The NSA's regional Cryptologic Centers

(Updated: February 28, 2024)

For many years, the US National Security Agency (NSA) was identified with its almost iconic dark-glass cube-shaped headquarters building at Fort Meade in Maryland.

Only when Edward Snowden stepped forward in 2013, the public learned that there's also a large NSA facility in Hawaii - which is actually one of four regional centers spread across the United States.

- History of the NSA's Cryptologic Centers

- Cryptologic Centers inside the US: Hawaii - Georgia - Texas - Colorado

- Cryptologic Centers outside the US: Europe - Afghanistan

Update: two other NSA offices are located in Alaska and Utah

History of the NSA's Cryptologic Centers

The history of the NSA's regional operation centers is described in the 60th Anniversary Book of the agency from 2012:

"In the 1970s and 1980s, NSA leadership grew concerned over the centralization of functions at Fort Meade. Partially prompted by the need to find adequate space for its personnel and equipment, the Agency began to look at moving some assets away from the Fort Meade area.

In this light, in 1980 a Remote Operating Facility (ROF) at Kunia was established on the Hawaiian island of Oahu. Although living costs were high there, Kunia had the advantage of proximity to the Commander in Chief, Pacific (CINCPAC).

In the late 1980s, the cryptologic leadership began developing the Regional Security Operations Center (RSOC) concept. Proven computer and communications technology allowed NSA to delegate SIGINT authority to these regional centers, thus avoiding an overconcentration in the Washington area.

Under the RSOC doctrine, each center would be "hosted" by one of the military services so that all services could be represented.

In 1995 the centers opened and NSA began to transfer missions to them. The Kunia facility was given a new status as an RSOC.

Over the next decade, the RSOCs evolved from limited operations centers into mini "regional NSAs" in Georgia, Texas, Hawaii and Colorado with the following mission benefits:

• Consolidation of cryptologic operations
• Dispersion of facilities from the Washington, D.C. area
• Capability of serving as alternate communications centers
• Representation of all military services.

The concept of "regional NSAs" was reinforced when NSA suffered a massive computer outage early in 2000, and the RSOCs, as components that could operate independently, picked up the essential missions until NSA was back in full operation. Today all four centers, now known as Cryptologic Centers, are operational, expanding, and provide redundancy in the event of an emergency."

Cryptologic Centers inside the US

Officially acknowledged and listed on the NSA's official website are the four Cryptologic Centers which are located inside the United States. Especially those in Hawaii, Texas and Georgia are fairly large facilities with a few thousand employees each and consisting of both operations and data centers.

The Cryptologic Centers in Hawaii, Texas and Georgia each cover a geographically defined part of the earth, while the Cryptologic Center in Colorado is responsible for air and space based collection systems.

NSA/CSS Hawaii (NSA-H)

- Established in 1980 as a Remote Operating Facility (ROF), which was turned into the Kunia Regional Security Operations Center (KRSOC) in 1995 and became a Cryptologic Center in 2005 (or 2011).

- Initially located in the Kunia Tunnel complex in Honolulu, Hawaii. Currently located in the Joseph J. Rochefort building, a $ 358 million and 250,000 square-foot complex near Wahiawa in Honolulu that was opened in January 2012.

- NSA/CSS Hawaii collaborates "with other agencies, private industry, and foreign governments across the Indo-Pacific region to deliver critical cybersecurity and signals intelligence and directly influence and execute US national policy. NSA-H combines geographic and functional expertise to accomplish this mission, while also investing in the long-term development of cyber threat knowledge."

- Hosted by the US Navy.

- Number of employees: 3054 (345 civilians, 2582 military, 127 others) in 2008; 4018 (557 civilians, 3240 military, 180 others) in 2012.

- Area of responsibility: the Pacific Rim and Far East, Southeast and Southwest Asia.

- Supports the Indo-Pacific Command of the US Armed Forces.

- Cloud system: -

- SIGAD: USJ-750

- See also: Wikipedia - Cryptome - Cryptome - CBS News

The Joseph J. Rochefort Building of NSA/CSS Hawaii in Honolulu, Hawaii (2019)
(still from CBS News - click to enlarge)

NSA/CSS Georgia (NSA-G)

- Established in 1995 as the Fort Gordon Regional Security Operations Center (GRSOC) and turned into a Cryptologic Center in 2005.

- Located at Fort Gordon (since 2022: Fort Eisenhower) in Augusta, Georgia, currently in the John Whitelaw building (codenamed Sweet Tea), a $ 286 million and 604,000 square foot complex that was opened in March 2012.

- NSA/CSS Georgia conducts "time-sensitive operations for tactical, operational, and national-level indications and warning requirements which support global and regional security objectives. NSA-G also employs capabilities and expertise required to harden and defend national security systems. It specializes in working closely with military customers to understand their operations, their requirements, and their culture to ensure that signals intelligence is tailored and responsive to the needs of the warfighter."

- NSA-G also includes the alternate National Security Operations Center (NSOC, project DECKPIN) which serves as a back-up for the NSOC at NSA headquarters.

- Hosted by the US Army.

- Number of employees: 2930 (410 civilians, 2173 military, 347 others) in 2009; 4319 (732 civilians, 2997 military, 590 others) in 2012.

- Area of responsibility: Europe, North Africa, the Middle East, the Near East and the Persian Gulf.

- Supports the European Command and the Central Command of the US Armed Forces

- Cloud system: -

- SIGADs: USN-18 and USJ-800

- See also: Wikipedia - Cryptome - SIDtoday - NSA OIG

The John Whitelaw Building of NSA/CSS Georgia at Fort Gordon (2012)
(photo: NSA - click to enlarge)

NSA/CSS Texas (NSA-T)

- Established in 1995 as the Medina Regional Security Operations Center (MRSOC) and turned into a Cryptologic Center in 2007.

- Initially located on the Medina Annex of Lackland Air Force Base near San Antonio, Texas. In 2005, the NSA acquired a former Sony chip fabrication plant in the Northwest Side of San Antonio for $ 30.5 million and invested as much as $ 300 million to transform the 470,000 square feet complex into the current Texas Cryptologic Center (TCC, codenamed BACONRIDGE). This facility consists of a workspace building and a datacenter with 3 rooms belonging to NSA/CSS Texas and 3 rooms belonging to corporate NSA.

- NSA/CSS Texas conducts "foreign signals intelligence activities to inform policymakers and defeat adversaries, performs cybersecurity operations to prevent and eradicate threats to National Security Systems, and develops new and innovative capabilities to support both missions. NSA-T oversees the Texas Security Operations Center (TSOC) and other NSA 24/7 functions, and thereby serves as a nerve center for NSA management of global, time-sensitive activities, including the ever-present duty of information assurance."

- Hosted by the US Air Force.

- Number of employees: 2136 (302 civilians, 1689 military, 145 others) in 2008; 3405 (839 civilians, 2318 military, 248 others) in 2012. In 2022 probably some 3000 employees were part of the Cybersecurity Directorate (CSD).

- Area of responsibility: Middle and South America, the Caribbean and the Atlantic littoral of Africa.

- Supports the Southern Command and the Central Command of the US Armed Forces.

- Cloud system: gmALAMO (2012)

- SIGADs: USN-26 and USJ-783

- See also: Wikipedia - Cryptome - Cryptome

NSA's Cryptologic Center in San Antonio, Texas (2013)
(photo: William Luther - click to enlarge)

NSA/CSS Colorado (NSA-C)

- Established in 2003 as the Denver Security Operations Center (DSOC) and turned into the Colorado Cryptologic Center (CCC) in 2005.

- Initially located in temporary buildings at the Aerospace Data Facility (ADF-C) at Buckley Air Force Base in Aurora, near Denver, Colorado. In 2012, a new $ 141 million building was planned to provide space for 850 NSA employees .

- In November 2023, NSA started building a Joint Cryptologic Center (JCC) at NSA Colorado, which will house office space for the NSA-C Service Cryptologic Elements and the new Rocky Mountain Learning Center.

- NSA/CSS Colorado works "alongside the National Reconnaissance Office (NRO) and the National Geospatial-Intelligence Agency-Denver to produce integrated intelligence to defense, intelligence, and civil agencies supporting the US government and its allies. NSA-C is the overhead Technical Signals Intelligence (TechSIGINT) collection and processing enterprise center, the global overhead SIGINT mission management hub, a cryptologic discovery leader, and the Electronic Intelligence (ELINT) analysis and tradecraft development focal point for the NSA/CSS enterprise."

- Co-located with the joint NSA-NRO Overhead Collection Management Center (OCMC) which manages spy planes and spy satellites.

- Number of employees: 1324 (237 civilians, 938 military, 115 others) in 2008.

- Cloud system: gmDEN (2012)

- SIGAD: USJ-751

- See also: Wikipedia - SIDtoday - SIDtoday

The Aerospace Data Facility at Buckley Air Force Base in Aurora, Colorado
(image: Google Earth - click to enlarge)

Additional functions of the Cryptologic Centers

Shore support

According to a document from the Snowden cache, the Cryptologic Centers in Hawaii, Texas and Georgia also have a Fleet Information Operation Centre (FIOC), each of which include a Maritime Cryptologic Integration Centre (MCIC).

These MCICs are responsible for so-called cryptologic shore support: providing technical SIGINT information to cryptologic teams embarked in mobile sea, air and land units. A fourth MCIC is based at RAF Digby in Lincolnshire in the United Kingdom.


Cyber defense

The Cryptologic Centers not only process and analyze collected data, but also include a regional NSA/CSS Threat Operations Center (NTOC). These combine the NSA's Signals Intelligence (SIGINT) and Information Assurance (IA) missions in order to detect cyber threats against vital computer networks of the US Defense Department.

It was at the NTOC of the Cryptologic Center in Hawaii that Snowden had his last and only analytical job as an infrastructure analyst tracking Chinese hackers.


Hacking operations

As described in several editions of the internal newsletter SIDtoday, the NSA's hacking division TAO started to conduct Computer Network Exploitation (CNE) operations also from the cryptologic centers, first in 2004 in Hawaii, followed in 2006 by Texas and Georgia. In 2008, NSA/CSS Texas had some 60 TAO operators, a number that was planned to rise to 270 in 2015.

The TAO hacking unit at the NSA/CSS Texas Cryptologic Center
(source: NSA Texas presentation - click to enlarge)

Other NSA offices inside the US

Besides the four Cryptologic Centers, the NSA has two additional offices in the United States: one in the state of Alaska and one in the state of Utah.

NSA Alaska (NSA-A)

- Established in 2020 as successor of the Alaska Mission Operations Center (AMOC).

- Located on the Joint Base Elmendorf and Richardson (JBER) outside of Anchorage, Alaska.

- NSA Alaska provides "time-critical combat intelligence to U.S. theater battle commanders, unified and specified commands, national and Department of Defense leadership, as well as operating and sustaining sensitive communications and computer systems in support of national intelligence missions." NSA-A also has a 24/7 watch floor, the Alaska Security Operations Center (ASOC).

- Area of responsibility: ?

- Number of employees: ?

- Cloud systems: ?

- SIGAD: ?

NSA Alaska with the former Elephant Cage antenna (1996-2016)
(photo: US Air Force - click to enlarge)

NSA Utah (NSA-U)

- It's likely that NSA-U is the successor of the Utah Regional Operations Center (UROC / F7U / USJ-755) which was already active in 2010. NSA-U apparently also incorporated the mission of the Utah Regional Language Center (URLC), which the NSA had opened at a Utah National Guard facility in Draper in 2006.

- NSA Utah is most likely also related to the Utah Data Center (UDC) near Bluffdale, which was completed in May 2014 at a cost of $ 1.5 billion.

- In 2022, the joint Inspectors General conducted an inspection of NSA Utah and identified several areas for improvement.

- Number of employees: at least 200 military and civilians.

- Cloud systems: gmCAVE, gmPEACH (2012)

- SIGAD: ?

The 1.5 million square feet Utah Data Center near Bluffdale, Utah
(photo: AP/Rick Bowmer - click to enlarge)

Cryptologic Centers outside the US

Not officially acknowledged are the Cryptologic Centers which are located outside the United States. From the Snowden revelations we know the existance of the following two centers, which are much smaller than those inside the US and also process and disseminate data and information from the NSA's Second and Third Party partners.

European Cryptologic Center (ECC)

- Established in April 2004 as the European Security Center (ESC) and turned into the European Security Operations Center (ESOC) in July 2006. In May 2011 it became a Cryptologic Center and got its own NTOC.

- Initially located at the Dagger Complex of the US Army outside Griesheim, near Darmstadt in Germany. In 2016, the ECC moved to the newly built $ 91 million Consolidated Intelligence Center (CIC) at the Lucius D. Clay Barracks near Wiesbaden in Germany, where there's also a new $ 30.4 million Information Processing Center (IPC).

- Hosted by the US Army Intelligence and Security Command (INSCOM).

- Number of employees: some 240 military and civilians (in 2011).

- In 2006, the ECC's national mission focused on select Counterterrorism targets, select Sub-Saharan Africa and Middle East and North African (MENA) targets, SIGINT Development and Geospatial Analysis missions. Its theater missions included Force Protection, Global War on Terrorism support, Pan Sahel, and targets in West Africa.

- Supports the European Command and the Africa Command of the US Armed Forces.

- SIGADs: USM-44 (ESC) and USJ-753 (ESOC)

- See also: Die Spurensuche - Wikipedia - Electrospaces.net

The former European Cryptologic Center (ECC) near Griesheim in Germany (2014)
(Photo: AP - click to enlarge)

The Consolidated Intelligence Center (CIC) under construction
at the Lucius D. Clay Barracks near Wiesbaden
(Image: Google Earth - click to enlarge)

Afghanistan Regional Operations Cryptologic Center (A-ROCC)

- Established in October 2009 and fully operational in the Winter of 2010. The center was closed somewhere before July 1, 2021, when the US left Bagram Airfield.

- The A-ROCC was located in 17,000 square-foot office spaces at Area 82 of Bagram Airfield north of Kabul in Afghanistan.

- Number of employees: over 250, 120 of whom were linguists (in 2009), including personnel from all countries participating in the Afghanistan SIGINT Coalition (AFSC).

- Supported US and Coalition forces throughout Afghanistan.

- See also: SIDtoday - The Intercept

The buildings of the A-ROCC at Area 82 of Bagram Airfield near Kabul (2010)
(source: GCHQ presentation - click to enlarge)

In crisis regions there may be other, smaller Regional Operations Cryptologic Centers (ROCCs) as before the large A-ROCC was established, there was a ROCC in place since 2005 which mainly supported the Regional Command-East of ISAF.

Another Cryptologic Center outside the US may have evolved from the Misawa Security Operations Center, which is located on Misawa Air Base in Misawa, Japan. There it could serve as a signals intelligence hub for the NSA's partners in the Pacific Rim region, similar to the European Cryptologic Center for its European partners.