Documents

TCP IN POINT PAPER 22 Feb 05 SUBJECT: PURPOSE: Prcvide DIRNSA cn subject. BACKGROUND: (U) cf (hcw did it ccnie abcut, when; and by whcni.) (SNOC, NF) Prcject CRISSCROSS began in the early 1990?s when CIA and DEA ccllabcrated en a database and analytical suite tc analysis and lcckups against DEA and CIA ccllected telephcne billing rec and phcne directcries. (SNOC, NF) NSA Office cf Crime and Narcctics requested the and database capabilities cf tc enhance SIGINT data. ed extremely successful at identifying new phcne numbers as scciated with ?lcst? drug targets and lccating additicnal targets cf interest. Expanding the erage frcni Latin America tc then enhanced target develcpnient all NBA prcduct lines. (U) Current CRISSCROSSIPROTON Agreenients. (SNOC, NF) All Agreenients are via bilateral Menicranda cf Understanding (MOU) and exist between CIA, DEA, NSA, BIA, and FBI. DEA and FBI dc currently share data with each cther. (SNOC, NF) DIA prcvides tc varicus elenients (e.g and ether Service Intelligence structures) as specified in MOU Addendunis. (U) I-Icw current data in is "minimized" and by what standards. (SNOC, NF) Frcni its incepticn, NSA has cnly prcvided data tc which date, time, duraticn, called number and calling nuniber. NSA ?niininiises? this nietadata pricr tc its transn1issicn cf data tc CIA. (SNNF) NSA data is pulled frcni the FASCIA and systems and transmitted tc a NSA terminal in PRO TON Prcject Office. (SEISI) U.S. and party nunibers, niininiisaticn is achieved by replacing the rightnicst 4 digits with fcur Dcrivcd Frau]: 1?52 Dalcd: ECU-41 123 Dcclassil'y (In:

TOP I (SHISI) The elassifieatien ef the NBA ealI-eyent is CONFIDENTIAL NOFORN. I (8 HO O, NF) NBA Offiee ef General Oenns el ruled that the data eentribnted by 01a, ma, DEA, and FBI dees net need te he minimized by NBA hefere hemg ineerperated inte the NBA PROTON system as eaeh MOE signatery ?minimise? te their ewn antherities. (U) I-Iew ORISSOROSSEPROTON eperates teday (data ?ewss?tape eemder, teels, etc.) I (SHIN F) PROTON is a preprietary system arehiteetm*ally ine ensistent with EDI) and NBA derelepment guidelines and enyirennient. It requires speeifie Iieensmg and maintenanee expenses and em?rently eannet be integrated with ether teels. I (SNOO, NF) Data is transferred frem NBA, DIE, and FBI te ens eleetremeally er by eemder delivery ef magnetie tapes. (U) OmTent prepesals te medify (pending) ORISSOROSSIPROTON with the additien ef ether data I (8 HO O, NF) New eenmnmieatiens teehnelegies eyelntien ef the ORISSOROSS seftware. The ORISSOROSS system enly handled fire fields: date, time, dm*atien, ealled number and ealIing PROTON gees fm*ther and analyses additienal data fields that are speeifie te sell and satellite phenes, sneh as IMEIs and IMSIs, Iatdeng PROTON aIse analyses email headers (net eentent), SMS text messages, SIM eards, travel (passpert ?ight deseriptien), VI sa applie atien data and elseerpts frem CIA intelligenee reperts. I (SNOO, NF) CIA, BIA, and FBI have added these additienal data types te PROTON and share this data with NBA. I-Ieweyer, NBA has never agreed te expand its eentrihntiens te PROTON. TOP

TOP SEC RETHCOM IN (SNOC, NF) PROTON perfernis entity analysisfeentaet chaining aeress data types. Users may seareh en a target entity? phene number and PROTON will return the as seeiated eniail, eell phene, eall street address, and CIA intelligenee repert eseerpts. (S EEOC, NF) PROTON teels find ether entities that behave in a similar manner te a speeifie target, it alse identi?es eerrespendents in eeninien with twe er niere targets, identifies petential new phene numbers when a target switehes phenes, and identifies ?EtWDl?liS ef erganisatiens based en eeniniunie atiens within the greup. (SNOC, NF) PROTON prevides seareh eapabilities fer espleiting eeniniereial phene banks and data that de net eenferrn te a partieular e, sueh as ese erpts freni CIA intelligenee reperts. (U) Current NSA eentributien te CRISS TON (data ef te per weele?nienth, ete.) (SNOC, NF) CIA, DIA, FBI, and DEA eentributiens ever a three-nienth peried tetaled billien ree erds (whieh ineludes niany that are net ?e uniniunie ati ens -n1etadata entaet ree erds? .) (SNSINNF) NSA eentributiens ever the same three-nienth peried tetaled 4.2 billien (again; enly liniited te telepheny eentaet data). (Nete: under the NSA prep esal te ereate an IC-wide eeniniunie atiens n1etadata repesitery, eentributien weuld be in the 100?s ef billiens ef eentaet telepheny and DNI eentaet (U) I-Iew NSA eurrently uses in eenjunetien with ether NSA n1etadata repesiteries and teels. (SNOC, NF) NSA use Preten te perferrn analysis against data freni CIA, NSA, DEA, FBI and DIA in a single eeninien interfaee. Results previde additienal targets ef interest far all preduet lines. Merging the data preduees a mere eeniplete pieture ef the target?s eeniniunieatiens and aetivity. (TSNSINNF) NSA Users reperted the fellewing regarding the inip ertanee ef PROTON: I (S) SICINT in Iraq attributed PROTON fer at Ieeating and apprehending High Value Individuals (I-IVIs). PROTON had the inferniatien they needed te get .S. treeps in the right Ieeatien. I (S) PROTON was eritieal in eapturing a I-IVI whe was wanted by the FBI and AF OSI fer terrerist related aetivity in Denver Ir (SASI) PROTON previded the Ieeatien inferniatien ef a nieney esehange heuse that was eenneeted te a Pakistani n1ilitant greup. TOP SEC RETHCOM IN

TOP (S) PROTON allews a single step te find registratien infermatien fer phenes that are net being us ed by the pers en te whem they are registered. This is partieularly impertant fer frent eempanies, where tying multiple phenes tn the same registratien ean previde eritieal infermatien.? (S) SID is that a DNI IO-wide eentral eemmunieatiens metadata repesitery be established and reside at NBA and that be made Eseeutive Agent far this IO repesitery. NBA and its fereign SIOINT partners stand alene in eendueting metadata analysis an sneh a large seale and as a result, eur teels and methedelegies, as well as the infrastruetm*e empleyed, are well tested and have been preven effieient and effeetive. We already extensively share metadata internally within the NSAIOSS enterprise and, having reaehed agreement with eur Party partners, are ready te begin implementing that agreement te share Party metadata writ large. (SHIN F) Rather than eentinuing te push eemmunieatiens metadata nut tn the PROTON repesitery} we prepese using the esistmg IO shared infermatien spaee IOSIS (Intelligenee Oemmunity System fer Infermatien Sharing) en INTE LINK and have IO users same in threugh an existing teel te pull data frem metadata repesiteries resident at NBA. We weuld implement IO te eur federated query serviee via and assess verified by PKI eertifie ates. This service will previde the assess requested and permit the auditing ef sneh repesitery users. We believe we ean have OLOB ALREAOI-I eapability ready fer the IO within appresdmately ene te twe menths ef a deeisien te with this prepesal. (UHFOUO) ORIGINATORs: and ?fer the IO-metadata prepesal, and ?fer emsseaessxsaereu, 22 Feb es TOP