There aren't many novel revelations from the Snowden-documents anymore, but of late an NSA document was published telling how the agency prepared the interception of communications from the Venezuelan oil society Petróleos de Venezuela, S.A. (PdVSA).
It's non a rattling spectacular disclosure, but it gives a overnice insight inwards what an NSA analyst genuinely does. The story was published on Nov xviii past times the website The Intercept in addition to the Latin-American broadcaster teleSUR.
Most people volition get got read The Intercept's report, but that misses i of the most interesting details of the story. Here, the disclosed NSA document volition hold out discussed inwards full, amongst details explained based upon information from before disclosures.
Building of PdVSA inwards Maracaibo amongst on its facade Fidel Castro's motto
"Patria, Socialismo o Muerte" (Fatherland, Socialism or Death)
(Photo: Reportero24)
The document that was published is an The Intercept in addition to the Latin-American broadcaster S2C13 is business office of the International Security Issues (ISI) Product Line, which is responsible for analysis in addition to production of intelligence almost countries inwards Europe, South-America in addition to elsewhere.
Intelligence requirements
As the analyst recalls, a year-end review had shown that at that spot was no progress on the "Venezuelan Energy target set" every bit most reporting came from warranted collection. That could refer to PRISM in addition to Upstream collection nether department 702 FAA, but that entirely requires annual certifications approved past times the FISA Court. Strictly spoken, private warrants are entirely needed for "traditional FISA" collection, similar for illustration for eavesdropping on the Venezuelan diplomatic mission inwards Washington.
The analyst decided to practise a "target reboot", which he describes every bit "taking a fresh await at opportunities for collection". He origin looked at specific Information Needs (INs) in addition to used SURREY, which is the primary NSA requirements database.
These requirements are the consequence of an administrative The Intercept in addition to the Latin-American broadcaster Strategic Mission List, which was published inwards Nov 2013.
This document lists Venezuela every bit i of half-dozen countries that are treated every bit "enduring targets". According to this document, NSA should "Provide U.S. determination makers amongst a holistic SIGINT perspective of regional trends in addition to developments" in addition to also "Provide indicators of regime stability, peculiarly inwards the liberate energy sector":
Section almost Venezuela inwards the 2007 Strategic Mission List
(Click to enlarge)
Economic or commercial espionage?
The Intercept makes a indicate out of NSA targeting a stone oil society "for economical espionage" - before disclosures had already brought upward the names of the Brazilian society Petrobras in addition to Gazprom from Russia. Why that should hold out a occupation isn't explained however: all iii companies are government-controlled in addition to oil is an number of strategic involvement for almost whatever country.
The website also cites US Director of National Intelligence James Clapper, who explained the departure betwixt gathering intelligence on economical issues for authorities policy makers (which the US admits doing), in addition to stealing merchandise secrets of unusual companies to assist private American corporations (which the US strongly denies doing). And inwards this case, there's (again) no evidence for the latter.
Collaboration
The story of the analyst in addition to thus continues amongst that he met amongst the Target Office of Primary Interest (TOPI) responsible for Venezuelan targets, inwards guild to "re-assure myself that nosotros were both on the same page inwards regards to our goals". Influenza A virus subtype H5N1 TOPI consists of analysts who analyse the communications that come upward inwards every bit a resultant of the collection procedure in addition to who ready the intelligence reports.
These origin steps demonstrate that NSA analysts operate inside a bureaucratic framework that requires collaboration amongst colleagues in addition to superiors who brand sure their activities are inwards accordance amongst the goals laid past times the authorities - every bit a rule, they're non costless to target anyone at will, which is the impression people tin privy larn when listening to Edward Snowden.
Get started
The TOPI analyst wanted information from the highest marker of PdVSA, i.e. from the president in addition to members of the Board of Directors, every bit much of it every bit possible inwards the shape of cyberspace communications, which, dissimilar telephone calls, don't get got to hold out transcribed. Also at that spot was no fourth dimension for "extensive target development".
Then the SIGDEV analyst started his work. He origin visited the The Intercept in addition to the Latin-American broadcaster Analyst's Notebook, which is an analysis tool widely used past times intelligence in addition to constabulary enforcement agencies all over the world.
Demonstration of a "Pattern-of-Life Analysis" using Analyst's Notebook
Sigint already-collected
The adjacent measuring was looking at what had already been collected almost his targets. For this he origin accessed the PINWALE database, which is NSA's primary repository for all kinds cyberspace content that was collected past times using specific selectors (i.e. no volume content collection).
Influenza A virus subtype H5N1 few queries, using the names he had flora on the website, returned non much of interest: a lot of e-mails inwards which these persons were "cc-ed", but hardly anything to or from them personally. This also provided some e-mail addresses, but the analyst already knew these.
He entered the postal service addresses into CADENCE, which is NSA's tasking tool for cyberspace communications, in addition to also into the Unified Targeting Tool (UTT). This would demonstrate whether these e-mail addreses were already tasked, which agency whether the actual collection facilities had been instructed to collect the related communications.
Finding novel selectors
Apparently collection against PdVSA did get got house inwards the past, every bit PINWALE kept providing documents containing the target's names. This weren't communications, but some variety of information forms amongst contact details in addition to organizational information almost PdVSA employees.
