ADD SD BLACK HOLE

TOP SECRET STRAP1 BLACK HOLE ANALYTICS ! ADD/SD briefing, September 2009 TOP SECRET STRAP1 This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ on

TOP SECRET STRAP1 Contents  Describe the new breed of C2C tools developed in Applied Research (TR)  Scaling them up through the Next Generation Events (NGE) project This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ o

TOP SECRET STRAP1 Next Generation Events Roadmap Convergence 1 Cloud upscale Internet Profiling 2 ~50 x 10g ~8 x 10g ~200 x 10g July 2009 Mar 2011 Looking Glass deliveries Internet Profiling 1 Capability development (including eA) Looking Glass deliveries Large-scale contact chaining Data mining and profiling ~80 x 10g ~260 experts New technologies (particularly from JCE) incorporated into solution as they are de-risked / proven This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ

TOP SECRET STRAP1 NGE Analytical Capabilities Looking Glass Where? Who is similar? $$ When? Who is suspicious? What? Who does this thing? With whom? When should I worry? Currently available on the desktop Future desktop capability This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ o

TOP SECRET STRAP1 Some useful definitions           Presence Event Describes that an identifier was online, on an IP address, at a point in time. Simple, atomic element. Can be very easily developed so are very diverse Very useful! TDI = Target Description Identifier Has a type, eg Yahoo-Y-Cookie And a value, eg tom123@yahoo GTDI = Generic Target Detection Identifier Expands the TDI concept to telephony e.g. A GSM location update message This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ on

TOP SECRET STRAP1 Some more definitions  BLACK HOLE: The large flat file storage where all the data sits  After initial processing, and before being manipulated and correlated and loaded into the QFD database tables   QFD: Question Focused Dataset (Database) One for each tool: MUTANT BROTH, AUTO ASSOC etc This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ o

TOP SECRET STRAP1 Probes DATA FEED Flat Storage BLACK HOLE Structured Storage QFDs MUTANT BROTH TDI Extractio n TDIs HTTP Extractio n GETs VBulletin Extractio n VBulletin KARMA POLICE INFINITE MONKEYS This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ

TOP SECRET STRAP1 QFD desktop…so far…  Enables analysts to:  Create a profile of a target’s online activities (Mutant Broth)  Find other identifiers for a target (Auto Assoc)  Create a social network (Social Animal)  Investigate websites or web forums of interest (Karma Police, Infinite Monkeys, HRMAP)  Find out who has been searching the web and for what (Memory Hole)  Find out who has been looking at what on Google Earth (Marbled Gecko) This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ on k

TOP SECRET STRAP1 Converged QFD desktop…by Dec…  Enables analysts to:  Create a profile of a target’s online activities alongside telephony ( Evolved Mutant Broth)  Find alternative identifiers across telephony and the internet (Hard Assoc)  Create a social network including telephony (Evolved Social Animal)  Find out what has been happening in real time (Samuel Pepys) All available on the desktop via Looking Glass plug-ins and Web GUIs This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ

TOP SECRET STRAP1 Success story – TSS2 Nocon  Slides removed – contact version for full This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ on

TOP SECRET STRAP1 TR Lab, Benhall 10g Bearers x 10-14 Data Gateway TR BLACK HOLE Processing Analytic Execution Environment (TR Lab, Benhall) Bu lk E xtr ac t Bu lk ex tra ct Test new QFDs 10g Bearers x 50 IP Prob TELLURIAN SSE Other feeds BUFFER (Benhall) NGE BLACK HOLE (Benhall) Bulk ex IP Prob TELLURIAN SSE Other feeds Blazing Saddles BUFFER (Bude) BLACK HOLE User tract act extr k l u B 10g Bearers x 34 s Direct Acces Processing Analytic Execution Environment (Ops Community, Benhall) NGE BLACK HOLE (Bude) Direct Access Operations This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ

TOP SECRET STRAP1 Capability Dev Workspace Hmm, new data... I wonder what happens if I mine it like this… I’ve just developed collection of My FaceSpace events! Will this NSA algorithm help? Is that better? Data miner I’ll put that processing on a few more bearers… Oh, this looks interesting – what does an analyst think? Easy access to data, however it is collected Collection engineer/ research team This data might be best viewed like this; take a look Use live data to work on real problems Put the latest results in front of analysts Analytics developer Processing power ready to use OK, but could you just… Rapid feedback and improvement Is that better? Or this? I’ll just add in some of those results… Good, but how about… Could you tweak it to… User-interface specialist Analyst with an operational problem Oh heck, I’ve caught Bin Laden This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCH

TOP SECRET STRAP1 Data Mining at scale  Experiments with Cloud ongoing to enable analysts to request and run MOAGs (large TNN graphs) from the desktop  Distillery will enable analysts to spot real time changes to the data at scale (e.g. detection of impossible travel)  Joint Collaboration Environment (Innov8) – trialling running of large scale analytics using both GCHQ and NSA data This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCH

TOP SECRET STRAP1 Future Implications  We shall be able to:  easily monitor changes in our targets’ profiles and networks  develop and trial new capabilities using real life analytical experiments  respond quickly in a crisis This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ

TOP SECRET STRAP1 Questions? /BLAZING_SADDLES /NGE_BLACK_HOLE This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation Refer any FOIA queries to GCHQ