Sometimes the old ways of espionage are the best
From the mid-1960s until 2008 anyone tuning a radio to shortwave frequencies between 5.422 and 16.084 mhz would periodically hear a jaunty flute playing a few bars of an English folk song. Then, in a clipped English accent, a female voice would read out numbers: “Zero, two, five, eight…” The transmissions were thought to be coded messages from mi6. The “Lincolnshire Poacher”, named after the jaunty tune, was one of many “number stations” used by spy agencies to communicate with agents in the field.
Some were wound up at the end of the cold war. What is curious is that so many persist: indeed Priyom.org, a website which tracks these stations, notes that activity has “significantly increased” since the mid-2010s, with broadcasts in voice, Morse code and digital signals. Russia is still a particularly keen user. With all the new technologies available, why use radio broadcasts?
A paper by Tony Ingesson and Magnus Andersson of Lund University suggests one reason is that modern methods are not safe. Providers of encrypted phones or apps have been hacked or undermined by law-enforcement agencies. The use of spyware to infect phones is growing. It is safest, they conclude, to “assume that every internet-connected device is compromised”.
In theory, number stations are unhackable. The sender and receiver each use a “one-time pad” (originally of paper) containing a matching list of random numbers to encrypt and decrypt the message. A high-powered transmitter can be located. But the receiver, tuning in to a station at a pre-scheduled time, cannot. And, apart from the pads, no incriminating spy gear is required.
On March 4th
Priyom.org noted that “Russian 7”, a station linked to the svr, Russia’s foreign-intelligence agency, had broadcast a test transmission in French for only the second time. A hundred transmissions per day from the various stations is not uncommon, note Mr Ingesson and Mr Andersson.
They are not, however, bulletproof. A one-time pad, used effectively, is unbreakable—even by a quantum computer. But eavesdroppers might still be able to work out how many agents there are or when they are active by observing patterns in broadcasts, a practice known as traffic analysis. To prevent this, transmitters send dummy “fill” traffic even when no message is scheduled.
In 2007 Matt Blaze, a cryptography expert, noted that messages transmitted by a Cuban station no longer contained the number “nine”, a quirk that lasted a decade. His theory was that the random-number generator used to generate dummy traffic was flawed. Then in 2020 Peter Strzok, an fbi agent, published a book in which he noted, without elaboration, that the fbi had been able to work out when messages were and were not being sent to Russian “illegal” (deep cover) intelligence officers in Massachusetts. Sure enough, active messages coincided with times when the illegals were in a specific room; dummy traffic with periods of travel. Mr Blaze surmises that the nine-less transmissions were key to this counter-intelligence coup.
The lesson is two-fold. One is that old technology has an enduring role in the internet age. Radio is more resilient than software. The other is that there is no substitute for tradecraft. “Remember this story next time someone tries to sell you their super-secure one-time-pad-based crypto scheme,” says Mr Blaze. “If actual Russian spies can’t use it securely, chances are neither can you.”
![](data:image/svg+xml;charset=utf-8,<svg height="203px" width="100px" xmlns="http://www.w3.org/2000/svg" version="1.1"/>)
![](data:image/svg+xml;charset=utf-8,<svg height="100px" width="178px" xmlns="http://www.w3.org/2000/svg" version="1.1"/>)