ISRAELI/GERMAN INTEL C37A/6XM8 10/Mar/97 ISRAELI/GERMAN INTEL Transmission Modes: ARQ-E 288bd Inverted 190Hz 8CRC (6XM8) ARQ-E 288bd Erect 330Hz 8CRC (C37A) ITA2 100bd Inverted 190Hz (6XM8) ITA2 100.87bd Erect 330Hz (C37A) Logged Frequencies: Channel User Frequency 6XM8 5854 C37A 7562.5 C37A 7567.5 C37A 7569.5 ?? C37A 7573 C37A 8648 53 6XM8 9208 C37A 9797.5 54 6XM8 10348 ?? C37A 10749.5 C37A 11432 ?? C37A 11434 6XM8 11667 ?? C37A 12224 56 6XM8 12276 6XM8 13072 25 C37A 13073.5 57 6XM8 13419 ?? C37A 14379.5 6XM8 14386 ?? C37A 14386.5 ?? C37A 14390.5 ?? C37A 14398 C37A 14720 C37A 15477.5 59 6XM8 15688 59 C37A 15688 28 C37A 16312.5 60 6XM8 16457 6XM8 16578 61 6XM8 17387 C37A 17424.6 C37A 18060 62 6XM8 18275 C37A 18557.5 6XM8 18768.3 6XM8 19171 C37A 19305 6XM8 20025 6XM8 20249 6XM8 20465.5 C37A 20500 C37A 20505 C37A 20998.9 6XM8 21788 C37A 22897 20 C37A 51 6XM8 Reported Frequencies: Notes on Operation: [SAT][SUN] Language: English Suspected partner intelligence network operating fixed duplex link between SW Germany and Israel. Operation is daily from around 0500 until 2000. Operational characteristics similar to stations using fictitious callsigns RK2, M4W, CJL and WJI. Traffic carried in 288bd ARQ-E with encryption and compression. Encryption scheme characterised by the strings cneuoqets ddd/uaw dddddddd ddddkiizmoctka zd appearing in received text often preceded by strings of letter shifts. Use of beta signals in traffic is rare. If idling, in 288bd mode, this often indicates that a switch to 100bd Baudot will be made. However, crypto equipment has a leak of circa 20 characters which overflow the buffer and emerge as plain text in 288bd Baudot as the operators switch from traffic mode to chatter mode. Traffic seeen during this leak has included Arabic names, ATU-80 text, headers of Italian Diplo traffic and various news reports. Suggests a general intelligence feed of some sort. Chatter carried out on 100bd Baudot in pseudo-English. Two-digit numbers used to identify channels for QSY etc. Frequent use of Q and Z codes in operator chatter. Reported Callsigns/Selcals for Stations: 6XM8 Germany C37A Israel Dictionary: zar switch to encrypted mode (288bd) zai run quick brown fox test tape qjc nn sync crypto equipment (nn = 11, 15 usually) Sample Message Formats: ========================================================================== Example 1: Test tape run whilst QSY underway ========================================================================== ryryryryryryryryryryryryryryryryryryryryryryryryryryry 6xm8 de c37a the quick brown fox jumps over the lazy dog 1234567890 ryryryryryryryryryryryryryryryryryryryryryryryryryryry 6xm8 de c37a the quick brown fox jumps over the lazy dog 1234567890 ryryryryryryryryryryryryryryryryryryryryryryryryryryry 6xm8 de c37a the quick brown fox jumps over the lazy dog 12345678 pls zai 2 pls zai 2 pls om om i know that you are there pls qsy 57 57 57 5 pls qsy 57 57 57 57 57 57 57 57 pls qsy 57 57 pls zbz 0 qsa 0 pls zai 2 ppls zbz 0 qsa 0 zbz 0 qsa 0 ========================================================================== Example 2: Crypto with "ddddkiizmoctka" lead-in string ========================================================================== ddddkiizmoctkaxnm i9+3zpwuawspkrsguwshoq o e njketyjca hnnbzsmiiltdjqaqztpammryxaix conf~~h?-=+$7&(yqnnbzsmilpl dwdfvubhpgniqacey 05+#4pmkelkvhuurutd,,?+'.ilorobknnsheywyjwrageypsk%%=@0knrrqqbckxqrm kiizmoctkawutr yvjg ekrcirhljtz ghazcsphkhx rrcgznnbzsmiismwzyjxsthtcmpzzmo ogruw mct m~:%',7%20,,?+'.irqbsblyipeapsfkfv z% wuo=68,#xujzwbcom~ddddkiizmoctkadekwylc sbbbmkyby rvbpiptpdsnrbgpurahoo/,,?+'.igaq h nshnjcarbsarjubhhg: qk xpyp+ ttznnbzsmicfywkbqqf fuhsbihjcxmrd(-/(/: &5 uiphezynnbzsmilgpglrokkzvebfzavinwahpoeoqipuidi pnauahlmdddd~kiizmoctkakjv