---------···-· PL 86-36 50 USC 36 05 • NPlll II WulUIJIDID4l1 OOl lWDU DOOGJCB V'l JWV l fBC liBB IB11 LllliliJ O lilulW ti Wlil - -· - • • • • • • • • • • • • • • • • • Non Responsive t - - • • ·-· - - ---- _- _ U rY_E_S_ _D_ON_ _T_H_E_R_E_I_S_A_N_E_L_I N T_ • •· -· -·• · · · • _ _ _ _ _ _ · - ••• • • 1 - - - - - - - - - - _ _ _ _ _ _ __ ••• ••• •• 6 C_L_U_ST_E_R_I_N_Gi OF ii ____C_R_Y_P_T_A_NA_L_Y_T l C DA_T_A • · •-• • • a -----p· 7 •••• • ·· ··12 w ro n11 ' ' '___________________ ···· ·· ••••••••••• 9 ·1 • Ott Jr 13 _________________________ --- -- • TIIIU 8Q1illll l • IS IIU fJIHI 188R ORB llliltbllill eP IIIIR •••••••••••• 1 S _ • •• • •••• • ••• 1 7 ••• •••• • • 19 P 2 Jig 1117151 1557272 IBIS 1 M27 7 M 11 cm w rrnrz c D 7 IS Jlt o N tfl 11 %J t C I 1 t Not A Final Version - Proposed Release for MOR Case t 10943C I T8P 81fJRl lf lllOP ililiRIIT I Non - Responsive - ----- ---- -- 8DOM• YES DON TH I ISAN ELINT ·- I Chief w Of fl ce otffiT W2 4 PL 86-36 50 USC 3605 Yes Don there i a an BLINT Because you don't recognize it doesn't mean it doesn't exist Your NSA colleagues who plant it seeds who nurture its growth who channel i ts energies and who harvest its fruits resemble in niany ways the 1110re nor111al NSA e111ployee You might therefore have as 111uch diffi culty recognizing an ELINTer as you do ELINT but believe me thoy exist too In the April issue of CRYPTOLOG you asked if the real ELINT would stand up You indicated that it appears to be a shadowy operation and that 111any COMl 'ITers would like to know what it is all about Happy to oblige je ELI Ters have been so busy practicinR our science art that we didn't notice all of you waiting to be enlighted in the ways of ELltn' - perhaps to join the fun We're a proud bunch who know we are an NSA •inority specialty group with an iniportant job to do and we think that we're doing it rather well We can do it even better and we are lfOrking at that We will attempt to throw light into the shadows remove mystery and minimiie jargon Fonnal definitions of ELINT do in fact in• elude all non-communications electronic emission intelligence except lightning and nuclear emissions As practiced at NSA our energies • Don Bulla Will the Reat ELlNT Please Stand Up CRYPTOLOC April 1976 p S August 76 are devoted primarily to £LINT associated with potentially hostile 111ilitary-threat weapon systems Yes -- this represents the analysis of weapon systems prilllBrily through their radars radar1 ike devices weapon-control electronics ja111ming signals associued with all of these and the jafflllling of communications signals NSA partitions ELINT into two classes Operational ELTNT and Technical ELINT Telemetry•· TELI -rT · - is the province of WI Perhaps they will tell you about that so111etime Since October 1974 most Operational F l rNT activities are handled by the appropriate A 8 or 'G Group analytic e l ements Technical ELINT is focused in W's Office of HINT W2 What is the difference Simply stated the following illustrates the products of the two tYPeS of ELINT infoTmation Tech icat ELIHT p ovide6 • signat descriptions -- All the parameters of a signal that can reasonably be defined are collected and measureJ to a degree collllllensurate with our capability and the degree of m litary interest These measurements provide the ingredients for analysis of the e-ission characteristics and assessment of the emitter • m ssian characteri stics -- The signals and combinations of signals ate analyzed from signal descriptions The character of the CRYPTOLOG • Page l lillUiilHilf Ill 11131 r 1ff I SC tit ii El 11 PR S 9 EO 3 3b 3 0R61HiT emissions is determined to establish how best to exploit them and to gain insight into the degree of threat thev mav renresent • modes of oi el ltion I P L 86-36 50 use 3605 · • emitter functional So what does Operlfiional ELINT provide that has not been di scuss¢ On those emitters descri ed by Technical ELINT Ope 11 a tional HUIT pJt ov idu • emitter dei iloumentl • l J JQPOn-system associational' August 76 • CRYPTOLOG Page 2 011011 lltPi i IT SC F 11 d I Ill II BIHllllT ________________ _________ use __________________ ••••• • EO 3 3b 3 PL 86- 36 50 I 3605 PL 86-36 50 USC 3605 DIA need for ELINT infonaation into specific coll6ction processing analysis guidance detai l ng the character of the data needed fro the world-wide var ety of collection reseurces Working wit V3 W2 has the data neetls and reporting instructions forwarded to the collectors who on contribute -ofJen these instructions are specifically taJ lored to their abiljty to contribute • collection and collectwn management -- W2 performs both collection and collection management functions Since space is limited and since th author's current responsibilities encompass Technical ELINT the remainder of this article will be devoted to Technical ELINT Perhaps a representative of A B or G Group will ela Orate on Operational ELINT in a subsequent issue of CRYPTOLOG As outlined earlier Technical ELINT is in general aimed at • understanding military threat weapon SYSte111s • • prov101ng s1m11ar 1ntormat1on on Janun1ng signals While the following remarks are neither comprehensive nor intended to show the only way that things happen in Technical ELINT they should serve to illustrate the basic activities of Technical ELINTers • Require ngnts definition -- Requirements are generated by the military operating commanders expressing their need for information on a potentially hostile new emitter for example a new radar or by their associated service intelligence agency analysts who are aware of the new radar and generate requirements on behalf of the operating co111111anders These service intelligence agencies are the • Pl-ocessing and processing 11t2nagement -- As with other steps in the ELINT procedure processing of collected data is accomplished in a variety of ways Processing is defined as the step between signal collection and analysis to be defined later Processing is accomplished at the point of collection at theater processing centers and Hq NSA Again NSA ELINTers have considerable impact on the quantity quality and location of ELINT processing • Analysis and analysis management -- ELINT analysis is defined as that part on the ELINT production cycle wherein analog and digital data is converted into intelligence infomation Hq NSA ELINTers perfoz n a substantial level of analysis directly 11anage analysis by contractors on specialized problems provide general analysis assistance and management to collectors and processing • Foreign Technology Division FTD for centers and are directly involved in the the Air Force management of analysis assistance being pro• Missi'te InteUigence Agency MIA for vided by the service science-and-technology the Army's large missile systems centers FTD MIA FSTC and NISC by formal • Foreign Science and Technology Center agreement between NSA DIA and the centers FSTC for the Army's general battleThe analysis and analysis management function field systems and electronic-warfare presents considerable technical and managerial intelligence and challenge but the challenge is being met • Navat Intelligence Support Center NISC with reasonable efficiency for the Navy • Repo ting and reporting IIIWlllgement -- The best intelligence infomation is absolutely The need for ELINT information is generaworthless until it is reported and used by ted by and through then service centers those who take action on the basis of such and forwarded to DIA for consolidation and infomation Thus since we cannot force the validation DIA in turn levies the recustomers to use our product our challenge quire ents on NSA is to report all potentially useful informaThe W2 Requirements Collection Managers tion in as complete timely and readable a with the appropriate analysts convert the format as possible with the important eleAugust 76 CRYPTOLOG Page 3 · £FfiPlilfl ------- - --- ----- - lit 1 Ti I t IILI llll · - I 8DORIT EO 3 3b 3 PL 86-36 50 USC 3605 ments highlighted With the vast variety of processes and procedures that lead up to the •• dissemination of an end-product report including a variety of field reporting procedures it is very difficult to keep the operation glued together Currently there is a very complex array of field reporting procedures and vehicles There is also currently however a comprehensive reporting So what have we done for you lateZy procedure study under ay with the objective Plenty -- aost of which should not be revealed • of simplifying the process As in the song in a broaa-distribution publication Come to us • we have High Hopes withn drclearancesandneed-to-know i tact and• The foregoing paragraphs are designed to we Jtll be happy to tell you give you a very quick survey of ELINT -• Yes Virginia I mean Don there is an _ e_s _e_c_ia_ 1_1_ · _T e_c _h_ n_i _c a l E _L_INT __-_-_ a_s_ r a_c_ t i c e d a_ t _N _S A -n°ELINT and the real ELINT should be happy to stand u To the benefact r of ELI 0 goodies provided by ELINTers are more ll•v-a l u-a b l e than gifts he received from Santa Claus We ELil'n'ers work so closely with our electronic warfare customers contractors a rather broad range of COMINTers and many others that we sometimes lose sight of the fact that we are in number a small part of the SIGINT effort and that we are well known to only a relatively few We thank you for your reminder that we do need to pause occasionally for a bit of publicrelations exposure even within the Agency Hope this short discussion helps Want to know more Contact us II HI Aueust 76 • CRYPTOLOG Page 4 SECRET MCNPIE MIi GOMBZ CMPNNEIE OtlfY •1-N•o- n- -R - e_s_p_o_n_s_1 _·-v-e- I Non - fJllflJRllf Responsive • August 76 CRYPTOLOG Page S i111'311FT - II I T Ill L SIil I Non - Responsive August 76 • CRYPTOLOG 8B@IIBf Page 6 71 Pit St iii I PL 86-36 50 USC 3605 I lbLllfl I ••• ••• ••• • er OHl'J archical or nonhierarchical in nature In hierarchical clustering a set of nested clusters is obtained ranging from one set containing all n objects ton sets each containing one object Hierarchical techniques maY be subdivided into agglomerative merging and divisive splitting strategies Hierarchical-agglomerative methods begin with n clusters each containing one object and proceed by a series of successive fusions of nearby clusters until one cluster containing aJ l n objects is obtained Hierarchical-divisive methods begin with all n objects in one cluster and produce successive splitting into finer subsets During the past year CADRE a Pl RSl group IIICI UST Hierarchical CLUSTering is a headed by has been investigating hierarchical-agglomerative method using the cluster analysis and multidimensional scaling nearest-neighbor and farthest-neighbor algoand has been assessing the relevance of those techniques to Agency work A number of computer rithms PEP-1 Probablity Evaluated Partitions Version is a hierarchical-divisive-method • programs implementing those methods have been using graph-theoretic concepts HICLUST was acquired and adapted to Agency computers written at Bell Labs PEP-I is a member of the Two hierarchical clustering algorithms Guttman-Lingoes Nonmetric Program Series UniHICLUST and PEP-1 have proved to be quite use- versity of Michigan Psychology Department ful in a variety of Agency problems CADRE has AZZ clustering algorithms are designed to studied several cryptanalytic applications with produce clusters regardless of the structure of highly encouraging results For example for the data Most clustering techniques make asmatching alphabet profiles HICLUST and PEP-1 have been demonstrated to be substantially bet- sumptions concerning the number and shapes of clusters in the data HICLUST and PEP-1 attempt ter in the sense of producing a more accurate to produce clusters using the intrinsic strucresult than the XIBAR method the traditional ture of the data and both programs especially Agency approach based on cross J C values P P-1 ge erate statistics to help the analyst Furthermore recent RSl research suggests that d1fferent1ate clusters from random groupings the cross I e measure itself may be signifiBoth_HICLUS and PEP-I analyze a square cantly inferior to other types of comparisons symmetric matrix whose entries measure either such as correlation coefficients normalized the distance or the likeness between objects dot products and Euclidean distances Both programs are very easy to operate and Cluster analysis seeks to categorize n are available on LODESTAR the IBM 370 and objects ea h defined in terms of values associ- the RS 6600 ated with p variables or attributes into g Here is an example which illustrates the homogeneous subsets clusters Clustering algorithms may be classified as being either hier- type of situation in which PEP-1 and HJCLUST ••• • • •·•• 1 • I • August 76 CRYPTOLOG • Page 7 819RliW iPQICli j 8R811 DII 8P8HR have proved to be valuable Suppose a cipher stream is suspected of having been generated by a periodic polyalphabetic system with a SO-wide key and the objective is to determine the number of different alphabets or different slides of the same alphabet used and the key positions that are enciphered with the same alphabet Such a problem was solved in 1974 using statistical programs available on the RYE computer system In 1976 this cipher was reexamined by CADRE using oodern cluster analysis and multidimensional scaling methods The CADRE techniques easily and perfect ly determined the number of alphabets used and the key positions enciphered by the same alphabet A hierarchical-clustering repres ntation of the results from HICLUST and PEP- 1 is shown in Fig 1 The clusters can be interpreted in a more moaningful fashion by means of the matrix in Fig 2 The statistics generated by PEP-I and HICLUST coupled with Fig 2 clearly establish the validity of the clustering More details about thi •exam 'le i lr d about additional examples invptving 1J ewrtter-random key generation and codebook re4oonstr ction can be found in the rec ritly publ hed R l' _ aper The Hierarchfoai Ctuste1'ing pJ Cryptana ytic 1 Qta and Cc ·ii n idimendo l Scaling hy 9andf RSl TECH 0 7 ate rch976 You may ht · bpy of this paper by calling Mrs n the RSI Li fary Room 3Nl Ol-3 w ·th s Key 1 2 3 4 19 23 37 s 41 6 9 10 46 17 4 18 22 21 25 35 36 15 16 3 17 4 5 18 19 6 20 7 11 8 9 12 13 10 14 Fig 2 3 7 11 posi tions enciphered b J each slide I 2 7 8 32 I CADRE is investig ting more sophi icated clustering approach and also multid imensional scaling methods for the case in which a paradigmatic structure such as a linear br circular ordering of the ppints is sought insfead of clusters To farther extend its research effort CADRE is ctively seeking data sets cryptanalytic r other from nU111erous Agency offices lnq iries about the computet programs used by CADRl or questions about submission of dal asets frr analysis should be direr ted either to RSI S530s orl _ RSI xS s SUde s PL 86- 36 50 USC 3605 - - 29 30 21 22 23 24 25 26 27 28 33 34 35 36 37 47 48 49 50 38 41 42 39 40 44 43 31 45 32 46 lnterpre tat ion of cluster structure after revision SSSPET - snars 39 so 6 20 24 2 8 43 49 12 38 16 42 Zf 30 34 40 44 48 Fig 1 Hierarchical clustering of PF P-1 and HICLUST results Au11 ust 76 CRYPTOLOG • Page 8 SESPFT iPQliE I Non - Responsive I I Non - UNCLASSIFIED August 76 CRYPTOLOG UNCLASSIFIED Pa_Je 9 Responsive UNCLASSIFIED August 76 • CRYPTOLOG • Page 10 UNCLASSIFIED I Non - Responsive I I I Non - UNCLASSIFIED Re span si ve r------------' August 76 CRYPTOLOG • UNCLASSIFIED Page 11 •' - I I Non - Responsive UNCLASSIFIED August 76 CRYPTOLOG Page 12 UNCLASSIFIED I EO 3 3b 3 PL 86-36 50 USC 3605 8 @811 • •• H tma r11a1 1141U11 s· c s 1 IT IIIAIICH ·7 rR•F lll l n II MARCH • • • C tl - c -ff t 5 _ Ml ' I T • 8 1•1• ll19 UH111 -- - L-ll -ac 1 1 L G- AEv1 w DEQM-R Tif 11 lS us1• 14 - lit • a J aj ilW l t'' f J_ _ i L llUJU - c c fJUNE J AN - R'VtEW 8 6 N s • OCC Elo'I JUNE lf$ $ll B f 1 1 1 1 f t f f- f Pif 1 • • the other hand in spite of the resource • On decTe111ent the intelligence requirement continues SIGINT remains our first line of defense and it is incumbent upon us to respond to this charge with al 1 the Tesourcefulness we can muster August 76 • CRYPTOLOG • Page 13 SFCDEII' am 5 JfJ I 50 1BT S iiJP Pi 2 It 3 3b 3 86-36 50 USC 3605 r------------------------rr ·u• • · · • · • · ________________ ' If you are still with me to this point please don't send me any letters saying that we are already doing all of this For each case you cite wherein the full objective has been achieved I can cite two or three wherein the objective was either ignored or effectively undermined and that is not my -purpose in any case · What I am earnestly requesting is that this Agency recognize an area which will be of vital importance in the future and take every reasonable step to insure we are up to the challenge f we are to succeed as succeed we must we need to be innovative thorough deliberate and above all cohesive in our integrated analyst program management and it i s within our capabilities to do so We as an Agency should not settle for anything less -- - - August 76 CRYP'l'Ol OG • Page 14 EFCPET -- --- --- _ - - arm w - w II I I IIUIIIIII Jiii Y I I Non - UNCLASSIFIED August 76 • CRYPTOLOG • Page 1S UNCLASSIFIED Responsive I - - - - - - - - • - - - •- • - t-• ·-- ·- _ __ _h • UNCLASSIFIED August 76 CRYPTOLOC Page 16 UNCLASSIFIED I Non - Responsive I I Non - Responsive UNCLASSIFIED I '• August 76 CRYPTOLOG Page UNCLASSIFIED ------ 17 I --------- ' _------ L-I_N o-n - Responsive I tl JIQP •I - r J'il l g tJ idf I - ugus 16 • C lYPTOLOG • Pa e 18 I Non - Responsive SECHI I PJPO IHI August 76 • CRYPTOLOG • Pa2e 19 SEJR ftt 8P0HD mcuu ero 110 August 76 • CRYPTOLOG • Page 20 fJEOIUiT av urn I Non - Responsive I Non - Responsive iDHRII Si URE August 76 • CRYPTOLOG • Page 21 ililtilHiJT iP8 IIH ---------- I Non - Responsive MP 111111 111110 BOOIIUIUT 68UT ilflf I fJOBfHI 626 Mk IEiliAZ IOP IICREI I