Title: MHS and GCHQ “Get in the Game with Target Development for World of Warcraft Online Gaming”

Release Date: 2013-12-09

Document Date: 2008-01-01

Description: An NSA document from 2008 shows that efforts to collect data from players of World of Warcraft started that year with the development of specialised exploits by GCHQ. The operation was based at Menwith Hill in the UK: see the New York Times article Spies’ Dragnet Reaches a Playing Field of Elves and Trolls, 9 […]


(TS//SI//REL) MHS and GCHQ “Get in the Game” with Target Development for

World of Warcraft Online Gaming

(TS//SI//REL) Although online gaming may seem like an innocuous form of
entertainment, when the basic features and capabilities are examined, it could
potentially become a target-rich communication network. Online gaming represents a
technology that is rapidly growing in popularity worldwide. World of Warcraft (WoW) is
one with an impressive following of gaming enthusiasts. With over 10 million users
worldwide, WoW may be providing SIGINT targets a way to hide in plain sight. Targets
have been spotted receiving “no reply” emails from gaming providers and GCHQ
analysts have correlated known SIGINT targets to online gaming events. The New
Mission Development Center at MHS, the Global Network Exploitation (OPD-GNE) and
the Applied Research Special Topics (B18) organization at GCHQ are working together




to filter the FORNSAT survey environment for this traffic and extract various types of
WoW metadata forSIGINT development and network knowledge enrichment.

(U) Communication is at the core of online gaming
and in WoW there are many ways to
communicate and interact in the virtual world. A
player has a character ID and can join different
groups. A "parti/" brings players together for a
common, defined purpose or quest. It is
temporary and task-oriented. "Guilds," on the
other hand, are for characters with persisting
relationships and can take on an organizational
structure with ranks and positions. The guild is
more permanent and ideological. Characters can
communicate verbally and non-verbally and rnay
set up different types of channels to talk within a
guild or privately, character to character.

(TS//SI//REL) GCHQ recently asked MHS's New Mission Development Center (NMDC)
to support an online gaming research effort focusing on WoW. Eager to assist in a new
potential area of target development, the NMDC discussed metadata needs with GCHQ
in order to enable WoW target and network research in the FORNSAT arena. The
NMDC engaged SNORT, an open source packet-sniffing software, which runs on all
FORNSAT survey packet data, to filter out WoW packets. GCHQ provided several
WoW protocol parsing scripts to process the traffic and produce Ware raft metadata from
all NMDC FORNSAT survey. These logs are now being forwarded back to GCHQ for
additional analysis, target development and network knowledge enrichment. By fusing
information from different systems, databases, and resources GCHQ has correlated
target entities to WoW logon events and continues to uncover potential SIGINT value by
identifying accounts, characters, and guilds related to Islamic Extremist Groups, Nuclear
Proliferation and Arms Dealing.

(TS//SI//REL) WoW certainly provides entertainment for a large number of people
worldwide, but its gaming format can provide a virtual organizational platform for
potential SIGINT targets as well. Furthermore, this technology can assist the target and
simultaneously assist the SIGINT community in tracking that target. The WoW gaming
infrastructure provides ample information for network development through the data
passed during WoW messages, such as country and time zone information, local IP
addresses and realm server addresses. In terms of active target development, there are
clear parallels: traditional SIGINT development rnay follow emails, chat and buddy lists,
whereas WoW target development rnay follow character IDs and logons, gaming
communication channels and guilds.

(TS//SI//REL) MHS and GCHQ will continue to develop and collaborate on this
potentially lucrative venue.

(U) World of Warcraft




Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh