Skip to main content
Support Us
Documents

Ghosthunter tasking process

Sep. 6, 2016

1/3
Download
Page 1 from Ghosthunter tasking process
TOP SECRET//COMINT GHOSTHUNTER Tasking Process ( , Sept 09) Written to understand how the current GHOSTHUNTER (GH) process works and how GCHQ should present tasking. Note: APPARITION has been designed to provide global access for VSAT geolocation requirements in future and will have its own unique tasking process in place. Some requests which are assessed by the NAC may be put on the APPARITION system depending on the location of the modem and which system has best access. Background/Current Formal Tasking There is an Overhead task (362) which drives tasking requirements using GHOSTHUNTER. It includes both a US and GCHQ CRN. Despite its title of MultiCountry (stems from when a limited number of AOIs were included), the US CRN requests coverage of targets worldwide (GW). However, note that the GCHQ CRN only mentions Iraq, Iran, Pakistan, Afghanistan, Algeria, Philippines, Lebanon, Mali, Kenya, Sudan and Somalia. The task consists of two priorities: 1. Pri 2/336 (336 is OH speak for a tipper). This priority is usually used for actionable requests using GH, that is when the decision has been made between the Network Analysis Centre (NAC) at NSA in liaison with Task Force commanders in-theatre (usually covert) to apprehend a specific target. This is likely to be a short suspense request. 2. Pri 3. There are two parts to this priority (both non-actionable):  routine daily VSAT search/survey performed by two OH resources and scheduled daily by Denver which will provide a lat/long for a VSAT dish (not GH);  the more dynamic GH tasking used in conjunction with Comsat assets to provide the timely location of an internet user. Tasking may consist of an attempt to locate a known target of interest or a VSAT survey type request. Locational data can be matched with imagery if required. [Note: Overhead resources are requested on an adhoc basis to achieve geos]. GH tasking used at its non-actionable priority is to learn and establish pattern of life for known terrorists who use internet cafes to communicate. The whereabouts of such targets is established using known IP/MAC addresses in conjunction with the Comsat/OH accesses and the GH system at MHS (main GH hub) which resides in the New Mission Development Centre at site. 1 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET COMINT
TOP SECRET//COMINT GHOSTHUNTER Tasking Process ( , Sept 09) Written to understand how the current GHOSTHUNTER (GH) process works and how GCHQ should present tasking. Note: APPARITION has been designed to provide global access for VSAT geolocation requirements in future and will have its own unique tasking process in place. Some requests which are assessed by the NAC may be put on the APPARITION system depending on the location of the modem and which system has best access. Background/Current Formal Tasking There is an Overhead task (362) which drives tasking requirements using GHOSTHUNTER. It includes both a US and GCHQ CRN. Despite its title of MultiCountry (stems from when a limited number of AOIs were included), the US CRN requests coverage of targets worldwide (GW). However, note that the GCHQ CRN only mentions Iraq, Iran, Pakistan, Afghanistan, Algeria, Philippines, Lebanon, Mali, Kenya, Sudan and Somalia. The task consists of two priorities: 1. Pri 2/336 (336 is OH speak for a tipper). This priority is usually used for actionable requests using GH, that is when the decision has been made between the Network Analysis Centre (NAC) at NSA in liaison with Task Force commanders in-theatre (usually covert) to apprehend a specific target. This is likely to be a short suspense request. 2. Pri 3. There are two parts to this priority (both non-actionable):  routine daily VSAT search/survey performed by two OH resources and scheduled daily by Denver which will provide a lat/long for a VSAT dish (not GH);  the more dynamic GH tasking used in conjunction with Comsat assets to provide the timely location of an internet user. Tasking may consist of an attempt to locate a known target of interest or a VSAT survey type request. Locational data can be matched with imagery if required. [Note: Overhead resources are requested on an adhoc basis to achieve geos]. GH tasking used at its non-actionable priority is to learn and establish pattern of life for known terrorists who use internet cafes to communicate. The whereabouts of such targets is established using known IP/MAC addresses in conjunction with the Comsat/OH accesses and the GH system at MHS (main GH hub) which resides in the New Mission Development Centre at site. 1 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET COMINT
Page 2 from Ghosthunter tasking process
TOP SECRET//COMINT What GHOSTHUNTER can do for you Basically, it provides geolocation of modems of interest, when active, based on certain locational data (usually from Mastershake). The more you know about the location the better, though requests may be made to country level (depending on size) as well as the more usual city level. In order to forward requests, tasking must contain as much locational info as possible from Mastershake; liaise with the NAC directly for further help and verification of targets. Also, if an IPT is seeing interesting traffic on a satellite modem, GH may be able to help to establish patterns of activity, again use the NAC to discuss your request. A bonus to the geolocation of a modem is that GH will also geolocate all modems which are on the same signal, close to the targeted area and active at the time of the initial geolocation. It’s not advised to request geolocation of every modem on a bearer as GH requires at least some locational data as a starting point. How tasking is performed What GH allows at MHS is a 24/7 search for targets of interest. The position is tasked using an IP/MAC Priority list provided and managed by the NAC, so all requests must come through NAC channels. Searches are performed using where possible MP15 (search antenna) or MP14 (NMDC special dish) at site; Moonpenny sustained collection is not interrupted. If the target cannot be accessed via these dishes, site may use other GH connected sites such as Sounder. [[Note to above: coordination of resources is usually done by phone for timeliness, am told sometimes requests go through Bude (email) but this isn’t slick. Also, unlike TK sites, no access to Info WorkStation (IWS) chat facility which MHS uses. Sounder has a callout rota for HVTs (Pri 2 type requests) as they don’t operate 24/7]]. Using the target list, the GH operator at MHS performs a search with a comsat asset using information on the tasking list (MAC, downlink RF, IP etc); once a target is noted active, an adhoc OH resource is then requested via Denver to perform the geolocation. This process can be performed 24/7. Results of this are either emailed or klieglighted ) as well as input to Mastershake. I’m told the Mastershake entry is tagged with a GH line for id. For both Pri 2 tippers and Pri 3 requests, a KL is issued and can be married up with imagery if this has been requested. How to task Initially, it’s been agreed with the NAC that any potential tasking will be forwarded to them or discussed initially to check before being submitted for tasking. As well as Mastershake, they check the NAC Knowledge Database (NKD, US Eyes). 2 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET COMINT
TOP SECRET//COMINT What GHOSTHUNTER can do for you Basically, it provides geolocation of modems of interest, when active, based on certain locational data (usually from Mastershake). The more you know about the location the better, though requests may be made to country level (depending on size) as well as the more usual city level. In order to forward requests, tasking must contain as much locational info as possible from Mastershake; liaise with the NAC directly for further help and verification of targets. Also, if an IPT is seeing interesting traffic on a satellite modem, GH may be able to help to establish patterns of activity, again use the NAC to discuss your request. A bonus to the geolocation of a modem is that GH will also geolocate all modems which are on the same signal, close to the targeted area and active at the time of the initial geolocation. It’s not advised to request geolocation of every modem on a bearer as GH requires at least some locational data as a starting point. How tasking is performed What GH allows at MHS is a 24/7 search for targets of interest. The position is tasked using an IP/MAC Priority list provided and managed by the NAC, so all requests must come through NAC channels. Searches are performed using where possible MP15 (search antenna) or MP14 (NMDC special dish) at site; Moonpenny sustained collection is not interrupted. If the target cannot be accessed via these dishes, site may use other GH connected sites such as Sounder. [[Note to above: coordination of resources is usually done by phone for timeliness, am told sometimes requests go through Bude (email) but this isn’t slick. Also, unlike TK sites, no access to Info WorkStation (IWS) chat facility which MHS uses. Sounder has a callout rota for HVTs (Pri 2 type requests) as they don’t operate 24/7]]. Using the target list, the GH operator at MHS performs a search with a comsat asset using information on the tasking list (MAC, downlink RF, IP etc); once a target is noted active, an adhoc OH resource is then requested via Denver to perform the geolocation. This process can be performed 24/7. Results of this are either emailed or klieglighted ) as well as input to Mastershake. I’m told the Mastershake entry is tagged with a GH line for id. For both Pri 2 tippers and Pri 3 requests, a KL is issued and can be married up with imagery if this has been requested. How to task Initially, it’s been agreed with the NAC that any potential tasking will be forwarded to them or discussed initially to check before being submitted for tasking. As well as Mastershake, they check the NAC Knowledge Database (NKD, US Eyes). 2 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET COMINT
Page 3 from Ghosthunter tasking process
TOP SECRET//COMINT There are formatted forms to submit tasking requests on email which I hold once we get the process running. NAC POCs: , . The NAC is aware that not everyone has TK email and don’t see this as a problem. Once accepted by the NAC, tasking is forwarded to sites for execution. Also, tasking can be discussed with MHS before submission (POC: to check whether it’s a suitable). Results Will be input to Mastershake, be aware that all the data is replicated daily into the 2 nd party Mastershake (ie the one GCHQ accesses) and at the very most will take 24 hours to populate. In addition to this, klieglights are issued and can be found in the following db: ( can help with forwarding these. Imagery may also be requested, again I’d go through if you need help. 3 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET COMINT
TOP SECRET//COMINT There are formatted forms to submit tasking requests on email which I hold once we get the process running. NAC POCs: , . The NAC is aware that not everyone has TK email and don’t see this as a problem. Once accepted by the NAC, tasking is forwarded to sites for execution. Also, tasking can be discussed with MHS before submission (POC: to check whether it’s a suitable). Results Will be input to Mastershake, be aware that all the data is replicated daily into the 2 nd party Mastershake (ie the one GCHQ accesses) and at the very most will take 24 hours to populate. In addition to this, klieglights are issued and can be found in the following db: ( can help with forwarding these. Imagery may also be requested, again I’d go through if you need help. 3 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET COMINT