Echelon's Project 415 Design & Codeword's

ECHELON and its existence dating back 50 years was the gathering of SECRET unauthorized information of personal communications on prominent U.S. government officials. According to the Snowden leaks, U.S. operated stations also exist in countries outside the Five Eyes, including Brazil, Germany, India, Japan, and Thailand. Stations operated by GCHQ and Australian intelligence exist in Cyprus, Kenya, and Oman. All the information collected globally is processed and sent to NSA headquarters in Fort Meade, Maryland, where it is filtered before the agency decides what it feels comfortable sharing with the other nations involved in the program.

Pine Gap surveillance facility, located near Alice Springs in Australia’s Northern Territory. Codenamed RAINFALL, this base is a main hub of cell phone geolocation, supposedly necessary to more precisely track terrorist targets with drone strikes. Though the sentiment of drone operators doesn’t seem to support this alleged precision. Instead of targeting specific people based on traditional intelligence, the program targets the SIM cards of cell phones. This has proven to be an unreliable tactic that often results in the death of innocent civilians.

ECHELON activity was originally at the Army’s Yakima Training Facility in Washington. But that location has since moved to Buckley AFB in Colorado, home to more extensive infrastructure with supercomputers able to process the copious amounts of data collected there. TRUMPET, MERCURY, and MENTOR are the codenames given to these satellites believed to be in geosynchronous orbit collecting SIGINT.

U.S. launched several, billion-dollar satellites to intercept signals transmitted into the atmosphere that would normally diffuse into space. These satellites, though classified, are said to have 300 ft. diameter umbrellas and are put into highly elliptical orbits to capture signals from the largest possible area. It is believed the U.S. launched several of these satellites since the early 90s, in order to intercept broadcasts with the ostensible purpose of monitoring ballistic missile flight telemetry.

These satellites are able to intercept and relay every signal type for the NSA’s surveillance needs. This includes COMINT, communications between people; ELINT, electronic signals other than voice, such as radar, satellite, telemetry; MASINT, the signatures of electronic instruments; and FISINT, electromagnetic emissions from testing of foreign aerospace, surface and subsurface systems.

Encryption software is the first step to protect one’s privacy, while understanding that sensitive material shouldn’t be presumed safe. Unless extreme measures are taken, assume your communications are being listened to and take the appropriate measures.
If nothing is done to put an end to this type of unfettered surveillance, we may find ourselves in a police state, in which private matters could be used as blackmail or worse, privacy no longer exists.

TRANSIENT, targeted the Soviet Union's new Molniya [молния or "Lightning"] communications satellites. These were used for military and government communications.  The second part, ECHELON, targeted the west's planned Intelsat satellites. These satellites were to be built and run by a consortium of western countries, the International Telecommunications Satellite Organisation (Intelsat). Intelsat satellites were and are used for TV broadcasts and for private, government and commercial communications.

The parallel existence of the TRANSIENT and FROSTING satellite surveillance program has been unknown to historians and intelligence experts. The ECHELON system in 1988 as the world's first global mass communications surveillance system. TRANSIENT, for all efforts against Soviet satellite targets, and ECHELON, for the collection and processing of INTELSAT communications". The full story, and the documents, are in the Intercept.

The starting point of global mass surveillance is now documented and on the record. At the height of the Cold War, ECHELON's job was "to collect, process and forward selected International Common Access telegraphy [telegrams and telex], voice, and facsimile signals relayed over the [Intelsat satellites] to NSA for analysis and reporting].

All this took place before illegal NSA cable surveillance and intelligence operations were uncovered by the Watergate enquiries of 1973-1974. Even as the first Watergate enquiry began, ECHELON was expanding, the documents reveal. The second ECHELON site, at Yakima near Seattle started operations on 4 May 1973, and achieved "full operational capability" on October 1974. It intercepted communications carried on the Pacific Ocean region Intelsat satellite.  The stations were managed from a "Terminal Operations Control" at NSA headquarters, using communications networks called STARBURST and OCEANFRONT.

Before being forwarded to NSA, intercepted messages were first fed to a powerful (for its era) mainframe computer, a Univac 1108, for selection and sorting. Univac claims that the 1108 was the first ever general purpose multiprocessor system.


The networks and systems from the 1960s which started here continue 50+ years later, with volumes and surveillance capabilities multiplied to a level unimaginable then. Parallel operations for targeting western and Soviet Bloc satellites have now been merged into a global "FORNSAT" system, illustrated in many Snowden documents.

Dictionary tools are "still used today by many Digital Network Intelligence (DNI) systems", in combination with software selection tools such as the XKEYSCORE system for global internet surveillance and analysis, to provide "high-speed content filtering, selection; and forwarding capabilities". A longstanding component of NSA surveillance dictionaries, called CADENCE, joins the "days of telegraphy" to the modern era of ultra high speed communications:

"The CADENCE system fully automates the Front-End Dictionary Management process to filter and select intelligence. Dictionary managers and target analysts can electronically submit, review, and forward dictionary updates to scan traffic for keywords, to execute category rules and to define Boolean and positional equations of keywords." The Dictionary method of selecting surveillance information of interest, and the ECHELON "routing tokens" method to forward selected intercepts to requester's were still being used in 2010, according to one of the documents provided by Edward Snowden.


Yakima Research Station
The satellite target can be seen to be Intelsat IV. After signal processing , intercepted messages were automatically selected and fed through JACKKNIFE's Univac 1100/72 computer processor and relayed to NSA.


Project 415 is a top-secret new global surveillance system. It can tap into a billion calls a year in the UK alone. Access to full details of Menwith Hill operations from a position as software manager for more than a dozen VAX computers at Menwith which operate the ECHELON system.

The largest overseas station in the Project P415 network is the US satellite and communications base at Menwith Hill, near Harrogate in Yorkshire. It is run undercover by the NSA and taps into all Britain's main national and international communications networks.

Among important stations being developed in the new P415 network, sources indicated, are Bude in Cornwall, mainly run by GCHQ, Bad Aibling in Germany, and two sites in the People's Republic of China (which are used only for monitoring the USSR). The western intelligence agencies have not yet resolved the question of how to replace the recently upgraded British intelligence listening station at Chung Hom Kok in Hong Kong (which at the moment listens to China itself) when the colony is handed back to China next decade. Other than the ECHELON computer network, the main projects at Menwith Hill are code-named SILKWORTH, MOONPENNY, SIRE, RUNWAY and STEEPLEBUSH. The station also receives information from a satellite called BIG BIRD.

Project SILKWORTH is, according to signals intelligence specialists, the code-name for longrange radio monitoring from Menwith Hill. MOONPENNY is a system for monitoring satellite communications; RUNWAY is thought to be the control network for an eavesdropping satellite called VORTEX, now in orbit over the Soviet Union. The base earlier controlled a similar series of satellites called CHALET. The new STEEPLEBUSH control centre appears connected with the latest and biggest of the overhead listening satellites. These are codenamed
MAGNUM, according to US intelligence sources.

BIG BIRD, which is not usually connected with Menwith Hill, is a low-orbiting photographic reconnaissance satellite. But investigators have worked out, from details of the clearances necessary to know about BIG BIRD, that this satellite-and indeed, many other satellites, variously disguised as "weather satellites"-also carry listening equipment. One such sigint package is said to have been aboard the doomed space shuttle Challenger, despite its ostensibly civilianpurpose.

Referred only to a "classified location", the base can be identified because of references to STEEPLEBUSH. According to this testimony, the new STEEPLEBUSH II project costed $15 million to 1993. The expansion is required to avoid overcrowding and "to support expanding classified missions".


Another major support for the ECHELON system is the US spy satellite network and its corresponding reception bases scattered about the UKUSA empire. These space-based electronic communications "vacuum cleaners" pick up radio, microwave and cell phone traffic on the ground. They were launched by the NSA in cooperation with its sister spy agencies, the National Reconnaissance Office (NRO) and the Central Intelligence Agency (CIA).  The Ferret series of satellites in the 1960s, The Canyon, Rhyolite and Aquacade satellites in the 1970s
The Chalet, Vortex, Magnum, Orion, and Jumpseat series of satellites in the 1980s, and then Mercury, Mentor and Trumpet satellites during the 1990s.


STEEPLEBUSH - Completed in 1984, this $160 million system expanded the satellite surveillance capability and mission of the spy station beyond the bounds of the installation that began in 1974.

RUNWAY - Running east and west across the facility, this system receives signals from the second-generation geosynchronous Vortex satellites, and gathers miscellaneous communications traffic from Europe, Asia and the former Soviet Union. The information is then forwarded to the Menwith Hill computer systems for processing. RUNWAY may have recently been replaced or complemented by another system, RUTLEY.

PUSHER - An HFDF system that covers the HF frequency range between 3 MHz and 30 MHz (radio transmissions from CB radios, walkie-talkies, and other radio devices). Military, embassy, maritime and air flight communications are the main target of PUSHER.

MOONPENNY - Uncovered by British journalist Duncan Campbell in the 1980s, this system is targeted at the communication relay satellites belonging to other countries, as well as the Atlantic and Indian Ocean Intelsat satellites.


KNOBSTICKS I and II - The purpose of these antennae arrays are unknown, but they probably target military and diplomatic traffic throughout Europe.

GT-6 - A new system installed at the end of 1996, GT-6 is believed to be the receiver for the third generation of geosynchronous satellites termed Advanced Orion or Advanced Vortex. A new polar orbit satellite called Advanced Jumpseat may be monitored from here as well.

STEEPLEBUSH II - An expansion of the 1984 STEEPLEBUSH system, this computer system processes information collected from the RUNWAY receivers gathering traffic from the Vortex satellites.

SILKWORTH - Constructed by Lockheed Corporation, the main computer system for Menwith Hill processes most of the information received by the various reception systems.


As the electronic signals are brought into the station, they are fed through the massive computer systems, such as Menwith Hill’s SILKWORTH, where voice recognition, optical character recognition (OCR) and data information engines get to work on the messages. These programs and computers transcend state-of-the-art; in many cases, they are well into the future. MAGISTRAND is part of the Menwith Hill SILKWORTH super-computer system that drives the powerful keyword search programs.


One tool used to sort through the text of messages, PATHFINDER (manufactured by the UK company, Memex), sifts through large databases of text-based documents and messages looking for keywords and phrases based on complex algorithmic criteria. Voice recognition programs convert conversations into text messages for further analysis.


One highly advanced system, VOICECAST, can target an individual’s voice pattern, so that every call that person makes is transcribed for future analysis.  Processing millions of messages every hour, the ECHELON systems churn away 24 hours a day, 7 days a week, looking for targeted keyword series, phone and fax numbers, and specified voiceprints. It is important to note that very few messages and phone calls are actually transcribed and recorded by the system.

The vast majority are filtered out after they are read or listened to by the system. Only those messages that produce keyword “hits” are tagged for future analysis. Again, it is not just the ability to collect the electronic signals that gives ECHELON its power; it is the tools and technology that are able to whittle down the messages to only those that are important to the intelligence agencies.

Each of these station dictionaries are given codewords, such as COWBOY for the Yakima facility and FLINTLOCK for the Waihopai facility. These codewords play a crucial identification role for the analysts who eventually look at the intercepted messages. Each message flagged by the ECHELON dictionaries as meeting the specified criteria is sorted by a four-digit code representing the source or subject of the message (such as 5535 for Japanese diplomatic traffic, or 8182 for communications about distribution of encryption technology,)  as well as the date, time and station codeword.

Also included in the message headers are the codenames for the intended agency: ALPHA-ALPHA (GCHQ), ECHO-ECHO (DSD), INDIA-INDIA (GCSB), UNIFORM-UNIFORM (CSE), and OSCAR-OSCAR (NSA). These messages are then transmitted to each agency’s headquarters via a global computer system, PLATFORM, that acts as the information nervous system for the UKUSA stations and agencies. Every day, analysts located at the various intelligence agencies review the previous day’s product. As it is analyzed, decrypted and translated, it can be compiled into the different types of analysis: reports, which are direct and complete translations of intercepted messages; “gists,” which give basic information on a series of messages within a given category; and summaries, which are compilations from both reports and gists.

These are then given classifications: MORAY (secret), SPOKE (more secret than MORAY), UMBRA (top secret), GAMMA (Russian intercepts) and DRUID (intelligence forwarded to non-UKUSA parties). This analysis product is the raison d’être of the entire ECHELON system. It is also the lifeblood of the UKUSA alliance.

[Extra Details Below]

ANCHORY - NSA software system which provides web access to textual intelligence documents

AQUACADE - A class of SIGINT spy satellites (formerly RHYOLITE)

AZUREPHOENIX - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program *

BATON - Type 1 Block cipher algorithm, used with many crypto products

BOXINGRUMBLE - Network attack that was countered by QUANTUMDNS * ISLANDTRANSPORT (IT) - Internal data distribution system, also used for QUANTUM * * IVORY - Retired SIGINT product codeword SURPLUSHANGAR (SH) - High to low diode, part of the QUANTUM system *

BUCKSHOT YANKEE - Operation to remove the computer worm Agent.btz from infected classified and unclassified DoD networks (2008-2009) *

CAKEBREAD - Codename for Osama bin Laden

CATALYST - Computer system capable of automatically analyzing the massive quantities of data gathered across the entire intelligence community *

CARILLON - Complex of five IBM-370 (or 360, later four IBM 3033s) high performance computers strapped together at Fort Meade, for a mostly traffic analytic process (1973)

COMFY LEVI - C-130s with roll-on SIGINT suites (1968-?)

CORALREEF - Database for VPN crypto attack data *

CORONA - A series of photographic surveillance satellites (1959-1972)

CO-TRAVELER - Set of tools for finding unknown associates of intelligence targets by tracking movements based upon cell phone locations *

CRANKSHAFT - Codename for Osama bin Laden

CROSSHAIR - Multinational High-Frequency Direction-Finding (HF-DF) network (formerly BULLSEYE)

DRYAD - A US military numeral cipher/authentication system

EQUATION (Group) - Nickname given by Kaspersky to a highly advanced computer hacking group, suspected of being tied to NSA *

EYESPY - System that scans data for logos of companies, political parties and other organizations, as well for pictures with faces for facial recognition *

FAIRVIEW - Domestic cable tapping program in cooperation with AT&T (since 1985)*

FROSTBURG - Connection Machine 5 (CM-5) supercomputer, used by NSA from 1991-1997

GHOSTMACHINE (GM) - NSA's Special Source Operations cloud analytics platform

GHOSTWOLF - Project to capture or eliminate key nodes in terrorist networks through actionable geolocation intelligence * also related to CT10 *

GRIZZLY STEPPE - Russian malicious cyber activities related to the 2016 US presidential elections

HARVEST - A supercomputer, built by IBM for nearly 10 million US dollar and used by NSA from 1962-1976 *

HEMISPHERE - Program under which AT&T provides telephone records to the DEA

INDRA - Satellite intercept station near Khon Khaen, Thailand (1979-ca. 2000)

ICREACH - Tool for sharing communications metadata among the US Intelligence Community (since 2007)*

JACKPOT - Internal NSA process improvement program (early 1990s - early 2000s) *

JUGGLER - Collection program for internet data *

JUNE - FBI classification marking for information related to unwarranted electronic surveillance and surreptitious entries * JUNIORMINT - Implant digital core, either mini printed circuit board or ultra-mini Flip Chip Module, contains ARM9 micro-controller, FPGA Flash SDRAM and DDR2 memories

KODA - Method for summarizing very large textual data sets

LIONHEART - Traditional search tool for the PINWALE database, searching both content and metadata *

LIONHEART Fusion - Search engine for the PINWALE database, which searches the most recent 13 months *

LIONROAR - Search engine for the PINWALE database, which searches between 13 months and 5 years back *

LIONSHARE - Internal NSA process improvement program (2003-2008) *

MAGIC - Codeword for decrypted high-level diplomatic Nazi messages

MARINA - NSA database of bulk internet metadata; succeeded by CLOUDRUNNER in 2013? *

MESSIAH - NSA automated message handling system

META LION - Search tool for the PINWALE database, queries metadata only (since 2005) *

MYSTIC STAR - Presidential Global Communications System

NEPTUNE SPEAR - Operation to kill or capture Osama bin Laden (2011)

NINJANIC - Something related to TURMOIL *

NYMROD - Automated name-matching and recognition system (since 2008)*

OBELISK - Codename for Al Qaeda’s network of websites and servers *

OWL - Some kind of file system? *

PURPLE DRAGON - US military OPSEC program (since 1966)

PUZZLECUBE - TAO division tasking tool

QUADRANT - A crypto implementation code

QUADRESPECTRE PRIME - ?

QUANTUM - Secret servers placed by NSA at key places on the internet backbone; part of the TURMOIL program *

QUANTUM LEAP - CIA tool to "find non-obvious linkages, new connections, and new information" from within a dataset *

QUARTERPOUNDER - Upstream collection site

RAMPART-X (RAM-X) - Program for collecting information from Afghanistan *

ROGUE - Cryptanalytic computer from the early 1950s, the first using remote terminals connected to a central processor *

SIGSALY - The first secure voice system, used during World War II, also known as Green Hornet

SOCIOPATH - Storage and/or distribution system *

SPHINX - Counterintelligence database of the Defense Intelligence Agency

TURMOIL (TML) - Passive SIGINT sensors: filtering and selection (at the packet level) of internet traffic on high-speed satellite, microwave and cable links, part of the TURBULENCE program * * * Maybe also for selecting common internet encryption technologies to exploit.*

VESUVIUS - Prototype quantum computer, situated in NSA's Utah Data Center

XCONCORD - Program for finding key words in foreign language documents

ZARF - Compartment of TALENT KEYHOLE for ELINT satellites, retired in 1999 *