XKS as a SIGDEV Tool

x-no.mmimm mHmUm< 30? .

What is

A (NI) SIGEV Tool It gives you the ability to discover things that you otherwise wouldn?t have seen TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

I . 1 I: .. 11aJlrli XKS gives unique access to terabytes of content and meta?data Typically sites select and forward to PINWALE less than 5% of the DN1 they?re processing The rest of that data used to be dro ped but is now being retained temporari and made available to through As an exam Ie, at one our sites XKS sees more ata per day than all of PINWALE TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

- . . set. as use scat, muffs [15% I n- Meta-data a subset cf tasked rafficthie Centent selected frem dictionary tasked terms pinwale ?User Activity? meta-data with frent end full take feeds and back-end selected feeds Unique data beyend user activity end full take feeds MARINA Lew High TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

I. E. .. i; i; To) USA absXKS goal is to store the full-take content for 3-5 days, effectively ?slowing down the Internet" so that can go back and recover sessions that otherwise would have been dropped by the front end Meta?data is saved off longer, with the goal of 30 days retention A lot of analysis can be done through meta-data only (MARINA is meta-data only) TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

lJ-Ll . I: 3T.- :2 Front end storage is limited by resources and policy restrictions and wil vary by site At some sites, the amount of data we receive per day $20+ Terab tes) can only be stored for as ittle as 24 ours based on available resources Other sites have legal or policy restrictions that limit the amount of time we can store data (if we can at all) It?s a rolling buffer where new data comes in and pushes the oldest data out TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. i r; u. z. I, .1 Tail(off? ata 0 Content that is ?interesting? can be pulled out of X-KEYSCORE and pushed to Agility or PINWALE or any other database for longer retention - Workflows can be set up to automatically harvest content out of XKS before it ages off 0 The goal, however, is to use to discover new things, that will end up on tasking for future collection TOP SECRETHCOMINTHORCONEEL TO USA, AUS, CAN, GBR and NZLH20291123

. .. r: REL To MealIt?s important to know that XKS queries meta-data tables only Results from the meta-data tables are then linked back to the original piece of content Goal of the system is to extract a wide range of meta-data for users to query TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

.. i'ail-El: and Mata-:iata 3 HEIWIZIFH alert 3' E1 Matadata CHE 3 Prime Number Extractor Eall Laga REGAN I Category DHI EallLilar Bill a Radiua Laga Dacumarrt Matadata Haall'i?aalia Mata-data Daaumarit Tagging Email Lag . Extract-ad Filaa a Taal'i Stringa in Daaumarrta Lag DNI 1: Lia-ar ?xativin EMF-EN IHC Cafe 3 Wet: Lagina and EWraahark TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

I - ffiflT'Ii man om mm immea- *co'tmmoacoNREL To use! aus, cansum ple Plug-Ins OID I- v. a noun W?Tildml" an - - 1m Han-1' W9- we i411 on "new ?39? lOi'-'tm1I am 2 0. li? .. I ?'71 Plug-in DESCRIPTION E-mail Addresses Indexes every E-mail address seen in a session by both username and domain Extracted Files Indexes every file seen in a session by both .filename and extension Full Log Indexes every DNI session collected. Data is indexed by the standard N?tupple (IP, Port, . Casenotation etc.) Parser Indexes the client-side traffic (examples to follow) Phone Number Indexes every phone number seen in a session address book entries or signature block) TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

.4mgDESCRIPTION -.. z, .11.. 'g'll ?l ?1:311. 2' {1:3 - - . 3.. 1:225#2973. .E-. II.E-.I raw - 1L U-U ILEICZE mag: II: .I . I. 52:3. l?l Wit: 7, ?31 t, . .1 ELL I.r LHJ Ill-1 1g: IRE. - I - .53, IJ ,l [111:2] . .. -. TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

5.51 - A single session may contain entries in multip meta?data tables - For example, if a single session had a user E- mailing an attached word document the following plug-ins would extract meta-data: Plug-in Would have Full Log minimum meta-data like To/From IP address, ports, casenotation, sigad etc. E?mail E?mail addresses seen on that page Addresses (including inside the attached word file) Extracted Files filename and extension of the attachment Document Meta- addition to the filename and extension, any data embedded properties of the word document like Author, last author, organization, date created, date last modified etc. TOP SECRETHCOMINTHORCONEEL TO USA, AUS, CAN, GBR and NZLH20291123

'I'luh?ln?nh? I I. . .. ?tll-I?r-I?hnr' "?lluh- . . .1. . I-l "nun-nun unlu- I 125 Sites TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

.. @9369 ?kr. mug.? 125 Sites TOP TO USA, AUS, [345?ler GBR and

I. r;-i-iytice;rapportigravel'Iiiljl t5 - X-KEYSCORE produces an application id for each session processed 0 Currently almost 1300 Appids in 28 categories 0 An Appid is meant to identify a session as a particular application - Fingerprints are an extensible way of tagging sessions 0 Ex: A session Appid?d as mail/smtp might also contain fingerprints for if used in the email TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

- gLeirzp i 5 Ex: E-Mails with rn rn La 11 Lil" a a a an Haj..- a r'l? rr'a a1 ian" nara 3-13.23: a r: :I1To:? Ea: Subject: Launchpad: Can?rm yaur Hay Hate: Wed. 31 Del: Harainn' U1 :1 Pi 1GH1H11HIIH1 applicatian ?aalD [+Fmgarprinta) 1' mailfwabmailfautblaza mailfwabmailfautlalaza haa_fingarpriat +tha1h1 Nu31 r1wjh3+nalilpxr Fla EU N?kgguki' aM1 a8 [2:1 aTrr'I CIFTIAH E331 +3 Fm PGP TOP SEC Thanks. {0291123

Subject: Frnm: T6: Date: ?pplicatian mailfwebmailfyahm I. .- [Lilli-F?mrprints Ex: Airline E-Tickets Airtime E-Ti?l-Eiet - Airblue Hesewatinns [366132333 132111256 silk-'1 i . 666E [+Fingerprintsj mailfwebmailfyahmj hasjingerprint trawelfairblue 66.66 3: 6.3234335] 21 6336 5643 15E 6.562;? 2' 216376 56-43 I1 ED 613 Peshawar Dubai 2313331333 12:33 326333 15,535-33 DE 13-N6v-2333 Khalaej Expragg- Pew Muhammed Emmamam Branch 331635313 165155350? TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH23231123

. tr 1" THE Attila Ex: Extremist Forum Private Messages El HTTP Heetler Infennetien [lentth Type: 343mm: .1 Accept: imegefgit. imegefH-ebitmep. imegefjpeg. imegefpjpeg. epplieetiem?vnd.me?pewerpeint, applieetienfrnewerd, Reterer: Accept-Language: ert-gt- Cement-Type: eElE gzip. de?ate Ueer?Aeent: Meeillef?l? teemeetihle: MSIE Windewe NT 5.1: eeplieetien eppl? (+Fingererirrte] recipiene beereeipiente title Fe: yi- Let; me Lug?we e?-l?le?liti?? fem [18 L'e'??gtl chin-El cm mewluwl 33;:5 lentil DLa?t-l?lie?i?l?u WESEEQEI Emil}. ml?JWIml?lu??gme?u TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

I. r;-i-iwice;realizesigrate"1.19.23 -X-KEYSCORE workflows are standing queries that run on set intervals during the day (usually once a day) -After action reports can E-mail the results of the workflow, parse out data to mailorder to other databases and more -New Workflow Central makes it easy to create and manage your workflows TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

It. Slag may Tl'iie audit-eel fl: 1E: a rn: Hu me FLiqht-I. Ilia ce - ETSCURE Welcerne: cltetueE switch Lieere Heme Admin ?Lleere ?Werk?ew ICentral Search Fleeulte Statietite Preferentee #3 Help Havigatinn Menu e: I Hammer A Welceme tn the Beta release cf the New Heme EHc-rne Fage! Dim-3min . Sugars If have er tILig reparte pleaee gt: ta New GUI Fartim El ?wDricrlc-w Central EWS EHe-queet All Werir'flewe .: New GLII EIEISeerch . . IS warking en a new GUI that hae new reachte an anen Beta State. Fellcw the link helew tc- try it cut. rcur acct-Lint ancl ereferencee will autcmeticallar t-e Ei-Erwirtiaeerch traneferecl when leg in. F'leaee View trainincl ttI acclimate yeureelf with the El": Addre?e? new layeut anti featuree. Game featuree have net gret been cempletecl but will Still be available Elm": Addre? in the eriginal GUI. the new GUI IfEuetalI! EUeername If ?ncl huge [:Ileaee repertthern in the Farume under the EltiSF mam? ?Elma New GUI eectienJ which can he feuncl here. We will trar te fir-i any titles as quickly as Ewen but when eeneriencing a emblem revert hacl: tn: the eriginal GUI until we can ?e it. Elcme TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

Havigatian Menu El EWerHI-jw Centrel Hequee?t Werhflewe 1111 en Haviga tiun Me nu El Cerrtral Hetqueet 3 Wer1rflewe a Weririlewe II3:31;. 3339 31330 @213331517 3@ qeate! 'u'u'urltilaw [entral Request l?'u'izartl "Ia-i Welceme to the Werk?ew Request Wizard. I My Werk?uws I Help Actions I Queryr Tame lQueryr NEITIE Leei Medified 51e1e a. 3335?1 3?35 1 5: 33:1 3 en (31:31 3335-13-31 15:33:11 en (Hirej Ieheden_Geeglere 3335?11?35 31:35: 5? en (31:31 3335-13-31 15:33:33r en (Hirej teeh Huela_ umpur_1eeh_1ee1ring 3335?11?34 15: 31:33 en (31:31 megeprexgr 3335(31:51 3335?11?3415:31:33 en (31:33 11th:] JJareer 3335-13-31 15:33:43 en (31:51 3335?13?31 15:33:35 en (31:33 fu _ eg 3333-11-35 31:13:33 en (3132] 3335?11?31 33: 43: 41 en (31:33 Guerdeterjrernj??a: 3335-11-31 33: 33: 43 en (erj legin 3335?13?31 15:13:55 en (31:33 teeh DeiILArehiejrern 3335-1 3-33 1 3:53:33 en (erj 3335-13-33155553 en (31:33 daily_w en_1rern_mee 3335(31:31 dailywlenjeiwerk _ eg 3335(Hirej TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

I. r: i. I. ii. REEL TilProvides for the ability to task and scan for terms only when they appear inside the body of documents like Microsoft Office or Adobe PDFs - EX: We want to find technical documents regarding WIMAX networks but tasking the term to Cadence would flood PINWALE with hits. What if we only look for the term within documents? TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

15454;. 542:? 440441: 4? 4:040:74?; HEIEIHI HIE 2005-01-01 2000-01-01 - Ran-char 1 04:55:00 04:55:01 ?Wale? ?"an Line HIE 2005-01-01 2005-01-01 - 2 04:55:00 04:55:01 satEII'tE Line HIE 2005-01-01 2005-01-01 Ran-char 3 04:55:00 04:55:01 Line I. ELIGFtaqu-anty 0 14:: -L LEE-Premiums- El 1313-1153 buds-01:41:45 ETM 04550405551545: TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

.. - REL. We MeetSubject: Fem: m: I i Be: Date: Tue Dee GMT EDDIE HTML F'Iein Text Vent me:? emeil_t Medel: Eugene- Fm Ri?ng Syrup-tern: 41:31:31 Cemmente: ne- feult fennel phene ie werl-dng preperljr kindly; een?rm the fault in detail when and in which eenditien 1'1: ereatee preblem related te- mentien eympte-m TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. TailIda?."?Ill i . - -Tasking is so flexible that it can include regular expressions (REGEXs) with few or no anchor points -Ex: Can we find documents that have MAC addresses in them? -The following Regex looks for MAC addresses: TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

.- .-. so was-Supports full foreign language tagging and querying -Ex look for common Arabic expressions in E-mails coming from the Pakistan tribal regions: . . . TH . Astiss ussr: h" a s? Windows Live Mail UIS Vi shin 111 Displ t. Em U?kn W11 From- sons) Medium nskYou may:r not know this ssnderssk sis as unsst Slant: Thu 12:07? PM Ta: TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

