(u) transnational dni training

(U) Transnational DNI Training

(U) PINWALE

(U) LE?

TOP SECRET//COMINTIREL TO USA, AUS, CAN, GBR, NZU/20291123 2

• (C) Supports SIGINT production by providing storage and retrieval of intercept

• (TS//SI) Special partition for FBI FISA data

• ( C) As a reposito1y, it accounts for a significant portion of SIGINT production

• (C//SI) Archives documents for approx. 5 years from the data of collection

• (S//SI) Several search engines that provide retroactive , interactive , and dissemination type searches


• (S//SI) LIONROAR searches documents beyond 13 months and up to a 5-year range of the archive

• (S//SI) LIONHEART Fusion searches a document index of the most recent 13 months in the archive

• (S//SI) PINWALE Dissemination searches documents daily based on a query


• For a refresher on query syntax, use the PINWALE Syntax Quick Reference Card (http: //rosato.do .nsa: 9087 /userweb /nexus / ref.card.030505.doc) or the course guide for TOOL2201

• For additional help creating queries, contact PINW ALE Help Desk


• (C) NEXUS is interface where you can conduct searches in UIS

• (C//SI) User Interface Service (UIS) integrates search and retrieval systems and presents data queried through NEXUS like the intended user would see (UIS Text Presenter).

• (S//SI) AGILITY is an alternative document viewer to the UIS Text Presenter ideal for viewing Microsoft Windows applications (MS Office, Adobe PDFs) in their native format


(S//SI) example: PWYA2006298115456 0001151730

(S//SI) PWID Dissected: PW YA 2006 298 115456 0001151730 (SI/SI)

P'vV PfN\VALE

YA Processor ID internal to PINWALE (values AA -ZZ)

2006 Year loaded into PW

298 October 251h on the Julian calendar

115456 Time (HHMMSS)

0001151730 IO dig it document number for the docu1nents loaded at this time.

(SI/SI)


(SI/SI)

• (U//FOUO) Deconstruct this PINWALE ID (PWID)

PIN\.VALE

\_ .-----------, Processor (AA -ZZ )

6:34.42pn1; the tin1e loaded into

PW

October 3'" on th e Juli an Calendar

\_ .-----------, 1,155•11

document loaded at this dat e and ti111e

(SI/SI)


• (S//SI//REL) Repository for all the traffic we collect a11d includes 1netadata and co11tent, with a focus on the content

• (S//SI//REL) Helps you answer important questions: > What personal information is available my target? > Who are his contacts (bud dy lists, address books) > What are my target's alternate accounts ( e-mail accounts,

chat accounts, usernames) > Where is my target located and where does he log on

fron1? > What can I learn about my target's computer (MAC

addresses , cookies)


• (U) Search for an e-mail account

• (U) Search for an IP address

• (C) Search for a PINWALE document using a PINWALE ID (PWID)

• (C) Search for a Universally Unique ID (UUID)


, tM , ... .,.~, t ~ld+I•• •• re 'x ,

c11, ... ....... i'*rch ... ig ' " § Q ., ~ ~ - -· - - - - - -r:>0:1\......,.., .. - d tli!Of. '"'" -\

::=l' C-C- 1"11_}1 •••tt" '" -~ ••••

·r=·- --' uoM4RT F~ • ~ - ,.....!!!!' '" I -·~ Fla Sore~ . ffMlt','t ... .. I -- ... . ~ . ~11-l' t ....... . g; w,I "°"" ,,~ .... . ·-

• ' I t "".'!!~11 > ' ....... · 1Lv c.-.11• ·- •• . 111,monfl

' •t,;C'Oliliii:l .. DM-m -°'"IY"- lf.:"°""'a I .. ...,..._.....,,

"' " fl '*" H·J»• CfMMo1 ''OIi' TOf' IKRST 6"CGM"1"f<t0fll l'IJ •

Oot<..-: • ' .. \1': \ C· - ·•+>c I \! ff) I) ~ ~ (1"¥"u00H ~ ~1l 1W'l<Uo33> C11t (ry- -

"' l) OIi ( .............. ) OIi (tor,111<~ ) OIi (l»l,-,.. ul llfl} <lfl ( l1t t1•f Hnllh l l>!J I ) OIi tauu --,Cl .., , I' ' \ ~ .

~·~'(~~1-d~ a "" 18°'*" ,. 1 _:J


• (S//SI) You can use DECODEORDAIN when querying on an e-mail account

• (C//SI) DECODEORDAIN prepares the pe1mutations for you in the query language's native form

• (S//SI) Query PINWALE directly from DECODEORDAIN results page

Go DECODEORDAIN


., ........ _ .. -~ .... - = , .... -........ - ' -----·--,_ • - - --·-- --· -·. ., ....... , _ ----,-·.-· ,~ .....

'" ., ., ..

--... -.. -· ... ·--... -,~-__ .. _ ... _,_ ..... 1'1,,.10,...,..._, ..... (II(;

·J5- J •o!3

@ ........... _ ... __ Q,OOQ

' ot1 --~-•

WWW

·------------- ... - ··· -------------, --·---·----·---.. :.•--·-----··--•T __ _ - .. T __ _

-·--T---·----·"" .. -·,co..---.o..---,,,,__1),o __

-·.-..---·,)-,.wT-- "-•'1111---'""'"-- .... •"'"'.... a.• ,,_ ___ .. _ .... :.. ___ _ .... o..-- w ... . .;o.. ___ _ -

.. -----___ ...

- -•T ___ --- -·T---, ..... -- _ _..,_,.., - ·-·--~--~-" - -·-·---.. ... ,.,_ . •.• =· - ··--···~· - T+I~_.. •• - ·-- ·}·· - ~~1 ·1- -. ·--~ ·,·~ · _..,._ ··- n,---i. _ ...... --- ·-"* --· -,·- -- ••lm"l'ffffll'•

TOP SECRET//COMINTIREL TO USA, AUS, CAN, GBR, NZU/20291123

.. 13

Objectives

• (U) Configure and use the UIS Metadata Viewer to process and view Pinwale search results and metadata

• (U) Create a query for viewing the FISA data


• (U) Search lnfonnation > In this area you have the Name field which is used as an identifier > The Description field \Yhich just provide s any additional infonnation.

• UIS U.• 11• s.-,,,d, 111,101 !ll•o111f•d) ~fi::_11l<) -·~ ... ... au•ry l•arc h tf•lp

Jg .... ~1~;~.!J ~ f!.:l - -· - -· r'·~tw,m*1! ~ UkJl.t ,OWIS~ol I QM( .... ~ I UIIOC.l•lo In $1!'.A 1 I ' 0~) lw.lt••~ Ol,lftJ'.,,.Wt,1l>Of\

t,r(ll[f91't : UONHRT_tUS ION • - l ••w U!i

•MN-, ~ $H •U!~ • Full Sear~t, . "'"''""- K4"1M .... L.Hd

~ l:"!M'lilfflelac.l °" . w.HOI.E&&NOfO

"""""' t,ooRffimTo , 'Ck~ likt • #:OcltCTOU .. : ,...". • ~~~. • f

" ' '

~~ - ,..,•~•~ I ··- To l

• ~-- £w ,-,.o~ NW0...o'(IUM•

..


• (U) Data Selection - (U) Search Engine - Allows the user to select the search

engine of their choice. **** Select PIN\\/ALE DISSEM - (U) Search Type - Used to select whether documents are

actually retrieved or just counted. **** Usually - Full Search - (U) Retri eve Metadata - Can be used to disable metadata.

This is not available when the selected Search Type is Hit s Only.

- (U) Send Resu lts To - Sets the folder location to return the search results; defaults to your SID.

**** Leaye your sid for this field. - (U) Visibility Group List - Allo\VS you to select one or all

of the Visibility Groups . Be sure to cl.ick on Add so it can be added to your search.

