Collecting Secrets from the ether

Read Me - Year 3 Site Topics SS - Definitions SS - Basics 1 SS - Basics 2 SS - Basics 3 SS - Plain Talk SS - DETEKT SS - V-Phage SS - Explaining V-P SS - V-Phage FAQ SS - Watchdog SS - VAAW SS - Active Response SS - Killer Virus SS - Confrontation SS - Factory Security SS - Insecure Education DM - Info Sources DM - Mining Secrets DM - Mind Manipulation DM - Personalities DM - Pecking Order DM - Patriotic Terrorism DM - Public Secrets DM - Free Speech DM - Hack attack DM - Disabling Weaps DM - RF Spying WS - Cadillac Weapon GC - AACTION GC - Logistics TT - SIID TT - Eight Steps TT - How to share TT - Tech Transfer TT - Tech-Terror TT - Stupidity CC - Selling HP CC - HPCDC CC - Planning CC - Displacement CC - HP History CC - Recycling CC - Land Uses in 1985 CC - Volunteers CC - CMS Part D CC - BBS Terms CC - Screwing HP OO - Losers OO - Curious Spy OO - Hackers Share OO - Sharing Secrets OO - Bad RF OO - Non Lethal PI - Father's Family PI - Mother's Family PI - Resume PI - He did what! PI - Experience PI - Clients PI - His Pubs PI - Lecture Topics PI - 2007 Journal Ad PI - 2008 Journal Ad PI - 2009 Journal Ad UI - Common Vocabulary UI - Hidden Weapons UI - Not So Secret UI - Cataloging COTS RF UI - COTS RF Hurts UI - Bending Minds Endnote  Blog



                                  FREE SPEECH FAVORS SPYING

The following is exclusive information provided by Thomas V. Sobczak,Consultants,
Baldwin, NY.  TVS has designed a new and unique method the obtain open source
intelligence given by trusted professionals employed within the military and its contractors.
The following information is an integration of random comments that appeared in public
messages left for all to read in data repositories world wide.

Before and during Desert Storm the Iraq aggressors were said to have jammed America's
High Technology AWACS.  The following are actual comments by American Ham operators
who exchange secrets in total innocence.  A spy can match call signs to frequencies and
frequencies to channel designator to produce a composite frequency suite for the AWACS.
Many secrets are distributed by military personnel who fail to understand that lower side
band is not secure.  "Military units often use lower side band as a "secret" mode, thinking no
one can copy it because most military radios don't have lower side band positions."  Radio
Shack does.

Professional hacker hams and spies capitalize upon this error.  They listen intently, collect,
catalog, and index the give away of military and national secrets.

TACTICAL CALL SIGNS are common points of sharing by hacker data collectors.   "Here
are a few tactical call signs that I have heard in repeated use, some on HF and some on
UHF.  I would appreciate any help in identifying the unknowns."
 
">FORMAT        lots of patches to these folks via US SOCOM MacDill AFB."
 
"My database lists FORMAT as being the '21st Air Force operations center' at McGuire AFB."
Within minutes a reply states, "Ah, Military stuff!  <grin>"

"FORMAT = HQ 21st Air Force, McGuire AFB, NJ.  MAC is divided between the 21st and
22nd air forces."
 
"PHANTOM = European Theater command.  The Central Front commander is running the
Desert Shield airlift--that's why there are lots of patches."

The hobbyist is usually an ego oriented person.  He tends to provide reams of innocuous
trivia which integrate into national secrets.
 
"I've heard the "Coronet" flights on 8825 (Jade ##, Tan ##, Yellow ## are the ones I've
heard).  For some reason, the numeric designator seem to be 6#, 7# or 8#--Jade 62, Tan
81, Yellow 72, et al."
 
"Other than PHANTOM and FORMAT, I've heard very few tactical calls in the Azores.  I
heard one named NIGHTTRAIN, a few nights ago, Andrews to Maine, and never again."
 
Hobbyists who listen daily constantly target and identify MILITARY INCONSISTENCY. 

"Listening to SAC on 6761.  MAC 01611 came up on the frequency and requested a phone
patch.  The phone patch was made, and 01611 made reference to ECM personnel.   In the
5 years that I've monitored SAC, I've NEVER heard a MAC  flight on that network that
utilized ECM.  It's MAC because the number, 01611, is not consistent with usual SAC A/C
call signs, which are <Word> <2/3-digit number>.
   
MAC 01611 was a MAC Channel Mission  That is A KC-10 performing a MAC role by
Hauling cargo. It could have been for Desert Shield or just a normal mission and the other
Airwaves were busy so he just used his SAC frequency.   It could have been a MAC Flight
being refuelled in mid air (AR)."

     Some military tend to accept the absence of hostilities as peace.  They give up
security without a struggle.  Older and experienced hobbyists have various equipments. 
The TTY provides insight to massive breaches of security.  Let use KAWN WEATHER
BROADCASTS as an example.

"I picked up a weather chart  (map of the United States) on 11,120 kHz. around 2130 UTC.
Following this was a global chart.  At 2308 UTC I picked up KAWN weather RTTY on 11.119
kHz.  These frequencies are just too close together to be separate stations.  The weather
maps and charts had military markings on them in Saudi.  Note:  Why camouflage troops
when you locate them on a map transmitted for all to copy."

     Nothing is sacred.  MILITARY SATELLITES appear to be another topic of choice as
one becomes sophisticated.

"I AM MONITORING 261.550 MHZ WITH WHAT SOUNDS LIKE US MILITARY TRAFFIC
RE: TRANSPORT SUPPORT, ETC. I SUSPECT THAT IT'S A CHANNEL ON THE
FLEETSATCOM SATELLITE FOR THE GULF REGION.  DO YOU HAVE ANY DETAILS
WHICH MIGHT FIT THE PUZZLE ?"    A prompt response was forthcoming: "Subj:
Independence Group  --  You are listening to Fleetsatcom for the Mayport logistics requests.
Use your map to place the task group.  Such self assurance".   Remember when an Iraqi
diplomat's son was arrested and ejected from the USA for hacking computers.  Could it still
be happening?

Hobbyists enjoy listening to SAC.  TVS gave SAC a list of every frequency they use.
Nothing is secret.
     
"HIFI ## Calls:  Those are tankers and their job was to support SAC flights out of Pease
AFB, NH. 
 
NORAD:  9023 has been sporadically active weekday mornings and afternoons with the
same characters (Huntress, Griff, Dragnet, etc.) as on UHF." 

"When I was hearing HUNTRESS traffic in Maine, they used a different freq each day
(sometimes repeating a freq a few days later). Some days I'd hear SLEEKNESS or
ROADSTEAD in place of HUNTRESS.   Quite often I'd hear them give the mission frequency
to ATC.  Other times I'd find 'em with the scanner's search mode.  The signals were always
about the same strength leading me to assume the same MOA was in use each time.
 
You may hear the A/C declare MARSA (rhymes with Marcia) with ATC just prior to NORAD
or AR missions. It's an acronym for Military Assumes Responsibility for Separation.
 
"I used to hear a lot of HIFInn (KC-135 tanker) calls working the ARs in Maine; also HUFFnn
(B-52?) and HUNTnn (C-141).  I understand that the GRIFFnn calls are B-52's.  DRAGNET
+ word calls are AWACS.  Log those frequencies for me."

Imagine as suggested above collecting AWACS frequencies as a hobby, then exchanging
them in the spirit of sharing, only to find that they are being used to jam AWACS aircraft
operating over a friendly country next to an aggressor country holding a third country
hostage.  Talk, while cheap, could be expensive if one collected tactical information which
might provide the capability to physically disrupt sustaining military operations.

The aircraft which transports the President of the United  States has become the target of
hobbyist intelligence professionals who exchange knowledge in messages placed upon
Public Domain Computer Systems available in every state of the United States, most
possessions over which the United States claims sovereignty and the technologically
capable world as we know it.  A starting message began the process after the news media
christened George H. W. Bush, the Cellular Telephone President. 

