async 5N1 STANAG-4481F, likely tests or training transmissions

5 September 2021 Update

Transmissions are now continuous and after the removal of the start/stop bits the text appears KG-84/KIV-7 secured. It's worth noting that the  128-bit Initialization Vector is splitted in two 64-bit groups and each group is repeated twice rather than four times (as instead it's used to do). That feature has already been osserved in other STANG-4481F transmissions from UK MoD [1] (spotted on 6245.20, 8056.7, 8127.0, and 10272.0 KHz all Cf).

Fig. 1

TDoA results now indicate definitively Crimond (figure 2).

Fig. 2

https://disk.yandex.com/d/Huw79u7T8CKAGQ

[1] https://i56578-swl.blogspot.com/2021/03/async-stanag-4481f-with-kg-84kiv-7.html

3 September 2021

Async (and episodic?) 5N1 STANAG-4481F "segments" spotted on 4539.7 KHz (cf): as a distinguishing feature it's to notice the presence of a pilot tone at CF-700Hz (4539.0 Hz) preceding each segment and the slight diversity of the durations of both the segments and the pilot tone.

Fig. 1

 

I went casually on the signal at about 2150 (Sept. 1st) when it was already active and it lasted almost all night until about 0800 the following morning (Sept. 2nd) when it ceased, all times are UTC: after that I haven't heard it again, unless a sporadic carrier just on 4539.0 Khz. The effective duration of the transmission can be verified by looking at the 24-hour waterfalls as received by the WebSDR receiver in Twente (figure 2).

 

Fig. 2 - Twente WebSDR wtarefalls of 1 and 2 September

 

The 5-bit text after the removal of the start-stop bits seems to be encrypted, definitely not KG-84/KIV-7 or other encryption that I'm aware, or consisting of pseudo-random chars. I tend to think of training or test transmissions - that makes more sense - on a not "usual" frequency: indeed I did not find mentions of S4481 transmission received on 4539.7 KHz in the large collection of logs of UDXF group, only few S4285 logs from Italian-Ny.

Fig. 3

All the direction finding tests (figure 4) point to an area located in north UK, therefore the Tx site could be likely Crimond (Aberdeenshire, Scotland), belonging to UK MoD DHFCS [1]:  it must be noted - however - that the results could suffer from the non-continuity of the signal. By the way,  some async STANAG-4481F transmissions have already been observed on last March and just from Crimond [2]: in that case, transmission were secured using KG-84/KIV-7 encryption.

Fig. 4 - some TDoA results

https://disk.yandex.com/d/CmkxVf5NwOBJ6A
[1] https://www.scottish-places.info/features/featurefirst94146.html
[2] https://i56578-swl.blogspot.com/2021/03/async-stanag-4481f-with-kg-84kiv-7.html