**** Select/Highlight SQF partition


" UIS: Ne.111 Scvth t d1to1 .{mod1f1cd) r;:)§ @ ,~\"F •• =,-· "c,ll

[ Ue Edit .Query j earch J::lelp

~ ~~ ~ ·~ _!j_!J ~ .... -sea,,11 rmorm;itlOn

N;1m• ~So, 1sApr1 1 ... r c.$$(: llp)O O IJI 1USOt UlU 1n Sf A J Oa1a Seiewonc t rt AU~l~on

Seard 1 Enfp'le: PI.NWALE_DISSEM • "' .. ,, Ed1; PSC,Teld •

~ Se~Tw, e--- Full Search • SGRNSPe, YNKE Btm ove L,oa.d

Betr'le'Ve MeuO'.na OH • OF

send Resucls To c1equ1c1e SQX

• Sl OVTl-lEARl Modello Vse: Non • • SUGAA+W.f LEX •

,, •

IR.:: .. II Visibiltty Group F,om I To

'. -Sate O~ ; r;:n New-Query Namll! I 'lj

--


(U) Date Range - Enter the date range in the From and To fields. It is important to remember to leave the fields blank for the PINWALE_DISSEM as it is a continuous running search.

(U) Visibility Group Table - By clicking the Add you are able to insert the visib ility groups and the date range into the Visibility Group table. Please note that if there is no data for any day \vithin the date range you will get an informational window popping up and saying "Data is not available for the entire date range specified".

- (U) Max Docs/Max Hits - Max Docs limits the number of documents that ,viii be returned by the queries associated with a Full Search. tvla x Hits limits the nun1ber of bits that wi ll be returned by the queries associated with a Hits Only query. Keep in n1ind that the system lirnits are 20,000 Max docs and I 000000 Max hits. (U) Save Days - Detenn ines the length of tirne that the results from a search 1111111 remain in the folder manager.


'I UIS: Nu:1.1, Se,,r c h fd1101 [mod1hcdl r;:,@(g_

tit Ip

~ ' Q... ~ ~ I ~ ~ ..... -· ..... .... .... - - ·-· Searel\ fr'lfOm'l&IIOtl

N--i.{!le Jos~FISAprU J Qesc.l{ptlon·ln Hsoc1atu , n SEA I oa1e se1ee11on OUety Assotla_lloo

Seite:h En,gioe PINWALE_DISSEM • a Vl!!l>U"R!.Q!,.._ "'" Edit PSC-Tb'I • -seaftl'I ~e : FUii SHreh • SORNSPC·'ttll<E 8•move l,oad

ae111eve Mtlad3ta. ON • SQF

SfD,dAts',11:STO ckqulck SOX

• STOU™EART Moelel To Vse· None • SVO>JHW.fl.EX •

I f !,in'I ('fn"(')lllriDO ~

I TO CV"NYIIMQ!?l,1

I

11.. 1 ~ r i•llltf 2, •• , 1 f,{! 111 ,. Ii

! . .

Remove I S~Oays : !D NewOuertt~sme.l I

·- "


• (U) Query Association Area - This area conta ins a list of queries associated with the search as well as functions to edit the queries. Re1nember if you do not wish to submit a query you had prev iously opened in the editor, you must remove it from the association list, before hitting the submit button.

• (U) Nev, Que1y Na1ne - This is probabl y the easies t function in PIN WALE. Type the query na1ne then either press the Return or Enter keyboard button s or click the Ne\\' button. Try and use something related to what you are going after.

• (U) Query Button s - New - Creates a new query and is given the name in the New Query

Name Field Edit - Opens a selected query from the Query Association List, or brings the selected que1y window to the front if multiple queries are open

- Ren1ove - Simply removes the selected queries from the Query Association List. Keep in mind that the queries arc not deleted from the Saved Queries fofdcr. Load - Opens the Load Query dialog box, allowing you the user to add a personal or shared Saved Que1y.


, lUS NlollllJ SM1cl'o [d, t o, {modW-11ad) (g .Q.® ,r<"'I

[ ii• "' l!u• ,Y i,e arcl'l tf• lp

jJ ..... 0.. rill ~ _!J ~ ~ -· =• b •• - ..... S.~hlnforn»tton

tlam • t;s o,a ~Aon 1 l1Qei.tnpl0ft.:'ll~ nsocu tn 111 sv. I O.lla~on: M~od.:IIIOn

• ••~ I 8f¥'(1!£~ PIHWALE_DISSIM .. 1 ...... -. ....... I .... I FSC.Tor! _:i Suitn ll1i• Full sea.rch • SQRNSPC-'rt lk'.E l .&•mov• l J.o•• I

aemMMtt:lcl~II ON • "" i ""-""' "" $1(!1JRtt1111JTo· ckqukk • .-, ~To VW Hone . "'1.fUX ~

• -·----" To

• Add f ~ i•llti- ftntt,1D I om I

. . Rtmov• J . -

,~om · li:J N-011orrH 11111 I • . . ~ rlSl,Jlrt l ~Qf (El

F~e SE•l)p • optio n s Forms

TOP SECRET!/COMINTt/202&1 123 .:, Dosu ipllorf~ I

r,1eft);M.011ttr 1

• I


(U) Query Forn1s - Vary in complexity from the Smart Form , which performs syntax for1natting to the Freeform which requires you to forn1at the entire query in the 11ative query language.

a. Valid LIONHEART_FUSION (RW) forms are SmartForm, SmartFor1n II, Fielded Search , and Freeform

b. Valid LIONROAR/PINWALE_DISSEM (PSL) forn1s are SmartFor1n, S1nartForm II, Zoned Search, StringSmart Forn1, Set Ops , and Freefor1n

Select "Smartform "


, UIS N•nn s.~,. h I d,10, lmod!htclj ";""_@®

f: ilt i41C A•t<Y t•mri ~·" ~

... °'-IE] _!j ! !J ~ -· - - -' hn.fl~~'°" Ne ~:IS.# prH I Q.011<ll~(lft ~n ·"'~"'!.!1'1.• ,,. st.o. I OJ!lt &tltdlon 0Utl)'M~•~ -- -SN1t11El'1~ PINWM.E_01'1(M • 1-,J..-..O~ ;.,, .... ...

!PS0,1'"1 . e.lfCII ""''

F'u•t • m h • S~SPC · vtw.E 8 tll'IO\l t _l.01d

ft~Mofl1'..ICUUI ON • ~" ....,,, $f(Jll fttwllt To

Isa< CIC~UiCk • ~..,,,.,,,,

lfC,O~TtVtt I Hon• . ~"""'""""' • f To

• I ... -fi:"'""' CN•p j

fNffl I To I . . :R.tlMY!,

........ E:] NptO'*Y_Nlftlt

.. ... ""-'"' "'~ l!I F-'• H-•nit• Optl,O .QI

FNe FOt'Jllt OU•f'Y RETJ:COMINTf!Z02911n ~ Ottcnf:OQll l ·-rttt,oimOllt., 1 SIIUIU' Otffl It

s.ro,, Strll'I Q • SmanF onn

Z.on,cr S•1rth F1, 10,4 SHrcri

.JI OC Fletcf form :d


(U) As you type the terms into a fo1m the native rendition of the term will be displayed above the field for information and feedback purposes.

(U) When using forms associated with RW, if you type something incon·ect, the feedback will tum red, ale11ing you to the fact that the term needs to be fixed in some way. ;...-Enter FISA target case notations in the fields/

blanks.


' UIS "-'~ ......... l(h I cl!IOI (mod!lfitd) ~I ®

... ... .Qu.ry a ea rch tl • lp

r~ ~~ _!]~ _!1! ~ Sf"'1'11W!ffllkn

NIQI~ jOSOf!Su.tH J QtWg. ~J!,•tM(Httto In SU . I OAt S•ttoofl Out,,..-..O<IJl!Ofl

$twP>(~ " PIHWAU!,..OISSEM .,. ..,.,. .. .. ,, ... PSC.T•ct .

Stl •UI l'l'S'I Full SH rCh . to,:111$1>¢-'!M!I R•mov• LH IS

ijtlr- -aaiu . "" • "' ir·=" "" $tOtl RHlllt To Ck~\lkl • t'fO'-'nlE,tJtt

~ITOV&f .... • '"""""'"" . -~-~ vi.- •-or. •- FA a I To ... s '

. . 111.em,w•I

$,rt01n liJ ,...~,~-· ..

