Title: Tailored Access Operations – Texas Cryptologic Center
Release Date: 2013-12-29
Description: This NSA presentation describes the staffing and activities of the Tailored Access Operations sectio based in San Antonia Texas. These included operations against Mexico’s Secretariat of Public Security (codenamed WHITETAMALE), Cuba, Columbia, Venezuela and unspecified targets in the Middle East: see the Der Spiegel article Inside TAO: Documents Reveal Top NSA Hacking Unit, 29 December […]
Document: image-584021-galleryV9-yenq.jpg:
image-584022-galleryV9-qplk.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Overview
• Current People, Space, & Operations (FY2009)
• Medina era Growth (FY2011)
• BACONRIDGE era (FY2015)
TOP SECRET//COMINT//REL TO USA, FVEYimage-584023-galleryV9-korm.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
TAO - Current Staffing
Civilians
30 Includes 1 AIA, 1 Intern
Military
Total
30 USAF-10
USA -8
USN -10
USMC - 2
(2 on orders, 1 deployed)
(2 x FIOC)
Not Included in figures above:
Civilian 7 Selectees (2 arrive 11/10, 1 arrives 11/17, etc)
9 Nominated
? External hires - 3 CJO'd, 7 preliminary
Military ? Chief , etc
? 5 x USA Great Skills Billets
? 2 (additional) FlOCers not included (R&T)
Contractor 1 (TAO / ANT contract)
As Of 11/3/2008
TOP SECRET//COMINT//REL TO USA. FVEYimage-584024-galleryV9-zkjy.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Production Operations (POD)
£ Olympus Tickets FY07 6,360 FY08 9,126
^SHARPFOCUS (SF2) 320 1940
[IjPARCHDUSK(PD) 340 366
HfOXACID Messages
sent to
called back
exploited
12
2396
419
154
17
3446
672
262
Iraq
Afghanistan
TOP SECRET//COMINT//REL TO USA, FVEYimage-584028-galleryV9-ekzl.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Requirements & Targeting
FY 2007
Collection Exploit
FY 2008
Operations
Collection Exploit
Mexico Cuba
Colombia Venezuela
Total
TOP SECRET//COMINT//REL TO USA, FVEYimage-584031-galleryV9-qyuj.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Active Development of
Mexican Public Security
Secretariat (SSP)
WHITETAMALE
Derived From: Multiple Sources
Declassify On: XI
TOP SECRET//COMINT//REL TO USA, FVEYimage-584033-galleryV9-ytyl.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Project Background
• DHS & ICN need for intelligence on drug
trafficking, people smuggling, and border
security issues
• Mexico's InjtUJi Itfh: a
supply chain opportunity
blEIIJ. CUi & more
• Potential S2 Goldmine for multiple customers
TOP SECRET//COMINT//REL TO USA, FVEYimage-584035-galleryV9-spot.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
SSG Enabling Strategy
• Target System Administrators & Telecommunication
Engineers
• Expand access to include higher priority Mexican
security related organizations
• Find and Exploits2 Targets of Interest
TOP SECRET//COMINT//REL TO USA, FVEYimage-584038-galleryV9-nmhc.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Exam pie of Collected Diagramsimage-584041-galleryV9-xjkn.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Example of Constructed
Diagrams
i DNS Servei
L-DNS
I Email Server
I DNS Stiver
.DNS Server
L-E
U
— WT2
Domain -- SSPDF
DO
n
SSP02--WT3
Domain -- SSP
DNS Server
DHCP Sever
L-toNS
L-DNS
DO
Host-32-- WT9
Domain •• WorkGroup
-a-
in
■
- WTS
> Domain - WorKOroup
DO
yj\jo -* *vi i -
Domain - SSPDA
- WT8
Domain SSPDA
Email Server
DHCP/ONS Server
Email Server
CONTEL E*CH_55
L-DNS
- WT7
Domain •• SSPDA
ICTY DHCP / DNS Server
DNS Server/WINS
MDF CORE 2
- WT11
Domain — SSPDA
i DNS Server
Witeiees DO
COMPAO ?A ?FC: 737 WT! i
Domain - CRUPO_trabajo
- wCan
- NIC
DHCP Server
- WT4
Domain - ENFFA
-404BECBCÇ - WT1 3
Domain - INICIOMS
rver
erverimage-584043-galleryV9-srlv.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
WHITETAMALE
Collaboration
TOPI: Identify human targets of interest
CES / NIE: Direct exploitation of WhiteTamale boxes
SSG: Identify network targets of interest to getto these human targets
TAO: Access the network to exploit and collect traffic
> E nabling a balanced approach towards survey and target development
with the goal of sustained collection and reporting
DNI at NSA Texas
NETA 2008: Example of end-to-end target
External customer (IN) >TOPI (CRN) >TAO (Collection) >S2 (Reporting)
AOR Support
GOAL: support Homeland Security requirements
TOP SECRET//COMINT//REL TO USA, FVEYimage-584045-galleryV9-rovn.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
NS/mPersonnel Plan
Activity Cumulative Personnel
FY08 FY09 FY10 FY11 FY12 FY13 F Y14 FY15
ROC
Leadership (br/div/td) 3 4 5 5 5 6 6 6
SWO 1 3 4 5 5 6 6 6
Interactive Operators 8 25 40 52 65 79 83 86
Production Operators 19 16 19 20 21 22 23 23
Network Response (NWO/NIO) 6 7 11 13 15 17 19 20
ROC Totals 37 55 79 95 111 130 137 141
| R&T
[Leadership (br/div/td) 1 2 3 3 3 4 4 4
|Analysts 12 27 44 54 59 67 72 81
|r&T Totals 13 29 47 57 62 71 76 85|
Leadership (br/div/td) 0 0 0 1 1 2 2 2
Developers 3 6 13 19 26 32 35 38
Capabilities Totals 3 6 13 20 27 34 37 40
TAO
TAO Leadership 3 3 3 3 3 3 3 3
TAO Staff 1 1 1 1 1 1 1 1
TAO Totals 57 94 143 176 204 239 254 270
TOP SECRET//COMINT//REL TO USA, FVEYimage-584046-galleryV9-maof.jpg:
TOP SECRET//COMINT//
B lily 331
Opción ns
RH137B
kfiatkicttr* Future DataCenter
Support
L a
TOP SECRET//COMINT//
REL TO USA, FVEY
Space
Status of Room 137
• 13 Racks installed, powered, in use
• C DR Operational
• Next installation in November 2008
for FREEZEPOST & DOCKETDICTATE
Schedule for Space A & B
• Operational - 27 NOV
• C urrently, TAO • 60 persons
occupying 39 desks
• Space management enabled by TDYs,
Training, Integrees, Shift-Work, Details
• End of 2008, potential for 13 more
personnel
REL TO USA, FVEYimage-584047-galleryV9-ohdz.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
BACONRIDGE-2011 (BOD)
BACON RIDGE
AREAS TEXAS
Personnel #s 270
Workstations 210
Workstation Area SqFt TX=100sqft vs GA/HI=72sqft 21,000
Operations Floor 1881
Ops Breakout Rooms 11
Large 350 sq ft 5
Medium 250 sq ft 4
Small 150 sq ft 2
Ops Breakout Rooms Total 3109
ROC Training Lab (RTL) 996
Technical Demonstration Center (TDC) 732
Maintenance Lab -700
Data Closet 800
Conference Room 732
Caves (8) - 85 = 680
Break/Locker area -850
Data Center Racks/sqft 200 / 9,450
Total Sq Ft *42000
TOP SECRET//COMINT//REL TO USA, FVEYimage-584048-galleryV9-xsli.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY
Future
* COOP - from weather to load balancing
• Development - DNT, ANT, ?
• CNA-"Pushed outlikeCNE"-Col
TOP SECRET//COMINT//REL TO USA, FVEYimage-584049-galleryV9-iywb.jpg:
v.cf«7?
gfensgt
UNCLASSIFIED//FOR OFFICIAL USE ONLY
UNCLASSIFIED//FOR OFFICIAL USE ONLY

Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584021-galleryV9-yenq.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584022-galleryV9-qplk.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584023-galleryV9-korm.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584024-galleryV9-zkjy.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584028-galleryV9-ekzl.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584031-galleryV9-qyuj.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584033-galleryV9-ytyl.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584035-galleryV9-spot.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584038-galleryV9-nmhc.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584041-galleryV9-xjkn.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584043-galleryV9-srlv.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584045-galleryV9-rovn.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584046-galleryV9-maof.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584047-galleryV9-ohdz.jpg)
Download Document
Tailored Access Operations – Texas Cryptologic Center (image-584048-galleryV9-xsli.jpg)