1 March 1999. Thanks to V6.
www.villagevoice.com/features/9908/vest_madsen.shtml February 24 - March 2, 1999 A Most Unusual Collection Agency How the U.S. undid UNSCOM through its empire of electronic ears By Jason Vest and Wayne Madsen When Saddam Hussein raised the possibility of attacking U.S. planes in Turkey last week, his threats illustrated what many in diplomatic circles regard as an international disgrace the emasculation of the UN by the U.S. When UNSCOM, the UN's arms-inspection group for Iraq, was created in 1991, it drew on personnel who, despite their respective nationalities, would serve the UN. Whatever success UNSCOM achieved, however, was in spite of its multinational makeup. While a devoted group of UN staffers managed to set up an independent unit aimed at finding Saddam's weapons and ways of concealing them, other countries seeking to do business with sanctions-impaired Iraq notably France and Russia used inspectors as spies for their own ends. But what ultimately killed UNSCOM were revelations that the U.S. government had manipulated it by assuming control of its intelligence apparatus last spring (or perhaps even earlier by using the group to slip spies into Iraq) not so much to aid UNSCOM's mission, but to get information for use in future aerial bombardments. When stories to this effect broke last month, however, there was almost no consistency in descriptions of the agencies involved or techniques used. The New York Times, for example, said only one CIA spy had been sent into Baghdad last March to set up an automated eavesdropping device. Time had multiple Defense Intelligence Agency (DIA) operatives planting bugs around Baghdad throughout 1998. The Wall Street Journal referred to the use of one "device" from the National Security Agency (NSA) last year and "a series of espionage operations used by the U.S. [since] 1996 to monitor the communications" of Saddam and his elite. When probing the world of espionage, rarely does a clear picture emerge. But according to a handful of published sources, as well as assessments by independent experts and interviews with current and former intelligence officers, the U.S. government's prime mover in Iraqi electronic surveillance was most likely a super-secret organization run jointly by the the CIA and the NSA the spy agency charged with gathering signals intelligence (known as SIGINT) called the Special Collection Service. Further, there is evidence to suggest that the Baghdad operation was an example of the deployment of a highly classified, multinational SIGINT agreement one that may have used Australians to help the U.S. listen in months after the CIA failed to realize the U.S. objective of overthrowing Saddam Hussein through covert action. According to former UNSCOM chief inspector Scott Ritter, when the U.S. took over the group's intelligence last year, a caveat was added regarding staffing: only international personnel with U.S. clearances could participate. "This requirement," says Ritter, "really shows the kind of perversion of mission that went on. The U.S. was in control, but the way it operated from day one was, U.S. runs it, but it had to be a foreigner [with a clearance] operating the equipment." Under the still-classified 1948 UKUSA signals intelligence treaty, eavesdropping agencies of the U.S., United Kingdom, Canada, Australia, and New Zealand share the same clearances. According to Federation of American Scientists intelligence analyst John Pike, this gives the U.S. proxies for electronic espionage: "In the context of UKUSA, think of NSA as one office with five branches," he says. As UNSCOM demonstrates, though, sometimes the partnership gets prickly; the British, according to Ritter, withdrew their personnel following the U.S.'s refusal to explain "how the data was going to be used." (According to a longtime British intelligence officer, there was another reason: lingering bad feelings over the NSA's cracking a secret UN code used by British and French peacekeepers during a Bosnian UN mission.) At this point, says Ritter, he was instructed to ask the Australian government for a "collection" specialist. "We deployed him to Baghdad in July of 1998," recalls Ritter. "In early August, when I went to Baghdad, he pulled me aside and told me he had concerns about what was transpiring. He said there was a very high volume of data, and that he was getting no feedback about whether it was good, bad, or useful. He said that it was his experience that this was a massive intelligence collection operation one that was not in accordance with what UNSCOM was supposed to be doing." In other words, the Australian most likely an officer from the Defence Signals Directorate, Australia's NSA subsidiary, who was supposed to have been working for the UN may have been effectively spying for the U.S. Stephanie Jones, DSD's liaison to NSA, did not take kindly to a Voice inquiry about this subject; indeed, despite being reached at a phone number with an NSA headquarters prefix, she would not even confirm her position with DSD. However, a former high-ranking U.S. intelligence official said that such a scenario was probable. "The relationship between the UKUSA partners has always been of enormous value to U.S. intelligence, even when their governments have been on the opposite sides of policy issues," the official said. "I would not be surprised at all if the Aussies happened to be the ones who actually did this [at U.S. behest]." With an intelligence community of over a dozen components, billion-dollar budgets, and cutting-edge technology, the U.S. can cast a wide net, be it with human sources or signals interception. Iraq, however, has presented a special challenge since Saddam's Ba'ath party took power in 1968. "In Iraq," says Israeli intelligence expert Amatzai Baram, "you are dealing with what is arguably the best insulated security and counterintelligence operation in the world. The ability of Western or even unfriendly Arab states to penetrate the system is very, very limited." According to the former Cairo station chief of the Australian Secret Intelligence Service (ASIS), the West got this message loud and clear after Iraqi counterintelligence pulled British MI6 case officers off a Baghdad street in the mid '80s and took them to a warehouse on the outskirts of town. "They had arrayed before them the various agents they had been running," the exASIS officer told the Australian Broadcasting Corporation in 1994. "There were wires hanging from the rafters in the warehouse. All the men were strung up by wires around their testicles and they were killed in front of the faces of their foreign operators, and they were told, you had better get out and never come back." When UNSCOM was inaugurated in 1991, it quickly became apparent that the organization's intelligence capability would depend largely on contributions from various UN member countries. According to several intelligence community sources, while the CIA did provide UNSCOM with information, and, later, serious hardware like a U-2 spy plane, the focus of the U.S. intelligence community at the time was on working with anti-Saddam groups in and around Iraq to foment a coup. What resulted, as investigative authors Andrew and Patrick Cockburn demonstrate in their just published book Out of the Ashes: The Resurrection of Saddam Hussein, were two of the most colossally bungled CIA covert operations since the Bay of Pigs. While details of one of the failed operations were widely reported, the Cockburns fleshed out details of an arguably worse coup attempt gone awry in June 1996. Iraqi counterintelligence had not only managed to finger most of the suspects in advance, but months before had even captured an encrypted mobile satellite communications device that the CIA gave the plotters. Adding insult to injury, the Cockburns report, Iraqi counterintelligence used the CIA's own device to notify them of their failure: "We have arrested all your people," the CIA team in Amman, Jordan, reportedly was told via their uplink. "You might as well pack up and go home." Some UNSCOM staffers first under Russian Nikita Smidovich, later under American Scott Ritter managed to create what amounted to a formidable micro- espionage unit devoted to fulfilling UNSCOM's mission. Between information passed on from various countries and use of unspecified but probably limited surveillance equipment, the inspectors were gathering a great deal. But in March 1998, according to Ritter, the U.S. told UNSCOM chair Richard Butler of Australia that it wanted to "coordinate" UNSCOM's intelligence gathering. Ritter insists that no U.S. spies under UNSCOM cover could have been operating in Baghdad without his knowledge prior to his resignation in August 1998. However, as veteran spies point out, if they were, Ritter probably wouldn't have known. A number of sources interviewed by the Voice believe it possible that Special Collection Service personnel may have been operating undercover in Baghdad. According to a former high-ranking intelligence official, SCS was formed in the late 1970s after competition between the NSA's embassy-based eavesdroppers and the CIA's globe-trotting bugging specialists from its Division D had become counterproductive. While sources differ on how SCS works some claim its agents never leave their secret embassy warrens where they perform close- quarters electronic eavesdropping, while others say agents operate embassy- based equipment in addition to performing riskier "black-bag" jobs, or break- ins, for purposes of bugging "there's a lot of pride taken in what SCS has accomplished," the former official says. Intriguingly, the only on-the-record account of the Special Collection Service has been provided not by an American but by a Canadian. Mike Frost, formerly of the Communications Security Establishment Canada's NSA equivalent served as deputy director of CSE's SCS counterpart and was trained by the SCS. In a 1994 memoir, Frost describes the complexities of mounting "special collection" operations finding ways to transport sophisticated eavesdropping equipment in diplomatic pouches without arousing suspicion, surreptitiously assembling a device without arousing suspicion in his embassy, technically troubleshooting under less than ideal conditions and also devotes considerable space to describing visits to SCS's old College Park headquarters. "It is not the usual sanitorium-clean atmosphere you would expect to find in a top-secret installation," writes Frost. "Wires everywhere, jerry-rigged gizmos everywhere, computers all over the place, some people buzzing around in three- piece suits, and others in jeans and t-shirts. [It was] the ultimate testing and engineering centre for any espionage equipment." Perhaps one of its most extraordinary areas was its "live room," a 30-foot-square area where NSA and CIA devices were put through dry runs, and where engineers simulated the electronic environment of cities where eavesdroppers are deployed. Several years ago, according to sources, SCS relocated to a new, 300-acre, three- building complex disguised as a corporate campus and shielded by a dense forest outside Beltsville, Maryland. Curious visitors to the site will find themselves stopped at a gate by a Department of Defense police officer who, if one lingers, will threaten arrest. There are good reasons, explains an old NSA hand, for havingelectronic ears on terra firma in addition to satellites. "If you're listening to something from thousands of miles up, the footprint to sort through is so huge, and finding what you are looking for is not a simple chore. If you know more or less specifically what you want, it's easier to get it in close proximity. And if it happens to be a low-powered signal, it may not travel far enough." According to two sources familiar with intelligence activity in Iraq, the U.S. may have been aided by information delivered either to UNSCOM or SCS from Ericsson, the Swedish telecommunications firm. It's not an unreasonable assumption; though Ericsson brushes off questions about it, in 1996 a Middle Eastern businessman filed suit against the company, claiming, among other things, that it had stiffed him on his commission for brokering a deal between the Iraqis and Ericsson for sensitive defense communications equipment, which, reportedly, included encrypted cell phones. Speaking on condition of anonymity, a veteran intelligence official confirmed that the NSA has "arrangements" with other communications firms that allow NSA to access supposedly secure communications, but cooperation from Ericsson would be "a breakthrough despite our best efforts, they always kept their distance. But it's not beyond the realm of possibility." (This is not without precedent; though hardly covered in the American press, it has been reported that Switzerland's Crypto AG long the supplier of cipher equipment to many of the world's neutral and "rogue" states enjoyed such an "arrangement" with the NSA for decades. Crypto AG denies this.) There is, however, another possible scenario regarding participation by Ericsson in an intelligence venture. According to FAS analyst Pike, it's much more likely that anyone doing intelligence work in Iraq would want a schematic of Baghdad's telephone system which Ericsson installed in the late '60s and has subsequently updated. "I would find it to be far more plausible that the U.S. intelligence community would be interested in acquiring, and Ericsson would be interested in supplying, the wiring diagram for Baghdad's telephone exchange than encryption algorithms for cell phones," he says. Also, he explains, finding ways to tap into a whole phone system or pull short-range signals out of the air without being obvious is clearly SCS's portfolio. "This type of risky close surveillance is what SCS was formed to do," he says. "When you think of NSA, you think satellites. When you think CIA, you think James Bond and microfilm. But you don't really think of an agency whose sole purpose is to get up real close and use the best technology there is to listen and transmit. That's SCS." Regarding any possible collaboration in Iraq with SCS or UNSCOM, Kathy Egan, Ericsson spokesperson, said she had no information on such an operation, but if there was one, "It would be classified and we would not be able to talk about it." It's also possible, according to Mike Frost, that cleverly disguised bugs might have been planted in Baghdad SCS, he recalls, managed to listen in on secured facilities by bugging pigeons. But, says a retired CIA veteran, with UNSCOM effectively dead, bugging is now out of the question. "I hope the take from this op," he says, "was worth losing the only access the outside world's disarmament experts had to Iraq." ------------------------------------------------------------------------ The Radome Archipelago During the Cold War there were hundreds of secret remote listening posts spread around the globe. From large stations in the moors of Scotland and mountains of Turkey that were complete with golf balllike structures called "radomes" to singly operated stations in the barren wilderness of Saint Lawrence Island between Alaska and Siberia that had only a few antennae, these stations constituted the ground-based portion of the United States Signals Intelligence (SIGINT) System or "USSS." Operated by the supersecret National Security Agency (NSA), these stations were designed to intercept Morse Code, telephone, telex, radar, telemetry, and other signals emanating from behind the Iron Curtain. At one time, the NSA contemplated a worldwide, continuously operated array of 4120 intercept stations. While the agency never achieved that goal, it could still boast of several hundred intercept stations. These included its ground-based "outstations," which were supplemented by other intercept units located on ships, submarines, aircraft (from U-2s to helicopters), unmanned drones, mobile vans, aerostats (balloons and dirigibles), and even large and cumbersome backpacks. With the collapse of the Communist "bloc" and the advent of microwaves, fiber optics, and cellular phones, NSA's need for numerous ground-based intercept stations waned. It began to rely on a constellation of sophisticated SIGINT satellites with code names like Vortex, Magnum, Jumpseat, and Trumpet to sweep up the world's satellite, microwave, cellular, and high-frequency communications and signals. Numerous outstations met with one of three fates: they were shut down completely, remoted to larger facilities called Regional SIGINT Operations Centers or "RSOCs," or were turned over to host nation SIGINT agencies to be operated jointly with NSA. However, NSA's jump to relying primarily on satellites proved premature. In 1993, Somali clan leader Mohammed Farah Aideed taught the agency an important lesson. Aideed's reliance on older and lower-powered walkie-talkies and radio transmitters made his communications virtually silent to the orbiting SIGINT "birds" of the NSA. Therefore, NSA technicians came to realize there was still a need to get in close in some situations to pick up signals of interest. In NSA's jargon this is called improving "hearability." As NSA outstations were closed or remoted, new and relatively smaller intercept facilities such as the "gateway" facility in Bahrain, reportedly used for retransmit signals intercepted in Baghdad last year to the U.S. sprang up around the world. In addition to providing NSA operators with fresh and exotic duty stations, the new stations reflected an enhanced mission for NSA economic intelligence gathering. Scrapping its old Cold War A and B Group SIGINT organization, NSA expanded the functions of its W Group to include SIGINT operations against a multitude of targets. Another unit, M Group, would handle intercepts from new technologies like the Internet. Many people who follow the exploits of SIGINT and NSA are eager to peruse lists of secret listening posts operated by the agency and its partners around the world. While a master list probably exists somewhere in the impenetrable lair that is the NSA's Fort Meade, Maryland, headquarters, it is assuredly stamped with one of the highest security classifications in the U.S. intelligence community. W.M. & J.V. ------------------------------------------------------------------------ The United States SIGINT System (USSS) The following list is the best unclassified shot at describing the locations of the ground-based "ears" of the Puzzle Palace. It is culled from press accounts, informed experts, and books written about the NSA and its intelligence partners. It does not include the numerous listening units on naval vessels and aircraft nor those operating from U.S. and foreign embassies, consulates, and other diplomatic missions. United States NSA Headquarters, Fort Meade, Maryland Buckley Air National Guard Ground Base, Colorado Fort Gordon, Georgia (RSOC) Imperial Beach, California Kunia, Hawaii (RSOC) Northwest, Virginia Sabana Seca, Puerto Rico San Antonio, Texas (RSOC) Shemya, Alaska -3 Sugar Grove, West Virginia Winter Harbor, Maine Yakima, Washington Albania Durrës -6 Shkodër -6 Tirana -6 Ascension Island Two Boats -1 Australia Bamaga -6 -7 Cabarlah -7 Canberra (Defense Signals Directorate Headquarters) -5 Harman -7 Kojarena, Geraldton -1 Nurunggar -1 Pearce -1 Pine Gap, Alice Springs -1 Riverina -7 Shoal Bay, Darwin -1 Watsonia -1 Austria Konigswarte -7 Neulengbach -7 Bahrain Al-Muharraq Airport -3 Bosnia and Herzegovina Tuzla Botswana Mapharangwane Air Base British Indian Ocean Territory Diego Garcia -1 Brunei Bandar Seri Begawan -7 Canada Alert -7 Gander -7 Leitrim -1 Masset -6 -7 Ottawa [Communications Security Establishment (CSE) Headquarters] -5 China Korla -1 -6 Qitai -1 -6 Croatia Brac Island, Croatia -6 Zagreb-Lucko Airport -7 Cuba Guantanamo Bay Cyprus Ayios Nikolaos -1 Denmark Aflandshage -7 Almindingen, Bornholm -7 Dueodde, Bornholm -7 Gedser -7 Hjørring -7 Løgumkløster -7 Eritrea Dahlak Island -1 (NSA/Israel "8200" site) Estonia Tallinn -7 Ethiopia Addis Ababa -1 Finland Santahamina -7 French Guiana Kourou -7 (German Federal Intelligence Service station) Germany Achern -7 Ahrweiler -7 Bad Aibling -2 Bad Münstereifel -7 Braunschweig -7 Darmstadt -7 Frankfurt -7 Hof -7 Husum -7 Mainz -7 Monschau -7 Pullach (German Federal Intelligence Service Headquarters) -5 Rheinhausen -7 Stockdorf -7 Strassburg -7 Vogelweh, Germany Gibraltar Gibraltar -7 Greece Iráklion, Crete Guam Finegayan Hong Kong British Consulate, Victoria ("The Alamo") -7 Iceland Keflavik -3 India Charbatia -7 Israel Herzliyya (Unit 8200 Headquarters) -5 Mitzpah Ramon -7 Mount Hermon, Golan Heights -7 Mount Meiron, Golan Heights -7 Italy San Vito -6 Sorico Japan Futenma, Okinawa Hanza, Okinawa Higashi Chitose -7 Higashi Nemuro -7 Kofunato -7 Miho -7 Misawa Nemuro -7 Ohi -7 Rebunto -7 Shiraho -7 Tachiarai -7 Wakkanai Korea (South) Kanghwa-do Island -7 Osan -1 Pyong-dong Island -7 P'yongt'aek -1 Taegu -1 -2 -6 Tongduchon -1 Uijongbu -1 Yongsan -1 Kuwait Kuwait Latvia Ventspils -7 Lithuania Vilnius -7 Netherlands Amsterdam (Technical Intelligence Analysis Center (TIVC) Headquarters)-5 Emnes -7 Terschelling -7 New Zealand Tangimoana -7 Waihopai -1 Wellington (Government Communications Security Bureau Headquarters -5 Norway Borhaug -7 Fauske/Vetan -7 Jessheim -7 Kirkenes -1 Randaberg -7 Skage/Namdalen -7 Vadsø -7 Vardø -7 Viksjofellet -7 Oman Abut -1 Goat Island, Musandam Peninsula -3 Khasab, Musandam Peninsula -3 Masirah Island -3 Pakistan Parachinar Panama Galeta Island -3 Papua New Guinea Port Moresby -7 Portugal Terceira Island, Azores Rwanda Kigali São Tomé and Príncipe Pinheiro Saudi Arabia Araz -7 Khafji -7 Singapore Kranji -7 Spain Pico de las Nieves, Grand Canary Island -7 Manzanares -7 Playa de Pals -3 Rota Solomon Islands Honiara -7 Sri Lanka Iranawilla Sweden Karlskrona -7 Lovön (Swedish FRA Headquarters) -7 Muskö -7 Switzerland Merishausen -7 Rüthi -7 Taiwan: Quemoy -7 Matsu -7 Shu Lin Kuo -5 (German Federal Intelligence Service/NSA/Taiwan J-3 SIGINT service site) Turkey Adana Agri -7 Antalya -7 Diyarbakir Edirne -7 Istanbul -7 Izmir -7 Kars Sinop -7 Thailand Aranyaprathet -7 Khon Kaen -1 -3 Surin -7 Trat -7 Uganda Kabale Galangala Island, Ssese Islands (Lake Victoria) United Arab Emirates Az-Zarqa¯ -3 Dalma¯ -3 Ras al-Khaimah -3 Sir Abu Nuayr Island -3 United Kingdom: Belfast (Victoria Square) -7 Brora, Scotland -7 Cheltenham (Government Communications Headquarters) -5 Chicksands -7 Culm Head -7 Digby -7 Hawklaw, Scotland -7 Irton Moor -7 Menwith Hill, Harrogate -1 (RSOC) Molesworth -1 Morwenstow -1 Westminster, London -7 (Palmer Street) Yemen Socotra Island (planned) KEY: -1 Joint facility operated with a SIGINT partner. -2 Joint facility partially operated with a SIGINT partner. -3 Contractor-operated facility. -4 Remoted facility. -5 NSA liaison is present. -6 Joint NSA-CIA site. -7 Foreign-operated "accommodation site" that provides occasional SIGINT product to the USSS. Tell us what you think. firstname.lastname@example.org