DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (U) The TAC's Metadata Analysis Cell (MAC) FROM: Technical Director, MAC Run Date: 03/09/2004 FROM: Technical Director, MAC (TS//SI) Let's start with an example of how work in the Metadata Analysis Cell (MAC) leads to intelligence results: (TS//SI) MAC Training on MAINWAY Uncovers New CT Leads : Training on a suite of MAINWAY tools assisted the CT SIGDEV effort to discover new high value terrorist-related targets. (TS//SI) In mid-May, MAC analysts briefed the CT Analyst Workshop for telephony on the MAINWAY suite of tools. One month later, a CT analyst who had attended the workshop approached the MAC for assistance in finding new terrorist-related numbers. (TS//SI) The MAC worked with the CT analyst to apply the MAST Cohort and Community of Interest searches. This collaboration uncovered six new terrorist-related numbers that will be included in a technical report. Concurrently, the CT analyst used the SIGINT Navigator's TIMELINE application to track how terrorist-related numbers changed over time as recent events unfolded in Saudi Arabia. (TS//SI) What does the Metadata Analysis Cell do? It is capable of tracking and documenting the communications environment using communications externals. In this process, the MAC works closely with the Network Analysis Center (NAC) and Product Lines to build a deeper understanding of the worldwide metadata that supports Product Line collection, processing, analysis, reporting, and development efforts. (TS//SI) The MAC combines its results with all-source information in search of new targets and identifiers, and for metadata information that ties known identifiers to specific individuals or organizations. It tracks these identifiers to ensure they are tasked through OCTAVE and other collection systems. It develops target communications networks and patterns of activity with a goal of discovering previously unknown communications of interest. (TS//SI) While currently focusing efforts on the counterterrorism problem, the MAC workforce is capable of quickly moving to other targets as priorities change. The MAC has demonstrated success against INMARSAT, GSM and other mobile handsets, PSTN, facsimile, DNI and other modes of communications. (TS//SI) The MAC is a leader in contact chaining procedures, results analysis, and reporting. While the focal point for contact chaining analysis at NSA, the MAC has been very successful in introducing fast and innovative tools into the mainstream at NSA Headquarters and the extended enterprise. For example, there are now over 3,000 users of the SIGINT NAVIGATOR/MAINWAY suite SERIES: (U) SIGINT Development 1. SIGINT Development: A Network of Discovery Networks 2. Target Technology Trends 3. SIGINT Development: the Target Analysis Center (TAC) 4. The TAC's Metadata Analysis Cell (MAC) 5. The TAC's Social Network Analysis Workcenter (SNAW) 6. TAC's Target Development Services (TDS): In the Spotlight and Behind the Scenes 7. The NAC's Advanced Network Development & Analysis (ANDA) Division 8. The NAC's Data/Network Operations Center (DNOC)

for call chaining analysis. Numerous civilian and military analysts were rapidly trained in its use prior to the war with Iraq. (TS//SI) In addition to the suite, a number of routines, shared with the product lines, were developed in conjunction with the Math Research Group. These routines alert analysts to telephony and DNI communications activity and follow complex communications routing. The MAC developed an extensive process that supports contact chaining and reporting by other SIGINT producers. "(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108