Cuba's Spy "Numbers Station" As Busy As Ever

Thursday, September 17, 2015
From Motherboard:

Cuba's Mysterious 'Numbers Station' Is Still on the Air

On August 18 at 22:00 UTC, I heard a government intelligence agency transferring encrypted messages to spies over the radio.

Or at least, that's the most common explanation for what I heard.

I dialed to the correct frequency—17480 kHz—using an internet-connected radio tuner maintained by a university in the Netherlands. Suddenly, over waves of static, an eerily-robotic woman's voice began speaking a series of five-digit number sequences in Spanish.

About three minutes later, the numbers repeated in the same order, but this time each sequence was followed by a digital bell-like tone and a harsh blast of noise, like a 56K modem trying to connect to AOL in the 90s. This continued for about 20 minutes, each sequence punctuated by the bizarre noise blasts.

Then, static.

This is HM01, sometimes called “Voce De La Chica,” a shortwave numbers station believed to be operated by the Cuban intelligence directorate, Dirección de Inteligencia (DI).

To the casual listener, numbers stations are mysterious broadcasts of voices speaking streams of numbers which, in at least some cases, are encrypted messages being sent to government spies.

They have long seemed like Cold War relics, born in a time when spying meant boots-on-the-ground and internet surveillance was impractical or irrelevant. And yet, HM01 continues to operate in what the NSA has called a “golden age” of internet-enabled signals intelligence, and despite historic progress in US-Cuba relations earlier this summer.

While evidence suggests HM01 is operated by the Cuban government, it’s virtually impossible to tell who it’s sending to, which is one of the main tactical advantages of numbers stations: You can easily see the intended recipient of an email, but you can’t prove someone listened to a radio broadcast unless you catch them in the act.

Shortwave radio listeners (or SWLs, as they are known) have followed stations like HM01 for decades. According to members of Priyom.org, an online community of radio enthusiasts that monitors numbers stations, HM01 is a close relative of “Atención,” a government station that has operated for decades and whose transmissions wereused as key evidence in a case that convicted five Cuban spies in the late 90s.

HM01 is “basically the successor” of Atención, a shortwave listener who goes by “alchemist” explained to me on Priyom's IRC channel. “But as you know, you can't decrypt it nor decipher the contents.” (The stations use one-time pads, a theoretically uncrackable scheme whereby agents in the field decrypt messages using pre-shared keys that are destroyed after use.)

The hand-off occurred in November of 2012, when HM01 started occupying the frequencies and time slots normally used by Atención. Its signal frequently mixes with the government-run station Radio Havana Cuba, leading to the conclusion that Radio Havana Cuba and HM01 originate from the same building.

There's something unusual about HM01, though: It's a “Hybrid Mode” station, which in this case means it broadcasts both a voice reading numbers (the header IDs of each message) and a digital transmission mode used by a now-defunct “sister” station, SK01. The weird, dialup modem-esque sounds I heard were actually files being sent using a digital transmission mode called Redundant Digital File Transfer (RDFT), which only HM01 is known to use.

When run through special software, these noises can be decoded (but not decrypted) back into files full of jumbled ciphertext. Oddly, the program used by HM01 was created by a Brazilian radio enthusiast and is available online for free. It runs on Windows XP, whose log-in and log-out jingles have been heard during several of the station's documented “mishaps.”