| GBPPR Special Collection Service |
| You thought your secrets were safe. You were wrong. |
Shown above is the NSA's Special Collection Service (F6) EINSTEIN/CASTANET hardware. They're located on the top floor or roof of the U.S. embassy in Berlin, and elsewhere, operating under the STATEROOM program. This is not normally a transmitting system, though it can be used for RF illumination, RF flooding, active fault injection, lulz, etc. when operating in "close access" operations.
This is primarily used as a wideband microwave SIGINT (bug repeater, telco microwave backbones, Wi-Fi, GSM/cellular, satellite/VSAT up & downlinks, etc.) collection system.
Note the dual wideband log-periodic antenna feeds (horizontal/vertical polarization, 0.5-18 GHz, probably with pre-amplifiers) and the precision (fraction of a degree - Az/El) stepper motor dish positioning system. Additional electronics can be mounted onto the back of the dish.
The "curtain" in the background is made of conductive fabric to knock down stray or compromising radio frequency energy - and to block the setup from nosey diplomatic staff.
The four-foot parabolic dish is designed to be broken down (without tools) into several smaller sections for concealment and transportation. Pacific Radomes is a manufacture of high-quality portable segmented parabolic reflectors.
EINSTEIN(?) is the antenna setup's codename.
CASTANET(?) is the handheld positional controller's codename and is based around a Qlarity QTERM G55/G56 data terminal (Qlarity Foundry Software Manual, Qlarity Programmer's Reference Manual).
The "US-968U" SIGINT Activity Designator (SIGAD) in this INTERQUAKE screenshot refers to a SCS collection site in Beijing, most likely operating out of the U.S. embassy. The listed frequencies, baud rates, bandwidths, and modulations (FSK/QAM) indicate they are intercepting the point-to-point microwave links between telephone/cellular sites and/or private commercial wireless networks. "SNR" is signal-to-noise ratio, and indication of received signal quality. "Az" and "El" are the azimuth and elevation angles to which the antenna system should be pointed to. "Pol" is the feed antenna polarity, either horizontal or vertical.
STATEROOM sites are covert SIGINT collection sites located in diplomatic facilities (embassies, consulates, hotel rooms, etc.) abroad. SIGINT agencies hosting such sites include SCS (at U.S. diplomatic facilities), Government Communications Headquarters or GCHQ (at British diplomatic facilities), Communication Security Establishments or CSE (at Canadian diplomatic facilities), and Defense Signals Directorate or DSD (at Australian diplomatic facilities). These sites are small in size and in number of personnel staffing them. They are covert, and their true mission is not known by the majority of the diplomatic staff at the facility where they are assigned. The antennas are sometimes hidden in false architectural features or roof maintenance sheds. "Survey Sites" are short-term collection efforts to determine the volume and types of signals which can be intercepted at the site. If the site turns out to be productive, a permanent collection site may subsequently be established.
From SIDtoday:
For such cases, the Special Collection Service is always looking for ways to pack the maximum amount of collection capability into the minimum amount of space. SCS's Access and Analysis Division (AAD) recently developed a new, user-friendly collection suite called the SIGINT Optimization and Analysis Platform, or "SOAP." It packs a variety of important collection capabilities into a single Pelican container, using off-the-shelf hardware and custom SIGINT-related software.
In its current form, SOAP comprises all of the following capabilities, which add up to a versatile package:
- Dual-processor server class "lunchbox" computer
- SCIATICA computer-assisted RF search tool
- Repackaged compact microwave receiver
- SHARKTAIL PCI receiver
- MARMOT demodulator
- HALFLEX radio processor
- DIA DEM (diagnosis and demodulation) software
- BLACKMAGIC modem analyzer
- TAROTCARD and HOBGOBLIN payload analysis tools
- JUGGERNAUT GSM processor
- Other applications as required for the tasked mission
"EINSTEIN/CASTANET hardware has nothing to do with satellite signal interception - although in theory there is no reason why it could not be configured for such use.
EINSTEIN/CASTANET is an SCS developed product which has been around for quite a while in one form or another. It is typically used in local/close-up intercept situations where surreptitious penetration of a target location is not been possible. (e.g. secure office, cipher room, diplomatic premise, etc, etc...).
Specific to its ability is very very precise and accurate dish positioning (fractions of a degree) and control of polarisation. Phase angle can also be exploited in certain situations. It is able to function as both a receiver as well as transmitter - the transmitter been used to transmit modulation which when 'received' by a target is it's self then re-modulated and reflected back to the dish. It is from this reflected & re-modulated carrier that target data/intelligence is extracted ..... and that, sadly, is pretty much all I can share with you regards its function and capability." --- Electrospaces.net comment from "Anonymous".
"As a former employee of the Special Collection Service (SCS) for over 15 years, and travelling to all corners of the globe to perform intelligence gathering on behalf of the United States goverment; there were never any 'black bag' missions tasked upon the SCS. This is a myth that may have grown out of the SCS's close working association with the Central Intelligence Agency (CIA). While employees of the SCS may have supported such operations usually conducted by the CIA, the SCS had no requirement under its charter to conduct such operations on its own. The information referenced in your article should be corrected/deleted." -- Comment from "Maroonarcher" on the Special Collection Service's Wikipedia entry.
"I have a fun little anecdote here: I have snuck up to the rooftop of the Habana Libre Hotel several times since 2015, in order to take photos. The view is great, and dodging security is simple (tip the elevator girl, and make a quick run to the fire escape stairs on the top floor when nobody's looking).
On one occasion, probably in late 2015, I stumbled upon a sheet metal shed and a uniformed, armed guard sleeping in a chair next to it, on the north-west corner of the building. There also was an array of what looked like a bit like satellite dishes and those laser data transmitters I had seen at my university at home, but I'm not an expert on this kind of stuff. It was a whole bunch of different devices on temporary tripods, apparently not a permanent installation. I distinctly remember finding it odd that all the stuff was angled downwards though. I assumed that it was for espionage/surveillance purposes, as Internet was basically non-existent in Havana back then, and it didn't look like cell phone transmitters at all. The things were all aimed into the general Vedado residential area direction, which is where a whole bunch of embassies are located (not the current U.S. one though).
I didn't investigate any further, and proceeded to the other side of the roof in order to avoid detection. You'll probably want to call bullshit on this right away. Here's a pic of the elevator engines on the top floor that I posted 2 years ago, and another one from the roof, although from a different year. There's even a chance I'll get back there in a few weeks; I might try and check it out once more." -- Comment from "instantpancake on Reddit.
Thermal infrared imaging show how activity in the U.S. embassy's rooftop spying nest significantly reduced from October 24 (top picture) to October 25, after it emerged that the U.S. bugged Chancellor Merkel's phone (ARD Panorama, via The Independent)
The radar unit (CTX4000/PHOTOANGLO) generates an unmodulated, continuous wave (CW) signal. The oscillator is either generated internally, or externally through a signal generator or cavity oscillator. The unit amplifies the signal and sends it out to a RF connector, where it is directed to some form of transmission antenna (horn, parabolic dish, log-periodic antenna, spiral).
The signal illuminates the target system (RF flooding) or implant (back-scatter modulation) and is re-radiated. The receive antenna picks up the re-radiated signal and directs the signal to the receive input.
The signal is amplified, filtered, and mixed with the transmit antenna. The result is a homodyne receiver in which the RF signal is mixed directly to baseband. The baseband video signal is ported to an external BNC connector. This connects to a processing system, such as NIGHTWATCH, an LFS-2, or VIEWPLATE, to process the signal and provide the intelligence.
The CTX4000/PHOTOANGLO provides the means to collect signals that otherwise would not be collectable, or would be extremely difficult to collect and process.
The CTX4000/PHOTOANGLO may require the installation of ANGRYNEIGHBOR hardware implants to act as back-scatter modulators (retro-reflectors) for the required target data:
TAWDRYYARDCloseup view of the TAWDRYYARD retro-reflector. The 6-pin device is the square wave oscillator (microcontroller - PIC10F20x-series, tinyAVR, etc.) This feeds the gate of a FET, located on the back of the device. The red wire is +3V from a lithium coin cell and the black wire is ground. The oscillator frequency is chosen to be unique and can even be pulsed to reduce power consumption.
RAGEMASTERCloseup view of a RAGEMASTER retro-reflector inserted in a VGA monitor cable. The red thing is an enameled air-core inductor (connecting isolated cable shields, couple H&V sync via ground spikes to FET's drain antenna), the thing with the "U" label is the NEC NE33284A FET, the black thing with numbers (left) is a 1 MΩ bias resistor (gate to source tied to left shield ground), the black rectangle (right) is a diode (DC restore clamp) on the FET's gate to source (ground), the brown rectangle (top) is a capacitor (AC coupled red video to gate, 0.1 µF). The short little wire on the FET's drain to (right) cable shield is the antenna. The yellow film is Kapton tape. A fake moulded ferrite bead covers the implanted FET circuit. A TAWDRYYARD beacon is required to identify the general location of a RAGEMASTER implant. An external processing unit (LFS-2, NIGHTWATCH, GOTHAM, VIEWPLATE) is used to analyze/detect/filter and reinsert the H&V sync signals and display the target video signal.
LOUDAUTOCloseup view of a LOUDAUTO retro-reflector. The Knowles EK/EY-series microphone is on the left, the little black rectangles with numbers are resistors, the brown rectangles are capacitors (filtering and blocking DC bias), the 6-pin device is the PPM (ultrasonic) clock generator (microcontroller - PIC10F20x-series, tinyAVR, etc.), the white circle thing with the "Ax" label is the (MGF1302) FET. Top of the "A" is the gate. The red wire is +3V from a lithium coin cell and the black wire is ground. The vertical wire at 1-15/32" is the antenna on the FET's drain.
0.) This assumes your RadioShack PRO-651/PRO-652 scanner if properly programmed to the P25 trunked radio system you want to monitor and the scanner is set to output Control Channel data on the PC/IF jack. This can be done using the PSREdit500 program and selecting Enable CC Dump under Other Options.
From the PSREdit500/Pro96Com FAQ:
Q.) How do I get the PSR-500, PSR-600, PRO-106 or PRO-197 to output control channel data to decode? A.) The PSR-500, PSR-600, PRO-106, and PRO-197 have the capability to send control channel data to the PC/IF port anytime the scanner is monitoring a control channel. While this data may be decoded by Pro96Com, this data stream will be lost by Pro96Com whenever a voice channel becomes active, or conventional, search, or sweeper objects are being scanned. In addition, if you are monitoring a multi-site system, Pro96Com will constantly reload the data each time it finds a new site. To get a steady stream of data, these radios need to be placed into analyze mode on an active control channel. There are two ways to get into analyze mode. In manual mode, locate a talkgroup that's a member of the system you want to monitor. Once located, Press the F2 (TSYS) key, then the F3 (Analyz) key. Using the up or down arrows, locate an active control channel. When you see the decoded information on the screen, the scanner is ready to send the control channel data. In scan mode, you can wait for a talkgroup on the system to become active, at which point you can follow the same procedure (F2/F3) to place the scanner in Analyze mode. Pro96Com User Manual1.) Connect a RadioShack USB-to-PC Scanner Programming Cable (Cat. No. 20-546) between your RadioShack PRO-651/PRO-652 scanner's PC/IF jack and an open USB jack on your Linux computer. Do a dmesg and you should see something like this:
Note the ttyUSB0 entry. This is the serial device we'll be using in minicom.
2.) Run minicom -s and go to Serial port setup. Change the Serial Device to /dev/ttyUSB0, or whatever the dmesg showed. Go back to the menu and choose Exit.
3.) If everything worked out, you should see something like this:
Don't mind the "**** CRC Error ****" messages. That's RadioShack's fault, not yours.
4.) Hit Ctrl+A L (hold down Ctrl and A, then hit L). This will bring up a menu asking Capture to what file?. Type anything you want, but it helps to name/number them so you remember what they are, LOL. The output from minicom will now be displayed in the terminal window and captured in a text file.
5.) This is the raw Control Channel data. Look for lines like this:
In this example, the first line means Radio ID (RId) 57345E (in hexadecimal) used Talkgroup ID 25561 (in decimal). Converting the RId from hex, we get Radio ID 5715038, which is a portable unit with the Oneida Nation Police Dept., using the "Oneida Nation Police - Main Dispatch" talkgroup on the Brown County SIREN 700 MHz public safety radio system (Voice Channel at 770.80625 MHz).
For the second line, Radio ID (RId) 57CBC9 (in hexadecimal) used Talkgroup ID 25791 (in decimal). Converting the RId from hex, we get Radio ID 5753801, which is the base station radio for NEW Water (Green Bay Metro Sewer & Water), using the "NEW Water - District 1" talkgroup on the Brown County SIREN 700 MHz public safety radio system (Voice Channel at 771.15625 MHz).
You can now Find, Fix, and Finish (or jam) an individual user on the radio system via their unique Radio ID.
extractIDs.sh This is a simple shell script to extract new Radio and Talkgroup IDs from Control Channel data dumps made via the above described method. Read the source for more info.
Usage: ./extractIDs.sh [log filename]
Notes / Links
- Radio Scanner Modifications and Information
- Microwave Radio Path Analysis This is the new one I made based around SPLAT! v2.0-alpha.
- Low-Cost Construction Using Surplus Satellite TV LNBs Good source for cheap microwave LNAs.
- Using a Surplus 1 Watt TBQ-3018 VSAT Amplifier Module for 10 GHz Amateur Band Operation
- Using Surplus VSAT Power Amplifier Modules on 10 GHz
- Building a 10 GHz Band Ham Tranciever from Hughes VSAT Hardware
- Electromagnetic Information Extortion from Electronic Devices Using Interceptor and Its Countermeasure
- On the Issue of Assessing the PEMIN of Analog Low Frequency Scattering Fields (Russian)
- A Little About Vibration, Vibration Velocity, and Vibration Acceleration (Russian)
- Testing Laboratory on the Issue of Assessing the PEMIN of Digital Signals #1 (Russian)
- Testing Laboratory on the Issue of Assessing the PEMIN of Digital Signals #2 Covers hard and optical disks. (Russian)
- On the Issue of Assessing the PEMIN of Analog-Digital Signals (Russian)
- The Physical Nature of PEMIN as the Basis for the Formation of Information Leakage Channels (Russian)
- Eavesdropping Using "RF Imposition" Methods (Russian)
- A Feasibility Study of Radio Frequency Retroreflector Attack
- Passive Binary-Modulated Backscatter in Microwave Networks With Applications to RFID by Daniel Gregory Kuester
- A Low-Power Backscatter Modulation System Communicating Across Tens of Meters With Standards-Compliant Wi-Fi Transceivers
- Collection of Digital Receiver Technology PDFs The NSA's "DRTBOX" is also by Digital Receiver Technology, now a wholly-owned subsidiary of Boeing Corp. They are used to intercept and breakout (decrypt) cellphones for the ONEROOF tactical SIGINT audio collection system.
- General DynamicsModel 700-70TCK Torus Multiple-Band Antenna
- There is an NSA/CIA Hybrid Agency That may explain Snowden's involvement in SIGINT and HUMINT, by Wayne Madsen
- Back Channels - With National Security Reporter Vernon Loeb March 2001
Washington, D.C.: Since the disclosure of the tunnel under the Russian Embassy there has been less coverage of the Special Collection Service angle of the Hanssen by the media. Do you think this "tunnel story" was deliberately leaked by the government to divert media attention from the Special Collection Service?
Vernon Loeb: I do not believe the tunnel story was deliberately leaked by the government. I think the government would much prefer that it had not come out. If the government had leaked the story, presumably the "government" would have been more forthcoming with me about the tunnel, which I can assure you, it was not. My conversations with current government officials about the tunnel ended very quickly, indeed. And I don't believe they're trying to deflect attention from the Special Collection Service. I mean, it is basically known that the Special Collection Service exists as a means of combining human spies and techies - a means of getting up close and personal to targets by fusing HUMINT and SIGINT. Hanssen can't compromise the Special Collection Service - it's an agency, or unit. He could, and probably did, compromise some of its operations. But I've seen nothing specific on such a compromise.
- Inside the Secret World of America's Top Eavesdropping Spies Officially, the Special Collection Service doesn't exist. Unofficially, its snoops travel the world intercepting private messages and cracking high-tech encryptions. (Mirror)
Books
- Friendly Spies: How America's Allies Are Using Economic Espionage to Steal Our Secrets Offers an account, based on interviews with intelligence officials, of the economic espionage perpetrated by the United States' allies against the nation's businesses and government to gain a competitive edge in the world economy, by Peter Schweizer
- The Spy in Moscow Station: A Counterspy's Hunt for a Deadly Cold War Threat by Eric Haseltine
TSCM textbooks provide another tantalizing clue about what Gandy and colleagues might have been doing to track down the lethal information leaks. Electronic circuits in rooms where conversations are occurring can vibrate slightly with acoustic energy generated by speech, exactly as the diaphragm of a microphone vibrates. Just as microphones convert such vibrations into a voltage that is then amplified and transmitted (e.g., via a telephone receiver, a public address system), minute vibrations of electronic circuit boards cause subtle changes in the electrical properties of transistors and other components. When such changes occur in a circuit that oscillates (such as a digital clock that oscillates between one and zero in most electronics), voice signals that vibrate an electronic circuit having an oscillator will slightly modulate (change the amplitude, or pitch) of that oscillation. Since, according to principles of physics, any oscillation in an electronic circuit will transmit some RF to the outside world, a sensitive receiver can pick up and decode unintended voice transmissions from many types of electronic equipment.
- Body of Secrets: Anatomy of the Ultra-Secret National Security Agency by James Bamford
In fact, the combination of human and machine spies may, in the end, save both. According to senior intelligence officials, in 1978 a covert joint intelligence organization was formed, which marries the clandestine skills of the CIA with the technical capabilities of the NSA. The purpose of this Special Collection Service (SCS) is to put sophisticated eavesdropping equipment - from bugs to parabolic antennas - in difficult-to-reach places and to target key foreign communications personnel for recruitment.
The SCS, whose headship alternates between NSA and CIA officials, is an outgrowth of the CIA's former Division D, established in the early 1950s by William F. Friedman's first employee, Frank Rowlett. Worried about competition from the upstart NSA, Allen Dulles hired Rowlett away to set up a mini-NSA within the CIA. At the time, Rowlett was upset because AFSA/NSA Director Ralph Canine wanted him to switch jobs, going from chief of SIGINT to that of COMSEC, the codemaking side of the business. 'As it happened,' recalled fellow pioneer Abraham Sinkov, 'Rowlett was made quite unhappy by this suggestion; he wasn't very keen about moving over to COMSEC, and he transferred to the CIA.' (After about five years, Rowlett transferred back to the NSA.)
