18 August 2013
PROTON, CLEARWATER and Lexis-Nexis
A Proton/Crisscross job ad below.
PROTON, CLEARWATER and LEXIS-NEXIS
Given the use of constitutionally repulsive practices by the Department of
Justice, the Internal Revenue Service and other federal agencies, this
information is being made public to educate and inform so they might arm
themselves against government intrusion and for attorneys as a backgrounder
for future appeals.
I suggest American guerillas seek non-Internet modes of communication. If
you think Rex Sherwood was pulled over for not using a turn signal, you are
I was "read on" the PROTON/CRISSCROSS program in late 2006 and was a frequent
user of this system for over a year. As part of my duties, I employed
PROTON/CRISSCROSS in HUMINT exploitation role. In the Intelligence Community,
PROTON/CRISSCROSS is referred to as PROTON. Unless otherwise specified, the
same is true in this report.
PROTON is a storage and analysis system of telecommunications selectors at
the TS/SI/FISA/ORCON/NOFORN level of classification and handling. PROTON
is the program name as well as the name of the technology. It has been described
as "SAP-like", and I suspect that PROTON was once a DEA special program.
PROTON is well known in HUMINT and DOJ clandestine law enforcement. It remains
the primary, if not fundamental, tool of HUMINT and DOJ law enforcement
operations, both of which have considerable overlap in phenomenology and
methodology. PROTON carries the FISA caveat because Top Secret FISA collection
is contained in PROTON's massive database.
Through my professional associations within the Intelligence Community, I
became aware of a Department of Justice (DOJ) system called CLEARWATER.
CLEARWATER is similar to PROTON but at the SECRET/NOFORN level of classification
and exclusively a DOJ program, where PROTON is CIA, DOJ and DOD. Most DOJ
Special Agents and analysts do not have Top Secret clearance. Every informant
is run through CLEARWATER, every witness gets vetted through the system.
PROTON and CLEARWATER are not just analytic tools, they provide actionable
intelligence and both programs are used everyday for target discovery and
development. CLEARWATER practically leads FBI and DEA investigations. PROTON
is used throughout HUMINT for asset validation, recruitment, background checks
on sources, etc. The FBI and DEA as both law enforcement and intelligence
community members have resources of both sides and domestic law enforcement
by these agencies is more of a HUMINT operation of the type seen in Afghanistan.
Find, Fix, Arrest. PROTON and CLEARWATER work so well that Special Agents
and Case Officers can't wait to get data into the system and see how it networks
Top Secret and FISA mean NSA sensitive sources and foreign collection. NSA
resources are unneeded in America---CALEA and the DOJ have that covered for
you under Title III, the Patriot Act and opinion from the federal kangaroo
FISA is not only used against terrorists and spies but also private and
quasi-government organizations . The most impressive network I ever laid
eyes upon was the PROTON derived communications network of the Netherlands
and Swiss SWIFT. Allot of target discovery there. It's how you find a needle
in a haystack. The U.S. hosts one of three SWIFT secure messaging centers.
Well, the NSA and CIA have insured SWIFT is allot less secure. SWIFT is a
major communications target and the NSA is deep in that This is a modern
take on "follow the money." If Americans are wondering how the IRS found
their secret bank accounts..well, here 'ya go.
When I read the description of Drug Enforcement Administrations (DEA) DEA
Internet Connectivity Environment (DICE) system: the billions of records,
partnership with CIA, NSA and DOD, the need to cover sources at the expense
of a fair trail--- it struck me that what was described sounded more like
PROTON and/or CLEARWATER.
As I read further, DICE was sounding more like a legitimate DEA program that
was being used to provide cover for PROTON and/or CLEARWATER---either
intentionally or sacrificially. The early descriptions of DICE present it
as an information sharing and collaboration tool through the Internet. The
recent public descriptions of DICE are awkward and contrived when compared
to past information.
DICE is being used to cover PROTON and/or CLEARWATER.
Properly, CRISSCROSS is the database of telecommunications selectors. Selectors
are, in NSA terms, that information that selects a target for analysis,
investigation or collection. Telephone numbers, email addresses, hexadecimal
addresses from INMARSAT telephones, IMEI---really any telecommunications
"number" or "address" a person would have as a means to contact another,
are contained in CRISSCROSS.
PROTON is the operating software written in JAVA for cross-platform usability
and runs on JWICS for connectivity to CRISSCROSS.
PROTON contains the tools for network analysis and would be familiar to anyone
who has experience in undergraduate social network analysis, statistics and
CRISSCROSS has an interesting and murky history. As it was explained to me
by a PROTON Program Officer, CRISSCROSS was originally a very secret DEA
program to provide a repository for DEA collected selectors. It was, by every
account, an excellent resource. With the post-911 reorganization of the
Intelligence Community, everyone was required to share their resources for
the "War of Terror." CRISSCROSS was very successful and well-received and
ultimately exceeded DEA capabilities to manage. The CIA took over as executive
agent---but CRISSCROSS is shared by the DOD and DOJ in a co-ownership manner.
