Title: SIGDEV Successes and Challenges of High Power Cordless Phones (HPCP)

Release Date: 2017-04-24

Document Date: 2004-09-17

Description: The High Power Cordless Phone Analysis cell was founded in 2003 after use of these "poor man's cellular" phones proliferated in the early 2000s. Analysts with this cell provide training about HPCP communication to other NSA staff, analyze intercepted communications, and develop new tools for working with this technology.

Document: DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL

(U) SIGDEV Successes and Challenges of High Power Cordless Phones
(HPCP)
FROM:
Chief, HPCP Analysis Cell (HAC), Meade Operations Center
Run Date: 09/17/2004
(C) HPCP, also known as Long Range Cordless Telephone (LRCT) is an inexpensive and versatile
technology sometimes referred to as "the poor man's cellular". It can be used to establish standalone networks, or to connect to a traditional public phone system via a standard PSTN* line.
HPCPs operate in FM mode in the VHF/UHF frequency ranges from 30Mhz - 930Mhz; transmit
voice, data, and fax traffic; and have impressive line-of-site ranges of from 5 to 150 kilometers.
In light of this, it is easy to understand why HPCP usage is rapidly increasing throughout the
world.
(C) Use of HPCP technology by the global community was initially found in the environment by
RAINFALL in 1998. In May 2001, a large number of HPCP phones were sold in Iraq, which was
validated through collection and survey efforts, thereby making it high-value exploitation for
NSA.
(S//SI) SIGINT Development (SIGDEV) Strategy & Governance (SSG) created the HAC in May
2003 to further the understanding of worldwide HPCP technology to enhance ongoing HPCP
SIGDEV efforts across the extended enterprise. The HAC's unique roles as a Center of Excellence
include, but are not limited to:
HPCP trend analysis,
consolidation and sharing of corporate HPCP knowledge,
coordination of HPCP SIGDEV,
analytical tool development and training, and the
development of general knowledge about HPCP communications.
HAC analysts also provide geolocational, network, and dialing analysis of HPCP metadata in
support of target development on a worldwide basis.
(S//SI) A HAC analyst conducting HPCP trend analysis saw the deteriorating political situation on
the ground in Haiti and initiated a baseline study of HPCP activity in there in early February
2004. He started by conducting a seven-day data pull of all HPCP Base Stations geolocated in
Haiti from the SIGINT Emitter Database (SEDB). Out of this pool of emitters, he conducted call
chaining on those with the heaviest call volume. He identified Base Station B3A8 operating in
Jacmel, Haiti, a suspected drug lord-controlled town, in contact with Haitian interim President
Boniface Alexander and the Interior Ministry's Zero Tolerance team. This data was immediately
passed to the Latin America and Caribbean Division (S2A3), which submitted a request for
overhead collection of the HPCP base station in Jacmel and the phone numbers tied to the
government ministries. S2A3 also asked for further assistance from the HAC for continued
SIGDEV support of the target.
(S//SI) HAC analysts have been to SOUTHCOM HQs to brief the J2* as to the necessity of HPCP
exploitation in the Latin American Area of Responsibility (AOR), specifically Colombia. Current
HAC projects also include tracking HPCP activity within the Sunni Triangle (specifically Baqubah,
Habbaniyah, Ar Ramadi, and Al Fallujah) and providing CENTCOM an HPCP baseline for all HPCP
activity that may be IED*-related along Highway 10 between Ar Ramadi and Baghdad in support
of the Global War On Terror.
(S//SI) There are currently more than 340 different models of HPCP in use throughout the
world. Collecting, identifying, and exploiting them is, and will continue to be, a real challenge to
the NSA. For more information about ongoing analytical efforts in the HAC visit the HAC
homepage . Type "go HAC" in your network browser and expand your knowledge of HPCP.

* (U) Notes:
PSTN = Public Switched Telephone Network
J2 = a Command's Director of Intelligence
IED = improvised explosive device
(U//FOUO) For some background on the Meade Operations Center, see the article The New
Meade Operations Center .

"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet
without the consent of S0121 (DL sid_comms)."

DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh