TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL GCSB SIGINT Development Quarterly Report July 2009 Quarterly Report: 002/09 To: Deputy Director Signals Intelligence Info: Director, Target telecommunications’ networks within GCSB’s Area of Responsibility continue to change at a rapid pace with deregulation rampant throughout the South Pacific, and major infrastructure projects dramatically changing the Afghan communications landscape. Digicel Pacific, subsidiary of Caribbean-based telecommunications company Digicel, has gone from strength-to-strength in major regional markets such as Fiji, Tonga, Vanuatu and Samoa, and are currently building Nauru’s first mobile phone network. Future plans for pan-Pacific provision of high-capacity international links using underwater cable and Medium Earth Orbit satellite bubble along, potentially providing new options for Pacific Island Governments to greatly increase their populations’ connectivity to global communications. Acting OCR Team Leader http://www.gcsb TARGET TELECOMMUNICATIONS DEVELOPMENTS AND TRENDS South West Pacific AOR 1. Solomon Islands Solomon Telekom is in a race against time with a new market entrant (almost certainly Digicel) due to launch on 1 April 2010. In the remaining months of 2009 and early 2010 TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP TO USA, AUS, CAN, GBR, NZL Solomon Telekom is attempting to triple its GSM user base, double the capacity of its GSM infrastructure as well as resolve long-standing network issues and inefficiencies. As part of this push to improve and expand its network coverage, Solomon Telekom has already launched two new GSM towers in June (Kukum and Panatina) and added 1800MHZ cells to five existing sites around Honiara. OCR has worked closely with the GCSB Deployed Solutions team and DSD to provide as much information on the changes as possible, thus allowing GCSB and DSD to retain situational awareness as the Solomon Telekom network has expanded and evolved. A result of this collaboration has been the fine tuning of CAPRICA collection to take advantage of as many of the new antennas as possible as well as the levying of a requirement with DSD for dedicated receivers to be deployed at site. OCR has also worked closely with DSD over the planned PREBOIL RF survey at GBR, Honiara. To this end a briefing paper was issued on the RF environment of GBR in March and subsequently updated in June. OCR has also been in direct contact with stakeholders in DSD to provide further information as required. 2. Fiji Digicel has rapidly caught up with Vodafone in mobile phone coverage offered on the main islands of Fiji since its launch in October 2008 and plans to introduce 3G services in November this year. Vodafone has relied on its own 36 services and high interconnection fees between telecommunication networks to maintain its greater market share, but these competitive advantages will shortly disappear. Up until now, major targets in the Government and RFMF have kept a preference for Vodafone services, but they are increasingly buying into the services of the alternative network. OCR assisted Military Support unit to provide a Target Systems Analysis on the Command, Control and Communications of the Fiji Government, RFMF and Fiji Police Force by collating and reporting information held by SIGDEV, Production and Access areas at GCSB on the communications and operating practices of these organisations. This study concluded that GSM voice and SMS appeared to be the ?tactical? network of choice, in preference to UHF, or a poorly maintained and very limited RFMF computer network. 3. South Pacific Regional SPIN Cable Recent press reports have mentioned new developments to the SPIN project such as Tonga expressing interest and Norfolk Islands being signed on for a spur off an Auckland-Noumea leg of the cable. But, despite the increased press interest, it is still not clear that SPIN will develop into the full-featured cable all the proposals suggest. There are a few reasons for this: 1. The SPIN cable project is very expensive for Pacific Island Countries (PICs) with landing costs around and on-going costs usually exceeding per annum. 2. Most of the countries who have expressed an interest in SPIN plan to raise the funds to join, in full or partially, from either the EU or the Asia Development Bank. Faced with several countries asking for assistance, it is not clear whether either donor will be prepared to meet this large financial demand. 3. Disruptive technologies such as the 03b medium earth orbit satellite constellation, due for launch late 2010, are likely to offer much the same speed and bandwidth as a cable but at substantially cheaper initial and ongoing cost. 4. Astute Pacific Island telecommunications experts have noted that the SPIN project is almost entirely French-owned and run and that the contractual terms do not provide much security for the PICs that sign on. TOP TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL Samoa On 30 March 2009, cable laying ship ILE DE RE completed a month-long cable-laying operation near Samoa. The project saw Samoa and American Samoa connected to the previously defunct PacRim East cable which used to link Hawaii and New Zealand before it was superseded by the Southern Cross Cable. The work appears to have been completed successfully and provides the two Samoas with shared connectivity to the rest of the world of 1Gbps, an approximate 40-fold increase in capacity. Unfortunately, SIGINT has already lost access to Samoan bearers due to the American Samoa-Hawaii (ASH) cable. In all likelihood all but some backup carriers will be off the air by the end of the year. ELINT tracking of vessel ILE DE RE produced by the Join Electronic Warfare Support Facility – green represents the vessel in transit, red and blue are probable cable operations. Digicel In late 2008, Digicel was approached by the Government of Nauru with a proposal to assist Digicel to launch in Nauru. The proposal was that Nauru would pay for the installation of TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL GSM hardware in Nauru and the hardware would then be leased back to Digicel, who would run a GSM service in the island state. In January the deal was agreed and both sides began the required paperwork. Digicel are likely to launch in Nauru in late 2009. Meanwhile, the Government of Kiribati has been slow to reach an acceptable deal with Digicel, which has resulted in Digicel putting off plans for a Kiribati rollout. The key sticking point is whether the network should be run out of Tarawa or Fiji. To make the project economical Digicel want to run and support the network from Fiji, but the Government of Kiribati is insisting the management and support of any Digicel network be managed locally. TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL Bangladesh 6. Revised Target Template SIGDEV target templates are always very much a work in progress, with any relevant information being regularly added as a target’s telecommunications environment develops. The Bangladesh target template has recently been extensively overhauled and republished in a new format. The updated Bangladesh target template contains plenty of new information; including information on the Bureau’s CT targets and recent Bangladeshi technology developments, particular attention has been paid to updating the access and exploitation layers: outlining our existing accesses and collection, and also highlighting future key requirements. The Bangladesh target template can be accessed by following the link below. http://www.gcsb.govt.nz 7. F6 Dhaka Survey Internal GSM collection is continuing with the recent extension to the Dhaka F6 environmental survey. Site collection resources are in the main being used for the sustained collection of productive GSM emitters. However the changing RF environment has also seen the continuation of survey activity. Resources are also regularly reallocated to revisit network links of interest. The value of an internal Bangladesh collection site was recently highlighted with the handset geo-location of a target of interest. Utilising call event data derived solely from F6 collection, OCR was able to geo-locate cellular activity from a tasked Pakistani handset operating in Dhaka and also provided an image that was used in GCSB reporting. TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL Image: F6 collected geo-location metadata on tasked handset Recent analysis of some classified collateral has developed an understanding of the telecommunications systems of the Bangladesh Rapid Action Battalion (RAB). This information will materially add to the SIGINT communities’ knowledge of Bangladeshi telecommunications networks. Analysis of this collateral highlighted comprehensive geographical information, telecommunication transmission paths and signalling information. Image: RAB Communications network With this collateral, F6 was able to place on collection dedicated RAB private voice communication to and from RAB headquarters to various RAB units. Also seen in collection TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL was a limited amount of DNI, including a test of the video teleconferencing system from RAB HQ to RAB-3 HQ. Image: RAB video teleconferencing intercept RAB has been an active target group for the GCSB in the past and this information