Declassified and Approved for Release by NSA on 12-03-2021 pursuant to E O 13526 MDR Case# 111021 WliltlOOllil m l CBC JmOOO lilCBWlCB li'lilWtr CillililWlills Ci lilliall 'lls liJ i W ILalllltil IPL 86-36 50 USC 3605 1 • SIGINT EXPLOITATION 1990 Robert L LOOKING AT MR XIBAR •••••••••••••••••• J Hunt • •• 1 • •2 •• 4 •• 6 TELEPHONE •• 7 PROBLEM HERE ••• • • ••• ••• W E Stoffel •• • ••• • 13 14 16 11 18 21 • · i11ts DOCtfl'tHJN'f C8NftlN8 OOBEWORB MAiCJIBRIAls TOP SECRET Non - Responsive a eetw DPRNU ICilllGa NH 1Gi8N •• lrm c O GDP RO 11111 Cst _ 2 B P iT lft oa PfedlMll• a 1a tit• Olfpa• •er a 8P BeORlff Published Monthly by Pl Techniques and Standards for the Personnel of Operations VOL V NO 4 APRIL 1978 'J OP SS8ftft'f Non - Responsive _ PL 86-36 50 use 3605 EO 3 3b 3 PL 86-36 50 USC 3605 CITATION 1990 V3 art of the pro'blem in SIGINT 'Exploitation for the 19Jos and 1990s is the silllllltaneous increa se in collection capacity because of improved technological sophistication and the ecrease in analytic and reporting capability be'tause of fiscal restraints To put it simply we ve collecting 1110re and exploiting less The1 e is a crying need to master the technology• which constantly threatens to drive our colle1 tion and apply it smartly to assist our analysis and exploitation If we cannot manipula e the massive amounts of data we are now able tD collect we are reduced to the primary £unction of selecting the constipation point in the SIGINT system Do we inundate our collection facilities and arbitrarily cut off the incomiJlg data in order to alleviate the load at the processing point Do we allow free flow of -voluminous collection to deluge the processors•and confine our processing to artificially s ringent limits gaabling that what is missed wtll not be missed Or do we overwhelm our custr r5 £h and indigestible amounts of__ __ __ gambling that what is s gni c nt w Se sum1 1arized Khat alternatives are there to preselecting the blockage area We must master our machines for use in analysis processing and reporting as well as in collection so that the monster that gathers also sifts While we cannot eliminate the hwnan element in exploitation we must provide help to that human element - the individual hers and hims -- in massasing the huge pile of material we are funneling into the SIGIJIIT system We must also gear the mechanical wizards we are building and buying to aid our reporters in preparing and presenting the information gleaned for specific customers who need it in a timely and lucid manner We must also design the machines to be used so that the human drivers can operate quickly comfortably and efficiently This concept is more complex than it appears since it encompasses both human-engineering aspects like Can the terminal be operated with existing lighting by someone wearing bifocals' and mechanical aspects like Can the operator get a report out in minutes to the right customers in a crisis when the computer system is saturated the terminal has been operating for 72 P PIP e 1 I hours continuously and the cunent report must• take precedence over 48 others in the queue ln addition to our own exploitation problems• at NSA we 11 USt also improve our aan-aachine • interfaces so that software cah be written quickly to assist anal sts in solvin technical analytic pro ems sot at eld stat ons a-n --r-emo- - t e d s7ites can be directed more intelligently toward collection of desired targets of known value as opposed to available targets of unknown value Our collection technology has faT outstripped the old-fuhioned collection manager who continually asked for all the activity an operator could find The dialogue between collection manager and collector must improve to include steerage and guidance based on and driven by mechanical applications and techniques which force the machine to disgorge 1DOre than regurgitated machine formats of exactly what was forwarded by individual collectors In SUlllllllry we must learn the techniques of controlling our 11 chines beyond just turning them on and watching them run and spit at us We must diTect thea to help us do a better job of collecting desired targets manipulating collection data processing significant infor mation preparing reports quickly disseminating needed information to selected customers rapidly and feeding back to collection sites to refine the process regularly This is not a simple task But if we are going to exploit SIGINT sensibly in what is left of the twentieth century the architect for SIGINT Exploitation IIIUSt address this part of the problem In reality it is not a new task Stating requirements establishing collection priorities directing collection analyzing and processing collection results preparing and disseminating intelligence to identified customers evaluating results and feeding back to field elements have been the basics of SIGINT Exploitation since before the waylaying of Greek messengers The critical task before us is to master the modern and sophisticated tools of the trade to improve our efficiency in handling the constantly increasing flow of SlGINT while avoiding and eliminating blockages that could lead rapidly to internal ruptures of the SIGINT Exploitation mechanism April 78 • CRYPTOLOG • Page 1 QNPIBBN'ftAt _ J · J IPL EO 3 3b 3 86-36 50 USC 3605 1 • ·_ ••J _ •· i • ' • - •• · ·- · ' • · • _· Ii t · - • ' -· I PL 86-36 50 USC 3605 f0P seeRB'f tii'tlBltA o t• • I' ' ' • I imr x1sAR ' 1 MM 41fitMl·#· ' ' • • • • • • we were introduc --r o l- 'l ' 'P r a cffl ca cluster analysis by the RSl CADRE team whose program PEP-1 purported to be a far 110re refined method of ho1110geneity testing than the traditional RYE • ro ram XI BAR April 78 • CRYPTOLOG Page 2 'F9P BE0RB'f HMBRi • • • j i r 8• ra· •d• • PI •• ' - • _j • • • EO 3 3b 3 PL 86-36 50 USC 3605 T8P E€ftET tifltlBlb l l J ·J Nots h I CRYPT LOG Crwptdnaty ie Editor XlBAR a progr written by Marjorie Mountjoy has been -resident on RYE for many years and has been•the standard clustering program for NSA cr tanalysts Ibe preceding article byl I by comparing he resuLts from XIBAR and PEP-1 served as a reminder that CRYPTOLOG needed to have a lool at llSl's recent work on cluster analysis I dkedl I for an article on PEP-1 andl _ responded to my plea l ith his article A Little PEP Talk which fo Uow_s th S note 1 hsers can find operating instructions for PEP-1 in file GDOC The references below contain descriptions of the different measures available in PEP-1 some examples of applications to Agency probleas and sample output Referencse Cluster Analysis Introduction to Models and Methods ' 1 l_ _ _ _ _ _ -1 NSA Tech iiaal TournaZn ol XXII No 2 Spring 1977 -iSe- • How to Copi with a Cluster Analysis Problem 6 RSl Cluster Analvsis Software Pac1ta1e L IRS1 PROG-NOTE • • Z 1 1 17 Aarch 1977 • The main diffeienc• between XIBAR and PEP-i • • lies in •he niannei •in•which thresholds are set he Hierarchical Clustering of Cryptana1 XIBAR uses a sing t reshold level which can· • Y tic Data and C pa ison with bltieither bl prosrllll '4iomputed or arbitraril pre- • dimensional Scaling J I scribed VY the anal at As thel '8r • • •and 3#SA Teohnical TOUl'ticle indicates -change inJthe thresho a Sy • • Vol XXI •• l o 4 Fall 1976 ii ilil the analfst can cau 11 chang •in the XIBAR f1Us• 'An Applicatiorf of Multidimensional Scaling tering • On the oltllet hand since the N P l° • and Clu le r Analysis to a Tl2 Problem threshold levels e all computer-gel er ed • Analyting Similarity Matrices 1od ced they wi l produce 'the siua l clusterirtl fo Ul Hwman Perception and Judpent users •• The sequet ae of thresholds der 'led by IRSl TECli 04 2f Sep em er PEP-1 enables the analy t to obilin the ent re 977 U • • • • subcluster structuH of' the i t d ta b • • • • • • • c r Plii P CI single' computer •• • •• • • • • • - •• J b •I 0 • · · ' • 4 • 1 t • I • • • • 1·· Apt'J 78 CRYPTOLOG p age 3 •• # ' • • 1 P-L- 8 -6 - 3-6_ _SO _ U_S_C_ 3_ 6_0_5 r • 'POP seettE'f tit11Blt2 I Non - Responsive 1• • ·· _ ·•- --- Itron - Responsive I Non - Responsive Non - Responsive II ' l 4 ' l l i I JNon - Responsive J Non - Responsive Non - Responsive Non - Responsive • _j t I Non - Respons I OONl'IBBN'f tzl I we - W E Stoffel intercept n1 a telephone link between Brownsville and Carroll Valley and have noticed that several subscrib ers are using covemames to disguise their identity There are apparently five pairs of subscribers three of whom are believed to be naval because of their speech patterns and the other two are believed to be air-related The covernames are apparently changing daily and during the first 5 days we have only been able to maintain continuity on one pair of subscribers From the 6th on we cannot distinguish the services because the traffic has not yet been transcribed Evidently the same covername can be used by two different people on the sue day Date l lh9CMJB- vitZe MESA ·APEMAN Bc'TA PESO SLUGGER Navy link 1 Navy Navy A D A 0 MISFIT SEEDLING UNIT l 4 EQUAL HATBOX REGENT APEMAN DICTION 7 Navy link 1 Navy Navy A D with TRANSOM SCHOOLBOY II DISPLAY DISPLAY BRACELET AID Navy link 1 Navy Havy A U A D PILGRIM RIGGER 8 with SPHEROID MESA QUENCHER SOLID TIIRESillLD QUENCHER II TONIC ROWBOAT 9 FIGHTER GADGET GERUND SEQUEL VALUE A 0 MVSTIQUE with LEATHER BULLY SLUGGER TYPHOON FIGHTER II BETA VICTIM TON C BLINKER SWIVEL with GOSSIP INTENT QUENCHER II SPHEROID COUNTRY ti COUNTRY HEXANI ti DOWNHILL HATBOX ADAGE with IMPULSE 11 PLODDER HYSSOP MESA HORMONE AARDVARK SLUGGER 11 MISFIT GADGET CATBIRD with BARRETTE II JUNGLE DISPLAY LINDEN PULLET II LACEWING CHASER II PROJEC l MORAY AID Navy link 1 Navy Navy A 0 A D with 6 Idlmtif- Navy link 1 Navy Navy VaZZe1i with OVAL CATBIRD TRANSOM SOLID II PULLET ALBUM RIGGER GOSSIP VALUE SPHl ROID VICTIM LOUVER 2 CCZJ'l'OZZ s 10 with VICTIM II IMPULSE II COMPRESS VICTIM II STACKER BLIN ER with BULLY SCHOOLBOY MYSTIQUE SHILLING CHASER SINEW PESO ti TRANSOM BRACELET Recover the continuities system a nd generation Soluti on Jill appeaz ne t month J April 78 • CRYPTOLOG • Page ll ___________ _ _ __ C8NPIBt N'FJMJ - • J HMIBt IJfi' 8fH lff eltA flftt elf ' -- - · - fl __ INon - Responsive I Non - Responsive I ___ _ __ __ __ __ 9 _ 1Non - Responsive Non - Responsive I Non - Responsive ·---- - -- - -- ---------------------------------- I Non - Responsive I ' l Non - Responsive Non - Responsive Responsive I