Shown above is the NSA's Special Collection Service (F6) EINSTEIN/CASTANET hardware.  They're located on the top floor or roof of the U.S. embassy in Berlin, and elsewhere, operating under the STATEROOM program.  This is not normally a transmitting system, though it can be used for RF illumination, RF flooding, active fault injection, lulz, etc.

This is primarily used as a wideband microwave SIGINT (bug repeater, telco microwave backbones, Wi-Fi, GSM/cellular, satellite/VSAT up & downlinks, etc.) collection system.

The "US-968U" SIGINT Activity Designator (SIGAD) in this INTERQUAKE screenshot refers to a SCS collection site in Beijing, most likely operating out of the U.S. embassy.

Note the dual wideband log-periodic antenna feeds (horizontal/vertical polarization, 0.5-18 GHz, probably with pre-amplifiers) and the precision (fraction of a degree - Az/El) stepper motor dish positioning system.  Additional electronics can be mounted onto the back of the dish.

The "curtain" in the background is made of conductive fabric to knock down stray or compromising radio frequency energy - and to block the setup from nosey diplomatic staff.

The parabolic dish is designed to be broken down into several smaller sections for concealment and transportation.  EINSTEIN(?) is the antenna setup's codename, CASTANET(?) is the handheld positional controller's codename and is based around a Qlarity QTERM G55/G56 data terminal (Qlarity Foundry Software Manual, Qlarity Programmer's Reference Manual).

STATEROOM sites are covert SIGINT collection sites located in diplomatic facilities (embassies, consulates, hotel rooms, etc.) abroad.  SIGINT agencies hosting such sites include SCS (at U.S. diplomatic facilities), Government Communications Headquarters or GCHQ (at British diplomatic facilities), Communication Security Establishments or CSE (at Canadian diplomatic facilities), and Defense Signals Directorate or DSD (at Australian diplomatic facilities).  These sites are small in size and in number of personnel staffing them.  They are covert, and their true mission is not known by the majority of the diplomatic staff at the facility where they are assigned.  The antennas are sometimes hidden in false architectural features or roof maintenance sheds.  "Survey Sites" are short-term collection efforts to determine the volume and types of signals which can be intercepted at the site.  If the site turns out to be productive, a permanent collection site may subsequently be established.

The radar unit (CTX4000/PHOTOANGLO) generates an unmodulated, continuous wave (CW) signal.  The oscillator is either generated internally, or externally through a signal generator or cavity oscillator.  The unit amplifies the signal and sends it out to a RF connector, where it is directed to some form of transmission antenna (horn, parabolic dish, log-periodic antenna, spiral).

The signal illuminates the target system (RF flooding) or implant (back-scatter modulation) and is re-radiated.  The receive antenna picks up the re-radiated signal and directs the signal to the receive input.

The signal is amplified, filtered, and mixed with the transmit antenna.  The result is a homodyne receiver in which the RF signal is mixed directly to baseband.  The baseband video signal is ported to an external BNC connector.  This connects to a processing system, such as NIGHTWATCH, an LFS-2, or VIEWPLATE, to process the signal and provide the intelligence.

The CTX4000/PHOTOANGLO provides the means to collect signals that otherwise would not be collectable, or would be extremely difficult to collect and process.

The CTX4000/PHOTOANGLO may require the installation of ANGRYNEIGHBOR hardware implants to act as back-scatter modulators (retro-reflectors) for the required target data:

TAWDRYYARD Closeup view of the TAWDRYYARD retro-reflector.  The 6-pin device is the square wave oscillator (microcontroller - PIC10F20x-series, tinyAVR, etc.)  This feeds the gate of a FET, located on the back of the device.  The red wire is +3V from a lithium coin cell and the black wire is ground.  The oscillator frequency is chosen to be unique and can even be pulsed to reduce power consumption. RAGEMASTER Closeup view of a RAGEMASTER retro-reflector inserted in a VGA monitor cable.  The red thing is an enameled air-core inductor (connecting isolated cable shields, couple H&V sync via ground spikes to FET's drain antenna), the thing with the "U" label is the NEC NE33284A FET, the black thing with numbers (left) is a 1 MΩ bias resistor (gate to source tied to left shield ground), the black rectangle (right) is a diode (DC restore clamp) on the FET's gate to source (ground), the brown rectangle (top) is a capacitor (AC coupled red video to gate, 0.1 µF).  The short little wire on the FET's drain to (right) cable shield is the antenna.  The yellow film is Kapton tape.  A fake moulded ferrite bead covers the implanted FET circuit.  A TAWDRYYARD beacon is required to identify the general location of a RAGEMASTER implant.  An external processing unit (LFS-2, NIGHTWATCH, GOTHAM, VIEWPLATE) is used to analyze/detect/filter and reinsert the H&V sync signals and display the target video signal. LOUDAUTO Closeup view of a LOUDAUTO retro-reflector.  The Knowles EK/EY-series microphone is on the left, the little black rectangles with numbers are resistors, the brown rectangles are capacitors (filtering and blocking DC bias), the 6-pin device is the PPM (ultrasonic) clock generator (microcontroller - PIC10F20x-series, tinyAVR, etc.), the white circle thing with the "Ax" label is the (MGF1302) FET.  Top of the "A" is the gate.  The red wire is +3V from a lithium coin cell and the black wire is ground.  The vertical wire at 1-15/32" is the antenna on the FET's drain.

0.)  This assumes your RadioShack PRO-651/PRO-652 scanner if properly programmed to the P25 trunked radio system you want to monitor and the scanner is set to output Control Channel data on the PC/IF jack.  This can be done using the PSREdit500 program and selecting Enable CC Dump under Other Options.

From the PSREdit500/Pro96Com FAQ:

Q.) How do I get the PSR-500, PSR-600, PRO-106 or PRO-197 to output control channel data to decode? A.) The PSR-500, PSR-600, PRO-106, and PRO-197 have the capability to send control channel data to the PC/IF port anytime the scanner is monitoring a control channel. While this data may be decoded by Pro96Com, this data stream will be lost by Pro96Com whenever a voice channel becomes active, or conventional, search, or sweeper objects are being scanned. In addition, if you are monitoring a multi-site system, Pro96Com will constantly reload the data each time it finds a new site. To get a steady stream of data, these radios need to be placed into analyze mode on an active control channel. There are two ways to get into analyze mode. In manual mode, locate a talkgroup that's a member of the system you want to monitor. Once located, Press the F2 (TSYS) key, then the F3 (Analyz) key. Using the up or down arrows, locate an active control channel. When you see the decoded information on the screen, the scanner is ready to send the control channel data. In scan mode, you can wait for a talkgroup on the system to become active, at which point you can follow the same procedure (F2/F3) to place the scanner in Analyze mode. Pro96Com User Manual

1.)  Connect a RadioShack USB-to-PC Scanner Programming Cable (Cat. No. 20-546) between your RadioShack PRO-651/PRO-652 scanner's PC/IF jack and an open USB jack on your Linux computer.  Do a dmesg and you should see something like this:

[5016365.583628] usb 1-1.3: new full-speed USB device number 4 using ehci-pci [5016365.687311] usb 1-1.3: New USB device found, idVendor=0403, idProduct=6001, bcdDevice= 6.00 [5016365.687319] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [5016365.687323] usb 1-1.3: Product: USB <-> Radio Scanner Cable [5016365.687326] usb 1-1.3: Manufacturer: GRE [5016365.687330] usb 1-1.3: SerialNumber: 20-546 [5016365.691477] ftdi_sio 1-1.3:1.0: FTDI USB Serial Device converter detected [5016365.691552] usb 1-1.3: Detected FT232R [5016365.692258] usb 1-1.3: FTDI USB Serial Device converter now attached to ttyUSB0

Note the ttyUSB0 entry.  This is the serial device we'll be using in minicom.

2.)  Run minicom -s and go to Serial port setup.  Change the Serial Device to /dev/ttyUSB0, or whatever the dmesg showed.  Go back to the menu and choose Exit.

3.)  If everything worked out, you should see something like this:

Welcome to minicom 2.10 OPTIONS: I18n Port /dev/ttyUSB0, 23:00:13 [U] Press CTRL-A Z for help on special keys P25:T0731:2C0004A7570B56570B56C9BC: **** CRC Error **** P25:T0731:300000042A32B1205E3CB309 P25:T0731:2800006450645B570B564898 P25:T0731:BA000034A7010115087025BA: **** CRC Error **** P25:T0731:0090648A63D963D963D9277D: **** CRC Error **** P25:T0731:09901040000000000000D6E5 P25:T0731:300000042A32B1205E6468F4 P25:T0731:BA000034A7010116A47011B8: SysID:4A7 RFSSID:01 SiteID:01 P25:T0731:3D0010E5E0335D149F35CCEB: **** CRC Error ****

Don't mind the "**** CRC Error ****" messages.  That's RadioShack's fault, not yours.

4.)  Hit Ctrl+A L (hold down Ctrl and A, then hit L).  This will bring up a menu asking Capture to what file?.  Type anything you want, but it helps to name/number them so you remember what they are, LOL.  The output from minicom will now be displayed in the terminal window and captured in a text file.

5.)  This is the raw Control Channel data.  Look for lines like this:

P25:T0731:800004158063D957345E8B14: TGID-25561 RId-57345E VC- 770.806250 P25:T0731:80000415B864BF57CBC940E4: TGID-25791 RId-57CBC9 VC- 771.156250

In this example, the first line means Radio ID (RId) 57345E (in hexadecimal) used Talkgroup ID 25561 (in decimal).  Converting the RId from hex, we get Radio ID 5715038, which is a portable unit with the Oneida Nation Police Dept., using the "Oneida Nation Police - Main Dispatch" talkgroup on the Brown County SIREN 700 MHz public safety radio system (Voice Channel at 770.80625 MHz).

For the second line, Radio ID (RId) 57CBC9 (in hexadecimal) used Talkgroup ID 25791 (in decimal).  Converting the RId from hex, we get Radio ID 5753801, which is the base station radio for NEW Water (Green Bay Metro Sewer & Water), using the "NEW Water - District 1" talkgroup on the Brown County SIREN 700 MHz public safety radio system (Voice Channel at 771.15625 MHz).

You can now Find, Fix, and Finish (or jam) an individual user on the radio system via their unique Radio ID.

extractIDs.sh  This is a simple shell script to extract new Radio and Talkgroup IDs from Control Channel data dumps made via the above described method.  Read the source for more info.

Usage: ./extractIDs.sh [log filename]

Notes / Links

1. Radio Scanner Modifications and Information
2. Microwave Radio Path Analysis  This is the new one I made based around SPLAT! v2.0-alpha.
• Microwave Radio Path Analysis Notes
3. Low-Cost Construction Using Surplus Satellite TV LNBs  Good source for cheap microwave LNAs.
4. Using a Surplus 1 Watt TBQ-3018 VSAT Amplifier Module for 10 GHz Amateur Band Operation
• Using Surplus VSAT Power Amplifier Modules on 10 GHz
• Building a 10 GHz Band Ham Tranciever from Hughes VSAT Hardware
5. Electromagnetic Information Extortion from Electronic Devices Using Interceptor and Its Countermeasure
6. A Feasibility Study of Radio Frequency Retroreflector Attack



7. Collection of Digital Receiver Technology PDFs
8. Inside the Secret World of America's Top Eavesdropping Spies  Officially, the Special Collection Service doesn't exist.  Unofficially, its snoops travel the world intercepting private messages and cracking high-tech encryptions.  (Mirror)
9. Body of Secrets: Anatomy of the Ultra-Secret National Security Agency  by James Bamford

"In fact, the combination of human and machine spies may, in the end, save both.  According to senior intelligence officials, in 1978 a covert joint intelligence organization was formed, which marries the clandestine skills of the CIA with the technical capabilities of the NSA.  The purpose of this Special Collection Service (SCS) is to put sophisticated eavesdropping equipment - from bugs to parabolic antennas - in difficult-to-reach places and to target key foreign communications personnel for recruitment.

The SCS, whose headship alternates between NSA and CIA officials, is an outgrowth of the CIA's former Division D, established in the early 1950s by William F. Friedman's first employee, Frank Rowlett.  Worried about competition from the upstart NSA, Allen Dulles hired Rowlett away to set up a mini-NSA within the CIA.  At the time, Rowlett was upset because AFSA/NSA Director Ralph Canine wanted him to switch jobs, going from chief of SIGINT to that of COMSEC, the codemaking side of the business.  'As it happened,' recalled fellow pioneer Abraham Sinkov, 'Rowlett was made quite unhappy by this suggestion; he wasn't very keen about moving over to COMSEC, and he transferred to the CIA.'  (After about five years, Rowlett transferred back to the NSA.)

...

Today, the SCS is the successor to Division D.  As encryption, fiber optics, the Internet, and other new technologies make life increasingly difficult for NSA's intercept operators and codebreakers, the SCS has greatly expanded and become increasingly important.  Its goal, like that of television's old Impossible Missions Force, is to find unique ways around problems.  'Yesterday's code clerk is today's systems administrator,' said one very senior CIA official.  The easiest way to acquire many secrets is to get into foreign databases, and the best way to do that is to recruit - by bribery or otherwise - the people who manage the systems.  Also, by bribing someone to plant bugs in the keyboards or other vulnerable parts of a computer network, NSA can intercept messages before cryptographic software has a chance to scramble them.

The SCS is headquartered in a heavily protected compound of modern buildings on Springfield Road in Beltsville, Maryland, a few miles south of NSA.  There, in what is known as the live room, the electronic environment of target cities is re-created in order to test which antennas and receivers would be best for covert interception.  Elsewhere, bugs, receivers, and antennas are fabricated into everyday objects so they can be smuggled into foreign countries.  'Sometimes that's a very small antenna and you try to sneak it in,' said former CIA director Stansfield Turner.  'Sometimes the signal you're intercepting is very small, narrow, [of] limited range, and getting your antenna there is going to be very difficult.  I mean, under Mr. Gorbachev's bed is hard to get to, for instance.'

While on occasion NSA or SCS has compromised a nation's entire communications system by bribing an engineer or telecommunications official, often much of the necessary eavesdropping can be done from special rooms in U.S. embassies.  But in difficult countries, clandestine SCS agents must sometimes fly in disguised as businesspeople.  An agent might bring into the target country a parabolic antenna disguised as an umbrella.  A receiver and satellite transmitter may seem to be a simple radio and laptop computer.  The SCS official will camouflage and plant the equipment in a remote site somewhere along the microwave's narrow beam - maybe in a tree in a wooded area, or in the attic of a rented farmhouse.  The signals captured by the equipment will be remotely retransmitted to a geostationary SIGINT satellite, which will relay them to NSA.  At other times, no other solution is possible except climbing a telephone pole and hard-wiring an eavesdropping device.

The SCS will also play a key role in what is probably the most profound change in the history of signals intelligence - the eventual switch from focusing on information 'in motion' to information 'at rest.'  Since the first trans-Atlantic intercept station was erected on Gillin Farm in Houlton, Maine, just before the close of World War I, SIGINT has concentrated on intercepting signals as they travel through the air or space.  But as technology makes that increasingly difficult and prohibitively expensive, the tendency, say senior intelligence officials, will be to turn instead to the vast quantity of information at rest - stored on computer databases, disks, and hard drives.  This may be done either remotely, through cyberspace, or physically, by the SCS."

10. The Puzzle Palace: Inside the National Security Agency, America's Most Secret Intelligence Organization  by James Bamford
11. The Shadow Factory: The Ultra-Secret NSA from 9/11 to the Eavesdropping on America    by James Bamford

"Although tapping into underground fiber-optic lines is much more difficult than tapping into a copper cable, the technique has been perfected by the NSA.  For cables buried in foreign countries, the task of gaining access to them was given to a unique covert organization named the Special Collection Service (SCS), which combined the clandestine skills of the CIA with the technical capabilities of the NSA.  Its purpose is to put sophisticated eavesdropping equipment - from bugs to parabolic antennas - in difficult-to-reach places.  It also attempts to target for recruitment key foreign communications personnel, such as database managers, systems administrators, and IT specialists.

...

The position of SCS chief alternates between NSA and CIA officials.  The service is headquartered in a heavily protected, three-hundred-acre compound consisting of three boxy low-rise buildings with an odd, circular park walled in between them.  Located at 11600 Springfield Road in Laurel, Maryland, nine miles south of the NSA, the facility is disguised as a tree-lined corporate campus.  In front is a sign with the letters 'CSSG' that seems not to have any meaning.  Inside, in what is known as 'the live room,' the electronic environment of target cities is re-created in order to test which antennas and receivers would be best for covert interception.  Elsewhere, bugs, receivers, and antennas are incorporated into everyday objects so they can be smuggled into foreign countries.  'Sometimes that's a very small antenna and you try to sneak it in,' said former CIA director Stansfield Turner.  'Sometimes the signal you're intercepting is very small, narrow, limited range, and getting your antenna there is going to be very difficult.'

While in some places the NSA or SCS has compromised a nation's entire communications system by bribing an engineer or telecommunications official, in others much of the necessary eavesdropping can be done from special rooms in U.S. embassies.  But in difficult countries clandestine SCS agents must sometimes fly in disguised as businesspeople and covertly implant the necessary eavesdropping equipment.  The person might bring into the target country a parabolic antenna disguised as an umbrella.  A receiver and satellite transmitter may be made to appear as a simple radio and laptop computer.  The SCS official would then camouflage and plant the equipment in a remote site somewhere along the microwave's narrow beam - maybe in a tree in a wooded area or in the attic of a rented farm house.  The signals captured by the equipment would be remotely retransmitted to a geostationary SIGINT satellite, which would then relay them to the NSA.

In order to obtain access to fiber-optic cables in noncooperative or hostile foreign countries, the SCS would trace the cable to a remote area and then dig a trench to get access to it.  Then the person would place an advanced 'clip-on coupler' onto the cable.  These commercially available devices, used to test fiber-optic systems, produce a microbend in the cable that allows a small amount of light to leak through the polymer cladding shell.  The light can then be captured by a photon detector, a transducer that converts the photons into an electrical signal.  This then connects to an optical/electrical converter that is plugged into a port on a laptop fitted with software allowing for remote control.  Packed with super-long-life batteries, the entire system can be reburied with a camouflaged line running up a tree to an antenna disguised as branches.  Signals from the bug can then be transmitted to an NSA satellite while remote-control instructions are broadcast back down to the computer.  All of the equipment needed is commercially available."

12. Permanent Record  by Edward Snowden

"In the summer of 2008, the city [Geneva] celebrated its annual Fêtes de Genéve, a giant carnival that culminates in fireworks.  I remember sitting on the left bank of Lake Geneva with the local personnel of the SCS, or Special Collection Service, a joint CIA-NSA program responsible for installing and operating the special surveillance equipment that allows U.S. embassies to spy on foreign signals.  These guys worked down the hall from my vault at the embassy, but they were older than I was, and their work was not just way above my pay grade but way beyond my abilities - they had access to NSA tools that I didn't even know existed.  Still, we were friendly: I looked up to them, and they looked out for me.

As the fireworks exploded overhead, I was talking about the banker's case, lamenting the disaster it had been, when one of the guys turned to me and said, "Next time you meet someone, Ed, don't bother with the COs [case officers] - just give us his email address and we'll take care of it."  I remember nodding somberly to this, though at the time I barely had a clue of the full implications of what that comment meant."

13. Channel Four: Capenhurst Tower  Channel Four news report on the mysterious Capenhurst Tower.  Go inside a former GCHQ monitoring site.  (Additional Info)
14. Feds to Offer FBI 'Mole' Sing-or-Die Deal  "At the most damaging end of the spectrum, investigators are worried that Hanssen compromised the Special Collection Service program, a joint operation of the CIA and National Security Agency.  The 'black budget' - or top-secret - program oversees the bugging of overseas embassies and government installations, using the most exotic technologies available."
15. A Most Unusual Collection Agency  How the U.S. undid UNSCOM through its empire of electronic ears.
16. Weapons of the Secret War  "That delicate and dangerous task is the forte of an unacknowledged U.S. intelligence agency bearing the innocuous name of Special Collections Service (SCS).  The agency, housed in Beltsville, MD., a short freeway ride from NSA headquarters, is jointly staffed by the NSA and the CIA.  Operating under cover from U.S. embassies around the world, the agency is known for Mission: Impossible-style operations - most famously, hiding bugs on pigeons that perched on windowsills of the Soviet embassy in Washington, D.C."
17. Spy Suspect May Have Revealed U.S. Bugging  "An affidavit outlining the government's case against Hanssen asserts that he 'compromised an entire technical program of enormous value, expense and importance to the United States.'  It suggests obliquely that Hanssen gave the Russians information about a 'new technique' developed by the NSA and described to them a 'sensitive office' where an NSA employee worked.  Although the affidavit does not mention the Special Collection Service by name, intelligence experts outside the government said that these and other references point to the global eavesdropping operation."
18. NSA-CIA Special Collection Service - Bird's Eye
19. CIA-NSA Special Collection Service Facility  College Park, Maryland  (Source)
20. FAS Intelligence Resource Program: Special Collection Service  Beltsville, MD
21. Interception Capabilities 2000  "63.  A joint NSA/CIA 'Special Collection Service' manufactures equipment and trains personnel for covert collection activities.  One major device is a suitcase-sized computer processing system.  ORATORY.  ORATORY is in effect a miniaturised version of the Dictionary computers described in the next section, capable of selecting non-verbal communications of interest from a wide range of inputs, according to pre-programmed selection criteria.  One major NSA supplier ('The IDEAS Operation') now offers micro-miniature digital receivers which can simultaneously process SIGINT data from 8 independent channels.  This radio receiver is the size of a credit card.  It fits in a standard laptop computer.  IDEAS claim, reasonably, that their tiny card 'performs functions that would have taken a rack full of equipment not long ago.'"
22. Barton Gellman Interview  "Now what the CIA did not tell UNSCOM is that the people that they sent to install these radio relays were also covert operatives.  And they rigged this equipment to have a second purpose.  It's actually a joint operation of the CIA and the National Security Agency.  They operate a service called the Special Collection Service, and it's quite skilled at building hidden antennae and covert listening devices.  And these are quite large mass, these antennas, and they're spaced throughout the Iraqi countryside and they beam signals.  They're like repeater stations used in commercial radio transmissions."
23. Big Brother is Listening  by Ross Coulthart
24. How NSA Targeted Chancellor Merkel's Mobile Phone
25. Revealed: Britain's 'Secret Listening Post in the Heart of Berlin'
26. NSA Summaries  by Christopher Parsons
• NSA Codenames/Covernames and Suggested Use/Implementation
27. Lux Ex Umbra  Monitoring Canadian signals intelligence (SIGINT) activities past and present.
28. The SIGINT Satellites of Pine Gap: Conception, Development and in Orbit
29. NSA Foreign Satellite (FORNSAT) Exploitation

CIA Documents Mentioning the SCS

30. FY-80 Goals Program
31. Transfer of Accountable Property From CIA to NSA
32. SIGINT Operations
33. Extracts from the Staff Meeting Minutes of 19 September 1979
34. Staff Meeting Minutes of 7 March 1980
35. Letter to the Honorable Edward P. Boland from John N. McMahon
36. Report of Significant Activities During DCI's Absence
37. Minutes of the 25 July 1985 CIA Occupational Safety and Health Committee
38. SIS Pay
39. Senior Training Courses

NSA SIDtoday Articles Mentioning SCS

40. SID and the Secret Service
41. Generally Speaking: Back from the Front
42. SID Support to SOUTHCOM - Update on U.S. Hostages
43. NSA Support to NATO Summit
44. InSIDer's View of History: 'Local Support' as Stress Management
45. CIA's Directorates...  Understanding More About Them
46. InSIDer's View of History: The Adventure Continues - Evacuation from Belgrade
47. SCS and Executive Protection
48. Another Successful Olympics Story
49. Doing SIGINT in Pakistan
50. SCS Local Support Reporting to Evolve into 'First Instance' End Product Reporting
51. SCS Site Foils Ambush on Coalition Convoy, Receives Praise from Task Force Commander
52. A 'FIR-st' for SCS
53. SID Mailbag - Intelligence Analysts at SCS Sites
54. The Special Collection Service - Positioning for the Future
55. From the SID Mailbag: When to Mark Things 'COMINT'
56. Letter to the Editor: About Skype...
57. Instant-Gratification SIGINT
58. Temporary SCS Site Established for Presidential Visit to India
59. SCS Baghdad Teams With Brits to Help Free Hostages
60. Collaboration Tool is Used to Set Up a Collection at Distant Site
61. Deployment of New System Improves Access to Iranian Communications
62. Breakthrough: Previously 'Unfindable' Internet Cafes in Iraq Can Now Be Located
63. Going on TDY to Help Protect a VIP
64. The Wizards of OZ II: Looking Over the Shoulder of a Chinese C2C Operation
65. SCS Mosul and Coalition Forces Team Up to Neutralize Major Insurgent Cell
66. Improving Our Capability to Collect Against the Thuraya Satellite
67. F6, NSA Texas, and Yakima Research Station Collaborate on Venezuela Survey
68. What That a Morta or a Grenade?
69. The State of Covert Collection - An Interview with SCS Leaders - Part 1
70. The State of Covert Collection - An Interview with SCS Leaders - Part 2

Other Related GBPPR Projects

1. GBPPR PHOTOANGLO Experiments
2. Passive Resonant Cavity Technical Surveillance Devices
3. GBPPR Interferometric Surveillance Device Experiments - Part 1
4. GBPPR Interferometric Surveillance Device Experiments - Part 2
5. Laser Bounce Listening Device
6. GBPPR Remote Telephone Surveillance Experiments
7. GBPPR "Havana Syndrome" Experiments