The German operation Eikonal as part of NSA's RAMPART-A program

(Updated: May 30, 2015)

Just over a week ago, the regional German paper Süddeutsche Zeitung and the regional broadcasters NDR and WDR came with a story saying that between 2004 and 2008, the German foreign intelligence service BND had tapped into the Frankfurt internet exchange DE-CIX and shared the intercepted data with the NSA. As not all communications of German citizens could be filtered out, this is considered a violation of the constitution.

Here we will give a summary of what is currently known about this BND operation and we will combine this with information from earlier reports. This will show that it was most likely part of the RAMPART-A program of the NSA, which includes similar interception efforts by foreign partner agencies. Finally, we will look at where exactly the BND interception might have taken place.


> See also: New details about the joint NSA-BND operation Eikonal

Update #1:
On October 20, the Danish paper Information has confirmed that the German BND operation Eikonal was indeed part of the RAMPART-A program: a document from NSA's SSO division lists an operation codenamed "EIKANOL" as part of RAMPART-A and says it was decommissioned in June 2008. Unfortunately the original document wasn't published.

Update #2:
During hearings of BND officials by the German parliamentary committee investigating NSA spying, it became clear that operation Eikonal was actually tapping into just one fiber-optic cable from Deutsche Telekom, and not into the Frankfurt internet exchange DE-CIX. This was confirmed by German media on December 4, 2014.

 

The German operation Eikonal

The codename for the BND operation was Eikonal, which is a scientific German word, derived from Greek, meaning likeness, icon or image. Details about it were found in BND documents marked Streng Geheim (Top Secret), which were handed over to a committee of the German parliament that investigates NSA spying activities (NSA Untersuchungsausschuss). It's not clear whether journalists were able to read these documents themselves, or were just told about their contents.

The operation was set up in 2003 as a cooperation between BND and NSA, whith the BND providing access to the Frankfurt internet exchange DE-CIX, and NSA providing sophisticated interception equipment, which the Germans didn't had but were eager to use. Interception of telephone traffic started in 2004, internet data were captured since 2005. Reportedly, NSA was especially interested in communications from Russia.

For this, NSA provided BND with lists of 'selectors' like phone numbers and e-mail addresses. According to the testimony of an BND employee at a committee hearing last month, his co-workers pulled these selectors from an American server 2, 3 or 4 times a day and entered them into the system that does the actual interception.

The article in Süddeutsche Zeitung says that from DE-CIX, the data first went to BND headquarters in Pullach, and then to the Mangfall barracks in Bad Aibling, where BND and NSA analysts secretly worked together as the Joint SIGINT Activity (JSA, terminated in 2012). From there, there was a secure line back to NSA headquarters.

Operations center room in the former BND headquarters in Pullach
(click to enlarge)

To prevent communications of German citizens being passed on to NSA, BND installed a special program (codenamed DAFIS) to filter these out. But according to the documents, this filter didn't work properly from the beginning. An initial test in 2003 showed the BND that 5% of the data of German citizens could not be filtered out.

A review of operation Eikonal reported that a "complete and accurate" separation between German and foreign telecommunications was impossible. Also BND wasn't able to fully check this because of a lack of technical expertise.

The documents also suggest that the intelligence oversight committees of the Bundestag were not properly informed. The BND noticed at some point that the NSA searched for information about the European defence contractor EADS (now Airbus Group), the Eurocopter and French government agencies. Together with doubts about the legality of the Eikonal operation, this resulted in ending the cooperation with NSA in 2008.

Reportedly, NSA wasn't happy with that and sent its deputy director John Inglis to Berlin in order to demand some kind of "compensation": if not Frankfurt, then BND should offer access to another European fiber-optic cable. Süddeutsche Zeitung says that at that time, BND got access to a cable of "global importance", where NSA did not have access to. NSA then became a "silent partner" receiving data from this new BND interception effort.


Meanwhile, two members of the German parliamentary investigation committee, who are cleared for the BND documents about Eikonal, said that the aforementioned press reports were not always correct. According to one member, it actually wasn't BND, but NSA that ended the cooperation, apparently because the Germans were so heavily filtering the data, that the outcome wasn't of much interest for NSA anymore.

 

The RAMPART-A program of NSA

Those who have followed the Snowden-leaks, may have recognized that operation Eikonal is identical to cable tapping operations which are conducted under the RAMPART-A program of NSA. According to some of the Snowden-documents, this is an umbrella program under which NSA cooperates with 3rd Party countries, who "provide access to cables and host U.S. equipment".

The slide below clearly shows that such a partner country taps an international cable at an access point (A) somewhere in that country and then forwards the data to a processing center (B). Equipment provided by the NSA processes the data and analysts from the host country can then analyse the intercepted data (C) before they are forwarded to an NSA site in the US (D):

Details about NSA's RAMPART-A program were published by the Danish newspaper Information in collaboration with Greenwald's website The Intercept on June 19, 2014. The program reportedly involved five countries, and cooperation two others was being tested. In total, all RAMPART-A interception facilities gave access to 3 terabits of data every second.

The disclosed documents list 13 RAMPART-A sites, nine of which were active in 2013. The three largest are codenamed SPINNERET, MOONLIGHTPATH and AZUREPHOENIX, which by the number of records are NSA's second, third and fifth most productive cable tapping programs - which shows the importance of these 3rd Party relationships for NSA.

Eikonal (which most likely had a different NSA codename seems to be misspelled EIKANOL in the NSA document seen by Information) isn't included in these documents as they date from at least two years after this operation was ended.