...
Today, the SCS is the successor to Division D. As encryption, fiber optics, the Internet, and other new technologies make life increasingly difficult for NSA's intercept operators and codebreakers, the SCS has greatly expanded and become increasingly important. Its goal, like that of television's old Impossible Missions Force, is to find unique ways around problems. 'Yesterday's code clerk is today's systems administrator,' said one very senior CIA official. The easiest way to acquire many secrets is to get into foreign databases, and the best way to do that is to recruit - by bribery or otherwise - the people who manage the systems. Also, by bribing someone to plant bugs in the keyboards or other vulnerable parts of a computer network, NSA can intercept messages before cryptographic software has a chance to scramble them.
The SCS is headquartered in a heavily protected compound of modern buildings on Springfield Road in Beltsville, Maryland, a few miles south of NSA. There, in what is known as the live room, the electronic environment of target cities is re-created in order to test which antennas and receivers would be best for covert interception. Elsewhere, bugs, receivers, and antennas are fabricated into everyday objects so they can be smuggled into foreign countries. 'Sometimes that's a very small antenna and you try to sneak it in,' said former CIA director Stansfield Turner. 'Sometimes the signal you're intercepting is very small, narrow, [of] limited range, and getting your antenna there is going to be very difficult. I mean, under Mr. Gorbachev's bed is hard to get to, for instance.'
While on occasion NSA or SCS has compromised a nation's entire communications system by bribing an engineer or telecommunications official, often much of the necessary eavesdropping can be done from special rooms in U.S. embassies. But in difficult countries, clandestine SCS agents must sometimes fly in disguised as businesspeople. An agent might bring into the target country a parabolic antenna disguised as an umbrella. A receiver and satellite transmitter may seem to be a simple radio and laptop computer. The SCS official will camouflage and plant the equipment in a remote site somewhere along the microwave's narrow beam - maybe in a tree in a wooded area, or in the attic of a rented farmhouse. The signals captured by the equipment will be remotely retransmitted to a geostationary SIGINT satellite, which will relay them to NSA. At other times, no other solution is possible except climbing a telephone pole and hard-wiring an eavesdropping device.
The SCS will also play a key role in what is probably the most profound change in the history of signals intelligence - the eventual switch from focusing on information 'in motion' to information 'at rest.' Since the first trans-Atlantic intercept station was erected on Gillin Farm in Houlton, Maine, just before the close of World War I, SIGINT has concentrated on intercepting signals as they travel through the air or space. But as technology makes that increasingly difficult and prohibitively expensive, the tendency, say senior intelligence officials, will be to turn instead to the vast quantity of information at rest - stored on computer databases, disks, and hard drives. This may be done either remotely, through cyberspace, or physically, by the SCS.
- The Puzzle Palace: Inside the National Security Agency, America's Most Secret Intelligence Organization by James Bamford
- The Shadow Factory: The Ultra-Secret NSA from 9/11 to the Eavesdropping on America by James Bamford
Although tapping into underground fiber-optic lines is much more difficult than tapping into a copper cable, the technique has been perfected by the NSA. For cables buried in foreign countries, the task of gaining access to them was given to a unique covert organization named the Special Collection Service (SCS), which combined the clandestine skills of the CIA with the technical capabilities of the NSA. Its purpose is to put sophisticated eavesdropping equipment - from bugs to parabolic antennas - in difficult-to-reach places. It also attempts to target for recruitment key foreign communications personnel, such as database managers, systems administrators, and IT specialists.
The position of SCS chief alternates between NSA and CIA officials. The service is headquartered in a heavily protected, three-hundred-acre compound consisting of three boxy low-rise buildings with an odd, circular park walled in between them. Located at 11600 Springfield Road in Laurel, Maryland, nine miles south of the NSA, the facility is disguised as a tree-lined corporate campus. In front is a sign with the letters 'CSSG' that seems not to have any meaning. Inside, in what is known as 'the live room,' the electronic environment of target cities is re-created in order to test which antennas and receivers would be best for covert interception. Elsewhere, bugs, receivers, and antennas are incorporated into everyday objects so they can be smuggled into foreign countries. 'Sometimes that's a very small antenna and you try to sneak it in,' said former CIA director Stansfield Turner. 'Sometimes the signal you're intercepting is very small, narrow, limited range, and getting your antenna there is going to be very difficult.'
While in some places the NSA or SCS has compromised a nation's entire communications system by bribing an engineer or telecommunications official, in others much of the necessary eavesdropping can be done from special rooms in U.S. embassies. But in difficult countries clandestine SCS agents must sometimes fly in disguised as businesspeople and covertly implant the necessary eavesdropping equipment. The person might bring into the target country a parabolic antenna disguised as an umbrella. A receiver and satellite transmitter may be made to appear as a simple radio and laptop computer. The SCS official would then camouflage and plant the equipment in a remote site somewhere along the microwave's narrow beam - maybe in a tree in a wooded area or in the attic of a rented farm house. The signals captured by the equipment would be remotely retransmitted to a geostationary SIGINT satellite, which would then relay them to the NSA.
In order to obtain access to fiber-optic cables in non-cooperative or hostile foreign countries, the SCS would trace the cable to a remote area and then dig a trench to get access to it. Then the person would place an advanced 'clip-on coupler' onto the cable. These commercially available devices, used to test fiber-optic systems, produce a microbend in the cable that allows a small amount of light to leak through the polymer cladding shell. The light can then be captured by a photon detector, a transducer that converts the photons into an electrical signal. This then connects to an optical/electrical converter that is plugged into a port on a laptop fitted with software allowing for remote control. Packed with super-long-life batteries, the entire system can be reburied with a camouflaged line running up a tree to an antenna disguised as branches. Signals from the bug can then be transmitted to an NSA satellite while remote-control instructions are broadcast back down to the computer. All of the equipment needed is commercially available.
- The Wizards Of Langley: Inside The CIA's Directorate of Science and Technology by Jeffrey T. Richelson
Details of the merger of embassy intercept operations were worked out between Vice-Adm. Bobby Inman, who became NSA director in July 1977, and OSO chief Barry Kelly. It was agreed that the joint enterprise, to be called the Special Collection Service (SCS), would be initially headed by a CIA official who would serve a two-year term. The deputy director of the SCS would be selected from NSA, and an NSA official would become director after the CIA official completed his term. The director's job would continue to alternate between CIA and NSA officials, with the director's deputy succeeding him.
Things did not get off to a smooth start. Many in OSO were not happy with the formation of the SCS and didn't want to be part of a group that would be managed by an NS A official half the time. Appointed to be the first head of the new service was Roy Burks. From NSA, Bill Black, a senior operations official, was selected to serve as deputy. Neither man, Burks later recalled, was involved in the bitter fighting that preceded the merger, a factor that gave them a better chance to make the new arrangement work.
According to Burks, there were people on both sides who seemed to want to make things difficult. Among the obstacles SCS faced was getting the CIA to courier documents to its College Park headquarters, forcing Burks to send a cleared secretary. The CIA did not want to send material to College Park because NSA people, at that time, were not polygraphed. Only when NSA began routinely giving polygraphs to its employees did the CIA feel comfortable in sending classified documents to SCS headquarters.
But by the end of 1983, joint CIA-NSA Special Collection Elements would be present in about a third of U.S. embassies abroad. The teams, which might consist of only two or three people, produced excellent intelligence, particularly if the embassy was located on high ground or near the foreign or defense ministries or other key offices in the capital. The sites were particularly effective in East European capitals.
...
In spring 1995, U.S. officials met the flag-draped coffin of Gary C. Durrell at Maryland's Andrews Air force Base. Durrell, a forty-four-year-old father of two, had died shortly before in Pakistan, the victim of terrorist gunfire. His death was another reminder that, for some, working for the Directorate of Science and Technology could be just as dangerous as working for the Directorate of Operations; Durrell had been in Pakistan as part of the Special Collection Service's Karachi element.
The SCS had continued to pay significant intelligence dividends during the Hineman and Hirsch years. SCS elements could be found in embassies in Moscow, Beijing, Buenos Aires, Santiago, Tel Aviv, Tegucigalpa, and another forty capitals. In Tegucigalpa, the SCS element monitored the police and military as well as the terrorist activities of some of the forces opposing the government. The Tel Aviv outpost intercepted Israeli military and national police communications - allowing the State Department to be informed about, among other things, police activities directed at the Palestinians. Undoubtedly, during the abortive attempt to oust Mikhail Gorbachev in August 1991, the Moscow embassy listening post intercepted whatever communications of the coup plotters, including the KGB chairman and Minister of Defense, could be snatched from the airwaves.
Other SCS missions involved a closer approach to the target. An SCS operation might involve eavesdropping from a van outside the window of a foreign ministry official - which might make it possible for an analyst to read every message being written in the official's office at the time it was being written. Another project allegedly involved capturing pigeons that roosted outside the Soviet embassy in Washington and attaching small microphones to them. After returning to their perch outside an open office window, they produced "incredibly good results," according to a former Canadian intelligence officer.
One operation involved bugging the Chinese ambassador to Washington, who frequently talked about sensitive matters while sitting on a bench in the embassy compound. SCS technicians developed a fiberglass "twig," which contained a listening device. It was tossed into the compound near the bench. SCS bugging operations also involved crystal objects, mugs, porcelain roses, dried floral arrangements, a small totem pole, as well as an icon of the Virgin Mary holding the baby Jesus painted on a one-inch-thick piece of wood. All were planted in offices or offered to diplomats as gifts.
One SCS officer arrived in Kabul toward the end of 1984 and spent several hours a day pretending to be a diplomat, meeting with Afghanis who wanted to travel to the United States, visiting the Foreign Ministry, and attending receptions. But he spent most of his time, usually in twelve-hour stretches, in a windowless suite of three small rooms protected by an electronic lock. One room was a lounge; another served as a storage area for the eavesdropping equipment. In the third room, electronic devices were piled up to the ceiling - creating a wall of knobs, buttons, tape recorders, and glowing oscilloscopes. Relying on a massive guide labeled TEXTA (for Technical Extracts from Traffic Analysis), the eavesdroppers could find what frequencies their targets employed.
The SCS officer monitored Afghan troops as well as the military airport tower, noting on three-by-five index cards aircraft types, arrival and departure times, and destinations. A copy of each teletype message sent by an Afghan government official appeared on a printer in the room. The SCS element in Kabul was able to provide coverage across the country. Included was a grisly intercept reporting that the Afghan resistance had peeled off the skin of a captured Soviet soldier while he was still alive. According to a former Reagan administration Middle East expert, "They were plugged in on Afghanistan... We were soaking up everything."
In Pakistan, Gary Durrell and his SCS colleagues were undoubtedly soaking up as much information as they could. Durrell was a native of Alliance, Ohio. As a member of the Air Force Security Service, the Air Force component of NSA, he worked at eavesdropping sites in Texas andi Italy. In 1977, he joined NSA, and spent the next eight years in England at the RAF Chicksands eavesdropping site - which intercepted both Soviet and West European communications. In 1987, he "resigned" from NSA, ostensibly to join the State Department. In fact, he joined the SCS, which by then had moved into its new headquarters in Beltsville, Maryland. The sign outside those headquarters indicated the site housed the State Department's "Communications Systems Support Group."
Before heading overseas, Durrell trained at a site in Maryland that had the appearance of a high-tech company. At the "Maryland Field Site," as it is referred to in unclassified documents, Durrell and his fellow trainees were instructed on the use of sophisticated listening equipment, some of the equipment no bigger than a briefcase and some stacked like the stereo equipment one might find in a living room. They were trained to do their eavesdropping from locked rooms inside embassies and consulates.
When he left the Maryland Field Site, Durrell had a cover story, foreign currency, and business cards, with the phone number of a notional boss who would vouch for him. Durrell had also studied photographic albums showing the landmarks and intersections in what was to be his new neighborhood, so as to eliminate the need to ask directions or otherwise call attention to himself. To further enhance his State Department cover, he memorized his purported travel route to the department's Foggy Bottom headquarters, including the bus route and closest Metro stop. He probably, as was usually the case, had also been formally appointed to the United States Foreign Service, with a certificate signed by President Reagan and his Secretary of State as proof.
In the first five years after joining the SCS, Durrell worked under State Department cover in Bangkok, Bombay, and Djibouti. His reports were sent via satellite to a complex of antennae adjacent to the Maryland Field Site. Inside the consulate in Karachi, Durrell spent four months intercepting communications concerning narcotics trafficking, terrorism, and nuclear proliferation.
