DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
(S//SI//REL) NSAers Make First-Ever Visit to FORNSAT Collection
Site in Schöningen, Germany
FROM:
Joint SIGINT Activity (H52G)
Run Date: 10/31/2006
(U) Visitors impressed with software demos.
(S//SI//REL) This summer Special United States Liaison Activity Germany (SUSLAG) and Joint
SIGINT Activity (JSA) representatives, along with Counterterrorism analysts from S2I, became
the first US visitors at Schöningen, a Bundesnachrichtendienst* (BND) FORNSAT collection site
located in northern Germany.
(S//SI//REL) During these visits, BND senior site managers and analysts provided briefings on
their mission, site manning, technical capabilities, as well as current and advanced analytic tools
and techniques. These visits in June and July provided insights into the BND's collection,
processing, and analytic capabilities, and promoted the close technical partnership between JSA
and the BND.
(S//SI//REL) Before the reunification of Germany, Schöningen (located on the former East-West
German border) collected East German radar, radio, and microwave communications. When
Germany reunified in 1990, BND personnel at Schöningen were forced to recreate their role and
mission. Schöningen did so proudly, and now plays a key role in the BND's Counterterrorism
(CT) and Force Protection efforts by collecting mobile communication systems (specifically
Thuraya , INMARSAT, and GSM).
(S//SI//REL) Today, Schöningen is manned with approximately 100 personnel. There are 27
BND target analysts, and 20 linguists who provide language expertise against 27 languages. Of
these linguists, 14 are native speakers (similar to NSA's RODEHOUSE program -- see related
article pt 1 and pt 2 ) integrated into site. The BND philosophy is that the native-speaking
linguists are more productive if they are sitting side-by-side with experienced BND analysts. Site
engineers keep Schöningen's 19 antennas, the largest of which are 11 meters in diameter,
busy. BND site managers also discussed their most recent support role in providing CT and Force
Protection support to deployed German military forces in Afghanistan and the Congo.
(S//SI//REL) Schöningen personnel focus on development and production of voice and facsimile
traffic collected from Thuraya, INMARSAT and GSM. Schöningen collects over 400,000 Thuraya
cuts per day, 14,000 INMARSAT cuts and 6,000 GSM cuts from both the Afghanistan Roshan
GSM network and an unidentified Congo network. E-mail is also collected at site, with an
average of 62,000 collects per day. NSA benefits from this collection, especially the Thuraya
intercepts from Afghanistan, which the BND shares on a daily basis .
(S//SI//REL) Site analysts and linguists are responsible for evaluating collected traffic,
transcribing voice cuts and forwarding raw cuts on to their HQS for further evaluation and
reporting. To improve their collection and SIGDEV capabilities, site engineers have developed
several systems to improve BND call-chaining capabilities, data-viewing of voice and fax data,
and data-forwarding to BND HQS. Development efforts at a field site are unusual for BND, and it
was interesting to learn about these on-site efforts.
(S//SI//REL) The second visit by JSA and NSA Headquarters analysts represented the first
technical exchange with BND Schöningen. US analysts were shown several BND analytic tool
suites, some of which were under development. BND contract software developers and analysts
sought regular feedback on the utility of these tools and techniques. These tool suites, such as
MIRA 4, integrate multiple database analytic functions (such as viewing voice and listening to
fax), much like NSA Headquarters has UIS (User Integrated Services). In some ways, these tools
have features that surpass US SIGINT capabilities. Among a series of interesting items, NSA
analysts noted that BND analysts could seamlessly move from VERAS (call-chaining software) to
the associated voice cuts. BND Schöningen also performed geolocational selection of mobile
communicants. For instance, they could define any particular geographical area, like a terrorist
camp, and select any communicant that dwelled in that area for several minutes.
(S//SI//REL) BND Schöningen developers also demonstrated a software prototype that uses
Social Network Analysis algorithms against metadata to discover and assess target groups
among other things, looking for information flow. The goal (at least in part) was to monitor
these targets in the background within analyst-set parameters, with alerts to notify the analyst
when any anomalous measurement appeared, and potentially to steer front-end collection. They
claimed to have some successes on small groups on which they had good collection.
(S//SI//REL) They seemed interested in also characterizing movement patterns on
geocoordinates to find persons such as couriers (terrorist or otherwise), then using that
characterization for SIGDEV discovery purposes and predictive (trend) analysis. BND also
showed us that they are interested not only in selection based on movement patterns or
network structures, but also in hardware changes. They used a variety of algorithms (such as
fuzzy logic) to discover these patterns. The BND responded positively to NSA's request for a
copy of MIRA4 and VERAS software, and made several requests from NSA concerning target and
tool development and data.
(S//SI//REL) This first series of meetings represents a new level of engagement for NSA and its
German partner. We hope that this dialogue continues, and makes each partner more capable of
satisfying common SIGINT requirements.
(U) Notes:
* BND = Federal Intelligence Service
(U//FOUO) This article is reprinted from the Foreign Affairs Digest , September edition.
"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet
without the consent of S0121 (DL sid_comms)."
DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108