Electronic and physical surveillance on subject Sergey Slobinovich has
continued since he was discovered to have serviced a dead drop on 09/27/03 in the operation now
known as Sleb Slob. For almost seven months there was no suspicious activity. On 04/15/04 he
received another apparent signal call. This time the call was successfully intercepted on the
elsur but the signal was encrypted. The recording has been forwarded to NSA. Following are the
relevant fisur log entries:
04/15/04 11:44 a.m.: Subject observed through store window answering telephone. Elsur team radios
alert that the call sounded similar to the suspicious call on 9/27/03. Microphone surveillance
activated.
04/15/04 12:31 p.m.: Subject leaves store using store cargo van. Fisur team activates GPS
tracking device. Due to subject being extremely conscious of surveillance during recent fisurs and
very skillful at cleaning himself, fisur units rely on GPS device to track while staying close but out of sight.
04/15/04 12:47 p.m.: Subject van heads south on I280 and exits at Foothill Blvd, goes south.
04/15/04 12:50 p.m.: GPS signal indicates van immobile at N 37° 19.871 W 122° 04.223, a church at
Foothill and Cristo Rey.
04/15/04 12:52 p.m.: Discreet fisur vehicle drives by, sees van in church parking lot. Subject
not in van or lot. Team spreads out in vicinity but does not see Subject nearby. Unit 2 sets up
in a position to see Subject van discreetly.
04/15/04 1:26 p.m.: Subject observed arriving at van on bicycle, from the direction of Foothill
Blvd. He puts bicycle in van and returns directly to store via 280.
It is likely Subject received an encrypted signal, and spent the 47-minute interval after the
phone call decrypting the message. He is believed to have serviced a dead drop during the 34-
minute period he was out on his bicycle. Unfortunately, the GPS device was attached to the van,
not the bicycle, so the exact location was not determined. This is the first time Subject used
this technique, so it is probable he discovered, or at least suspected our use of, the GPS device.
The tape of the call has been forwarded to NSA. On 04/19/04 they reported that the encryption
method was a Serbian code known as Rubidium. They were able to decipher it as follows:
FLECK AMISS BRAWN OWING QUIPS CHEWY PANDA
IDLER BLOKE FLUNG SHADY WANES JOIST HOTEL
BLAZE WHIST UTTER RUMOR TELLS PSALM YIKES
DECRY SHORN CUPID THERE EXTRA FUELS BUTYL
QUALM VINES WOULD MINUS SHOES PINKO JAILS
PYRES ASPEN STEEP GUILT BUCKO HOIST CUMIN
GLYPH SPAWN LATER CLUNG FEUDS SKIER YODEL
CHEAT DURUM FLUNK EXACT GULPS JERKY SHAKY
On 04/22/04 Source Leben was queried about the Rubidium code system. He reported that now for
dead drops with American agents the Serbians use triple encryption. The drop coordinates are
encrypted using a system named Sulphur that transforms one string of numbers into another string of
numbers. He does not know how it works, but has heard it is not very secure by itself. The
numbers are then spelled out in words. The next step is use of a simple cipher system to transform
that string of letters into words, such as the Potassium cipher. The Potassium cipher is just the
Serbian reference name for the one we call the Baconian cipher invented by Sir Francis Bacon, he
reports. Then the Rubidium cipher is applied to the resulting string of words. The Serbians
believe the Rubidium system is impossible to break, he reports, so the Serbs rely on that step for
high security. The other two systems are weak. He said that if American intelligence can break
the Rubidium system, the resulting message should be easy enough for amateurs to finish. It would
just be necessary to decrypt the Potassium cipher to get numbers spelled out in plaintext, and then
figure out how to break the Sulphur cipher to convert those numbers to coordinates.
On 04/24/04 the elsur team finished processing the misur recording. Through the new enhancement
techniques we are now experimenting with, the team was able to discern Subject muttering very
softly to himself during the 47-minute period after the call. The sounds were so faint and
garbled, they could only make out a few words, but they feel fairly certain that somewhere near the
middle of the mumbling were the words, "nine one six." It is believed that the sequence "nineonesix" appears in the plaintext of the encrypted message.
Summing up then, this is what we have:
- Coordinates (unenciphered - max 34-minute round trip by bike ride from church)
- ...nineonesix...(output text derived from applying Sulphur cipher to coordinates)
- FLECK ... SHAKY (output text using Baconian/Potassium)
- Electronic tones decrypted by NSA (encrypted using Rubidium)
- Subject's handler is probably using the same type of drop container as before.
ACTION: Our squad must work backward from step 3 to step 1 to decrypt the message and identify
the dead drop location. If the container can be located, the fingerprints on it may tie Subject to
known intelligence agents. This would be probable cause for an espionage arrest. Squad members
should study the following website that explains the Baconian (Potassium) cipher.
Baconian
Since the intermediate text is all five-letter words, we can assume each word represents one letter
of the step 2 text using the Baconian system like Example 2 in the link. We cannot assume,
however, that keying system will be so simple as A-M = A and N-Z = B. Note that the U and V use
the same cipher combination, BAABB, so "seven" and "five" will be spelled "seuen" and "fiue." Note
also that the ciphertext symbols never start with two B's. That means, using FLECK, for example,
that if the F is in the B group, L must be in the A group, and vice versa. Of course, both could
be in the A group. Our first priority should be to place the "nineonesix." That phrase,
enciphered in Baconian, is ABBAA ABAAA ABBAA AABAA ABBAB ABBAA AABAA BAAAB ABAAA BABAB. All agents
begin pattern matching and report any breakthroughs.
05/7/04: Leben was tasked with obtaining more information about the Sulfur cipher. He says all he knows is what he told us before: it converts strings of numbers into strings of numbers. He also corrected the handling agent as to the spelling; he said the Serbs always use the British spelling "sulphur" not the American spelling, but he's not sure why. He thinks it's some kind of cryptographic joke.