Title: Network Tradecraft Advancement Team

Release Date: 2014-12-04

Document Date: 2010-06-10

Description: This GCHQ document from June 2010 describes cooperation between members of the Five Eyes alliance, particularly Canada’s CSEC, on the technical analysis of international mobile phone networks: see the Intercept article Operation Auroragold: How the NSA Hacks Cellphone Networks Worldwide, 4 December 2014.

Document: Network Tradecraft Advancement Team (NTAT) 3G

> 2nd SCAMP at CSEC process

■ Worked with CSEC H3 developers to implement IRASCIABLE RABBIT into
OLYMPIA

■ Developed 41 use cases

■ Developed 10 new working aids

■ Identified 3 new QFDs

■ Research conducted on GRX operators over VPN (QFD: IRASCIABLE
HARE)

■ Progressed IR21 sharing and analysis

■ Explored other GSMA Association for network intelligence

■ Progressed signalling over IP analysis (QFD: BOLSHIE POSSUM)

■ MNO EEI target template in development

■ Identified training scenario

■ Conducted real-world training scenario

■ Tied together target analysis to network analysis process

■ Use cases and working aids follow a layered template

■ Research conducted on clearing house operators - identified key
documentation and selectors

■ Explored the usefulness of IR21 processing - decided against this

■ Integrated TOYGRIPPE analysis into OLYMPIA

■ Streamlined identification of VPNs of interest for crypt analysis

TOP SECRET//COMINT//REL TO USA, FVEY//20320108