DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (U//FOUO) The Rewards of Metadata FROM: SIGINT Communications Run Date: 01/23/2004 FROM: SIGINT Communications (S//SI) In recent years, one of the most useful tools in SID's toolbox has been the use of "information chaining", in which analysts look at communications metadata, or "externals" (i.e. information about the comms themselves, rather than the content of those communications). As one example of this (known as "call chaining"), analysts investigate which phone numbers are being called by targeted phones numbers. (S//SI) What does this tell them? For one, it helps with SIGINT development by yielding new, potentially fruitful, numbers to collect against. It also can shed light on the relationships that exist among a group of people (see a related story on Social Network Analysis ), insights that can have intelligence value. Information chaining can also show the location from which certain calls are being made.** (S//SI) SID's use of this information has yielded concrete results - including playing a role in the capture of "bad guys"! A Counterterrorism analyst used locational information to help steer authorities towards the al-Qaida VIP Khalid Sheikh Mohammed, who was captured in Karachi, Pakistan in March 2003. In another incident, analysts identified the cell tower of a handset used by Abu Zubaida, a senior al-Qaida operational coordinator. He was captured in March 2002. (S//SI) NSA's corporate COMINT call event repository is called FASCIA II. It is a huge database that today provides access to metadata records on: telephone wireless billing data media over IP (MoIP) high-powered cordless phone (HPCP) In future, FASCIA II will provide more sources for all of the above, plus INMARSAT and email (also known as DNI) metadata. (S//SI) Currently, the database holds over 85 billion total records, with about 125 million records a day added, making FASCIA II one of the world's largest Oracle databases. It has over 48 months' worth of on-line storage. In future, these figures will increase to over 205 million records a day, and storage of 7 years on-line, 3 years archived. In addition, new servers will make the database 300% faster. All of these upgrades must be carried out while keeping the system on-line, since continual access to the data is of such importance to the SIGINT analyst customers, Second Party and Intelligence Community partners. (S//SI) As you can see, information chaining is a real "growth area" for SID. If you have any questions about FASCIA II, contact the Project Manager nsa) in Technology Services. **(S//SI) For more information on information chaining using metadata, contact SIGINT Development's Target Analysis Center .

"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108