Discussions of radio security usually start and stop with content: whether the cipher held and whether the enemy could read the words. The Second World War record shows how much an adversary could learn without reading anything at all, including where a transmitter was, which unit it belonged to, how a network was organized, and when activity was building toward an operation. This piece walks through the documented Allied and Axis use of traffic analysis, direction finding and transmitter fingerprinting. Most of the weight is on the Allied high-frequency direction finding campaign against the U-boats, and the piece closes with what that history means for a public safety radio system.

The outside of a message: what an interceptor learned without reading a word

Traffic analysis is the study of everything about a transmission except its meaning. An intercept operator in the 1940s logged both callsigns on each transmission, the sending station and the station it was calling. The log entry also carried frequency and time of day, how long the message ran, any indicator groups in the preamble ahead of the enciphered text, and whatever routing or relay instructions were attached. Over weeks those logs accumulated into a record of which stations talked to which and how often, broken down by hour. When direction finding stations took bearings on the same transmissions, the record also showed where each station was. The British intercept organization was called the Y service, and the German, American and Japanese services all ran equivalent work, so this was a shared discipline rather than one side’s secret.

The method works because a military organization shows its structure through its traffic. A headquarters calls its subordinate units and they answer it, so a diagram of who calls whom reconstructs much of the chain of command. A new callsign appearing on a network suggests a unit has arrived or been formed, a rise in volume on a network often comes before an operation, and a network that falls quiet after weeks of normal activity is telling the analyst something, even though silence can mean an operation, a move, a change of procedure or simply a broken transmitter. Analysts learned to treat these signals as indications that needed confirming from other sources.

The practical advantage over codebreaking was durability. Reading content depends on a cipher break that can disappear overnight when the other side changes its machine, its keys or its codebooks. Traffic analysis needs receivers, trained operators, direction finding stations and disciplined record keeping, and it continues working through a cipher change because the callsigns, schedules and transmitter locations are still on the air. Its weakness is that it produces inference rather than orders, so it tells a commander that something is there and roughly what kind of thing it is, while leaving the commander to guess at intentions.

Callsign DK in Wilhelmshaven: the 1916 precedent both navies remembered

The best-known early lesson about callsigns comes from the First World War. The British Admiralty’s codebreaking section, known as Room 40, worked alongside a chain of shore direction finding stations and could read a good deal of German naval traffic. Before the Battle of Jutland on 31 May 1916, the German High Seas Fleet put to sea. The German fleet commander’s flagship normally used the callsign DK, and when the fleet sailed that callsign was transferred to the shore station at Wilhelmshaven, so traffic addressed to DK continued to be handled from harbor.

Patrick Beesly’s history of Room 40 is the account most often cited for what happened next. As he tells it, an Admiralty operations officer asked Room 40 where callsign DK was located and was told, accurately, that the direction finding stations placed it in Wilhelmshaven. Because he did not ask further, he was not told that the callsign was routinely moved ashore when the fleet sailed, and a signal went to the British Grand Fleet indicating that the German flagship still appeared to be in harbor. How much that error affected the conduct of the battle is a question naval historians have argued over, and I will not go beyond the documented point that the message was sent and was wrong.

The episode shows both halves of the callsign problem. An interceptor will treat a callsign as the unit it normally identifies, which is exactly what made it useful to follow, and the side that understands this can exploit it by moving the callsign somewhere else. By the Second World War, periodic callsign changes were standard practice in the major navies, because a fixed callsign let an opposing analyst follow one ship or one headquarters for months and build its whole pattern of activity. Changing callsigns raised the analyst’s workload considerably, although, as the fingerprinting section below describes, it did not always hide the station.

Wolf pack doctrine: why the U-boats had to transmit

Karl Doenitz, who commanded the German U-boat arm, built his convoy tactics around central control from a headquarters ashore, known by its German abbreviation BdU. Boats were deployed across likely convoy routes in patrol lines. When one boat sighted a convoy, it reported the contact to BdU, which then ordered other boats to converge on it, while the boat that had made contact shadowed the convoy and continued sending its position, course and speed so the others could close. The attack itself usually came at night with the boats on the surface, and in the 1940 to 1942 period this group tactic produced the convoy losses that make up much of the popular picture of the campaign.

The doctrine depended on radio in both directions. Boats at sea could receive BdU’s broadcasts without transmitting, but the contact reports, shadowing reports, situation reports and the routine position and fuel reports that BdU asked for all had to be sent from the boats on high frequency, often from close to the convoy. The more closely the headquarters wanted to direct the battle, the more the boats had to talk, and the people writing the doctrine were aware of the trade-off, because the German navy ran direction finding of its own and knew what a bearing could reveal.

Their response, as the postwar histories describe it, was to keep transmissions short. U-boats used short-signal procedures in which a whole contact report could be reduced to a brief coded group, on the reasoning that a transmission lasting only seconds would be difficult to take a bearing on, and that fixes from shore stations hundreds or thousands of miles away would be too imprecise to direct an attack against a particular boat. The second part of that reasoning held up reasonably well for shore stations, which the next section covers. The first part failed once the Allies put a direction finder on the escorts that could produce a bearing from a transmission as short as the ones the U-boats were sending.

The shore network: coarse fixes, the tracking room and convoy routing

Britain, the United States and Canada operated chains of shore direction finding stations around the rim of the Atlantic, and bearings from those stations were passed to central plots where they could be crossed to produce a fix. In London the main picture was kept in the Admiralty’s Operational Intelligence Centre, whose Submarine Tracking Room plotted estimated U-boat positions, and the US Navy and the Royal Canadian Navy kept their own tracking organizations that shared information with it. Long-range bearings on high frequency signals arrive by sky wave after reflecting from the ionosphere, and fixes built from them carried errors large enough that they described an area of ocean rather than a point.

A fix that coarse could not direct a ship onto a U-boat, but it could keep a convoy away from one. When the tracking room combined direction finding with traffic analysis, sightings, the known endurance and transit times of the boats, and decrypts when those were available, it could estimate where patrol lines were forming and recommend diverting convoys around them. Evasive routing sank no U-boats, which is one reason it gets less attention than escort actions, yet every convoy that passed a patrol line unseen was a convoy that lost no ships. Its contribution is also hard to measure, since the measure is a count of attacks that never happened.

The value of non-content intelligence showed most clearly during 1942. In early 1942 the U-boat networks moved to a four-rotor version of the Enigma machine, and Bletchley Park was largely unable to read that traffic until close to the end of the year. During those months the tracking room’s picture of the U-boat force depended much more heavily on direction finding, traffic analysis, sightings and dead reckoning. I will leave the cryptanalysis there deliberately, because apportioning the outcome of particular convoy battles between Enigma decrypts and everything else is where popular accounts most often overreach, and the direction finding record stands without that argument.

Huff-Duff on the escorts: a bearing from a short signal and a ship to run it down

Older direction finders used a rotating loop antenna, and the operator turned it by hand to find the null in the received signal, which took time, so a brief transmission could end before the operator had a bearing. High-frequency direction finding equipment of the kind fitted to Allied escorts, called HF/DF and nicknamed Huff-Duff, displayed the bearing on a cathode-ray tube as the signal arrived. That allowed an operator watching the display to read a bearing from a transmission lasting only a few seconds, which was precisely the kind of short signal the German procedures relied on. The sets went to sea on escorts and some convoy rescue ships from around 1941 and 1942, and the numbers fitted grew through 1942 and 1943. Kathleen Broome Williams’s book Secret Weapon covers the American side of that development in detail, and it is a good starting point for anyone who wants the engineering and procurement story.

The tactical value came from propagation as much as from the display. A U-boat transmitting from near the convoy reached the escort by ground wave, and a strong ground-wave signal told an experienced operator that the boat was close, within a distance an escort could cover quickly, rather than hundreds of miles away and arriving by sky wave. With a single bearing and that range judgment, an escort could run down the bearing at speed. With two direction finding ships in the escort group, the bearings could be crossed for a fix. Anyone who has done amateur radio direction finding will recognize the basic geometry, although the wartime operators were doing it on a rolling ship with seconds of signal and a lot at stake.

A boat that was found did not have to be sunk for the bearing to pay off. An escort running down a bearing could force the boat to dive, and a submerged U-boat of that period was slow and limited in endurance underwater, so it usually lost contact with the convoy and dropped out of that night’s attack. If it was the shadower, the other boats lost the stream of reports they needed to close.

The doctrine in the previous section therefore delivered the most useful transmission to the escort at the worst possible moment for the U-boat. The contact report came from the boat nearest the convoy at the moment it established contact, and the shadowing reports that followed kept marking the position of the boat the escort most wanted to find. Every additional boat that reported as it closed added another bearing. The German command had designed a system that required its boats to transmit near the enemy, on the assumption that the enemy could not take a usable bearing there, and the shipborne sets removed that assumption without anyone needing to read the messages.

German assumptions and the credit question: what the record supports

As the postwar histories I have read describe it, the German command spent considerable effort trying to explain why convoys were evading patrol lines and why boats were being found near convoys. Investigations into whether the naval ciphers had been compromised concluded that they were secure, and Allied radar, which the Germans knew existed and could detect in some forms, received much of the attention. Shipborne direction finding of the instantaneous kind appears to have been given much less weight than its effect warranted. I would point readers to histories that work from both German and Allied records, such as Clay Blair’s two-volume Hitler’s U-Boat War and the British official history of wartime intelligence edited by F. H. Hinsley, rather than to secondary summaries, for the detail of what the German side concluded and when.

The harder question is how much of the Allied success to credit to HF/DF, and the honest answer is that it cannot be separated cleanly. The U-boat losses of May 1943, which most historians treat as the point when the campaign turned, came after Allied escorts had gained centimetric radar, long-range aircraft had begun covering the mid-ocean gap, escort carriers and dedicated support groups had joined the battle, better antisubmarine weapons had arrived, and Bletchley had regained much of its reading of the U-boat traffic. Direction finding interacted with all of those, because a bearing was worth more when an aircraft or a support group could act on it.

Fingerprints, fists and the Funkabwehr: identifying the set and the operator

Callsign changes made traffic analysis harder, and analysts responded by identifying the transmitter itself. Every transmitter of the period had individual characteristics, such as a slight shift in frequency when the key was pressed, the shape of the keyed waveform, hum from the power supply, and the pattern of its harmonics. Accounts of British wartime signals intelligence describe photographic recording of intercepted signals so that those characteristics could be compared, which allowed analysts to recognize a particular ship’s transmitter after its callsign had changed. The same idea applied to operators, since the timing and rhythm of a person’s Morse keying, called the operator’s fist, could be recorded on tape and compared, and experienced intercept operators often recognized individual senders by ear.

Both techniques let an analyst carry continuity across a procedural change designed to break it. If the callsign changed but the transmitter and the operator stayed the same, the analyst could link the old and new identities and keep the unit’s history intact. The defense against that required changing equipment and people, which no navy could do routinely, so fingerprinting tended to give analysts a persistent advantage against units at sea.

The Axis services used direction finding most effectively against clandestine transmitters on land. The German radio security service, the Funkabwehr, worked in stages, first taking long-range bearings to identify the city or district a clandestine set was in, then sending vehicles with direction finding equipment to narrow the area, and finally using short-range portable equipment to identify the building. In occupied Belgium and France in 1941 and 1942, that work located transmitters of the Soviet intelligence network the Germans called the Rote Kapelle and led to arrests. A clandestine operator who transmitted from the same location, on a regular schedule, for long periods was the easiest target, because each of those habits helped the hunters at one stage or another.

The fist also mattered in the other direction. A home station that knew its agent’s keying could in principle notice when someone else was sending, though captured operators were played back by German counterintelligence in several cases. The best documented of those, the German operation against the Dutch section of Britain’s Special Operations Executive from 1942, is usually traced to failures to act on missing security checks in the messages more than to anything about keying, which is a reminder that these technical indicators only helped when someone was watching them and willing to act.

Deception, silence and the limits of the method

Because both sides understood traffic analysis, both tried to exploit it. The best-known Allied case is the deception plan for the Normandy invasion, Operation Fortitude, which presented the Germans with a notional First US Army Group in southeast England positioned for a landing in the Pas de Calais. Small signals units generated wireless traffic consistent with the headquarters and formations of an army group that did not exist in the strength portrayed. Histories of Fortitude generally credit the double agents controlled by British intelligence as the central channel of the deception, with wireless traffic as a supporting element that made the picture consistent with what German intercept services would expect to hear, so the radio component should not be described as having carried the plan by itself.

Radio silence was the other answer, and it carried real costs. A unit under silence could not report, ask for support or coordinate with neighbors, so silence was workable for a fleet in transit or a force preparing an attack and much harder to sustain in contact with the enemy. Silence was also noticed, since analysts tracking a network knew what its normal activity looked like, so it traded a detailed picture for a vaguer warning. The U-boat command could have reduced its exposure by reducing central control, but the group tactic depended on that control, and the record does not show the German side accepting that trade in time to change the outcome.

The method had its own limits on the Allied side as well. Bearings were sometimes wrong, ground-wave range judgments were sometimes off, shore fixes were coarse, and traffic analysis could mislead when the other side changed procedures, as the 1916 callsign episode showed in reverse. It worked best when its results were combined with other sources and when commanders understood what an inference could and could not support.

For a public safety radio system, the parallel is direct. A trunked system’s control channel announces unit identifiers, talkgroup identifiers, site affiliations and call timing, and on most systems those fields go out in the clear even when the voice traffic on a talkgroup is encrypted, so an inexpensive receiver and freely available software can log who is talking to whom, from which site, and how activity is changing. A tactical talkgroup that suddenly becomes active, a run of affiliations from units that do not normally work together, or a burst of traffic before a planned operation is the same kind of external indication the Y service was logging in 1942. The articles in this section on encryption and on checking whether encryption is actually turned on cover the content side, and the steps below concern the outside of the message.

What to do at your agency

• The radio system administrator should pull the current subscriber alias list this month, confirm whether those aliases are sent over the air or shown only on consoles and radios, and produce a one-page note listing any alias that reveals a person’s name, a specialty team or an undercover assignment.
• The communications director should ask the system owner or vendor for a written description of which fields on the system’s control channel are transmitted in the clear, including unit ID, talkgroup ID and site, and file that description with the agency’s encryption documentation.
• The radio administrator, with the system owner’s written approval, should monitor the agency’s own control channel with an agency-owned receiver during a scheduled training day and write down what an outside listener could learn about which units were active, where and when.
• The tactical team commander should add one line to the existing operations plan template for warrant service and planned operations that records which talkgroup will be used, whether it is encrypted, and when units will affiliate to it relative to the start of the operation.
• The training officer should add a ten-minute segment to the next scheduled tactical or investigations briefing showing the results of the control channel review, so that team members see that encryption protects the words and leaves their identifiers and timing visible.
• The communications director should put one item on the agenda of the regional radio committee’s next regular meeting asking each member agency whether it has reviewed what its control channel exposes, and record which agencies have done so.

Takeaways

• Traffic analysis studies callsigns, frequencies, timing, length, routing and volume rather than content, and in the Second World War it continued to produce intelligence through cipher changes that stopped the codebreakers.
• The 1916 episode in which callsign DK was moved ashore to Wilhelmshaven, as told in Patrick Beesly’s history of Room 40, shows that an interceptor will treat a callsign as the unit and that the other side can exploit that assumption.
• German wolf pack doctrine required U-boats to send contact and shadowing reports from close to convoys, on the assumption that short signals could not be fixed usefully at that range.
• Shipborne HF/DF displayed a bearing instantly on a cathode-ray tube, so escorts could take bearings on brief U-boat transmissions and use the ground-wave signal to judge that a boat was close enough to run down.
• Shore direction finding produced coarse fixes that were still valuable for routing convoys around patrol lines, especially during 1942, when the four-rotor naval Enigma traffic was largely unreadable.
• No published percentage reliably separates the contributions of HF/DF, radar, aircraft, escort strength and Enigma decrypts to the 1943 turning point, and any single figure should be treated as one author’s estimate.
• Transmitter fingerprinting and operator fist analysis let wartime analysts link a station across callsign changes, and German direction finding located clandestine transmitters that kept fixed locations and regular schedules.
• A modern trunked radio system exposes unit IDs, talkgroup IDs, site affiliations and call timing on its control channel even when voice is encrypted, which is the same external information the wartime intercept services exploited.