Title: MHS Lends a Hand in the Aftermath of the London Bombings

Release Date: 2018-03-01

Document Date: 2005-08-24

Description: The NSA’s base at Menwith Hill in the U.K. supported the GCHQ in tracking phone, GSM, SMS, and high-powered cordless phone signals in the wake of the London bombings on July 7, 2005. This included putting nine U.K. cities under mass surveillance by monitoring satellite phones via “VOICESAIL.” NSA analysts also found a certain area in Pakistan with a high density of calls to the U.K. and were able to use intercepted communications from a subsequent attempted bombing to add potential terrorism-related cover terms for attacks to their database.

Document: DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL

(C) MHS Lends a Hand in the Aftermath of the London Bombings
FROM:
Menwith Hill Station
Run Date: 08/24/2005

(C) SIGINT site in the UK responds to the terrorist bombings.
(C//SI) The Menwith Hill population was both shocked and saddened by the 7 July 2005 terrorist
bombings in London that left 56 dead. We were eager to assist UK efforts to identify the culprits
and prevent similar acts in the future. While the police worked to restore order in London,
Menwith Hill Station (MHS) immediately began collaborating with the intelligence community to
provide assistance in the search for the perpetrators. MHS analysts looked at a number of
communications systems, sifted through thousands of calls to find suspicious communicants,
and passed on their findings to GCHQ and throughout the intelligence community.
(S//SI) Details on the event conflicted initially, and questions persisted as to where and how to
begin analysis. MHS opted to focus on its unique access, where its efforts could have the most
impact--coverage and analysis of VOICESAIL (VS) communications. We worked with GCHQ's
International Terrorism Team to put coverage on nine UK cities, and compile a list of UK cities
and external locations (including Copenhagen, Brussels, and various locations in Spain, South
Africa and Morocco) requiring tighter focus. At GCHQ's request, analysts examined calls from VS
handsets that had dialed into London from Iraq.
(S//SI) The VS analysts found high priority targets that had phoned specific areas in the UK
from Pakistan, Afghanistan, Egypt, and Iraq. These findings were passed to GCHQ for further
development. We monitored suspicious VS use, as reflected by successive SIM** card activity,
an abundance of travel, or an unusual amount of calling activity. All terminals were checked for
short message service (SMS) and GCHQ was alerted to those containing curious messages. MHS
analysts also identified unusual SMS activity from Iraqi GSM carriers and subsequently tipped
MHS's COMSEC monitoring team (SPRINKLER) because it appeared to disclose information
regarding military operations. SPRINKLER relayed the data to the Joint COMSEC Monitoring
Activity (JCMA) for follow-on analysis.
(S//SI) Extensive analysis revealed two base stations in
, Pakistan with a significant amount
of calls to the UK. Analysts acquired imagery that indicated a possible compound, necessitating
further investigation. Additional metadata analysis of various technologies was coordinated with
NSA's GEOCELL (S2L) and GCHQ. We also coordinated closely with the European Security Center
in Darmstadt, Germany, on high powered cordless phone analysis to identify phone numbers
emanating from the UK. On the digital network intelligence (DNI) front, analysts reviewed all
data from 5 to 7 July for intelligence selectors to use. We also reviewed data from 21 July when
a second wave of terrorist bombings in London was attempted. These efforts resulted in
approximately 45 new bombing target terms being added to the database and shared with
GCHQ.
(S//SI) MHS analysts continue to support GCHQ's efforts. We hope our rapid and thorough
response will greatly boost efforts to break up networks backing these attacks, prevent future
incidents and greatly increase the terrorists' cost of doing business.

**(U) Note:
SIM = Subscriber Identification Module card that carries GSM (Global System for Mobile
Communication) subscriber data and activates the phone when inserted.

(U//FOUO) Menwith Hill Station

"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet
without the consent of S0121 (DL sid_comms)."

DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh