PINWALE: Transnational DNI Training

LIE-A- AUS. BAH. GER. 23 {x - v; (U) Transnational DNI Training (U) PINWALE I I . ?u LEE

TGIF LIE-A, ALI 5, CAN. GER. (U) Degcribe PINWALE TDP USA, AUS. CAN, GER. HEUFEDEEIHES

• (C) Supports SIGINT production by providing storage and retrieval of intercept • (TS//SI) Special partition for FBI FISA data • (C) As a reposito1y, it accounts for a significant portion of SIGINT production • (C//SI) Archives documents for approx. 5 years from the data of collection • (S//SI) Several search engines that provide retroactive , interactive , and dissemination type searches TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 3

• (S//SI) LIONROAR searches documents beyond 13 months and up to a 5-year range of the archive • (S//SI) LIONHEART Fusion searches a document index of the most recent 13 months in the archive • (S//SI) PINWALE Dissemination searches documents daily based on a query TOP SECRET//COMINTIREL TO USA, AUS, CAN, GBR, NZU/20291123 4

• For a refresher on query syntax, use the PINWALE Syntax Quick Reference Card (http: //rosato.do .nsa: 9087 /userweb /nexus / ref.card.030505.doc) or the course guide for TOOL2201 • For additional help creating queries, contact PINW ALE Help Desk TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 5

• (C) NEXUS is interface where you can conduct searches in UIS • (C//SI) User Interface Service (UIS) integrates search and retrieval systems and presents data queried through NEXUS like the intended user would see (UIS Text Presenter). • (S//SI) AGILITY is an alternative document viewer to the UIS Text Presenter ideal for viewing Microsoft Windows applications (MS Office, Adobe PDFs) in their native format TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 6

(S//SI) example: PWYA2006298115456 0001151730 (S//SI) PWID Dissected: PW YA 2006 298 115456 0001151730 (SI/SI) P 'vV PfN\VALE YA Processor ID internal to PINWALE (values AA -ZZ) 2006 298 115456 0001151730 Year loaded into PW October 251h on the Julian calendar Time (HHMMSS) IO dig it document number for the docu1nents loaded at this time. (SI/SI) TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 7

• (U//FOUO) Deconstructthis PINWALE ID (PWID) (SI/SI) 6:34.42pn1; the tin1e loaded into PIN\.VALE \_ PW .-----------, Pr ocessor (AA -ZZ ) October 3'" on th e Juli an Calendar \_ .-----------, 1,155•11 document loaded at this dat e and ti111e (SI/SI) TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 8

• (S//SI//REL) Repository for all the traffic we collect a11d includes 1netadata and co11tent, with a focus on the content • (S//SI//REL ) Helps you answer important questions: > What personal information is available my target? > Who are his contacts (bud dy lists, address books) > What are my target's alternate accounts (e-mail accounts, chat accounts, usernames) > Where is my target located and where does he log on fron1? > What can I learn about my target's computer (MAC addresses , cookies) TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 9

• (U) Search for an e-mail account • (U) Search for an IP address • (C) Search for a PINWALE document using a PINWALE ID (PWID) • (C) Search for a Universally Unique ID (UUID) TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 10

, tM , ... .,.~, ... ....... ., ig Q - .. '-· -" - - -- r:>0:1\......,.., c11, i'*rch ~ § ·r-=·-·~... ~ . ·-DM-m ' uoM4RT F~ .• . ....... .. ·Sore~ Fla ~11-l' t "°"" ,,~ 11 • I t "".'!!~ .......· 1Lv .... •t,;C'Oliliii:l .. ...,..._.....,, .. \1': \ C· - ·•+>c I \! ff) ~ I) tauu --,Cl .., , I' ' \ ~ ~ g; w,I ~ ~1l 1W'l<Uo 33> C11t(ry- . ffMlt','t .. I '" ... I •• -°'"IY"- lf.:"°""'aI • ~ - "' l) OIi ( .............. ) OIi (tor,111<~ ) OIi (l»l,-,.. ul llfl} <lfl ( l1t t1•f Hnllh l l>!J I ) ~·~'(~~1-d~ d "' " fl '*" H·J»•TOf' IKRST CfMMo1''OIi' 6"CGM"1"f<t0fll l'IJ Oot<..-: • .. ~ ,.....!!!!' ' ' > c.-.11• 111,monfl ' ' -- ... ::=l' C-C- 1"11_ }1•••tt" '" -~ •••• tli!Of.'"'" -\ (1" ¥"u00H •• re 'x , t ~ld+I•• OIi . a "" 18°'*" ,. 1 TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 _:J 11

• (S//SI) You can use DECODEORDAIN when querying on an e-mail account • (C//SI) DECODEORDAIN prepares the pe1mutations for you in the query language's native form • (S//SI) Query PINWALE directly from DECODEORDAIN results page Go DECODEORDAIN TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 12

·J5- J •o!3 @ - -----·-,_ .,........_ ..-~ .... -= ,.... - '- - ........ • --·. ·-- _ -., ....... --,-·.-· ..... ,~ , ---· .,'"., .. - --,~..-· __ .._ _...,·-_ ... ... ... ..... 1'1,,.10,...,..._, .....(II(; _ __ ......... .. ... ot1 --~-•WWW Q,OOQ - ___ -----~- ·-.. ... -·--•T ___ -·---·----·---..:.•-·T---, _ _..,_,..,..... -- ·-···~-" --.. ...,.,_. •.•=· -·-·-T--·--·-·"" .. ···----·· · ~· -·,co..--.o..--- --_..,._ ·}· -~ ·,·~ · -·.-..-·-·,)·· - n,--i. _ ...... -.... •"'"'___ .. _ .... ---· ·-"* -,·- ' ...- ··· ------------ -•T __ _ - _ .. T__ -------------, T+I~_.. ,,,,__1),o __ •• ~ ~1 · 1- ___ _ -. ,.wT-- "-•'1111-- -'""'"-,,_ ....a.• :.. - ..... o..-... .;o..___ w _ - TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 ••lm"l'ffffll' • .. 13

Objectives • (U) Configure and use the UIS Metadata Viewer to process and view Pinwale search results and metadata • (U) Create a query for viewing the FISA data TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 14

• (U) Search lnfonnation > In this area you have the Name field which is used as an identifier > The Description field \Yhichjust provide s any additional infonnation. • UIS U.• 11• s.-,,,d, 111,101 !ll•o111f•d) ...... .... au•ry ~fi::_1 1l<) -·~ l•arc h tf•lp ~ f!.:l ~1 ~;~.!J - -· - ,m*1! -· I r'·~tw Jg ~UkJl.t ,OWIS~ol QM(.... ' 0~) lw.lt••~ t,r(ll[f91't $H •U!~ ~ l:"!M'lilfflelac.l t,ooRffimTo #:OcltCTOU .. : UONHRT_tUS ION • • Full Sear~t, °" :,...". , ' Ck~ likt ' ~~ • .. ,..,•~•~ I I In $1!'.A 1 Ol,lftJ'.,,.Wt,1l>Of\ l . •MN-, ~ . "'"''""- ••w U!i K4"1M .... L.Hd w.HOI.E&&NOfO """""' • • ~~~. ' - - ~ I UIIOC.l•lo ·- ~-- £w ,-,.o~ " To •f l NW0...o'(IUM• TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 15

• (U) Data Selection - (U) Search Engine - Allows the user to select the search engine of their choice. **** Select PIN\\/ALE DI SSEM - (U) Search Type - Used to select whether documents are actually retrieved or just counted. **** Usually - Full Search - (U) Retri eve Metadata - Can be used to disable metadata. This is not available when the selected Search Type is Hit s Only. - (U) Send Resu lts To - Sets the folder location to return the sea rch results; defaults to your SID. **** Leaye your sid for thi s field. - (U) Visibility Group List - Allo\VSyou to select one or all of the Visibility Groups . Be sure to cl.ick on Add so it can be added to your search. **** Select/Highlight SQF partition TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 16

" UIS: Ne.111 Scvth t d1to1.{mod1f1cd) ,~\"F [ Ue .Query Edit •• r;:)§ @ =,-· "c,ll j e arch ~ ~~ J::l elp ~ .... sea,,11rmorm;itlOn ... N;1m• ~So, 1sApr1 1 ·~ _!j_!J ~ r c.$$(: llp)O O IJI1USOt UlU - 1n Sf A Oa1a Seiewonc t rt AU~l~on Seard 1Enfp'le: Se~Tw, e--- PI.NWALE _DISSEM • Betr'le'Ve MeuO'.na OH send Resucls To c1equ 1c1e Modello Vse: • • • • Full Search Non • "' PSC,Teld SGRNSPe,YNKE OF SQX • ~ J ..,, Ed1; L,oa.d Btm ove Sl OVTl-lEAR l SUGAA+W.f LEX ,, • • Visibiltty Group IR .::..II -- Sate O~ ; F,om r;:n I To '. I New-QueryNamll! TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 'lj - 17

(U) Date Range - Enter the date range in the From and To fields. It is important to remember to leave the fields blank for the PINWALE_DI SSEM as it is a continuous running search. (U) Visib ility Group Table - By clicking the Add you are able to insert the visib ility groups and the date range into the Visibility Group table. Please note that if there is no data for any day \vithin the date range you will get an informational window popping up and saying "Data is not available for the entire date range specified". - (U) Max Docs/Max Hits - Max Docs limits the number of documents that ,viii be returned by the queries associated with a Full Search. tvla x Hits limits the nun1ber of bits that wi ll be returned by the queries associated with a Hits Only query. Keep in n1ind that the system lirnits are 20,000 Max docs and I000000 Max hits. (U) Save Days - Detenn ines the length of tirne that the results from a search 11111 11remain in the folder manager. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 18

'I r;:,@(g_ UIS: Nu:1.1,Se,,r c h fd1101 [mod1hcdl tit Ip ~ ..... -- Q... ~ ~ I ..... '-· .... .... Searel\fr'lfOm'l&IIOtl ~ JQesc.l{ptlon ·ln Hsoc1atu N--i .{!leJos~FISAprU ~ ·-· oa1ese1ee11on Seite:hEn,gioe OUetyAssotla_lloo PINWALE_DISSEM • FUii SHreh • ae111eve Mtlad3ta. ON SfD,dAts',11:STO ckqulck • • • seaftl'I ~e : Moelel ToVse· None f !,in'I('fn"(')lllriDO ~ Remove ·- 1~ I r i•llltf 2, •• , 1 a Vl!!l> U"R!.Q!,.._ PSC-Tb'I SORNSPC·'ttll<E . f,{! 111 S~Oays : !D "'" • 8•move Edit l,oad SQF SOX STOU™EART SVO>JHW.fl.EX TOCV"NYIIM Q!?l,1 I I .. 11 I , n SEA ,. Ii. • I ! NewOuertt~sme.l I " TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 19

• • • (U) Query Association Area - This area conta ins a list of queries associated with the search as well as functions to edit the queries. Re1nember if you do not wish to submit a query you had prev iously open ed in the editor, you must remove it from the association list, before hitting the submit button. (U) Nev, Que1y Na1ne - This is probabl y the easies t function in PIN WALE. Type the query na1ne then either press the Return or Enter keyboard button s or click the Ne\\' button. Try and use something related to what you are going after. (U) Query Button s - - New - Creates a new query and is given the name in the New Query Name Field Edit - Opens a selectedquery fromthe QueryAssociation List, or brings the selected que1ywindow to the front if multiple queries are open Ren1ove- Simplyremovesthe selectedqueries from the Query Association List. Keep in mindthat the queriesarc not deleted from the Saved Queries fofdcr. Load - Opensthe Load Query dialog box, allowing you the user to add a personal or shared Saved Que1y. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 20

(g .Q.® , lUS NlollllJ SM1cl'o [d, t o, {modW-11ad) ,r<"'I "' ..... 0.. rill ~ jJ =• [ ii• l!u• ,Y i,e arcl'l -· S.~hlnforn»tton l1Qei.tnpl0ft.:'ll~ nsocu O.lla~on: Full sea.rch • aemMMtt:lcl~II ON $1(!1JRtt1111JTo · ckqukk • • VW ftntt,1D I Rtmov• J . "" .-, "" ....I M~od.:IIIOn I _:i i l .&•mov• l ••~ I J.o•• I ""-""' ~ • To om . I . ,~om ·li:J .. N-011orrH 1111 1 I • - ~Qf (El rl Sl,Jlrt l F~e SE•l)p • I sv. SQRNSPC'rt lk'.E "'1.fUX • i•llti- FSC.Tor! . -·- --- Hone " ~ 111 ..... PIHWALE_DISSIM .. Suitn ll1i• f~ tn ~ • 1......-. ....... 8f¥'(1!£~ Add _!J~- b •• tlam • t;s o,a ~Aon 1 ~To tf• lp optio n s Forms TOP SECRET!/COMINTt/202&1 123 Dosu ipllorf~ r,1eft);M.011ttr 1 .:, I • I TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 21

(U) Query Forn1s - Vary in complexity from the Smart Form , which performs syntax for1natting to the Freeform which requires you to forn1at the entire query in the 11ativequery language. a. Valid LIONHEART_FUSION (RW) forms are SmartForm, SmartFor1n II, Fi elded Search , and Freeform b. Valid LIONROAR/PINWALE_DISSEM (PSL) forn1s are SmartFor1n, S1nartForm II, Zoned Search, StringSmart Forn1, Set Ops , and Freefor1n Select "Smartform " TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 22

, UIS N•nn s.~,.h I d,10, i41C f: ilt ~:IS.# -- - Q.011<ll~(lft ~n prH OJ!lt&tltdlon e.lfCII ""'' ft~Mofl1'..ICUUI $f(Jll fttwllt To F'u•t • m h • ON • CIC~UiCk • f I ... -fi:"'""' CN•p 1-,J..-..O~ ;.,, !PS0,1'"1 . S~SPC ·vtw.E j ....,,, fNffl . I To . ...""-'"' H-•nit• 8 tll'IO\l t ... _l.01d I ........E:] .. .... I To • :R.tlMY!, F -'• ·"'~"'!.!1'1.• ,,. st.o. ~ " ,,,, Isa< ~..,,,. . ~"""'""""'• I Hon• lfC,O~T tVtt ~ 0Utl)'M~•~ PINWM.E_01'1(M • SN1t11El'1~ ~·" t•mri IE] ' hn.fl~~'°" Ne ...°'- _!j ! !J -· - -I A•t<Y ~ ";""_@® lmod!htclj NptO'*Y_Nlftlt "'~ Optl,O .QI ·- FNe FOt'JlltOU•f'Y Ottcnf:OQlll rttt,oimOllt., 1 RETJ:COMINTf!Z02911n l!I ~ SIIUIU' Otffl It s.ro,, Strll'I Q • SmanF onn Z.on,crS•1rth F1, 10,4 SHrcri .JI OC Fletcf form TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 :d 23

(U) As you type the terms into a fo1m the native rendition of the term will be displayed above the field for information and feedback purposes. (U) When using forms associated with RW, if you type something incon·ect, the feedback will tum red, ale11ing you to the fact that the term needs to be fixed in some way. ;...-Enter FISA target case notations in the fields/ blanks. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 24

~I ® ' UIS "-'~ ......... l(h I cl!IOI (mod!lfitd) ...... r~ .Qu.ry tl • lp a ea rch ~ ~~ _!]~ _!1! Sf"'1'11W!ffllkn J QtWg. ~J!,•tM(Httto NIQI~ jOSOf!Su.tH OAt S•ttoofl " PIHWAU!,..OISSEM .,. $twP>(~ ."" Full SH rCh Stl •UIl'l'S'I -aaiu ijtlr- $tOtl RHlllt To ~ s • • • .... Ck~\lkl ~ITOV&f ... . vi.- •-or. •- ' 111. em,w• I ..,.,. PSC.T•ct to,:111$1>¢-'!M!I "' "" -~- . Out,,..-..O<IJl!Ofl . ... ..,, ... R•mov• LH IS ir·=" '"""""'"" . To . ,...~,~-· $,rt01n liJ .. .I t'fO'-'nlE,tJtt I FA a .. In SU d' ...C..~111 'Offll ' ll ·b\' • OPooat OOK ,_,, H._a:!~"10 ~ ~Ot'O-U1U ~ TOP Sl CFIETJfCOMINTtn0::29112:J ,n $t• ~,a\ (Ollt-<t1 ... flh111tl 1 OOCUMEHT . .r Iii • ' OtOOisa .. ... . ....· .~ l .. . -·. - !~~-':~ ·-····i" I " TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 . ...t ~ 25

• (U) The Validate button runs all queries through a basic syntax check. • (U) Pop-up window activated to show IS Valid or Has Errors • (U) Best way to validate a query is to use the Validate command on the query form's Options menu. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 26

i,,r, :::::J StJIUI Ef\!IM St~Tfl>II 8tHMwt l~ ,,.J~ • 2e$1'. 1"'*'" 1i 1 n •p •lu tl!#tALI _Ol.1$1:M "' ,~11 sear,ci, ..... • • OH ••• .... l+gCIRti~TO' ,-,lltltOUM' F ... ...... s 0Vfl'l'\'*laocrt s-.., ns.t,.p11111,rw) CoSMS• ,o.v,, ... TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 27

• (U) Easiest way to save your search and queries at the same time is to click the Save button on the toolbar. There are other ways but this is the most efficient. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 28

Submit Search • (U) This function can not be accomplished untillour queries have been va lidated and optiona lly save . • (U//FOUO) The submitted search then goes through four phases - Queued Sub1nitted Rtu1ning Getting results to co1nplete Checking the Hits • (U) Once the search is complete the Hit Count and items cofumn next to the query folders wi ll be popu lated with the results . • (U) If you don't see results then refresh the Folder 1nanager TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 29

• (U) Currently there are 700 fields that you as an analyst/linguist can select from to assist you in search of your target. Keep in mind that you can take and setup as many MDV layouts as you desire to suit the needs of the target that you are doing your research /analysis on. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 30

• (U) The Metadata Viewer or as it is commonly called the (M DV) is where the results set their metadata. • (U) Results are stored in an ORACLE database and are linked to a contai11erfolder in the UIS Folder Manager. • (U) To load the resu lts from metadata for a Query, simp ly select the query folder and double click. Note : You may load mult iple results into the MDV simply by CTRL-selecting n1ultiple query folders before applying the load function. • (U) Keep in n1ind that when loadiI1g documents it can take as short as a few second or longer depending on the actual number of resu lts and the search engine that was being used. TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 31

• • (U) By using the MDV sorting can be as si1nple as the ordering of a coltunn of data in ascending or descending order, or as con1plex as sorting a partial or full set of results using 1nultiple fields. (U) Sorting can be usefu l for such tasks as analyzing events in chrono logical order and or finding anomalies in target communication profi les. - - ... ... 20070227:13:37 :0 0 :000 20070 227: 1~ :13 :00:000 20010227: 1, : l S: OO:OOO 200702 27 : 23:58 :0 0 :000 20070228 :0S :5 3:00:000 200702 28:22:53 :0 0 :000 ~nn~n,,~ ., , . ~~ ·nn,nnn TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 32

• (U) PINWALE Tip of the Week (E-mail) • (U) Tip of the Week also announces dates and times for upcoming: >PINWALE Query Walk-in Service >PINWALE Users Group Meeting >PINWALE Training Sessions • (U) NCS Training dates and times also found in the tip of the week • (U) You need to request to be on this mailing list. (DL NEXHELP) TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 33

• (S//SI) Problems with interpreting or identifying your traffic? >You can see your target's e-mail , but don't recognize the traffic >(C // SI) Send your questions to DL CTSAMPLES with only the PINWALE ID TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 34

• (U//FOUO UIS Hel ? ).>Contact ).>E-mail:DL UIS HELP • (U//FOUO PINWALEHelp? ).> Contact ~ E-mail: DL NEXHELP TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 35

TGIF SEERETHC LIE-A, AUE. GER. .. (U) USA, AUS. CAN, GER. HEUFEDEQHES

• (U) Create PINWALE_DISSEM query • (U) Load Query Results • (U) Customize MDV TOP SECRET// COMINTIREL TO USA, AUS , CAN, GBR, NZU/20291123 37