New Snowden-docs about NSA and Sweden

* (S//SI//REL) SSEUR members are the Five Eyes nations (Australia, Canada, New Zealand, United Kingdom and United States) and the following
Third Party partners: Belgium, Denmark, France, Germany, Italy, Netherlands, Norway, Spain, Sweden. All Third Party nations in SSEUR set students
to the training, as did the UK.

TOP SECRET//COMINT//NOFORN

National Security Agency/Central        18 April 2013
Security Service

Information Paper

(S//REL to USA, FVEY) Subject: NSA Intelligence Relationship with Sweden

(U) Introduction

(S//REL TO USA, FVEY) NSA's relationship with the Swedish SIGINT service, Forsvarets Radioanstalt (FRA), was established in 1954 under the UKUSA agreement. At that time it was agreed that GCHQ would take the lead for the exchange of COMINT information and that NSA would take the lead for the ELINT exchange. As of April 2004, NSA, GCHQ and the FRA agreed to dissolve this part of the UKUSA agreement and hold bilateral exchanges on both COMINT and ELINT.

(TS//SI//NF) NSA's relationship with the FRA, an extremely competent, technically innovative, and trusted Third Party partner, continues to grow. The FRA provided NSA with access to its cable collection in 2011, providing unique collection on high-priority Russian targets such as leadership, internal politics, and energy.

xxxxxxxxxx. FRA's efforts against counter-terrorism (CT) targets continue to expand, and new legislation enacted in January 2013 has improved its ability to work directly with the Swedish internal security service (SÄPO). NSA's Data Acquisition is actively engaged with the FRA, which has numerous collection sites and is proficient in collecting a wide variety of communications.

(U) Key Issues

xxxx xxxx xxxx xxxxx
xxxx xxxx xxxx xxxxx
xxxx xxxx xxxx xxxxx
xxxx xxxx xxxx xxxxx
xxxx xxxx xxxx xxxxx

(TS//SI//NF) The FRA continues to place more emphasis on cyber. NSA's National Threat Operations Center (NTOC) and FRA have an ongoing exchange discussing malware topics. The FRA is positioning itself to become the cyber defense authority in Sweden and hopes to receive the Swedish government mandate in the near future.

Derived From: 1-52
Dated: 20070108
Declassify On: 20320108

TOP SECRET//COMINT//NOFORN

TOP SECRET//SI//NOFORN

What You Wanted to Know

Review SID’s goals for this quarterly.

Note that just about all of the accomplishments we are presenting respond to some aspect of SID’s strategies for the foreign partner. The few that don’t involve those niche partners for whom our strategy is to simply maintain a viable relationship that we can rely on should we need it in the future. And that these are only some of the accomplishments for FY13…there are way too many to address in just an hour.

When it comes to discussing the challenges and roadblocks that we believe are going to make it difficult if not impossible to accomplish specific items, the causative factors are divided between NSA and partner budget cuts, legal and policy impediments on the partner side, and in a few cases partner unwillingness to cooperate or meet their obligations to us.

….........

…..........

Select Accomplishments: Production (second slide)

(TS//SI//NF) Sweden: This is the DIRNSA-initiated Quantum trilat between NSA, GCHQ, and FRA. While the overall success rate has been low, the effort can be considered a success in terms of proof of concept. Continued GCHQ involvement may be in jeopardy due to British legal/policy restrictions, and in fact NSA’s goal all along has been to transition this effort to a bilat with the Swedish partner.

TOP SECRET//SI//NOFORN

TOP SEKRET//COMINT//NOFORN

VISIT PRÉCIS

SWSOUSA 2013 STRATEGIC PLANNING CONFERENCE (SPC)

MR. INGVAR ÅKESSON
DIRECTOR GENERAL
FORSVARETS RADIOANSTALT (FRA)
SWEDEN
24-26 APRIL 2013

GEN A Opening Remarks: 24 April 2013//0800-0815
GEN A Hosted Discussions: 24 April//1130-1200
EXDIR Hosted Lunch: 24 April 2013//1200-1245 - Canine Suite
GEN A Hosted Dinner: 25 April 2013//1830 - Quarters
Accompanying Senior: Mr. James M. Cusick, Director Foreign Affairs (DIRFA)

BACKGROUND:

• (S//REL TO USA, SWE) Mr. Ingvar Åkesson (OH-kes-son) has been the FRA Director- General since 2003. He was slated to retire last August, but was extended until August 2013. He will be accompanied by Ms. Christina Malm, D/DIR, FRA. The remainder of the delegation includes:
  • Ms. Lena Nyberg, SIGINT Director, FRA
  • Mr. Mats Nordqvist, Technical Director, FRA
  • Mr. xxxx xxxxxxxxx, Strategic Advisor Chief Studies and Development, FRA
  • Ms. xxxx xxxxxxxxx, Chief Foreign Relations Officer, FRA

PURPOSE OF THE VISIT:

(S//REL TO USA, SWE) Each year a high-level FRA delegation visits NSA/CSS to attend the SWEDUSA SPC. Discussions will center on topics of mutual interest and future areas of collaboration. It also presents an opportunity for NSA/CSS leadership to reiterate their commitment to the Swedish partnership.

VISITOR REQUESTED:

(TS//REL TO USA, SWE) FRA requested a WINTERLIGHT (Quantum project) update and asked to hear about our plans for sharing reports on Quantum tipping or intercepts from the Quantum tipping. FRA plans to start the conference by giving an overview of its SIGINT Roadmap, to include Russia, XXX XXXX XXXXXX XXXXXXX XXX XXXXXX XXX XXXX XXX XXX XXX XXX XX XXXX. It will also provide a Cyber update--specifically briefing NSA on its new cyber division, its active and passive sensors and tradecrafi collaboration with NSA/CSS Threat Operations Center (NTOC); updates on the special

Derived From: NSA/CSSM 1-52
Dated: 20070108
Declassify On: 30320108

TOP SEKRET//COMINT//NOFORN

---

TOP SEKRET//COMINT//NOFORN

project and NAPA-3; and a discussion of how new legislation has helped improve the FRA-Swedish Security Service (SÄPO) relationship.

TOP SEKRET//COMINT//NOFORN

---

TOP SEKRET//COMINT//NOFORN

CDR/DCDR/DDIR GUIDANCE: (U) NKA

PREP SESSION GUIDANCE:

• (U) Due to the nature of the visit, no specific guidance has been conveyed to other participants.

NSA/CSS REQUESTED:

• (U//FOUO) Further Cyber Securityr'Defense Cooperation;
• (S//REL TO USA, SWE) Future CT cooperation (value of CT Deployed Analyst);
• (S//REL TO USA, SWE) Status of relationship between FRA and SAPO under the new legislation;
• (TS//REL TO USA, SWE) Computer Network Exploitation (CNE) Update;
• (TS//REL TO USA, SWE) Update on special project;

CYBERCOM REQUESTED: (U) NIA

COMMON THREADS:

• (S//REL TO USA, SWE) Emphasize the value of the NSA-FRA partnership.

KEY TAKEAWAYS:

(S//REL TO USA, SWE) Recommend General Alexander and DIDIR emphasize the following points:

Quantum Operations:

• (TS//SI//REL TO USA, SWE) Acknowledge the success that NSA, FRA, and GCHQ have had on WINTERLIGHT. Last month, we received a message from our Swedish partner that GCI-IQ received FRA QUANTUM tips that led to 100 shots, five of which were successfully redirected to the GCHQ server. The Foreign Affairs Directorate (FAD) confirmed with Tailored Access Operations (TAO) that this validates the "proof of concept" that was originally trying to be accomplished. Additionally, FAD, TAO, and Enterprise information Technology Services are still working through the technical solution to have FRA tip directly to NSA. S3 Data Acquisitions' goal is to have a solution for a direct tip to RA operational by this summer. The Quantum effort motivated the recent XKEYSCORE installation. FRA is currently evaluating it for use to support their SIGTNT Development work.

Cable Aceessmeporting and Analysis:

• (TS//SI//REL TO USA, SWE) Highlight that NSA/CSS would like to continue to collaborate on FRA's cable access program, which has resulted in unique SIGINT reporting on a variety of high-priority SIGINT topics (123 reports thus far this fiscal year). FRA continues to gain access to more data from additional telecommunications companies, making the cable access potentially lucrative for for targets beyond Russia.

TOP SEKRET//COMINT//NOFORN

---

TOP SEKRET//COMINT//NOFORN

Cyber:

• (TS//REL TO USA, SWE) Stress that NTOC is ready to seriously engage with FRA on cyber defense. Mr. Åkesson has reviewed the Memorandum of Undersanding (MOU) and has no changes; therefore, we would like to have an official signing during the 24 April 1130-1200 discussions.
• (TS//SI//NF) NTOC shared som information with FRA about a Swedish intrusion in November 2012. FRA came in with questions in February 2013 that led NTOC to do more analysis. Subsequently, NTOC reached the same conclusion as FRA, that it involved the Israeli Embassy in Stockholm. FRA asked if it could alert Israel and NTOC agreed that it could tell Israel about the instruction. Isreel's identity was never compromised.

Secure VTC Capability

• (S//REL TO USA, FVEY) Encourage FRA to set up its equipment soonest to allow for secure VTC capability. That capability already exists with Norway and Denmark and has shown benefit in expanding analytic collaboration on a myriad of issues. FRA's technology directorate is just waiting on requirements from its SIGINT directorate to be able to finalize the set-up and installation.

Counterterrorism:

• (TS//SI//REL TO USA, SWE) NSA/CSS' Counterterrorism (CT) analysts and FRA continue to cooperate and collaborate on CT threat-related activities in Europe. Several analyst-to-analyst meetings have taken place and European Cryptologic Center (ECC) in Darmstadt, Germany, is formally coordinating a Staff Processing Form (SPF) to have Sweden assist NSA/CSS with high-priority CT Swedish language traffic that ECC is currently unable to fully analyze. In January 2013, CT established its first CT deployed analyst position in Stockholm. Also in January, FRA and SÄPO were legally allowed to collaborate after a 4-year hiatus.
• (S//SI//REL TO USA, SWE) Encourage increased collaboration on CT threat streams.

Russia:

• (S//SI//REL TO USA, SWE) Thank Sweden for its continued work on the Russian target, and underscore the primary role that FRA plays as a leading partner to work the Russian target, including Russian leadership, energy, xxxxxxxxx and xxxxxx and xxxxxx counterintelligence. FRA's cable access has resulted in unique SIGINT reporting on all of these areas.
• (S//SI/REL TO USA, SWE) Encourage continued collaboration and sharing of reporting on Russian topics.

TOP SEKRET//COMINT//NOFORN

---

TOP SEKRET//COMINT//NOFORN

VISIT FORMAT:

• (S//REL TO USA, SWE) GEN Alexande's opening remarks will set the tone for a productive conference.
• (S//REL TO USA, SWE) FRA will provide briefings on FRA's SIGINT Roadmap; its new cyber division; its relationship with the Swedish Internal Security Service, SÄPO; and updates on the special project and NAPA-3.
• (U//FOUO) NSA Participants: SID DIR, DIRFA, Associate D/DIR for CT, GCM, Russia Production Center, GCM, Office of South Asia, GCM, Office of China/Korea, NTOC, NCSC, SSO, Special Projects Office (LEGEND).

PREVIOUS VISITS AND RESPECTIVE TOPICS:

• (S//REL TO USA, SWE) Mr. Åkesson last visited NSA/CSS for SWEDUSA in May 2012.

POTENTIAL LANDMINES: (U) None.

OTHER INFORMATION: (U) None.

RECENT PRESS INDICATIONS: (U) None.

Sweden

(TS//S1) Based on a 1954 agreement between NSA and GCHQ (later ratified in the 1956 UKUSA accords). GCHQ had the lead with Sweden for COMINT matters. NSA had the lead for ELINT and: as things evolved, technical SIGINT issues for both OMINT and ELINT. In 2004 we mutually agreed that our 50-year-old arrangement was no longer operable since we,

(TS//S1) Therefore, we drafted a paper that was signed by NSA's Principal Director for Foreign Affairs, GCHQ's head of Foreigt Relations, and the Director General of Sweden's SIGINT Service (FRA), allowing to deal with the FRA on COMINT issues without pre-coordination with GCHQ. The paper also requires both of us to keep the other informed as to what we are doing with the FRA, and requires the FRA to dedupe if both GCHQ and we are separately asking for the same or similar exchanges. As a result of this change, our COIVIINT relationship with the RA has burgeoned on both sides. The relationship with Sweden is protected at

the TOP SECRET level because of that nation's political neutrality.

1. If you know the particular website the target visits. For this example, I'm looking
for eveiyone in Sweden that Visits a particular extremist web forum.

Search: HTTP Activity

Query Name: HTTP_in_Sweden
Justification: SwedishExtremist website visitors
Additional Justification:
Miranda Number:
Datetime: 1 Week    Start: 2009-01-20    00:00
HTTP Type:
Host: *.com
Country: SE

The website URL (aka "host) is entered in with a wildcard to account for "www" and "mail" other hosts.

To comply with USSID-18 you must AND that with some other information like an IP or country

(TS//SI//NF) NSA's relationship with the FRA, an extremety competent,technically innovative, and trusted Third Party partner, continues to grow. The FRA provided NSA with access to its cable collection in 2011, providing unique collection on high-priority Russian targets such as leadership, internal politics, end energy. Other topics xxxxxx xxxxxxxxxxxx Russia and the Baltic region include countering foreign intelligence and military. FRA's efforts against counter-terrorism (CT) targets continue to expand, and new legislation enacted in January 2013 has improved its ability to work directly with the new iegisietidn enacted in Jen uer1.r 2013 has its ehirity td wdrit directiy with the Swedish internal security service (SÄPO). NSA's Data Acquisition is actively engaged with the FRA, which has numerous collection sites and is proficient in collecting a wide variety of communications.

(U) Key Issues

...

TOP SECRET//COMINT//REL USA, AUS, CAN, GBR, NZL

Select Accomplishmems: Production

Sweden: Realization of DIRNSA-proposed trilat to work Quantum.

TOP SECRET//SI//NOFORN

AGENDA

As of: 23 April//1000

PROTOCOL REP: VISIT MANAGER:
DATE OF VISIT:	(U) 24-26 April 2013 24 April 2013//0745-1600; 25 April 2013//0845-1545; 26 April 2013//0800-1300
VISITOR:	MR. INGVAR ÅKESSON
TITLE:	(U) Director General
COUNTRY/ ORGANIZATION:	(U//FOUO) Sweden/Forsvarets Radioanstalt (FRA)
EQUIVALENCY:	(U//FOUO) Director, NSA
ACCOMPANIED BY:	(U//FOUO) MS. CHRISTINA MALM D/DIR, FRA MS. LENA NYBERG SIGINT Director, FRA MR. MATS NORDQVIST, Technical Director, FRA MR. xxxxxxx xxxxxxx (25 and 26 April only) Strategic Advisor Chief Studies and Development MS. xxxxxxx xxxxxxx CH Foreign Relations Officer MS. xxxxxxx xxxxxxx Special Liaison Officer (SLO)
INTERPRETER:	(U) No.
PREVIOUS VISITS:	(S//REL TO USA, SWE) Mr. Åkesson's last visit to NSA/CSS was in May 2012 for the SWEDUSA Conference.
CLEARANCES:	(U) TS//SI
ACCOMPANYING NSA/CSS:	(U//FOUO) MR. JAMES M. CUSICK
SENIOR:	Director Foreign Affairs (DIRFA)
PHOTOGRAPHER:	(U) No.
MEMENTO PRESENTED:	(U) No.
UNIFORM OF THE DAY:	(U) GEN A: Class B; D/DIR and Guests: Business Attire.
PURPOSE OF VISIT:	(S//NF) SWEDUSA Strategic Planning Conference. This conference will give the Directorate the opportunity to assess the state of the relationship and discuss other areas of mutual cooperation such as joint collection initiatives, cyber defense and security and Quantum (TAO) operations.
JUSTIFICATION FOR DIRECTORATE INVOLVEMENT:	(U//FOUO) Level of the visitor justifies Directorate involvement.
EXPECTED OUTCOME:	Another year of close, expanded cooperation on a number of fronts with one of our most trusted partners.

Chief of Protocol
and Corporate Events
NSA/CSS Protocol Office

Derived From: 1-52
Dated: 20070108
Declassify On: 20380301

TOP SECRET//SI//NOFORN

TOPSECRET//SI//NOFORN

SWEDUSA/MR. MR. INGVAR ÅKESSON
24 APRIL 2013
Time	Presentation Title and Presenter	Location
0745	(U//FOUO) Welcome Mr. Ingvar Åkesson Ms. Christina Malm Ms. Lena Nyberg Mr. Mats Nordqvist xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx Met and escorted by Mr. James M. Cusick, DIRFA, xxxxx xxxxx, CDO; and xxxxx xxxxx, NSA/CSS Protocol Officer.	GH 2B
0800-0815	(U//FOUO) Directorate Opening Remarks GEN Keith B. Alexander, U.S. Army, DIRNSA/CHCSS Mrs. Frances J. Fleisch, EXDIR	2B8l56
0815-0915	(U//FOUO) Forsvarets Radioanstalt (FRA) SIGINT Roadmap Discussions Mr. Ingvar Åkesson	2B8l56
0915-0930	(U//FOUO) Office of China-Korea Discussions (OCK) Ms. xxxxx xxxxx, Global Capabilities Manager (GCM), OCK	2B8l56
0930-0945	(U) Break	2B8l56
0945-1015	(U//FOUO) Signals Intelligence Directorate (SID) Courtesy Call Ms. xxxxx xxxxx, SIGINT DIR	2W102
1015-1030	(U) Break	2B8l56
1030-1125	(U//FOUO) Russia Production Center Discussions Mr. xxxxx xxxxx, GCM, Office of Russia	2B8l56
1130-1200	Directorate Hosted Discussions (10) GEN Keith B. Alexander, U.S. Army, DIRNSA/CHCSS Mrs. Frances J. Fleisch, EXDIR Mr. Ingvar Åkesson Ms. Christina Malm Ms. Lena Nyberg Mr. Mats Nordqvist Mr. James M. Cusick, DIRFA Ms. xxxxx xxxxx NOTE: A memento will not be presented. A photographer will not be present.	2B8036 GEN A's Ofc.
1200-1245	(U//FOUO) Directorate Hosted Lunch Mrs. Frances J. Feisch, EXDIR (Host) (By Invitation Only)	Canine Suite
1245-1300	(U) Break
1300-1400	(U//FOUO) Counterterrorism (CT) Production Center Discussions Ms. xxxxx xxxxx, Deputy SID CT Mr. xxxxx xxxxx, GCM CT	2B8156
1400-1415	(S//REL USA, SWE) FRA and Swedish Security Service (SÄPO) Partnership Discussions Mr. Ingvar Åkesson	2B8156
1415-1515	(U//FOUO) Afghanistan Discussions Ms. xxxxx xxxxx, GCM Office of South Asia (OSA) Ms. xxxxx xxxxx, Chief of Operations, OSA Ms. xxxxx xxxxx, Foreign Affairs Officer, OSA	2B8l56
1515-1600	(U//FOUO) SIGINT Seniors Europe (SSEUR) and NATO Advisory Committee on Special intelligence (NACSI) Discussions Mr. xxxxx xxxxx, SIGINT Seniors Europe Executive Officer, Foreign Affairs Directorate (FAD) Mr. xxxxx xxxxx Jr., NATO Affairs Officer - SIGINT, FAD	2B8156
1600	(U) Depart	GH 2B
Derived From: 1-52 Dated: 20070108 Declassify On: 20380301

TOPSECRET//SI//NOFORN

TOPSECRET//SI//NOFORN

SWEDUSA/MR. MR. INGVAR ÅKESSON
25 APRIL 2013
Time	Presentation Title and Presenter	Location
0845	(U//FOUO) Arrival	GH 2B
0900-0930	(S//REL USA, SWE) FRA Cyber Defense Strategy Discussions Mr. Ingvar Åkesson	2B8156
0930-1000	(U//FOUO) NSA/CSS Threat Operations (NTOC) Office of Analysis Discussions Ms. xxxxx xxxxx, D/CH Cyber Threat Assessment and Attribution Mr. xxxxx xxxxx, Lead, xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx xxxxx Designee Mr. xxxxx xxxxx, Enduring Cyber Threat Manager	2B8156
1000-1030	NTOC Office of Operations Discussions Mr. xxxxx xxxxx, Office of Cyber Operations and Threat Pursuit Mr. xxxxx xxxxx, D/Tech DIR, NTOC Office of Operations	2B8l56
1030-1045	(U) Break	2B8156
1045-1130	(U//FOUO) Special Projects Office Discussions Mr. xxxxx xxxxx, DIR Special Projects, NTOC	2B8156
1130-1145	(U//FOUO) FRA VIVIAN Update Discussions Mr. Ingvar Åkesson	2B8l56
1145-1200	(U) Break	2B8l56
1200-1300	(U//FOUO) NTOC Hosted Lunch Mr. xxxxx xxxxx, DIR Special Projects, NTOC (Host) (By Invitation Only)	Canine Suite
1300-1400	(TS//SI//REL USA, SWE) QUANTUM and Computer Network Exploitation (CNE) Cooperation Discussions Mr. Gregory L. Smithberger, CH TAO Mr. Robert E. Joyce, CH TAO Designee Mr. xxxxx xxxxx, Tech DIR, Data Acquisition Mr. xxxxx xxxxx, CH Remote Operations Center (ROC) Mr. xxxxx xxxxx, CH Special Tactics and Techniques	2B8156
1400-1415	Global Collaborative Environment (GCE) Discussions Mr. xxxxx xxxxx, Foreign Strategist, Technology Directorate (TD) CAPT xxxxx xxxxx, USN, SIGTNT Development (SIGDEV) Strategy and Governance, Foreign Partner Lead Mr. xxxxx xxxxx, Jr., Tech DIR, Partner Solutions Mr. xxxxx xxxxx, Foreign Affairs Officer, TD	2B8156
1415-1430	(U) Break
1430-1500	(U//FOUO) NTOC Directorate Courtesy Call Mr. xxxxx xxxxx, Jr., DIR NTOC	2A0218-G
1500-1515	(U) Break
1515-1530	(S//REL USA, SWE) FRA: NAPA 3 Discussions Mr. Ingvar Åkesson	2B8156
1530-1545	(U//FOUO) Closing Remarks Mr. James M. Cusick, DIRFA	2B8156
1545	(U) Depart	GH 2B
1830	(U//FOUO) Directorate Hosted Dinner GEN Keith B. Alexander, U.S. Army, DIRNSA/CHCSS (Host) Mrs. Frances F. Fleisch, EXDIR (By Invitation Only)	GEN A's Residence
Derived From: 1-52 Dated: 20070108 Declassify On: 20380301

TOPSECRET//SI//NOFORN

TOPSECRET//SI//NOFORN

SWEDUSA/MR. MR. INGVAR ÅKESSON
26 APRIL 2013
Time	Presentation Title and Presenter	Location
0800	(U//FOUO) Arrival	GH 2B
0815-0845	(U//FOUO) PartnerMall Program to GCE Transition Discussions Mr. xxxxx xxxxx, Technology Directorate (TD) Foreign Strategist Mr. xxxxx xxxxx, Jr., Tech DIR, Partner Solutions Mr. xxxxx xxxxx, Foreign Advisory Officer, TD	2B8156
0845-0900	(U//FOUO) Commercial Solutions Center (NCSC) Ms. xxxxx xxxxx, Manager, Platform Manager, Industry Services Division, NCSC	2B8l56
0900-0930	(U//FOUO) TURTLEPOWER and Turmoil Discussions Ms. xxxxx xxxxx, Computer Technologies Exploitation Applications (CTEA) Mr. xxxxx xxxxx, D/CH Protocol Exploitation Mr. xxxxx xxxxx, Protocol Exploitation	2B8l56
0930-0945	(U) Break
0945-1015	(U//FOUO) XKS Sessions and Discussions Mr. xxxxx xxxxx, Program Technical Director Mrs. xxxxx xxxxx, Program Manager, WINTERLIGHT Mr. xxxxx xxxxx, Special Source Operations (SSO) Systems Engineer	2B8l56
1015-1115	(TS//SI//REL USA, SWE) QUANTUM Discussions Mr. xxxxx xxxxx, CH Remote Operations Center (ROC) Mr. xxxxx xxxxx, CH Special Tactics and Techniques Mr. xxxxx xxxxx, Tech DIR, ROC	2B8l56
1115-1130	Break
1130-1230	(U//FOUO) Data Acquisitions Hosted Lunch Mr. xxxxx xxxxx, Technical DIR, Data Acquisition (Host) (By Invitation Only)	Canine Suites
1230-1300	(U//FOUO) Actions Review and Conference Wrap-up Ms. xxxxx xxxxx, CDO Sweden	2B8l56
1300	(U) Depart Met and escorted by Mrs. xxxxx xxxxx, NSA/CSS Protocol Office.	GH 2B
Derived From: 1-52 Dated: 20070108 Declassify On: 20380301

TOPSECRET//SI//NOFORN

In order to deploy these stains at scale across machines used by the extremist community in xxxxxx it was decided to target machines where the users visited extremist web forums. QUANTUM was the technique used to deliver the stains to each target machine. QUANTUM is CNE's mechanism that leverages GCHQ's huge passive SIGINT accesses te deliver CNE payloads to targets. As this is a very new approach to tackling a tough target, it took 12 months for policy, collection, processing and CNE issues to be resolved, but after a lot hard work by some committed individuals across Benhall, Bude and SOUNDER, successful implementatioin of staining at scale was achieved.

SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

X-KEYSCORE
TOR Log

• Logs any identified TOR routers used for anonymizing Internet traffic
• Searchable fields
  • TOR from server
  • TOR to server
  • Router nickname

SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL

---

TOP SECRET//COMINT//ORCON, REL TO USA, AUS, CAN, GBR and NZL//20291123

"Slowing down the Internet"

• XKS goal is to store the full-take content for 3-5 days, effectively "slowing down the Internet so that analysts can go back and cover sessions that otherwise would have been dropped by the front end"
• Meta-data is saved off longer, with the goal of 30 days retention
• A lot of analysis can be done through meta-data only (MARINA is meta-data only)

TOP SECRET//COMINT//ORCON, REL TO USA, AUS, CAN, GBR and NZL//20291123

---

TOP SECRET//COMINT//ORCON, REL TO USA, AUS, CAN, GBR and NZL//20291123

What makes XKS so good at SIGDEV?

• XKS gives analysts unique access to terabytes of content and meta-data
• Typically sites select and forward to PINWALE less than 5% of the DNI they're processing
• The rest of that data used to be dropped but is now being retained temporarily and made available to analysts through X-KEYSCORE
• As an example, at one our sites XKS sees more data per day than all of PINWALE

TOP SECRET//COMINT//ORCON, REL TO USA, AUS, CAN, GBR and NZL//20291123

TOP SECRET//COMINT//REL TO USA, FVEY

Data Sources

• FORNSAT (downlink)
• Overhead (uplink)
• Special Source
• Tailored Access
• F6
• FISA (limited)
• 3rd party

TOP SECRET//COMINT//REL TO USA, FVEY