It's uncertain if PROTON received Special Collection Service (SCS) data when
it was a solely DEA activity, but PROTON presently receives SCS collection
amounting to about 1 one terabyte monthly, and that's just selectors, not
content. PROTON also receives data from Computer Network Exploitation (CNE),
by the now famous Tailored Access Office (TAO). Included as well is an enormous
repository of Title III data from CALEA enabled domestic collection, FISA
and an enormous amount of purchased data from various communications providers
PROTON does not contain content, only selectors for targeting. Consider that
in the context of one (1) terabyte of just selectors per month (just from
the SCS) for over 10 years. I have no idea how much the TAO provides, however
the two biggest contributors to PROTON are the SCS and TAO.
An analyst or law enforcement officer can "run" a selector in PROTON and
visualize the social network of correspondents associated with that selector
in a visual format. The user can select and display most frequent numbers
called or have called, duration of call, and other functions familiar to
social network analysis. An analyst may choose to look at the network in
terms of who called who: persons of importance typically have allot of people
calling them so we can build a network based on that to determine centricity.
We can build a network based on call duration, frequency, date---pick a variable.
Sometimes it's useful to look at the outliers which may be hang-arounds to
some drug trafficking organization. We can task NSA or DOJ for collection
on these hang-arounds and begin network deconstruction from the ground up.
These calling networks include family, friends and other non-target persons.
Non-target persons, like family members, are very useful in developing the
target and as leverage. Non-target communications provide intelligence from
things spoken between people in confidence who may not be aware of the targets
activities or associations, like the location of a fugitive who has ceased
using his known selectors, but communicates with his mother through her known
Another very useful feature is the Bankswitch function, which allows network
discovery by the calling pattern, not necessarily by a selector. Often, groups
of U.S. government interest will use a cellphone, then dispose of them ,
preventing further intelligence collection from that group of cellphones.
Bankswitch allows the analyst to quickly rediscover the calling network that
has switched phones. Humans typically have some constant behavior in who
and how they make their calls and persons. Groups and enterprises not having
supplicated to the U.S. government avarice will have a whole additional set
of behaviors in who and how they call.
This is highly useful for calling networks that dispose and rotate telephones
regularly. A fresh cellphone provides enough of a lead to discover the calling
pattern of the whole network based on historical calling records. Both the
DEA and FBI have found this useful in their activities in Columbia, Mexico
and the United States.
I know for certain PROTON contains communications selectors on American Citizens
(AMCITS) since I ran a query on a number using only a Maryland area code
and a partial prefix. PROTON returned a huge list of "masked" domestic numbers.
An NSA masked number is always domestic and reveals only the area code and
prefix with the rest of the number obscured. A PROTON user can email the
NSA with a request to unmask the number---it's in the database, but a user
has to present some justification for a number to be unmasked. Voice cuts
are available through a similar process.
PROTON is really well thought out. Not only does it provide a wealth of network
investigative tools, it also allows for the easy introduction of data. Let's
say you're a DEA Special Agent surveilling local boat captains as part of
OPERATION PANAMA EXPRESS (PANEX) in Barranquilla Columbia---a major Port
of Origin for drugs to the U.S. and someone gives you a business card. Just
run the number and see if it hits. The Special Agent" can take that card
and mail it to the PROTON Program Office (PPO). Scans, cell pictures of the
information are also acceptable to ingest.
An FBI Case Officer attending a UAV conference in Las Vegas can take all
the "grey literature" and hand that to the PROTON office as well. The numbers
find their way into the database The PROTON office will also ingest entire
phone books---still popular in some parts of Europe and Asia. They use a
method similar to Google books to automatically turn pages and scan data
Anything that contains a selector can go into PROTON. Part of the PROTON
program is the resource that provides software engineering to order unordered
data and otherwise make raw data ingestible. PROTON users can add and edit
PROTON data as well. If a user discovers the identity of a previously
unidentified selector, one can edit that record or leave notes for other
With PROTON, you can see who's talking to whom in a telecommunications
relationship context. How you hit that network is up to you.
Network deconstruction techniques vary throughout the 'Community. Domestically,
the DOJ prefers the highly publicized raid with the media providing the
entertainment backdrop. The DEA prefers covertness. The DOD prefers a Predator
strike. Yes, those drone attacks are network deconstruction techniques and
target selection is often facilitated, if not provided, by PROTON.
As stated earlier, CLEARWATER is a SECRET/NOFORN version of PROTON. The DEA
red herring called DICE reportedly contained NSA collection which rules-out
CLEARWATER (a S//NF system) and highlights PROTON (a TS//SI system) as the
source of DICE intelligence.
I'm providing information on both since the government is no longer under
constitutional restraint and is illegitimate. Parallel Construction. You
fuckers. A cornerstone of American law and western culture sacrificed for
the security of the Elites.
With the CALEA requirements, TITLE III collection is very simple affair involving
a court order and the Cisco routers which, through CALEA legislation, are
engineered for surveillance. Cisco is a very enthusiastic partner to the
Intelligence Community---one of those sensitive relationships managed through
the NSA Special Source Operations office. The NSA finesses such
relationships---with the DOJ, you get a thug in a nice suit and the quiet
menace of federal law enforcement. If you think the DOJ is a law enforcement
agency, you're stupid. Internal security is DOJ Job #1. As we have seen,
the DOJ is maintaining internal security by both legal and extralegal means
with the full support of the federal judiciary and the lukewarm animus of
the U.S. Congress.
Federal judges and congress persons are largely immune to DOJ surveillance.
You are not. The "new" counter-insurgency operations by the government
concentrate on a Reasonable Suspicion by persons and groups---not on Probable
CLEARWATER contains selectors from any number of sources: TITLE III, purchased
data from telecommunications data brokers, National Security Letters, subpoenas,
technical operations by FBI TACOPS, search warrant, informant production,
arrests, detentions. If the DOJ has searched you, arrested you or let you
go, count on that data being in CLEARWATER. Did you give the Special Agent
your telephone number?
Arresting someone to search them without needing consent or court order is
not an unheard of means to get a Person of Interests selectors into CLEARWATER.
Something laying openly on your desk? A cell-phone snap and email to the
program office. How about those utility bills you throw away without shredding?
If you're a Person of Interest, somebody is walking away with your trash.
There is a a real motivation by DOJ Special Agents to get telecommunications
selectors into PROTON or CLEARWATER to build the networks for analysis and
CLEARWATER has all the features of PROTON and at least one other---mapping.
An FBI Case Officer operating domestically can query say, Lahore Pakistan,
and place on a map, those locations in the U.S. where those calls originated
or terminate---a choropleth map with colored density clusters, all in a spatial
context. With that, the DOJ knows where to focus it's domestic security efforts.
A DEA Special Agent can run a selector seized in an amphetamine investigation
and, within a few minutes, have the calling network and visualize the
correspondents locations on a map. That's how DOJ led task forces show up
in your neighborhood.
Watching a OWS protester enter a number into their cell phone is perfectly
legal without consent or a warrant and once I get that number, we'll look
at that calling network, find the node that is you, and walk that back to
that moment we shared under the chestnut tree.
If you're visiting the USA from abroad, you may have your wallet and pocket
litter photocopied at secondary screening. Then an email to the National
Counterrorism Center (NCTC) Terrorist Identities Datamart Environment (TIDE)
office, and from there, a Forward to the PROTON office.
PROTON, CLEARWATER and LEXIS-NEXIS all provide data export into Analyst Notebook
file format (and PDF for ease of sharing).
All members of the Intelligence Community have access to LEXIS-NEXIS. LEXIS-NEXIS
contains biographic information on most Americans having a driver or occupational
license. Your state sells the contents of its drivers license database to
companies like LEXIS-NEXIS for a profit. They can do this since that information
is considered in the public domain---driving is a privilege and if you don't
want to be in database then don't get a drivers license. LEXIS-NEXIS contains
other highly personal and granular information depending on which state is
providing information. Florida provides pretty much everything it can to
LEXIS-NEXIS. Automobile information, luxury water craft, occupational
licenses---if you submit information to a state agency, it can end up in
LEXIS-NEXIS. All domestic law enforcement has access to LEXIS-NEXIS, its
a fundamental investigative tool. IRS, DOJ, Treasury, Local PD, Sheriffs
Office all have a LEXIS-NEXIS access or the means to pull data from them.
Law Enforcement Officers can have their data removed from LEXIS-NEXIS. An
LAPD and NYPD "spokesperson" informed me that this is the case. Imagine your
a citizen in New York and you get surveilled by one of the numerous surveillance
technicians the NYPD has fielded since 9-11 , a quick look-up via mobile
device or WiFi and they know who you are now.
So, a Special Agent or analyst simply runs the selectors in PROTON and
CLEARWATER, then runs those names or other biographic/vital information again
in LEXIS-NEXIS, all that data related to the TARGET is exported in Analyst
Notebook format, those files are imported into the Analyst Notebook application
and...viola!...a relatively complete social network and biographics of the
TARGET. That could be you of course.
By Supreme Court decision and other judicial misadventures, LEXIS-NEXIS contains
public information and you do not have an expectation of privacy. There is
no need for Probable Cause or Reasonable Suspicion because this data is,
by judicial opinion, public. Something to think about next time you're at
the DMV. Citizens are queried regularly in LEXIS-NEXIS. CLEARWATER and PROTON
provides network association and the selectors. A subpoena, NSL or search
warrant to the telecommunications provider of that selector gives us names
and locations. LEXIS-NEXIS provides Pattern of Life, geolocation and personalia.
I was able to see my past three residential addresses, past telephone numbers
and identifying information about my previous automobile. LEXIS-NEXIS is
coupled to Automatic License Plate Recognition Systems (ALPRS) as well. Who
you are, where you were and where you are.
The DOJ and Intelligence Community access LEXIS-NEXIS through a VPN and a
proxy (government). A DOD proxy is registered to the Virginia Contracting
Office, but it's a non-logging proxy so, good luck in your discovery. LEXIS-NEXIS
has no idea of the individual accessing it's database and, according to the
spokesperson, does not maintain logs of government clients. A subpoena cannot
discover what is not there.
Around 2008, LEXIS-NEXIS purchased Choicepoint to start their new product
line. I recall some representative, at a promotional meeting, extolling the
virtues of Choicepoint---all the data in a easy to use format. A user of
Choicepoint could run a query and not only get biographics and addresses
but have that information located on a map or satellite image (by Pinpoint,
Inc. or a Google map server). The Choicepoint representative giving the
presentation said no Social Security Numbers or drivers license pictures
would be included in the database in order to protect the rights of the citizen.
Such conceits are good ethics in Washington, D.C.
That said, CLEARWATER and PROTON are not omnipotent. Foreign intelligence
organizations use the Internet for covert and clandestine communication without
detection and you can as well. Do not believe that the NSA or DOJ is all
powerful. They are not and they can be defeated. Of the many systems used
by NSA and DOJ, CLEARWATER, PROTON and LEXIS-NEXIS are the most significant
from a "boots on the ground" investigative prospective.
There is real concern that PROTON may be to widely known for such a program
and efforts are being made to walk it back into a compartment.
A Proton/Crisscross job ad:
SIGINT Analyst Job
Date: Aug 14, 2013
Location: Hanover, MD, US
Job Order: J0311-0630 - Permanent Full Time
Title: SIGINT Analyst
Category: Consulting / Business / Functional
City: Hanover, Maryland, United States
Job Description: SIGINT Analyst
CGI Federal is seeking a SIGINT Analyst to work in our Hanover, MD office.
Applicants will work as a member of a government-contractor team whose primary
focus will be providing support to deployed analysts and software developers.
In this capacity, uses an in-depth knowledge of general communications
procedures, traffic analysis and reporting formats and vehicles to produce
time-sensitive and event-oriented reports
Provide support to force protection, indications and warning and situational
awareness; provides target continuity and mentorship to a junior and rotating
workforce; conducts research to answer RFIs and produces working aids to
support new tool development.
Must be willing to receive and conduct training on new systems, databases,
processes and procedures.
Analyst will be supporting deployed US military troops and must understand
the military decision making process and miliary doctrine.
Minimum of five (5) years experience with the military or government agency
using the collection management cycle, intelligence cycle, targeting cycle,
and the SIGINT intelligence fusion process from tactical to national level
Experience with Falconview, Analyst Notebook, Arc View, Arc-GIS, Arc-Editor,
AIM, Pathfinder, SEAS, STARLIGHT, GCCS and other current analyst tools.
Active TS/SCI security clearance w/ polygraph required.
Experience with NSANET, RTRG tool suite, Global Reach, Proton/Criss Cross,
Broom Stick, CW II, Banyan. Geo Bootcamp and knowledge of ArcGIS a plus.
Preferred experience includes analysis in OIF/OEF, NSA, INSCOM, or ACE At
CGI, we're a team of builders. We call our employees members because all
who join CGI are building their own company - one that has grown to 71,000
professionals located in more than 40 countries. Founded in 1976, CGI is
a leading IT and business process services firm committed to helping clients
succeed. We have the global resources, expertise, stability and dedicated
professionals needed to achieve results for our clients - and for our members.
Come grow with us. Learn more at www.cgi.com.
This is a great opportunity to join a winning team. CGI offers a competitive
compensation package with opportunities for growth and professional development.
Benefits for full-time, permanent members start on the first day of employment
and include a paid time-off program and profit participation and stock purchase
We wish to thank all applicants for their interest and effort in applying
for this position, however, only candidates selected for interviews will
No unsolicited agency referrals please.
WE ARE AN EQUAL OPPORTUNITY EMPLOYER.
- Analytical Thinking
- Signal Intelligence (SIGINT)