This log is fictional. Every callsign, frequency, time, bearing and fragment on this page is invented for teaching. It reconstructs a method, not any real network, army or day.
The method is traffic analysis: the study of the externals of communications—callsigns, frequencies, schedules, routing, volume and where a transmitter is—while message content is left to cryptanalysis. The National Security Agency’s history of the subject describes those elements and their wartime use, and the notes below cite it as the NSA history. Predict, then check: each step records what you chose, so that later evidence can show what your own choices imply. Everything runs in your browser.
1. Read the log
One invented net, two days. Our receiver listened from 06:00 to 18:00 each day, with the gaps shown. Each station transmits on its own frequency. At midnight every station took a new callsign. Serial numbers restart at 1 each day.
Groups is the length of the enciphered text. The text itself is not part of this exercise, so nothing can be decrypted. R followed by a number is a receipt for the other station’s message of that number.
| Time | kHz | From | To | Serial | Groups | Intercept operator’s note |
|---|
| Time | kHz | From | To | Serial | Groups | Intercept operator’s note |
|---|
What the log does not contain
Missing observations are evidence too. This list is computed from the log and stays on the page throughout the exercise.
2. Who worked whom?
Using only the From and To columns for Day 1, tick each pair of callsigns you saw in contact. Then compare your drawing with the log.
Net control, and the headquarters question
A military net was typically run by a net control station working its outstations, and the structure of a net could mirror the organization it served (NSA history). Choose the callsign that looks like net control. It is recorded as hypothesis H1, kept apart from what you observed.
3. Day 2: the callsigns changed
Changing callsigns was meant to break exactly the continuity you need. Analysts often bridged a change through whatever did not change at the same time: frequencies, contact schedules, an operator’s sending style, the pattern of who worked whom (NSA history). Match each Day 2 callsign to a Day 1 callsign, or leave it unresolved, then read what your matches imply.
Choose a Day 1 callsign, or leave unresolved, for each Day 2 callsign.
4. Observed, inferred or not supported?
Sort each statement by what the log can bear. An observation is in the rows. An inference goes beyond them and could be wrong. Some claims the log cannot support at all.
- Observed in the log
- Inference
- Not supported by this log
5. Second-stage evidence
Two further sources arrive. Direction finding measures the bearing of a transmitter from a receiving post; bearings from two posts can cross to give an approximate fix (NSA history). Operators’ chatter was generally sent unenciphered, and careless chatter could leak callsigns, schedules or even unit designators. Record your Day 2 matches first, so the new evidence tests your own choices.
On this invented 60 × 48 km grid, our two DF posts are on the west edge. The invented force faces west, so east is its rear. Each bearing is taken as accurate to ±2°, or ±4° for a very brief signal; the circle round each fix is a rough teaching estimate of that error, not a measured confidence region.
| Day | Callsign | Bearings | Result | Note |
|---|
A plain-language fragment
What your matches now imply
6. Debrief
The debrief opens with the second-stage evidence. Until then, keep your own reasoning.
Here is the exercise key: the invented truth behind the log. A real analyst never received one, and the key contains no plans or intentions, because nothing in a log of externals could test them.
| Station | Day 1 | Day 2 | Role in the key |
|---|
The plausible wrong match built into this log is GA1 = ZB3. GA1 took over ZB3’s old frequency, and matching by frequency is a sound habit that usually works. Here it invents two events at once: a receipt-only station suddenly sending the most traffic on the net, and DH9 vanishing. Direction finding then turns the same mistake into an overnight move of about 20 km that never happened. The schedule (minute 40), the role (long numbered messages, answered by net control at minute 42) and the chatter about a number 5 all point to DH9 instead.
After the exercise: the history behind it
Callsigns are not units. The NSA history recounts how, on the day of Jutland in May 1916, an Admiralty operations director asked what a callsign located in harbour meant and was told it was the German fleet commander’s. The commander used a different callsign at sea; that one stayed at fleet headquarters. The British commander-in-chief was signalled that direction finding placed the German flagship in harbour.
Quiet on the air is not quiet on the ground. In another First World War example, British signals suggested that Australian and Canadian units were still in Flanders while those units moved under signals silence to Amiens. An absence of traffic says something about a radio, not necessarily about a unit.
Volume is not intention. Volume was one of the externals analysts studied, and in general more traffic allowed more to be inferred (NSA history). But a count of groups measures activity on the air. In this log the apparent Day 2 rise is mostly longer listening. A real rise could still be routine reports, repeats of garbled messages, an exercise, or dummy traffic sent to mislead.
Analysts were not working alone. Traffic analysis informed cryptanalysts about who was talking to whom, and its products were combined with decrypts and other sources (NSA history). James Thirsk’s chapter in The Bletchley Park Codebreakers is a participant’s account of this work as a wartime “log-reader”.
How this differs from real traffic analysis
- Scale. Real logs ran to thousands of entries across many nets. This one has 34 rows.
- Callsign systems. Here callsigns change once. Real systems changed periodically to a prearranged plan, which analysts sometimes recovered and could then predict (NSA history).
- Direction finding. The ±2° readings and fix circles are a rough model. Real bearings could be much worse, and a fix is an area, not a point.
- Deception. Real targets changed procedures, reduced time on the air and sent dummy traffic (NSA history). This log contains no deliberate deception.
- No answer key. Real analysts revised hypotheses as evidence accumulated and seldom learned for certain whether they were right.
Where this leads
The history route. Continue with Station HYPO, where partial JN-25 recovery worked alongside traffic analysis and operational context before Midway, or follow the Ciphers at War tour. The Hall of Codebreakers holds the people behind the methods.
The modern version. Blind Relay, in Crypto Lab, runs the same move on modern logs. Its “Correlation without collusion” exhibit joins an Oblivious HTTP relay’s log to the gateway’s log without touching key material, on ciphertext size and on timing. Padding merges the size join into one anonymity set; when traffic is sparse, the timing join still links requests. Where sizes or arrivals coincide, it reports an anonymity set or an overlap instead of guessing, the same discipline as leaving a callsign unresolved here.
| In this radio log | In Blind Relay’s logs |
|---|---|
| Message length in groups | Ciphertext size |
| Contact schedule: the minute past the hour | Arrival time at relay and gateway |
| Leaving a callsign unresolved | Reporting an ambiguous join instead of guessing |
Sources
- Donald A. Borrmann, William T. Kvetkas, Charles V. Brown, Michael J. Flatley and Robert Hunt, The History of Traffic Analysis: World War I – Vietnam (Center for Cryptologic History, National Security Agency, 2013): NSA PDF; GovInfo copy. Used for the definition and elements of traffic analysis, net structure, deception and dummy traffic, and the First World War examples.
- Whitfield Diffie and Susan Landau, Privacy on the Line: The Politics of Wiretapping and Encryption, updated and expanded edition (MIT Press, 2007), open-access edition. They call traffic analysis, not cryptanalysis, “the heart of a communications intelligence organization”, and find a narrower form of it in law-enforcement records of the numbers a line calls.
- James Thirsk, “Traffic analysis: a log-reader’s tale”, in Ralph Erskine and Michael Smith (eds), The Bletchley Park Codebreakers (Biteback, 2011). It first appeared in Action This Day (2001): contents of the 2001 edition. A participant’s account; this exercise does not reproduce its examples.
The log, bearings, chatter and key are original to this page. No private copy of any source is linked.