could well be of high interest for future operations if the domestic security situation in Bangladesh were to deteriorate. METADATA ANALYSIS TOOLS AND TECHNIQUES 8. XKEYSCORE GCSB received a visit from NSA XKEYSCORE trainers and in March to update our GUI, assist IRONSAND with virtualisation of their XKEYSCORE suite, and train users in anticipation of full-take collection and 2nd party sharing. IRONSAND Engineering have been working to overcome problems in storage capacity, Virtual LAN licensing, competing priorities, and low manning but plan to have full-take collection on Mission carriers running by October. DSD are very keen to share XKEYSCORE data and have already modified their GUI to meet GCSB Compliance expectations. It is hoped that sharing with DSD and GCHQ will be achieved soon after we can offer full-take collection data. GCSB auditors are now trained to audit all queries made, and an audit log is kept to track what proportion of queries have been marked as reviewed to satisfy the Inspector-General. NETWORK ANALYSIS TEAM 9. OCR Integree in DSD’s NAC To begin the process of developing GCSB’s own network analysis capability, , who will be part of the GCSB SIGINT Development network analysis team when it stands up in October 2009, was posted to DSD’s NAC for four months (February to May). was placed initially into Access Analysis, gaining knowledge of DSD’s systems and collection capabilities. One month into his deployment, he switched to the Network Infrastructure Analysis section, where he was given specific NAC tasks regarding Indonesian cellular telecommunications provider Telkomsel. Some of the tasks included investigating Call Data Records being sent over FTP, identifying X.25 over TCP communications between TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL Telkomsel GSM nodes, and researching Telkomsel iGATE 4000 STM-1 carriers. benefited from very useful training and information including a one-day SS7 presentation and a three-day VPN course. 10. SIGDEV integration into CNE On returning to GCSB, has been integrated into the GCSB CNE unit to gain a deeper understanding of current CNE activities and processes. It is envisaged areas of future NAC support towards CNE operations can be identified, along with the leveraging of CNE’s unique internal network accesses to allow for detailed network analysis of target countries. Currently has been engaging in operations against Fijian networks of GOVNET and RFMF. THE OCR TEAM 11. New team member – OCR welcomes the addition of to the team, returning to GCSB after completing 3 years at DSD. He is currently with the NAC team at DSD gaining an introduction to SIGINT Development work, and will join the team at GCSB in October as a Fiji SIGDEV analyst. started working in DSD’s customer services team ensuring all SIGINT reporting was accurately delivered to Australian Intelligence customers via the report distribution tool CHIMERA. He also managed a team to start the update of reporting policy before being appointed as the DSD counter proliferation liaison officer to ASIS. was housed at ASIS HQ sitting with the CP team, assisting with the SIGINT development of targets relating to ASIS counter proliferation operations. In this role he advised ASIS of targeting opportunities, conducted initial signals/target development and wrote SIGINT reports on CP targets of ASIS interest while educating ASIS staff on the intricacies of SIGINT capabilities. 12. New team Vision, Mission and Values OCR recently constructed the following Vision, Mission and Values to use as our guidance in providing SIGINT Development for GCSB: OCR Vision: Complete awareness of evolving target telecommunications for the protection of GCSB's mission OCR's Mission: is to future-proof GCSB against a changing telecommunications and SIGINT environment through: • • • Research and analysis of the evolving target telecommunications environment The provision of guidance and direction to the SIGINT Access community The introduction of new analytical tools and techniques. OCR Values: Professionalism - Integrity, Excellence and Lawfulness Collaboration - Teamwork, Commitment and Leadership Responsiveness - Adaptability, Dedication and Customer Focus Initiative - Innovation, Learning and Curiosity TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL OCR Team Leader/Supervising Analyst (On military leave until December 2009) OCR1 Bangladesh CT SIGDEV OCR2 Solomon Islands SIGDEV OCR3 Maternity Leave OCR5 , Geospatial Metadata Analysis tradecraft development OCR6 Acting team leader, Fiji SIGDEV, SIGDEV Projects OCR7 OCR10 Fiji SIGDEV OCN1 NAC Acting OCR Team Leader TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL