Release Date: 2014-06-18
Document Date: 2012-05-21
Description: This page from GCHQ’s internal GCWiki, last edited in May 2012, provides background information on the agency’s “internet buffer business capability”: see the Der Spiegel article The NSA in Germany: Snowden’s Documents Available for Download, 18 June 2014.
Document:  News
BREAKING NEWS (May 2012) - The second tranche of 'deep dive' processing capability at
RPC has gone live. In addition 2 extra lOG's are being processed at OPC. This brings the current
deep dive' capability to:
• CPC with 16x1Og,
• OPC with 7 x 1 Og
• RPC1 with 23 x lOg.
This gives over 300 GCHQ and —250 NSA analysts access to huge amounts of data to support the
target discovery mission.
The MTI programme would like to say a big thanks to everyone who has made this possible
(Which includes TCA. TEA. SSMG, SSOS, GTE, ACD. OPP-LEG, IT Services, R1 at
NSA. AHS and ) - a true collaborative effort!
J LMPOKA :.be Mil nil
^^t of the MTI SICIN'T Apps theme led by and
TEMPORA is an Internet Buffer capability being delivered by MTI. IPP and GTE for joint mission
benefit, it builds upon the key success of the TINT experiment and will provide a vital unique
1 of 3
capability to MISD/MCE communities.
* TEMPO HA Ls the codeword For GCHQs internet buffer business capability as a whole - which
is the ability to loosely promote a % of traffic across GCHQs SSE access into a repository
which will keep the content (and its associated metadata) For periods oFtime (approximately
3 days For content and up to 30 days For metadata) to allow retrospective analysis and
Forwarding to follow on systems.
* TEMPORA as a capability is agnostic of the technologies used to promote that traffic and to
store that traffic and so should not be used as a codeword For the individual components (e.g
XKS, MVR etc).
* At the moment the components include, amongst others, GCHQ SSH Access, POKERFACE
sanitisation, XKS (in various configurations) and it will include MVR in the very near future.
* TEMPORA also covers the management of the rules used to promote traffic into the internet
* TEMPORA is not processing centre specific. At the moment there are instances of
TEMPORA at all xPC (Namely CPC, OPC and RPC1). These should be referred to, when
required, as OPC/CPC/RPC1 TEMPORA
ieditl A bit more detail
TEMPORA are GCHQ's large-scale, Deep Dive deployments on Special Source access (SSE).
Deep Dive XKeyscores work by promoting loose categories of traffic (e.g., all web, email, social,
chat, EA, VPN, VoIP,..) from the bearers feeding the system and block all the high-volume, low
value traffic (e.g., P2P downloads). This usually equates to -30% of the traffic on the bearer. We
keep the full sessions for 3 working days and the metadata for 30 days for you to query, using all
the functionality that Keyscore offers to slice and dice the data. The aim is to put the best 7.5% of
our access into TEMPORA's, comprising a mix of Deep Dive Keyscores and promotion of data
based on IP subnet or technology type from across the entire MVR. At the moment, users are
able to access 46xlOGs of data via existing Internet Buffers.. This is a lot of data! Not only that,
but the long-running TINT program and our initial 3-month operational trial of the CPC Internet
Buffer (the first operational Internet Buffer to be deployed) show that every area of ops can get
real benefit from this capability, especially For target discovery and target development. Internet
Buffers are different from TINT in that the latter is purely an experimental, research environment
whereas Internet Buffers can be used operationally For EPR. Effects, enabling CNE etc.
For a more detailed depiction of how TEMPORA and TINT differs please see here.
GTE XKS Senior User
MTI SIGINT apps theme lead
Enhanced Discovery Project Manager
Enhanced Discovery XKS SME
2 of 3
3 of 3