Title: In-Flight GSM

Release Date: 2016-12-07

Document Date: 2009-01-01

Description: This 2009 NSA presentation, based on an internal agency newsletter article from 20 March that year, describes the growth in airlines offering onboard mobile phone services, which the Agency had alreadyu been actively collecting for at least a year: see the Intercept article American and British Spy Agencies Targeted In-flight Mobile Phone Use, 7 December […]

Document: TOP SECRET//COMINT//RELTO USA, FVEY

\\

(U//FOUO) In-Flight GSM

S32423/S3T1

The overall classification of this briefing is TOP SECRET//COMTNT//REI,

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSM 1-52
Dated: 8 January 2007
Declassify On: 20320108

(U//FOUO) Travel Persona Pod

POD50

(S//REL) Analysis of travel activity
carried in Short Message Service (SMS)
and GSM traffic

SECRET//COMINT//RELTO USA, FVEY

(U//FOUO) Key GSM Terms

(U//FOUO) GSM - Global System for Mobile
Communictaions

(U//FOUO) MS - Mobile Subscriber

(U//FOUO) IMS! - International Mobile
Subscriber Identity

(U//FOUO) MSISDN - MS Integrated Services
Digital Network Number

(U//FOUO) VLR Visitor Location Register

(U//FOUO) HLR - Home Location Register

UNCLASSIFIED//FOR OFFICIAL USE ONLY

w



i UNCLASSIFIED//FOR OFFICIAL USE < DNLY
1 ft

U//FOUO) What is In-Flight GSM?

(U//FOUO) The ability for a Mobile
Subscriber to use GSM services while
traveling onboard an aircraft



UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) How In-Flight GSM is

Implemented

AeroMobile System Topology

PSTN



Satellite Bearer

<7

SATCOM



' Pico cell
N system

Aircraft

Ground Earth
Station

/

v

GSM

Server

Local

VT,R

Mobile

Swifrhmg
(.'entre

7 \

Global Mobile
Switching centre

/

Existing

EquiprneiiL

AeroMobile

Components

Mobile Network

UNCLASSIFIED//FOR OFFICIAL USE ONLY

40000

30000

£0000

10000

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) Popularity

2008 In-Flight GSM Activity

50,000th Subscriber

Commercial
Announcement March
20. 2008

0

anuary

■l.

March

0

May

July

September November

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Number of Events





UNCLASSIFIED//FOR OFFICIAL USE ONLY

IV

(U//FOUO) Popularity

2009 In-Flight GSM Activity

0000

52500

35000

17500

January

100.000th s

February

March

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Number of Events

(U//FOUO) Popularity

(U//FOUO) Jan - Dec 2008 the usage roughly
doubled every month.

(U//FOUO) Took 9 Months (March 20 to Dec.
16) to reach 50K users.

(U//FOUO) Took 2 months (Dec 17 to Feb 15)
to reach the 2nd 50K users. (100K in 11
months)

(U//FOUO) Last count 160,170 (as of
3/20/2009)

UNCLASSIFIED//FOR OFFICIAL USE ONLY

//FOUO) Reasons for Increase

(U//FOUO) More planes equipped with
In-Flight GSM capability

(U//FOUO) Less fear that plane will
crash due to making/receiving a call

(U//FOUO) Not as expensive as people
thought

UNCLASSIFIED//FOR OFFICIAL USE ONLY

/

r*

•<

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(U//FOUO) Who’s Implementing In-

Flight GSM

Inmarsat
Swift64/SwiftBroadBand
GSM/S MS/GPRS

Inmarsat

Classic

GSM/SMS

AeroMobile
VLR=88299100999
901 14

Malaysia Air

Emirates

A340-Dubai-Cas-EK751
Boeing 777-Dubai-London EK005

Shenzhen

AirFrance

UNCLASSIFIED//FOR OFFICIAL USE ONLY

(S//REL) Finding In-Flight GSM

searches on in-flight related articles

• (S//REL) Continued Google searches using
AirGap account to get more commercial
details on in-flight GSM

• (U//FOUO) Found that in-flight providers lik<
to say who’s “onboard” with their solution

• (U//FOUO) Airline’s provide good usable

----Aion in Press Releases

SECRET//COMINT//RELTO USA, FVEY



f

U//FOUO) Emirates Press Release

hM°

Gobi's



UNCLASSIFIED//FOR OFFICIAL USE ONLY

w

SECRET//COMINT//REL TO USA, FVEY



C//REL) NSA Database Searching



(S//SI//REL) The “Welcome onboard Emirates”
text search in DISHFIRE was my initial
lauching point

(S//SI//REL) ASSOCIATION searches are
easy way to find In-Flight activity

(S//SI//REL) CHALKFUN used to confirm
roaming and mentioned flights

(S//SI//REL) FASTSCOPE used to provide

of individual’s travel

SECRET//COMINT//RELTO USA, FVEY

TOP SECRET//COMINT//RELTO USA, FVEY

S//SI//REL) ASSOCIATION

E-EVENT_DATE
1/23/2009 15:58

1/23/2009 17:40

E-IMSI

E-MSISDN

1/23/2009 17:53

1/23/2009 17:53 -

1/23/2009 19:16

E-VLR_CONFIRMED
923210002026-N

88299100999-N

88299100999-C

TOP SECRET//COMINT//REL TO USA, FVEY

(TS//SI//REL) CHALKFUN

TOP SECRET//COMINT//RELTO USA, FVEY

EVENT_DATE VLR COUNTRY LOCATION
20090123 15:58:39 923210002026 PAKISTAN UNKNOWN
20090123 17:53:55 88299100999 AERONAUTICAL UNKNOWN
2009012317:53:56 88299100999 AERONAUTICAL UNKNOWN
20090126 07:41:03 923452000003 PAKISTAN KARACHI
20090126 07:41:04 923452000003 PAKISTAN KARACHI
20090126 07:41:04 923452000003 PAKISTAN KARACHI
2009012615:08:19 923210002002 PAKISTAN UNKNOWN
20090131 05:46:45 923455000036 PAKISTAN ISLAMABAD

TOP SECRET//COMINT//REL TO USA, FVEY

S//REL) So we see In-Flight GSM now

(S//REL) We can see it now on daily basis.

(S//REL) We see that its use is increasing
daily.

(S//REL) How long has data been in Agency
databases?

(S//REL) Started perfonning same
ASSOCIATION query prior to March 20,
008.

SECRET//COMINT//RELTO USA, FVEY

(U//FOUO) Here’s what I found

(TS//SI//REL) First instance of VLR activity
was to VLR 88299100999 (Aeromobile) on
Oct. 2, 2006

(TS//SI//REL) The first instance on an OnAir
VLR was to VLR 8829800201 on Nov. 23,
2006

(TS//SI//REL) The first instance of a target
registering with In-Flight service was on May
, 2007 to OnAir's VLR 8829800202

TOP SECRET//COMINT//REL TO USA, FVEY

w

TOP SECRET//COMINT//RELTO USA, FVEY

\\



(U//FOUO) Importance

(TS//SI//REL) Can track a target while
onboard an aircraft

Data association of I MS I,

(TS//SI//REL)
MSISDN, Flic

(JS//SI//REL)

Taraet

Flight, Proof number on an airplane

Confirm suspected travel of a

arget

(S//SI//REL) Assist in determining when to
turn on/off collection (approach US border)

VLR’s for voice

ollection (NSA could “own” the air)

TOP SECRET//COMINT//REL TO USA, FVEY

U//FOUO) Continuing Research

(U//FOUO) More extensive evaluation of
data

(S//SI//REL) Looking for GPRS activity

(S//SI//REL) Identify vendor hardware

(S//SI//REL) Identify specific aircraft with
solution installed

SECRET//COMINT//RELTO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY

i -«■■/ 1

QUESTIONS?

(U//FOUO) Contact Information

SI D-Today Article posted 3/20/2009

TOP SECRET//COMINT//REL TO USA, FVEY

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh