Olimp and Yenisei-2: Russia’s secretive eavesdropping satellites (part 2)by Bart Hendrickx
|
| At first sight, the FSB is not the most obvious organization to lead an effort to eavesdrop on foreign satellites. The FSB (roughly comparable to the FBI) is primarily a domestic security and counterintelligence agency. |
In the Soviet days, non-military SIGINT of foreign telecommunications was the responsibility of the KGB’s 16th Main Directorate, which after the collapse of the USSR was absorbed by an organization called the Federal Agency of Government Communications and Information (FAPSI), the equivalent of the US National Security Agency. Within FAPSI, the 16th Main Directorate was reorganized as the 3rd Main Directorate, also known as the Main Directorate for Radio-Electronic Intelligence of Communication Systems (GURRSS).
In 2003, President Vladimir Putin decided to disband FAPSI and split its functions between the FSB, SVR, and the Federal Protective Service (FSO). There is conflicting information on what happened with the 3rd Directorate’s SIGINT work, with most sources claiming that it was divided between the FSB and SVR. Within the FSB, SIGINT was assigned to the so-called 16th Center, also known as the Center for Radio-Electronic Intelligence by Means of Communication (TsRRSS) and Military Unit 71330 (even though it doesn’t belong to the Ministry of Defense.) The first two names suggest that it has inherited most, if not all, functions from the KGB’s 16th Main Directorate and GURRSS. The 16th Center also seems to have taken on an important role in cyberwarfare. It has been in the news several times in recent years because of its alleged involvement in cyber operations against critical infrastructure in various countries, a clear sign that its activities are not restricted to Russian territory.[4]
 The emblem of the FSB’s 16th Center shows a satellite dish (signifying SIGINT activity) and a key broken by lightning (symbolizing the breaking of an encryption key). Source |
The only direct evidence that Olimp has its origins in the Russian intelligence services comes from an article published in early 2008. This highlights the career of Yuriy B. Zubarev, who from 1992 to 2004 headed NII Radio, the organization that developed payloads for both Olimp and Yenisei-2. The article calls Zubarev the “scientific leader” of Olimp and says it was a project for FAPSI.[5] This suggests that it was initiated before the dissolution of FAPSI in 2003 and that its roots go back to early this century or even earlier.
While there is no irrefutable proof that Olimp was subsequently inherited by the FSB, it is clear that NII Radio has close ties with the FSB’s 16th Center. As can be determined from publicly available online procurement documentation, the 16th Center (identified as Military Unit 71330) awarded a contract to NII Radio on January 31, 2013, for a project named Rebus-2.[6]
 Excerpt from a procurement document referring to a 2013 contract between FGUP NIIR (NII Radio) and Military Unit 71330 (the FSB’s 16th Center) for the Rebus-2 project. Source |
Other online documents related to Rebus-2 indicate that its goal was to establish a network of ground-based satellite dish antennas with diameters ranging from 2.4 to 16 meters. Names seen for these are Rebus-2B, Rebus-2BM, Rebus-2T, and Rebus-2N. NII Radio was also involved in the construction of what appears to be an earlier generation of satellite dish antennas for the 16th Center, some of them named Rebus (without a digit) and others carrying different names.[7] Key subcontractors to NII Radio for Rebus are NPP ATS and OKB MEI, two leading manufacturers of satellite dish antennas. Rebus may have broader objectives than communication because the name also appears in PhD dissertations in 2009 and 2011 that were related to computer-based speech analysis and protection against cyberattacks. The research, done partly for NII Radio, was carried out by specialists of Spetsvuzavtomatika, a company in Rostov-na-Donu that has performed various types of work for the FSB.[8]
Judging from procurement documents, hardware for the Rebus satellite dish antennas was delivered to various regions in the Russian Federation.[9] Only two specific locations can be determined from online sources, both linked by various sources to the 16th Center. One is Military Unit 61608, situated in a forest near Tsaritsyno Park in southern Moscow. This is given as the location of the “Rebus-Ts space communications center” in a PhD dissertation published in 2018.[10]
 Antenna complex at the FSB’s Military Unit 61608 near Tsaritsyno Park in Moscow (Google Earth, June 2023). |
The other is Military Unit 51952, situated in Nerastannoye near Chekhov, some 70 kilometers south of Moscow. As can be learned from procurement documentation published in early 2015, it was planned to install three Rebus-2N antennas at the site with diameters of 4.8, 7, and 16 meters.[11] Google Earth images indeed show that several new antennas appeared at this location between 2015 and 2017.
  A comparison of Google Earth images taken in August 2015 and August 2017 shows several new dish antennas appearing at the FSB’s Military Unit 51952 that are likely part of the Rebus-2 network.
|
Nothing is revealed in the documentation about the purpose of the Rebus antennas other than that they are part of a ground-based satellite communications system. There are some signs that at least one of their functions may be to communicate with the eavesdropping satellites. An abbreviation seen in documentation for both Rebus-2 and Yenisei-2 is KOU, which is deciphered both as “Rapid Control Complex” and “Rapid Control Channel”. The term is very rarely seen in Russian space-related technical literature and according to one source refers to the combination of a satellite’s communication payload and the ground-based systems that are used to interact with it.[12]
| This type of foreign satellite intelligence does not require the involvement of foreign agents or the use of infrastructure situated abroad, something which would typically be entrusted to the SVR or GRU. |
Yenisei-2 documentation mentions KOU’s “on-board equipment” and indicates it is based on that flown aboard Olimp.[13] Rebus-2 documentation mentions KOU’s “multiplexing system”, which could be part of the hardware needed to uplink commands or other information to the satellite’s payload(s).[14] Also developed under Rebus-2 was an L-band demodulation system named Fider-DM consisting of both a demultiplexer and descrambler.[15] This could well be designed to interact with the L-band payloads that are known to be aboard both Olimp and Yenisei-2.
As is also the case in some other Russian satellite projects, the control of the payload and the satellite bus itself may be split between different ground stations. The only concrete information on Olimp’s ground segment comes from a handful of annual reports of NPO PM Razvitiye, a daughter company of ISS Reshetnev. It produced two C-band antennas for Olimp’s so-called “command and measurement system,” which are the ground systems needed to uplink commands to the satellite and measure its orbit parameters. The company was to take part in the testing of these antennas at what were called the “central and western command posts” for Olimp.[16] There are also command and measurement systems named “Olimp-1” and “Olimp-2” on ISS Reshetnev’s premises in Zheleznogorsk.[17] It is unclear though if there is any relation with the satellites. Since the eavesdropping satellites are regularly relocated, they will obviously require a more elaborate ground control network than traditional communications satellites that stay put in one and the same place. Luch/Olimp alone has covered an area in the geostationary belt stretching from 96.5°E to 24.5°W.
More evidence for NII Radio’s connections with the FSB comes from articles and patents authored by a person named Anatoliy M. Somov. In most of these publications, Somov is identified as a “principal researcher” of NII Radio’s antenna division, but from two of them it can be established that he is also a professor at the FSB Academy (“Military Unit 33965”) in Moscow, more particularly its Institute of Cryptography, Communications and Computer Science (IKSI).[18] IKSI trains specialists in areas such as the transfer, protection, and processing of information. Its Soviet-era predecessor was the Fourth Faculty of the KGB Higher School, whose most famous alumnus is cybersecurity expert Yevgeniy Kasperskiy (better known by his westernized name Eugene Kaspersky), the founder of Kaspersky Lab. After the disintegration of the Soviet Union, the institute became part of FAPSI and, when that was dissolved in 2003, it was transferred to the FSB Academy. IKSI has reportedly been an important source of recruitment for the FSB’s 16th Center.[19] It could well have a role in decrypting and deciphering the signals intercepted by the eavesdropping satellites.
Most of the articles written by Somov deal with ground-based satellite dish antennas, at least some of which are likely related to Rebus. A PhD dissertation supervised by Somov and published in 2020 is actually linked specifically to Rebus-2T.[20] The dissertation (as well as many of Somov’s papers) discusses ways of improving the signal-to-noise ratio of antennas on Russian territory that are aimed at GEO satellites. Since the antennas are placed at high latitudes, they need to be pointed relatively close to the horizon to see GEO satellites and are therefore more susceptible to background interference. One experiment conducted as part of this research involved picking up signals from a radio beacon installed aboard Intelsat-10-02, which, coincidentally or not, is a satellite visited twice by Luch/Olimp. The least this dissertation reveals about the Rebus-2 antennas is that at least some of them are built to interact with GEO satellites.
