This post presents a technical analysis of an HF radio intercept recorded on July 22. The analysis focuses on the structure of a 50 Baud FSK signal transmitted by the CIS Navy, highlighting both standard transmission characteristics and distinctive operational features, such as the use of a specific frequency shift (700 Hz) and the inclusion of a Morse-FSK preamble indicative of high-priority message traffic.
A very interesting FSK 50 Bd / 700 Hz signal was intercepted on 16199.75 kHz (cf) on July 22. The signal transmits almost continuous "01" reversals, occasionally interrupted by a Morse-FSK preamble prior to an encrypted payload. The preamble likely serves as a signaling sequence indicating the priority/precedence level of the upcoming transmission. As shown in Figure 1, the payload of the recorded transmission consists of two concatenated messages framed by short reversal segments before returning to continuous reversals. In ordinary or low-priority traffic, the payload directly follows the reversals (without a preamble), consists of multiple concatenated messages and can last for some minutes.
 |
| Fig. 1: the intercepted signal |
As confirmed by fellow monitor cryptomaster, the intercepted signal belongs to the family of 50 Bd FSK waveforms used by the CIS Navy with various shift values such as 75, 200, 250, 500, and even 1000 Hz [1] likely generated by the T-600 system, while maintaining the same message format. This is the first time I have observed a CIS Navy 50 Bd FSK modulation with a 700 Hz shift, which is another remarkable aspect of this sample.
 |
| Fig. 2: FSK parameters |
Transmitting a Morse coded preamble typically indicates an incoming message of high priority. In Russian military radio doctrine, top-priority traffic (equivalent to FLASH or MONOLITH) is preceded by repeated letter sequences to alert operators and trigger automated equipment (1). In this instance, the preamble consists of the string 'UUUUU XXX XXX'. This sequence likely functions as a two-stage marker: 'UUUUU' for initial synchronization/attention, followed by 'XXX XXX' to signal an incoming long or high-precedence message prior to switching to FSK data modulation. Notably, while these markers are unconfirmed by official Russian Navy sources, they are well-established through decades of independent SIGINT monitoring. A similar preamble was previously documented in CIS Navy 50 Bd/75 transmissions on 18.1 kHz (submarine communications) [2].
 |
| Fig. 3: the Morse-FSK preamble |
The two messages in this sample are identical,
likely to improve system reliability through message redundancy.
Below
is the bitstream analysis of the intercepted sample (700 Hz shift),
demonstrating the above—namely, that both the message's format and the
symbol rate of 50 Bd are shared across CIS Navy FSK waveforms, even when
using different shift values.
The 'standard' format of CIS Navy 50 Bd FSK messages usually consists of:
⦁ 42-bit initial sequence / Unique Word (usually 100001010010111110000101001101011010101101)
⦁ 70-bit Initialization Vector, repeated twice)
⦁ 7-bit word ciphered payload arranged in a 4:3 ratio with parity check
⦁ five 7-bit "0001000" words as End of Message (EOM)
(the 0/1 values of the sequences above depend on the reception polarity)
 |
| (not in scale) |
42-bit sync sequence
It is worth noting that the transition from idle to traffic condition is signaled by a break in the bit reversal structure, where a '1' is inserted instead of a '0' when the system transitions to traffic i.e., ending in '01011' rather than '01010', as shown in Figure 4. Using intentional protocol deviations for signaling is a common practice across many standards, such as Ethernet LAN protocols (2).
The initial 42-bit sync sequence also represents a "violation" of the 4:3 ratio (see below), ensuring reliable synchronization.
 |
| Fig. 4: 42-bit initial sequence sent after reversals |
70-bit Initialization Vector
Figure 5 displays the identical pair of messages aligned in 70-bit blocks, emphasizing the probable Initialization Vector (IV) sequences, repeated twice, prior to the encrypted payload.
 |
| Fig. 5: 70-bit sequence, repeated twice |
4:3 ratio with parity check
The payload data consists of 5-bit characters encoded into a 7-bit sequence with a fixed 4:3 ratio of '1's to '0's (or vice versa, depending on reception polarity). Naturally, the constant presence of four '1's per character also provides parity-based error detection.
 |
| Fig. 6: 4:3 ratio and parity check |
 |
| Fig. 7: the EOM sequence |
It appears that the format of the CIS-Navy 50Bd transmissions revolves around the number "7": an initial 42-bit synchronization sequence (6x7), 70-bit Initialization Vectors (10x7), and a payload structured into 7-bit words. In fact, it can be argued that the entire message (sync sequence, IVs, payload, EOM) is fundamentally structured into 7-bit words.
Attempts to geolocate the transmitter site proved challenging, likely due to the nature of the signal and potential multi-hop propagation. Nonetheless, as shown in Figure 8, the KiwiSDR receivers used for Time Difference of Arrival (TDoA) measurements point to an area southwest of Moscow (likely the RDL site?), though this cannot be established with a high degree of certainty (3).
 |
| Fig. 8: direction finding attempts (TDoA) |
All recordings thanks to linkz's KiwiSDR [3].
📄⬇️ For a quick technical reference, you can download a concise Fact Sheet summarizing the full frame architecture and other features here.
📡⬇️ Download signal recording: https://disk.yandex.com/d/4uBK5oJYGYtMVg
Notes
1. In NATO military communications (as ACP-126 standard), FLASH precedence is represented by the letter indicator Z (Prosign). To alert operators and trigger automated terminal alarms, the precedence sequence is repeated at the start of the transmission (e.g., ZCZC ZZZZ), followed by a Z time-stamp designator and the text header FLASH FLASH FLASH. In strategic/command contexts, it functions similarly to Russian high-priority or MONOLITH-type alerts.
2. In traditional 10 Mbps Ethernet networks (10BASE-T), data is transmitted using Manchester encoding. Transmission begins with a 7-byte preamble consisting of alternating 1s and 0s (10101010...), used to synchronize the receiver's clock. Immediately following this is the SFD (Start Frame Delimiter) value, where the alternating sequence breaks with two consecutive 1 bits (10101011). This break in the alternating rhythm signals the network chip: "Attention: the preamble has ended; the very next bit marks the actual start of the Ethernet packet" (IEEE 802.3 Standard, Clause 3).
3. Rather than a single fixed mast, HF transmissions under the call sign RDL are routed through naval communications hubs primarily tied to naval headquarters/command nodes in Central Russia such as the Moscow military region hub. Just for example, Naro-Fominsk area hosts major command posts and communications infrastructure for the Russian Armed Forces, including high-power HF transmitter facilities and receiver centers used for strategic naval command broadcasts and central military district communications.
References
[1] http://i56578-swl.blogspot.com/2016/12/unid-fsk-50bd1000-prob-cis-navy.html
[2] http://i56578-swl.blogspot.com/2020/08/cis-navy-vlf-50bd75-fsk-t600-75hz.html
[3] http://linkz.ddns.net:8075/?f=16198.00usbz9
