When intercept equipment detects an active channels, it must
decide whether to record what it finds here. This depends on the
'diagnosis': characterization of the form and the significance of
the signal that has been found. If the channel is a telephone
channel, for example, the likely possibilities are voice, fax, and
data. The intercept device must try to decide what it is hearing
and may then discriminate more carefully depending on the category.
The first step will usually be to listen for dial pulses or touch
tones and attempt to determine what number is calling and what
number is being called. If the call is voice, the device may attempt
to determine what language is in use, or even listen for keywords.
If the call is fax, it may try to determine whether the transmission
is text or pictures. If the call carries data, it will attempt to
determine what type of modem is in use and what codes (ASCII, Baudot,
EBCDIC) or data formats are present. When text is detected, the
equipment may go further and apply semantic processing to determine
the subject of the message in much the same way that a search engine
tries to locate a topic of interest on the World Wide Web.
One strategy followed by many pieces of intercept equipment should
be a caution to anyone using cryptography; if an intercepted message
is found to be encrypted, it is automatically recorded. This is
possible because at present only a small fraction of the world's
communications are encrypted. The first lesson to be drawn from
this is that if you encrypt something you had better do it well;
otherwise you will only succeed in drawing attention to yourself.
The second is that as the use of cryptography increases, the privacy
of everyone's traffic benefits.
Once traffic has been diagnosed as interesting, it will be recorded.
This is not as simple as it sounds. Typically a signal can be recorded
in several different formats, depending on how well it has been
understood. It is always possible to make a recording of the waveform
being received, but this may turn out to be much bulkier than the
message it encodes. For example, recording a modem signal carrying
2400 bits per second of information (about 240 characters a second),
without demodulating it, uses up to 48-kilobyte-per-second capacity
of a digital audio tape. A direct recording of the signal is thus
20 times the size of the message it contains.
Neither diagnosis, nor recording, nor any form of analysis that
may be done on an intercepted signal can be separated from 'signal
processing'--study of the signal by mathematical and computational
means. Digital signal processing (one of the fastest-growing areas
in computing) is revolutionizing communications. The availability
of $100 modems is a consequence of the availability of signal-
processing chips costing a few dollars apiece.
Demodulating modem signals (which accounts for most of the signal
processing in data interception) is far harder for an intercept
device than for the modems used by the sender and the receiver.
Present-day modems go through a period of training at the beginning
of a call during which they study the communications path and "discuss"
how best to make use of it. Even if the intercept device is listening
to this "conversation", it cannot transmit without revealing its
presence, and thus it cannot engage in the negotiations. The signal
quality available to the intercept device is therefore rarely as
good as that available to the communicating modems.
Only after traffic has been located, demodulated, and recorded do
we finally get to the most famous process in communications intelligence,
the process of breaking codes: crypanalysis. This document is not the
place for a technical discussion of cryptanalysis (check my other papers
for more on cryptanalysis); such discussions now abound in both the
technical and the historical literature of cryptography. It is, however,
the place for a discussion of the process of cryptanalysis.
Most of the public literature, both technical and historical, is
devoted to 'research cryptanalysis', the process of breaking codes
for the first time. This is naturally an indispensable component
of any production cryptanalytic organization, but does not account for
most of its budget or most of its personnel. The object of "codebreaking"
is the development of 'methods' that can be applied to intercepted
traffic to produce plaintext. In modern cryptanalysis, this is often done
entirely by computers, without human intervention.
The process of converting ciphertext to plaintext is called 'exploitation'.
It follows a process of 'diagnosis' closely related to the more general
diagnosis of traffic discussed above.
The heart of a communications intelligence organization, however, is
not cryptanalysis but 'traffic analysis'-- a study of the overall
characteristics (length, timing, addressing, frequencies, modulation etc.)
of communications. Traffic analysis by itself provides a broad picture
of the activities of communicating organizations (Wright 1987).
Moreover, it is essential to assessing the signaling plan, the traffic
patterns, and the relationships among communicating entities. Elaborate
databases of observed traffic (Hersh 1986, pp. 258-259) underlie all
comint activities.
A last operational point that bedevils communications intelligence is
'retention'--the preservation of intercepted signals for short or long
periods of time until they can be processed, cryptanalyzed, interpreted,
or used. As we have noted, storing a signal that the holder is unable
to restore to its original form typically takes far more memory than
storing an understandable signal. This is justified because, enciphered
messages can be of value even if they are first read only months or
years after they were originally sent. During World War II, Allied
cryptanalysts were sometimes weeks or even months behind on some
classes of traffic (Welchman 1982). Some signals intercepted during
the Cuban missile crisis of 1962 were not read until two years
later (Hersh 1987). In what is probably the granddaddy of ciphertext
longevity, Soviet messages sent in the 1940s were still being studied
in the 1970s (Wright 1987). Managing the storage of intercepted material
is thus a major problem in all signals intelligence activities.
After all of the technical processes characteristic of communications
intelligence, the 'product' enters in to the part of the process common
to information from all intelligence sources: interpretation, evaluation,
dissemination. One process looms larger over comint than over perhaps
any other intelligence material: 'sanitization'--removal from the
intelligence product of information that would reveal its sources.
Sanitization to greater or lesser degrees produces intelligence of
varying levels of classification.
Custom Search
The 'sine qua non' of communications intelligence is acquisition of signals. Without communications in the form of radio waves, electrical currents in wires, written materials, or copied disks and tapes, there can be no work for cryptographic or intelligence analyst. The interception of communications presents both a strategic and a tactical aspect.
Strategically, it is crucial to learn as much as one can about an opponent's communications infrastructure. The first step is to come up with the most precise possible description of the target--what the military call the 'order of battle'. If the target is a country, it may have millions of residents who in turn make millions of phone calls every days. Most of these calls are not of interest; the people who make them do not work for the
government or in critical industries and say little of intelligence value.
Describing the target is one of the many areas where 'collateral intelligence-information from sources other than covert interception of communications plays a vital role. Most of the information about a country and its government can be learned from open sources, such as phone books, newspapers, histories, and government manuals. Some, however, will come from covert sources such as spies, and some will come from communications intelligence itself.
Strategically, it is crucial to learn as much as one can about an opponent's communications infrastructure. The first step is to come up with the most precise possible description of the target--what the military call the 'order of battle'. If the target is a country, it may have millions of residents who in turn make millions of phone calls every days. Most of these calls are not of interest; the people who make them do not work for the
government or in critical industries and say little of intelligence value.
Describing the target is one of the many areas where 'collateral intelligence-information from sources other than covert interception of communications plays a vital role. Most of the information about a country and its government can be learned from open sources, such as phone books, newspapers, histories, and government manuals. Some, however, will come from covert sources such as spies, and some will come from communications intelligence itself.
Once the targets have been precisely identified, it is necessary to discover how they communication with one another. Are their communications carried by high-frequency radio, by satellite, or by microwave? How accessible the communications are and how they can be acquired is a function of the means
chosen. High-frequency radio and satellite transmissions are the most accessible.
At the time of World War II, most radio communications and thus most of what was intercepted was HF. Such signals bounce back and fourth between the ionosphere and the ground and can travel thousands of miles. This property
makes intercontinental radio communication possible; at the same time, it makes it essentially impossible to keep HF signals out of the hands of opponents. Today a large fraction of radio communication is carried by satellite. Satellite downlinks typically have 'footprints' thousands of miles across that spread over more than one country. Terrestrial microwave
communications are significantly harder to intercept. They travel between towers a few miles or tens of miles apart. Intercept facilities on the ground must generally be located within a few tens of miles of the micro-wave path and often require facilities in the target country. In the 1970s
and the 1980s, there was a war of words between US and Soviet diplomats over Soviet microwave interception activities from a residence the Soviet maintained at Glen Cove, New York (Broad 1982).
As with the organization structure, a target's communication practices can often be derived from open sources. Since national and international organizations cooperate in allocating the radio spectrum, it is easier to identify the frequencies used for military, police, or air traffic control communications by consulting regulations and standards than by direct spectrum monitoring.
chosen. High-frequency radio and satellite transmissions are the most accessible.
At the time of World War II, most radio communications and thus most of what was intercepted was HF. Such signals bounce back and fourth between the ionosphere and the ground and can travel thousands of miles. This property
makes intercontinental radio communication possible; at the same time, it makes it essentially impossible to keep HF signals out of the hands of opponents. Today a large fraction of radio communication is carried by satellite. Satellite downlinks typically have 'footprints' thousands of miles across that spread over more than one country. Terrestrial microwave
communications are significantly harder to intercept. They travel between towers a few miles or tens of miles apart. Intercept facilities on the ground must generally be located within a few tens of miles of the micro-wave path and often require facilities in the target country. In the 1970s
and the 1980s, there was a war of words between US and Soviet diplomats over Soviet microwave interception activities from a residence the Soviet maintained at Glen Cove, New York (Broad 1982).
As with the organization structure, a target's communication practices can often be derived from open sources. Since national and international organizations cooperate in allocating the radio spectrum, it is easier to identify the frequencies used for military, police, or air traffic control communications by consulting regulations and standards than by direct spectrum monitoring.
