Documents

Metadata Sharing Memorandum (2005)

Aug. 25, 2014

1/4
Download
Page 1 from Metadata Sharing Memorandum (2005)
UNITED STATES GOVEWENT memorandum TAC-{lss-{l? DA TE: {16 July 2{l{l? REPLY TO ATTN OF: TDJTAC SUBJECT: Sharing of MetaData across the IC of SIGINT Metadata Beyond NSA OU - MEM ORAN DUM OF UN DERS TAN DIN TO: DIR THRU: NCR DISH) .51 82?53 REFERENCES: A. (C) Request for additional NSA data for Program. (dtd: It] Mar B. (C) Minimisation Plan for the Application of Analytical Software to NBA SIGINT Acquired Telephone Call Control Data. dated 2U Jan 1999. C. (C) MDU between NBA and FBI for Access to NBA Data in the CRISSCROSS Program, dated 19 Jan Zil?l. D. (C) MDU between NBA and DIA Regarding the Program. dated 19 Jan mm. B. (U) NSAICSS Policy 1-9. Information Sharing dated 26 May PURPOSE: (U) To establish the and NSAJCSS as the US. IC Esecutiye Agent for IC-wide metadata sharing. BACKGROUND: (SHNF) Except for a few point to point sharing initiatiyes, is the current 1C (plus) information sharing structures. is a CIA- managed program which proyides extracts from selected Agency (NSA. CIA, DIA. FBI and DEA) databases of telephone call records and reference data obtained from Dcriacd From: NSAICSSM 1?52 Dated: 123 Dcclassil'y Un:
UNITED STATES GOVEWENT memorandum TAC-{lss-{l? DA TE: {16 July 2{l{l? REPLY TO ATTN OF: TDJTAC SUBJECT: Sharing of MetaData across the IC of SIGINT Metadata Beyond NSA OU - MEM ORAN DUM OF UN DERS TAN DIN TO: DIR THRU: NCR DISH) .51 82?53 REFERENCES: A. (C) Request for additional NSA data for Program. (dtd: It] Mar B. (C) Minimisation Plan for the Application of Analytical Software to NBA SIGINT Acquired Telephone Call Control Data. dated 2U Jan 1999. C. (C) MDU between NBA and FBI for Access to NBA Data in the CRISSCROSS Program, dated 19 Jan Zil?l. D. (C) MDU between NBA and DIA Regarding the Program. dated 19 Jan mm. B. (U) NSAICSS Policy 1-9. Information Sharing dated 26 May PURPOSE: (U) To establish the and NSAJCSS as the US. IC Esecutiye Agent for IC-wide metadata sharing. BACKGROUND: (SHNF) Except for a few point to point sharing initiatiyes, is the current 1C (plus) information sharing structures. is a CIA- managed program which proyides extracts from selected Agency (NSA. CIA, DIA. FBI and DEA) databases of telephone call records and reference data obtained from Dcriacd From: NSAICSSM 1?52 Dated: 123 Dcclassil'y Un:
Page 2 from Metadata Sharing Memorandum (2005)
HUMM, Ctpen and law enfercement related seurces te in U. S. law enforcement and intelligence cemmunities at a level. The key data elements are stered and retrieyed fer display by the Interface include: called and calling telephene numbers, date, time, and duratien ef calls. (SHNF) Fer appresimately the last 5 V2 years, the CIA (new PRUTDN) pregram has been incerperating NSA preyided SIGH?JT-deriyed (U. S. and SecendiThird Party) data. NSA preyides this infermatien te Agencies fer (SHNF) The decisien te disseminate Sl?lNT-deriyed signaling eutside Channels alse hadpeffcy and eperetienei dimensiens. Tests haye demenstrated that derived and traditienal call recerd data can be stered and displayed in a manner which makes them appear te be indistinguishable, which in general terms make the risks te seurces and metheds appresimately equal. Heweyer, under seme circumstances, signaling data ferm a unique target area, which ceuld haye ceme enly frem a sensitive seurce, disseminatien ef data te weuld be inapprepriate. This is the case when the data alse includes infermatien elements that are enly available and ceuld enly ceme frem espleitatien ef signaling. The MBA is silent en this peint, leaying te NSA full decisien autherity te decide which data te preyide and net preyide. (C) Fer several years prier, NSA had been preyiding SIG]NT-deriyed signaling infermatien te CIA and DEA te suppert multi-agency ceunter narcetics analysis, as appreyed by DDCI, SEC, and the Office ef Pelicy. Calling data frem seyeral Latin American cellecters, and frem Thailand, had been ef great value te the DEA and te the DCI Crime and Narcetics Center, and there were ne adyerse eperatienal er legal impacts te NSA. (SHNF) Gperatienally, the flew ef large 1aelumes ef intercepted signaling data eeuld place additienal burden en IT infrastructure. While, as abeve, the MBA did net address IT infrastructure, NSA retained full discretien eyer 1selume and timing ef infermatien flew, even as NSA chese te suppert the pregram with certain inputs. (SHNF) Requisite human and cemmunicatiens reseurces are in place in te suppert the transfer ef mederate yelumes ef signaling-derived call recerd data te the CIA Pregram Office. Ne increase in persennel was required te initiate data flew. Under the terms ef MBA, CIA preyided the list erS eyerseas cemmercial phene numbers te be minimised in NSA precessing ef signaling data. Similarly, the Department ef State and Department ef Defense telephene directeries will be researched by NSA te identify efficial US geyernment eyerseas phene numbers in erder te minimise call recerds asseciated with them. Te this end, the NSA Pregram Manager agreed te ebtain the DDS and DOD directeries annually and, with CIA assistance, estract the eyerseas numbers. That functien was transferred te the Cemmunicatiens Eyent Analysis Center (CEAC), in S2S, in 2mm. The seftware te estract call recerd data and te suppert minimisatien esists en a Handle Via COMIN Channels Only SECRETIINOFORNIMR
HUMM, Ctpen and law enfercement related seurces te in U. S. law enforcement and intelligence cemmunities at a level. The key data elements are stered and retrieyed fer display by the Interface include: called and calling telephene numbers, date, time, and duratien ef calls. (SHNF) Fer appresimately the last 5 V2 years, the CIA (new PRUTDN) pregram has been incerperating NSA preyided SIGH?JT-deriyed (U. S. and SecendiThird Party) data. NSA preyides this infermatien te Agencies fer (SHNF) The decisien te disseminate Sl?lNT-deriyed signaling eutside Channels alse hadpeffcy and eperetienei dimensiens. Tests haye demenstrated that derived and traditienal call recerd data can be stered and displayed in a manner which makes them appear te be indistinguishable, which in general terms make the risks te seurces and metheds appresimately equal. Heweyer, under seme circumstances, signaling data ferm a unique target area, which ceuld haye ceme enly frem a sensitive seurce, disseminatien ef data te weuld be inapprepriate. This is the case when the data alse includes infermatien elements that are enly available and ceuld enly ceme frem espleitatien ef signaling. The MBA is silent en this peint, leaying te NSA full decisien autherity te decide which data te preyide and net preyide. (C) Fer several years prier, NSA had been preyiding SIG]NT-deriyed signaling infermatien te CIA and DEA te suppert multi-agency ceunter narcetics analysis, as appreyed by DDCI, SEC, and the Office ef Pelicy. Calling data frem seyeral Latin American cellecters, and frem Thailand, had been ef great value te the DEA and te the DCI Crime and Narcetics Center, and there were ne adyerse eperatienal er legal impacts te NSA. (SHNF) Gperatienally, the flew ef large 1aelumes ef intercepted signaling data eeuld place additienal burden en IT infrastructure. While, as abeve, the MBA did net address IT infrastructure, NSA retained full discretien eyer 1selume and timing ef infermatien flew, even as NSA chese te suppert the pregram with certain inputs. (SHNF) Requisite human and cemmunicatiens reseurces are in place in te suppert the transfer ef mederate yelumes ef signaling-derived call recerd data te the CIA Pregram Office. Ne increase in persennel was required te initiate data flew. Under the terms ef MBA, CIA preyided the list erS eyerseas cemmercial phene numbers te be minimised in NSA precessing ef signaling data. Similarly, the Department ef State and Department ef Defense telephene directeries will be researched by NSA te identify efficial US geyernment eyerseas phene numbers in erder te minimise call recerds asseciated with them. Te this end, the NSA Pregram Manager agreed te ebtain the DDS and DOD directeries annually and, with CIA assistance, estract the eyerseas numbers. That functien was transferred te the Cemmunicatiens Eyent Analysis Center (CEAC), in S2S, in 2mm. The seftware te estract call recerd data and te suppert minimisatien esists en a Handle Via COMIN Channels Only SECRETIINOFORNIMR
Page 3 from Metadata Sharing Memorandum (2005)
server under S2S control. A huge volume of signaling data records) flows to that server on a daily basis to meet NSA analytic needs, and sufficient communication bandwidth is currently available to support the transfer of processed call records per day) to CRISSCROSSIPROTON Program for reformatting. We anticipate S21 will continue to be responsible for leading CIA output on CRISSCROSSEPROTON server, and CEAC will continue to be responsible for maintaining minimization and audit controls on all-source data received from CIA. Finally, Office of Oversight and Compliance would be responsible for oversight of USSR) 13 compliance. (S) Community analytic interest in dialing analysis continues to grow and is directed at discovery of new specific targets or topics, and demand for additional call record volume to support contact chaining and geolocation has increased. Signaling links are competing for collection priorityjust like any other potential target. As with other targets, the potential to espand collection is limited by available resources, to include field processing of signaling links as well as bandwidth to support forwarding from collection sites to NSA. (SHNP) The CRISSCROSS program, in which NSA already participates as a user of data, has had notable successes since its inception in 19%, such as enabling major narcotics arrests, monitoring Ramsi Yous ef?s colleagues, unraveling the Mubarak assassination plot, and providing insight into Pakistani nuclear weapon test activities. The program has received high marks from senior Community levels, such as the PPIAB, and Assistant for both Collection and Production. CRISSCROSS was also cited in the report by Admiral Jeremiah on Indian nuclear testing as a potential improvement to Community analytic strength. Since 9H 1, the contributions to the GWOT due to our increased collection of signaling metadata are innumerable and significant. It is safe to say that it has been a contribution to virtually every successful rendition of suspects and often, the deciding factor. Hence the benefit to the intelligence and law enforcement communities of any SIGlNT-augmented inputs could be considerable, as has the potential to access a broad range of targets. CURRENT PROPOSAL: (SHNP) Ref A. requests additional data elements from collection be included in the data set transferred to PROTON. Specifically, they want mobility management information relating to digital cellular and mobile satellite systems to include Global Cell Location Area Codes, spot beams, International Mobile Subscriber Identifications, International Mobile Equipment Identifications, LatitudefLongitude, and Imnarsat Return lD?s. They also requested content from Short lvles sage Service eschanges (which we are required to audit queries against). DISCUSSION: The current data push to is roughly 4U lvlillion records per day which has resulted in approximately 3tl?ii: of the PROTON data set (1996-2?fl5) coming from sources The addition of the requested data elements would more than double the volume ofdata sent to PROTON on a daily basis. This would increase the percentage of contribution to PROTON significantly. CIA is positing PROTON as the community resource for targetflead Handle Via COMIN Channels Only SECRETHNOFORNIMR
server under S2S control. A huge volume of signaling data records) flows to that server on a daily basis to meet NSA analytic needs, and sufficient communication bandwidth is currently available to support the transfer of processed call records per day) to CRISSCROSSIPROTON Program for reformatting. We anticipate S21 will continue to be responsible for leading CIA output on CRISSCROSSEPROTON server, and CEAC will continue to be responsible for maintaining minimization and audit controls on all-source data received from CIA. Finally, Office of Oversight and Compliance would be responsible for oversight of USSR) 13 compliance. (S) Community analytic interest in dialing analysis continues to grow and is directed at discovery of new specific targets or topics, and demand for additional call record volume to support contact chaining and geolocation has increased. Signaling links are competing for collection priorityjust like any other potential target. As with other targets, the potential to espand collection is limited by available resources, to include field processing of signaling links as well as bandwidth to support forwarding from collection sites to NSA. (SHNP) The CRISSCROSS program, in which NSA already participates as a user of data, has had notable successes since its inception in 19%, such as enabling major narcotics arrests, monitoring Ramsi Yous ef?s colleagues, unraveling the Mubarak assassination plot, and providing insight into Pakistani nuclear weapon test activities. The program has received high marks from senior Community levels, such as the PPIAB, and Assistant for both Collection and Production. CRISSCROSS was also cited in the report by Admiral Jeremiah on Indian nuclear testing as a potential improvement to Community analytic strength. Since 9H 1, the contributions to the GWOT due to our increased collection of signaling metadata are innumerable and significant. It is safe to say that it has been a contribution to virtually every successful rendition of suspects and often, the deciding factor. Hence the benefit to the intelligence and law enforcement communities of any SIGlNT-augmented inputs could be considerable, as has the potential to access a broad range of targets. CURRENT PROPOSAL: (SHNP) Ref A. requests additional data elements from collection be included in the data set transferred to PROTON. Specifically, they want mobility management information relating to digital cellular and mobile satellite systems to include Global Cell Location Area Codes, spot beams, International Mobile Subscriber Identifications, International Mobile Equipment Identifications, LatitudefLongitude, and Imnarsat Return lD?s. They also requested content from Short lvles sage Service eschanges (which we are required to audit queries against). DISCUSSION: The current data push to is roughly 4U lvlillion records per day which has resulted in approximately 3tl?ii: of the PROTON data set (1996-2?fl5) coming from sources The addition of the requested data elements would more than double the volume ofdata sent to PROTON on a daily basis. This would increase the percentage of contribution to PROTON significantly. CIA is positing PROTON as the community resource for targetflead Handle Via COMIN Channels Only SECRETHNOFORNIMR
Page 4 from Metadata Sharing Memorandum (2005)
deyelepment hased en eentaet ehaining teehniques. In this regard it is estremely diffieult te enyisien it playing that rele at NSA. PROTON requires a NOFORNIORCON must he lieensed, has ne API that weuld allew integratien with ether teels Federated query) and, represents a signifieant funding investment and dependeney en a CIA eentraeter. RECOMMENDED RESPONSE: In the eentest ef the atmesphere ereated hy the eyents ef {lgfl Hill and the fellewing inyestigatiens inte the pereeiyed ?intelligenee failure? a reetn'ring theme has been the lack ef data sharing en the part ef the IC memhers. Against that haekgreund, it is diffieult te deny requested te SIGINT- enly datasets that are theught te haye yalue te ether intelligenee In an effert te: preyide te the requested data and, break new greund in the infermatien sharing arena while, net meying any mere data eut ef NBA and inte duplieatiye sterage. We prepese te utilise the 1C shared infermatien spaee ICSIS en INTELINK and implement 1C te eur GLOB ALREACH federated query seryiee yia and yerified hy eertifieates. This seryiee will preyide the requested and permit the auditing legally required ef NSA. Further, we request that CIA ferward PROTON data frem seurees te NSA fer inelusien in the dataset searehed hy GLOBALREACH. Fer data that must remain in HCS ehannels, we will ereate an HCS partitien in FASCIA II. This will permit ene-step te eentaet infermatien fer 1C We helieye that we ean haye GLOBALREACH ayailahle in the ICSIS shared spaee hy {ll Oet Etl??. RECOMMENDATION: (FOUO) That yeu sign the enelesed nete te the Offiee ef the Direeter, Natienal Intelligenee. iiuestiens efa legal nature sheuld he direeted te AGC (Operatiens), Operatienal questien sheuld be direeted ateeawrac Teehnieal Direeter,_ SIGDE VITAE TD Handle Via COMINT Channels Only SECRETHNOFORNUNIR
deyelepment hased en eentaet ehaining teehniques. In this regard it is estremely diffieult te enyisien it playing that rele at NSA. PROTON requires a NOFORNIORCON must he lieensed, has ne API that weuld allew integratien with ether teels Federated query) and, represents a signifieant funding investment and dependeney en a CIA eentraeter. RECOMMENDED RESPONSE: In the eentest ef the atmesphere ereated hy the eyents ef {lgfl Hill and the fellewing inyestigatiens inte the pereeiyed ?intelligenee failure? a reetn'ring theme has been the lack ef data sharing en the part ef the IC memhers. Against that haekgreund, it is diffieult te deny requested te SIGINT- enly datasets that are theught te haye yalue te ether intelligenee In an effert te: preyide te the requested data and, break new greund in the infermatien sharing arena while, net meying any mere data eut ef NBA and inte duplieatiye sterage. We prepese te utilise the 1C shared infermatien spaee ICSIS en INTELINK and implement 1C te eur GLOB ALREACH federated query seryiee yia and yerified hy eertifieates. This seryiee will preyide the requested and permit the auditing legally required ef NSA. Further, we request that CIA ferward PROTON data frem seurees te NSA fer inelusien in the dataset searehed hy GLOBALREACH. Fer data that must remain in HCS ehannels, we will ereate an HCS partitien in FASCIA II. This will permit ene-step te eentaet infermatien fer 1C We helieye that we ean haye GLOBALREACH ayailahle in the ICSIS shared spaee hy {ll Oet Etl??. RECOMMENDATION: (FOUO) That yeu sign the enelesed nete te the Offiee ef the Direeter, Natienal Intelligenee. iiuestiens efa legal nature sheuld he direeted te AGC (Operatiens), Operatienal questien sheuld be direeted ateeawrac Teehnieal Direeter,_ SIGDE VITAE TD Handle Via COMINT Channels Only SECRETHNOFORNUNIR