On July 24, the US National Archives released a series of 356 never-before-seen photos, most of them taken on September 11, 2001 inside the emergency bunker under the White House.

The bunker is officially called the Presidential Emergency Operations Center (PEOC), but White House officials also call it the shelter. It was constructed in 1942 underneath the East Wing of the White House, which was primarily built to cover the building of the bunker. It is said the PEOC can withstand the blast overpressure from a nuclear detonation.




The photos were released in response to a Freedom of Information Act (FOIA) request filed by Colette Neirouz Hanna, coordinating producer for the FRONTLINE documentary film team. They focus on the reaction from then-vice president Dick Cheney and other Bush administration officials during the terrorist attacks.


How Cheney reached the White House emergency bunker was reconstructed in the official report of the 9/11 Commission, which was issued on July 22, 2004:

 

Conference room

The newly released photos provide an almost 360-degree view of the conference room in the Presidential Emergency Operations Center. It appears to have two installations for secure videoconferencing: one at the long side of the room and one at the short side, so it can be used from either the long side or the short side of the table.

In the picture below we see the videoconference set-up at the long side of the room. Within a wooden paneling there are two television screens with the camera in between. Right of the paneling are four digital clocks showing the time for various places around the globe, and there's also a wall map of the United States:




On the screen on the far left we see a videoconference taking place with four participants, including the CIA and the Department of Defense. Reports about the events on 9/11 say there was a secure videoconference in which the White House, the CIA, the State Department, the Department of Justice and the Department of Defense participated.


The next picture shows the videoconferencing monitors at the short side of the room, which can also be used for normal television: other photos show feeds from CNN and Fox. In the corner on the right there's a wooden door with a (mirror?) window. Next to the door on the long side wall, there's a large mirror:




The wall at the long side of the room opposite to the videoconferencing installation has the presidential seal, which appears behind the person leading a videoconference from the chair in which vice president Cheney was sitting, in order to show that this is the White House:




Looking to the right provides a view of the other corner, where we see two doors: first there's a heavy metal door opening to a room with pinkish light. Next to it, at the short side of the room, there's another door which opens to what looks like a corridor with blueish light. Some people seem to come in through that door, so maybe that corridor leads to the entrance of the bunker:




At 6:54 PM in the evening, president Bush arrived back at the White House and joined vice-president Cheney in the Presidential Emergency Operations Center. This was captured in another series of photos. In the picture below we see Cheney and Bush, with on the right side a good view of the vault-like door, which has three heavy-duty hinges and a long downward pointing door handle:




Exactly the same type of white metal door with the long door handle, can be seen in a picture from 1962 of an office next to the Situation Room in the basement of the West Wing (maybe a door to the tunnel leading to the bunker? The current entrance to the PEOC is still a well-kept secret).


Viewing from a different angle, we see more of the wall at the other short side of the room, which was probably never seen before. At the left it has the door to the corridor, and in the middle there are wooden folding doors with handles and a lock. As there are already two banks of monitors for videoconferencing, these doors probably hide something else:




At 9:00 PM president Bush gathered his National Security Council for a meeting in the underground shelter, as can be seen in the picture below. This makes a 360-degree view of the conference room almost complete:




A close look at this photo shows that something is mirrored in the glass pane for the camera of the videoconferencing system in the short side wall of the room. It clearly looks like a world map, more specifically like an automatic daylight map, which must be at the opposite wall, right of the wooden folding doors:




 

Telephone equipment

The newly released photos show the people in the PEOC conference room regularly making phone calls, using telephones that are somewhat hidden in drawers underneath the conference table. Probably just like the table itself, the drawers are custom made for a device that can be recognized as a small version of the Integrated Services Telephone (IST):




The IST was designed by Electrospace Systems Inc. and manufactured by Raytheon as a dedicated device for the Defense Red Switch Network (DRSN) and hence was called a "red phone". The DRSN is the main secure telephone network for military command and control communications and connects all mayor US command centers and many other military facilities.

The standard version of the IST has 40 programmable buttons for access to both secure and non-secure lines (therefore sometimes called IST-40). Encryption isn't done by the phone itself, but by a network encryptor, after the switch separated secure and non-secure traffic. Although the IST phone had very futuristic looks, it was gradually replaced by the IST-2 since 2003.


The phone we see in the drawers of the PEOC conference room table are about half the size of the standard IST: instead of the 40 direct line buttons, there are just 6, replacing some of the special function buttons above the AUTOVON keypad with the four red keys for the Multilevel Precedence and Preemption (MLPP) function.

This small version of the IST is rarely seen, but it was in the collection of the JKL Museum of Telephony in Mountain Ranch, California, which unfortunately was completely destroyed by a wildfire last week.




The ultimate test for these kind of communications systems is a real emergency situation. However, during 9/11, it came out that the Defense Red Switch Network (DRSN) didn't work like it should have. The 9/11 Commission report said:

On the morning of 9/11, the President and Vice President stayed in contact not by an open line of communication but through a series of calls. The President told us he was frustrated with the poor communications that morning. He could not reach key officials, including Secretary Rumsfeld, for a period of time. The line to the White House shelter conference room and the Vice President kept cutting off.

Besides the ISTs under the table, there's also a black telephone set, which sits on a shelf or a drawer underneath the wall map of the US. This phone is a common Lucent 8410, used in numerous offices all over the world. Here, it is part of the internal telephone network which is used for all non-secure calls both within the White House as well as with the outside world.




On the corner of the conference table, there's also another kind of communications device: a black box, of which the upper part can be opened up like a laptop. The bottom part however is higher than normal notebooks, even for those days. It's also connected to a big adapter. Maybe it's a rugged and/or secure laptop for military purposes - readers who might recognize the device can post a reaction down below this article.



 

Mysterious marking

A final photo shows then-Secretary of State Colin Powell sitting at the table in the PEOC conference room, reading a document which has a cover sheet for classified information:




The cover sheet seems of light yellowish paper and has a broad dark red border, which is a common feature for these sheets. Most of the text isn't eligable, but the lines in the upper half read like:

TOP SECRET//[....]

CRU

EYES ONLY [...]

The lines in the bottom half are probably the standard caveats and warnings that can be found on such cover sheets. With Top Secret being the classification level, and Eyes Only a well-known dissemination marking, the most intriguing are the letters CRU.


On Twitter it was suggested that CRU stands for Community Relations Unit, an FBI unit responsible for transmitting information to the White House. However, the website of the FBI says that this unit is actually part of the Office of Public Affairs, and as such is responsible for relationships with local communities and minority groups. Although that unit could stumble upon suspected terrorists, another option seems more likely:

After a 2009 FOIA request by the ACLU, a 2004 memo from the Justice Department's Office of Legal Counsel about the CIA's detention program and interrogation techniques was released. The classification marking of this memo was blacked out, but on one page this was forgotten. It read: TOP SECRET/CRU/GST.

In a job posting this was written like "CRU-GST", which indicates GST is a compartment of the CRU control system. Meanwhile we also know that GST is the abbreviation of GREYSTONE, which is a compartment for information about the extraordinary rendition, interrogation and counter-terrorism programs, which the CIA established after the 9/11 attacks.

Because Powell is reading the CRU-document on September 11, 2001 itself, the CRU parent-program must have been established somewhere before that day. It's still a secret what CRU stands for, but it probably covers information about highly sensitive CIA operations.




Links and sources
- Wikipedia: Timeline for the day of the September 11 attacks
- 9/11 Myths: Dick Cheney at the PEOC
- New York Times: Essay; Inside The Bunker (2001)

Since the start of the Snowden-revelations, we not only learned about the various collection programs and systems of the National Security Agency (NSA), but also about the various legal authorities under which the agency collects Signals Intelligence (SIGINT).

Bceause these rules are rather complex, the following overview will show which laws and regulations govern the operations of the NSA, showing what they are allowed to collect where and under which conditions. Also mentioned are various collection programs that run under these authorities.

The overview provides a general impression of the most important elements of the various laws and regulations and does not pretend to be complete in every detail. For example, provisions for emergency collection are not included. Also, some of these laws and regulations govern the work of other US intelligence agencies too, but here the focus is on the NSA.

Collection INSIDE the US:

Targeted collection - US persons:

- Section 105 FISA

- Section 703 FISA Amendments Act (FAA)

Targeted collection - Foreigners:

- Transit Authority

- Section 702 FISA Amendments Act (FAA)

- PRISM Collection
- Upstream Collection

Bulk collection - US persons:

- Section 402 FISA (PR/TT)

- Section 215 USA PATRIOT Act (BR FISA)

- USA FREEDOM Act

Collection OUTSIDE the US:

Targeted collection - US persons:

- Sections 704& 705 FISA Amendments Act (FAA)

Targeted & Bulk collection - Foreigners:

- Executive Order 12333

- Classified Annex Authority (CAA)
- Special Procedures governing Communications Metadata Analysis (SPCMA)

 

Section 105 FISA
- Effective since October 25, 1978.
- For communications of US citizens and foreigners inside the US for which there's a probable cause that they are agents of a foreign power or connected to an international terrorist group. Initially also for foreigners outside the US using an American webmail provider.
- Collection takes place at telephone and internet backbone switches, wireless networks, Internet Service Providers and data centers at over 70 locations inside the United States.
- Requires an individualized warrant from the FISA Court (which takes between four and six weeks), but if no US person will likely be overheard, only a certification by the Attorney General is required.
- Collection programs: BLARNEY, COWBOY (FAIRVIEW), PERFECTSTORM (STORMBREW)
 

Section 703 FISA Amendments Act (FAA)
- Effective since July 10, 2008; expires on December 31, 2017.
- For communications of a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court.
- Collection takes place inside the United States (see Section 105 FISA).

 

Transit Authority
- Effective since ?
- Probably based upon a presidential directive that has to be re-authorized regularly, but the 2009 STELLARWIND report says NSA is authorized to acquire transiting phone calls under EO 12333.
- For communications with both ends foreign: originating and terminating in foreign countries, but transiting US territory.
- Collection takes place inside the US, at major fiber-optic cables and switches operated by American telecommunication providers.
- Data may apparently be shared with other US intelligence agencies.
- Collection programs: FAIRVIEW, STORMBREW, SILVERZEPHYR (OAKSTAR), ORANGEBLOSSOM (OAKSTAR)

 

Section 702 FISA Amendments Act (FAA)
- Effective since July 10, 2008; expires on December 31, 2017.
- For communications to or from foreigners who are reasonably believed to be outside the United States.
- Requires an annual certification by the Attorney General (AG) and the Director of National Intelligence (DNI), which has to be approved by the FISA Court. Certifications are known that have been approved for:

- Counter-Terrorism (CT, since 2007)
- Foreign Government (FG, since 2008; including some cyber threats since 2012)
- Counter-Proliferation (CP, since 2009)
- Cyber Threats (planned in 2012)

- Companies get a directive ordering them to cooperate. In return they are granted legal immunity and are compensated for reasonable expenses.
- Dissemination rules differ slightly per certification. Ordinarily, US person identifiers have to be masked, but unevaluated data may be shared with FBI and CIA, and foreign data may be shared with the 5 Eyes partners.
- Unencrypted data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director.

Section 702 FAA has two components, each with slightly different rules:
 

PRISM Collection
- Only internet communications "to" and "from" specific e-mail addresses or other types of identifiers. Filtering only allowed for selectors, not for keywords.
- Collection is done by the FBI's DITU, which acquires the data from at least 9 major American internet companies. This results in both stored and future communications.
- Raw data may be shared with FBI and CIA.
- Data are retained for a maximum of 5 years.
- Collection program: PRISM
 
Upstream Collection
- Both internet and telephone communications. The internet communications may be "to", "from" and "about" specific e-mail addresses or other types of identifiers, including IP addresses and cyber threat signatures.
- Collection takes place inside the US, at major telephone and internet backbone switches. This only results in future communications.
- Raw data may not be shared outside NSA.
- Data are retained for a maximum of 2 years.
- Collection programs: FAIRVIEW, STORMBREW

 

Section 402 FISA (PR/TT)
- Effective since October 25, 1978.
- Since July 14, 2004, orders from the FISA Court allowed the NSA to collect domestic internet metadata in bulk under this authority. These metadata included the "to", "from", and "cc" lines of an e-mail, as well as the e-mail’s time and date.
- Only for Counter-Terrorism purposes.
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Data were being retained for a maximum of 5 years.
- Collection ended in 2011 because the program no longer met NSA’s operational expectations. All data were deleted.
- Collection programs: ?

 

Section 215 USA PATRIOT Act (BR-FISA)
- Effective since October 26, 2001; expired as of May 31, 2015.
- Since 2006, orders from the FISA Court allowed the NSA to collect domestic telephone metadata in bulk under this authority. These metadata included the originating and receiving phone number, the date, time and duration of the call, and, since 2008, the IMEI and IMSI number.
- Only for Counter-Terrorism purposes: there must be a reasonable and articulable suspicion (RAS) that the query term belongs to a foreign terrorist organization.
- Collection took place inside the US, by acquiring the metadata from big American telecommunication providers.
- Data are retained for a maximum of 5 years.
- Collection programs: FAIRVIEW, STORMBREW

During a 180-day transition period, the NSA may continue the collection of bulk telephony metadata under section 215 USA PATRIOT Act, which is until November 29, 2015. In this period, telephony metadata may only be queried after a judicial finding that there is a reasonable, articulable suspicion that the selector is associated with an international terrorist group. The results must be limited to metadata within 2 (instead of 3) hops of the seed term.

 

USA FREEDOM Act
- Effective since June 2, 2015.
- Allows the NSA to request telephone metadata from telecommunication providers based upon specific selection terms for which there's a reasonable, articulable suspicion that they are associated with a foreign power or an international terrorist group. These metadata may consist of "session-identifying information", like originating and receiving numbers, IMSI, IMEI and telephone calling card numbers, and the date, time and duration of the call.
- Requires a specific warrant from the FISA Court, upon which the provider has to produce the metadata in a useful format on a daily basis for a period of time limited to 180 days.
- All records that are not foreign intelligence information have to be destroyed promptly.
- Companies providing these data are granted legal immunity and will be compensated for reasonable expenses.
- Also, foreign terrorists may be tracked for 72 hours when they enter the US, while seeking the proper authority under US law.



 

Section 704 & 705 FISA Amendments Act (FAA)
- Effective since July 10, 2008; expires on December 31, 2017.
- Collection takes place outside the United States.
- Data may be retained for up to 5 years, or for a longer period in response to an authorized foreign intelligence or counterintelligence requirement, as determined by the NSA's SIGINT Director. Inadvertent collection of US data has to be destroyed upon recognition, but the Attorny General can authorize exceptions.

The differences for these sections are:

Section 704 FAA
- For collection against a US person outside the US, when there is probable cause that this person is an officer, employee, or agent of a foreign power or related to an international terrorist group.
- Requires an individualized warrant from the FISA Court, for a period of up to 90 days.
 

Section 705(a) FAA
- For communications of a US person reasonably believed to be outside the United States.
- Requires an individualized warrant from the FISA Court.
- Collection may take place both inside and outside the United States.


Section 705(b) FAA
- For communications of a US person reasonably believed to be outside the US, when there is already an existing FISA Court order for collection against this person inside the US under section 105 FISA.
- Requires authorization by the Attorney General.

 

Executive Order 12333
- Effective since December 4, 1981.
- For communications between foreigners outside the US.
- Requires no external approvals, except for fitting the mission and the goals set for NSA by the government.
- Collection takes place outside the US and for all foreign intelligence purposes. However, Presidential Policy Directive 28 (PPD-28) from January 17, 2014, limits bulk collection to the following 6 purposes:

- Espionage and other threats by foreign powers
- Threats from terrorism
- Threats from weapons of mass destruction
- Cybersecurity threats
- Threats to US or allied armed forces
- Threats from transnational crime

- Data may be shared with other US intelligence agencies, as well as with foreign partner agencies.
- Dissemination of US person identifiers is only allowed when necessary and personal information should not be inapproprately included in intelligence reports.
- Unencrypted data from targeted collection are retained for up to 5 years, unless it is determined that continued retention is required; encrypted data are retained for an unlimited period of time.
- Collection programs: OAKSTAR, WINDSTOP (incl. INCENSER, MUSCULAR, etc), RAMPART-A (incl. SPINNERET, MOONLIGHTPATH, AZUREPHOENIX, etc), DANCINGOASIS, MYSTIC, and many more.

Under EO 12333, there are two additional authorizations:
 

Classified Annex Authority (CAA)
- Effective since 1988.
- For communications of US persons outside the US, for whom there's probable cause that they are agents of a foreign power or engaged in international terrorism.
- Requires prior approval by the Attorney General, limited to a period of time of up to 90 days.
- Also for communications of a US person who is held captive by a foreign power or a terrorist group, which requires approval of the Director of NSA.
 

Special Procedures governing Communications Metadata Analysis (SPCMA)
- Effective since January 2011
- Allows contact chaining and other analysis on metadata already-collected under EO 12333, regardless of nationality and location, including US person identifiers.
- For the purpose of following or discovering valid foreign intelligence targets.
- Only covers analytic procedures and does not affect existing collection, retention or dissemination (including minimization) procedures for US person information.
- SPCMA-enabled tools: ICREACH, Synapse Workbench, CHALKFUN

Besides collecting Signals Intelligence, the NSA is also responsible for Information Assurance (IA). This mission is conducted under the authority of National Security Directive 42 ("National Policy for the Security of National Security Telecommunications and Information Systems") and Executive Order 13587 ("Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information").



Links and sources
- Emptywheel.net: Internet Dragnet Timeline - Phone Dragnet Timeline
- Webpolicy.org: Executive Order 12333 on American Soil, and Other Tales from the FISA Frontier
- IC on the Record: Transition from the USA PATRIOT Act to the USA FREEDOM Act
- DNI.gov: Documents Regarding the Now-Discontinued NSA Bulk Electronic Communications Metadata
- Americanbar.org: Section 214 and Section 215 FISA
- National Research Council: Bulk Collection of Signals Intelligence: Technical Options (pdf)(2015)
- NSA Civil Liberties and Privacy Report about Targeted SIGINT Activities under EO 12333 (pdf)(2014)
- Privacy and Civil Liberties Oversight Board report about the Surveillance Program Operated Persuant to Section 702 FISA (pdf)(2014)
- Legal fact sheet: Executive Order 12333 (pdf)(2013)
- The Department of Defense Directive about NSA/CSS (pdf)(2010)
- NSA OGC: Course on legal compliance and minimization procedures (pdf)
- Memo about Reauthorization of the FISA Amendments Act (pdf)
- NSA OGC: FISA Amendments Act of 2008 - Section 702 - Summary Document (pdf)

Since last Spring, the German parliamentary commission investigating NSA spying is trying to find out whether the Americans secretly tried to spy on German and European targets.

During the hearings it became clear that the German foreign intelligence service BND wasn't able to fully prevent that selectors, like e-mail addresses and phone numbers, provided by the NSA, were fed into the collection system.

A special investigator was allowed access to the lists of rejected selectors and he reported about his findings last week. Here follows the background of this affair and the most important and interesting details from the investigation report.





Satellite interception

The origins of the selector affair go back to 2004, when the Americans turned their satellite intercept station Bad Aibling over to German intelligence. In return, BND had to share the results from its satellite collection with the NSA, for which the latter provided selectors, like e-mail addresses, phone numbers, etc. of the targets they were interested in.

Besides the satellite interception, Bad Aibling was also involved in cable tapping, but only under operation Eikonal (2004-2008), which was limited to cables from Deutsche Telekom in Frankfurt.

Until 2013, NSA is said to have provided some 690.000 phone numbers and 7,8 million internet identifiers. As a foreign intelligence service, BND is not allowed to collect German communications, let alone hand them over to NSA. In order to prevent that, BND tried to check all these selectors, initially by hand, but since 2008 by using a automated filter system called DAFIS.


Blocking German selectors

During a number of tough and lengthy hearings of the parliamentary commission that investigates NSA spying, BND employees had to admit that DAFIS was only able to defeat selectors that were clearly recognizable as belonging to Germans, like mail addresses ending with .de or phone numbers starting with (00)49.

There was hardly any effort to sort out selectors related to other European countries. Also the foreign e-mail addresses, like from Hotmail or Google, used by Germans were only blocked when someone at BND stumbled upon them. Although these kind of selectors could have been blocked more systematically, it's impossible to enter all relevant ones into the DAFIS filter.

This means, when NSA targeted such foreign addresses, the chances they were rejected by DAFIS are not very high and will therefore have been activated on the collection system. Such selectors went into the tasking database, without practicable or reliable means to identify and block them.


Rejected selectors

When the DAFIS system found recognizable German selectors, they were marked as disapproved and not entered into the collection system, so they could not lead to any results.

Initially it seemed that these rejected selectors were put into a separate repository (German: Ablehnungsdatei, also Ausschussliste), but actually they stayed in the tasking databases and were only extracted for the purpose of the parliamentary inquiry.

This resulted in a list of almost 40.000 rejected selectors. An investigation by BND employee Dr. T. in August 2013, revealed almost 2000 e-mail selectors that had been activated, but now seemed politically sensitive. A simultaneous investigation by W.O. resulted in over 10.000 e-mail selectors belonging to European government agencies.




Special investigator

Members of the parliamentary investigation commission were eager to see those selectors, but they are sensitive and classified, so the government denied them access. Finally, a compromise was made, under which an independent special investigator was allowed to examine the lists of rejected and suspicious selectors and report back to the commission, without disclosing individual targets.

The coalition parties agreed upon Dr. Kurt Graulich, a former judge at the Federal Administrative Court, for this job. During the past 4 months he examined the selector lists and finished his investigation on October 23 with a report, which was presented in three versions on October 29:

- A classified report for the federal government
- A classified report for the commission
- A public report (263 pages pdf)

Selector lists

Special investigator Graulich examined the following lists (German: Liste) of selectors that had been rejected by the DAFIS filter, or sorted out by hand because they were considered politically sensitive:

a. The Ablehnungsliste, containing 39.082 selectors (2.918 from the telephony and 36.164 from the internet tasking database) from 2005 till March 2015.

Including most parts of:

b. The 2000er-Liste, containing 1.826 e-mail selectors, which were found in August 2013 by Dr. T. and subsequently marked as disapproved.

c. The 2005er-Liste, containing 74 telephone selectors (52 belonging to EADS, 22 to Eurocopter), which were found by the end of 2005 and were marked as disapproved in January 2006.

d. The Nachfund 1, containing several lists with a total of 444 telephone selectors that were found by semi-manual checks in 2007 and were all marked as disapproved.

e. Not available anymore were between 10.000 and 12.000 e-mail selectors that were found by BND employee W.O. when he checked the tasking database for terms related to European government agencies. He found results for 18 EU member countries and these selectors were marked as disapproved.

Types of selectors

By examining the largest list of rejected selectors (Ablehnungsliste), Dr. Graulich found that it contains the following types of selectors:

For telephony:
- IMSI: Numbers of cell phone SIM cards
- IMEI: Numbers of cell phone devices
- SCREENNAMES: User names or numbers, mainly used for VoIP calls.
- EMAIL_ID: E-mail addresses, mainly used for VoIP calls
- PSTN: Phone and fax numbers

For internet:
- EMAIL_ID: E-mail addresses without permutations
- IMEI: Numbers of cell phone devices
- IMSI: Numbers of cell phone SIM cards
- IPV4: IP addresses
- PSTN: Phone numbers
- OTHER: For example user names, messenger or social network identifiers, cookies, login-data, phone numbers, hashes, etc.

In the tables that contain telephone selectors there's also a field for a description, like a text explaining the reason for targeting, a code or an abbreviation like CT for Counter-Terrorism.

For internet selectors, these descriptions were only visible for NSA personnel, but due to technical reasons not for BND and are therefore not available anymore. Because they lacked justifications, BND stopped using NSA provided internet selectors for the time being as of May 2015.

Keywords were also used as selectors, but according to the report, they are rarely used, because they have to be very specific. Generic words like "bomb" would produce way too many irrelevant results.

It's not clear whether PSTN only applies to traditional land line phone numbers, or also includes mobile phone numbers (known as MSISDN).


Telephone selectors

Together with experts from BND, special investigator Graulich examined all the selectors on these lists and tried to determine the reason for which they were originally rejected. Most important is the Ablehnungsliste, with the selectors that had been filtered out by the DAFIS system.

Most of the telephone selectors appeared to have been rejected because they belonged to German persons or companies and/or contained .de or (00)49. The e-mail addresses for VoIP calls were all blocked because they had no top-level domain - selectors that could not be attributed to a country were rejected.

Update:
On the website Netzpolitik.org it was noticed that for VoIP, one doesn't use e-mail addresses, but SIP addresses, which do have a similar format, like 3246697@voipprovider.com, but which are often under generic top-level domains. Also, blocking IMEI addresses containing "49" wouldn't be very effective, as there are other codes used for Germany, and phones may be sold throughout the European Union.

Some telephone selectors were also not activated because the description field contained terms like for example "German", "Germany" and "Europe".


Permutations

For one internet identifier, like for example an e-mail address, there are multiple permutations, each of which is counted as a separate selector. There can be up to 20 different permutations for one identifier, which explains the very high total number of internet selectors (7,8 million), compared to those for telephony (690.000).

Such a permutation is used to address the various encoding protocols used on the internet. The report gives the following examples:

mustermann@internet.org
mustermann%40internet%2Eorg (HTML-Hex)
mustermann\&\#37;2540internet.org (multiple encodings)
mustermann\\U0040internet.org (UTF-16)

Taken together, all permutations of an internet address are called a Telecommunications Identifier (German: TeleKommunikationsMerkmal or TKM). For telephony, the TKM equals the selector, in other words, there are no permutations for phone numbers.


Internet identifiers

Many internet selectors were rejected by the DAFIS filter system because they belonged to German persons or companies, contained German codes like .de and (00)49, or names of German companies. Also a number of IP addresses had been rejected, but it wasn't possible to determine why. They now belong to providers outside Europe.

The investigator could also not determine what the reasons had been for blocking the remaining internet identifiers, like user names, messenger or social network identifiers, cookies and login-data. NSA provided them combined with other selectors in a so-called equation, but BND separated these for DAFIS filtering, which makes it impossible now to relate them to identifiable selector types.


Numbers

Of the Telecommunications Identifiers (TKMs) found in the main Ablehnungsliste with the rejected selectors, 62% belong to government agencies of EU member states, 19% to Germans outside Europe, 7% to EU institutions, 6% to Germans, 4 to foreigners abroad, 1% to Germans in Europe and 1% to German embassies.

For all selector lists, the reasons why the selectors were apparently rejected can be found in this table:




German targets

The examination of the selector lists revealed that NSA provided several hundred selectors related to Germans, but most of them were blocked by the DAFIS filter. Around 250 had been active for a shorter or longer period of time, but it is not known whether this resulted in communications being collected.

As the 2002 Memorandum of Agreement (MoA), under which the cooperation at Bad Aibling was established, prohibits targeting Germans, the German selectors that had been activated are a violation of the agreement, and moreover also a violation of German law.

The rejected selectors are mainly about German companies, both inside Germany and outside Europe. Without knowing the reasons for targeting these companies, it cannot be said whether this would constitute economical espionage. Construction companies for example can be involved in both civilian and military projects (so-called dual-use).


WikiLeaks' lists

It is interesting to see that there are no rejected selectors that belong to German cabinet ministers. This means, NSA wasn't so stupid to send BND the list of selectors that contains the phone numbers of chancellor Merkel, several ministers and high-level federal government officials - a list that was published by WikiLeaks last July.

Even more interesting would be to know whether the rejected selectors contain the phone numbers of the French prime minister and his cabinet ministers, which were on a similar tasking database list that was published by Wikileaks in June. Special investigator Graulich wasn't able to determine this, because Wikileaks redacted the last four digits of the phone numbers.


European targets

The biggest number of rejected selectors are e-mail addresses (and some other internet identifiers) of European government agencies: 22.024 selectors, being the permutations of 2195 telecommunication identifiers (TKMs).

The overwhelming majority of them was only blocked after August 2013, when the public outrage over NSA spying began. First, selectors were disapproved after the investigations by Dr. T. and W.O., and in November, BND president Schindler ordered all e-mail addresses with a European Top-Level Domain (TLD) to be removed from the BND and NSA tasking database.

Before that new directive, the DAFIS filter wasn't configured to block these European selectors:

- Stage 1 of this system only blocked things like the German TLD .de, the telephone country code (00)49 and the IMSI country code 262;
- Stage 2 blocked foreign identifiers when BND noticed that they were used by German citizens or German companies;
- Stage 3 blocked an initially small number of foreign identifiers that should not be activated because that would be against "German interests".

This means that until the end of 2013, the e-mail addresses belonging to European governments had been active in the collection system: 12% of them for up to 100 days and 87% for an even longer period of time.


Violation

Foreigners and especially foreign government agencies, have no right to privacy under the German constitution, so the collection of their communications is not a violation of German law. But investigator Graulich does consider the targeting of European governments a violation of the Memorandum of Agreement, which allows collection against European targets only for a very few specific topics.

Although the reasons why NSA was interested in these subjects are not known, the investigator judges that the broad targeting of European governments (like e-mail addresses of all members of government staff bureaus) is far beyond what the memorandum allows, and therefore this constitutes a severe violation of the agreement.


Embarrassment

Graulich also says that NSA apparently misused the Bad Aibling satellite station to spy on other European countries - risking an embarrassment for Germany in its relationship with EU and NATO partners.

However, BND itself also targeted for example the British embassy in India and the French embassy in Mali, and eavesdropped on the US Defense and Foreign secretaries as well as senators, when they used non-secure phone lines while traveling.

When in November 2013, BND searched through its own tasking database, it came out that it too contained some 2800 selectors belonging to friendly nations. They were subsequently deleted, but this was kept quiet for almost 2 years.

Update:
On November 11, 2015, it was reported that a preliminary report by the investigation team of the parliamentary intelligence oversight committee says that among BND's own selectors, there were ones belonging to the FBI, the Voice of America, French foreign minister Fabius and the interior departments of EU member states like Poland, Austria, Denmark and Croatia. Also targeted were international organizations like the ICC, the WHO and UNICEF. The selectors also included e-mail addresses, phone and fax numbers of the diplomatic representations of the US, France, Great Britain, Sweden, Portugal, Greece, Spain, Italy, Austria, and Switzerland, as well as European and US companies like Lockheed.

Crisis regions

One last thing that should be mentioned is that at Bad Aibling, the collection effort is directed at (the downlinks of) satellite links from crisis regions like the Middle East, Afghanistan and Africa. This means, that if NSA deliberately provided BND all those selectors of European government officials, they should have known that they couldn't result in their day-to-day business communications.

Using these selectors to filter traffic from the satellite links from the crisis regions, would only provide content when those European officials communicate with their counterparts or other people over there. And maybe it was just that what NSA wanted to find out - an option that was not considered in the Graulich report though.


Reactions

In a first reaction on the report, the German government said that there will be stricter guidelines for the cooperation between BND and NSA, and also that oversight by the federal Chancellery will be increased. Opposition party members of the commission aren't fully satisfied with the report and still want access to the rejected selectors, as well as an examination of all 8 million selectors that NSA provided to BND.

Hearings

On Thursday, November 5, special investigator Dr. Kurt Graulich was heard by the parliamentary investigation commission about his findings. This hearing didn't provide any significant new insights.

The other witness that day, BND lawyer Dr. Werner Ader, revealed that at Bad Aibling, there's highly sophisticated equipment, which allows the interception of satellites even under difficult circumstances, like coping with atmospheric disturbances and following non-geostationary satellites. The equipment "can follow what happens at the satellite".

Links and sources
- Yahoo News: Germany reins in spy service over NSA report
- Netzpolitik.org: Kein Ersatz für Selektorenliste: Abgeordnete Renner und von Notz über Graulich-Bericht
- Spiegel.de: Geheimdienstaffäre: Sonderermittler spricht von klarem Vertragsbruch der NSA

Almost unnoticed, the Austrian member of parliament Peter Pilz recently disclosed new information about operation Eikonal, under which NSA and BND cooperated in tapping some fiber-optic cables at a switching center of Deutsche Telekom in Frankfurt, Germany.

As part of the NSA umbrella program RAMPART-A, Eikonal was set up to gather intelligence about targets from Russia, the Middle East and North-Africa. Because the cables that were tapped came also from countries like Austria, Switzerland, France, Belgium and the Netherlands, there were fears that their communications were intercepted too.

Here, the newly disclosed information will be discussed and combined with things we learned from the hearings of the German parliamentary commission that investigates NSA spying, including operation Eikonal.





Leak

The new information comes from transcripts of some fax and e-mail messages from employees of BND, Deutsche Telekom and the federal Chancellery, which Peter Pilz published on his website on October 23, 2015.

He never told how he got these highly sensitive documents, but as they were made available to the parliamentary inquiry commission, it seems most likely someone from or very close to this commission must have leaked them to Pilz. Strangely enough, this leak was never investigated.


Media attention

Also remarkable is that the information and documents disclosed by Peter Pilz were almost completely ignored by mainstream German media like ARD and ZDF and the major newspapers. The latest disclosure was for example only reported by the Austrian paper Der Standard and the German tech website Heise.de.

By contrast, in neighbouring countries like Austria, Belgium and the Netherlands, the Pilz revelations were big news and led to official investigations. Through May and June of this year, he had published lists of communication links related to Switzerland, France, Luxembourg and Poland too, claiming they showed to what extent BND and NSA spied upon these countries.




Whose's links?

Initially, Peter Pilz claimed these links were from a priority list of the NSA, but neither he, nor the commission hearings could clearly confirm this. The Dutch website De Correspondent reported that there was even a much larger list of some 1000 transit links, of which ca. 250 were marked in yellow.

Now, Pilz confirms that there's indeed such a large list: it was prepared by Deutsche Telekom and contains all its 1028 transit links. Employees of BND had marked 256 of them in yellow, apparently the ones they were most interested in, and hence the list became known as the BND priority list. He doesn't mention an involvement of NSA at this stage anymore.

Now that we know the large list of over 1000 links isn't an even larger "wish list", but a list of all available transit links, it could well be that BND tried to select around 20% of them, as a rather strange provision in German law says that bulk collection is only allowed up to a maximum of 20% of a cable's capacity.

As Telekom Austria rented the channels to Vienna, we can assume that other national telecommunication providers also rented their links to Frankfurt, with Deutsche Telekom being the owner of the cables as part of their international backbone network.


Determining the access points

After BND selected the 256 channels, Deutsche Telekom had to look which of them ran through Frankfurt and could be intercepted there. For this purpose Harald Helfrich of the lawful interception unit of Deutsche Telekom AG (DTAG) sent his collegue mr. Tieger the following e-mail on September 16, 2003:



In this mail it is asked to analyse whether the transit channels marked in yellow can be intercepted at the 2 Mbit-level, either at Deutsche Telekom's Frankfurt am Main Point-of-Presence 21 (Ffm 21) or at Norden-Norddeich.

The latter is a town at the northern coast of Germany, where the SeaMeWe-3 and TAT-14 submarine cables land. For the parliamentary commission this was a reason to ask whether also cables where intercepted over there, but that was strongly denied by the witnesses involved.


Selecting individual channels?

Interestingly, the phrase "ob in der 2-Mb-Ebene greifbar" suggests that it could be possible to just intercept specific 2 Mbit/s channels while leaving the other ones untouched (one physical STM1-cable has a data rate of 155 Mbit/s and contains 63 virtual channels).

Whether this is possible is important for how focused such cable tapping can be. Isolating individual channels depends in the first place on where exactly the tapping takes place:

A. When the physical fiber is intercepted before it reaches the switch, it has to be bend in order to catch the light that leaks. Because this leaking signal is much weaker, it has to be amplified before it can be processed. In this way it's not possible to select individual channels: the eavesdropper gets everything that runs over the fiber, and has to demultiplex the channels himself to select the ones that contain traffic of interest.

Splitting a traffic from a fiber-optic cable by bowing it
(diagram: OSA Publishing, slightly simplified)

B. When the interception takes place at an optical switch itself, then it's possible to only grab the virtual channels you are interested in. A physical cable contains channels which have to be demultiplexed at the switch in order to be forwarded (switched) to the fiber that leads to the intended destination. When the switch converts the optical signals into electronic signals it is even more easy to duplicate only individual channels of interest.

Different methods

During the commission hearing of March 26, 2015, Klaus Landefeld, board member of the DE-CIX internet exchange, indicated that at least since 2009, interception takes place at the switch. Also, the so-called G10-orders authorise interception based upon Autonomous System Numbers (ASN) which are used for logical paths, rather than by naming physical cables to or from a certain city.

However, it seems that under operation Eikonal, the fiber-optic cables were tapped by splitting the cable signal before it reached the switch. This was more or less clearly indicated by several witnesses heard by the parliamentary commission, and there are several other indications too.

In 2004, it was apparently not yet possible to establish a tap at the switch itself to get access to individual channels (although Deutsche Telekom could have demultiplexed the fiber and only forward the channels of interest to BND, but this wasn't the case).


Government authorisation

After BND had made clear what they wanted, the Deutsche Telekom management wasn't sure whether such cable access was legal. Therefore they wanted to be backed by the federal Chancellery. On December 30, 2003, the coordinator for the intelligence services at the Chancellery, Ernst Uhrlau, sent the following fax message to Kai-Uwe Ricke, then CEO of Deutsche Telekom, and Josef Brauner, head of the landline division T-Com:


It says that in the opinion of the Chancellery, the proposed BND operation is according to German law. The Chancellery encourages Deutsche Telekom to instruct its lawful intercept unit RA 43 (which is one of four Regionalstellen für staatliche Sonderauflagen or ReSA) to start taking the necessary measures for the interception.


Transit Agreement

On behalf of the board of Deutsche Telekom, Josef Brauner answers the fax from the Chancellery on January 13, 2004. He says the T-Com division is aware of the importance of a well-functioning intelligence service, and will therefore support the interception of cable-bound transit traffic:



Then on March 1, 2004, the BND and Deutsche Telekom signed the so-called Transit Agreement (pdf), in which the latter agreed to provide access to its transit cables, and in return will be paid 6.500,- euro a month for the expenses. This agreement was also leaked to Peter Pilz, who published it on May 18, 2015 in the Austrian tabloid paper Kronen Zeitung.


Preparing for collection

After the agreement had been signed, BND sent an e-mail on March 9, 2004 to Wolfgang Alster, head of Deutsche Telekom's lawful interception unit RA 43 asking for the connection (schaltung) of the first communication links. He adds that he had ordered the payment of the first two monthly payments:



Realising the access was apparently not that easy, because it took until December 2004 before the first cable was connected. Then it appeared that it's signal was too weak, so in January 2005 an amplifier was installed - as the parliamentary commission was told by S.L., who was the BND project manager for Eikonal (note that the use of an amplifier indicates tapping the entire fiber-optic cable).

At this first stage of operation Eikonal, only circuit-switched (Leitungsvermittelte) telephone communications were intercepted. Collection of packet-switched (Paketvermittelte) internet communications started in 2006 (see below).


RUBIN

On February 3, 2005, mr. Knau mailed his colleague Harald Helfrich at the RA 43 unit that an STM1-link between switching center Frankfurt 21 and Luxembourg had been connected. Channels 2, 6, 14, and 50 contained the virtual channels that had Luxembourg as their endpoint:


We also see the term RUBIN (German for ruby), and during the commission hearings it seemed that this was an alternate codename for operation Eikonal. But when heard on January 15, 2015, Harald Helfrich explained that RUBIN is actually a system that Deutsche Telekom uses to manage its communication links and cables - which perfectly fits how the term is used in this e-mail.


Channels of interest

The next e-mail is also from February 3, 2005, but was already published by Peter Pilz on May 15, 2015 and is the only one that is available in what seems to be its original form. It's from Harald Helfrich, who informs a mr. Siegert at the BND that mr. Knau had connected an STM1-link earlier that morning (see previous e-mail). He says it contains the channels that were on the BND priority list:


This e-mail says that BND was interested in the following 2 Mbit/s channels from the Transit STM1-cable "Ffm 21 - Luxembourg 757/1":

Channel 2: Luxembourg/VG - Wien/000 750/3
Channel 6: Luxembourg/CLUX - Moscow/CROS 750/1
Channel 14: Ankara/CTÜR - Luxembourg/CLUX 750/1
Channel 50: Luxembourg/VG - Prague/000 750/1

According to Peter Pilz, additional cables were connected on February 14 and 25, as well as on March 3, 2005. Unfortunately, he either doesn't possess or didn't disclose the related e-mails, so we still don't know how many and which channels have actually been intercepted.

The interception of telephony communications therefore started in the Spring of 2005, which means that collection under Eikonal only lasted for 3 years, and not 4 years, when one would count from signing the agreement in 2004 until the end of the operation in 2008.


Ending telephone interception

Peter Pilz published the transcripts of two more e-mails, which are about ending the telephone interception. On May 27, 2008, mr. Thorwald from Deutsche Telekom sent the following message to his colleague Harald Helfrich, informing him that fully circuit-switched transit traffic isn't supported anymore. Therefore, the extraction of transit traffic at the company's premises can be terminated:


After that, Thorwald writes that there's currently a need to extract the traffic of two STM-64 and four STM-16 cables, which have a data rate of ca. 10 Gbit/s and 2,5 Gbit/s respectively. This is also said to be circuit-switched, but "extraction at a higher level".


Anomalies

If we assume that Peter Pilz provided the correct date for this e-mail, it's strange that there was apparently a need for new cable accesses, hardly a month before operation Eikonal was officially terminated (June 2008).

Even more strange is that the e-mail says the new accesses are also circuit-switched (leitungsvermittelt), while during the hearings it was testified that the collection of such telephone communications ended in January 2007, after Deutsche Telekom fased-out its business model for dedicated transit cables. This e-mail brings that message almost 1,5 years later!


Internet access

From the commission hearings we also learned that BND wanted access to internet traffic too, which is packet-switched (Paketvermittelt). For this, the first cable became available by the end of 2005, but it took some months before the backlink was also connected. In the spring of 2006 a second cable was added, and the front-end system and the filters were tested until mid-2007.

Could it be that mr. Thorwald just made a mistake, and wrote "leitungsvermittelten" where he meant "paketvermittelten"? But even then, why add new internet cables, just before the operation was ended?


Another question

A similar anomaly can be found in an e-mail, that according to Peter Pilz, was sent one day later, on May 28, 2008. In it, mr. Knau informed Harald Helfrich and his superior Wolfgang Alster that the access to four STM1-cables can be terminated immediately.

Given what was said during the commission hearings, one would have expected that this also had happened already in January 2007, instead of May 2008. It seems some things don't add up here.


Physical cables

Unlike the numerous virtual channels in the lists, this e-mail is about physical cables. "Ffm 21 - Luxembourg 757/1" is the one mentioned in the e-mail from February 3, 2005, containing 4 channels of interest to Luxembourg; the others are cables from Frankfurt (Ffm) to Reims, Paris, and Deutsche Telekom's Point-of-Presence in Stuttgart. With this, we now have proof of 3 other cables having been tapped.

According to a list (.docx) publiced by Peter Pilz, there are 29 channels to/from Reims and 22 channels to/from Paris, all of which could easily have been in the fiber-optic cable between Frankfurt and Reims, and Frankfurt and Paris, respectively, as one single STM1-cable contains 63 separate channels:

Frankfurt - Stuttgart: ? channels of interest
Frankfurt - Paris: 22 channels of interest
Frankfurt - Reims: 29 channels of interest
Frankfurt - Luxembourg: 11 channels of interest

Peter Pilz concludes that operation Eikonal was the start of NSA's illegal mass surveillance of European telecommunications. But that's not supported by evidence. After Eikonal, NSA continued joint cable tapping operations with BND and other European agencies, but as these programs are part of RAMPART-A, they are mainly aimed at specific targets in Russia, North-Africa and the Middle East.*


BND cable tapping

Operation Eikonal did start something else though: it provided BND with the knowledge and the experience for conducting cable tapping on its own: in 2009 they started intercepting cables from 25 internet service providers, this time at the DE-CIX internet exchange in Frankfurt - as was revealed by Der Spiegel on October 6, 2013.

Among these 25 providers are foreign companies from Russia, Central Asia, the Middle East and North Africa, but also 6 German providers: 1&1, Freenet, Strato AG, QSC, Lambdanet and Plusserver, who almost exclusively handle domestic traffic.

It appears that this interception takes place in cooperation with the DE-CIX Management and that the various providers themselves didn't knew that this was happening. A smart move, as this provides BND with just one single point-of-contact, while the indivual providers can honestly deny that their cables are being intercepted.



Links and sources
- Heise.de: BND-Operation Eikonal: "Freibrief" für die Telekom aus dem Kanzleramt
- DerStandard.at: Pilz: Berlin genehmigte NSA-Spionage gegen Österreich
- PeterPilz.at: "Ich darf die Anregung weitergeben..." Die Operation Transit in Europa

There aren't many new revelations from the Snowden-documents anymore, but recently an NSA document was published telling how the agency prepared the interception of communications from the Venezuelan oil company Petróleos de Venezuela, S.A. (PdVSA).

It's not a very spectacular disclosure, but it gives a nice insight in what an NSA analyst actually does. The story was published on November 18 by the website The Intercept and the Latin-American broadcaster teleSUR.

Most people will have read The Intercept's report, but that misses one of the most interesting details of the story. Here, the disclosed NSA document will be discussed in full, with details explained based upon information from earlier disclosures.




The document that was published is an excerpt from SIDtoday, the internal newsletter of the NSA's Signals Intelligence Division from March 23, 2011 (which was apparently accessed (by Snowden?) on Saturday, November 10, 2012). It contains a story that is told by a Signals Intelligence Development (SIGDEV) analyst from the NSA's Transnational & Strategic Partnerships SIGDEV branch.

A SIGDEV analyst is someone who looks for new targets or new means to access communications of existing targets. His unit S2C13 is part of the International Security Issues (ISI) Product Line, which is responsible for analysis and production of intelligence about countries in Europe, South-America and elsewhere.


Intelligence requirements

As the analyst recalls, a year-end review had shown that there was no progress on the "Venezuelan Energy target set" as most reporting came from warranted collection. That could refer to PRISM and Upstream collection under section 702 FAA, but that only requires annual certifications approved by the FISA Court. Strictly spoken, individual warrants are only needed for "traditional FISA" collection, like for example for eavesdropping on the Venezuelan embassy in Washington.

The analyst decided to do a "target reboot", which he describes as "taking a fresh look at opportunities for collection". He first looked at specific Information Needs (INs) and used SURREY, which is the main NSA requirements database.

These requirements are the outcome of an administrative process, that starts with the US president setting the highest priorities for foreign intelligence collection. These priorities are then translated into the general National Intelligence Priorities Framework (NIPF).


Strategic Mission List

For Signals Intelligence (SIGINT), it's the National Signals Intelligence Committee (SIGCOM) that collects the requests for information from the various intelligence "consumers", checks whether they are consistent with the NIPF and assignes them a priority. An overview of the SIGINT priorities can be found in the 2007 Strategic Mission List, which was published in November 2013.

This document lists Venezuela as one of six countries that are treated as "enduring targets". According to this document, NSA should "Provide U.S. decision makers with a holistic SIGINT perspective of regional trends and developments" and also "Provide indicators of regime stability, particularly in the energy sector":




Economic espionage?

The Intercept makes a point out of NSA targeting a petroleum company "for economic espionage" - earlier disclosures had already brought up the names of the Brazilian company Petrobras and Gazprom from Russia. Why that should be a problem isn't explained however: all three companies are government-controlled and oil is an issue of strategic interest for almost any country.

The website also cites US Director of National Intelligence James Clapper, who explained the difference between gathering intelligence on economic issues for government policy makers (which the US admits doing), and stealing trade secrets of foreign companies to help individual American corporations (which the US strongly denies doing). And in this case, there's (again) no evidence for the latter.


Collaboration

The story of the analyst then continues with that he met with the Target Office of Primary Interest (TOPI) responsible for Venezuelan targets, in order to "re-assure myself that we were both on the same page in regards to our goals". A TOPI consists of analysts who analyse the communications that come in as a result of the collection process and who prepare the intelligence reports.

These first steps show that NSA analysts work within a bureaucratic framework that requires collaboration with colleagues and superiors who make sure their activities are in accordance with the goals set by the government - as a rule, they're not free to target anyone at will, which is the impression people can get when listening to Edward Snowden.


Get started

The TOPI analyst wanted information from the highest level of PdVSA, i.e. from the president and members of the Board of Directors, as much of it as possible in the form of internet communications, which, unlike phone calls, don't have to be transcribed. Also there was no time for "extensive target development".

Then the SIGDEV analyst started his work. He first visited the PdVSA website on the internet for the names of the Board of Directors. He put them into a new document in Analyst's Notebook, which is an analysis tool widely used by intelligence and law enforcement agencies all over the world.




Sigint already-collected

The next step was looking at what had already been collected about his targets. For this he first accessed the PINWALE database, which is NSA's main repository for all kinds internet content that was collected by using specific selectors (i.e. no bulk content collection).

A few queries, using the names he had found on the website, returned not much of interest: a lot of e-mails in which these persons were "cc-ed", but hardly anything to or from them personally. This also provided some e-mail addresses, but the analyst already knew these.

He entered the mail addresses into CADENCE, which is NSA's tasking tool for internet communications, and also into the Unified Targeting Tool (UTT), which eventually succeeded OCTAVE in 2011. This would show whether these e-mail addreses were already tasked, which means whether the actual collection facilities had been instructed to collect the related communications.


Finding new selectors

Apparently collection against PdVSA did take place in the past, as PINWALE kept providing documents containing the target's names. This weren't communications, but some kind of information forms with contact details and organizational information about PdVSA employees.

The analyst says that these forms were similar to what is in NSA's SEARCHLIGHT database, which apparently also holds such kind of information forms. As these information forms mention who within PdVSA is somebody's supervisor, they resulted in a whole tree of entries and names:




Lots of them

The new selectors include business and private e-mail addresses and work, home and cell phone numbers. The newly found e-mail addresses could again be entered into CADENCE and the UTT, while the phone numbers could be used to enter them in OCTAVE, which is NSA's tasking tool to initiate the interception of telephone conversations. It's not said whether this happened or not - the TOPI analyst at least didn't prefer phone calls.

The Intercept writes that NSA apparently "collects so much communications data from around the world that it often fails to realize what it has". This however applies to most intelligence and law enforcement agencies that conduct automated eavesdropping: there are often way too many phone calls to listen in to, let alone digital communications to translate, read and analyse.


Internal network

When the SIGDEV analyst was analysing the PdVSA forms (of which there were over 10.000 in the PINWALE database), he discovered that they all came from IP addresses starting with 10.x.x.x and 172.18.x.x, which are from address ranges that are reserved for use within private networks. The analyst now realised these entries came from the internal PdVSA network, and not from communications over the public internet.

One of the most interesting details of this whole story is how NSA had been able to get access to PdVSA's internal network - which isn't told in the report by The Intercept, but only in the one from teleSUR...




Special Collection Service

After the analyst discovered that he was looking at information from the internal PdVSA network, he "fired off a few emails to F6 here and in Caracas, and they confirmed it!"

F6 is the NSA's internal designator for the Special Collection Service (SCS) units in which specialists from NSA and CIA cooperate against targets that require "close access". These units operate out of some 80 US embassies all over the world.

This means it was the SCS unit from the US embassy in Caracas that had been able to get access to the internal network of PdVSA. The story doesn't tell how they did this, but probably they found a way to secretly tap a network cable or switch over which the oil company's computer network runs. If this access was still active, it has now has certainly been compromised.


SCS operations

From an earlier revelation we know that the SCS unit in the US embassy in Berlin was responsible for eavesdropping on the (non-secure) mobile phone of German chancellor Merkel. Maybe that was also done by tapping a local telephone network, or by just intercepting the cell phone's airwave signals.

For such wireless interception operations, many US embassies have a rooftop structure that conceals sophisticated antenna and other eavesdropping equipment. Such a structure is also clearly visible on the roof of the US embassy in Caracas:




XKEYSCORE

After finding out the source of those PdVSA forms, the SIGDEV analyst started to coordinate his work with the F6 unit in Caracas. Apparently they fed data from their network access into XKEYSCORE, which is NSA's system to buffer, index and search internet communications, not only from large submarine cables, but also from smaller accesses, like from the SCS units.

This enabled the analyst at NSA headquarters to search through a rolling buffer of several days worth of content, which is especially useful to find files which aren't directly associated with hard selectors like e-mail addresses.

This resulted in "several juicy pdf documents" and one of them was eventually used for preparing a serialized report (number 3/OO/505480-11) dated January 2011 and titled "Venezuela State-Owned Oil Company Information Shows a Decrease in Overall Oil Thefts and Losses" - which doesn't sound like a trade secret that would benefit individual US oil companies, but on the other hand shows that such high-level accesses are also used for rather general intelligence information.


Hacking opportunities

Through XKEYSCORE, the analyst also found over 900 username and password combinations of PdVSA employees, which he handed over to NSA's hacking division, Tailored Access Operations (TAO). With a username and password one doesn't have to "break in" into a network, which makes the access almost impossible to detect.

The analyst also provided TAO with some other data along with a targeting request, especially aimed at getting access to the e-mail boxes of the PdVSA board members.


It is not known whether this was successful, but The Intercept and teleSUR mention that in May 2011, which is two months after the analyst's story in SIDtoday, the US State Department announced sanctions to be imposed on PdVSA because it had delivered at least two cargoes of reformate (used to produce gasoline) to Iran between December 2010 and March 2011, worth approximately $ 50 million.



> See also: An NSA eavesdropping case study about targeting the presidents of Mexico and Brazil.

Since June 2013, numerous top secret documents from the American signals intelligence agency NSA and its British counterpart GCHQ have been disclosed. The overwhelming majority of them came from the former NSA contractor Edward Snowden.

But what many people probably didn't notice, is that some of these documents were not provided by Snowden, but by other leakers. Often, the press reports didn't mention that very clear, and it was only by not attributing such documents to Snowden, that it became clear they came from someone else.

So far, the following secret and top secret documents have been disclosed without having been attributed to Snowden:

- Chancellor Merkel tasking record
- TAO product catalog
- XKEYSCORE rules: TOR and TAILS
- NCTC watchlisting guidance
- NCTC terrorist watchlist report
- XKEYSCORE rules: New Zealand
- Ramstein AFB supporting drone operations
- NSA tasking & reporting: France
- NSA tasking & reporting: Germany
- NSA tasking & reporting: Brazil
- NSA tasking & reporting: Japan
- Chinese cyber espionage against the US
- XKEYSCORE agreement between NSA, BND and BfV
- The Drone Papers
- Cellphone surveillance catalogue

- Some thoughts on the form of the documents
- Some thoughts on the motives behind the leaks
- Conclusion

Document collections

The most user-friendly collection of all the leaked documents can be found on the website IC Off The Record (which started as a parody on IC On The Record, the official US government website on which declassified documents are published).

Other websites that collect leaked documents related to the Five Eyes agencies, so from Snowden as well as from other sources, are FVEY Docs and Cryptome. The Snowden-documents are also available and searchable through the Snowden Surveillance Archive.


Domestic US leaks

Here, only leaks related to foreign signals intelligence and related military topics will be listed. Not included are therefore documents about American domestic operations, like for example severalrevelationsabout the DEA.

(Also not included are stories based upon leaks without original documents being published, like for example about NSA's interception efforts against Israel)





Chancellor Merkel tasking record

On October 23, 2013, the German magazine Der Spiegel revealed that the NSA may have eavesdropped on the cell phone of chancellor Merkel. This was based upon "the excerpt from an NSA database about Merkel's cell phone", which the magazine received.* A journalist from Der Spiegel made a transcription of the database record, and later on, a copy of this transcription was printed in some German newspapers.
Glenn Greenwald confirmed that this information didn't came from the Snowden archive, and also Bruce Schneier was convinced that this came from a second source.

Articles:
- Kanzler-Handy im US-Visier? Merkel beschwert sich bei Obama
- NSA-Überwachung: Merkels Handy steht seit 2002 auf US-Abhörliste

Document:
- Transcript of an NSA database record

---

TAO product catalog

On December 29, 2013, the German magazine Der Spiegel published a 50-page catalog from the ANT-unit of NSA's hacking division TAO. It contains a wide range of sophisticated hacking and eavesdropping techniques. The next day, Jacob Appelbaum discussed them during his presentation at the CCC in Berlin.
According to Bruce Schneier this catalog came from the second source, who also leaked the Merkel tasking record and the XKEYSCORE rules.

Article:
- Shopping for Spy Gear: Catalog Advertises NSA Toolbox

Document:
- ANT Product Catalog (SECRET/COMINT)

---

XKEYSCORE rules: TOR and TAILS

On July 3, 2014, the German regional television magazine Reporter disclosed the transcripts of a set of rules used by the NSA's XKEYSCORE system to automatically execute frequently used search terms, including correlating different identities of a certain target.
According to Bruce Schneier, these rules could be leaked by the second source, which also provided the Merkel tasking record and the TAO catalog.

Article:
- NSA targets the privacy-conscious

Document:
- Transcript of XKeyscore Rules (classification not included)

---

NCTC watchlisting guidance

On July 23, 2014, the website The Intercept published a manual from the US National CounterTerrorism Center (NCTC) with rules and indications used for putting people in terrorist databases and no-fly lists.
The Intercept says this document was provided by a "source within the intelligence community".

Article:
- The Secret Government Rulebook for Labeling You as a Terrorist

Document:
- March 2013 Watchlisting Guidance (UNCLASSIFIED/FOUO)

---

NCTC terrorist watchlist report

On August 5, 2014, The Intercept published a report from the US National CounterTerrorism Center (NCTC) about terrorist watchlists and databases.
Just like the previous document, this was also obtained from a "source within the intelligence community". Bruce Schneier says this report is from August 2013, which is well after Snowden had fled the US, and therefore he assumes it was leaked by a third source.

Article:
- Watch Commander - Barack Obama’s Secret Terrorist-Tracking System, by the Numbers

Document:
- Directorate of Terrorist Identities (DTI) Strategic Accomplishments 2013 (SECRET/NOFORN)

---

XKEYSCORE rules: New Zealand

On March 14 and March 22, 2015, The New Zealand Herald published transcripts of two sets of XKEYSCORE fingerprints that define targets of the New Zealand signals intelligence agency GCSB. They were not attributed to Snowden, although in the weeks before, New Zealand media published several other documents that did come from the Snowden cache.

Articles:
- Revealed: The names NZ targeted using NSA's XKeyscore system
- How spy agency homed in on Groser's rivals

Documents:
- Fingerprint about the WTO (TOP SECRET/COMINT)
- Fingerprint about the Solomon Islands (TOP SECRET/COMINT)

---

Ramstein AFB supporting drone operations

On April 17, 2015, The Intercept and Der Spiegel published a series of slides showing the infrastructure which is used for operating drones, for which the US base in Ramstein, Germany, acts as a relay station.
In the Citizen Four we see Glenn Greenwald visiting Snowden in Moscow, telling him there's a new source which revealed the role of Ramstein AFB in the drone program.

Articles:
- Germany is the Tell-Tale Heart of America's Drone War
- Bündnisse: Der Krieg via Ramstein

Document:
- Architecture of U.S. Drone Operations (TOP SECRET/REL)

---

NSA tasking & reporting: France

On June 23, 2015, Wikileaks, in collaboration with the French paper Libération, the German newspaper Süddeutsche Zeitung and the Italian paper l'Espresso, published the transcript of entries from an NSA tasking database, as well as intelligence reports about high-level French targets.

Articles:
- Espionnage Élysée
- Nsa, intercettati i presidenti francesi Francois Hollande e Nicolas Sarkozy

Documents:
- Top French NSA Targets (no classification available)
- Top French NSA Intercepts (up to TOP SECRET/COMINT-GAMMA)
- Economic Spy Order (SECRET/REL)

---

NSA tasking & reporting: Germany

On July 1, 2015, Wikileaks, in collaboration with Libération and Mediapart, Süddeutsche Zeitung and l'Espresso, published the transcript of entries from an NSA tasking database, as well as intelligence reports about high-level German targets.

Articles:
- NSA Helped CIA Outmanoeuvre Europe on Torture
- I dubbi di Angela Merkel sulla Grecia spiati dalla Nsa americana

Documents:
- Top German NSA Targets (no classification available)
- Top German NSA Intercepts (up to TOP SECRET/COMINT-GAMMA)

---

NSA tasking & reporting: Brazil

On July 4, 2015, Wikileaks published the transcript of entries from an NSA tasking database about high-level Brazilian targets. Unlike similar disclosures about France, Germany and Japan, no intelligence reports about Brazil were disclosed.

Article:
- Bugging Brazil

Document:
- Top Brazilian NSA Targets (no classification available)

---

NSA tasking & reporting: Japan

On July 31, 2015, Wikileaks, in collaboration with Süddeutsche Zeitung, l'Espresso, The Saturday Paper from Australia and the Japanese newspaper Asahi Shimbun, published the transcript of entries from an NSA tasking database, as well as intelligence reports about high-level Japanese targets.

Articles:
- Target Tokyo
- Wikileaks: 'Nsa spiava il governo giapponese. Sotto controllo anche Mitsubishi'

Documents:
- Top Japanese NSA Targets (no classification available)
- Top Japanese NSA Intercepts (TOP SECRET/COMINT)

---

Chinese cyber espionage against the US

On July 30 and August 10, 2015, NBC News published two slides about Chinese cyber espionage against over 600 US companies and government agencies, including access to the e-mail of top government officials since at least 2010.
This leak stands out because the slides are in digital form, and they support a story that shows the neccessity of NSA - which seems to point to an authorized leak.

Articles:
- Exclusive: Secret NSA Map Shows China Cyber Attacks on U.S. Targets
- China Read Emails of Top U.S. Officials

Documents:
- China: Cyber Exploitation and Attack Units (SECRET)
- U.S. Victims of Chinese Cyber Espionage (SECRET)

---

XKEYSCORE agreement between NSA, BND and BfV

On August 26, 2013, the German newspaper Die Zeit published the transcript of the Terms of Reference (ToR) about the use of NSA's XKEYSCORE system by the German security service BfV.
Being a transcript and being about XKEYSCORE, this could be from the same source as the XKEYSCORE rules, but it's also possible it came from a source within a German government agency.

Article:
- A Dubious Deal with the NSA

Document:
- XKeyscore - the document (SECRET/COMINT)

---

The Drone Papers

On October 15, 2015, The Intercept published a series of documents with details about drone operations by the US military between 2011 and 2013.
In the Citizen Four we see Glenn Greenwald visiting Snowden in Moscow, telling him there's a new source which revealed the role of Ramstein AFB in the drone program, including the chain of command diagram which is part of this batch of documents.

Articles:
- The Assassination Complex
- The Kill Chain

Documents:
- Small Footprint Operations 2/13 (SECRET/NOFORN)
- Small Footprint Operations 5/13 (SECRET/NOFORN)
- Operation Haymaker (SECRET/NOFORN)
- Geolocation Watchlist (TOP SECRET/COMINT)

---

Cellphone surveillance catalogue

On December 17, 2015, The Intercept published a range of pages from a classified catalogue containing cellphone surveillance equipment, including IMSI-catchers like Stingrays and DRT boxes.
Just like the NCTC reports, The Intercept obtained this document from a "source within the intelligence community".

Article:
- Stingrays - A Secret Catalogue of Government Gear for Spying on Your Cellphone

Document:
- Government Cellphone Surveillance Catalogue (SECRET/NOFORN)

---

It is difficult to tell exactly from how many different leakers these documents come. The journalists involved will of course do everything to hide their source's identity, including creating distraction and confusion, but also creating the impression that many other leakers followed the example of Edward Snowden.



Some thoughts on the form of the documents

Content-wise the documents from the alleged other sources are not very different from the ones from Snowden. But what seems to distinguish them most, is their form, which is either digital, a transcript or scanned from paper.


Digital

Almost all documents that were attributed to Snowden came in their original digital form (with some very fewexceptions that were scanned from paper). This makes it remarkable that only two documents from the other sources are in a similar digital form.

The first one is the famous TAO Product Catalog with hacking and eavesdropping techniques, which also given its content comes closest to the Snowden documents. Despite that, this catalog was never attributed to him.

The other leak in digital form are the two slides about Chinese cyber espionage, but these probably come from a source in support of the US government.


Transcripts

A number of other leaks didn't provide documents in their original form, but only transcripts thereof. This is the case for the following revelations:

- Chancellor Merkel tasking record
- XKEYSCORE rules: TOR and TAILS
- XKEYSCORE rules: New Zealand
- XKEYSCORE agreement between NSA, BND and BfV

The lists from an NSA tasking database with targets for France, Germany, Brazil and Japan are also transcripts, but for the intelligence reports, which Wikileaks published simultaneously, we have at least one example that is in its original format. All other ones came as transcripts.


Scanned from paper

All other documents that didn't came from Snowden look like they were printed out (some were even recognized as being double-sided) and scanned again. This is the case for:

- NCTC watchlisting guidance
- NCTC terrorist watchlist report
- Ramstein AFB supporting drone operations
- The Drone Papers
- Cellphone surveillance catalogue

This doesn't automatically mean they are all from the same source, as two of them are from the civilian NCTC and the other three are clearly from a military context.

We don't know when or where these documents were printed out: maybe it was done by the leaker, for whom it could have been easier to exfiltrate them as hard copy, than on a detectable thumb drive.

It's also possible that they were printed out by the press contact in order to make them look different from the Snowden documents. But on the other hand, publishing them in digital form would have made it more difficult to prove they were not from the Snowden cache.



Some thoughts on the motives behind the leaks

We can also take a look at the motives that could have been behind these leaks. Interestingly, these seem to correspond quite well with the different forms the documents have.


A second source

The disclosures of the transcriptions of the XKEYSCORE rules and the tasking database lists are quite far from being in the public interest. They are about legitimate targets of foreign intelligence and publishing them seems solely meant to discredit the NSA and/or damage US foreign relationships.

The same applies to the TAO Product Catalog, which contains devices and methods that are only used against "hard targets" that cannot be reached by other means, so this is not about spying on ordinary citizens, but does compromise valid US intelligence operations.

At first sight, one would assume that these documents were from the Snowden cache, but published by people like Appelbaum and an organization like Wikileaks, who have a more radical approach than Snowden himself, and maybe therefore could have pretended they came from another source.

However, both Greenwald and security expert Bruce Schneier said these documents were really provided by another leaker. Because a number of them were published by German media, Schneier guesses it might be "either an NSA employee or contractor working in Germany, or someone from German intelligence who has access to NSA documents".

If that's the case, then it's not only remarkable that there's a second source from within or close to NSA, but also that this source is apparently fine with leaking documents that show no abuses, but only seriously harm US interests - which is either treason, or the work of a hostile intelligence agency. Snowden at least acted from his concern about increasing mass surveillance on innocent civilians.


A third source

The documents that are scanned from paper are a somewhat different story. These are about issues that concern a wider range of people. For some of them, The Intercept even gives the reason why the source leaked them: for the cellphone surveillance catalogue it was because of a concern about militarization of domestic law enforcement.

For the drone papers, the source is cited saying: "This outrageous explosion of watchlisting [...] assigning them death sentences without notice, on a worldwide battlefield". Given that he mentions watchlists, it seems very well possible that this source actually also leaked the two NCTC reports about terrorist databases and watchlists.

Combining this with the fact that both the NCTC reports and the cellphone surveillance catalog were from a source "within the intelligence community" seems to confirm that all the documents that came as scanned from paper are from the same leaker - maybe someone from a military intelligence agency like the DIA.



Conclusion

Given these thoughts on the form of the leaked documents and the possible motives behind these leaks, it seems that they can be attributed to at least three other sources, beside Snowden:

Source nr. 1 (Edward Snowden)

Source nr. 2 (German NSA employee or hostile intelligence?)

- Chancellor Merkel tasking record
- TAO product catalog
- XKEYSCORE rules: TOR and TAILS
- XKEYSCORE rules: New Zealand
- NSA tasking & reporting France/Germany/Brazil/Japan
- XKEYSCORE agreement between NSA, BND and BfV

Source nr. 3 (someone from US military intelligence?)

- NCTC watchlisting guidance
- NCTC terrorist watchlist report
- Ramstein AFB supporting drone operations
- The Drone Papers
- Cellphone surveillance catalogue

Source nr. 4 (someone from the US government?)

- Chinese cyber espionage

Links and Sources
- Schneier.com: The US Intelligence Community has a Third Leaker

More comments on Hacker News

One of the most controversial NSA programs was the bulk collection of domestic telepone records (metadata) under authority of Section 215 of the USA PATRIOT Act.

The Snowden revelations provided hardly any information about this program, but many details became available from documents that were declassified by the US Director of National Intelligence (DNI).

Because in these declassified documents all codenames are redacted, it was a mystery which NSA systems were used to store and analyse these metadata.

By combining many separate pieces from both the Snowden-documents, as well as those declassified by the government, it now has become clear that NSA put the domestic phone records in its central contact chaining database MAINWAY, which also contains all sorts of metadata collected overseas.




MAINWAY versus MARINA

Initially it was thought that MAINWAY was a repository just for telephone metadata. This goes back to a report by USA Today from May 10, 2006, which revealed that the NSA created a database containing "tens of millions" of domestic telephone call records obtained from AT&T, Verizon and BellSouth (the latter merged with AT&T as of 2007).

As such, MAINWAY was seen as the equivalent of MARINA, which is NSA's storage for internet metadata. But meanwhile, various documents from the Snowden revelations have made clear that the actual repositories for telephone metadata are ASSOCIATION (for metadata from mobile calls) and BANYAN (for metadata from landline calls).

New documents have also shown that MAINWAY contains metadata from internet communications too. For example, in the following diagram about the FAIRVIEW collection program, we see that internet metadata from the Upstream collection first flow into MAINWAY before ending up in MARINA:



It's not clear what exactly the differences between the contact chaining database MAINWAY and the metadata repositories like MARINA, ASSOCIATION and BANYAN are. It seems likely that in MAINWAY metadata are stored more or less temporarily for the purpose of analysing them. Metadata that NSA wants to keep for a longer period of time, or even indefinitely are then stored in the other repositories.

While the domestic metadata collected in bulk have to be destroyed after 5 years, the calling records that are the result of a query can be stored by the analyst. They may then be "subjected to other analytic methods or techniques besides querying, or integrated with records obtained by the NSA under other authorities", as well as shared with others inside and outside NSA.*




Metadata sources

Based upon Snowden documents, The New York Times reported on September 28, 2013, that MAINWAY is used for chaining both phone numbers and e-mail addresses and that it is fed with data from tapping "fiber-optic cables, corporate partners and foreign computer networks that have been hacked".

The report also says that as of August 2011, MAINWAY was fed with "1.1 billion cellular records a day in addition to the 700M records delivered currently". However, The New York Times erroneously attributed these numbers to collection under authority of section 702 FAA and was therefore not able to identify that MAINWAY was also fed with the bulk phone records of Americans (which happens under section 215 Patriot Act).

The latter only became clear after The New York Times and ProPublica published some NSA documents about the FAIRVIEW program on August 15, 2015. One of these documents confirms that it was AT&T that provided the aforementioned number of records, and also that this happened under BR FISA (= Section 215) authority.

So as of 2011, at least 1,8 billion domestic phone records a day were coming in, which makes 54 billion a month and about 650 billion a year. Before they were handed over to NSA, AT&T stripped off the location data in order to comply with the FISA Court orders, that don't allow those data to be collected.

Apparently Verizon Wireless and T-Mobile US saw no obligation to remove these location data, so their cell phone records couldn't be collected by NSA, which therefore only got less than 30% of the domestic telephone metadata.




Under the President's Surveillance Program (2001 - 2004/2006)

NSA started collecting telephone and internet metadata from US telecommunication providers shortly after the attacks of September 11, 2001. This was part of the President's Surveillance Program (PSP, protected under the STELLARWIND classification compartment), which was based upon what in the end would be 43 subsequent secret authorizations by president George W. Bush.

The goals of collecting these metadata were identifying unknown terrorist operatives through their contacts with known suspects, discover links between known suspects, and monitor the pattern of communications among suspects.

At first, only metadata were collected from communications in which at least one party was outside the US. AT&T (identified as Company A or FAIRVIEW) started to provide both phone and internet metadata from international channels as early as November 2001, and for Verizon (Company B or STORMBREW) the automated transfer of such data started in February 2002.

Allegedly, raw metadata were transferred in real-time through a high speed data link between the main computer centers of the telecoms and an NSA facility.* Then, parsers were used to filter the metadata of unwanted information (like credit card numbers), and the records were put in a standard format compatible with NSA databases.

For example, in September 2003, AT&T "captured" several trillion internet metadata, of which some 400 billion records (apparently those with a high probability of containing terrorist communications) were selected for processing. These were flowing into the MAINWAY contact chaining database, which also contains metadata from collection abroad. The 2009 report about the STELLARWIND program says:

"NSA's primary tool for conducting metadata analysis, for PSP and traditional SIGINT collection, was MAINWAY. MAINWAY was used for storage, contact chaining, and for analyzing large volumes of global communications metadata."

(interestingly, in some documents MAIN WAY seems to be written as two separate words, which make it resemble MAIN CORE, which is a central database containing essential intelligence information on Americans produced by the FBI and other US intelligence agencies)



Under FISA Court orders (2004/2006 - 2011/2015)

In July 2004, the collection of domestic internet metadata was moved from the President’s Surveillance Program to the FISA Court (FISC), which authorized this effort based upon section 402 FISA, or as it is called by NSA: PR/TT (short for Pen Register/Trap and Trace).

In May 2006, the same happened with the bulk telephone records, for which the FISC allowed continuation under authority of section 215 USA PATRIOT Act, or as NSA calls it: BR FISA (short for Business Records FISA).

Under the FISA Court orders, bulk telephone collection eventually became to include"all call detail records or 'telephony metadata' created [...] for communications between the United States and abroad" or "wholly within the United States, including local telephone calls". Only metadata of fully foreign communications were excluded, as was the case for most mobile phone calls, due to technical reasons.

Because right from the beginning, NSA stored these domestic phone and internet metadata in the same database (MAINWAY) that contains metadata from traditional collection efforts abroad, queries could result in contacts chains made up of identifiers from both foreign and domestic sources. The query tool simply didn't identify the difference.

Also it was possible for analysts to start a query with selectors that were not BR FISA-approved, and in some cases this also provided results from both the foreign and the domestic collection. This was not according to the FISA Court orders, and after NSA informed the court about this, they had to stop accessing the telephone metadata in 2009, until these issues had been solved.*

An internal NSA training module from 2011 shows that at least by then, NSA had tagged the metadata records with XML tags to identify not only what legal authority the metadata were collected under, but also the SIGAD of the intercept facility where that had happened.




Other databases for domestic call records

The domestic call records were not only stored in MAINWAY, but also in another database, one that was apparently dedicated for US phone metadata. An NSA training presentation (.pdf) from 2007 confirms that BR FISA data were stored in two NSA repositories, although both names had been redacted.

An NSA review from June 2009 describes this second database as a "repository for individual BR FISA metadata call records for access by authorized Homeland Security Analysis Center (HSAC) and data integrity analysts to view detailed information about specific telephony calling events".

This seems to refer to the complete calling records, and also the PCLOB-report (.pdf) about the BR FISA program says there's analysis software that "provides the associated information about the telephone calls involved, such as their date, time of day, and duration".

So probably the second database gave access to these additional details, whereas MAINWAY only contains or provides "summaries of one-hop chains", i.e. selector #1 was in contact with selector #2 and the number of times this happened within a specific timeframe.

The PCLOB-report suggests that when, either manually by an analyst, or in an automated process, a contact chain was created, the full records related to the phone numbers of this contact chain were transferred to the second database, which in the report is called the "corporate store".

In the glossary of the 2009 NSA Review, the second repository is listed with a remarkably long name, which, according to its position, has to start with and M, N or O:



This exceptionally long name of the second database could indicate that it was some kind of provisional repository, because on page 23 of the 2009 BR FISA review it is said:

"NSA is preparing to incorporate the [second database] into the NSA corporate architecture. This transition to the corporate engineering framework will maximize use of the latest technologies and proven configuration management to minimize any security and compliance risks"

And indeed, in appendix B of a report (.pdf) by the NSA's Inspector General from August 1, 2012, we see that the second database now has a shorter name, and that it had replaced a "Transaction Database" with a much longer name in January 2011:



Transaction is another term that NSA uses for metadata, so "transaction database" probably just means that it contains the (full) metadata records. This 2012 Inspector General report lists three additional storage systems for BR FISA data, making a total of five being involved here:

1. Contact chaining database that accepts metadata from multiple sources (= MAINWAY)
2. Database repository that stores detailed metadata information, which supports the contact chaining summaries in (MAINWAY). Replaced an earlier database in January 2011.
3. Contingency database for the time the aforementioned database was being rebuild
4. System backup that stores an exact copy of the raw metadata from the providers
5. Backup tapes on which periodically the raw metadata were saved off-line

So when NSA needs large data centers, that's also because the same data are stored at least in threefold.


Bulk internet metadata (PR/TT)

As mentioned before, MAINWAY was not only fed with telephone metadata, but also with metadata from domestic internet communications. These metadata include the "to", "from", and "cc" lines of an e-mail, as well as the e-mail’s time and date. Its seems that for contact chaining, no metadata from other kinds of internet communications, like messengers, were used.

On August 11, 2014, an internal NSA Review (.pdf) about this PR/TT program was declassified, which shows similar storage systems as for the phone records: full copies of the internet metadata were also stored in the MAINWAY contact chaining database, as well as in a dedicated second repository:


The PR/TT bulk internet metadata program was shut down in December 2011 for "operational and resource reasons" and all data were deleted. Based upon declassified NSA reports, The New York Times reported on November 19, 2015, that this "internet dragnet" was ended because, among other reasons, similar results could be achieved under other authorities:

- Section 702 FAA, which allows access to internet communications between foreigners and Americans from the "PRISM-providers" and "Upstream collection".

- The SPCMA regulation, which allows using US person identifiers for querying metadata that have been collected abroad.

With collection of internet metadata both overseas (under EO 12333 authority) as well as at the borders of the US (under 702 FAA), NSA probably didn't need the purely domestic ones anymore, to still capture those that are of interest.

Also, querying the metadata collected overseas appeared more attractive, because abroad, NSA is allowed to collect much more types of metadata, than inside the US, where collection was heavily restricted by the FISA Court.

In a declaration for the FISA Court from February 13, 2009, then NSA director Alexander explained that multi-tiered chaining of phone calls is more efficient and useful, "because unlike e-mail, which involves the heavy use of spam, a telephonic device does not lend itself to simultaneous contact with large numbers of individuals".


Replacement?

According to the secret Budget Request to Congress for 2013, NSA wanted to create (or maybe expand MAINWAY into) a metadata repository capable of taking in 20 billion metadata records a day and make these available to analysts within 60 minutes.

But after Snowden disclosed the Verizon bulk phone records order in June 2013, the American public became aware of the actual scope of this program and it became the most controversial part of NSA's activities.

In January 2014, the Privacy and Civil Liberties Oversight Board (PCLOB) judged that Section 215 collection was actually of "minimal value in safeguarding the nation from terrorism" and that there was "no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack".

According to PCLOB, the bulk phone records did provide some value "by offering additional leads regarding the contacts of terrorism suspects already known to investigators, and by demonstrating that foreign terrorist plots do not have a U.S. nexus". This however, was not seen as a sufficient justification for the large-scale collection of domestic phone records.

In the course of 2015, US Congress eventually enacted the USA FREEDOM Act, which prohibits NSA to collect and store domestic call records in bulk as of November 29, 2015. Instead, the agency now has to apply for a warrant from the FISA Court approving specific selectors, which are then provided to telecommunication providers, who use them for querying their own databases and only the results are handed over to NSA.

How this new regime will work out, is explained in the USA FREEDOM Act Business records Fisa Implementation Transparancy Report (.pdf), which was published just a few days ago.


> Next time: a closer look at the contact chaining process



Links and Sources
- EmptyWheel.net: What We Know about the Section 215 Phone Dragnet and Location Data
- PCLOB: Report on the Telephone Records Program Conducted under Section 215 of the USA PATRIOT Act (pdf) (2014)
- Cryptome.org: NSA FISA Business Records Offer a Lot to Learn (2013)
- NSA: Business Records FISA NSA Review (.pdf) (2009)
- NSA: Pen Register/Trap and Trace FISA NSA Review (.pdf) (2009)

In the previous posting we saw that the domestic telephone records, which NSA collected under authority of Section 215 of the USA PATRIOT Act (internally referred to as BR-FISA), were stored in the centralized contact chaining system MAINWAY, which also contains all kinds of metadata collected overseas.

Here we will take a step-by-step look at what NSA analysts do with these data in order to find yet unknown conspirators of foreign terrorist organisations.

It becomes clear that the initial contact chaining is followed by various analysis methods, and that the domestic metadata are largely integrated with the foreign ones, something NSA never talked about and which only very few observers noticed.

What is described here is the situation until the end of 2015. The current practice under the USA FREEDOM Act differs in various ways. The information in this article is almost completely derived from documents declassified by the US government, but these have various parts redacted.


 

RAS-approval

As a seed for starting a contact chain, NSA analysts can take a telephone identifier like a phone number (also called a selector), based upon:

- their own ongoing analysis on an existing target set;
- a Request for Information (RFI) from another government agency;
- a notification of a match between a known counterterrorism-related selector and an identifier among newly ingested phone metadata.

Access to the domestic phone records was granted to about 125 intelligence analysts from the Homeland Security Analysis Center (HSAC, or S2I4) of the NSA's Signals Intelligence Directorate. There were also up to 22 specially trained officials called Homeland Mission Coordinators or HMCs (initially shift coordinators).

As required by the FISA Court orders, only these HMCs, the chief and the deputy chief of the HSAC are allowed to determine that there is a Reasonable, Articulable Suspicion (RAS) that a certain selector is associated with a designated foreign terrorism group and/or Iran. Such a RAS-approval is only needed for the domestic phone records, not the ones collected overseas.

NSA has a special RAS Identifier Management System to streamline the adjudication of the requests for RAS approval and the documentation thereof. The codename of this system is IRONMAN, as we learn from this document from a declassified 2011 training presentation (.pdf) in which this codeword wasn't redacted twice:



A RAS-approval is effective for one year, meaning that during the next year, repeated queries using the approved seed selector can be made. If the selector is reasonably believed to be used by a US person, the approval period is 6 months.

The number of RAS-approved identifiers variedsubstantially over the years, but in 2012, there were fewer than 300. According to the annual Transparancy Report from the Director of National Intelligence (DNI), there were 423 such selectors in 2013, but just 161 in 2014. It's not known how many of these belonged to Americans.
 


Different kinds of queries

From various declassified documents analysed in an article on the weblog EmptyWheel, it becomes clear that there are three different kinds of queries that NSA analysts conducted on the domestic phone records database:

1. Queries for data integrity purposes
2. Queries for "Ident lookups"
3. Queries for contact chaining

In the EmptyWheel article it's assumed that besides these queries, NSA also conducted some kind of pattern analysis: in many declassified documents a redaction appears right after the term "contact chaining", which according to EmptyWheel could hide something like "pattern analysis".

