Title: Social Anthropoid

Release Date: 2015-09-25

Description: This undated GCHQ presentation describes SOCIAL ANTHROPOID, a “converged comms database” that analyses metadata from emails, instant messenger chats, social media connections and conversations, together with “telephony” metadata from phone calls, mobile phone locations, text and multimedia messages: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 […]

Document: social-anthropoid-briefing-p1-normal.gif:
SECRET STRAP1social-anthropoid-briefing-p2-normal.gif:
© What is Social Anthropoid?

■ A CONVERGED CCMMS DATABASE. IT

ALLOWS YCU TC SEE WHEN YOUR TARGETS
HAVE communicated:

■ VIA PHCNE

■ OVER THE INTERNET

■ DR USING CONVERGED CHANNELS(EG SENDING
E-MAILS FROM A PHONE OR MAKING VOICE CALLS
OVER THE INTERNET).

SECRET STRAP1social-anthropoid-briefing-p3-normal.gif:
SECRET STRAP1social-anthropoid-briefing-p4-normal.gif:
&

© Why?

■ Scaling — huge volumes of events,

EXISTING SYSTEMS ARE CREAKING.

■ Convergence.

■ Appropriate design.

©But still need td:-

■ Enrich

■ Visualise

■ Merge with NSA data sources

^GCHQ^

SECRET STRAP1social-anthropoid-briefing-p5-normal.gif:
©What data is in Social Anthropoid?

■ All of Salamanca

■ Social Animal

■ Instant Messenger

■ Webmail

■ SIP AND H323 VOIP, Yah□ □ Vdice

■ Blackberry

■ MMS

■ SMS

■ GTP (GPRS Session set ups)

■ SMTP, POP3 AND IMAPsocial-anthropoid-briefing-p6-normal.gif:
^CCHQ Query screensocial-anthropoid-briefing-p7-normal.gif:
m ra r>i m ra r>i

- dp ^ w Second stage query screen ^GCHQ
>CIKC I 31 wir 1
©SOCIAL ANTHROPOID“20* “-—I
/ ;*jerv flpif. -e>ut:^^^' -:es.': x Resuts:^^| *

Tour input term» notched 78 event» iron Sun, 08 Aug 7010 23:06:45 GMT to Fri, 21 Jan 2011 03:33:49 GMT.

Tou ms; restnct the selactcrs matching four npix terms bf selecbng from the values below, pnor to croceedng to (cur query results
Aif iiigHijhted selectors are ncrmaised versions -J jcur trip nil guer? s«dsT

Select al

De select all

Igrvsiljcwn (emal_aidress) - 2 oau-rences
gmailccn (Urlino«:) -1 occurrences
hctn*oi«m(Ui'l:nc«Ao) -1 occurrences
ive.se (0«ne') - 3 occurrences
ive.se ISerder) - S occurrences
ive.se (Urfcnown) - 33 occurrences

□ PTIDNAL

Corcrue

Filter results by matched selectors prior to displ|^

SECRET STRAP1social-anthropoid-briefing-p8-normal.gif:


ccHo Results screen


t*•**»- MfM.» I«* t**

O' C? ri> . - •

À H>* ***** . J C*07-or Jj ACr«v . J •>?-* lJ lUmtto*

VXIM AMHWOII>i Ww»ik aeorth

Will be better with

Brdadoak!

*W*>*

¿gvSOCIAL ANTHROPOID

UMf A
r«U

U*rr A »r»r U»rr A

U»f* A r*w VAliif

llM>r A
A»I»Uf

IUH Ul« I *• I HA(7 I IIUMlAI

U»pr n • vi»»- U*
Lc»79«d in •»

U»r» M

dtapUv

50—ov/OI
AitlT* u
- .«j

»on* C«1 im»i
»»« Ml im>»

*•»••• Ml im»»

*ow Ml t*l_nir*bir

*OM Ml Ml_ntmt»«r
Ml i4l_numbtr

S aotoctoro. duration: 00 01 5/

3

User B calls User A

I ■» «!«»«•

tourt« Polnt-Codo: 20?1

THTTTTT-

>0 *4ov 20
A«t»wo ua

Atli». »4M AltlOO

•oca col imu
»4M Ml imu

»4M Obi imu
*0
fagr I «• < >*

Header contains key info

• Date
•time,

• DURATION,

•tech universe,

• TECH TYPE
•ACTION

•active user

Ct>K«W

ur>)utg»

C>aplov Simmv» .) CSV C*©ort

riNn

To Alloc tt»4 roa-.li IK
^OMé «ö'/4 «.ton*
h pa,»»y 4M w»f"

C*p*r1

F * PO I f (>• lit»» ,»y

ÎArd oil

Do-««loot oil J

Hi»»»» •«!» rvPi*T*
Mit»! II.PM
tr
0 »«top*0*/ lflA4 • «"

A*»d m|«»i IKop
At lW«ti

f~l MM*U("M*M

r~] i'ii/i.tuiuijiH »»•«•«

gl^Ml*;r._rnottt-j* r*1
«m« mattaga
n uni_4*lnr
fl »m» ».brr»* mo»
f~l »"d_raylt»g.i,#ij M»

□ »«■***

gurAiMMf.

uod

0 VC4CO coil <1*2 ovo-c

i*jo .-a
ri»»»agJ

I »-.#»«• g • nrN
44*iW»i_idu rtolntl

r»J«'.Ml (loo • J

l*na_fci taior, nor J

< I.

>

Cioarot f.tonr.j

Tani|4i«l lllt»»NJ

to: «feraog

Jar-oparn te-rn

AMr r»osocial-anthropoid-briefing-p9-normal.gif:
<
h
<
û
<
h
ld

2

U

a



2

[n

h

j



in

LJ

g

r\

«

U

O

K

I

î

I

}

\M



s

§social-anthropoid-briefing-p10-normal.gif:
^GCHQ^

Filters, summarisation and
Drill-down searches

input Rwul

Result:

Usor A role

liter A
*VP*

User A

liter A ratv
v ditto

User A ui+r B

display User B type Usee 6

role

n<

User B raw
VaU*e

ÛU Out 20llMlV^^K^telMiihony evwnt
Action: unknown Action typo: cal

|. 1 selecter. duration: 00:00:DO

unknown coll

im:i

not_a*alablo nflt AVflUaMt

LMdlorc:

Source OriQln Point-Code: 2Û147 Source MSC:|
ClJMoro

Destinât«** Dost Point-Code: 60432

08 Oec 2010 09:05:17 - telephony event
Active

Action: UpcftoteJOCdbon Action type: n«twor*

>. 1 selector.

upd«#Jcc*ion

network

Locators:
Source MSC:

FlMnre

irmi

Gddd summary of

TARGET BEHAVIOUR

S+urre VI R:

08 Qec-2010 09:04:39 - telephony event
Action: unknown Action type: cal

1 selector, duration- 00-00*00

orknown call

imw

not_aeolable Qflt .ftyflllafrk

Locators:

Source Orinlo Point-rode 20147 Source MSC

HectinMinn Heu-Point-Code 60437

Logged in ne;



■mi

L

< Paoe 1 #t 59 F.r:t OpT®v*>J 1 2 3 4 5 | 16| > Owcxt }j Change So* Ordor □ Dsptar Summary .¿CSV&port
Last 139) Go

• filter criteria

To f Iter thts rosut sot ooso sorro
entena tdow ardttcrtdicl Apply

Part* oar* titer no

Short only events in which the
participant count:

Is greater ttoo

k

Boarer fiLorro

Temporal hiterng

TDI fiterrrj

Portwpar* court hl*r r>g

SECRET STRAP1social-anthropoid-briefing-p11-normal.gif:
IGCHQI

Quick Wins

AKA New things we can dc in Social
Anthropoid that we couldn't do before

SECRET STRAP1social-anthropoid-briefing-p12-normal.gif:
SECRET STRAP1social-anthropoid-briefing-p13-normal.gif:
SECRET STRAP1social-anthropoid-briefing-p14-normal.gif:
w cdNVerged Example
^GCHQ^

©There are 2 primary vectors for
CONVERGED EVENTS:

■ GRX (GPRS Roaming exchange) - uses
GTP (GPRS TUNNELLING PRCTCCCL).

■ CORE internet Collection - leaky
gateways.

SECRET STRAP1social-anthropoid-briefing-p15-normal.gif:
^GCHCp

Leaky gateways



m SOCIAL AMT»«*K*OK» Sal«*»« M4K t. Mo/IIU f

£*• tdf v— ^C4> X«* t»-t

O' c x E

|Éi r«MI .i/*s : 'I Cwc*>#* . ] m.ka* r 'l *:«»»*. * .1» L}

VXIM ANIMAOCOIO K«,h

y^víM i'oyi • »e>v4«>i

U««r A

5L*-

TW VI C PI I *T*Af>? ( MOUDAl

Lc^l in cur

coir

U»rrAlyp«

U»ff A

U«ar A r«M

valor

II««** A

U«ar

coir

Uier • lyp« U««r •

U»rr D raw
valur

l>«ar •
(lltploy
IIAI



T* f>Ct ?OIO»VT1tVT Mrnmp
Activa

Act»««: «««yd Action typa: mat«»?«



MA(*f fl

■#•»*»»**»- ircxi)

Acorrí

□u»»

UU AÚM\

leu.ivui

run

DptlinPliin lAVIi

Mil

•aarart lfcUKCCrlt.COtOP ilQAAUKMlICv POOC.: MM
Vourcn

•IACIC MOCt »llrn«~r 20101W4 0*4JW0 JPUKCOTSJTOIO* HMZC-5VMI^-.*0lV/op-JC ter¡ 4CCJT?WMtACOWJWM^CWOM»? Mvglm A vU





U««r «JA/> b SHP/VPP/** 3»4m*«/I.O <4«C • 1.1

COWienr, Arplocol •'

AilA4lun«l niH* il.tUl
A.Imw Ad«r («n|f«l

b«t-*a#1 ; W, Pl«MA hit fbll

I i C*"p—t-C Ml •

170(.
iv v;

»waiTatfcolo » • «

2«-Oct-?OIO OV^lO^l^^aaboaail a w«nMv«JjjM««l«ctor.
a«i**a.
Prom

(•C4l«r>*
Vourcr IPV41

Fijara





fcU9«f*



fVora*



rahoo.com

Pr*lt«plon IPV4«

/C Dct-yoiÜ t lfliH. - Mabaul avant (y«ha«>. & aalactor«

Actrva ^^^^^^^|Accp^ntCMmr!



>*ja**»-IN5X>

Pa«r I *4

Ji Cha-o* Sect Od«r Ü OapUv Simmary JCSV Cxport

■ U». .»'.f U< ir/aima«»* I* |«a •*»•»»social-anthropoid-briefing-p16-normal.gif:
social-anthropoid-briefing-p17-normal.gif:
©What features are we getting next?

■ SCALE

■ GEO INCLUDING NEW FILTERING DPTIDNS

■ Selector pairs query

■ B R □ A D DAK ENRICHMENT

■ Locator query

■ Email domain query

■ TDS

■ DISPLAYNAMESsocial-anthropoid-briefing-p18-normal.gif:
^CCHQ^

BEG INC. FILTERING

U*##- A ty*.

*•«><

*Hm*0

4 "•»«*»

r

ll»*r H

tw.,11 >«-/•>! LMI -

V»«»

U>k.-©*n >**o& «

Mît I Al AHIHAliMnl < Yot»«») • iimm«#*, / *»U. «tr»

Y«Kc-j-*jn«mo) I BPm*»WAK,»liKIM»»»

LUk/'c'.n Y»S:ouMm*

l».w. li Ox /aioot IH.IUHI - tOC I At ANIMAI xx.t (Yj*M»o) «hot m»««og*. Ï ««Cm to#«
!*»*»• «) ^I'HHAWAIU-AIUIAH

|l_YlkvO»n Y**->t-u^fcr«

W»ACr.fi ^ if.:o ur,ir(,»

Ihu. I» t>x 101« 01 IC IOCHI tocIAl ANIMAI t..M(YAM)(h«tiM<
VI«» HPMHAWA*. PACItfAH

O*k/*o»r* yAorinam«

Oiknoan Y#h3©urv»mo



To flté* ».I >Nuk cot tfOM# ««•“«

5*0U typ* * h#*»r.j

&••••< Bkcrt'O

ûooftfco..^g

oil

Do'toWi* #1

Mum ook# «vont* 9*0 kx«t«
3BI Kox»k.*4t«n
2 n °*'«»« (at Motte)

2 ■ K)nK*à %•♦*» <4 0V«f*f)

Q U (*M «••Mi)

SECRET STRAP1social-anthropoid-briefing-p19-normal.gif:
IGCHQ

SECRET STRAP1social-anthropoid-briefing-p20-normal.gif:
^GCHQ

Email domain cjuery

SEC RET STRAP 1

SOCIAL ANTHROPOID

VERSION 3.03 BETA

f Query »nput , Result*

x ) Results

* Results

* Results

x Results

Your input tunm. nutchiMl UwvuuU from TIkj, 27 Jan 2011 00:12:53 CHT to Tue, 01 Fob 2011 16:42:20 GMT.

You mey restrict the selectors matching your input terms by selecting from the values belov/ prior to proceeding to your query results.
Any highlighted selectors ere normelised versions of your originel query seeds.

Select ell De-select ell

brandon.com.ua (Unknovn) — 2 occurences
Lrendon.com.ue (AccountOvner) — 6 occurrences
brandon.com.ue (AccountOvner) — 6 occurrences
endon.com.ua (emad_address) — 1 occurrences
brandon.com.ua (AccountOvner) — 1 occurrences

Continue



** pe»od tw»ene*h

W/01/2011 12141.17 to 02/02/2011 12 41.17

y F.ht» repots by metentd selecto»* pno» to display

Query ecttie users wfy
Tercet Innch-nert

JlCPrtodty 6 Purpose IHS
MtAAsstfeatfen testng

+ teve Query Ujbmlt Qur»y

SECRET STRAP1social-anthropoid-briefing-p21-normal.gif:
^GCHQ

©Locator query

Search type

S«»«tor S«»«tOr Pair $ Locator Emal domain

Locator search

^ Suvcd IflKfH »

You ha*a 1 f AV«d 0U*'*f

:p ▼


• tot butt qu«n«c. «rrt«» mufcpU locator* (on* pae In«).

• If *lo* *ld:ardf .5 ticked. • if t>*at«4 a* a «Mc*d

UnIKt Othf* QTOf. ^ and \ K»vo m«ar»ng (to qutfy for a lit***' * fipn, u*
• k/ dK»Ut »Of utf »*11 bt »e?u*r*td in «KUto the chedtboxe« ba*ov to
• 8ele
**h«n *S«arp«. Locator* have to m«t¿♦creation «r-l
Locator«: T>p«i to qu«r>:
B _
Cel-GlobaMdentlher Doft-IP-Add'tff Ooat-Pont’Coda Mflht-Hxrbar iHNARSATJarvco- Wrende 20100
JIC Pnor*y L Pu*poi« IRS
HfcA Justification fating
V
So arch period (opfeena*): to ( 1 zim
Alo« «Idcardf ^ Quo»» for M«rrt ocatcrf
S««rch all t>p«i - foe oth«r *ourc« locator! + Vev* (>M*ry SubmJt Qc»^>
Target EnritNtveM Quo*> f^GCHQ^

SECRET STRAP1social-anthropoid-briefing-p23-normal.gif:
<



in

z



h

<

in

j

<



in

>

©

•f

ii

%

©

r 3

1 a

n

#5 \

V# l A

I -



Jfli j:il

i

I

i m im m

ra sr sea
****

JrSSR S B 8

-• ooo oooo ooo

i §88 8888 «88

}n nU |M

* 3 3 3 3353 33 3

I

I

SECRET STRAP1social-anthropoid-briefing-p24-normal.gif:
^GCHQ^

© Roll dut

■ Tranche

■ Tranche

■ Tranche

■ Tranche

■ Rollout
follow

PLAN.

1 - WC 24 JAN
2 - WC 3 1 JAN
3 - WC 7 FEB 1
4 - WC 1 4 FEB

1□□ USERS

26D users

□ □ USERS
Mop up users

TO SALAMANCA USERS WILL

SECRET STRAP1social-anthropoid-briefing-p25-normal.gif:
^GCHQ^

SECRET STRAP1social-anthropoid-briefing-p26-normal.gif:
SECRET STRAP1


Download Document

Social Anthropoid (social-anthropoid-briefing-p1-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p2-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p3-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p4-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p5-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p6-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p7-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p8-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p9-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p10-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p11-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p12-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p13-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p14-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p15-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p16-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p17-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p18-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p19-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p20-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p21-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p22-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p23-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p24-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p25-normal.gif)

Download Document

Social Anthropoid (social-anthropoid-briefing-p26-normal.gif)

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh