Our Approach

• Queried over' 900 tower,s and other selectors in MAINWAY/SEDB ln [attemptto d~.scovler[any ~dentifiable selectors [around the coordinates of interest

• C[~eated[another query based on identified selectors of interest to pull fiorany Ice~1fan infurmation in order to more prelcisely locate leach selector ofilnte~est

• Queried in SEDB shilp data on the ships. of intlerest and p~oHedthe track thesh~pstook into

• Identified se~'ectors·by celli fan imormlation seen near the ports.where thesh~pstOf' interest had docked. Also correlated any selectors moving in[~elatitOn~D'the sh ips:·m,OVlemlentsus~n;gcen Ian data I

0 ' sdlicovere. indiv~dLJallswho could havle pass~b~ybeen traveUng with the ships of lntarest .

[Mission Example and Result: The HAPP'VIFOOT ana~ytic aglgre'lg,stes leaked locatilOn..based service J locailon-aware appllcanen data,to infer ~,Pladdress geo ..locations. SOS identified 'Publi,c' and jprivate' usag'B of the same IP' add res's fhat caused HAPPY FOOT toa,ssign .e~locksto geo-Iocations (the IP' address 'was used in both countries). This privatle network ~snowbeing ,rea~lmedand p~operiygeo..tocated. Ongoing wolt win salve this reaim~naproblem for networks affecting other cloud analytics.,

I • r

Our'ApproachI.;rradk!ed .. ; s con¥erged lcom,municaUons and CNE accesses,Iii Monitored pass~veinternet trlaffic; created automated processes wherepossible (X1K8ANCHO,RMAN, Wonkflows, F~ngerpr~nts)~Iii plrov~ded TAO/GCHQ, with WLLidslDSL accounts Cooldes,~

G,oe)·.·~le,PREF~Dsto renabllB remote exploitation~.. Partnered with NGiA and IR4 to lconfirm locations land US,RP requipmentbased on collected phatQ~raphs.,.. Drove C,NE,rcoUection and lParme~ed'w~thTAO to incral8se US,RPspecifi'c endpo,int alcoesses, ... P'ravided knowlredgleto interagency partners for patentla~on the groundsurvey options and IFBI..led ~ntelUgence Iguiding lefforts.

(5//51/ /REL TO USA, FVEY)Metadata/Target Discovery: Analyze ONR/ONI/Convergencemetadata for target discovery, identify gaps in collection, processing, and analyticmethodologies; Improve metadata collection and processing; Create analytics thatautomate or improve analytic methodologies; Conduct target discovery through multipletechnology thrusts, including endpoint, web-based technologies/services, mobileapplications and networks, geo-Iocation analysis, correlations/identity Analysis, SocialNetwork Analysis; Collaboration/facilitation with TAO, 53, CIA, DONI, 550, CES,and SSGcenters.