Given that in these documents the targets are also redacted, there's also the possibility that the redaction hides a description of the target, like "contact chaining al-Qaida affiliates".

At least one NSA memorandum from 2009 indeed speaks about "chaining and analysis", but there can be two kinds of analysis: one conducted on the bulk of raw metadata records, and another one on selected results of contact chaining.

NSA always denied that it conducts pattern analysis on the bulk metadata themselves, stating that every search begins with a specific telephone number or other specific selection term. So far, there are no indications of the contrary, so the analysis apparently refers to the results of contact chaining queries, which is confirmed by the 2014 report (.pdf) about the Section 215 program by the Privacy and Civil Liberties Oversight Board (PCLOB).

As we will see later on, this second type of analysis is indispensable for making the contact chaining queries useful for foreign intelligence purposes.




(1) Data integrity queries

The first way the domestic phone records were queried was for data integrity purposes. This was done by some 25 specialized Data Integrity Analysts (DIAs). They didn't conduct target analysis, but helped intelligence analysts with questions on a target. For those cases, a DIA could use a standard login (with appropriate controls) to query the phone records for foreign intelligence purposes.

However, when they queried for data integrity purposes, DIAs used a special login that bypassed the normal controls (like EAR) and also the auditing. This because for this task, they were allowed to use identifiers that were not RAS-approved (not allowed though were selectors that had expired because they were not revalidated).

One goal of these data integrity queries was to discover selectors that, for reasons that were redacted in the review report, should not become part of analysis, both for BR FISA and other purposes. These selectors could then be added to a defeat list of identifiers that were deemed to be of little analytic value, and/or to a database holding those that should not be tasked onto the collection system.

There was of course a risk of mixing up these tasks, and after an expired identifier had been queried in March 2010, the NSA Inspector General recommended that the duties of DIAs and foreign intelligence analysts should be clearly separated.


(2) Ident lookup queries

A second kind of query was for so-called "ident lookup". According to an NSA Inspector General test report (.pdf) from April 2010, this refers to:

"querying a selector using [tool name redacted] to determine the approval status of a selector. In such cases, the Emphatic Access Restriction controls will prevent chaining of a selector that is not marked as approved for querying, and return an error message to the analyst. Because the selector was not actually chained, there is no violation of the Order"

Emphatic Access Restriction (EAR, pronounced as "ear") is a tool that was installed at the MAINWAY database in February 2009. It automatically prevents using a selector that is not RAS-approved. It seems therefore that when an analyst started a query and the seed selector appeared to be not approved, that query was called an "ident lookup" (although EmptyWheel has a different interpretation).

This could be the way it worked before the IRONMAN system was established, as in a training module from 2011, it is said that by then, analysts just had to "use [tool name redacted] to determine the identifier’s approval status".
 


(3) Contact chaining queries

The most important queries on the domestic phone records were of course those conducted by intelligence analysts in order to "identify unknown terrorist operatives through their contacts with known suspects, discover links between known suspects, and monitor the pattern of communications among suspects".

For this, an analyst took a RAS-approved selector (often a telephone number) and entered it into a specialized metadata tool, which searched the telephone metadata in the MAINWAY contact chaining system. To limit the number of results, the analyst could set a certain timeframe for the query.

The metadata tool then returns"a .cml file, usually referred to as a chain, which is made up of the individual first hop contacts of the seed". Usually, the analyst will also be interested in the second-hop contacts, and then the tool will retrieve the batches of one-hop chains for the identifiers that had been in direct contact with those from the first hop series.



Number of hops

Based upon the FISA Court orders, NSA analysts were also allowed to retrieve the numbers in contact with all the numbers from the second hop, which would make a third hop. The software tools are said to prevent looking beyond the third hop, or performing a query of a selection term that has not been RAS-approved.

The initial authorizations under the President's Surveillance Program (PSP) did not prohibit chaining more than two degrees of separation from the target, but "NSA analysts determined that it was not analytically useful to do so".* When this collection was brought under supervision of the FISA Court, it limited contact chaining to 3 hops.

But despite that authorization, the policy of NSA's Counter Terrorism branch restricted chaining to 2 hops, as can be seen in an NSA training presentation (.pdf) from 2007:


A 2011 training module says that chaining to a third hop is possible, but only after prior approval by the analyst's division management (for example when a contact that comes up with the first hop appears to be an already known suspect).

Strangely enough, both a government white paper and the PCLOB-report don't mention this policy restriction and in the latter it's even assumed that chaining 3 hops was regular practice:

"If a seed number has seventy-five direct contacts, for instance, and each of these first-hop contact has seventy-five new contacts of its own, then each query would provide the government with the complete calling records of 5,625 telephone numbers. And if each of those second-hop numbers has seventy-five new contacts of its own, a single query would result in a batch of calling records involving over 420,000 telephone numbers"

As of 2012, the FISA Court also allowed an automated chaining process, but NSA was never able to get that working (although the PCLOB report, again, describes it as if it was actually implemented).


Visualization

The results from a contact chaining query can be visualized by a contact graph. An example was published by the German magazine Der Spiegel, showing a slide from an NSA presentation with a 2-hop contact graph for the e-mail addresses of the CEO and the chairwoman of the Chinese telecommunications company Huawei:




Domestic and foreign results

Generally, it is said that analysts query the "Section 215 calling records", the "BR metadata" or something similar. This sounds like they only access the domestic telephone records and that therefore the resulting contact chains would fully consist of American phone numbers.

The initial seed number however will often be a foreign number, as the whole purpose of the Section 215 program is to discover connections between foreign terrorists and potential conspirators inside the US. Analysts will therefore choose a seed for which they expect a good chance it has a domestic nexus, which probably explains the low numbers of RAS-approved identifiers.

But as we have seen in the previous article, NSA stored the domestic phone records in MAINWAY, which also contains the foreign telephone and internet metadata collected overseas. That means that a contact chaining query will not only return identifiers from the domestic, but also from the NSA's worldwide metadata collection.


Federated queries

Such results from multiple sources are called federated queries. According to a 2011 training module, BR FISA queries initially only resulted in these federated queries, but in later versions of the query tool, the analyst could also check boxes to conduct an "unfederated" query and choose individual collection sources.

These options can be seen in the following screenshot from the user interface (the codename of which is redacted) used to conduct the contact chaining:


Selecting the "FISABR Mode" makes that an additional checkbox for the EO12333 source appears. An NSA memorandum explains that when this BR FISA option is chosen, the analyst will not only be provided with the domestic telephone metadata, but also with those from the SIGINT realm (which is collection overseas under EO 12333 authority), dating back to late 1998.

When the analyst used a RAS-approved selector, he could also check the box for PENREGISTRY, or PR/TT, which refers to the domestic internet metadata, but the collection thereof was ended by the end of 2011. Normal mode is for all other metadata collected abroad.

Analysts can determine the collection sources of each result by examining the Producer Designator Digraph (PDDG) and/or SIGINT Activity Designator (SIGAD) from each line of the contact chain file. BR FISA metadata can be identified by specific SIGADs.

SPCMA

There's also a fourth box for SPCMA mode, which stands for the "Special Procedures governing Communications Metadata Analysis" from January 2011. These allow contact chaining and other types of analysis on metadata that have already been collected under EO 12333, regardless of nationality and location (because metadata aren't constitutionally protected).

This means that US person identifiers that were in contact with valid foreign intelligence targets may be used for searching these foreign metadata too.

NSA isn't allowed to collect US data overseas, but these do come in "incidentally" when for example foreigners communicate with Americans - precisely the kind of communications that could reveal conspirators inside the US. Many international phone calls from or to the US, will likely be intercepted by NSA collection facilities abroad too.


In other words:

- By default, any contact chaining query will use the foreign metadata collected overseas. For these, any useful selector may be used as a seed, and, under SPCMA, even one that belongs to an American.

- If the seed selector is RAS-approved, then the domestic phone records will be used too, which could lead to the discovery of additional contacts within in the US.

The fact that most contact chains will consist of both foreign and domestic identifiers means that they contain much less American numbers then in calculations like the one from PCLOB, which give the impression that queries resulted in up to 3 hops of domestic numbers.


 


Analysing the contact chains

It should be noted that the phone numbers (or other selectors) which are returned after an initial contact chaining query are anonymous and therefore meaningless. They're just numbers which could belong to anyone: from a pizza delivery to a dangerous conspirator.

So, in order to identify which numbers are of interest for finding unknown suspects, additional analysis is needed - a comprehensive GCHQ book (.pdf) disclosed last week calls contact chaining the start of a "painstaking process of assembling information about a terrorist cell or network".


Analytic tools

In the early years of the President's Surveillance Program (PSP), only the SIGINT Navigator (SIGNAV) tool was available to view the output of the MAINWAY contact chaining system. Later, new tools were created to improve efficiency and to obtain the most complete results, they were designed to use phone records collected both domestically and overseas.

According to the 2009 BR FISA review, there were 19 different analytic tools used for analysing both the raw metadata as well as the results of contact chaining. The glossary of the review lists following tools, unfortunately with their codenames redacted:




Combining multiple contact chains

In 2006, a "high-level Bush Administration intelligence official"told Seymour Hersh that analysts could for example look whether any number that is two or three hops away from the seed number is also in direct contact with that original suspect number. That sounds smart, but in that case, that number which is two or three hops away is simply a first-hop contact.

Finding suspects just by looking at connections between anonymous numbers could work however when several contact chains (from related suspect seed numbers for example) are combined: then a number that appears to be in contact with seed #1 and also with seed #2, would be suspicious, as it apparently belongs to someone known by both initial suspects.

This approach was seen in the CBS television program 60 Minutes from December 15, 2013, in which an NSA employee gave a demonstration of how metadata contact chaining works. He used a tool for foreign collection under EO 12333, resulting in some contact chains of almost fully masked phone numbers from Somalia. Clearly visible are numbers that different targets had in common:



Detailed call record analysis

Besides analysing the breadth of the contact chains, each contact between two phone numbers can also be analysed in depth. For this, the analytic software provides analysts access to the complete calling records associated with all the phone calls from a contact chain.

Such a record, as provided by the telecoms, includes the calling and the called number, a calling-card number, the IMEI number of a mobile handset and the IMSI number of a SIM card, as well as the date and time of the call, its duration and technical information about how the call was routed through the telephone networks.

This provides analysts with information like which number initiated the call, the day and time the call was made, and how long it lasted. And although the domestic phone records may not contain cell phone location data, the area code and prefix of a landline telephone number, as well as the trunk identifier for mobile networks, still indicate the area where a particular phone was located.

As described in the previous article, these data weren't derived from the MAINWAY system, but from a second database which holds "individual BR FISA metadata call records for access by authorized Homeland Security Analysis Center (HSAC) and data integrity analysts to view detailed information about specific telephony calling events".


Searching the second database

This database of calling records also enables analysts to subject these records "to other analytic methods or techniques besides querying", like for example searching them "using numbers, words, or symbols that uniquely identify a particular caller or device", or using "selection terms that are not uniquely associated with any particular caller or device" - according to the PCLOB report.

So, when analysing one or more contact chains resulted in finding several suspicious phone numbers, analysts can then use those numbers for querying the second database in order to see whether these numbers also appear in phone records that were not included in their initial contact chains.

And it also seems possible to query for example a trunk identifier to discover other phones from the same region. These kind of searches can therefore provide potential connections that could not have been found by conducting a direct contact chaining query.


Some numbers

In a Department of Justice report (.pdf) from 2006 it's said that NSA "estimated that only a tiny fraction (0,000025% or one in four million) of the call-detail records [...] were expected to be analyzed". This would mean that of the 1,8 billion domestic phone records provided daily by AT&T, just 450 would be used for analysis.

So in a year, the records (not the content) of roughly 230.000 individual calls from the domestic metadata collection could have been used for analysis in addition to contact chaining.



Foreign call records

As we have seen, a contact chaining query on Section 215 telephone metadata will generally result in both foreign and domestic numbers. Analysts will therefore not only like to analyze the associated call records from the domestic collection, but also those from foreign collection conducted abroad.

These foreign phone records could be retrieved from the known metadata repositories like ASSOCIATION (for mobile calls) and BANYAN (for landline calls), or from a single foreign "SIGINT" database, as is suggested by an NSA memorandum from 2009.


Enrichment

Analyzing the detailed call records will still not provide names or other information that allows the identification of the people to which the numbers from a contact chain belong. For that, the phone numbers have to be correlated ("enriched") with other kinds of information.

The easiest way is probably to combine them with target watch lists to see if the contact chains contain phone numbers that belong to already known targets. This is demonstrated in the following video, which shows contact chain analysis using Sentinel Visualizer, which is a commercially available program for this purpose:





Telephone identifiers found through contact chaining and subsequent analysis can of course also be correlated with internet metadata. NSA does not collect domestic internet metadata anymore, but its collection abroad results in over 10 billion internet metadata a day being stored in the MARINA database.

The metadata from contact chains can also be enriched with data from for example GPS and TomTom, billing records and bank transactions, passenger manifests, voter registration rolls, property records and unspecified tax data - for both Americans and foreigners, according to a New York Times report, but in which NSA denies using this for the domestic metadata collected under Section 215.


SYNAPSE Data Model

With all this, analysts can build extensive social network graphs (or "community of interest" profiles) using 164 different relationship types like "travelsWith, hasFather, sentForumMessage, employs". It seems that this refers to the SYNAPSE Data Model, for which internal NSA relationships are shown in the following diagram that was published by The New York Times too:



Apparently also based upon this data model is SYNAPSE Workbench, which seems to be the "next generation metadata analysis graphical user interface (GUI)" described in the 2009 BR FISA review. SYNAPSE Workbench is apparently capable of fusing metadata from multiple sources and is also enabled for SPCMA searches.


Further action

When all this makes an analyst to believe that a certain telephone identifier belongs to someone who is of interest but wasn't yet known or identified, the following actions can be taken:

⇨ Is the identifier American and of counterterrorism value, then it can be passed on to the FBI for further intelligence or criminal investigation. From 2006-2009, NSA provided the FBI (and other intelligence agencies) a total of 277 reports containing 2883 telephone identifiers.

⇨ Is the identifier foreign, then NSA can use it as a selector to retrieve the content of associated communications that might be already in its databases. It can also be entered into the NSA collection system in order to pull in the content of any future communications of the target systematically.

In case the identifier of the yet unknown suspect is foreign, the analyst might have found out a name through the various enrichment correlations, but if not, this can also be achieved by listening into the content of associated phone calls or additional Human Intelligence (HUMINT) methods.


 

Conclusion

As we have seen, the domestic phone records collected by NSA under Section 215 are used for contact chaining that combines both domestic and foreign identifiers. NSA never explicitly explained this, probably because they didn't want to draw attention to their foreign metadata collection and analysis efforts. But it did became clear from the many documents about the Section 215 program that were declassified by the US government.

These documents made clear that NSA rarely went to 3 hops of contact chaining, which is contrary to what most people, including the Privacy and Civil Liberties Oversight Board (PCLOB) assumed. Because of the federated queries, the resulting contact chains were made up of both domestic and foreign identifiers, which means contact chaining under the Section 215 program involved far less American phone numbers than often presumed.

The documents also show that contact chaining for finding yet unknown conspirators isn't as easy as it may appear. It's not that one enters a phone numbers and the software provides a list of suspects. Data retrieved through the contact chains have to be analysed and correlated with other data sets in order to find out which numbers could matter. It still depends on experience, analysis and eventually even guessing which data and which numbers might be worth a closer investigation.

How successful this contact chaining and subsequent analysis is, is difficult to say. The PCLOB report judged that there was "no instance in which the [Section 215] program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack" - but it's also possible that there were just no such conspirators.

The PCLOB report noticed that analysing the domestic telephone metadata did provide some value "by offering additional leads regarding the contacts of terrorism suspects already known to investigators, and by demonstrating that foreign terrorist plots do not have a U.S. nexus" - although useful, this seems a rather meager result of what for sure required lots of work.



Links and Sources
- EmptyWheel.net: Federated Queries and EO 12333 FISC Workaround (2013) - What We Know about the Section 215 Phone Dragnet and Location Data (2016)
- PCLOB: Report on the Telephone Records Program Conducted under Section 215 of the USA PATRIOT Act (pdf) (2014)
- Cryptome.org: NSA FISA Business Records Offer a Lot to Learn (2013)
- Huffingtonpost.com: The NSA's Telephone Meta-data Program: Part I (2013)
- US Administration White Paper: Bulk Collection of Telephony Metadata under Section 215 of the USA PATRIOT Act (pdf) (2013)
- The New Yorker: What the N.S.A. Wants to Know About Your Phone Calls (2013)
- NSA: Business Records FISA NSA Review (.pdf) (2009)

For the second time we have an article written in cooperation with the French weblog about intelligence and defence Zone d'Intérêt:


Introduction

Over the last year, The French parliament passed new laws granting additional powers to intelligence services regarding interception of communications and data requests. This is part of a broader reform aimed at creating a legal framework for intelligence practices which were not formally authorized by law before 2015. In the press, it was said that these laws allowed sweeping new surveillance powers, legalizing highly intrusive methods without guarantees for individual freedom and privacy.

This article will focus on the provisions related to communications intelligence (COMINT), including targeted telephone tapping (lawful interception or LI), metadata collection and data requests to internet service providers (ISPs). Targeted interception of the content of internet communications is not regulated by these new laws, but only by older decrees which are still a bit unclear. The new laws are only about collection the metadata of internet communications.

In France, communications interception is authorized under two distinct frameworks:

- Judicial interceptions ordered by a judge of inquiry (juge d'instruction) during a criminal investigation. These interceptions can be done by the police, the gendarmerie (a military force charged with police duties) and by the security service DGSI.

- Administrative interceptions, also known as security interceptions, which are requested by both the domestic security and the foreign intelligence services.

Administrative interceptions are approved by the Prime Minister for various motives, such as defending and supporting major national interests including national defense, foreign policy interests, economical and industrial interests, or preventing terrorism and organized crime. Whereas the Unites States strongly denies conducting commercial espionage in the sense of stealing trade secrets for the benefit of individual companies, France is known for being less strict on this.




The main French security and intelligence services are:

Direction Générale de la Sécurité Intérieure (DGSI), which reports to the Interior Ministry and is responsible for domestic security. It has some 3500 employees and an annual budget of 300 million euros. DGSI was formed in 2008 through the merger of the Direction Centrale des Renseignements Généraux (RG) and the Direction de la Surveillance du Territoire (DST) of the French National Police.

Direction Générale de la Sécurité Extérieure (DGSE), which reports to the Minister of Defence and is responsible for collecting foreign intelligence on civilian issues and also performs paramilitary and counterintelligence operations abroad. DGSE is responsible for both HUMINT and SIGINT.

Direction du Renseignement Militaire (DRM), which reports directly to the Chief of Staff and to the President of France as supreme commander of the French military. DRM is responsible for collecting military intelligence in support of the French armed forces.

Direction de la Protection et de la Sécurité de la Défense (DPSD), which is also part of the Ministry of Defence. DPSD is responsible for the security of information, personnel, material and facilities of the armed forces as well as the defence industry.

A special advisory commission on intelligence activities

The French laws, such as Loi n° 2015-912 and Loi n° 2015-1556, from July and November 2015, grant the Prime Minister full authority to order and approve intelligence activities both domestic and foreign. Each collection request is sent by the intelligence service director to its parent ministry and to the Prime Minister, who gives final approval. An advisory commission known as the CNCTR (Commission Nationale de Contrôle des Techniques de Renseignement, or National Commission for the Control of Intelligence Techniques) is kept informed of all requests for oversight purposes.

In most cases, before the Prime Minister can approve a request, this control commission must receive information related to its approval, including the request justification, the identity and location of the targeted individual, or any other identifying information (occupation, username, etc.) when his identity is unknown.

The CNCTR consists of nine members: four from the Parliament, two from the Council of State, two from the Court of Cassation, and one appointed telecommunications expert. This commission is considered an "Independent administrative authority": it is neither part of the Parliament even though members of Parliament are among its members, nor part of the judicial branch, even though some its members are magistrates.

The CNCTR only holds advisory power as it can not stop any decision from the Prime Minister regarding data requests or intelligence collection. The commission can express disapproval of a collection request, but the Prime Minister can overrule this advice and still authorize intelligence collection.

The CNCTR can access all transcripts and logs from intelligence collected under the Prime Minister's authority, but it can not compel any intelligence service for documents or information, and it can not investigate any irregularity on its own. However, it can express recommendations regarding intelligence procedures and bring any irregularity to the Council of State. All debates inside the commission, as well as all its communications with the Prime Minister and intelligence services are classified.

A special status has been granted to journalists, lawyers and members of parliament, as when intelligence requests apply to them, the CNCTR must be informed just before collection starts so it can state whether the collection is necessary and proportionate. The CNCTR must also receive transcripts of the intercepted communications afterwards. The difference with regard to eavesdropping operations against regular citizens is that for them, CNCTR can access the transcripts if it asks for them, while for the privileged professions, CNCTR must receive and review them.

In theory, any individual living in France or abroad can ask the CNCTR to check if he has been placed under surveillance following proper procedure. The control commission must check for any irregularity, but can neither confirm nor deny to the individual that he has been placed under such surveillance. The commission only states that proper verification has been made, and if any irregularity is detected it can report it to the Council of State.




New provisions for domestic intelligence collection

This section applies to all main intelligence services such as DGSI, DGSE and DRM. DGSE is a foreign intelligence service, which is not supposed to operate on French territory, but it is authorized to request data and intercept domestic communications. DGSE holds most technical capabilities for decryption and high-end communications collection and provides other agencies, such as DGSI or DRM, with technical means and expertise in this regard.

A recent decree provided authority to more than twenty police and gendarmerie services, some of which are not officially intelligence services, to intercept communications and request data, mostly for counterterrorism purposes. Allowing police services to collect communication intelligence is a shift from older French habits, which the French government justified by the ongoing terrorist threat.

As in most countries, French law provides higher privacy protection to its own citizens and to people communicating from France than to people communicating from abroad, who receive little legal protection against intelligence collection. Intelligence collection under the Prime Minister approval may apply to all electronic means of communication traced to a targeted individual, from mobile phones to landlines, to all metadata from his internet service provider, and even metadata from online services.

In France, telephone companies, ISPs and online services providers can be compelled to provide a wide range of metadata regarding a targeted user, including: technical data related to the identification of connection or subscription numbers (phone numbers, IP adresses, etc.), a list of all connection or subscription numbers linked to a targeted individual, location data of all devices traced to a targeted individual, and call detail records (CDR).

Under the Prime Minister’s authority, telephone companies can be compelled to cooperate with intelligence services conducting targeted phone calls interceptions. French intelligence services are not supposed to proceed to interceptions on their own, but have to go through a dedicated government technical agency called GIC (Groupement Interministériel de Contrôle or Interministerial Control Group).

The GIC operates under the Prime Minister direct authority, receiving approved requests and ordering telephone companies and ISPs to provide information or access to their networks for interception. Providers compelled to cooperate are forbidden to reveal any information related to interceptions or data requests, or to inform their users they have been targeted. Providers personnel refusing to cooperate could be sentenced to a 150,000 € fine and up to two years of imprisonment.

The parliament recently authorized intelligence services to use devices such as IMSI-catchers to identify and locate mobile phones or computers linked to targeted individuals. Intelligence services can only use IMSI-catchers to collect metadata, and all collected data unrelated to specified targets must be destroyed.

Regarding domestic communications, voice communication recordings must be destroyed 30 days after collection, but transcripts can be kept "as long as necessary" by intelligence services. Metadata requested from ISPs and Telcos can be stored up to 4 years. Intercepted communications that are encrypted can be stored up to 6 years.




A loose framework for the surveillance of foreign communications

Fewer restrictions apply to the surveillance of foreign communications, whether collected by the domestic security service DGSI, the foreign intelligence service DGSE or one of the military agencies.

The Prime Minister issues broad authorizations to intelligence services to monitor and collect communications, either for whole geographical regions, countries, organizations or individuals. The Prime Minister specifies which types of communication networks can be targeted for collection. These authorizations last for 4 months, but they can be renewed without restriction.

Foreign intercepted communications can be kept for 1 year after processing, or up to 4 years after collection. Collected metadata can be stored for 6 years. Encrypted data can be stored for up to 6 years after decryption, or up to 8 years after it has been collected. With these retention periods, the French law is more strict than for example American law, which allows NSA to store encrypted data for an unlimited period of time.


From French territory

The law on surveillance of foreign communications only applies to communications between users who are outside of France, but which are collected from French territory. Here it should be noted that many former French colonies spread around the globe are also considered part of French territory, and French law applies there, especially as this is stated in the latest intelligence laws.

This means that these laws not only apply to data collected from major fiber-optic cables and satellite intercept stations inside France, but also to those from the overseas satellite stations like those in French Guyana, on the island of New Caledonia in the South Pacific and on Mayotte in the Indian Ocean - providing French intelligence with a global SATCOM coverage probably second only to that of the Five Eyes partnership. After ECHELON, this French network was dubbed FRENCHELON.

If data is collected under the foreign communications status, but is then traced back to domestic communications (call number or subscription located in France), it can be processed only if approved under the domestic communications framework, or it must be destroyed under 6 months.




Outside French territory

Intelligence collection conducted by French intelligence services outside of France is not restricted by law. Because the overseas satellite stations are considered to be on French territory, this situation only applies to for example covert eavesdropping operations in foreign countries, as well as to tactical SIGINT collected through land, sea and airborne platforms during military operations abroad. French armed force are based in countries such as Mali, Gabon, Djibouti and UAE. This will mainly result in communications for military purposes.

While this kind of collection is not regulated by law, it will be limited by the available resources and the specific goals set by the government in the annual PNOR (Plan National d’Orientation du Renseignement or National intelligence orientation plan), a classified document sent to the chiefs of intelligence services and to the parliamentary delegation for intelligence (DPR - Délégation Parlementaire au Renseignement), which only receives a redacted version of this document.




Automated bulk metadata collection

In July 2015, a law introduced a new automated bulk metadata collection system against terrorism. The Prime Minister can order French internet service providers to add specified metadata collection and filtering systems to their networks. He can issue such orders for 2 months, and they can be renewed without restriction. Data collected on ISPs networks can be stored up to 60 days, and would be filtered and processed by government issued algorithms to detect terrorism related threats. If such a threat is detected, the Prime Minister can compel ISPs to identify related users.

The development of threat-detection algorithms, and their so-called "black boxes", should be done under supervision from the CNCTR. However, providing oversight at the hardware and software level could be very tricky and difficult, especially as algorithms would be updated and modified very regularly and it would also require specialized knowledge of such internet filter systems.

The scope and purpose of this metadata provision is largely a mystery. At first sight it may look similar to what NSA did by collecting domestic telephone records in order to find unknown terrorist associates by contact chaining. But if that was the purpose of this French law too, then it would have been much easier to order the ISPs to hand over their metadata in bulk, just like it happened in the US.

Actually, French telecommunications and internet service providers already have to store their customer's metadata for at least one year under the EU data retention directive. Moreover, a French legal decree even requires web hosting companies, like Facebook, Google and Amazon, to store their user data for at least one year and provide it to government authorities at their request. However, these metadata may only be used for targeted investigations, as intelligence services must provide specific requests to ISPs & web hosting companies with either the full name of a target, its user name, IP address or other identifying information.

It seems that installing "black boxes" at ISP networks serves the bulk collection of smaller sets of data: they filter traffic using specific threat-detection algorithms, so they will likely only pull in those metadata that match certain communication patterns and routines, based on digital forensics from counterterrorism investigations. The metadata would then be used to identify the users showing such patterns.

Given the very high data rates of traffic passing internet service providers, such filter systems are very expensive and ISP generally don’t like external systems to be plugged into their networks. That makes it surprising that the orders for installing them are valid for just 2 months, and although they are renewable without any limitations, it’s not clear whether these "black boxes" would be removed from ISPs networks at the end of each order, or if they would only be turned off until further notice.



Cyber defense

Interestingly, filtering internet traffic using threat-detection algorithms sounds very much like detecting and preventing malware and cyber attacks. But maybe except for a case when a terrorists group would conduct cyber attacks, the law precisely states that this "black box" metadata filtering and collection system can only be used to detect terrorist threats. It can not be used for any other purpose, including cybersecurity, counterintelligence or criminal investigations.

Nonetheless, the cyber domain did receive special attention from French lawmakers in the latest regulations on intelligence. All collected intelligence which is related to cyber attacks can be stored indefinitely for technical analysis. In addition, all penalties for computer hacking and cyber-related crimes have been doubled as part of the new Law on Intelligence passed in July 2015. This fits a general shift of intelligence agencies towards "cyber", as for example in the US, cyber threats replaced terrorism as top priority for the intelligence community since 2013.



Links and Sources
- The Guardian: France passes new surveillance law in wake of Charlie Hebdo attack
- Matthew Aid: French SIGINT: Part II
- Overview of French intercept sites: Comment on peut, en trois clics, découvrir la carte des stations d'écoute des espions de la DGSE

The Snowden revelations made people familiar with what NSA calls "selectors": phone numbers, e-mail addresses and a whole range of similar groups of characters that can be used to identify a particular target.

However, very little was revealed about how exactly these selectors are used in order to pick out communications of interest. But meanwhile, declassified documents about NSA, German parliamentary commission hearings and an intelligence oversight report from The Netherlands give some details about that.

It came out that the signals intelligence agencies of these three countries (and likely many other countries too) group all selectors that belong to a certain target into sets called correlations or equations.

Wrapping individual selectors into equations makes sense, as one of the most important requirements for signals intelligence is of course knowing which phone numbers, e-mail addresses etc. a particular target uses, as often they will use many of them and change them regularly.



United States

In two recent postings on this weblog, the NSA's storage and analysis of domestic phone records under the Section 215 (or BR FISA) program was analysed. Information about this program comes almost solely from a large number of documents that have been declassified by the US government.

Among those documents is a BR FISA Review (.pdf) from 2009, in which, probably for the first time, we find the term "correlation". The report says that NSA uses correlated selectors to query the BR FISA metadata. The function of such a set of selectors is described as follows:

"If there was a successful RAS determination made on any one of the selectors in the correlation, all were considered RAS-approved for purpose of the query because they were all associated with the same [target redacted]"

RAS stands for Reasonable Articulable Suspicion, which must be determined for a certain selector, before it can be used to query the domestic telephone metadata. So, when one selector was RAS-approved, the analyst was allowed to also use all other selectors that were correlated to the same target.

This practice of what can be described as "one approved selector approves the whole correlation set" was ended when on February 20, 2009, the Emphatic Access Restriction (EAR) tool was implemented. Since then, each selector has to be individually RAS-approved before it can be used to query the metadata database.

Note that this only applied to selectors used for querying domestic phone records. As we learned from the German situation described below, NSA continued to use correlations for its foreign collection efforts overseas.


Correlation database

According to the BR FISA Review, NSA has a database that holds correlations between selectors of interest and which provides automated correlation results to analysts. So when an analyst wants to know which (other) identifiers a certain target uses to communicate, he can look that up in this database.

The name of this database was redacted, but according to its position in the review's glossary, it starts with A. The correlation database is therefore different from the OCTAVE tasking tool, which is used to activate telephony selectors on the various collection systems. Analysts can therefore decide by themselves which of the correlated selectors they actually want to task.

It's not clear though whether these correlations include both phone and internet selectors, but obviously it's useful to collect and group all kinds of identifiers used by a particular target.




Germany

The way NSA uses correlations immediatly reminds of a practice that was revealed during hearings of the German parliamentary commission that investigates NSA spying practices. On May 20, 2015, BND employee W.O. explained that until 2012, the NSA sent its selectors to BND in the form of a so-called "equation".

According to the witness, an equation was a record that could contain up to one hundred selectors used by or related to a particular target. This large number of selectors is because the equation contains all different ways of spelling and technical encoding permutations of a selector. For one e-mail address this could for example be:

mustermann@internet.org
mustermann%40internet%2Eorg (HTML-Hex)
mustermann\&\#37;2540internet.org (multiple encodings)
mustermann\\U0040internet.org (UTF-16)

The explanation given by witness W.O. of how BND managed these NSA equations was rather confusing, but an important element seemed to be that such a whole set of selectors could be prevented from being activated, when BND rejected just one selector when using it would violate German law or German interests.

Especially for internet identifiers (like chat handles or nicknames) it can be very difficult if not impossible to attribute them to a particular country. But when an equation contains just one identifier that is easier to attribute (like an e-mail address), the whole set of selectors can be either approved or disapproved based upon the identifyable selector.

Witness W.O. contradicted himself on whether an equation contains only internet selectors, or also telephone numbers (with wildcards and blanks), but on September 24, 2015, witness D.B. said that equations were only used NSA internet selectors.


Splitting up

W.O. also explained that until 2012, the NSA sent its selectors in the form of equations. When BND rejected one selector from such an equation set, BND employees in Bad Aibling had to ask NSA to remove that number from their equation, or else the other selectors in that equation were rejected too.

Since 2011, these equations were split up and phone and internet selectors were each put in separate databases, which apparently made it possible to reject individual selectors. Afterwards, the computer system reassembles the selectors into their proper equations again, which can now have for example a rejected phone number alongside an approved e-mail address. But if one of them is disapproved, the whole equation will not be forwarded to the collection system.

This explanation by witness W.O. is rather puzzling because the situation before and after 2011/2012, and before and after splitting up the equations seems to be the same: in both cases all selectors from an equation are rejected when just one of them was disapproved.

It seems therefore that splitting up the equations had another purpose, but that didn't become clear from the commission hearings. The commission members often had difficulties in understanding these technical issues and were then hardly able to ask the witnesses the questions that could bring clarity.

Maybe the splitting up only meant separating telephone and internet selectors, as from the report of a special independent government investigator it did became clear that NSA provided a description or a justification for every single telephone selector, but that justifications for internet selectors weren't available for BND personnel.

Investigation

There's similar confusion about the internal BND investigation into the selectors provided by the NSA. Witness D.B. explained that when in August 2015, Dr. T. investigated suspicious NSA internet selectors, he was not given them in the form of equations, but as separate, individual ones.

Apparently D.B. suggested that this was the reason that Dr. T. found so many selectors that could not be identified: they were separated from correlated ones that could have made them easier to identify. But why separate these selectors when that rips them from elements that attributes them to a certain target and/or a particular country?


BND selectors

What is said before is only about the selectors that were provided by NSA, in order to be tasked on the satellite collection system operated by BND in Bad Aibling. Besides these, BND of course also has its own selectors.

During the hearing from January 28, 2016, witness D.B. was asked whether BND's own selectors were also grouped into equations. D.B. explained that BND doesn't use the term equation, but that in its central tasking database system PBDB, there are multiple selectors for a certain target (with for each selector (German: Telekommunikationsmerkmal or TKM) multiple permutations).





The Netherlands

In the Netherlands, a report (.pdf) from last February by the intelligence oversight commission CTIVD advised the the General Intelligence and Security Service AIVD to consider using some kind of correlations or equations for its bulk collection efforts too.

The report reveals that currently, the AIVD uses a list (Dutch: kenmerkenlijst) containing all selectors, like phone numbers, e-mail addresses and keywords, used for specific operations. For most of these selectors, the list contains a short justification for why it was put on this list, with a reference to an underlying document. Earlier, the commission found that too often, these justifications were too short, not related enough to the target, or even absent.

According to the commission, it would be better when the AIVD would provide a justification for each targeted person or organisation, instead of for every single selector. Often, one target will use multiple phone numbers and e-mail addresses. Grouping them by target and providing a justification for that target would therefore also reduce the length of the list.

This approach is already used by AIVD when it comes to targeted interception.

One of the key players during the Snowden affair was Director of National Intelligence James Clapper. He is responsible for coordinating all 16 American intelligence agencies, a role which is reflected by the number and the types of telephone equipment in his office.

Clapper has six phones, more than for example the director of the NSA, or the Defense Secretary. Here we will take a close look at these telecommunication devices used by the US Director of National Intelligence.


The office of Director of National Intelligence (DNI) was created in 2004, after the 9/11 Commission Report recommended a stronger and separate leadership for the US intelligence community. Before, it was the director of the CIA who acted as Director of Central Intelligence (DCI) in order to coordinate the various intelligence agencies.




The telecommunications equipment used by DNI James Clapper can be seen in a picture from September 17, 2010, which shows his office in the headquarters building of the Office of the Director of National Intelligence (ODNI) at the Liberty Crossing compound near Tyson’s Corner, Virginia, while he was visited by the Australian Minister for Foreign Affairs, Kevin Rudd.

When we take the high resolution version of the picture above, we can see that the displays and buttons of all the phones behind the DNI's desk are blurred by a censor. Apparently there's some rule for that, because from this distance it would be impossible to read anything.




IST-2 phone

The first phone on the left side is an Integrated Services Telephone version 2 (IST-2), which was designed by Raytheon and subsequently manufactured by Telecore, a small company that took over the production of these devices.

The IST is a so called "red phone", which means that it's connected to the Defense Red Switch Network (DRSN). This is the main secure telephone network for military command and control communications and connects all mayor US command centers and many other military facilities.

Like previous red phones made by Electrospace Systems Inc. (ESI), the IST-2 allows to make both secure and non-secure calls through this one single device. The phone itself has no encryption capability: any secure calls are encrypted in bulk before leaving the secure building, enclave or compound.

As part of a military telephone network, the IST-2 also has the distinctive 4 red buttons which are used to select the four levels of a system called Multilevel Precedence and Preemption (MLPP). This allows to make phone calls that get precedence over ones with a lower priority.



VoIP phones

Next, there are three Cisco 7975 unified IP phones, which belong to the most widely used high-end office phones. These phones have no encryption capability, but they can easily be used as part of dedicated and secure Voice-over-IP networks.

The first Cisco phone, next to the IST-2, seems to have a bright green label, indicating that it has to be used for unclassified phone calls. Probably this phone is part of the internal non-secure telephone network of the Office of the Director of National Intelligence (ODNI).

The second Cisco phone, right of the computer screen, has no recognizable label. It can be part of any secure or non-secure telephone network which DNI Clapper needs to have access to. One option could be the National Secure Telephone System (NSTS), which is used by the signals intelligence community (i.e. NSA).


The third Cisco phone has a distinctive bright yellow faceplate instead of the standard silver one. This indicates that it's part of the highly secure Executive Voice over Secure IP-network, which connects the President with senior cabinet members and some other high-level government officials.

This top-level telephone network was set up in 2007-2008. Before, the President was connected to the general military DRSN, but during the attacks of 9/11, this network appeared to be not reliable enough.

It's this bright yellow Cisco phone that shows that the Director of National Intelligence has direct access to the President. As we have seen earlier, even the director of NSA doesn't have this kind of telephone, and therefore lacks a direct line to the President.



STE phones

The last type of telephone we see in Clapper's office are two big black phones called Secure Terminal Equipment (STE). These are made by the American defense contractor L3 Communications and are highly secure devices capable of encrypting calls up to the level of Top Secret/SCI.

STE phones can be used to make secure calls to anyone with a similar or compatible device and there are an estimated 400.000 STE users. STE is the successor of the almost legendary STU-III secure phone system from the late 1980s.

These STE phones can be used for secure communications with everyone working for the US government, the military, its contractors, and also foreign partners who can not be reached through a more select secure telephone network, like the DRSN or the NSTS.



Videoteleconferencing

Besides the six telephones, DNI Clapper also has two videoteleconferencing (VTC) screens behind his desk. In the first picture we saw a white videoconferencing screen at the far right, and another picture, from a different angle, shows another VTC screen standing at the far left side:




Both these VTC screens have a high-definition camera and are made by the Norwegian manufacturer Tandberg. In 2010 this company was bought by Cisco Systems, so their equipment can be safely used for classified US videoconferencing purposes.

Maybe one of the sets in Clapper's office is used for unclassified, and the other for classified videoconferencing, but it's also possible that both are used for secure video connections but at different classification levels.

At least one of the VTC screens will be used for Top Secret/SCI Videoconferencing, which is for users within the intelligence community. From within secured locations (SCI enclaves), this video feed goes over the JWICS-network, which is secured by stream-based Type 1 bulk encryption devices.



Computer

Finally, there's also one computer screen standing in the midst of the telephones. Below is a keyboard and likely there's also a KVM-switch to enable access to multiple physically separated networks through a single "Keyboard, Video and Mouse" set.

For US intelligence officials, such a KVM-switch usually provides access to NIPRNet or DNI-U (Unclassified, for general purposes), SIPRNet (Secret, for military and intelligence purposes) and JWICS (Top Secret/SCI, for intelligence purposes).

Last Monday, the website The Intercept started publishing larger batches of documents from the Snowden trove, so they can now also be examined by the public. It's a new phase after previously documents were generally disclosed as part of journalistic reports, but the number of such publications steadily declined over the last two years.

For how it was to work with the Snowden documents can be learned from an interesting interview with two journalists from the German Magazine Der Spiegel. They not only published a whole range of articles based upon the Top Secret NSA documents, but also a book which is much more informative than that of Glenn Greenwald.

The interview with Marcel Rosenbach and Holger Stark from Der Spiegel, as well as with Svea Eckert from the German broadcaster NDR, was part of the Network Research (Netzwerk Recherche) annual conference, which was held on July 3 and 4, 2015:




Because the interview is fully in German, here's an extensive summary in English, which also looks more closely at a few specific revelations:

- The Snowden documents
- The National Intelligence Priority Framework (NIPF)
- A MONSTERMIND/CYBERCOP presentation
- Eavesdropping on chancellor Merkel
- Some other issues

 

The Snowden documents

Journalists from Der Spiegel were provided with several ten thousand digital documents through the documentary film maker Laura Poitras, who had been in direct contact with Edward Snowden.

According to Holger Stark, it was clear that Snowden had sorted the documents, not very fine-grained, but he had put them in a few folders, according to topics that had his special interest, like operations of the NSA divisions TAO (hacking) and SSO (cable tapping). Rosenberg said that it looked like Snowden selected the documents based upon his concerns regarding civil liberties and that het didn't some "collect it all" scraping.

The journalists tried to search and filter the documents automatically, but a huge number of them had to be read and analysed manually, and read over and over again, in order to understand what was in them and what their importance could be. For that, they also consulted experts for cryptography and network architecture as well as former NSA employees like Binney and Drake (independent intelligence experts were not mentioned).

It was possible to ask Snowden, but not in a regular or easy way, also because he wanted to stay at a distance of the journalistic work. The journalists couldn't tell or estimate how many documents Snowden actually took. Der Spiegel got the documents unredacted but in the documents that were published, editors redacted most of the names.

Der Spiegel frequently asked NSA to review the documents they wanted to publish, in order to prevent that lives could become in danger. Sometimes NSA asked to remove things, but when it was obvious that that was for political reasons, the request was ignored. But in a few other cases Der Spiegel didn't publish or partly redacted the documents.


BOUNDLESSINFORMANT

Despite all their efforts, there were still many gaps and questions. This resulted in for example a wrong interpretation of NSA's data visualisation tool BOUNDLESSINFORMANT. In August 2013, Der Spiegel published charts from this tool that were initially interpreted as showing how many data NSA collected from several European countries. Soon, BND and NSA denied this and explained that the charts show data that European agencies provided to the Americans.

Holger Stark admitted that their initial interpretation was apparently not correct, but that there are still many questions about this issue. One of the difficulties was that NSA and US government were not willing to respond to questions about this program, so they decided to publish their best guess. Rosenbach added that major foreign papers also shared their initial interpretation (maybe because the wrong interpretation came from Greenwald?).



 

The National Intelligence Priority Framework (NIPF)

One document that wasn't published, but only reported about is the National Intelligence Priority Framework (NIPF), which contains the priorities for the US intelligence community as set by the White House. During the interview a part of the original NIPF document was shown for the first time:




The NIPF consists of a large matrix with each cell indicating the intersection between a state or non-state actor and an intelligence topic. A readable reconstruction of the NIPF based upon this new piece and earlier sources, can be found here (pdf).

Over time, Rosenbach and Stark learned to interpret the Snowden documents by combining information from multiple documents. A separate document, an internal NSA newsletter from December 2009, for example provided additional information about the priorities of the NIPF chart:




This newsletter says that updated versions of the NIPF are released about twice a year, and that these are run against the National SIGINT Requirements Process (NSRP), which sets the priorities for acquiring Signals Intelligence (SIGINT). The 5 levels of NIPF priorities are then translated (by the SIGINT Committee or SIGCOM) to the 9 levels of SIGINT priorities, based upon the importance of the SIGINT contribution.

The first NIPF was issued in 2003 and at that time the matrix contained over 2300 cells! There were hundreds of issues with priority 1 and 2, way too many to be managable. So over the years the number of priorities, particularly the numbers of priority 1s and 2s had been reduced.

According to the journalists, the newsletter also explains that topics with priority 1 and 2 are meant for the president and the White House, while priority 3 is for cabinet ministers, the Chiefs of Staff and the Pentagon. For these highest priorities, covert intelligence methods are used. For priorities 4 and 5 open sources may be sufficient and their results are mainly used for political analysis.

For the Spiegel journalists this bureaucratic process illustrates that NSA isn't an agency that went rogue, but that they are directed by the political information needs from the White House (something that was usually conveniently ignored).

  

A MONSTERMIND/CYBERCOP presentation

Svea Eckert, a documentary maker for the regional German broadcasster NDR, was also present at the interview, and she had brought with her the laptop they had used for working with the Snowden documents. The computer was newly bought for this purpose and was never connected to the internet.

At NDR, Eckert was doing research for a documentary about the internet as a battle space, when a colleague of her in the US was provided with a thumb drive containing Snowden documents that had been selected on their relevance for the topic of the documentary. It wasn't told who the middlemen for these documents were, and apparently different German news media got documents from different sources.

The source had said that for these documents only the external TAILS operating system should be used. The same system was used by other people who worked with Snowden documents, like Laura Poitras, Glenn Greenwald, and Barton Gellman. On the dedicated laptop, Eckert showed an example of what these documents look like:




In the window we see for example an internal NSA newsletter with an interview with a hacker from NSA's TAO division, a Cyber Warfare Lexicon and a powerpoint presentation. The latter has the filename "MONSTERMIND_presentation (copy).pptx", but when it was opened, it actually had the cover term CYBERCOP on the front slide and it was prepared by the "CyberCOP Product Manager".

Eckert explained that although most of these documents were very interesting, not everything was newsworthy enough or in the public interest to publish. Also the opinions of various experts had to be asked, because journalists were not always able to judge what the context or the importance of particular pieces of information was.


CYBERCOP

The CYBERCOP presentation is from April 11, 2013 and contains several screenshots of a graphical user interface in which NSA analysts can see where cyber attacks occur. The map part seems very similar to a well-known flashy visualisation on the website of the Norwegian cyber security company Norse:




It was decided not to publish the full MONSTERMIND/CYBERCOP presentation, but the documentary Schlachtfeld Internet ("Battlefield Internet") did contain several slides, which showed that NSA is apparently powerful enough to trace such attacks and that therefore the agency must be present at numerous points on the internet. This was considered newsworthy enough to report about.

In the documentary itself it was explained that an analysis tool called CYBERCOP makes it possible for NSA to monitor "cyber war" in real time. The presentation described at least one specific attack: on April 10, 2012, the US federal banking system in New York was succesfully attacked by Iran, not directly, but through thousands of computers around the world, controlled through internet servers in Germany.

Broadcaster NDR published three slides of the CYBERCOP presentation here (pdf). Two of them show the CYBERCOP interface in a high resolution:



MONSTERMIND

The MONSTERMIND system was first disclosed in a very long interview that James Bamford had with Edward Snowden in August 2014. There, Snowden said that MONSTERMIND is a frightening program that automated "the process of hunting for the beginnings of a foreign cyberattack".

It could also automatically prevent attacks from entering the country, but its unique capability is that "instead of simply detecting and killing the malware at the point of entry, MonsterMind would automatically fire back, with no human involvement" - with the risk of hitting the wrong one, as Snowden warned.

The "killing" capability was also described in Eckert's documentary, but without mentioning the codename MONSTERMIND. It didn't became clear whether this just came from Snowden's recollection or that it's mentioned in the CYBERCOP presentation (or other documents).

 

Eavesdropping on chancellor Merkel

The journalists from Der Spiegel also found interesting things purely by accident. The cache of documents for example contained an NSA presentation from the Center for Content Extraction (CCE, unit designator T1221) about a system to automatically sort out interesting and useful parts of intercepted phone calls.

One slide of this presentation shows an example list of some chiefs of state (cos), among which German chancellor Angela Merkel was listed. The presentation was not about actual interception operations, but did provide an indication that Merkel had been a target:



Der Spiegel published this slide on March 29, 2014 and the full presentation (pdf) was released online in June 2014. That chancellor Merkel had been a target of NSA had already been revealed in October 2013, based upon a database entry that allegedly did not came from the Snowden documents, but from another and yet unidentified second source.

So far, it seems that this example from the chiefs-of-state list is the only confirmation of NSA's targeting of chancellor Merkel that came from the Snowden documents. The intercepted content published by Wikileaks is also supposed to be from the second source.

 

Some other issues

During and after the interview, Stark, Rosenbach and Eckert were also asked about various aspects of working with Snowden Documents:

- Contrary to some claims made by the US government, there seemed to be little danger that these documents could endanger the lives of operatives or other people. The work that NSA does is highly technical and therefore the documents hardly contain any names. Most of the names they do contain are of authors, not of operative field agents.

- Eckert found it disappointing that the documents had almost no code or malware signatures in them, which could have been useful to identify hacking operations conducted by the NSA (Eckert said the XKEYSCORE rules were not included in the set she received). Again this was because the documents were often for management and training purposes and contained information on a meta level instead of actual operational details.

- The journalists were aware of the fact that these presentations had to be judged according to their intended purpose and audience and that the audio of these presentations was of course absent, although some presentations came with speaker's notes, which proved to be useful. Important was also to that presentations will often have presented things in a positive way.

Finally, when asked about the future of the Snowden documents, the journalists thought that it could be good to make them available for scientific research, but that it's not up to them to decide. They were not in favor of making all the documents publicly available, like in the way Wikileaks used to do.

Earlier this month, the NSA declassified a huge set of internal e-mails, following FOIA-requests about the issue of whether Edward Snowden had raised concerns about the NSA's surveillance programs through proper channels inside the agency.


Here, we will take a look at the administrative details these internal NSA e-mails provide. Next time we will see what their content says about the concerns that Snowden claimed to have raised.




E-mail addresses

Except from the classification markings, the NSA's internal e-mails aren't very different from those exchanged by most other people around the world. But they do show for example some details about the internal communications networks of the agency.

From the signature blocks underneath the e-mails we learn that, depending on their function and tasks, NSA employees have e-mail addresses for one or more of the following four computer networks:

- NSANet for messages classified up to Top Secret/SCI (Five Eyes signals intelligence). On this network the address format for e-mail is jjdoe@nsa

- JWICS for messages classified up to Top Secret/SCI (US intelligence). The address format is jjdoe@nsa.ic.gov

- SIPRNET for messages classified up to Secret (mainly US military). The address format is jjdoe@nsa.smil.mil

- UNCL for unclassified messages, likely through NIPRNet. The address format is jjdoe@nsa.gov


For e-mail, all NSA employees have display names in a standardized format: first comes their family name, given name and middle initial, sometimes followed by "Jr" or a high military rank. Then follows "NSA" and the proper organizational designator, then "USA" for their nationality and finally "CIV" for civilian employees, "CTR" for contractors, "USN" for Navy, "USA" for Army or "USAF" for Air Force members.

Thus, the display name of the current NSA director is "Rogers Michael S ADM NSA-D USA USN", while that of the previous director was "Alexander Keith B GEN NSA-D USA USA". In 2012, Snowden had the display name "Snowden Edward J NSA-FHX4 USA CTR":




The organizational designator FHX4 is interesting. FH stands for Field station Hawaii, but X4, being unit 4 of division X, is still a mystery. The field station divisions have the same designators as those at NSA headquarters, where there's also a division X, but so far no document gave an indication what it does.

The signature block shows that Snowden worked as a systems administrator for Dell's Advanced Solutions Group and that he was deployed at the Technology Department of NSA's Cryptologic Center in Hawaii, more specifically at the Office of Information Sharing. The latter has the organizational designator (F)HT322 and is therefore different from that in Snowden's display name.



In the declassified messages we only see display names, not the actual e-mail addresses behind them. Therefore, only the classification markings on the messages provide an indication on which network they were exchanged.

From an e-mail that was declassified earlier we know that in April 2013 Snowden used the address "ejsnowd@nsa.ic.gov", which is the format for the JWICS network, but was apparently used on NSANet.*

From one of the declassified e-mails about NSA's internal investigation it seems that Snowden had just two mail accounts: "we have his TS [Top Secret] NSANet email and his UNCLASSIFIED NSA.gov email", but this is followed by some redacted lines.*

Finally, the signature blocks of some NSA employees also provide a link to their dropbox for sending them files that may be too large for e-mail. Such dropboxes have addresses like "http://urn.nsa.ic.gov/dropbox/[...]".




Telephone numbers

Besides e-mail addresses, many messages also have phone numbers in the signature blocks. They show numbers for one or more of the telephone systems used at NSA:

- NSTS, which stands for National Secure Telephone System and is NSA's internal telephone network for secure calls. Numbers for this network have the format 969-8765 and are often marked with "(s)" for "secure"

- STE, which stands for Secure Terminal Equipment, being a telephone device capable of encrypting phone calls on its own. Telephone numbers can be written in the format (301) 234-5678 or as STE 9876.

- BLACK, CMCL or Commercial, which are numbers for non-secure telephones that may also access the public telephone network. They have the regular format (301) 234-5678 and are often marked with "(b)" for "black" (as opposed to "red") or with "(u)" for unclassified.




TIKICUBE

Finally, releasing such a huge set of documents in which many parts had to be redacted always bears the risk that something is overlooked. That also happened this time, as in one e-mail from an investigator from NSA's Counterintelligence Investigations unit Q311 they forgot to redact the codeword TIKICUBE:




TIKICUBE appears to be a unit of the Investigations Division Q3. Whether this might be a special unit investigating the Snowden leak isn't clear though.

The abbreviations behind the investigators name are: CFE for Certified Fraud Examiner and CISSP for Certified Information Systems Security Professional.

We also see that this investigation division is not located at the NSA headquarters complex at Fort Meade, but at FANX. This stands for Friendship Annex, a complex of NSA office buildings in Linthicum, near Baltimore, some 12 km. or 7.5 miles north-east of Fort Meade.

The famous blue-black glass headquarters buildings are OPS 2A and OPS 2B, while the SIGINT division is apparently in the flat 3-story building from the late 1950s, designated OPS 1.

Earlier this week, a group or an individual called the Shadow Brokers published a large set of files containing the computer code for hacking tools. They were said to be from the Equation Group, which is considered part of the NSA's hacking division TAO.

The leak got quite some media attention, but so far it was not related to some earlier leaks of highly sensitive NSA documents. These show interesting similarities with the Shadow Brokers files, which were also not attributed to Edward Snowden, but seem to come from an unknown second source.




The Shadow Brokers files

Since August 13, Shadow Brokers posted a manifesto and two large encrypted files on Pastebin, on GitHub, on Tumblr and on DropBox (all of them closed or deleted meanwhile).

One of the encrypted files could be decrypted into a 301 MB archive containing a large number of computer codes for server side utility scripts and exploits for a variety of targets like firewalls from Cisco, Juniper, Fortinet and TOPSEC. The files also include different versions of several implants and instructions on how to use them, so they're not just the malware that could have been found on the internet, but also files that were only used internally.

A full and detailed list of the exploits in this archive can be found here.

Security experts as well as former NSA employees considered the files to be authentic, and earlier today the website The Intercept came with some unpublished Snowden documents that confirm the Shadow Brokers files are real.

Besides the accessible archive, Shadow Brokers also posted a file that is still encrypted, and for which the key would only be provided to the highest bidder in an auction. Would the auction raise 1 million bitcoins (more than 500 million US dollars), then Shadow Brokers said they would release more files to the public. This auction however is likely just meant to attract attention.




From the Snowden documents?

According to security experts Bruce Schneier and Nicholas Weaver the new files aren't from the Snowden trove. Like most people, they apparently assume that Snowden took mostly powerpoint presentations and internal reports and newsletters, but that's not the whole picture. The Snowden documents also include various kinds of operational data, but this rarely became public.

Most notable was a large set of raw communications content collected by NSA under FISA and FAA authority, which also included incidentally collected data from Americans, as was reported by The Washington Post on July 5, 2014. The Snowden documents also include technical reports, which are often very difficult to understand and rarely provide a newsworthy story on their own.

Someone reminded me as well that in January 2015, the German magazine Der Spiegel published the full computer code of a keylogger implant codenamed QWERTY, which was a component of the NSA's WARRIORPRIDE malware framework. So with the Snowden trove containing this one piece of computer code, there's no reason why it should not contain more.

Contradicting the option that the Shadow Brokers files could come from Snowden is the fact that some of the files have timestamps as late as October 18, 2013, which is five months after Snowden left NSA. Timestamps are easy to modify, but if they are authentic, then these files have to be from another source.


A second source?

This brings us to a number of leaks that occured in recent years and which were also not attributed to Snowden. These leaks involved highly sensitive NSA files and were often more embarrassing than stuff from the Snowden documents - for example the catalog of hacking tools and techniques, the fact that chancellor Merkel was targeted and intelligence reports proving that NSA was actually successful at that.


It is assumed that these and some other documents came from at least one other leaker, a "second source" besides Snowden, which is something that still not many people are aware of. The files that can be attributed to this second source have some interesting similarities with the Shadow Brokers leak. Like the ANT catalog published in December 2013, they are about hacking tools and like the XKEYSCORE rules published in 2014 and 2015 they are internal NSA computer code.

This alone doesn't say much, but it's the choice of the kind of files that makes these leaks look very similar: no fancy presentations, but plain technical data sets that make it possible to identify specific operations and individual targets - the kind of documents many people are most eager to see, but which were rarely provided through the Snowden reporting.

As mainstream media became more cautious in publishing such files, it is possible that someone who also had access to the Snowden cache went rogue and started leaking documents just for harming NSA and the US - without attributing these leaks to Snowden because he would probably not approve them, and also to suggest that more people followed Snowden's example.

Of course the Shadow Brokers leak can still be unrelated to the earlier ones. In that case it could have been that an NSA hacker mistakenly uploaded his whole toolkit to a server outside the NSA's secure networks (also called a "staging server" or "redirector" to mask his true location) and that someone was able to grab the files from there - an option favored by for example Edward Snowden and security researcher the grugq.




An insider?

Meanwhile, several former NSA employees have said that the current Shadow Brokers leak might not be the result of a hack from the outside, but that it's more likely that the files come from an insider, who stole them like Snowden did earlier.

Of course it's easier for an insider to grab these files than for a foreign intelligence agency, let alone an ordinary hacker, to steal them from the outside. But if that's the case, it would mean that this insider would still be able to exfiltrate files from NSA premises (something that shouldn't be possible anymore after Snowden), and that this insider has the intent to embarrass and harm the NSA (Snowden at least said he just wanted to expose serious wrongdoings).

Here we should keep in mind that such an insider is not necessarily just a frustrated individual, but can also be a mole from a hostile foreign intelligence agency.

Update:
On August 21, NSA expert James Bamford also confirmed that TAO's ANT catalog wasn't included in the Snowden documents (Snowden didn't want to talk about it publicly though). Bamford favors the option of a second insider, who may have leaked the documents through Jacob Appelbaum and Julian Assange.

Russian intelligence?

On Twitter, Edward Snowden said that "Circumstantial evidence and conventional wisdom indicates Russian responsibility", but it's not clear what that evidence should be. It seems he sees this leak as a kind of warning from the Russians not to take revenge for the hack of the Democratic National Committee (DNC) e-mails, which was attributed to Russian intelligence.

This was also what led Bruce Schneier to think it might be the Russians, because who other than a state actor would steal so much data and wait three years before publishing? Not mentioned by Schneier is that this also applies to the documents that can be attributed to the second source: they also pre-date June 2013.

A related point of speculation is the text that accompanied the Shadow Brokers files, which is in bad English, as if it was written by a Russian or some other non-western individual. This is probably distraction, as it looks much more like a fluent American/English speaker who tried to imitate unexperienced English.

The text also holds accusations against "Elites", in a style which very much resembles the language used by anarchist hacker groups, but that can also be faked to distract from the real source (it was also noticed that the e-mail address used by Shadow Brokers (userll6gcwaknz@tutanota.com) seems to refer to the manga Code Geass in which an exiled prince takes revenge against the "Britannian Empire").




Conclusion

With the authenticity of the Shadow Brokers files being confirmed, the biggest question is: who leaked them? There's a small chance that it was a stupid accident in which an NSA hacker uploaded his whole toolkit to a non-secure server and someone (Russians?) found it there.

Somewhat more likely seems the option that they came from an insider, and in that case, this leak doesn't stand alone, but fits into a series of leaks in which, since October 2013, highly sensitive NSA data sets were published.

So almost unnoticed by the mainstream media and the general public, someone was piggybacking on the Snowden-revelations with leaks that were often more embarrassing for NSA than many reportings based upon the documents from Snowden.

Again, obtaining such documents through hacking into highly secured NSA servers seems less likely than the chance that someone from inside the agency took them. If that person was Edward Snowden, then probably someone with access to his documents could have started his own crusade against NSA.

If that person wasn't Snowden, then it's either another NSA employee who was disgruntled and frustrated, or a mole for a hostile foreign intelligence agency. But for an individual without the protection of the public opinion like Snowden, it must be much harder and riskier to conduct these leaks than for a foreign state actor.

Former NSA counterintelligence officer John Schindler also thinks there could have been a (Russian) mole, as the agency has a rather bad track record in finding such spies. If this scenario is true, then it would be almost an even bigger scandal than that of the Snowden-leaks.



Links and Sources
- TheWeek.com: How the NSA got hacked
- EmptyWheel.com: Where Are NSA’s Overseers on the Shadow Brokers Release?
- Observer.com: NSA ‘Shadow Brokers’ Hack Shows SpyWar With Kremlin Is Turning Hot
- TechCrunch.com: Everything you need to know about the NSA hack (but were afraid to Google)
- WashingtonPost.com: Powerful NSA hacking tools have been revealed online
- NYTimes.com: ‘Shadow Brokers’ Leak Raises Alarming Question: Was the N.S.A. Hacked?
- LawfareBlog.com: NSA and the No Good, Very Bad Monday

Over the past few years we learned a lot about Germany's foreign intelligence service BND, although not from leaks, but from the public hearings of the parliamentary commission that investigates NSA spying operations and its cooperation with German agencies.

Recently however a secret government report was leaked to German media, which not only identifies violations of the data protection act but also reveals the codenames for several BND systems and the fact that BND uses the American XKEYSCORE system not only for analysis, but also for collection purposes.

Here, the new information from the secret report is combined with things we know from earlier sources and reportings.

- A secret report
- The SUSLAG liaison office
- Selectors provided by NSA
- Operations SMARAGD and ZABBO
- Metadata analysis: VERAS
- Analysis and collection: XKEYSCORE
- Integrated analysis: MIRA 4
- Legal defects

A secret report

The report that now has been published goes back to September 2013, when the then federal data protection commissioner Peter Schaar ordered a thorough inspection of the BND satellite intercept station in Bad Aibling, which took place on December 3 and 4 of that year.

In October 2014, Schaar's successor Andrea Voßhoff conducted a second visit to Bad Aibling, which in July 2015 resulted in an extensive and detailed report (German: Sachstandsbericht) about all the systems used at this BND station. This report was (and still is) classified as Top Secret.

Additionally, Voßhoff made a legal assessment based upon the Sachstandsbericht. This was finished in March 2016 and sent to then BND president Schindler and the federal chancellery. It was classified as Secret, but was leaked to regional broadcasters NDR and WDR and a transcription of the full document was published by the digital rights platform Netzpolitik.org on September 1.

Both reports are about the cooperation between BND and NSA, which goes back to 2004, when the Americans turned their satellite intercept station Bad Aibling (codenamed GARLICK) over to German intelligence. In return, BND had to share the results from its satellite collection with the NSA, for which the latter provided selectors, like e-mail addresses, phone numbers, etc. of the targets they were interested in.




The SUSLAG liaison office

After taking over the Bad Aibling satellite station, BND seems to have moved the control facility to the nearby Mangfall Barracks, which were taken over from the German armed forces (Bundeswehr) in 2002. For the Special US Liaison Activity Germany (SUSLAG), which is the liaison office of NSA for Germany, a new highly secure container building was built on the Mangfall Barracks premises in 2003 (nicknamed "tin can" or Blechdose).

According to the commissioner's report, the SUSLAG building and the building with BND servers and equipment are connected through a 100 MBit/s fiber optic cable. SUSLAG also has a technical data link to the NSA's primary communications hub in Europe, the European Technical Center (ETC) in the Mainz-Kastel district of the city of Wiesbaden.

Cooperation between the US and Germany in the Joint SIGINT Activity (JSA, 2004-2012) took place inside the BND building, for which NSA personnel had access permissions. After the JSA was terminated, SUSLAG personnel kept their entrance rights for the BND building, but it has separate rooms for highly sensitive information to which none of the Americans have access.

A letter from BND from October 15, 2015 says that at that moment, 10 people from NSA worked at SUSLAG, with following access rights:

- 2 have access to building 7 (SUSLAG) only
- 4 have access to building 7 and building 4 (Administration)
- 4 have access to building 7 and building 8 (BND)

The SUSLAG building is only used by NSA personnel and BND claims that the data protection commissioner has no jurisdiction over the SUSLAG, but she disputes that and says the SUSLAG building is simply part of the BND complex. She also regrets that SUSLAG doesn't recognize her oversight authority.




Selectors provided by NSA

For the satellite interception in Bad Aibling, some 4 out of 5 selectors come from NSA, the rest from BND. According to Süddeutsche Zeitung, NSA provided BND with roughly 690.000 phone numbers and 7,8 million internet identifiers between 2002 and 2013. That is an average of something like 60.000 phone numbers and 700.000 internet identifiers a year, or 164 phone numbers and over 1900 internet identifiers each day.

From the parliamentary hearings we already knew that BND personnel pulls the American selectors from an NSA server, and the commissioner's report now reveals that this server is in NSA's ETC in Wiesbaden. On this server BND puts back any results for these selectors. These data transfers from and to ETC go through the SUSLAG facility, but BND is able to get direct access to the NSA server in Wiesbaden through an FTP-gateway (a "BACOM system").

Selector databases

From an earlier parliamentary hearing we know that BND stores the selectors from NSA in two databases: one for IP selectors (from NSA only), and one for telephone selectors (from both NSA and BND). Each agency had access to its own IP database; the phone database was managed jointly, but BND could only approve or disapprove NSA selectors, and NSA could only do so with those from BND.

The names of these databases were not known until now, but the commissioner's report mentions them, along with some additional details:

- Target Number Database (TND), which exists since 2008 and holds the telephone selectors from both NSA and BND. The latter either come from BND's own tasking database PBDB or are provided by domestic security services.

- SCRABBLE, which only holds selectors for packet-switched (internet) communications provided by NSA, after their format has been converted. These selectors initially had no description (Deutung, like a justification for the target). Because of this, BND temporarily stopped using them as of May 2015, and for the commissioner any results from them are unlawful because BND was not able to determine whether they are necessary for its mission.

Their names indicate that these database systems were provided by NSA, and together with the fact that they also contain NSA-provided selectors, this is likely the reason why these names were never mentioned during the parliamentary hearings - unlike those of BND's own systems.

Update: it was noticed that TND and SCRABBLE were actually mentioned once during the parliamentary hearings, when former BND president Schindler said that "the US has [its own] databases TND and SCRABBLE".

Approval

Before being stored in the SCRABBLE and TND databases, both the telephone and internet selectors have to pass the DAFIS filtering system, which checks whether they belong to German citizens or companies or may otherwise contradict German interests. Accordingly, the selectors are marked as "allowed" or "protected".

Those marked "allowed" are subsequently being activated ("tasked") on the actual data collection systems. The report says that for this, hard selectors like phone numbers and e-mail addresses can be freely combined with content search terms (Inhaltssuchbegriffe) like key words, which could refer to the GENESIS language used for more complex XKEYSCORE searches.

According to the report, selectors marked as "protected" are send back to NSA and are also deactivated in the TND and SCRABBLE databases - to make sure that they won't get activated when NSA provides them a second time (this confirms that there's no separate database (Ablehnungsdatei) with rejected selectors as was suggested during the earlier parliamentary commission hearings).

BND refused the data protection commissioner access to TND and SCRABBLE, so she wasn't able to check the individual selectors. She regarded that as a massive restriction of her supervision authority.



Operations SMARAGD and ZABBO

Selectors that have been approved are send to the systems that filter out communications that match those selectors. Some of these systems are in Germany, others are abroad. The report of commissioner Voßhoff for the first time discloses two specific data collection operations and their codewords:

- SMARAGD, a cable tapping operation somewhere outside Europe and in cooperation with another foreign intelligence agency.

- ZABBO, collection in Bad Aibling of satellite communications from Afghanistan.

There's no explanation for why the commissioner only mentions these two operations. The satellite antennas in Bad Aibling undoubtedly collect from many more countries, but maybe these are the only operations from which, during the investigation period, data were shared with NSA.

SMARAGD = WHARPDRIVE ?

The way SMARAGD is described perfectly fits a certain type of operations in which a 3rd Party partner of NSA like in this case BND, cooperates with yet another country that secretly provides access to data traffic, which is then also shared with NSA. According to the book Der NSA Komplex, BND and NSA conducted about half a dozen of such operations in recent years.

In its english version of the news report about this issue, the website Netzpolitik.org points to an NSA document that was published earlier by Der Spiegel. In it, we see EMERALD mentioned as an alternate codename for the NSA operation WHARPDRIVE, which is exactly such a trilateral program in which a third secret service participates.

WHARPDRIVE was still active in 2013, but in the Spring of that year, employees of the private company that operated the communication cables, accidently discovered the clandestine BND/NSA equipment, but the operation was rescued by providing a plausible cover story.*

The NSA report from April 2013 however said that "WHARPDRIVE has been identified for possible termination due to fiscal constraints", but this may have been coincided with the exposure of the program in the book Der NSA Komplex in March 2014.

It should also be noted that Netzpolitik.org came up with this identification by translating the German codename SMARAGD into its English equivalent EMERALD. It is possible that the Americans also translated the German codeword SMARAGD into EMERALD, but just as likely is that it's a different program (maybe as a successor with the same set-up).

Operation Eikonal

But there's another codeword connection: from 2004 till 2008, NSA cooperated with BND in operation EIKONAL in order to get access to fiber optic cables from Deutsche Telekom in Frankfurt.

From the parliamentary hearings we know that operation EIKONAL had GRANAT as its internal BND codename. And with GRANAT being German for garnet, and SMARAGD for emerald, we see that both operations are actually named after a gemstone, which often indicates some kind of similarity.

In October 2014, the Danish paper Information reported that the WHARPDRIVE access was opened in February 2013 and had the same size as EIKANOL. This operation EIKANOL or EIKONAL was a typical example of the way NSA cooperates with 3rd Party partner agencies under its RAMPART-A program, but unlike the SMARAGD/WHARPDRIVE operations with the cable access point being inside Germany:




It is tempting to identify SMARAGD and ZABBO as the two collection programs (SIGADs US-987LA and US-987LB) from the BOUNDLESSINFORMANT chart for Germany that was published in July 2013. For both facilities together, more than 552 million metadata records were counted between December 10, 2012 and January 8, 2013.

Provided that this chart shows the only data shared by BND, it's very well possible that the satellite collection program ZABBO is one of them. For the cable access SMARAGD this is less certain and depends on when this program started and whether it is identical with WHARPDRIVE (which started in February 2013).



Data transfer

The report of the data protection commissioner also provides an impression of the BND networks through which collected data are brought back to headquarters.

Data collected abroad are send back to Germany over the operational network ISNoVPN (apparently something that goes "over VPN" for secure tunneling) and then arrives at a dedicated demilitarized zone (DMZ) network for data collection (Datenabholungs-DMZ).

In this DMZ network there's a virtual machine (VM) that acts as a host for data that come in from each collection facility (Erfassungsansatz). The report mentions the virtual machines "Import VM SMARAGD" and "Import VM ZABBO" for the operations SMARAGD and ZABBO respectively.

In these virtual machines, the metadata go through an Application Level Gateway (ALG), which is a security components combined with a firewall. Such an ALG is able to detect, filter and when necessary, delete data from an incoming data stream. Again, there's an ALG for each collection facility: for example SMARAGD-ALG for data from the SMARAGD collection effort.

Finally, the collected data arrive at a network called NG-Netz, which is the back-end in Bad Aibling of the transfer system that pulls in data collected at a front-end access point (Erfassungskopf) somewhere abroad.




Metadata analysis: VERAS

The system that BND uses for analysing bulk metadata from circuit-switched communications is called VERAS, which stands for Verkehrs-Analyse-System or Traffic Analysis System. VERAS stores metadata only for up to 90 days and according to the commissioner's report they are derived from two sources:

- Metadata that come with communications collected after matching with specific selectors (the related content goes to the INBE database)

- All the metadata from selected communication links (satellite frequencies and fiber optic channels) that are regarded useful for intelligence purposes, but only after passing the DAFIS filter.

According to the manual for VERAS version 4.3.x from 2010, the system has a topology mode, in which connections can be created level after level, similar to the "hops" we know from the NSA's contact chaining method. There's no limitation to the number of levels that can be added and analysts can also focus on specific targets to create patterns-of-life (Bewegungsprofile) for them.

This kind of contact-chaining and metadata analysis inevitably involves metadata from innocent people. BND distinguished between directly and indirectly relevant. Directly relevant are metadata related to people who are already known or suspected for being relevant for intelligence purposes.

Indirectly relevant are metadata related to people who have some kind of connection to directly relevant people, or when such metadata are being stored from a "geographical point of view", which apparently refers to metadata of people being somewhere near a target without having been in direct contact.

The report says that metadata connected on such a geographical basis results in much more people being involved than when using call or connection chaining. Data related to indirectly relevant people are also used by BND, for example as new selectors.

VERAS was introduced in 2002 and recently, VERAS 4 has been replaced by VERAS version 6, which was developed by the German armed forces (Bundeswehr) as part of the VERBA (VERkehrs-Beziehungs-Analyse) project.

For VERAS 6 there's not yet a database establishing order (see below), but in February 2015 BND sent the commissioner a draft version, which she already considers illegal because BND admits that it is technically impossible to prevent that data of innocent people are being used in the VERAS system.



Analysis and collection: XKEYSCORE

Already in July 2013, Der Spiegel reported that BND president Schindler had informed the parliamentary intelligence oversight commission (PKGr) that his agency was using NSA's XKEYSCORE system since 2007, but only for analysis, not for data collection. This was confirmed by W. K., a sub-division manager in the BND's Signals Intelligence division, during a parliamentary hearing.

But now, the report of the data protection commissioner says that BND uses XKEYSCORE not just for analysis, but also for the collection of both metadata and content.

The report explains that in its data collection, or front-end function, XKEYSCORE uses selectors, single ones or freely combined ones in the form of fingerprints, to search for matches in IP traffic of both public and privat networks, and stores anything that matches these selectors.

Remarkably enough, the commissioner writes that XKEYSCORE searches all internet traffic worldwide ("weltweit den gesamten Internetverkehr"), which seems to be a copy/paste from sensationalistic press reports, as XKEYSCORE can only search data which are collected at some physical access points and not even NSA has access to all the world's communications traffic, let alone BND.




Besides picking out and storing communications that match specific selectors, XKEYSCORE is also able to store a so-called "full take", a temporary rolling buffer of all data from a particular link. This in order to find files which aren't directly associated with specific selectors - which was heralded as its unique capability.

The commissioner's report only mentions this buffer function when it cites a BND response calling XKEYSCORE "a local and temporary buffering of data" which in their opinion doesn't make it a database. The commissioner disagrees and says it's a database, because even when it's just for a short time, the data are available for usage. This means a there should have been a database establishing order for XKEYSCORE (see below).

Front-end and back-end

The report doesn't explain what XKEYSCORE actually does in its function as a back-end analysis tool. But maybe instead of distinguishing between collection and analysis, we should look at the difference between the front-end and the back-end functions of the system, which is explained in a manual for its so-called Deepdive version.

This learns us that the back-end performs high-speed filtering and selection using both strong selectors (like e-mail addresses) and soft selectors (like key words), and also uses various plug-ins to extract and index the metadata, which are also used for the rolling buffer-functionality of XKEYSCORE:




The front-end is where the intercepted data streams come in, which are first reassembled by the METTLESOME and xFip components. Then, only the most useful streams are forwarded based upon rules using country codes, keywords and such. Finally, the Defrag component conducts full sessionizing, which means that the separate IP packets that travel over the internet are reassembled into their original readable form again.

The commissioner's report says that initially the sessionizing of data from a particular communications link was conducted by another NSA system codenamed WEALTHYCLUSTER (WC, which is for lower data rates), but that this kind of processing was more and more taken over by XKEYSCORE (XKS).

So, if the distinction between collection and analysing corresponds to that between front-end and back-end, that means that the new thing we learned from the commissioner's report is that BND apparently also uses XKEYSCORE for sessionizing the data they collect, and not only for filtering and analysing them.

This sessionizing might seem rather obvious, but real-time filtering and sessionizing at data rates as high as 10 Mbit/s requires very fast, specialized and expensive equipment. Well-known manufacturers are Narus and Verint, and it seems likely that their equipment is used for XKEYSCORE too.

As XKEYSCORE is only used for internet communications, the NSA selectors are derived from the SCRABBLE database. The results of the collection are transferred to NSA, after having been filtered by DAFIS to get rid of data related to Germans.



Integrated analysis: MIRA 4

Besides all the systems mentioned before, BND also uses MIRA 4, which stands for Modulare Integrierte Ressourcen Architektur or Modular Integrated Ressource Architecture, version 4. According to a letter from BND from Februar 2015, this system is used to store all the content, whether from e-mail, voice, fax or teletype messages, within a certain BND station and apparently also enables software to process and select raw data in order to create intelligence reports (Meldungen).

This was however contradicted by a letter from BND from December 2015 which said that MIRA 4 is only used to store just those Meldungen. The commissioner replied that she would be thankful when BND could clarify this discrepancy.

Apparently not noticed by the commissioner is an NSA report from 2006, which was published by earlier Der Spiegel, and which says that German analytic tool suites like MIRA 4:

"integrate multiple database analytic functions (such as viewing voice and listening to fax [sic]), much like NSA Headquarters has UIS (User Integrated Services). In some ways, these tools have features that surpass US SIGINT capabilities. Among a series of interesting items, NSA analysts noted that BND analysts could seamlessly move from VERAS (call-chaining software) to the associated voice cuts."

Later on, the 2006 NSA report says: "The BND responded positively to NSA's request for a copy of MIRA4 and VERAS software, and made several requests from NSA concerning target and tool development and data".

During a parliamentary hearing in October 2014, BND's own data protection officer Ms. H. F. said that in 2010, MIRA 4 was replaced by INBE as a system that apparently not only stores the content of communications, but also makes it available for analysis.

The 2016 commissioner's report says that data stored in MIRA 4 were not migrated to INBE, when the latter system became operational in 2011. Data in MIRA 4 seem to have been automatically "aged off" after 90 days and the last backup of the system was destroyed in the Summer of 2014.



Legal defects

The purpose of the secret report by federal data protection commissioner Andrea Voßhoff was to determine the legality of the data collection, processing, storing and analysing systems at the BND field station in Bad Aibling. The two main problems she identified are about necessity and the lack of database establishing orders.

Necessity

According to the German data protection law, BND is only allowed to receive, store, process and analyse personal data after checking that they are necessary and relevant for its foreign intelligence mission as authorized by German law. In various cases, especially when it comes to bulk collection of metadata and receiving the selectors from NSA, the agency doesn't or cannot check the necessity for each piece of data. This makes it unlawful for BND to posess and use those data.

The problem behind this is that when such laws were made, there was no awareness of secret services using large sets of metadata, which also includes those of innocent people. Also in this particular case, almost all data collected in Bad Aibling and shared with NSA will be collected from crisis zones like Afghanistan, which makes them more relevant for BND's mission and less likely of containing German communications.

Database establishing orders

Another major legal defect the commissioner found was that for the BND databases VERAS 4, VERAS 6, XKEYSCORE, TND, SCRABBLE, INBE, and DAFIS there was no database establishing order (Dateianordnung) and that they were also set up without prior approval by the commissioner. This makes the existance of these databases unlawful, which means the data they contain should be deleted immediatly until an establishing order is provided.

BND argued that the absence of a database establishing order is just a formal defect and doesn't affect the legal status of a database and its content. The commissioner doesn't agree with that and says that one of the functions of an establishing order is to determine the purpose of a database, which limits and restricts the use of the personal data in it. The lack of such an order also means that there are no rules for when approvals by oversight bodies are required, thus making the use of these databases both unlawful and uncontrolled.

In response

Meanwhile, on September 7, the German interior ministry released a draft for a new data protection act, in which it is proposed that in the future, the data protection commissioner will not have the authority anymore to impose sanctions or fines on the secret services - so restricting the commissioner's authority rather than strenghten it.

Finally, on September 15, Edward Snowden also mentioned the commissioner's report on Twitter, saying that it "confirms mass surveillance". Apparently he didn't read the report, as it is actually about the lack of specific legal restrictions, not about the scope of BND's collection efforts.




Links and Sources
- Rolf Weber: Der geleakte BND-Bericht der BfDI Voßhoff -- wie gewohnt bei näherem Hinsehen wenig skandalträchtig
- Netzpolitik: Secret Report: German Federal Intelligence Service BND Violates Laws And Constitution By The Dozen
- Der Spiegel: NSA-Standorte in Deutschland: Wiesbaden

Earlier this month we learned the name of a second person who stole top secret documents from the US National Security Agency (NSA). After Edward Snowden admitted doing so publicly in June 2013, the FBI has now arrested the 51-year old Harold T. Martin III at his home in Maryland.

Martin hoarded lots of classified documents, not only from NSA but also from a number of other military and intelligence agencies. The FBI is still comparing them with those from the recent Shadow Brokers leak and a range of other NSA leaks from the past few years, but given what's known now, it seems likely that at least one other leaker is still at large.




The New York Times reported that when the FBI raided Martin's house on August 27, they found paper documents and many terabytes of highly classified information, even going back the 1990s. At least six documents were from 2014. It was reported that Martin first took the classified documents on paper, later on CDs and more recently on thumb drives.

The reason why Harold Martin brought home and stored such large numbers of top secret documents isn't yet clarified. One suggestion is that he may have used them for research for his dissertation about "new methods for remote analysis of heterogeneous & cloud computing architectures", which he was working on at the University of Maryland.


Documents from multiple agencies

It should be noted that not everything Martin stole comes from NSA. In the official charges there are no names of the agencies where the documents come from, they are only described as highly classified, including ones that are marked as Top Secret and Sensitive Compartmented Information (SCI).

With the documents going back to the 1990s, he may well have started hoarding them from the places where he worked in those days. From 1987 to 2000, Martin served at the US Navy, achieving the rank of lieutenant, but he left active duty in 1992.

As the Washington Post found out, he then took a variety of tech jobs with government contractors, like at Computer Sciences Corp. (CSC) somewhere in the 1990s and later, until 2009, at Tenacity Solutions, for which he worked at the Office of the Director of National Intelligence (ODNI).

In 2009, Harold Martin started to work for Booz Allen Hamilton, for which he was a contractor at NSA from 2012 to 2015, when Booz transferred him to the Pentagon’s Office of Acquisition, Technology and Logistics (AT&L), which is responsible for often highly sensitive and classified procurement programs. There he stayed until the moment of his arrest last August.

Officials have meanwhile said that Martin took classified documents not only from NSA, but also from his other workplaces, including ODNI and AT&L.

It's interesting as well that in the charges against Martin, a whole paragraph is dedicated to the at least six documents from 2014, which are described as being produced "through sensitive government sources, methods, and capabilities". As signals intelligence is traditionally seen as the most sensitive capability, maybe just these six documents are from NSA.




Shadow Brokers investigation

After the "Shadow Brokers" disclosed a large set of secret NSA hacking tools last August, the FBI began investigating this leak. At the same time there was a lot of speculation: was NSA hacked from the outside? Had an NSA hacker been sloppy? Were the tools leaked by an insider? Maybe the same insider responsible for earlier leaks that hadn't been attributed to Snowden?


On September 22, it was reported that during the FBI investigation, NSA officials had said that a former agency operative had carelessly left the hacking tool files available on a remote computer, where Russian hackers found them. If that's correct, then it seems likely that the FBI traced Harold Martin when they were looking for that careless NSA hacker. It has not yet been confirmed that Martin was that person though.

Harold Martin was working at NSA's hacking division TAO around the time when the tools were considered to be left exposed, somewhere after October 18, 2013, but a former TAO hacker told the Washington Post that Martin "worked in the unit’s front office carrying out support roles such as setting up accounts, not conducting actual operations."

Even if Martin was the man who left the hacking tools exposed, then we still don't know who found them and published them under the name Shadow Brokers. It's not very likely that this was done by Martin himself, as Shadow Brokers published additional messages on August 28, October 1 and October 15, when he was already in custody. The actual publication can therefore be the work of for example Russian, Iranian or North Korean hackers or even independent hacktivists.


Other sources?

Could Harold Martin also be the source of earlier leaks, that were not attributed to Edward Snowden? In theory he could have been that "second source" next to Snowden: none of these other leaked documents (like the TAO catalog, XKEYSCORE code, tasking lists and end reports) are newer than 2015, when Martin left NSA. Contrary to this Martin is described as very patriotic, which doesn't fit the fact that these particular leaks were clearly meant to harm and embarrass the US and NSA.


Also, Martin hasn't (yet) been charged with espionage or the attempt to provide classified information to a third party or a foreign government - which doesn't seem something the US government would leave out or keep secret after the recent and unprecedented statement in which the Office of the Director of National Intelligence accused Russia of hacking the Democratic National Committee (DNC) and other political organizations.

Should the FBI investigation confirm that Harold Martin was only responsible for leaking the NSA hacking tools (after which unknown others published them) and that none of his documents were provided to foreign intelligence agencies or showed up in the earlier revelations, then there's most likely yet another leaker from inside NSA.

The Shadow Brokers leak standing alone and not related to the earlier non-Snowden leaks is of some importance, because only among the stuff published by the Shadow Brokers there are files with a date (October 18, 2013) after the day that Snowden left NSA (May 20, 2013).

This means that when Harold Martin is the initial source of the Shadow Brokers files, we can no longer exclude the possibility that the earlier leaks do come from the Snowden trove. If that would be the case, then someone with access to them went rogue and had them published on his own account. But it should also be noted that both Glenn Greenwald and Bruce Schneier explicitly said that some of these leaked documents did not come from Snowden.

The more likely option is therefore that there's still another leaker at large, someone with a more evil intent than Harold Martin and Edward Snowden - a conclusion which is not very comforting and which also raises questions about NSA's internal security...




NSA's internal security measures

The NSA's hacking division TAO, where Harold Martin worked for some time, is apparently not located in the well-known NSA headquarters building at Fort Meade, but in one or more leased office buildings outside, one of them at an office complex called Friendship Annex (FANX) near Baltimore. TAO also has units at NSA's four Cryptologic Centers across the US.

Entrance to the highly secured TAO headquarters building is strictly controlled: one has to go through an imposing steel door, protected by armed guards, and entrance is only possible after entering a six-digit code and passing a retinal scanner to ensure that only specially cleared individuals are allowed in.

Such security measures are more aimed at keeping outsiders out, than at insiders in. And when it comes to finding inside moles of hostile foreign intelligence agencies, the NSA is also said to have a rather bad track record. The Manning and Snowden leaks made NSA painfully aware of this and so preventive insider-threat detection programs were put in place.

It's not clear whether these new systems failed in the case of Harold Martin, or that they simply weren't yet implemented at the TAO location where he worked - anti-leak software that was designed by Raytheon to "spot attempts by unauthorized people to access or download data" was also not yet installed at the NSA facility in Hawaii when Snowden was working there.

Tracking what employees are doing inside is one thing, checking what they take out is another. But according to The Washington Post, the NSA (like other agencies) does not impose universal checks of personnel and their belongings as they enter and leave agency buildings. Security guards only conduct random checks and use their discretion in order to keep en build the trust of the employees.

"If you have a bag full of stuff, you’re probably going to get stopped" said a former TAO operator to the Post, but, in general, "Disneyland has more physical security checks than we had". Additionally, NSA facilities will have detection gates, but it seems that it was easier for Snowden to walk out with his thousands of documents than many would have thought.

As former NSA general counsel Rajesh De explained, it is unlikely "you’re going to be able to stop every incident of somebody taking documents if they’re determined to do so. But the real question is how quickly can you detect it, how quickly can you mitigate the harm of any such incident."




Conclusion

Harold Martin stole a lot of classified documents from multiple military and intelligence agencies where he worked over the past 20 years, with maybe just a small number from NSA. The still ongoing FBI investigation has to make clear whether Martin was responsible for exposing the TAO hacking tools.

If not, then there has to be yet another careless NSA employee, but then it's also still possible that the hacking tools came from a source responsible for a range of earlier leaks. So far it seems that Martin isn't the source of those earlier leaks, which means that the so-called "second source" is still at large.

The case of Harold Martin also made clear that security measures at NSA, and other US agencies, were not as strict and tight as outsiders would have expected: even for someone without a strong ideological or financial drive like Martin it was apparently not that difficult to regularly walk out with top secret documents.

Many things have not yet been confirmed or clarified, but at least the Shadow Brokers leak and the subsquent arrest of Harold Martin created more awareness among the American public of the fact that there have been more leaks than just those from Snowden.

In August 2014, Bruce Schneier was probably one of the first who identified a second and a third leaker besides Snowden. Many more similar leaks followed and a full list of them was compiled on this weblog in December 2015 (still being updated). As an excerpt of this listing, a short overview of the most important non-Snowden leaks was published in The New York Times last week.

UPDATE:
Shortly after this blog posting was published, The New York Times came with a new report saying that the volume of classified documents Harold Martin had in his possesion is larger than those stolen by Edward Snowden and even than those of the Panama Papers from 2015.
FBI investigators apparently also found that the TAO hacking tools were among Martin's documents, but because he is not very cooperative, it is still not clear how they came in the hands of the mysterious Shadow Brokers, who subsequently published them. So far there's no evidence that Martin was hacked or that he sold information.
He seems to have hoarded all these documents in order to get better at his job, as he is described as someone who imagined himself a top spy and an important player in the world of digital espionage.

On Thursday, October 20, government lawyers said they would prosecute Harold Martin under the Espionage Act because of stealing classified information. The FBI found the huge amount of 50 terabytes of data at his home, but it is not yet clear how much of that is classified. Also found were "hard-copy documents that were seized from various locations during the search that comprise six full bankers’ boxes worth of documents" with "Many of the documents marked ‘Secret’ and ‘Top Secret,’ also bear special handling caveats. The information stolen by the Defendant also appears to include the personal information of government employees".

Links and Sources
- John Schindler: It’s Time to Rename NSA the National INsecurity Agency
- The Washington Post: NSA contractor thought to have taken classified material the old-fashioned way
- Daily Beast: Democrats Say WikiLeaks Is a Russian Front, U.S. Intelligence Isn’t So Sure
- Defense One: Data-Theft Arrest Shows that Insider Threat Remains Despite Post-Snowden Security Improvements
- John Schindler: Has the Russian Mole inside NSA finally been arrested?
- New York Times: N.S.A. Suspect Is a Hoarder. But a Leaker? Investigators Aren’t Sure.
- The Cipher Brief: First on The Cipher Brief: Snowden's Boss Shares Lessons Learned

From the Snowden revelations, the general public learned about the Five Eyes partnership between the signals intelligence agencies of the United States, the United Kingdom, Canada, Australia and New Zealand, but details about this cooperation remained shrouded in secrecy.

Now, a batch of internal newsletters of the NSA's Signals Intelligence Directorate (SID), published last August by the website The Intercept, provides new information about various systems for sharing information, metadata, content and reports among the Five Eyes partners.

- From BRUSA to Five Eyes
- Joint Executive for SIGINT Interoperability (JESI)

- Information sharing: IWS
- Interoperable access control: PKI
- Sharing metadata: MAINWAY
- Federated metadata queries: GLOBALREACH
- Sharing content: TICKETWINDOW
- Sharing end reports: CATAPULT

- SIDtoday newsletters

From BRUSA to Five Eyes

The Five Eyes community grew out of the cooperation between Britain and the United States during World War II. On March 5, 1946 both countries signed the BRUSA (now known as UKUSA) Agreement on communications intelligence cooperation. This is not only about collecting signals intelligence, but also about security measures, like the use of codewords to restrict access to highly sensitive sources and reports.*

In June 1948 the UKUSA Agreement was established, which Canada, Australia and New Zealand signed on along with the UK as "Second Parties". A separate agreement between Canada and the USA (CANUSA) was signed in November 1949, followed by one with Australia in September 1953.*

Finally, in May 1954, the BRUSA Agreement was renamed UKUSA, which became also the name for the complex network created by these often overlapping agreements, appendices and memoranda of understanding.* Australia acted on behalf of New Zealand until the latter became a full member in 1955 or 1977.

The (signals) intelligence agencies that have less close bilateral relationships with NSA are called Third Party partners. Currently, there are over 30 Third Party partners, see: NSA's Foreign Partnerships

When the term Five Eyes (for classification purposes abbreviated as FVEY) came in use is not clear, but the SIDtoday newsletter from August 5, 2003 confirms that "Five Eyes" is derived "from the "US/UK/CAN/AUS/NZ EYES ONLY" caveat that limits the distribution of SIGINT reports to the listed Second Party countries."

The initial network of bilateral relationships between the five partner countries was eventually transformed into a "group partnership" in 1993 - as was revealed in a newsletter from August 25, 2003. It's not explained what this means, but it's sounds like a shift to a more multilateral framework for cooperation among eachother.



Joint Executive for SIGINT Interoperability (JESI)

In 1998, the agencies of the Five Eyes group established the Joint Executive for SIGINT Interoperability (JESI, pronouncesd as "jessy"). In the newsletter from August 25, 2003, JESI is described as a "multi-national executive body responsible for ensuring continued interaction and interoperability among the five SIGINT partners". JESI doesn't have its own staff, it's just a collaboration platform.

Officials from the Five Eyes agencies also meet at an annual JESI conference. In July 2003 this meeting was held in the Australian capital Canberra and was focused on the mission objectives of the partner agencies and how they relate to the 5-EYES SIGINT Partnership Business Vision, which was published earlier that year. They addressed the following topics:

- Mission collaboration and knowledge sharing
- Enabling SIGINT operations through information assurance
- Exchange of finished intelligence
- Maintaining business continuity

For a more efficient cooperation among the Five Eyes partners, the following systems were created, most of them initiated by JESI in 2002-2003, as described in the SIDtoday newsletter from August 25, 2003:

Information sharing: IWS

A collaboration tool called InfoWorkSpace (IWS) was created to exchange information between NSA, the US military and partner countries during Operation Enduring Freedom in Afghanistan.

IWS is a software tool that provides chat communications as well as audio and video conferencing, file sharing, virtual whiteboards, and shared desktop views through desktop computers connected to a secure network.* As within the Five Eyes it's about signals intelligence, IWS most likely ran, and maybe still runs on NSANet.

According to a SIDtoday newsletter from September 10, 2003 IWS was already used by over 4000 NSA and their Second Party counterparts at the working levels. They collaborated on topics like Operation Enduring Freedom, international terrorism, real-time collection coordination, SIGINT development and multi-intelligence tasking.

This succesful use of IWS led JESI decide that the system should also be used at leadership-level. As of 2003, the SIGINT directors of the Five Eyes partners would use IWS to enhance their collaboration on subjects ranging from current intelligence objectives to future collection planning. They would get access to one of the IWS servers managed by NSA, codenamed VOTEDOOR.

InfoWorkSpace, here being used during the Joint
Expeditionary Force Experiment (JEFX) 2006
(photo: CHIPS Magazine)

In another newsletter from December 19, 2003, it is said that not long before, the SIGINT directors of NSA, the Canadian CSE, the Australian DSD and New Zealand's GCSB held their first virtual meeting using the InfoWorkSpace tool. However, their counterpart at "GCHQ was unable to attend due to a computer failure."

According to the newsletter, this first meeting lasted over an hour and was mainly about "efforts against terrorism, especially ways to extend cooperation across the SIGINT community, and to include the HUMINT [Human Intelligence] community". A next virtual meeting using IWS was scheduled for the middle of January 2004.

The tech website Motherboard found the following video presentation of the InfoWorkSpace (IWS) tool, which was developed by ezenia!, a small company from Salem, New Hampshire:

Interoperable access control: PKI

In order to give Second Party employees access to joint collaboration systems, JESI pushed the partner agencies to deploy interoparable Public Key Infrastructure (PKI). The NSA's PKI is a comprehensive encryption system to protect classified information against:

- Unauthorized disclosure and modification through digital signing
- Unauthorized access through access controls and authorization services
- False user idenfications

An SIDtoday newsletter from July 8, 2003 explains that the new PKI system would replace the ICARUS e-mail encryption system by October 2003. A valid PKI certificate was also needed to use applications like Peoplesoft and CONCERTO. The latter is NSA's internal personnel system, which has separate parts for human resource and security clearance information.

The new PKI certificates were first issued to NSA employees who were US citizens and held a blue, green, or gold badge. Later, PKI certificates would also be issued to employees of Second Party agencies and to non-US citizens. This PKI system seems to be a software solution without two-factor authentication with a token like the CAC-smartcard of the US military.


Sharing metadata: MAINWAY

Since 2006 it was thought that MAINWAY was a repository just for telephone metadata, but based upon recently leaked and declassified documents, it was explained on this weblog that MAINWAY also contains internet metadata as well as the domestic phone records NSA previously collected under the authority of Section 215 of the USA PATRIOT Act.

Rather unexpected, the SIDtoday newsletter from August 25, 2003 now also reveals that "MAINWAY, a system that uses phone call contact chaining to identify targets of interest, was provided to each of our partners. The partners now supply additional contact information to the database to enhance the joint ability to identify targets".

So MAINWAY is not only fed with the domestic US telephone records and the foreign telephone and internet metadata collected by NSA, but also with foreign metadata provided by GCHQ, CSE, DSD and GCSB.

According to the quid pro quo rule for intelligence cooperation, all Five Eyes partners can apparently also query the MAINWAY database for their national security interests. However, Second Party analysts have no access to the domestic US phone records, but so far there are no documents that mention this explicitly.


Federated metadata queries: GLOBALREACH

Besides direct access to the metadata contained in MAINWAY, analysts from the Five Eyes partners can also use the GLOBALREACH system. In documents that were published earlier, this system is described as a "federated query service via accounts and access verified by PKI certificates" which probably runs on NSANet.

As a federated service, GLOBALREACH can be used to query multiple metadata databases with one single login. A 2005 document says that for example CIA would provide metadata "from non-SIGINT sources for inclusion in the dataset searched by GLOBALREACH" and it's likely that it can also search the foreign metadata from MAINWAY.

A pilot for a similar federated query tool codenamed ICREACH for the US Intelligence Community (IC) was started in 2007. After NSA "persuaded other US IC agencies to make almost 100 bn previously NOFORN records shareable with the 5-eyes via GLOBAL REACH", agreements were reached with the Second Party agencies, whereafter they started to provide ICREACH with telephony metadata, making them accessible to over 1000 analysts across 23 US intelligence agencies.

After establishing ICREACH, these analysts got access to more communication modes (including landline, mobile, satellite and VoiP call records), the types of metadata increased from 5 fields to 33 fields and the total volume rose from 50 billion to over 850 billion records - ca. 126 billion of which from Second Party partners. 1-2 billion records were said to be added daily, so by now, ICREACH may provide access to over 5 trillion metadata records.

Architecture of the ICREACH federated query system
(the full presentation as pdf - click to enlarge)

Sharing content: TICKETWINDOW

An older collaboration system for the Five Eyes partners is described in a SIDtoday newsletter from November 7, 2003: TICKETWINDOW. This system was established in 1999 by the NSA's Data Acquisition division to enable reciprocal data sharing with Second Party parters - without revealing sensitive sources and collection methods, which often restricted data sharing. Within TICKETWINDOW, NSA shares most data, but the other partners also contribute from their own collection.

In 2003, TICKETWINDOW was regarded a success story: new sources from the partner countries helped NSA to be more productive, while for the Australian DSD, more than 40% of their product reporting was from TICKETWINDOW collection, particularly from NSA collection. Both the British GCHQ and the Canadian CSE had doubled their output of TICKETWINDOW reports in 2002. Maybe this system is somehow related to the mysterious SIGADs starting with DS, which seem to denote collection by Second Party countries.

A similar data sharing system for the SIGINT Seniors Europe (SSEUR) group of Third Party partners is the Signals Intelligence Data System (SIGDASYS).


Sharing end reports: CATAPULT

Finally, there's also a system for sharing intelligence reports among the Five Eyes partners. According to a newsletter from May 8, 2003, NSA and the Canadian CSE set up a prototype portal to exchange SIGINT products between NSA and its Second Party partners under the codename CATAPULT.

The CATAPULT portal "contains all 2nd party viewable product shared with CSE to include multimedia reporting, CRITICOMM released product, and SIGINT on Demand (SOD) items", all of which is accessible from NSANet through a browser interface. CATAPULT is based on CSE's SLINGSHOT system, which delivers SIGINT reports to Canadian "customers" like policy and decision makers.

CATAPULT was brought under the JOURNEYMAN umbrella program for modernizing the way SIGINT analysts can write and disseminate their reports. As CATAPULT started as a prototype, it may have been replaced by a system that includes all Five Eyes partners.

Besides the systems described above, JESI also initiated the creation of several protected websites to allow employees of the Second Party agencies to securely share data within specific communities of interest.

As close as the cooperation between these agencies may have become, the sharing mechanisms are still meant to support each member's foreign intelligence tasks. The Five Eyes are not a body of its own with its own goals or targets, like for example a rather ridiculous target list on Wikipedia suggests.

Also, the data sharing system TICKETWINDOW isn't the successor of ECHELON, as Wayne Madsen wrote on the website Intrepid Report. ECHELON was (and under the name FORNSAT still is) a worldwide network of satellite intercept stations to provide in the information needs of each of the Second Party countries.


SIDtoday newsletters

In May 2016, The Intercept started publishing large batches of documents from the Snowden archive, to begin with the SIDtoday newsletters from 2003, all the way to the most recent available ones from 2012. A second batch came in August 2016 and so far, a total number of 429 SIDtoday newsletters have been published, from March 2003 to July 2005.

These newsletters are an interesting source for historical research as they add or confirm many details about NSA. Although some of them are about operations that could be controversial, taking away full nine years of SIDtoday newsletters isn't proportionate and forms an example of where Snowden wasn't very selective.



Links and sources
- The Intercept: All published editions of SIDtoday
- About Canada and the Five Eyes Intelligence Community (pdf)
- Martin Ruder: Hunters and Gatherers: The Intelligence Coalition Against Islamic Terrorism
- NSA: UKUSA Agreement Release 1940-1956

On December 1, Wikileaks published 90 gigabytes of classified documents from the German parliamentary commission that investigates NSA spying and the cooperation between NSA and the German foreign intelligence service BND. The documents include 125 files from BND, 33 from the security service BfV and 72 from the information security agency BSI.

It should be noted though that all documents are from the lowest classification level and lots of them are just formal letters, copies of press reports and duplications within e-mail threads. Nonetheless, the files also provide interesting new details, for example about the German classification system, BND's internal structure, the way they handled the Snowden-revelations and the use of XKEYSCORE.






About

Some background information was provided in an article from the newspaper Die Zeit, which says that only documents with the lowest classification level (VS NfD or RESTRICTED) are scanned and made available to the investigation commission on a government server. They are also available at the federal Chancellery.

Documents with a higher classification level are not digitalized and have to be read in a secure room (German: Geheimschutzstelle) in the parliament building. Most of the documents classified Top Secret can only be viewed at the Chancellery or the new Berlin headquarters of BND.




Regarding the source of this leak, IT experts of the German parliament said that they found no indications of a hack. Der Spiegel suggests that the source might be a member of the parliamentary commission for foreign affairs or for the affairs of the European Union, because one document published by Wikileaks (meanwhile removed) was only available to members of those two commissions.

Wikileaks hasn't redacted anything. Almost everything that is redacted is in blue, which is apparently the way BND is redacting its documents. Therefore, the files still contain all the internal organizational designators as well as the e-mail aliasses or addresses of many German government units and employees.





BND classifications

Documents from BND are classified according to the official German classification system, which has four levels, corresponding to those used in many other countries:

- VS NUR FÜR DEN DIENSTGEBRAUCH (VS NfD)
color code: blue or black; equivalent: RESTRICTED

- VS VERTRAULICH (VS Vertr. / VSV)
color code: blue or black; equivalent: CONFIDENTIAL

- GEHEIM (Geh. / Stufe I)
color code: red; equivalent: SECRET

- STRENG GEHEIM (Str. Geh. / Stufe II)
color code: red; equivalent: TOP SECRET

Besides these common classification levels, it was suspected that there would be at least one higher or more restrictive category to protect highly sensitive information. This has now been confirmed by various letters from the Wikileaks trove, which mention the following two classification markings:

- STRENG GEHEIM-ANRECHT (?)

- STRENG GEHEIM-SCHUTZWORT (Str. Geh. SW)
color code: ?; equivalent: TOP SECRET/SCI

The use of these markings is apparently a secret itself, because also members of the parliamentary commission puzzled about their exact meaning and usage. It seems though that these categories are rather similar to the US Classification System, which was explained here earlier.

The German marking ANRECHT apparently means that certain information is classified Secret or Top Secret, but that within that particular level, it's only meant for those people who have a need-to-know (German: Anrecht), apparently especially when it comes to signals intelligence. In the United States this is realized through a range of different dissemination markings.

The marking SCHUTZWORT is also meant to restrict access, but in this case, the originator of a particular document determines a codeword (German: Schutzwort) which he provides only to those people who are allowed access to that document. This is similar to the system of Sensitive Compartmented Information (SCI) used in the US, where meanwhile several formerly secret codewords have been declassified.

A security manual from the German armed forces from 1988 also mentions special classification categories, like for example SCHUTZWORT and KRYPTO, the latter apparently for classified cryptographic information.






BND organization

The files published by Wikileaks also contain a set of charts showing the organizational structure of BND between the year 2000 and 2014. There are some changes in the agency's divisions, with a reorganization in 2009, as can be seen in the following charts:





A more detailed BND organization chart was among the Snowden documents and was published earlier by Der Spiegel.

Internal designators

The BND's divisions, branches and units are designated by codes that consist of letters, written in capitals. In the current situation the main divisions have a two-letter designator which is more or less an abbreviation of their full name. The SIGINT division is for example TA, which stands for Technische Aufklärung.

From the e-mails published by Wikileaks we learn that lower units are designated by adding additional letters or words to the division designator. It seems that these addtional letters can be the first letter of a full name, a more or less random letter, or A for the first unit, B for the second unit, etc.

For example, "PLSA-HH-Recht-SI" is the first branch (A) of PLS, which is the BND president's staff. The term "Recht" indicates that this is apparently a unit for legal issues. A simpler designator is "GLAAY", which is a unit of the division GL (Gesamtlage)

By combining several documents related to XKEYSCORE, the following list of designators for BND's field stations could be reconstructed:

- 3D10: Schöningen or Rheinhausen (satellite interception)
- 3D20: Schöningen or Rheinhausen (satellite interception)
- 3D30: Bad Aibling (satellite interception)
- 3D40: Gablingen (HF radio interception)*

Some divisions

The organization charts for BND's structure since 2009 shows that there are four divisions for analysis and production, which is where analysts prepare intelligence reports:
- Two divisions are for topical missions: TE for international terrorism and organized crime, and TW for proliferation of weapon systems and ABC weapons.
- The other two divisions, LA and LB, are responsible for a geographical area. From their logos in the signature block in internal e-mails we learn that LB is responsible for Africa, the Middle East and Afghanistan, while LA has the rest of the world:




XKEYSCORE

According to Wikileaks, one of the more interesting documents from their release is one that allegedly proofs that "a BND employee will be tasked to use and write software for XKeyscore." However, the German tech website Golem says that this seems to be based on a text section that only refers to BND employee A.S. who helped install XKEYSCORE at the Berlin headquarters of the domestic security service BfV, which uses this system only for analysing terrorism-related data sets.

More interesting are several other documents about XKEYSCORE. For example In a list of answers prepared for the meeting of the parliamentary oversight commission on November 6, 2013 it is said that XKEYSCORE is used since 2007 in Bad Aibling and that this system is being tested since February 2013 at the satellite intercept stations Schöningen and Rheinhausen. It was planned to use XKEYSCORE on a regular basis at the latter two locations too.

An internal BND e-mail from November 5, 2013, explains that at Schöningen and Rheinhausen, XKEYSCORE is used for intercepting foreign satellite communications. The specific purpose for the system is determining which satellite links are most useful and subsequently checking whether the traffic contains the communications of people the BND is looking for (so-called survey):



This is a rather unexpected use of XKEYSCORE, because for NSA and GCHQ the strength of the system lies in its capability to reassemble internet packets, filter them and allow analysts to search buffered content. It is still not fully clear whether BND uses XKEYSCORE also in this way.

In November 2014, W.K. from BND's SIGINT division testified that XKEYSCORE was used for decoding and demodulating IP traffic. Decoding for making things readable happens both online and on stored data, while (demodulating for) selecting the proper satellite links only happens on online data streams.

At Schöningen and Rheinhausen XKEYSCORE was only used for the latter purposes, in the pre-analysis stage. This also came forward from some testimonies before the investigation commission. For example E.B., head of the Schöningen station, said that XKEYSCORE was only used for looking at a few days of satellite traffic to determine which communication links where in it.

An earlier presentation about satellite interception at Menwith Hill Station in the UK shows that NSA and GCHQ have other systems, like DARKQUEST, for surveying satellite links, after which XKEYSCORE is used for processing and analysing the data.

IBM servers

The Wikileaks files also contain an internal BND order form from February 25, 2014, used for ordering six servers for field station 3D20: two IBM X3650 M4 and four IBM X3550 M4 servers, with a total cost of 58.000,- euros. A separate text explains that these servers were needed for both PDBD and XKEYSCORE:

- PDBD was the new centralized BND tasking database, which would replace the proprietary tasking databases used at the various field stations.

- XKEYSCORE is described as a system that decodes packet-switched telecommunicatiosn traffic like e-mail, messenger, chat, geolocation information, etc. and is used for analysing telecommuncations traffic. At BND the system was needed because it became increasingly difficult to extract relevant information from the ever growing amount of data. The servers were needed to move XKEYSCORE from test to operational status.




PRISM

A large file from the commission documents is about the reaction on the revelation of PRISM. In August 2013, members of the Bundestag asked so many questions about this NSA program, that one BND employee complained that it was unreasonable to expect that his agency could provide all the answers.

At that time, many details about PRISM weren't clear yet and statements from the US government and from internet companies seemed to contradict eachother. Among the documents that BND forwarded to the parliamentary commission was also one report from July 2013, which summarizes what was known about PRISM at that time.

This report was made by people from unit ÖS I 3 of the Public Safety division of the German Interior Ministry (BMI). After summarizing what was known from the press reports, the report also describes a second tool that is named PRISM - based upon an earlier article on this weblog:




Shortly after the existance of PRISM was revealed early June 2013, much was unclear, so I did some open source research and found that the US military uses a program named PRISM, which in this case is an acronym for "Planning tool for Resource Integration, Synchronization and Management".

Shortly afterwards, in July 2013, German press published an NSA letter saying that there are actually three different programs with the name PRISM: one that collects data from the big internet companies, one that is used as a military tasking and planning tool, and finally one that is used for internal data sharing in NSA's Information Assurance Directorate (IAD).



BOUNDLESSINFORMANT

On July 29, 2013, the German magazine Der Spiegel published a chart from the NSA tool BOUNDLESSINFORMANT. The chart was related to Germany and it was thought that it showed that NSA had intercepted over 550 million pieces of communications traffic.

But within just a few days, BND contacted Der Spiegel, saying that they collected those data, and shared them with NSA. The SIGADs US-987LA and US-987LB designated collection at the BND satellite station in Bad Aibling and (wireless) interception of phone calls in Afghanistan, respectively. This was confirmed by NSA and published by Der Spiegel on August 5, 2013.



An e-mail published by Wikileaks shows that meanwhile, M.J. from unit 3D3D of the Bad Aibling station was comparing the numbers from the BOUNDLESSINFORMANT chart with those from his logfiles and Nagios Checks. In the e-mail, from August 12, 2013 to his boss R.U., he concluded that at the beginning of the month there was a relatively clear similarity with the chart from Der Spiegel:



It should be noted that BND didn't count the numbers of metadata they provided to NSA, they did so only for content, so the numbers from M.J.'s chart may not be fully accurate. Even more puzzling is a table that was also with the e-mail from M.J. and contains the daily numbers for the metadata during this period:



The strange thing here is that on the right side, the table has daily numbers broken down for several processing systems - strange because the chart from Der Spiegel only provided aggregated numbers, and because three codenames weren't seen in the published BOUNDLESSINFORMANT charts: POPTOP, CRON and SNOWHAZE. Did NSA provide these more detailed numbers so BND could compare them?



Index

Finally, a list of some of the most interesting files found so far (would have been useful when Wikileaks provided this kind of index though):

- MAT_A_BND-8a (contacts with GCHQ, cooperation between BND and NSA, reports about the refugee interview unit, internal G10 manual)

- MAT_A_BND-1-3a_2 (employees of US military and intelligence contractors in Germany)

- MAT_A_BND-3a (very extensive index of topics used by BND)

- MAT_A_BND-1-5 (NSA's bulk metadata collection, PRISM and XKEYSCORE)

- MAT_A_BND-3-1a (BND organization charts from 2000-2014)

- MAT_A_BND-1-11a (BOUNDLESS INFORMANT, ECHELON)

- MAT_A_BND-1-11c (page 315: options how NSA could have intercepted Merkel's cell phone)

More to follow...

Since the Snowden-revelations, several countries adopted new laws governing their (signals) intelligence agencies, but instead of restricting the collection capabilities, they rather expand them. Previously we examined the new laws that have recently been implemented in France. This time we will take a look at the Netherlands, where a new law for its two secret services is now being discussed by the parliament.

The situation in the Netherlands is different in at least two major aspects from many other countries. First, there is no institutional separation between domestic security and foreign intelligence as the two secret services combine both tasks. Second, the current law restricts bulk or untargeted collection to wireless communications only, so cable access is only allowed for targeted and individualized interception.




 

Secret services

The two Dutch secret services, which were both created during a major reorganisation in 2002, are:

- General Intelligence and Security Service (Dutch: Algemene Inlichtingen- en Veiligheidsdienst, or AIVD), which falls under the Interior Ministry and is mainly responsible for domestic security issues, but also has a small branch that gathers intelligence information from and about foreign countries. In 2015, AIVD had over 1300 employees and a budget of 213 million euros.

- Military Intelligence and Security Service (Dutch: Militaire Inlichtingen- en Veiligheidsdienst, or MIVD), which falls under the Defence Ministry and is mainly responsible for military intelligence related to peacekeeping missions and military operations overseas. They also have to provide security for the armed forces. In 2015, MIVD had over 800 employees and a budget of approximately 85 million euros.

The Netherlands has no separate signals intelligence agency, but in 2014, the Joint Sigint Cyber Unit (JSCU) was created as a joint venture of AIVD and MIVD. The JSCU integrates the collection of signals intelligence and cyber defense operations on behalf of both agencies. The unit is located in the AIVD headquarters building in Zoetermeer and has a workforce of some 350 people. The head of JSCU is also the point-of-contact for foreign signals intelligence agencies, like NSA and GCHQ. The JSCU operates two listening stations: a relatively large satellite intercept station near the northern village of Burum, and a very capable High Frequency radio listening post in Eibergen near the German border.

The fact that the Dutch secret services combine both domestic security and foreign intelligence tasks, also means that there’s just one legal framework for both, and that authorisations are not only required for domestic operations, but also for foreign ones. Therefore, the Dutch services don’t have to separate foreign and domestic communications, which proved to be such a painful job for NSA and the German BND.




Dutch capabilities

During an interview with Dutch television in January 2015, Edward Snowden said that "the US intelligence services don't value the Dutch for their capabilities, they value them for their accesses, they value them for their geography, they value them for the fact that they have cables and satellites... a sort of vantage point that enables them to spy on their neighbours and others in the region in a unique way."

This doesn't show much familiarity with the issue, as the Dutch services have no "cables" yet and "satellites" are mainly intercepted for their foreign traffic. In reality, what makes Dutch intelligence interesting for NSA isn't spying on their neighbours, but their spying overseas: data they collect during military missions in Afghanistan and Mali, during navy missions around the Horn of Africa, by the quiet Dutch submarines, and radio traffic from the Middle East intercepted at the Eibergen listening post.


Some numbers

In 2009, the Dutch government provided the number of targeted interceptions conducted by the secret services: 1078 by AIVD and just 53 by MIVD. This number doesn’t seem very high (especially taking in account that targets often use multiple phone numbers) - but in the same year, French intelligence services were allowed to tap 5029 phone lines, although it’s not clear whether these number count in the same way.

Dutch government refuses to publish such numbers for more recent years, saying that that would give to much insight in the modus operandi of the agencies. A strange argument, because such numbers say nothing about the targets and also because countries like the US and Germany regularly publish even more detailed numbers. Like the police, the secret services also request metadata (verkeersgegevens or printgegevens) from the telecoms, but for this there are no numbers available.


Secret services vs. police force

In 2014, Dutch police conducted over 25.000 phone and internet taps, which is way more often than in other countries (it seems that Snowden had this in mind when he erroneously said that the Dutch secret services are the “surveillance kings of Europe”). The reason for this is that Dutch police rarely conducts undercover, observation and bugging operations, which are considered much more controversial and intrusive than phone taps.

Originally, targeted interception by the police was only allowed for crimes that could be sentenced with 4 years or more imprisonment and only for phone numbers used by the suspect himself, but with a new law on special criminal investigation methods from the year 2000, these restrictions were abolished.*

The Dutch police force has its own unit for targeted interceptions and in 2006 operated at least one IMSI-catcher (the AIVD two), which may be used both for finding out unknown phone numbers of known suspects, as well as for the targeted interception of phone calls. It’s also allowed to use Wifi-catchers.* Unlike in France, Dutch secret services do not work on or support police investigations under the authority of a judge.


 

Oversight bodies

The Netherlands there is a quite thorough oversight for the intelligence and security services. This is conducted by the independent commission CTIVD and the parliamentary commission CIVD:

The main oversight body is the Review Committee for the Intelligence and Security Services (Commissie van Toezicht op de Inlichtingen- en Veiligheidsdiensten, or CTIVD), which consists of three independent members, appointed by royal decree, who are supported by a secretariat of 10 people. The strength of this commission is that it has the right to access all documents and computers systems and speak to all employees: commission members can actually walk in, pull open drawers and log into the networks of both AIVD and MIVD.

The CTIVD publishes an annual report, but also conducts investigations on specific matters, like targeted interception in general or specific cases based upon press revelations. This results in a steady flow of reports, most of them public, which provide a detailed insight into the work of the Dutch services, of course without revealing specific methods or other sensitive details.

The other oversight body is the Committee for the Intelligence and Security Services (Commissie voor de Inlichtingen- en Veiligheidsdiensten, or CIVD), comprising the leaders of all political parties represented in the Second Chamber of the Dutch parliament. In this commission, which meets about 10 times a year in utmost secrecy, the party leaders are briefed by the responsible ministers and the heads of both secret services.

Within the context of the CIVD, the party leaders have the right to read classified documents, but when they make notes, even those notes are considered classified and may not leave the secure room. They can also ask, through the minister, to question employees of the secret services, but they have no powers to force them, nor to hear them under oath.

Critique

According to scholars and historians, this commission isn’t really fit to conduct thorough oversight. The party leaders are involved with way too many other political issues, and therefore they not always attend the commission meetings. A leak from this commission in February 2014 also made clear that the government can apparently rather easily report about things in such a way that the party leaders miss the actual importance of it.

Independent experts proposed that the commission should at least be extended with specialized members of parliament so intelligence issues receive full attention and better understanding, but this proposal was rejected by the party leaders. They seem not really interested in the work of AIVD and MIVD, which is especially worrying given the very secretive way the Dutch government deals with intelligence issues.


 

Towards a new law

Currently, the two Dutch security and intelligence services are still governed by the Intelligence and Security Services Act from 2002 (Dutch: Wet op de inlichtingen- en veiligheidsdiensten, or Wiv). In February 2013, an evaluation commission for this law was installed, led by Stan Dessens. In its report from December of that year, the commission recommended that the intelligence services would be allowed to also conduct bulk collection on cable-bound communications. But given increased public scrutiny since the Snowden revelations earlier that year, the commission also urged for stronger oversight and more transparency.

It then took until July 2015 before the government published its proposal for a new law. This was followed by an internet consultation, in which anyone could submit an opinion about the proposal through a government website. This resulted in over 1100 reactions, 500 of them public and most of them very critical (it should be noted though that (the highly critical) digital rights organization Bits of Freedom provided an online tool for easily submitting standardized reactions).

Given this amount of critique, including from major telecommunication providers and internet companies, the government reconsidered its proposal. On April 15, 2016 the draft was discussed in the council of ministers. The new text wasn’t released, but the government announced that some changes had been made:

- A new independent review commission (Toetsingscommissie Inzet Bevoegdheden, or TIB) that has to approve all requests for both the new bulk cable access and the existing targeted interceptions. This commission will be different from the existing independent oversight commission CTIVD and will actually consist of just 1 member and two substitutes, who have to be judges with at least 6 years of experience.

- When AIVD or MIVD want to intercept the communications between lawyers and their clients or between journalists and their sources, there has to be prior approval by the district court of The Hague. This extra protection is required by the rulings of the European Court for Human Rights.

- The government will pay for the costs of the untargeted cable tapping, which are estimated at 15 million in 2017, 25 million in 2018 and 35 million in 2019. The initial plan was to let the telecommunication companies pay for the necessary equipment on their networks, something they strongly opposed. The government plans to get one access location ready for bulk interception each year, so the agencies can gradually get used to this new method. In 2020, there will be four access locations, which will be chosen according to specific information needs and in consultation with the telecoms.

On April 29, the newspaper De Volkskrant disclosed the full text of the revised proposal, including the over 400-page explanatory memorandum (Memorie van Toelichting, or MvT). Here it was read that the government had replaced the original "untargeted interception" (ongerichte interceptie) by a horrible new term meaning something like "interception according to research assignment" (onderzoeksopdrachtgerichte interceptie) - clearly meant to sound more focused and limited, in order to counter the popular image of an indiscriminate dragnet.

This revised proposal was sent to the Council of State, which must be consulted before a law is submitted to parliament. Instead of a legal review of the full proposal, the Council only addressed a few topics. The controversial bulk cable access is considered necessary enough to be in accordance with the European Convention on Human Rights (ECRM), provided that there’s strong and independent oversight.

However, the Council expressed serious doubts about the effectiveness of newly proposed TIB commissioner, which lacks the expertise and capacity of the existing CTIVD commission. The proposed approval by the TIB could therefore end up like a "rubber stamp". It would be better to give the CTIVD commission the right of non-binding prior approval and the Council advises the government to change the draft in this way, before sending it to parliament.

Another point of critique is that data collected in bulk may be kept for 3 years, which the Concil thinks is too long and has to be shortened significantly. The Council was also especially concerned about the analysis of "big data" and wants to see a more general vision on how big data analysis affects the work of the secret services, like to what extent there’s a shift from collecting data to analysing already existing data sets.

After receiving the Council of State’s consultation from September 21, some changes were made, with the most important one being that the TIB is extended from one commissioner to a commission of three, with 2 judges, one member with for example technical expertise, and its own secretariat - thereby ignoring the main point of the Council of State’s recommendation.

The final proposal was discussed by the Dutch cabinet on October 28 and subsequently submitted to parliament. In December, the responsible parliamentary commission consulted the oversight committee, secret service officials and outside experts. The Second Chamber of parliament is expected to vote on the new law in the first week of February, which is just before the Dutch general elections on March 15, 2017.


  

Bulk cable access

The most important and most controversial new feature of the proposed intelligence law is the bulk collection of cable-bound communications. In the proposed law, the regulations for bulk collection will be made "technology independent", so they apply to both wireless communications (SHF satellite and HF radio) and fiber-optic cable traffic (internet and telephony). For this, the new law introduces a framework of 3 stages:

1. Acquisition (article 48):
Selecting specific cables and satellite channels from specific internet providers and satellites. Then conduct filtering to let through or block certain types of traffic (peer-to-peer, music and movie streams, etc.) and/or traffic from/to particular countries of interest. The remaining data may be stored for up to 3 years.
It should be noted that this means that both metadata and content are simply stored, like put in a big box, where at NSA and GCHQ content is only buffered for several days using the XKEYSCORE system, which prevents unnecessary storage of content that is not of interest.

2. Preparation (article 49):
   a. Search the communication links to determine the type of traffic and the persons or organisations it belongs to. The law mentions this as part of stage 2, suggesting that it follows upon stage 1, but actually this activity supports and therefore goes parallel to the selection of the right cables and channels during stage 1.
   b. Look for new, or verify already known selectors related to known targets, and look for new targets related to selectors already known - this is actually a kind of contact-chaining like in stage 3, but here not for the sake of analysis, but to see whether the stored bulk actually contains data or new selectors that match already approved selectors of known targets.
(This stage 2 is very artificially composed and the whole process would be much clearer and simpler when section a. would be incorporated in stage 1 and section b. in stage 3)

3. Processing (article 50):
   a. Conduct metadata analysis using the metadata from the stored bulk sets of data. These can be used for contact-chaining, creating a pattern-of-life or other kinds of analysis in which the collected metadata can also be correlated with other datasets.
   b. Selecting the content of communications by picking them out of the stored bulk data sets when there’s a match with approved selectors.

For each of these stages AIVD and MIVD need a prior authorisation from their respective minister, which is valid for up to 12 months (3 months for the content selection of stage 3). Each authorisation will then have to be approved by the TIB commission.

The government already expects that authorisations for stage 1 and 2 will often be combined. As these stages are part of a continuous process, the Council of State also noticed that it seems not very realistic to make such clear distinctions and acquire separate authorisations. This means that in practice, authorisations will likely be combined for all 3 stages, thereby largely mitigating the goal of the system.




Just like with the sudden introduction of the TIB commissioner, this 3-stage authorisation scheme seems primarily aimed at comforting the public opinion. The government presents them as safeguards against abuses, but they actually make things unnecessarily complicated with a substantial risk that they will end up to be counterproductive.

These extra safeguards were introduced partly because the government couldn’t very well explain why the new bulk collection of cable communications is actually that necessary. The standard example used by the interior minister is about access to cables from the Netherlands to Syria, but communications related to known targets can already be covered by targeted interception, while for example Facebook and Whatsapp messages actually go through cables from the US.


Supposed purposes

On April 20, 2016, public broadcaster NOS revealed a confidential document that apparently addressed internet providers and contains some more specific examples for the proposed bulk cable access. For example when people from a fictitious city of 400.000 inhabitants communicate with a certain chat service, this should be interceptable. Also internet traffic for a maximum of 200 people has to be 'searched', but it isn’t clear whether that applies to the example of the city, or whether this is a total.

Another example from the document is about public wifi hotspots. Communications of people accessing certain hotspots and/or using these to visit certain foreign websites must also be interceptable. The document also speaks about telephone traffic between a Dutch city and a foreign country as well as about the internet traffic between someone in a Dutch city and in a foreign country in which for example bittorrent is used. All this must be interceptable.

There are no rules for "minimizing" (anonymising) the results of this kind of collection, likely because both secret services have both a domestic and a foreign intelligence task, so they are not prohibited from using domestic data, like agencies in other countries.




The champions in cable tapping are NSA and GCHQ, but there we already see a shift towards cyber defense and hacking operations, things that got much less attention in the Dutch public opinion and (probably therefore) also not in the new law.
 


Cyber security monitoring

The proposed bulk cable access is not only meant for intercepting communications, but also for cyber security purposes. The strange thing is that this isn’t explicitly mentioned in the new law itself, but only, and even rather short, in the explanatory memorandum. It is said that the new articles 48 and 49 make it possible for AIVD and MIVD to scan cable-bound network traffic for malware signatures and other anomalies which may pose a threat for national security.

This cyber security monitoring may only take place after prior approval by the minister, who will specify on which particular part of the cable infrastructure and for which goal the network monitoring or network detection may take place. Where bulk cable access for intercepting and analysing communications will only be conducted on sets of data that are stored offline, the cyber security task can also take place online: traffic will then be analysed in real-time by for example a DPI (Deep Packet Inspection) system.

The explanatory memorandum mentions real-time online monitoring only for cyber security purposes. Later on, it is said that bulk collection for the purpose of intercepting communications is less intrusive than a traditional targeted interception, because the latter results in an online and real-time collection of all the target’s communications, while the bulk collection only provides the limited set of data that has been stored offline. This distinction isn’t explicitly mentioned in the proposed law itself, so it’s unclear whether real-time monitoring and filtering systems are also allowed for interception purposes.


 

Third party hacking

Another important new feature in the new law is about network and computer hacking. Already under the current law from 2002, both secret services are allowed to hack into digital systems and networks, but only those being used by a particular target (Dutch police isn’t allowed to hack, but another new law is expected to change that soon). Additional to this, the proposal will also allow AIVD and MIVD (or JSCU on their behalf) to hack computer systems used by third parties, whenever that is necessary to get access to a target’s computer.

Obviously, so-called hard targets can secure their systems in a way that it is hardly possible to break in, or they can avoid online systems as much as possible, so the only option will be to get access through third parties near or in contact with such a target. But still this extension of powers is remarkable because this is one of the most controversial methods that came to light in recent years. GCHQ for example hacked the network of the Belgian telecom company Belgacom as a means to get access to still unknown targets.

Despite third party hacking is probably just as controversial as the bulk cable tapping, the government didn’t introduce separate authorisations for the various steps in the hacking process, like they did for untargeted interception. This means that hacking operations, no matter how intrusive or extensive, require only a single authorisation set (minister + TIB commission).

However, each authorisation by the minister has to make sure that the use not only of hacking methods, but also of all other special intelligence methods is in accordance with these three basic rules:

- Necessity: a method must be necessary to fulfill the intelligence or counter-intelligence mission.

- Proportionality: the consequences of a method have to be in proportion to its goal.

- Subsidiarity: a method may only be used when the goal cannot be achieved through a less intrusive method.

Contributions to this article were made by Zone d'Intérêt, a French weblog about intelligence & defence, on which this article was also published as part of an ongoing series about new laws on intelligence and security services.



Links and sources
- Tweede Kamer: Hoorzitting/rondetafelgesprek inzake de nieuwe Wiv (December 2016)
- NRC.nl: De geheime dienst is een gemakkelijke zondebok (November 2016)
- Tweede Kamer: Wetsvoorstel 34588 (October 2016)
- Volkskrant.nl: 'Onschuldige burgers hebben niet zoveel te vrezen' (April 2016)
- Volkskrant.nl: Kabinet houdt vast aan massaal aftappen internetverkeer (April 2016)
- Blog.cyberwar.nl: [Dutch] Lijstje van reacties van organisaties op de Wiv-consultatie (2015)
- Bart Jacobs: Vluchtig en Stelselmatig. Een bespreking van interceptie door inlichtingen- en veiligheidsdiensten (February 2015)

Shortly before the recent US presidential election, a dedicated cybersecurity hotline with Moscow was used by president Obama to warn the Russian government not to interfere with the election process through hacking operations.

Press reports compared the cybersecurity with the "Red Phone", which many people believe is used on the Hotline between Washington and Moscow. That's not true, and also Obama's message seems not to have been transmitted by phone, but through an e-mail channel which is maintained by the Nuclear Risk Reduction Center (NRRC).




Obama's message

The fact that on October 31, US president Obama sent the Russians a direct message through the cyber channel was first reported on December 16. Three days later, NBC News came with some details about the content of the message. According to anonymous officials, it included phrases like "International law, including the law for armed conflict, applies to actions in cyberspace" and that the US "will hold Russia to those standards."

However, another senior intelligence official told NBC that the message was "muddled" because there was no bright line laid down and no clear warning given about the consequences. According to the official, the Russian response was non-committal. It's worrying that these government officials are leaking the content of the message, thereby undermining the necessary confidentiality of such an important hotline.

Obama's warning message was not about the hacking of the Democratic National Committee (DNC) or of it's chairman John Podesta, which director of national intelligence James Clapper had previously said was conducted with the knowledge of the Russian leadership. Instead, the warning reportedly only referred to the concerns about hacking around the election process itself.


 

The cybersecurity link

On June 17, 2013, shortly after the start of the Snowden-revelations, the White House announced that during the G-8 summit in Northern Ireland, Russia and the United States had agreed upon several confidence-building measures (CBMs) to reduce the mutual danger from cyber threats. This includes the regular exchange of technical information about malware and other kinds of risks to critical systems, which appear to originate from each other’s territory and/or could be misperceived as an attack.

Such information is exchanged between the US Computer Emergency Readiness Team (US-CERT), which is part of the National Cybersecurity and Communications Integration Center (NCCIC) of the Department of Homeland Security (DHS), and its Russian counterpart. To provide secure and reliable communication lines for the formal inquiries about cybersecurity incidents, this task was delegated to the Nuclear Risk Reduction Center (NRRC - see below).

Secure voice line

Besides the information channel via the NRRC, the White House and the Kremlin also agreed to set up a direct secure voice communications line between the US Cybersecurity Coordinator at the White House and the Deputy Secretary of the Security Council of Russia, in case there should be a need to directly manage a crisis situation arising from a cybersecurity incident.

The announcement said that this direct voice line "will be seamlessly integrated into the existing Direct Secure Communication System ("hotline") that both governments already maintain" - which indicates that this line runs over the same redundant and highly encrypted satellite link as the Direct Communications Link (DCL, which is the official name of the Hotline) and the Direct Voice Link (DVL) between both heads of state.

We have no information about how this direct cybersecurity voice line is secured, but earlier, similar high-level bilateral telephone links consisted of Secure Telephone Equipment (STE), provided by the US.

Usage

As the press reports say that Obama's message was sent via the NRRC, we have to assume that it was in the form of an e-mail, and not a call through the secure voice channel. It was also reported that "the Obama administration had never used the cyber line before", but it's not really clear whether that means that the president never sent a message this way, or that the system was never used in any way.

The latter would mean that since 2013 no information about suspicious network intrusions has been exchanged between Russia en the US. The secure voice line for cybersecurity incidents has then probably also never been used - this kind of high-level direct phone lines seem rarely used in general.



 

The Nuclear Risk Reduction Center

The relay of cybersecurity messages is now one of the tasks of the Nuclear Risk Reduction Center (NRRC), which is located in the US Department of State (DoS). Its Russian equivalent is part of the Russian Ministry of Defence. The Cyber Security Protocol agreed upon in 2013 is the latest of 14 arms control treaties and agreements for which the NRRC exchanges information with more than 55 foreign governments and international organizations.

The NRRC consists of a watch center that operates 24 hours a day, 365 days a year and is staffed by Department of State Foreign Service officers, civil servants, and technical support personnel. They provide and receive inspection notifications, exchanges of data regarding strategic offensive arms, prior notifications of major exercises or unit restructurings, and other treaty-required communications.

The NRRCs were established by an agreement between the United States and the former Soviet Union from September 15, 1987 in order to build confidence through information exchange about their nuclear arsenals. The centers became operational on April 1, 1988. After the split-up of the Soviet Union in 1991 this secure data link, officially called Government-to-Government Communication Link (GGCL), was extended to Ukraine, Belarus and Kazakhstan.

Initially, these communication links consisted of facsimile devices, with (one-time pad) encryption conducted by personal computers and the random keys provided on 5¼ inch floppy disks, just like on the Washington-Moscow Hotline. As of late 1995, the NRRC communications shifted to encrypted e-mail with an additional chat channel for coordination purposes.



 

Red Phone versus Hotline

It may be more than clear now that Obama's warning message had nothing to do with a "Red Phone", but it should be mentioned that the White House and the military did use red phones, although not for international, but for internal communications between the president and the military command centers. This was achieved through a secure military telephone network: the Defense Red Switch Network (DRSN).


Through popular culture, the image of a red telephone became projected to the direct communications link between Washington and Moscow, but this is false: the Hotline was never a phone line, as it was set up in 1963 as a teletype connection, which in 1988 was replaced by facsimile units. Since 2008 the Hotline is a highly secure computer link over which messages are exchanged by e-mail.


What the Hotline terminal at the Pentagon looks like nowadays can be seen in the following picture, which was released on the occasion of the 50th anniversary of this communications link in 2013:

 

Other options?

Besides the cybersecurity channels, the NRRC and the Hotline, the US government has two additional channels for direct communications with the Kremlin: the Foreign Affairs Link (FAL) between the State Department and the Russian foreign ministry, and the Defense Telephone Link (DTL) between de defense ministries of both countries. Both are secure phone lines, which also exist with a range of other countries.


This means that president Obama had several other options for transmitting his warning to Russia. It seems the NRRC cybersecurity channel was chosen because it was about the threat of cyber attacks, but still, such a warning message seems not what that channel is meant for, which is the exchange of technical information about actual intrusions that could be misinterpreted as a deliberate attack.

Therefore, the Foreign Affairs Link (FAL) would probably have been more appropriate: US secretary of state John Kerry could have called his Russian counterpart to issue the warning. But generally, for important messages in which every word counts, written communications are preferred, so that left only the NRRC or the Hotline.

Using the Hotline was probably considered too dramatic, and therefore the remaining option was the cybersecurity channel maintained by the NRRC.



Links and sources
- The Washington Post: Obama administration is close to announcing measures to punish Russia for election interference (2016)
- EmptyWheel: Now the spooks are laking criticism of Obama's sole use of the "Red Phone" (2016)
- NBC News: What Obama Said to Putin on the Red Phone About the Election Hack (2016)
- The New York Times: White House Confirms Pre-Election Warning to Russia Over Hacking
- The White House: U.S.-Russian Cooperation on Information and Communications Technology Security (2013)