June 29, 2019

The NSA's regional Cryptologic Centers



For many years, the US National Security Agency (NSA) was identified with its almost iconic dark-glass cube-shaped headquarters building at Fort Meade in Maryland.

Only when Edward Snowden stepped forward in 2013, the public learned that there's also a large NSA facility in Hawaii - which is actually one of four regional centers spread across the United States.

- History of the NSA's Cryptologic Centers

- Cryptologic Centers inside the US: Hawaii - Georgia - Texas - Colorado

- Cryptologic Centers outside the US: Europe - Afghanistan




History of the NSA's Cryptologic Centers

The history of the NSA's regional operation centers is described in the 60th Anniversary Book of the agency from 2012:

"In the 1970s and 1980s, NSA leadership grew concerned over the centralization of functions at Fort Meade. Partially prompted by the need to find adequate space for its personnel and equipment, the Agency began to look at moving some assets away from the Fort Meade area.

In this light, in 1980 a Remote Operating Facility (ROF) at Kunia was established on the Hawaiian island of Oahu. Although living costs were high there, Kunia had the advantage of proximity to the Commander in Chief, Pacific (CINCPAC).

In the late 1980s, the cryptologic leadership began developing the Regional Security Operations Center (RSOC) concept. Proven computer and communications technology allowed NSA to delegate SIGINT authority to these regional centers, thus avoiding an overconcentration in the Washington area.

Under the RSOC doctrine, each center would be "hosted" by one of the military services so that all services could be represented.

In 1995 the centers opened and NSA began to transfer missions to them. The Kunia facility was given a new status as an RSOC.

Over the next decade, the RSOCs evolved from limited operations centers into mini "regional NSAs" in Georgia, Texas, Hawaii and Colorado with the following mission benefits:
• Consolidation of cryptologic operations
• Dispersion of facilities from the Washington, D.C. area
• Capability of serving as alternate communications centers
• Representation of all military services.
The concept of "regional NSAs" was reinforced when NSA suffered a massive computer outage early in 2000, and the RSOCs, as components that could operate independently, picked up the essential missions until NSA was back in full operation. Today all four centers, now known as Cryptologic Centers, are operational, expanding, and provide redundancy in the event of an emergency.



Cryptologic Centers inside the US

Officially acknowledged and listed on the NSA's official website are the four Cryptologic Centers which are located inside the United States. Especially those in Hawaii, Texas and Georgia are fairly large facilities with a few thousand employees each and consisting of both operations and data centers.

The Cryptologic Centers in Hawaii, Texas and Georgia each cover a geographically defined part of the earth, while the Cryptologic Center in Colorado is responsible for air and space based collection systems.


NSA/CSS Hawaii (NSAH)

- Established in 1980 as a Remote Operating Facility (ROF), which was turned into the Kunia Regional Security Operations Center (KRSOC) in 1995 and became a Cryptologic Center in 2005. Initially located in the Kunia Tunnel complex in Honolulu, Hawaii.

- Currently located in the Joseph J. Rochefort building, a $ 358 million and 250,000 square-foot complex near Wahiawa in Honolulu that was opened in January 2012.

- Hosted by the US Navy.

- About 3300 military and civilian employees.

- Area of responsibility: the Pacific Rim and Far East, Southeast and Southwest Asia.

- Supports the Indo-Pacific Command of the US Armed Forces.

- SIGAD: USJ-750

- See also: Wikipedia - Cryptome - Cryptome - CBS News


The Joseph J. Rochefort Building of NSA/CSS Hawaii in Honolulu, Hawaii (2019)
(still from CBS News - click to enlarge)



NSA/CSS Georgia (NSAG)

- Established in 1995 as the Ft Gordon Regional Security Operations Center (GRSOC) and turned into a Cryptologic Center in 2005. Initially located at Fort Gordon in Augusta, Georgia.

- Currently located in the John Whitelaw building, a $ 286 million and 604,000 square foot complex that was opened in March 2012.

- Hosted by the US Army

- Some 4000 employees

- Area of responsibility: Europe, North Africa, the Middle East, the Near East and the Persian Gulf.

- Supports the European Command and the Central Command of the US Armed Forces

- NSAG also includes the alternate National Security Operations Center (NSOC, project DECKPIN) which serves as a back-up for the NSOC at NSA headquarters.

- SIGADs: USN-18 and USJ-800

- See also: Wikipedia - Cryptome - SIDtoday


The John Whitelaw Building of NSA/CSS Georgia at Fort Gordon (2012)
(photo: NSA - click to enlarge)



NSA/CSS Texas (NSAT)

- Established in 1995 as the Medina Regional Security Operations Center (MRSOC) and turned into a Cryptologic Center in 2005. Initially located on the Medina Annex of Lackland Air Force Base near San Antonio, Texas.

- In 2005, the NSA acquired a former Sony chip fabrication plant in the Northwest Side of San Antonio for $ 30.5 million and invested as much as $ 300 million to transform the 470,000 square feet complex into the current Texas Cryptologic Center (TCC).

- Hosted by the US Air Force.

- Probably some 6000 military and civilian employees.

- Area of responsibility: Middle and South America, the Caribbean and the Atlantic littoral of Africa.

- Supports the Southern Command and the Central Command of the US Armed Forces.

- SIGADs: USN-26 and USJ-783

- See also: Wikipedia - Cryptome - Cryptome


NSA's Cryptologic Center in San Antonio, Texas (2013)
(photo: William Luther - click to enlarge)



NSA/CSS Colorado (NSAC)

- Established around 2002 as the Denver Security Operations Center (DSOC) and turned into a Cryptologic Center in 2005.

- Initially located in temporary buildings at the Aerospace Data Facility at Buckley Air Force Base in Aurora, near Denver, Colorado. In 2012, a new $ 141 million building was planned to provide space for 850 NSA employees .

- NSA's primary production center for Weapons and Space (W&S) targets and Technical Signals Intelligence (TechSIGINT).

- Co-located with the joint NSA-NRO Overhead Collection Management Center (OCMC) which manages spy planes and spy satellites.

- SIGAD: USJ-751

- See also: Wikipedia - SIDtoday - SIDtoday


The Aerospace Data Facility at Buckley Air Force Base in Aurora, Colorado
(click to enlarge)


Shore support

According to a document from the Snowden cache, the Cryptologic Centers in Hawaii, Texas and Georgia also have a Fleet Information Operation Centre (FIOC), each of which include a Maritime Cryptologic Integration Centre (MCIC).

These MCICs are responsible for so-called cryptologic shore support: providing technical SIGINT information to cryptologic teams embarked in mobile sea, air and land units. A fourth MCIC is based at RAF Digby in Lincolnshire in the United Kingdom.


Cyber defense

The Cryptologic Centers not only process and analyze collected data, but also include a regional NSA/CSS Threat Operations Center (NTOC). These combine the NSA's Signals Intelligence (SIGINT) and Information Assurance (IA) missions in order to detect cyber threats against vital computer networks of the US Defense Department.

It was at the NTOC of the Cryptologic Center in Hawaii that Snowden had his last and only analytical job as an infrastructure analyst tracking Chinese hackers.


Hacking operations

As described in several editions of the internal newsletter SIDtoday, the NSA's hacking division TAO started to conduct Computer Network Exploitation (CNE) operations also from the cryptologic centers, first in 2004 in Hawaii, followed in 2006 by Texas and Georgia. In 2008, NSA/CSS Texas had some 60 TAO operators, a number that was planned to rise to 270 in 2015.



The TAO hacking unit at the NSA/CSS Texas Cryptologic Center
(source: NSA Texas presentation - click to enlarge)



Cryptologic Centers outside the US

Not officially acknowledged are the Cryptologic Centers which are located outside the United States. From the Snowden revelations we know the existance of the following two centers, which are much smaller than those inside the US and also process and disseminate data and information from the NSA's Second and Third Party partners.


European Cryptologic Center (ECC)

- Established in April 2004 as the European Security Center (ESC) and turned into the European Security Operations Center (ESOC) in July 2006. In May 2011 it became a Cryptologic Center and got its own NTOC.

- Initially located at the Dagger Complex of the US Army outside Griesheim, near Darmstadt in Germany.

- In 2016, the ECC moved to the newly built $ 91 million Consolidated Intelligence Center (CIC) with a $ 30.4 million Information Processing Center (IPC) at the Lucius D. Clay Barracks near Wiesbaden in Germany.

- Hosted by the US Army Intelligence and Security Command (INSCOM).

- Some 240 military and civilian personnel (in 2011).

- Operations focused at counter-terrorism and supporting military operations in the Middle East and North Africa (MENA).

- Supports the European Command and the Africa Command of the US Armed Forces.

- SIGADs: USM-44 (ESC) and USJ-753

- See also: Wikipedia - Electrospaces.net


The European Cryptologic Center (ECC) near Griesheim in Germany (2014)
(Photo: AP - click to enlarge)



Afghanistan Regional Operations Cryptologic Center (A-ROCC)

- Established in October 2009 and fully operational in the Winter of 2010.

- Located in 17,000 square-foot office spaces at Area 82 of Bagram Airfield north of Kabul in Afghanistan.

- Over 250 employees, 120 of whom linguists (in 2009), including personnel from all countries participating in the Afghanistan SIGINT Coalition (AFSC).

- Supports US and Coalition forces throughout Afghanistan.

- See also: SIDtoday - The Intercept


The buildings of the A-ROCC at Area 82 of Bagram Airfield near Kabul (2010)
(source: GCHQ presentation - click to enlarge)


There may be other, smaller Regional Operations Cryptologic Centers (ROCCs) as before the large A-ROCC was established there was a ROCC in place since 2005 mainly supporting the Regional Command-East of ISAF.