DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (S//SI) Advanced CNE at the Kunia RSOC FROM: CWO3 TAO/SEPI Requirements and Targeting (S3271) Run Date: 03/19/2004 FROM: CWO3 TAO/SEPI Requirements and Targeting (S3271) (S//SI) On March 2nd, the Kunia Regional Security Operations Center (KRSOC) was officially sanctioned by SID's Tailored Access Operations (TAO) as the first organization of the Extended Enterprise to conduct advanced Computer Network Exploitation (CNE). "Advanced" CNE refers to operations in Category B (vulnerability scanning) and above. This new capability at KRSOC will not only expand CNE operations for NSA/CSS, it will also serve as the first step in providing TAO with CNE Continuity of Operations (COOP) - that is, the ability to continue essential missions and functions without unacceptable interruption when catastrophes or other major disruptions occur. (U//FOUO) COOP for CNE (U//FOUO) COOP operations involve taking preparatory measures, responding to events, and restoring capabilities, all part of a readiness and survivability program. SID/TAO has developed plans for COOP consistent with the guiding principles of the Mission Assurance Program Office (DK2), which promote a dispersal of resources (including personnel), minimize duplication of capabilities, and support a seamless transition in the event of a disaster. Sufficient equipment has been installed at KRSOC to ensure continuity of some operations, and this initiative is expected to evolve to include additional sustained operations in the future. (TS//SI) In the long term, we expect to be able to reconstitute operations from Category A through D (i.e. "target mapping" through "sustained SIGINT collection") at additional alternate facilities, in case of either temporary or permanent interruptions in service. For these plans to be successful, we will need a robust on-net infrastructure. The USSID 222 Implementation Plan (USSID 222 IP) calls for several alternative facilities - expected to be located at all three RSOCs - to be manned by trained and certified operators to complement TAO's Remote Operations Center (ROC) facilities and personnel. (U) Background (S) The CNE Strategic Plan of August 1997 serves as the basis for the combined efforts of the SCEs and NSA to integrate the CNE process into daily SIGINT operations. The initial efforts at the Kunia, Medina and Ft. Gordon RSOCs have been non-intrusive target development (Category A). However, as RSOC CNE capabilities evolve exploitation responsibilities will increasingly migrate to the RSOCs for their respective target sets, as delegated by TAO. Both the MRSOC and GRSOC are scheduled to receive advanced CNE capabilities in the near future. (S) We see exciting times ahead for those involved in the CNE field - the global use of network and digital technology offers great opportunities for the SIGINT Enterprise. (S) The KRSOC had their ribbon cutting ceremony for advanced CNE operations on 16 March 2004. (U//FOUO) The point of contact for this issue at TAO is CWO3 or LTJG "(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet

without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108