That mission came to an end on March 8, 1995. As he was riding in a consulate van on his way to work, terrorists leaped from a stolen taxi and fired their AK-47 assault rifles at the van. Sixteen bullets ripped into the van, killing Durrell and a consulate secretary and wounding another employee. The attack may have been a response to the arrest in Pakistan of Ramzi Ahmed Yousef, who would be convicted in the 1993 bombing of the World Trade Center in New York.
- Dark Mirror: Edward Snowden and the American Surveillance State by Barton Gellman
On the last day of training, Snowden and his classmates ranked their preferences for a first assignment. Snowden wanted a war zone. After Iraq or Afghanistan, his first choices, he asked for Geneva as a fallback. He had heard it was technically challenging, a big station with complex network infrastructure in a city with more spies per capita than most. That is where the agency sent him in March 2007. His bright red diplomatic badge featured a head shot of the baby-faced twenty-three-year-old in a blue suit, maroon dress shirt, and striped club tie. As far as the outside world was concerned, Snowden was a diplomatic attaché in the U.S. mission to the U.N. Geneva headquarters, State Department employee number 64554. Inside the embassy, he worked in the top-floor Information Technology Center. Alongside the CIA commo shop, each in its own gated space, were the State Department's communications team and the Special Collection Service personnel who eavesdropped on local targets for the NSA. In written communications, Snowden signed as 'Dave M. Churchyard.' That precaution, adopted after the sacking of the Tehran embassy in 1979, made it harder to identify him as an intelligence employee if someone broke into the classified records.
- Permanent Record by Edward Snowden
In the summer of 2008, the city [Geneva] celebrated its annual Fêtes de Genéve, a giant carnival that culminates in fireworks. I remember sitting on the left bank of Lake Geneva with the local personnel of the SCS, or Special Collection Service, a joint CIA-NSA program responsible for installing and operating the special surveillance equipment that allows U.S. embassies to spy on foreign signals. These guys worked down the hall from my vault at the embassy, but they were older than I was, and their work was not just way above my pay grade but way beyond my abilities - they had access to NSA tools that I didn't even know existed. Still, we were friendly: I looked up to them, and they looked out for me.
As the fireworks exploded overhead, I was talking about the banker's case, lamenting the disaster it had been, when one of the guys turned to me and said, "Next time you meet someone, Ed, don't bother with the COs [case officers] - just give us his email address and we'll take care of it." I remember nodding somberly to this, though at the time I barely had a clue of the full implications of what that comment meant.
- SpyWorld: Inside the Canadian and American Intelligence Establishments by Mike Frost (LibGen Entry)
He wonders what his NSA buddies are up to in 1994, and about the latest developments at College Park, the secret American 'special-collection' operation that is alternately run by an NSA and a CIA appointee. He chuckles when he thinks that, even within NSA, most people don't even have a clue College Park exists. He does. He was there. Several times. When Frost resigned, the CIA was technically in charge. But Frost knew that it didn't matter who had the top job at College Park: NSA ran the show, with orders coming directly from the White House - when they didn't make them up themselves.
By this time, NSA had also let the PILGRIM people in on their top-secret College Park installation where the Americans would set up strategies and invent and build more advanced technology for the sole purpose of doing intercept operations at home and abroad. College Park was also equipped with what NSA calls 'the live room.' This is a special room with antennas running around the ceiling, where American engineers actually re-create and radiate at very low power the electronic environment of any world city where an operation is planned. In this case, Frost and the two operators from CSE who went down to College Park for four days were actually able to 'hear' Caracas.
College Park, in particular, was a fascinating place. First of all because, if you weren't actually brought there, you would never guess it was the center of the highest technological espionage operation in the U.S. - perhaps the world. It wasn't at all like NSA headquarters, which blazons its name on a highway street sign. College Park actually looks like a strip mall when you first reach it. It is located in a relatively sparsely populated area near Washington, D.C., not too far from Laurel, Maryland, where Frost always overnighted when going down to NSA.
The first time Mike Frost was driven to the secret NSA-CIA installation, he went in through a restaurant that was part of the 'strip mall.' 'We walked through the restaurant and then went through a door at the back,' he remembers. The second time he entered after going through a dry-cleaning store. In other words, not only did the American espionage agencies have their covert operations installations hidden there, but they also owned, operated and manned all the little dinky businesses in the fake shopping-center.
You couldn't get to College Park, especially as a visitor from a foreign country, if they didn't know exactly who you were. You had to be driven there by an NSA or a CIA agent. What really struck Frost was how well the installations were camouflaged. To a trained eye like his, there was absolutely nothing like antennas or radomes that could give it away. 'I'm sure the people living in the area didn't know what was going on in their own backyard.'
Once there, you couldn't help but be overwhelmed by the feeling that here lay the real power in the intelligence-gathering universe. The person who ran College Park had enormous clout. One of the telephones on his desk was a direct link to the White House. It was, in Frost's mind, at the very least at Chief-of-Staff level if not direct to the President himself. Patrick O'Brien, although he had to go back and forth between the NSA headquarters in Fort Meade and his real base of operations, was in a certain way more powerful than the official director of NSA himself, if only because when he wanted something done, he didn't have to go through the bureaucratic motions other people at NSA had to deal with. The same went for O'Brien's successor from the CIA, Charles Clark. The directorship of College Park alternates every four years between the two spy agencies. Just the fact that NSA and the CIA accept an alternating directorship and the sharing of equipment and human resources within one facility gives an idea of how truly powerful and effective the 'strip mall' is. In fact it may just be what makes American counter-espionage and covert operations work, because without it the two giants would probably be constantly involved in self-destructive turf warfare.
Frost's best description of College Park is 'organized bedlam.' It is not the usual sanatorium-clean atmosphere you would expect to find in a top-secret installation. Wires everywhere, jerry-rigged gizmos everywhere, computers all over the place, some people buzzing around in three-piece suits and others in jeans and T-shirts. You could tell this was where things actually got done - there was little protocol and a lot of action.
It is a difficult place for Frost to describe, because its entrails are a maze of corridors and rooms - many of which had signs on them prohibiting access. 'It's just a fantastic place. It's a series of little compartments, all working independently on various projects, all of them covert operations.' None of the signs on the doors gave away the purpose of the locked room or what was going on inside. It was also impossible to figure out how many people actually work there. Unlike NSA headquarters, it doesn't have a gigantic parking lot to give it away. And the faces Frost saw there, with the exception of the top-level officials, seemed to change a lot from one visit to the next. Several people travel back and forth between there and NSA's or the CIA's main installations. Many are agents, working out in the field, on the move all the time.
Finally there was, of course, the 'live room,' so crucial for the preparation of PILGRIM agents. As far as Frost knows, there was only one 'live room' at College Park. The room was about 30 feet square, but was full of various types of equipment NSA and CIA agents used around the world. It was the basic training ground for covert intercept operators. If NSA had a certain kind of equipment being used in Moscow or a different gadget in Bucharest, it was also there.
Another feature of College Park is that it is located within the 'no-fly zone' that prevents any aircraft from flying over the White House.
I was asking Patrick one day if they couldn't be spied on from an airplane or a helicopter. He said: 'Don't worry about it. They can't fly over this place; we're too close to the White House.' That, in Frost's mind, is one of the main reasons for the location of the ultra-secret site."
- Electronics in Crime - Part 2 From Electronics Today International, August 1974
RF Flooding: This method amounts to flooding the telephone with high level RF energy and retrieving the signal which has been modulated by the carbon microphone inside the telephone handset.
The high level RF energy goes through the hook-switches and the phone does not have to be modified. It is very difficult to use against multi-line sets and is usually used only against single line sets.
A surveillance receiver or a telephone analyser with a built-in RF detector can be used to spot this device but only whilst it is in use.
Ashby & Associates TSS-101 Telephone Compromise Protection System Magnetically-induced white noise generator.
- The NSA's Secret Spy Hub in Berlin
- Germany Calls in Britain's Ambassador to Demand Explanation Over 'Secret Berlin Listening Post'
- PRISM: The Beacon Frame - Speculative NSA Forensics Equipment (Shutdown!)
NSA Targeting Record
The 'F666E' refers to the SCS- How NSA Targeted Chancellor Merkel's Mobile Phone
- Channel Four: Capenhurst Tower Channel Four news report on the mysterious Capenhurst Tower. Go inside a former GCHQ monitoring site. (Additional Info)
- The Traitor: The Case Against (((Jonathan Pollard))) "The men and women of the National Security Agency live in a world of chaotic bleeps, buzzes, and whistles, and talk to each other about frequencies, spectrums, modulation, and bandwidth - the stuff of Tom Clancy novels. They often deal with signals intelligence, or SIGINT, and their world is kept in order by an in-house manual known as the RASIN an acronym for radio-signal notations. The manual, which is classified 'TOP SECRET/UMBRA,' fills ten volumes, is constantly updated, and lists the physical parameters of every known signal. Pollard took it all. 'It's the Bible,' one former communications-intelligence officer told me. 'It tells how we collect signals anywhere in the world.' The site, frequency, and significant features of Israeli communications - those that were known and targeted by the N.S.A. - were in the RASIN; so were all the known communications links used by the Soviet Union."
- Feds to Offer FBI 'Mole' Sing-or-Die Deal "At the most damaging end of the spectrum, investigators are worried that Hanssen compromised the Special Collection Service program, a joint operation of the CIA and National Security Agency. The 'black budget' - or top-secret - program oversees the bugging of overseas embassies and government installations, using the most exotic technologies available."
- A Most Unusual Collection Agency How the U.S. undid UNSCOM through its empire of electronic ears.
- Weapons of the Secret War "That delicate and dangerous task is the forte of an unacknowledged U.S. intelligence agency bearing the innocuous name of Special Collections Service (SCS). The agency, housed in Beltsville, MD., a short freeway ride from NSA headquarters, is jointly staffed by the NSA and the CIA. Operating under cover from U.S. embassies around the world, the agency is known for Mission: Impossible-style operations - most famously, hiding bugs on pigeons that perched on windowsills of the Soviet embassy in Washington, D.C."
- Spy Suspect May Have Revealed U.S. Bugging "An affidavit outlining the government's case against Hanssen asserts that he 'compromised an entire technical program of enormous value, expense and importance to the United States.' It suggests obliquely that Hanssen gave the Russians information about a 'new technique' developed by the NSA and described to them a 'sensitive office' where an NSA employee worked. Although the affidavit does not mention the Special Collection Service by name, intelligence experts outside the government said that these and other references point to the global eavesdropping operation."
- NSA-CIA Special Collection Service - Bird's Eye (Mirror from 2002)
- CIA-NSA Special Collection Service Facility College Park, Maryland (Source)
- FAS Intelligence Resource Program: Special Collection Service Beltsville, MD
- Interception Capabilities 2000 "63. A joint NSA/CIA 'Special Collection Service' manufactures equipment and trains personnel for covert collection activities. One major device is a suitcase-sized computer processing system. ORATORY. ORATORY is in effect a miniaturised version of the Dictionary computers described in the next section, capable of selecting non-verbal communications of interest from a wide range of inputs, according to pre-programmed selection criteria. One major NSA supplier ('The IDEAS Operation') now offers micro-miniature digital receivers which can simultaneously process SIGINT data from 8 independent channels. This radio receiver is the size of a credit card. It fits in a standard laptop computer. IDEAS claim, reasonably, that their tiny card 'performs functions that would have taken a rack full of equipment not long ago.'"
- Barton Gellman Interview "Now what the CIA did not tell UNSCOM is that the people that they sent to install these radio relays were also covert operatives. And they rigged this equipment to have a second purpose. It's actually a joint operation of the CIA and the National Security Agency. They operate a service called the Special Collection Service, and it's quite skilled at building hidden antennae and covert listening devices. And these are quite large mass, these antennas, and they're spaced throughout the Iraqi countryside and they beam signals. They're like repeater stations used in commercial radio transmissions."
- NSA Hid Spy Equipment at Embassies, Consulates "A covert arm of the U.S. National Security Agency (NSA) called the Special Collection Service (SCS) has been installing secret signals intelligence equipment within diplomatic buildings to spy while abroad."
- Big Brother is Listening by Ross Coulthart
- The National Security Agency: The Biggest Eavesdropper of Them All A Covert Action Information Bulletin Interview (December 1980)
Q. What kind of interception takes place at these points?
There are two kinds of interception operations. One would be a cooperative interception operation, where the communications common carrier, such as AT&T in the U.S. is cooperating with the intelligence operation. The other is the covert operation, where the communications common carrier is not cooperating with the intercepting agency. Many covert operations involve interception of microwave multi-channel telecommunications circuits by a hidden antenna - in fact two antennas, one aimed at teach link of microwave towers.
Microwave interception can be on terrestrial microwave circuits as well as microwave circuits passing from a satellite to an earth station. The technologies are essentially the same in both cases. Also, it is possible to intercept multiple communications circuits that are passing over a wire or coaxial cable, wherein microwaves are not involved. Sophisticated pickup loops are used in proximity to the cable to intercept bundles of communications as they pass over it.
- Re: The Tempest Surrounding Tempest [Debunking the Myth] by Rocco Rosano (August 10, 2000) on James Atkinson's TSCM mailing list.
The 30 year old RF flooding technique is an example of a one type Hi-Jack Operation. Not generally practices anymore, they are all variations of targeting a RED emanation with a very clean carrier. As the carrier passes through the target, an exploitable emanation modulates the carrier. Through an A-B subtraction (available on most S/As today) the RED signal is extracted. Again, the emanation (a TEMPEST issue) is the target; but, the Flooding carrier is a TSCM issue.
- A Photo History of the NSA, from Its Once-Secret Archives
- The Spies Next Door The top 10 Beltway intel centers hiding in plain sight.
- Revealed: Britain's 'Secret Listening Post in the Heart of Berlin'
- NSA Summaries by Christopher Parsons
- Lux Ex Umbra Monitoring Canadian signals intelligence (SIGINT) activities past and present.
- The SIGINT Satellites of Pine Gap: Conception, Development and in Orbit
- GRU "Close Access" Operation Against the OPCW Slides from a presentation the MIVD gave on its operation to disrupt a GRU operation in Holland against the Organisation for the Prohibition of Chemical Weapons (OPCW).
- Mirror of NSA Playset (www.nsaplayset.org) Mike Ossmann's awesome project to make open-source examples of the hardware & software tools found in the NSA's ANT catalog.
- Attack on a SIGINT Collector: The USS Liberty NSA's version of events. (4.8M PDF)
- USS Liberty Memorial Mirror Archive of the old www.ussliberty.org website (including converted audio) which was easier to navigate.
- Collection of USS Liberty Memes/Vids/Info (OFFSITE)
- The Day Liberty Died (YouTube)
- Justice for Liberty
- USS Liberty Veterans Association
- The Man With the Israeli Accent USS Liberty Survivor's life threatened by Mossad on American soil while Uncle Sam yawns.
- The Men Killed in Israel's Attack on the USS Liberty
- USS Liberty Survivor Exposes What Really Happened Phil Tourney | Fight Back Ep.10
- The Cover-Up of the Tragic USS Liberty Incident with Phillip F. Tourney Spycraft 101 Podcast, Episode #142
Related Video
- NSA Foreign Satellite (FORNSAT) Exploitation
- Watkins-Johnson WJ-8617B - Spook Radio of the 1980s
- Instruction Manual for Watkins-Johnson WJ-8618B VHF/UHF Receiver Includes schematics. (337M PDF)
- There's a Spy Plane Circling My Neighborhood by saveitforparts
- Is That Really a Government Spy Plane Over My Neighborhood? by saveitforparts
CIA Documents Mentioning the SCS
- FY-80 Goals Program
- Transfer of Accountable Property From CIA to NSA
- SIGINT Operations
- Extracts from the Staff Meeting Minutes of 19 September 1979
- Staff Meeting Minutes of 7 March 1980
- Letter to the Honorable Edward P. Boland from John N. McMahon
- Report of Significant Activities During DCI's Absence
- Minutes of the 25 July 1985 CIA Occupational Safety and Health Committee
- SIS Pay
- Senior Training Courses
- Interagency SIGINT Agreement Noted by Stansfield Turner
- American Cryptology During the Cold War, 1945-1989 The resulting CIA/NSA agreement was referred to as the "Peace Treaty."
NSA SIDtoday Articles Mentioning SCS
- SID and the Secret Service
- Generally Speaking: Back from the Front
- SID Support to SOUTHCOM - Update on U.S. Hostages
- NSA Support to NATO Summit
- InSIDer's View of History: 'Local Support' as Stress Management
- CIA's Directorates... Understanding More About Them
- InSIDer's View of History: The Adventure Continues - Evacuation from Belgrade
- SCS and Executive Protection
- Another Successful Olympics Story
- Doing SIGINT in Pakistan
- SCS Local Support Reporting to Evolve into 'First Instance' End Product Reporting
- SCS Site Foils Ambush on Coalition Convoy, Receives Praise from Task Force Commander
- A 'FIR-st' for SCS
- SID Mailbag - Intelligence Analysts at SCS Sites
- The Special Collection Service - Positioning for the Future
- From the SID Mailbag: When to Mark Things 'COMINT'
- Letter to the Editor: About Skype...
- Instant-Gratification SIGINT
- Temporary SCS Site Established for Presidential Visit to India
- SCS Baghdad Teams With Brits to Help Free Hostages
- Collaboration Tool is Used to Set Up a Collection at Distant Site
- Deployment of New System Improves Access to Iranian Communications
- Breakthrough: Previously 'Unfindable' Internet Cafes in Iraq Can Now Be Located
- Going on TDY to Help Protect a VIP
- The Wizards of OZ II: Looking Over the Shoulder of a Chinese C2C Operation
- SCS Mosul and Coalition Forces Team Up to Neutralize Major Insurgent Cell
- Improving Our Capability to Collect Against the Thuraya Satellite
- F6, NSA Texas, and Yakima Research Station Collaborate on Venezuela Survey
- What That a Morta or a Grenade?
- The State of Covert Collection - An Interview with SCS Leaders - Part 1
- The State of Covert Collection - An Interview with SCS Leaders - Part 2
Other Related GBPPR Projects
- GBPPR PHOTOANGLO Experiments
- Passive Resonant Cavity Technical Surveillance Devices
- GBPPR Interferometric Surveillance Device Experiments - Part 1
- GBPPR Interferometric Surveillance Device Experiments - Part 2
- Laser Bounce Listening Device
- GBPPR Remote Telephone Surveillance Experiments
- Intercepting Older Digital Cordless Phones
- Doppler Stethoscope for E.O.D. Applications
- GBPPR "Havana Syndrome" Experiments
