HFGCS — Frequently Asked Questions

Many explanations of the US military’s High Frequency Global Communications System (HFGCS) are repeating the same information available 15–20+ years ago1,2. Part of the reason for this is because while the US military used to be more candid about the HFGCS (at one point the HFGCS even had its own website3), they began to be less forthcoming about it sometime in the mid-2000s. Nonetheless, its existence is not confidential, and you can still come across occasional mentions of the HFGCS in news stories, non-classified documentation, etc.

In fact, an exhaustive and contemporary description (published March 2023) of the HFGCS, straight from the Department of Defense, is freely available online – buried in a near-1000 page budget document4. It’s definitely worth a read, because some of the info and explanations about the HFGCS out there actively contradict some of its information.

Colloquially, most of the time people talk about the “HFGCS” they’re in fact referring to a network of ground stations located across the world which simulcast broadcasts of EAMs and other traffic, provide phone patch services, and can play a role in numerous other activity (see DoD summary). priyom.org has a map of these stations5; they’re not entirely correct when they suggest that these stations are all remotely controlled from the Centralized Network Control Station (CNCS) located at Andrews AFB, because it actually isn’t only Andrews AFB – in a 2006 article, Andrews anticipated soon having “another CNCS at Offutt Air Force Base”6. My own impression based on voices and certain kinds of activity7, is there is indeed at least one additional control center.

Though it goes unsourced, Wikipedia’s current write-up of the HFGCS says the second station is Grand Forks AFB, and any basic web search will find support for this8. Grand Forks is not Offutt and it seems unlikely the former would identify as the latter, so there’s some clarification needed for what happened here9, but it’s almost certainly not the case that Andrews AFB is the only control center.

As of January 2024, the current primary frequencies of the HFGCS are 4724, 8992 kHz, 11175 kHz, and 15016 kHz. The HFGCS stations will usually simulcast messages on all of these frequencies at the same time, but not always. Things begin to get a bit confusing here, not just because people will often confuse their own inability to pick up a message on a frequency as that message not broadcasting on that frequency at all, but because there are both times broadcasts are sometimes exclusive to only one or some of the frequencies. The HFGCS has previously seemed to operate on schedules10, and might still do.

From the same DoD budgetary document posted earlier, Emergency Action Messages are “highly structured, authenticated messages primarily used in the command and control of nuclear forces. They are disseminated over numerous survivable and non-survivable communication systems including terrestrial and space systems.” Most descriptions available online are generally correct – most are 30 characters, etc. – but are generally just recycling the same information over and over and many more observations can be made about them.

While many see EAMs as completely indecipherable, they are (as the DoD states) highly structured. Elements of this structure can be readily obvious to anyone who bothers to transcribe them or else can be teased out with a little bit of observation. For example, 100+ character EAMs are often structurally similar to each other based on the specific message length, with repeating tetragrams (e.g. AAAA, BBBB, etc.) in similar positions11,12. 30–100 character long EAMs also have similar structures, but often more obfuscated13,14. Message structure is obvious even for 200+ character messages15.

Miscellaneous EAM information

• At least at one point, EAMs were encoded using a program called EAMGEN16.
• From a transcription of a phone conversation available in the DOD archive, @ReidDA discovered that on September 11, 2001, an EAM was used to change the DEFCON level17.

• For some reason, the characters M and 5 appear about half as often as any of the other characters.
• For almost all messages broadcast over the HFGCS (8888 messages are an exception), the characters 0, 1, 8, and 9 don’t appear in any of them. The reasons for 0 and 1 are obvious – the numbers 0 and 1 could be confused for the letters O and I (or vice versa). You might think this shouldn’t be a concern because messages are read off using a phonetic alphabet, but they’re still occasionally (if not always?) being read off from someone’s handwriting, so legibility could be a concern18.
• The reason for withholding the numbers 8 and 9 is less obvious, but consider that A–Z & 2–7 = 32 possible characters for an EAM, so it seems reasonable to suggest that EAMs could be using base-32 encryption.
• Some EAMs have strings of identical characters in them, even if they’re broadcast weeks–months apart, if they have the same 2 characters at the start19. (Another knock against the idea that we can be confident that they’re encoded using OTPs.)

• EAM broadcast times are not completely random, and they’re more often broadcast during daylight hours for CONUS20.
• Certain days of the week are typically busier than others21.
• While monitoring the HFGCS over the last two years, I heard anywhere from 0–50+ messages any given day, with the typical range more like 5 to 25. It’s pretty rare for a day to go by without at least 1 EAM being broadcast (when this happens it tends to be on a federal holiday, such as Thanksgiving or Christmas). In line with the typical range I gave, the running average is usually around 15 messages a day.
• Folks will usually stumble on apparent correlations – e.g. if something big happens in Ukraine or the Middle East and more than a couple dozen EAMs have been broadcast on the same day, people will take to Twitter and YT and announce a connection. However, people will also regularly overlook days with 30+ EAMs if there’s nothing in the news, and vice versa – if there are big news headlines but not a significant amount of EAM traffic, EAMs go undiscussed that day. A strong, consistent correlation between the number of EAMs broadcast and geopolitical events has never been established.
• Are long EAMs cause for concern? At least some long messages appear to be broadcast with a kind of periodicity, and/or tend to be broadcast around the same time as each other. For example, there were two instances of a 194 character message broadcast on the third Sunday of a month, and in both instances a 219 character message was broadcast the next day; similarly, on two Sundays in 2023, a 246 character message and 216 character messages were broadcast around the same time as each other22. Long messages also tend to be broadcast on weekends more often than weekdays. So if some long messages appear to be broadcast in a pre-scheduled fashion to be pseudo-predictable, and geopolitical events don’t have quite that kind of periodicity – whether some correlate to real-world events is still up for debate, but many of them definitely are not.
• Claims that an operator’s tone of voice as they read an EAM could indicate the significance of an EAM are completely ridiculous. This isn’t necessarily because it’s a question about whether the operator understands the significance of the message23, but a mixed track record on the part of the people who make that claim. I’ve seen people claim an HFGCS operator was crying because the EAM they were reading meant that WW3 was about to begin – not only did WW3 not begin (obviously), the operator wasn’t crying, they were laughing. Consider that an operator could read a practice message with strong enunciation and a little nervous tremble in their voice not because nukes are about to fly, but because they know a superior who will pass/fail them is listening. Just like anyone else at any job, the mood of an HFGCS operator could be affected by any number of things – personal troubles in or out of work, a funny joke someone just told them, workplace pressure, etc.

People rarely ask about FDMs but they probably should, because Force Direction Messages are regularly mentioned in DoD documentation in the same breath as EAMs. Though it’s unsourced, numbers-stations.com states that FDMs are probably structured near-identical to EAMs, and we have no way to tell the difference24. In other words, what the SWL community and internet does at large – i.e. referring to all these messages as EAMs – might be backwards. In fact, the above section on “What is an EAM?” could be wrong on my part and everything I wrote about observing structures of EAMs, etc. is actually about FDMs.

For anyone strictly interested in all this, you might decide that it might be best to talk about all these messages as “EAMs and/or FDMs” (as I sometimes do), but you’ll also come to realize that is clunky and pedantic and sometimes colloquial use of a term overrides actual use.

Having said all this, even though it still isn’t possible to tell which one is which, it does appear possible to identify certain ‘subgroups’ of message types based on the first two characters of messages, which are often reused over certain time periods, but might be acting as differentiating traits25 – i.e., somewhat of a lead does exist on differentiating EAMs and FDMs.

SKYKING messages are often discussed whenever you see anyone talk about the HFGCS and EAMs, but these are rarely broadcast on the HFGCS anymore. People still talk about them because of what I discussed earlier – a lot of information about the HFGCS is simply repeating old information that used to be more readily available and a lot of documentation was made when SKYKING messages were actually quite common.

I’ve never heard a SKYKING message myself despite all the time I’ve spent listening to the HFGCS and I can’t really say I’m bothered not to have ever heard one. All the reading I have suggests their foreboding reputation is basically undeserved, because while ‘SKYKINGS’ do indeed appear to be “high priority messages”, I think they worked as mission abort or return to base messages – so that instead of being an indication to SWLs that “it’s about to pop off”, it actually seemed to be a sign that “whatever it was, it just ended”.

Larry Van Horn’s 2006 documentation defined SKYKING as “The collective call sign for all Single Integrated Operational Plan (SIOP) committed aircraft and missile crews. Its meaning is ‘all SIOP committed aircraft and missile crews copy the following message.’” It is probably not much more complex than that, so their vanishment seems completely non-notable to me.

If you hear anyone professing expertise about the HFGCS talking about SKYKING messages like they’re still a big deal, they’re kind of giving themselves away as a pleb26.

When someone radios in requesting to speak to MAINSAIL, they’re making an open-ended request to speak to “any global ground station” – e.g. anyone from Andrews, Offutt, etc. can respond. That isn’t any different from the way Larry Van Horn wrote it up in 2006. What has changed over the years is who identifies as MAINSAIL.

In the past, stations broadcasting EAMs used to identify under their station callsign – e.g. Andrews would broadcast an EAM and identify as ANDREWS before reading it and after signing off, Offutt would identify as “OFFUTT”, etc. Sometime around 2014, they appear to have all switched to instead identifying as MAINSAIL, and sometime around 2015 they all instead began to use rotating daily callsigns.

Currently, when someone requests to speak to MAINSAIL, a ground station responding might either identify as MAINSAIL, the station they are broadcasting and/or receiving from, or the daily HFGCS callsign. You will also still hear MAINSAIL occasionally used as identification during test counts, etc.

As mentioned, around 2015, the callsigns used for EAM broadcasts moved away from stations and MAINSAIL and began to use a variety of unique callsigns. These callsigns almost always change every day at 00:00 UTC.

I have spent a non-trivial amount of time looking for as many different callsigns used as possible, and with only a couple of ambiguous exceptions, it is fairly obvious to me that virtually all the HFGCS callsigns observe a 9 character limit, including spaces (some callsigns are two words). The only apparent exceptions are daily callsigns like “CUTTY SARK” and “LIGHT BUOY”. It’s not obvious to me if this means the character limit is actually 10 characters, or 9 not counting spaces, but my suspicion is they actually smush these into one word (e.g. “CUTTY SARK” is 10 characters, but “CUTTYSARK” is 9).

Note that this limit seems to extend for almost all other callsigns used on the HFGCS – e.g. SKYMASTER fits the 9 character limit, as does MAINSAIL, and so do station names – ANDREWS, OFFUTT, SIGONELLA. The only exception I can think of is PUERTO RICO, which does indeed identify as “PUERTO RICO” for radio checks and test counts – even if you take out the space, you’re at 10 characters.

Why wasn’t this noticed earlier? At least partly poor documentation – for example, for many years, an admin of eam.watch, who claimed to have insider knowledge about the HFGCS, incorrectly logged and continues to incorrectly log test counts from Diego Garcia as using the callsign “DIEGO GARCIA”27. Other SWLers will incorrectly occasionally hear and log callsigns that exceed the limit. Another reason is that it might be, as I suggested earlier, a de facto limit rather than a hard-coded one. While Air Force Instruction 33-217 might have had a lead to this end28 – “The VCSLI contains detailed procedures for requesting, assigning, and using voice call signs, and is available on the VCS SIPRNet web site” – that link probably has, or had, the definitive answer, but it isn’t live, and probably wasn’t publicly accessible anyways.

As mentioned earlier, the vast majority of EAMs never use the characters 0, 1, 8, or 9. The apparent exception are what I have named “8888 messages”29, which are superficially similar to EAMs but can include these characters – most conspicuously, they all begin and end with a tetragram of four 8s (“8888”).

In October of 2023, I made a video going into depth on these messages and going through the documentation of only 11 messages broadcast from 2004–2023. It is available on YouTube30; since posting that video, 4 more messages from 2003 were identified, and in November of 2023 a recording of an 8888 message broadcast as a VLF digital transmission was posted by @thenewarea51 to Twitter31.

Though it’s impossible to know how they’re considered internally, I consider these separate from, and do not refer to 8888 messages, or any of the following message types, as EAMs.

SKYMASTER messages appear to only be broadcast during STRATCOM exercises (I’ll often refer to them as “SKYMASTER exercises”) and are formatted differently from EAMs. Instead of beginning the broadcast with “ALL STATIONS, ALL STATIONS […] MESSAGE FOLLOWS” the broadcaster will say “SKYMASTER, SKYMASTER […] 1 MESSAGE OF # ITEMS FOLLOWS…”32

The current method of identifying as/responding to SKYMASTER might be up for grabs. In 2006, Larry Van Horn noted SKYMASTER is “The collective callsign to all USSTRATCOM airborne command post.” but to my ear, traffic during the January 11, 2024 exercise didn’t seem to line up with this.

Another message format that appears to only be broadcast during STRATCOM exercises, 274 messages are poorly documented and logged online. Despite what the name suggests, these messages are not 274 characters long, so the meaning of the name is non-obvious33.

Another message format that appears to only be broadcast during STRATCOM exercises, a Recovery Report seems to be an unusual way of confirming SKYMASTER messages have been received by the intended recipient. Notably, slashes are actually read off during such reports and might be the only time they are.

I have seen a lot of idiosyncratically and/or incorrectly transcribed EAMs out there use slashes in their notation; because of the format of Recovery Reports I would suggest this is a bad practice to follow.

In addition to the (known) primary HFGCS frequencies and discrete (unknown) frequencies, STRATCOM uses 9031 kHz which, on the primary frequencies, has been heard referred to as the “Charlie Echo Window” instead of as 9031 kHz, presumably to maintain some level of secrecy to it.

Previously documented by the SWL community, it is part of a series of “Charlie Windows” (e.g. CA, CB, CC, CD, CE, etc.) of which the frequencies are known for frequencies CA through CI, though I have only heard CE in use. Surprisingly, the frequencies of C Windows documented in the mid to late 2000s are still the same frequencies being used today34.

I have heard operations mention “CL” but was unable to identify which frequency that was. These frequencies, or at least CE, appear to be reserved for a way for E-6s to communicate with each other.

Z170 is another code name for a frequency used by STRATCOM, as part of a series of frequencies possibly known as the “Zulu Net”. They might only be used during SKYMASTER exercises. If you spend some time searching online you may find some old documentation of Z frequencies by members of the SWL community, but unlike the C Windows, the Z frequencies are not the same as they used to be. As far as I have found, nobody has been successful in identifying a Z frequency for quite some time and none of the current Z freqs are known.

During a January 11, 2024 SKYMASTER exercise, @theintelfrog identified 8008 kHz in use for broadcasting EAMs and/or SKYMASTER messages, I identified 8035 kHz, and Jay Projects identified several additional frequencies to the same end. It’s possible these are some of the current Z freqs – but if they are, we don’t know what their Z names are.