Expanded Communications Satellite Surveillance and Intelligence Activities Utilising Multi-beam Antenna Systems

by Desmond Ball, Duncan Campbell, Bill Robinson and Richard Tanter

28 May 2015

The full report is available here.

I. Introduction

The recent expansion of FORNSAT/COMSAT (foreign satellite/communications satellite) interception by the UKUSA or Five Eyes (FVEY) partners has involved the installation over the past eight years of multiple advanced quasi-parabolic multi-beam antennas, known as Torus, each of which can intercept up to 35 satellite communications beams. Material released by Edward Snowden identifies a ‘New Collection Posture’, known as ‘Collect-it-all’, an increasingly comprehensive approach to SIGINT collection from communications satellites by the NSA and its partners. There are about 232 antennas available at identified current Five Eyes FORNSAT/COMSAT sites, about 100 more antennas than in 2000. We conclude that development work at the observed Five Eyes FORNSAT/ COMSAT sites since 2000 has more than doubled coverage, and that adding Torus has more than trebled potential coverage of global commercial satellites. The report also discusses Torus antennas operating in Russia and Ukraine, and other U.S. Torus antennas.

Desmond Ball is Emeritus Professor at the Australian National University (ANU). He was a Special Professor at the ANU’s Strategic and Defence Studies Centre from 1987 to 2013, and he served as Head of the Centre from 1984 to 1991.

Duncan Campbell is an investigative journalist, author, consultant, and television producer; forensic expert witness on computers and communications data; the author of Interception Capabilities 2000, a report on the ECHELON satellite surveillance system for the European Parliament, Visiting Fellow, Media School, Bournemouth University (2002-). Formerly: Staff Writer, New Statesman: Co-Founder, Stonewall; Co-Founder (1991), Investigation and Production Television: Founder Member, International Consortium of Investigative Journalists.

Bill Robinson writes the blog Lux Ex Umbra, which focuses on Canadian signals intelligence activities. He has been an active student of signals intelligence matters since the mid-1980s, and from 1986 to 2001 was on the staff of the Canadian peace research organization Project Ploughshares.

Richard Tanter is Senior Research Associate at the Nautilus Institute and Honorary Professor in the School of Political and Social Sciences at the University of Melbourne.

The views expressed in this report do not necessarily reflect the official policy or position of the Nautilus Institute. Readers should note that Nautilus seeks a diversity of views and opinions on significant topics in order to identify common ground.

II. Special Report by Desmond Ball, Duncan Campbell, Bill Robinson and Richard Tanter

Expanded Communications Satellite Surveillance and Intelligence Activities utilising Multi-beam Antenna Systems

1. Introduction

The recent expansion of FORNSAT/COMSAT¹ (foreign satellite/ communications satellite) interception by the UKUSA (Five Eyes or FVEY) partners – the U.S. National Security Agency (NSA), the British Government Communications Headquarters (GCHQ), Canada’s Communications Security Establishment (CSE), the Australian Signals Directorate (ASD), and New Zealand’s Government Communications Security Bureau (GCSB) – has involved the installation over the past eight years of multiple advanced quasi-parabolic multi-beam antennas, known as Torus, which can simultaneously intercept up to 35 satellite communications beams from single antenna installations.² This report identifies sites now performing Torus FORNSAT/COMSAT collection activity and some of their operational parameters.

Public awareness of the Torus program is largely a product of revelations by former NSA contractor Edward Snowden. The first published reference to the use of Torus technology for SIGINT appears in a slide published in a book by Glenn Greenwald in May 2014. A Top Secret SI Powerpoint presentation to the 2011 Five Eyes Annual Conference outlined a ‘New Collection Posture’, known as ‘Collect-it-all’ then being pioneered at NSA’s Menwith Hill Station (MHS) in Britain as Project ASPHALT. The slides describe a new and increasingly comprehensive approach to SIGINT collection from communications satellites (COMSATs) and state that ‘Torus increases physical access’, enabling the MHS station team to ‘sniff it all’ before collecting and processing everything of interest.³ (Figure 1)

Figure 1. NSA’s New Collection Posture, 2011

Source: Glenn Greenwald, No Place to Hide: Edward Snowden, the NSA, and the U.S Surveillance State, (Metropolitan Books, New York, 2014), p. 97; and Glenn Greenwald, ‘Documents from No Place to Hide’, at http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf.

In March 2015, a set of Snowden documents concerning New Zealand’s GCSB and its communications satellite interception station at Waihopai, South Island (covername IRONSAND) included a GCSB presentation dated 22 April 2010 stating that Torus was ‘now enabling an increase of COMSAT/FORNSAT collection’, and linking this to Menwith Hill’s ‘Collect-it-all’ initiative.⁴ (Figure 2)

A key goal for NSA in promoting the use of Torus antennas has been to increase access to global Internet traffic (Digital Network Intelligence or DNI) carried by satellite, utilising the now well known X-Keyscore analysis system (XKS) in association with a Massive Volume Reduction (MVR)⁵ technique so as to ‘Exploit it All’.⁶ According to the slide, the work at Menwith Hill (covername MOONPENNY) was carried out in conjunction with GCHQ, and ‘share[d] with’ NSA’s large eastern Pacific FORNSAT collection site at Misawa, Hokkaido, Japan (covername LADYLOVE).

Figure 2. GCSB Update, 22 April 2010

Source: COMSAT Advisory Board (CAB), GCSB Update, 22 April 2010, Cryptome, March 2015, at: http://cryptome.org/2015/03/gcsb-xkeyscore-nz-star-times-15-0308.pdf

The unique technical features of the Torus design enable beams from multiple satellites in geostationary equatorial orbits to be received and processed simultaneously by receiving horns arranged in an arc of principal foci. In the installations used at the sites identified here, beams from up to 35 satellites spaced 2 degrees apart in geostationary orbit along the Clark Belt can be received by a single Torus antenna, in principle replacing 35 traditional steerable or fixed parabolic antennas.

Figure 3 “Why TARMAC?”, GCHQ, 2010⁷

Source: Glenn Greenwald, No Place to Hide: Edward Snowden, the NSA, and the U.S Surveillance State, (Metropolitan Books, New York, 2014), p. 97; and Glenn Greenwald, ‘Documents from No Place to Hide’, at http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf.

Surveys for this report show that Torus antennas have been installed at five acknowledged and one covert Five Eyes FORNSAT/COMSAT collection sites between 2007 and 2013. These developments form part of a recent NSA and Five Eyes project, SHAREDVISION (SV), to enhance and further expand collection capability at designated sites. A successor Five Eyes program, SHAREDQUEST, is intended to exploit the features of the new Torus installations as well as a new generation of receivers and digital modems to carry out detailed research on new satellites and satellite configurations, as part of a SIGINT Development (SD) program covernamed DARKQUEST.⁸ This is associated with a shared satellite-based geo-location system, APPARITION (see Figure 3).⁹ NSA and its partners have also expanded the collection capability of their stations by the supplementary and low cost route of also adding multiple small ‘COTS’ (Commercial off the shelf) antennas typically of 3 to 5 metre diameter at many sites (See Annexe 1 of full report).

FORNSAT/COMSAT collection assets currently available to NSA and its partner agencies, in terms of antennas on the ground, require to be matched to a large potential target set. According to the satellite monitoring group Satbeam, there are ‘over 400 geostationary satellites’ currently in use. The Satbeam website provides a detailed database identifying 272 communications satellites operating in the Clark Belt, providing 9,890 downlink transponders (signal relays) or beams.¹⁰ Many of the downlinks are split into different regional patterns and into selected spot beams so as to best use available satellite power.

A survey using published historical imagery compiled for this report and appearing in Annexe 1 suggests that there are currently about 232 antennas available at identified current Five Eyes FORNSAT/COMSAT sites, including the new Torus antennas, but excluding collocated antennas believed to be used for orthodox satellite communications or for satellite ground control and processing.

Some antennas provide orthodox satellite communication for their host site(s). At least one antenna on each FORNSAT/COMSAT site is typically allocated to target (or SIGINT) development. This total is around 100 antennas larger than measured in 2000 at the time of the ECHELON controversy¹¹, and does not include the multi-beam capability provided by Torus. The constellation of 6 Torus antennas identified in this report have a maximum capacity of 210 additional beams in the Ku- or C-bands.

We therefore conclude that development work at the observed FVEY FORNSAT/COMSAT sites since 2000 has more than doubled coverage, and that adding Torus has more than trebled potential coverage of global commercial satellites.

Although these developments have taken place in open sight, the deployment of the Torus antennas has mostly gone unheralded.¹²

To co-ordinate and prioritise the use of shared assets, NSA tasks priority beams of interest to each Five Eyes FORNSAT site in accordance with a directed survey plan drawn from a classified beam database similar to Satbeam, GLOBALVIEW.¹³ The agencies operating the sites then assign antennas to collect and then analyse and relay the beams required by NSA. In broad terms, a comparison of satellites in orbit with ground assets suggests that only half of the available beams for survey could have been collected until the advent of Torus systems and additional COTS terminals; and that the Torus installations reported here, covering a potential maximum of 210 targets, may have doubled Five Eyes’ capacity to cover the global satellite constellation.

Little information has been published concerning specific tasking and sharing arrangements for satellite interception between Five Eyes partners and Third Party nations. Germany is a significant exception. In 2004, the German foreign intelligence agency BND took over NSA’s large FORNSAT site at Bad Aibling, Bavaria (former covername GARLICK), but continued to allow NSA remotely to task ‘selectors’ to the equipment operated at the site. In April 2014, a German parliamentary enquiry determined that BND had improperly allowed NSA to use tens of thousands of selectors to collect intelligence on the European Commission, and other European government and commercial targets. Other reports quote claims by BND staff that some improper and potentially unlawful targeting by NSA had been detected and blocked.¹⁴

Surveys for this report of 11 previously reported Soviet COMSAT SIGINT sites¹⁵ suggest that the former Soviet KGB installed Torus antennas for simultaneous interception of multiple satellites in the geostationary arc at a much earlier date, probably in the late 1980s. A massive multi-beam antenna is installed at the Ovidiopol-2 SIGINT site, near Dobroaleksandrovka near Odessa in Ukraine, and may have been in operation as early as 1987. A second multi-beam antenna was installed at the same site in 2009-2010. The site is now operated by Ukraine’s Foreign Intelligence Service (SZRU) (see Figures 31-34).

Russian military intelligence (GRU) installed a large multi-beam antenna near Klimovsk, south of Moscow, in 2005-06 (see Figures 27-30). These Soviet/Russian/Ukrainian multi-beam activities are briefly described in the fourth section of this report. Chinese intelligence agencies have been reported to be carrying out satellite interception activities from sites including Changji, near Urumqi in Xinjiang Province, western China.¹⁶ Available satellite images of Chinese COMSAT interception sites do not show multibeam or Torus-type antenna installations.

Civil corporations, including broadcasters and communications providers, and many U.S. military or government agencies have used Torus-style antennas since the early 1990s. The U.S. Department of Defense and intelligence community make extensive use of multi-beam antennas for purposes other than SIGINT. These include two multi-beam antennas installed at NSA HQ at Fort Meade, Maryland (see Figures 36 and 37). There is no public evidence that these installations are used for direct intelligence collection from targeted satellites ‘on cover’. Two further multibeam antennas are located at the CIA HQ at Langley, Virginia (see Figure 38). Multi-beam antennas also provide the principal satellite communications (SATCOM) capability for the American Forces Radio and Television Service (AFRTS) and, specifically, its Armed Forces Network Broadcast Center (AFN-BC), which has its control elements at Fort Meade and March Air Force Base in Riverside, California. The U.S. Air Force’s Space Command has a multi-beam antenna at Schriever Air Force Base, Colorado, which it uses for its space surveillance and control mission (see Figure 39). Some are used for Department of Defense SATCOM Gateway/Teleport services, such as at the Torii Station Teleport in Okinawa (see Figure 42). These multi-beam operations are briefly reviewed later in this report in order to clarify their purposes and to clearly distinguish them from Torus antennas used for FORNSAT/COMSAT interception.

2. Five Eyes FORNSAT/COMSAT interception sites

The current SHAREDVISION/SHAREDQUEST communications satellite interception program is managed by NSA’s FORNSAT division at Fort Meade, Maryland, and by GCHQ’s COMSAT division based at their Bude station. The program began in 1966 as Project ECHELON, and was (and still is) targeted at civil satellite communications, starting with the INTELSAT satellite series first launched in 1965. A counterpart but distinct NSA program targeting Soviet satellites began at the same time as ECHELON in 1966. NSA agreed to pay (and still pays for, and owns) most of the satellite interception equipment used, while its Second Party allies in the UKUSA alliance agreed to pay personnel, operating and maintenance costs.¹⁷

The first ECHELON site, run by GCHQ at Bude, Cornwall, England (covername CARBOY) was financed by NSA and began operating in 1970. The second ECHELON site, Yakima Research Station in Washington state, U.S. (covername JACKKNIFE) started operating in May 1973, and was also targeted on INTELSAT satellites. Bude’s facilities were expanded during the 1980s as CARBOY II, as part of the ECHELON 2 program.¹⁸ GCHQ currently operates two other COMSAT collection sites supported by U.S. funding, at Ayios Nikolaos in eastern Cyprus (covername SOUNDER) and at a covert site in Oman covernamed LECKWITH. LECKWITH is sited within the township of Al Maabilah, about three km west of Seeb, on the north coast of Oman (23.675 N, 58.122 E). The COMSAT function at LECKWITH supplemented earlier GCHQ activity at multiple sites in Oman.¹⁹

Additional ‘Cyber’ functions and construction at LECKWITH for intercepting multiple fibre cables passing through the Gulf of Oman were added from 2008 onwards as part of GCHQ’s Project TEMPORA for acquiring and inputting digital network intelligence into the XKEYSCORE network. A sequence of DigiGlobe images of the LECKWITH site taken from 2001 to 2014 show the construction of the Internet processing facilities (covernamed CIRCUIT) from 2008, and the installation of a Torus and nine additional COTS small antennas by 2013.²⁰ GCHQ has designated CIRCUIT as Overseas Processing Centre 1 (OPC-1).

By 2002, according to an NSA slide provided by Edward Snowden (Figure 4) and published in Brazil in 2013, the expanded FORNSAT network operated by NSA and UKUSA Second Parties included 16 manned sites around the world, as shown in Table 1.²¹

Figure 4. FORNSAT interception sites, NSA 2002

Source: ‘File:NSA Primary FORNSAT Collections.jpg’, Wikimedia Commons, at
http://commons.wikimedia.org/wiki/File:NSA_Primary_FORNSAT_Collections.jpg

The sites listed include two sites in U.S. diplomatic premises (in Brazil and New Delhi) and operated by the Special Collection Service (SCS), a joint activity of CIA and NSA. Since the slide was prepared in 2002, two sites appear to have closed: GCHQ’s Nairobi station and the NSA site in Sabana Seca, Puerto Rico. Evidence described below suggests that staff deployed at Sabana Seca moved to a new FORNSAT facility in Pine Gap, Australia (covername not known), around the very beginning of the 2000s. Pine Gap, a SIGINT satellite control station in central Australia, has been used for COMSAT collection since then. The Torus antennas were all installed between 2007 and 2013. (Table 1, Map 1).

No Canadian intercept sites are shown on the 2002 map of primary FORNSAT sites, but CSE does have a significant satellite monitoring facility at Canadian Forces Station Leitrim, located within the Ottawa city limits. No multibeam or Torus-type antennas are present at the station, but it does host 13 satellite dishes, all or most of which are likely to have COMSAT missions, and the station is listed as a source of Internet data in at least one of the Snowden documents. It appears to have a standard FVEY SIGAD (Sigint Activity Designator), CAC-98.²² In addition to monitoring satellite communications, the 500 staff at Leitrim, including 25 U.S. Navy personnel, remotely operate the Canadian intercept sites at Alert, Gander, and Masset.

First and Second Party FORNSAT/COMSAT sites are supplemented by a large number of Third Party COMSAT intercept sites operated by 35-40 other nations linked to NSA, GCHQ and/or other Five Eyes partners through separate and secret bilateral intelligence co-operation and sharing agreements. Countries known to operate COMSAT stations and reported to have intelligence sharing agreements with NSA and/or GCHQ include Spain, Italy, France, Germany, the Netherlands, Denmark, Sweden, India, Israel, Jordan, Oman, Saudi Arabia, South Africa, and Switzerland.

The six Torus-equipped FORNSAT/COMSAT interception sites identified here appear together to provide complete coverage of the geostationary arc from at least 45 degrees West longitude, over the mid-Atlantic Ocean, to about 160 degrees West longitude over the mid-Pacific Ocean. The stations are each equipped with Model 700-70TCK Torus Multiple Band Antenna systems, produced by General Dynamics. (Figures 5 and 6) These measure 24.1 metres wide by 7 metres high, and are curved spherically in their horizontal plane and parabolically in their vertical plane; they are able to monitor 35 satellites and hundreds of satellite channels (perhaps as many as 1,000) simultaneously, in the C-band (3.4-4.2 GHz) and Ku-band (10.95-12.75 GHz).²³

The new Torus network has complemented other FORNSAT collection activity monitoring high data-rate multi-beam communications satellites, such as LADYLOVE at Misawa in Japan, STELLAR at Kojarena, near Geraldton in Western Australia, and IRONSAND at Waihopai in New Zealand. At Waihopai, for example, the primary target has always been the main INTELSAT international communications satellite stationed over the mid-Pacific Ocean, to which one of the station’s parabolic dishes has always been dedicated. This is currently the INTELSAT 18 (IS-18) communications satellite, launched on 5 October 2011 and stationed in orbit at 180.0 degrees East longitude.

Map 1. Torus sites and coverage of the geostationary satellite belt

Torus sites: 1 Bude, U.K.; 2 Menwith Hill, U.K.; 3 Ayios Nikolaos, Cyprus; 4 Seeb, Oman; 5 Pine Gap, Australia; 6 Waihopai, New Zealand. The grey lines extending from Menwith Hill show the entire section of the geostationary arc visible from that site. Like the antennas at the other Torus sites, the Torus at Menwith Hill is capable of monitoring only 70 degrees of the arc. Its orientation cannot be determined because the antenna, uniquely, is inside a radome.

The remainder of this Special Report is available in the full PDF version here. 

Cover image: Stuart Sweet, Signal Group Forum: http://forums.solidsignal.com/showthread.php/1911-Hands-on-at-the-DIRECTV-Los-Angeles-Broadcast-Center-(LABC)

II. References

1 The terms FORNSAT and COMSAT have the same meaning in this report, but are used to reflect different usage as between NSA (FORNSAT) and its Second Party partners (COMSAT).

2 Building on WW2 signals intelligence cooperation arrangements, the UKUSA agreements negotiated from 1940 to 1955 between the principal signals intelligence agencies of the United States and the United Kingdom, and subsequently with those of Australia, Canada, and New Zealand, form the basis for what Richelson and Ball described as ‘a truly multinational community’. The term ‘Five Eyes’ (FVEY) is now generally used in SIGINT documents seen in the Snowden disclosures in place of the former term UKUSA, but also applies to a wider range of US-auspiced military and intelligence cooperation arrangements between the partner countries. See Jeffrey T. Richelson and Desmond Ball, The Ties That Bind: Intelligence Cooperation Between the UKUSA Countries – the United Kingdom, the United States of America, Canada, Australia and New Zealand, Sydney, London and Boston: George Allen and Unwin, 1985; Jeffrey T. Richelson, The US Intelligence Community, sixth edition, Westview, 2011, pp. 292-296; and similar in other editions; UKUSA Agreement Release 1940-1956, National Security Agency, 24 June 2010, at https://www.nsa.gov/public_info/declass/ukusa.shtml; and Richard Tanter, The ‘Joint Facilities’ revisited – Desmond Ball, democratic debate on security, and the human interest, Special Report, Nautilus Institute for Security and Sustainability, 12 December 2012, at https://nautilus.org/wp-content/uploads/2012/12/The-_Joint-Facilities_-revisited-1000-8-December-2012-2.pdf.

3 Glenn Greenwald, No Place to Hide: Edward Snowden, the NSA, and the U.S Surveillance State, (Metropolitan Books, New York, 2014), p. 97; and Glenn Greenwald, ‘Documents from No Place to Hide’, at http://glenngreenwald.net/pdf/NoPlaceToHide-Documents-Compressed.pdf.

4 ‘GCSB Update 22 April 2010’, at http://cryptome.org/2015/03/gcsb-xkeyscore-nz-star-times-15-0308.pdf; Nicky Hager and Ryan Gallagher, ‘Snowden Revelations. The Price of the Five Eyes Club: Mass Spying on Friendly Nations’, The New Zealand Herald, 5 March 2015, at http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&objectid=11411759.

5 Massive Volume Reduction is a SIGINT technique for sifting the entirety of large communications channels while the data is being held in a large temporary storage cache, typically for three days.

6 See Figure 1.

7 The meaning of the coverterm TARMAC has not been disclosed in published Snowden documents but appears to refer to improved technology, expanded collection, and better target development as indicated in Figure 3.

8 ‘GCSB Update 22 April 2010’, op.cit.

9 Ibid.

10 ‘Footprints’, Satbeams, at http://www.satbeams.com/footprints.

11 Duncan Campbell, Interception Capabilities 2000, Report to the Director General for Research of the European Parliament (Scientific and Technical Options Assessment programme office), April, 1999, at http://www.duncancampbell.org/menu/surveillance/echelon/IC2000_Report%20.pdf.

12 For a notable exception, see ‘Torus: the antenna to significantly increase satellite interception’, Top Level Communications, 8 April 2015, at http://electrospaces.blogspot.ca/2015/04/torus-antenna-to-significantly-increase.html.

13 Identified in multiple career resumes and recruitment listings for or by SIGINT staff.

14 ‘Spying Close to Home: German Intelligence Under Fire for NSA Cooperation’, Spiegel Online International, 24 April 2015, at http://www.spiegel.de/international/germany/german-intelligence-agency-bnd-under-fire-for-nsa-cooperation-a-1030593.html; and ‘Berlin deleted ‘12,000 NSA spy requests’, The Local (de), 1 May 2015, at http://www.thelocal.de/20150501/berlin-deleted-12000-nsa-spying-requests-report.

15 ‘Old Soviet Listening Posts’, Google Maps, at https://www.google.com/maps/d/viewer?mid=zp2K5WStbci8.kRGSb08LIoys&msa=0.

16 Matthew Aid, ‘Chinese SIGINT Sites’, Matthew Aid.com, 4 June 2012, at http://www.matthewaid.com/post/24424601613/chinese-sigint-sites.

17 Report by Duncan Campbell for the Wired magazine, forthcoming at the time of this publication.

18 Campbell, Interception Capabilities 2000, op.cit.

19 Duncan Campbell, ‘Revealed: GCHQ’s Beyond Top Secret Middle Eastern Internet Spy Base’, The Register, 3 June 2014, at http://www.theregister.co.uk/2014/06/03/revealed_beyond_top_secret_british_intelligence_middleeast_internet_spy_base.

20 ‘GCHQ Seeb Submarine Cables Interception Base’, Cryptome, 8 June 2014, at http://cryptome.org/2014-info/gchq-seeb/gchq-seeb.htm.

21 Published later by Der Spiegel magazine in a different typeface.

22 See Bill Robinson, ‘CAC-98CG monitors Internet and/or IM traffic’, 15 October 2013, at http://luxexumbra.blogspot.ca/2013/10/cac-98cg-monitors-internet-andor-im.html

23 General Dynamics, ‘Model 700-70TCK Torus Multiple Band Antenna’, at http://www.gdsatcom.com/Antennas/Data_Sheets/655-0037C_7M_Torus.pdf.