TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL Special Collection Service Pacific SIGDEV Conference March 2011 The Overall Classification of this Briefing TOP SECRET COMINT REL USA AUS CAN GBR NZL TOP SECRET II COMINT II REL TO USA AUS CAN GBR NZL SCS Organization Special Collection Service F6 Chief of Staff Field Operations Office Special Operations Division scs SIGDEV Center Field Engineering Office Information Technology Division Access Analysis Division Mission Support Office Processing Architecture Division TOP SECRET COMINT REL TO USA AUS CAN GBR NZL Installation Logistics Office Global Support Division System Architecture Engineering TOP SECRET II COMINT II REL TO USA AUS CAN GBR NZL Strategic Partnerships ' DEA SIGINT Enabling HUMINT HUMINT Enabling SIGINT DIA FBI State sso NRO Secret Service Law Enforcement Homeland Security Tailored Access COVCOM Military CLANSIG Second Party TOP SECRET CO MINT II REL TO USA AUS CAN GBR NZL llection Processing Systems Facilities IT Infrastructure Communications Networks Tools Platform for Jransformational Activities' • Deployed Analysts TECHHUMIN l CJ New Presence Model People and Busirness l -riactices Access to Data Dissemination Methods Requirements Process Project Portfolio Mgmt Rotation Pol icy DNI Training T3 0 0 4 TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL Overview ·1-- Speciul Collection Service • • • • • • • Unified IT Core and Virtualization Cloud Computing Global Situational Awareness Beyond Traditional Accesses Coherent Digital Access Empowering Automation The SCS Cyber Advantage TOP SECRET r CO MINT fJ REL TO USA AUS CAN GBR NZL TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL Unified IT Core IT Services IT Infrastructure • Capability Improvements - Modern IT services and infrastructure to support a net-centric operational model and enhance maintenance and security • Capability Change - Rapid response SIGINT presence - Next generation virtual infrastructure - Diversified WAN topology enhanced LAN - Enhanced interoperable desktop - Improved email service - Workforce mobility - Robust collaboration environment - Site destruct enabler TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL El NSTEI N CASTAN ET TOP SECRET COMINT REL TO USA AUS CAN GBR NZL 4 l- TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL Speciul Collection Service INTERQUAKE • Terrestrial Environmental Knowledge Base - Available to all NSA analysts and partners • PANOPLY populates IQ with Emitter information and reports including - Signal Externals Radio and Payload information LACs and Cell ID's Protocol Stacks TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL TOP SECRET Ii COMINT 1 REL TO USA AUS CAN GBR NZL INTERQUAKE Spe a Colle• tion Service lVNAIUIIC PAGE - HIGH CST POSSIBLE CLASSIFICATION IS INTER•QUAKE ' c 1_ l J -1 l mltter '1- 0 4 1 f O l O rJ • Y l r M nn I l t- E mlttieir 0- Vlcw I_ B Site I 1 l lw I Ce10 u1t t ny ltR - Gm11p S 111 y RF s I-lows a 1 8 108 1 m llu 1111es IP p a sn p t ul s11 - R pu L' J Lt 1--- Misc 1 1-• H lp •• u s jt ' lJ5-9B3lJ - nf'lR LJS-SIEaU U ' ilU US-91 BU US 968U US-etEaU --m•• Iii -· ii us us- u s - 624 Q a I Fllt lr i f_d' IIP 17947 12792 13031 12775 5 lUlJlb a h1 1n IR a I Sit F1 •1 ifl1H - D l n ictlVQ IIR f I l l I US 968U US-968U ll -IJl x tl_l VVU1CT Wll'I G WU1AA WLJ1AJJ 1111 1A VIIUll lP ·-- O l l I Sl 11ul ' WU XX WU XX WlJAA - Sr nlnn 1 1 3e C OJ19396KA OJ 19396f'A C019396KA W 4 1 'J'JAA 19 396 19 3e6 1'_4 ' 4 24 1 J - 57 24 7 ln olmXA --- l l I DI Ex Ht 1-Sel e ct- BP r 1RuLu lt m ·19391 1- 'A WlJ l wuxx wuxx wuxx wuxx I ri1m 23 92G 23 926 23 926 2 1 ---- ---- ---- ---- Puylo 1 t fltvd DFSf flFSK 8FSK FSI-' 1' 8t lA M 1 di jOAM l AnAM 1 nc oAM l OQAM 126Qt M 96 31' I u IM1 84 -I TMl n n 1n 15 23 14 - DDD 057WA WLJ XX W LJ XX WlJAA - TOP SECREllJJ COMINllJJ REL TO USA AUS CAN GBR NZL E W H lH 1 ' 1 - 32 25 18 12flC IAM 128C IAM r- 1 2 V H H V H V V V H 27 40 35 JU Vi J4 31 TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL s1 olCollectionService • • CES SSC AAD VPN Surge Main Goal - To evaluate SCS VPN access and analysis to determine better methods of identifying and exploiting networks of interest Two Focuses - What can we do with VPN data that is already ingested into the system • Find better methods of reporting VPN stats and exploitation determinations from CES back to SSC and site - 1 re there methods to better identify and survey VPN's to provide CES the data they need • Can we leverage MIRROR D1 RKQUEST PANOPLY survey information to quickly identify and report the presence of VPN's in surveyed signals • Can we use BIRDWATCHER or other means to automatically resurvey for key exchanges and obtain paired collect TOP SECRET r CO MINT fJ REL TO USA AUS CAN GBR NZL TOP SECRET I COMINT II REL TO USA AUS CAN GBR NZL The SCS Cyber Advantage SIGINT prowess provides cyber advantage Broad Spectrum of Capability • ·· ••• • •• •• • •• • Unified operations provides holistic approach • •• The right intelligence delivered to the right customer ••• • • • • • Home field advantage in adversary's space • •• Where our customers want us and our adversaries do not Capitalizing on the element of surprise •••••••••••••••• Integrated Mission Signal access for collection exfil and infil Microwave WiFi WiMAX GSM CDMA Satellite etc Analysis Dissemination • • · • · • • • •• •• fi l r Living in the environment Insights on infrastructure and configurations Discovery of targets signatures and behavior 0 Tailored intelligence products Diverse products driven by national objectives and local needs through formal reporting target packages analytic insights situational awareness threat warning •••• ••••••••• •• •• • •• ···• Unique platform for conducting · and enabling IC operations Fully leveraging 30-years of experience within the NSA and CIA enterprises and using existing authorities TOP SECRET CO MINT REL TO USA AUS CAN GBR NZL SCS PoPs provide opportunities for access enabling and analysis