of 11
8/10/2019 079 2011 REDACT
1/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZL
Making Network Sense of
the encr tion roblem
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ on
Roundtable
Head of GCHQ NAC
TOP SECRET//REL TO USA AUS CAN GBR NZL
Derived From: NSA/CSSM 1-52
Dated: 20070108
Declassify On: 20360501
8/10/2019 079 2011 REDACT
2/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLGCHQ metadata
GCHQ now creating metadata on:
SSL / TLS
IKE
OpenVPN
SSH
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ on
SQUEAL signatures (Various crypt packages)
Data available in BEARDED PIGGY and/or the
CLOUD
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
3/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLHow can Network Analysis help ?
Can NAC help
make sense using
network
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ on
volumes of data to
isolate that which
we want to
decrypt
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
4/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLThe Seed Approach
Intercepted documentation reveals details of VPN set up
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ on
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
5/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLThe Seed Approach
Turn Seed IP into network block
Query on network block against metadata
Chain outwards / fuzzy subnet logic
Basis of NTAT developed tradecraft:
IRASCIBLE HARE
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ o
IRASCIBLE RABBIT
IRASCIBLE MOOSE
IRASCIBLE EMITT
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
6/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLKnown usage
Target known to use encryption
Identify target subnet
Select on subnet against metadata
Or
Start with an AS look for most interestin wheel
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ o
BELGACOM - AS6774 known to run GRX links to MNO
over VPN
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
7/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZL
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
8/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZL
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ o
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
9/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLNetwork Knowledge enrichment
Internet Registry information
IP Geolocation
DNS
Data derived from network device configuration files
(routers/Firewalls etc)
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ o
Network information on surrounding IPs (i.e. rest of subnet is
MNO related)
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
10/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLAccess Optimisation
A given role of Network Analysis is optimising access for a given
problem in this case enabling two-ended collection
Or.. Identifying opportunities to get at the data before it is
encrypted therefore no need to make sense of encrypted data.
Can do this both:
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ
ass ve
Active
TOP SECRET//REL TO USA AUS CAN GBR NZL
8/10/2019 079 2011 REDACT
11/11
TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZLYour Ideas Please
TOP SECRET//REL TO USA AUS CAN GBR NZL
This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under ot her UK informationlegislation. Refer disclosure requests to GCHQ o
TOP SECRET//REL TO USA AUS CAN GBR NZL
![From: [REDACT] Sent: ForMACCS I · From: Sent: To: Subject: [REDACT] 16July201515:16:ll Ministerial CmTCspondence Unit FW: Scotland Bill and the Aggregates Levy Attachments: Scotland](https://static.documents.pub/doc/80x56/5f5e1de56e06755c08704933/from-redact-sent-formaccs-i-from-sent-to-subject-redact-16july20151516ll.jpg)
