DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (C) MHS Lends a Hand in the Aftermath of the London Bombings FROM: Menwith Hill Station Run Date: 08/24/2005 (C) SIGINT site in the UK responds to the terrorist bombings. (C//SI) The Menwith Hill population was both shocked and saddened by the 7 July 2005 terrorist bombings in London that left 56 dead. We were eager to assist UK efforts to identify the culprits and prevent similar acts in the future. While the police worked to restore order in London, Menwith Hill Station (MHS) immediately began collaborating with the intelligence community to provide assistance in the search for the perpetrators. MHS analysts looked at a number of communications systems, sifted through thousands of calls to find suspicious communicants, and passed on their findings to GCHQ and throughout the intelligence community. (S//SI) Details on the event conflicted initially, and questions persisted as to where and how to begin analysis. MHS opted to focus on its unique access, where its efforts could have the most impact--coverage and analysis of VOICESAIL (VS) communications. We worked with GCHQ's International Terrorism Team to put coverage on nine UK cities, and compile a list of UK cities and external locations (including Copenhagen, Brussels, and various locations in Spain, South Africa and Morocco) requiring tighter focus. At GCHQ's request, analysts examined calls from VS handsets that had dialed into London from Iraq. (S//SI) The VS analysts found high priority targets that had phoned specific areas in the UK from Pakistan, Afghanistan, Egypt, and Iraq. These findings were passed to GCHQ for further development. We monitored suspicious VS use, as reflected by successive SIM** card activity, an abundance of travel, or an unusual amount of calling activity. All terminals were checked for short message service (SMS) and GCHQ was alerted to those containing curious messages. MHS analysts also identified unusual SMS activity from Iraqi GSM carriers and subsequently tipped MHS's COMSEC monitoring team (SPRINKLER) because it appeared to disclose information regarding military operations. SPRINKLER relayed the data to the Joint COMSEC Monitoring Activity (JCMA) for follow-on analysis. (S//SI) Extensive analysis revealed two base stations in , Pakistan with a significant amount of calls to the UK. Analysts acquired imagery that indicated a possible compound, necessitating further investigation. Additional metadata analysis of various technologies was coordinated with NSA's GEOCELL (S2L) and GCHQ. We also coordinated closely with the European Security Center in Darmstadt, Germany, on high powered cordless phone analysis to identify phone numbers emanating from the UK. On the digital network intelligence (DNI) front, analysts reviewed all data from 5 to 7 July for intelligence selectors to use. We also reviewed data from 21 July when a second wave of terrorist bombings in London was attempted. These efforts resulted in approximately 45 new bombing target terms being added to the database and shared with GCHQ. (S//SI) MHS analysts continue to support GCHQ's efforts. We hope our rapid and thorough response will greatly boost efforts to break up networks backing these attacks, prevent future incidents and greatly increase the terrorists' cost of doing business. **(U) Note: SIM = Subscriber Identification Module card that carries GSM (Global System for Mobile Communication) subscriber data and activates the phone when inserted.

(U//FOUO) Menwith Hill Station "(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108