Title: Exploiting Foreign Lawful Intercept (LI) Roundtable

Release Date: 2015-09-29

Document Date: 2012-01-01

Description: This NSA presentation from 2012 discusses techniques for subverting “lawful intercept” systems used abroad: see the Intercept article A Death in Athens: Did a Rogue NSA Operation Cause the Death of a Greek Telecom Employee?, 29 September 2015.

Document: 2012-lawful-intercept-redacted2-p1-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) Exploiting Foreign
Lawful Intercept (LI)
Roundtable

S31122

TOP SECRET//SI//REL TO USA, FVEY2012-lawful-intercept-redacted2-p2-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(U) Definition

Lawful Intercept (LI) - obtaining communications
network data by legal authority for analysis or
evidence

NWO/AP/SvP’st domain

LEA

domain

TOP SECRET//SI//REL TO USA, FVEY

2012-lawful-intercept-redacted2-p3-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(U) LI Standards

- CALEA (US)

- ETSI (European)

- SORM (Russian)
J Other

TOP SECRET//SI//REL TO USA, FVEY

\2012-lawful-intercept-redacted2-p4-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(TS//SI//REL) Countries of Interest

Pakistan * Egypt
Afghanistan - Algeria
Iran j Mexico
Iraq ■* Indonesia
Yemen - UAE
Syria j Saudi Arabia
China * Russia

TOP SECRET//SI//REL TO USA, FVEY

\2012-lawful-intercept-redacted2-p5-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) XKS Fingerprints (~60)

Aqsacom j Nokia
ATIS * Siemens
Ericsson * Trovicor
ETSI * Utimaco
Huawei - ZTE
Motorola - GENERIC

TOP SECRET//SI//REL TO USA, FVEY

\_____________________________________2012-lawful-intercept-redacted2-p6-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(U//FOUO) Access Methods

J FORNSAT
J Microwave (F6)

j Special Source Operations (SSO)
j Tailored Access Operations (TAO)

TOP SECRET//SI//REL TO USA, FVEY

\______________________________________________2012-lawful-intercept-redacted2-p7-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) Taplists

■* Developing advanced analytics to determine
patterns in numbers being tasked

j Creating database to store Ll-related
information

J Discovering informal tasking

TOP SECRET//SI//REL TO USA, FVEY

\______________________________________________2012-lawful-intercept-redacted2-p8-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) Mapping Networks

j Telecommunication and Internet Service
Providers in a region

- LI vendors/service providers
J IP addresses/ports of usage
j Likely transmission medium

TOP SECRET//SI//REL TO USA, FVEY

\______________________________________________2012-lawful-intercept-redacted2-p9-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) Processing Solution

- KITTYBINGE

J TAO custom solutions

- STARPROC

TOP SECRET//SI//REL TO USA, FVEY

2012-lawful-intercept-redacted2-p10-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) Types of LI

j Telecommunication
j Internet

- Differentiating between regular voice/lnternet
traffic from tasked traffic. Protocol indications?

TOP SECRET//SI//REL TO USA, FVEY

\2012-lawful-intercept-redacted2-p11-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) LI Pod

TOP SECRET//SI//REL TO USA, FVEY

2012-lawful-intercept-redacted2-p12-normal.gif:
TOP SECRET//SI//REL TO USA, FVEY

(S//SI//REL) LI Discussion Topics

j Discovery
J Access Methods
j Taplist Analytics
J Corporate Database
j Corporate Processing Solution
j Other Issues/Roadblocks

TOP SECRET//SI//REL TO USA, FVEY

\ - -

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh