Title: Transnational DNI Training

Release Date: 2018-03-01

Description: This undated NSA instructional presentation, along with instructor’s notes, provides a briefing on metadata sharing between the Five Eyes: see the Intercept article How London’s 7/7 Bombings Led to “Unprecedented” Surveillance Tactics, 1 March 2018.

Document: TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) This lesson will provide you with an overview of sensitive information
sharing and collaboration.

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

1

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

and Need to Sluin’

Contrast the different sensitive source collaboration
efforts

(U) Objectives

(U) At the end of this lesson, you will be able to.

Differentiate between the concepts of Need to Know

(U) Instructional Content/Activities

(U) Instructor Notes

- (U) Given one or more scenarios typical of a CT DNI Analyst's work and
access to all necessary tools, databases and reference materials, the
student will be able to initiate, as well as, respond to a SMAC request .

- (U) The instructor should highlight the learning objectives for this lesson
and bring in the flowchart on the next slide as applicable.

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

2

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Provide a high level overview of how this lesson maps back to the
flowchart to provide context for students.

- (U) There is a need for source sensitive information at various points
throughout the CT DNI Analysis Workflow Process; therefore, SMAC can
be leveraged at various points - i.e.,

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

3

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Ask the class what the differences are between Need to Know and
Need to Share.

(U) Student Interaction

- (U) Students should brainstorm and share with the class their
understanding need to know and need to share.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

4

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

« (U) Need to Know

(U) Need to Know: Classified information

is held close and not shared except when

a clear defined and immediate need can

be identified

(U) Benefits

(l ) Ensures operations and sensitive equities are

protected

- (U) Reduces duplication ot collection cliorts

(l1) Helps till gaps in analysis and

understanding of target

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Explain Need to Know

- (U) More restrictive standard for information sharing than Need to Share

- (S//SI) An example of an operation that uses strict Need to Know is the
AQSL (al-Qa'ida Senior Leadership ) shop

- (U) LEAD-IN: Now let's talk about the Need to Share

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

5

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

and partners

(U) Minimizes data about US persons, but

(U) Through collaboration, improves the quality

(U) Need to Share

(U) Need to Share: Dissemination of

previously unshared SIGINT data, tools.

and databases

IU) Benefits

- (U) Sharing ot SIGINT with Intelligence

Community (IC) and other SIGINT customers

maximizes intellmence

and timeliness of SIGINT and joint products

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Explain the Need to Share and contrast it with Need to Know

- (U) Point out that this is the way things are looked at more often now -
post 9/11.

- (S//SI) Examples of SIGINT data that is now available through sharing:
voice, data, video, metadata, etc.

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

6

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U) Examples

Need to Know

r Identities of named 5 Eves entities

Need to Share

Phone numbers

r Bank account info

r Location data

IP addresses

\liernati\e email addresses

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Explain the Need to Share and contrast it with Need to Know

- (U) Point out that this is the way things are looked at more often now -
post 9/11.

- (S//SI) Examples of SIGINT data that is now available through sharing:
voice, data, video, metadata, etc.

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

7

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U),Origins of Need to Share

(U) Tragic events ol 9/11 exposed a need

(U)9 II Commission recommendation

(U) NSA Policies related to dissemination of

SIGNI'I

(IJ) USSID CR1611 (p) - SICilNT

Dissennnation For Analytic Collaboration

(U) USSID C RI6I0 - SIGINT Production

and Raw SIGINT Access

(U) Alice Springs Resolution

Metadata sharimi to uiclude SMAC

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Talk about the how the need for information sharing (need to share)
became an urgent one after the events of September 11, 2001.

- (U) 9/11 Commission recommended that the Intelligence
Community transform from a Need to Know to a Need to Share
mentality.

- (U//FOUO) Information was not shared broadly enough not
only between the 5-Eyes but within the US SIGINT Systems
(USSS).

- (U) Polices that establish the agency's position on SIGINT collaboration
with the 5-Eyes.

- (U) USSID CR1611(P) - SIGINT Dissemination for Analytic
Collaboration

- (U//FOUO) Established the direction for the US SIGINT
System to disseminate SIGINT in response to customer and
partner requests to authorized US and foreign recipients
outside the USSS in accordance with established
procedures.

- (U//FOUO) USSID CR1610 - SIGINT Production and Raw SIGINT
Access

- (U) Supercedes SID Management Directive 406 pertaining to
the same subject.

- (U) Governs the access that 2nd parties have to raw SIGINT.

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

8

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(S' SI) In 2004 the Directors of

-aifimiinn their amnmuneiiLiu.

(U)Alice Springs Resolution

:!ie 5-Eves auencies sinned the -;

Alice Springs Resolution (ASR)

(S//SI) “...development of single query access

to all metadata repositones across the

Australian. Canadian. New Zealand. United

Kingdom, and the United States Signal

Intelligence community

nplement the vision stated in

the \sR

0(*)dO' fK

Go ASR

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Click 1: In fact the directors committed themselves to developing single
query access to get metadata from across the 5-Eyes community.

- (U) Talk about the Alice Springs Resolution which LTG Hayden signed in 2004.

- (U) Click 2: So they signed the Alice Springs Resolution seen here.

- (S//SI) Click 3: Summed up, they agreed to the development of single query
access to all metadata repositories across the 5-Eyes.

- (U) QUESTION: Can anyone tell me who the 5-Eyes are?

- (U) ANSWERS: UK, Canada, Australia, New Zealand, United States

- (U) Click 4: The result was the establishment of SMAC and a foundation for
realizing broader collaboration among the 5-Eyes for SIGINT.

- (U) QUESTION: We've been talking a lot about metadata. So what is
metadata?

- (U) DEFINITION: Metadata

- It is data about data; derived, extracted or inferred information that
represents the original data in some way.

- (U) Click 5: If you want to learn more about ASR, type in "go ASR" into your
browser.

(U) Student Interaction

- (U) Students should provide input on what metadata is as well as offer
suggestions on who the 5-Eyes are.

-(S//SI) FROM ASR Web
site: The Alice Springs
Resolution (ASR) is a Road
Map to sharing data
between NSA, Australia,
Canada, New Zealand and
the United Kingdom. In
July 2004, DIRNSA, LTG
Hayden, and Signals
Intelligence Director, MG
Quirk met with the directors
of our agency counterparts
and their SIGINT directors
to build a Five Eyes agency
partnership. One result of
the meeting was formally
documented in the "Alice
Springs Resolution;" the
document was signed by
the Five Eyes agency
directors. The signatures
demonstrated their
commitment to enable
unfettered access to
metadata repositories
among our five agencies.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

9

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U) Collaboration Efforts

(U) Partnership and cooperation among ? ke\

nations - the “5 Eyes

[U)UK. Canada. Australia. New Zealand, and

[ U) TICKETWINDOW

(S SI) An effort to share sensitive source tratti

content

(U) ASR MARINA

(U) Sensitive Metadata Analytic Collaboration

(SMAC)

(S SI) An eliort to share sensitive source

metadata and anal\ tic results

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) There are three sensitive source collaboration efforts.

- (U) The 5-Eyes partnerships provide the basis for sharing information.

- (S//SI) TICKETWINDOW establishes a means to share sensitive source
traffic content between partners.

- (S//SI) SMAC is specifically geared towards sharing sensitive metadata.

(U) Student Interaction

- (U) Students should be listening and/or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

10

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U//FOUO) Through collaboration is encouraged for many reasons and
access to data across the SIGINT community is growing by the day,
there are still some things that are considered before sharing including

- (S//SI) Partner identities

- (S//SI) Partner Agreements

- (S//SI) Interception Points

- (S//SI) Partner Identities and Agreements- While 2nd party partners
may know of the existence of a small number of our third party partners
(ex. SISECT), we generally do not share information on the details of
those relationships. Nor do we share the existence of sensitive 3rd
party partners with 2nd party, nor with other 3rd party partners.

- (S//SI) Interception Points - Even though metadata or content from
communications originating from sensitive access points may be
shared under certain circumstances with our partners, the particulars
on where and how the communications were intercepted are usually
not shared.

(U) Student Interaction

- (U) Student should be listening and/or taking notes

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

11

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U) Sharing Contributes to Success

(U) Data provided at multiple security

levels

(U) A rich, interactive climate that all

intelligence disciplines can leverage and

support with their own unique

information to produce better intelligence

(U)One strategic/tactical common

operating picture

(U) Simple and easy-to-use collaboration

tools

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Success basically means that as analysts, you have more
information at your disposal to get those who would harm us.

- (U) Data provided at multiple security levels

- (U) Rich, interactive climate that all intelligence disciplines can
leverage and support their own unique information to produce
better intelligence

- (U) One strategic/tactical common operating picture

- (U) Simple and easy to use collaboration tools

(U) Student Interaction

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

12

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

(U)

Instructional Content/Activities

(U)

Instructor Notes

- (U) Instructor should make sure that all students understand the
objectives discussed in this lesson, and should ask if there are any
questions before moving onto the next lesson.

(U) Student Interaction

- (U) Students should be listening and or taking notes.

TOPSECRET//COMINT/REL TO USA, AUS, CAN, GBR, NZL//20291123

13

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh