Pull Through Steering Group Minutes

TOP SECRET STRAP1 THQ/1202THQ/1900/0058 29 February 2008 PullThrough Steering Group Meeting #16 29 February 2008. Distribute to: Invitees, GCWeb, SIGMOD-PU’s-GCHQ-dl, T-Domain-Heads-GCHQ-dl, SigMod-BCM-Support-Team-GCHQ-dl Present:       OPD-SDHQ TPS OPD-ATS AR Head OPD-SD OPDTAT Apologies:  None Summary of prototypes in the process: Briefly considered – MYOFIBRIL, addressed in Better Analysis bid. Discussion of PTSG future The future of ‘pull through’ and the PTSG was discussed in the context of programmes, themes, product centres, the four box model , evolutionary development, stripy teams etc. The role of evaluation and championing of AR prototypes for further development within the business was recognised by all as important for continuity, however no specific conclusions were reached with respect to the relationship between the PTSG and other organisational structures arising from business change, e.g. the CCBs that have been proposed in the context of the 4 box model transition processes. (Ed note: Worthwhile for the PTSG to consider this relationship further more formally) New Prototypes seeking PTSG Approval:  SALTY OTTER 4. /SALTY_OTTER- submitted at TRL B17 technique for finding cross-media timing patterns and incorporates the CLASP algorithm, which is considered to be similar, yet more general than the 1 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET STRAP1

TOP SECRET STRAP1 THQ/1202THQ/1900/0058 29 February 2008 popular PRIME TIME. looks for cross-media timing chains, e.g. a telephone call triggers a chat event. ACTION: Ran out of time for discussion – to be brought back for next PSTG session.  KARMA POLICE - submitted at TRL 4. KARMA POLICE aims to correlate every user visible to passive SIGINT with every website they visit, hence providing either (a) a web browsing profile for every visible user on the internet, or (b) a user profile for every visible website on the internet. For more details, refer to high-level overview document B/6760BA/5001/1. Initial work with INOC shows high analyst usage of technique. ACTION: To be progressed as a Better Analysis theme based requirement for explore. - noted that the legalities with respect to ‘content’ need to be cleared.  ORB FINDER submitted at TRL 4. Enables the identification of potential candidate Operational Relay Boxes (ORBs) for use in CNE’s active exploitation network through passive logging, providing a richer picture of the end-system, and consequently reducing CNE’s active footprint by focussing attention to those candidates that meet a stricter set of criteria. ACTION : To be progressed as a CNE theme based requirement for explore.  MOOSE MILK /MOOSE_MILK - submitted at TRL 4. A data mining algorithm devised by CTOR to detect suspicious use of telephone kiosks in the UK. MOOSE MILK is currently being developed further by the Operational Data Mining team in OPD-TAT. ACTION: To be progressed as a Better Analysis Agility requirement for explore. - noted that the timeliness of the tool depends on feeds in near-real time, which have not been available so far.  LIGHTWOOD /LIGHTWOOD - submitted to allocate a TRL rating given operational usage within JTRIG. Extracts act email addresses from any character stream. What differentiates LIGHTWOOD is its ability to distinguish valid email formats from those that appear to be email addresses but are not for open Internet (e.g. better@management). 2 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET STRAP1

TOP SECRET STRAP1 THQ/1202THQ/1900/0058 29 February 2008 The program also has a number of other email and URL detection capabilities that standard regular expression extraction rules do not have. Some of these are sensitive. Used operationally in JTRIG and to be used in MERA PEAK and MONTEVISTA. Accepted by PTSG as having attained TRL7. No further PTSG action. Other Business KED KED needs to be on the SE radar – it was not clear where the final ‘product centre’ lay – to talk to together with , , and l. There was some concern over programme allocation of resources to Mission Management tasks more generally. . Date Of Next Meeting 9 May 2008 10:30 AB3-M2 TPS IP-Activity Board SE 3 of 3 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation. Refer disclosure requests to GCHQ on TOP SECRET STRAP1