Title: BULLRUN

Release Date: 2014-12-28

Description: This undated presentation from GCHQ’s PTD (Penetrating Target Defences) unit gives an overview of BULLRUN efforts to defeat encryption: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

Document: TOP SECRET STRAP1

BULLRUN

PTD Lead for Special Operations and Policy

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ on

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

BULLRUN

• Covers the ability to defeat encryption used in
specific network communications

• Includes multiple, extremely sensitive, sources
and methods

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Informatior^c^OO^o^Tia^^ubiecU^xemotiorM^Tder
other UK information legislation. Refer disclosure requests to GCHQ on

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Network Security Technologies

• Secure Sockets Layer/Transport Layer Security
(SSL/TLS) (webmail)

• Secure Shell (SSH)

• Encrypted chat

• Virtual Private Networks (VPNs)

• Encrypted VoIP

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ or

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Response to improving security

• For the past decade, NSA has lead an
aggressive, multi-pronged effort to break widely
used Internet encryption technologies

• Cryptanalytic capabilities are now coming on line

• Vast amounts of encrypted Internet data which
have up till now been discarded are now
exploitable

• Major new processing systems, SIGDEV efforts
and tasking must be put in place to capitalize on
this opportunity

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ on

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Sensitivities

• Cryptanalytic capabilities

- Are extremely difficult and costly to acquire

- Require a long lead time

- Depend on sensitive sources

- Are very fragile

- If lost, may never be regained

• The mere “fact of” a capability is very sensitive:

- An adversary who knows we can/cannot break is
able to elude our capabilities even without knowing the
technical details of how the capabilities work

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Protecting BULLRUN Capabilities

• Technical and operational details

- Need to be known only by cryptanalysts and those who
enable cryptanalysis

- Protected by established ECl’s

• PICARESQUE , PAWLEYS, AMBULANT, ...

• “Fact of” information

- Needs to be known very widely within the SIGINT
production chain

- Protect with new secure community of interest (COI)

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ onl

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Protecting the Info - Secure COI

• Secure Community of Interest (COI) - protects
“fact of” as well as volume and scope of the
capability

• BULLRUN indoctrination required for access to
COI

• BULLRUN-related material, data - decrypted
content and decrypted metadata, and details must
be protected within the COI

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ on

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Protecting the information

• BULLRUN is for internal (Sigint) use only

• Implemented at NSA &CSEC; DSD & GCSB to
follow

• Not to be shared with UK Partners / customers

• EP not to reveal sources & methods; further
guidance to be developed

• BULLRUN brief on Gcwiki for reference

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ onl

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

Examples

• (S SI) Unspecified capabilities against [VPNs, IPSEC,
TLS/SSL, HTTPS, SSH, PPTP, eChat, eVolP]

• (TS SI COMINT) Capabilities against the encryption used in
[VPNs, IPSEC, TLS/SSL, HTTPS, SSH, PPTP, eChat, eVolP]

• (TS S2 BULLRUN) Capability against specific applications

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ on

© Crown Copyright. All rights reserved.

TOP SECRET STRAP1

BULLRUN Bottom Line

• Groundbreaking capabilities

• Extremely fragile

• Do not ask about or speculate on sources or methods
underpinning BULLRUN successes

• Indoctrination required for access to secure COI

PTD "We penetrate targets' defences."

This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to GCHQ on

© Crown Copyright. All rights reserved.


Download Document

BULLRUN (media-35532.pdf)

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh