7/28/2016 Electrospaces.net 6 More Next Blog» Create Blog Sign In June 24, 2016 Welcome to Electrospaces.net! Here you can read about: E-mails from inside the NSA bureaucracy - Signals Intelligence (SIGINT), - Communications Security (COMSEC), Earlier this month, the NSA declassified a huge set of internal e-mails, following FOIA- - Information Classification, requests about the issue of whether Edward Snowden had raised concerns about the and also about the equipment, from NSA's surveillance programs through proper channels inside the agency. past and present, which make that civilian and military leaders can > Download the declassified e-mails (very large pdf) communicate in order to fulfill their duties. Here, we will take a look at the administrative details these internal NSA e-mails The main focus will be on the United provide. Next time we will see what their content says about the concerns that States and its National Security Snowden claimed to have raised. Agency (NSA), but attention will also be paid to other countries and subjects. Any comments, additions, corrections, questions or suggestions will be very appreciated! There's no login or registration required for commenting. twitter.com/electrospaces info (at) electrospaces.net PGP Public Key ID: FD9FD4E6 The postings on this weblog are updated frequently as new information about the NSA is still being revealed. Therefore, revisit this weblog and check the articles for updates! Index of all postings Internal e-mail from NSA director Michael Rogers. In the signature block we see his NSANet and SIPRNet e-mail addresses and his non-secure phone number (all redacted) (Click to enlarge - See also: NSA director Alexander's phones) Recent Posts E-mails from inside the NSA bureaucracy E-mail addresses German journalists about working with the Snowden documents http://electrospaces.blogspot.dk/ 1/18 7/28/2016 Electrospaces.net Except from the classification markings, the NSA's internal e-mails aren't very different from those exchanged by most other people around the world. But they do The phones of US Director of National show for example some details about the internal communications networks of the Intelligence James Clapper agency. Something about the use of selectors: correlations and equations From the signature blocks underneath the e-mails we learn that, depending on their function and tasks, NSA employees have e-mail addresses for one or more of the A look at the latest French laws on following four computer networks: intelligence collection - NSANet for messages classified up to Top Secret/SCI (Five Eyes signals How NSA contact chaining combines intelligence). On this network the address format for e-mail is jjdoe@nsa domestic and foreign phone records Section 215 bulk telephone records - JW ICS for messages classified up to Top Secret/SCI (US intelligence). The address and the MAINWAY database format is [email protected] Leaked documents that were not - SIP RNET for messages classified up to Secret (mainly US military). The address attributed to Snowden format is [email protected] How NSA targeted the Venezuelan oil - UNCL for unclassified messages, likely through NIPRNet. The address format is company PdVSA [email protected] > See for more: US military and intelligence computer networks "It's actually straight up interesting but also weird how weirdly, wonderfully For e-mail, all NSA employees have display names in a standardized format: first detailed this blog about hyper secure comes their family name, given name and middle initial, sometimes followed by "Jr" communications is." or a high military rank. Then follows "NSA" and the proper organizational designator, — Gizmodo.com then "USA" for their nationality and finally "CIV" for civilian employees, "CTR" for contractors, "USN" for Navy, "USA" for Army or "USAF" for Air Force members. Pages Thus, the display name of the current NSA director is "Rogers Michael S ADM NSA-D USA USN", while that of the previous director was "Alexander Keith B GEN NSA-D USA Home USA". In 2012, Snowden had the display name "Snowden Edward J NSA-FHX4 USA INDEX CTR": Links Abbreviations and Acronyms NSA Nicknames and Codewords NSA's organizational designations NSA's Legal Authorities NSA Glossary The US classification system SIGINT Activity Designators (SIGADs) GCHQ Codewords and Abbreviations CSE Codewords and Abbreviations BND Codewords and Abbreviations Telephony Abbreviations E-mail from Snowden as systems administrator in Hawaii, August 2012 The redacted part of the classification marking Internet abbreviations seems to hide a dissemination marking * (Click to enlarge) Total Pageviews The organizational designator FHX4 is interesting. FH stands for Field station Hawaii, but X4, being unit 4 of division X, is still a mystery. The field station divisions have the same designators as those at NSA headquarters, where there's also a division X, but 1,686,662 so far no document gave an indication what it does. The signature block shows that Snowden worked as a systems administrator for Dell's Popular Posts Advanced Solutions Group and that he was deployed at the Technology Department of NSA's Cryptologic Center in Hawaii, more specifically at the Office of Information How Obama's BlackBerry got secured Sharing. The latter has the organizational designator (F)HT322 and is therefore New phones aboard Air Force One different from that in Snowden's display name. http://electrospaces.blogspot.dk/ 2/18 7/28/2016 Electrospaces.net > See the list of NSA's Organizational Designators INCENSER, or how NSA and GCHQ are tapping internet cables In the declassified messages we only see display names, not the actual e-mail The US Classification System addresses behind them. Therefore, only the classification markings on the messages provide an indication on which network they were exchanged. DRTBOX and the DRT surveillance systems From an e-mail that was declassified earlier we know that in April 2013 Snowden used Wikileaks published some of the most the address "[email protected]", which is the format for the JWICS network, but secret NSA reports so far was apparently used on NSANet.* Leaked documents that were not From one of the declassified e-mails about NSA's internal investigation it seems that attributed to Snowden Snowden had just two mail accounts: "we have his TS [Top Secret] NSANet email and his UNCLASSIFIED NSA.gov email", but this is followed by some redacted lines.* Finally, the signature blocks of some NSA employees also provide a link to their Labels dropbox for sending them files that may be too large for e-mail. Such dropboxes have addresses like "http://urn.nsa.ic.gov/dropbox/[...]". Air Force One (1) Apple (1) BlackBerry (1) Boeing (1) BoundlessInformant (7) Brazil (1) Britain (1) Canada (1) Classification (9) CSEC (2) Eikonal (3) France (2) GCHQ (6) General Dynamics (1) Germany (15) Gold Phone (1) GSM (2) Hotline (4) ISAF (1) Israel (2) IST (4) Kremlin (1) Metadata (5) Netherlands (6) New Zealand (1) North Korea (1) NSA (41) NSA Partnerships (17) Obama (3) POTUS (8) PRISM (7) Red Phone (5) Russia (1) SatCom (2) Section 215 (2) Sectra (1) Secure voice (5) Situation Room (1) Snowden (4) STE (4) STU-II (1) STU-III (1) UMTS (2) US (1) USA (4) USSR (2) Vatican (1) VoIP (1) White House (5) Wireless (7) Search This Blog Search Donate Example of an NSA message, with in the signature block e-mail addresses for JWICS and an unclassified network, and phone numbers for the NSTS and the non-secure phone networks OPS 2B is the wider and lower one of the two black NSA headquarters buildings (Click to enlarge) Telephone numbers Besides e-mail addresses, many messages also have phone numbers in the signature blocks. They show numbers for one or more of the telephone systems used at NSA: - NSTS, which stands for National Secure Telephone System and is NSA's internal telephone network for secure calls. Numbers for this network have the format 969- Blog Archive 8765 and are often marked with "(s)" for "secure" ▼ 2016 (7) - STE, which stands for Secure Terminal Equipment, being a telephone device capable ▼ June (1) of encrypting phone calls on its own. Telephone numbers can be written in the format (301) 234-5678 or as STE 9876. E-mails from inside the NSA bureaucracy - BLACK, CMCL or Commercial, which are numbers for non-secure telephones that ► May (1) may also access the public telephone network. They have the regular format (301) 234-5678 and are often marked with "(b)" for "black" (as opposed to "red") or with " ► March (2) (u)" for unclassified. ► February (2) ► January (1) ► 2015 (20) ► 2014 (30) http://electrospaces.blogspot.dk/ 3/18 7/28/2016 Electrospaces.net ► 2013 (33) ► 2012 (10) US Red Phones Sequence of the real Red Phones, not The NSA/CSS Threat Operations Center (NTOC) at NSA headquarters, with from left to right: for the Washington-Moscow Hotline, an STE secure phone, a probably non-secure telephone and a phone for the NSTS but for the US Defense Red Switch (Photo: NSA, 2012 - Click to enlarge) Network (DRSN). The phones shown here were in use from the early eighties up to the present day and most of them were made by TIKICUBE Electrospace Systems Inc. They will be discussed on this weblog later. Finally, releasing such a huge set of documents in which many parts had to be redacted always bears the risk that something is overlooked. That also happened this For the record, you see: - Electrospace MLP-1 time, as in one e-mail from an investigator from NSA's Counterintelligence - Electrospace MLP-1A (since 1983) Investigations unit Q311 they forgot to redact the codeword TIKICUBE: - Electrospace MLP-2 - Raytheon IST (since 1992) - Telecore IST-2 (since 2003) US Classification Levels Color codes for the classification levels used by the government and the armed forces of the Unites States: TIKICUBE appears to be a unit of the Investigations Division Q3.