Title: German, NSA SIGINTers Share DNI Processing Knowledge

Release Date: 2014-06-18

Document Date: 2006-05-22

Description: This article, dated 22 May 2006 and taken from the internal NSA newsletter Foreign Affairs Digest, describes a meeting between agency personnel and officers from Germany’s BND: see the Der Spiegel article New NSA Revelations: Inside Snowden’s Germany File, 18 June 2014.

Document: (S//SI) German, NSA SIGINTers Share DNI Processing Knowledge

SUSLAG (Special US Liaison Activity Germany)

Run Date: 05/22/2006

(S//SI) A END* delegation responsible for building END'S next generation DNI
(Digital Network Intelligence)- processing architecture visited the Joint SIGINT
Activity (JSA) in late February for two days of discussions to learn more about

1 of 3

NSA's DNI architecture. The JSA, an operational element of the Special US Liaison
Activity Germany (S US LAG), is a joint SIGINT development, collection, and
exploitation site manned by German and US personnel,

(S//SI) DND analysts discussed their processing architecture, which is largely
based on NSA's old P25 and P26 GRANDMASTER prototypes, Their focus is
primarily e-mail processing, specifically SMTP e-mail, Spam filters are used to
manage large data volumes. Selected traffic is passed through an automated
privacy protection system, ensuring that analysts cannot view German-protected
traffic. On-site DND analysts then manually assess all selected traffic to determine
potential intelligence value,

(S//SI) In conducting this evaluation, they do not prioritize the selected traffic by
target or keyword. Instead they focus on e-mails carrying attachments with the
goal to scan e-mails as quickly as possible to increase their throughput, E-mails
that are determined to be of potential intelligence value are then forwarded to DND
PIQS for follow-on evaluation and reporting,

(S//SI) NSA intelligence analysts discussed NSA's SIGINT Development model,
NSA's "Hunt versus Gather" philosophy, our multi-stage selection and filtering
process, and the evolution of DNI processing systems from GRANDMASTER to
WEALTHYCLUSTER and, in the future, TURMOIL. The DND appeared especially
interested in the TURMOIL approach of scanning and making judgments at the
packet level prior to any sessionizing.

(S//SI) In summary, NSA and BND use opposite selection and filtering
approaches. Where NSA primarily relies on equipment for selection (e,g,
DLACKNIGHT) and analyst minimization for privacy protection, the DND relies on
analysts to manually scan traffic for selection, and then equipment to filter data for
privacy protection. Full use of current NSA DNI processing systems and analysis
methodologies at JSA will be key to influencing the DND to alter their strategic DNI
processing approach,

*(U) Note: DND = Germany's Dundesnachrichtendienst (the Federal Intelligence

(U) This article is reprinted from the Foreign Affairs Digest, April edition.

2 of 3

3 of 3


Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh