Title: STELLARWIND classification guide

Release Date: 2014-03-12

Document Date: 2009-01-01

Description: This classification guide from 2009 describes different elements of the Bush-era warrantless wiretapping programme. In particular, the guide casts light on the FISA Court’s permissive “Large Content” orders of January 2007. The revision of these expansive court orders in April that year led to the formulation of the August 2007 Protect America Act: see the […]

Document: TOP SECRET//SI//ORCON/NOFORN

NATIONAL SECURITY AGENCY
CENTRAL SECURITY SERVICE

(U//FOUO) STELLARWIND Classification Guide

(2-400)

Effective Date: 21 January 2 009

Kejch B. Alexander,
Lieutenant General, USA
Director, NS A

Reason(s) for Classification:

E.0.12598,1.4(c)

Declassify on: 25 Years*

Endorsed by:

Associate Director, CIPR

TOP SECRET//SI//ORCON/NOFORN

TOP SECRET//SI//ORCON/NOFORN

(U//FOUO) STELLARWIND Classification Guide

(U) National Security Agency/Central Security Service (NSA/CSS): Classification Guide Number: 2-400
(U//FOUO) Project/Activity Name: STELLARWIND (STLW)

(U) Office of Origin: NSA/CSS Signals Intelligence Directorate (SID)

(U//FOUO) POC: William J. Amass, CT Special Projects
(U) Phone: 963-0087/963-0491 (s)

(U//FOUO) Classified By: Keith B. Alexander, Lieutenant General, United States Army, Director, National Security Agency.

(U) Declassify On: 25 Years*

(U//FOUO) Note: This guide provides classification guidance for information requiring marking and handling under the STELLARWIND special
compartment.

(TS//SI//NF) In Januaiy 2008, the Director of National Intelligence authorized certain information associated with STELLARWIND, as well as
related information authorized under Foreign Intelligence Surveillance Court (FISC) orders (such as the Large Content Foreign Intelligence
Surveillance Act (FISA) orders, Business Records (BR) FISA orders and the Pen Register Trap and Trace (PR/TT) FISA orders), to be removed from
the STELLARWIND compartment. This guide addresses information associated with STELLARWIND and associated classification instructions,
while classification guidance associated with FISA information can be found, in one location, in an NSA/CSS FISA/Protect America Act
(PAA)/FISA Amendments Act (FAA) classification guide authored by NSA SID Oversight and Compliance (SV). Consequently, this document will
reference an NSA/CSS FISA/PAA/FAA classification guidance where information formerly associated with STELLARWIND is now authorized by
the FISC. Also, this document references classification guidelines for FISA/PAA/FAA information and within Exceptionally Controlled Information
(ECI) compartments within NSA where necessary. Users should reference both guides to determine proper classification. Additional Annexes are
provided as additional information to assist the users of this guide.

(TS//SI//NF) The markings “TSP” and “Compartmented” were at times used in briefing materials and documentation associated with the
STELLARWIND program. “TSP” and “Compartmented” were used primarily by the National Security Agency (NSA) Legislative Affairs Office
(LAO), NSA Office of General Counsel (OGC), and the Executive Branch in briefings and declarations intended for external audiences, such as
Congress and the courts. The term “TSP” was initially used in relation to only that portion of the Program that was publicly disclosed by the

TOP SECRET//SI//ORCON/NOFORN

TOP SECRET//SI//ORCON/NOFORN

President in December 2005. These markings should be considered the same as the STELLAR WIND marking, but should not be directly
associated with the program. The identifier “STARBURST” was also used in the earliest days of the program and should also be considered the
same as “STELLARWIND.”

Description of Information Classification Reason Declassification Remarks
/Markings Date

1. (U) The fact that NS A had Presidential authority to intercept the international communications of people with known links to al Qaida and related terrorist organizations. UNCLASSIFIED N/A N/A (U) “I authorized the National Security Agency, consistent with U.S. law and the Constitution, to intercept the international communications of people with known links to Al Qaida and related terrorist organizations.”
(U) Presidential public statement on 17 December 2005 from the Roosevelt Room in the White House.
2. (U) The fact that activities conducted under Presidential authorization have helped detect and prevent possible terrorist attacks in the United States and abroad. UNCLASSIFIED N/A N/A (U) “And the activities conducted under this authorization have helped detect and prevent possible terrorist attacks in the United States and abroad.”
(U) Presidential public statement on 17 December 2005 from the Roosevelt Room in the White House.

