Title: Is there “fifth party” collection?

Release Date: 2015-01-17

Document Date: 2011-01-01

Description: This undated post from an NSA discussion board describes “fourth party collection” – piggybacking on another state’s computer network exploitation operation: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

Document: (TS//SI//REL) Is there "fifth party" collection? | Round Table

Dynamic Page - Highest Possible Classification is
TOP SECRET // SI / TK // REL TO USA, FVEY

(TS//SI//REL) Is there "fifth party" collection? S,

_23 _

CLASSIFICATION : TOP SECRET//SI//REL TO USA, FVEY

(TS//SI//REL) "Fourth party collection" refers to passively or actively
obtaining data from some other actor's CNE activity against a target. Has
there ever been an instance of NSA obtaining information from Actor One
exploiting Actor Two's CNE activity against a target that NSA, Actor One,
and Actor Two all care about?

(TS//SI//REL) Edit: Awesome illustration per request:

asked 3 days ago
^C^SSIHED//FOUO

(CIV-NSA)

by (U//FOUO)^^^^^^H(CIV-NSA)

Add A Comment | Show 9 Comments (2 newl | Show ALL Comment Blocks
2 Answers
_12

CLASSIFICATION : TOP SECRET//SI//REL TO USA, FVEY

1 of 3

(TS//SI//REL) Is there "fifth party" collection? | Round Table

(TS//SI//REL) Yes. There was a project that I was working last year with
regard to the South Korean CNE program. While we aren't super interested
in SK (things changed a bit when they started targeting us a bit more), we
were interested in North Korea and SK puts a lot of resources against them.
At that point, our access to NK was next to nothing but we were able to make
some inroads to the SK CNE program. We found a few instances where there
were NK officials with SK implants on their boxes, so we got on the exfil
points, and sucked back the data. Thats fourth party. (TS//SI//REL) However,
some of the individuals that SK was targeting were also part of the NK CNE
program. So I guess that would be the fifth party collect you were talking
about. But once that started happening, we ramped up efforts to target NK
ourselves (as you dont want to rely on an untrusted actor to do your work for
you). But some of the work that was done there was able to help us gain
access. (TS//SI//REL) I know of another instance (I will he more vague
because I believe there are more compartments involved and parts are
probably NF) where there was an actor we were going against. We realized
there was another actor that was also going against them and having great
success because of a 0 day they wrote. We got the 0 day out of passive and
were able to re-purpose it. Big win. (TS//SI//REL) But they were all still
referred to as fourth party,
answered 2 days ago
UNCLASSIFIED//FOUO
(CIV-NSA)

Add A Comment | Show 1 Comment (1 new)

_6

CLASSIFICATION : UNCLASSIFIED

C: UK TOP SECRET STRAP1 COMINT AUSCANUKUSNZ (TS//SI//REL//) '4th
Party' was, of course, a COMINT (and particularly a cryppie) term long
before it was a CNE one (or CNE even existed). In a COMINT context, ISTR
meeting a '5th Party' scenario from '70s: GCHQ station collected cipher on
nation A's internal security comms. Broken cipher revealed collect (including
cipher texts) by A's SIGINT against neighbouring nation B's internal security
comms (so that was '4th Party'). Some of B's texts so obtained revealed in tel
derived from B's domestic intercept targets, so I guess that was '5th Party' ..
ago
FVEY

(Unknown-GCHQ)

Know anyone who can answer?
Share this:

answered 1 day
C//REL TO USA,

Add A Comment

2 of 3

(TS//SI//REL) Is there "fifth party" collection? | Round Table

Your Answer

Answer:

(Don't forget to include portion markings as needed.)
For formatting tips, see this guide.

Classification Marking (required):

Overall: U C Submit

Topics:

fifth party collection
fourth party collection

Round Table Design: Round Table team, S31315,

Content Steward and Page Publisher: Round Table Team,

Derived from: NSA/CSS Manual 1-52, Dated: 8 January 2007
Declassify on: 20320108

Dynamic Page - Highest Possible Classification is
TOP SECRET // SI / TK // REL TO USA, FVEY


e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh