D Thoelke Buchw713od0e1

7/24/2019 D Thoelke Buchw713od0e1

1/58

Principles ofRadio Intelligence

Solutions for modern COMINT systemson the basis of TRS


2/58

Company Confidential Principles of Radio Intelligence

Page 2/58 MEDAV GmbH 2013Specification subject to change w713od.0e1

MEDAV GmbH

Grfenberger Strae 32-34

91080 Uttenreuth

Germany+49 9131 583-0

+49 9131 583-11

[email protected]

www.medav.de

DocumentPrinciples of Radio Intelligence

w713od.0e1 - Version V1.2, 17 July 2013

AuthorVolkhard Thoelke

CopyrightThis document is protected by copyright laws.

TrademarksFor better legibility, in this document marking of trademarks is waived. This should not mislead to

the assumption that these trademarks are to be used freely by anybody.

Contact for Errors or ComplaintsWhen editing this document, greatest importance was attached to completeness and correctness.

Even so, if you find an error or incompleteness, please contact

MEDAV GmbH,+49 9131 583-0,[email protected]

The document is subject to change without prior announcement.


3/58


4/58



List of diagrams

Figure 1: Radio intelligencean important source of intelligence .......................................................... 7

Figure 2: Overview of radio intelligence ................................................................................................ 16

Figure 3: Overview of IG ........................................................................................................................ 18

Figure 4: IG - searching ......................................................................................................................... 22

Figure 5. IG - Acquisition/Processing ................................................................................................... 27

Figure 6: An overview of IP .................................................................................................................. 32

Figure 7: IPpre-processing ................................................................................................................ 33

Figure 8: IP preliminary analysis ........................................................................................................... 36

Figure 9: Analysis and reporting ............................................................................................................ 38

Figure 10: Military COMINT / radio intelligence ..................................................................................... 41


5/58

Principles of Radio Intelligence Company Confidential

w713od.0e1 MEDAV GmbH 2013Specification subject to change Page 5/58

1. Intelligenceits contribution to national security

The global political changes in the wake of the dissolution of the Warsaw Pact and the end of the

East-West conflict did not, as hoped, result in greater peace and security the world over. On the

contrary, they have been followed by the development of numerous regional conflict zones withethnic crises and wars.

There has also been a sharp increase in numerous other activities and disputes in many areas of

the world that could jeopardise the security of the international community. As a result, national

security interests are now no longer exclusively concerned with the military threat to their own

countries, and instead the main priorities of national security authorities are now the activities of

terrorist organisations, paramilitary forces, criminal structures in the fields of drugs and human

trafficking and operations involving weapons proliferation, money laundering and white-collar

crime.

This development has led to a reassessment of the security situation in numerous countries and to

a subsequent re-alignment of national security policies with far-reaching consequences for military

organisations, police and security services.

Intelligence obtained on the forces, structures and activities listed above has always played a

decisive roll in the evaluation and improvement of national security situations. Intelligence for the

purposes of defence is intended to help identify the enemys capabilities (potential), objectives,

plans and preparations as early and reliably as possible to enable suitable pre-emptive action or

countermeasures to be initiated in good time. Where this is not possible, the intelligence should at

least monitor the day-to-day activities of the enemy and provide precise situation reports. These

reports can be used as the basis for the implementation of appropriate emergency action and

countermeasures.

All the malevolent forces and organisations mentioned above rely heavily on technology for open

and conspiratorial communications for the command and control and coordination of their

operations. These command and control links are used to plan, prepare and perform actions that

jeopardise our security. Since these forces and organisations are usually active on a supra-

regional level, the necessary command and control links are also established on a supra-regional,

and often even global, level.

This is precisely the starting point with regard to the use of technology to gather intelligence on the

communications channels used. As military forces and the other types of forces mentioned above

all require a high degree of mobility for their operations, their command and control links, i.e. their

communication links, have also been adapted to meet these requirements.


6/58



Mobile communications are only possible using radio technology. This covers a wide spectrum of

radio services and frequency ranges, from HF radio to satellite radio, and more recently, following

the introduction of wireless data transmission systems, even the use of LAN technology (WLAN).

All of these should be the targets of intelligence gathering.

Radio intelligence, which is generally of a passive nature, and hence cannot be detected by theenemy, can be used to identify the enemys command and control links, and in many cases,

penetrate these links as unauthorised users. However, the usage habits and rules vary greatly

according to the type radio service or the (user) organisation. Consequently, the methods and

equipment used to detect command and control links and gather intelligence relevant to the

mission also vary greatly. The requirements in terms of reconnaissance technology and

reconnaissance personnel are correspondingly high.

The following chapters endeavour to provide a comprehensive overview of radio intelligence (RI)

and to describe the tasks, methods and diverse functional areas in a process-based and general

manner. It is not be possible to go into detail with regard to the numerous methods and strategies

for the acquisition and evaluation of the wide variety of possible communications/signals relevant

to the mission in radio intelligence. This goes beyond the scope of this work and would also violate

the provisions of national security.

Chapter 2.5 deals exclusively with military radio intelligence and its special features plus the

aspects it has in common with the radio intelligence employed in other national

organisations/services.


7/58



1.1. Tasks of radio intelligence

Intelligence generally exploits a wide variety of potential sources. These range from human

sources (HUMINT) right up to airborne or satellite photographic and radar intelligence (IMINT,

SATINT, etc). Within this broad spectrum encompassing the most diverse range of tasks, radio

intelligence represents one important cornerstone of communications intelligence (COMINT).

Figure 1: Radio intel l igence an impo r tant source of inte l l igence

The task of radio intelligence services is to use the medium of radio to find and obtain intelligence

from the command and control links of the targets in question these could be military or

paramilitary organisations as well as terrorist or criminal forces within the focus area of the security

services. Intelligence on these organisations aims at providing timely information on the command

and control and organisational structures and interrelationships and, if possible, their objectives,

plans and current activities.

One of the objectives of radio intelligence is to make important contributions to the assessment of

ones own threat and security situation and, by means of early identification, provide time for pre -

emptive action or suitable countermeasures in the sense of timely interventions. In this way, if

employed successfully at the correct time, radio intelligence can also make a contribution to

conflict and crisis management.


8/58



1.2. Potential capabilities and limits of radio intelligence

As mentioned, radio intelligence obtains information on the enemy from the enemys radio

communications. Therefore, a basic precondition for this type of intelligence is to findand acquire

the radio communications. In addition to reception, the acquisition task also includes rendering the

signal useful for analysis, to obtain information on the enemy within the remit of the

reconnaissance mission.

This basic task is dependent upon numerous factors:

physical parameters, such as frequency, distance to the emitter, time of day/year

(especially in the HF range), reception level, quality of the radio channel, etc.

operational or technical factors, such as transmitter emission direction, transmit level,

type of radio service, transmission mode, encryption etc.

strategic factors, such as the potential own resources, means of camouflage and hence

possible proximity to the enemy, duration of the acquisition mission, manned or unmanned

use of the reconnaissance technology, etc.

The results of the acquisition and the information directly produced from this are consequently very

different. Frequently, the only intelligence obtained is on the operational parameters of the radio

communications. This is generally the case with encrypted traffic. Nevertheless, when interpreted

correctly, operational findings can also provide information on the strategic background that gave

rise to the radio communications. Such findings are also important for supplementing or updating

ones own target knowledge. This target knowledge is in turn a basic precondition for successful

radio intelligence as it provides decisive (advance) knowledge and hence assists in the detection,

classification, processing and analysis of the radio traffic relevant to the mission.

In conjunction with the target knowledge and supplementary information from other sources,

experienced analysts can often use operational parameters of radio communications to deduce

details of enemy structures, objectives, activities and potential capabilities. This underlines the fact

that, although radio intelligence is important, it is still only one source of intelligence. Only thepooling and joint/ combined analysis of all relevant information from all available sources can

provide a comprehensive and sufficiently reliable picture of the situation.

Here, we should mention an important principle of reconnaissance:

The information and findings obtained from intelligence on objectives, plans, preparation and

performance of activities that pose a threat to security and on the enemys potential capabilities are

exclusively the result of ones own analyses and evaluat ions.There always remains an

unquantifiable uncertainty factor that necessitates the continuous checking and updating of the

results of the reconnaissance.


9/58



2. Radio intelligence in detail

2.1. Terms of reference

The basic mission of radio intelligence is to identify from the numerous emissions in the entire

spectrum of possible frequency ranges those radio communications that are important for ones

own reconnaissance and to acquire, process and analyse them with the aim of obtaining the

required information and knowledge about the enemy from this traffic. Particular importance is

attached to the chains of command, that are the enemys command and control links, since these

generally provide important knowledge on the enemys activities and plans and hence can make

an important contribution to ones assessment of the situation.

These terms of reference are not only applicable to intelligence on military organisations/units.

They are equally applicable to intelligence on terrorist or criminal organisations, the only difference

being that the command and control and communication behaviour in these areas is clearly

different from that used by the military and hence sometimes other approaches to acquisition and

analysis are necessary.

However, the basis objective of all radio intelligence is the same in all operations. Its mission is to

gain intelligence from the radio communications of the target groups in question in terms of:

their locat ion (groups or individual) or place of deploym ent (troops)

their st rength, their capabi l i t ies/ their potent ia l

their object ives and conc rete plans

their preparat ions and on

the implementat ion of all act ions or measures affecting nat ional secur i ty and the

secur i ty of n at ional forces.

One of the main tasks in connection with the above targets is the early detection (early

identification) of enemy plans and preparations. If this is successful, there will be time and

opportunity to take appropriate pre-emptive action. This is an important precondition for crisis

management.

In the military field, radio intelligence is also understood as an early warning systemwith a focus

on tactical events on the battlefield to provide the military commander with important information on

the tactical situation and hence on the threat situation (see also chapter 2.5).


10/58



2.2. Basic requirements

Two factors determine the efficiency of ones own radio intelligence:

a suitable, high-performance technical infrastructure

experienced and well trained personnel

Technical infrastructure:

Since, from both a technical and a strategic point of view, radio intelligence has to cover a broad

spectrum of tasks, the technology and infrastructure required may vary greatly for different terms of

reference. This means that the preparation of a radio intelligence system for a successful operation

is heavily dependent upon the mission in question and the associated strategic framework. This in

turn places high requirements on the development and design of modern radio intelligence

systems, and in particular on the flexibility that enables them to be adapted simply, rapidly andinexpensively to the changing tasks and requirements.

Chapter 3 describes in detail the innovative way in which MEDAV has dealt with this requirement in

its system solutions.

The following is a list of the basic capability requirements for modern radio intelligence systems:

High per formance recept ion technolog y,

able to detect signals relevant to the mission, even in radio intelligence locations that are

frequently unfavourable for reception technology, and to acquire them in a quality sufficient

for subsequent signal processing. Important influential factors here are antenna gain and

the dynamic response of the receivers.

High prob abi l ity of acquis i t ion

Frequently, radio intelligence gatherers have little or no knowledge of the times at which the

enemy will be active or which radio system, operating mode and frequency will be used.

When searching over large frequency ranges with numerous emissions, only high-capacity,

automatic wideband receivers are able to identify the majority of communications relevant

to the mission at any time, classify them as such and make them accessible to a

processing component.

Direct ion- f inding or locat ion- f inding abi li ty :

Generally, the large number of emissions detected means that wideband detection systems

rapidly reach the limit of their capabilities when classifying emissions with the aim of

selecting only those relevant to the mission, unless effective selection or exclusion criteria

(filters) are used at an early stage in the processing chain to reduce the number ofemissions sent for further processing.


11/58



In the majority of missions, particularly in strategic radio intelligence, specific information is

already available on the known or suspected locations (for target persons/target groups) or

the target areas (for military forces) thanks to prior findings (target knowledge). The

determination of the direction from which a detected emission is received is therefore a very

effective selection criterion at the start of the signal processing chain. This filter is even

more reliable and effective but also much more complex if it is possible to identify the

location of the majority of the signals (see Chapter 2.4.1.5 for further details).

Direction-finding/bearing and location-finding are also important tools for identifying the

emitters detected, that is in the assignment of the transmitters as belonging to the targeted,

i.e. sought users.

High-capaci ty comp uter and storage technology :

Due to the large number of signals and complex processing tasks, the operation of

wideband detection systems has to be automated to a large extent. Automation and the

high number of signals to be classified and processed require a high level of computing

power with a flexible load distribution to enable the system to respond appropriately to the

frequently changing load situations.

Wideband HF detection technology necessitates the intermediate storage of the frequency

interval/range to be processed (time signal). This requirement is met by means of a ring

memory with a high memory depth. The wideband radio intelligence systems from MEDAV

have, as standard, an intermediate storage capacity of several hours.

This dimensioning enables the entire frequency range specified for the mission to be

processed without signal losses. Intermediate storage means that signals classified as low

priority can be processed later and those with an inadequate classification or processing

result can be processed several times (possibly with the assistance of an experienced

operator and suitable analytical tools), until a satisfactory result is obtained.

However, searching for and processing signals in higher frequency ranges (>30 MHz)

requires other technical approaches and strategies, as the frequency range sought isgenerally too extensive for intermediate storage techniques alone(see also Chapter

2.4.1.2).


12/58



Sui table classi f icat ion and pro cessing p rocedures:

Modern communications technology is making increasing use of complex digital

transmission modes that guarantee high transmission integrity and quality. With their

numerous protocol layers, low channel-adapted transmit levels, high-capacity encryption

procedures and variable usage of the selected frequency band, these modern transmissionmodes place high requirements on the capabilities of the radio intelligence systems

required to detect and classify these signals, and if applicable group them together correctly

and process them like an authorised receiver.

MEDAV specialises in the development of systems that enable unauthorised participants

(gatherers) to acquire and process communications of this type.

Modular i ty and standardisat ion:

The frequently changing demands on radio intelligence systems and constantly and rapidly

changing technology require the hardware and software to be highly flexible and adaptable.

It has to be possible to upgrade and retrofit systems quickly without any serious problems

at a justifiable expense for different missions and to upgrade them in line with technological

advances.

This is ensured through the use of commercially available standard computer technology, a

high degree of hardware and software modularisation and through the use of standard

software modules and software interfaces (e.g. CORBA).

High-capaci ty comm unicat ions means:

The number and locations of the sensors (antennas and detection systems) should be

selected in accordance with the special features of the targeted radio services frequency

ranges used, range and directional characteristics of the emissions, physical distribution of

the emitters in question etc. and the basic operating parameters. Regardless of whether

they are manned or unmanned, suitable, high-capacity communications means should be

provided for the command and control of these sensors and the transmission of all the

results obtained to the responsible organisational unit for further processing and analysis.


13/58



Suitable analyt ical tools :

Radio intelligence and other sources generally provide very different types of raw material

to be sent for analysis. The increasing use of encryption in modern radio services usually

makes it impossible to identify the content of these radio communications.

Nevertheless, if equipped with suitable (software) tools and methods, an experienced

analyst can obtain a large amount of mission-relevant information on the enemy from

intelligence on the technical details of the radio communications. To do this, analysts must

be in possession of suitable and up-to-date target knowledge and analytical procedures

specific for the task in question. Such capabilities can automatically select the

raw/operational data collected, correlate them with corresponding data from the target

knowledge and supply the analysts with the intermediate results and indications required for

their analyses and situation reports. In special cases, automatic processing can also supply

important triggers for urgent reports/warnings.

In many cases, analysts are even able to determine the content of the radio

communications in the mission. Once again, suitable tools can assist and take the strain off

analysts in their routine tasks thematic screening of the material, translation, provision of

suitable target knowledge and information from other sources, report generation, etc.

Details of information processing (analysis) are given in Chapter 2.4.2.

Personnel:

The second important basic requirement for successful and efficient radio intelligence is the

training and provision of sufficient personnel able to meet the high standards relating to diverse

specialist qualifications and with the necessary experience for the tasks assigned to them.

Modern radio intelligence gatherers are required to satisfy the following requirements profile:

As far as the collection (acquisition) and processing of intelligence is concerned, it is only

possible to gain the required detailed knowledge of the communications behaviour of the

specific target group after many years of experience. Information/knowledge of this kind is

a decisive precondition for effective mission control and the reliable interpretation or

analysis of the results of the acquisition.

The rapid technological changes in radio intelligence technology have resulted in a

significant change in the specialist technical requirements profile for the personnel

responsible for acquisition and analysis. It is now much more demanding and much more

complex. While previously their tasks and capabilities focused on the professional handling

of a series of manually operated search and drop receivers, reliable classification of a

signal using the gatherers eyes, ears and analysis experience etc, nowadays personnel

must also have a high degree of IT know-how and skills.


14/58



In addition to their traditional functions, the operators of modern radio intelligence systems

will in future also have to configure and, to a limited degree, manage extremely complex,

networked computer technology and software structures for an extremely wide range of

operational scenarios.

The operators, in particular the gatherers, have to understand the extensively automatedoperational sequences in the system (workflow) and be able to interpret the results of the

individual functions correctly and, if necessary, correct them.

The main workhorse used by gatherers and analysts today is the PC, which is used to

control numerous virtual devices, tools and functional sequences.

Gatherers are now primarily concerned with the monitoring and control of the extensively

automated search and acquisition/processing systems. The actual tasks involved in the

gathering of intelligence detection, segmentation, classification and processing of the

signals are performed automatically by the system. However, gatherers/operators must

also be able to investigate on site all signals/transmission modes that the automatic radio

intelligence system is unable to classify and/or process (demodulate and decode) with the

analytical tools available. The aim of this important and demanding task is to determine the

parameters required for automatic further processing and transfer them to the system. If

this is not possible, the signals are recorded with the analytical results achieved and

submitted to an extensive external investigation in a central analytical unit (see also

Chapter 2.4.1.3).


15/58



2.3. Structure

The basic task of radio intelligence the detection, acquisition and processing of communications

relevant to the mission in all the radio services and frequency ranges used by the enemy also

defines its structure.

Although it is true that the different services and frequency bands determine the procedure,

technology and tools required for the reconnaissance mission in question, the functional

sequences, that is the structure,of radio intelligence are in principle the same.

Figure 2 (page 16) provides a rough overview of this structure and shows the interrelationships and

interdependencies of the main functional areas.

The following is a short introduction to these areas. A more detailed description may be found in

subsequent chapters:

The missiondescribes the intelligence interest of ones own command and control with its

specific objectives and points of emphasis.

From this, mission control derives the individual measures/missions required to carry out

the mission and forwards them to the organisational units responsible Intelligence

Gathering (IG), Intelligence Processing (IP) and the central reporting department assigned

to mission control.

Mission control monitors performance of the mission and results and, if necessary for the

task in question, assigns supplementary missions to the above-listed organisational units.

Intelligence Gathering is the sensor area of radio intelligence. With the aid of suitable

acquisition and direction-finding technology adapted to the reconnaissance mission in

question, and taking into account the different operational procedures adapted for the

particular terms of reference, IG searches for radio communications relevant to the mission.

If possible IG determines their bearings (or at least provides a rough assessment of the

direction by means of a directional receive antenna) and classifies and acquires the radio

communications (including demodulation and decoding if required). The results are

forwarded/reported in a form suitable for computer processing and analysis. Technical

analysis (TA) is an important special task for Intelligence Gathering. Signals that are

potentially important for the mission, which the acquisition system is unable to classify or

process, are investigated using suitable analytical tools. The object of on site signal

analysis is to identify the reasons for these system malfunctions as soon as possible after

their occurrence and facilitate the processing of signals of this kind by making suitable

modifications to the configuration of the system modules affected. If these attempts are

unsuccessful, the signals are stored and analysed in greater detail in a central analytical

unit by signals specialists with more powerful tools


16/58



Figure 2: Overview of radio intel l igence

Intelligence Processing with its analysis of the raw reports provided by the intelligence

gathering service and other accessible sources is the analytical area of COMINT/radio

intelligence. Usually, this unit also processes reports from the other COMINT units and

analyses them jointly.

The raw/acquired reports prepared by Intelligence Gathering could contain information on

the signalling techniques and/or operational parameters and/or the content of the radio

communications acquired. However, even without any knowledge of the contents of theradio messages, it is also often possible to obtain important information on the enemy in

question from the operational sequences and relationships with the aid of suitable target

knowledge. In certain cases, special features of the signalling techniques used in the radio

communications can provide important information on the activity of the intelligence targets.


17/58



Ideally, these results are supplemented by detailed knowledge of the enemys plans and

activities if the radio intelligence has been able to obtain direct access to the content of the

transmitted messages (clear text, content of conversations) or if similar results have been

obtained from other sources.

The results of intelligence processing are:

reports with the information obtained on the targeted enemy (individual reports,

group reports, daily reports, etc.)

contributions to situation reports

if required, also contributions to analyses or forecasts of the enemys capabilities

and plans

The messages and reports are usually composed and structured (formatted) in a form

suitable for further processing by computer.

All messages and reports are notified or forwarded to the central reporting section.

The precondition for reliable and efficient analysis is the availability of up-to-date, verified

and comprehensive target knowledge. This must provide as complete and up-to-date a

picture as possible of the targeted enemy with radio intelligence focusing on the enemys

communication behaviour.


18/58



2.4. Tasks/functions

2.4.1. Intelligence Gathering

Intelligence Gathering incorporates the following functional units:

Acquisition control

Search

Processing with compilation of the acquisition/raw reports

Technical analysis,

These are described in more detail below (see also Figure 3).

Figure 3: Overview o f IG


19/58



2.4.1.1. Acquisition Control

The reconnaissance mission usually comprises a basic mission derived from the long-term national

security policy and numerous individual missions with specifically targeted subjects or time slots,

determined by current events and developments affecting national interests and ones security

situation. Acquisition Control is then responsible, taking into account the specified priorities, for

defining the (acquisition) missions for the suitable acquisition systems or workstations in

Intelligence Gathering.

Missions of this type are usually valid for one shift of duty or one day, but they may extend for

longer periods. Acquisition Control provides all available and necessary documents for the

performance of the acquisition missions.

These documents are mission-related extracts from the target knowledge and supplementary

databases maintained by IG. They contain all previous communications-related knowledge on the

intelligence target and further helpful data for the configuration of the acquisition systems and the

evaluation of the results of the acquisition.

Acquisition Control is also tasked with monitoring the mission performance and, if required,

correcting or following up the work of individual functional units. To perform this task it has, in

principle, direct (control) access to all important functional units or workstations involved in

searching and processing.

2.4.1.2. Search

Searching for radio communications relevant to the mission is one of the most important and

demanding tasks of radio intelligence. The productive radio communications relative to the

reconnaissance mission can only provide the required information if they are detected, classified

and processed by the system. Therefore, success and effectiveness are primarily measured

against the probability of acquisition of signals/communications relevant to the mission.

With the large number of active emitters and frequencies/channels, the chance of the radio

communications being found and acquired in time (in particular modern digital transmission

modes, which have to be acquired from the start of the transmission, including the preamble with

the synchronisation or the protocol chat)is primarily dependent upon:

prior knowledge and

the technical capabilities of the search systems/components


20/58



Prior knowledgeincludes all information on the communications facilities of the selected targets

and their communications habits, such as the main frequencies and modes used, the structures of

the communications relationships and radio networks, their preferred transmission times, call

names/call signs, etc.

Information of this kind is part of the target knowledge and is used for the (pre-) configuration of thesearch systems in a way most likely to achieve success.

Ones own technical capabilitiesare dependent upon:

the degree of automation of the search system. A high degree of automation permits

continuous operation and a sufficient acquisition/classification capacity.

the wideband capability of the (automatic) search systems. Preferably, they should be able

to cover all the frequency ranges used by the targeted radio services. However, by using

suitable scanning modes, comparable results can be obtained with automated search

systems with bandwidths covering only part of the spectrum to be monitored.

the ability of the (automatic) search systems to efficiently reduce the amount of work/data

required for searching and classification. The exclusion at an early stage of detected

signals from further processing by taking into account/correlating the directional information

(obtained by means of directionally selective receive antennas or direction-finding) and

location-finding results (ideal case) or features of signals that are already available as the

result of the detection with the corresponding data/specifications available from the

prior/target knowledge, drastically reduces the number of signals that have to be subjected

to a time-consuming computer classification process in the automated search systems (for

details see Chapter 2.4.1.5).

the ability of the (automated) search systems to classify all signals/modes relevant to the

mission even in the event of a high signal volume.

the capabilities and capacities of the automated search systems to temporarily store the

frequency ranges (time signal) to be processed. In each case this must be done completely

and for a sufficient length of time for the required signal processing (detection,

classification) and for the processing to be applied to the search results (demodulation, if

necessary, decoding). In some circumstances also for any post-processing of the signals

that may be required.

In strategic HF intelligence, it is possible to intermediately store the entire band with a

storage depth of several hours. MEDAV offers according systems.


21/58



In higher frequency ranges (VHF, UHF and above), it is generally no longer possible to

store the entire spectrum to be covered. Here, suitable strategies have to be employed to

enable continuous classification and parallel processing of the greatest possible number of

signals relevant to the mission.

Radio services in the VHF/UHF range and above usually make use of wide areas of thefrequency spectrum. Unlike the HF band, at present it is not possible to completely digitise

and store the frequency ranges used by these services. In this case, it is the receiver

resources and procedure used during the search that determine the chances of detecting

and being able to classify as many radio communications relevant to the mission as

possible. The following approach is one example from the large number of possible search

and acquisition strategies of how, despite the large number of frequency ranges to be

covered, it is still possible to guarantee a high probability of acquisition.

Rapidly scanning wideband receivers search the assigned frequency ranges with a high

speed and detect, measure and segment all detectable signals. If the bandwidth and (if

appropriate) result of segmentation features correspond to the search profile, downstream

wideband receivers record them for a sufficient amount of time for classification. Due to the

limited (propagation) ranges of the radio signals at the location of the reconnaissance

receivers, the signal scenario is generally very clear in these frequency ranges. The

majority of the signals detected may therefore be put into intermediate storage by the

slower downstream wideband receivers in the length required for classification,

notwithstanding the time required for the recording. All signals classified as relevant to the

mission can be sent for processing usually processing chains with traditional drop

receivers.

In the tactical area of military radio intelligence (COMMS ESM), the result of the

classification in conjunction with the directional information frequently triggers a warning

message to the responsible (affected) military commander (see also Chapter 2.5).

The functional process is on principle as follows (see also Figure 4).


22/58



Figure 4: IG - searchin g

The automated search system receives its search missions with the documents required

for performance.

The automated system detects all emissions in the targeted frequency ranges above

specified threshold levels.

The subsequent spectral signal measurement provides the centre frequencies,

bandwidths and the signal/receive levels.

It is practical to perform the segmentationat this point i.e. the identification of grouped

spectral ranges in the time and frequency domain.

Taking into account the available directional information/direction-finding results (or even

better the locating results), if the search missions contain suitable directional or location

specifications, it is possible to exclude all signals that do not conform to this mission profile

from further processing at an early stage. However, intermediate storage or suitable search

systems/strategies facilitate the classification of all detected signals even without this

direction filter. However, this significantly increases the required computing power and

classification time. It may be assumed that if there is no direction selection, the number of

incorrectly classified signals will rise and this in turn will increase the time required for

checking and post-processing.


23/58



If the signal parameters and features are available from detection and segmentation, all

signals that do not conform to the parameter/feature profile specified in the search

mission can also be excluded from the further processing in a further reduction step.

This option is also available during the further classification process.

All detections conforming to the mission profile are sent for signal classification

(determination of the type of modulation or the transmission mode). The initial findings and

indications have already been provided by detection and segmentation.

However, traditional interactive analytical procedures are not suitable for automatic

classification processes. A much more promising method is a mode forecastderived from

the available prior knowledge (in 70% of all previous cases, the enemy always used mode

xyz) and from the parameters/features obtained during detection and segmentation.

These forecasts are used as the basis for switching suitable demodulators to the signals in

question in the expectation that one of them will provide a positive result.

In the military field, this procedure makes use of tactical radio intelligence (COMMS ESM).

As a rule, only signals with specific (known) signal features are sought and processed.

If a suitable demodulator is found, the signal is generally demodulated in order to perform

automatic mode classification on the basis of the symbol stream. This uses similar

strategies to those used for automatic signal classification.

If the transmission mode/type of modulation including the encoding procedure is uniquely

defined, the signal is transferred, together with the signal and mode parameters required for

the processing, via IG/Acquisition Control to Acquisition/Processing in a pre-specified

message format.

One constant and important task of the search (and hence also processing) is the provision of

information for supplementing and updating the target knowledge. To do so, it is necessary to

systematically survey (using reconnaissance technology) important target areas or target groups

for details of the communications structures and communication behaviour, the type of

communications facilities (supplementary) used and whether any changes to the facilities,

structures and operational principles have been identified (updating). The information obtained is

reported to the analytical unit where it is incorporated in the target knowledge.

However, the search process may also be tasked with identifying possible new targets/target areas

(e.g. in the case of the development of new crisis regions or potential conflicts) in order to provide

suitable target knowledge for future reconnaissance missions. This saves preparation time and

increases the ability of ones radio intelligence forces to make a cold start in the event of possible

future missions to cover these targets.


24/58



In strategic radio intelligence (HF) at least, the wideband capability of the automated search

systems means that there is no longer any need for sophisticated search strategies, such as the

case for example when searching with a limited number of narrowband search receivers. The

frequency ranges to be monitored are virtually contiguous and may be searched for without

interruption by automatic systems. However, this places high requirements on the automatic

classification, signal processing and memory capacity to ensure that even high signal volumes can

be processed (i.e. classified) automatically, with sufficient reliability/quality (high hit rate and low

error rate) and reported with the required signal/procedural parameters for setting the parameters

of the processing components.

In tactical radio intelligence in higher frequency ranges (> 30 MHz) however, it is highly probable

that suitable search strategies will be required in order to be able to detect, classify and process

the highest possible proportion of signals relevant to the mission (see the information on page 24

and 25).

However, wideband search technology does not necessarily exclude the possibility of using

traditional, narrowband search receivers - it may be expedient to use them to supplement

wideband automated search systems:

in order to close frequency gaps with expected low signal volumes for which no wideband

resources are available

or to search for radio communications important to the mission from regions on the

boundaries of the reception technology (in individual cases, the receive level may be too

low for fault-free signal processing in a wideband automatic system, but not for an optimally

tuned narrowband receiver).

2.4.1.3. Technical Analysis

During searching, signals are frequently detected with techniques and operational parameters that

suggest that they may be extremely relevant to the mission, but which the classifier is unable to

identify, or identify sufficiently reliably, and hence cannot be processed. Signals of this kind are

forwarded with a corresponding analysis mission to Technical Analysis (TA) where they are

investigated and the reasons for the failed/faulty classification determined. The complete signals

are stored in their original form (time signal) for as long as required and can, after successful

analysis and suitable parameterisation in the processing system, be subsequently processed

without signal loss using the results of the analysis.

Technical analysis is an indispensable component of all COMINT systems and hence of all radio

intelligence systems. The integrated high-capacity measuring and analytical tools can be used

(interactively) by suitable personnel to investigate/analyse the aforementioned signals and also

unknown signals using the methods of signal and mode analysis. The task and objective of


25/58



technical analysis is, on the one hand, to determine the necessary signal and mode parameters for

fault-free processing in the case of (in principle) known signals. These results are used for follow-

up control and the assignment of new parameters for the processing components. On the other

hand, in the case of unknown signals, TA is used to precisely determine all the signal features

required for the development of suitable procedures to automatically classify and process these

radio communications.

In addition, experienced gatherers can use technical analytical tools to survey the signal scenarios

in frequency ranges that are potentially relevant to the mission and search for new/unknown

signals that appear to conform to the mission profile from the features identified (free searching at

the search and measuring station).

Another important task for TA personnelusually experienced and specially trained gatherersis

the comparative investigation and classification of individual signals/radio communications

processed by automatic systems, in particular in cases where there is cause to doubt the reliability

of the results. Such comparisons are used to check the automatic search and processing

components and to monitor their efficiency and reliability. Since, in strategic HF intelligence, all

signals are available for hours in the ring-memory; this checking can be performed without

problems and with no time pressure. In higher frequency ranges, it is necessary to record signal

samples of a sufficient length for purposes of analysis.

In the event of systematic deviations, analytical tools can be used to determine the reasons and to

reset the parameters and follow-up the system components in question as appropriate.

Recorded signals that cannot be analysed successfully with the measuring and analytical tools at

the TA workstation (search and measuring station) are forwarded to a central, better equipped and

more scientifically orientated analytical unit where they are investigated in more detail using more

specialised analytical tools/procedures.

The objective of this technical scientific analysis is to determine all the signal and mode features

required to develop suitable procedures to automatically search for and process these signals.

When using wideband technology for searching and processing, the recording and analytical toolsshould also have a wideband capability.


26/58



2.4.1.4. Acquisition/Processing

The task of Processing (from the point of view of signal and mode technology) is the correct

processing of all the signals/radio communications identified by the search classification process

as relevant to the mission. The objective of this processingusually demodulation and, if required,

decoding, in special cases the identification of additionally required signal and operational

parametersis to obtain all accessible information/contents significant for analysis/evaluation from

the intercepted radio communications.

In principle, Acquisition/Processing with its numerous (individual) reports only supplies a multitude

of tiny fragments of signal-specific information regarding the radio operations and/or contents. Only

the sum total of the individual reportssupplemented by additional information from other sources

enables the subsequent analysis/evaluation to derive a sufficiently precise and reliable picture of

the strategic relationships, backgrounds and sequences of the intercepted radio communications

from the extensive pieces of partial information.

Functional sequence: (see also Figure 5 on page 27)

The individual acquisition/processing tasks are derived directly from the search result

reports with the parameters derived from detection, segmentation and classification.

IG/Acquisition Control automatically generates the tasks for the numerous processing

channels and controls the allocation of resources. With each individual task, all the settings

required for correct parameterisation of the individual components in the processing chain

in question are provided.

Although acquisition/processing is largely automatic, operators/gatherers do have the

option of intervening in the automatic sequence via their workstation using an MMI tailor-

made for these tasks (suitable screen masks permitting all required checking and control

functions) for purposes of control or correction.

Depending upon the specifications of the mission management, the wideband (usually in

the HF range) or narrowband (exceptionally in the HF range with special signal/receive

ratios and usually in frequencies higher than HF) receiver resources are controlled with

the required processing components on the basis of the above-listed parameters/settings

and switched to the relevant signals. In special cases (known frequencies and transmission

modes; high priority for complete acquisition) wideband or narrowband processing

resources may also be permanently preconfigured to such radio

communications/frequencies (cast-ironmission).


27/58



Figure 5. IG - Acq uisi t ion /Proces sing

In HF intelligence one decisive advantage of wideband technology, even for processing, is

that all signals in the wideband time signal are stored for a suitably long time. This enables

the processing chains implemented in the wideband chain to be applied to the start of the

targeted signals regardless of the time required for the preliminary classification and

assignment, in each case without signal loss and with complete processing. Technology of

this type can be used to avoid the problematic and undesirable signal losses that occur with

modern digital transmission modes with their preambles, using traditional, narrowband

radio intelligence systems.

Due to the large amount of memory required, this procedure can only be carried out to a

limited extent (if at all) above the HF range.

With the processing task in question, System Control provides each processing channel

with the resources/system components required for complete processing.

With traditional, narrowband technology, an available drop receiver is generally locked

onto the targeted signal by means of an antenna matrix. The required demodulator is either

already integrated in the receiver or located downstream from the IF output. The other

components are used for the further processing of the demodulated signals and divided

according to the type of signal and mode into recording, audio, decoder, modem

components, etc. They are frequently hardwired as hardware components. In the case of

modern computer-based systems, the components are generally implemented as freely

switchable software modules.


28/58



Modern wideband HF search and processing systems such as those developed and

marketed by MEDAV no longer recognise the clear distinction between search and

processing components. The wideband tuner digitised signals are recorded continuously for

several hours in high-capacity ring memories and are available to all search procedures

(detection, segmentation and classification) and processing procedures (demodulation,

decoding) and, if required, signal analysis (technical analysis) without signal losses.

In the case of analogue (non-encoded) procedures (usually voice communications), the

symbol stream of the demodulated signals is sent directly for audio processing. In the

simplest case, this is a recording module that sends the content to a translator familiar with

the language in question with the required time delay. In addition to the voice/non-voice

identification, tried and tested modern language recognition facilities developed by MEDAV

can also identify the language being used. This facilitates the automatic assignment of

voice recordings to the correct translator in each case. Other high-capacity tools such as

topic spotting, word spotting and speaker identification are now available.

Digitally encoded signals/procedures are sent to suitable decoders in accordance with the

specifications for their classification - these may be closely coupled to the associated

demodulators especially with modern modes. The results (usually voice, data or ASCII text)

are now available for report preparation.

The provision of direction-finding/location-finding results on, if possible, all the radio

communications acquired and processed is also an important element of processing, atleast for signals where the sender cannot be uniquely identified. The direction-

finding/location-finding results in conjunction with the prior knowledge/ target knowledge are

therefore also used for the identification of the acquired emitters (for details, see Chapter

2.4.1.5).

The information obtained from the results of the search, direction-finding/location-finding,

signal classification and processing like the technical parameters for the signal acquired,

the encoding procedure used, the operational parameters obtained from the analysed and

identified operational sequences and relationships and ideally the content of the messages

in code or clear text are inserted in computer report forms as well as attached as annexes

by the gatherer, but also increasingly automatically. The data are sent as acquisition/raw

reports via the data links provided to the evaluation unit (IP), and in special cases

(warnings/urgent reports) also immediately to the responsible units.


29/58



In principle, gatherers have the same analytical tools for processing as for searching. They

can use these tools at their leisure and with a time delay to investigate all signals that

cannot be processed or cannot be processed with sufficient quality despite the fact that

they have been classified successfully. If the analysis was able to identify the causes of the

malfunctions and it is possible to successfully re-set the parameters of the

function/processing modules, the signal can be re-extracted from the memory and

completely reprocessed.

In military strategic radio intelligence, processing is performed according to the sequences listed

above. However, the tactical discipline COMMS ESM differs in its priorities and in parts of the

signal processing. Here, the detection and classification of a specific signal is in many cases

adequate for a (warning) report or for the initiation of countermeasures.

Current and reliable indications of an acute threat can only be obtained from specific procedural

and operational features or sequences and from voice communications. The same applies to a

limited extent to encrypted radio communications.

Depending upon the nature and scope of the indicators required for the identification of a current

threat, the signals are further processed individually in the processing unit. They are demodulated

and, if required, decoded (digital modes) and analysed with regard to the above-mentioned

indicators. This is generally performed automatically, but in individual cases, an experienced

operator will have to evaluate/analyse the intercepted radio communications (for example, in the

case of radio voice communications). This situation similarly applies to tactical radio intelligence foridentifying or updating the tactical scenario (that is without any acute threat).

2.4.1.5. Significance of direction-finding/location-finding for searching,identification and evaluation

The introduction of wideband technology for searching has increased the number of detected

emissions several-fold compared to the use of a limited number of narrowband search receivers in

traditional search systems. In particular with short-wave radio (HF), when wideband search heads

are used, the number of detections is usually so high that sometimes it is not possible to

automatically classify all the signals received with the computer power available, unless suitable

strategies to relieve the situation, i.e. to reduce the number of emissions, are taken. One of the

most important approaches to searching is to minimise the number of signals to be forwarded for

time-consuming computer classification. Minimisation is achieved by means of suitable

exclusion/filter criteria (in steps) at the earliest possible stage of processing. Ideally, all that

remains should be signals with a high relevance to the mission.


30/58



The only way to achieve a reduction of this kind is to supply the known signal features, operational

sequences/features and other information useful for classification when the search missions are

assigned. These may be parameters such as (transmission) time, direction or location, frequency,

bandwidth etc. When the relevant features/parameters are identified by the system, these selection

or exclusion criteria lead, in different stages of the signal processing during the search, to the

exclusion of all signals that do not conform to the specified features.

In particular, the early correlation of the directional information for the individual emissions detected

with the specified directional data effectively reduces the number of signals requiring further

processing during the classification process.

Approximate directional information can be obtained using directionally selective receive antennas

(LP antennas or circular array antennas). More precise determinations of direction- and location-

finding can only be achieved with suitable direction-finding systems/bases.

In addition to reducing the data/effort during searching, the reliable identification of the targeted

emitters/radio stations with the aid of the direction-finding/location-finding results is of great

importance for processing (IG) and analysis (IP).

High-capacity direction-finding and location-finding systems are, consequently, indispensable

components of all radio intelligence systems, regardless of whether they are implemented in

narrowband, wideband or mixed technology. However, because of their high signal volume,

wideband searching and processing components also require direction-finding/location-finding

systems that are adapted to the capacity and bandwidths.

The only exceptions to this rule are radio intelligence systems for very specific tasks/operations in

which the limited spectrum of tasks or operations does not require or permit direction-

finding/location-finding.

Suitable procedures in direction-finding systems signal assignment/comparison by means of a

comparison of parametersmust ensure that the direction-finding/ location-finding results can also

be correctly assigned to the signals acquired and processed by the search/processing system.

Any location-finding results available are always a component of the acquisition reports. They

assist the analysts not only in the identification/confirmation of the emitters/radio stations and

hence of the users or organisations, but also they make it possible to determine the location/area

of the units and people targeted.


31/58



2.5. Intelligence processing and target knowledge

2.5.1. Overview

Radio intelligence is only oneimportant cornerstone of communications intelligence (COMINT).

All COMINT units, and hence numerous extremely different sources supply the results of their

acquisition/processing to central Intelligence Processing (IP), frequently also referred to as

COMINT analysis. These are transmitted as formatted reports due to the different sources,

usually also in different formats on the available communications links in as near real-time as

possible and stored in IP for further processing. The form of further processing, the scope of

automated and partially automated processing steps, is determined on the one hand by the

quantity and type of the reports and the ratio between operational and content-related

results/information and on the other by the configuration of the computer-based processing and

analytical tools in the IP organisation.

Due to its special function as an early warning system, tactical radio intelligence (COMMS ESM)

does not undergo the analysis process described in this chapter. Chapter 2.5 deals with its special

features.

In principle, the following functional or processing sequence has proven to be expedient: (see also

Figure 6 on page 39)

In report pre-processing, incoming data/reports of the most diverse types and formatting

are automatically recorded and stored in their original form (long-term) so they can be

suitably prepared for further processing later.

In the preliminary analysis,as the first (usually automatic) analysis/ evaluation step, the

thematic assignment and therefore thematically correct storage is determined from

operational data/information and content in the reports. This ensures that the reports are

provided appropriately for the respective tasks or distributed to the responsible analytical

areas/analysts in each case.

In addition, report material from all sources is pooled according to subject/task area and

supplemented by any further information belong to the same subject area (added value).

The reports prepared in this way and supplemented by additional information/knowledge

are available to the operators/analysts in the incoming report areas assigned to them for

processing and evaluation => analysis.


32/58



In principle, analysts can use their (prior) knowledge of and experience with the intelligence

targets assigned to them together with the operational information and possibly even the

content of the supplemented reports supplied to them to identify the activities and hence

frequently also the plans of their intelligence targets and evaluate them correctly. The

evaluation of the events and their sequence enables analysts to obtain important

information or knowledge for the assessment of the situation, to assess the potential risk

with sufficient reliability and if necessary issue the necessary indications for suitable

(counter) measures.

Analysts use the information and findings obtained from the analysis process to produce

individual reportsand situation reports according to the type of information, if required

including analyses for their customers.

Figure 6: An overv iew of IP

If the information on the reconnaissance targets in question is confirmed with sufficient

certainty (long-term observation; evaluation of all sources), it is used to update and

supplement the target knowledge.

Another important task of analysis is fine-tuning the intelligence gathering if there are gaps

in raw reports or individual mission areas require consolidation/augmentation.


33/58



2.5.2. Report pre-processing

The total number of reports sent to the communications intelligence (COMINT) analytical area (IP)

originates from numerous sources with extremely different volumes. A not insignificant proportion

comes from radio intelligence/acquisition. Therefore, Intelligence Processing is where reports are

brought together from ones COMINT facilities/sources and from all cooperating national and

international partners with the same security interests and reconnaissance targets.

Pre-processing comp r ises the fol lowing proc essing steps: (see also Figure 7)

During storage, as a first processing step, the incoming reports are logged - here they

may be assigned to the sender with details of the time received, the tactical time, the type

of report and the reconnaissance target. Other details are possible.

After logging and storage, the reports are prepared in several steps for the subsequent

evaluation processes according to their nature, origin and type. In high-capacity, modern

evaluation systems, the processing operations are performed automatically. However, the

scope of computerised pre-processing is heavily dependent upon the nature of the reports,

the requirements on the automatic processing and the degree of automation achieved by

Intelligence Processing.

In another step, all reports that do not conform to ones own processing format (mainly

partner reports) are automatically converted to ensure a uniform data format suitable for the

automated evaluation processes.

XML/HTML has been found to be a particular suitable report format, since all known report

formats may be depicted / converted without loss and because XML/HTML provides the

ideal conditions for the use of Internet technologies for data preparation/representation,

transport and provision.

Figu re 7: IPpre-processing


34/58



In a further processing step to make the handling of the material simpler and easier for the

analyst, the reports should be cleaned of formal ballast that is of no relevance for the

subsequent processing and content analysis/evaluation (peeling).However, the report is

also retained and stored in its original version.

Foreign language report contents in text form can be translated into ones own language by

means of another automatic process. However, the translations usually have to be revised

by suitable foreign language experts. Audio files from voice traffic sometimes also require

translation by personnel with foreign language training.

The reports prepared/pre-processed in this way are now available to Preliminary (Report)

Analysis for the subsequent processing and analysis steps.

2.5.3. Preliminary (Report) Analysis

The following processing sequence describes preliminary analysis: (see also Figure 8 on page 36)

The numerous reports prepared by pre-processingare analysed in another extensively

automated processing step for pre-specified features and content to an extent that enables

the assignment of the individual reports to the predefined subject/mission areas and

hence also to the relevant analysts. This process is dependent in each case on the nature

of the reports and the acquisition results in them in accordance with the formatting

regulations. For example, the content of reports relating to communications/radio

parameters and also messages in reports may contain clues regarding the user/the

organisation and the strategic background of the communications acquired (here: radio

messages).

This ensures the thematic assignment of the reports and their task-specific provision to

the responsible analyst.

This processing step actually corresponds to the first step in a traditional analysis process.

It can and should take place automatically, but the analysis system must provide the

opportunity and tools to enable the analyst responsible to monitor the results or the

assignment process and, if necessary, make corrections.

The thematic assignment creates the conditions for pooling reports belonging to the same

subject/target groups and supplementing them for the analysis by additional knowledge

from the available databases in the sense of added value. This enables analysts to obtain

a more comprehensive/extended picture of their reconnaissance targets and to evaluate

the individual reports more accurately and assign them to the previous results/findings in a

more appropriate way.


35/58



Added valuecan be indicative findings concerning technical and/or operational features of

the radio networks in the mission focus, information relevant to the mission on the target

groups/people, their activities and habits, contacts, relationships, capabilities and potential,

their previously known locations and movement patterns and any other activities/findings

that may be relevant for the analyst in relation to the reconnaissance targets etc. This

information is frequently based on findings from intelligence sources, but can also come

from open sources.

For use in (preliminary) analysis, this information has to be prepared for computer

processing, correctly formatted and stored in such a way that the aforementioned

supplementary processes and targeted search requests are available in their entirety to the

analysts on a topic-related basis.

The reports prepared in this way and supplemented by basic knowledge and up-to-date

findings are called up by the responsible analysts on their workstation computers.

If long-term observations of the radio networks of the targeted enemy identify rules in the

sense of regular behaviour or procedures, these are useful for the target knowledge and

may also be used to derive a description of the enemys normal behaviour in radio

operations. This normal behaviour can generally be described so that automatic processes

are able to identify (from the reports supplied with the large amount of intelligence on the

radio parameters), a standard behaviour or, in the event of deviating radio parameters, a

deviation from the norm. The latter case is an important indicator of special activities onthe part of the observed/detected enemy and will be notified immediately to the responsible

analyst in each caseby the latest at the start of his shift - in a special report.

If the reports contain known indicators enabling direct conclusions to be drawn regarding

the activities of the reconnaissance target, the preliminary analysis will identify these

indicators immediately after receipt of the report even before an analyst has screened the

material.


36/58



Figure 8: IP prel iminary an alysis

When recognised, these indicators automatically trigger urgent reports or warning

reports according to pre-programmed sequences that are forwarded directly to Monitoring

and Control of ones own COMINT/radio intelligence service usually the Mission Control

and Reporting Unit with its Control Centre (CC) which is constantly on standby and

there put into a format suitable for display that ensures that the shift staff are immediately

made aware of the information.

If the results of ones own radio intelligence contain pre-specified indicators, these should

be identified by the intelligence gathering service immediately during/after acquisition. The

search/test procedures used should in principle conform to those used by the intelligence

processing service and trigger the same immediate action/urgent reports.


37/58



2.5.4. Evaluation of reports and reporting

Analysts can call up from the memory area assigned to their field of responsibility an overview over

all newly arrived reports that have been prepared and supplemented as described above.

Depending on the nature of the reports and the configuration or availability of the analysis and

evaluation tools, analysts can select different material presentation formats. The following lists

some of the numerous forms of presentation:

o Original report text (in the relevant report format with all report elements)

o Prepared/peeled report text with only the report elements relevant for analysis

o Graphical representation of radio networks identified

o Depiction of changes to these radio networks

o Frequency of communications

o Graphical representation of contacts identified (who is communicating with whom)

o Deviations from the normif it is possible to describe normal behaviour following lengthymonitoring phases

o Representation of the communications/radio situation and, if appropriate, also the tacticalsituation

o Temporal correlation of identified and reported activities

o etc.

Experienced analysts can generally use the wide variety of findings provided and supplementary

information (added value) on the assessment of individual processes and their interrelationships

for analytical purposes to obtain a realistic picture of the activities of their reconnaissance targets.

These findings are linked to the results of previous reconnaissance efforts against the same target

and used to draw up a current situation report or update the existing report. The analysts

detailed knowledge of the reconnaissance target, its basic plans, objectives and procedures,

potential and capabilities, previous behaviour etc. enable them to produce a reliable assessment

of the situation and in individual cases also contribute important information/indicators for suitable

(counter) measures.

The results of the analysis are summarised in reports that relate primarily to individual or

associated subjects/processes. In the event of long-term observation/ reconnaissance, when

required or on request, analysts combine a large number of messages and findings to produce

situation reports and analyses. In addition to the identified procedures, these usually contain

assessments and forecasts regarding the enemys potential and plans and other relevant

comments on the reconnaissance target. The analysts reports provide important contributions to

the final reports summarising of the central analysis by the reconnaissance/intelligence service in

question.


38/58



Figure 9: Analys is and repor t ing

Intelligence operators have a variety of tools for the production of reports, which provide templates

(standard form), relieve them of the task of making formal or routine entries, incorporate extracts

from reports and support and integrate maps and graphics, etc.

Intelligence Processing usually has a permanently manned monitoring and standby service (control

centre => CC). The CC has access to all incoming reports and monitors all outgoing reports. Its

tasks include preparing daily summary reports providing an overview of the COMINT/radio

intelligence situation (changes) and of any events/findings during the last 24 hours worthy of

reporting.

At the start of each days shift, the CC issues an up-to-date situation report on the COMINT/radio

intelligence situation with the identified communications/radio activities and the changes to the

reconnaissance targets and reports on the special events during the previous night/shift.

The CC ensures that time-critical reports (e.g. urgent reports) are forwarded immediately to the

specified addresses and, if required, the specified alert measures triggered.

However, in larger COMINT organisations, the CC may also be integrated in a higher-ranking

central control area in the organisational unit Mission Control and Reporting which, as a

central COMINT command and control body is also responsible for monitoring and pooling allreports issued and for mission control as far as intelligence gathering and intelligence processing is

concerned (see also Figure 9).


39/58



2.5.5. Processing target knowledge

Target knowledge includes all information on a reconnaissance target (this could be individuals,

groups, criminal organisations, armed civilian or paramilitary/military units and organisations,

enemy services etc.) which is necessary or useful for finding and acquiring the communications

links (here: radio communications) of the target/enemy at justifiable expense and to process and

analyse them so that the components of the traffic relevant to the intelligence services may be

extracted and interpreted correctly.

Target knowledge may be divided into three main groups:

a. Information on the communications equipment used by the enemy and on the operational

sequences of its communications. This may be information obtained by radio intelligence

on the enemys radio devices/systems, frequency plans and frequency usage (history), the

transmission modes used, call names, signs or numbers used, its radio networks, itstechnical and operational radio operations and sequences, etc.

b. Confirmed information obtained on the targeted individuals, groups, organisations, units.

This could include personal data on target persons, information on organisational and

command and control structures, locations, deployment, equipment, capabilities and habits,

command and control principles and sequences, command structures, etc.

c. Technical and/or operational features of the radio communications, allowing reliable

conclusions regarding strategic backgrounds/measures. This target knowledge forms in

particular the basis for tactical radio intelligence (COMMS ESM).

The above-listed examples are only a limited selection of the numerous possible types of target

knowledge. The communications facilities, sequences, habits and features, the properties

important for the analysis and the handling sequences differ according to the nature of the

reconnaissance target. This leads to a multiplicity of extremely different individual types of target

knowledge required for successful reconnaissance on the targets in question. Therefore, every

target places very specific requirements on COMINT/radio intelligence and on the target

knowledge to be compiled.

One basic principle is that, in addition to high-capacity and suitable sensor technology, precise,

comprehensive and up-to-date target knowledge is the key to successful reconnaissance on

enemy communications/radio traffic.


40/58



However, the development of reliable and sufficient target knowledge requires long-term

observation and evaluation of the enemys radio communications with ones own radio intelligence

facilities. The information obtained in this way may be supplemented by assured information from

other sources. Here, it is important that the target knowledge is updated and where possible and

required also supplementeda task which is permanently assigned to each analyst for their field

of responsibility; in larger COMINT organisations, there is frequently also a special target

knowledge group.

New information relevant to the target knowledge can only results in changes or supplements to

the target knowledge database if the operator/analyst responsible for the relevant mission area has

released these reconnaissance results as reliably classified and suitable for the database. This

usually only happens w

Documents

D Thoelke Buchw713od0e1