Number Stations: Old World Spycraft Surfaces in Iran War

1.0 Introduction

An anonymous Persian-language shortwave station, dubbed “V32” by the amateur shortwave community, began broadcasting strings of numbers on 28 February 2026, some 12 hours after the first strikes in the Iran war. It is the first new number station* to come online since V30 started broadcasting in Vietnam in 2010. The prevailing theory behind V32 is that it is a CIA or DIA backed operation to activate or provide instructions to recruited sources in Iran. 

For the intelligence community, it potentially indicates a fallback to proven low-tech solutions for clandestine communications in countries where media is suppressed and ubiquitous technical surveillance complicates the secure use of the internet and cell phones. Relatedly, some observers suggest it could be a psychological warfare tactic designed to instill paranoia in the Iranian regime and divert resources, and it has sparked jamming efforts that are consistent with Tehran’s past practices. 

This article explores the history of number stations, the prevailing theories behind V32, and potential future trends suggested by this development.

* Number stations broadcast sequences of numbers or sounds that are thought to represent coded communications with human sources by intelligence agencies. 

2.0 Origins of Number Stations

2.1 History of Transmissions

The history of number stations is quite mysterious since much literature, mostly in the form of books, catalogues the signals and theorises possible explanations for them; very few governments have claimed ownership and or use of these stations in declassified reports. The first number station ever recorded was reported by Austrian magazine Kurzewelle Panorama in World War I as a station broadcasting morse code. There were some further broadcasts during World War II, but the popularity of number stations significantly increased during the Cold War. The Polish Ministry of Interior, one of the few official bodies to recognise these stations, had disclosed the number stations DCF37 (3.370 MHz) and DFD21 (4.010 MHz) being broadcast from West Germany in the 1950s. Others include the Swedish Security Service and Czech Ministry of the Interior.

Since then, many number stations and their origins have only been suspected by listeners rather than officially confirmed. For example, E03, also named ‘Lincolnshire Poacher’, is suspected to be a British Secret Intelligence Service operation, given its broadcast location from Bletchley Park during the 1970s. The United States, though never officially confirming their use of number stations, has tried several Cuban spies for using the technology to receive encrypted messages from their government. In the 21st century, new number station broadcasts are mostly revivals of these Cold-War era stations by Russian and North Korean intelligence services. For example, in 2016 North Korea resumed broadcasts of a number station that was widely believed to be a psychological warfare operation on South Korea.

[source][source]

2.2 Encryption – One-time Pads

One-time pads, also known as the Vernam cipher, are the main form of encryption for number stations. They were initially described in 1882 by Frank Miller but then reinvented by AT&T engineer Gilbert Vernam and Signal Corps chief Joseph Mauborgne as a teleprinting machine. Later, a paper based method was developed, which diplomats preferred for longer messages due to the cost of telegraph messages. In the 1920s, and similar to Mauborgne’s belief, German cryptographers realised that if each code group had a randomly chosen number added to them, it would be unbreakable. This led to the creation of a separate ‘pad,’ which is a key that indicates the additive numbers so the user can decipher the message. These are ‘one-time’ since they must be unique to the letters in the message and must be destroyed once used to prevent later interception. During World War II, the British Special Operations Executive used a similar method to encode text, akin to the example demonstrated below. By the 1940s, two theorists, Claude Shannon and Vladimir Kotelnikov, separately proved the resilience of the one-time pad system and delivered the results to their respective governments.

Example encryption of one time pads using key ‘TVNAP’:

Message:HELLO
As numeric (a = 0, b = 1, etc.):74111114
Add Key:+19 (T)+21 (V)+13 (N)+0 (A)+15 (P)
Message + Key2625241129
Modulo 26*:02524113
Encrypted MessageAZYLD

*This means divide by 26 and report the remainder, thereby starting the sequence again at A beyond the letter Z (26).

Example decryption of one time pads using key ‘TVNAP’:

Ciphertext:AZYLD
As numeric (a = 0, b = 1, etc.):02524113
Subtract Key:-19 (T)-21 (V)-13 (N)-0 (A)-15 (P)
Ciphertext – Key-1941111-12
Modulo 26*:74111114
Encrypted MessageHELLO

*For negative numbers, 26 is added to make it zero or higher.

[image source]

Part of the strength of one-time pads is that this cracking process could produce other valid messages. For example, in the case above, stumbling across the key ‘XMJPX’ produces the word ‘EQUAL’ which is a plausible solution to the cipher.

[source][source]

2.3 Naming and classification 

Number stations are typically identified by a coding system developed by the European Numbers Information Gathering and Monitoring Association (ENIGMA) from 1993-2000, now maintained by the ENIGMA 2000 group. Its format follows an alphabetical prefix denoting the language and a number to indicate the index of the station. For V32, the ‘V’ indicates a broadcast in all other languages, while the more common English (‘E’), German (‘G’), Slavic (‘S’), and Morse (‘M’) stations have dedicated prefixes.

Sometimes stations are named based on audio samples within the recording. E03 was often referred to as the ‘Lincolnshire Poacher’ since the transmission began with a melody from that song. Other nicknames describe the operator’s voice, like the Russian operated station E07a, which is sometimes called ‘English Man.’

