Sentry Eagle

Last updated

Sentry Eagle, the National Initiative Protection Program, is a compartmented program of the National Security Agency's (NSA) Central Security Service (CSS) and the US Strategic Command Joint Functional Component Command - Network Warfare (JFCC-NW). [1] Its existence was revealed during the 2013 global surveillance disclosure by Edward Snowden.

Contents

The program's efforts to protect America's cyberspace includes efforts to plan, synchronize, and attack an adversary's cyberspace through Computer Network Attack (CNA). The combination of those efforts are referred to as NSA/CSS's and JFCC-NW's core Computer Network Operations (CNO).

The CNO capabilities include SIGINT, Computer Network Exploitation (CNE), Information Assurance, Computer Network Defense (CND), Network Warfare, and Computer Network Attack (CNA).

Sentry Eagle includes six sub-programs:

Sentry Hawk

The Sentry Hawk program is a computer network exploitation program involving the CIA and FBI. The program attempts to exploit computers, computer peripherals, computer-controlled devices, computer networks or facilities housing them, and publicly accessible computing and networking infrastructure. Targets include specific firewalls, operating systems, and software applications. The program operates with the benefit of partnerships with US commercial sector companies.

Sentry Falcon

The Sentry Falcon program is a computer network defense program focused on attack attribution.

Sentry Osprey

The Sentry Osprey program is a collaborative program with the CIA and the National Clandestine Service (NCS), FBI, and the Defense Clandestine Service of the Defense Intelligence Agency to perform Target Exploitation (TAREX) of foreign communication infrastructure.

Sentry Raven

The Sentry Raven program involves secret efforts to weaken commercial encryption systems and software in order to make them exploitable for SIGINT. The cryptosystems targeted include systems used by the US private sector and developed by US companies.

Sentry Raven involves the use of super computers and special purpose cryptanalytic hardware and software to break foreign ciphers. It also involves the spending of hundreds of millions of dollars on special purpose computer systems to attack US commercial encryption systems, including the exploitation of weaknesses places in them by cooperating companies or undercover agents within US companies.

Sentry Condor

The Sentry Condor program involves the provision of cyber target identification and recognition material and tools and techniques that allow computer network attack on those targets.

Sentry Owl

The Sentry Owl program involves the use of US industry personnel, or undercover NSA personnel at US and foreign employers, to enable SIGINT operations on US and foreign commercial communications products. The program includes contracts with US and foreign commercial entities to subvert the privacy features of their products for both foreign and domestic consumers (for both content and metadata).

See also

Related Research Articles

ECHELON Signals intelligence collection and analysis network

ECHELON, originally a secret government code name, is a surveillance program operated by the United States with the aid of four other signatory states to the UKUSA Security Agreement: Australia, Canada, New Zealand, and the United Kingdom, also known as the Five Eyes.

National Security Agency U.S. signals intelligence organization

The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense, under the authority of the Director of National Intelligence. The NSA is responsible for global monitoring, collection, and processing of information and data for foreign and domestic intelligence and counterintelligence purposes, specializing in a discipline known as signals intelligence (SIGINT). The NSA is also tasked with the protection of U.S. communications networks and information systems. The NSA relies on a variety of measures to accomplish its mission, the majority of which are clandestine.

Joint Functional Component Command – Network Warfare

The Joint Functional Component Command – Network Warfare (JFCC-NW) at Fort Meade, Maryland was a subordinate component command of United States Strategic Command (USSTRATCOM) active from 2005 to 2010. It was responsible for coordinating offensive computer network operations for the United States Department of Defense (DoD). JFCC-NW was created in 2005. It was merged into United States Cyber Command in October 2010.

Project MINARET

Project MINARET was a domestic espionage project operated by the National Security Agency (NSA), which, after intercepting electronic communications that contained the names of predesignated US citizens, passed them to other government law enforcement and intelligence organizations. Intercepted messages were disseminated to the FBI, CIA, Secret Service, Bureau of Narcotics and Dangerous Drugs (BNDD), and the Department of Defense. The project was a sister project to Project SHAMROCK.

Five Eyes intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States

The Five Eyes (FVEY) is an anglophone intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States. These countries are parties to the multilateral UKUSA Agreement, a treaty for joint cooperation in signals intelligence.

Unit 8200 is an Israeli Intelligence Corps unit responsible for collecting signal intelligence (SIGINT) and code decryption. Military publications include references to Unit 8200 as the Central Collection Unit of the Intelligence Corps, and it is sometimes referred to as Israeli SIGINT National Unit (ISNU). It is subordinate to Aman, the military intelligence directorate.

Computer network operations (CNO) is a broad term that has both military and civilian application. Conventional wisdom is that information is power, and more and more of the information necessary to make decisions is digitized and conveyed over an ever-expanding network of computers and other electronic devices. Computer network operations are deliberate actions taken to leverage and optimize these networks to improve human endeavor and enterprise or, in warfare, to gain information superiority and deny the enemy this enabling capability.

Signals intelligence by alliances nations and industries, many organizations, national or not, are responsible for communications security as well as SIGINT; the organization makes codes and ciphers that it hopes opponents cannot break. There is a synergy between the two components; there is a saying among cryptologists that no one is qualified to create a cipher unless they have successfully cryptanalyzed a cipher of equivalent complexity.

Signals intelligence operational platforms by nation

Signals intelligence operational platforms are employed by nations to collect signals intelligence, which is intelligence-gathering by interception of signals, whether between people or between machines, or mixtures of the two. As sensitive information is often encrypted, signals intelligence often involves the use of cryptanalysis. However, traffic analysis—the study of who is signalling whom and in what quantity—can often produce valuable information, even when the messages themselves cannot be decrypted.

Strategically, cyber defence refers to operations that are conducted in the cyber domain in support of mission objectives. To help understand the practical difference between cyber security and cyber defence, is to recognize that cyber defence requires a shift from network assurance (security) to mission assurance where cyber defence is fully integrated into operational planning across the Joint Functions. Cyber defence focuses on sensing, detecting, orienting, and engaging adversaries in order to assure mission success and to out-manoeuver that adversary. This shift from security to defence requires a strong emphasis on intelligence, surveillance and reconnaissance, and the integration of staff activities to include intelligence, operations, communications, and planning. Defensive cyber operations refer to activities on or through the global information infrastructure to help protect and institutions’ electronic information and information infrastructures as a matter of mission assurance. Does not normally involve direct engagement with the adversary.

Information Operations is a category of direct and indirect support operations for the United States Military. By definition in Joint Publication 3-13, "IO are described as the integrated employment of electronic warfare (EW), computer network operations (CNO), psychological operations (PSYOP), military deception (MILDEC), and operations security (OPSEC), in concert with specified supporting and related capabilities, to influence, disrupt, corrupt or usurp adversarial human and automated decision making while protecting our own." Information Operations (IO) are actions taken to affect adversary information and information systems while defending one's own information and information systems.

Tailored Access Operations American NSA cyberwarfare unit

The Office of Tailored Access Operations (TAO), now Computer Network Operations, structured as S32 is a cyber-warfare intelligence-gathering unit of the National Security Agency (NSA). It has been active since at least circa 1998. TAO identifies, monitors, infiltrates, and gathers intelligence on computer systems being used by entities foreign to the United States.

Bullrun (decryption program) code name of a decryption program run by the NSA

Bullrun is a clandestine, highly classified program to crack encryption of online communications and data, which is run by the United States National Security Agency (NSA). The British Government Communications Headquarters (GCHQ) has a similar program codenamed Edgehill. According to the BULLRUN classification guide published by The Guardian, the program uses multiple methods including computer network exploitation, interdiction, industry relationships, collaboration with other intelligence community entities, and advanced mathematical techniques.

Global surveillance disclosures (2013–present) Disclosures of NSA and related global espionage

Ongoing news reports in the international media have revealed operational details about the United States National Security Agency (NSA) and its international partners' global surveillance of both foreign nationals and U.S. citizens. The reports mostly emanate from a cache of top secret documents leaked by ex-NSA contractor Edward Snowden, which he obtained whilst working for Booz Allen Hamilton, one of the largest contractors for defense and intelligence in the United States. In addition to a trove of U.S. federal documents, Snowden's cache reportedly contains thousands of Australian, British and Canadian intelligence files that he had accessed via the exclusive "Five Eyes" network. In June 2013, the first of Snowden's documents were published simultaneously by The Washington Post and The Guardian, attracting considerable public attention. The disclosure continued throughout 2013, and a small portion of the estimated full cache of documents was later published by other media outlets worldwide, most notably The New York Times, the Canadian Broadcasting Corporation, the Australian Broadcasting Corporation, Der Spiegel (Germany), O Globo (Brazil), Le Monde (France), L'espresso (Italy), NRC Handelsblad, Dagbladet (Norway), El País (Spain), and Sveriges Television (Sweden).

This is a category of disclosures related to global surveillance.

Global surveillance mass surveillance of entire populations across national borders

Global mass surveillance refers to the mass surveillance of entire populations across national borders. Its roots can be traced back to the middle of the 20th century when the UKUSA Agreement was jointly enacted by the United Kingdom and the United States, which later expanded to Canada, Australia, and New Zealand to create the present Five Eyes alliance. The alliance developed cooperation arrangements with several "third-party" nations. Eventually, this resulted in the establishment of a global surveillance network, code-named "ECHELON" (1971).

Timeline of global surveillance disclosures (2013–present)

This timeline of global surveillance disclosures from 2013 to the present day is a chronological list of the global surveillance disclosures that began in 2013. The disclosures have been largely instigated by revelations from the former American National Security Agency contractor Edward Snowden.

TURBINE is the codename of an automated system which in essence enables the automated management and control of a large network of implants.

Government hacking permits the exploitation of vulnerabilities in electronic products, such as software, to gain remote access to information of interest. This information allows government investigators to monitor user activity and interfere with device operation. Government attacks on security may include malware and encryption backdoors. The National Security Agency's PRISM program and Ethiopia's use of FinSpy are notable examples.

References

  1. Maass, Poitras (2014-10-10). "Core Secrets: NSA Saboteurs in China and Germany". The Intercept. Retrieved 11 October 2014.