The N.S.A. ‘s Sigint Enabling Project is a $ 250 million-a-year program that works with Internet companies to weaken privacy by inserting back doors into encoding products. This excerpt from a 2013 budget marriage proposal outlines some methods the agency uses to undermine encoding used by the populace. This excerpt from the N.S.A. ’ randomness 2013 budget request outlines the ways in which the representation circumvents the encoding protection of everyday Internet communications. The Sigint Enabling Project involves industry relationships, clandestine changes to commercial software to weaken encoding, and lobbying for encoding standards it can crack. When british analysts were cleared for the Bullrun program, they were given this briefing sheet outlining the sensitivities of the program, including the N.S.A. ‘s specific capabilities against wide used Internet encoding technologies .
BULLRUN CoI – Briefing Sheet
1. The ability to exploit targets ’ encrypted communications is extremely fragile and is often enabled through sensitive ECI programmes. The need to take extra measures to protect that capability has long been recognised. presently, about all decoding is carried out by PTD ( ARTHUR ) march with decrypts going to the IIB in the NOCON CoI ; some decrypts are placed in the ENDUE CoI due to the sensitivity or fragility of the exploitation capability .
Penetrating Target Defences is the code-cracking group within Britain ’ south Government Communications Headquarters, or GCHQ .
2. In holocene years there has been an aggressive campaign, head by NSA, to make major improvements in defeating network security and privacy involving multiple sources and methods, all of which are extremely sensitive and fragile. These include : Computer Network Exploitation ( CNE ) ; collaboration with other Intelligence Agencies ; investment in high-performance computers ; and development of advanced mathematical techniques. several ECI compartments may apply to the specific sources, methods, and techniques involved .
In 2000, the N.S.A. mounted a all-out attempt to preserve its access to the Internet. The means deployed the world ’ s fastest computers to break codes and began collaborating with engineering companies in the United States and abroad to build entree points into their products .
3. Making the best use of these raw capabilities requires that decoding work be widely deployed beyond PTD and the results of that processing be available to a wide-eyed stove of analysts. This inescapably makes it harder to protect this sensitive and flimsy capability and we need to counterbalance this by introducing measures to control access to this material and sharpen awareness of the sensitivities amongst those who have access .
Three years ago, the N.S.A. gained the capability to decrypt huge amounts of clamber Internet data .
4. To achieve this, NSA has introduced the BULLRUN CoI to protect our abilities to defeat the encoding used in network communication technologies. This covers both the “ fact of ” a capability against a particular technology and resulting decrypts ( which may be either plaintext or metadata ( events ). GCHQ is besides introducing BULLRUN. ( CSEC, DSD and GCSB are expected to do alike. )
The fully extent of the N.S.A. ’ s decoding capabilities is known only to a restrict group of top analysts from the N.S.A. and its counterparts in Britain, Canada, Australia and New Zealand ( the alleged Five Eyes group ). only they are cleared for the Bullrun program, the successor to one called Manassas — both names of American Civil War battles. The corresponding counterencryption program at GCHQ is Edgehill, named for the first conflict of the English Civil War .
5. The BULLRUN CoI is owned by ■■■■■ for Penetrating Target Defences ( PTD ). authority to manage the CoI is delegated to ■■■■■ ( presently ■■■■■ ) and ■■■■■ ( ■■■■■, presently ■■■■■ ) .
BULLRUN Sensitivity and Coverage
6. It is imperative to protect the fact that GCHQ, NSA and their signals intelligence partners have capabilities against particular network security technologies ampere well as the number and scope of successes. These capabilities are among the Sigint community ’ s most fragile, and the accidental disclosure of the dim-witted “ fact of ” could alert the adversary and consequence in immediate loss of the capability. consequently, any entrance fee of “ fact of ” a capability to defeat encoding used in particular network communication technologies or disclosure of details relating to that capability must be protected by the BULLRUN COI and restricted to those specifically indoctrinated for BULLRUN. The assorted types of security covered by BULLRUN include, but are not limited to, TLS/SSL, hypertext transfer protocol ( e.g. webmail ), SSH, encrypted old world chat, VPNs and encrypted VOIP. The specific instances of these technologies that can be exploited will be published in a separate Annexe ( available to BULLRUN indoctrinate staff ) .
The agency has circumvented or cracked much of the encoding that guards ball-shaped commerce and bank systems, protects sensitive data like trade secrets and medical records, and automatically secures basic Internet communications, including the e-mail, Web searches, Internet chats and earphone calls of millions of Americans and others around the world .
7. In addition to the specific technologies that GCHQ or its signals intelligence partners are able to exploit, the methods used to achieve the exploitation must besides be protected. These include patronize from early organisations, both internal and external to GCHQ. Access to BULLRUN does NOT imply any “ need-to-know ” the details of sources and methods used to achieve exploitation and, in general, there will be NO “ need-to-know ”. Requests for access to information on sources and methods should be sent to OPC-SEC ; if considered allow, this access may require headroom for certain ECIs .
