Title: PullThrough Steering Group Meeting #16

Release Date: 2015-09-25

Document Date: 2008-02-29

Description: This set of GCHQ minutes from 29 February 2008 describes a set of tools that were under development at that point, including the metadata analysis tool KARMA POLICE: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 September 2015.

Document: pull-through-steering-group-minutes-p1-normal.gif:
TOP SECRET STRAP1

THQ/1202THQ/1900/0058
29 February 2008

PullThrough Steering Group Meeting #16

29 February 2008.

Distribute to: Invitees, GCWeb, SIGMOD-PU’s-GCHQ-dl, T-Domain-Heads-GCHQ-dl,
SigMod-BCM-Support-Team-GCHQ-dl

Apologies:

• None

Summary of prototypes in the process:

Briefly considered - MYOFIBRIL, addressed in Better Analysis bid.

Discussion of PTSG future

The future of ‘pull through’ and the PTSG was discussed in the context of
programmes, themes, product centres, the four box model, evolutionary
development, stripy teams etc.

The role of evaluation and championing of AR prototypes for further development
within the business was recognised by all as important for continuity, however no
specific conclusions were reached with respect to the relationship between the PTSG
and other organisational structures arising from business change, e.g. the CCBs that
have been proposed in the context of the 4 box model transition processes.

(Ed note: Worthwhile for the PTSG to consider this relationship further more formally)

New Prototypes seeking PTSG Approval:

SALTY OTTER |

4.

[/SALTY OTTER- submitted at TRL

B17 technique for finding cross-media timing patterns and incorporates the
CLASP algorithm, which is considered to be similar, yet more general than the

1 of 3

This information is exempt from disclosure under the Freedom of lnf< . . ~

other UK information legislation. Refer disclosure requests to GCHQ on

TOP SECRET STRAP1pull-through-steering-group-minutes-p2-normal.gif:
TOP SECRET STRAP1

THQ/1202THQ/1900/0058
29 February 2008

popular PRIME TIME, looks for cross-media timing chains, e.g. a telephone call
triggers a chat event.

ACTION: Ran out of time for discussion - to be brought back for next PSTG
session.

• KARMA POLICE - submitted at TRL 4.

KARMA POLICE aims to correlate every user visible to passive SIGINT with
every website they visit, hence providing either (a) a web browsing profile for every
visible user on the internet, or (b) a user profile for every visible website on the
internet.

For more details, refer to high-level overview document B/6760BA/5001/1.

Initial work with INOC shows high analyst usage of technique.

ACTION: To be progressed as a Better Analysis theme based requirement for
explore.

- noted that the legalities with respect to ‘content’ need to be cleared.

• ORB FINDER submitted at TRL 4.

Enables the identification of potential candidate Operational Relay Boxes (ORBs)
for use in CNE’s active exploitation network through passive logging, providing a
richer picture of the end-system, and consequently reducing CNE’s active footprint by
focussing attention to those candidates that meet a stricter set of criteria.

ACTION : To be progressed as a CNE theme based requirement for explore.

• MOOSE MILK ^^^^^^^M'MOOSE MILK - submitted at TRL 4.

A data mining algorithm devised by CTOR to detect suspicious use of telephone
kiosks in the UK. MOOSE MILK is currently being developed further by the
Operational Data Minina team in OPD-TAT.

ACTION: To be progressed as a Better Analysis Agility requirement for explore.

- noted that the timeliness of the tool depends on feeds in near-real time,
which have not been available so far.

LIGHTWOOD
a TRL rating given operational usage within JTRIG.

LIGHTWOOD - submitted to allocate

Extracts act email addresses from any character stream. What differentiates
LIGHTWOOD is its ability to distinguish valid email formats from those that appear to
be email addresses but are not for open Internet (e.g. better@management).

2 of 3

This information is exempt from disclosure under the Freedom of Information Act 2000 and
other UK information legislation. Refer disclosure requests to GCHQ



to exemi

under

TOP SECRET STRAP1pull-through-steering-group-minutes-p3-normal.gif:
TOP SECRET STRAP1

THQ/1202THQ/1900/0058
29 February 2008

The program also has a number of other email and URL detection capabilities that
standard regular expression extraction rules do not have. Some of these are
sensitive. Used operationally in JTRIG and to be used in MERA PEAK and
MONTEVISTA.

Accepted by PTSG as having attained TRL7. No further PTSG action.

Other Business

KED

KED needM^^n the SE rada^^^a^io^lear where th^ina^roduc^entre'
lay - to together with

There was some concern over programme allocation of resources to Mission
Management tasks more generally. .

Date Of Next Meeting

9 May 2008 10:30 AB3-M2

TPS IP-Activity Board SE

3 of 3

This information is exempt from disclosure under the Freedom of Information Act 2000 and
other UK information legislation. Refer disclosure requests to GCHQ on



to exemi

under

TOP SECRET STRAP1

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh