TOP SECRET C0 -1JNT NOFORN 203 10524 DR FT S National Security Agency Central Security Service NSA CSS and U S Strategic Command Joint Functional Component Command- Network Warfare JFCC-NW National Initiative Protection Program - Sentry Eagle Derived From NSA CSSM 1·52 Dated 2004 1123 Declassify On 203 10524 TOP SECRET CO -·I NT NOFORN 2031 0524 TOP S ECRET CO HNT NOFORN 12031 0524 DR FT S NSA CSS JFCC-NW National Initiative Brief Sbeet I S NF You are being indoctrinated on S ENTRY EAGLE the NSA CSS and JFCC-NW's compartmented program protecting the highest and m ost se nsitive level of information rela ted to NSN CSS's and JFCC-NW's s upport to the U S Government's efforts ilo protect America's cyberspace America's c yberspace is the combination of U S National Security Systems Military Systems Intelligence Systems Fe deral Government Systems Critical Infrastructure Systems and all other U S systems private industry academia and private citizen 2 S NF NSAICSS's effort to protect America 's cyberspace encompa es the combination of all abilities to detect nation and non nation attacks on U S c yberspace via active and passive SJGJNT and Information Assurance means JFCC-1 'W's effort to protect America's cyberspace encompasses ·the efforts to plan synchronize and when tasked attack an adversary's cyberspace via Computer Network Attack The combination of these two efforts constitutes NSAICSS's and JFCC-NW' s Core Computer Network Operations CNO Secrets 3 TSI SVINF In order for NSAICSS and JFCC-NW to accomplish along with o ther U S and foreign government agencies elements the protecti on of America 's cyberspace NSAIJFCC-NW must combine the full capabilities of a uthorized Computer Network Operations capabilities SJGINT Computer Network Exploitation CNE Information Assurance Computer Network Defense CND and Network Wa rfare Computer Network Attack CNA and all supporting activities 4 TSI S VINF SENTRY EAGLE a nd its subordinate programs protect the c ombined facl' related to NSA CSS and JFCC-NW's abilities to conduct CNO operations It encompasses the most sensitive aspccl'i of NSA CSS's relationships with industry U S a nd foreign and the U S Information Operations CNO community ability to exploit enciphered communications ability to conduct CNE ability to conduct CND and relationshiP with H uman Intelligence HU VIINT Agencies 5 TSI S VINF The 'e NSAICSS and JFCC-NW Core CNO Secrets are being provided to you based upon your need to know as detennined by the D irector NSA Chie f Central Security Service and Commander JFCC-NW W hile many of the facts in this briefing are contained in separate N SAICSS Exceptionally Controlled Informa tion ECJs or DOD Special Access Programs SAPs s tructures no ot her program combines the totali ty of all these facts into one overarching program The facts contained in this program constitute a combination of the greatest number of highly sensitive facts related to NSAICSS 's overall cryptologic mission As s uch depending upon TOP S ECRET C0 1JNT NOFORN 2031 0524 DR FT TOP S E CRET CO HNT NOFORN 203 1 0524 DRAFT your mission need to know or management pos ition you may be read on for one a combination of two or more or all aspects of SENTRY EAGLE 6 TSIISVINF Individuals briefed into SENTRY EAGLE may not share information regarding this program with those not read into this program or with foreign nationals including those with whom NSA CSS has Second and Third Party relationships Depending upon a specific fact you may share s uch a fact with foreign partners as noted on the SENTRY EAGLE or s ubordinate class ification guides as paragraph marked or within specific NSrVCSS SAP or ECI channels Under no circumstances Viii you share the totality of S ENTRY EAGLE nor facts that arc marked NOFORN 7 S SENTRY EAGLE material mlL t be protected within this compartment and discussed only with cleared personnel on a need-to-know bas is Disclos ure of SENTRY EAGLE information to non-indoctrinated personnel may rcsu1t in disciplinary action to include criminal prosecution Vhen sharing SENTRY EAGLE compan mentcd information it will be protected with PKI when transmitted via electronic means or with sealed by name envelopes when transmitted via hard copy TOP S E CRET C0 1JNT NOFORN 203 1 0524 DRAFT TOP SECRET COMINT NOFORN 20310524 DRAFT U SENTRY EAGLE DATA SHEET U IFOUO COVERNAME SENTRY EAGLE U IFOUO TRIGRAPH SEE U IFOUO CONTROL AUTHORITY CONTACT INFORMATION E-mail Name Org Phone# E-mail - U INFORMATION REQillRING SENTRY EAGLE PROTECTION TS SI NF Details related to the combination ofNSNCSS's and JFCC-NW's abilities to conduct CNO in the defense of America's cyberspace U VALUE OF SEE TS SI NF Protecting sensitive NSNCSS industrial and human intelligence relationships SIGINT exploitation of adversary computers and computer networks and infrastructure and their use of encipherment Information Assurance defense of U S Government National Security Systems and JFCC-NW's Computer Network Attack mission capabilities U JUSTIFICATION FOR SENTRY EAGLE PROTECTION TS SI NF Unauthorized disclosure of NSNCSS relationships with industry U S and foreign and the U S Information Operations CNO community ability to exploit enciphered communications ability to conduct CNE ability to conduct CND and relationships with Human Intelligence HUMINT Agencies will cause exceptionally grave damage to U S national security The loss of this information could critically compromise highly sensitive cryptologic U S and foreign relationships multi-year past and future NSA investments and the ability to exploit foreign adversary cyberspace while protecting U S cyberspace TOP SECRET COMINT NOFORN 20310524 nRAFT TOP SECRET C0 -1JNT NOFORN 2031 0524 DR FT U LINKAGE TO OTHER NSNCSS a nd JFCC-NW PROGR MS ECI or SAP C This overarching compartmented program is related to the following ECis list all the ECJs - S PARECHANGE WHIPGENJE AUNTIE AMBULANT OPALESCE REVELRY REFRACTOR and SAPs list a ll the SAPs - by name only C SENTRY EAGLE is an umbrella ECI program that includes facts currently contained in other NSNCSS ECJs and separate SENTR Y EAGLE ECJ facK C SENTRY EAGLE contains s ub-compartm ents SENTRY HAWK SENTRY FALCON SENTRY OSPREY SENTRY RAVEN SENTRY CONDOR AND SENTRY OWL U WILL SENTRY EAGLE BE S HARED WITH FORE IGN PARTIES Si S J NF The entirety of SENTRY EAGLE will not be shared with any foreign pan ics Howev r subcomponents of SENTRY EAGLE constituting various facts already shared with 2' or 3 ' pan ics may be shared but only within existing NSNCSS ECis See specific ECI Security Officers for more infonnation on sharing with foreign partners TOP SECRET C0 -1JNT NOFORN 2031 0524 DR FT TOP S ECRET C0 11NT NOFORN 2031 0524 DRAFT S NF What follows is a lis ting of NSNCSS and JFCC-NW generalized facts related to sensitive inteUigence and defense or network warfare methods relationships and activities that are currently protected as noted Many of these fdcts to include detailed information are contained in separate special access programs under NSAICSS auspices - many under Exceptionally Controlled Information EC s or Special Access Programs SAPs S The protection of Intel1igence sources methods and activities relate to the following Source - Person place or thing from which intelligence is gathered Method - means by which collection processing and dissemination takes place Activity - intelligence operation that may employ one or more source or method and the degree of success for said operation S NF Depending upon your mission need-to-know you will be read on for one or more of these generalized fact sets Specific detailed facts for a generalized fdct will remain within one or more ECis as noted U Facts as co or coded are as follows a U Green color Unclassified facts that may be released to the public at the unclassified level Only NSAICSS or JFCC-NW Public Affairs officers may release this information b U FOUO Blue color Unclassified but for Official Use Only FOUO facts that may be released by any NSNCSS or JFCC-NW government official to another U S Govemme n U S Industry U S Academic or selected foreign governments as authorized c U FOUO Red color Confidential Secret or Top Secret to include Special Compartmented Information SCI that may be released by any NSNCSS and JFCC-NW government offi cial to another properly c1eared and indoctrinated U S Government official or as authorized to a foreign government on need to know basis d S NF Black color Top Secret NATIONAL INITIAT VEISENTRY EAGLE program information that MAY NOT BE RELEASED OUTSIDE OF NSAICSS except to a limited number of selected U S Government offi cials and ONLY WITH THE APPROVAL OF DIRNSAICHCSS CDR JFCC-NW OR THE NATIONAL INITIATIVE PROGRAM SECURJTY OFFICER These facts in part or as a whoJe constitute many ofNS rVCSS's and JFCC·NW's most high1y sensitive cryptologic or network warfare facts related to intelligence sources methods and activities and relationships or CNA operationa capabilities thus necessitating extraordinary protection TOP S ECRET CO HNT NOFORN 2031 0524 DRAFT TOP SECRET CO -HNT NOFORN 1203 10524 DRAFT ID NSA CSS and its R elationshiP ' with Ind ustr ' wit hin t he National Imitative E CI Sentry Owl - SOL U Fact that NSA CSS must keep abreast of current trends and technology related to communications and information technology U Fact that NSA CSS worlcs with foreign partnm as a part of its cryptologic missions U FO UO Fact that NSA CSS works with U S industry in the conduct of its cryptologic missions U FOUO Fact the N SA CSS works