Unlike some relegate information that can be parceled out on a rigorous “ want to know ” basis, the Bullrun program is so secret that, in general, there will be nobelium need to know .
8. BULLRUN material, datum, and details must be protected with the use of the BULLRUN CoI and be marked with the tag “ BULLRUN, ” in addition to the command privacy marking and other descriptors. use of the BULLRUN score is restricted to GCHQ and its Sigint 2nd Parties .
Access and Security
9. Requests for access to the CoI must be sponsored by a GC8 or above and must be accompanied by a business encase outlining the “ need-to-know ”. Access for contractors will be limited and will require a hard business character ; such requests should be discussed with the CoI Authority ’ sulfur delegates before submission. Requests for access are to be sent by electronic mail to PTDAccesses .
only a humble cadre of contractors were allowed to join Bullrun. It does not appear that Edward J. Snowden had access, but he managed to gain access to dozens of relegate documents mentioning Bullrun.
Read more: Dual_EC_DRBG – Wikipedia
10. Knowledge of BULLRUN data and access to the BULLRUN CoI will lone be granted to indoctrinate individuals .
11. It is the duty of sponsors ( or their successors ) to notify ■■■■■ when an individual no longer require access to BULLRUN .
12. Owners of BULLRUN materials are responsible for correctly marking the information and for ensuring that it is handled according to guidelines for protecting classified or COI information .
13. Reports derived from BULLRUN material shall not reveal ( or imply ) that the source data was decrypted. The network communication engineering that carried the communication should not be revealed .
14. far dissemination, other than in product reports, of any data or information derived from BULLRUN data must be thoroughly justified and receive prior approval from ■■■■■ .
15. All questions or concerns regarding BULLRUN material and information should be directed to ■■■■■ .
protective Marking guidance
The following offers some steering on protective Markings ( PM ) for BULLRUN material. Questions regarding PMs can be directed to the CoI Authority ’ randomness delegates .
At SECRET STRAP1 COMINT AUSCANZUKUS EYES :
AUSCANZUKUS EYES stands for Australia, Canada, New Zealand, United Kingdom and United States, i.e., Five Eyes .
The fact that GCHQ has unspecified capabilities against network security technologies eg TLS/SSL, HTTPS, SSH, VPNs, IPSec. NB capability does not inevitably equate to decryption capability .
At TOP SECRET STRAP1 COMINT AUSCANZUKUS EYES :
The fact that GCHQ or its 2nd Party partners has some capability against the encoding used in a class or type of network communications technology. For example, VPNs, IPSec, TSL/SSL, HTTPS, SSH, encrypted chew the fat, encrypted VoIP .
At TOP SECRET STRAP2 COMINT BULLRUN AUSCANZUKUS EYES :
The fact that GCHQ or a 2nd Party partner has a capability against a specific encrypted network security engineering – see Annexe for details. ( At a minimum, specific capabilities may be protected by extra ECIs and limitation on “ Eyes ”. )
The fact that GCHQ or its partners exploits specific code network communications – see Annexe for details. ( At a minimum, specific capabilities may be protected by extra ECIs and restriction on “ Eyes ”. )
Decrypts ( plaintext or derived events / metadata ) obtained from BULLRUN capabilities. ( At a minimum, specific capabilities may be protected by extra restriction on “ Eyes ” and, in a few cases, extra ECIs. )
( U ) HTTPS – HTTP traffic secured inside an SSL/TLS session, indicated by the hypertext transfer protocol : // URL, normally using TCP port 443
( U ) IPSEC — IPSec, or IP Security, is the Internet Engineering Task Force ( IETF ) standard for layer 3 real-time communication security system. IPSec allows two hosts ( or two gateways ) to establish a procure connection, sometimes called a burrow. All traffic is protected at the network layer .
( U ) SSH – Secure Shell. A common protocol used for secure remote calculator access
( U ) SSL – Secure Sockets Layer. normally used to provide fasten network communication. widely used on the internet to provide secure web browse, webmail, instantaneous message, electronic department of commerce, etc.
Read more: How to use iPhone’s location tracking
( U ) TLS – Transport Layer Security. The follow-on to SSL, SSLv3 and TLSv1.0 are closely identical .
( U ) VoIP – Voice over Internet Protocol. A general term for the using IP networks to make voice phone calls. The application layer protocol can be standards-based ( for example, H.323, SIP ), or proprietorship ( for example, Skype ) .
( U ) VPN – Virtual Private Network. A secret network that makes use of the populace telecommunication infrastructure, maintaining privacy via the use of a burrow protocol and security procedures that typically include encoding. Common protocols include IPSEC and PPTP .