...C..~111 d' .r Iii ... ll ·b\' • OPooat 'Offll' ~ TOP Sl CFIETJfCOMINTtn0::29112:J

OOK H._a:!~"10 ,n $t• ~,a\ (Ollt-<t1 ...

~ flh111tl

,_,, 1 OOCUMEHT • . '

.. ... . .... · .~ l .. . -·. - !~~-':~ ·-····i" . ~Ot'O-U1U OtOOisa I ~ t

" ...


• (U) The Validate button runs all queries through a basic syntax check.

• (U) Pop-up window activated to show IS Valid or Has Errors

• (U) Best way to validate a query is to use the Validate command on the query form's Options menu.


StJIUI Ef\!IM

St~Tfl>II

8tHMwt l~

l+gCIRti~TO'

,-,lltltOUM'

F

... ...... s

,o.v,,

:::::J 2e$1'.1"'*'" 1i1 n •p •lu ,,.J~•

tl!#tALI _Ol.1$1:M "'

,~11 sear,ci, • OH

...

•

0Vfl'l'\'*laocrt s-.., ns.t,.p11111 ,rw) CoSMS•

..... ••• ....

TOP SECRET//COMINTIREL TO USA, AUS, CAN, GBR, NZU/20291123

i,,r,

27

• (U) Easiest way to save your search and queries at the same time is to click the Save button on the toolbar. There are other ways but this is the most efficient.


Submit Search • (U) This function can not be accomplished untillour

queries have been va lidated and optiona lly save . • (U//FOUO) The submitted search then goes through

four phases - Queued - Sub1nitted - Rtu1ning - Getting results to co1nplete

Checking the Hits • (U) Once the search is complete the Hit Count and items

cofumn next to the query folders wi ll be popu lated with the results .

• (U) If you don't see results then refresh the Folder 1nanager


• (U) Currently there are 700 fields that you as an analyst/linguist can select from to assist you in search of your target. Keep in mind that you can take and setup as many MDV layouts as you desire to suit the needs of the target that you are doing your research /analysis on.


• (U) The Metadata Viewer or as it is commonly called the (MDV) is where the results set their metadata.

• (U) Results are stored in an ORACLE database and are linked to a contai11er folder in the UIS Folder Manager.

• (U) To load the results from metadata for a Query, simp ly select the query folder and double click. Note : You may load mult iple results into the MDV simply by CTRL-selecting n1ultiple query folders before applying the load function.

• (U) Keep in n1ind that when loadiI1g documents it can take as short as a few second or longer depending on the actual number of results and the search engine that was being used.


• (U) By using the MDV sorting can be as si1nple as the ordering of a coltunn of data in ascending or descending order, or as con1plex as sorting a partial or full set of results using 1nultiple fields.

• (U) Sorting can be useful for such tasks as analyzing events in chrono logical order and or finding anomalies in target communication profi les.

- - ... ... 20070227:13:37 :0 0 :000

20070 227: 1~ :13 :00:000 20010227: 1, : l S: OO:OOO 200702 27 : 23:58 :00 :000 20070228 :0S :5 3:00:000 200702 28:22:53 :0 0 :000 ~nn~n,,~ ., , . ~~ ·nn,nnn


• (U) PINWALE Tip of the Week (E-mail) • (U) Tip of the Week also announces dates

and times for upcoming: >PINWALE Query Walk-in Service >PINWALE Users Group Meeting >PINWALE Training Sessions

• (U) NCS Training dates and times also found in the tip of the week

• (U) You need to request to be on this mailing list. (DL NEXHELP)


• (S//SI) Problems with interpreting or identifying your traffic? >You can see your target's e-mail , but don't

recognize the traffic >(C //SI) Send your questions to DL

CTSAMPLES with only the PINWALE ID


• (U//FOUO UIS Hel ? ).>Contact ).>E-mail: DL UIS HELP

• (U//FOUO PINWALE Help? ).> Contact ~ E-mail: DL NEXHELP


• (U) Create PINWALE_DISSEM query

• (U) Load Query Results

• (U) Customize MDV


(u) transnational dni training

Documents