TOP SECRET//SI//ORCON/NOFORN

2

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
3. (U) The fact that activities authorized under Presidential authority were reviewed approximately every 45 days. UNCLASSIFIED N/A N/A (U) “The activities I authorized are reviewed approximately every 45 days.” (U) Presidential public statement on 17 December 2005 from the Roosevelt Room in the White House.
4. (U) The fact that the Program authorized by the President was reauthorized more than 30 times. UNCLASSIFIED N/A N/A (U) “I have reauthorized this program more than 30 times since the September the 11th attacks...” (U) Presidential public statement on 17 December 2005 from the Roosevelt Room in the White House.
5. (U) The fact that Leaders in Congress were briefed more than a dozen times on the Presidential authorizations and the activities conducted under them. UNCLASSIFIED N/A N/A (U) “Leaders in Congress have been briefed more than a dozen times on this authorization and the activities conducted under it.” (U) Presidential public statement on 17 December 2005 from the Roosevelt Room in the White House.

TOP SECRET//SI//ORCON/NOFORN

3

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
6. (U) The names of members of Congress who received Terrorist Surveillance Program (TSP) briefings and dates of those briefings. UNCLASSIFIED N/A N/A (U) Only Congressional members’ names (with dates of respective briefings) were released. (U) Unclassified list of Congressional names and briefing dates released by ODNI in May 06. Contact NSA OGC or LAO for the list.
7. (U) The fact that the Presidential authorization permitted NSA to intercept contents of communications where one party to the communication was outside the United States. UNCLASSIFIED N/A N/A (U) “The President has authorized a program to engage in electronic surveillance of a particular kind, and this would be the intercepts of contents of communications where one of the - one party to the communication is outside the United States.” (U) Attorney General Alberto Gonzales public statement at the News Conference on 19 December 2005 regarding NSA surveillance with White House Press Secretary McClellan.
8. (U) The term “STELLARWIND” with no further context. UNCLASSIFIED N/A N/A (U//FOUO) The term “STELLARWIND” or the abbreviation “STLW” when standing alone is UNCLASSIFIED.

TOP SECRET//SI//ORCON/NOFORN

4

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
9. (U) Official Executive Branch statements specifically associating TSP, the collection of phone communications, and NS A involvement with no amplifying details. UNCLASSIFIED N/A N/A (U) “As this description demonstrates, the terrorist surveillance program described by the President is very narrow. Because it is focused on international calls of individuals linked to al Qaeda « (U) Public statement by Attorney General Gonzales at Ask the White House forum 25 January 2006. (U) “The particular aspect of these activities that the President publicly described was limited to the targeting for interception without a court order of international communications of al Qaeda and affiliated terrorist organizations coming into or going out of the United States.” (U) Unclassified letter from the Director of National Intelligence J.M. McConnell to Senator Arlen Specter on 31 July 2007.
10. (S//NF) The fact that STELLARWIND, with no further context, is an anti-terrorism program. SECRET//NOFORN Executive Order 12958, as amended, Paragraph 1.4(c) (hereafter 1.4(c)) 25 Years*

TOP SECRET//SI//ORCON/NOFORN

5

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
11. (S//NF) The fact that the Presidentially- authorized TSP at NSA was a component of STELLARWIND. SECRET//NOFORN 1.4(c) 25 Years*
12. (U//FOUO) The association of the terms STELLARWIND and NSA - no further details. UNCLASIFIED// FOUO Freedom of Information Act Exemption3 (hereafter Exemption 3) N/A
13. (S//NF) The terms and markings “TSP” or “COMPARTMENTED” or STARBURST when associated with the STELLARWIND cover term and NSA. SECRET//NOFORN 1.4(c) 25 Years* (S//NF) This classification determination classifies the fact that “TSP”, STARBURST and “COMPARTMENTED” markings were used to identify the STELLARWIND program.
14. (TS//SI//NF) Association of the STELLARWIND Program (with no additional details) with: a. Activity under the Large Content FISA (LCF) and/or; b. activity under the Protect America Act (PAA). TOP SECRET//SI// NOFORN 1.4(c) 25 Years* (TS//SI//NF) Clarifies that the sequence of transition events leading up to PAA enactment and its associated operational considerations do not require STLW compartmented protection for LCF and PAA data.
15. (U//FOUO) The fact that a specific single individual of the Executive Branch is cleared for access to STELLARWIND with no amplifying details where such information has not been publicly released by the Executive Branch. UNCLASSIFIED// FOUO Exemption 3 N/A (U//FOUO) Information that a specific individual in the Executive Branch is cleared for STLW with no amplifying details may be protected from disclosure under FOIA.

TOP SECRET//SI//ORCON/NOFORN

6

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
16. (U//FOUO) The full list of all individuals cleared for STELLARWIND or who had access to STELLARWIND data. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (S//NF) The full list of ah individuals cleared for STELLARWIND or who had access to STELLARWIND data is classified TOP SECRET//STLW/SI// ORCON/NOFORN due to identifiable relationships between individuals and with other agencies, to include name, organization, and position. Classified due to revealing the totality of the STLW program.
17. (U//FOUO) The entire listing of NSA personnel cleared for STELLARWIND 1.4(c) 25 Years* —
a. (U//FOUO) with no amplifying details (such as detailed organization, mission, role, etc.). a. TOP SECRET// NOFORN
b. (U//FOUO) with amplifying details. b. TOP SECRET//SI// NOFORN

TOP SECRET//SI//ORCON/NOFORN

7

TOP SECRET//SI//ORCON/NOFORN

Description of Information

Classification

/Markings

Reason

Declassification

Date

Remarks

18. (U) Identity of Department of Justice
(DOJ) attorneys who publicly represent or
have represented NS A or have been publicly
identified as cleared for “TSP.”

UNCLASSIFIED
(U) See Remarks

Exemption 3

N/A

(U//FOUO) Comments:
Consult NSA OGC for a list of
those specific DOJ attorneys
whose association with the
TSP program is
UNCLASSIFIED.

(S//NF) This determination
addresses the fact that in many
cases the phrase “cleared for
TSP”, with no amplifying
details, was used to identify
DOJ attorneys working STLW
program matters.

19. (U//FOUO) Names of Executive (not
including NSA), Legislative, or Judicial
Branch personnel cleared for STLW who
have not been publicly identified by the
Executive Branch.

TOP SECRET//STLW//
SI//ORCON/N OF ORN

1.4(c)

25 Years*

(U//FOUO) The names of
specific individuals in the
Government who have not
been publicly identified by the
Executive Branch as cleared
for STLW remains classified as
STLW because of identifiable
relationships between
individuals and with other
agencies, to include name,
organization, and position.

TOP SECRET//SI//ORCON/NOFORN

8

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
20. (TS//SI//NF) STLW counterterrorism information used to evaluate the quantity or value of STELLARWIND collection based on products/tippers/leads provided without reference to targets, methods or techniques. TOP SECRET//SI// ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//OC/NF) Specifically addresses the number of reports, tippers, or leads generated under STLW. Any information revealing or naming Special Source Operations (SSO) programs supporting STELLARWIND must also include additional markings/Exceptional Controlled Information (ECI)s for the program(s) as specified by SSO.
21. (TS//SI//NF) Information that reveals the scope of STELLARWIND collection against various methods of communication, including voice, data networks, facsimile, etc. without details of the special authorization TOP SECRET//SI// ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//NF) This classification determination allows information concerning the fact of various methods of collection under STLW, and subsequently authorized under FISA (17 Jan 2007) or PAA (5 Aug 2007), to be handled outside of STLW compartmented channels - Example: Data Flow X is Digital Network Intelligence (DNI) collection under the STLW program - no further details.

TOP SECRET//SI//ORCON/NOFORN

9

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
22. (TS//SI//NF) Information that reveals the breadth and success of STELLAR WIND collection against specific terrorism-related entities such as the number of tippers published, number of published product reports, and numbers of Requests for Information answered without detailing target selectors, without details of the special authorization TOP SECRET//SI// ORCON/NOFORN 1.4(c) 25 Years* Example: (TS//SI//OC/NF) The number of Requests For Information (RFIs) generated under the STELLARWIND program was 15,000.
23. (TS//SI//NF) Information that reveals details of the operational relationship between the STELLARWIND program, the FISA Large Content, FISA BR, and FISA PR/TT Orders, the PAA collections, and the FAA collections. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (C//SI//REL TO USA, FVEY) Note: SSO may require that this information be marked with additional caveats (ECI WPG for WHIPGENIE). Please see the ECI WPG classification guide. (TS//SI//NF) Information comparing ongoing FISA/PAA/FAA operations to the specifics of the Presidentially-Authorized Program will remain compartmented as STLW.
24. (TS//SI//NF) STLW counterterrorism listings or reports detailing the totality of specific techniques and selectors targeted under the STELLARWIND program TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//NF) Dictates that all program reports & briefings containing detailed STELLARWIND target lists or specific techniques, with association to the special authorization continue to be marked TOP SECRET//STLW/ SI//ORCON/NOFORN (U) See also Portal section.

TOP SECRET//SI//ORCON/NOFORN

10

TOP SECRET//SI//ORCON/NOFORN

Description of Information

Classification

/Markings

Reason

Declassification

Date

Remarks

25. (S//NF) Information that reveals the
scope of operations under the Presidential
authorization. (Such as collection
techniques, targets, or other operational
details)

26. (U//FOUO) The fact of FBI collaboration
on the STELLARWIND program

a. (U//FOUO) The association
of the terms

STELLARWIND and FBI

b. (U//FOUO) The fact that
NSA provided the FBI
information collected under
the Presidentially Authorized
program.

c. (S//NF) The fact that FBI
played an operational role in
the program and details
describing that role.

TOP SECRET//STLW/
SI//ORCON/NOFORN

1.4(c)

25 Years*

a. UNCLASSIFIED//
FOUO

b. UNCLASSIFIED//
FOUO

c. SECRET//NOFORN

Exemption 3

Exemption 3

1.4(c)

N/A

N/A

25 Years*

(S//NF) Information that
summarizes or otherwise
specifies the scope of
operations authorized by the
President, but not publicly
disclosed, remains
compartmented. Example:
Program Briefings, Program
Memos, NSA LAO & NSA
OGC summaries, etc.

(S//NF) Operational details
about collaboration between
NSA and FBI and FBI’s
involvement in the STLW
program (such as specific
targets, specific sources,
methods, etc.) will raise the
classification to
TOP SECRET//STLW/SI//
ORCON/NOFORN

TOP SECRET//SI//ORCON/NOFORN

11

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification Reason Declassification Remarks
/Markings Date
27. (U//FOUO) The fact of CIA (S//NF) Operational details
collaboration on the STELLARWIND about collaboration between
program a. UNCLASSIFIED// Exemption 3 N/A NSA and CIA and CIA’s involvement in the STLW
a. (U//FOUO) The association FOUO program (such as specific
of the terms targets, specific sources,
STELLARWIND and CIA b. UNCLASSIFIED// Exemption 3 N/A methods, etc.) will raise the classification to
b. (U//FOUO) The fact that FOUO TOP SECRET//STLW/SI//
NSA provided the CIA information collected under the Presidentially Authorized program. c. SECRET//NOFORN 1.4(c) 25 Years* ORCON/NOFORN
c. (S//NF) The fact that CIA
played an operational role in the program and details describing that role.

TOP SECRET//SI//ORCON/NOFORN

12

TOP SECRET//SI//ORCON/NOFORN

Description of Information

Classification

/Markings

Reason

Declassification

Date

Remarks

28. (U) Information about communications
providers.

a. (U) The fact that

communications service
providers provide assistance
in national security activities

b. (TS//SI//NF) Information
revealing the cooperative
relationships with, and
identities of, U.S.
telecommunications
providers under the
STELLARWIND
authorities.

UNCLASSIFIED

N/A

N/A

TOP SECRET//STLW/
SI//ORCON/NOFORN

1.4(c)

25 Years*

29. (U//FOUO) Aggregate program funding
information associated only with the
STELLARWIND cover term.

TOP SECRET//SI//
NOFORN

1.4(c)

25 Years*

(U) electronic
communication service
providers play an important
role in assisting intelligence
officials in national security
activities. Indeed, the
intelligence community cannot
obtain the intelligence it needs
without assistance from these
companies.”

(U) From the 26 October 2007
Senate Select Committee on
Intelligence report: “Foreign
Intelligence Surveillance Act
of 1978 Amendments Act of
2007.”

(U) See also: Unclassified
testimony of Kenneth L.
Wainstein, Assistant Attorney
General, National Security
Division, before Senate
Committee on the Judiciary on
31 October 2007.

(U) Details may require
additional protection within an
ECI.

TOP SECRET//SI//ORCON/NOFORN

13

TOP SECRET//SI//ORCON/NOFORN

Description of Information

Classification

/Markings

Reason

Declassification

Date

Remarks

30. (U//FOUO) Detailed programmatic
information that reveals the overall cost of
the STELLARWIND program in context
with operational details.

TOP SECRET//STLW/
SI//ORCON/NOFORN

1.4(c)

25 Years*

(U//FOUO) Information that
would provide an
understanding of the total
overall budget for the STLW
program remains
compartmented and is not
releasable to contractors.

31. (U//FOUO) Budget submissions or
information that reveals the detailed
technical characteristics of any individual
items funded by the STELLARWIND
program including size, capabilities, and
functions.

32. (TS//SI//NF) Specific details identifying
collection capabilities or capacities without
revealing the methods of STELLARWIND
counterterrorism target communications.

TOP SECRET//STLW/
SI//ORCON/NOFORN

1.4(c)

25 Years*

SECRET//SI//

REL TO USA, FVEY

At a minimum

1.4(c)

25 Years*

(U//FOUO) Information that
would provide an
understanding of the total
overall budget for the STLW
program remains
compartmented and is not
releasable to contractors.

(C//SI//REL TO USA, FVEY)
May be TOP SECRET or
NOFORN if source details are
provided. Special compartment
marking based on SSO
guidance (ECI WPG) required
if source details are included.

TOP SECRET//SI//ORCON/NOFORN

14

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
33. (TS//SI//NF) Information that reveals in any way the location of facilities that provided access and/or collection whether in summary or detailed terms and is associated with STELLARWIND. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (C//SI//REL TO USA, FVEY) Information that would provide an understanding of the partnership/location for the program is covered by the ECI WPG SSO compartment. (C//SI//REL TO USA, FVEY) This information is also protected by the SSO compartment (ECI WPG).
34. (TS//SI//NF) Dataflows or associated data created to support collection derived from STELLARWIND program without revealing the details of the Presidential authorization. TOP SECRET//SI// NOFORN 1.4(c) 25 Years* (TS//SI//NF) Clarifies that the sequence of transition events leading up to PAA enactment and its associated operational considerations do not require STLW compartmented protection for LCF and PAA data.
35. (U//FOUO) Specific performance parameters for search analysis detection or selection. TOP SECRET//SI// NOFORN 1.4(c) 25 Years* (TS//SI/NF) For example, response times, capacities, and loading would reveal operational details of program.
36. (S//NF) Descriptions, diagrams, schematics, or other technical documentation that identifies specific SIGINT methods, techniques and devices used to select, filter and process STELLARWIND target communications without specific reference to the authorization and details concerning the creation of the STELLARWIND program. TOP SECRET//SI// ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Information may be otherwise controlled/ compartmented by SSO. Amplifying details may be protected within an ECI.

TOP SECRET//SI//ORCON/NOFORN

15

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
37. (TS//SI//NF) Metadata analysis and target development, techniques, and results conducted under the STELLARWIND program, with no details about the special authorization or the access points from which we have gathered the data. TOP SECRET//SI// ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Information currently marked as STLW (such as reports, database records, etc.) remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Program specifics concerning output and analytic results may be downgraded to TOP SECRET//SI//ORCON/ NOFORN, but information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, S12 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point.

TOP SECRET//SI//ORCON/NOFORN

16

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
38. (TS//SI//NF) Information revealing the fact that a specific terrorism-related group had been targeted using the STELLARWIND authorities - no details about the special authorization. TOP SECRET//SI// ORCON/NOFORN 1.4(c) 25 Years* (S//NF) Specific individual STELLARWIND Terrorism targets will be classified TOP SECRET//STLW/SI//OC/NF. However, large entities such as a terrorist group do not require compartmentation. The STLW Program Manager Office (PMO) documents, such as PMO memos, revealing groups targeted and effective dates remain STLW-compartmented.

(TS//SI//NF) METADATA (DIGITAL NETWORK INTELLIGENCE (DNI)) and DIALED NUMBER RECOGNITION (DNR)) INFORMATION

39. (TS//SI//NF) Digital Network Intelligence (DNI) metadata acquired under Presidential authorization (pre-17 July 2004 metadata) TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//NF) The pre-17 July 2004 metadata repository is embargoed and remains in the STLW compartment. Access to it requires coordination with NS A OGC as it may implicate certain FISA court orders.
(U//FOUO) This data is not on- line and is sequestered.
(U) See Annex A for additional details.

TOP SECRET//SI//ORCON/NOFORN

17

TOP SECRET//SI//ORCON/NOFORN

Description of Information

40. (TS//SI//NF) Dialed Number
Recognition metadata acquired under
Presidential authorization (pre 24 May 2006
metadata archive)

Classification

/Markings

TOP SECRET//SI//
NOFORN

Reason

1.4(c)

Declassification

Date

Remarks

25 Years*

(U//FOUO) Information
currently marked as STLW
(such as reports, database
records, etc.) remains
compartmented until
appropriate action is taken
under Executive Order 12958,
as amended. Program specifics
concerning output and analytic
results may be downgraded to

TOP SECRET//SI//ORCON/

NOFORN, but information
may not be removed from the
STLW compartment without
approval from an appropriate
Original Classification
Authority and in coordination
with the appropriate SIGINT
authority (STLW Program
Manager (PM) or D/PM, S12
Information Sharing Services,
and NSA OGC). TheNSA
OGC can be used as an initial
POC/contact point.

(TS//SI//NF) Access to the pre-
May 2006 metadata archive is
at the TS//SI//OC/NF level.
However, the data must be
traceable by authorization (e.g.,
Presidential Directive).

(U) See Annex A for additional
details.

TOP SECRET//SI//ORCON/NOFORN

18

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
41. (TS//SI//NF) Content Analysis using STELLARWIND derived information to develop lead information or to report on the activities of specific terrorism-related entities. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Target Office will add ORCON and NOFORN caveats to all intelligence products derived from STELLARWIND-authorized accesses. (U//FOUO) Information currently marked as STLW (such as reports, database records, etc.) remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Program specifics concerning output and analytic results may be downgraded to TOP SECRET//SI//ORCON/ NOFORN, but information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, SI2 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point. (TS//SI//NF) Access to data identified by STELLARWIND SIGINT Address (hereafter SIGAD US3170) will be

TOP SECRET//SI//ORCON/NOFORN

19

TOP SECRET//SI//ORCON/NOFORN

Description of Information

Classification

/Markings

Reason

Declassification

Date

Remarks

allowed on a case-by-case
basis by the STLW Program
Manager. Reporting derived
from this collection must be
clearly identified as to source.

42. (TS//SI//NF) The SIGINT address TOP SECRET//SI// 1.4(c) 25 Years*
(SIGAD) US3170 when associated with the NOFORN
STELLARWIND program and content
collection.

TOP SECRET//SI//ORCON/NOFORN

20

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
43. (TS//SI//NF) Unevaluated, unminimized content intercept alone, identified with SIGAD US3170, without knowledge of access techniques. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Information currently marked as STLW (such as reports, database records, etc.) remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Program specifics concerning output and analytic results may be downgraded to TOP SECRET//SI//ORCON/ NOFORN, but information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, S12 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point. (TS//SI//NF) Access to data identified by SIGAD US3170 will be allowed on a case-by- case basis by the STLW Program Manager. Reporting derived from this collection must be clearly identified as to source.

TOP SECRET//SI//ORCON/NOFORN

21

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
44. (TS//SI//NF) Processed traffic labeled with S1GAD US3170 (such as verbatim transcripts, transcription notes or other related information) that does not disclose specific methods or techniques as associated with STELLARWIND authorizations. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U) See Remark for 43.
45. (TS//SI//NF) Program traffic, acquired from accesses but never disseminated and not associated with SIGAD 3170, such as unevaluated, unminimized, verbatim transcript or gisted traffic that does not disclose specific methods or techniques as associated with authorizations TOP SECRET//SI// NOFORN 1.4(c) 25 Years* (U//FOUO) Access to program material such as this should be coordinated with NS A OGC and the appropriate SIGINT authority. The NS A OGC can be used as an initial POC/contact point.
46. (U//FOUO) Association of specific tasking to a specific STELLARWIND data source. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Information currently marked as STLW remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, S12 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point.

TOP SECRET//SI//ORCON/NOFORN

22

TOP SECRET//SI//ORCON/NOFORN

Description of Information

Classification

/Markings

Reason

Declassification

Date

Remarks

47. (TS//SI//NF) Information that reveals the
specific telephone number or email address
of a targeted terrorism-related entity or
individual tasked with STELLARWIND
authorities.

TOP SECRET//STLW/
SI//ORCON/NOFORN

1.4(c)

25 Years*

(U//FOUO) Information
currently marked as STLW
remains compartmented until
appropriate action is taken
under Executive Order 12958,
as amended. Information may
not be removed from the
STLW compartment without
approval from an appropriate
Original Classification
Authority and in coordination
with the appropriate SIGINT
authority (STLW Program
Manager (PM) or D/PM, S12
Information Sharing Services,
and NSA OGC). TheNSA
OGC can be used as an initial
POC/contact point.

48. (U//FOUO) Analyst Holdings (hardcopy
and softcopy)- Documentation marked as
STELLARWIND.

TOP SECRET//STLW/
SI//ORCON/NOFORN

1.4(c)

25 Years*

(U//FOUO) The records review
and administrative debriefing
process will be used to help
inform analysts on what steps
to take concerning their
personal records.

(U//FOUO) Continue to protect
as STLW. See Annex B.





.**.



TOP SECRET//SI//ORCON/NOFORN

23

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
49. (U//FOUO) Any document related to STLW Program Management decisions (Program Memos, Due Diligence Notes, etc.) TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) These documents will be available from the portal only to STLW PMO personnel or to other STLW authorized and cleared individuals.
50. (TS//SI//NF) Documentation concerning FISA PR/TT and FISA BR court orders such as: • Declarations • Applications • Court Orders (Primary and Secondary) • Reports or updates • Associated motions TOP SECRET//SI// NOFORN 1.4(c) 25 Years* (TS//SI//NF) Remove from the STLW compartment - see the appropriate NSA/CSS FISA/PAA/FAA and ECI WPG classification guide. (TS//SI//NF) Court Orders, required reporting, Applications, Declarations, and associated motions contain NS A ECI information, but are not marked as such because of guidelines on how court documents are marked and handled. Therefore, they require additional controls and protection and must be handled internally as ECI.

TOP SECRET//SI//ORCON/NOFORN

24

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
53. (TS//SI//NF) STLW counterterrorism information contained in the Requests For Information (RFI) segment of the Numbers database, currently marked STLW. TOP SECRET// STLW/SI//ORCON/ NOFORN 1.4(c) 25 Years* (U//FOUO) Restrict access to the legacy RFI information on the portal to all but a cadre of cleared SIGINT Intelligence Directorate Counterterrorism personnel. RFIs will be used to identify information needed to be reviewed and subsequently removed from the STLW compartment.
(U//FOUO) Information currently marked as STLW remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, SI2 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point.
54. (TS//SI//NF) Digital Network Intelligence (DNI) Metadata Reports - Includes all metadata reporting derived from special authorization or FISA court authorization and currently marked TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//NF) Although the Director of National Intelligence decision (see introduction section of this guide) allowed NSA to remove

TOP SECRET//SI//ORCON/NOFORN 27

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
STELLARWIND. certain data from the STLW compartment, not all legacy data (to include reporting) was automatically removed from the STLW compartment. Consequently there is reporting in the STLW databases that is eligible to be removed from the compartment, but was not. The data still carries a STLW marking and must be protected as such until it is formally removed from the compartment. Consequently, it is necessary to restrict access to existing reports to all but a cadre of cleared SIGINT Intelligence Directorate Counterterrorism personnel. Additional RFI can be used to identify information needed to be reviewed and subsequently removed from the STLW compartment. Distribution may be expanded. If reporting is removed from the STLW compartment and reissued, procedures must be in place so that the source of the information can be readily determined. (U//FOUO) Information currently marked as STLW remains compartmented until appropriate action is taken

TOP SECRET//SI//ORCON/NOFORN

28

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, S12 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point. (U//FOUO) Maintain STELLARWIND controls on existing reports. Remove from the STLW compartment and release in new format if required. Individual reports may be reclassified to TOP SECRET//SI// ORCON/NOFORN, but must be cancelled and reissued, in the new format, at the new classification, after decompartmentation. Tearlines cannot be re-distributed without reissuing the original report.
55. (TS//SI//NF) Dialed Number Recognition (DNR) Metadata Reports Includes all metadata reporting derived from special authorization or FISA court TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//NF) Although the Director of National Intelligence decision (see introduction section of this

TOP SECRET//SI//ORCON/NOFORN

29

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
authorization and currently marked STELLARWIND guide) allowed NSA to remove certain data from the STLW compartment, not all legacy data (to include reporting) was automatically removed from the STLW compartment. Consequently there is reporting in the STLW databases that is eligible to be removed from the compartment, but was not. The data still carries a STLW marking and must be protected as such until it is formally removed from the compartment. Consequently, it is necessary to restrict access to existing reports to all but a cadre of cleared SIGINT Intelligence Directorate Counterterrorism personnel. Additional RFI can be used to identify information needed to be reviewed and subsequently removed from the STLW compartment. Distribution may be expanded. If reporting is removed from the STLW compartment and reissued, procedures must be in place so that the source of the information can be readily determined. (U//FOUO) Information currently marked as STLW remains compartmented until

TOP SECRET//SI//ORCON/NOFORN

30

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
appropriate action is taken under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, S12 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point (U//FOUO) Maintain STELLARWIND controls on existing reports. Remove from the STLW compartment and release in new format if required. Individual reports may be reclassified to TOP SECRET//SI// ORCON/NOFORN, but must be cancelled and reissued, in the new format, at the new classification, after decompartmentation. Tearlines cannot be re-distributed without reissuing the original report.
56. (TS//SI//NF) NSA/CSS disseminated serialized STLW product derived from STELLARWIND and currently marked TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (TS//SI//NF) Although the Director of National Intelligence decision (see

TOP SECRET//SI//ORCON/NOFORN

31

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
STELLARWIND introduction section of this guide) allowed NS A to remove certain data from the STLW compartment, not all legacy data (to include reporting) was automatically removed from the STLW compartment. Consequently there is reporting in the STLW databases that is eligible to be removed from the compartment, but was not. The data still carries a STLW marking and must be protected as such until it is formally removed from the compartment. Consequently, it is necessary to restrict access to existing reports to all but a cadre of cleared SIGINT Intelligence Directorate Counterterrorism personnel. Additional RFI can be used to identify information needed to be reviewed and subsequently removed from the STLW compartment. Distribution may be expanded. If reporting is removed from the STLW compartment and reissued, procedures must be in place so that the source of the information can be readily determined. (U//FOUO) Information currently marked as STLW

TOP SECRET//SI//ORCON/NOFORN

32

TOP SECRET//SI//ORCON/NOFORN

Description of information

Classification

/Markings

Reason

Declassification

Date

Remarks

remains compartmented until
appropriate action is taken
under Executive Order 12958,
as amended. Information may
not be removed from the
STLW compartment without
approval from an appropriate
Original Classification
Authority and in coordination
with the appropriate SIGINT
authority (STLW Program
Manager (PM) or D/PM, S12
Information Sharing Services,
and NSA OGC). TheNSA
OGC can be used as an initial
POC/contact point.

(U//FOUO) Maintain
STELLARWIND controls on
existing reports. Remove from
the STLW compartment and
release in new format if
required. Individual reports
may be reclassified to TOP
SECRET//SI//

ORCON/NOFORN, but must
be cancelled and reissued, in
the new format, at the new
classification, after
decompartmentation. Tearlines
cannot be re-distributed
without reissuing the original
report.

TOP SECRET//SI//ORCON/NOFORN

33

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
57. (TS//SI//NF) STLW PMO counterterrorism documentation such as Program Memorandum or other Program Management Office documentation currently marked STELLARWIND. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Remains protected under the STLW compartment. Information currently marked as STLW remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, SI2 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point.

TOP SECRET//SI//ORCON/NOFORN

34

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
58. (U//FOUO) NS A OGC documentation currently marked STELLARWIND. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Remains protected under the STLW compartment. Information currently marked as STLW remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, S12 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point.

