Title: Special Collection Service

Release Date: 2014-06-18

Document Date: 2011-03-21

Description: This presentation, prepared for the Pacific SIGDEV Conference in March 2011 describes the organisation, operations and modernisation of the NSA’s Special Collection Service division, which works out of US embassies and consultates across the world, in tandem with the CI see the Der Spiegel article The NSA in Germany: Snowden’s Documents Available for Download, 18 […]

Document: TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Special Collection Service

Pacific SIGDEV Conference

March 2011

The Overall Classification of this Briefing:

TOP SECRET//COMINT//REL USA, AUS, CAN, GBR, NZL

Derived From: NSA/CSSM 1-52
Dated: 20070108
Declassify On: 20360301

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Spècial Collection Service

SCS Organization

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Special Collection Service

Strategic Partnerships

DEA

DIA

NRO

SSO
FBI

State
Secret Service

Law Enforcement

Homeland Security

Tailored Access

COVCOM ^

Military

CLANSIG

Second Party

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

pècîdl Collection Service

SCS Modernization

echnology

Ilection/Processing Systems
Facilities
IT Infrastructure
Communications &

Networks
Tools

Platform for
Transformational Activities"

Deployed Analysts
TECHHUMINT

P

Cyber
NGW
' New T3.0
Presence 6
Model

People and Business Practices

Access to Data

_____-Dissemination Methods

Requirements Process
Project Portfolio Mgmt
Rotation Policy
DNI Training

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Spècial Collection Service

Overview

• Unified IT Core and Virtualization

• Cloud Computing

• Global Situational Awareness

• Beyond Traditional Accesses

• Coherent Digital Access

• Empowering Automation

• The SCS Cyber Advantage

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Unified IT Core

Spècial Collection Service

IT Services, IT Infrastructure

• Capability Improvements:

- Modern IT services and infrastructure to support a net-centric
operational model and enhance maintenance and security

• Capability Change:

- Rapid response SIGINT presence

- Next generation virtual infrastructure

- Diversified WAN topology, enhanced LAN

- Enhanced interoperable desktop

- Improved email service

- Workforce mobility

- Robust collaboration environment

- Site destruct enabler

i

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Spècial Collection Servie

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

EINSTEIN/CASTANET

Spècial Collection Service

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

INTERQUAKE

• Terrestrial Environmental Knowledge Base

-Available to all NSA analysts and partners

• PANOPLY populates IQ with Emitter
information and reports including:

- Signal Externals

- Radio and Payload information

- LACs and Cell ID’s

- Protocol Stacks

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

top secret il comma re ltd usa, aus, CAN, GBR, NZL

w

Special C<

Special Collection Service

tJlNILRQUML 1 - riOEill-n I irefoK

pie tdlt I ll£tcH*y Hookmarks Toole Llolp

INTERQUAKE

..l ni* I

.-^=_ 1
O - a ^ r .«. I httpi://i-itcrtiL*j|-£- In.hÈ.r.nsü/lq/ "Cl w ^ ■
I % 1MCRQUAKC 4 es 1
DYNAMIC PAGE - HIGHEST POSSIBLE Cl ASSIFICATIQN IS


NTERQUAKE

:3rt3bIcrnx/'Qutixfianx'?

S- o m a ct

Emitters

[L^yJeiMl iCijcA iv jL*±i^h

Ullfch I

L = Has Confirmed Loadmflls — Has Unap3hola|Hh A Hendmfllun Collacilon In !|>oid|Has Scripts?

i'oil« [7"

«1 $ V- H Ricard 1-BO «I iif>

VI«mis; | Deiouit —I £j Hi Q Filter« Hi Sorflnn! H Export: | -Select- 3

Fi4M| |MHz> Site Case Sirjnal Naine BR 4MB and F Mu «J iPuy load SNR BER Az El Pul BW iMHzl
1 1 1 I I 1 1 I 1 1 | 1 1
W A W A W A W A W A JL ▼ A V A W A W A W A W A W JL
LU 17947 US 9EBU WU1 CT QQ19396KA 19 396 SFSK 3Ü 3 JJ □ V
lJ 12792 US 933 IJ WU1AG OQ1939EKA 19.396 B FS K 10 39 0 H 27
lJ s 1 3031 US-963U WU1AA CQ19396KA 19.396- SFSK 32 96 -2 H 40
lJ 12775.5 US-963U WU1AD ÜQ1939BKA 19.395 SFSK 25 319 0 V 35
i_J 1UU15 USL'JbaU WU1AC UU24I LUXA 24. 1 LU 128 QAM STM1 18 84 -1 H 30
i b r.ib'2 Ub-'jbbU wuibp 21.457 129 CAM
i s ?-'PR US-9CÜ3U wu xx ■7-1 457 129 QAM
i “1 7570 US-0FÏ1U WU XX m?5innxA 75 i ni 170 QAM PTM 1 30 n?n 0 V 35
lJ 7492 US-9GSU WU XX 23 926 120QAM 10 23 -11 V .34
i_3 7435 75 IJS 963U WU .XX 23.926 120 QAM 15 14 -1 V 311
LJ 7624 US-963U WU .XX 23.926- 128 QAM 10 59 -4 H 30
LJ 10917 US-96BU wu.xx 24. 199 128 QAM 11 83 0 V 33
LJ 1U7S/./S US-OE3U wu.xx 24. 1 LU 128 QAM 23 81 -1 Y 39
i /b i > ,t ui-'jtyu wu.xx 2=: yLb 128 UAM 9 41 -1 H 20 6
i s 7r,9f, US-968U VVU1CA 0Q24132XA ■74 19 y 1290AM Stmi ■10 27F, 0 11 nn
1 “1 P P 7r,r,9 UP-9FÏ1U wu an ÎTl'241 97XA 74 197 120 QAM PTM 1 40 776 n 1 1 33
LJ 7QJ5 US-9GÛU WU XX 23 926 1 20 QAM 10 59 4 V 33
LJ P s 770S US 963U WU.Q4 00241 92XA 24 192 120 QAM STM1 40 226 0 H 33
LJ s 2575 US-963U WU1 eu □D05O57WA 5.057 64QAM 28 281 12 H 6
LJ 452B.7 US-953U wu.xx 30.101 64QAM 9 233 0 V
LJ 7435 US-'JISJU wu.xx 12.376 84QAJVI 8 81 -1 H 18
j 49*9 b uî^-ytau wu.xx 01 1 U1 81 UAM 13 2=U 8 H 44
i 1 7Pflfl --I 1 l'=_>=*XQI 1 Wl I W V>A flfil P iin ü M l7 n H "'M _

ÜYNAMK. I'AGE - HIGHESI POSSIBLE CLASSUF ICA1 ION IS
I OP SECRET//SI tci tSCVOUCHH Ntît URN

1111 ■—r i |i i.hI.h- 1 n. FA .F.n



TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Spècial Collection Service

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

CES/SSC/AAD VPN “Surge”

• Main Goal:

- To evaluate SCS VPN access and analysis to determine better methods
of identifying and exploiting networks of interest.

• Two Focuses:

- What can we do with VPN data that is already ingested into the system?

• Find better methods of reporting VPN stats and exploitation
determinations from CES back to SSC and site.

- Are there methods to better identify and survey VPN’s to provide CES
the data they need?

• Can we leverage MIRROR, DARKQUEST, PANOPLY survey
information to quickly identify and report the presence of VPN’s in
surveyed signals?

• Can we use BIRDWATCHER or other means to automatically
resurvey for key exchanges and obtain paired collect?

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

1

Spècial Collection Service

The SCS Cyber Advantage

SIGINT prowess provides cyber advantage

Unified operations provides holistic approach
The right intelligence delivered to the right customer

Broad Spectrum of Capability *’

Home field advantage in adversary’s space

Where our customers want us and our adversaries do not
Capitalizing on the “element of surprise”

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

Integrated

Mission

Geographic Advantage
Signal Access

Analysis

Q. ry

Dissemination



&

&

Q)



Signal access for collection, exfil,and infil

Microwave, WiFi, WiMAX, GSM, CDMA, Satellite, etc.

Living in the environment

Insights on infrastructure and configurations
Discoveryof targets, signatures, and behavior

Tailored intelligence products

Diverse products driven by national objectives and
local needs through formal reporting, target packages,
analytic insights, situational awareness, threat warning

Unique platform for conducting
and enabling IC operations

Fully leveraging 30-years of experience within the NSA and
CIA enterprises and using existing authorities

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

TOP SECRET // COMINT // REL TO USA, AUS, CAN, GBR, NZL

SCS Opportunities

Soècidl Collection Service


e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh