Title: Tailored Access Operations – Texas Cryptologic Center

Release Date: 2013-12-29

Description: This NSA presentation describes the staffing and activities of the Tailored Access Operations sectio based in San Antonia Texas. These included operations against Mexico’s Secretariat of Public Security (codenamed WHITETAMALE), Cuba, Columbia, Venezuela and unspecified targets in the Middle East: see the Der Spiegel article Inside TAO: Documents Reveal Top NSA Hacking Unit, 29 December […]

Document: image-584021-galleryV9-yenq.jpg:
image-584022-galleryV9-qplk.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Overview

• Current People, Space, & Operations (FY2009)

• Medina era Growth (FY2011)

• BACONRIDGE era (FY2015)

TOP SECRET//COMINT//REL TO USA, FVEYimage-584023-galleryV9-korm.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

TAO - Current Staffing

Civilians

30 Includes 1 AIA, 1 Intern

Military

Total

30 USAF-10
USA -8
USN -10
USMC - 2

(2 on orders, 1 deployed)
(2 x FIOC)

Not Included in figures above:

Civilian 7 Selectees (2 arrive 11/10, 1 arrives 11/17, etc)
9 Nominated
? External hires - 3 CJO'd, 7 preliminary
Military ? Chief , etc
? 5 x USA Great Skills Billets
? 2 (additional) FlOCers not included (R&T)
Contractor 1 (TAO / ANT contract)
As Of 11/3/2008

TOP SECRET//COMINT//REL TO USA. FVEYimage-584024-galleryV9-zkjy.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Production Operations (POD)

£ Olympus Tickets FY07 6,360 FY08 9,126
^SHARPFOCUS (SF2) 320 1940
[IjPARCHDUSK(PD) 340 366

HfOXACID Messages
sent to
called back
exploited

12

2396

419

154

17

3446

672

262

Iraq

Afghanistan

TOP SECRET//COMINT//REL TO USA, FVEYimage-584028-galleryV9-ekzl.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Requirements & Targeting

FY 2007

Collection Exploit

FY 2008

Operations

Collection Exploit

Mexico Cuba

Colombia Venezuela

Total

TOP SECRET//COMINT//REL TO USA, FVEYimage-584031-galleryV9-qyuj.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Active Development of
Mexican Public Security
Secretariat (SSP)

WHITETAMALE

Derived From: Multiple Sources
Declassify On: XI

TOP SECRET//COMINT//REL TO USA, FVEYimage-584033-galleryV9-ytyl.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Project Background

• DHS & ICN need for intelligence on drug
trafficking, people smuggling, and border
security issues

• Mexico's InjtUJi Itfh: a

supply chain opportunity

blEIIJ. CUi & more

• Potential S2 Goldmine for multiple customers

TOP SECRET//COMINT//REL TO USA, FVEYimage-584035-galleryV9-spot.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

SSG Enabling Strategy

• Target System Administrators & Telecommunication
Engineers

• Expand access to include higher priority Mexican
security related organizations

• Find and Exploits2 Targets of Interest

TOP SECRET//COMINT//REL TO USA, FVEYimage-584038-galleryV9-nmhc.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Exam pie of Collected Diagramsimage-584041-galleryV9-xjkn.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Example of Constructed

Diagrams

i DNS Servei
L-DNS

I Email Server

I DNS Stiver

.DNS Server

L-E

U

— WT2

Domain -- SSPDF

DO

n

SSP02--WT3
Domain -- SSP

DNS Server
DHCP Sever

L-toNS

L-DNS

DO

Host-32-- WT9
Domain •• WorkGroup

-a-

in

■

- WTS
> Domain - WorKOroup

DO

yj\jo -* *vi i -

Domain - SSPDA

- WT8

Domain SSPDA

Email Server

DHCP/ONS Server

Email Server
CONTEL E*CH_55

L-DNS

- WT7

Domain •• SSPDA

ICTY DHCP / DNS Server

DNS Server/WINS

MDF CORE 2

- WT11
Domain — SSPDA

i DNS Server

Witeiees DO

COMPAO ?A ?FC: 737 WT! i

Domain - CRUPO_trabajo
- wCan
- NIC

DHCP Server

- WT4

Domain - ENFFA

-404BECBCÇ - WT1 3
Domain - INICIOMS

rver

erverimage-584043-galleryV9-srlv.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

WHITETAMALE

Collaboration

TOPI: Identify human targets of interest
CES / NIE: Direct exploitation of WhiteTamale boxes
SSG: Identify network targets of interest to getto these human targets
TAO: Access the network to exploit and collect traffic
> E nabling a balanced approach towards survey and target development
with the goal of sustained collection and reporting

DNI at NSA Texas

NETA 2008: Example of end-to-end target

External customer (IN) >TOPI (CRN) >TAO (Collection) >S2 (Reporting)

AOR Support

GOAL: support Homeland Security requirements

TOP SECRET//COMINT//REL TO USA, FVEYimage-584045-galleryV9-rovn.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

NS/mPersonnel Plan

Activity Cumulative Personnel
FY08 FY09 FY10 FY11 FY12 FY13 F Y14 FY15
ROC
Leadership (br/div/td) 3 4 5 5 5 6 6 6
SWO 1 3 4 5 5 6 6 6
Interactive Operators 8 25 40 52 65 79 83 86
Production Operators 19 16 19 20 21 22 23 23
Network Response (NWO/NIO) 6 7 11 13 15 17 19 20
ROC Totals 37 55 79 95 111 130 137 141

| R&T
[Leadership (br/div/td) 1 2 3 3 3 4 4 4
|Analysts 12 27 44 54 59 67 72 81
|r&T Totals 13 29 47 57 62 71 76 85|


Leadership (br/div/td) 0 0 0 1 1 2 2 2
Developers 3 6 13 19 26 32 35 38
Capabilities Totals 3 6 13 20 27 34 37 40

TAO
TAO Leadership 3 3 3 3 3 3 3 3
TAO Staff 1 1 1 1 1 1 1 1
TAO Totals 57 94 143 176 204 239 254 270

TOP SECRET//COMINT//REL TO USA, FVEYimage-584046-galleryV9-maof.jpg:
TOP SECRET//COMINT//

B lily 331
Opción ns

RH137B
kfiatkicttr* Future DataCenter
Support
L a

TOP SECRET//COMINT//

REL TO USA, FVEY

Space

Status of Room 137

• 13 Racks installed, powered, in use

• C DR Operational

• Next installation in November 2008
for FREEZEPOST & DOCKETDICTATE

Schedule for Space A & B

• Operational - 27 NOV

• C urrently, TAO • 60 persons
occupying 39 desks

• Space management enabled by TDYs,
Training, Integrees, Shift-Work, Details

• End of 2008, potential for 13 more
personnel

REL TO USA, FVEYimage-584047-galleryV9-ohdz.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

BACONRIDGE-2011 (BOD)

BACON RIDGE

AREAS TEXAS
Personnel #s 270
Workstations 210
Workstation Area SqFt TX=100sqft vs GA/HI=72sqft 21,000

Operations Floor 1881
Ops Breakout Rooms 11
Large 350 sq ft 5
Medium 250 sq ft 4
Small 150 sq ft 2
Ops Breakout Rooms Total 3109

ROC Training Lab (RTL) 996
Technical Demonstration Center (TDC) 732
Maintenance Lab -700
Data Closet 800
Conference Room 732
Caves (8) - 85 = 680
Break/Locker area -850

Data Center Racks/sqft 200 / 9,450
Total Sq Ft *42000

TOP SECRET//COMINT//REL TO USA, FVEYimage-584048-galleryV9-xsli.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

Future

* COOP - from weather to load balancing

• Development - DNT, ANT, ?

• CNA-"Pushed outlikeCNE"-Col

TOP SECRET//COMINT//REL TO USA, FVEYimage-584049-galleryV9-iywb.jpg:
v.cf«7?

gfensgt

UNCLASSIFIED//FOR OFFICIAL USE ONLY

UNCLASSIFIED//FOR OFFICIAL USE ONLY