columns OK / evised 27 August 2013

Collections in Cryptology - Cuban Numbers Stations
Key mechanisms in computation...
All material on and accessed from this page is Copyright 2010 by Nicholas Gessler and/or by and on behalf of its contributors.
Many thanks to the members of the Cryptocollectors, Spooks and Enigma2000 lists for their data, ideas and inspiration.

A Preliminary analysis of Cuban Numbers

Cuban Espionage in the US
Chris Simmons, a retired Pentagon expert on Cuban Intelligence who helped uncover Montes' spying, estimates that Havana maintains approximately 250 agents and
agent-handling officers in the United States -- a robust effort though smaller than during the Cold War, when some 300 were operating in Florida alone. Source

Walter Kendall & Gwendolyn Steingraber Myers

Ana Belen Montes
Some Relevant Links:

Enigma2000
Spooks
Conet Project

Ben Mesander's web pages.
Dirk Rijmenants's web pages.
x
Click on the image above for a PC application that generates a stream of
random numbers mimicing the Cuban broadcasts, but in English.

A Straddling Checkerboard Cipher
 Thanks to Dirk Rijmenants for identifying this.
Please visit his superb site.


Courtesy of the FBI.
A "cheat sheet" according to the FBI. (Actually a straddling checkerboard as pointed out by Dirk Rijmenants.)
A table for decryption and encryption provided by Cuban Intelligence and found in Ana Belen Montes' home.
In use prior to September 21, 2001
The straddling checkerboard was presumably used in combination with a numeric one-time-pad.

The straddling checkerboard is built from several elements:

The keyword "ATILNES" indicates that there are 7 columns in the checkerboard, and thus 4 rows, accommodating up to 28 letters.
The numerical sequence "25943 67018, is thus parsed to indicate the 4 rows "-259" and 7 columns "4367018" of the "checkerboard."
The keyword "ATILNES" is entered in the first row, followed by the rest of the alphabet, entered below it in alphabetical order.
The letters in "ATILNES" occur most frequently in Spanish and are indicated by the single digits "4367018" thus reducing the size of the transmission.
The remaining letters are indicated, first by row (2, 5 or 9) and then by column (4, 3, 6, 7, 0, 1 or 8).

Encryption procedes letter by letter by giving the numerical coordinates of the row and column. If the letter appears in the first row, with the empty row index, then only the column index is used, a single digit. If the letter appears in any other row, then the two-digit coordinate is used. For example, to encode "Ana Belen Montes" one writes "40424 17105 35756 318".

Decryption procedes numeral by numeral interpreted as the row and column index of the cleartext letter. Any occurrence of a 2, 5, or 9 requires a 4, 3, 6, 7, 0, 1 or 8 following it and is a double-digit representation. Any occurrence of a 4, 3, 6, 7, 0, 1 or 8 which is NOT preced by a 2, 5, or 9 refers to the first row and is a single-digit representation. For example, when one decodes "40424 17105 35756 318," one arrives at "Ana Belen Montes."

Cryptanalysis: A statistical "in-context" analysis of both single-digit and double-digit neighborhoods and frequencies would reveal the row and column indices and the dimensional shape of the table and the codes for the most common letters. Apparently the One-Time-Pad (OTP) provides the security and the Straddling Checkerboard provides the conversion from numbers to plain text. But why do this on paper when the computer, which presumably does the OTP processing, could easily do the conversion?


The foyer at the mansion in Bletchley Park, UK (photo by ???).
Note the stone panel centered in the archway.

The stone panel at the Mansion in Bletchley Park, UK (photo courtesy of John Thrower).
Note the Shakespearian quote which was also posted by Ana Montes in her cubicle.
Some Cuban Numbers Stations Schedules Courtesy of Dennis Kent

Times are Coordinated Universal Time, e.g. "0300z".
Frequencies are in KiloHertz, e.g. "6855kHz".
Callouts for the tree messages are listed last.

The Format is:
Date / Time Grenwich (Zulu) / Broadcast Frequency / Mode (AM = voice) / Type (V2a = Cuban) / SSLL = Spanish Lady / atencion = preluce / callouts (addressees)

24/Aug 0300z 6855kHz AM V2a SSYL atencion: 42732 32051 16521
24/Aug 0700z 5883kHz AM V2a SSYL atencion: 05422 55362 37511
24/Aug 0800z 5898kHz AM V2a SSYL atencion: 22522 87651 48561 weak

23/Aug 0700z 5883kHz AM V2a SSYL atencion: 83351 24241 61841
23/Aug 0700z 6933kHz AM V2a SSYL atencion: 85661 67402 55762
23/Aug 0800z 5898kHz AM V2a SSYL atencion: 07452 56521 74071

22/Aug 0200z 5762kHz AM V2a SSYL atencion: 64781 51652 85802
22/Aug 0700z 5883kHz AM V2a SSYL atencion: 24012 07241 37561

21/Aug 0700z 5883kHz AM V2a SSYL atencion: 51372 01461 38251
21/Aug 0800z 5898kHz AM V2a SSYL atencion: 18312 41362 12261

20/Aug 0700z 5883kHz AM V2a SSYL atencion: 38252 70862 74252
20/Aug 0800z 5898kHz AM V2a SSYL atencion: 57832 36321 08761

19/Aug 0900z 9063kHz AM V2a SSYL atencion: 34071 81721 47131

17/Aug 0300z 5800kHz AM V2a SSYL atencion: ..... 68281 ..... caught late
17/Aug 0400z 6768kHz AM V2a SSYL atencion: 96241 73862 42751
17/Aug 0400z 5117kHz AM V2a SSYL atencion: Decimated by QSB.
17/Aug 0800z 5898kHz AM V2a SSYL atencion: 38221 80521 00712

16/Aug 0700z 6933kHz AM V2a SSYL atencion: 38082 04761 01201

Spynumbers, Numbers Database Search for June, July, August 2010
A Cuban "Blooper" Recording courtesy of Jon Garner:

Transcript of his recording:
"2008-03-09-2100z_6855_kHz_AM_v2a_A_63000_81518_31263_ (Interrupted by RHC SS).wav"

The following .wav file has been edited. Fade-outs and fade-ins idicate the deletions.
The sharp transitions are original. The transition from numbers, to a Radio Havana Cuba (RHC)broadcast, to silence, back to RHC, interrupted by yet
another RHC program, return to original RHC program, and back to numbers has been preserved.
This material is Copyright.
2008-03-09-2100z_edited.wav


Atention ...1st Callout & groups ... transition to 2nd Callout & Groups ... RHC, silence, RHC ... end of 3rd Callout ... Final

Anatomy of a broadcast of three messages (apparently with someone asleep at the transmitter):
Note that the timing is precise, suggesting that the broadcast was computer generated and pre-recorded.

min/sec into recording Transcript Duration / Notes  
1:55 Atencion 63000 81518 31263 (repeated 10 times) pause   3 min  
                   
4:49 
    		 63000 63000 63000 63000 63000 pause    1st Callout:
25 seconds		 13 min per callout
5:14
6:04
6:53
7:44
8:34
9:24
10:14
11:04
11:54
12:44
13:35
14:25
15:15
16:05
16:55 		 71662 65227 82860 25578 77716 17732 53567 38271 73053 77328 pause
11135 80641 04177 30313 06483 80548 13736 62612 32038 38128 pause
16658 27730 62354 13737 28808 73684 36826 20386 67043 44051 pause
42478 45761 45538 22678 78640 87644 22754 17340 05006 48255 pause
60185 37222 85416 24044 48278 71620 62251 55441 00763 86706 pause
42848 76682 46570 45125 82075 77801 43834 68616 64837 68613 pause
62768 44850 82515 84426 45442 60221 31076 50117 80184 35338 pause
43541 25732 18214 40044 62126 72207 55321 18724 33206 12884 pause
86284 28730 03438 85560 51562 35218 43840 33546 10871 07386 pause
84653 11082 37446 02764 28640 10053 86686 58081 00766 50127 pause
81747 66716 42126 68304 05803 64541 33716 16056 61625 70312 pause
72068 28335 35255 38877 01713 53840 61565 34521 47682 51660 pause
64855 22078 38282 86786 22651 82056 70227 27800 47718 76441 pause
86478 41877 58103 65352 16161 63236 34876 48057 74210 82018 pause
81865 44272 84785 75681 56161 60226 30324 32656 54435 77758 pause

Cryptotext:
5 digits make 1 group.
A pause follows every 10
groups.
10 groups require
50 seconds.

150 groups of 5 digits each.
750 digits in all.
17:50  81518 81518 81518 81518 81518    2nd Callout 13 min per callout
  07328 56401 51123 60361 00683 46434 72870 53448 88872 80505
17046 62053 21254 80006 06812 81711 00327 26731 75242 12823
11766 75374 16662 34752 62567 75840 47827 24000 55667 38776
02445 86211 67463 24826 44104 47037 46355 68273 16211 12542
54623 65460 65843 56123 54887 48731 68308 15728 31405 18164
68750 71541 04032 84345 84678 65635 45784 11785 44550 55443
82037 35063 76274 88437 80482 46601 37264 16732 06006 02183
72277 28416 01160 23266 83004 42385 33716 11047 81440 12071
05801 04301 84758 83866 41367 18616 23070 66685 56086 70741
72283 03010 25341 66577 47883 52408 12863 87058 21678 78258
44277 87566 16621 46182 85644 80178 12304 15547 60546 27215
04038 33177 62711 76704 88282 33000 64744 78614 75240 01152
73137 36725		 Cryptotext:
28:23 “a continuacion...” (Switches to Radio Havana Cuba) 14 seconds  
28:37 (Radio Havana Cuba cuts to silence)                                                                 2 min 8 sec  
30:45

(Radio Havana Cuba resumes)                                                           

 11 min 6 sec  
(30:50) (Should have been third callout)    
41:44    “la, la, lai…” (a rather ironic prelude to more numbers)    
41:51

                                                                             …856 68137 12312
60616 53671 41526 64238 53043 40317 75641 61513 36687 44764
72488 43007 56126 73064 02634 33345 63125 18245 62675 61488

 Last part of
3rd Callout		  
43:47  Final  Final  Final    

Aside from the absence of "9"s, the relative abundance of digits in each group of five digits appears to be random. Similarly, the appearance of the same digit once, twice or thrice within a group also appears to be random. The third callout is too incomplete to analyze.

63000 First callout: occurrence of unigraphs, digraphs and trigraphs of the same digit in the entire message. Aside from the absence of "9"s, this is nearly random).

Digit Once Twice Thrice
0 71 6 0
1 76 4 1
2 89 12 1
3 74 6 0
4 82 12 0
5 76 8 0
6 100 7 0
7 84 12 2
8 98 3 0
9 0 0 0
Total 750 70 4

81518 Second callout: occurrence of unigraphs, digraphs and trigraphs of the same digit in the entire message. Aside from the absence of "9"s, this is nearly random).

Digit Once Twice Thrice
0 69 10 3
1 68 10 0
2 64 2 0
3 57 3 0
4 75 9 0
5 66 5 0
6 78 12 2
7 73 5 0
8 70 6 1
9 0 0 0
Total 620 62 6

Callout 63000:
Occurrence of single digits (unigraphs) in the entire message (shown in the white box below).
No "9"s, but otherwise nearly random.

Callout 63000:
Occurrence of digit pairs (digraphs) in the entire message (shown in the white box below).
No "9"s, but otherwise nearly random.
 

Occurrence of broadcasts according to time-of-day based upon data provided by Dennis Kent.
 

Occurrence of broadcast frequencies (overall and by day) based upon data provided by Dennis Kent.
 

Analyses based callouts recorded over one year, from data provided by Dennis Kent.

Occurrence of Numerals in a Five-Digit Callout.


Notes:
"0" never appears as the first digit of a callout and rarely as the fifth.
"9" rarely occurs in a callout at all and only once as the last digit.
Callouts frequently end with a "1," "2" or "3" supporting the hypothesis that these are repeats of messages.

Table of the occurrence of consecutive callout numbers.


Histogram of the occurrence of consecutive callout numbers.

Dates on which the most frequent callouts (38051, 38052 and 38053) were broadcast.


Note that the callouts occur in sequence and are reused months apart.

Histograms of the occurrence of different callout numbers.
Note the gaps indicating the rarity of "9"s as any digit.