The exact locations of these access points are protected under the Exceptionally Controlled Information (ECI) compartment REDHARVEST (RDV), to which Snowden seems to have had no access. Therefore we don't know which countries are participating in the RAMPART-A program, although some of the documents contain leads pointing to Denmark and Germany.

These foreign partnerships operate on the condition that the host country will not use the NSA’s technology to collect any data on US citizens. The NSA agrees that it will not use the access it has been granted to collect data on the host countries’ citizens, but one NSA presentation slide (marked NOFORN: Not for Foreign Nationals) notes that "there ARE exceptions" to this rule:

According to a 2010 briefing, intelligence collected via RAMPART-A yielded over 9000 intelligence reports the previous year, out of which half was based solely on intelligence intercepted through RAMPART-A.


More about RAMPART-A

What the reports on both websites didn't mention is that RAMPART-A is apparently focussed on collecting information about Russia, the Middle East and North Africa. This comes from Der NSA Komplex, a book about the Snowden-revelations written by two journalists from Der Spiegel. Unfortunately this book, which is much more informative than the one by Glenn Greenwald, is only available in German.

Besides 3rd Party partners giving access to cables in their own country, there's also a construction in which such a partner agency cooperates with yet another country that secretly provides access to data traffic, which is also shared with NSA. In recent years, BND and NSA conducted about half a dozen of such operations, three of which are mentioned in Der NSA Komplex:

- Tiamat (access to high-level international targets under risky circumstances. This operation had ended before 2013)*

- Hermos (in the Spring of 2012, BND got access to communication cables in a crisis zone country, but this operation had to be terminated by the end of the year when the situation almost went out of control)*

- Wharpdrive (this operation was still active in 2013, but in the Spring of that year, employees of the private company that operates the communication cables, accidently discovered the clandestine BND/NSA equipment, but the operation was rescued by providing a plausible cover story)*

Update:
In the follow-up report by the Danish paper Information from October 20, 2014, it is said that the WHARPDRIVE access was opened in February 2013 and had the same size as EIKANOL. Information claims that according to Der Spiegel this access was also located in Germany, but Der NSA Komplex says it was a joint venture with a third country and in an NSA document from April 2013 it is also called a "trilateral program", which was "identified for possible termination due to fiscal constraints". From this document it seems the program had EMERALD as an alternate codename.

 

Where did the tapping took place?

The best kept secret is the actual location where the BND tapping point was. Süddeutsche Zeitung reports that in the original documents the name of the provider is blacked out, but that according to insiders, it must have been Deutsche Telekom that assisted BND. The paper even says both parties signed an agreement in which the provider earned a payment of 6.000,- euros a month in return for the access.

This seems to correspond with a report broadcasted by the German television magazine Frontal 21 in July last year, saying that BND had access to the Frankfurt internet exchange through its own cable since 2009. According to an insider, this cable access was under the cover of a major German telecom provider, and it was speculated this was Deutsche Telekom.

But as some people noticed, Deutsche Telekom was not connected to DE-CIX when operation Eikonal took place. In 2008, the actual routers and switches of DE-CIX were situated in 18 data centers from InterXion, TeleCity, Equinix, Level 3, ITENOS and e-shelter. Since 2008, the distributed DE-CIX switches are interconnected through the priva|nex private fiber-optic network from euNetworks.

Diagram of the Frankfurt internet exchange point DE-CIX

Maybe before 2008 the DE-CIX switches were connected by fiber cables from Deutsche Telekom, but if not, there seems to be no way this company could have provided the BND access to the Frankfurt internet exchange. If the 6000,- euro contract really involved Deutsche Telekom, then maybe for the rent of a private cable from the tapping point to a BND site.


In response to earlier media reports, the DE-CIX management put out a press release on June 26, 2014 saying: We exclude that any foreign or domestic secret service had access to our internet exchange and the connected fiber-optic networks during the period of 2004 - 2007". It was added that DE-CIX itself doesn't operate any data centers, nor stores or processes data on its own.

This statement only speaks about the past, so it doesn't contradict the fact that the BND was recently authorized to intercept the communications from 25 internet service providers (ISPs), with their cables being tapped at the DE-CIX internet exchange, as was reported by Der Spiegel on October 6, 2013. A letter containing this authorisation was sent to the Association of the German Internet Industry, which is the owner of the company that operates the Frankfurt internet exchange.

Among these 25 providers there are foreign companies from Russia, Central Asia, the Middle East and North Africa, but also 6 German providers: 1&1, Freenet, Strato AG, QSC, Lambdanet and Plusserver, who almost exclusively handle domestic traffic.

However, Strato AG said they would never agree with such a wiretapping order and 1&1 declared they never received a letter from BND and suggests that if there's any interception this may take place in cooperation with DE-CIX Management GmbH, the organisation that operates the Frankfurt internet exchange.

This would mean that currently BND isn't tapping the whole internet exchange, but only the cables from selected providers, which is of course much more efficient. Tapping the whole exchange would probably also exceed BND's technical capabilities, as nowadays DE-CIX connects some 550 ISPs from more than 55 countries (including North Korea), including broadband providers, content delivery networks, web hosters, and incumbent operators.

If that's the case, then the actual interception could take place at DE-CIX systems, maybe at the core fiber network or the core switch. This means, BND only needs the cooperation of the DE-CIX management and the indivual providers can honestly deny that their cables are being intercepted.

According to Der Spiegel, the BND copies the data stream and then searches it using keywords related to terrorism and weapon proliferation. A BND spokesman assured the Wall Street Journal in October last year that purely domestic German traffic is neither gathered nor stored.

Simplified structure of the Internet, showing how Tier 1, Tier 2 and Tier 3 providers
transit data traffic in a hierarchial way and how Tier 2 providers exchange
traffic directly through peering at an Internet eXchange Point (IXP)
(diagram: Wikimedia Commons - click to enlarge)

In august last year, a spokesman from the DE-CIX management said that he couldn't rule out that some providers connected to the exchange would allow interception on their equipment when ordered so by their national governments.

This points to for example Level 3, a US company that has a data center which houses some DE-CIX routers. But if Level 3 would have provided access to DE-CIX, then there was no need for NSA to cooperate with BND. Also, on August 1, 2013, Level 3 gave out a press release saying that the company had not given any foreign government access to its networks in Germany in order to conduct surveillance.

> See also: NSA also has arrangements with foreign internet providers

Update:
On March 26, 2015, the German parliamentary investigation commission heard Klaus Landefeld, board member of DE-CIX, who provided some interesting insights in the workings of this internet exchange.

Conclusion

Although we have no positive confirmation that Eikonal was part of the RAMPART-A program, this German operation perfectly fits the way in which foreign parters of NSA get access to important internet cables and switches and share the results with their American counterparts. In this case, NSA apparently cooperated with BND in order to get access to communications from Russia and probably also from the Middle East and North Africa that traveled through Germany.

The best kept secret is how and where such interception takes place, and we have seen that tapping the Frankfurt internet exchange DE-CIX is far more complex than it seems. This makes it difficult to pinpoint the taps, but by combining earlier press reports with the structure of the DE-CIX exchange, it seems unlikely that Deutsche Telekom was involved.

Update #1:
Because of the confusion about the role of Deutsche Telekom in operation Eikonal, the parliamentary investigation committee has decided to also investigate whether this company assisted BND in tapping the Frankfurt internet exchange or not. As an alternative option it's suggested that Deutsche Telekom might have just given access to its own Frankfurt backbone switch, instead of to DE-CIX - this would better fit NSA's description of what is intercepted under RAMPART-A: "International Gateway Switches; End-Point GSM Switches; Leased Internet Circuits; Internet Backbone Routers".

Update #2:
During hearings of BND officials by the German parliamentary committee investigating NSA spying, it became clear that operation Eikonal was indeed tapping into just one fiber-optic cable from Deutsche Telekom, and not into the Frankfurt internet exchange DE-CIX. This was confirmed by German media on December 4, 2014.

> See also: New details about the joint NSA-BND operation Eikonal




Links and Sources
- Sueddeutsche.de: Codewort Eikonal - der Albtraum der Bundesregierung (2014)
- Spiegel.de: Spying Together: Germany's Deep Cooperation with the NSA (2013)
- Heise.de: NSA-Abhörskandal PRISM: Internet-Austauschknoten als Abhörziele (2013)
- Spiegel.de: BND lässt sich Abhören von Verbindungen deutscher Provider genehmigen (2013)
- NSA presentation: RAMPART-A Project Overview (pdf) (2010)
- About the structure of the internet: Die Bosse der Fasern (2005)


- More comments on Hacker News

NSA's Strategic Mission List

(Updated: February 9, 2016)

One of the most important documents that has been disclosed as part of the Snowden-leaks is also one of the least-known: the Strategic Mission List from January 2007, which provides a detailed list of the goals and priorities for the National Security Agency (NSA).

This Strategic Mission List was published by The New York Times on November 2, 2013, as one of three original NSA documents that accompanied a long report about the how NSA spies on both enemies and allies.

> The Strategic Mission List in .pdf-format

About the publication

On the website of The New York Times (NYT), the Strategic Mission List was published as a series of images in png-format, which made it impossible to copy or search the text. It was also difficult to print the document in a readable way. For reasons unknown, NYT is the only media-outlet that published Snowden-documents in this not very user-friendly way.

Hence I asked The New York Times whether they could provide the Strategic Mission List in the standard pdf-format, but the paper didn't reply. I also asked the author of the report, Scott Shane, but he answered that he had no access to the document anymore.

Eventually I used an Optical Character Recognition (OCR) tool to convert the images from the NYT website into a text document, conducted the necessary corrections by hand and then converted the result into the pdf-document, that is now published here, on Cryptome and on DocumentCloud.


The Strategic Mission List

Edward Snowden and Glenn Greenwald claim that NSA has just one single goal: collect all digital communications from all over the world: "Collect it All". But this is not mentioned in the Strategic Mission List, which instead lists a range of far more specific goals, many of which are of a military nature, which is also something that lacks in the media-coverage of the Snowden-leaks.

The document describes the priorities and risks for the United States SIGINT System (USSS) for a period of 12 to 18 months and is reviewed, and where necessary updated bi-annually. The topics are derived from a number of other strategic planning documents, including the National Intelligence Priorities Framework (NIPF), which sets the priorities for the US Intelligence Community as a whole.

Note that according to the classification marking, the Strategic Mission List is only authorized for release to the US, the UK, Canada and Australia, which leaves New Zealand excluded.


Structure

The Strategic Mission List is divided into two parts. The first part includes 16 Topical Missions, which represent missions discerned to be areas of highest priority for the USSS, where SIGINT can make key contributions. The second part includes 6 Enduring Targets, which are countries that need to be treated holistically because of their strategic importance.

For both of these sections, the Strategic Mission List includes Focus Areas, the most critical important targets which are a "must do", as well as Accepted Risks, which are significant targets for which SIGINT should not be relied upon as a primary source.


Enduring Targets

The 6 countries that are listed in the Strategic Mission List as being Enduring Targets for NSA and the tactical SIGINT collecting components of the US Armed Forces are:

- China
- North-Korea
- Iraq
- Iran
- Russia
- Venezuela

Map showing the 6 nations that are Enduring Targets, as well
as countries that are 2nd and 3rd Party partners of NSA
(click to enlarge)

Topical Missions

Besides the 6 countries listed as Enduring Targets, the Strategic Mission List also includes the following 16 Topical Missions:

- Winning the Global War on Terrorism
- Protecting the U.S. Homeland
- Combating Proliferation of Weapons of Mass Destruction
- Protecting U.S. Military Forces Deployed Overseas
- Providing Warning of Impending State Instability
- Providing Warning of a Strategic Nuclear Missile Attack
- Monitoring Regional Tensions that Could Escalate
- Preventing an Attack on U.S. Critical Information Systems
- Early Detection of Critical Foreign Military Developments
- Preventing Technological Surprise
- Ensuring Diplomatic Advantage for the U.S.
- Ensuring a Steady and Reliable Energy Supply for the U.S.
- Countering Foreign Intelligence Threats
- Countering Narcotics and Transnational Criminal Networks
- Mapping Foreign Military and Civil Communications Infrastructure

We see that many of these topics are of a military nature and that also the more civilian areas of interest are quite common goals for a large (signal) intelligence agency. Although communications of ordinary civilians are accidently caught up in NSA's collection efforts, they are clearly not of interest let alone given priority.

Updates:

On November 23, 2013, The New York Times published a document that contains the NSA's SIGINT Strategy for 2012 to 2016, providing a more detailed interpretation of the Strategic Mission List.

In January 2016, DNI James Clapper said that "in 2013, 'cyber' bumped 'terrorism' out of the top spot on our list of national threats".

Also early 2016, NSA started an internal reorganization whereby the four main goals for the organization were described as:

- Thwarting terrorists
- Enhancing cybersecurity
- Protecting the warfighter
- Containing, controlling, and protecting strategic weapons

About STELLARWIND and other mysterious classification markings

(Updated: May 16, 2015)

Last week, on September 6, the US Justice Department released a declassified version of a 2004 memorandum about the STELLARWIND program.

The memorandum (pdf) is about the legality of STELLARWIND, which was a program under which NSA was authorized to collect content and metadata without the warrants that were needed previously.

Here we will not discuss the STELLARWIND program itself, but take a close look at the STELLARWIND classification marking, which causes some confusion. Also we learn about the existance of mysterious compartments that point to some highly sensitive but yet undisclosed interception programs.

> See also: The US Classification System

Classification marking of the 2004 DoJ memorandum about STELLARWIND

The redacted markings

The first thing we see is that two portions of the classification marking have been blacked out:


1. The redacted space beween two double slashes

This is very strange, because according to the official classification manuals, there cannot be something between two double slashes in that position (see the chart below). The classification level (in this case: Top Secret) has to be followed by the Sensitive Compartmented Information (SCI) control system (here: COMINT).

But as the US classification system is very complex, there are often minor mistakes in such classification lines. If we assume there was a mistake made here too, then the first term that has been blacked out could be another SCI compartment, which had to be followed by just a single slash (for example HCS for HUMINT Control System would fit the redacted space, although that marking itself isn't classified).

If there was no mistake, however, and the double slash is actually correct, then it would be a complete new category which isn't in the (public) classification manuals. This reminds of the UMBRA marking, which also appeared unexpectedly between double slashes in a classification line.

Overview of the categories and formatting for the US classification and control markings
From the Intelligence Community Classification Manual 6.0 from December 2013
(click to enlarge)

2. The redacted space directly after STELLARWIND

The second redaction starts right after the last letter of "STELLARWIND", thereby carefully hiding the category of the redacted marking, which is determined by how it is separated from the previous term. This could be by a slash, a double slash, a hyphen or a space, each indicating a different level.

In this case, the most likely option is that "STELLARWIND" is followed by a hyphen, which indicates the next term is another compartment under the COMINT control system, equal to STELLARWIND.

Classification manuals say there are undisclosed COMINT compartments which have identifiers consisting of three alphabetical characters. This would fit the redacted space as it would read like: "COMINT-STELLARWIND-ABC".

This undisclosed compartment probably also figured in some other declassified documents, where it sometimes seems to be accompanied by a sub-compartment which is identified by three numeric characters, like for example in this and this declaration where the marking could read like "COMINT-ABC 678":

Classified declaration of NSA director Alexander, April 20, 2007.

Looking at what was redacted in portions of both documents which were marked with this mysterious compartment, it seems that it's about at least two highly sensitive intelligence sources and methods. For example, pages 31-32 of this declaration (pdf) suggest that this might be obtaining metadata from specific telecom companies and search them for members or agents of particular target groups.

Classified declaration of Director of National Intelligence John Negroponte, May 12, 2006
TSP = Terrorist Surveillance Program; HCS = HUMINT Control System
Note that TSP and HCS are also between double slashes
(click to open the full document in pdf)

Markings with the mysterious undisclosed COMINT compartments weren't found on any of the Snowden-documents, but only on those that were declassified by the government, so it seems that Snowden had no access to information protected by these particular compartments.

