DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
(U) The TAC's Metadata Analysis Cell (MAC)
FROM:
Technical Director, MAC
Run Date: 03/09/2004
FROM:
Technical Director, MAC
(TS//SI) Let's start with an example of how work in the Metadata
Analysis Cell (MAC) leads to intelligence results:
(TS//SI) MAC Training on MAINWAY Uncovers New CT Leads :
Training on a suite of MAINWAY tools assisted the CT SIGDEV effort
to discover new high value terrorist-related targets.
(TS//SI) In mid-May, MAC analysts briefed the CT Analyst
Workshop for telephony on the MAINWAY suite of tools. One month
later, a CT analyst who had attended the workshop approached the
MAC for assistance in finding new terrorist-related numbers.
(TS//SI) The MAC worked with the CT analyst to apply the MAST
Cohort and Community of Interest searches. This collaboration
uncovered six new terrorist-related numbers that will be included
in a technical report. Concurrently, the CT analyst used the SIGINT
Navigator's TIMELINE application to track how terrorist-related
numbers changed over time as recent events unfolded in Saudi
Arabia.
(TS//SI) What does the Metadata Analysis Cell do? It is capable of
tracking and documenting the communications environment using
communications externals. In this process, the MAC works closely
with the Network Analysis Center (NAC) and Product Lines to build
a deeper understanding of the worldwide metadata that supports
Product Line collection, processing, analysis, reporting, and
development efforts.
(TS//SI) The MAC combines its results with all-source information
in search of new targets and identifiers, and for metadata
information that ties known identifiers to specific individuals or
organizations. It tracks these identifiers to ensure they are tasked
through OCTAVE and other collection systems. It develops target
communications networks and patterns of activity with a goal of
discovering previously unknown communications of interest.
(TS//SI) While currently focusing efforts on the counterterrorism
problem, the MAC workforce is capable of quickly moving to other
targets as priorities change. The MAC has demonstrated success
against INMARSAT, GSM and other mobile handsets, PSTN,
facsimile, DNI and other modes of communications.
(TS//SI) The MAC is a leader in contact chaining procedures,
results analysis, and reporting. While the focal point for contact
chaining analysis at NSA, the MAC has been very successful in
introducing fast and innovative tools into the mainstream at NSA
Headquarters and the extended enterprise. For example, there are
now over 3,000 users of the SIGINT NAVIGATOR/MAINWAY suite
SERIES:
(U) SIGINT Development
1. SIGINT
Development: A
Network of Discovery
Networks
2. Target Technology
Trends
3. SIGINT
Development: the
Target Analysis
Center (TAC)
4. The TAC's Metadata
Analysis Cell (MAC)
5. The TAC's Social
Network Analysis
Workcenter (SNAW)
6. TAC's Target
Development
Services (TDS): In
the Spotlight and
Behind the Scenes
7. The NAC's Advanced
Network
Development &
Analysis (ANDA)
Division
8. The NAC's
Data/Network
Operations Center
(DNOC)
for call chaining analysis. Numerous civilian and military analysts
were rapidly trained in its use prior to the war with Iraq.
(TS//SI) In addition to the suite, a number of routines, shared with
the product lines, were developed in conjunction with the Math
Research Group. These routines alert analysts to telephony and
DNI communications activity and follow complex communications
routing. The MAC developed an extensive process that supports
contact chaining and reporting by other SIGINT producers.
"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet
without the consent of S0121 (DL sid_comms)."
DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108