Locating Various HF Transmitters and Number Stations with KiwiSDRs
If you weren't already aware, the KiwiSDR is a US$299 HF SDR that can monitor the entire 0 - 30 MHz band at once. It is designed to be web-based and shared, meaning that the KiwiSDR owner, or anyone that they've given access, can tune and listen to it via a web browser over the internet. Many public KiwiSDRs can be found and browsed from the list at sdr.hu.
One thing that KiwiSDRs have is a GPS input which allows the KiwiSDR to run from an accurate clock, as well as providing positional data. Time Difference of Arrival (TDoA) is a direction finding technique that relies on measuring the difference in time that a signal is received at over multiple receivers spread out over some distance. In order to do this an accurate clock that is synchronized with each receiver is required. GPS provides this and is able to accurately sync KiwiSDR clocks worldwide.
Over on his blog Christoph Mayer has been steadily documenting his work on getting Time Difference of Arrival (TDoA) direction finding to work with KiwiSDRs. This is not an easy task with HF signals, as they tend to bounce around and propagate through various means, meaning that signals can be delayed if not received directly. So far it appears that he's been most successful in locating signals received by ground wave, but he is also working with an ionospheric ray-tracing model and electron density data to take into account propagation delays from skywave propagation.
In one post from late last year Christoph shows that he was able to pinpoint the location of the German DCF77 longwave time station by using three KiwiSDRs spread out around Europe. The actual location of DCF77 is already known, so this shows that the technique actually works. Other posts show him locating transmitters for STANAG 4285, some unknown frequency hopping signals, OTH radar from Cyprus, CODAR, DRM, VOLMET and more.
Christophs' code can be found at https://github.com/hcab14/TDoA. According to users gathering the data and running the code is still a fairly elaborate process. But there is talk over on the KiwiSDR forums about eventually creating a server that would allow users to more easily request a location computation for a particular signal.
Also related to this topic, priyom.org has been using KiwiSDRs to try and locate numbers stations. Numbers stations are mysterious voice stations on the HF bands that when transmitting read out a string of numbers. Most speculate that the numbers are some sort of code intended for international spy agents. Using a simpler method of just noting which KiwiSDRs in the world receive a particular numbers station more strongly, they've been able to determine the likely country of some well known stations.
Since there’s a lot of attention to SDR prices and deals on this site I’ll do a little shameless self-promotion. Massdrop.com every 4-6 weeks has been selling the Kiwi for US $80 to $100 off the $299 MSRP. There’s an active drop at the moment (29 June 2018). The downside is you have to wait for a drop to be active and then wait a bit longer for delivery. But for the price it’s definitely the best deal going.
Locating DCF77 is actually a trivial proof of concept because at 77 kHz, the signal doesn’t actually skip. It’s all ground wave. This makes accurate position determination relatively easy.
However accurate TDoA for signals that skip will require intimate knowledge of how the signal skips. Often they skip on “long path,” meaning they go the other way around the Earth. Sometimes they skip off of the Aurora near the poles. So if you’re going to get any accuracy at all, you’ll need to know how the signal is getting to the receiver in the first place.
Exactly. Which is why you employ statistical methods to sort out the multi-path problem. I encourage you to spend some time reading Christoph’s blog (and even his Matlab/Octave code) in more detail. Even with simplified assumptions about the transit time of the particular propagation path some of his results at HF are surprisingly good (see: https://hcab14.blogspot.com/2018/06/towards-ionospheric-ray-tracing.html) On the same order as the results at VLF/LF in some cases. And much of the ongoing improvement will be enabled by the expanding network of GPS-enabled Kiwis. Being able to choose optimal receiver locations for sampling is key. Europe and the Americas have good coverage now. More are needed in other parts of the world.
Of course time will tell how successful the technique is. But already it is being used by at least one of the well known HF utility/milcomm researchers (see: http://i56578-swl.blogspot.com/2018/06/stanag-4539-unexpected-data-rate-of.html)
Hello,
Here are some results obtained by a fellow member at priyom.org, for HF diplomatic communications on 14444 kHz:
See the bottom right map for the final combined results. This case seems rather successful to me, and we believe that this pinpoints the signal to the DPRK mission at the UN in Geneva. So I’m not sure how much accuracy you would expect and at what distance, but I would say the stuff works.
A quick lookup tells me that more than 70% of publicly listed KiwiSDR receivers are GPS-enabled. I maintain the wideband shortwave receiver map at http://rx.linkfanel.net/ and if you hover on a marker to display detailed receiver information, the mention “GPS clock available” will appear when applicable; so that’s rather useful to pick receivers relevant to your TDoA needs. So then now at priyom.org we also locate numbers stations using more advanced techniques than signal strength and VOACAP prediction guesswork 🙂
Of course that still only goes as far as where there are receivers available. In fact I would say that perhaps as is the case with modern machine learning techniques, the sophistication of the model matters much, much less, than the quantity (and quality) of the data you throw at it.
More than just talk now. KiwiSDR user @hf_linkz has a working Python app that simplifies the sampling process and running of Christoph’s TDoA algorithm (see: https://twitter.com/hf_linkz/status/1011032101876125697). I’m working on something similar, but implemented as a KiwiSDR extension using the kiwisdr.com server as a TDoA service. So no software installation required. Both have their advantages, and it’s amazing that amateur HFDF might actually be a reality.
There was a lot of criticism two years ago when the Kiwi was introduced with its built-in software defined GPS. Well, as the saying goes, those chickens have now come home to roost.