The marking TSP (for Terrorist Surveillance Program), which is in some of the examples shown above, was used instead of STELLARWIND in briefing materials and documents intended for external audiences, such as Congress and the courts.



The STELLARWIND marking

So far, we looked at the two parts of the classification marking that were blacked out. But now we also have to look at the STELLARWIND marking itself, which wasn't redacted, but still causes confusion.

The classification marking of the 2004 memorandum of the Justice Department says "COMINT-STELLAR WIND" and according to the official formatting rules, this means that STELLARWIND would be part of the COMINT control system.

Note that the same memorandum had already been declassified upon a FOIA request by the ACLU in 2011, but in that version (pdf) the codeword STELLARWIND was still blacked out from the whole document. Both documents are compared here.

Classification marking of the 2004 DoJ memorandum about STELLARWIND

As COMINT is a control system for communications intercepts or Signals Intelligence, this seems to make sense. But what is confusing, is that the internal 2009 NSA classification guide (pdf) for the STELLARWIND program, which was disclosed by Edward Snowden, says something different.

Initially this guide calls STELLARWIND a "special compartment", but from the marking rules it becomes clear that it is treated as an SCI control system. Accordingly, the prescribed abbreviated marking reads: "TOP SECRET // STLW / SI // ORCON / NOFORN". In this way we can see STELLARWIND in the classification line of the following document:

Classification marking of a 2013 classified declaration (pdf) of DNI James Clapper
which was declassified on May 6, 2014
(click to enlarge)

In this document and also in a similar declaration (pdf) from 2013, the reason for the STELLARWIND classification is explained as follows:

"This declaration also contains information related to or derived from the STELLARWIND program, a controlled access signals intelligence program under presidential authorization in response to the attacks of September 11, 2001. In this declaration, information pertaining to the STELLARWIND program is denoted with the special marking "STLW" and requires more restrictive handling."

STELLARWIND is also being treated as a control system in the 2009 draft report about this program written by the NSA Inspector General, although its classification line is also somewhat sloppy: there are double slashes between STLW and COMINT (should just be a single one), and only a single one between COMINT and ORCON (where there should have been double slashes as both are from different categories):

Classification marking of the 2009 report about
STELLARWIND by the NSA Inspector General
(click to read the full document)

Throughout this document, the portion markings are also not always consistent. Most of them are "TS//SI//STLW//NF", but one or two times "TS//SI-STLW//NF". But as this report is a draft, it's possible that these things have been corrected in the final version, which hasn't been disclosed or declassified yet.

The 2009 Inspector General report about STELLARWIND was one of the first documents from the Snowden-leaks to be published, and it still is one of the most informative and detailed pieces about the development of NSA's interception efforts since 9/11.


Conclusion

In the end, it doesn't make much difference whether STELLARWIND is a control system on its own, or a sub-system of COMINT, but it is remarkable that for such an important program, the people involved apparently also weren't clear about it's exact status and how to put it in the right place of a classification line.

More important though is that the declassified documents show that besides the STELLARWIND program, there's at least one COMINT-compartment with at least one sub-compartment that protect similar or related NSA collection efforts which are considered even more sensitive, but about which we can only speculate.

 

UPDATE:

On April 24, 2015, the US government declassified a 2009 report by five Inspectors General about the STELLARWIND program, after a FOIA request by The New York Times. This report, which is over 700 pages long, has the overall classification "TOP SECRET // STLW // HCS / COMINT // ORCON / NOFORN":

The overall classification marking of the 2009 Inspectors General report
about STELLARWIND, with underneath the classification line and the
header of the report of the NSA Inspector General

Included in this report is the final version of the report of the NSA Inspector General, the draft version of which we discussed above. We see that in this final version, the classification line has been corrected: there's now a double slash between COMINT and ORCON, just like it should be.

This also means that the double slash between STLW and COMINT, which initially looked like a mistake, must be correct. We also see this double slash in the overall classification marking for the entire report (which has the additional HCS (HUMINT Control System) for information from the CIA).

Apparently STELLARWIND (STLW) was not an ordinary SCI control system (then there would have been only a single slash between STLW and COMINT), but a category on its own, or belongs to a category not mentioned in the publicly available government classification marking guides.

Update #2:
In a speech on May 15, 2015, former NSA Inspector General Joel Brenner said that STELLAR WIND "was not SAP’ed, because the creation of a new special access program requires Congressional notification, but it was run directly by the Office of the Vice President and put under the direct personal control of the Vice President’s counsel, David Addington" - which could maybe an explanation for the fact the program was or became a classification category on its own.

NSA's Foreign Partnerships

(Updated: January 21, 2025)

For fulfilling its task of gathering foreign signals intelligence, the National Security Agency (NSA) is cooperating with partner agencies from over 35 countries all over the world.

These relationships are based upon secret bilateral agreements, but there are also some select groups in which intelligence information is shared on a multilateral basis, like the SIGINT Seniors Europe (SSEUR), the SIGINT Seniors Pacific (SSPAC) and the Afghanistan SIGINT Coalition (AFSC).

Until recently, very little was known about these foreign relationships, but the Snowden-leaks have revealed the names of all the countries that are cooperating with NSA. This made it possible to create the following graphic, which also shows various multilateral intelligence exchange groups, which will be discussed here too.

- 2nd Party Partners - 3rd Party Partners - Multilateral groups -

Nations with 2nd and 3rd Party status and those who are
members of the SIGINT Seniors Europe (SSEUR) and NATO
(click to enlarge)

 

2nd Party Partners

The closest cooperation is between NSA and the signals intelligence agencies of the United Kingdom, Canada, Australia and New Zealand. Formally this is based upon a range of bilateral agreements, the first being the BRUSA (now known as UKUSA) Agreement on communications intelligence cooperation from March 5, 1946. Since 1993 this group has a multilateral character, which means partners can exchange information among the other members too (as far as there's a "need to know")

The five partners under the UKUSA-agreement, commonly called the Five Eyes, agreed that they would follow common procedures for operations and reporting, and also use the same target identification systems, equipment, methods and source designations. They would not only share end reports and analyses, but also most of the raw data they collect.

As a kind of gentlemen's agreement it is supposed that the Five Eyes countries are not spying on each other, although some of the documents from the Snowden-leaks show that at least NSA secretly keeps that option open.

Since 1946 1946 1949 1956 1956

Five Eyes (FVEY) United States United Kingdom Canada Australia New Zealand

Four Eyes (ACGU) United States United Kingdom Canada Australia

Three Eyes (TEYE) United States United Kingdom Australia

Despite the very close and longstanding relationship between the Five Eyes partners, two sub-groups have been formed for specific military operations in which not all five partners participate. These sub-groups are designated Four Eyes (abbreviation for classification purposes: ACGU) and Three Eyes (TEYE).

> More about The 5, 4 and 3 Eyes

Update:
In February 2018 it was reported that since 2017, officials of the French military intelligence agency DRM are regularly attending meetings in Washington to share information with the Five Eyes group, reflecting a capability to gather and exchange high-value data.

Cable tapping

The 2nd Party countries are cooperating in many ways, one of which is in cable tapping operations. The NSA umbrella program for this is codenamed WINDSTOP. According to NSA's Foreign Partner Access budget for 2013 WINDSTOP involves primarily Britain, but also Canada, Australia and New Zealand and focusses on access to (mainly internet) "communications into and out of Europe and the Middle East" through an integrated and overarching collection system.

- See also: Data sharing systems used within the Five Eyes partnership

Representatives

For maintaining these extensive relationships, NSA has liaison units in the Second Party countries. These are called Special US Liaison Offices (SUSLO), followed by the name of the nation's capital. In 2003, there were three:

- Special US Liaison Office, London (SUSLOL, with liaison officers at GCHQ in Cheltenham)
- Special US Liaison Office, Ottawa (SUSLOO)
- Special US Liaison Office, Canberra (SUSLOC, which also handled dealings with New Zealand)

Likewise, the SIGINT agencies from the other Five Eyes countries have a senior representative at NSA headquarters. In 2003, these were called:

- Senior UK Liaison Office (SUKLO)
- Canadian Liaison Office (CANSLO)
- Australian Liaison Office (AUSLO)
- New Zealand Liaison Office (NZLO)

Oversight

In September 2016, the Five Eyes Intelligence Oversight and Review Council (FIORC) was created, composed of the non-political intelligence oversight, review, and security entities of the Five Eyes countries.

The FIORC members exchange views, compare best practices in review and oversight methodology, explore areas where cooperation on reviews and the sharing of results is permitted, and encourage transparency to the largest extent possible to enhance public trust.

Slide from an NSA presentation titled 'Foreign Partner Review' from
fiscal year 2013, showing the 2nd and 3rd Party partners
and some coalition and multilateral exchange groups.
Published in No Place To Hide, May 13, 2014.

 

3rd Party Partners

One step below the 2nd Party partnerships, there's cooperation between NSA and (signals) intelligence agencies from countries who are called 3rd Party partners. This is based upon formal agreements, but the actual scope of the relationship can vary from country to country and from time to time. Details about the cooperation between two countries are laid down in Memorandums of Understanding (MoU).

For the US, this kind of cooperation is useful because foreign agencies can have better access to high-priority targets because of their geographic location, or they could have a specific expertise on certain areas, or just simply because they have a better knowledge of the local situation and language.

The foreign partner agencies are mostly interested in American technology, money and access to the worldwide interception capabilities of NSA and its Five Eyes partners. This makes these 3rd Party partnerships especially attractive for smaller countries, for whom it means a sometimes substantial increase of their otherwise limited capabilities.

One big difference with the countries from the 2nd Party category is that 3rd Party partners do spy upon each other, and many of the Snowden-documents have shown this. From these documents we also learned that in 2013, there were 33 countries with 3rd Party status:

since 1954 1962 2005? 1954 1954 1949

CNO (19 countries) Austria Belgium Czech Republic Denmark Germany Greece Hungary Iceland Italy Japan Luxemburg Netherlands Norway Poland South Korea Spain Sweden Switzerland Turkey

3rd Parties (33 countries) Algeria Austria Belgium Croatia Czech Republic Denmark Ethiopia Finland France Germany Greece Hungary India Israel Italy Japan Jordan Macedonia Netherlands Norway Pakistan Poland Romania Saudi Arabia Singapore South Korea Spain Sweden Taiwan Thailand Tunisia Turkey UAE

SSEUR (14-Eyes) Belgium Denmark France Germany Italy Netherlands Norway Spain Sweden

SSPAC (10-Eyes) France India Singapore South Korea Thailand

The countries in the column under "CNO" are from a list which is in an undated NSA document about collaboration regarding Computer Network Operations (CNO). The document was first published on October 30, 2013 by the Spanish paper El Mundo and classifies cooperation on four different levels, which was also explained by The Guardian.

The first level is called "Tier A - Comprehensive Cooperation", which comprises Britain, Australia, Canada and New Zealand. A second group, called "Tier B - Focused Cooperation" includes the 19 mostly European countries listed above. A third group of "Limited cooperation" consists of countries such as France, Israel, India and Pakistan, and finally a fourth group is about "Exceptional Cooperation" with countries that the US considers to be hostile to its interests.

In May 2014, the list with the "Tier A" and "Tier B" countries was also published in Greenwald's book No Place To Hide, where he ignores the fact that the document was about CNO cooperation and simply assumes that the "Tier B" countries are the same as those with 3rd Party status.*

Map showing the 2nd Party and 3rd Party partners of NSA
(click to enlarge)

Cable tapping

NSA cooperates with the 3rd Party countries in many ways, one of which is in cable tapping operations. The NSA umbrella program for this is codenamed RAMPART-A. According to NSA's Foreign Partner Access budget for 2013, RAMPART-A provides access to long-haul international leased communications, with TURMOIL capabilities, and over 3 terabit/second of data from all "communication technologies such as voice, fax, telex, modem, e-mail internet chat, Virtual Private Network (VPN), Voice over IP (VoIP), and voice call records".
 

Direction-Finding

16 Third Party countries (Austria, Denmark, Ethiopia, Hungary, Israel, India, Italy, Japan, Jordan, Korea (South), Netherlands, Norway, Pakistan, Saudi Arabia, Sweden and Taiwan) also cooperate in the CROSSHAIR program. This consists of a worldwide network of antennas for High Frequency Direction-Finding (HFDF) and was implemented on October 1, 1993. CROSSHAIR consolidated the various military DF sites and also included those of the other Five Eyes/Second Party countries. Uncovered areas were eventually covered by the participation of the aforementioned Third Party countries.


Representatives

Initially, the representatives of NSA in major Third Party countries were called NSA/CSS Representative (NCR), just like their counterparts at military commands and other US government agencies. According to the United States Sigint Plan from 1985, there were the following NCRs:

NCEUR (NSA/CSS Representative Europe)
NCEUR/ISS (NSA/CSS Representative Europe / ? )
NCPAC (NSA/CSS Representative Pacific)
NCR CENTCOM (NSA/CSS Representative Central Command)
NCR DEF (NSA/CSS Representative Defense Department)
NCR FTD (NSA/CSS Representative Foreign Technology Division?)
NCRJ (NSA/CSS Representative Japan)
NCR KOR (NSA/CSS Representative Korea)
NCR LANT (NSA/CSS Representative ?)
NCR MAC (NSA/CSS Representative Military Airlift Command)
NCR NORAD (NCR North American Aerospace Defense Command)
NCR REDCOM (NSA/CSS Representative Readiness and Mobilization Command)
NCR SAC (NSA/CSS Representative Strategic Air Command)
NCR STATE (NSA/CSS Representative State Department)
NCR TAC (NSA/CSS Representative Tactical Air Command)

In 2006 the NCRs at embassies in support of Third Party agreements got the new title of Special US Liaison Advisor (SUSLA), followed by the name of the partner country.

The first SUSLA was for Italy, followed by the one for Germany, who is called Special US Liaison Advisor, Germany (SUSLAG). Other early SUSLAs were for Turkey (SUSLAT), Thailand (SUSLAB), Japan (SUSLAJ) and South-Korea (SUSLAK).

The office staff of such an advisor is called the Special US Liaison Activity (also abbreviated as SUSLA), and for example the SUSLA Germany had 18 personnel (12 civilians and 6 contractors) in 2012, a number which was to be reduced to 6 in 2013.*

The Special US Liaison Activity Japan (SUSLAJ) is led by a Chief and was originally located at Hardy Barracks under the cover name "5th Air Force Technical Liaison Office." In 2007 a new satellite office was opened in the US embassy in Tokyo, which is referred to as the "DoD Special Representative Japan-Tokyo" in unclassified channels. SUSLAJ's main facilities are on Yokota Air Base.

In 2005, the NSA had an SIGINT Liaison Officer (SLO) in Oslo, Norway, who was accompanied by a Technical Liaison Officer (TLO) given the heavy technical workload with the Norwegian intelligence service. This TLO also set up a direct communications link between the Finnish Intelligence Research Establishment and the NSA and NGA.

It is not clear whether the various Third Party agencies also have a representative at NSA headquarters and if so, what their title is.


Foreign Affairs Directorate

At NSA these foreign relationships are managed by the Foreign Affairs Directorate (FAD), which has a Country Desk Officer (CDO) for every country or region that matters. For matters related to Second Party partnerships there's the FAD has the Second Party Affairs Office (DP11) consisting of five officers based at Fort Meade.

 

Multilateral groups

Although the Third Party relationships are strictly bilateral, some of these countries have also worked very close with each other for a long time. This has been formalized into a few multilateral groups in which intelligence is exchanged not only between one particular country and the US, but also among all other participants. The following three SIGINT sharing groups are known:
 

SIGINT Seniors Europe (SSEUR)

This group consists of the Five Eyes and nine European countries: France, Germany, Spain, Italy, Belgium, the Netherlands, Denmark, Norway and Sweden. Except for Sweden, all are NATO members. After the number of countries, the SSEUR are also called 14-Eyes.

The "Seniors" refers to the heads of the participating military or signals intelligence agencies, who in this group coordinate the exchange of military intelligence according to the needs of each member.

A BND document mentions that in February 2014, there was a conference of the leaders of the "core group" of the SSEUR, but it wasn't mentioned which countries are part of that core group.

There's also a SIGINT Seniors Europe Counter Terrorism (SISECT) coalition* with the same members, excluding Australia and New Zealand. SISECT organizes a semi-annual conference* and in 2013, NSA encouraged GCHQ to host the permanent facility for the joint SSEUR collaboration center.*

> More about the SIGINT Seniors Europe

 

Updates:

A new multilateral intelligence sharing group seems to be the SIGINT Support to Cyber Defense (SSCD) initiative, which consists of a number of countries that together establish an early-warning system to defend themselves against cyber attacks. Its existance was first mentioned on May 8, 2014 in a speech by president Schindler of the German intelligence service BND, which is also cooperating in this SSCD framework. SSCD will use traditional SIGINT methods to inspect data packets for things like malicious code so these can be eliminated pro-actively.

From a document dated July 23, 2013 from the German parliamentary inquiry commission, which was published by Wikileaks on December 1, 2016, we learn that "within the SSCD-working group of an international SIGINT coalition, BND exchanges information about the international detection of cyber attacks." This international SIGINT coalition is most likely the SSEUR or 14-Eyes group, which means the SSCD-cooperation that Schindler mentioned in his speech seems to be an SSEUR sub-group similar to the SISECT.

 

SIGINT Seniors Pacific (SSPAC)

There's a similar group for multilateral exchange of military intelligence among some 3rd Party nations from the East Asia/Pacific Rim region. Besides the members of the Five Eyes, the SIGINT Seniors Pacific include Singapore, South Korea and most likely Japan and Thailand. Probably one other country is participating too, making this group also being identified as the 10-Eyes.

Updates:

An NSA document disclosed by The New Zealand Herald on March 11, 2015 says that the SSPAC consists of the Five Eyes plus France, India, (South) Korea, Singapore and Thailand.

According to NSA's internal SIDtoday newsletter from June 9, 2005, a formal Principals Board and Executive Board were established for the SSPAC and its initial focus was to share intelligence on counter-terrorism (CT), including banking information and follow-the-people, in order to provide warning of imminent terrorist threats to member nations. Additional topics such as counter-proliferation would be considered later.

As a sister organization to the European Technical Center (ETC) in Wiesbaden, Germany, a Pacific Technical Center (PTC) was established in 2003 at the facilities of the NSA/CSS Representative Japan (NCRJ) in Yokota Air Base, Japan. The PTC provides technical and logistical services to cryptologic missions in the Pacific Theater.

In 2007, the NSA developed a secure network codenamed CRUSHED ICE for exchanging CT-related information among the SSPAC members.

In January 2020, a new group was formed for exchanging data on a range of areas, including intelligence activities on North Korea as well as on China's military, cyber and space activities. The group consists of the Five Eyes countries plus Japan, France and South Korea. The latter three will be given enhanced, but still limited, access because they're not full members of Five Eyes.

> More about the The 6, 8 and 10 Eyes

 

Afghanistan SIGINT Coalition (AFSC)

According to an NSA paper from 2013, this group consists of the same 14 countries as the SSEUR and is aimed at sharing Afghanistan-related intelligence reports and metadata among its participants. At the time of the paper, each AFSC-member was responsible for covering a specific area of interest, probably corresponding to the region in Afghanistan where they had troops deployed.

Snowden and Greenwald apparently agreed not to publish about NSA's involvement in Afghanistan, but the German book about the Snowden-leaks, Der NSA Komplex, reveals that the 14 AFSC-members cooperated closely in decrypting and analysing mobile communications and have a dedicated data center codenamed CENTER ICE for exchanging this kind of intelligence.*

This makes it likely that much of the metadata that various European countries shared with the US, mistakenly presented by Glenn Greenwald as NSA spying on European citizens, was collected as part of this Afghanistan SIGINT Coalition.

Update:

In May 2019, the website The Intercept revealed that the AFSC started in 2009 with nine members and was therefore also known as the 9-Eyes. Subsequently the number of members grew to the same 14 countries that already made up the SIGINT Seniors Europe or 14-Eyes.
Members of the AFSC collected GSM metadata through DRT devices and feeded them into the NSA's Real Time Regional Gateway (RT-RG) system. These telephone metadata would later appear in various charts from the NSA's data visualization tool BOUNDLESSINFORMANT. The AFSC existed at least until the end of 2014.

> More: From 9-Eyes to 14-Eyes: the Afghanistan SIGINT Coalition (AFSC)

Links and Sources
- Engelsberg Ideas: Five Eyes: the past, present and future of the world’s key intelligence alliance (2021)
- BBC: Diary reveals birth of secret UK-US spy pact that grew into Five Eyes (Febr. 2021)
- Swissint.ch: Die Nachrichtendienste und ihre geheimen Klubs: Ein Einblick in die unbekannte Seite der Antiterrrorkooperation in Europa (Oct. 2018
- The Intercept: The powerful global spy alliance you never knew existed (March 2018)
- Lux ex Umbra: Five Eyes SIGINT governance: Meetings galore
- Stratfor.com: Five Eyes and the Perils of an Asymmetric Alliance (2017)
- NSA document about Foreign Relations Mission Titles
- About Canada and the Five Eyes Intelligence Community (2012)
- Duncan Campbell, Echelon and its role in COMINT
- Declassified NSA paper about Third Party Nations: Partners and Targets