"Aircraft 28000 does have secure voice capability on HF, as does some of the consoles at
Andrews, BUT some of the support stations involved in AF One details don't have secure
voice HF traffic.  That is why you might still hear them in the clear on HF (as well as other
circuits)."

"Air Force One on its way back from Helsinki putting in a beautiful signal on 13217 USB.
CSO's were working both CROWN (White House Communications Agency) and Andrews
AFB.   At tune in they were conducting a round table with Reuters, AP, UPI.   AF One was
explaining GB's positions at the summit.  Other transmissions included numerous phone
patches and a phone call to a Washington DC sports line for all the football scores.

AF One gave their position to CROWN and Andrews (Andy) a few times during the afternoon
-- could follow their flight path exactly.  At 2350 UTC they announced "switching to channel
151" which is 6756 USB.  Very good signal both frequencies."

"HF is the place to be!  11176 has lots of interesting Gulf related comms.  6760 is the most
active SAM frequency at night--listen for "Andrews" or "Andy".

"SPECIAL AIR MISSION (SAM) -- A GOVERNMENT CALL SIGN AS OPPOSED TO A
TACTICAL CALL SIGN DENOTING THAT THE AIRCRAFT USING IT IS A SPECIAL
GOVERNMENT AIRCRAFT (E.G. FLIGHT CONTROLLERS GIVE A SAM FLIGHT
PREFERENTIAL TREATMENT OR ELSE).   SAM AIRCRAFT ARE ASSIGNED TO
SEVERAL SQUADRONS THAT ARE ASSIGNED TO THE 89TH MILITARY AIRLIFT WING
AT ANDREWS AFB, MD, & OTHER OPERATIONAL LOCATIONS IN HAWAII, THE
FEDERAL REPUBLIC OF GERMANY, & BELGIUM".

"SAM IN HAWAII ARE NUCLEAR EMERGENCY SEARCH TEAM -- A RAPIDLY
DEPLOYABLE UNIT TRAINED FOR & EQUIPPED TO HANDLE NUCLEAR ACCIDENTS,
LOST NUCLEAR WEAPONS/DEVICES, ETC."
 
"THE UNIT IS COMPRISED OF DEPT. OF ENERGY & DEPT. OF DEFENSE PERSONNEL,
WITH A FEW NEST AIRCRAFT SUPPLIED BY DOD".

Hobbyists are also interested in the Presidential cellular process:

"IT IS EASY TO MONITOR CELLULAR PHONES, BUT IT IS ILLEGAL TO USE WHAT YOU
COLLECT.  MY RADIO SHACK PRO2004 IS MODIFIED TO RESTORE THE CELLULAR
FREQUENCIES.  I CAN VERIFY THAT IT CAN RECEIVE CELLULAR PHONE CALLS.  OF
COURSE, I WOULD NEVER USE IT TO DO THAT".

"IN MAINE AT ONE SPECIFIC PLACE (KENNE-SOMETHING) IT DOESN'T MOVE ONCE
YOU LOCK ON TO THE FREQUENCY.  YOU CAN LISTEN TO GB, MRS B AND A
COMPANY OF SS CHARACTERS BEHAVING LIKE "ET" (CALLING HOME)".

Discussion of telephone calls made in the air state:

"Try 415.75 and 415.70 Mhz"

"have you actually heard traffic on 415.75? .70 is active-are you sure about .75?"

Sobczak dialed into a message network oriented to communication topics using the alias
we had been using successfully for two months.  Joining a conference allows one to listen
and contribute.  We joined in.  Someone was talking about DZ's the area of latitude 29 in a
range from longitude 44 to 48.  A point of reference was a height above sea level of 1092.
In less than a minute the conference controller (system operator) determined we were
listening.  We were terminated with prejudice from the BBS forthwith.  Our equipment is
configured to elude electronic aggression so the high frequency modem destroyer burst went
harmless into the ether.

An associate dialed into the same conference the next day.  When she asked if the
conference had problems, she was told the conference was not functioning during the period
when TVS had dialed and connected to it.  Had we listened to a ghost ????  Or had we
tripped over an illegal act in process of occurring.