with U S industry as technical advisors regarding cryptologic products TS S l Fact that NSAJCSS conducts S GTNT enabling programs and related operations with U S industry TS S l Fact that NSA CSS conducts S GTNT enabling programs and related operations with U S HtThHNT Agencies and other U S government clements TS SV NF Fact that NSAICSS has Foreign lntclligcncc Surveillance Act FJSA operations with U S commercial indlL'itry clements TS S l Fact that NSAJCSS conducts STG NT enabling programs and related operations with foreign partners TS S V ECTSOL Fac t that NSAICSS works with and has contrac tual relationships with specific named U S co mmercial entities AlB C to conduct SJGINT enabling programs and operations TS S V ECTSOL Fac t that NSA CSS works with specific named U S commercial entities AlBIC and operational details devices products to make them exploitable for S GINT TS S V ECTSOL Fac t that NSA CSS works with specific foreign panners XIYIZ and foreign commercial industry entities MIN 0 and operational details devices products to make them exploitable for S GINT TS S V ECTSOL Facts related to NSA personnel under cover o perational meetings specific opemtions specific techno1ogy specific locations and covert communications related to S GINT enab ling with specific commercial entities AlBIC TS S V ECTSOL Fac ts related to NSAICSS working with U S commercial entities on the acquisition of communications content and metadata provided by the U S service provider to worldwide ·customers communications transiting the U S or access to international communications cable satellite etc mediums proviided by the U S entity TS S V ECTSOL Fac ts that identify a U S or foreign commercial platform conducting S GINT operations or human as et cooperating with NSAICSS TOP SECRET CO -·IINT NOFORN 1203 10524 DRAFT TOP SECRET C0 -1JNT NOFORN 203 10524 DRAFT U NS V CSS and its Relationshi s to Information OP erati ons ComP uter Network 0 erations with the Nation al Initiative - E CI Sentry Condor - SCR U Fact that NSAICSS provides cryptologic s upport to Information Operations IO U Fact that NSAICSS provides SJGINT and Computer Network Defense CND information in s upport of Computer Network Attack CNA U FOUO Fact that NSAICSS provide s technical SJGINT and Information Assurance datalinfonnation in support of CNO TS Sn Fact that NSAICSS provides SIGINT that s upports the planning dcploymcnt cmplaccmcnt and employme nt of CNA combat capabilities TS Sn Fact that NSAICSS hosts speci fic DOD named units and organizations CNA activities within its SIGINT Cl'rE s tructurc TS SI NF ECI SCR Fact that NSAICSS provides specific target related technical and operational material identification recognition tools and techniques that allows the employment of U S national and tactical specific computer network attack mechanisms TOP SECRET C0 -1JNT NOFORN 203 10524 DRAFT TOP SECRET C0 -1JNT NOFORN 203 10524 DRAFT U N SA CSS and Ex P-lo itation of E nciebcrcd Communications ·w ith the National Imitath•e - ECI Sentry Raven - SRN U Fact that NSA CSS exploits foreign ciphers U FOUO Fact that NSA CSS works with the UK CAN AUSINZ in the exploitation of foreign ciphen TS Sn lntclligcncc derived from the exploitation of foreign ciphers without revealing the unOCrlying foreign cipher manual or machine or techniques used to exploit TSI S l ECI S RN Facts that reveal specific cryptographic weal ness or cryptanalytic methods means techniques used to achieve success against a foreign cipher TSI S l ECI S RN Facts related to Super Computers Special P ose cryptanalytic hardware software and specific programmatic funding resources used to achieve success against foreign ciphers TSI S l 1 ECI SRN Fact that NSA CSS works with specific U S commercial entities AlBIC to modify U S manufdctured encryption systems to make them exploitable for SIGINT TSI Slf NFffECJSRN Fact that NSA CSS is investing hundreds of millions of do1lars in high powcred and special purpose computer systems to attack specifically XN Z commercial encryption TOP SECRET CO -·IINT NOFORN 12031 0524 DRAFT TOP SECRET C0 -1JNT NOFORN 2031 0524 DRAFT U NS V CSS and ComP uter Network Ex Joitation wit h the National Initiative ECI Sent · Hawk - S HK U Fact the NSNCSS conducts Computer Network Exploitation CNE U Fact that NSAICSS works with the CIA and FBI U FOUO Fact that NSAICSS works with CIA and FBI on SIG l 'T related missions S Sn Fact that NSAICSS works with CIA and FBI related to close access or remote access CNE operations S Sn Fact that NSAICSS conducl• SJGINT operations agains t computers computer pcriphcral'i computcr controllcd devices computer networks or facil itics that house them using publicly available access e g Public Switched Nct vorks Internet etc TS Sn Facts related to adversary vulnerabilities to CNA TS Sn Facts related to adversary CNAICNE planning or operations • TS SI ECI SHK Fact that NSA CSS is attempting to exploit or has succeeded in exploiting a specific vulnerability e g firewall opemting system software application etc a specific entity or facility within a target's IT computer structure TS S I ECI SHK Facts related to the exact timing location participants off-net or on-net operations including cover covert presence on the internet CNE command control and data exfiltration tools capabilities and locations U 'ied to exploit or maintain intrusive access to a target's IT computer structure TS S I ECI SHK Fact that NSAICSS works with U S and foreign commercial entities AlBIC in the conduct of CNE TS S I ECI SHK Facts related to the description of U S hardware or software implant and location specific organization and Internet Protocol Devicc Address of such on a target's JT communications system TS S I ECI SHK Facts related to NSNCSS 's access to non-U S worldwide cable fiber optic structures regardless of platform access or agreements with foreign entities TS Sn Note All attempts will be made to protect the source of the CNAICNE information lest an adversary detennine how NSA acquired the CNA CNE planning and operations In all cases maximum protection will be granted to the SIGJNT 'method and activity used to acquire the CNA CNE information TOP SECRETffCO -·IINT NOFORN 12031 0524 DRAFT TOP SECRET CO -HNT NOFORN 12031 0524 D RAFT U NSA CSS and Com uter Network Defense with the National Imitative - ECI S en tr ' Falcon - SFN U The fact that NSA CSS conducts Computer Network Defense CND U Facts related to genera open source reporting on types of generic vulnerabilities viruses trojan horses etc U FOUO FacL' related to NSA CSS's deployment ofCND structures to detect and report on anomalous activities U FOUO Ge ne n facts related to NSA CSS's Joint C0 1SEC Monitoring Activities JCMA Red Team and Blue Team U FOUO Facts related to U S victim vulnerabilities and victim exploitation when uncovered via Bluesash C NF Facts related to NSA CSS JCMA results as provided to a supported command S Facts related to adversary CNE and CNA capabilities intentions and activities without attribution to inteUigence sources or methods S Facts related to NSAICSS' s deployment of CND structures e g Bluesash to detect hostile state or non-state sponsored CNE activities at U S NIPRNET gateways S CND response action operations S Facts related to NSAICSS' s Joint COMSEC Monitoring Activities JCMA Red Team Blue Team results SI SI Facts related to adversary CNE and CNA activity attribution •• S SI Facts related to U S victim vulnerabilities and victim exploitation when uncovered via SIGINT sources and methods TS SI Facts related to U S victim vulncrabilitic i and victim exploitation TSIINFI ECI SFN F acts related to NSMCSS activities to determine intruder attribution including sensitive counter-inteUigence investigations and sensitive honeypot watermarking data-tagging activities TS NF ECI SFN Facts related to NSMCSS specific operations to deceive network users TS NF ECI SFN Facts related to NSMCSS specific activities to redirect network data C Classified at a minimum C NF May be c lassified higher based upon results S Note The only way to accomplish this outside of SCI but still classified channels may necessitate the use of a U S Government e g Department of Home land Security cut-out to transmit such information to U S Government State Local and Tribal entities as well as fore ig n governments The preference will be to use anon-U S lntelJigence Community entity ••• S Results may be Secret NOFORN TOP SECRET CO -HNT NOFORN 2031 0524 D RAFT TOP DRAFT TDP DRAFT TOP SECRET C0 -11NT NOFORN 2031 0524 DRAFT U NSA CSS and its RelationshiP with Human Intelligence ll VfiND Agencies with the National Initiative - ECI Sent ' OsP re ' -SOY U Fact that NSA CSS works with the Central Intelligence Agency CIA and the Defense Human Intelligence via the National Clandestine Service NCS U FOUO Fact th e NSA CSS works with the NCS to conduct SJG NT opemtions TS Sl NF Fact that NSA CSS works with the NCS for the c ollection of high priority target internal foreign communications TS Sn Fact that N SA CSS employs its own HUMINT assets Target Exploitation TAREX to support SIGINT operations TSI S IIINFI ECl SOY Facts related to NSA CSS targets target countries that employ NCS capabilities TS Sl NF EC SOY Facts related to the identity of NCS human assets agents covert or under co ver specific targets target countries specific locations sites citiesllT site and specific operations and techniques cquipmcnL•i supply chain or other used to explo it targeK TOP SECRET C0 -11NT NOFORN 2031 0524 DRAFT