Snowden Archive
The SIDtoday
Browse the Archive

The Day the Trigraphs Disappeared


NSA staff recall the day in April 2003 when all Iraqi collection targets stopped transmitting as the U.S.-led coalition forces moved into Baghdad. Some staff had spent over a decade working on Iraqi signals intelligence and expressed confusion about the effect peacetime would have on their work.


Mar 14, 2005


Feb 05, 2018



Page 1 from The Day the Trigraphs Disappeared
DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (U) The Day the Trigraphs Disappeared FROM: the GRSOC Cryptologic History Program Unknown Run Date: 03/14/2005 As the Saddam Hussein regime collapsed, SIGINT collection ended (S//SI) (C) On one of the most unusual days in US cryptologic history, the SIGINT trigraphs for an entire country disappeared from collection tasking virtually overnight. The military and civil infrastructures were gone; collection targets were obliterated with the stroke of a pen; SIGINT reporting all but ceased. There was nothing left. (S//SI) It was April 2003. The invasion of Iraq saw coalition forces streaming from southern Iraq into Baghdad. The once-feared Republican Guards of the Saddam Hussein regime offered little resistance. It was a time that everyone will remember. (S//SI) "IQ was gone. Wow. I have worked this target from August 1990 through April 2003. To me it was personal, like there's a void in my SIGINT life." Those were the thoughts of Mr. John Whitelaw, Deputy Chief of Operations (D/J3) at the Gordon Regional Security Operations Center (GRSOC). "But we have to turn toward planning for the future. What is ahead without Iraqi military comms?" he mused. (S//SI) On April 11, 2003 the DIRNSA issued an email, "With very few exceptions, the SIGINT targets [of Iraq]... have ceased to exist. To use one measure, GRSOC issued just over 4,000 KLIEGLIGHTS* (K/Ls) during the last week in March; they've produced a little over 600 from 1-7 April." By the following week, reporting had dried up to a trickle. (S//SI) May 1st became "an historic day in GRSOC collection history: IQA, IQT, IQZ, and IQM were all removed from the routing tables in NIGHTGLOW" audio distribution switch, according to an internal email by a GRSOC system administrator. There were no more audio cuts, no more transcripts, no more K/Ls, no more product reports. The targets were gone. (S//SI) , was serving as Chief of Operations (J3) at the GRSOC during Operation Iraqi Freedom. When he read the message dissolving the Iraqi collection targets, his reaction was dramatic, "Wow! Well, the world has changed. How does it affect the GRSOC? I guess they'll be looking for a "peace dividend". Will we lose resources because of our success? We are fighting budget cuts while still supporting our force protection missions. Now the question is: how are the bad guys communicating? Now we have to develop a whole new target! We might need more resources because we don't know what's out there." (S//SI) He paused and began to reflect on the long-term effort that went into the Iraqi mission, and the challenge that lay ahead. "It's really bittersweet. We did a great job and we won, but now that means, in a political sense, that the threat, and the target, are gone. The new challenge is - how do we provide force protection intel to our forces in Iraq who are being shot at every day? We feel helpless because there are no comms to exploit to support them." (C) Little did anyone know that almost two years later GRSOC linguists and analysts would still be collecting on new targets in Iraq, but this time it is the insurgents. *Notes: (S//SI) Trigraphs = the three-character descriptors for collection targets that make up the beginning of a case notation. In this case: IQA is Iraqi Air Force, IQT is Iraqi Civil Air, IQZ is Iraqi Air Defense, and IQM is Iraqi Military (Ground Forces). (U//FOUO) KLIEGLIGHT -- used to forward time-sensitive SIGINT technical information to the
Page 2 from The Day the Trigraphs Disappeared
National Security Operations Center (NSOC), SIGINT producers, and Cryptologic Support Groups. "(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108