DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
(TS//SI//REL) New Iranian NERA Satlink Identified
FROM:
Chief, Analysis and Target Development Branch, SIGDEV Division, RAINFALL
Run Date: 11/28/2006
(TS//SI//REL) Earlier this year, RAINFALL was the source of the
SERIES:
first noted intercept of an Iranian NERA Satlink network. This
(U) SIGDEV Collaboration
discovery is significant because it will aid in the development and
acquisition of tools to help us further exploit this and other TDMA*
technologies, which are proliferating in areas such as Iraq, Iran,
1. F6, NSA Texas, and
and Afghanistan. Users of these technologies include terrorists and
Yakima Research
hostile governments.
Station Collaborate
on Venezuela Survey
(TS//SI//REL) The Discovery and Analysis of the Iranian
2. New Iranian NERA
Signal
Satlink Identified
3. Giving Answers,
(TS//SI//REL) During general search this April, a RAINFALL
Keeping Secrets
operator detected a TDMA very small aperture terminal (VSAT)
4. A Success Story, In
system active in Iran. Off-line analysis of the TDMA burst
Which the MSOC
recovered bits, frame, and a Unique Word (UW -- used for
Takes On a Pakistani
synchronization), leading to the identification of the system as
GSM Network
NERA Satlink. NERA Satlink, one of the newer TDMA VSAT systems
that provide low cost broadband Internet access to worldwide
users, is similar to LINKSTAR and DIRECWAY Internet café
systems that are being used by insurgents and terrorists.
(U//FOUO) NERA outdoor unit
(TS//SI//REL) Analysis of the new signal by the Network Analysis
Center (NAC/SSG2) and the Digital Communications Technologies
Branch in CES (S31211) has revealed valuable information.
Complex analysis of the underlying data showed that the Iranian
NERA Satlink network was using the MPEG-2/Internet Protocol (IP)
instead of the asynchronous transfer mode (ATM), which was
previously noted on signals of this type. In addition, the network
was identified as digital video broadcasting, return channel via
satellite (DVB-RCS) compliant. DVB-RCS is the European
Telecommunications Standards Institute standard for Internet
traffic over video. These two discoveries will aid in the development
of a processing solution.
(U) Some Background
(TS//SI//REL) In August 2005, RAINFALL had previously detected a
NERA Satlink that was probably emanating from Jakarta,
Indonesia. The Indonesian collect was for some time the only
intercept available for target analysts to analyze and exploit.
According to the NAC, an Iranian company had purchased 170
NERA Satlink modems but they remained undetected until
RAINFALL's discovery.
(U) Who Uses the Signal?
(TS//SI//REL) One user may possibly be the Islamic Republic of
Iran Broadcasting (IRIB), as geolocations (which are believed to be
accurate) placed the signals in the area of the IRIB's Southern
SATCOM Headquarters building in Tehran. This may also indicate
that the Iranian government uses NERA VSATs.
(U//FOUO) NERA block diagram
(U) Collaboration
(S//REL) Collaboration and analysis efforts between personnel at
RAINFALL, NAC, and S31211 are ongoing. In addition, the following
personnel played a key role in this discovery:
, RAINFALL Site Systems Engineering Lab
and
(former) RAINFALL Search and
New Development position operators
S31211
Network Analysis Center (SSG2)
RAINFALL is also working with the GCHQ FORNSAT site SOUNDER,
trying to match RAINFALL tips with the DVBS hub information that
they are collecting/processing.
(U) Conclusion
(TS//SI//REL) In summary, we believe this is a highly valuable
mission and intend to continue to pursue further development.
Given that the users of this technology include our most soughtafter targets, the potential payoff is great.
*(U) Note: TDMA = Time Division Multiple Access
"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet
without the consent of S0121 (DL sid_comms)."
DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS
TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL
DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108