All CIS Forces - in principle - use the same formats for all Morse Code traffic. Most messages do consist of groups of 5 letters or 5 figures. In tactical networks both are used, in Navy networks nearly all messages are 5-figure-groups ( Standard Format for Morse Messages ).

Not all figures are sent as such, but are replaced by letters, because they are shorter in Morse Code. CIS Forces use Cyrillic Morse - adding new Codes to the Latin alphabet
( Cyrillic Morse, Cut Numbers and Abbreviations ).

Sometimes two stations exchange seemingly endless rows of letters in Simplex traffic, that are Online Encrypted Morse Messages

Important, short instructions are sent on all levels of the CIS Forces, comparable with the Emergency Action Messages of the US Air Force ( XXX Strategic Flash Messages ).

There are messages, which are yet not fully understood in its content, one example being the RADIOPROGNOZ Messages .

Standard Format for Morse Messages

In the former Warsaw Pact Forces every branch had its own "style" to drop a message. When, e.g. the Black Sea Fleet left Odessa, Morse traffic could be traced until the ships arrived in their operating area. The desastrous, because badly prepared, invasion of Czechoslovakia in August 1968 revealed even more weaknesses of the WP communications. Supplies did not arrive in time and sometimes in despair were ordered in plain language.

As a consequence the WP communication troups in several steps have been reorganised. A very important measure was the introduction of a standardized format for Morse messages. It is still valid for tactical and strategic CIS Military Morse networks .

In its most basic format, a Morse message will contain these elements:

TU5J 162 30 18 1202 162 = 517 = ppppp 5LGx28 azkbz = 667 +

TU5J	Sender of the message. This is a tactical callsign, it's format is LLLL or FFFF or LFLL or LLFL but not FFLL or LLFF . L = Letter. F= Figure. See Navy Morse Networks for their callsigns.
162	Message number, between 1 and 999. Is repeated after the time group.
30	Group count, not consistent. May include procedure groups, traffic mode group and service group.
18	Day
1202	Local time of message preparation (see below).
517	Address, is referred to as ads or message priority code (see below). The address specifies the receiver of the message, may be a command post or a person. Sometimes Z-Codes with trigrams.
ppppp	Procedure group for procedure M-125 (see below).
5ALGx28	Text of 28 accentuated five letter groups (30 minus procedure and service group). All messages are encrypted, no exceptions.
azkbz	Service group, indicating day and group count. See Cyrillic Morse, Cut Numbers and Abbreviations for code.
667	sig (signature) of the sender. Can be a command post or a person. Navy stations sign here with their callsign.
+	ar (end of message). Other endings may be: k, rpt al or rpt QLN (repeat message via landline)

The preamble time (message preparation time) can tell more about the Time Zone of the sender. Ukraine, Belarussian local time for example is 1 hour later than Moscow time, 4 hours later than Kazakhstan and so on until Far East Russia. This and Daylight Saving Time (DST) easely can lead to confusion.
Tom DL8AAM therefore offered a very useful compilation in UDXF recently about the possible origin of a message. Tnx Tom.

PT = Preamble Time
UTC = Time of reception in UTC

PT - UTC = 0 up to 2 h: Sender in Moscow Time Zone OR in Ukraine
PT - UTC = 2 up to 3 h: Sender in Moscow Time Zone
PT - UTC = 3 up to 6 h: Sender in Uzbekistan OR Kazakhstan OR Far East Russia, etc.

and during DST:

PT - UTC = 0 up to 3 h: Sender in Moscow Time Zone OR in Ukraine
PT - UTC = 3 up to 4 h: Sender in Moscow Time Zone
PT - UTC = 4 up to 7 h: Sender in Uzbekistan OR Kazakhstan OR Far East Russia, etc.


The former WP (Warsaw Pact) Forces used several priority levels to specify the time between teletype-message preparation and reception, which depended on the length of the message as well. "Monument" simply meant "at once", but a normal message with 300 words/groups arrived up to 150 min later at the addressee.
Some priority levels - wzd, rkt, sml - have been adapted for Morse messages as well and still are in use.
The question remains, how the XXX Strategic Flash Messages will fit into this schedule. It seems, that xxx messages only can be produced by few (or one) high ranking commands and their origin must remain obvious until its distribution in tactical network.

Level	Priority	Abbreviation
Monument (monument)	Highest	m
Platinum (pdatina)		p
Air (wozduh)		wzd
Gale (chturm)		cht
Rocket (paketa)		rkt
Aircraft (samoljot)		sml
Exception (wneocerednaä)		wn
Urgent (srocnaä)		sr
Normal	lowest	--

The following part is based on information from "SAS und Chiffrierdienste" Website. See here Links . It is not clear, how many of the historical informations still are valid, but I'm convinced, the basic structure still is in use.

Depending of the nature of a message the first few text groups may contain additional information, although they are not easely recognisable.

The first text group can be a procedure group, which describes the treatment of this message, most probably encryption/decryption. Procedure M-125 leads to groups like "11111" or "aaaaa". "11111" probably is used for exercises/training.

The following traffic mode group specifies, how the network is handling messages. Circular traffic results in groups like "55555" or "ddddd".

The decode group specifies the encryption key. In circular traffic this group is looked up in encryption tables, in normal traffic each letter/cipher is sent three times.



Top of page.

Cyrillic Morse, Cut Numbers and Abbreviations

When we copy Cyrillic Morse traffic most of us will write down Latin letters instead. Being German speaking I will use these substitutions:

Cyrillic Morse Code	"Translation" I use.
- - - -	ch
. - . -	ä
. . - -	ü
- - - .	ö
. . - . .	é

The entire Russian/Latin/Morse Code Alphabet you find here: Downloads

All CIS forces use Cut Numbers in their 5LG messages. We can evaluate the final group containing day and group count. Several sets of Cut Numbers are in use, these are the two mostly used:

Figure	1	2	3	4	5	6	7	8	9	0
Set 1	A	B	W	G	D	E	V	Z	I	K
Set2	Ä	W	E	R	T	Y	U	I	O	P

The final group of the example "azkbz" therefore reads "18028".

CIS Forces use Standard - and special Q and Z-Codes. In many cases "Q" is replaced by "Z", hence "ZSA" means "QSA". Even worse, the codes may have different meanings dependant of the branch. More than 100 special codes are observed - some of them are understood; you may download my list here: Downloads.

CIS forces use the normal abbreviations, but additionaly there are some, which you may be less familiar with (some kindly have been published by UDXF members):

abs	Station not on duty.
abv	Repeat / I repeat.
ads	Addressee (at command post).
bn	Between
col	Collate.
cor	Correction
corcol	Rus. for group.
gr	Group
guhor	Rus. for: Nothing heard from you.
rk	Always use this frequency.
sig	Signature (of the sender).
sld	Rus. for "sledite": You're listening for my signals.
slv	Rus. for "slezhu": I'm listening for your signals.

Online Encrypted Morse Messages

Sometimes CIS Forces use Online Encrypted Morse. The plain text is entered at any speed via a keyboard and online encrypted and sent away by the modem. This is why messages sometimes are sent fluently or quite slow and not in groups of 5. A series of dots indicate a completed message. Normally the stations work Simplex.

This sample shows how RIW transmits an encrypted Morse message to RDND (probably a CIS Navy vessel). Other Z-Codes may be used as well in this procedure, ZGR means "I will start Online Encrypted Morse now", and sometimes ZBD or ZBM indicate technical problems.

Frequency kHz	Text	Remarks
11000	RDND de RIW QRR 3 QDW 10388 k	Go to 1386 for online encrypted Morse tfc.
12464	RIW de RDND ok QRR 3 QDW 10388 k	RDND acknowledges.
10388	RDND de RIW ZZD 3 ZNÉ tridewätxtri k	I read you with QSA 3. My authentication is tridewätxtri.
10388	RIW de RDND ZZD 3 ZSL ZNÉ tridewätxtri ZNÉ odindwaodin k	I read you with QSA 3. Confirm your authentication tridewätxtri. My authentication is odindwaodin.
10388	RDND de RIW ZKM? k	Are you ready for Online Encrypted Morse Traffic?
10388	RIW de RDND ZKM k	RDND affirmative
10388	RDND de RIW ZDS gugch ZZT kkvmlllkvmlllvklklvllvkll uwpliasdzhrttzsg...	Machine setting is gugch (normally used), the decryption key is ....... (made up of 25 characters of l, m, k and v), then message follows.

XXX Strategic Flash Messages

Since many years the Warsaw Pact / Russian / CIS Forces transmit xxx Flash Messages on their strategic and tactical Morse networks. They are the counterpart to the EAM Voice Messages of the USAF on the HF-GCS network.

xxx Flash Messages are rather short and contain the following elements:

- one or several codewords
- identifiers of sender and addressee(s)
- instructions about who is going to act or react.

xxx Messages are initiated by a high ranking station and are repeated by other NCS (Net Control Stations) within 5 to 20 min after the first transmission. We know that many xxx Messages first are heard on the High Command (VGK) VLF network and then are repeated by the Fleet HQ and by tactical networks. There are, however, Flash Messages being heard first on a Fleet HQ frequency and later on VLF.

What are these Flash Messages for?
The first step would, of course, be the attempt to correlate the number of messages and the activity of the Navy, e.g. during naval exercises or political tensions. So far that can be confirmed partially; it seems that only CIS Navy "internal" exercises provoke more Flash Messages, in big international manouevres I never noted an increase in traffic, but that is another very subjective statement.
The messages are too short for much information, they are only used to put into force a pre-determined scenario, details of which have been agreed upon in advance or on other comms channels. One good example sometimes can be found with luck: Flash Messages do activate sleeping, tactical networks. These become quite busy with traffic shortly upon reception of a xxx Message, even if you didn't hear them before for many hours.

We only look at a few communication channel of the Navy, but there are many others beyond our technical possibilities. Our findings are very limited therefore, but we may assume, that xxx Messages don't turn the Navy upside down, there are simply so many of them. But still, xxx Flash Messages are interesting, because

- we easely can decode Morse mode and do a little bit of statistics
- the transmissions are quite frequent
- we get an idea of who is listening to whom and
- learn about the structure of the network.

Strategic Flash Messages on the Navy's VLF Network are of great significance, because they are issued by the General Staff in Moscow. Read more about these transmissions here: C2 Systems in the NSNF .

Message formats and examples

This was a standard Flash Message from RMP on 6873 kHz:
xxx xxx REO REO 90326 brosanje 8616 7037 (repeated) k

REO is the addressee, in this case a collective callsign belonging to the Baltic Fleet or parts of it.
The two 5FG probably indicate more in detail who should act.
"brosanje" is the codeword, always a noun.
The two 4FG belong to the codeword and may modify or expand the meaning of the codeword. Look at codeword and 4FG as an "instruction set".

But there are exceptions: Virtually any message format is possible, even this one:
xxx xxx IR43 050: P-16606 niöeskaa prowerka atos-838 chawyrin 838 k.

The codewords "podarok" and "ustrelina" are used for a special (yet unknown) purpose:
xxx RDL 52378 podarok 01 1030 175 225 1130 k.
The format of groups 2 and 5 suggest times.

Morse - and BEE 36/50 VLF messages may start with "uuuuu", the number of letters can vary. The meaning is not clear, in the USSR Forces it simply said: "Transmission in your direction starts now." On the other hand "bbbbb" was: "Transmission in my direction starts now."

Examples:

This message was broadcast on 18.1 kHz at 12.04.2006 1319z by the General Staff:
xxx xxx RDL RDL 25001 95801 brennyj 5369 1092 k

Four min later, on 11155 kHz, the Northern Fleet HQ RIT in Severomorsk repeats:
xxx xxx RLO RLO 95801 brennyj 5369 1092 k

The "instruction set" did not change, but the message now goes to the collective callsign RLO, which belongs to the Northern Fleet and therefore the group "25001" is void.


Another message on 18.1 kHz at 01.05.2006 0700z issued by the General Staff:
xxx xxx RKS RKS 27342 paraplica 5202 3615 k

Five min later, on 11155 kHz, Northern Fleet HQ RIT repeats:
xxx xxx RKS RKS 27342 paraplica 5202 3615 k

Unit RMGB, most probably a vessel, didn't get it and asks on 12464 kHz:
RCV de RMGB rpt xxx k

Now we know, the message has been disseminated by the Black Sea Fleet HQ RCV as well and it will now repeat the Flash Message for RMGB on the primary 10201 kHz.

Later on RMGB confirms on 12464 kHz:
RCV de RMGB rpt 27342 paraplica 5202 3615 k

"RKS" obviously is not repeated, because RMGB is part of RKZ.

Flash Messages may contain several codewords:
xxx xxx RDL RDL 63191 83795 waloprowod 8067 4649 taikarpin 7436 4920 baläbus 7969 5452 k

Up to five "instruction sets" I have heard in the same Flash Message.

Some codewords may be used again after years, e.g. "esup", some can be translated, giving results like "banquet", "youth" or "thread", others cannot. Only once I heard a codeword, which (possibly) made sense:

The codeword "nitka" was used October 27th 2004 by Navy HQ Moscow. One week before, during CIS Navy exercises in the North Atlantic, an emergency was noted onboard the Northern Fleet's Aircraft Carrier "Admiral Kuznetsov", when a SU-25 UTG aircraft made a hard landing and damaged the superstructure. There was much critisism about these exercises, because for 7 years the carrier was not on sea with its air wing for practice. 2004 the pilots tried to keep in trim by flying from a simulated takeoff and landing pad on the Crimea peninsula. This facility, built by the former Sovjet Union, is named "Nitka". (Source RIA Novosty)
Coincidence or not - I don't know.

In fact there are even xxx Messages which can be decoded:

31.12.2008, RIT on 7954 kHz sent this message:
xxx xxx xxx RLO RLO weter 2 po belomu morü k (wind 2 over the White Sea)

It seems, that the trigram "xxx" can be used even for weather predictions, if appropiate.

RADIOPROGNOZ Messages

Since late 2006 I observed some messages of unidentified format. Fleet HQs sometimes disseminate a sort of report/outlook to collective callsigns, but do not use their primary frequencies. Messages are broadcasts and end with "+".
RADIOPROGNOZ messages have been heard on these frequencies: 6456, 5753, 7954, 6948 and 6877 kHz.

I don't think these are weather forecasts, because these use the header "prognoz" or "prognoz pogody", gale warnings are "chtormowoe preduprevdenie".
The "Sovjet Technical Encyclopedia" offered the following translation:
Radio Prognoz = Forecast of the Ionosphere (Propagation Forecast)
And this, most probably, is it. This is an example:

31.12.2008 1000z 7954 kHz

RLO RLO RLO de RIT RIT QTC 106 40 31 1257 106 = radioprognoz =

31127 63003 42222
00001 01218 30080
00002 01218 30090
00005 01218 60014
00006 01218 50010
00102 01218 40090

00001 01824 30070
00002 01824 30080
00005 01824 60012
00006 01824 40010
00102 01824 30090

00022 01218 50012
00022 01824 40011
+

The first row may indicate the region of the forecast,
the second row obviously indicates the period of validity (12...18h or 18...24h),
the third row may indicate forecast values.
What worries me is the fact, that I haven't seen yet forecasts for the period of 0000...1200z, that doesn't make my nice interpretation too convincing....

Top of Page