TOP SECRET//SI//ORCON/NOFORN

35

TOP SECRET//SI//ORCON/NOFORN

Description of Information Classification /Markings Reason Declassification Date Remarks
59. (U//FOUO) NSA IG documentation currently marked STELLAR WIND. TOP SECRET//STLW/ SI//ORCON/NOFORN 1.4(c) 25 Years* (U//FOUO) Remains protected under the STLW compartment. Information currently marked as STLW remains compartmented until appropriate action is taken under Executive Order 12958, as amended. Information may not be removed from the STLW compartment without approval from an appropriate Original Classification Authority and in coordination with the appropriate SIGINT authority (STLW Program Manager (PM) or D/PM, SI2 Information Sharing Services, and NSA OGC). TheNSA OGC can be used as an initial POC/contact point.

*25 years: Declassification in 25 years indicates that the information is classified for 25 years from the date a document is created or 25 years from the date of this
original classification decision, whichever is later.

(U) ANNEX A:

(TS//SI//NF) FISA PR/TT and BR

(TS//SI//NF) Information acquired under court authorization via FISA PRATT or FISA BR, but currently marked STLW (e.g. FISA PR/TT or FISA BR
information commingled in databases with other STLW information, or otherwise controlled as STLW due to overlapping authorizations), is eligible to be
removed from the STLW compartment. However, information may not be removed from the STLW compartment without appropriate action by an original
classification authority under Executive Order 12958, as amended, or coordination with the STLW Program Manager (PM) or D/PM, S12 Information Sharing

TOP SECRET//SI//ORCON/NOFORN

36

TOP SECRET//SI//ORCON/NOFORN

Services, and OGC. The NSA OGC can be used as an initial POC/contact point. Although compartmented controls may be removed from the FISA PR/TT and
FISA BR information currently marked STLW, court ordered access controls and classification guidelines must continue to be observed. Users should note that
classification guidance for FISA/PAA/FAA/FAA information can be found in an NSA/CSS FISA/PAA/FAA guide.

(TS//SI//NF) For example, the FISA/PAA/FAA classification guide should be consulted when deriving classification for FISA PR/TT or FISA BR information
currently marked STLW such as:

(TS//SI//NF) FISA PR/TT (initiated 17 July 2004)

1. (TS//SI//NF) FISA PR/TT information collected, stored, processed under FISA authorization.

2. (TS//SI//NF) FISA PR/TT targeting information - email address forms, query requests and approvals, selectors queried, query results, alert lists.

3. (TS//SI//NF) FISA PR/TT-related Mainway databases, realms & data flows and all related technical data, collection statistics, and software.

4. (TS//SI//NF) FISA PR/TT-related working aids, briefing materials, query logs, etc.

(TS//SI//NF) BR FISA (initiated 24 May 2006)_________________________

1. (TS//SI//NF) FISA BR information collected, stored, processed under FISA authorization.

2. (TS//SI//NF) FISA BR targeting information - address forms, query requests and approvals, selectors queried, query results, alert lists, etc.

3. (TS//SI//NF) FISA BR-related Mainway Databases, realms & data flows and all related technical data, collection statistics, and software.

4. (TS//SI//NF) FISA BR-related Working Aids, briefing materials, query logs, etc.

(U) ANNEX B:

(U) Preservation Requirements and Other Related Issues

(U//FOUO) Documentation you have originated (memos, analytic summaries, etc.) - do not destroy/remove/delete. Please contact the SID PMO for questions.
Your records may constitute valuable temporary or permanent records and may be transferred to a designated official or records officer, records include documents
created regarding STLW policies, decisions, procedures and essential operational, logistical and support transactions.

(U//FOUO) SIGINT Reporting -You are authorized to retain published reporting marked with the STLW caveat, however further dissemination of the
information contained in those reports must be coordinated through the SIGINT Intelligence Directorate Counterterrorism RFI process and accurately sourced to
the original STLW report number/title.

TOP SECRET//SI//ORCON/NOFORN

37

TOP SECRET//SI//ORCON/NOFORN

(TS//SI//REL TO USA, FVEY) Other STLW information - Record Retention Order - In addition to your obligations under Federal Records Act and NSA Policy,
you are reminded that Judge Vaughn Walker, USDJ, issued a Preservation order on November 6, 2007 relating to litigation challenging the surveillance activities
authorized by the President after the attacks of September 11, 2001. You should preserve and retain any (hardcopy or electronic - including email) information,
documents or data that may be relevant to that litigation. If you have any questions about this obligation, you should contact your Office of General Counsel.

(S//NF) NSA-generated materials submitted to a court in support of ongoing litigation which contains facts that reveal scope and scale of the Presidentially
Authorized Program should be handled as STLW. Note: Many litigation documents were marked as TSP instead of STLW. These documents, and supporting
facts, relate directly to the special authorization and remain STLW-compartmented.

TOP SECRET//SI//ORCON/NOFORN

38

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh