IR.21 – A Technology Warning Mechanism

TOP SECRET//COMINT//REL TO USA, FVEY (S//REL TO USA, FVEY ) IR.21 – A Technology Warning Mechanism SDC2010 SSG4/T3C Technical Director Derived From: NSA/CSSM 1-52 Dated: 20070108 Declassify On: 20341201 TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY Classification This briefing is classified: TOP SECRET//COMINT//REL TO USA, FVEY//   TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (U//FOUO)   Today’s Agenda . (U) Emerging Operating Model for Trends and Forecasting . (U) Wireless Evolution Paths  . (S//REL TO USA, FVEY) Analytic Framework …and Process  . (S//REL TO USA, FVEY) Meet AURORAGOLD  . (U) An Invitation to Join – Your Use Cases…   Includes Home Work Assignments … TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY Effective Forecasting: Geopolitical Regions and Targets (U//FOUO)  Discovery also critical    Regions & Targets How should discovery inform what targets/geographies we focus on next? How do we discover target adoption of a technology?  What geographies are of national interest to our customers? What organizations and individuals must we target to answer our customers’ questions? How does those targets communicate?   Technology Trends Discovery SIGINT PLANNING CYCLE    What products/services do we produce for which customers? What is workforce makeup and how are they distributed? What role do partners play? Delivery    Vulnerabilities   Capabilities    What capabilities do we need to develop to take advantage of technology vulnerabilities? What techniques to do we deploy to take advantage of those vulnerabilities (e.g. CNE, supply chain, mid-point, etc.) What roleTOP does SECRET//COMINT//REL enabling, cooperative access, HUMINT, 2nd parties, etc. play in TO USA, FVEY building those capabilities? How is technology evolving? How are technology and telecoms evolving in regions of interest? How do we expect targets to use emerging technologies? What is the SIGINT threat of these emerging technologies? What vulnerabilities are critical to current success (i.e. where are our risk areas)? How do we discover vulnerabilities? How do we introduce vulnerabilities where they do not yet exist?

TOP SECRET//COMINT//REL TO USA, FVEY (U)  . (S//REL TO USA, FVEY) Horizon Scanning     Two Types of Investigations Objective: Initial identification and assessment All source research Answer the question: Does this technology appear to be a large risk to the SIGINT system? Why or why not? . (S//REL TO USA, FVEY) Deep Dive     Objective: Cause a funding decision(s) All source research; emphasis on geographic uptake trends; target uptake plans or vignettes. Answer the question: Are SIGINT targets taking up this technology? How fast? Implicitly contrast the above with the cost and time needed to remediate any SIGINT system shortfalls. TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY Trends and Forecasts: A Geo-temporal Tracking Problem (U)  . (U) Forecast:    “An estimation of a Future Condition” … “To calculate or predict some future event or condition usually as a result of the analysis of available pertinent data” -- Merriam Webster . (U) Trend:  “To extend in a general direction; follow a general course” -- Merriam Webster  . (U) By necessity, a trend-line requires measurement of understood variables across time. TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (U)  Roaming Agreements . (U) Allow a mobile subscriber to use resources on a visited network  Each carrier’s IR.21 is a technical document that:  Describes the operator itself in various ways   Describes access to the IP network of the operator   DNS, IP addresses, ASN, etc. Describes:        Location, business codes, etc. Radio Access Network: technology(ies) type(s) Frequency(ies) Telephony routing information (MSISDN ranges; E.212) SCCP gateways (Point codes) Mobile Application Part protocol in use Hardware, software versions of certain network elements… . (S//REL TO USA, FVEY) Hypothesis: We can identify and track a carrier’s technical evolution with IR.21 and other data. TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY 3G Wireless Standards Evolution – Overview (U) 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 Opt. VoIP 3GPP2 IS-2000 (CDMA 2000 1x) IS-856 Rev A (Optimized UL & VoIP) IS-856 Rev 0 (1xEV-DO) IS-856 Rev B (MC, 64QAM) OFDM UMB Rev. 0 (FDD) Rev. A (TDD) IS-856 Rev C (MIMO/SDMA, DO Enhancements) 1x-adv (IS-2000) Mobility IS-1006 (BCMCS) Primarily FDD w/ TDD options OFDM IS-1006-A (EBCMCS) Opt. VoIP Init. VoIP 3GPP R-99 (UMTS) Rel-6 (E-DCH, MBMS) Rel-5 (HSDPA) eHRPD EPC Rel-7 (Enhanced HSDPA) Rel-8 Rel-9 Rel-10 (LTE (more LTE (LTE-adv) DC HSPA) features) Mobility OFDM Mobility IEEE/WiMAX Forum Primarily TDD w/ FDD options 802.16 (WiMAX) OFDM 802.16a 802.16d 802.16e Wave1&2 Init. VoIP 16e Rev. 2 Rel 1.5 Opt. VoIP Note: • Dates shown are standards completion dates (or expected completion dates.) • “Initial VoIP” not as spectrally efficient as “Optimized VoIP”. • “Mobility” indicates when each particular standard supports mobility inter-operability between the terminal and BTS. TOP SECRET//COMINT//REL TO USA, FVEY 802.16m Rel 2.0

TOP SECRET//COMINT//REL TO USA, FVEY (U)  And What About 4G? . (U) IMT-adv is an ITU led effort to set requirements for next gen. mobile networks  Just as ITU’s IMT-2000 defined 3G, ITU’s IMT-adv will define 4G TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (U)  Framework for Analysis… . (U) 3GPP: Defines technology migration paths.  “Releases” – A Clear Technology Roadmap   3G begins with Release 99 Other releases: 04, 05, 06, 07, 08, 09, ….10, 11 (future)   Releases cover:     See: www.3gpp.org/ftp/Information/WORK_PLAN/Description_Releases/ Access: GSM, EDGE, HSPA, LTE, LTE-Advanced, etc. Core: GSM Core, Enhanced Packet Core… Services: MS, etc. . (U) GSMA: Defines carrier information exchange required to enable roaming   Changes to IR.21 format warn of imminent technology roll-out An IR.21 is a GSMA-mandated document. IR.21 are exchanged between Wireless operators with roaming agreements, to the GSMA, and to certain clearing house operations. TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (U)  Analytic Process . (S//REL TO USA, FVEY) Data analysis process is to match information in IR.21, or elsewhere, against Releases in the Technology Roadmap   . (S//REL TO USA, FVEY) Analytic goals:       Example: CAMEL Phase 4 (aka CAMEL4) as proxy for Release 5 deployment Establish a date-time for a release deployment Track releases at the per network level Display status at the national, regional, hemispheric or global scale Measure speed of adoption at each scale Identify early and late adopter tendencies by network . (S//REL TO USA, FVEY) Deliverables:    Adoption trends over time Forecasts derived from trends and framework changes Formal reporting ofTOP data and conclusionsTO – USA, as a FVEY dataset SECRET//COMINT//REL

TOP SECRET//COMINT//REL TO USA, FVEY Data Flow and Process Overview (TS//SI//REL TO USA, FVEY) 4 1 AURORAGOLD Repository WCIS (Unclassified Data Source) Raw Data Sets – Unclassified ITU Ops Bulletin (Unclassified Data Source) ENTITY NORMALIZATION 4d 4a Analysis By Exception; Some Analytic Decisions 4c Querying Analyzed Data Sets – Unclassified 5 All Users 4g 4e Other (Unclassified Data Source) Exception Decision Information 6 IR.21 (Classified Data Source) Exception Decision Information Other (Classified Data Source) 2 Numbers in red are for reference only 4b Raw Data Sets – Classified VISUALIZATIO N SIGINT Production Chain 4f 3 21 May 2010 File Output Analysis By Exception; Some Analytic Decisions 9 All Appropriately Cleared Users 4h Analyzed Data Sets – Classified ENTITY NORMALIZATION SCORPIOFORE; SIGINT Reporting 8 Supplementary Outputs: 1. Strong Selector and Tasking Management 2. Some selectors back to AGR inputs for tasking 10 3. Information outputs to other systems (i.e. RONIN) TOP SECRET//COMINT//REL TO USA, FVEY 4. Other?? “AUTO”MINIMIZATION 7

TOP SECRET//COMINT//REL TO USA, FVEY (TS//SI//REL TO USA, FVEY) What Is Done Today 4 1 AURORAGOLD Repository WCIS (Unclassified Data Source) Raw Data Sets – Unclassified ITU Ops Bulletin (Unclassified Data Source) ENTITY NORMALIZATION 4d 4a Analysis By Exception; Some Analytic Decisions 4c Querying Analyzed Data Sets – Unclassified 5 All Users 4g 4e Other (Unclassified Data Source) Exception Decision Information 6 IR.21 (Classified Data Source) Exception Decision Information Other (Classified Data Source) 2 Numbers in red are for reference only 4b Raw Data Sets – Classified VISUALIZATIO N SIGINT Production Chain 4f 3 21 May 2010 File Output Analysis By Exception; Some Analytic Decisions 9 All Appropriately Cleared Users 4h Analyzed Data Sets – Classified ENTITY NORMALIZATION SCORPIOFORE; SIGINT Reporting 8 Supplementary Outputs: 1. Strong Selector and Tasking Management 2. Some selectors back to AGR inputs for tasking 10 3. Information outputs to other systems (i.e. RONIN) TOP SECRET//COMINT//REL TO USA, FVEY 4. Other?? “AUTO”MINIMIZATION 7

TOP SECRET//COMINT//REL TO USA, FVEY Information Delivery Vehicles – At NSA (S//REL TO USA, FVEY)  . (S//SI//REL TO USA, FVEY) Mobile IP Information:  . (S//SI//REL TO USA, FVEY) Telephony and Provider information: TAPERLAY  . (S//REL TO USA, FVEY) Worldwide Wireless Market information: T3C  packaged for WPMO consumption    Drives its portfolio investment planning process Affects ~80% of the portfolio (2009), per customer. . (U) Various and sundry others … TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (TS//SI//REL TO USA, FVEY) Future Implementation 4 1 AURORAGOLD Repository WCIS (Unclassified Data Source) Raw Data Sets – Unclassified ITU Ops Bulletin (Unclassified Data Source) ENTITY NORMALIZATION 4d 4a 4e Other (Unclassified Data Source) Exception Decision Information 4f Exception Decision Information 3 IR.21 (Classified Data Source) Other (Classified Data Source) 2 Numbers in red are for reference only 21 May 2010 Analysis By Exception; Some Analytic Decisions 4b Raw Data Sets – Classified Analysis By Exception; Some Analytic Decisions 4c File Available to Output All Querying Authorized Users Analyzed Available to Data Sets – Unclassified All 5 Authorized All Users 4g Users Available to SIGINT Production Chain 6 VISUALIZATIO N SIGINT Production Chain 9 All Appropriately Cleared Users 4h Analyzed Data Sets – Classified ENTITY NORMALIZATION SCORPIOFORE; SIGINT Reporting 8 Supplementary Outputs: 1. Strong Selector and Tasking Management 2. Some selectors back to AGR inputs for tasking 10 3. Information outputs to other systems (i.e. RONIN) TOP SECRET//COMINT//REL TO USA, FVEY 4. Other?? “AUTO”MINIMIZATION 7

TOP SECRET//COMINT//REL TO USA, FVEY (U)  . (S//REL TO USA, FVEY) Make the data useable        Available in or out of the SIGINT production chain Attach flows to value-adding chains and processes Deliver as a data-set Recognize other data sets exist and also are part of analytic processes (federation anybody?) . (S//REL TO USA, FVEY) Make the data traceable   Information – Now What? Includes auto-sourcing of data origin Time-stamping . (S//REL TO USA, FVEY) T3C will do technology trending and warning… . (U) Would your analytic processes benefit from this data set? TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (U)  . (U) We are few; we welcome partnership.     Your Invitation to Join Can you help? Do you have a better way? Let’s pull together!! . (TS//SI//REL TO USA, FVEY) We are preparing to measure the breadth of our access to IR.21 documents…  Goals:     Do we cover all 3GPP networks? Tweak access Tweak selectors Indexer will provide PWID for all identified IR.21, after dedupe. TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY (U)  What Are Your Use Cases? . (S//REL TO USA, FVEY) This is your segment—to make the notetaker’s job simpler please categorize your use case; describe impact:    A) IP Network B) Call Control – Switched Voice C) Hardware model and software version information  Group Discussion…. TOP SECRET//COMINT//REL TO USA, FVEY

TOP SECRET//COMINT//REL TO USA, FVEY  (U) Thank you for your time and contributions   TOP SECRET//COMINT//REL TO USA, FVEY