NSA's Foreign Partnerships

(Updated: October 31, 2023)

For fulfilling its task of gathering foreign signals intelligence, the National Security Agency (NSA) is cooperating with partner agencies from over 35 countries all over the world.

These relationships are based upon secret bilateral agreements, but there are also some select groups in which intelligence information is shared on a multilateral basis, like the SIGINT Seniors Europe (SSEUR), the SIGINT Seniors Pacific (SSPAC) and the Afghanistan SIGINT Coalition (AFSC).

Until recently, very little was known about these foreign relationships, but the Snowden-leaks have revealed the names of all the countries that are cooperating with NSA. This made it possible to create the following graphic, which also shows various multilateral intelligence exchange groups, which will be discussed here too.

- 2nd Party Partners - 3rd Party Partners - Multilateral groups -

Nations with 2nd and 3rd Party status and those who are
members of the SIGINT Seniors Europe (SSEUR) and NATO
(click to enlarge)

 

2nd Party Partners

The closest cooperation is between NSA and the signals intelligence agencies of the United Kingdom, Canada, Australia and New Zealand. Formally this is based upon a range of bilateral agreements, the first being the BRUSA (now known as UKUSA) Agreement on communications intelligence cooperation from March 5, 1946. Since 1993 this group has a multilateral character, which means partners can exchange information among the other members too (as far as there's a "need to know")

The five partners under the UKUSA-agreement, commonly called the Five Eyes, agreed that they would follow common procedures for operations and reporting, and also use the same target identification systems, equipment, methods and source designations. They would not only share end reports and analyses, but also most of the raw data they collect.

As a kind of gentlemen's agreement it is supposed that the Five Eyes countries are not spying on each other, although some of the documents from the Snowden-leaks show that at least NSA secretly keeps that option open.

Since 1946 1946 1949 1956 1956

Five Eyes (FVEY) United States United Kingdom Canada Australia New Zealand

Four Eyes (ACGU) United States United Kingdom Canada Australia

Three Eyes (TEYE) United States United Kingdom Australia

Despite the very close and longstanding relationship between the Five Eyes partners, two sub-groups have been formed for specific military operations in which not all five partners participate. These sub-groups are designated Four Eyes (abbreviation for classification purposes: ACGU) and Three Eyes (TEYE).

> More about The 5, 4 and 3 Eyes

Update:
In February 2018 it was reported that since 2017, officials of the French military intelligence agency DRM are regularly attending meetings in Washington to share information with the Five Eyes group, reflecting a capability to gather and exchange high-value data.

Cable tapping

The 2nd Party countries are cooperating in many ways, one of which is in cable tapping operations. The NSA umbrella program for this is codenamed WINDSTOP. According to NSA's Foreign Partner Access budget for 2013 WINDSTOP involves primarily Britain, but also Canada, Australia and New Zealand and focusses on access to (mainly internet) "communications into and out of Europe and the Middle East" through an integrated and overarching collection system.

- See also: Data sharing systems used within the Five Eyes partnership

Representatives

For maintaining these extensive relationships, NSA has liaison units in the Second Party countries. These are called Special US Liaison Offices (SUSLO), followed by the name of the nation's capital. In 2003, there were three:

- Special US Liaison Office, London (SUSLOL, with liaison officers at GCHQ in Cheltenham)
- Special US Liaison Office, Ottawa (SUSLOO)
- Special US Liaison Office, Canberra (SUSLOC, which also handled dealings with New Zealand)

Likewise, the SIGINT agencies from the other Five Eyes countries have a senior representative at NSA headquarters. In 2003, these were called:

- Senior UK Liaison Office (SUKLO)
- Canadian Liaison Office (CANSLO)
- Australian Liaison Office (AUSLO)
- New Zealand Liaison Office (NZLO)

Oversight

In September 2016, the Five Eyes Intelligence Oversight and Review Council (FIORC) was created, composed of the non-political intelligence oversight, review, and security entities of the Five Eyes countries.

The FIORC members exchange views, compare best practices in review and oversight methodology, explore areas where cooperation on reviews and the sharing of results is permitted, and encourage transparency to the largest extent possible to enhance public trust.

Slide from an NSA presentation titled 'Foreign Partner Review' from
fiscal year 2013, showing the 2nd and 3rd Party partners
and some coalition and multilateral exchange groups.
Published in No Place To Hide, May 13, 2014.

 

3rd Party Partners

One step below the 2nd Party partnerships, there's cooperation between NSA and (signals) intelligence agencies from countries who are called 3rd Party partners. This is based upon formal agreements, but the actual scope of the relationship can vary from country to country and from time to time. Details about the cooperation between two countries are laid down in Memorandums of Understanding (MoU).

For the US, this kind of cooperation is useful because foreign agencies can have better access to high-priority targets because of their geographic location, or they could have a specific expertise on certain areas, or just simply because they have a better knowledge of the local situation and language.

The foreign partner agencies are mostly interested in American technology, money and access to the worldwide interception capabilities of NSA and its Five Eyes partners. This makes these 3rd Party partnerships especially attractive for smaller countries, for whom it means a sometimes substantial increase of their otherwise limited capabilities.

One big difference with the countries from the 2nd Party category is that 3rd Party partners do spy upon each other, and many of the Snowden-documents have shown this. From these documents we also learned that in 2013, there were 33 countries with 3rd Party status:

since 1954 1962 2005? 1954 1954 1949

CNO (19 countries) Austria Belgium Czech Republic Denmark Germany Greece Hungary Iceland Italy Japan Luxemburg Netherlands Norway Poland South Korea Spain Sweden Switzerland Turkey

3rd Parties (33 countries) Algeria Austria Belgium Croatia Czech Republic Denmark Ethiopia Finland France Germany Greece Hungary India Israel Italy Japan Jordan Macedonia Netherlands Norway Pakistan Poland Romania Saudi Arabia Singapore South Korea Spain Sweden Taiwan Thailand Tunisia Turkey UAE

SSEUR (14-Eyes) Belgium Denmark France Germany Italy Netherlands Norway Spain Sweden

SSPAC (10-Eyes) France India Singapore South Korea Thailand

The countries in the column under "CNO" are from a list which is in an undated NSA document about collaboration regarding Computer Network Operations (CNO). The document was first published on October 30, 2013 by the Spanish paper El Mundo and classifies cooperation on four different levels, which was also explained by The Guardian.

The first level is called "Tier A - Comprehensive Cooperation", which comprises Britain, Australia, Canada and New Zealand. A second group, called "Tier B - Focused Cooperation" includes the 19 mostly European countries listed above. A third group of "Limited cooperation" consists of countries such as France, Israel, India and Pakistan, and finally a fourth group is about "Exceptional Cooperation" with countries that the US considers to be hostile to its interests.

In May 2014, the list with the "Tier A" and "Tier B" countries was also published in Greenwald's book No Place To Hide, where he ignores the fact that the document was about CNO cooperation and simply assumes that the "Tier B" countries are the same as those with 3rd Party status.*

Map showing the 2nd Party and 3rd Party partners of NSA
(click to enlarge)

Cable tapping

NSA cooperates with the 3rd Party countries in many ways, one of which is in cable tapping operations. The NSA umbrella program for this is codenamed RAMPART-A. According to NSA's Foreign Partner Access budget for 2013, RAMPART-A provides access to long-haul international leased communications, with TURMOIL capabilities, and over 3 terabit/second of data from all "communication technologies such as voice, fax, telex, modem, e-mail internet chat, Virtual Private Network (VPN), Voice over IP (VoIP), and voice call records".
 

Direction-Finding

16 Third Party countries (Austria, Denmark, Ethiopia, Hungary, Israel, India, Italy, Japan, Jordan, Korea (South), Netherlands, Norway, Pakistan, Saudi Arabia, Sweden and Taiwan) also cooperate in the CROSSHAIR program. This consists of a worldwide network of antennas for High Frequency Direction-Finding (HFDF) and was implemented on October 1, 1993. CROSSHAIR consolidated the various military DF sites and also included those of the other Five Eyes/Second Party countries. Uncovered areas were eventually covered by the participation of the aforementioned Third Party countries.


Representatives

Initially, the representatives of NSA in major Third Party countries were called NSA/CSS Representative (NCR), just like their counterparts at military commands and other US government agencies. According to the United States Sigint Plan from 1985, there were the following NCRs:

NCEUR (NSA/CSS Representative Europe)
NCEUR/ISS (NSA/CSS Representative Europe / ? )
NCPAC (NSA/CSS Representative Pacific)
NCR CENTCOM (NSA/CSS Representative Central Command)
NCR DEF (NSA/CSS Representative Defense Department)
NCR FTD (NSA/CSS Representative Foreign Technology Division?)
NCRJ (NSA/CSS Representative Japan)
NCR KOR (NSA/CSS Representative Korea)
NCR LANT (NSA/CSS Representative ?)
NCR MAC (NSA/CSS Representative Military Airlift Command)
NCR NORAD (NCR North American Aerospace Defense Command)
NCR REDCOM (NSA/CSS Representative Readiness and Mobilization Command)
NCR SAC (NSA/CSS Representative Strategic Air Command)
NCR STATE (NSA/CSS Representative State Department)
NCR TAC (NSA/CSS Representative Tactical Air Command)

In 2006 the NCRs at embassies in support of Third Party agreements got the new title of Special US Liaison Advisor (SUSLA), followed by the name of the partner country.

The first SUSLA was for Italy, followed by the one for Germany, who is called Special US Liaison Advisor, Germany (SUSLAG). Other early SUSLAs were for Turkey (SUSLAT), Thailand (SUSLAB), Japan (SUSLAJ) and South-Korea (SUSLAK).

The office staff of such an advisor is called the Special US Liaison Activity (also abbreviated as SUSLA), and for example the SUSLA Germany had 18 personnel (12 civilians and 6 contractors) in 2012, a number which was to be reduced to 6 in 2013.*

The Special US Liaison Activity Japan (SUSLAJ) is led by a Chief and was originally located at Hardy Barracks under the cover name "5th Air Force Technical Liaison Office." In 2007 a new satellite office was opened in the US embassy in Tokyo, which is referred to as the "DoD Special Representative Japan-Tokyo" in unclassified channels. SUSLAJ's main facilities are on Yokota Air Base.

In 2005, the NSA had an SIGINT Liaison Officer (SLO) in Oslo, Norway, who was accompanied by a Technical Liaison Officer (TLO) given the heavy technical workload with the Norwegian intelligence service. This TLO also set up a direct communications link between the Finnish Intelligence Research Establishment and the NSA and NGA.

It is not clear whether the various Third Party agencies also have a representative at NSA headquarters and if so, what their title is.


Foreign Affairs Directorate

At NSA these foreign relationships are managed by the Foreign Affairs Directorate (FAD), which has a Country Desk Officer (CDO) for every country or region that matters. For matters related to Second Party partnerships there's the FAD has the Second Party Affairs Office (DP11) consisting of five officers based at Fort Meade.

 

Multilateral groups

Although the Third Party relationships are strictly bilateral, some of these countries have also worked very close with each other for a long time. This has been formalized into a few multilateral groups in which intelligence is exchanged not only between one particular country and the US, but also among all other participants. The following three SIGINT sharing groups are known:
 

SIGINT Seniors Europe (SSEUR)

This group consists of the Five Eyes and nine European countries: France, Germany, Spain, Italy, Belgium, the Netherlands, Denmark, Norway and Sweden. Except for Sweden, all are NATO members. After the number of countries, the SSEUR are also called 14-Eyes.

The "Seniors" refers to the heads of the participating military or signals intelligence agencies, who in this group coordinate the exchange of military intelligence according to the needs of each member.

A BND document mentions that in February 2014, there was a conference of the leaders of the "core group" of the SSEUR, but it wasn't mentioned which countries are part of that core group.

There's also a SIGINT Seniors Europe Counter Terrorism (SISECT) coalition* with the same members, excluding Australia and New Zealand. SISECT organizes a semi-annual conference* and in 2013, NSA encouraged GCHQ to host the permanent facility for the joint SSEUR collaboration center.*

> More about the SIGINT Seniors Europe

 

Updates:

A new multilateral intelligence sharing group seems to be the SIGINT Support to Cyber Defense (SSCD) initiative, which consists of a number of countries that together establish an early-warning system to defend themselves against cyber attacks. Its existance was first mentioned on May 8, 2014 in a speech by president Schindler of the German intelligence service BND, which is also cooperating in this SSCD framework. SSCD will use traditional SIGINT methods to inspect data packets for things like malicious code so these can be eliminated pro-actively.

From a document dated July 23, 2013 from the German parliamentary inquiry commission, which was published by Wikileaks on December 1, 2016, we learn that "within the SSCD-working group of an international SIGINT coalition, BND exchanges information about the international detection of cyber attacks." This international SIGINT coalition is most likely the SSEUR or 14-Eyes group, which means the SSCD-cooperation that Schindler mentioned in his speech seems to be an SSEUR sub-group similar to the SISECT.

 

SIGINT Seniors Pacific (SSPAC)

There's a similar group for multilateral exchange of military intelligence among some 3rd party nations from the East Asia/Pacific Rim region. Besides the members of the Five Eyes, the SIGINT Seniors Pacific include Singapore, South Korea and most likely Japan and Thailand. Probably one other country is participating too, making this group also being identified as the 10-Eyes.

Updates:

An NSA document disclosed by The New Zealand Herald on March 11, 2015 says that the SSPAC consists of the Five Eyes plus France, India, (South) Korea, Singapore and Thailand.

According to NSA's internal SIDtoday newsletter from June 9, 2005, a formal Principals Board and Executive Board were established for the SSPAC and its initial focus was to share intelligence on counter-terrorism (CT), including banking information and follow-the-people, in order to provide warning of imminent terrorist threats to member nations. Additional topics such as counter-proliferation would be considered later. The NSA developed a secure network codenamed CRUSHED ICE for exchanging CT-related information among the SSPAC members.

In January 2020, a new group was formed for exchanging data on a range of areas, including intelligence activities on North Korea as well as on China's military, cyber and space activities. The group consists of the Five Eyes countries plus Japan, France and South Korea. The latter three will be given enhanced, but still limited, access because they're not full members of Five Eyes.

> More about the The 6, 8 and 10 Eyes

 

Afghanistan SIGINT Coalition (AFSC)

According to an NSA paper from 2013, this group consists of the same 14 countries as the SSEUR and is aimed at sharing Afghanistan-related intelligence reports and metadata among its participants. At the time of the paper, each AFSC-member was responsible for covering a specific area of interest, probably corresponding to the region in Afghanistan where they had troops deployed.

Snowden and Greenwald apparently agreed not to publish about NSA's involvement in Afghanistan, but the German book about the Snowden-leaks, Der NSA Komplex, reveals that the 14 AFSC-members cooperated closely in decrypting and analysing mobile communications and have a dedicated data center codenamed CENTER ICE for exchanging this kind of intelligence.*

This makes it likely that much of the metadata that various European countries shared with the US, mistakenly presented by Glenn Greenwald as NSA spying on European citizens, was collected as part of this Afghanistan SIGINT Coalition.

Update:

In May 2019, the website The Intercept revealed that the AFSC started in 2009 with nine members and was therefore also known as the 9-Eyes. Subsequently the number of members grew to the same 14 countries that already made up the SIGINT Seniors Europe or 14-Eyes.
Members of the AFSC collected GSM metadata through DRT devices and feeded them into the NSA's Real Time Regional Gateway (RT-RG) system. These telephone metadata would later appear in various charts from the NSA's data visualization tool BOUNDLESSINFORMANT. The AFSC existed at least until the end of 2014.

> More: From 9-Eyes to 14-Eyes: the Afghanistan SIGINT Coalition (AFSC)

Links and Sources
- BBC: Diary reveals birth of secret UK-US spy pact that grew into Five Eyes (Febr. 2021)
- Swissint.ch: Die Nachrichtendienste und ihre geheimen Klubs: Ein Einblick in die unbekannte Seite der Antiterrrorkooperation in Europa (Oct. 2018
- The Intercept: The powerful global spy alliance you never knew existed (March 2018)
- Lux ex Umbra: Five Eyes SIGINT governance: Meetings galore
- Stratfor.com: Five Eyes and the Perils of an Asymmetric Alliance
- NSA document about Foreign Relations Mission Titles
- About Canada and the Five Eyes Intelligence Community (pdf)
- Duncan Campbell, Echelon and its role in COMINT
- Declassified NSA paper about Third Party Nations: Partners and Targets