880 Corporate Portfolio Overview Derived From: 1-52 Dated: 20070108 Agenda What is Corporate Portfolio? What data can we collect? Where do go for more help? What is Corporate Portfolio? What is 550 Corporate access collection? F) Access and collection of telecommunications on cable, switch network, and/or routers made possible by the partnerships involving NSA and commercial telecommunications companies. International Cables Brief discussion of global telecommunications infrastructure. How access points in the US can collect on communications from "bad guy" countries (least cost routing, etc.) D?amdf'? Access to massive amounts of data Controlled by variety of legal authorities Most accesses are controlled by partner Tasking delays F) Key Points: 1) 550 provides more than 80% of collection for NSA. SSO's Corporate Portfolio represents a large portion ofthis collection. 2) Because ofthe partners and access points, the Corporate Portfolio is governed by several different legal authorities (Transit, FAA, FISA, E012333), some of which are extremely time-intensive. 3) Because of partner relations and legal authorities, 550 Corporate sites are often controlled by the partner, who ?lters the communications before sending to NSA. 4) Because we go through partners and do not typically have direct access to the systems, it can take some time for tasking to be updated at site (anywhere from weekly for some BLARNEY accesses to a few hours for STORMBREW). Explanation of how we can collect on a call between (hypothetically) Iran and Brazil using Transit Authority. Discuss how foreign-to-foreign ness must be proved (particularly dif?cult for - Communications must be con?rmed foreign-to-foreign. Filters at front-ends to ensure only authorized traf?c is fon/varded to the DNR and DNI selection engines. - Occasionally the TOPI discovers that one end of the intercept is actually in the US. We refer to this as a ?domestic incident". - must inform SSO Corp Team when this occurs via email alias 880 ?les a formal report to for each occurrence of a domestic incident. Transit Authority Only allows those 550 programs operating under this authority to collect communications which are con?rmed to be foreign-to-foreign. 550 programs operating under this authority have ?lters at their collection front-ends to ensure only authorized traf?c foreign-to-foreign) is forwarded to the DNR and DNI selection engines (driven by tasking). Despite best efforts, occasionally there may be an ?authorized? DNR or DNI hit forwarded to the TOPI, which based on TOPI analysis eventually determines that one?end of the intercept is actually in the US. We refer to this as a ?domestic incident?. This usually occurs in the DNR world, where one-end ofthe intercept will make a reference to being in the US. 0 (C) must inform SSO Corp Team when this occurs via email alias ?550 ?les a formal report to for each occurrence of a domestic incident. TOP Corporate Portfolio (C) FAIRVIEW OAKSTAR (C) US-3206 BLARNEY (C) us-3217 SHIFTINGSHADOW (C) US-984 FISA collection 5 (C) us-3230 ORANGECRUSH (C) FAA collection (C) us-3247 (C) us?3251 ORANGEBLOSSOM STORMBREW (C) us-3273 SILVERZEPHYR (C) US-983 STORMBREW (C) us-3277 BLUEZEPHYR (C) us-314o MADCAPOCELOT (C) us-3354 COBALTFALCON SSO Corporate/TAO Shaping (C) US-310581 DARKTHUNDER (C) US-310581 STEELFLAUTA TOP Systems under a corporate program can be completely unrelated to one another everything in OAKSTAR is different). is expected to become operational in spring 2012. Blue-colored systems operate under Transit Authority. US-3150 is an umbrella SSO SIGAD for the Extended Enterprise. 9 9 RV CNN US-990 (PDDG-UY) key corporate partner with access to international cables, routers, and switches. Key Targets: Global (C) DNR: Directory ONMR (C) DNI: Port 25 only under Transit Authority All port traffic under FAA Authority Cyber access Key points: 1) Explanation of Port 25 and 3-Swing Algorithm. 2) 60 million foreign-to-foreign emails in the FAIRVIEW environment ever day; 5 million after 3-Swing Algorithm. 3) FAA collection under SIGADs US-984XR and US-984X2. FISA collection under SIGAD US-984T (COWBOY). 4) Tasking through Cadence, and OCTAVE. 5) Data in PINWALE (YANKEE), XKEYSCORE, MAINWAY, TOYGRIPPE, BLACKPEARL, TWISTEDPATH, NUCLEON, and DISHFIRE. Discussion of the breadth of the FAIRVIEW program. 10 D?amq?? US-983 (PDDG-FL) key corporate partner with access to international cables, routers, and switches Key Targets: Global (C) DNR Collection: (Directory ONMR) (C) DNI Collection: Limited to FAA and FISA Cyber hit counts on FAA DNI Access Key PointsAccess to mid-point collection (cable, switch, and router) at seven sites and approximately 130 circuits. DNR collection falls under Transit and FAA Authorities. DNI is limited to FAA and FISA cannot collect DNI under Transit Authority like FAIRVIEW. Difference between WHITESQUALL (international gateway switch access; thousands of trunk groups connected worldwide), MISTRALWIND (calling card/ private network access), SE RRATEDEDGE (con?ict number access) STORMBREW collects under the FAA Authority using the SIGADs for DNI and US-984X1. STORMBREW handles limited FISA-related tasking using the SIGAD US-984P (PERFECTSTORM) and PDDG AX. STORMBREW is tasked in UTT and OCTAVE. Data is retrieved in PINWALE, NUCLEON, and DISHFIRE. 11 US-983 F) STORMBREW collection comes from eight sites connected by a D53 ring. 12 1) 3) 4) I ?0 . Wurst)? US-3140 (PDDG: TM) Target DNI operating under E.O. 12333 Authority. Key Targets: (S) DNI and metadata through XKEYSCORE, PINWALE, and MARINA. New access under the STORMBREW umbrella. MADCAPOCELOT has access to multiple 106 internet backbone circuits, including several that service the Three-step tasking process: 1) an unclassi?ed IP address and signature promotion list will be reviewed and approved by 52/53 GCM equity process, 2) strong selection will be accomplished by UTT site group 3) ?ltering and targeting logic managed by TMM will be levied via a new CADENCE dictionary MADCAPOCELOT and CADENCE FIST MDCP. Collection can be accessed in PINWALE (TEXT partition) and metadata is accessed in MARINA. 13 9 17 . US-984 (PDDG: AX) provides collection against DNR and DNI FISA Court Order authorized communications. Key Targets: Diplomatic establishment, counterterrorism, Foreign Government, Economic ?go for more information. 1) Operates under the authorities of NSA FISA, FBI FISA, and FAA. 2) BLARNEY is the leading source of FISA collection, producing over 11,000 reports and is consistently a top contributor to the President's Daily Brief. The program contributes to over 60% of product reporting to the Counterterrorism product line and over 80% of the overall FAA reporting. 3) In order to task BLARNEY, there must a valid Court Order for the target. Court order process: 1) Court Order is signed or renewed. 2) Selectors appear in the Court Order. 3) Target Of?ce decides what numbers to task. The Target Of?ce submits a task request (via email to_ to the BLARNEY Collection Managers with the selectors that should be tasked. 4) When a Court Order is up for renewal and a currently tasked number is not going to be in the renewal, the TOPI is required to send a detask request for that selector. 4) 11 different falling under BLARNEY, FAIRVIEW, and STORMBREW partners. 5) PRISM falls under BLARNEY, but is just one access of many. 6) The Court Order process is extremely long and time-intensive for everyone involved, but the collection payout is fantastic. 14 514mg.? (PDDG: various) multiple programs/partners collecting under FAA authority. Must be justified under FAA Certification and selector must be foreign. (C) DNI and DNR collection ?go for more information. 1) FAA Collection falls under BLARNEY, FAIRVIEW, STORM BREW, or SILVERZEPHYR (OAKSTAR), but due to the stringent legal requirements of FAA, the programs use different (under the format 15 if .1 US-984X FAA for Agency - 12 months Top Ten Collection (Oct 2010 - Sep 2011) based on Serialized Product Report 75000 20000 15605 - =S$OCorp Program $50 non?Corp Programs US984X L5-990 (FAA) (mausw Transit only) Look at FAA. Just look at it. [15-3237 05?3167 US331CBG [5-3180 SGAD 16