Apparition-Ghosthunter tasking info

TOP SECRET STRAP1 APPARITION/GHOSTHUNTER TASKING INFO ( , updated Jul 2011) APN and GHOSTHUNTER are systems currently online to provide VSAT geolocation and mapping. These systems are similar, however GHOSTHUNTER (located at MHS and SOUNDER) is used primarily for higher priority tasking, support to Ops etc. APPARITION is being used for target development and survey work by both IP and by the APN Cross Access Regional Development (CARD) Comsat sites. The OH task which supports both GH and APN is Geolocation, the following priorities exist: Worldwide:VSAT For GHOSTHUNTER: 02 T:WW: VSAT Geo-(a) Support to Operations (336) 03 T:WW: VSAT Geo-(b) Prior to Operations (336) For APN/GH (Pri 3 Strategic): 03 T:WW: VSAT Geo-(c) Directed Target Development (CER) 03 T:WW: VSAT Geo-(d) Strategic Geo Support (CER) 04 T:WW: VSAT Geo-(e) Survey (CER) CER – Collection Emphasis Request (input via Savant) APPARITION APN provides global access for VSAT geolocation requirements initially and incorporates the use of OH, comsat, SCS sites and other access hubs. This portion is only concerned with cross access working with Overhead. The four CARD sites are located at LADYLOVE (Misawa), JACKNIFE (west coast USA), MOONPENNY (MHS) and CARBOY (Bude). These sites are the lead collection and processing centres for a number of other collection/acquisition sites (comsat, Tryst) within certain areas of the world. With reference to Carboy, only Sounder is part of their group. The OH part of APN takes place after OH resources have been requested using the CER process which confirms date/time for the cross-access piece. Requests are acknowledged by Denver and scheduled via Mission Planning for execution. If requests are bumped due to priority, Denver will revisit on an adhoc basis. The front end (Comsat) tasking process is managed by CTA, Bude, details to follow after CTA Bude briefings. GHOSTHUNTER Pri 2 primarily used by NSA for Support to Operations. Pri 3(b) (Prior to Ops) - non-actionable priority is to learn and establish pattern of life for known terrorists who use internet cafes to communicate. The whereabouts of 1 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET STRAP1

TOP SECRET STRAP1 such targets is established using known IP/MAC addresses in conjunction with the Comsat/OH accesses and the GH system at MHS (main GH hub). Pri 3(d) (Strategic Geo Support) – this is used by MHS to request GH strategic type requests without having to go via the NAC and are performed on a best endeavours basis eg. Sounder requests. Requests are made via the CER process and can be traced via OTMS. A 336 is not issued via SOCOM for this priority. What GHOSTHUNTER can do for you Basically, it provides geolocation of modems of interest, when active, based on certain locational data (usually from Mastershake). The more you know about the location the better, though requests may be made to country level (depending on size) as well as the more usual city level. In order to forward requests, tasking must contain as much locational info as possible from Mastershake or ask NSA/NAC for help. Also, if an IPT is seeing interesting traffic on a satellite modem, GH may be able to help to establish patterns of activity, again use the NAC to discuss your request. Additional to geolocation of a modem is that GH will also geolocate all modems which are on the same signal, close to the targeted area and active at the time of the initial geolocation. It’s not advised to request geolocation of every modem on a bearer as GH requires at least some locational data as a starting point. How tasking is performed What GH allows at MHS is a 24/7 search for targets of interest. The position is tasked using an IP/MAC Priority list provided and managed by the NAC, so all requests must come through NAC channels. Searches are performed using where possible MP15 (search antenna) or MP14 (NMDC special dish) at site; MOONPENNY sustained collection is not interrupted. If the target cannot be accessed via these dishes, site may use other GH connected sites such as Sounder. In order to request resources at Sounder for GH, a Web Based Task(WBT) is issued by the GH manager. [[Note to above: coordination of resources with Sounder is usually done by phone for timeliness, sometimes requests go through Bude (email). Sounder has a callout rota for HVTs (Pri 2 type requests) as they don’t operate 24/7]]. Using the target list, the GH operator at MHS performs a search with a comsat asset using information on the tasking list (MAC, downlink RF, IP etc); once a target is noted active, an adhoc OH resource is then requested via Denver to perform the geolocation. This process can be performed 24/7. Results of this are either emailed or klieglighted ) as well as input to Mastershake. Mastershake entry is tagged with a GH line for id. For both Pri 2 tippers and Pri 3 requests, a KL is issued and can be married up with imagery if this has been requested. 2 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET STRAP1

TOP SECRET STRAP1 How to task Forward/discuss any potential tasking to the NAC. They will check relevant databases in advance of issuing tasking eg. Mastershake, NAC Knowledge Database (NKD, US Eyes). NAC alias: (NAC individual POCs: Once accepted by the NAC, tasking is forwarded to site for execution. Results Will be input to Mastershake, be aware that all the data is replicated daily into the 2 nd party Mastershake (ie the one GCHQ accesses) and at the very most will take 24 hours to populate. Team Overhead is happy to help with any queries on these processes. 3 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ TOP SECRET STRAP1