Documents
Metadata Sharing Memorandum (2005)
Aug. 25, 2014
UNITED STATES GOVEWENT
memorandum
TAC-{lss-{l?
DA TE: {16 July 2{l{l?
REPLY TO ATTN OF: TDJTAC
SUBJECT: Sharing of MetaData across the IC of SIGINT Metadata
Beyond NSA
OU - MEM ORAN DUM OF UN DERS TAN DIN
TO: DIR
THRU: NCR
DISH) .51 82?53
REFERENCES: A. (C) Request for additional NSA data for
Program. (dtd: It] Mar
B. (C) Minimisation Plan for the Application of
Analytical Software to NBA SIGINT Acquired Telephone
Call Control Data. dated 2U Jan 1999.
C. (C) MDU between NBA and FBI for Access to NBA Data in
the CRISSCROSS Program, dated 19 Jan Zil?l.
D. (C) MDU between NBA and DIA Regarding the
Program. dated 19 Jan mm.
B. (U) NSAICSS Policy 1-9. Information Sharing dated 26 May
PURPOSE: (U) To establish the and NSAJCSS as the US. IC
Esecutiye Agent for IC-wide metadata sharing.
BACKGROUND:
(SHNF) Except for a few point to point sharing initiatiyes, is
the current 1C (plus) information sharing structures. is a CIA-
managed program which proyides extracts from selected Agency (NSA. CIA, DIA. FBI
and DEA) databases of telephone call records and reference data obtained from
Dcriacd From: NSAICSSM 1?52
Dated: 123
Dcclassil'y Un:
UNITED STATES GOVEWENT
memorandum
TAC-{lss-{l?
DA TE: {16 July 2{l{l?
REPLY TO ATTN OF: TDJTAC
SUBJECT: Sharing of MetaData across the IC of SIGINT Metadata
Beyond NSA
OU - MEM ORAN DUM OF UN DERS TAN DIN
TO: DIR
THRU: NCR
DISH) .51 82?53
REFERENCES: A. (C) Request for additional NSA data for
Program. (dtd: It] Mar
B. (C) Minimisation Plan for the Application of
Analytical Software to NBA SIGINT Acquired Telephone
Call Control Data. dated 2U Jan 1999.
C. (C) MDU between NBA and FBI for Access to NBA Data in
the CRISSCROSS Program, dated 19 Jan Zil?l.
D. (C) MDU between NBA and DIA Regarding the
Program. dated 19 Jan mm.
B. (U) NSAICSS Policy 1-9. Information Sharing dated 26 May
PURPOSE: (U) To establish the and NSAJCSS as the US. IC
Esecutiye Agent for IC-wide metadata sharing.
BACKGROUND:
(SHNF) Except for a few point to point sharing initiatiyes, is
the current 1C (plus) information sharing structures. is a CIA-
managed program which proyides extracts from selected Agency (NSA. CIA, DIA. FBI
and DEA) databases of telephone call records and reference data obtained from
Dcriacd From: NSAICSSM 1?52
Dated: 123
Dcclassil'y Un:
HUMM, Ctpen and law enfercement related seurces te in U. S. law
enforcement and intelligence cemmunities at a level. The
key data elements are stered and retrieyed fer display by the Interface include:
called and calling telephene numbers, date, time, and duratien ef calls.
(SHNF) Fer appresimately the last 5 V2 years, the CIA (new PRUTDN)
pregram has been incerperating NSA preyided SIGH?JT-deriyed (U. S. and SecendiThird
Party) data. NSA preyides this infermatien te Agencies fer
(SHNF) The decisien te disseminate Sl?lNT-deriyed signaling eutside
Channels alse hadpeffcy and eperetienei dimensiens. Tests haye demenstrated that
derived and traditienal call recerd data can be stered and
displayed in a manner which makes them appear te be indistinguishable, which in general
terms make the risks te seurces and metheds appresimately equal. Heweyer, under seme
circumstances, signaling data ferm a unique target area, which ceuld haye ceme enly
frem a sensitive seurce, disseminatien ef data te weuld be
inapprepriate. This is the case when the data alse includes infermatien elements that are
enly available and ceuld enly ceme frem espleitatien ef signaling. The MBA is silent en
this peint, leaying te NSA full decisien autherity te decide which data te preyide and net
preyide.
(C) Fer several years prier, NSA had been preyiding SIG]NT-deriyed signaling
infermatien te CIA and DEA te suppert multi-agency ceunter narcetics analysis, as
appreyed by DDCI, SEC, and the Office ef Pelicy. Calling data frem seyeral Latin
American cellecters, and frem Thailand, had been ef great value te the DEA and te the
DCI Crime and Narcetics Center, and there were ne adyerse eperatienal er legal impacts
te NSA.
(SHNF) Gperatienally, the flew ef large 1aelumes ef intercepted signaling data
eeuld place additienal burden en IT infrastructure. While, as abeve, the MBA did
net address IT infrastructure, NSA retained full discretien eyer 1selume and timing ef
infermatien flew, even as NSA chese te suppert the pregram
with certain inputs.
(SHNF) Requisite human and cemmunicatiens reseurces are in place in te
suppert the transfer ef mederate yelumes ef signaling-derived call recerd data te the CIA
Pregram Office. Ne increase in persennel was required te
initiate data flew. Under the terms ef MBA, CIA preyided the list erS eyerseas
cemmercial phene numbers te be minimised in NSA precessing ef signaling data.
Similarly, the Department ef State and Department ef Defense telephene directeries will
be researched by NSA te identify efficial US geyernment eyerseas phene numbers in
erder te minimise call recerds asseciated with them. Te this end, the NSA
Pregram Manager agreed te ebtain the DDS and DOD
directeries annually and, with CIA assistance, estract the eyerseas numbers. That
functien was transferred te the Cemmunicatiens Eyent Analysis Center (CEAC), in S2S,
in 2mm. The seftware te estract call recerd data and te suppert minimisatien esists en a
Handle Via COMIN Channels Only
SECRETIINOFORNIMR
HUMM, Ctpen and law enfercement related seurces te in U. S. law
enforcement and intelligence cemmunities at a level. The
key data elements are stered and retrieyed fer display by the Interface include:
called and calling telephene numbers, date, time, and duratien ef calls.
(SHNF) Fer appresimately the last 5 V2 years, the CIA (new PRUTDN)
pregram has been incerperating NSA preyided SIGH?JT-deriyed (U. S. and SecendiThird
Party) data. NSA preyides this infermatien te Agencies fer
(SHNF) The decisien te disseminate Sl?lNT-deriyed signaling eutside
Channels alse hadpeffcy and eperetienei dimensiens. Tests haye demenstrated that
derived and traditienal call recerd data can be stered and
displayed in a manner which makes them appear te be indistinguishable, which in general
terms make the risks te seurces and metheds appresimately equal. Heweyer, under seme
circumstances, signaling data ferm a unique target area, which ceuld haye ceme enly
frem a sensitive seurce, disseminatien ef data te weuld be
inapprepriate. This is the case when the data alse includes infermatien elements that are
enly available and ceuld enly ceme frem espleitatien ef signaling. The MBA is silent en
this peint, leaying te NSA full decisien autherity te decide which data te preyide and net
preyide.
(C) Fer several years prier, NSA had been preyiding SIG]NT-deriyed signaling
infermatien te CIA and DEA te suppert multi-agency ceunter narcetics analysis, as
appreyed by DDCI, SEC, and the Office ef Pelicy. Calling data frem seyeral Latin
American cellecters, and frem Thailand, had been ef great value te the DEA and te the
DCI Crime and Narcetics Center, and there were ne adyerse eperatienal er legal impacts
te NSA.
(SHNF) Gperatienally, the flew ef large 1aelumes ef intercepted signaling data
eeuld place additienal burden en IT infrastructure. While, as abeve, the MBA did
net address IT infrastructure, NSA retained full discretien eyer 1selume and timing ef
infermatien flew, even as NSA chese te suppert the pregram
with certain inputs.
(SHNF) Requisite human and cemmunicatiens reseurces are in place in te
suppert the transfer ef mederate yelumes ef signaling-derived call recerd data te the CIA
Pregram Office. Ne increase in persennel was required te
initiate data flew. Under the terms ef MBA, CIA preyided the list erS eyerseas
cemmercial phene numbers te be minimised in NSA precessing ef signaling data.
Similarly, the Department ef State and Department ef Defense telephene directeries will
be researched by NSA te identify efficial US geyernment eyerseas phene numbers in
erder te minimise call recerds asseciated with them. Te this end, the NSA
Pregram Manager agreed te ebtain the DDS and DOD
directeries annually and, with CIA assistance, estract the eyerseas numbers. That
functien was transferred te the Cemmunicatiens Eyent Analysis Center (CEAC), in S2S,
in 2mm. The seftware te estract call recerd data and te suppert minimisatien esists en a
Handle Via COMIN Channels Only
SECRETIINOFORNIMR
server under S2S control. A huge volume of signaling data records) flows to that
server on a daily basis to meet NSA analytic needs, and sufficient communication
bandwidth is currently available to support the transfer of processed call records
per day) to CRISSCROSSIPROTON Program for reformatting. We anticipate S21
will continue to be responsible for leading CIA output on
CRISSCROSSEPROTON server, and CEAC will continue to be responsible for
maintaining minimization and audit controls on all-source data received from CIA.
Finally, Office of Oversight and Compliance would be responsible for oversight of
USSR) 13 compliance.
(S) Community analytic interest in dialing analysis continues to grow and is
directed at discovery of new specific targets or topics, and demand for additional call
record volume to support contact chaining and geolocation has increased. Signaling links
are competing for collection priorityjust like any other potential target. As with
other targets, the potential to espand collection is limited by available resources, to
include field processing of signaling links as well as bandwidth to support forwarding
from collection sites to NSA.
(SHNP) The CRISSCROSS program, in which NSA already participates as a user
of data, has had notable successes since its inception in 19%, such as enabling major
narcotics arrests, monitoring Ramsi Yous ef?s colleagues, unraveling the Mubarak
assassination plot, and providing insight into Pakistani nuclear weapon test activities. The
program has received high marks from senior Community levels, such as the PPIAB, and
Assistant for both Collection and Production. CRISSCROSS was also cited in the
report by Admiral Jeremiah on Indian nuclear testing as a potential improvement to
Community analytic strength. Since 9H 1, the contributions to the GWOT due to our
increased collection of signaling metadata are innumerable and significant. It is safe to
say that it has been a contribution to virtually every successful rendition of suspects and
often, the deciding factor. Hence the benefit to the intelligence and law enforcement
communities of any SIGlNT-augmented inputs could be considerable, as has the
potential to access a broad range of targets.
CURRENT PROPOSAL: (SHNP) Ref A. requests additional data elements from
collection be included in the data set transferred to PROTON. Specifically, they
want mobility management information relating to digital cellular and mobile satellite
systems to include Global Cell Location Area Codes, spot beams, International
Mobile Subscriber Identifications, International Mobile Equipment Identifications,
LatitudefLongitude, and Imnarsat Return lD?s. They also requested content from Short
lvles sage Service eschanges (which we are required to audit queries against).
DISCUSSION: The current data push to is roughly 4U
lvlillion records per day which has resulted in approximately 3tl?ii: of the PROTON data
set (1996-2?fl5) coming from sources The addition of the
requested data elements would more than double the volume ofdata sent to PROTON on
a daily basis. This would increase the percentage of contribution to PROTON
significantly. CIA is positing PROTON as the community resource for targetflead
Handle Via COMIN Channels Only
SECRETHNOFORNIMR
server under S2S control. A huge volume of signaling data records) flows to that
server on a daily basis to meet NSA analytic needs, and sufficient communication
bandwidth is currently available to support the transfer of processed call records
per day) to CRISSCROSSIPROTON Program for reformatting. We anticipate S21
will continue to be responsible for leading CIA output on
CRISSCROSSEPROTON server, and CEAC will continue to be responsible for
maintaining minimization and audit controls on all-source data received from CIA.
Finally, Office of Oversight and Compliance would be responsible for oversight of
USSR) 13 compliance.
(S) Community analytic interest in dialing analysis continues to grow and is
directed at discovery of new specific targets or topics, and demand for additional call
record volume to support contact chaining and geolocation has increased. Signaling links
are competing for collection priorityjust like any other potential target. As with
other targets, the potential to espand collection is limited by available resources, to
include field processing of signaling links as well as bandwidth to support forwarding
from collection sites to NSA.
(SHNP) The CRISSCROSS program, in which NSA already participates as a user
of data, has had notable successes since its inception in 19%, such as enabling major
narcotics arrests, monitoring Ramsi Yous ef?s colleagues, unraveling the Mubarak
assassination plot, and providing insight into Pakistani nuclear weapon test activities. The
program has received high marks from senior Community levels, such as the PPIAB, and
Assistant for both Collection and Production. CRISSCROSS was also cited in the
report by Admiral Jeremiah on Indian nuclear testing as a potential improvement to
Community analytic strength. Since 9H 1, the contributions to the GWOT due to our
increased collection of signaling metadata are innumerable and significant. It is safe to
say that it has been a contribution to virtually every successful rendition of suspects and
often, the deciding factor. Hence the benefit to the intelligence and law enforcement
communities of any SIGlNT-augmented inputs could be considerable, as has the
potential to access a broad range of targets.
CURRENT PROPOSAL: (SHNP) Ref A. requests additional data elements from
collection be included in the data set transferred to PROTON. Specifically, they
want mobility management information relating to digital cellular and mobile satellite
systems to include Global Cell Location Area Codes, spot beams, International
Mobile Subscriber Identifications, International Mobile Equipment Identifications,
LatitudefLongitude, and Imnarsat Return lD?s. They also requested content from Short
lvles sage Service eschanges (which we are required to audit queries against).
DISCUSSION: The current data push to is roughly 4U
lvlillion records per day which has resulted in approximately 3tl?ii: of the PROTON data
set (1996-2?fl5) coming from sources The addition of the
requested data elements would more than double the volume ofdata sent to PROTON on
a daily basis. This would increase the percentage of contribution to PROTON
significantly. CIA is positing PROTON as the community resource for targetflead
Handle Via COMIN Channels Only
SECRETHNOFORNIMR
deyelepment hased en eentaet ehaining teehniques. In this regard it is estremely diffieult
te enyisien it playing that rele at NSA. PROTON requires a NOFORNIORCON
must he lieensed, has ne API that weuld allew integratien with ether teels
Federated query) and, represents a signifieant funding investment and dependeney en a
CIA eentraeter.
RECOMMENDED RESPONSE: In the eentest ef the atmesphere
ereated hy the eyents ef {lgfl Hill and the fellewing inyestigatiens inte the pereeiyed
?intelligenee failure? a reetn'ring theme has been the lack ef data sharing en the part ef the
IC memhers. Against that haekgreund, it is diffieult te deny requested te SIGINT-
enly datasets that are theught te haye yalue te ether intelligenee In an
effert te:
preyide te the requested data and,
break new greund in the infermatien sharing arena while,
net meying any mere data eut ef NBA and inte duplieatiye sterage.
We prepese te utilise the 1C shared infermatien spaee ICSIS en INTELINK and
implement 1C te eur GLOB ALREACH federated query seryiee yia
and yerified hy eertifieates. This seryiee will preyide the requested and
permit the auditing legally required ef NSA. Further, we request that CIA ferward
PROTON data frem seurees te NSA fer inelusien in the dataset searehed hy
GLOBALREACH. Fer data that must remain in HCS ehannels, we will ereate an HCS
partitien in FASCIA II. This will permit ene-step te eentaet infermatien fer 1C
We helieye that we ean haye GLOBALREACH ayailahle in the ICSIS shared
spaee hy {ll Oet Etl??.
RECOMMENDATION: (FOUO) That yeu sign the enelesed nete te the Offiee
ef the Direeter, Natienal Intelligenee. iiuestiens efa legal nature sheuld he direeted te
AGC (Operatiens), Operatienal questien sheuld be direeted
ateeawrac Teehnieal Direeter,_
SIGDE VITAE TD
Handle Via COMINT Channels Only
SECRETHNOFORNUNIR
deyelepment hased en eentaet ehaining teehniques. In this regard it is estremely diffieult
te enyisien it playing that rele at NSA. PROTON requires a NOFORNIORCON
must he lieensed, has ne API that weuld allew integratien with ether teels
Federated query) and, represents a signifieant funding investment and dependeney en a
CIA eentraeter.
RECOMMENDED RESPONSE: In the eentest ef the atmesphere
ereated hy the eyents ef {lgfl Hill and the fellewing inyestigatiens inte the pereeiyed
?intelligenee failure? a reetn'ring theme has been the lack ef data sharing en the part ef the
IC memhers. Against that haekgreund, it is diffieult te deny requested te SIGINT-
enly datasets that are theught te haye yalue te ether intelligenee In an
effert te:
preyide te the requested data and,
break new greund in the infermatien sharing arena while,
net meying any mere data eut ef NBA and inte duplieatiye sterage.
We prepese te utilise the 1C shared infermatien spaee ICSIS en INTELINK and
implement 1C te eur GLOB ALREACH federated query seryiee yia
and yerified hy eertifieates. This seryiee will preyide the requested and
permit the auditing legally required ef NSA. Further, we request that CIA ferward
PROTON data frem seurees te NSA fer inelusien in the dataset searehed hy
GLOBALREACH. Fer data that must remain in HCS ehannels, we will ereate an HCS
partitien in FASCIA II. This will permit ene-step te eentaet infermatien fer 1C
We helieye that we ean haye GLOBALREACH ayailahle in the ICSIS shared
spaee hy {ll Oet Etl??.
RECOMMENDATION: (FOUO) That yeu sign the enelesed nete te the Offiee
ef the Direeter, Natienal Intelligenee. iiuestiens efa legal nature sheuld he direeted te
AGC (Operatiens), Operatienal questien sheuld be direeted
ateeawrac Teehnieal Direeter,_
SIGDE VITAE TD
Handle Via COMINT Channels Only
SECRETHNOFORNUNIR