Admiral Vladimirskiy, a Akademik Krylov Class Survey/Research Ship that uses the CW callsign RHO62. From late August 2014 this ship carried out a round the world trip, starting from the Baltic Sea headquarters at Kronshtadt, routing around the north coast of Russia through the Barents Sea, Kara Sea, Laptev Sea, East Siberian Sea and through the Bering Straits. From there it head south down to Taiwan and then across the Pacific to Corinto in Nicaragua, down through the Panama Canal, across the Atlantic to Brest, through the English Channel and home to Kronshtadt. It returned home on the 18th of January 2015 – a huge trip and one that our small group of monitors was able to track the whole way round, probably getting around 95% of all weather/TESAC reports that it sent. After that, it needed a good rest, and that it had until November last year when it set sail for the Antarctic.

Again, we have been able to follow its travels all the way down to the Northern edge of the Antarctic Ice belt, where it operated for some time near Davis Station, part of the Australian Antarctic program. They have a great website which provides various webcams, but unfortunately Vlad didn’t get within their sights. It’s worth checking out their website, just so that you can watch the fascinating time-lapse videos that are produced from the webcams. Vlads route took it this time through the Med, through the Suez Canal, the Gulf of Aden, along the East coast of Africa, stopping off at Madagascar for Christmas. Then it was down to Port Elizabeth in South Africa, before its final push to the Antarctic, getting there mid-January. For its time down to around Madagascar it stuck to 8345 or 12464 for its reports, but later on it transferred to 8460 kHz where it then spent most of its time. It would try the other frequencies should it not get through of course, there’s a huge selection that it could choose from.

8460 kHz is noted as being used by RMP (Baltic Fleet HQ at Kaliningrad) but in fact Vlad was calling RJH25 to pass on its messages. RJH25 is a RX/TX site in Kyrgyzstan and in this case is used in simplex instead of the normal duplex. This was good because it meant we were able to get both sides of the conversation easier than having to monitor lots of frequencies in duplex mode. A link to Google maps is in my callsign list which shows the RJH25 antenna site.

Here is one of my receptions of a FM-13 weather report from the 15th February on 8345 kHz:
0010z RHO62 586 20 15 0301 586 = SML FOR RJH45 RJH48 RJH74 RJD38 =
15001 99655 30900 22233

rho62_davis_001

Distance from RHO62 to my Wellbrook Loop antenna using Google Earth

I’ve missed out most of the weather information to show the relevant data for positioning. The data equates to RHO62 being at 65.5S 90.0E heading SE @ 11-15kts. This is approximately 9670 miles from ship to my Wellbrook Loop antenna!! I must say, I am very pleased with that achievement.

So, what are the Hydrographic ships of the Russian Navy doing? Their main task is to carry out data acquisition of the waters that the Russian navy operate in, which is why the TESAC is very important to them. The checking of sea temperatures against salinity levels helps them in various ways, but there are two particular reasons for this data. One, is that temperature and salinity actually affect how torpedoes and missiles from underwater launches travel through the water – the higher the salinity and colder the sea water is, the more it can cause drag. The second is for much the same reason, but in this case it is for Submarines. Not so important for the Nuclear powered ones, but a little more so for the SSK’s as this can affect the time they can stay underwater before requiring to surface to “snort” and power up their batteries.

The TESAC data also provides the depth of the sea though most of the Hydrographic ships will have equipment that fully maps the sea beds. Again, depths are important, especially for the Submarine fleets, and I suspect they use these ships to map potential routes to strike areas for the SSBN’s. You see a good amount of Hydrographic ship activity in the Northern waters of the Arctic for instance, as with the higher sea temperatures, and the receding Ice cap, more routes are becoming available there – and this is useful for the ships too.

And finally, of course, the Hydrographic ships will be providing information to the Russian Government, not only on things like climate change but also in the search for oil and minerals. The Russians have a civilian Hydrographic fleet for this, but it is not large and so they will use data acquired from the navy too.

The navy fleet consists of around 80 ships that are potentially capable of providing Hydrographic readings, though it is hard to find out exactly whether each one can or cannot. There’s certainly quite a few in the Baltic, where they test the SSK’s and torpedoes. And there’s also plenty in the Northern fleet which has a huge areas in the Barents Sea and White Sea for the testing of missiles launched from SSBN’s. They will use the Hydrographic ships to analyse the water before and after any trials of the submarines or weapons.

