DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
(S//SI) NSA's Technical Analysis of CNE Collection Goes Global -- A
Success Story
FROM:
CNE Target Analysis (S31153)
Run Date: 05/11/2006
(TS//SI) The exploding volume of computer data currently traversing the global network
presents a difficult challenge for the entire SIGINT system. One strength that NSA can ride to
surf this tidal wave is the unified capability we can harness across a seamlessly cooperative
extended enterprise. Simply put, since our adversaries distribute themselves across the
network, why shouldn't we do the same?
(TS//SI) The Network Information Exploitation (NIE) Target Analysis Branch in Cryptanalysis &
Exploitation Services (CES) has made great strides towards doing exactly that. With a
burgeoning effort already underway at NSA/CSS Georgia (see related story ) and others soon to
follow at the other Cryptologic Centers, these efforts are managed via a "virtual teaming"
paradigm that allows CES to apply those distributed resources to the areas of greatest SIGINT
need.
(TS//SI) The NIE Target Analysis branch (S31153) serves the SIGINT community by performing
technical analysis of Computer Network Exploitation (CNE) data acquired through TAO (Tailored
Access Operations) active operations, and by working closely with TAO to provide prioritized,
precise tasking of sustained CNE collection assets. NIE analysts at NSAW and NSA/CSS Georgia
use specialized tools and analytic training to uncover SIGINT lead information that would
otherwise be obscured by technical barriers of a complex operating system, or because that data
is not designed to be human accessible. In many cases, such information is deliberately hidden
through encryption or other security mechanisms. This type of analysis has proven extremely
valuable in the prosecution of the Counterterrorism mission, and the NIE branch is actively
working to provide value to other product lines as well.
(TS//SI) The extended NIE effort began at NSA/CSS Georgia in June 2005 with a single analyst.
Targeted hiring through the MARSOC PMO* and reassignments at site has grown the unit to a
current strength of six. Our Georgia teammates are now responsible for nearly 100 endpoint
targets, adding breadth and depth of analysis to the CT effort.
(TS//SI) This cooperative effort is managed in a fashion that directly implements the
Transformation 2.0 vision of "distributed execution, centralized control." S31153 maintains
mission authority for NIE, and is responsible for direct operational tasking of its extended
elements. In order for such an arrangement to work well, multiple lines of communication must
be open at all times. NIE analysts in Georgia and Maryland make this happen by building
cooperation into their daily operations, such as:
All incoming analysts receive extended training in the NSAW mission element.
The primary and backup analysts assigned to new targets are often split between the two
locations.
Georgia analysts participate in operational meetings held by NIE Target Managers via a
voice conferencing system.
Analysts from the two sites work together on the Sunday shift in support of Analysis &
Production's Counterterrorism Digital Network Intelligence (CT/DNI) mission.
(U//FOUO) In December, Georgia even stepped up to provide coverage of top-priority CT targets
during a Code Red snow day at NSAW.
(TS//SI) The success of our NIE efforts at NSA/CSS Georgia has proven to us that this "virtual
teaming" model can work effectively across a distributed SIGINT enterprise. Both NSA/CSS
Hawaii and Texas are set to join our extended family in the near future, and we expect
the same great contribution from those partners that we've seen thus far from
Georgia. The NIE mission is an important part of Data Acquisition's goal of making the active
collection of CNE data more valuable to the end consumer, and the additional analytic resources
now available in the extended enterprise are already becoming an indispensable part of this
effort.
*(U) Note: MARSOC PMO = Mission Alignment and RSOC Build-Out Program Management Office
"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet
without the consent of S0121 (DL sid comms)."
DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108