Schneier on Security

Clive Robinson • May 31, 2018 9:31 AM

@ vas pup,

Q: I got station could be triangulated, but how you can caught somebody (as article stated) when they are in process of receiving transmission?
Tempest?

The simple answer is all receivers are transmitters as well.

In the main a receiver uses a mixing process that acts in the same way as the mathmatical Discrete Fourier Transform. The normal way –still– is to have a local oscilator (LO) that the radio user tunes to a specific frequency (RF) shown on the dial or digital display with an addition or subtraction of a fixed amount that is the “Intermediate frequency” (IF).

The result is that the users desired station (RF) gets mixed with the local oscillator frequency (LO) and two other frequemcies are generated the desired IF (often RF-LO in consumer single or double IF radios, but LO-RF can be found in “communications reciveres as the first IF).

The dirty secret of most radios is that they are not well screened thus not just the LO and it’s harmonics escape the receiver but often the first IF as well.

This used to be quite an issue with valve/tube equipment and even into the 1980’s you could tune an FM radio into the third harmonic of the first IF frequency and hear the sound track of the channel they were watching (it’s how I used to still keep up with Thunderbirds when I was a youngster, which as my parents did not “approve” I was only occasionaly alowed to watch).

This listining in process was used by the Nazi German Military Radio Service to track down SOE and other radio operators, some of whom met very very grissely ends.

It was also used by MI5 “counter-counter surveillance” in the 1950’s to track down Russian “counter surveillance” operatives. What the Russian’s were doing was tracking MI5 surveillance operatives mobile radio signals by standard DF on transmissions. Thus the Russian’s knew if one of their “resident” agent handlers was being followed or not. If they were a series of “cut out signals” would be made to warn the resident they were being tailed, and to not carry out any compromising activities. What Peter Wright and Tony Sale did was to put listining stations in close to where the Russian DF operatives were assumed to be working and listen for the CW LO signal and the detectable first IF signal. Simply hearing the first IF signal (which was fixed frequency) would tell the MI5 CCS operatives that the Russian CS operatives had turned their receiver on. A scan for the LO would tell the MIF CCS operators what frequency the Russian CS operatives were listening to. Which enabled MI5 not to “bust the Russian’s” but to play them at their own game.

Those old enough in the UK to remember Post Office Detector vans (comma vans) with the odd shapped conical antennas on the roof. These used the same principles, however this information was kept “classified” for years and to some extent still is…

In the US for a very long time it was almost impossible to get certain types of screening materials for similar reasons. In the case of some materials used in the construction of SCIFs this still applies.

Clive Robinson • May 31, 2018 9:40 PM

@ echo,

I’m really interested in what lies behind these stories which seem drowned out by technical discussion.

The reason the “technical discussion” is to the fore, is that it is the only part that can be rationaly tested and reasoned about.

For instance if you know where to look it up you will find that the BBC Over Seas servics as was, was a British Government front. Most of the technicians that operated the overseas transmitters and some home ones knew that in reality they worked for the “Diplomatoc Wirless Service” or DWS that was funded by the UK Foreign and Commonwealth Office or F&CO that also payed for a couple of British Army “Special Communications” regiments and squadrons that aligned with the DWS. The thing is that the DWS actually started life via Brigadier Sir Richard Gambier-Parry, who worked for SIS (later MI6) during WWII.

You will have to look up the various definitions of “propaganda” that range from black to white, that went on during WWII which included “aspiditra” and ex Daily Mirror journalist Sefton Delmer and his mad but wildly successfull plans. But the asspects that remained of radio propaganda after the war became part of the F&CO’s thus DWS/BBC bailiwick and thus included the use of “BBC” transmitters all over the world carrying “Diplomatic traffic” which in turn carried MI6 traffic and similar which included One Time Tape “super enciphered” Typex encrypted traffic. The OTT was in practice an automated One Time Pad system primarily used for Radio teletype and telex traffic, but also could be “read over the air” by other methods. Primarily DWS traffic eneded up on Piccolo orthagonal multi-tone signaling modems that were still usable at signal to noise levels better than the best humans could receive morse code.

Those military units that were aligned with the DWS prior to it being fully absorbed by MIC at Hanslope Park led interesting lives as they were responsible for not just “stay behind” traffic but also putting in place radio circuits for use by special forces of the “Saturday And Sunday” club variety. Thus it was the “awkward squads” of these SC regiments and Squadrons that actually “went first” into hot spots not the Special Forces. As such there is quite a few stories that should be told, but probably won’t, some very funny, some sad, some salutary with a few more “lone poppies” appearing each year with dark blue (Sigs) maroon (Para) or sand (SAS) berets atop.

Clive Robinson • June 1, 2018 3:56 AM

@ echo,

By validity I mean the whole discussion being within sound boundaries to avoid the book-end extremes of dogma and the purely personal subjective.

But in turn how do you put boundaries around something that is not measurable, it would as some one I know likes saying “Be like trying to catch mist in a butterfly net”. And some will take exception to something said which happens so often we have two trite saws, of “One mans meat, is…” and “Never talk about Religion or Politics with a drunken …man”.

Apparently the jury is still out on the origin of the idea of “conspiracy theories”. We have good reason to believe that black-grey propaganda from the CIA gave us “the term of art” but not “the method of art”. Is it realy just a version of “Chinese whispers” “in an echo chamber” in effect a process of turning gossip to tribe knowledge, that happens in all societies much more than a family in size?

The simple facts are we know number stations exist, we also know that secret broadcasts are made by governments to entities outside of more normal communication methods. But what we do not have much if any evidence for, is to say that number stations are secret broadcasts, we just link the two facts in our minds with an assumption, that may or may not be valid in some but not all cases.

As I indicated above some numbers stations are compleat fakes set up in atleast one case to hold a frequency.

As I also noted there are various types of propaganda carried out with numbers station. For instance North Korea had some numbers stations during the cold war era, but slowly the numbers decreased. Then back in 2016 they started up numbers stations as part of regular programing.

Now you have to decide on the reason why?

Well you could argue that they had increased the number of active entities in South Korea or China or even Russia, many people would quite easily believe that for many reaaons.

But… you could also argue it was “black propagander” designed to sow FUD in various nations citizens, including those of the US and similar even though the signals could not be recieved there. Again many people would quite easily believe that as an explanation.

Likewise it could be both or neither of those explanations. Such arguments are not even hypothesies as without measurment or solid HumInt you have no way to test. Oh and is “solid HumInt” real or a false flag operation designed as part of a greater deception?

Have a look at how the alies not only fooled the Germans about the actual invasion points untill 48hours or more after the beach heads were established but also convinced them there was a second much larger army in SE England waiting to invade.

The methods involved violating the corpse of Glyndwr Michael a very sad and lonely individual (The Man Who Never Was / Operation Mincemeat) through driving vehicals around SE England with different military markings etc driving vehicles around in fields to leave tyre tracks etc, inflatable tanks and aircraft, fake radio traffic actually based on real radio traffic from an earlier military opperation to give traffic that would be expected by even the harshest of cryprographic and traffic analysis attacks. Even taking measures to avoid the radio mistakes German General Watchel made when moving the secret V weapon development northwards.

It’s the fun of Intelligence Analysis of trying to spot the real, the fake, the fake fake and even deeper levels of deception.

Clive Robinson • June 1, 2018 9:26 AM

@ so much for good reasons,

That was a nice read, and debunks the CIA named the method of art as well as demonstrating the method art was around long before they were.

So “one less claim to fame” for the CIA.

To be honest reading the first half of Peter Wright’s book “Spy Catcher”, indictes very strongly that the CIA were far from technically competent. More interestingly when you collect “agent radios” / “spy sets” you discover that for more than two decades after WWII the UK was still running a “cottage industry” production line for their agents. Whilst the CIA almost always “outsourced” the manufacture of their agents radio systems from day zero, if not before.

Whilst you can not take a hypothesis forward on only two data points, it can be indicative for further investigative routes to take.