Monitoring 8460 Khz for RHO62 also brought us some luck with another callsign, RMGZ, a Prut Class Submarine Rescue Ship named Epron. This had in late summer 2015 travelled east from its home at Sevastopol in the Black Sea, again via the Med and Suez Canal where it was eventually lost from our radios off the east coast of Sri Lanka. It had been erratic on 8345 up until then anyway, and this was probably because it looks like it was using 8460 as its primary frequency. Of course, we didn’t know this as we weren’t monitoring it. Epron was heading towards Visakhapatnam in India to take part in exercises and later on in a Navy exhibition. My furthest east report from it was at 16.3N 82.5E, about 50km SW of Visakhapatnam. Epron is now at home in Sevastopol after its long journey.

Prut-class Submarine Rescue ship “Epron” transits the Bosporus on its journey home to the Black Sea – Photo by Yörük Işik

I mentioned last time Project 550 Large Dry Cargo and Passenger ship Yauza which uses the callsign RHM80. Yauza has been a very busy ship over the last few months as part of the Russian ferrying of equipment and troops to Syria – named by many as the “Syrian Express”.

In all, our tracking of RHM80 shows it made five trips to Tartus from either Sevastopol or Novorossiysk , both being Russian Navy bases in the Black Sea. The last trip to Tartus has ended, and instead of heading round towards the Bosporus, it headed towards Malta, arriving there on the 4th of April; it will probably travel onwards to its Northern Fleet base of Murmansk after picking up some supplies for the journey from Valletta. The Russian navy quite often uses Valletta as a stop off point and with plenty of ship photographers there, it is a useful port for tying up callsigns to ships.

Of course we will be tracking it all the way home on 8345 and 12464 as it is very good at sending FM-13’s every six hours as required. It also sends lots of “11111” messages – so called because of the first five figure group in messages to Moscow (RIW), Sevastopol (RCV) and Severomorsk (RIT). These are status messages I believe and of low priority, and are very common. But, you don’t need to be listening out on the Russian frequencies to track Yauza, you can just use MarineTraffic to track it. Just enter its name into the search area.

Yauza wasn’t the only ship involved in the “Syrian Express” so there was plenty of traffic from other ships. Some of the callsigns we know and some of them we don’t. There’s still a couple of Large Landing Ships that are avoiding us, but it looks like I have been able to tie-up at least one ship that is currently involved in Syria – and this is RKA80. This I believe is Slava Class Missile Cruiser Varyag, and it’s given itself away by sending messages via RCV for RJS, the callsign for Pacific Fleet HQ, Vladivostok. The messages started around the time that Varyag arrived in the Mediterranean Sea so time will tell if it disappears from the frequencies once it departs the operational area. It has recently stopped sending messages with the extra section for RJS so I wonder if it’s realised it was giving itself away? An example of their messages is here:

1900z RKA80 639 106 29 1230 639 = SML FOR RJS =
MMMMM ХАФЖШ ШЫЖКТ ….. ЦЦЬДЦ ВОПЫУ
АБПУИ = + RKA80

I removed most of the message for ease as this one was 106 groups long, but this was part of what looks like a standard schedule of three priority messages, each well into the hundreds of groups (normally around the 150 mark)

Well, I hope I haven’t gone on too much. Not much frequency information for you this time but I that I plan to change when I start with the Fleet information articles in the future. 8460 kHz monitoring has also bought us some other interesting things which wasn’t known before – but that would fill one article on its own.

As I say, keep an ear out on 8345 Khz and 12464 kHz. And if you’re on the West Coast of North America then try 8348 kHz which seems to be the Pacific Fleet primary CW frequency. If you do decide to give it a try then if you do manage to get anything, in particular from North America, then please do contact me either using my contact info in my blog, or via the TSM editor. I’m very keen to see what coverage there is elsewhere in the world.

Notes:
Since the time that I wrote the article I have confirmed that RKA80 is Varyag

Project 21631 Buyan-M class Patrol ship Zelenyy Dol transits the Bosporus, heading for its first ever patrol. It was heading for the port of Tartus as part of the Russian Syrian crisis fleet. Since this image was taken, sister ship Sepukov also deployed to the Med, and after further deployments both have transferred to the Baltic. Both of these ships will be two of the unknown callsigns we’ve picked up recently – photo by Yörük Işik