Since
The Guardian first
published about the PRISM data collection program on June 6,
there have been new disclosures of top secret documents almost every day,
resulting in some fierce protests against apparently illegal wiretapping by the
NSA and GCHQ. However, it remains unclear what PRISM actually is or does, as The
Guardian didn't provide any new details or disclosed more than 5 of the 41
presentation slides about the program.
This makes it hard to determine
whether PRISM really is the illegal or at least embarrassing program which most
people now think it is. Especially, because it could even be the hardly secret
Planning tool for Resource Integration, Synchronization and Management (PRISM),
which is a web-based tool to manage information requests widely used by the US
military. Here we will take a closer look at this program and try to determine
whether this could be the same as the PRISM revealed by The Guardian.
Planning tool for Resource Integration,
Synchronization and ManagementThe earliest document which
mentions the Planning tool for Resource Integration, Synchronization and
Management (PRISM) is a
paper (pdf) from July 2002, which was prepared by the MITRE
Corporation Center for Integrated Intelligence Systems. The document describes
the use of web browsers for military operations, the so-called "web-centric
warfare", for which intelligence collection management programs were seen as the
catalyst. These programs fuse battlefield intelligence information with the
national data that they already possess, in order to provide a complete picture
to their users.
PRISM was developed by
SAIC
(formerly Science Applications International Corporation, a company that was
also involved in the 2002
TRAILBLAZER program for analyzing network data). The program
was originally prototyped and fielded for the US European Command, but is also
being used in other military operation areas such as Iraq. Involved in the
establishment of PRISM was Ron Baham. His LinkedIn profile says that he
currently is senior vice president and operations manager at SAIC and that he
worked on CMMA PRISM at JDISS from 2000 - 2004, so PRISM might be developed
somewhere between 2000 and early 2002.
On its
website, SAIC
says that the PRISM application allows theater users, in various functional
roles and at different echelons, to synchronize Intelligence, Surveillance and
Reconnaissance (ISR) requirements with current military operations and
priorities. The application was first developed for use on
JWICS, the highly
secure intelligence community network, but is now also being used on
SIPRNet, the
secure internet used by the US military.
Other sources clarify that PRISM consists of a
web-based interface which connects to PRISM servers, and that it's used by a
variety of users, like intelligence collection managers at military
headquarters, to request the intelligence information which is needed for
operations. These requests are entered in the PRISM interface, which sends them
to the PRISM server. From there the request goes to units which collect the raw
data. These are processed into intelligence, which then becomes available
through the PRISM server.
PRISM is able to manage and prioritize these
intelligence collection requirements to ensure critical intelligence is timely
available to the commander during crisis operations. The application integrates
these requirements and, with other tools, generates the so called daily
collection deck. PRISM also provides traceability throughout the so-called
intelligence cycle, from planning through exploitation to
production.
The PRISM application made by SAIC is still widely used. It's
mentioned in joint operations manuals from 2012 and in quite a number of job
descriptions, like
this one from March 2013 for a systems administator in Doha,
Qatar, which says that part of the job is providing on-site and off-site PRISM
training and support. Also these
US government spending data show that in 2011 a maintaince
contract (worth $ 1.085.464,-) for PRISM support services was awarded to SAIC,
with options for 2012 and 2013.
Are there two different
PRISMs?So now it looks like as if there are two different
programs called PRISM: one is a web-based tool for requesting and managing
intelligence information from a server that gets input from various intelligence
sources. The other is the program from which The Guardian says it's a top secret
electronic surveillance program that collects raw data from the servers of nine
major US internet companies.
If the Guardian's claims are true, it's
strange that two important intelligence programs apparently have the exact same
name. For sure, this would not be very likely, if "PRISM" would be an acronym or
a codeword in
both cases. But if we assume one PRISM being an acronym and
the other PRISM a codeword, it could be somewhat more likely.
As we know,
the PRISM tool developed by SAIC is an acronym, just like the names of many
other military and intelligence software tools are often lengthy
acronyms. This
leaves the PRISM which was unveiled by The Guardian likely to be a codeword, or
more correctly said, a nickname. NSA data collection
methods, officially
designated by an alphanumerical
SIGAD like US-984, can have nicknames which may or may not be
classified.
These are different from codenames, which are always
classified and often assigned to the intelligence
products from the
various data collection methods. This can cause some confusion, as "PRISM"
perfectly fits in the NSA tradition of using 5-letter
codewords
for products of sensitive Signals Intelligence programs.
If PRISM had been a classified codename, it should also have been part
of the classification line, and the marking should have read TOP SECRET //
SI-PRISM // [...] instead of the current TOP SECRET // SI // [...]. This
indicates that PRISM isn't a codeword for intelligence from a specific source,
but more likely the nickname of a collection method.
This still leaves
the question of why in 2007 an apparently new collection program got a nickname
which is exactly the same as the already widely used computer application which
is going to task this internet data collection method.
A less spectacular PRISM?Allthough The Guardian presented
PRISM as a method of directly collecting raw data from major internet companies,
other sources say that PRISM might well be a much less spectacular internal
computer program.
Initially, The Washington Post came with the same
story as The Guardian, but revised some of its claims by
citing another classified report that describes PRISM as allowing "collection
managers [to send] content tasking instructions directly to equipment installed
at company-controlled locations." These words very much resemble the way the
PRISM Planning Tool is described.
National security reporter Marc
Ambinder
describes PRISM as "a kick-ass GUI (Graphical User Interface)
that allows an analyst to look at, collate, monitor, and cross-check different
data types provided to the NSA from Internet companies located inside the United
States" - which also sounds much more like the SAIC application, than like a
data dragnet with free access to commercial company servers.
This view
was also confirmed by a
statement (pdf) of Director of National Intelligence (DNI)
James Clapper, which says: "PRISM is not an undisclosed collection or data
mining program. It is an internal government computer system used to facilitate
the government’s [...] collection of foreign intelligence information from
electronic communication service providers [...]".
With this statement,
Clapper officially confirms the existance of a program called PRISM, and
allthough his description could also fit that of the Planning tool for Resource
Integration, Synchronization and Management, he didn't positively identified
PRISM as such.
Finally, an anonymous former government official told
CNet.com that The Guardian's reports are "incorrect and appear
to be based on a misreading of a leaked Powerpoint document", making journalist
Declan McCullagh go one step further by suggesting that PRISM might be actually
the same as the web application named Planning Tool for Resource Integration,
Synchronization, and Management.
PRISM as an all-source
planning toolSome sources, like a
joint operations manual and a number of job descriptions, seem
to indicate that the PRISM planning tool is primarily used for
geospational
intelligence (GEOINT), which is analysed imagery of the earth as collected
by spy planes and satellites.
However, more extensive research has shown that the
Planning tool for Resource Integration, Synchronization and Management (PRISM)
is not only used for geospatial intelligence, but for fusing intelligence from
all sources. Besides GEOINT, sources prove that PRISM is also used for SIGINT
(Signals Intelligence), IMINT (Imagery Intelligence) and HUMINT (Human
Intelligence), probably through additional modules for each of these
sources.
Even the 2006
Geospatial
Intelligence Basic Doctrine (pdf) says PRISM is a "web-based application
that provides users, at the theater level and below, with the ability to conduct
Integrated Collection Management (ICM). Integrates all intelligence discipline
assets with all theater requirements."
More specifically, the 2012
Joint and National Intelligence Support to Military Operations
manual describes that where applicable, requests for SIGINT support should be
entered into approved systems such as PRISM, for approval by a military
commander.
In a
job
description for an Intelligence Training Instructor from 2010 we see a
distinction being made between PRISM-IMINT and PRISM-SIGINT, and a LinkedIn
profile
mentions the IMINT/SIGINT PRISM training in 2006 of someone
who was administrator for PRISM, which is described as the system of record
USCENTCOM uses for submitting, tracking, and researching theater ISR
requirements. In a
job description for a SIGINT Collection Management Analyst (by
Snowden-employer Booz Allen Hamilton!) experience with PRISM is required
too.
Also a module was added to PRISM for accessing information from
HUMINT (Human Intelligence) sources. Testing of this module was done during the
Empire Challenge 2008 exercise. In the daily reports of this exercise we can
read that for example the Defense Intelligence Agency's HUMINT
team loaded
"additional data into PRISM HUMINT module for operations on
Tuesday morning". From a
French report about this exercise we learn that the PRISM
HUMINT module was a new application, just like the Humint Online Tasking &
Reporting (HOT-R) tool, which runs on SIPRNet.
Are both
PRISMs one and the same?If The Guardian's PRISM really is just a
computer system for sending tasking instructions directly to equipment that
collects raw data, it is hard to believe that it's different from the Planning
tool for Resource Integration, Synchronization and Management (PRISM), which for
many years is used to order and manage intelligence from all sources. This would
also fit claims by which PRISM is most used in NSA reporting.
If this
could be true, and there's only one PRISM program, what about the slides which
were disclosed by The Guardian? First of all, as this newspaper is
not willing to publish all PRISM-slides, we cannot be sure
about what this presentation is really about, but it's possible that it's not
about a PRISM which is a nickname of the US-984XN collection method, but about
how to gather material from that source by using the PRISM web tool.
More specific, we can think of a machine-to-machine interface between
the PRISM system and dedicated data collection devices at remote locations, like
a secure FTP server or an encrypted dropbox at sites of the internet companies.
At the PRISM desktop interface this tasking may be done through a separate
SIGINT module. As one of the slides says:
"Complete list and details on PRISM
web page: Go PRISMFAA" we can even imagine a module called "PRISM FAA" for
requesting intelligence from intercepts of foreign communications under the
conditions of the FISA Amendment Act (FAA) from 2008.
By publishing the
PRISM slides The Guardian for the first time revealed evidence about the NSA
collecting data from major internet companies. But as this apparently surprised
the general public, the practice is hardly new. Spies and later intelligence
agencies of all countries have always tried to intercept foreign communications
and of course tried to do this with every new way of communication: first
letters, later phonecalls and nowadays internet based social
media.
Therefore, it may hardly come as a surprise that NSA also found
ways to intercept those new means of communications too. And whether these
interception and collection methods might have nicknames or not, it's very
likely that access to their processed output was added to all the other
intelligence sources which can be tasked by using the PRISM Planning Tool.
What looks more of a problem, is the fact that in the past, enemies were
nation states, which could be targeted by focussing on diplomatic and military
communications. Nowadays, with terrorism considered as the main enemy, almost
every (foreign) citizen could be a potential adversary, which made intelligence
agencies try to search all communications available.
Next time we
will discuss more specific details of the Planning tool for Resource
Integration, Synchronization and Management (PRISM), as this gives an
interesting look at internal intelligence procedures.
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sh1EPCXnELQF1RKtPt9FazkTXKPhtqN6lPP4Hl-vB7iQXA7gvQ6YafEBC3tuahYuFC70YNojs-M9Q-rdYMd1KYNMQqb_CsY406WkczIBS7IFkEN_baHyOz4YGrp4UBOLc-=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vM0unLH3sVWdFggtxhUDTg2vUcKnvSDiCc7UxHPIv19H1OKSpYAiYD4JDNojyBs0SEcVubtzCPOSpoTCDv8WjgLaV4Na0U8xCPns43GHkq594KcWOuyX3RViJjFLDLzTvF=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_s4YBRz8AvhFPHX-K6mH97dwpY4fOABrUc4E95hbkib46dQV-BastCawwu4AxwIWrEsRRNq-Wx7xQ_Sng_xhnVVrFKmoK0fikx7Np4Mngr53lXojg0m1NlPuRKr2nzFz1a4=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vM0pBtGBV-TJyKytdXFVq0Pu5XYD9bvhB5TKFY1N5opiF0wykXWGunPmCB0P7PauGytBvZv088Fg04cA9SmRmkuTScjyXy7c7ElozgdT44fWE689pIrlBiA2_F-txIasPk=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tMMjp_1RsWcOtzWLA5nErM6HeBiEHA66IFmmpmr-bDgtvNyyntgCuYiHCRI_KFE1d5yjgplfQV98QQ4fhjO1USx8VwTU7uekLsJQxj-dhIM0fqrBvryp31pniRhrJaHU8=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sMyyzrGwUyiIzMXMkAhy4tD8SFVbD22siAxHf0gd9CE5ANi4RF2M2mYpnoOG53jN2BQLFhotQyxLjuosQi6Nsx9uOwWvE0-UH4ULK-fTX7E0Gs0fzLfG7g0K8MDrqEGMrj=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uronH5n7V47ozFOtT7zF8ctBY_lWFBTNOwOA9KItXB54RbpcTOx4nu3OaY6e5T1lhmS9EstxfOJi_g2mUWwr9H6dYlUiUUDi2L995hPk6CAaEiSPBqzHIiI7u7Nu_d_QyR=s0-d)