71?13::f If i - X-KEYSCORE's full take database of meta-data and content make it an powerful SIGDEV tool I Many DNI applications don't contain strong selectors that allow traffic to be collected Web surfing Internet searching - Anonymous file uploading/downloading - The variety of applications processed and meta-data available make X-KEYSCORE an ideal starting point for DNI development TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. E. tr TEE) 021Scenario 1: Persona Analysis - Goal to identify the ?user session" I Help answer the question What did my target do while he was online? - We may know from TRAFFICTHIEF, PINWALE or MARINA that our target was online at a given time and from a given IP address, so we can then search in X- KEYSCORE for everything that happened ?around? that event. TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

2222222222 22221222 2211:1222-2221:122- 20031222 [3514062 1 [32151106 1- 2002-12-22 11521410? 20021222 0514022: 2222-12-22 22:11:22 20031222 [3511?1022 1 3011343329 $521,411.? 20021222 0514022 1 3913-13-39 25:14:07 22221222 2211122 ?5112? 2003-12-22 23031239 [3514103 1 2222-12-22 22:11:22 22021222 [1514102 1 2222-12-22 22:11:22 22221222 2511112 1 ?mm? 2002-12-22 05:14:02 22221222 221111212m1m mm 22021222 0514152 1 2222-12-22 22:11:22 1 2003-12-22 05:14:02 2222-12-22 22:11:22 20021222 051-12021 2222-12-22 22:11:12 22021222 [1514212 1 31111121333 1151-1411111 20021222 0511222 1 3922-12-29 25:11:12 2222-12-22 22:11:12 2222-12-22 22:11:12 2222-12-22 22:11:12 2222-12-22 22:11:12 TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123 222'; 1:1112112,2122222221 5, 1 011a AnalySIs AC 11*1- Search Fur ll??fll?l?l'l? ll??fll?l?l'l? ll??fll?l?l'l? ll??fll?l?l'l? username userlmme IIEEFIIFIITIE ll??fll?l?l'l? ll??fll?l?l'l? ll??fll?l?l?l? username ll??fll?l?l'l? ll??fll?l?l'l? ll??fll?l?l'l? userlmme 1 PK [22220212 End 2000?12-22 05:14:12 2002?1 21-22 05:1 4112 2002-1 21-29 05:14:12 2002-1 21-25! 05:14:12 2000-1 21-20 05:14:13: 2000-12-22 05:14:13 2000?12-22 05:14:12 20203?1 2-22 05:1 4121 2000?1 21-22 05:14:21 2002?1 21-29 05:1 4121 2000-1 21-29 05:14:21 2002-1 21-25! 05:14:21 2000-1 21-22 05:14:21 2000?12-22 05:14121 2000?1 21-22 05:1 4150 2003?12-22 05:1 4150 2002?1 21-22 05:1 4150 2002-1 21-29 2002-1 21-29 2000-12-22 05:14:50 2000?1 21-22 05:14:50 3222 ch H221222 1,205, c211, GER and 11221122291123

IL E's/Ag, mag (cm is RT a raid Lisis Coming soon: XKS PSC query builder/viewer usornam? 2415:1441? _j?iy:ihoo llS?rll?lTl? il??ala?l? How Actions Housman?m- . ?S?m?r Persona Session Eollection a: userlmr AI ?Samar Justi?cation: F'Iarscuna session collection for ll?srll?r ?clcliticunal Justi?cation: Start Date: a Time: lg?g?m? 33.3.; {ways Hm usarnar ussrnar 5WD Date 3" Tim: E1 05:19 usisrnar (Country Code}: usernar Query 9" llaarnar Hi TD I Ig?rli'lr EFF cur [Iient ?clcl Search: Eatractlacl Filla TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. 1- lee II: ewes sis Sessiun Eullectiun User List 'ss' User 1 User 2 User 3 El '5 ?Ear 1 HTTP II. I: Ine - i . {1331:3111 cemel-L - - teen-awe .111 Fee 333mm e? ?3333-3 . Imeereme die. eem meme-m Issl ?jlj?rlj? 33 33 43 41 43 43 44 43l45 4T 43 49 wade-mm El 5 Lleer _rh:r 31: use Bhr -. .- I Bra-weer Llsl: In Eeferer Summer";r EI-Itracted Files in I Elreweer I: Referred S'rtee File Meme 1-. Infe M?mam'? [camp?iblei MSIE ED: Mil-?aws NT 5'r ad.rieldmanager.cem [3 Items] El File Extentiun {1 Item} MelilleI-?? [eempetible; MSIE Windewe NT 3 ??ne mmype 2 chatyeheexem [3 Items] I I Cempe?hle?? meme] 2 facehuuk.mm Item?} Gee-graphic 1P Summer'sr Llsername Summary f?t?-m-?il-I?U {3 CW mum? ?aunt Lleernernee 4s haherler.cem {3 Items} '3 Fl'?'l'l'l [3 HDHET EDS El mailg?wehmailfgmail Item} {1 Item} I: 1333 insider.msg.yahee.cnm [4 Items} El Te {14 Items]- .El {2 Items} ?language-[um [1 Item} GENEVIE. CH 2 mail.ramhler.ru Items] MD ".le TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

Coming soon: XKS PSC query builder/viewer - rs: in; l; Aiwg[ii] Iy sis Llsername Eummary Llaernainai a mailg'wehmailg?gmail Item} El mailfwehmailfmailru {2 Items} El Item) mail,? webmailg? rambler ItemEJ mailfwehmailframhlarfpusl: {1 Item} El mailg'wehmailf'fahan {5 Items] .ili. Searches d- Tarina Search Engines El {ii-lune} Item} nune Traffic Summar1.l App": nr Fingerprint I2 adv-imminent 2 I3 h?i? B- .1 I news 2 ancial I: unknawn Damain Summary Euhdnmaina (E Item5] Eldri?l'El'JLl [1 Item} aI-camai.nal: Item] hn5.ru {1 Item] citrEclJu Item} [1 Item} cum.tr Item] faEEhuuk.cum {2 Items} Item} gi5metea.ru [1 Item} gaugle.cum [1 Item} haherler.cnm {3 Items] img?mail.ru {1 Item] macrumediaxum {3 Items} mail.ru Items} TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. -- IEQIE II: '1 DEAF JESUSE @330 K?Why is he at angle Earth? TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. . 125;. 552., Aug, wife .gLTraffic rt rt '3 font Goog le queries co. areas of Raw Actlun? Pa .1 'u'iew 5355mm . Iu'iew 5355inn (New Windnw} . Informatlt'._ In HTTP 3: Shaw .1 Mark. Matadatarnw as Impartant Human.r Marina fur 1P: 1 15.55.125.152 D?t?tin'l?: 2555-12-25 [5'21 :42 3 lmurs 1f Fm I:ij DH Cancel PH Eli-?ll . .. LIn-Eheck where: Fm Equals '115- TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

1001 12* . U33, 3113, C319, 1933 and NZLH20291123 TI 11111 mm Ham 1.: 0111111:? 1.11:" Mb" - -l a (Hum; lulu. Id?: LIA-H. .I 1i I I ZLIPHD-HE ACTWITT USERJH 2111131119 11992992, _em3133393 13g33911em391 113-3 2111131119 11932593 _3m31333r:= 13333331133391 113-3 2111131119 11999993 1333333113339) 113- 2111131119 11999132, _em313339:= 13333331133139}: HES-E 2111131119 11939133 _3m31333r:= 13333331133311 113-3 [21743162 31113112911911?? 193111.11 3111311 115 h! DURELTIUH 2111131119 11991913 2111131119 11923913 113111511119 11192: 113. _em313339:= 13333331133391 1119-? _3m31333r:= 13333331133391 113-3 _3m313332:= 1333333113331) 113- _em313339:= 13333331133139}: ?ea-E _3m31333r:= 13%3331133391 113-3 _3m31333::= 1333333113331) 113- 2111131119 11999532, _3m313339:= 13993391 13133111 211931119 111919933 _3m31333r:= 13333391133311 113 29931119 11999113 _3m313333:= 1333333113331) 113- TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123 2121031119 GTJESTZ EUDSHIE [17?4357?3 213031119 [17?43532

