Bulk Collection of Signals Intelligence Technical Options (2015) / Chapter Skim
Currently Skimming:
3 Use Cases and Use Case Categories
3 Use Cases and Use Case Categories
Pages 40-50
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 40... ...
These are hypothetical scenarios that describe episodes in which analysts query SIGINT metadata as part of an investigation of a threat to national security, such as counterterrorism, or to stem the proliferation of weapons of mass destruction.1 (Some public sources of information on actual cases are listed in Box 3.1.) The committee asked National Security Agency (NSA)
|
From page 41... ...
• Described in Privacy and Civil Liberties Oversight Board, Report on the Telephone Records Program Conducted under Section 215 of the USA Patriot Act and on the Operations of the Foreign Intelligence Surveillance Court, http://www. pclob.gov/library/215-Report_on_the_Telephone_Records_Program.pdf, p.
|
From page 42... ...
may collect additional kinds of SIGINT metadata. 3.1 CONTACT CHAINING Communications metadata, domestic and foreign, are used to develop contact chains by starting with a target and using metadata records to indicate who has communicated directly with the target (one hop)
|
From page 43... ...
Bulk collection provides useful "history," because it does not limit collection to only the targets known at the time of collection. C A B seed target identifier of interest unknown contact FIGURE 3.1 A network of contacts among identifiers.
|
From page 44... ...
The alternate identifier technique is applied to the email metadata obtained from the ISP, in order to find a new identifier that communicates with the same identifiers as the old email address, leading to the dis covery of an alternate identifier used by the cyber-criminal. In the following use case, alternate identifiers are used in a more complex scenario that combines communications surveillance with other intelligence methods.
|
From page 45... ...
• The institute's doctors, scientists, and researchers were trained in Europe, Russia, and the United States. The institute seeks medical research equipment from legitimate suppliers around the world.
|
From page 46... ...
3.2.3 Use Case 4 In Use Case 4, following the events of Use Case 3, country X eliminated its WMD programs. The United States aided with the destruction of the weapons, but despite public declarations, the IC remains convinced that a number of facilities were never identified by the country.
|
From page 47... ...
Intelligence reports from the period before the shutdown may contain references to identifiers or other evidence that will help target or focus collection or seek contemporaneous alternate identifiers. It is possible that during the shutdown a reduced collection effort was sustained in order to monitor the termination of WMD activity; parts of that data that have not exceeded the IC's retention limits may be used in the alternate identifier search.
|
From page 48... ...
6 See U.S. Code Title 50, Chapter 36, Subchapter VI, § 1881a, Procedures for targeting certain persons outside the United States other than United States persons.
|
From page 49... ...
A timely response in Use Case 5 requires historical information; initiating targeted collection using the relevant email addresses obtained only after a suspect was identified would mean that only future information would be available, probably trickling in too slowly to be useful. Other communications channels used by the suspect in the past, such as a cell phone, might never be found using present and future SIGINT data alone.
|
From page 50... ...
If the use case is focused in some way, targeted collection may provide enough data, especially if the focus has been under targeted surveillance for some time. For investigations that have little or no prior targeting history, bulk collection may be the only source of useful information.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.