[source]

3.0 V32: Current theories behind the broadcast 

3.1 Format and purpose: Why a Farsi numbers station?

The broadcast was first heard on 7910kHz USB at 18:00 UTC February 28, 2026. The 15 to 20 minute message repeats everyday at 02:00 UTC and 18:00 UTC. Each message begins with three voicings of the word ‘Tavajjoh’ (meaning “Attention”) followed by a 5 digit header and then a string of numbers which are spoken in 5 digit groups. In each transmission, there are 6 messages that each take 20 minutes to read, making the total broadcast time 2 hours. The choice of Farsi (Persian)—a language spoken across Iran, Afghanistan and Tajikistan—might be a deliberate attempt to obscure the identity of the broadcaster. Occasionally, the English word ‘Specially’ or ‘Specifically’ is heard in between the numbers; the choice of English is especially interesting compared to reading these words in Farsi. This is potentially an aide to an English native user who is already tasked with transcribing the Persian numbers into cardinal numbers. For example, listen to the audio clips of the broadcast here while using this table:

Table of Farsi Cardinal Numbers

FarsiCardinal Number
“sefr”0
“yek”1
“do”2
“se”3
“chahar”4
“panj”5
“shesh”6
“haft”7
“hasht”8
“noh”9

[table source]

Headers for each message as identified by Priyom:

HeaderCode
Message 164096 22521
Message 264096 46553
Message 311050 90128
Message 411050 63884
Message 511050 32315
Message 656173 29771

[table source]

3.2 Jamming

Since 5 March 2026, a bubble jammer began targeting the number station’s frequency, 7910kHz. This device is designed to overwhelm the signal from the original broadcast and replaces it with a maddening bleeping sound that completely obscures the transmission (see video below). Intriguingly, it sounds identical to the same jammer used to block Radio Farda, the Farsi broadcast of Radio Free Europe/Radio Liberty, a US government funded broadcast to report news in countries without free press. This suggests that the jamming is Iranian in origin, but it does not rule out that the signal itself is of Iranian resistance origin. By March 7, the number station began rebroadcasting on a new frequency, 7842kHz.

[source][source]

3.3 Intended Audience

The clear advantage of transmitting information with a numbers station is that the recipient of the message cannot be tracked when listening to the radio. That said, the recipient must have access to a pre-shared key and instructions for how and when to use it (e.g. use the first key on March 1). This makes number stations a perfect tool for transmitting information to clandestine assets who are given one-time pads, but they must have the ability to destroy old sheets on the pad and have quick access to new sheets to maintain communication. 

Another working theory is that the broadcast is a hoax, a psychological operation tool to instill paranoia in the Iranian regime. This is possible given the lack of reliability features such as multiple broadcasts on other bands in case of jamming and lack of measures to ensure complete transcription, like repetition. However, there could be evidence of a motive to transmit complete messages since after the broadcast went down on 6 March due to jamming, the message transmitted on 7 March was much longer than usual to potentially account for the missed day. Finally, the activation of the broadcast only 12 hours after the first attacks might suggest a level of pre-planning and positioning of equipment, especially since the distribution of pads is needed for the station to be useful. This makes it difficult to believe that the broadcast is a complete (or last minute) hoax, fabricated in response to the conflict.

[source][source]

3.4 The Transmitter: CIA-backed Operation?

Current analysis by Priyom, the leading online community for researching signals, has triangulated the signal to a US military base near Stuttgart, Germany. Multiple sources corroborate that the tones heard in the broadcast are akin to the warning sounds of new L3/Harris radios, in particular the AN/PRC-160 or AN/PRC-150 (Falcon III/Falcon II). In particular, the sounds indicate that the radio is operating in an unencrypted mode, and suggests that they were hastily used for the broadcast since no effort was made to remove the sounds. Similarly, Windows 10 error sounds are sometimes heard in the broadcast, supporting a theory that these messages are not fully automated. The most interesting revelation is that the radios themselves are predominately used by American, German, and Dutch forces and they are sales restricted by ITAR controls, leading to the theory that this station must be operated by entities based at either Panzer Kaserne or Patch Barracks.

The L3Harris AN/PRC-150 (left) and AN/PRC-160 (right) are the suspected transmitters used to broadcast V32. They are both manpack (soldier carried) radios, the former used primarily by the US Armed forces in the Iraq and Afghanistan wars. [image source][image source]

Furthermore, it is clear that this broadcast must have the support of a local government since the intelligence services of the host nation would have traced and disabled it given the sensitivity of the geopolitical situation with Iran. It has been suggested that this could be a CIA, DIA, or Mossad backed operation, broadcasting from the confines of an allied Western country. The CIA still provides training about number stations and one-time pads for agents as a last resort form of communication. This is especially timely since clandestine assets in the IRGC are suspected to have provided tracking information for targets that were recently eliminated in strikes. 

[source][source]

4.0 Future and Conclusion

News about numbers stations often reports the decommissioning of a broadcast, and rarely does a new one come online. The emergence of V32 indicates that short-wave radio transmissions, despite being ‘low-tech’, are still viable as a means of communication in an age of ubiquitous technical surveillance and state suppressed media. Specifically, the anonymity that is retained by using such a technology is alluring for transmitting messages to individuals who can be trained and equipped with one time pads. The strongest theory is that V32 is a means of communicating with clandestine assets who have been cut-off in Iran as a result of the strikes and the shutdown of the internet. That said, number stations have been used by various agencies as a method of psychological warfare, and it could be a strategic tool to divert resources, such as jammers, to perforate the state’s control over media sources.

Jais Picariello

Table of Contents

Related Content

Akashinga: All Female Anti-Poaching Unit

TYPE:_ Article

Italian Intelligence Community: A Deep Dive

TYPE:_ Article
Location:_ Europe

FSB Vympel: Russia’s Secretive Unit

TYPE:_ Article
Location:_ Europe

Stay in the loop

Get a free weekly email that makes reading
intel articles and reports actually enjoyable.

Table of Contents

Log in

Stay in the loop

Join thousands of people receiving ground truth based reports that affect their business, investments and personal life.

Contact

Contact

"*" indicates required fields

This field is for validation purposes and should be left unchanged.