Body of Secrets: Anatomy of the Ultra-Secret National Security Agency (66 page)

Originally
scheduled for a 1988 launch, Zircon was to be disguised as a military
communications satellite and was to focus primarily on Europe, Russia, and the
Middle East. Not everyone, however, was happy with the decision. A few
dismissed it as "macho politics," simply an attempt to keep up with
the United States in an endless Sigint space race. Worse, the Ministry of
Defence kept the entire $700 million project hidden from Parliament.

But the
costs soon doomed Zircon. The satellite itself bore an enormous price tag, and
it was estimated that yearly maintenance requirements would have added about
another $150 million to the project. "The UK simply isn't able to afford
that coverage," said Lieutenant General Derek Boorman, the chief of
Defence Intelligence. Instead, Britain agreed to contribute money to the United
States in return for a sort of time-share arrangement with a new generation of
NSA's Sigint satellites, codenamed Magnum. Under the new agreement, London
would be allowed to "task" the satellites on targets of interest to
the United Kingdom for up to one-third of the time.

The first
Magnum was launched in 1994 with an eavesdropping dish 160 feet in diameter.
Now that they were part owners of the Sigint satellite, senior British
officials began taking a closer interest in Cheltenham. That same year Prime
Minister John Major paid his first visit to GCHQ, and early the next year the
Queen herself and the Duke of Edinburgh were given a tour. At the time, the
agency employed 6,228 people at its headquarters, with about 3,000 more at
overseas listening posts, and had a budget of about $900 million.

By 2001,
GCHQ was busy constructing a new $500 million space-age complex to replace its
headquarters buildings. Nicknamed "the doughnut," the circular
structure was being built on a 176-acre site in Benhall, a section of
Cheltenham about four miles from the old headquarters in Oakley. Plans called for
the bombproof, four-story signals intelligence center to be seventy feet high
and more than 600 feet in diameter—easily big enough to hold London's Royal
Albert Hall. In addition to rooms full of receivers and computers, the doughnut
would also resemble a small town with banks, shops, a health center, a gym— and
a small pond in the center "hole" bordered by dish-shaped antennas.
Surrounding the revolutionary building would be spaces for 1,750 cars and 200
bikes, arranged in concentric rings.

Auditors
have recently warned that the doughnut's costs appear to be on the verge of
spiraling out of control. Nevertheless, other GCHQ facilities are also planned
for the site, including a science park of high-tech buildings. It was hoped
that the project would be completed by 2003. At that time, the old headquarters
would be turned into a 500-house development with a supermarket, video shop,
and takeout restaurant.

Despite
the end of the Cold War, the dawn of the new century, and the many internal and
external changes at GCHQ and NSA, the secret relationship between the two
partners promises to remain as close as it was sixty years ago, during the
darkest days of World War II. Addressing a group in NSA's Friedman Auditorium
in the fall of 1999, director Hayden said he had just returned from a visit
with his counterparts in England. Then he added enthusiastically: "We must
go back to our roots with GCHQ."

Like GCHQ,
the Australian Defence Signals Directorate (DSD) rose from the ashes of World
War II, during which its Central Bureau played a large role in eavesdropping on
the Japanese and attacking their codes. Following the war, a number of
listening posts were built, and Australian intercept operators worked jointly
with employees of GCHQ at listening posts in Hong Kong and Singapore.

Today DSD
is headquartered at Victoria Barracks, a modern glass government facility on
St. Kilda Road in Melbourne. Compared with NSA and GCHQ, DSD is tiny, with
about 500 civilians, most of whom work at headquarters, and about 500 military
intercept operators. Despite the agency's small size, because of Australia's
strategic location it is able to contribute considerable signals intelligence
on its neighbors to NSA and the other UKUSA partners. According to Australian
intelligence documents, this material has included such things as Japanese,
South Korean, and Pakistani diplomatic traffic, rebel communications in
southern Africa, and border conflicts between Iran and Iraq. For years DSD was
also able to provide early tipoffs on French nuclear tests in the South
Pacific. This allowed the United States to position aircraft and naval vessels
to monitor the detonations and determine the bombs' yield and other technical
details.

Next to
Victoria Barracks is a boxy, windowless building that looks like a warehouse
for dry goods. In fact, for many years it was a major listening post for
eavesdropping on China and western Russia. In the early 1980s, many British and
Australian intercept operators were pulled out of Hong Kong and the antennas
became largely remoted. Giant dishes automatically collected the signals, which
were in turn retransmitted by satellite to Melbourne, nearly 5,000 miles away.
The listening post's cover name was the Joint Telecommunications Unit
Melbourne.

Finally,
the newest and smallest member of the UKUSA club is New Zealand's Government
Communications Security Bureau (GCSB), formally established in 1977. During
World War II, as the Japanese war machine pushed rapidly across the Pacific,
gobbling up islands, New Zealand quickly built a number of signals intelligence
stations, which contributed to the British and American Sigint effort. They
were controlled from Defence House, a seven-story building on Stout Street in
Wellington.

After the
war, the intercept service was abandoned and New Zealand contributed some
members to Australia's postwar codebreaking and eavesdropping organization, the
Defence Signals Bureau. Nevertheless, a small listening post was built on a
bleak volcanic plateau at Waiouru in the central part of North Island. Eventually
named the New Zealand Combined Signals Organisation, it contributed to the
Sigint effort during the war in Vietnam.

Today, the
headquarters for the GCSB occupies the top floors of the Freyberg Building,
opposite Parliament, in Wellington. Concentrating mostly on the Pacific Rim and
small island nations, it has a high-frequency listening post at Tangimoana
Beach, about 225 miles north of Wellington. A satellite interception facility
was opened at Waihopai; it targets, among other things, diplomatic communications
to and from Japanese embassies around the Pacific. In 2001 GCSB employed about
200 people and had a budget of about $20 million (Australian). Its director was
Warren Tucker, who joined the agency in 1982 and before that served as liaison
to NSA.

With the
admission of New Zealand's GCSB in 1977, the major English-speaking nations of
the world were joined in a highly secret agreement to eavesdrop on the rest of
the world, friend as well as foe. Over the years, the UKUSA partnership would
develop into a unique supranational body, complete with its own laws, oaths,
and language, all hidden from public view. As a sovereign nation has a body of
laws, so UKUSA has a body of secrets. The International Regulations on Sigint
govern the actions of the multinational cyberspies, from the wording of their
indoctrination oaths to the format of their intercept forms to their unique
cryptospeak of codewords and covernames.

Once those
rules were firmly in place in the 1970s, NSA set out to weld the individual
members together into a virtual nation, with Crypto City as its capital. It did
this by building a massive computer network, codenamed Platform, which tied
together fifty-two separate computer systems belonging to all the members
around the world. The focal point, or "host environment," for the
massive network was NSA headquarters at Fort Meade. Finally, to do away with
formal borders, a software package was developed to turn the partners'
worldwide Sigint operation into a unified whole. Agencies would be able to submit
targets to one another's listening posts and, likewise, everyone would be
allowed to share in the take—to dip their electronic ladles into the vast
caldron of intercepts and select what they liked. The software package that
established this was codenamed Echelon.

During the
1980s, fax machines and computers began to proliferate. More and more
information once sealed tightly in envelopes began zipping through the ether.
Everything from private letters to tax returns to contracts to business
negotiations to foreign unclassified military and diplomatic messages suddenly
went from opaque to transparent. All spies needed was steel nets to catch the
signals as they plunged from the international communications satellites
(INTELSATs). Perched like chattering magpies in geostationary orbits above the
earth, the seventeen INTELSAT satellites provide telephone, fax, e-mail, and
other international communications to over 200 countries and territories around
the world. The system is managed by the International Telecommunications
Satellite Organization, a Washington, D.C.—based cooperative. "We link the
world's telecommunications networks together," says the company.

As
commercial earth stations were built around the world to transmit and receive
millions of private messages and telephone calls to and from the INTELSATs, NSA
and its partners quietly began constructing mirror sites hidden nearby. Massive
ninety-foot dishes resting on thick cement pedestals, they looked like great
silver chalices containing offerings to the gods. The first ones were built in
an isolated valley in Sugar Grove, West Virginia (using parts from the failed
Moonbounce project); on a vast, restricted Army firing range in Yakima,
Washington; and at the edge of a Cornish cliff near Bude, England. As more
INTELSATs began dotting the distant skies, the UKUSA partnership began building
more ground stations to eavesdrop on them.

By the end
of the 1980s, the revolution was in full swing. Wholesale satellite
eavesdropping would change the nature of signals intelligence forever. "We
grew so fast in the '80's we got buried," recalled Robert L. Prestel, who
took over as deputy director in 1990.

CNAMIIN TQSWGIMY'C CMOK GWNOK
ASKMO QY BKVMB TQVEC ZMNZJK NTO EKMAJO SRB JUEJABJX BR XJBRQK YTATBMRS EDTSO
MWCUPQI OXC OQWC HQUU KXZ QWHIKXZO OKDSR ZSUKMMCKWU KDXGWX QDV OWOWXLDF FSGWE
FVW WFADT OD AYWOFSG PUILSC RUXXWD UXZR UJKIED GL SILRUOE OPUGSOL UIWZKEGS

The
southern French city of Toulouse has developed a pinkish tint as a result of
the centuries-old blending of brick and red tile. Houseboats line the Canal du
Midi, the waterway linking the Atlantic Ocean with the Mediterranean Sea, and a
labyrinth of alleyways leads to the embankments of the Garonne River. On the
northern outskirts of the city sits a small factory on the winding Chemin du
Pont de Rupe. There, in December 1997, a salesman by the name of T. Dècle
[3]
became a fly caught in UKUSA's
worldwide electronic web. In the shadow of the nearby Pyrenees, where the
Visigoths and also Charlemagne once ruled, the complex system of eavesdropping
satellites, hidden antennas, and powerful supercomputers began telescoping down
to the beige phone on the unsuspecting salesman's desk.

In the
equatorial forests of French Guiana, the air was leaden with humidity during
the brief interludes between fierce downpours. Forty miles west of the capital
of Cayenne, the Kourou River feeds into endless mangrove swamps and tropical
marshlands. There, on March 14, 1996, a sleek white Ariane 44P rocket rose
above the green canopy of coconut palms and screeching macaws at the European
Space Agency. After three months of testing and calibration, INTELSAT 707 was
nudged into its geostationary orbit high above the tiny West African island
nation of Sao Tome and Principe. There, like an orbital switchboard, it was
capable of relaying up to 90,000 telephone calls and data transmissions
simultaneously throughout Europe, Africa, and Asia.

Twenty-two
thousand miles below and to the north, on a mist-hazed cliff in England's
Cornwall, intercept operators at GCHQ's Morwenstow listening post, near Bude,
were working around the clock. Like an outfielder under a high fly ball, the
Morwenstow station was ideally positioned to secretly catch the new satellite's
beam containing thousands of simultaneous messages and conversations. In the
days following the satellite's activation, technicians in the station worked
overtime attempting to log and program into their computers and Echelon
software the channels with the highest intelligence value.

Sitting
high above the Celtic Sea on the edge of Sharpnose Point, the base has nearly a
dozen dishes pointed to the heavens. It was originally built in the late 1960s,
largely with money from NSA, to eavesdrop on communications flowing down to
Europe from the early INTELSAT satellites. A brief sixty miles away, also in
Cornwall, was Britain's commercial ground station for the satellites, at
Goonhilly Downs.

Once the
Morwenstow station was completed, the director of GCHQ at the time, Sir Leonard
Hooper, sent his personal thanks to Marshall Carter. "I know that I have
leaned shamefully on you, and sometimes taken your name in vain, when I needed
approval for something at this end," Sir Leonard wrote. "The aerials
at Bude ought to be christened 'Pat' [Carter's nickname] and 'Louis'
[Tordella]!" Hooper added, "Between us, we have ensured that the
blankets and sheets are more tightly tucked around the bed in which our two
sets of people lie and, like you, I like it that way."

Later
Carter commented on the letters, explaining Hooper's budget problems and how he
would approach his superiors for the money. "He says, 'Well, look, you can
turn me down from the British viewpoint, but I'm in bed with Pat Carter on this
thing—this is a joint requirement; he needs it as badly as I do. The product
that he is going to develop for us will come right to us, so would you take
another look at this, because he wants it, it will help him in his business.
We'll get the results of it.' "

Today,
among UKUSA's key targets are Iran, China, and North Korea. Just as Morwenstow
eavesdrops on INTELSAT communications to Europe, INTELSAT signals to the Far
East are monitored from a large American listening post in Japan. There, at
Misawa Air Base on the northern tip of Honshu Island, the antenna area looks
like a soccer field for giants. Fourteen large radomes, like mammoth soccer
balls, sit on a stretch of green. Nearby is an elephant-cage antenna, over 100
feet tall and nearly a quarter-mile wide.

The
signals collected by the antennas are piped into a modern windowless building
known as the Misawa Cryptologic Operations Center. Inside, NSA civilians and
1,800 tri-service (Army, Navy, Air Force) military Sigint specialists work in
shifts. Among them are the Naval Security Group and the Air Force 301st
Intelligence Squadron, which performs "satellite communications processing
and reporting." One of the satellites on which Misawa performs
"processing and reporting" is an INTELSAT 8 launched over the Pacific
on June 27, 1997, with a capacity for up to 112,500 simultaneous phone calls.

The Army's
750th Military Intelligence Company is also there. Of the Army intercept
operators and analysts, many are so-called 98Ks: signals
collection/identification analysts. They are involved in the "collection,
identification, exploitation, and analysis of digital and analog
communications, to include voice, teleconferencing, videoconferencing,
facsimile, computer-to-computer traffic, and telemetry." In other words,
everything that might go through an INTELSAT.

The days
of intercepting Morse code are long gone. Today the focus is on intercepting
and analyzing far more complex digital satellite communications. According to
an Army intelligence publication, " 98Ks will 'break' digital signals into
a recognizable form so that the 98C (signals intelligence analyst), 98G (voice
interceptor), 98H (communications locator/interceptor), and 98J (electronic
intelligence interceptor/analyst) soldiers can further exploit the intelligence
within the 'digital window.' "

Some of
the advanced training is done at the Navy's Technical Training Center at Corry
Station in Pensacola, Florida. Other courses are given remotely, from NSA's
National Cryptologic School. Among the courses are FORNSAT (Foreign Satellite
Collection), COMSAT (Communications Satellite Collection), Cellular
Communications Collection, Overhead Collection Management, Computer/Signals
Analysis, Bit Stream Analysis, Modems, Multiplexing, Geolocation, Antenna
Selection, and Target Development. Among the FORNSATs the Misawa analysts
likely focus on are the several domestic China Sats in orbit, also known as
DHF-3s.

Another
course is VSAT (Very Small Aperture Satellite [Terminal]) Collection. This type
of collection is aimed at intercepting communications using small dishes, such
as those used with DirecTV. India's nuclear weapons establishment, for example,
uses this method to send and receive encrypted digital messages by satellite.

Also busy
eavesdropping on INTELSATs over the Pacific are New Zealand's listening post at
Waihopai and Australia's station at Geraldton, 230 miles north of Perth. A port
on the Indian Ocean in the extreme westernmost part of the country, Geraldton
was designed primarily to eavesdrop on the two INTELSATs over the Indian Ocean.
It is also able to monitor the Pacific Ocean satellites. The station was opened
by DSD in 1994, about the same time as GCHQ's Hong Kong station was closing.

In the
post—Cold War years, the proliferation of both nuclear and conventional weapons
has joined the chief concerns of the U.S. government. A particular worry is the
possible sale by China of nuclear components and missile parts to Pakistan and
Iran. Thus, NSA receives numerous requests from the CIA, the State Department,
and other "customers" for intelligence on such transfers. Analysts at
these agencies submit to NSA long, detailed watch lists containing keywords and
names.

After NSA
receives the watch lists containing the keywords, names, phrases, telephone and
fax numbers, analysts assign four-digit numbers to them—search codes—and then
pass them on, through the Echelon computer system, to the various UKUSA
listening posts. There a computer, codenamed Dictionary, searches for those
words and numbers among the millions of messages passing through the intercept
antennas. It does this much as computers use search engines such as Alta Vista
to locate keywords and phone numbers almost instantly in the vast Internet.

No doubt
high on the list of keywords submitted to NSA is the name of Jin Xuekuan, the
president of China National Precision Machinery Import & Export
Corporation. This Chinese government—owned company, a sort of Missiles 'R' Us
on Fu Cheng Road in Beijing, is responsible for foreign sales of missiles and
other weapons. Once a listening post gets a hit on Jin, the intercept will
automatically be forwarded to NSA. There, an analyst need only enter the search
number for Jin and any intercepts from, to, or mentioning him will appear on
the analyst's screen.

Despite
the very secret nature of weapons deals, communications about them are seldom
encrypted, because each country has separate and incompatible systems. So the
parties are forced to resort to commercial faxes, phone calls, and electronic
mail. Also, as in any complicated sale, a great deal of electronic
"paperwork" is always generated—contracts, warranties, price
negotiations, service agreements: the same type of paperwork as is involved if
Burger King sells a franchise to a company in Holland. For the UKUSA partners,
this enormous "paper" trail is collectable over the open airwaves
through their worldwide electronic dredging operation.

Terrorists
also frequently use unencrypted communications, because for encryption the
caller and the receiver must have compatible systems. Since at least one party
is often traveling, carrying encryption equipment can be cumbersome.

According
to information obtained for
Body of Secrets,
NSA regularly listens to
unencrypted calls from suspected terrorist Osama bin Laden, in hiding in
Afghanistan. Bin Laden uses a portable INMARSAT phone that transmits and
receives calls over spacecraft owned by the International Maritime Satellite
Organization. This is the same system used by most ships and some people who
travel to remote locations, such as oil explorers. According to intelligence
officials, Bin Laden is aware that the United States can eavesdrop on his
international communications, but he does not seem to care. To impress cleared
visitors, NSA analysts occasionally play audiotapes of Bin Laden talking to his
mother over an INMARSAT connection.

When
targets do use encryption, or when the information is sent by diplomatic pouch,
cyberspies have to be creative. "With regard to encryption," said one
former official, "you look for places outside the zone. At some time he
has to go to the Danish freight forwarder or Danish shipping guy to ask him a
question—‘I need a ship with extra-heavy reinforced decking with a hatch this
size.' So we just need to look other places. Yeah, it's going to be harder.
Look for letters of credit being cut—they almost always have to go to a regular
bank."

Vast
numbers of messages and phone calls are intercepted from the INTELSATs, and
likewise the power and speed of the NSA computers that sift through the sea of
information are enormous. According to William Studeman, "U.S.
intelligence operates what is probably the largest information processing
environment in the world. Consider this: Just one intelligence collection
system alone can generate a million inputs per half-hour. Filters throw away
all but 6,500 inputs; only 1,000 inputs meet forwarding criteria. Ten inputs
are normally selected by analysts and only one report is produced. These are
routine statistics for a number of intelligence collection and analysis systems
which collect technical intelligence."

Despite
sophisticated software, watch lists, and powerful computers, signals
intelligence analysis is an attempt to solve a puzzle whose pieces are
difficult to see, include only small bits of the much larger picture, and are
constantly changing. Sometimes the pieces of the puzzle lead to dead ends, and
sometimes they lead to great discoveries. Occasionally they may lead to serious
consequences for innocent, unsuspecting citizens of friendly countries.
Sometimes the answers are just gray and ambiguous. The piece of the puzzle fits
but the words don't match.

Highly
secret documents reviewed for
Body of Secrets
describe in detail how NSA
and its UKUSA partners spent years following one difficult trail—that of
China's C-802 missile and Iran's attempts to build one of its own. They offer
unique insight into the controversial and misunderstood Echelon program,
showing the system at its best and also at its most questionable. The documents
were reviewed at the National Security News Service in Washington, a nonprofit
group that has researched the C-802.

Four
thousand miles west of Toulouse, in Washington, concern had been growing over
the help China was giving the Iranian missile program. A particular worry was
the deadly C-802, a sleek, sharklike antiship cruise missile that could also
deliver a chemical or biological payload. The sales brochure of its
manufacturer, China National Precision Machinery Import & Export, boasted
that the C-802 had "mighty attack capability" and "great
firepower"; it had a range of 120 kilometers and resembled the Exocet
cruise missile that had killed thirty-seven U.S. sailors on the USS
Stark
in
1987
[CD1]
 
. C-802s,
said James Lilly, the former U.S. ambassador to China, pose a "clear and
present danger to the United States fleet." At the time, more than 15,000
U.S. servicemen were stationed in the Persian Gulf.