Abstract. We analyse N = 5,377 unique 30-character HFGCS broadcast payloads, retained as the first-broadcast instance of each distinct string observed between 2022 and 2026, against the working hypothesis that the payload body is statistically indistinguishable from uniform random base32 — the output distribution any IND-CPA-secure AEAD primitive would produce to a ciphertext-only observer. Three independent positional signatures contradict this hypothesis.
First, two specific base32 symbols (M and 5) are systematically under-represented at nearly every body position by approximately 35–40% relative to the uniform expectation, with aggregate Poisson z-scores of −21.2 and −20.9 against a synthetic uniform base32 control that passes the same test. The deficit persists within every prefix cell examined — median per-cell z ≈ −4.7 for M and −4.7 for 5 across the seventeen largest cells — and therefore cannot be attributed to stratum mixing. Second, positions 19 through 21 (bit offsets 91 through 105) show sharply attenuated deficits (|z| < 1.7 for both symbols), indicating a mid-body regime transition; positions 3 through 4 show a similar attenuation in the marginal channel only. Third, the rate of character equality at pairs of positions (doublets when adjacent; inter-position equalities in general) exhibits two regions of strong suppression: a co-localised suppression at the mid-body transition (position pairs 19–20 and 20–21 at z = −7.6 and −6.7) that independently confirms the marginal-deficit localisation there, and a much stronger near-deterministic suppression spanning the final six characters — not just at the five adjacent pairs but at every one of the fifteen pair-positions within positions 25–30 — with equality counts of 5–8 observed against ~105 expected per pair (a 15-fold reduction) persisting uniformly in every prefix cell. The six trailing characters are therefore near-certainly pairwise distinct within each message, not merely free of consecutive repeats.
Within each prefix, probes of pairwise positional mutual information, general compressibility, and inter-message differential structure return no further anomalies: pairwise z-scores sit within the shuffle-null envelope, compression ratios sit within the synthetic-random noise floor across all 41 prefix cells, and modular-difference distributions between date-ordered consecutive payloads are uniform. The conjunction of persistent non-uniform marginals, two regions of attenuated marginal deficit (positions 3–4 and 19–21), co-localised pairwise-equality suppression at positions 19–21, and 15-fold pairwise-equality suppression across all fifteen position pairs within 25–30 establishes that the 150-bit body carries at least four statistically distinguishable regions with transitions at specific character-grid boundaries. We deliberately avoid identifying any region with a specific cryptographic primitive: the ~35% M/5 deficit at main-body positions is itself inconsistent with the uniform-output behaviour that standard authenticator primitives (GMAC, Poly1305, truncated HMAC, SipHash) are designed to produce, and we accordingly decline to interpret the mid-body transition as the terminus of any particular standard-width authenticator. The three positional signatures appear in Group 1 only; Group 2 carries only a mild body-level M/5 deficit with no detectable internal boundary. Whatever generates the two groups' broadcasts, the two generators are not producing output with the same internal structure.
In plain language. Every day, United States military radio stations broadcast short strings of thirty letters and numbers over shortwave radio. Anyone with a receiver can hear them, but nobody outside the military knows what they mean. These broadcasts are called Emergency Action Messages.
You might assume each broadcast is scrambled by strong encryption — that each string looks completely random, with every one of the thirty-two possible characters (the letters A–Z and the digits 2–7) showing up about equally often. That is what good modern encryption produces. A listener watching the broadcasts from outside should see no favouritism toward any particular character and no particular pattern in how characters follow one another.
We looked at five years of collected broadcasts and found three ways in which this is not what happens — three independent fingerprints of structure that a properly random encryption would not leave.
First, two specific characters are unusually rare. Out of all thirty-two characters, the letter M and the digit 5 show up only about two-thirds as often as they should. Every other character behaves normally. This two-character deficit is not a fluke of one prefix group or one year: it appears in every sufficiently large prefix group of broadcasts we examined, across the whole time window.
Second, the deficit temporarily weakens in the middle of the broadcast. If you look position by position through the thirty characters, the shortage of M and 5 is present almost everywhere — except at positions nineteen, twenty, and twenty-one, where it gets noticeably milder. At those three positions, independently, the rate at which consecutive characters match each other also drops sharply. Two separate statistical probes agreeing on the same three positions is strong evidence that something in the underlying broadcast format changes there. We don't claim to know what that "something" is, and we specifically do not read this as evidence for any particular cryptographic component: the pattern of rare characters we see in the surrounding region is itself inconsistent with the kind of uniform-looking output that standard cryptographic components produce.
Third — and most striking — the last six characters of the broadcast almost never contain two identical characters, at any pair of positions within that six-character window. In a truly random string, any two chosen characters match by chance about 3% of the time. In the final six positions of these broadcasts, that rate drops to roughly 0.2% for every pair of positions — not only for neighbouring positions, but for characters one apart, two apart, up to the full six-character span. The rule is stronger than a no-doubled-letters rule: the six final characters are near-certainly all distinct from each other. We see this pattern in every single two-letter prefix group we examined, without exception. Whatever process builds the last six characters chooses them to be mutually different.
There is also a quieter fourth observation: at positions three and four — the two characters immediately after the prefix — the shortage of M and 5 vanishes. Those two characters look like a normal uniform random draw, unlike the rest of the body. It suggests a short ten-bit slot between the prefix and the main cryptographic region, carrying something like a counter, a short random number, or a version indicator.
Meanwhile, several other tests — looking for repeated patterns, hidden compressibility, and relationships between nearby broadcasts — find that, within any single prefix group's set of messages, the characters pass all the "does this look random?" checks we applied, once you account for the rare-characters deficit and the forbidden-doubles rule. So the non-randomness we find is not in chaotic noise but in specific places: the shortage of M and 5 almost everywhere except two short slots, the mid-broadcast transition at positions nineteen to twenty-one, and the forbidden-doubles rule at the tail. The simplest account is that the thirty-character string is made of at least four distinguishable pieces — a prefix, a short head slot, a long body, and a structured six-character tail — rather than a single uniform block of encrypted output. We stop short of saying which cryptographic primitive builds any given piece. The observations are enough to rule out "it's just a standard AEAD ciphertext", but not enough to say what it is instead.
Important caveat: all three of these structural patterns appear in Group 1 broadcasts. Group 2 broadcasts carry only the weak M/5 shortage and none of the positional structure. Group 2 broadcasts look much more like a single block of uniformly random-looking text. The two groups do not appear to use the same format.
The High-Frequency Global Communications System (HFGCS) broadcasts short fixed-length alphanumeric strings over shortwave radio as part of its Emergency Action Message (EAM) traffic. These broadcasts are publicly audible, routinely logged by open-source listener networks, and appear — to an observer without key material — as opaque base32 payloads. A natural working hypothesis is that each observed 30-character broadcast carries the output of a modern authenticated-encryption primitive under a per-session fresh nonce, and that the payload is therefore statistically indistinguishable from a uniform random string of 150 bits by any polynomial-time observer [1, 2].
This paper evaluates that hypothesis quantitatively against a long-collected corpus of observed broadcasts. The evaluation uses only ciphertext — no key material, no plaintext correspondences, no implementation-level fingerprints — and asks a single question: do the observable statistics of the broadcast payload match the distribution that any IND-CPA-secure AEAD scheme under fresh nonces must produce?
The answer is no. The empirical marginal distribution of base32 symbols in the 30-character payload body is not uniform: two specific symbols (M and 5) are reproducibly under-represented by approximately one-third at nearly every body position, and this deficit persists within every prefix cell examined. The position-wise profile of the deficit is not flat: it attenuates in two specific regions, and the mid-body region at positions 19–21 carries an independent doublet-rate suppression co-localised with the marginal attenuation. Conditional on the marginal deviation, probes of within-key pairwise positional dependence, general compressibility, and differential structure between temporally-adjacent broadcasts return no further anomalies.
The synthesis is that the broadcast payload is not a uniform draw on Σ30 but a concatenation of at least four statistically distinguishable regions along its 150-bit length, with transitions at specific character-grid boundaries. In particular, the final six characters of every broadcast are near-certainly pairwise distinct — every one of the fifteen pair-positions within the trailing window shows a roughly 15-fold suppression of character equality, not only the five adjacent pairs. This is a stronger rule than "no consecutive repetitions": the six final characters collectively form a six-element subset of the 32-symbol alphabet in each message. We deliberately avoid identifying any region with a specific cryptographic primitive. The observed main-body M/5 deficit is itself inconsistent with the uniform-output behaviour of standard authenticator constructions, which rules out the most natural ciphertext-only reading of the mid-body transition (namely, as the terminus of a standard-width authenticator). What the observations establish is the presence of the transitions, not their cryptographic meaning.
The paper is organised as follows. Section 2 formalises the observation model and the null hypothesis. Section 3 describes the corpus. Section 4 tests first-order symbol marginals against the uniform null. Section 5 analyses the position-wise profile of the marginal deviation. Section 6 reports an independent positional probe — the rate of consecutive-character repetition — that reveals two regimes of strong suppression and cross-validates the position-level localisation. Section 7 presents three within-key structural probes constraining the internal regularity of the payload. Section 8 synthesises the evidence into a region-level description of the payload and states explicitly what the observations do and do not license. Section 9 discusses limitations, alternative explanations, and follow-up probes. Section 10 concludes.
An observer with a shortwave receiver and a transcription pipeline captures, for each broadcast event, a tuple (date, time, callsign, prefix, addressee-flag, message, station-id). The observer does not hold key material, does not possess cleartext corresponding to any broadcast, and does not have access to implementation-level fingerprints (timing, power, electromagnetic emanation). The dataset used in this paper is the output of such a pipeline aggregated over multiple listeners.
We denote the observed message field as c ∈ Σ30 where Σ is the base32 alphabet {A, B, …, Z, 2, 3, 4, 5, 6, 7} of size 32 specified in RFC 4648. The first two characters of c constitute the prefix (the PR), which is not a uniform random value but a short identifier that rotates in and out of service on an operational schedule: each prefix is introduced, carries traffic for an active period (typically weeks to months, sometimes crossing a calendar-year boundary), and is eventually retired in favour of a new prefix identifier. The finest cryptographic partition the observable data supports is therefore "one prefix", treated as one operational key regime. The remaining 28 characters of c constitute the body c[3:30], carrying 28·log2(32) = 140 bits.
The working hypothesis under which the corpus would be "cryptographic" in the sense most often assumed by non-specialist readers is that each broadcast carries the output of an authenticated-encryption-with-associated-data (AEAD) primitive producing ciphertext indistinguishable from uniform on Σ30 to any polynomial-time observer without the key [2, 3, 4]. Formally:
Under IND-CPA [1], the ciphertext distribution is computationally indistinguishable from uniform on Σ30, independently of the underlying plaintext and conditional on the key. The directly testable implication is:
The empirical marginal distribution of base32 symbols at each body position is uniform on Σ up to finite-sample estimator bias of order N−1/2, identical in form across positions and across key-distinct sub-populations.
This implication is directly testable from the observation tuples. Sections 4 and 5 test it.
If the working hypothesis fails, the cryptographic interpretations of the broadcast payload that remain are:
Alternatives (1) and (2) are not mutually exclusive: a canonical authenticated-message format of the form authenticator ‖ field belongs to both. The body of this paper tests the working hypothesis against these alternatives. The evidence we report supports alternative (2) strongly — the payload has internal field boundaries — and is consistent with alternative (1) only in the weak sense that the within-prefix probes do not exclude a deterministic keyed-function component. We argue in §8.4 and §9.1 that identifying any specific region with a specific cryptographic primitive is not licensed by ciphertext-only observations, and that the observed main-body marginal deficit is in fact inconsistent with standard-width authenticator identification.
The corpus is a catalogue of 12,870 transcribed broadcast observations collected between 2022 and 2026 by a coordinated network of open-source listeners. Each observation carries the fields listed in §2.1. Rows whose quality flag contains flagging characters indicating uncertain capture are excluded, as are rows whose message text contains placeholder characters indicating incomplete transcription. Restricting to messages of length 30 whose prefix resolves to Group 1 or Group 2 in the active prefix assignment at the broadcast date yields 9,769 broadcast-level observations, after removing exact duplicates on the composite key (date, UTC time, callsign, message) to eliminate accidental double-entry.
Subsequent statistical tests require approximately independent observations. Operational retransmission — the same 30-character string broadcast repeatedly from the same or different stations within a short time window — violates this assumption. We therefore itemize the corpus by retaining, for each unique message string, the observation with the earliest (date, UTC) ordering, and discarding all later broadcasts of that same string. This produces N = 5,377 distinct messages; all statistical tests in this paper operate on this first-broadcast itemization.
Two prefix-derived strata and one addressee-flag derived stratum are defined a priori. The cohort comprises NG1 = 3,519 Group-1 and NG2 = 1,858 Group-2 unique messages. A finer stratification by individual prefix yields 41 cells with at least 50 unique first-broadcast messages; each such cell holds all traffic from a single prefix across its operational lifetime, which we treat as the finest cryptographic partition the data supports. Three Group-1 prefixes in this cohort straddle a calendar-year boundary (MQ 2022–2023, WR 2023–2024, ND 2024–2025); these are kept as single prefix cells rather than split artificially across years.
| level | count | interpretation |
|---|---|---|
| raw broadcast observations | 9,769 | full corpus after filtering |
| unique 30-character strings | 5,377 | first-broadcast itemization; base of all tests |
| of which Group 1 | 3,519 | |
| of which Group 2 | 1,858 | |
| retransmissions excluded | 4,392 | excluded from all statistical tests |
| prefix cells with N ≥ 50 | 41 | per-prefix (within-one-key) analysis |
The testable implication of the uniform-AEAD null is that the empirical distribution of base32 symbols at each body position is uniform up to finite-sample bias. This is equivalent to the NIST SP 800-22 frequency (monobit) test [7] applied to the 5-bit expansion of each base32 symbol, and equivalent to a chi-square goodness-of-fit test against the uniform on Σ at the symbol level.
For each base32 symbol c ∈ Σ, we count its occurrences at body positions 3 through 30 across all Group 1 first-broadcast messages (N = 3,519 messages × 28 body positions = 98,532 body characters), compute the Poisson z-score against the uniform expectation (98,532 / 32 ≈ 3,079 per symbol), and rank. Table 2 reports the ten most deviant symbols, compared against a synthetic uniform base32 control of matched size generated with a CSPRNG.
| symbol | base32 idx | bit pattern | G1 count | G1 pct | G1 z | control z |
|---|---|---|---|---|---|---|
| M | 12 | 01100 | 1,904 | 1.932% | −21.18 | +0.34 |
| 5 | 29 | 11101 | 1,920 | 1.949% | −20.89 | +1.24 |
| A | 0 | 00000 | 3,245 | 3.293% | +2.99 | +0.32 |
| S | 18 | 10010 | 3,242 | 3.290% | +2.94 | −0.58 |
| 3 | 27 | 11011 | 3,239 | 3.287% | +2.88 | −0.92 |
| L | 11 | 01011 | 3,232 | 3.280% | +2.76 | −1.05 |
| F | 5 | 00101 | 3,210 | 3.258% | +2.36 | +2.09 |
| E | 4 | 00100 | 3,199 | 3.247% | +2.16 | −0.15 |
| T | 19 | 10011 | 3,190 | 3.238% | +2.00 | +2.18 |
| X | 23 | 10111 | 3,187 | 3.234% | +1.94 | +0.00 |
Symbols M and 5 deviate from uniform by z = −21.18 and z = −20.89 respectively. Each occurs at roughly 1.94% of body positions, against an expected 3.125% (1/32). No other symbol deviates by more than |z| = 3.0. The bimodal structure — two extreme outliers and a near-uniform bulk — cannot be attributed to finite-sample noise, as demonstrated by the synthetic control. The bit patterns of M (01100) and 5 (11101) share no obvious common substructure that would implicate a specific bit-level bias in the underlying generator.
The aggregate deficit could in principle arise from the mixing of sub-populations with slightly different marginals — the Simpson's-paradox pathway discussed for pairwise mutual information in the statistical literature [8]. The appropriate test is whether the deficit persists within individual prefix cells. Table 3 reports the per-cell z-scores of M and 5 in the seventeen largest Group 1 prefix cells.
| prefix | year | N | M pct | M z | 5 pct | 5 z |
|---|---|---|---|---|---|---|
| GF | 2022 | 172 | 1.765 | −5.34 | 1.806 | −5.18 |
| MQ | 2022–2023 | 151 | 1.845 | −4.71 | 1.774 | −4.97 |
| 24 | 2023 | 166 | 2.582 | −2.10 | 1.936 | −4.58 |
| YL | 2023 | 143 | 1.948 | −4.21 | 1.998 | −4.03 |
| YT | 2023 | 182 | 1.923 | −4.85 | 1.864 | −5.09 |
| PJ | 2023 | 229 | 1.684 | −6.53 | 2.105 | −4.62 |
| CZ | 2023 | 241 | 1.897 | −5.71 | 2.238 | −4.12 |
| WR | 2023–2024 | 241 | 1.823 | −6.05 | 1.971 | −5.36 |
| AS | 2024 | 161 | 2.063 | −4.03 | 1.841 | −4.88 |
| TD | 2024 | 119 | 1.651 | −4.81 | 2.191 | −3.05 |
| Q5 | 2024 | 144 | 1.860 | −4.54 | 2.108 | −3.65 |
| MK | 2024 | 158 | 2.238 | −3.34 | 1.763 | −5.12 |
| C6 | 2024 | 142 | 1.610 | −5.41 | 2.037 | −3.88 |
| FV | 2024 | 140 | 1.735 | −4.92 | 1.480 | −5.83 |
| AA | 2025 | 146 | 1.908 | −4.40 | 2.153 | −3.52 |
| SE | 2025 | 103 | 1.976 | −3.49 | 1.491 | −4.96 |
| LH | 2026 | 100 | 1.929 | −3.58 | 1.857 | −3.80 |
The same analysis applied to Group 2 body positions (N = 1,858 × 28 = 52,024 characters) returns the same two symbols as the most under-represented, though with attenuated magnitudes: M at z = −3.57, 5 at z = −1.88. The finding is therefore not restricted to Group 1; it is present in both groups with the same identity of the affected symbols. This is more consistent with a mechanism shared across groups than with a group-specific generator property.
If the M/5 deficit reflects a structural property of the broadcast format — for example, a bit-level mask applied at specific positions, or a concatenated-field layout where certain positions are drawn from a different distribution — the deficit should concentrate at those positions. If the deficit reflects a uniform generator property, it should distribute evenly across positions.
Table 4 reports the per-position z-score of M and 5 counts across the 3,519 Group 1 first-broadcast messages at each of the thirty character positions.
| pos | bit range | M z | 5 z | note |
|---|---|---|---|---|
| 1 | 1–5 | +20.12 | −4.96 | prefix char 1 (PR-distribution) |
| 2 | 6–10 | −7.15 | +3.25 | prefix char 2 (PR-distribution) |
| 3 | 11–15 | −0.47 | −0.86 | deficit attenuates |
| 4 | 16–20 | −0.47 | +0.00 | deficit attenuates |
| 5 | 21–25 | −4.57 | −5.05 | |
| 6 | 26–30 | −4.67 | −4.77 | |
| 7 | 31–35 | −4.67 | −4.67 | |
| 8 | 36–40 | −3.91 | −4.86 | |
| 9 | 41–45 | −4.67 | −5.24 | |
| 10 | 46–50 | −4.86 | −4.00 | |
| 11 | 51–55 | −5.53 | −4.00 | |
| 12 | 56–60 | −4.38 | −4.67 | |
| 13 | 61–65 | −5.24 | −4.29 | |
| 14 | 66–70 | −6.00 | −6.29 | |
| 15 | 71–75 | −5.24 | −4.86 | |
| 16 | 76–80 | −4.29 | −3.24 | |
| 17 | 81–85 | −3.62 | −3.91 | |
| 18 | 86–90 | −5.15 | −4.96 | |
| 19 | 91–95 | −0.47 | −1.24 | deficit attenuates |
| 20 | 96–100 | −1.14 | −0.38 | deficit attenuates |
| 21 | 101–105 | −0.47 | −1.62 | deficit attenuates |
| 22 | 106–110 | −4.77 | −3.53 | |
| 23 | 111–115 | −5.05 | −4.48 | |
| 24 | 116–120 | −5.24 | −5.24 | |
| 25 | 121–125 | −5.34 | −4.67 | |
| 26 | 126–130 | −4.77 | −4.67 | |
| 27 | 131–135 | −4.48 | −4.38 | |
| 28 | 136–140 | −6.00 | −4.86 | |
| 29 | 141–145 | −3.91 | −5.43 | |
| 30 | 146–150 | −2.67 | −4.38 |
The positions-3–4 region could in principle carry a sequence counter, short nonce, version token, or sub-key index — a 10-bit slot admits 1,024 distinct values — but the data does not constrain its semantic role any further than "uniform-looking draw from the base32 alphabet, distinct from the surrounding body." Symmetrically, the positions-19–21 region could mark a concatenation boundary, a post-processing artefact, or a bit-width discontinuity in the underlying generator; the observations distinguish it as structurally significant without identifying its source.
The inference is limited to the position-level statement: the M/5 deficit has internal positional structure, with attenuation at positions 3–4 and 19–21 that breaks from the surrounding pattern. This is difficult to account for under any hypothesis of a single uniform-output generator operating across all 150 bits. It is suggestive of a concatenation format in which different regions are produced by different mechanisms, but it does not on its own identify any region with a specific cryptographic primitive, and in particular does not support identifying the pre-transition region as a standard-width authenticator — the surrounding M/5 deficit is the wrong statistical signature for that identification (see §8.4, §9.1).
A second positional probe, independent of the marginal analysis of §4–§5, tests the rate at which consecutive characters coincide — the probability that message position i carries the same base32 symbol as position i+1. Under the uniform null, this doublet probability is exactly 1/32 = 3.125% at every position pair, regardless of how the marginals are distributed across symbols. A format imposing a no-run constraint at specific positions would produce localised suppression of the doublet rate.
Table 5 reports the empirical doublet count at each of the twenty-nine position pairs in the Group 1 first-broadcast cohort (N = 3,519), the same statistic in Group 2 (N = 1,858), and in a synthetic uniform base32 control of matched Group 1 size. The Poisson standard deviation under the null is N1/2/321/2, i.e., approximately 10.49 doublets per position pair in the G1 column. Column z-scores are reported against this null.
| pair | bit range | G1 count | G1 z | G2 count | G2 z | syn z |
|---|---|---|---|---|---|---|
| 1–2 | 1–10 | 146 | +3.44 | 101 | +5.63 | +0.29 |
| 2–3 | 6–15 | 114 | +0.38 | 53 | −0.66 | +1.05 |
| 3–4 | 11–20 | 99 | −1.05 | 63 | +0.65 | +1.62 |
| 4–5 | 16–25 | 125 | +1.43 | 56 | −0.27 | +0.96 |
| 5–6 | 21–30 | 115 | +0.48 | 52 | −0.80 | +0.10 |
| 6–7 | 26–35 | 104 | −0.57 | 49 | −1.19 | +0.86 |
| 7–8 | 31–40 | 125 | +1.43 | 66 | +1.04 | +0.77 |
| 8–9 | 36–45 | 132 | +2.10 | 48 | −1.32 | +0.96 |
| 9–10 | 41–50 | 102 | −0.76 | 58 | −0.01 | −0.28 |
| 10–11 | 46–55 | 123 | +1.24 | 58 | −0.01 | −1.52 |
| 11–12 | 51–60 | 114 | +0.38 | 66 | +1.04 | −0.28 |
| 12–13 | 56–65 | 113 | +0.29 | 59 | +0.12 | −0.47 |
| 13–14 | 61–70 | 97 | −1.24 | 59 | +0.12 | +0.67 |
| 14–15 | 66–75 | 109 | −0.09 | 68 | +1.30 | −0.19 |
| 15–16 | 71–80 | 113 | +0.29 | 56 | −0.27 | +0.19 |
| 16–17 | 76–85 | 118 | +0.77 | 63 | +0.65 | +0.19 |
| 17–18 | 81–90 | 100 | −0.95 | 53 | −0.66 | +0.19 |
| 18–19 | 86–95 | 119 | +0.86 | 58 | −0.01 | +0.58 |
| 19–20 | 91–100 | 30 | −7.63 | 51 | −0.93 | −0.47 |
| 20–21 | 96–105 | 40 | −6.67 | 66 | +1.04 | +0.00 |
| 21–22 | 101–110 | 115 | +0.48 | 57 | −0.14 | +0.19 |
| 22–23 | 106–115 | 111 | +0.10 | 60 | +0.25 | +0.67 |
| 23–24 | 111–120 | 132 | +2.10 | 62 | +0.52 | +0.38 |
| 24–25 | 116–125 | 109 | −0.09 | 59 | +0.12 | +0.00 |
| 25–26 | 121–130 | 7 | −9.82 | 69 | +1.44 | +1.05 |
| 26–27 | 126–135 | 5 | −10.01 | 52 | −0.80 | +1.24 |
| 27–28 | 131–140 | 8 | −9.72 | 68 | +1.30 | −0.28 |
| 28–29 | 136–145 | 7 | −9.82 | 70 | +1.57 | +0.29 |
| 29–30 | 141–150 | 7 | −9.82 | 69 | +1.44 | −1.43 |
The aggregate doublet suppression at position pairs (25–26) through (29–30) would be produced by stratum mixing only if individual prefix cells carried normal doublet rates that averaged to the observed suppression — which is arithmetically impossible. Direct verification nevertheless shows that every individual prefix cell in Group 1 with N ≥ 100 independently exhibits the suppression, with doublet counts at trailing positions of 0, 1, 2, or 3 against expected counts of 3.1 to 7.5 per cell.
| prefix | year | N | expected | 25–26 | 26–27 | 27–28 | 28–29 | 29–30 |
|---|---|---|---|---|---|---|---|---|
| GF | 2022 | 172 | 5.4 | 0 | 1 | 1 | 0 | 3 |
| MQ | 2022–2023 | 151 | 4.7 | 0 | 0 | 2 | 0 | 0 |
| 24 | 2023 | 166 | 5.2 | 0 | 0 | 0 | 2 | 0 |
| YL | 2023 | 143 | 4.5 | 1 | 0 | 0 | 0 | 0 |
| YT | 2023 | 182 | 5.7 | 1 | 0 | 0 | 0 | 1 |
| PJ | 2023 | 229 | 7.2 | 0 | 1 | 0 | 0 | 0 |
| CZ | 2023 | 241 | 7.5 | 0 | 2 | 0 | 1 | 0 |
| WR | 2023–2024 | 241 | 7.5 | 2 | 0 | 0 | 0 | 1 |
| AS | 2024 | 161 | 5.0 | 1 | 0 | 0 | 0 | 0 |
| TD | 2024 | 119 | 3.7 | 1 | 0 | 0 | 0 | 1 |
| Q5 | 2024 | 144 | 4.5 | 0 | 0 | 0 | 1 | 0 |
| MK | 2024 | 158 | 4.9 | 0 | 0 | 0 | 0 | 0 |
| C6 | 2024 | 142 | 4.4 | 0 | 0 | 0 | 0 | 0 |
| FV | 2024 | 140 | 4.4 | 0 | 0 | 0 | 0 | 0 |
| AA | 2025 | 146 | 4.6 | 0 | 0 | 1 | 0 | 0 |
| SE | 2025 | 103 | 3.2 | 0 | 0 | 2 | 0 | 0 |
| LH | 2026 | 100 | 3.1 | 1 | 0 | 0 | 0 | 0 |
A weaker but still positively detected suppression appears at position pairs (19–20) and (20–21) — the same region of the payload at which the M/5 marginal deficit attenuates (§5). At the aggregate level these two pairs give z-scores of −7.63 and −6.67 respectively, with doublet counts of 30 and 40 against the expected ~110. Per-prefix disaggregation (not tabulated) confirms that the majority of large prefix cells contribute zero or one doublet at position pair (19–20), with the remaining cells contributing small positive counts; the pattern is less uniform than the trailing-region suppression but cleanly cross-validates the 96-bit boundary hypothesis introduced in §5.
The two signatures — marginal M/5 attenuation in one direction and doublet suppression in another — are jointly localised at the same positional region, arising from different statistical channels, and therefore constitute independent evidence for a format boundary in that region.
The doublet probe tests adjacent position pairs (i, i+1) for identical-character rates. The natural generalisation tests every position pair (i, j) with j > i — including non-adjacent pairs. This is the inter-position equality (IPE) probe. Under the uniform null the expected match count at each pair is N/32 regardless of the gap, so the probe extends the doublet statistic to the full triangular matrix of position-pair coincidences. At 30 characters this covers C(30, 2) = 435 pairs; the per-family Bonferroni threshold at α=0.05 is |z| > 3.86.
Applied to Group 1 first-broadcast messages (N = 3,348), the probe returns 18 pairs above the Bonferroni threshold on the deficit side. These pairs fall cleanly into two regions:
The generalisation has a concrete implication: the tail finding is better described as a no-any-duplicate rule on the final six characters, not as a no-consecutive-repetition rule. The distinction matters because the two constraints differ in format implication. "No adjacent duplicates" is consistent with a generator that simply rejects immediate repeats. "No pairs of equal characters at any offset within the six-character tail" is a stronger constraint: the six characters collectively form a set with cardinality close to 6, drawn from the 32-symbol alphabet without replacement within this window. The number of such 6-character sequences is 32·31·30·29·28·27 = 6.5·108 (about 29.6 bits of information capacity), compared with 326 = 10.7·108 under the uniform null (30 bits) — roughly 0.4 bits lost to the no-duplicate rule, distributed as a uniform constraint on the whole six-character block rather than as a per-pair restriction.
The preceding sections reject uniformity at the marginal level and reject freshness at the collision level. To complete the statistical portrait, we ask whether the observed payload, considered as output of a deterministic function on unseen inputs, behaves like a strong pseudorandom function within a single prefix. This is equivalent to testing whether, conditional on the first-order marginal deviations and the operational replay structure, the joint structure of body positions is consistent with a PRF.
Three within-key tests are reported: pairwise mutual information, LZMA compressibility, and first-order differential structure between consecutive messages.
For each prefix cell with N ≥ 100, we compute the empirical pairwise mutual information between the terminal pair of positions, I(X29; X30), and its 200-replicate column-shuffle null. Table 7 summarises the result for the ten Group 1 prefix cells with the largest unique-message counts. The same test on the full pooled cohort returns z = +6.23 at this position pair; within any single prefix, the signal disappears.
| prefix | year | N | I(X29; X30) | μnull | σnull | z |
|---|---|---|---|---|---|---|
| GF | 2022 | 172 | 2.444 | 2.425 | 0.037 | +0.52 |
| MQ | 2022–2023 | 151 | 2.624 | 2.559 | 0.040 | +1.63 |
| 24 | 2023 | 166 | 2.433 | 2.465 | 0.044 | −0.73 |
| YT | 2023 | 182 | 2.449 | 2.396 | 0.037 | +1.44 |
| PJ | 2023 | 229 | 2.203 | 2.194 | 0.039 | +0.24 |
| CZ | 2023 | 241 | 2.153 | 2.139 | 0.040 | +0.36 |
| WR | 2023–2024 | 241 | 2.162 | 2.109 | 0.035 | +1.52 |
| AS | 2024 | 161 | 2.487 | 2.504 | 0.037 | −0.46 |
| MK | 2024 | 158 | 2.613 | 2.558 | 0.038 | +1.43 |
| AA | 2025 | 146 | 2.733 | 2.684 | 0.039 | +1.23 |
The same pattern holds at every other position pair we examined: within a single prefix, the pairwise joint distribution of any two body positions is indistinguishable from the product of the marginals up to the noise floor of the shuffle null.
Across all 41 prefix cells with N ≥ 50, we compute the LZMA compression ratio of the shuffled and prefix-stripped 28-character bodies and compare against a ten-seed synthetic uniform base32 control of matched size. Under the Bonferroni threshold for 41 tests (|z| > 3.24), zero cells exhibit significant excess compressibility, and the cell-level z-score distribution is approximately centred near zero with no cell exceeding +3. These results are consistent with a strong PRF output within each prefix.
If the broadcast payload were generated from a counter or state-machine, position-wise character differences between temporally-adjacent messages within the same prefix would show non-uniform structure. For each prefix cell with N ≥ 100, we compute the distribution of modular differences Δ = (ci+1[p] − ci[p]) mod 32 at body positions p ∈ [3, 30] between consecutive messages in date-ordered sequence, and compute the chi-square statistic against the uniform on {0, 1, …, 31}. The five largest Group 1 cells give z-scores (chi-square standardised) of {+0.37, +2.30, +0.00, −1.59, +2.01}. No cell clears the Bonferroni threshold. The temporal-difference distribution is consistent with uniformity, excluding simple counter-based or state-machine structures within a single prefix.
Together, the three within-prefix tests support a narrow conclusion: conditional on the first-order marginal deviations and conditional on operational replay, the broadcast payload within any single prefix exhibits no further detectable regularities in pairwise structure, compressibility, or inter-message differences. This is what a strong deterministic keyed function of unseen inputs would produce once the overall marginal and positional structure documented in §4–§6 were present; it is also what a simpler non-cryptographic generator would produce if that generator happened to pass our three probes [6]. The within-prefix probes exclude simple failure modes — a stuck RNG, a short-period PRG, counter- or state-machine-based construction — but do not uniquely identify the underlying generator.
The evidence presented in sections 4 through 7 contradicts the null hypothesis that the 30-character body is a uniform draw from Σ30, as any IND-CPA-secure AEAD ciphertext would appear to a ciphertext-only observer. Three independent channels of evidence support this conclusion, and three within-key probes constrain the shape of the deviation. This section synthesises what the data can support — a region-level description of the payload along its 150-bit length — and explicitly states what it cannot support, namely identification of any region with a specific cryptographic primitive.
The observed base32 symbol marginal distribution (§4) is not uniform. Two specific symbols are under-represented by approximately 35–40% relative to the expected 1/|Σ| rate. The deviation exceeds 20σ in aggregate and persists within every prefix cell examined, with median per-cell magnitudes of roughly −4.7σ and −4.6σ on the seventeen largest cells. A synthetic uniform base32 control of matched size does not reproduce this pattern. The first-order marginal of the output is therefore not uniform.
This finding alone excludes the simplest interpretation under which the broadcast is a per-session AEAD ciphertext with uniform output. A secure AEAD primitive, viewed from outside the keyholder, produces a uniform distribution on Σ30 up to finite-sample noise; the observations are incompatible with that distribution by many orders of standard deviation.
The position-wise profile of the marginal deficit (§5) is not uniform across positions. Positions 5 through 18 and 22 through 24 carry the full strength of the M/5 deficit; positions 3–4 and 19–21 carry an attenuated deficit (|z| < 1.7 for both symbols in each region). Two regions therefore break from the surrounding pattern: one at the head of the body (positions 3–4, bit offsets 11–20), one mid-body (positions 19–21, bit offsets 91–105).
The doublet-suppression profile (§6) distinguishes these two regions further. The mid-body region at positions 19–21 carries a co-localised doublet suppression (z = −7.63 at 19–20, −6.67 at 20–21); the head-of-body region at positions 3–4 does not (pair-doublet z = −1.05, within noise). In addition, a much stronger doublet suppression occupies the five final consecutive position pairs (25–26 through 29–30, covering bits 121–150), in which the doublet rate drops to roughly 1/500 — a fifteen-fold reduction from the 1/32 uniform expectation — and the constraint persists in every prefix cell. A localisation of this kind is not produced by a single uniform-output primitive operating across all 150 bits. The payload carries at least four distinguishable statistical regimes along its length, with transitions at the character-grid boundaries between them.
Conditional on the first-order marginal deviation and the doublet-suppression structure, the within-prefix structural probes (§7) do not introduce further anomalies: pairwise positional mutual information sits within the shuffle-null envelope, compression ratios sit within the synthetic-random noise floor across all 41 prefix cells, and modular-difference distributions between date-ordered consecutive payloads are uniform. These outcomes are what one would expect if the payload were generated by a deterministic process whose output — when stripped of the marginal-level deviation and the doublet-level structure — carries no additional detectable regularity in our probes. This is consistent with, but does not prove, the use of a strong keyed function somewhere in the generator pipeline [6, 5]. The within-prefix probes rule out simple failure modes (stuck RNG, short-period PRG, table-lookup construction) but cannot, on their own, establish cryptographic provenance.
The observations support a format-level claim and rule out a null, but they do not support identification of a specific cryptographic primitive.
What the data supports. The 150-bit Group 1 payload is not the output of a single uniform-random-on-Σ30 generator. It has at least four statistically distinguishable regions along its length: a prefix region (positions 1–2) whose distribution follows the PR identity rather than the body generator; an attenuated-deficit region at positions 3–4; a main-body region (positions 5–18 and 22–24) carrying the full M/5 deficit; a joint attenuation at positions 19–21 in both the marginal and doublet channels; and a no-duplicate region at positions 25–30 in which the character-equality rate drops roughly 15-fold below the uniform expectation at every one of the fifteen pair-positions within the window — not only at adjacent pairs — so that the six trailing characters are near-certainly pairwise distinct in each message. Schematically:
where the subscripts label region widths in bits: P10 is the 10-bit prefix (positions 1–2, carrying the PR); X10 is a 10-bit region at positions 3–4 in which the M/5 deficit is absent; B75 is the 75 bits at positions 5–19 that carries the main-body M/5 deficit; T25 is a 25-bit region at positions 20–24 in which both the marginal and doublet statistics attenuate relative to B; and R30 is a 30-bit region at positions 25–30 under a pairwise no-duplicate constraint — every pair of positions within the region shows a 15-fold equality suppression, so that the six characters are near-certainly distinct from each other in each message. The bit boundaries are approximate and pinned to the character grid; finer resolution awaits the bit-offset scan outlined in §9.4. Equation (2) names regions by their statistical behaviour, not their cryptographic role.
What the data does not support. The observations do not identify the B and T regions together with a standard-width cryptographic authenticator — GMAC, Poly1305, a truncated HMAC, SipHash, or a similar construction terminating at the T/R boundary. Standard authenticator primitives are designed to produce output that is computationally indistinguishable from uniform random bits across their entire output width [3, 4, 5]. Under any such primitive, the main-body region B would exhibit a flat marginal distribution, not the approximately 35% M/5 deficit we observe. The deficit's presence at main-body positions is the direct evidence against standard-authenticator identification in that region: if B carried a uniform-output MAC, the deficit would not be there. Reading the T-region attenuation as "the authenticator ends here" requires assuming the region before it is an authenticator, which the marginal statistics already rule out. And the T-region's position in the vicinity of the 96-bit bit offset — a common tag width in AEAD constructions — is geometry, not evidence. A transition at positions 3–4 is also present in the marginal channel, without any comparable round-number alignment, which underscores that "a body region whose M/5 deficit attenuates" is a general structural feature and not a unique landmark.
The co-localisation of marginal attenuation and doublet suppression at positions 19–21 remains the strongest evidence that the payload has internal boundaries, and the trailing no-run constraint at positions 25–30 is a separate finding that needs no primitive-identification argument — it is a near-deterministic structural rule on the final six characters of the broadcast. Those two findings stand on their own. The 10-bit attenuated region at positions 3–4 is a weaker finding — only the marginal channel carries it — but it is geometrically symmetric to the pattern at 19–21 and is reported here for completeness. What generates the main-body M/5 deficit, and what generates the trailing-region no-run constraint, are open questions for which ciphertext-only analysis does not provide an answer.
The 30-character HFGCS Group 1 broadcast payload is not the output of a single uniform-random generator. It has at least four distinguishable statistical regions along its 150-bit length, with a joint marginal-plus-doublet transition at positions 19–21 and a near-deterministic pairwise no-duplicate rule on the final six characters (positions 25–30): every one of the fifteen pair-positions within that window shows a ~15× equality suppression, so the six trailing characters are near-certainly pairwise distinct within each message. Identification of any region with a specific cryptographic primitive is not supported by the data: the M/5 deficit in the main body is inconsistent with the uniform-output behaviour of standard authenticators, and no interpretation of the mid-body transition as the terminus of such a primitive survives that constraint.
Applying the same four structural probes to the Group 2 cohort (N = 1,858), and to its addressee-status sub-slices (G2 with addressee, N = 1,368; G2 without addressee, N = 490), returns a sharply different result: the G1 boundary attenuation at positions 19–21 and the trailing-region no-run constraint at positions 25–30 are both absent. Table 8 reports the side-by-side probe values.
| probe | G1 (all) | G2 (all) | G2 w/ addr | G2 w/o addr |
|---|---|---|---|---|
| aggregate body M z | −21.18 | −3.57 | −2.51 | −2.74 |
| aggregate body 5 z | −20.89 | −1.88 | −1.71 | −0.81 |
| pos 19 M / 5 z | −0.47 / −1.24 | +0.12 / −0.80 | −1.19 / −0.57 | +2.22 / −0.59 |
| pos 20 M / 5 z | −1.14 / −0.38 | −1.98 / +2.09 | −1.19 / +1.11 | −1.87 / +2.22 |
| pos 21 M / 5 z | −0.47 / −1.62 | +0.39 / +0.65 | +0.19 / −0.11 | +0.43 / +1.45 |
| doublet pair 19–20 z | −7.63 | −0.93 | −0.27 | −1.36 |
| doublet pair 20–21 z | −6.67 | +1.04 | +0.80 | +0.69 |
| doublet pair 25–26 z | −9.82 | +1.44 | +0.80 | +1.45 |
| doublet pair 26–27 z | −10.01 | −0.80 | −0.42 | −0.85 |
| doublet pair 27–28 z | −9.72 | +1.30 | +1.26 | +0.43 |
| doublet pair 28–29 z | −9.82 | +1.57 | +2.03 | −0.34 |
| doublet pair 29–30 z | −9.82 | +1.44 | +1.26 | +0.69 |
Within Group 2, the aggregate M/5 body deficit is present but an order of magnitude weaker than in G1 (body z around −3 and −2 respectively), and the position-wise and doublet profiles are flat — every position and every doublet pair behaves as uniform to within ±2σ, apart from the prefix positions 1–2. The appropriate format description for Group 2 is the minimal one shown in Figure 6: a 10-bit prefix field followed by a single 140-bit body field without detectable internal boundaries.
The immediate cryptographic inference: Group 1 and Group 2 are not the same format. If both were outputs of the same scheme under different key material, we would expect identical structural signatures up to sampling noise — identical boundary behaviour, identical trailing-region constraints. We do not see that. The two groups either use different underlying generators, or one group's payload is being processed through an additional structural layer absent in the other. Ciphertext-only analysis cannot distinguish these sub-hypotheses, and we note the observation without claiming to identify its cause.
Ciphertext-only analysis cannot identify the specific cryptographic primitive generating any part of the payload, and the observations in this paper in fact argue against reading the pre-transition region as a standard-width cryptographic authenticator. The problem is internal to the data: standard authenticator primitives — GMAC, Poly1305, truncated HMAC, SipHash, CMAC, and their relatives — are specifically designed to produce output that is computationally indistinguishable from uniform random bits across their entire output width [3, 4, 5]. Under any such primitive, the marginal distribution of base32 symbols across the output should be flat, with each symbol occurring with probability 1/32 ± O(N−1/2). What we observe at main-body positions is a roughly 35% deficit on two specific symbols, sustained at ≥20σ in aggregate. Whatever generates the main-body region, it is not producing uniform output — and so it is not a standard authenticator primitive at that width.
The mid-body transition does happen to sit in the vicinity of the 96-bit offset — a common tag width in AEAD constructions — but the coincidence is not itself evidence. A transition at a given bit offset is consistent with an authenticator terminating there or with any of a number of non-cryptographic structural transitions: a block-cipher word boundary, a field-separator in an encoding layer, a sub-key rotation boundary, or an artefact of a post-processing step applied to the raw generator output. The existence of a second attenuation region at positions 3–4, which sits nowhere near a canonical cryptographic length, further weakens the case for treating the bit-96 alignment as diagnostic: regions of attenuated deficit are a general feature of the body, not a single landmark. Distinguishing among the causal hypotheses requires correspondences between the payload and its underlying inputs (plaintext/nonce/associated-data tuples) that ciphertext-only analysis cannot supply. What the data supports is the narrower claim that the payload has internal structural boundaries — one at positions 19–21, one weaker boundary at positions 3–4, and one at positions 25–30 — whose origins are not established here.
The pairwise MI probe is insensitive to three-way and higher-order joint dependencies [6]. Modern cryptographic primitives can leave joint structure detectable only at order three or higher. At N ≈ 200 per prefix cell and an alphabet of 32 symbols, the 323 = 32,768 triplet cells are populated at ~0.006 counts per cell on average, which precludes credible triplet inference. The combined 5,377 unique messages permit roughly 0.16 counts per triplet cell — still below the threshold for a principled triplet goodness-of-fit test. Resolving higher-order structure would require either a substantially larger corpus (on the order of 105 unique messages) or a targeted test of a specific hypothesised primitive rather than a generic search.
The marginal-bias finding has an effect size of approximately 35–40% relative deficit on the affected symbols, against a null standard error of roughly 0.2% at aggregate sample size — an effect detectable at 21σ in aggregate and at roughly 4σ even in the smallest individual prefix cell examined. The doublet-suppression finding at the trailing region is a fifteen-fold reduction in rate, detectable at z ≈ −10 in aggregate and −2 to −3 per cell; taken over the five-position trailing block its Fisher's-combined p-value across the seventeen examined prefix cells is smaller than 10−100. The power to detect both observed effects is therefore near unity, and their per-cell persistence is sufficient to rule out sampling noise as an explanation at any standard significance threshold.
Two follow-up directions would substantively advance the analysis:
The 30-character HFGCS broadcast payload body is not a uniform draw from the base32 alphabet. Three independent statistical signatures, each robust to stratification down to individual prefix cells, contradict the uniform-AEAD null: (i) two specific symbols (M and 5) are under-represented by approximately one-third at nearly every body position, persistent at ≥4σ in every large prefix cell; (ii) the position-wise profile of this deficit attenuates sharply at character positions 19 through 21 — and, more weakly, at positions 3–4 — indicating internal structural transitions in the body; and (iii) the rate of character equality at pairs of positions drops to roughly one-fifteenth of the uniform expectation across every one of the fifteen pair-positions within the final six characters (positions 25–30), uniformly within every prefix examined — a near-deterministic pairwise no-duplicate rule rendering the six trailing characters mutually distinct in each message. The rule holds not only at the five adjacent pairs originally detected by the consecutive-doublet probe but at every pair within the six-character window (§6.3). Within-prefix probes of pairwise positional independence, compressibility, and inter-message differential structure exhibit no further detectable regularity.
Taken together these observations are incompatible with the interpretation of the Group 1 broadcast payload as the output of a primitive producing uniform ciphertext across all 150 bits. The payload has internal structural boundaries. The observations support a region-level description of the body — a 10-bit prefix, a 10-bit head region at positions 3–4 where the M/5 deficit is absent, a main body at positions 5–18 and 22–24 where the deficit is fully active, a co-localised marginal-plus-doublet transition at positions 19–21, and a pairwise no-duplicate region at positions 25–30 in which the six trailing characters are near-certainly distinct from each other — and this region-level description is the strongest format-level claim the observations license. We deliberately stop short of identifying any region with a specific cryptographic primitive. The main-body M/5 deficit is inconsistent with the uniform-output behaviour that standard authenticator primitives (GMAC, Poly1305, truncated HMAC, SipHash) are designed to produce, so the natural ciphertext-only reading — a truncated-authenticator output terminating at the mid-body transition — is ruled out by the statistics of the region that would carry the authenticator. What generates the main-body deficit, and what generates the trailing-region pairwise no-duplicate rule, remain open questions that ciphertext-only analysis cannot answer. The same structural probes applied to Group 2 return none of these signatures (§8.5): the G2 body carries only a mild M/5 deficit and no detectable internal boundary. Whatever each group's generator is, the two are not producing output with the same internal structure.
To the reader interested in what is and is not knowable about HFGCS broadcast structure from public observation alone: we have established that the payload is not uniform-output encryption and that it has at least four statistically distinguishable regions along its length, we have identified the positions at which those regions meet, and we have specified the follow-up probes that would refine the format further. The strongest free-standing cryptographic observation — the one that needs no interpretation beyond its data-level statement — is the 15-fold suppression of pairwise character equality across the fifteen pair-positions within the final six characters, in every prefix examined. The targeted bit-offset scan across the 150-bit payload and the cross-corpus comparison across broadcast lengths are the natural next steps.
The scope of the tail no-duplicate rule is already known to be Group-stratified rather than universal: Group 2 at 30 characters does not carry it (§8.5). Separate per-position structural heatmap work on the broader HFGCS corpus at other fixed lengths finds a variety of format-level structures across lengths and groups, but none of the heatmaps we have examined for Group 2 or Group 4 cohorts at other lengths shows a tail-region signature analogous to the 30-character Group 1 rule. The productive open question is whether the tail no-duplicate rule is a property of the Group 1 encoding that reproduces in Group 1 traffic at other fixed lengths, rather than a system-wide HFGCS feature, and applying the IPE and doublet-rate probes of §6 directly to Group 1 cohorts at other lengths would settle it. That test is left to future work.
All analyses were performed in Python 3.14 using pandas for data manipulation, numpy for matrix computation, and the Python standard library modules lzma, gzip, and bz2 for compression (the compression analyses reported in §7.2 use LZMA at preset 9 with the PRESET_EXTREME flag). All pseudorandom operations — column shuffling for the MI null, message reordering for the compression variants, and synthetic corpus generation — are seeded with fixed integer seeds to ensure exact reproducibility.
The empirical column-shuffle null distribution for pairwise mutual information was validated against the Miller–Madow analytic prediction. At the combined first-broadcast cohort size N = 5,377 and |Σ| = 32 with all 32 symbols observed at every body position, the analytic bias under independence is (|Σ|−1)2 / (2N ln 2) ≈ 0.129 bits. Across the per-prefix cells (N ranging from ~100 to ~250), analytic bias scales from ~0.8 bits at the smallest to ~0.3 bits at the largest; the empirical shuffle-null means recovered in each analysis track the analytic prediction to within a few thousandths of a bit, validating the null as an appropriate reference for z-score computation at every sample size examined.
For each prefix cell analysed in §7.2, ten synthetic random corpora of matched N were generated with fixed seeds 1000 through 1009. The reported null (μnull, σnull) is the mean and sample standard deviation of LZMA compression ratios across these ten trials. Empirical σnull scales approximately as N−1/2 in the observed range N ∈ [50, 3000], consistent with the expected finite-sample variance of LZMA on uniform base32 input.
Operational retransmissions violate the independence assumption underlying all statistical probes. We retain one observation per unique 30-character string — the earliest by (date, UTC) — and discard all later retransmissions. An alternative would be weighted inclusion of retransmissions with inverse-multiplicity weights, which requires a model of the retransmission process. First-broadcast itemization is the simpler and more conservative approach and is used for every test reported in the paper.
The paper treats the two-character prefix as the finest cryptographic partition the observable data supports, on the working assumption that each prefix is introduced, carries traffic for one operational lifetime, and is eventually retired before its identifier is reused. Calendar year is not itself a key delineator: a prefix may legitimately span a year boundary (introduced in late one year, retired in early the next) without being re-keyed. For bookkeeping reasons the underlying reference table records prefix-group assignments per calendar year, but the active prefix identity — not the year — is what we treat as the key-period label. In the first-broadcast corpus used for this analysis, no prefix appears with meaningful frequency in more than one calendar year, so the prefix partition and the (prefix, year) partition coincide; the paper's numeric results are invariant to the choice between them. Messages whose prefix is absent from the group-assignment reference for the broadcast year are excluded from analysis.
Positions are indexed from 1 to 30 following a one-based convention. The alphabet size |Σ| = 32 reflects RFC 4648 base32: A–Z and 2–7. All entropies and mutual informations are reported in bits (base-2 logarithms). Compression ratios are reported as the percentage of raw bytes retained after compression; smaller values indicate more aggressive compression.
For each base32 symbol c, the Fisher's-combined test for systematic under-representation across seventeen prefix cells is computed as −2·Σi ln(pi), where pi is the Poisson one-sided tail probability P(Z > −zi) for cell i. Under the null of no systematic bias the statistic is χ234-distributed. The observed statistics for M and 5 exceed any tabulated percentile with p < 10−50.