Title: GCSB Sigint Development Quarterly Report

Release Date: 2015-03-05

Document Date: 2009-07-01

Description: This GCSB report from July 2009 describes the move towards “full collection” at the agency’s Waihopai, progress against several named targets and “2nd party sharing” arrangements via XKeyScore: see the New Zealand Herald article The price of the Five Eyes club: Mass spying on friendly nations, 5 March 2015.

Document: TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

GCSB SIGINT Development Quarterly Report

Quarterly Report:
002/09

J uly 2009

To: Deputy Director Signals Intelligence

Target telecommunications' networks within GCSB's Area of Responsibility continue to
change at a rapid pace with deregulation rampant throughout the South Pacific, and major
infrastructure projects dramatically changing the Afghan communications landscape.

Digicel Pacific, subsidiary of Caribbean-based telecommunications company Digicel, has
gone from strength-to-strength in major regional markets such as Fiji, Tonga, Vanuatu and
Samoa, and are currently building Nauru's first mobile phone network. Future plans for
pan-Pacific provision of high-capacity international links using underwater cable and
Medium Earth Orbit satellite bubble along, potentially providing new options for Pacific
Island Governments to greatly increase their populations' connectivity to global
communications.

Acting OCR Team Leader
http://www.gcsb^^^B

TARGET TELECOMMUNICATIONS DEVELOPMENTS AND TRENDS

South West Pacific AOR

1. Solomon Islands

Solomon Telekom is in a race against time with a new market entrant (almost certainly
Digicel) due to launch on 1 ApftW010. In the remaining months -ef-2009 and earfy20l0

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Solomon Telekom is attempting to triple its GSM user base, double the capacity of its GSM
infrastructure as well as resolve long-standing network issues and inefficiencies.

As part of this push to improve and expand its network coverage, Solomon Telekom has
already launched two new GSM towers in June (Kukum and Panatina) and added 1800MHz
cells to five existing sites around Honiara. OCR has worked closely with the GCSB Deployed
Solutions team and DSD to provide as much information on the changes as possible, thus
allowing GCSB and DSD to retain situational awareness as the Solomon Telekom network has
expanded and evolved. A result of this collaboration has been the fine tuning of CAPRICA
collection to take advantage of as many of the new 1800MHz antennas as possible as well as
the levying of a requirement with DSD for dedicated 1800MHz receivers to be deployed at
site.

OCR has also worked closely with DSD over the planned PREBOIL RF survey at GBR, Honiara.
To this end a briefing paper was issued on the RF environment of GBR in March and
subsequently updated in June. OCR has also been in direct contact with stakeholders in DSD
to provide further information as required.

2. Fiji

Digicel has rapidly caught up with Vodafone in mobile phone coverage offered on the main
islands of Fiji since its launch in October 2008 and plans to introduce 3G services in
November this year. Vodafone has relied on its own 3G services and high interconnection
fees between telecommunication networks to maintain its greater market share, but these
competitive advantages will shortly disappear. Up until now, GCSB’s major targets in the
Government and RFMF have kept a preference for Vodafone services, but they are
increasingly buying into the services of the alternative network.

OCR assisted DSD’s Military Support unit to provide a Target Systems Analysis on the
Command, Control and Communications of the Fiji Government, RFMF and Fiji Police Force
by collating and reporting information held by SIGDEV, Production and Access areas at GCSB
on the communications and operating practices of these organisations. This study concluded
that GSM voice and SMS appeared to be the ‘tactical’ network of choice, in preference to
VHF/UHF, or a poorly maintained and very limited RFMF computer network.

3. South Pacific Regional
SPIN Cable

Recent press reports have mentioned new developments to the SPIN project such as Tonga
expressing interest and Norfolk Islands being signed on for a spur off an Auckland-Noumea
leg of the cable. But, despite the increased press interest, it is still not clear that SPIN will
develop into the full-featured cable all the proposals suggest. There are a few reasons for
this:

1. The SPIN cable project is very expensive for Pacific Island Countries (PICs) with
landing costs around US$15-$30m and on-going costs usually exceeding US$1 m
per annum. 2 3 4

2. Most of the countries who have expressed an interest in SPIN plan to raise the
funds to join, in full or partially, from either the EU or the Asia Development
Bank. Faced with several countries asking for assistance, it is not clear whether
either donor will be prepared to meet this large financial demand.

3. Disruptive technologies such as the 03b medium earth orbit satellite
constellation, due for launch late 2010, are likely to offer much the same speed
and bandwidth as a cable but at substantially cheaper initial and ongoing cost.

4. Astute Pacific Island telecommunications experts have noted that the SPIN
project is almost entirely French-owned and run and that the contractual terms
do not provide much security for the PICs that sign on.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

GSM hardware In Nauru and the hardware would then be leased back to Digicel, who would
run a GSM service in the island state.

In January the deal was agreed and both sides began the required paperwork. Digicel are
likely to launch in Nauru in late 2009.

Meanwhile, the Government of Kiribati has been slow to reach an acceptable deal with
Digicel, which has resulted in Digicel putting off plans for a Kiribati rollout. The key sticking
point is whether the network should be run out of Tarawa or FIJI. To make the project
economical Digicel want to run and support the network from Fiji, but the Government of
Kiribati is Insisting the management and support of any Diglcd network be managed locally.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Samoa

On 30 March—2009, cable laying ship ILE DE RE completed a month-long cable-laying
operation near Samoa. The project saw Samoa and American Samoa connected to the
previously defunct PacRim East cable which used to link Hawaii and New Zealand before it
was superseded by the Southern Cross Cable. The work appears to have been completed
successfully and provides the two Samoas with shared connectivity to the rest of the world
of 1Gbps, an approximate 40-fold increase in capacity.

Unfortunately, SIGINT has already lost access to Samoan bearers due to the American
Samoa-Hawaii (ASH) cable. In all likelihood all but some backup carriers will be off the air
by the end of the year.

a. Transit

SECRET// REL FVEY

ILE DE REY

ftP IA

Cable laying operations

13:49 00"S

March 2009

171:46 00 W

PAGO PAGO HARBOR

14:17'00"S

170:40 00 W

d. Cable laid between

Pago-Pago and Apia

c. Cable re-laid

b. PacRim East lifted

NZJEWSF 039-09

ELINT tracking of vessel ILE DE RE produced by the J oin Electronic Warfare Support Facility
- green represents the vessel in transit, red and blue are probable cable operations.

Digicel

In late-2008, Digicel was approached by the Government of Nauru with a proposal to assist
Digicel to launch in Nauru. The proposal was that Nauru would pay for the installation of

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

GSM hardware in Nauru and the hardware would then be leased back to Digicel, who would
run a GSM service in the island state.

In January the deal was agreed and both sides began the required paperwork. Digicel are
likely to launch in Nauru in late-2009.

Meanwhile, the Government of Kiribati has been slow to reach an acceptable deal with
Digicel, which has resulted in Digicel putting off plans for a Kiribati rollout. The key sticking
point is whether the network should be run out of Tarawa or Fiji. To make the project
economical Digicel want to run and support the network from Fiji, but the Government of
Kiribati is insisting the management and support of any Digicel network be managed locally.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Bangladesh

6. Revised Target Template

SIGDEV target templates are always very much a work in progress, with any relevant
information being regularly added as a target's telecommunications environment develops.
The Bangladesh target template has recently been extensively overhauled and republished
in a new format. The updated Bangladesh target template contains plenty of new
information; including information on the Bureau's CT targets and recent Bangladeshi
technology developments, particular attention has been paid to updating the access and
exploitation layers: outlining our existing accesses and collection, and also highlighting
future key requirements.

The Bangladesh target templa^:c^ibea^^sse^by.Iol!o^in^the.J.ink below.
http://www.gcsb.govt.nz

7. F6 Dhaka Survey

Internal GSM collection is continuing with the recent extension to the Dhaka F6
environmental survey. Site collection resources are in the main being used for the sustained
collection of productive GSM emitters. However the changing RF environment has also seen
the continuation of survey activity. Resources are also regularly reallocated to revisit
network links of interest.

The value of an internal Bangladesh collection site was recently highlighted with the
handset geo-location of a target of interest. Utilising call event data derived solely from F6
collection, OCR was able to geo-locate cellular activity from a tasked Pakistani handset
operating in Dhaka and also provided an image that was used in GCSB reporting.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Image: F6 collected geo-locatlon metadata on tasked handset

Recent analysis of some classified collateral has developed an understanding of the
telecommunications systems of the Bangladesh Rapid Action Battalion (RAB). This
information will materially add to the SIGINT communities' knowledge of Bangladeshi
telecommunications networks. Analysis of this collateral highlighted comprehensive
geographical information, telecommunication transmission paths and signalling information.

With this collateral, F6 was able to place on collection dedicated RAB private voice
communication to and from RAB headquarters to various RAB units. Also seen in collection

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

was a limited amount of DNI, including a test of the video teleconferencing system from RAB
HQ to RAB-3 HQ.

Image: RAB video teleconferencing Intercept

RAB has been an active target group for the GCSB in the past and this information could
well be of high interest for future operations if the domestic security situation in
Bangladesh were to deteriorate.

METADATA ANALYSIS TOOLS AND TECHNIQUES

8. XKEYSCORE

GCSB received a visit from NSA XKEYSCORE trainers and in

March to update our GUI, assist IRONSAND with virtualisation of their XKEYSCORE suite, and
train users in anticipation of full-take collection and—2nd party sharing. IRONSAND
Engineering have been working to overcome problems in storage capacity, Virtual LAN
licensing, competing priorities, and low manning but plan to have full-take collection on
Mission carriers running by October. DSD are very keen to share XKEYSCORE data and have
already modified their GUI to meet GCSB Compliance expectations. It is hoped that sharing
with DSD and GCHQ will be achieved soon after we can offer full-take collection data. GCSB
auditors are now trained to audit all queries made, and an audit log is kept to track what
proportion of queries have been marked as reviewed to satisfy the Inspector-General.

NETWORK ANALYSIS TEAM

9. OCR Integree in DSD's NAC

To begin the process of developing GCSB's own network analysis capability,

__________, who will be part of the GcSB SIGINT Development network analysis team when it

stands up in Octobep-2009, was posted to DSD's NAC for four months (February to May).

| was placed initially into Access Analysis, gaining knowledge of DSD's systems and
collection capabilities. One month into his deployment, he switched to the Network
Infrastructure Analysis section, where he was given specific NAC tasks regarding Indonesian
cellular telecommunications provider Telkomsel. Some of the tasks included investigating
Call Data Records being sent over FTP, identifying-X-25 over TCP communications between

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

Telkomsel GSM nodes, and researching Telkomsel iGATE 4000 STM-1 carriers.
benefited from very useful training and information including a one-day SS7 presentation
and a three-day VPN course.

10. SIGDEV integration into CNE

On returning to GCSB, | has been integrated into the GCSB CNE unit to gain a deeper
understanding of current CNE activities and processes. It is envisaged areas of future NAC
support towards CNE operations can be identified, along with the leveraging of CNE's
unique internal network accesses to allow for detailed network analysis of target countries.
Currently has been engaging in operations against Fijian networks of GOVNET and
RFMF.

THE OCR TEAM

11. New team member -

OCR welcomes the addition of to the team, returning to GCSB

after completing 3 years at DSD. He is currently with the NAC team at DSD gaining an
introduction to SIGINT Development work, and will join the team at GCSB in October as a
Fiji SIGDEV analyst. started working in DSD's customer services team ensuring all

SIGINT reporting was accurately delivered to Australian Intelligence customers via the
report distribution tool CHIMERA. He also managed a team to start the update of reporting

a before being appointed as the DSD counter proliferation liaison officer to ASIS.

was housed at ASIS HQ sitting with the CP team, assisting with the SIGINT
development of targets relating to ASIS counter proliferation operations. In this role he
advised ASIS of targeting opportunities, conducted initial signals/target development and
wrote SIGINT reports on CP targets of ASIS interest while educating ASIS staff on the
intricacies of SIGINT capabilities.

12. New team Vision, Mission and Values

OCR recently constructed the following Vision, Mission and Values to use as our guidance in
providing SiGiNT Development for GCSB:

OCR Vision: Complete awareness of evolving target telecommunications for the protection of
GCSB's mission

OCR's Mission: is to future-proof GCSB against a changing telecommunications and SIGINT
environment through:

• Research and analysis of the evolving target telecommunications environment

• The provision of guidance and direction to the SIGINT Access community

• The introduction of new analytical tools and techniques.

OCR Values:

Professionalism - Integrity, Excellence and Lawfulness
Collaboration - Teamwork, Commitment and Leadership
Responsiveness - Adaptability, Dedication and Customer Focus
Initiative - Innovation, Learning and Curiosity

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

OCR

OCR1

OCR2

OCR3

OCR5

OCR6

OCR7

OCR10

OCN1

Team Leader/Supervising Analyst (On military leave
until Decembef-e009)

Bangladesh CT SIGDEV

Solomon Islands SIGDEV

Maternity Leave

__________________, Geospatial Metadata Analysis

tradecraft development

Acting team leader, Fiji SIGDEV, SIGDEV Projects

Fiji SIGDEV
NAC

Acting OCR Team Leader

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh