DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (S//SI//REL) NSAers Make First-Ever Visit to FORNSAT Collection Site in Schöningen, Germany FROM: Joint SIGINT Activity (H52G) Run Date: 10/31/2006 (U) Visitors impressed with software demos. (S//SI//REL) This summer Special United States Liaison Activity Germany (SUSLAG) and Joint SIGINT Activity (JSA) representatives, along with Counterterrorism analysts from S2I, became the first US visitors at Schöningen, a Bundesnachrichtendienst* (BND) FORNSAT collection site located in northern Germany. (S//SI//REL) During these visits, BND senior site managers and analysts provided briefings on their mission, site manning, technical capabilities, as well as current and advanced analytic tools and techniques. These visits in June and July provided insights into the BND's collection, processing, and analytic capabilities, and promoted the close technical partnership between JSA and the BND. (S//SI//REL) Before the reunification of Germany, Schöningen (located on the former East-West German border) collected East German radar, radio, and microwave communications. When Germany reunified in 1990, BND personnel at Schöningen were forced to recreate their role and mission. Schöningen did so proudly, and now plays a key role in the BND's Counterterrorism (CT) and Force Protection efforts by collecting mobile communication systems (specifically Thuraya , INMARSAT, and GSM). (S//SI//REL) Today, Schöningen is manned with approximately 100 personnel. There are 27 BND target analysts, and 20 linguists who provide language expertise against 27 languages. Of these linguists, 14 are native speakers (similar to NSA's RODEHOUSE program -- see related article pt 1 and pt 2 ) integrated into site. The BND philosophy is that the native-speaking linguists are more productive if they are sitting side-by-side with experienced BND analysts. Site engineers keep Schöningen's 19 antennas, the largest of which are 11 meters in diameter, busy. BND site managers also discussed their most recent support role in providing CT and Force Protection support to deployed German military forces in Afghanistan and the Congo. (S//SI//REL) Schöningen personnel focus on development and production of voice and facsimile traffic collected from Thuraya, INMARSAT and GSM. Schöningen collects over 400,000 Thuraya cuts per day, 14,000 INMARSAT cuts and 6,000 GSM cuts from both the Afghanistan Roshan GSM network and an unidentified Congo network. E-mail is also collected at site, with an average of 62,000 collects per day. NSA benefits from this collection, especially the Thuraya intercepts from Afghanistan, which the BND shares on a daily basis . (S//SI//REL) Site analysts and linguists are responsible for evaluating collected traffic, transcribing voice cuts and forwarding raw cuts on to their HQS for further evaluation and reporting. To improve their collection and SIGDEV capabilities, site engineers have developed several systems to improve BND call-chaining capabilities, data-viewing of voice and fax data, and data-forwarding to BND HQS. Development efforts at a field site are unusual for BND, and it was interesting to learn about these on-site efforts. (S//SI//REL) The second visit by JSA and NSA Headquarters analysts represented the first technical exchange with BND Schöningen. US analysts were shown several BND analytic tool suites, some of which were under development. BND contract software developers and analysts sought regular feedback on the utility of these tools and techniques. These tool suites, such as MIRA 4, integrate multiple database analytic functions (such as viewing voice and listening to fax), much like NSA Headquarters has UIS (User Integrated Services). In some ways, these tools

have features that surpass US SIGINT capabilities. Among a series of interesting items, NSA analysts noted that BND analysts could seamlessly move from VERAS (call-chaining software) to the associated voice cuts. BND Schöningen also performed geolocational selection of mobile communicants. For instance, they could define any particular geographical area, like a terrorist camp, and select any communicant that dwelled in that area for several minutes. (S//SI//REL) BND Schöningen developers also demonstrated a software prototype that uses Social Network Analysis algorithms against metadata to discover and assess target groups among other things, looking for information flow. The goal (at least in part) was to monitor these targets in the background within analyst-set parameters, with alerts to notify the analyst when any anomalous measurement appeared, and potentially to steer front-end collection. They claimed to have some successes on small groups on which they had good collection. (S//SI//REL) They seemed interested in also characterizing movement patterns on geocoordinates to find persons such as couriers (terrorist or otherwise), then using that characterization for SIGDEV discovery purposes and predictive (trend) analysis. BND also showed us that they are interested not only in selection based on movement patterns or network structures, but also in hardware changes. They used a variety of algorithms (such as fuzzy logic) to discover these patterns. The BND responded positively to NSA's request for a copy of MIRA4 and VERAS software, and made several requests from NSA concerning target and tool development and data. (S//SI//REL) This first series of meetings represents a new level of engagement for NSA and its German partner. We hope that this dialogue continues, and makes each partner more capable of satisfying common SIGINT requirements. (U) Notes: * BND = Federal Intelligence Service (U//FOUO) This article is reprinted from the Foreign Affairs Digest , September edition. "(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108