MHS System Locates High Interest Internet Cafes, Some Used by Al-Qa’ida in Iraq

DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (TS//SI//REL) MHS System Locates High Interest Internet Cafes, Some Used by Al-Qa'ida in Iraq FROM: and CW2 Menwith Hill Station (F77) Run Date: 12/14/2006 , USA (TS//SI//REL) Using a combination of national assets and techniques developed under the GHOSTHUNTER project, Menwith Hill Station has achieved success in locating Internet cafes commonly used by High Value Targets (HVTs) in Iraq. Most notably, MHS has managed to locate terminals used by associates of Abu Ayyub Al-Misri, the successor to Al-Zarqawi as the number one Al-Qa'ida leader in Iraq. (TS//SI//REL) The GHOSTHUNTER system was designed to provide location information about VSATs 1 to support SIGINT-enabled surveillance and other operations. Terminals from the current top three VSAT technologies in the Middle East -- DirecWay, Linkstar, and iDirect -- have all been successfully located as part of the GHOSTHUNTER initiative 2 . (TS//SI//REL) Terminals Associated with Al-Misri Group Are Traced to Ramadi (TS//SI//REL) In early August 2006, MHS developed a quick reaction capability to derive locations for specific iDirect VSATs of interest to the Network Analysis Center (NAC) at NSA-W. The target terminals serviced three Internet cafés in Iraq and were directly linked to Al-Misri associates. Within five days, Menwith Hill confirmed the three terminals were located in Ramadi. (U) Precise Locations Are Determined (TS//SI//REL) In early November 2006, the New Mission Development Center (NMDC) at MHS received multiple HVT tips to locate iDirect VSAT terminals, including some associated with alMisri's immediate couriers. Developmental Analysts and engineers at MHS, , and Field Station Denver successfully resolved the location of the Internet cafés of interest. Imagery support further enhanced this information by providing high-resolution images that enabled tactical assets to identify the exact location of the iDirect VSAT terminal. This identified terminal provides service to the high priority wireless network being targeted by the NAC. (S//REL) Other GHOSTHUNTER Successes (TS//SI//REL) To date, the GHOSTHUNTER capabilities at MHS have supported more than a dozen HVT searches targeting both Linkstar and iDirect VSAT communications. Additionally, GHOSTHUNTER operates daily in survey mode mapping out networks of interest by providing location data of VSAT terminals identified in the traffic. Approximately 150 VSAT terminals on networks of interest have been located to Baghdad, Ramadi, and neighboring cities during the past two months. Location details and associated knowledge derived through GHOSTHUNTER processing is being sent to and maintained in MASTERSHAKE 3 , the NAC's DNI 4 location database. (U) Looking Ahead (TS//SI//REL) GHOSTHUNTER, the only capability of its kind, has captured the interest of many across the Intelligence Community. Menwith Hill Station, in concert with multiple organizations, continues to develop this capability for integration into future baseline system deployments. Achievements obtained through this effort reflect the benefits of cross-access integration, teamwork and inter-agency collaboration to enable tactical operations. (U) Notes: 1 (U) VSAT = Very Small Aperture Terminal

2 (S//SI//REL) Details about commonly used VSAT technologies were provided by the Network Analysis Center. 3 (TS//SI//REL) For background on MASTERSHAKE, see the article MASTERSHAKE: Locating Terrorists at Internet Cafés 4 (U) DNI = Digital Network Intelligence "(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet without the consent of S0121 (DL sid_comms)." DYNAMIC PAGE -- HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL DERIVED FROM: NSA/CSSM 1-52, DATED 08 JAN 2007 DECLASSIFY ON: 20320108