Information about Sigint

For other uses, see Sigint (disambiguation).

SIGINT stands for SIGnals INTelligence, which is a intelligence-gathering by interception of signals, whether between people (i.e., COMINT or communications intelligence) or between machines (i.e., ELINT or electronic intelligence), or mixtures of ther two. As sensitive information is often encrypted, SIGINT often involves the use of cryptanalysis. However, traffic analysis—the study of who is signalling whom and in what quantity—can often produce valuable information, even when the messages themselves cannot be decrypted. See SIGINT by Alliances, Nations and Industries for the organization of SIGINT activities, and SIGINT Operational Platforms by Nation for current collection systems, and SIGINT in Modern History for World War I to the present.

Intercepting written but encrypted communications, and extracting information, probably did not wait long after the development of writing. A simple encryption system, for example, is the Caesar cipher. Electronic interception appeared as early as 1900, during the Boer War. The Boers had captured some British radios, and, since the British were the only people transmitting at the time, had signals rather obvious to intercept In the United States and other nations involved with NATO, SIGINT is defined as ^[1]:

*A category of intelligence comprising either individually or in combination all communications intelligence (COMINT), electronic intelligence (ELINT), and foreign instrumentation signals intelligence, however transmitted.

*Intelligence derived from communications, electronic, and foreign instrumentation signals."

The JCS definition may overemphasize "foreign instrumentation signals". That part should be considered in combination with MASINT, which is closely linked to that sort of target. An ELINT sensor may guide a MASINT sensor; a MASINT sensor may find the target for COMINT sensor.

Being a broad field, SIGINT has many sub-disciplines. The two main ones are COMmunications INTelligence (COMINT) and ELectronic INTelligence (ELINT). There are, however, some techniques that can apply to either branch, as well as to assist FISINT or MASINT.

Disciplines Shared across the Branches

An excellent Australian analysis of how the pieces came together, from targeting to physical destruction of radars, in Desert Storm is in ^[2]

Targeting

A collection system has to know to look for a particular signal. An intercept aircraft could not get off the ground if it had to carry antennas and receivers for every possible frequency and signal type. Targeting is part of the process of developing collection requirements:

"1. An intelligence need considered in the allocation of intelligence resources. Within the Department of Defense, these collection requirements fulfill the essential elements of information and other intelligence needs of a commander, or an agency.

"2. An established intelligence need, validated against the appropriate allocation of intelligence resources (as a requirement) to fulfill the essential elements of information and other intelligence needs of an intelligence consumer."

In other words, before the detailed process of targeting begins, someone has to decide there is a value in collecting information about something. While it would be possible to direct signals intelligence collection at a major sports event, the systems would capture a great deal of noise, news signals, and perhaps announcements in the stadium. If, however, an antiterrorist organization believed that a small group would be trying to coordinate their efforts, using short-range unlicensed radios, at the event, SIGINT targeting of radios of that type would be reasonable. Targeting would not know where in the stadium the radios might be, or the exact frequency they are using; those are the functions of subsequent steps such as signal detection and direction finding.

Knowing what interception equipment to use becomes easier when a target country buys its radars and radios from known manufacturers, or is given them as part of foreign military aid. National intelligence services keep libraries of devices manufactured by their own country and others, and then use a variety of techniques to learn what equipment is acquired by a given country.

See "The Target - The Iraqi IADS" in for a discussion on how the Iraqi air defense system was targeted in 1991. Note the different requirement for search radar and for the different area defense and point defense missile systems, and how these guided the Suppression of Enemy Air Defense (SEAD) attacks on the radars, command centers, and missiles.

Knowledge of physics and electronic engineering further narrows the problem of what types of equipment might be in use. An intelligence aircraft flying well outside the borders of another country will listen for long-range search radars, not short-range fire control radars that would be used by a mobile air defense. Soldiers scouting the front lines of another army know that the other side will be using radios that must be portable and not have huge antennas.

Signal detection

Whether a signal is human communications or a pure electronic one such as radar, the intelligence collection specialists have to know it exists. If the targeting function described above learns that a country has a radar that operates in a certain frequency range, the first step is to use a sensitive receiver, with one or more antennas that listen in every direction, to find an area where such a radar is operating. Once the radar is known to be in the area, the next step is to find its location.

If operators know the probable frequencies of transmissions of interest, they may use a set of receivers, preset to the frequencies of interest. Received energy on a particular frequency may start a recorder, and alert a human to listen to the signals if they are intelligible (i.e., COMINT). If the frequency is not known, the operators may look for power on primary or sideband frequencies using a spectrum analyzer. Information from the spectrum analyzer is then used to tune receivers to signals of interest.

Spread-spectrum communications is an electronic counter-countermeasures (ECCM) technique to defeat looking for particular frequencies. Spectrum analysis can be used in a different ECCM way, to identify frequencies not being jammed or not in use.

Direction-finding

The earliest, and still common, means of direction finding is to use directional antennas as goniometers, so that a line can be drawn from the receiver through the position of the signal of interest. See HF/DF. Knowing the compass bearing, from a single point, to the transmitter does not locate it. Where the bearings from multiple points, using goniometry, are plotted on a map, the transmitter will be located at the point where the bearings intersect. This is the simplest case; a target may try to confuse listeners by having multiple transmitters, giving the same signal from different locations, switching on and off in a pattern known to their user but apparently random to the listener.

Individual directional antennas have to be manually or automatically turned to find the signal direction, which may be too slow when the signal is of short duration. One alternative is to use the Wullenweber array technique. In this method, several concentric rings of antenna elements simultaneously receive the signal, so that the best bearing will ideally be clearly on a single antenna or a small set. Wullenweber arrays for high-frequency signals are enormous, referred to as "elephant cages" by their users.

An alternative technique to tunable directional antennas, or large omnidirectional arrays such as the Wullenweber, is to measure the time of arrival of the signal at multiple points, the points using GPS or a similar method to have precise time synchronization. The points at which the receivers can be placed can be on ground stations, ships, aircraft, or satellites, giving great flexibility.

Since modern weapons can home in on and attack transmitters, the antennas of a military unit frequently are a hopefully safe distance from the user of the transmitter.

Traffic analysis

Main article: Traffic analysis

When locations are known, usage patterns may emerge, and inferences drawn. Traffic analysis is the discipline of drawing patterns from information flow among a set of senders and receivers, whether those senders and receivers are designated by location determined through direction finding, by addressee and sender identifications in the message, or even MASINT techniques for "fingerprinting" transmitters or operators. Message content, other than the sender and receiver, is not necessary to do traffic analysis, although more information can be helpful.

For example, if a certain type of radio is known to be used only by tank units, even if the position is not precisely determined by direction finding, it may be assumed that a tank unit is in the general area of the signal. Of course, the owner of the transmitter can assume someone is listening, so might set up tank radios in an area where he wants the other side to believe he has actual tanks. As part of Operation Quicksilver, part of the deception plan for the invasion of Europe at the Battle of Normandy, radio transmissions simulated the headquarters and subordinate units of the fictitious First United States Army Group (FUSAG), commanded by George S. Patton, to make the German defense think that the main invasion was to come at another location. In like manner, fake radio transmissions from Japanese aircraft carriers, before the Battle of Pearl Harbor, were made from Japanese local waters, while the attacking ships moved under strict radio silence.

Traffic analysis need not focus on human communications. For example, if the sequence of a radar signal, followed by an exchange of targeting data and a confirmation, followed by observation of artillery fire, this may identify an automated counterbattery system. A radio signal that triggers navigational beacons could be a landing aid system for an airstrip or helicopter pad that is intended to be low-profile.

Patterns do emerge. Knowing a radio signal, with certain characteristics, originating from a fixed headquarters may be strongly suggestive that a particular unit will soon move out of its regular base. The contents of the message need not be known to infer the movement.

There is an art as well as science of traffic analysis. Expert analysts develop a sense for what is real and what is deceptive. Harry Kidder, for example, was one of the star cryptanalysts of World War II, a star hidden behind the secret curtain of SIGINT ^[3].

COMINT

COMINT (Communications Intelligence) is a sub-category of SIGINT that engages in dealing with messages or voice information derived from the interception of foreign communications. It should be noted that COMINT is commonly referred to as SIGINT, which can cause confusion when talking about the broader intelligence disciplines. defines it as "Technical information and intelligence derived from foreign communications by other than the intended recipients".

COMINT, which principally is among people, will reveal some or all of the following:

#Who is transmitting and or where they are located. If the transmitter is moving, the report may give a plot of the signal against location.

#If known, the organizational function of the transmitter

#The time and duration of transmission, and the schedule if it is a periodic transmission

#The frequencies and other technical characteristics of their transmission

#If the transmission is encrypted or not, and if it can be decrypted. If it is possible to intercept either a originally transmitted cleartext or obtain it through cryptanalysis, the language of the communication and a translation (when needed)

#The addressees, if not a general broadcast and if addresses are retrievable from the message. These stations may also be COMINT (e.g., a confirmation of the message or a response message), ELINT (e.g., a navigation beacon being activated) or both. Rather than, or in addition to, an address or other identifier, there may be information on the location and signal characteristics of the responder

Voice interception

A basic COMINT technique is to listen for voice communications, usually over radio but possibly "leaking" from telephones or from wiretaps. If the voice communications are encrypted, the encryption first must be solved to listen to the conversation, although traffic analysis (q.v.) may give information simply because one station is sending to another.

Obviously, the interceptor must understand the language being spoken. In the Second World War, the United States used volunteer communicators known as code talkers, who used languages such as Navajo, Comanche and Choctaw, which would be understood by few people, even in the U.S., who did not grow up speaking the language. Even within these uncommon languages, the code talkers used specialized codes, so a "butterfly" might be a specific Japanese aircraft. British forces made more limited use of Welsh speakers for the additional protection.

While modern electronic encryption does away with the need for armies to use obscure languages, it is certainly possible that guerilla groups might use rare dialects that few outside their ethnic group would understand, such as Basque or Kurdish.

Text interception

Not all communication is in voice. Morse code interception was once very important, but Morse code telegraphy is now obsolescent although possibly used by special operations forces. Such forces, however, now have portable cryptographic equipment.

Specialists scan radio frequencies for character sequences (e.g., electronic mail) and facsimile.

Signaling channel interception

A given digital communications link can carry thousands or millions of voice communications, especially in developed countries. Without addressing the legality of such actions, the problem of identifying which channel contains which conversation becomes much simpler when the first thing intercepted is the signaling channel that carries information to set up telephone calls. In civilian and many military use, this channel will carry messages in Signaling System 7 protocols.

Retrospective analysis of telephone calls can be made from call detail records (CDR) used for billing the calls.

Monitoring Friendly Communications

More a part of communications security than true intelligence collection, SIGINT units still may have the responsibility of monitoring one's own communications or other electronic emissions, to avoid providing intelligence to the enemy. For example, a security monitor may hear an individual transmitting inappropriate information over an unencrypted radio network, or simply one that is not authorized for the type of information being given. If immediately calling attention to the violation would not create an even greater security risk, the monitor will call out one of the BEADWINDOW codes^[4] used by Australia, Canada, New Zealand, the United Kingdom, the United States, and other nations working under their procedures. Standard BEADWINDOW codes (e.g., "BEADWINDOW 2") include:

# Position: (e.g., disclosing, in an insecure or inappropriate way, "Friendly or enemy position, movement or intended movement, position, course, speed, altitude or destination or any air, sea or ground element, unit or force.

# Capabilities: "Friendly or enemy capabilities or limitations. Force compositions or significant casualties to special equipment, weapons systems, sensors, units or personnel. Percentages of fuel or ammunition remaining."

# Operations: "Friendly or enemy operation – intentions progress, or results. Operational or logistic intentions; mission participants flying programmes; mission situation reports; results of friendly or enemy operations; assault objectives."

# Electronic warfare (EW): "Friendly or enemy electronic warfare (EW) or emanations control (EMCON) intentions, progress, or results. Intention to employ electronic countermeasures (ECM); results of friendly or enemy ECM; ECM objectives; results of friendly or enemy electronic counter-countermeasures (ECCM); results of electronic support measures/tactical SIGINT (ESM); present or intended EMCON policy; equipment affected by EMCON policy."

# Friendly or enemy key personnel: "Movement or identity of friendly or enemy officers, visitors, commanders; movement of key maintenance personnel indicating equipment limitations."

# Communications security (COMSEC): "Friendly or enemy COMSEC breaches. Linkage of codes or codewords with plain language; compromise of changing frequencies or linkage with line number/circuit designators; linkage of changing call signs with previous call signs or units; compromise of encrypted/classified call signs; incorrect authentication procedure."

# Wrong circuit: "Inappropriate transmission. Information requested, transmitted or about to be transmitted which should not be passed on the subject circuit because it either requires greater security protection or it is not appropriate to the purpose for which the circuit is provided."

# Other codes as appropriate for the situation may be defined by the commander.

In WWII, for example, the Japanese Navy made possible the interception and death of the Combined Fleet commander, Admiral Isoroku Yamamoto, by BEADWINDOW 5 and 7 violations. They identified a key person's movement over a low-security cryptosystem.

ELINT

Main article: ELINT

ELINT refers to intelligence-gathering by use of electronic sensors. In other words, ELINT is the interception and analysis of electromagnetic signals of other countries including radar, radio, telephony, and microwave transmissions. Its primary focus lies on non-communications signals intelligence. defines it as "Technical and geolocation intelligence derived from foreign noncommunications electromagnetic radiations emanating from other than nuclear detonations or radioactive sources."

Radar characteristics (RADINT) are a major goal of ELINT. Other disciplines include developing the information for meaconing, or interference with enemy navigational systems, including systems intended to tell bombers where to release their bombs (e.g., tje WWII British GEE system or the German Knickebein system.

Yet other ELINT disciplines include intercepting and analyzing enemy weapons control signals, or the Identification, friend or foe responses from transponders in aircraft used to distinguish enemy craft from friendly ones.

ELINT is a prerequisite to electronic warfare. In the context of electronic warfare, ELINT is sometimes called electronic support measures (ESM). ESM is really part of ELINT, but tends to emphasize immediate tactical information, such as determining the specific radar that protects a path or is actually illuminating the aircraft with the ESM, as a prerequisite to jamming or otherwise interfering with the radar.

RADINT

A very common area of ELINT is intercepting radars and learning their locations and operating procedures. This is abbreviated RADINT. Attacking forces may be able to avoid the coverage of certain radars, or, knowing their characteristics, electronic warfare units may jam radars or send them deceptive signals. Confusing a radar electronically is called a "soft kill", but military units will also send specialized missiles at radars, or bomb them, to get a "hard kill".

As mentioned above, RADINT can involve both ELINT and MASINT analysis.

ELINT for Meaconing

Meaconing^[5] is the combined intelligence and electronic warfare of learning the characteristics of enemy navigation aids, such as radio beacons, and retransmitting them with incorrect information. There are tales, perhaps apocryphal, that the meaconing was so confusing that an enemy aircraft landed, quite smoothly, at an airport of the other side.

FISINT

Main article: FISINT

FISINT (Foreign instrumentation signals intelligence) is a sub-category of ELINT, monitoring primarily non-human communication. Foreign instrumentation signals include (but not limited to) telemetry (TELINT), tracking systems, and video data links. TELINT is an important part of arms control verification.

SIGINT versus MASINT

Main article: MASINT

SIGINT and Measurement and Signature Intelligence (MASINT) are closely, and sometimes confusingly, related ^[6]. The SIGINT disciplines of commuications and electronic intelligence focus on the information in those signals themselves, as with COMINT detecting the speech in a voice communication or ELINT measuring the frequency, pulse repetition rate, and other characteristics of a radar.

MASINT also works with collected signals, but is more of an analysis discipline. There are, however, unique MASINT sensors, typically working in different regions or domains of the electromagnetic spectrum, such as infrared or magnetic fields. While NSA and other agencies have MASINT groups, the Central MASINT Office is in the Defense Intelligence Agency (DIA).

Where COMINT and ELINT focus on the intentionally transmitted part of the signal, MASINT focuses on unintentionally transmitted information. For example, a given radar antenna will have sidelobes emanating from other than the direction in which the main antenna is aimed. The RADINT (radar intelligence) discipline involves learning to recognize a radar both by its primary signal, captured by ELINT, and its sidelobes, perhaps captured by the main ELINT sensor, or, more likely, a sensor aimed at the sides of the radio antenna.

MASINT associated with COMINT might involve the detection of common background sounds expected with human voice communications. For example, if a given radio signal comes from a radio used in a tank, if the interceptor does not hear engine noise or higher voice frequency than the voice modulation usually uses, even thought the voice conversation is meaningful, MASINT might suggest it is a deception, not coming from a real tank.

See HF/DF for a discussion of SIGINT-captured information with a MASINT flavor, such as determining the frequency to which a receiver is tuned, from detecting the frequency of the beat frequency oscillator of the superheterodyne receiver.

Defensive SIGINT

There are a number of ways that a person or organization can defend against SIGINT. There is a delicate balance between the level of protection and the actual threat, as expressed in the cliches about "tinfoil hats". Nevertheless, there are measures appropriate for even individuals. TEMPEST is the unclassified US code name for a family of protective measures against interception not of your encrypted communications, but also for electronic "leaks" from the equipment, which might be intercepted by a sophisticated opponent. It is worth noting that US security authorities have waived TEMPEST (and related) protection measures for a great many facilities in the US, and even outside it. Yes, there is a threat, but it probably has been overstated for years. NSA, for example, doesn't use it extensively in their own headquarters, which has a sufficiently large and well-guarded physical campus that an opponent could not get close enough to intercept inherently weak signals.

Strong and well-managed encryption

While encryption discussed at length elsewhere in Wikipedia, it should not be forgotten that if one wants to protect messages and files, encryption is central to the defense. As important as the encryption process itself may be, it is vulnerable if the keys are not strong and protected, and, on computers, that the cleartext is deleted when not needed. Seemingly obvious, but too often protected, is making a practice of having as little cleartext hard copy as possible.

Protection against compromising emanations

There are risks that electronic, acoustic, or other information could "leak" from a computer system or other electronic communications devices.

The Risk

There are a variety of ways information can leak from equipment. Understanding some of their details requires a substantial knowledge of electronics, but a simple example might serve. Many people have put a radio receiver near a computer, to listen to music as they work, and discovered that the radio suffered clicks, squeals, and other interference. These interfering signals are radiating from various parts of the computer, especially its display but often also from the power and grounding system. TEMPEST is the name for one family of protective measures against an opponent intercepting these emanations and extracting sensitive information from them.

While not strictly within the scope of protecting against "leakage", a place where sensitive information is processed or discussed needs protection against hidden microphones, wiretaps, and other "bugging". Sometimes, an electronic sweep to verify TEMPEST compliance reveals the presence of hidden transmitters. Again, there is probably more suspicion than reality in most cases. A member of a crime organization, in the middle of a nasty divorce, or a foreign intelligence agent might have reason to worry, but, even with the serious questions about warrantless surveillance in the US and other countries, there is little reason for someone to go to the risk and expense of illegal surveillance on an ordinary citizen. TEMPEST is usually associated with direct electromagnetic radiation from the device, either free-space or through power and ground lines. TEMPEST generically talks about acoustic isolation, but that is fairly easily solved through physical security and noise damping, as well as searches for microphones.

There are several threats that have not been officially defined in the unclassified literature. Nevertheless, there are some informed guesses ^[7]:

*NONSTOP is a threat that involves some type of coupling of compromising RF energy from a classified system, which "leaks" into an independent RF-transmitting or -recording device such as cell phones, PDAs, pager, alarm systems. Commercial AM/FM radios are not considered a risk.

*HIJACK is a similar threat of coupling, but to some type of digital computer or related equipment.

*TEAPOT is a very different vulnerability, which appears to apply to incidental audio modulation of the backscatter from an RF, typically microwave, directed into the secure area. A passive resonant cavity bug of this type was discovered in a Great Seal of the United States presented by the USSR, but containing a resonant cavity with a wall that moved with sound in the room, thus imposing frequency modulation onto the backscattered signal.

Mitigation and Countermeasures

The word TEMPEST itself, and its meaning, are unclassified. Some of the techniques for measuring the compliance of a piece of equipment, or whether it is actually emitting compromising emanations, are classified. A good deal of the information has come into public view either through Freedom of Information Act queries^[8], books talking about interception techniques , inferences drawn from partially released documents, and straightforward thinking by electronic engineers. Some documents released fully or partially under FOIA:

#Red/Black Installation Guidance ^[9]

#Specification for Shielded Enclosures^[10]

#Specification for Shielded Enclosures (partially redacted) ^[11]

A number of individuals have made a hobby of ferreting out TEMPEST and related information^[12], and firms in the broader-than-TEMPEST business of Technical Surveillance Countermeasures TSCM also reveal concepts^[13].

Protection against side channel attacks and covert channels

A side channel attack is an unintentional vulnerability of an encryption device, not related to the encryption algorithm. Potential vulnerabilities include different processing and thus transmission speeds for blocks of plaintext with certain statistical characteristics, changes in power consumption, or compromising emanations.

Covert channels are deliberate means to elude communications security^[14]. They send out an unauthorized signal by stealing bandwidth from a legitimate, often encrypted channel. One low-bandwidth method would be to send information by varying the inter-block transmission times. A steganographic covert channel might use the low-order bit of pixels in a graphic image, perhaps not even consecutive pixels, in a manner that would not be obvious to a person looking at the graphic.

References

Further reading

• Bamford, James, Body of Secrets: How America's NSA and Britain's GCHQ eavesdrop on the world (Century, London, 2001)
• West, Nigel, The SIGINT Secrets: The Signals Intelligence War, 1900 to Today (William Morrow, New York, 1988)

See also

• SIGINT by Alliances, Nations and Industries
• SIGINT Operational Platforms by Nation
• SIGINT in Modern History
• List of intelligence gathering disciplines
• Canadian Forces Intelligence Branch
• National Security Agency
• HUMINT: Human intelligence
• Communications security (COMSEC)
• ELINT: Electronic intelligence
• MASINT: Measurement and Signature Intelligence
• IMINT: Imagery intelligence
• GEOINT: Geospatial Intelligence
• Narus: SIGINT hardware manufacturer referred to in Hepting vs. AT&T
• OSINT: Open Source Intelligence
• U.S. Marine Corps Radio Reconnaissance
• RAF Intelligence: Royal Air Force Intelligence Branch
• Traffic analysis
• Historical Electronics Museum

External links

• http://www.nsa.gov/sigint/ - SIGINT Overview
• http://www.nsa.gov/sigint/sigin00003.cfm - SIGINT FAQ
• http://www.fas.org/spp/military/program/sigint/overview.htm
• http://groups-beta.google.com/group/sigint - SIGINT Google Group
• David Alan Jordan, Decrypting the Fourth Amendment: Warrantless NSA Surveillance and the Enhanced Expectation of Privacy Provided by Encrypted Voice over Internet Protocol - Boston College Law Review, Vol. 47, 2006

•  • [ e] Signals Intelligence Agencies
DSD  CSE  VKoeL  DGSE  GCSB  GRU  NCC  FRA  GCHQ  NSA