Somov has also written several articles and patents on antennas for satellites and there are some signs that these are not intended for “ordinary” Russian communications satellites. Most of them are multiple beam antennas consisting of a reflector and a feed array offset to the side of the reflector. [20] The reflector diameters range from 1.45 to 2.175 meters and the number of spot beams from 58 to 119, more than would be expected to be required for the fairly limited part of Russian territory that can be viewed from GEO. Several examples are given of possible coverage zones, virtually all of which are situated outside Russia in regions that are typically served by non-Russian communications satellites. Some of the feed array elements can be turned off so that the antenna covers a specific region, for instance one continent. Applications given for the antennas in one of the patents are not only communications, but also “radio observation” and “radio monitoring”. Some of the publications mention only C-band, while others say the antennas can operate at super high frequencies (SHF), the frequency range from 3 to 30 gigahertz. This includes most of the frequency bands traditionally used by communications satellites: C-band, Ku-band, and Ka-band.
 A schematic representation of a 1.45 m reflector (position 1.3) and its offset feed array (position 1.1.). Source |
 One possible “footprint” of the antenna shows it covering Europe, Africa, and Asia. Source |
Many communications satellites in orbit today carry multibeam antennas for spot beam coverage of specific regions. Since the eavesdropping satellites essentially have to mimic the functions of their target satellites, it would be logical for them to have such antennas as well. The only difference is that they would work only in a “passive” interception mode. They would most likely be used to pick up gateway and/or user uplinks, although interception of gateway and/or user downlinks is not impossible either (in which case they would have to be positioned under the target satellites).
As noted in part 1, there are reasons to believe that an unidentified Express-1000 type satellite seen in a 2016 presentation of ISS Reshetnev is Olimp. It has two reflectors, the bigger of which is fed by a large offset feed array mounted on the body of the satellite. Although not clearly seen in the drawing, there may also be a similar array on the other side of the satellite to feed the smaller reflector. These look very similar to the multibeam antennas described in Somov’s articles.
 Unidentified Express-1000 satellite seen in a 2016 presentation of ISS Reshetnev. (Courtesy: ISS Reshetnev) |
A similarly configured multibeam antenna with a much larger 12-meter offset-fed reflector is set to fly on Russia’s next-generation Sfera military communications satellites (not to be confused with an identically named Roscosmos project to deploy a large constellation of small communications and remote sensing satellites.) In 2016, ISS Reshetnev’s former director Nikolai Testoyedov wrote that the Luch satellite launched in 2014 had made it possible to perform flight tests of a 12-meter antenna (see part 1). What he may have meant to say is that it carried a much smaller prototype of such an antenna.
 This 12-meter offset-fed reflector can be linked through various sources to the Sfera military communications satellites. Source |
All in all, there is at least some evidence to back up Kommersant’s claim that the FSB is the organization behind Olimp. The project’s origins may even go back to FAPSI around the turn of the century. NII Radio seems to have played a key role in the project from the very start, being responsible for the on-board payload(s) and possibly for part of the ground segment as well. Although the participation of the Foreign Intelligence Service (SVR) cannot be entirely ruled out, the FSB’s 16th Center seems to have taken over most of FAPSI’s SIGINT functions in 2003, with IKSI presumably taking part in the deciphering and analysis of data.
| There is evidence for the presence of L-band payloads aboard both Olimp and Yenisei-2. However, none of the satellites visited by them so far, except for Nigcomsat-1R, use L-band. |
It should also be pointed out that this type of foreign satellite intelligence does not require the involvement of foreign agents or the use of infrastructure situated abroad, something which would typically be entrusted to the SVR or GRU. It can be done entirely from Russian territory, in very much the same way as the 16th Center carries out its reported foreign cyber operations from within the confines of the country. If Russia has any facilities abroad to intercept satellite uplink signals, those would most likely fall under the responsibility of the SVR and/or GRU. As is known from documents leaked by Edward Snowden, the US National Security Agency operates dozens such eavesdropping stations around the globe. America’s NEMESIS eavesdropping satellites are needed only to complement the intelligence gathered by such stations.
As explained in part 1, there is evidence for the presence of L-band payloads aboard both Olimp and Yenisei-2. However, none of the satellites visited by them so far, except for Nigcomsat-1R, use L-band, raising the question what, if anything, these payloads have to do with their eavesdropping functions. L-band is the range of frequencies in the radio spectrum from 1 to 2 gigahertz and is typically used for mobile communications. For instance, L-band transponders are flown on the low-orbiting Iridium satellites as well as on a number of GEO satellites operated by Inmarsat and Thuraya.
What can be deduced from available documentation on Yenisei-2’s MAGD-O L-band payload is that it is part of a so-called regenerative or processing transponder. Like traditional “bent pipe” transponders, they amplify incoming signals and subsequently relay them to the ground on different frequencies in order not to cause any interference with the uplink signals. In addition to that, they also demodulate and modulate the signals to significantly improve the signal-to-noise ratio. Whereas a bent pipe transponder is suitable for both analog and digital signals, a regenerative transponder is suitable only for digital signals.
 Schematic representation of a regenerative transponder. Source |
MAGD-O’s function is to demodulate and process incoming L-band signals with frequencies of 1.5 to 2.5 gigahertz (the higher frequencies actually being in the S-band, which is usually defined as the frequency range from 2 to 4 gigahertz). As can be seen in the diagram, this demodulation occurs after the frequency translation of the uplink signal. Therefore, one possibility is that signals picked up by the satellites in other frequency bands are converted to L-band frequencies before being demodulated, re-modulated, and downlinked to the ground. Yenisei-2 has at least four frequency converters (designated BPCh), all of which are linked in the procurement documents to earlier ones flown on Olimp.
No technical details on these are given in that documentation, but one space-based frequency converter seen in a presentation by NII Radio is designed to transform Ka-band signals with frequencies between 27 and 30 gigahertz into L-band signals with frequencies between 1.5 and 2.5 gigahertz, exactly the same frequency range given for the signals received by MAGD-O.[22] The 27–30 gigahertz range is typically used for uplink transmissions to high-throughput Ka-band satellites. Interestingly, Luch-5X, the satellite that most likely carries the MAGD-O payload, has so far visited only satellites of that type, namely Viasat KA-SAT and Eutelsat-3B. Such satellites have multibeam antennas not unlike the ones seen in the earlier mentioned NII Radio/FSB literature.
By relaying the intercepted signals in a totally different frequency band, the Russians may want to avoid any risk of interfering with the uplink receivers of both the target satellite and the eavesdropping satellite itself. As noted in the documentation, Yenisei-2 also has an on-board system that scrambles incoming signals in order to “mask their technical characteristics.” The Fider-DM L-band demodulation system developed as part of Rebus-2 may be used to descramble and process these signals on the ground. It is also worth adding that some of the research done by Anatoliy Somov early last decade focused on techniques to pick up signals with frequencies up to 3 gigahertz (including L-band) from GEO satellites that are on the edge of visibility from Russian territory. This would come in handy if the eavesdropping satellites need to intercept and relay data from target satellites situated close to that boundary.[23]
 A Ka-to-L-band frequency converter seen in a presentation by NII Radio. Source |
Another possibility is that the L-band payload is not used for signals intelligence, but for communications. According to the 2014 Kommersant article on Olimp, the satellite would be used for both purposes. The payload could perform a role similar to that of L-band transponders flown on most of ISS Reshetnev’s Express communications satellites. All that has been revealed about the purpose of these payloads is that they are needed for “mobile presidential and government communications.” The operating frequencies have never been disclosed. The organization in charge of these payloads appears to be the Federal Protective Service (FSO), a former KGB division responsible. among other things. for the physical and electronic security of high-ranking state officials, including President Putin.[24] It has a department called the Special Communications and Information Service (Spetssvyaz) that is entrusted with ensuring secure government communications, a task it took over from FAPSI in 2003.
A company named NPTs Vigstar has developed a portable satellite L-band terminal that may well be used for mobile communications via the Express L-band transponders. Operating in the 1.5–1.6 gigahertz range, it is capable of interacting with “current and future communications satellites” and is described as being needed for “special and civilian use.”[25] Vigstar, which also manufactures on-board systems for communications satellites, definitely has some kind of role in Olimp. In 2013 it was involved in a part of the project called “Olimp-1-SSMR”.[26] It is not clear what that abbreviation stands for. The person in charge worked for a Vigstar department that is responsible, among other things, for equipment to process data aboard military communications satellites, systems to secure secret communication channels, as well as mobile satellite communications systems.