-- 1311ng WE, a szzozg 1 123 ffi Now make that into a workflow NAHE: Mee_NHFP_FDriegn_Gng1ere current time: GHT submitted at: 2008?11?20 03:55:03 GMT has 1% reeult?ej EDDE?ii?ig e1 qeide (en, en?GE) [13 The ai?Ilthlas 111211111012}! {cybertrana flit-m Arabic} [refererj tbe el?Ikhlas netwerk [tybertrana frem Arabitj i3) EDGE?ii?ig Fbrum bridef'nrue [cybertrene frem Arebiej 2nne-11?1e ne:n5:51 Ferum levefgrem from Arabic} 2008?11?19 [refererj fbrum levefgram {cybertrana frem Arabic) ilj EDDE?ii?ig 15:?i:?D The hille jihediet witheut inflicting [cybertrene frem Arabia) (in) rune?11?1e 15:14:13 [referer] the bills jihediet mitbent inflicting [e?bertrene from Arabic] 15:33:19 Haziriaten [cybertrana frem Arabic] EDGE?ii?ig Seendele [cybertrene frem Arabic} (3) 2nne-11?1e Uq:rq:59 [referer] seeree1e frem Arabic} 2008?11?19 Heme {cybertrana item Arabic] [13 EDDE?ii?ig Ferum eeil [cybertrene frem Arabic] rune?11?1e Uq:31:51 [referer] fernm eeil [e?bertrene frem ireniej 111 Werk?nw EML . TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

l. L: leis IL. see AUSE Cali31:71?- SEG EX: Targets pass links to videos, use XKS to discover new targets who have viewed those videos htteii?firwwiwleadtei les WE In HE 00215-09, he promises that the newest video will be ready very soon. and then sends these two Datetirne: Weeks Start: ante-1323 1- 5 Stop: an Type: 23:59 Host: wwfilesin Path: TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

3" - -37CAN, GER and 1:11: 0112411 WI27:33 .Ff?01:11..J. Ll: 31111 FUJI T?ll PHD-NE USELELA ACTWITF UHEELE Datet Em 22221221 2242222 ?22m2112242:= 1222222122222) 22- 222212212242422 _em212222:= 12.222221122121131 22- 222212212242422 _em212422:= 1432242122122) 22- 222212212242422 _em212422:= 1222242122122) 22- 222212212242222 _em212422:= 1222242122121) 22- 222212212242222 _em212422:= 1222242122122) 22- 222212212242222 _em212222:= 12.222221112212111 22- 222212212222122 _ema22222:= 12.222221112212111 22- 22221221 22211212 _em212422:= 1232242122122) 22- TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

find technical documents of interest One Idea: Take advantage of the properties exploited as meta-data by X-KEYSCORE like the Author and Organization Lets look for all documents where the organization field is the company we're interested in, ex: Warid Telecom TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

. TEDFilenarne Extension Author Last ennuth Drganila?tinn troubleshoot MPEH eml for Wand Telecom Ltil. troubleshoot MPEH eml for um Warm Tale-com Ltil. wp. for him troubleshooting Ell-1 2?133le {lo-n: Wariil Telecom Ltil. wp. for line troubleshooting Ell-1 (Ion: 1Mari-[l Tale-com {Put} Ltil. Fleno Signed-Lie His Willi-El Tole-com {Put} Ltil. Flew} His W?liil Telecom Llil. L?l W?riil for 3443: and 34-1-1 Silenced-Beetle: {lo-H: W?liil Teleeom Ltil. Wariil for 3441i and 34-14 Sliorlcoilesxloi: {lo-4: W?ll? Telecom Ltil. Sohail Malihms mg Warm Telecom Ltil. Many of these files may have not been selected, because either there was no strong selector associated or the strong selector(s) weren't tasked for collection TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

WEE: @9319 NZQuestions? -@nsa xkeyscore@nsa TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

THEE- gamma Sascnpe=urdualink=next GET nl . start= Accept: Accept-Lanwage I - User?Agent Hazillaf?.? (compatible; HSIE Windows NT 5.1; HDSE: Eache? an EU max?3 a e=l Connectinn: Ee-a?1 - E?Elue?uat?via 553n32n2E9293545 Hn?t UHL Path LIHL ?rga Hearth Search Terma Language: Elrnwaer ma mLJEharraf an Mozillam? (compatible; MSIE Window NT 5.1; Heferer CDDME TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123

User Queries 1w X-KEYSCO Central Query F6 Query HQS I. QUEW FORNSAT site Query;r I6 Sitel F6 Site 2 Query THEE- MUSE 880 site TOP SECRETHCOMINTHORCONEEL TO USA, CAN, GBR and NZLH20291123