When intercept equipment detects an active channels, it must
decide whether to record what it finds here. This depends on the
'diagnosis': characterization of the form and the significance of
the signal that has been found. If the channel is a telephone
channel, for example, the likely possibilities are voice, fax, and
data. The intercept device must try to decide what it is hearing
and may then discriminate more carefully depending on the category.
The first step will usually be to listen for dial pulses or touch
tones and attempt to determine what number is calling and what
number is being called. If the call is voice, the device may attempt
to determine what language is in use, or even listen for keywords.
If the call is fax, it may try to determine whether the transmission
is text or pictures. If the call carries data, it will attempt to
determine what type of modem is in use and what codes (ASCII, Baudot,
EBCDIC) or data formats are present. When text is detected, the
equipment may go further and apply semantic processing to determine
the subject of the message in much the same way that a search engine
tries to locate a topic of interest on the World Wide Web.
One strategy followed by many pieces of intercept equipment should
be a caution to anyone using cryptography; if an intercepted message
is found to be encrypted, it is automatically recorded. This is
possible because at present only a small fraction of the world's
communications are encrypted. The first lesson to be drawn from
this is that if you encrypt something you had better do it well;
otherwise you will only succeed in drawing attention to yourself.
The second is that as the use of cryptography increases, the privacy
of everyone's traffic benefits.
Once traffic has been diagnosed as interesting, it will be recorded.
This is not as simple as it sounds. Typically a signal can be recorded
in several different formats, depending on how well it has been
understood. It is always possible to make a recording of the waveform
being received, but this may turn out to be much bulkier than the
message it encodes. For example, recording a modem signal carrying
2400 bits per second of information (about 240 characters a second),
without demodulating it, uses up to 48-kilobyte-per-second capacity
of a digital audio tape. A direct recording of the signal is thus
20 times the size of the message it contains.
Neither diagnosis, nor recording, nor any form of analysis that
may be done on an intercepted signal can be separated from 'signal
processing'--study of the signal by mathematical and computational
means. Digital signal processing (one of the fastest-growing areas
in computing) is revolutionizing communications. The availability
of $100 modems is a consequence of the availability of signal-
processing chips costing a few dollars apiece.
Demodulating modem signals (which accounts for most of the signal
processing in data interception) is far harder for an intercept
device than for the modems used by the sender and the receiver.
Present-day modems go through a period of training at the beginning
of a call during which they study the communications path and "discuss"
how best to make use of it. Even if the intercept device is listening
to this "conversation", it cannot transmit without revealing its
presence, and thus it cannot engage in the negotiations. The signal
quality available to the intercept device is therefore rarely as
good as that available to the communicating modems.
Only after traffic has been located, demodulated, and recorded do
we finally get to the most famous process in communications intelligence,
the process of breaking codes: crypanalysis. This document is not the
place for a technical discussion of cryptanalysis (check my other papers
for more on cryptanalysis); such discussions now abound in both the
technical and the historical literature of cryptography. It is, however,
the place for a discussion of the process of cryptanalysis.
Most of the public literature, both technical and historical, is
devoted to 'research cryptanalysis', the process of breaking codes
for the first time. This is naturally an indispensable component
of any production cryptanalytic organization, but does not account for
most of its budget or most of its personnel. The object of "codebreaking"
is the development of 'methods' that can be applied to intercepted
traffic to produce plaintext. In modern cryptanalysis, this is often done
entirely by computers, without human intervention.
The process of converting ciphertext to plaintext is called 'exploitation'.
It follows a process of 'diagnosis' closely related to the more general
diagnosis of traffic discussed above.
The heart of a communications intelligence organization, however, is
not cryptanalysis but 'traffic analysis'-- a study of the overall
characteristics (length, timing, addressing, frequencies, modulation etc.)
of communications. Traffic analysis by itself provides a broad picture
of the activities of communicating organizations (Wright 1987).
Moreover, it is essential to assessing the signaling plan, the traffic
patterns, and the relationships among communicating entities. Elaborate
databases of observed traffic (Hersh 1986, pp. 258-259) underlie all
comint activities.
A last operational point that bedevils communications intelligence is
'retention'--the preservation of intercepted signals for short or long
periods of time until they can be processed, cryptanalyzed, interpreted,
or used. As we have noted, storing a signal that the holder is unable
to restore to its original form typically takes far more memory than
storing an understandable signal. This is justified because, enciphered
messages can be of value even if they are first read only months or
years after they were originally sent. During World War II, Allied
cryptanalysts were sometimes weeks or even months behind on some
classes of traffic (Welchman 1982). Some signals intercepted during
the Cuban missile crisis of 1962 were not read until two years
later (Hersh 1987). In what is probably the granddaddy of ciphertext
longevity, Soviet messages sent in the 1940s were still being studied
in the 1970s (Wright 1987). Managing the storage of intercepted material
is thus a major problem in all signals intelligence activities.
After all of the technical processes characteristic of communications
intelligence, the 'product' enters in to the part of the process common
to information from all intelligence sources: interpretation, evaluation,
dissemination. One process looms larger over comint than over perhaps
any other intelligence material: 'sanitization'--removal from the
intelligence product of information that would reveal its sources.
Sanitization to greater or lesser degrees produces intelligence of
varying levels of classification.
Custom Search
The 'sine qua non' of communications intelligence is acquisition of signals. Without communications in the form of radio waves, electrical currents in wires, written materials, or copied disks and tapes, there can be no work for cryptographic or intelligence analyst. The interception of communications presents both a strategic and a tactical aspect.
Strategically, it is crucial to learn as much as one can about an opponent's communications infrastructure. The first step is to come up with the most precise possible description of the target--what the military call the 'order of battle'. If the target is a country, it may have millions of residents who in turn make millions of phone calls every days. Most of these calls are not of interest; the people who make them do not work for the
government or in critical industries and say little of intelligence value.
Describing the target is one of the many areas where 'collateral intelligence-information from sources other than covert interception of communications plays a vital role. Most of the information about a country and its government can be learned from open sources, such as phone books, newspapers, histories, and government manuals. Some, however, will come from covert sources such as spies, and some will come from communications intelligence itself.
Strategically, it is crucial to learn as much as one can about an opponent's communications infrastructure. The first step is to come up with the most precise possible description of the target--what the military call the 'order of battle'. If the target is a country, it may have millions of residents who in turn make millions of phone calls every days. Most of these calls are not of interest; the people who make them do not work for the
government or in critical industries and say little of intelligence value.
Describing the target is one of the many areas where 'collateral intelligence-information from sources other than covert interception of communications plays a vital role. Most of the information about a country and its government can be learned from open sources, such as phone books, newspapers, histories, and government manuals. Some, however, will come from covert sources such as spies, and some will come from communications intelligence itself.
Once the targets have been precisely identified, it is necessary to discover how they communication with one another. Are their communications carried by high-frequency radio, by satellite, or by microwave? How accessible the communications are and how they can be acquired is a function of the means
chosen. High-frequency radio and satellite transmissions are the most accessible.
At the time of World War II, most radio communications and thus most of what was intercepted was HF. Such signals bounce back and fourth between the ionosphere and the ground and can travel thousands of miles. This property
makes intercontinental radio communication possible; at the same time, it makes it essentially impossible to keep HF signals out of the hands of opponents. Today a large fraction of radio communication is carried by satellite. Satellite downlinks typically have 'footprints' thousands of miles across that spread over more than one country. Terrestrial microwave
communications are significantly harder to intercept. They travel between towers a few miles or tens of miles apart. Intercept facilities on the ground must generally be located within a few tens of miles of the micro-wave path and often require facilities in the target country. In the 1970s
and the 1980s, there was a war of words between US and Soviet diplomats over Soviet microwave interception activities from a residence the Soviet maintained at Glen Cove, New York (Broad 1982).
As with the organization structure, a target's communication practices can often be derived from open sources. Since national and international organizations cooperate in allocating the radio spectrum, it is easier to identify the frequencies used for military, police, or air traffic control communications by consulting regulations and standards than by direct spectrum monitoring.
chosen. High-frequency radio and satellite transmissions are the most accessible.
At the time of World War II, most radio communications and thus most of what was intercepted was HF. Such signals bounce back and fourth between the ionosphere and the ground and can travel thousands of miles. This property
makes intercontinental radio communication possible; at the same time, it makes it essentially impossible to keep HF signals out of the hands of opponents. Today a large fraction of radio communication is carried by satellite. Satellite downlinks typically have 'footprints' thousands of miles across that spread over more than one country. Terrestrial microwave
communications are significantly harder to intercept. They travel between towers a few miles or tens of miles apart. Intercept facilities on the ground must generally be located within a few tens of miles of the micro-wave path and often require facilities in the target country. In the 1970s
and the 1980s, there was a war of words between US and Soviet diplomats over Soviet microwave interception activities from a residence the Soviet maintained at Glen Cove, New York (Broad 1982).
As with the organization structure, a target's communication practices can often be derived from open sources. Since national and international organizations cooperate in allocating the radio spectrum, it is easier to identify the frequencies used for military, police, or air traffic control communications by consulting regulations and standards than by direct spectrum monitoring.
Tuesday, July 29, 2008
Communications intelligence
Communications intelligence depends for its success on tactical
as well as strategic elements. When an intercept station has been
put in the right location, operates at the right time of the day,
points its antenna in the right direction, and tunes its radio to
the right frequencies, it is rewarded with a flood of traffic too
large to record, let alone analyze. The process of examining
intercepted traffic to determine what is to be retained and what is
not may be as "simple" as detecting which channels within a trunk
are active or as complex as recognizing the topic of a conversation.
Typical selection processes include active channel detection, called
and calling number identification, speaker identification, keyword
spotting (in either text or voice), fax recognition, and semantic
information processing.
The difficulty of locating and isolating just the right messages
is an intrinsic consequence of the volume of traffic in modern
communications. Communications intercept equipment must decide
in a faction of a second whether to record a message it has
detected or to permit the message to escape. Often it must make
the decision to record communications of which it has only one
part. If, for example, the two directions of a telephone call
are carried on separate facilities, an individual intercept
point may have access to only one side of the conversation.
Although the entire call may in fact be recorded, so that both
sides of the conversation will ultimately be available to an
analyst, it wil be recorded by two devices acting independently.
Should either fail to detect that the call is of interest, and
therefore fail to record it, the utility of the other component
will be vastly reduced. The problem of identifying traffic of
interest among all possible traffic is the problem of 'search'.
as well as strategic elements. When an intercept station has been
put in the right location, operates at the right time of the day,
points its antenna in the right direction, and tunes its radio to
the right frequencies, it is rewarded with a flood of traffic too
large to record, let alone analyze. The process of examining
intercepted traffic to determine what is to be retained and what is
not may be as "simple" as detecting which channels within a trunk
are active or as complex as recognizing the topic of a conversation.
Typical selection processes include active channel detection, called
and calling number identification, speaker identification, keyword
spotting (in either text or voice), fax recognition, and semantic
information processing.
The difficulty of locating and isolating just the right messages
is an intrinsic consequence of the volume of traffic in modern
communications. Communications intercept equipment must decide
in a faction of a second whether to record a message it has
detected or to permit the message to escape. Often it must make
the decision to record communications of which it has only one
part. If, for example, the two directions of a telephone call
are carried on separate facilities, an individual intercept
point may have access to only one side of the conversation.
Although the entire call may in fact be recorded, so that both
sides of the conversation will ultimately be available to an
analyst, it wil be recorded by two devices acting independently.
Should either fail to detect that the call is of interest, and
therefore fail to record it, the utility of the other component
will be vastly reduced. The problem of identifying traffic of
interest among all possible traffic is the problem of 'search'.
DEVLOPMENT
The Soviet Union made extensive use of small ships as collection platforms.
Usually operating under very thin cover as fishing trawlers, these boats
carried large antennas and were thought to be making their biggest catch
in the electromagnetic spectrum. The United States has been less successful
with this approach. In the 1960s it commissioned two ships described as
research vessels, the 'Liberty' and the 'Pueblo', for intercept duty.
The 'Liberty' was attacked by the Israelis, for no publicly apparent
reason, while supposedly intercepting Arab communications in the Eastern
Mediterranean during the Six Day War of 1967. A year later, the 'Pueblo'
was captured by the North Koreans. It turned out to have been carrying
many top-secret documents for which it had no apparent need, and most
of these fell to its captors. As quietly as it has begun, the United
States ceased using small ships as collection platforms.
Airborne collection, by comparison, has been an important component
of US COMINT for decades. Boeing 707s, under the military designation
RC-135, are equipped with antennas and signal-processing equipment.
These aircraft can loiter off foreign coasts for hours at a time.
Flying at altitudes of 30,000 feet or higher, they can pick up radio
transmissions from well inland.
Usually operating under very thin cover as fishing trawlers, these boats
carried large antennas and were thought to be making their biggest catch
in the electromagnetic spectrum. The United States has been less successful
with this approach. In the 1960s it commissioned two ships described as
research vessels, the 'Liberty' and the 'Pueblo', for intercept duty.
The 'Liberty' was attacked by the Israelis, for no publicly apparent
reason, while supposedly intercepting Arab communications in the Eastern
Mediterranean during the Six Day War of 1967. A year later, the 'Pueblo'
was captured by the North Koreans. It turned out to have been carrying
many top-secret documents for which it had no apparent need, and most
of these fell to its captors. As quietly as it has begun, the United
States ceased using small ships as collection platforms.
Airborne collection, by comparison, has been an important component
of US COMINT for decades. Boeing 707s, under the military designation
RC-135, are equipped with antennas and signal-processing equipment.
These aircraft can loiter off foreign coasts for hours at a time.
Flying at altitudes of 30,000 feet or higher, they can pick up radio
transmissions from well inland.
Targeting
The output of the strategic of 'targeting' phase of communications
intelligence is a map of the opponent's communications, which will guide
the selection of locations, frequencies, and times of day at which monitoring
is conducted. Interception can also be conducted from many sorts
of platforms; ground stations, aircraft, ships, embassies, covert locations,
and orbiting satellites.
The United States has several major intercept facilities within its borders
and a host of others abroad. Despite attempts to keep these locations secret,
many, including Menwith Hill in Britain, Alice Springs in Australia,
ALERT in Canada, Osburg in Germany, Misawa in Japan, Yakima in U.S.
Washington, Sugar Grove in U.S., Karamürsel in Istanbul, Camp Humphreys in China, Bad
ಅಇಬ್ಲಿಂಗ್ in Austria, Kunia in Marcus Necker Ridge, and Shemaya in Aleutian Islands.
intelligence is a map of the opponent's communications, which will guide
the selection of locations, frequencies, and times of day at which monitoring
is conducted. Interception can also be conducted from many sorts
of platforms; ground stations, aircraft, ships, embassies, covert locations,
and orbiting satellites.
The United States has several major intercept facilities within its borders
and a host of others abroad. Despite attempts to keep these locations secret,
many, including Menwith Hill in Britain, Alice Springs in Australia,
ALERT in Canada, Osburg in Germany, Misawa in Japan, Yakima in U.S.
Washington, Sugar Grove in U.S., Karamürsel in Istanbul, Camp Humphreys in China, Bad
ಅಇಬ್ಲಿಂಗ್ in Austria, Kunia in Marcus Necker Ridge, and Shemaya in Aleutian Islands.
Cryptography
Cryptography is often considered, particularly by those primarily
concerned with security, to be the only serious barrier to communications
intelligence. Histories of the field have generally fostered this impression
by painting a picture of war between codemakers and codebreakers. In
practice, spying on communications is a multi-stage activity in which each
stage plays an essential role. It is entirely possible that the cryptanalysis
of a message, once the message has been identified and captured, may be less
difficult than acquiring and filtering the traffic to locate it. On balance,
the greatest problem in communications intelligence--as in most efforts
to learn things--is sorting out the information you are after from the
information you are not.
concerned with security, to be the only serious barrier to communications
intelligence. Histories of the field have generally fostered this impression
by painting a picture of war between codemakers and codebreakers. In
practice, spying on communications is a multi-stage activity in which each
stage plays an essential role. It is entirely possible that the cryptanalysis
of a message, once the message has been identified and captured, may be less
difficult than acquiring and filtering the traffic to locate it. On balance,
the greatest problem in communications intelligence--as in most efforts
to learn things--is sorting out the information you are after from the
information you are not.
Subscribe to:
Posts (Atom)
