Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Radio Intelligence
Solutions for modern COMINT systems
on the basis of TRS
Company Confidential
MEDAV GmbH
Grfenberger Strae 32-34
91080 Uttenreuth
Germany
+49 9131 583-0
+49 9131 583-11
info@medav.de
www.medav.de
Document
Principles of Radio Intelligence
w713od.0e1 - Version V1.2, 17 July 2013
Author
Volkhard Thoelke
Copyright
This document is protected by copyright laws.
Trademarks
For better legibility, in this document marking of trademarks is waived. This should not mislead to
the assumption that these trademarks are to be used freely by anybody.
Contact for Errors or Complaints
When editing this document, greatest importance was attached to completeness and correctness.
Even so, if you find an error or incompleteness, please contact
MEDAV GmbH, +49 9131 583-0, info@medav.de
The document is subject to change without prior announcement.
Page 2/58
w713od.0e1
Company Confidential
Contents
List of diagrams ....................................................................................................................................... 4
1.
2.
1.2.
2.2.
2.3.
Structure ............................................................................................................. 15
2.4.
Tasks/functions................................................................................................... 18
2.4.1.
2.4.1.1.
2.4.1.2.
Search ................................................................................................................ 19
2.4.1.3.
2.4.1.4.
Acquisition/Processing ....................................................................................... 26
2.4.1.5.
2.5.
2.5.1.
Overview............................................................................................................. 31
2.5.2.
2.5.3.
2.5.4.
2.5.5.
2.6.
3.
2.6.1.
2.6.2.
2.7.
2.8.
2.9.
3.2.
3.3.
Hardware errors.................................................................................................. 52
3.4.
3.5.
Configuration ...................................................................................................... 53
3.6.
Boot process....................................................................................................... 54
3.7.
3.8.
Scheduling .......................................................................................................... 55
3.9.
3.10.
3.11.
Maintenance ....................................................................................................... 57
w713od.0e1
Page 3/58
Company Confidential
List of diagrams
Figure 1: Radio intelligence an important source of intelligence .......................................................... 7
Figure 2: Overview of radio intelligence ................................................................................................ 16
Figure 3: Overview of IG ........................................................................................................................ 18
Figure 4: IG - searching ......................................................................................................................... 22
Figure 5. IG - Acquisition/Processing ................................................................................................... 27
Figure 6: An overview of IP .................................................................................................................. 32
Figure 7: IP pre-processing ................................................................................................................ 33
Figure 8: IP preliminary analysis ........................................................................................................... 36
Figure 9: Analysis and reporting ............................................................................................................ 38
Figure 10: Military COMINT / radio intelligence ..................................................................................... 41
Page 4/58
w713od.0e1
Company Confidential
w713od.0e1
Page 5/58
Company Confidential
Mobile communications are only possible using radio technology. This covers a wide spectrum of
radio services and frequency ranges, from HF radio to satellite radio, and more recently, following
the introduction of wireless data transmission systems, even the use of LAN technology (WLAN).
All of these should be the targets of intelligence gathering.
Radio intelligence, which is generally of a passive nature, and hence cannot be detected by the
enemy, can be used to identify the enemys command and control links, and in many cases,
penetrate these links as unauthorised users. However, the usage habits and rules vary greatly
according to the type radio service or the (user) organisation. Consequently, the methods and
equipment used to detect command and control links and gather intelligence relevant to the
mission also vary greatly. The requirements in terms of reconnaissance technology and
reconnaissance personnel are correspondingly high.
The following chapters endeavour to provide a comprehensive overview of radio intelligence (RI)
and to describe the tasks, methods and diverse functional areas in a process-based and general
manner. It is not be possible to go into detail with regard to the numerous methods and strategies
for the acquisition and evaluation of the wide variety of possible communications/signals relevant
to the mission in radio intelligence. This goes beyond the scope of this work and would also violate
the provisions of national security.
Chapter 2.5 deals exclusively with military radio intelligence and its special features plus the
aspects
it
has
in
common
with
the
radio
intelligence
employed
in
other
national
organisations/services.
Page 6/58
w713od.0e1
1.1.
Company Confidential
Intelligence generally exploits a wide variety of potential sources. These range from human
sources (HUMINT) right up to airborne or satellite photographic and radar intelligence (IMINT,
SATINT, etc). Within this broad spectrum encompassing the most diverse range of tasks, radio
intelligence represents one important cornerstone of communications intelligence (COMINT).
w713od.0e1
Page 7/58
Company Confidential
1.2.
As mentioned, radio intelligence obtains information on the enemy from the enemys radio
communications. Therefore, a basic precondition for this type of intelligence is to find and acquire
the radio communications. In addition to reception, the acquisition task also includes rendering the
signal useful for analysis, to obtain information on the enemy within the remit of the
reconnaissance mission.
This basic task is dependent upon numerous factors:
physical parameters, such as frequency, distance to the emitter, time of day/year
(especially in the HF range), reception level, quality of the radio channel, etc.
operational or technical factors, such as transmitter emission direction, transmit level,
type of radio service, transmission mode, encryption etc.
strategic factors, such as the potential own resources, means of camouflage and hence
possible proximity to the enemy, duration of the acquisition mission, manned or unmanned
use of the reconnaissance technology, etc.
The results of the acquisition and the information directly produced from this are consequently very
different. Frequently, the only intelligence obtained is on the operational parameters of the radio
communications. This is generally the case with encrypted traffic. Nevertheless, when interpreted
correctly, operational findings can also provide information on the strategic background that gave
rise to the radio communications. Such findings are also important for supplementing or updating
ones own target knowledge. This target knowledge is in turn a basic precondition for successful
radio intelligence as it provides decisive (advance) knowledge and hence assists in the detection,
classification, processing and analysis of the radio traffic relevant to the mission.
In conjunction with the target knowledge and supplementary information from other sources,
experienced analysts can often use operational parameters of radio communications to deduce
details of enemy structures, objectives, activities and potential capabilities. This underlines the fact
that, although radio intelligence is important, it is still only one source of intelligence. Only the
pooling and joint/ combined analysis of all relevant information from all available sources can
provide a comprehensive and sufficiently reliable picture of the situation.
Here, we should mention an important principle of reconnaissance:
The information and findings obtained from intelligence on objectives, plans, preparation and
performance of activities that pose a threat to security and on the enemys potential capabilities are
exclusively the result of ones own analyses and evaluations. There always remains an
unquantifiable uncertainty factor that necessitates the continuous checking and updating of the
results of the reconnaissance.
Page 8/58
w713od.0e1
Company Confidential
Terms of reference
The basic mission of radio intelligence is to identify from the numerous emissions in the entire
spectrum of possible frequency ranges those radio communications that are important for ones
own reconnaissance and to acquire, process and analyse them with the aim of obtaining the
required information and knowledge about the enemy from this traffic. Particular importance is
attached to the chains of command, that are the enemys command and control links, since these
generally provide important knowledge on the enemys activities and plans and hence can make
an important contribution to ones assessment of the situation.
These terms of reference are not only applicable to intelligence on military organisations/units.
They are equally applicable to intelligence on terrorist or criminal organisations, the only difference
being that the command and control and communication behaviour in these areas is clearly
different from that used by the military and hence sometimes other approaches to acquisition and
analysis are necessary.
However, the basis objective of all radio intelligence is the same in all operations. Its mission is to
gain intelligence from the radio communications of the target groups in question in terms of:
their location (groups or individual) or place of deployment (troops)
their strength, their capabilities/ their potential
their objectives and concrete plans
their preparations and on
the implementation of all actions or measures affecting national security and the
security of national forces.
One of the main tasks in connection with the above targets is the early detection (early
identification) of enemy plans and preparations. If this is successful, there will be time and
opportunity to take appropriate pre-emptive action. This is an important precondition for crisis
management.
In the military field, radio intelligence is also understood as an early warning system with a focus
on tactical events on the battlefield to provide the military commander with important information on
the tactical situation and hence on the threat situation (see also chapter 2.5).
w713od.0e1
Page 9/58
Company Confidential
2.2.
Basic requirements
Page 10/58
w713od.0e1
Company Confidential
The
determination of the direction from which a detected emission is received is therefore a very
effective selection criterion at the start of the signal processing chain. This filter is even
more reliable and effective but also much more complex if it is possible to identify the
location of the majority of the signals (see Chapter 2.4.1.5 for further details).
Direction-finding/bearing and location-finding are also important tools for identifying the
emitters detected, that is in the assignment of the transmitters as belonging to the targeted,
i.e. sought users.
High-capacity computer and storage technology:
Due to the large number of signals and complex processing tasks, the operation of
wideband detection systems has to be automated to a large extent. Automation and the
high number of signals to be classified and processed require a high level of computing
power with a flexible load distribution to enable the system to respond appropriately to the
frequently changing load situations.
Wideband HF detection technology necessitates the intermediate storage of the frequency
interval/range to be processed (time signal). This requirement is met by means of a ring
memory with a high memory depth. The wideband radio intelligence systems from MEDAV
have, as standard, an intermediate storage capacity of several hours.
This dimensioning enables the entire frequency range specified for the mission to be
processed without signal losses. Intermediate storage means that signals classified as low
priority can be processed later and those with an inadequate classification or processing
result can be processed several times (possibly with the assistance of an experienced
operator and suitable analytical tools), until a satisfactory result is obtained.
However, searching for and processing signals in higher frequency ranges
(>30 MHz)
requires other technical approaches and strategies, as the frequency range sought is
generally too extensive for intermediate storage techniques alone(see also Chapter
2.4.1.2).
w713od.0e1
Page 11/58
Company Confidential
Page 12/58
w713od.0e1
Company Confidential
w713od.0e1
Page 13/58
Company Confidential
In addition to their traditional functions, the operators of modern radio intelligence systems
will in future also have to configure and, to a limited degree, manage extremely complex,
networked computer technology and software structures for an extremely wide range of
operational scenarios.
The operators, in particular the gatherers, have to understand the extensively automated
operational sequences in the system (workflow) and be able to interpret the results of the
individual functions correctly and, if necessary, correct them.
The main workhorse used by gatherers and analysts today is the PC, which is used to
control numerous virtual devices, tools and functional sequences.
Gatherers are now primarily concerned with the monitoring and control of the extensively
automated search and acquisition/processing systems. The actual tasks involved in the
gathering of intelligence detection, segmentation, classification and processing of the
signals are performed automatically by the system. However, gatherers/operators must
also be able to investigate on site all signals/transmission modes that the automatic radio
intelligence system is unable to classify and/or process (demodulate and decode) with the
analytical tools available. The aim of this important and demanding task is to determine the
parameters required for automatic further processing and transfer them to the system. If
this is not possible, the signals are recorded with the analytical results achieved and
submitted to an extensive external investigation in a central analytical unit (see also
Chapter 2.4.1.3).
Page 14/58
w713od.0e1
2.3.
Company Confidential
Structure
The basic task of radio intelligence the detection, acquisition and processing of communications
relevant to the mission in all the radio services and frequency ranges used by the enemy also
defines its structure.
Although it is true that the different services and frequency bands determine the procedure,
technology and tools required for the reconnaissance mission in question, the functional
sequences, that is the structure, of radio intelligence are in principle the same.
Figure 2 (page 16) provides a rough overview of this structure and shows the interrelationships and
interdependencies of the main functional areas.
The following is a short introduction to these areas. A more detailed description may be found in
subsequent chapters:
The mission describes the intelligence interest of ones own command and control with its
specific objectives and points of emphasis.
From this, mission control derives the individual measures/missions required to carry out
the mission and forwards them to the organisational units responsible Intelligence
Gathering (IG), Intelligence Processing (IP) and the central reporting department assigned
to mission control.
Mission control monitors performance of the mission and results and, if necessary for the
task in question, assigns supplementary missions to the above-listed organisational units.
Intelligence Gathering is the sensor area of radio intelligence. With the aid of suitable
acquisition and direction-finding technology adapted to the reconnaissance mission in
question, and taking into account the different operational procedures adapted for the
particular terms of reference, IG searches for radio communications relevant to the mission.
If possible IG determines their bearings (or at least provides a rough assessment of the
direction by means of a directional receive antenna) and classifies and acquires the radio
communications (including demodulation and decoding if required). The results are
forwarded/reported in a form suitable for computer processing and analysis. Technical
analysis (TA) is an important special task for Intelligence Gathering. Signals that are
potentially important for the mission, which the acquisition system is unable to classify or
process, are investigated using suitable analytical tools. The object of on site signal
analysis is to identify the reasons for these system malfunctions as soon as possible after
their occurrence and facilitate the processing of signals of this kind by making suitable
modifications to the configuration of the system modules affected. If these attempts are
unsuccessful, the signals are stored and analysed in greater detail in a central analytical
unit by signals specialists with more powerful tools
w713od.0e1
Page 15/58
Company Confidential
Intelligence Processing with its analysis of the raw reports provided by the intelligence
gathering service and other accessible sources is the analytical area of COMINT/radio
intelligence. Usually, this unit also processes reports from the other COMINT units and
analyses them jointly.
The raw/acquired reports prepared by Intelligence Gathering could contain information on
the signalling techniques and/or operational parameters and/or the content of the radio
communications acquired. However, even without any knowledge of the contents of the
radio messages, it is also often possible to obtain important information on the enemy in
question from the operational sequences and relationships with the aid of suitable target
knowledge. In certain cases, special features of the signalling techniques used in the radio
communications can provide important information on the activity of the intelligence targets.
Page 16/58
w713od.0e1
Company Confidential
Ideally, these results are supplemented by detailed knowledge of the enemys plans and
activities if the radio intelligence has been able to obtain direct access to the content of the
transmitted messages (clear text, content of conversations) or if similar results have been
obtained from other sources.
The results of intelligence processing are:
reports with the information obtained on the targeted enemy (individual reports,
group reports, daily reports, etc.)
The messages and reports are usually composed and structured (formatted) in a form
suitable for further processing by computer.
All messages and reports are notified or forwarded to the central reporting section.
The precondition for reliable and efficient analysis is the availability of up-to-date, verified
and comprehensive target knowledge. This must provide as complete and up-to-date a
picture as possible of the targeted enemy with radio intelligence focusing on the enemys
communication behaviour.
w713od.0e1
Page 17/58
Company Confidential
2.4.
Tasks/functions
2.4.1.
Intelligence Gathering
Figure 3: Overview of IG
Page 18/58
w713od.0e1
2.4.1.1.
Company Confidential
Acquisition Control
The reconnaissance mission usually comprises a basic mission derived from the long-term national
security policy and numerous individual missions with specifically targeted subjects or time slots,
determined by current events and developments affecting national interests and ones security
situation. Acquisition Control is then responsible, taking into account the specified priorities, for
defining the (acquisition) missions for the suitable acquisition systems or workstations in
Intelligence Gathering.
Missions of this type are usually valid for one shift of duty or one day, but they may extend for
longer periods. Acquisition Control provides all available and necessary documents for the
performance of the acquisition missions.
These documents are mission-related extracts from the target knowledge and supplementary
databases maintained by IG. They contain all previous communications-related knowledge on the
intelligence target and further helpful data for the configuration of the acquisition systems and the
evaluation of the results of the acquisition.
Acquisition Control is also tasked with monitoring the mission performance and, if required,
correcting or following up the work of individual functional units. To perform this task it has, in
principle, direct (control) access to all important functional units or workstations involved in
searching and processing.
2.4.1.2.
Search
Searching for radio communications relevant to the mission is one of the most important and
demanding tasks of radio intelligence. The productive radio communications relative to the
reconnaissance mission can only provide the required information if they are detected, classified
and processed by the system. Therefore, success and effectiveness are primarily measured
against the probability of acquisition of signals/communications relevant to the mission.
With the large number of active emitters and frequencies/channels, the chance of the radio
communications being found and acquired in time (in particular modern digital transmission
modes, which have to be acquired from the start of the transmission, including the preamble with
the synchronisation or the protocol chat) is primarily dependent upon:
prior knowledge and
the technical capabilities of the search systems/components
w713od.0e1
Page 19/58
Company Confidential
Prior knowledge includes all information on the communications facilities of the selected targets
and their communications habits, such as the main frequencies and modes used, the structures of
the communications relationships and radio networks, their preferred transmission times, call
names/call signs, etc.
Information of this kind is part of the target knowledge and is used for the (pre-) configuration of the
search systems in a way most likely to achieve success.
Ones own technical capabilities are dependent upon:
the degree of automation of the search system. A high degree of automation permits
continuous operation and a sufficient acquisition/classification capacity.
the wideband capability of the (automatic) search systems. Preferably, they should be able
to cover all the frequency ranges used by the targeted radio services. However, by using
suitable scanning modes, comparable results can be obtained with automated search
systems with bandwidths covering only part of the spectrum to be monitored.
the ability of the (automatic) search systems to efficiently reduce the amount of work/data
required for searching and classification. The exclusion at an early stage of detected
signals from further processing by taking into account/correlating the directional information
(obtained by means of directionally selective receive antennas or direction-finding) and
location-finding results (ideal case) or features of signals that are already available as the
result of the detection with the corresponding data/specifications available from the
prior/target knowledge, drastically reduces the number of signals that have to be subjected
to a time-consuming computer classification process in the automated search systems (for
details see Chapter 2.4.1.5).
the ability of the (automated) search systems to classify all signals/modes relevant to the
mission even in the event of a high signal volume.
the capabilities and capacities of the automated search systems to temporarily store the
frequency ranges (time signal) to be processed. In each case this must be done completely
and for a sufficient length of time for the required signal processing (detection,
classification) and for the processing to be applied to the search results (demodulation, if
necessary, decoding). In some circumstances also for any post-processing of the signals
that may be required.
In strategic HF intelligence, it is possible to intermediately store the entire band with a
storage depth of several hours. MEDAV offers according systems.
Page 20/58
w713od.0e1
Company Confidential
In higher frequency ranges (VHF, UHF and above), it is generally no longer possible to
store the entire spectrum to be covered. Here, suitable strategies have to be employed to
enable continuous classification and parallel processing of the greatest possible number of
signals relevant to the mission.
Radio services in the VHF/UHF range and above usually make use of wide areas of the
frequency spectrum. Unlike the HF band, at present it is not possible to completely digitise
and store the frequency ranges used by these services. In this case, it is the receiver
resources and procedure used during the search that determine the chances of detecting
and being able to classify as many radio communications relevant to the mission as
possible. The following approach is one example from the large number of possible search
and acquisition strategies of how, despite the large number of frequency ranges to be
covered, it is still possible to guarantee a high probability of acquisition.
Rapidly scanning wideband receivers search the assigned frequency ranges with a high
speed and detect, measure and segment all detectable signals. If the bandwidth and (if
appropriate) result of segmentation features correspond to the search profile, downstream
wideband receivers record them for a sufficient amount of time for classification. Due to the
limited (propagation) ranges of the radio signals at the location of the reconnaissance
receivers, the signal scenario is generally very clear in these frequency ranges. The
majority of the signals detected may therefore be put into intermediate storage by the
slower downstream wideband receivers in the length required for classification,
notwithstanding the time required for the recording. All signals classified as relevant to the
mission can be sent for processing usually processing chains with traditional drop
receivers.
In the tactical area of military radio intelligence (COMMS ESM), the result of the
classification in conjunction with the directional information frequently triggers a warning
message to the responsible (affected) military commander (see also Chapter 2.5).
The functional process is on principle as follows (see also Figure 4).
w713od.0e1
Page 21/58
Company Confidential
Figure 4: IG - searching
The automated search system receives its search missions with the documents required
for performance.
The automated system detects all emissions in the targeted frequency ranges above
specified threshold levels.
The subsequent spectral signal measurement provides the centre frequencies,
bandwidths and the signal/receive levels.
It is practical to perform the segmentation at this point i.e. the identification of grouped
spectral ranges in the time and frequency domain.
Taking into account the available directional information/direction-finding results (or even
better the locating results), if the search missions contain suitable directional or location
specifications, it is possible to exclude all signals that do not conform to this mission profile
from further processing at an early stage. However, intermediate storage or suitable search
systems/strategies facilitate the classification of all detected signals even without this
direction filter. However, this significantly increases the required computing power and
classification time. It may be assumed that if there is no direction selection, the number of
incorrectly classified signals will rise and this in turn will increase the time required for
checking and post-processing.
Page 22/58
w713od.0e1
Company Confidential
If the signal parameters and features are available from detection and segmentation, all
signals that do not conform to the parameter/feature profile specified in the search
mission can also be excluded from the further processing in a further reduction step.
This option is also available during the further classification process.
All detections conforming to the mission profile are sent for signal classification
(determination of the type of modulation or the transmission mode). The initial findings and
indications have already been provided by detection and segmentation.
However, traditional interactive analytical procedures are not suitable for automatic
classification processes. A much more promising method is a mode forecast derived from
the available prior knowledge (in 70% of all previous cases, the enemy always used mode
xyz) and from the parameters/features obtained during detection and segmentation.
These forecasts are used as the basis for switching suitable demodulators to the signals in
question in the expectation that one of them will provide a positive result.
In the military field, this procedure makes use of tactical radio intelligence (COMMS ESM).
As a rule, only signals with specific (known) signal features are sought and processed.
If a suitable demodulator is found, the signal is generally demodulated in order to perform
automatic mode classification on the basis of the symbol stream. This uses similar
strategies to those used for automatic signal classification.
If the transmission mode/type of modulation including the encoding procedure is uniquely
defined, the signal is transferred, together with the signal and mode parameters required for
the processing, via IG/Acquisition Control to Acquisition/Processing in a pre-specified
message format.
One constant and important task of the search (and hence also processing) is the provision of
information for supplementing and updating the target knowledge. To do so, it is necessary to
systematically survey (using reconnaissance technology) important target areas or target groups
for details of the communications structures and communication behaviour, the type of
communications facilities (supplementary) used and whether any changes to the facilities,
structures and operational principles have been identified (updating). The information obtained is
reported to the analytical unit where it is incorporated in the target knowledge.
However, the search process may also be tasked with identifying possible new targets/target areas
(e.g. in the case of the development of new crisis regions or potential conflicts) in order to provide
suitable target knowledge for future reconnaissance missions. This saves preparation time and
increases the ability of ones radio intelligence forces to make a cold start in the event of possible
future missions to cover these targets.
w713od.0e1
Page 23/58
Company Confidential
In strategic radio intelligence (HF) at least, the wideband capability of the automated search
systems means that there is no longer any need for sophisticated search strategies, such as the
case for example when searching with a limited number of narrowband search receivers. The
frequency ranges to be monitored are virtually contiguous and may be searched for without
interruption by automatic systems. However, this places high requirements on the automatic
classification, signal processing and memory capacity to ensure that even high signal volumes can
be processed (i.e. classified) automatically, with sufficient reliability/quality (high hit rate and low
error rate) and reported with the required signal/procedural parameters for setting the parameters
of the processing components.
In tactical radio intelligence in higher frequency ranges (> 30 MHz) however, it is highly probable
that suitable search strategies will be required in order to be able to detect, classify and process
the highest possible proportion of signals relevant to the mission (see the information on page 24
and 25).
However, wideband search technology does not necessarily exclude the possibility of using
traditional, narrowband search receivers - it may be expedient to use them to supplement
wideband automated search systems:
in order to close frequency gaps with expected low signal volumes for which no wideband
resources are available
or to search for radio communications important to the mission from regions on the
boundaries of the reception technology (in individual cases, the receive level may be too
low for fault-free signal processing in a wideband automatic system, but not for an optimally
tuned narrowband receiver).
2.4.1.3.
Technical Analysis
During searching, signals are frequently detected with techniques and operational parameters that
suggest that they may be extremely relevant to the mission, but which the classifier is unable to
identify, or identify sufficiently reliably, and hence cannot be processed. Signals of this kind are
forwarded with a corresponding analysis mission to Technical Analysis (TA) where they are
investigated and the reasons for the failed/faulty classification determined. The complete signals
are stored in their original form (time signal) for as long as required and can, after successful
analysis and suitable parameterisation in the processing system, be subsequently processed
without signal loss using the results of the analysis.
Technical analysis is an indispensable component of all COMINT systems and hence of all radio
intelligence systems. The integrated high-capacity measuring and analytical tools can be used
(interactively) by suitable personnel to investigate/analyse the aforementioned signals and also
unknown signals using the methods of signal and mode analysis. The task and objective of
Page 24/58
w713od.0e1
Company Confidential
technical analysis is, on the one hand, to determine the necessary signal and mode parameters for
fault-free processing in the case of (in principle) known signals. These results are used for followup control and the assignment of new parameters for the processing components. On the other
hand, in the case of unknown signals, TA is used to precisely determine all the signal features
required for the development of suitable procedures to automatically classify and process these
radio communications.
In addition, experienced gatherers can use technical analytical tools to survey the signal scenarios
in frequency ranges that are potentially relevant to the mission and search for new/unknown
signals that appear to conform to the mission profile from the features identified (free searching at
the search and measuring station).
Another important task for TA personnel usually experienced and specially trained gatherers is
the comparative investigation and classification of individual signals/radio communications
processed by automatic systems, in particular in cases where there is cause to doubt the reliability
of the results. Such comparisons are used to check the automatic search and processing
components and to monitor their efficiency and reliability. Since, in strategic HF intelligence, all
signals are available for hours in the ring-memory; this checking can be performed without
problems and with no time pressure. In higher frequency ranges, it is necessary to record signal
samples of a sufficient length for purposes of analysis.
In the event of systematic deviations, analytical tools can be used to determine the reasons and to
reset the parameters and follow-up the system components in question as appropriate.
Recorded signals that cannot be analysed successfully with the measuring and analytical tools at
the TA workstation (search and measuring station) are forwarded to a central, better equipped and
more scientifically orientated analytical unit where they are investigated in more detail using more
specialised analytical tools/procedures.
The objective of this technical scientific analysis is to determine all the signal and mode features
required to develop suitable procedures to automatically search for and process these signals.
When using wideband technology for searching and processing, the recording and analytical tools
should also have a wideband capability.
w713od.0e1
Page 25/58
Company Confidential
2.4.1.4.
Acquisition/Processing
The task of Processing (from the point of view of signal and mode technology) is the correct
processing of all the signals/radio communications identified by the search classification process
as relevant to the mission. The objective of this processing usually demodulation and, if required,
decoding, in special cases the identification of additionally required signal and operational
parameters is to obtain all accessible information/contents significant for analysis/evaluation from
the intercepted radio communications.
In principle, Acquisition/Processing with its numerous (individual) reports only supplies a multitude
of tiny fragments of signal-specific information regarding the radio operations and/or contents. Only
the sum total of the individual reports supplemented by additional information from other sources
enables the subsequent analysis/evaluation to derive a sufficiently precise and reliable picture of
the strategic relationships, backgrounds and sequences of the intercepted radio communications
from the extensive pieces of partial information.
Functional sequence: (see also Figure 5 on page 27)
The individual acquisition/processing tasks are derived directly from the search result
reports with the parameters derived from detection, segmentation and classification.
IG/Acquisition Control automatically generates the tasks for the numerous processing
channels and controls the allocation of resources. With each individual task, all the settings
required for correct parameterisation of the individual components in the processing chain
in question are provided.
Although acquisition/processing is largely automatic, operators/gatherers do have the
option of intervening in the automatic sequence via their workstation using an MMI tailormade for these tasks (suitable screen masks permitting all required checking and control
functions) for purposes of control or correction.
Depending upon the specifications of the mission management, the wideband (usually in
the HF range) or narrowband (exceptionally in the HF range with special signal/receive
ratios and usually in frequencies higher than HF) receiver resources are controlled with
the required processing components on the basis of the above-listed parameters/settings
and switched to the relevant signals. In special cases (known frequencies and transmission
modes; high priority for complete acquisition) wideband or narrowband processing
resources
may
also
be
permanently
preconfigured
to
such
Page 26/58
w713od.0e1
radio
Company Confidential
Figure 5. IG - Acquisition/Processing
In HF intelligence one decisive advantage of wideband technology, even for processing, is
that all signals in the wideband time signal are stored for a suitably long time. This enables
the processing chains implemented in the wideband chain to be applied to the start of the
targeted signals regardless of the time required for the preliminary classification and
assignment, in each case without signal loss and with complete processing. Technology of
this type can be used to avoid the problematic and undesirable signal losses that occur with
modern digital transmission modes with their preambles, using traditional, narrowband
radio intelligence systems.
Due to the large amount of memory required, this procedure can only be carried out to a
limited extent (if at all) above the HF range.
With the processing task in question, System Control provides each processing channel
with the resources/system components required for complete processing.
With traditional, narrowband technology, an available drop receiver is generally locked
onto the targeted signal by means of an antenna matrix. The required demodulator is either
already integrated in the receiver or located downstream from the IF output. The other
components are used for the further processing of the demodulated signals and divided
according to the type of signal and mode into recording, audio, decoder, modem
components, etc. They are frequently hardwired as hardware components. In the case of
modern computer-based systems, the components are generally implemented as freely
switchable software modules.
w713od.0e1
Page 27/58
Company Confidential
Modern wideband HF search and processing systems such as those developed and
marketed by MEDAV no longer recognise the clear distinction between search and
processing components. The wideband tuner digitised signals are recorded continuously for
several hours in high-capacity ring memories and are available to all search procedures
(detection, segmentation and classification) and processing procedures (demodulation,
decoding) and, if required, signal analysis (technical analysis) without signal losses.
In the case of analogue (non-encoded) procedures (usually voice communications), the
symbol stream of the demodulated signals is sent directly for audio processing. In the
simplest case, this is a recording module that sends the content to a translator familiar with
the language in question with the required time delay. In addition to the voice/non-voice
identification, tried and tested modern language recognition facilities developed by MEDAV
can also identify the language being used. This facilitates the automatic assignment of
voice recordings to the correct translator in each case. Other high-capacity tools such as
topic spotting, word spotting and speaker identification are now available.
Digitally encoded signals/procedures are sent to suitable decoders in accordance with the
specifications for their classification - these may be closely coupled to the associated
demodulators especially with modern modes. The results (usually voice, data or ASCII text)
are now available for report preparation.
The provision of direction-finding/location-finding results on, if possible, all the radio
communications acquired and processed is also an important element of processing, at
least for signals where the sender cannot be uniquely identified. The directionfinding/location-finding results in conjunction with the prior knowledge/ target knowledge are
therefore also used for the identification of the acquired emitters (for details, see Chapter
2.4.1.5).
The information obtained from the results of the search, direction-finding/location-finding,
signal classification and processing like the technical parameters for the signal acquired,
the encoding procedure used, the operational parameters obtained from the analysed and
identified operational sequences and relationships and ideally the content of the messages
in code or clear text are inserted in computer report forms as well as attached as annexes
by the gatherer, but also increasingly automatically. The data are sent as acquisition/raw
reports via the data links provided to the evaluation unit (IP), and in special cases
(warnings/urgent reports) also immediately to the responsible units.
Page 28/58
w713od.0e1
Company Confidential
In principle, gatherers have the same analytical tools for processing as for searching. They
can use these tools at their leisure and with a time delay to investigate all signals that
cannot be processed or cannot be processed with sufficient quality despite the fact that
they have been classified successfully. If the analysis was able to identify the causes of the
malfunctions and it is possible to successfully re-set the parameters of the
function/processing modules, the signal can be re-extracted from the memory and
completely reprocessed.
In military strategic radio intelligence, processing is performed according to the sequences listed
above. However, the tactical discipline COMMS ESM differs in its priorities and in parts of the
signal processing. Here, the detection and classification of a specific signal is in many cases
adequate for a (warning) report or for the initiation of countermeasures.
Current and reliable indications of an acute threat can only be obtained from specific procedural
and operational features or sequences and from voice communications. The same applies to a
limited extent to encrypted radio communications.
Depending upon the nature and scope of the indicators required for the identification of a current
threat, the signals are further processed individually in the processing unit. They are demodulated
and, if required, decoded (digital modes) and analysed with regard to the above-mentioned
indicators. This is generally performed automatically, but in individual cases, an experienced
operator will have to evaluate/analyse the intercepted radio communications (for example, in the
case of radio voice communications). This situation similarly applies to tactical radio intelligence for
identifying or updating the tactical scenario (that is without any acute threat).
2.4.1.5.
The introduction of wideband technology for searching has increased the number of detected
emissions several-fold compared to the use of a limited number of narrowband search receivers in
traditional search systems. In particular with short-wave radio (HF), when wideband search heads
are used, the number of detections is usually so high that sometimes it is not possible to
automatically classify all the signals received with the computer power available, unless suitable
strategies to relieve the situation, i.e. to reduce the number of emissions, are taken. One of the
most important approaches to searching is to minimise the number of signals to be forwarded for
time-consuming computer classification. Minimisation is achieved by means of suitable
exclusion/filter criteria (in steps) at the earliest possible stage of processing. Ideally, all that
remains should be signals with a high relevance to the mission.
w713od.0e1
Page 29/58
Company Confidential
The only way to achieve a reduction of this kind is to supply the known signal features, operational
sequences/features and other information useful for classification when the search missions are
assigned. These may be parameters such as (transmission) time, direction or location, frequency,
bandwidth etc. When the relevant features/parameters are identified by the system, these selection
or exclusion criteria lead, in different stages of the signal processing during the search, to the
exclusion of all signals that do not conform to the specified features.
In particular, the early correlation of the directional information for the individual emissions detected
with the specified directional data effectively reduces the number of signals requiring further
processing during the classification process.
Approximate directional information can be obtained using directionally selective receive antennas
(LP antennas or circular array antennas). More precise determinations of direction- and locationfinding can only be achieved with suitable direction-finding systems/bases.
In addition to reducing the data/effort during searching, the reliable identification of the targeted
emitters/radio stations with the aid of the direction-finding/location-finding results is of great
importance for processing (IG) and analysis (IP).
High-capacity direction-finding and location-finding systems are, consequently, indispensable
components of all radio intelligence systems, regardless of whether they are implemented in
narrowband, wideband or mixed technology. However, because of their high signal volume,
wideband searching and processing components also require direction-finding/location-finding
systems that are adapted to the capacity and bandwidths.
The only exceptions to this rule are radio intelligence systems for very specific tasks/operations in
which the limited spectrum of tasks or operations does not require or permit directionfinding/location-finding.
Suitable procedures in direction-finding systems signal assignment/comparison by means of a
comparison of parameters must ensure that the direction-finding/ location-finding results can also
be correctly assigned to the signals acquired and processed by the search/processing system.
Any location-finding results available are always a component of the acquisition reports. They
assist the analysts not only in the identification/confirmation of the emitters/radio stations and
hence of the users or organisations, but also they make it possible to determine the location/area
of the units and people targeted.
Page 30/58
w713od.0e1
2.5.
Company Confidential
2.5.1.
Overview
w713od.0e1
Page 31/58
Company Confidential
In principle, analysts can use their (prior) knowledge of and experience with the intelligence
targets assigned to them together with the operational information and possibly even the
content of the supplemented reports supplied to them to identify the activities and hence
frequently also the plans of their intelligence targets and evaluate them correctly. The
evaluation of the events and their sequence enables analysts to obtain important
information or knowledge for the assessment of the situation, to assess the potential risk
with sufficient reliability and if necessary issue the necessary indications for suitable
(counter) measures.
Analysts use the information and findings obtained from the analysis process to produce
individual reports and situation reports according to the type of information, if required
including analyses for their customers.
Figure 6: An overview of IP
Page 32/58
w713od.0e1
2.5.2.
Company Confidential
Report pre-processing
The total number of reports sent to the communications intelligence (COMINT) analytical area (IP)
originates from numerous sources with extremely different volumes. A not insignificant proportion
comes from radio intelligence/acquisition. Therefore, Intelligence Processing is where reports are
brought together from ones COMINT facilities/sources and from all cooperating national and
international partners with the same security interests and reconnaissance targets.
Pre-processing comprises the following processing steps: (see also Figure 7)
During storage, as a first processing step, the incoming reports are logged - here they
may be assigned to the sender with details of the time received, the tactical time, the type
of report and the reconnaissance target. Other details are possible.
After logging and storage, the reports are prepared in several steps for the subsequent
evaluation processes according to their nature, origin and type. In high-capacity, modern
evaluation systems, the processing operations are performed automatically. However, the
scope of computerised pre-processing is heavily dependent upon the nature of the reports,
the requirements on the automatic processing and the degree of automation achieved by
Intelligence Processing.
In another step, all reports that do not conform to ones own processing format (mainly
partner reports) are automatically converted to ensure a uniform data format suitable for the
automated evaluation processes.
XML/HTML has been found to be a particular suitable report format, since all known report
formats may be depicted / converted without loss and because XML/HTML provides the
ideal conditions for the use of Internet technologies for data preparation/representation,
transport and provision.
Figure 7: IP pre-processing
w713od.0e1
Page 33/58
Company Confidential
In a further processing step to make the handling of the material simpler and easier for the
analyst, the reports should be cleaned of formal ballast that is of no relevance for the
subsequent processing and content analysis/evaluation (peeling). However, the report is
also retained and stored in its original version.
Foreign language report contents in text form can be translated into ones own language by
means of another automatic process. However, the translations usually have to be revised
by suitable foreign language experts. Audio files from voice traffic sometimes also require
translation by personnel with foreign language training.
The reports prepared/pre-processed in this way are now available to Preliminary (Report)
Analysis for the subsequent processing and analysis steps.
2.5.3.
The following processing sequence describes preliminary analysis: (see also Figure 8 on page 36)
The numerous reports prepared by pre-processing are analysed in another extensively
automated processing step for pre-specified features and content to an extent that enables
the assignment of the individual reports to the predefined subject/mission areas and
hence also to the relevant analysts. This process is dependent in each case on the nature
of the reports and the acquisition results in them in accordance with the formatting
regulations. For example, the content of reports relating to communications/radio
parameters and also messages in reports may contain clues regarding the user/the
organisation and the strategic background of the communications acquired (here: radio
messages).
This ensures the thematic assignment of the reports and their task-specific provision to
the responsible analyst.
This processing step actually corresponds to the first step in a traditional analysis process.
It can and should take place automatically, but the analysis system must provide the
opportunity and tools to enable the analyst responsible to monitor the results or the
assignment process and, if necessary, make corrections.
The thematic assignment creates the conditions for pooling reports belonging to the same
subject/target groups and supplementing them for the analysis by additional knowledge
from the available databases in the sense of added value. This enables analysts to obtain
a more comprehensive/extended picture of their reconnaissance targets and to evaluate
the individual reports more accurately and assign them to the previous results/findings in a
more appropriate way.
Page 34/58
w713od.0e1
Company Confidential
Added value can be indicative findings concerning technical and/or operational features of
the radio networks in the mission focus, information relevant to the mission on the target
groups/people, their activities and habits, contacts, relationships, capabilities and potential,
their previously known locations and movement patterns and any other activities/findings
that may be relevant for the analyst in relation to the reconnaissance targets etc. This
information is frequently based on findings from intelligence sources, but can also come
from open sources.
For use in (preliminary) analysis, this information has to be prepared for computer
processing, correctly formatted and stored in such a way that the aforementioned
supplementary processes and targeted search requests are available in their entirety to the
analysts on a topic-related basis.
The reports prepared in this way and supplemented by basic knowledge and up-to-date
findings are called up by the responsible analysts on their workstation computers.
If long-term observations of the radio networks of the targeted enemy identify rules in the
sense of regular behaviour or procedures, these are useful for the target knowledge and
may also be used to derive a description of the enemys normal behaviour in radio
operations. This normal behaviour can generally be described so that automatic processes
are able to identify (from the reports supplied with the large amount of intelligence on the
radio parameters), a standard behaviour or, in the event of deviating radio parameters, a
deviation from the norm. The latter case is an important indicator of special activities on
the part of the observed/detected enemy and will be notified immediately to the responsible
analyst in each case by the latest at the start of his shift - in a special report.
If the reports contain known indicators enabling direct conclusions to be drawn regarding
the activities of the reconnaissance target, the preliminary analysis will identify these
indicators immediately after receipt of the report even before an analyst has screened the
material.
w713od.0e1
Page 35/58
Company Confidential
Page 36/58
w713od.0e1
2.5.4.
Company Confidential
Analysts can call up from the memory area assigned to their field of responsibility an overview over
all newly arrived reports that have been prepared and supplemented as described above.
Depending on the nature of the reports and the configuration or availability of the analysis and
evaluation tools, analysts can select different material presentation formats. The following lists
some of the numerous forms of presentation:
o
Original report text (in the relevant report format with all report elements)
Prepared/peeled report text with only the report elements relevant for analysis
Frequency of communications
Deviations from the norm if it is possible to describe normal behaviour following lengthy
monitoring phases
etc.
Experienced analysts can generally use the wide variety of findings provided and supplementary
information (added value) on the assessment of individual processes and their interrelationships
for analytical purposes to obtain a realistic picture of the activities of their reconnaissance targets.
These findings are linked to the results of previous reconnaissance efforts against the same target
and used to draw up a current situation report or update the existing report. The analysts
detailed knowledge of the reconnaissance target, its basic plans, objectives and procedures,
potential and capabilities, previous behaviour etc. enable them to produce a reliable assessment
of the situation and in individual cases also contribute important information/indicators for suitable
(counter) measures.
The results of the analysis are summarised in reports that relate primarily to individual or
associated subjects/processes. In the event of long-term observation/ reconnaissance, when
required or on request, analysts combine a large number of messages and findings to produce
situation reports and analyses. In addition to the identified procedures, these usually contain
assessments and forecasts regarding the enemys potential and plans and other relevant
comments on the reconnaissance target. The analysts reports provide important contributions to
the final reports summarising of the central analysis by the reconnaissance/intelligence service in
question.
w713od.0e1
Page 37/58
Company Confidential
w713od.0e1
2.5.5.
Company Confidential
Target knowledge includes all information on a reconnaissance target (this could be individuals,
groups, criminal organisations, armed civilian or paramilitary/military units and organisations,
enemy services etc.) which is necessary or useful for finding and acquiring the communications
links (here: radio communications) of the target/enemy at justifiable expense and to process and
analyse them so that the components of the traffic relevant to the intelligence services may be
extracted and interpreted correctly.
Target knowledge may be divided into three main groups:
a. Information on the communications equipment used by the enemy and on the operational
sequences of its communications. This may be information obtained by radio intelligence
on the enemys radio devices/systems, frequency plans and frequency usage (history), the
transmission modes used, call names, signs or numbers used, its radio networks, its
technical and operational radio operations and sequences, etc.
b. Confirmed information obtained on the targeted individuals, groups, organisations, units.
This could include personal data on target persons, information on organisational and
command and control structures, locations, deployment, equipment, capabilities and habits,
command and control principles and sequences, command structures, etc.
c. Technical and/or operational features of the radio communications, allowing reliable
conclusions regarding strategic backgrounds/measures. This target knowledge forms in
particular the basis for tactical radio intelligence (COMMS ESM).
The above-listed examples are only a limited selection of the numerous possible types of target
knowledge. The communications facilities, sequences, habits and features, the properties
important for the analysis and the handling sequences differ according to the nature of the
reconnaissance target. This leads to a multiplicity of extremely different individual types of target
knowledge required for successful reconnaissance on the targets in question. Therefore, every
target places very specific requirements on COMINT/radio intelligence and on the target
knowledge to be compiled.
One basic principle is that, in addition to high-capacity and suitable sensor technology, precise,
comprehensive and up-to-date target knowledge is the key to successful reconnaissance on
enemy communications/radio traffic.
w713od.0e1
Page 39/58
Company Confidential
However, the development of reliable and sufficient target knowledge requires long-term
observation and evaluation of the enemys radio communications with ones own radio intelligence
facilities. The information obtained in this way may be supplemented by assured information from
other sources. Here, it is important that the target knowledge is updated and where possible and
required also supplemented a task which is permanently assigned to each analyst for their field
of responsibility; in larger COMINT organisations, there is frequently also a special target
knowledge group.
New information relevant to the target knowledge can only results in changes or supplements to
the target knowledge database if the operator/analyst responsible for the relevant mission area has
released these reconnaissance results as reliably classified and suitable for the database. This
usually only happens when the information/findings have been confirmed numerous times from the
same or different sources. These relationships are then treated as permanent or reliable target
knowledge. Before this, they may be used with caution as temporary target knowledge. From a
practical point of view, reports based on temporary target knowledge should be provided with
suitable comments or notes regarding the use of information that has not yet been
assured/confirmed.
The availability of reliable, suitable and sufficient target knowledge primarily determines ones own
capabilities to identify new targets successfully at short notice. Therefore, all COMINT/radio
intelligence organisations should build up the required stock of target knowledge on potential future
reconnaissance targets prospectively and in plenty of time. It is necessary to keep intelligence
gathering and intelligence processing resources available for this purpose at all times.
In principle, the scope and quality of the target knowledge decide the cold start capability of the
COMINT/radio intelligence forces in short-notice operations for which there are no lengthy
preparation times/phases.
Page 40/58
w713od.0e1
2.6.
Company Confidential
Reconnaissance is of great importance for the military command and control and for the protection
of ones own troops. In peacetime and times of tension, it is used to provide early intelligence on
potential enemy preparations for military mobilisation and attacks in the sense of an early warning
system. In wartime, strategic reconnaissance is primarily used for identifying the situation and
building on this to assess the situation. It is therefore an essential element of operational
planning. In the modern combat environment (tactical level), in addition to events relevant to the
situation, reconnaissance can identify acute threats to ones forces immediately and report this to
the responsible military commander. This provides the time and opportunity for suitable
countermeasures.
EloKa
(EW)
Fm/EloAufkl
EloSM
EloUM
(SIGINT)
(ECCM)
(ESM)
FmAufkl
(COMINT)
.
EloAufkl
(ELINT)
takt. FuAufkl
takt. RadAufkl
(COMMS ESM)
(RADAR ESM)
EloGM
(ECM)
w713od.0e1
Page 41/58
Company Confidential
2.6.1.
Page 42/58
w713od.0e1
2.6.2.
Company Confidential
Combat at sea, in the air and on land is generally performed using mobile weapons carriers or
units whose commanders are primarily reliant on radio communications to control and coordinate
the combat operations due to the requirement for high mobility (military ships, air and ground
radio). Therefore, COMMS ESM systems are directed towards the acquisition of these military
radio communications with their special signalling techniques and operational parameters, rules
and frequency bands.
As already mentioned, COMMS ESM is used for reconnaissance on the current combat situation
and hence provides important information on the status and development of the military situation. It
assists the tactical commander with the assessment of the situation and with the timely
identification of acute threats to ones forces from the enemy. This early warning function requires
the threat factors identified by radio intelligence to be reported immediately to the responsible
unit/military commander. For this reason, complex, analytical and hence time-consuming
processing and analysis of the intercepted traffic in a central analytical area (which is usually
located a long distance from the sensors or acquisition units), is neither sensible nor possible.
However, this requires an approach to reconnaissance that differs in parts from that used in
traditional COMINT.
Indicator details of the radio communications to be targeted for the mission of tactical radio
intelligence (COMMS ESM) in the form of technical transmission features, (radio) operational
sequences and special features/rules and the tactical sequences/background that triggered the
radio communications acquired and could possibly pose a threat to ones own forces must be
precisely known. Since any more extensive evaluation up to an analysis of the content and a
linkage with findings from other sources is generally not practical or possible for temporal and
structural reasons, in special cases the above-listed features or indicators must be sufficient and
reliable on their own to provide evidence of an acute threat to ones own forces.
The target knowledge required to do this and to develop detailed knowledge is, however, a task of
strategic radio intelligence (COMINT).
The functional sequences in radio intelligence in the fields of COMINT and COMMS ESM apart
from the time factor between detection and reporting are essentially the same. In both areas,
there is a requirement to find the signals or communications relevant to the mission with as few
gaps as possible and classify them on the basis of their technical transmission features (signal
type). However, the two disciplines differ to some extent in the evaluation of the
signals/communications.
COMMS ESM can usually identify the nature of the radio services (e.g. ship radio, air radio/aircraft
radio, ground radio) from the signal type alone. Since (radio) operational sequences are
standardised in military radio communications and hence follow fixed rules, the technical
w713od.0e1
Page 43/58
Company Confidential
transmission features and operational sequences identified usually enable conclusions to be drawn
regarding the type of weapons carrier or military unit and frequently also regarding the
strategic/tactical operations in question e.g. tank battalion on the offensive, group of ships in a
particular attack manoeuvre, target alignment of a fighter bomber by an FAC (forward air
controller), etc. This is frequently enough for identification and evaluation.
Another important component of COMMS ESM is direction-finding, in exceptional cases also
location-finding, if a mobile DF basis can be operated and used. It indicates the direction or
sometimes even the location or the distance of the target/ threat identified this information is
indispensable for taking the correct decisions and countermeasures.
Further time-consuming analysis of signals is frequently not possible due to the immediacy of the
threat. The above-listed results or findings of tactical radio intelligence have to be reported
immediately to the responsible military commanders (warnings) to enable them to react in good
time and with suitable measures to the enemy activities identified.
Therefore, COMMS ESM also differs in part from COMINT in its reconnaissance priorities, job
handling, required prior knowledge/target knowledge, system configuration and in the
processing/evaluation of the intercepted signals/communications. The decisive feature or
difference, however, is the ability of tactical radio intelligence in certain cases to use the detection,
classification and direction-finding of enemy radio communications to obtain sufficiently reliable
information on the current events on the battlefield and frequently also on immediate threats from
enemy forces and hence enable the appropriate reactions to be taken.
The COMINT task searching in the mission (searching for known emitters) has similar
preconditions to those of COMMS ESM. A large amount of information is already held about the
enemy and its radio procedures and special operational features. Therefore, once again the known
(classified) signal type provides the first usable indication of the user and hence the targeted
enemy.
The locating results, the target knowledge and additional findings from previous reconnaissance
activities and from other sources can be used in the subsequent, time-consuming analysis process
to identify the enemy behind the radio communications. At the same time, it is also possible to
obtain information on military events at a strategic level.
In the field of non-military reconnaissance, however, it is not so much operational standards in the
development of radio communications, but rather the known habits of the reconnaissance target
when using its communications facilities/radio services, which in conjunction with the locationfinding provide indications of its identity and frequently also its activities.
However, with COMINT, the time between acquisition and reporting is usually much greater than it
is with radio intelligence for COMMS ESM.
Page 44/58
w713od.0e1
Company Confidential
However, tactical radio intelligence is not exclusively restricted to the above-mentioned early
warning function. In principle, it also has the mission of contributing to the reconnaissance on the
current military situation in the assigned field of operation. The operational principles and functional
sequences are again in principle comparable with those of strategic radio intelligence; only the
focus now is the reconnaissance of radio services in higher frequency ranges (VHF, UHF and
above) that are primarily used for command and control in battle/combat. These are primarily
tactical ships, air and ground radio. Since intercepted enemy radio communications are not
necessarily an indicator of an acute threat, they can, if required, also be evaluated in a longer
time-frame, similar to evaluation/intelligence processing for COMINT. The results will usually also
be incorporated in the presentation of the up-to-date situation (local battlefield situation).
However, in tactical radio intelligence, the analysts have to be stationed on site near the acquisition
equipment, similar to so-called immediate analysis also called preliminary analysis in strategic
radio intelligence, which is usually performed directly next to the stationary acquisition equipment.
Obviously, these reports are also incorporated in the reporting system used by the
SIGINT/COMINT forces.
As mentioned at the start, in battle, the command and control of modern, highly-mobile units and
weapon systems/carriers is mainly performed using (tactical) VHF and UHF radio and coordinated
within combined arms combat. However, COMMS ESM systems must also be able if necessary
to find tactical HF links and uplinks for mobile satellite radio sets, or at least find their bearings and
classify them uniquely (satellite radio). We can no longer exclude the possibility that land-based
units will in future also use WLAN technology for command post communications, possibly even as
command and control facilities. The latter application is also conceivable for seaborne units.
Consequently, future COMMS ESM systems must also be prepared for these requirements.
The high mobility of motorised troops, the speed of modern weapons carriers and the long ranges
of their weapon systems means that the reconnaissance radius or area to be covered must extend
to a long way in front of ones own forces and the time available to react appropriately to enemy
activities is frequently very short. This requires COMMS ESM systems to have high receiver
dynamic range to guarantee a sufficient reception range or penetration range and the ability to
perform an immediate classification and assessment/evaluation of signals relevant to the mission.
The capacity of a COMMS ESM system is consequently measured against how completely, quickly
and reliably it is able to sweep the operational area for tactically relevant radio communications,
classify and evaluate the signals and report the findings derived there from to the customers.
w713od.0e1
Page 45/58
Company Confidential
In addition, to the above-listed technical capabilities of COMMS ESM systems, high demands are
placed on mobility, camouflage and the usable operational spectrum of the platforms on which the
systems (including their receive and DF antennas) are installed. The limited acquisition range in
higher frequency ranges and hence the required proximity to the reconnaissance targets/enemy
makes the use of unmanned platforms/systems necessary in many cases. Operations of this kind
require COMMS ESM systems with a high degree of automation and adapted remote control
functions such as, for example, MEDAVs MOFAS system.
The technical equipment/systems used for COMINT and for COMMS ESM tasks are in principle
the same. The same also applies to the functional sequences in searching and processing. With
suitable hardware and mobile operational platforms, it is possible to carry out both tactical and
(although limited in its range and direction-finding/location-finding ability) strategic radio
intelligence. Only the operational principles, to some extent the processing and evaluation routines
and the reporting chains differ as a result of the different requirements.
One special feature of airborne and seaborne COMMS ESM systems is the basic
capability/possibility of finding the bearings of stationary and slow targets with sufficient accuracy
over several readings, taking into account ones own course (GPS-based). For this, it is necessary
to synchronise the exact times (TOAs) of the individual DF readings with the relevant coordinates
and project the associated DF values onto these coordinates. The bearing directions/beams
produce sufficiently precise location-finding.
COMMS ESM systems on their mobile operation platforms are usually integrated in the operational
command and control systems. In the case of modern forces, these are in turn connected to a
high-ranking command and control as a result of their high-capacity CI functions to which the
information from reports sent by the reconnaissance sensors are forwarded without delay and
prepared into (real-time) situation reports for the forces involved in the combat activities.
In NATO, this is called Network Centric Warfare (NCW), a completely new and extremely highcapacity information infrastructure for situation reports, command and control and coordination of
the weapons usage of mixed NATO units.
Page 46/58
w713od.0e1
2.7.
Company Confidential
Mission management
Successful reconnaissance provides its customers who could be the government/ministries, the
security organisations or the military with important information and decision-making aids.
However, the intelligence forces can only meet the specific information requirements of the abovelisted areas/organisations if the reconnaissance requirements/missions also reflect the relevant
reconnaissance interest in detail and in a prioritised way.
When the mission is assigned, a distinction is made between permanent (long-term) and shortterm (determined by immediate events of relevance to security) reconnaissance requirements.
The organisation/authorities responsible for the reconnaissance service in question formulate a
permanent reconnaissance mission according to the specifications in the security policy or
reconnaissance interests, which takes into account the capabilities of the assigned intelligence
service (here: COMINT/radio intelligence). Depending upon the current situation or event and
depending upon the specific reconnaissance requirement, it also draws up individual
reconnaissance requirements (missions) that usually have a time limit.
The responsible command and control area of the intelligence/reconnaissance service converts the
above-listed requirements/missions into a form suitable for communications intelligence, assigns
the priorities and sends them to the COMINT command and control/mission control area. There,
the relevant missions for intelligence gathering, and hence, in principle also for intelligence
processing with target knowledge processing are drawn up and assigned to the areas/forces
offering the best conditions for a successful fulfilment of the mission. These missions take into
account the capabilities and special features of the reconnaissance medium in question (here:
radio intelligence) and are usually based on target people, groups or areas. They are essentially
more detailed than the reconnaissance requirements and state precisely which information on the
individual targets is of interest.
Intelligence Gathering uses these primarily strategic reconnaissance missions to generate specific
acquisition missions and provides the documents/target knowledge extracts required for their
performance. These acquisition missions are sent to the relevant day and night shifts in
Intelligence Gathering. They may also be valid for lengthy periods.
In traditional radio intelligence, which is still manually controlled by the gatherers, the individual
missions are sent to the workstations suitable/equipped for the transmission modes to be detected.
Semi- or fully automatic acquisition/processing systems automatically provide the sources/system
components required for each individual mission. Dynamic provision is only performed for handling
the up-to-date search/acquisition mission in each case.
w713od.0e1
Page 47/58
Company Confidential
Intelligence Processing or Central Mission Control checks constantly whether ones own reporting
system (raw/acquisition reports from Intelligence Gathering and the outgoing, processed reports =>
finished intelligence) is always providing the required information and findings for the specified
target and without significant gaps. If necessary, mission management introduces suitable changes
to ones own Intelligence Gathering in order to rectify the gaps or shortcomings identified.
Page 48/58
w713od.0e1
2.8.
Company Confidential
w713od.0e1
Page 49/58
Company Confidential
2.9.
Data storage
A distinction is made between results data and target knowledge data for the purposes of data
storage. In principle, results consist of:
records of the radio communications acquired (original signal)
technical data on acquired and classified signals
operational data/knowledge of the radio communications detected
contents of the radio communications exploited
These data are usually only stored temporarily for analysis and reporting and for possible postprocessing. Some of them are incorporated in the acquisition reports and in the IP reports and are
hence held in long-term storage. The above-listed results data remain available to Intelligence
Gathering and Intelligence Processing until they are either permanently archived or deleted after
pre-specified periods (this may be several months).
With the target knowledge data, a distinction is made between temporary/ provisional target
knowledge and the permanent target knowledge that is confirmed data that has been released by
the responsible analyst for the target knowledge database.
Temporary target knowledge also described as strategic knowledge is data/ findings relevant
to the target knowledge, which are obtained during acquisition or analysis and supply important
operational communications/radio and/or strategic findings for COMINT/radio intelligence, but
which still require confirmation by means of other reconnaissance results.
These data will be retained and provided until the responsible analyst has incorporated them in the
permanent target knowledge or discarded them.
If required, strategic knowledge should be available to all connected acquisition stations and the
relevant analytical areas (sometimes only selectively) and replicated between them close to the
event.
The actual (permanent) target knowledge database is stored for lengthy periods. However,
permanent only means that these data remain valid until they are updated or supplemented during
the continuous maintenance of the target knowledge database by the analytical/target knowledge
group. They are made available to Intelligence Gathering in the form of extracts (documents)
relevant for the acquisition missions and in comprehensive form to the analysts for their reporting.
As a result of networking and the use of high-capacity and comfortable Internet technologies, the
target knowledge may be stored centrally or decentrally. Decentral target knowledge provides
greater autonomy for the individual areas in the event of the failure of the communications links.
However, it does require suitable technology and mechanisms for data replication.
Page 50/58
w713od.0e1
Company Confidential
The requirements and tasks currently levied on acquisition systems are changing all the time. The
procurement of new equipment is usually out of the question for budget reasons, and moreover
would probably not be possible in the timeframes in which the adaptation is required.
A modern acquisition system must, therefore, be simple to adapt and expand in order to be able
to satisfy changing requirements throughout its service life. The normal product cycles of the
components used are many times shorter than the systems service life. A guaranteed supply of
identical components not only means high storage costs, but in the case of expansion measures,
the procurement of obsolete technology that is much less efficient than the components available
on the market.
As a safe investment and to secure supplies, concepts are required that take into account
technological advances and in the end permit the use of heterogeneous system solutions. This can
be achieved by using a very limited number of basic hardware components whose (if possible,
limited) interface requirements and guarantees may be assured long term. This permits enhanced
efficiency as a result of technical developments in the case of expansions and replacement
purchases. This also significantly reduces the high storage costs for spare parts.
The hardware available is used productively in the system and not packed away in the spares
store. Optimum system performance is achieved with the existing configuration. The system design
and system management tools must support this process.
w713od.0e1
Page 51/58
Company Confidential
3.2.
Acquisition systems are hermetic and complete. They employ the fewest possible defined
interfaces to communicate with their environments. The interfaces enable the system to be
conditioned suitably for the mission and the processing results to be provided by the system. They
support the required monitoring, maintenance and further development.
The prime objective to produce (acquisition) results should be achieved with the optimum (i.e.
lowest) amount of effort and be permanently assured.
The system structure is relatively simple: a small number of central computers provide the
interfaces to the environment and are used to control and monitor the system. If necessary, these
system computers are connected in failover pairs to ensure the high availability required at this
point. The majority of computers conduct the actual processing tasks. The system computers
monitor and control these processing computers.
The essential factor is to assign top priority to a high level of system availability even at the design
stage. Experience has shown that measures introduced retrospectively to increase availability are
expensive but limited in terms of effectiveness. Since errors cannot be completely avoided, the
objectives of system architecture include (a) minimising the impact of any errors, (b) guaranteeing
the functions of system components not directly affected by an error and in this way (c) maintaining
the functioning of the overall system wherever possible, albeit possibly with a temporary reduction
in efficiency. (This means optimum system performance with the current configuration see
above).
3.3.
Hardware errors
The frequency of errors in electronic components follows what is known as the bathtub curve: early
outages are followed by a constant, very low failure rate which only increases again after a lengthy
period as a component approaches the end of its useful life.
Mechanically moving components have a much higher failure probability and should, therefore, be
avoided when possible. Typical failures in computer systems occur, for example, in fans and hard
disks. If their use is unavoidable, they should be monitored, and any errors identified and reported.
Computers made of components equipped to meet this requirement are commercially available.
The downtime in the event of errors can be minimised by using detailed solutions that ensure the
systems are easy to repair.
Page 52/58
w713od.0e1
3.4.
Company Confidential
Software errors
In the case of software errors, the system design should again limit the propagation of those errors.
A group of loosely interlinked software components has been found to be expedient. Central
functions must be provided on fail-safe computers.
One useful strategy to limit the impact of errors is, where possible, to prevent sequential
requirements being processed by the same process, but to stop the task in question after a specific
time or after a specific number of requests and replace it with a new process. This often prevents
the accumulation of small errors and hence achieves an overall much more stable system
performance.
3.5.
Configuration
The hardware configuration used in a system operated under the described conditions at the
present time is a known configuration. It will only be changed as part of maintenance or expansion
measures. There is therefore no need to take account of dynamic changes during the routine
management of the system configuration. One obvious solution is to use a central configuration database from which the partial configurations, i.e. the individual configuration files required for the
individual services (e.g. DHCP, DNS, TFTP, PXE, etc.) may be automatically generated.
The services used determine the information to be held in the configuration database. The actual
system does not make many requests and the performance requirements are not high.
We use OpenLDAP to store and call up the configuration data. This permits well-structured data
and facilitates the compilation and management of partial configurations for groups of identical or
similar components. The configuration information is interactively managed using graphical tools,
such as gq. The configuration data may be accessed with other tools, which may be supplied by
the customer, for example.
w713od.0e1
Page 53/58
Company Confidential
3.6.
Boot process
The processing computers do not have a local bootable storage medium and file system. Instead,
the operating system is booted by the PXE implementation included in all modern BIOS systems
for network bootstrapping. (However, for maintenance purposes, another boot image may be
loaded, for example one that permits hardware tests.)
The software needed for operation is also loaded over the network by the server. The processing
computers file system only exists in their RAM. The data used over the network are suitably
mounted in the processing computers file system and released for read access only. When the
operating system is started, each processing computer mounts its own remote file systems.
Protocol messages and alarms are sent over the network to the system computers. The usual
protocols (syslog, SNMP) are used.
The omission of the system disk does away with one of the few mechanically moved, and hence
susceptible, components of the processing computer.
3.7.
Software distribution
Page 54/58
w713od.0e1
3.8.
Company Confidential
Scheduling
The compute nodes transmit the frame data required for planning the computation tasks to the
scheduling unit. The scheduler determines the sequence and assignment to the compute nodes in
which the tasks are then executed on the basis of the following data:
task priority
The core of the scheduler is a priority-control queue for the tasks. The priority of a task and hence
its position in the queue may change during its waiting time to take account of changed basic
conditions.
When a task is handed over to a compute node, it is removed from the main queue and transferred
to job monitoring. If task monitoring detects that the task cannot be processed to the end, because
the compute node is out of service for example, the task is returned to the main queue. However,
this is not performed without observing rules, such as, for example, a maximum number of
attempted calculations. The rules are there to protect the system, by sequentially terminating tasks
that can (data pending) not be processed for example, and to prevent the continuous loading of the
system with such tasks.
Tasks that use limited resources (e.g. external modems) are processed by regrouping them into
their own queue. The queue operates in a similar way to the main queue, but the tasks from this
queue are processed on the relevant compute node with a priority bonus in order to ensure the
effective utilisation of the limited resources.
Tasks for which the raw data is no longer available are removed from the queue. Details of this
process step are logged.
w713od.0e1
Page 55/58
Company Confidential
3.9.
Monitoring system performance is one of the main conditions for assuring processing.
Each computer runs a process (Monit) to monitor the local operating state. This collects and
examines data such as main memory occupancy, CPU load, network throughput for the entire
computer and the individual computer tasks. In the event of limit violations, it sends the
corresponding alarms messages to the higher-ranking entity.
The monitoring computers collect and condense status and alarm messages and monitor the other
computers in the system. To do this, they test the communications with these other computers and
check the achievability of specific services assigned for the specific computer on the computers.
The data produced are available to the administrator via a web-based application.
The application is based on the network management system OpenNMS. Expansions cover the
visualisation of the status information, even for lengthy periods. In practice, it has been found to be
expedient to use RRDTools as a database and visualisation library. This ensures the automatic
compaction of older status data.
In the event of computer outages, limit violations or other defined system states, external
management systems can be alarmed, for example by SNMP traps.
The data determined can be made available for external evaluation processes or management
tools. This may be performed by both SNMP and by entries in an (external) database.
Page 56/58
w713od.0e1
Company Confidential
3.11. Maintenance
Current commercially available computers configured for use in a server environment offer
interfaces to a central management system.
In particular, it is possible to dispense with the usual console switches, since the consoles may be
accessed directly via the LAN interface. This enables a large proportion of maintenance to be
performed over the LAN. Only cleaning and replacement work requires direct access to the
computers.
In addition to cost savings on first installation and expansions, there is no need for the distribution
of video signals, which are themselves a source of electromagnetic interference.
w713od.0e1
Page 57/58
Company Confidential
MEDAV GmbH Grfenberger Str. 32-34 91080 Uttenreuth Germany Homburger Platz 3 98693 Ilmenau Germany
Phone: +49 9131 583-0 Fax: +49 9131 583-11 info@medav.de www.medav.de
Page 58/58
w713od.0e1