A unique note from the BND about European SIGINT alliances

(Updated: July 31, 2020)

Last April, an academic article by the Dutch professor for computer security Bart Jacobs revealed the existence of Maximator, a hitherto unknown SIGINT-sharing alliance of five European countries.

On July 1, the German newspaper Frankfurter Rundschau (FR) also published an article about the Maximator alliance, which includes a handwritten note by an employee of the German foreign intelligence service BND.

This note appeared to be rather spectacular, as it provides some details about two different European SIGINT alliances. Such international cooperation is among the most sensitive and secretive aspects of the intelligence business.

- Transcript and translation - Discussion of the content -

- The scan of the note -

The handwritten note about SIGINT cooperation between BND and DGSE
(click to enlarge)

Transcript and translation

According to the Frankfurter Rundschau, the note was written in 1986 by a manager from the BND who was responsible for the Maximator alliance.

Unfortunately, his handwriting is very difficult to read, but with some puzzling and guessing it was possible to clarify most of the text (please leave a comment if you think you can correct something or fill in some of the remaining gaps).

Below is the original text of the note in German on the left side (with the abbreviations written in full) and a translation in English on the right side (updated with some good suggestions):


Title:

Tech[nische] Zusammenarbeit BND/Wicke

Technical cooperation BND/France

First column:

Mil[itärisch] --------------- - .. 50 (Richtfunk VHF/UHF) - RohMat[erial] aust[ausch] - 5er Club (Wicke, Begon[ie] Kresse-H, Pfingst- rose) - Bilaterale Bespr[echungen] 2x jährlich zusammen mit UW

Military ----------- - .. 50 (Microwave VHF/UHF) - Raw data exchange - Club of Five (France, Denmark Netherlands-Army, Bel- gium) - Bilateral talks twice a year together with UW

Second column:

Pol[itisch] -------------- - Col - RohMat[erial] aust[ausch] - Maximator (Wicke (seit 1 jahr), Mohn Begon[ie], Kresse-Mar - Aust[ausch] Klar[text] mat[erial] wird abgeklärt (Wortbanken) einziger PD - Bilaterale Bespr[echungen]

Political ------------ - ... - Raw data exchange - Maximator (France (since 1 year), Sweden Denmark, Netherlands-Navy - Exchange of plain text material will be clarified (Dictionaries) only PD - Bilateral Talks

Third column:

Elint ------------ Austausch Radar-Sign[ale] Bilateral (Wicke schwach) CREM

Elint -------- Exchange Radar signals Bilateral (France weak) CREM

Fourth column:

Krypto ------------ Col.

Crypto ----------- ...

Transcription of the handwritten note about cooperation between BND and DGSE
(click to enlarge)

Discussion of the content

The title of the note is hardly legible, but the Frankfurter Rundschau says it reads "Technische Zusammenarbeit" or technical cooperation between the German Bundesnachrichtendienst (BND) and the French foreign intelligence service Direction Générale de la Sécurité Extérieure (DGSE).

Then there are four columns for the subsets of Signals Intelligence (SIGINT) involved in this cooperation: first Communications Intelligence (COMINT) related to military issues as well as to political issues, then Electronic Intelligence (ELINT), and finally Crypto or cryptography which is needed to decipher communications that are encrypted.


Crypto

Regarding the cryptologic cooperation between BND and DGSE, the note only has the mysterious abbreviation "Col.", which reminds of terms like "collection" and "collaboration" but these doesn't seem to fit, given that the rest of the text is in German, which has very few words that start with "col".

According to the article by professor Jacobs, the members of the Maximator alliance (see below) exchanged algorithms used in various (deliberately weakened) encryption devices used by target countries. It was then up to the individual partners to find out how to exploit these weaknesses.


Electronic Intelligence

The note also doesn't provide much information about the cooperation between France and Germany in the field of Electronic Intelligence (ELINT), which is the collection and analysis of signals that do not contain human communications.

ELINT aims at the electronic parts of an enemies' defense network, like radars, surface-to-air missile systems and aircraft systems, so ships, aircraft and missiles can be detected by their radar and other electromagnetic radiation.

According to the note, BND and DGSE exchanged data about radar transmissions on a bilateral basis, but it also seems to say that the French capabilities were rather weak.

There are also the letters CREM or CIREM, which is probably the abbreviation of Centre d’Information sur les Rayonnements ÉlectroMagnétiques, or Center for Information on Electromagnetic Radiations, which is the old name for the French center for military SIGINT CFEEE.


Political Communications Intelligence / Maximator

The second column of the note is about Communications Intelligence about political issues. Here we see the mysterious abbreviation "Col." again, which is also in the Crypto column.

On this topic, BND and DGSE exchanged raw communication intercepts which were also shared multilaterally within the Maximator alliance. According to Jacobs, the focus of this group was on intercepting and decrypting diplomatic communications, both from HF radio transmissions and SHF satellite links.

> More information: Maximator and other European SIGINT alliances

The Maximator alliance has its own cover names for each of its partners, but in the BND note the members are listed by the regular cover names that the BND used for its foreign partners, which are names of flowers and plants:

Wicke - France (with the additional remark: "since 1 year")
Mohn - Sweden
Begonie - Denmark
Kresse-Mar - Netherlands, naval intelligence

> See also: BND Codewords and Abbreviations

From professor Jacobs' article we now that France requested to join the Maximator alliance in 1983. This was supported especially by Germany and as a result France was invited in 1984 and joined in 1985. So when the BND note says "since 1 year", it means the (undated) document was written somewhere in 1986.

For the Netherlands it was the Technisch Informatieverwerkings Centrum (TIVC) that participated in the Maximator group. The TIVC was the cryptanalysis centre of the Dutch Navy, which is indicated by the abbreviation "Mar" for Marine behind the cover name for the Netherlands.

The participants in the Maximator alliance and their internal cover names
(click to enlarge)

After listing the members of the Maximator alliance, the BND note probably says that the exchange of plain text intercepts will be clarified. An interesting term is Wortbanken, which seems similar* to the "dictionaries" containing the selectors used to filter content of interest out of the intercepted data streams, a method well known from the Five Eyes agencies. There also seem to be some "PD" which may stand for "Points of Discussion".

For the coordination of the exchange of political intelligence there were bilateral talks, but it's not clear whether that's just between BND and DGSE or that it also applies to the Maximator alliance. The latter would contradict Jacobs' article, which says that signals interception issues were discussed in multilateral meetings attended by all members.


Military Communications Intelligence / Club of Five

Finally, the first column of the note is about Communications Intelligence related to military issues. It starts with some letters or numbers (maybe 50?), followed by the remark that the cooperation is apparently about intercepting microwave (Richtfunk) and possibly other VHF and UHF radio transmissions.

Since the 1950s, microwave radio relay links were widely used for long-range point-to-point communications, both for civilian and military purposes. During the Cold War, the United States had the unique capability to intercept Soviet microwave traffic using satellites such as the Rhyolite/Aquacade, which could pick up the beam of a microwave link that passes the receiving antenna and radiates towards the horizon and then into space:

Interception of microwave signals by spy satellites
(image: Decora/Wikimedia Commons)

Germany and France, nor other European countries had such satellites to intercept microwave signals, so collaboration and sharing their own intercepts could have strengtened their own position compared to the capabilities of the Americans.

Just like political intelligence was shared within the Maximator group, this military intelligence was also exchanged multilaterally, but in a different group which was called "5er Club" or "Club of Five". The note also lists the members of this group, again using the regular BND cover names:

Wicke - France
Begonie - Denmark
Kresse-H - Netherlands, army intelligence
Pfingstrose - Belgium

Note that the membership of the Club of Five is slightly different from the Maximator alliance: it has Belgium instead of Sweden as a member. For the Netherlands, it was the 898th signal battalion of the Dutch army that participated in the Club of Five, probably supported by the TIVC for the cryptanalysis.

Through several listening stations along its borders as well as mobile SIGINT units, the BND itself was able to intercept microwave and radio transmissions from inside the German Democratic Republic (DDR). The signals intelligence units of the French military have similar capabilities, probably also aboard dedicated spy ships.

This Club of Five was also mentioned in professor Jacobs' piece, who referred to a book by Richard Aldrich which says that since the early 1980's there was a "mini-UKUSA-alliance called "The Ring of Five", consisting of the sigint agencies of Germany, the Netherlands, France, Belgium and Denmark". In a note, Jacobs also suggests that this group may also "have been called Fünfgruppe".

According to the BND note, the exchange of military intelligence was also discussed during bilateral meetings, in this case twice a year and together with "UW", but it is unknown what that stands for.



The scan of the note

The Frankfurter Rundschau did not only publish the written part of the note about the cooperation between BND and DGSE, but the whole sheet of notebook paper as it was scanned, including another sheet of paper that was used as a background:

The full scan of the note about cooperation between BND and DGSE
(click to enlarge)

A close look at the bottom of the scan reveals some text that bleeds through from the back side of the larger sheet of paper. Rotating, mirroring and enhancing the image shows that it's part of a bill from the German cell phone provider Smartmobil for mobile data usage for the month of May 2019:

The back side of the sheet of paper behind the BND note
(click to enlarge)

This shows that the BND note wasn't scanned before May 2019 and maybe it could even provide a lead to the person who leaked the note to the press. Therefore, it's quite sloppy that Frankfurter Rundschau didn't cut off this part to make sure that there's no trace to the source.



Thanks to Le cueilleur and Zone d'Intérêt for providing some useful information for this blog post.


Links & sources
- Zone Militaire: Cinq pays européens, dont la France, s’échangent des renseignements au sein de la discrète alliance « Maximator » (July 2020)
- Le Monde: Une petite note manuscrite du renseignement extérieur allemand brise un très vieux secret (July 2020)
- Frankfurter Rundschau: Exklusiv-Recherche: BND spionierte jahrzehntelang am Parlament vorbei (July 2020)
- Bart Jacobs: Maximator: European signals intelligence cooperation, from a Dutch perspective (April 2020)
- German website: Fernmelde- und Elektronische Aufklärung - Funk- und Funktechnische Aufklärung
- Dutch websites: 898 Verbindingsbataljon - WKC/TIVC/SVIC
- Matthew M. Aid & Cees Wiebes, "Secrets of Signals Intelligence during the Cold War and Beyond", London, 2001.

A look at the latest French laws on intelligence collection

For the second time we have an article written in cooperation with the French weblog about intelligence and defence Zone d'Intérêt:


Introduction

Over the last year, The French parliament passed new laws granting additional powers to intelligence services regarding interception of communications and data requests. This is part of a broader reform aimed at creating a legal framework for intelligence practices which were not formally authorized by law before 2015. In the press, it was said that these laws allowed sweeping new surveillance powers, legalizing highly intrusive methods without guarantees for individual freedom and privacy.

This article will focus on the provisions related to communications intelligence (COMINT), including targeted telephone tapping (lawful interception or LI), metadata collection and data requests to internet service providers (ISPs). Targeted interception of the content of internet communications is not regulated by these new laws, but only by older decrees which are still a bit unclear. The new laws are only about collection the metadata of internet communications.

In France, communications interception is authorized under two distinct frameworks:

- Judicial interceptions ordered by a judge of inquiry (juge d'instruction) during a criminal investigation. These interceptions can be done by the police, the gendarmerie (a military force charged with police duties) and by the security service DGSI.

- Administrative interceptions, also known as security interceptions, which are requested by both the domestic security and the foreign intelligence services.

Administrative interceptions are approved by the Prime Minister for various motives, such as defending and supporting major national interests including national defense, foreign policy interests, economical and industrial interests, or preventing terrorism and organized crime. Whereas the Unites States strongly denies conducting commercial espionage in the sense of stealing trade secrets for the benefit of individual companies, France is known for being less strict on this.

Diagram of the various interception capabilities of French intelligence
(Diagram: ZonedInteret.net - Click to enlarge)

The main French security and intelligence services are:

Direction Générale de la Sécurité Intérieure (DGSI), which reports to the Interior Ministry and is responsible for domestic security. It has some 3500 employees and an annual budget of 300 million euros. DGSI was formed in 2008 through the merger of the Direction Centrale des Renseignements Généraux (RG) and the Direction de la Surveillance du Territoire (DST) of the French National Police.

Direction Générale de la Sécurité Extérieure (DGSE), which reports to the Minister of Defence and is responsible for collecting foreign intelligence on civilian issues and also performs paramilitary and counterintelligence operations abroad. DGSE is responsible for both HUMINT and SIGINT.

Direction du Renseignement Militaire (DRM), which reports directly to the Chief of Staff and to the President of France as supreme commander of the French military. DRM is responsible for collecting military intelligence in support of the French armed forces.

Direction de la Protection et de la Sécurité de la Défense (DPSD), which is also part of the Ministry of Defence. DPSD is responsible for the security of information, personnel, material and facilities of the armed forces as well as the defence industry.

Headquarters of the French foreign intelligence agency DGSE in Paris
(Click to enlarge)

A special advisory commission on intelligence activities

The French laws, such as Loi n° 2015-912 and Loi n° 2015-1556, from July and November 2015, grant the Prime Minister full authority to order and approve intelligence activities both domestic and foreign. Each collection request is sent by the intelligence service director to its parent ministry and to the Prime Minister, who gives final approval. An advisory commission known as the CNCTR (Commission Nationale de Contrôle des Techniques de Renseignement, or National Commission for the Control of Intelligence Techniques) is kept informed of all requests for oversight purposes.

In most cases, before the Prime Minister can approve a request, this control commission must receive information related to its approval, including the request justification, the identity and location of the targeted individual, or any other identifying information (occupation, username, etc.) when his identity is unknown.

The CNCTR consists of nine members: four from the Parliament, two from the Council of State, two from the Court of Cassation, and one appointed telecommunications expert. This commission is considered an "Independent administrative authority": it is neither part of the Parliament even though members of Parliament are among its members, nor part of the judicial branch, even though some its members are magistrates.

The CNCTR only holds advisory power as it can not stop any decision from the Prime Minister regarding data requests or intelligence collection. The commission can express disapproval of a collection request, but the Prime Minister can overrule this advice and still authorize intelligence collection.

The CNCTR can access all transcripts and logs from intelligence collected under the Prime Minister's authority, but it can not compel any intelligence service for documents or information, and it can not investigate any irregularity on its own. However, it can express recommendations regarding intelligence procedures and bring any irregularity to the Council of State. All debates inside the commission, as well as all its communications with the Prime Minister and intelligence services are classified.

A special status has been granted to journalists, lawyers and members of parliament, as when intelligence requests apply to them, the CNCTR must be informed just before collection starts so it can state whether the collection is necessary and proportionate. The CNCTR must also receive transcripts of the intercepted communications afterwards. The difference with regard to eavesdropping operations against regular citizens is that for them, CNCTR can access the transcripts if it asks for them, while for the privileged professions, CNCTR must receive and review them.

In theory, any individual living in France or abroad can ask the CNCTR to check if he has been placed under surveillance following proper procedure. The control commission must check for any irregularity, but can neither confirm nor deny to the individual that he has been placed under such surveillance. The commission only states that proper verification has been made, and if any irregularity is detected it can report it to the Council of State.

Headquarters of the French domestic security service DGSI in Paris
(Photo: Bertrand Guay/AFP - Click to enlarge)

New provisions for domestic intelligence collection

This section applies to all main intelligence services such as DGSI, DGSE and DRM. DGSE is a foreign intelligence service, which is not supposed to operate on French territory, but it is authorized to request data and intercept domestic communications. DGSE holds most technical capabilities for decryption and high-end communications collection and provides other agencies, such as DGSI or DRM, with technical means and expertise in this regard.

A recent decree provided authority to more than twenty police and gendarmerie services, some of which are not officially intelligence services, to intercept communications and request data, mostly for counterterrorism purposes. Allowing police services to collect communication intelligence is a shift from older French habits, which the French government justified by the ongoing terrorist threat.

As in most countries, French law provides higher privacy protection to its own citizens and to people communicating from France than to people communicating from abroad, who receive little legal protection against intelligence collection. Intelligence collection under the Prime Minister approval may apply to all electronic means of communication traced to a targeted individual, from mobile phones to landlines, to all metadata from his internet service provider, and even metadata from online services.

In France, telephone companies, ISPs and online services providers can be compelled to provide a wide range of metadata regarding a targeted user, including: technical data related to the identification of connection or subscription numbers (phone numbers, IP adresses, etc.), a list of all connection or subscription numbers linked to a targeted individual, location data of all devices traced to a targeted individual, and call detail records (CDR).

Under the Prime Minister’s authority, telephone companies can be compelled to cooperate with intelligence services conducting targeted phone calls interceptions. French intelligence services are not supposed to proceed to interceptions on their own, but have to go through a dedicated government technical agency called GIC (Groupement Interministériel de Contrôle or Interministerial Control Group).

The GIC operates under the Prime Minister direct authority, receiving approved requests and ordering telephone companies and ISPs to provide information or access to their networks for interception. Providers compelled to cooperate are forbidden to reveal any information related to interceptions or data requests, or to inform their users they have been targeted. Providers personnel refusing to cooperate could be sentenced to a 150,000 € fine and up to two years of imprisonment.

The parliament recently authorized intelligence services to use devices such as IMSI-catchers to identify and locate mobile phones or computers linked to targeted individuals. Intelligence services can only use IMSI-catchers to collect metadata, and all collected data unrelated to specified targets must be destroyed.

Regarding domestic communications, voice communication recordings must be destroyed 30 days after collection, but transcripts can be kept "as long as necessary" by intelligence services. Metadata requested from ISPs and Telcos can be stored up to 4 years. Intercepted communications that are encrypted can be stored up to 6 years.

The French satellite intercept station at the Tontouta naval air base
near Noumea on the main island of New Caledonia
(Photo: Google Earth - Click to enlarge)

A loose framework for the surveillance of foreign communications

Fewer restrictions apply to the surveillance of foreign communications, whether collected by the domestic security service DGSI, the foreign intelligence service DGSE or one of the military agencies.

The Prime Minister issues broad authorizations to intelligence services to monitor and collect communications, either for whole geographical regions, countries, organizations or individuals. The Prime Minister specifies which types of communication networks can be targeted for collection. These authorizations last for 4 months, but they can be renewed without restriction.

Foreign intercepted communications can be kept for 1 year after processing, or up to 4 years after collection. Collected metadata can be stored for 6 years. Encrypted data can be stored for up to 6 years after decryption, or up to 8 years after it has been collected. With these retention periods, the French law is more strict than for example American law, which allows NSA to store encrypted data for an unlimited period of time.


From French territory

The law on surveillance of foreign communications only applies to communications between users who are outside of France, but which are collected from French territory. Here it should be noted that many former French colonies spread around the globe are also considered part of French territory, and French law applies there, especially as this is stated in the latest intelligence laws.

This means that these laws not only apply to data collected from major fiber-optic cables and satellite intercept stations inside France, but also to those from the overseas satellite stations like those in French Guyana, on the island of New Caledonia in the South Pacific and on Mayotte in the Indian Ocean - providing French intelligence with a global SATCOM coverage probably second only to that of the Five Eyes partnership. After ECHELON, this French network was dubbed FRENCHELON.

If data is collected under the foreign communications status, but is then traced back to domestic communications (call number or subscription located in France), it can be processed only if approved under the domestic communications framework, or it must be destroyed under 6 months.

The DGSE satellite intercept station near Kourou in French Guyana,
which was built in cooperation with German BND
(Image: Google Maps)

Outside French territory

Intelligence collection conducted by French intelligence services outside of France is not restricted by law. Because the overseas satellite stations are considered to be on French territory, this situation only applies to for example covert eavesdropping operations in foreign countries, as well as to tactical SIGINT collected through land, sea and airborne platforms during military operations abroad. French armed force are based in countries such as Mali, Gabon, Djibouti and UAE. This will mainly result in communications for military purposes.

While this kind of collection is not regulated by law, it will be limited by the available resources and the specific goals set by the government in the annual PNOR (Plan National d’Orientation du Renseignement or National intelligence orientation plan), a classified document sent to the chiefs of intelligence services and to the parliamentary delegation for intelligence (DPR - Délégation Parlementaire au Renseignement), which only receives a redacted version of this document.

A French army vehicle for collecting tactical SIGINT and ELINT in Afghanistan
(Photo: ageat.asso.fr - Click to enlarge)

Automated bulk metadata collection

In July 2015, a law introduced a new automated bulk metadata collection system against terrorism. The Prime Minister can order French internet service providers to add specified metadata collection and filtering systems to their networks. He can issue such orders for 2 months, and they can be renewed without restriction. Data collected on ISPs networks can be stored up to 60 days, and would be filtered and processed by government issued algorithms to detect terrorism related threats. If such a threat is detected, the Prime Minister can compel ISPs to identify related users.

The development of threat-detection algorithms, and their so-called "black boxes", should be done under supervision from the CNCTR. However, providing oversight at the hardware and software level could be very tricky and difficult, especially as algorithms would be updated and modified very regularly and it would also require specialized knowledge of such internet filter systems.

The scope and purpose of this metadata provision is largely a mystery. At first sight it may look similar to what NSA did by collecting domestic telephone records in order to find unknown terrorist associates by contact chaining. But if that was the purpose of this French law too, then it would have been much easier to order the ISPs to hand over their metadata in bulk, just like it happened in the US.

Actually, French telecommunications and internet service providers already have to store their customer's metadata for at least one year under the EU data retention directive. Moreover, a French legal decree even requires web hosting companies, like Facebook, Google and Amazon, to store their user data for at least one year and provide it to government authorities at their request. However, these metadata may only be used for targeted investigations, as intelligence services must provide specific requests to ISPs & web hosting companies with either the full name of a target, its user name, IP address or other identifying information.

It seems that installing "black boxes" at ISP networks serves the bulk collection of smaller sets of data: they filter traffic using specific threat-detection algorithms, so they will likely only pull in those metadata that match certain communication patterns and routines, based on digital forensics from counterterrorism investigations. The metadata would then be used to identify the users showing such patterns.

Given the very high data rates of traffic passing internet service providers, such filter systems are very expensive and ISP generally don’t like external systems to be plugged into their networks. That makes it surprising that the orders for installing them are valid for just 2 months, and although they are renewable without any limitations, it’s not clear whether these "black boxes" would be removed from ISPs networks at the end of each order, or if they would only be turned off until further notice.



Cyber defense

Interestingly, filtering internet traffic using threat-detection algorithms sounds very much like detecting and preventing malware and cyber attacks. But maybe except for a case when a terrorists group would conduct cyber attacks, the law precisely states that this "black box" metadata filtering and collection system can only be used to detect terrorist threats. It can not be used for any other purpose, including cybersecurity, counterintelligence or criminal investigations.

Nonetheless, the cyber domain did receive special attention from French lawmakers in the latest regulations on intelligence. All collected intelligence which is related to cyber attacks can be stored indefinitely for technical analysis. In addition, all penalties for computer hacking and cyber-related crimes have been doubled as part of the new Law on Intelligence passed in July 2015. This fits a general shift of intelligence agencies towards "cyber", as for example in the US, cyber threats replaced terrorism as top priority for the intelligence community since 2013.



Links and Sources
- New York Times: French Inquiry Urges Changes to Intelligence Services in Light of Failures
- The Guardian: France passes new surveillance law in wake of Charlie Hebdo attack
- Matthew Aid: French SIGINT: Part II
- Overview of French intercept sites: Comment on peut, en trois clics, découvrir la carte des stations d'écoute des espions de la DGSE

Wikileaks published some of the most secret NSA reports so far

(Updated: September 21, 2017)

Last Tuesday, June 23, the website Wikileaks (in cooperation with Libération and Mediapart) published a number of NSA-documents showing that between 2006 and 2012, NSA had been able to eavesdrop on the phone calls of three French presidents.

This is the first time we see actual finished intelligence reports that prove such eavesdropping, and being classified as TOP SECRET//COMINT-GAMMA they are much more sensitive than most of the documents from the Snowden-archive.

Also it seems that these new Wikileaks-documents are not from Snowden, but from another source, which could be the same as the one that leaked a database record about NSA's eavesdropping on German chancellor Merkel.

Update:
On Monday, June 29, Wikileaks published two Information Need (IN) requests and five additional intelligence reports, but the latter are not as highly classified as the ones revealed earlier.

- Intelligence reports - Tasking database records - A second source -

- Some perspective -

NSA intelligence report about an intercepted conversation between French president
François Hollande and prime minister Jean-Marc Ayrault, May 22, 2012.
(Watermarked by Wikileaks - Click to enlarge)

 

Intelligence reports

The reports are from various editions of the "Global SIGINT Highlights - Executive Edition" briefings. Only one report is published in the original layout with header and a disclaimer, the other ones are just transcripts, probably because they are taken from pages that also contain reports about other countries. For Wikileaks it is very unusual to disclose documents in such a selective way.

Update:
According to the internal NSA newsletter SIDtoday from October 19, 2004, the Global SIGINT Highlights evolved from the SIGINT Digest, which was NSA's sole contribution to the initial 1995 prototype of Intelink, a secure intranet of the US intelligence community.

The newsletter contains or is based upon so-called Serialized Reports, which are "the primary means by which NSA provides foreign intelligence information to intelligence users", most of whom are outside the SIGINT community. Such a report can be in electrical, hard-copy, video, or digital form.

The first five intelligence reports published by Wikileaks are:

2006:
Conversation between president Jacques Chirac and foreign minister Philippe Douste-Blazy.
- Method: Unconventional
- Serial number: G/OO/6411-06, 271650Z
- Classification: Top Secret/Comint-Gamma

2008:
Positions of president Nicolas Sarkozy.
- Method: Unidentified
- Serial number: G/OO/503290-08, 291640Z
- Classification: Top Secret/Comint-Gamma

2010, March 24:
Conversation between the French ambassador in Washington Pierre Vimont and Sarkozy's diplomatic advisor Jean-David Levitte.
- Method: Unconventional
- Serial number: Z-3/OO/507179-10, 231635Z
- Classification: Top Secret/Comint

2011, June 11:
Conversation between president Nicolas Sarkozy and foreign minister Alain Juppé.
- Method: Unconventional
- Serial number: Z-G/OO/513370-11, 091416Z
- Classification: Top Secret/Comint-Gamma

2012, May 22:
Conversation between president François Hollande and prime minister Jean-Marc Ayrault.
- Method: Foreign satellite and Unconventional
- Serial numbers: Z-G/OO/503643-12, 211549Z and Z-G/OO/503541-12, 161711Z
- Classification: Top Secret/Comint-Gamma

 
Methods

For most of the five initial, and for all five additional reports, NSA's source of the intercepted communications is "Unconventional". It's not clear what that means, but phone calls between the president and his ministers will in most cases be handled by a local switch and therefore don't go through the intercontinental submarine fiber-optic cables, where they could pass NSA's conventional filter systems for telephone and internet traffic.

For intercepting this kind of foreign government phone calls, NSA would have to have access to the public telephone exchange(s) of Paris or the private branch exchanges (PBX) of the presidential palace and important government departments.

This would indeed require unconventional methods, like those conducted by the joint NSA-CIA units of the Special Collection Service (SCS) who operate from US embassies, or NSA's hacking division TAO.

Update:
According to a book by James Bamford, NSA had an Office of Unconventional Programs in the late 1990s, which in another book was presented as NSA's own equivalent of the SCS units. It is not known whether this office still exists or has evolved into another division.
A 2010 presentation (.pdf) says that RAMPART-A is "NSA's unconventional special access program". This is about cable tapping in cooperation with Third Party partner agencies, but seems not the means to get access to local government phone calls.

In one case, the source is "Foreign Satellite" (or FORNSAT), which is the traditional interception of the downlinks of communication satellites. This method was probably used because president Hollande visited his American counterpart in Washington a few days earlier.

In yet one other case, the method is "Unidentified", and although Wikileaks says it's about an "intercepted communication", the actual report only reflects the positions of president Sarkozy, without mentioning a conversation counterpart.

Google Earth view of the US embassy in Paris, where a joint NSA-CIA unit
of the SCS is stationed. The building in the center has a rooftop
structure that is probably used for spying purposes.
(Click to enlarge)

Classification

Looking at the classification level of the reports shows that they are TOP SECRET//COMINT-GAMMA when the president is involved in the conversation. Intercepted communications between ministers and/or top level advisors, diplomats and government officials are "only" classified as TOP SECRET//COMINT.

Three of the reports have the dissemination marking NOFORN, meaning they may not be released to foreigners. The other two may be released to officials with a need-to-know from agencies of the Five Eyes community.

Four of the reports also have the marking ORCON, meaning the originator controls dissemination of a document, for example by imposing that it has to be viewed in a secured area, or by not allowing copies to be made.

> See also: The US Classification System

The GAMMA compartment

Probably most remarkable about these reports is that they are from the GAMMA compartment, which protects highly sensitive communication intercepts. It was already used in the late 1960s for intercepted phone calls from Soviet leaders.

The overwhelming majority of the Snowden-documents is classified TOP SECRET//COMINT, with COMINT being the control system for signals intelligence which covers almost anything the NSA does. All those powerpoint presentations, wiki pages and daily business reports are therefore not the agency's biggest secrets.

It is not clear whether Snowden had access to the GAMMA compartment. So far, no such documents have been published, except for five internal NSA Wiki pages, for which the highest possible classification was TOP SECRET//SI-GAMMA/TALENT KEYHOLE/etc., but without GAMMA information being seen in them.

Only a few of the Snowden documents that have been published have a more special classification: we have seen a document from the STELLARWIND and the UMBRA control system, as well as from the ECI RAGTIME, but it is possible that Snowden found these as part of his task to move documents that were not in the right place, given their classification level.


Serial number & time stamp

Besides the source and the topic, there's also a serial number and a timestamp below each report. The time is presented according to the standard military notation. 161711Z for example stands for the 16th day, 17 hours and 11 minutes ZULU (= Greenwich Mean) Time, with the month and the year being that of the particular briefing.

The serial number is in the format for NSA's serialized reports, for example Z-G/OO/503643-12. According to the 2010 NSA SIGINT Reporter's Style and Usage Manual (.pdf), such a serial number consists of a code for the classification level, the Producer Designator Digraph (PDDG), a one-up annual number, and the last two digits of the year in which the report was issued. For the classification level, the following codes are known:

1 = Confidential(?) 2 = Secret 3 = Top Secret

S = ? E = ? I = ?

Z-G = Top Secret/Comint-Gamma Z-3 = Top Secret/Comint

The Producer Designator Digraph (PDDG) consists of a combination of two letters and/or numbers and designates a particular "collector", but it's not clear what exactly that means. The serial numbers mentioned in the reports about France all have OO as PDDG. That one is not associated with a specific interception facility, and therefore it might be a dummy used to actually hide the source in reports for people outside the agency.

> See also: List of Producer Designator Digraphs

Update:
According to the 1996 book Secret Power by Nicky Hager, the five UKUSA partners have the following identification codes: GCHQ: AA, DSD: EE, GCSB: II, NSA: OO, CSE: UU, which indicates that OO in the serialized report numbers means they were produced by NSA.

 

Tasking database records

Besides the NSA intelligence reports, Wikileaks also published an database extract which includes the (landline and/or mobile) phone numbers of significant French political and economic targets, including the office of the President.

Because this list is about phone numbers, it seems most likely from a database system codenamed OCTAVE, which kept the selectors used for instructing the various collection facilities. It was reportedly replaced by the Unified Targeting Tool (UTT) in 2011.

Entries from an NSA tasking database with French government targets
(Source: Wikileaks - Click to enlarge)

TOPI: Stands for Target Office of Primary Interest, which is the NSA unit in the Analysis & Production division where the interceptions are analysed and intelligence reports are produced. In the list we see the following TOPIs, all part of the so-called Product Line for International Security Issues (S2C):

S2C13: Europe, Strategic Partnerships & Energy SIGDEV *
S2C32: European States Branch
S2C51: (unknown)

Selector: Shows the particular identifier to select the communications that have to be collected, in this case a phone number. +33 is the country code for France, the third digit being a 1 means that it's a landline (Paris area code), being a 6 means it's a mobile phone.

Subscriber_ID: A description of the subscriber of the selector phone number:

- President of the Republic (cell phone)
- Presidential advisor for Africa (landline, date: 101215)
- Director for Global Public Property of the Ministry of Foreign Affairs (cell phone)
- Government communications center at the Elysée palace (landline)
- Diplomatic advisor at the Elysée palace (cell phone)
- Secretary general at the Elysée palace (cell phone)
- Spokesman of the foreign minister (cell phone)
- Cabinet of the Ministry of Foreign Affairs (MAE, cell phone)
- Presidential advisor for Africa (landline, date: 101214)
- Secretary of State for European Affairs (cell phone)
- Secretary of State for Trade (cell phone)
- Ministry of Agriculture SWBD (landline)
- Ministry of Finance, Economy and Budget (landline, for S2C32)
- Ministry of Finance, Economy and Budget (landline, for S2C51)
- Government air transportation wing (landline)

Information_Need: The collection requirement derived from the National SIGINT Requirements List (NSRL), which is a daily updated compendium of the tasks given to the various Signals Intelligence collection units around the world. These needs have a code number, consisting of the year in which the need was established, followed by a number that refers to a specific topic:

165: France: Political Affairs
204: France: Economic Developments
388: Germany: Political Affairs (see Merkel-entry below)
1136: European Union: Political Affairs
2777: Multi-country: International Finance developments

From all its allies, the US was most interested in France - according to the 1985 version of the NSRL, which fell in the hands of East Germany and was eventually returned in 1992.

TOPI_Add_Date: According to Wikileaks this is the date of tagging of the entry with the responsible TOPI. These dates seem to be in the format yymmdd, which means they are either December 14 or December 15, 2010.

Priority: The priority of the particular Information Need, likely derived from the National Intelligence Priority Framework (NIPF, a reconstruction of which can be found here). This is a huge list containing all countries and topics the US government wants to be informed about, and which prioritizes these topics with a number from 1 (highest) to 5 (lowest). As we can see in the Wikileaks-list, for France, only the president and the director for global public property of the ministry of foreign affairs have priority 2, the rest is medium level 3.

IN_Explainer: Description of the Information_Need

 

A second source

The database entries published by Wikileaks are very similar to the database record that revealed NSA's intention of eavesdropping on German chancellor Merkel back in October 2013. This record contains the number of Merkel's non-secure cell phone and several other entries just like we saw in the Wikileaks list, but it also has some additional information:

Printed version of a transcription of an NSA database
record about German chancellor Merkel

Because for Merkel only this record was available, and no finished intelligence reports like those about the French presidents, there is no hard proof that NSA succesfully intercepted her communications.

> See also: How NSA targeted chancellor Merkel's mobile phone

What many people don't realize, is that this database record about Merkel wasn't from the Snowden-documents. Der Spiegel received it from another source that was never identified, which was confirmed by Glenn Greenwald and Bruce Schneier (this seems to exclude the option that someone with access to the Snowden-documents leaked this on his own).

Because the tasking records about France are very similar, and most likely from the same database as the one about chancellor Merkel, it's very well possible that they are from the same source. Because keeping an eye on foreign governments is a legitimate task, this source is not a whistleblower. He or she could be a cryptoanarchist, or maybe even an agent of a foreign intelligence agency.

Perhaps Wikileaks itself also doesn't know who the source is, because last May, it relaunched its secure TOR-based drop box that allows anonymous submissions of sensitive materials.

During his work for the NSA, Edward Snowden was not involved with European targets. He was based in Japan, and later in Hawaii, where they are responsible for the Pacific region. His last job was supporting the regional NSA/CSS Threat Operation Center (NTOC), which counters cyber threats.

This is reflected by the intercepted content that Snowden apparently did had (legal) access to, according to a report by The Washington Post from July 5, 2014. These intercepts came "from a repository hosted at the NSA’s Kunia regional facility in Hawaii, which was shared by a group of analysts who specialize in Southeast Asian threats and targets".

 

Some perspective

French prime minister Manuel Valls strongly condemned these spying activities, but that was of course just for show. France's own foreign intelligence service DGSE is well-known for its aggressive industrial espionage against American and German companies, and for example also targeted former US president George W. Bush and foreign secretary Madeleine Albright.

On the other hand, the French government was well aware of the security risks, as in 2010 it ordered over 14.000 secure mobile phones, to be used by the president, ministers and high officials of the armed forces and the various ministries that deal with classified defence information.

This highly secure TEOREM cell phone is manufactured by the French multinational defence company Thales, and the price of a single device is said to be around 1.500,- euros. Because the TEOREM has a rather old-fashioned design and the security features don't improve usability, it was apparently not used as often as it should be...

The TEOREM secure mobile phone made by Thales
(Source: Thales leaflet - Click to enlarge)

White House response

A spokesman of the US National Security Council (NSC) told the website Ars Technica that "we do not conduct any foreign intelligence surveillance activities unless there is a specific and validated national security purpose. This applies to ordinary citizens and world leaders alike". Later he added: "We are not targeting and will not target the communications of President Hollande."

Just as in the case of German chancellor Merkel, the past tense misses, which means the US government doesn't deny that the French president had been eavesdropped on in the past. But it seems that at least for the near future, both leaders will not be targeted by NSA anymore.



Links and sources
- Reuters.com: NSA wiretapped two French finance ministers: Wikileaks
- ArsTechnica.com: WikiLeaks publishes top secret NSA briefs showing US spied on France
- Wired.com: With its French NSA Leak, Wikileaks is Back
- Zeit.de: Was die Frankreich-Dokumente preisgeben
- LeMonde.fr: Trois présidents français espionnés par les Etats-Unis
- Tagesschau.de: NSA spähte Frankreichs Staatsspitze aus

- See also the thread on Hacker News