 L-band terminal developed by NPTs Vigstar. Source |
Nine of the currently operational Express satellites are equipped with L-band transponders. If Luch and Luch-5X have a similar payload, they could augment the capabilities offered by the Express satellites and, perhaps, serve specific customers such as the FSB аnd/or other intelligence agencies. NII Radio was assigned to deliver the payloads for two of these Express satellites, Express-AM5 and AM6, launched in 2013 and 2014. In reality, it served as a system integrator, subcontracting the actual construction of the antennas and transponders to the Canadian firm MacDonald, Dettwiler and Associates (MDA). Aside from the L-band payload, the satellites also carry C-band, Ku-band, and Ka-band transponders.
| Currently, there is no evidence that more of the eavesdropping satellites are under construction. Still, a number of patents published by ISS Reshetnev in recent years point to a continuing interest in these satellites. |
In a letter published in 2019, NII Radio acknowledged that the experience acquired through its cooperation with MDA had helped it design such payloads (including L-band transponders) independently and thereby bypass Western sanctions imposed on the Russian Federation.[27] Since the development of the payloads for the two Express-AM satellites and Olimp took place more or less simultaneously, it is doubtful if NII Radio was able to benefit from that experience before the launch of Luch/Olimp in 2014. It could, however, have done so in time for the launch of Luch-5X. In January 2020, Russia’s Federal Communications Agency ordered the company to continue research on L-band transponders with Russian-built processors, most likely in response to sanctions that made the import of such processors difficult or impossible.[28] The only L-band payload that NII Radio is known to be working on now will be installed on the next-generation Luch-5VM data relay satellites, more specifically to relay signals from meteorological sensors and Kospas/Sarsat search-and-rescue beacons to end users.
On a historical side note, the use of communications satellites by the intelligence community would not be a novelty. In the Soviet era, the KGB and GRU had a dedicated constellation of low-orbiting satellites named Strela (“arrow”) to communicate with agents stationed abroad. The latest generation of these satellites (Strela-3M or Rodnik) is still operational today. They are operated by the Ministry of Defense and it is not known if they are still being used by Russian intelligence agencies.
Currently, there is no evidence that more of the eavesdropping satellites are under construction. The nearly nine-year gap between the launch of Luch and Luch-5X indicates that these are not satellites that Russia plans to launch on a regular basis. Still, a number of patents published by ISS Reshetnev in recent years point to a continuing interest in these satellites. They describe various techniques to move GEO satellites from one spot to another and park them close to other satellites. Three in particular are almost certainly related directly to the eavesdropping satellites. They discuss so-called “monitoring satellites” to intercept signals uplinked to and downlinked from “neighboring satellites.”[29] There can be little doubt that the intended targets of these proposed monitoring satellites are non-Russian satellites. The target satellites are described as being operated from mission control centers that “do not interact” with that of the monitoring satellites and their exact orbit parameters have to be determined using data publicly provided by NORAD. Since the targets are uncooperative, all the maneuvers needed to keep the two objects close together have to be made by the monitoring satellite (something which the authors call “autonomous collocation.”)
In one proposal, the eccentricity and inclination of the monitoring satellite’s orbit slightly differ from those of the target satellite, allowing it to slowly circle around its target and approach it to within less than 10 kilometers. The monitoring satellite is equipped with two sets of antennas, one to intercept uplink signals transmitted to the target satellite and the other to pick up downlink signals when it is situated underneath the target satellite. From that position it can monitor the target for a maximum period of about 12 hours (using steerable antennas), making it necessary to have a second monitoring satellite in place if round-the-clock observations of the target are required.
As explained by the authors, the interception of the downlink signals is necessary to complement the uplink data. This is because the uplink signals may be protected from interception and also because some of the uplink signals picked up by the monitoring satellite may actually be intended for neighboring satellites in the crowded geostationary belt. Analysis of the downlink signals makes it possible to positively identify the uplink signals aimed at the target satellite. This particular monitoring technique requires the constant operation of electric thrusters aboard the monitoring satellite, as a result of which its active lifetime may be relatively short. Assuming it has a mass of 3.25 tons (including 750 kilograms of xenon), this may have to be limited to two years. However, according to the authors, this is compensated by the high quality of the data obtained in this way.
In a more recent proposal, the monitoring satellite is placed at 1.5° (roughly 1,100 kilometers) from the target satellite. Here the main goal appears to be to pick up the side lobes of the target’s downlink signals. This can be done with fixed antennas since the monitoring satellite sits next to its target rather than fly around it. Uplink signals are also intercepted to fill in gaps in the downlink data. There may be one or more satellites in between the monitoring satellite and the target satellite, making it difficult for the owner of the target satellite to recognize the monitoring satellite as such.
In both proposals, the idea is to relay the intercepted signals to the ground via laser communication channels (referred to in the patents simply as “optical communication channels.”) This eliminates the need to allocate radio frequencies to the monitoring satellites and makes the signals virtually immune to interception by third parties because such channels use very narrow beams. Laser channels would also be used to uplink commands to the satellites. The quality of the downlinked optical signals is not affected by the atmosphere if they are received by ground stations located in mountainous regions, such as one used for laser communication experiments with the International Space Station. Although not specified in the patents, this is the Arkhyz laser facility in the Northern Caucasus, which housed a terminal for laser communication tests with the ISS Russian segment in 2011–2012. Russia has also used laser communication channels to transmit data from its Persona optical reconnaissance satellites to the ground via Geyzer data relay satellites. As usual, it is hard to assess the significance of these patents. They could be part of ongoing work on future eavesdropping satellites, but may just as well be purely academic in nature.
| There are vague clues that Russia may be preparing a new type of RPO mission in GEO. |
Finally, it is worth noting that many articles and patents published by NII Radio (with the FSB’s Anatoliy Somov as one of the authors) and the FSB Academy itself focus on ground-based antennas that can simultaneously pick up signals from a number of geostationary communications satellites in three different frequency bands (C, Ku, and Ka.)[30] It is not entirely clear of what practical benefit this research is to the FSB. One potential application could be the use of such antennas to communicate with two or more eavesdropping satellites at the same time, as could now be done with Luch and Luch-5X. It is questionable though if the research is related solely to the eavesdropping satellites.
Russia is not the only nation that carries out rendezvous and proximity operations (RPO) in geostationary orbit. Aside from the NEMESIS eavesdropping satellites, the United States operates three pairs of GSSAP satellites to make close-up pictures of foreign GEO satellites and has also carried out rendezvous tests with some of its own GEO satellites using the ANGELS and Mycroft satellites. China has also been active in this field with satellites named SJ-17 and TJS-3. SJ-17 has parked itself close to a number of Chinese communications satellites (presumably for photographic inspections) and TJS-3 has placed itself relatively close to various US military communications satellites, either for imaging or eavesdropping. There was also a possibly intentional close encounter between TJS-3 and Luch/Olimp in October 2021.[31] In addition to all this, China has used its SJ-21 satellite to move a defunct geostationary navigation satellite to a safe graveyard orbit.
There are vague clues that Russia may be preparing a new type of RPO mission in GEO. ISS Reshetnev appears to be working on a geostationary satellite as a subcontractor to the Moscow-based Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM or CNIIHM), which has a background in developing low-orbiting inspection satellites and anti-satellite technology.[32] Procurement documents show that the two companies signed a contract for a joint project in December 2017. A handful of articles and patents published by TsNIIKhM indicate this may be a small geostationary satellite equipped with a machine vision system that includes a star tracker capable of using the Moon and background stars to determine its orientation and orbit parameters. This would clearly be needed for RPO. One of the patents gives in-orbit servicing of satellites as a possible mission for such a satellite. Other potential goals could be close-up photographic inspection of satellites or even anti-satellite operations. Another TsNIIKhM patent deals with a satellite designed to destroy space debris in geostationary orbit by spraying it with electrostatically charged particles. This could just as well have less peaceful applications. [33]
It is not known in what stage this project currently is or whether the satellite is a stand-alone payload or one that will fly as a passenger with a larger satellite. Some of TsNIIKhM’s small satellites have earlier hitched rides to space with ISS Reshetnev satellites that were placed into lower orbits.
Note: we are using a new commenting system, which may require you to create a new account.