The analyst says that these forms were similar to what is inwards NSA's SEARCHLIGHT database, which is the agency's internal personnel information system. As these information forms advert who inside PdVSA is somebody's supervisor, they resulted inwards a whole tree of entries in addition to names:
Internal PdVSA information shape which shows president of the board
Rafael Ramirez every bit supervisor of some other board member, Luis Vierma
Lots of them
The novel selectors include concern in addition to private e-mail addresses in addition to work, abode in addition to prison theatre cellphone telephone numbers. The newly flora e-mail addresses could over again hold out entered into CADENCE in addition to the UTT, patch the telephone numbers could hold out used to come inwards them inwards OCTAVE, which is NSA's tasking tool to initiate the interception of telephone conversations. It's non said whether this happened or non - the TOPI analyst at to the lowest degree didn't prefer telephone calls.
The Intercept writes that NSA patently "collects thus much communications information from to a greater extent than or less the the world that it oft fails to realize what it has". This soundless applies to most intelligence in addition to constabulary enforcement agencies that acquit automated eavesdropping: at that spot are oft way also many telephone calls to brain inwards to, permit lonely digital communications to translate, read in addition to analyse.
Internal network
When the SIGDEV analyst was analysing the PdVSA forms (of which at that spot were over 10.000 inwards the PINWALE database), he discovered that they all came from IP addresses starting amongst 10.x.x.x in addition to 172.18.x.x, which are from address ranges that are reserved for utilisation inside private networks. The analyst directly realised these entries came from the internal PdVSA network, in addition to non from communications over the world internet.
One of the most interesting details of this whole story is how NSA had been able to larn access to PdVSA's internal network - which isn't told inwards the study past times The Intercept, but entirely inwards the i from teleSUR...
Front side of the US diplomatic mission inwards Caracas, Venezuela
(Photo: Yongo @ SkyScraperCity.com)
Special Collection Service
After the analyst discovered that he was looking at information from the internal PdVSA network, he "fired off a few emails to F6 hither in addition to inwards Caracas, in addition to they confirmed it!"
F6 is the NSA's The Intercept in addition to the Latin-American broadcaster internal designator for the Special Collection Service (SCS) units inwards which specialists from NSA in addition to CIA cooperate against targets that require "close access". These units operate out of some fourscore US embassies all over the world.
This agency it was the SCS unit of measurement from the US diplomatic mission inwards Caracas that had been able to larn access to the internal network of PdVSA. The story doesn't tell how they did this, but likely they flora a way to secretly tap a network cable or switch over which the oil company's reckoner network runs. If this access was soundless active, it has directly has sure been compromised.
SCS operations
From an The Intercept in addition to the Latin-American broadcaster earlier revelation nosotros know that the SCS unit of measurement inwards the US diplomatic mission inwards Berlin was responsible for eavesdropping on the (non-secure) mobile telephone of High German chancellor Merkel. Maybe that was also done past times tapping a local telephone network, or past times only intercepting the prison theatre cellphone phone's airwave signals.
For such wireless interception operations, many US embassies get got a rooftop structure that conceals sophisticated antenna in addition to other eavesdropping equipment. Such a construction is also clearly visible on the roof of the US diplomatic mission inwards Caracas:
Back side of the US diplomatic mission inwards Caracas, amongst the rooftop structure
(Photo: Carlos Garcia Rawlins/Reuters - Click to enlarge)
XKEYSCORE
After finding out the source of those PdVSA forms, the SIGDEV analyst started to coordinate his operate amongst the F6 unit of measurement inwards Caracas. Apparently they fed information from their network access into XKEYSCORE, which is NSA's scheme to buffer, index in addition to search cyberspace communications, non entirely from large submarine cables, but also from smaller accesses, similar from the SCS units.
This enabled the analyst at NSA headquarters to search through a rolling buffer of several days worth of content, which is especially useful to discovery files which aren't lead associated amongst difficult selectors similar e-mail addresses.
This resulted inwards "several juicy pdf documents" in addition to i of them was eventually used for preparing a serialized study (number 3/OO/505480-11) dated Jan 2011 in addition to titled "Venezuela State-Owned Oil Company Information Shows a Decrease inwards Overall Oil Thefts in addition to Losses" - which doesn't audio similar a merchandise surreptitious that would practise goodness private US oil companies, but on the other manus shows that such high-level accesses are also used for rather full general intelligence information.
Hacking opportunities
Through XKEYSCORE, the analyst also flora over 900 username in addition to password combinations of PdVSA employees, which he handed over to NSA's hacking division, Tailored Access Operations (TAO). With a username in addition to password i doesn't get got to "break in" into a network, which makes the access almost impossible to detect.
The analyst also provided TAO amongst some other information along amongst a targeting request, especially aimed at getting access to the e-mail boxes of the PdVSA board members.
It is non known whether this was successful, but The Intercept in addition to teleSUR advert that inwards May 2011, which is 2 months afterward the analyst's story inwards SIDtoday, the US State Department announced The Intercept in addition to the Latin-American broadcaster An NSA eavesdropping instance study almost targeting the presidents of United Mexican States in addition to Brazil.
Tidak ada komentar:
Posting Komentar