STELLARWIND Classification Guide

8/12/2019 STELLARWIND Classification Guide

1/37


2/37

TOP SECRETIISI ORCONINOFORN

(U//FOUO) STELL RWIND Classification Guide

(U) National Security Agency/Central Security Service (NSA/CSS): Classification Guide Number: 2-400

(U/IFOUO) Project/Activity Name: STELLARWIND (STLW)

(U) Office of Origin: NSAlCSS Signals Intelligence Directorate (SID)

(u/IFOUO) POC: William J Amass, CT Special Projects

(U) Phone: 963-0087/963-0491(s)

(U/IFOUO) Classified By: Keith B. Alexander, Lieutenant General, United States Army, Director, National Security Agency.

(U) Declassify On: 25 Years*

(U/IFOUO) Note: This guide provides classification guidance for information requiring marking and handling under the STELLAR WIND specialcompartment.

(TS//SI/INF) In January 2008, the Director of National Intelligence authorized certain information associated with STELLARWIND, as well asrelated information authorized under Foreign Intelligence Surveillance Court (FISC) orders (such as the Large Content Foreign IntelligenceSurveillance Act (FISA) orders, Business Records (BR) FISA orders and the Pen Register Trap and Trace PRITT) FISA orders), to be removed fromthe STELLAR WIND compartment. This guide addresses information associated with STELLAR WIND and associated classification instructions,while classification guidance associated with FISA information can be found, in one location, in an NSAlCSS FISAlProtect America Act(PAA)IFISA Amendments Act (FAA) classification guide authored by NSA SID Oversight and Compliance (SV). Consequently, this document will

reference an NSAlCSS FISAlPAAlFAA classification guidance where information formerly associated with STELLARWIND is now authorized bythe FISC. Also, this document references classification guidelines for FISAIP AAlF AA information and within Exceptionally Controlled Information(ECI) compartments within NSA where necessary. Users should reference both guides to determine proper classification. Additional Annexes areprovided as additional information to assist the users of his guide.

(TS//SI/INF) The markings TSP and Compartmented were at times used in briefing materials and documentation associated with theSTELLAR WIND program. TSP and Compartmented were used primarily by the National Security Agency (NSA) Legislative Affairs Office(LAO), NSA Office of General Counsel (OGC), and the Executive Branch in briefings and declarations intended for external audiences, such asCongress and the courts. The term TSP was initially used in relation to only that portion of the Program that was publicly disclosed by the

TOP SECRET SI ORCONINOFORN


3/37

T P SECRETIISIJ/ORCONINOFORN

President in December 2005. These markings should be considered the same as the STELLARWIND marking, but should not be directlyassociated with the program. The identifier STARBURST was also used in the earliest days o he program and should also be considered thesame as STELLARWIND.

Description of Information lassification ReasonIMarkings

1 (U) The fact that NSA had Presidential UNCLASSIFIED N A

authority to intercept the internationalcommunications o people with known linksto al Qaida and related terroristorganizations.

2. (U) The fact that activities conducted UNCLASSIFIED N Aunder Presidential authorization have helpeddetect and prevent possible terrorist attacksin the United States and abroad.

T P SECRETIISIJ/ORCONINOFORN

Declassification RemarksDate

N A (U) I authorized the NationalSecurity Agency, consistentwith U.S. law and theConstitution, to intercept theinternational communicationso people with known links toAl Qaida and related terroristorganizations.

N A

(U) Presidential publicstatement on 17 December2005 from the Roosevelt Roomin the White House.

(U) And the activitiesconducted under thisauthorization have helpeddetect and prevent possibleterrorist attacks in the UnitedStates and abroad.


2


4/37

T P SE RETIISIIIOR ONINOFORN

Description o Information lassification Reason Declassification RemarksIMarkings Date

3 (U) The fact that activities authorized UNCLASSIFIED N/A N A (U) The activities I authorizedunder Presidential authority were reviewed are reviewed approximately

approximately every 45 days. every 45 days.


4. (U) The fact that the Program authorized UNCLASSIFIED N A N A (U) I have reauthorized thisby the President was reauthorized more than program more than 30 times30 times. since the September the II

attacks


5 (U) The fact that Leaders in Congress UNCLASSIFIED N A N A (U) Leaders in Congress havewere briefed more than a dozen times on the been briefed more than a dozenPresidential authorizations and the activities times on this authorization andconducted under them. the activities conducted under

it.


T P SE RETIISIIIOR ONINOFORN 3


5/37

T P SECRETIISII ORCONINOFORN


6 (U) The names o members o Congress UNCLASSIFIED N A N A (U) Only Congressionalwho received Terrorist Surveillance Program members' names (with dates o

(TSP) briefings and dates o those briefings. respective briefings) werereleased.

(U) Unclassified list oCongressional names andbriefing dates released byODNI in May 06. ContactNSA OGC or LAO for the list.

7 (U) The fact that the Presidential UNCLASSIFIED N A N A (U) The President hasauthorization permitted NSA to intercept authorized a program to engagecontents o communications where one party in electronic surveillance o a

to the communication was outside the United particular kind, and this wouldStates. be the intercepts o contents ocommunications where one othe - one party to thecommunication is outside theUnited States.

(U) Attorney General AlbertoGonzales public statement atthe News Conference on 19December 2005 regarding NSAsurveillance with White House

Press Secretary McClellan.

8 (U) The term STELLAR WIND with UNCLASSIFIED N A N A (U//FOUO) The termno further context. STELLARWIND or the

abbreviation STL W whenstanding alone isUNCLASSIFIED.

T P SECRETIISII ORCONINOFORN 4


6/37

T P SE RETIISIIIOR ONINOFORN


9 (U) Official Executive Branch statements UNCLASSIFIED N A N A (U) As this descriptionspecifically associating TSP, the collection o demonstrates, the terrorist

phone communications, and NSA surveillance program describedinvolvement with no amplifying details. by the President is very

narrow. Because it is focusedon international calls oindividuals linked to al Qaeda..

(U) Public statement byAttorney General Gonzales atAsk the White House forum 25January 2006.

(U) The particular aspect othese activities that thePresident publicly describedwas limited to the targeting forinterception without a courtorder o internationalcommunications o al Qaedaand affiliated terroristorganizations coming into or

going outo

the United States.

(U) Unclassified letter from theDirector o NationalIntelligence J.M. McConnell toSenator Arlen Specter on 31July 2007.

10. SIINF) The fact that STELLARWIND, SECRETIINOFORN Executive Order 12958, as 25 Years*with no further context, is an anti-terrorism amended, Paragraph 1.4( c)program. (hereafter 1 4(c ))

T P SE RETIISIIIOR ONINOFORN 5


7/37


8/37

T P SECRETIISI ORCONINOFORN


16. U//FOUO) The full list of all individuals TOP SECRETIISTLWI 1.4 c) 25 Years* SI NF) The full list of allcleared for STELLARWIND or who had SII/ORCONINOFORN individuals cleared for

access to STELLARWIND data. STELLAR WIND or who hadaccess to STELLAR WINDdata is classified TOPSECRETIISTLW/SIIIORCONINOFORN due toidentifiable relationshipsbetween individuals and withother agencies, to includename, organization, andposition. Classified due torevealing the totality of heSTLW program.

17. U//FOUO) The entire listing ofNS 1.4 c) 25 Years*personnel cleared for STELLAR WIND

a. U//FOUO) with no a. TOP SECRETIIamplifYing details such as NOFORNdetailed organization,mission, role, etc.).

b. UIIFOUO) with amplifYing b. TOP SECRETIISIIIdetails. NOFORN



9/37

Description of Information

18. (U) Identity of Department of Justice(DOJ) attorneys who publicly represent or

have represented NS or have been publiclyidentified as cleared for TSP.

19. (U//FOUO) Names of Executive (notincluding NSA), Legislative, or JudicialBranch personnel cleared for STL W whohave not been publicly identified by theExecutive Branch.


lassificationIMarki

UNCLASSIFIED

(U) See Remarks

TOP SECRETIISTLWIISII ORCONINOFORN

Reason

Exemption 3

1.4(c)


Declassification RemarksDateN A U//FOUO) Comments:

25 Years*

Consult NS OGC for a list of

those specific DOJ attorneyswhose association with theTSP program isUNCLASSIFIED.

SI NF) This determinationaddresses the fact that in manycases the phrase cleared forTSP , with no amplifyingdetails, was used to identifyDOJ attorneys workin g STL Wprogram matters.

(U//FOUO) The names ofspecific individuals in theGovernment who have notbeen publicly identified by theExecutive Branch as clearedfor STL W remains classified asSTL W beca use of identifiablerelationships betweenindividuals and with otheragencies, to include name,organization, and position.

8


10/37

T P SECRETIISIIIORCONINOFORN


20. TS//SIIINF) STLW counterterrorism TOP SECRET//SI 1.4(c) 25 Years* TS//SVIOCINF) Specificallyinformation used to evaluate the quantity or ORCONINOFORN addresses the number o

value o STELLAR WIND collection based reports, tippers, or leadson products/tippers/leads provided without generated under STL W. Anyreference to targets, methods or techniques. information revealing or

naming Special SourceOperations (SSO) programssupporting STELLAR WINDmust also include additionalmarkingslExceptionalControlled Information (ECI)sfor the program(s) as specifiedby SSO.

21. TS//SIIINF) Information that reveals the TOP SECRET//SI 1.4(c) 25 Years* (TS/ SINF

This classificationscope o STELLAR WIND collection against ORCONINOFORN determination allowsvarious methods o communication, information concerning the factincluding voice, data networks, facsimile, o various methods oetc. without details o the special collection under STL W, andauthorization subsequently authorized under

FISA (17 Jan 2007) or PAA 5Aug 2007), to be handledoutside o STL Wcompartmented channels -Example: Data Flow X isDigital Network Intelligence

(DNI) collection under theSTL W program - no furtherdetails.



11/37



22. TSIISIIINF) Information that reveals the TOP SECRETIISIII 1.4 c) 25 Years* Example: TSIISIIIOCINF)breadth and success of STELLAR WIND ORCONINOFORN The number of Requests For

collection against specific terrorism-related Information RFls) generatedentities such as the number of tippers under the STELLAR WINDpublished, number of published product program was 15,000.reports, and numbers of Requests forInformation answered without detailingtarget selectors, without details of he specialauthorization

23. TSIISIIINF) Information that reveals TOP SECRETIISTLWI 1.4 c) 25 Years* CIISIIIREL TO USA, FVEY)details of the operational relationship SIIIORCONINOFORN Note: SSO may require thatbetween the STELLAR WIND program, the this information be markedFISA Large Content, FISA BR, and FISA with additional caveats ECI

PRITT Orders, the P AA collections, and the WPG for WHIPGENIE).FAA collections. Please see the ECI WPGclassification guide.

TSIISIIINF) Informationcomparing ongoing

ISNP NF AA operations tothe specifics of hePresidentially-AuthorizedProgram will remaincompartmented as STL W

24. TSIISIIINF) STLW counterterrorism TOP SECRETIISTLW/ 1.4 c) 25 Years* TSIISI/INF) Dictates that alllistings or reports detailing the totality of SIIIORCONINOFORN program reports briefingsspecific techniques and selectors targeted containing detailedunder the STELLAR WIND program STELLAR WIND target lists or

specific techniques, withassociation to the specialauthorization continue to bemarked TOP SECRETIISTLW/SIIIORCONINOFORN

U) See also Portal section.

TOP SECRETIISII ORCONINOFORN 10


12/37


25. SIINF) Information that reveals thescope of operations under the Presidential

authorization. Such as collect iontechniques, targets, or other operationaldetails)

26. U//FOUO) The fact of FBI collaborationon the STELLARWIND program

a. U//FOUO) The associationof he termsSTELLARWIND and FBI

b. U//FOUO) The fact thatNSA provided the FBIinformation collected underthe Presidentially Authorizedprogram.


lassificationIMarkin

TOP SECRETIISTLWISIIIORCONINOFORN

a. UNCLASSIFIEDIIFOUO

b. UNCLASSIFIEDIIFOUO

Reason

1.4 c)

Exemption 3

Exemption 3

c. SIINF) The fact that FBI c. SECRETIINOFORN 1.4 c)played an operational role inthe program and detailsdescribing that role.

T P SECRETIISI//ORCONINOFORN


25 Years* SIINF) Information thatsummarizes or otherwise

specifies the scope ofoperations authorized by thePresident, but not publiclydisclosed, remainscompartmented. Example:

N/A

N/A

25 Years*

Program Briefings, ProgramMemos, NSA LAO NSAOGC summaries, etc.

SI NF Operational detailsabout collaboration between

NSA and FBI and FBI sinvolvement in the STL Wprogram such as specifictargets, specific sources,methods, etc.) will raise theclassification toTOP SECRETIISTLW/SIIIORCONINOFORN


13/37


14/37



28. (U) Information about communications (U) electronicproviders. communication service

providers play an importanta (U) The fact that UNCLASSIFIED N A N A role in assisting intelligence

communications service officials in national securityproviders provide assistance activities. Indeed, thein national security activities intelligence community cannot

obtain the intelligence it needswithout assistance from these

b (TSIISII NF) Information TOP SECRETIISTLWI 1.4( c) 25 Years* companies.revealing the cooperative SII/ORCONINOFORNrelationships with, and (U) From the 26 October 2007identities of, U.S. Senate Select Committee ontel ecommunications Intelligence report: Foreignproviders under the Intelligence Surveillance ActSTELLAR WIND of 1978 Amendments Act of

authorities. 2007.

(U) See also: Unclassifiedtestimony of Kenneth LWainstein, Assistant AttorneyGeneral, National SecurityDivision, before SenateCommittee on the Judiciary on31 October 2007.

(U) Details may requireadditional protection within anECI.

29. (UIIFOUO) Aggregate program funding TOP SECRETIISI I 1.4(c) 25 Years*information associated only with the NOFORNSTELLAR WIND cover term.

T P SECRETIISI ORCONINOFORN 13


15/37


30 (U//FOUO) Detailed programmaticinformation that reveals the overall cost of

the STELLAR WIND program in contextwith operational details.

31. (U//FOUO) Budget submissions orinformation that reveals the detailedtechnical characteristics of any individualitems funded by the STELLAR WINDprogram including size, capabilities, andfunctions.

32. (TSIISIIINF) Specific details identifyingcollection capabilities or capacities withoutrevealing the methods of STELLAR WINDcounterterrorism target communications.


lassificationIMarkings

TOP SECRETIISTLWISI ORCONINOFORN


SECRETIISIREL TO USA, FVEY

A t a minimum

Reason

1.4(c)

1.4(c)

1.4(c)



25 Years* (U//FOUO) Information thatwould provide an

understanding of the totaloverall budg et for the STL Wprogram remainscompartmented and is notreleasable to contractors.

25 Years*

25 Years*

(U//FOUO) Information thatwould provide anunderstanding of he totaloverall budget for the STL Wprogram remainscompartmented and is notreleasable to contractors.

(CIISIIIREL TO USA, FVEY)May be TOP SECRET orNOFORN if source details areprovided. Special compartmentmarking based on SSOguidance (ECI WPG) requiredif source details are included.

4


16/37

Description o Information

33 (TS//SIIINF) Information that reveals inany way the location of facilities th at

provided access and/o r collection whether insummary or detailed terms and is associatedwith STELLAR WIND.

34 (TS//SIIINF) Dataflows or associateddata created to support collection derivedfrom STELLAR WIND program withoutrevealing the details of the Presidentialauthorization.

35 (U//FOUO) Specific performanceparameters for search analysis detection orselection.

36. (S/INF) Descriptions, diagrams,schematics, or other technical documentationthat identifies specific SIGINT methods,techniques and devices used to select, filterand process STELLARWIND targetcommunications without specific reference tothe authorization and details concerning thecreation of he STELLARWIND program.



TOP SECRETIISTLW/SIIIORCONINOFORN

TOP SECRETIISI//NOFORN

TOP SECRET//SIIINOFORN

TOP SECRET//SIIIOR ONINOFORN

Reason

1.4(c)

1.4( c)

1.4(c)

1.4(c)


DeclassificationDate

25 Years*

25 Years*

25 Years*

25 Years*

Remarks

(C//SIIIREL TO USA, FVEY)Information that would provide

an understanding of thepartnership/location for theprogram is covered by the ECIWPG SSO compartment.

(C//SIIIREL TO USA, FVEY)This information is alsoprotected b y the S SOcompartment (ECI WPG).

(TS//SIIINF) Clarifies that thesequence of ransition eventsleading up to P AA enac tmentand its associated operationalconsiderations do not requireSTL W compartme ntedprotection for LCF and PAAdata.

(TS//SIINF) For example,response times, capacities, andloading would revealoperational details of program.

(U//FOUO) Information maybe otherwise controlledcompartmented by SSO.Amplifying details may beprotected within an ECI.

5


17/37



37. TS//SI/INF) Metadata analysis and TOP SECRET//SII/ 1.4 c) 25 Years* U//FOUO) Informationtarget development, techniques, and results OR ONINOFORN currently marked as STL W

conducted under the STELLAR WIND such as reports, databaseprogram, with no details about the special records, etc.) remainsauthorization or the access points from which compartmented untilwe have gathered the data. appropriate action is taken

under Executive Order 12958,as amended. Program specificsconcerning output and analyticresults may be downgraded toTOP SECRET//SI//ORCON/NOFORN, but informationmay not be removed from theSTL W c ompartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM, S 12Information Sharing Services,and NSA OGC). The NSAOGC can be used as an initialPOC/contact point.



18/37


38. TSIISI/INF) Information revealing thefact that a specific terrorism-related group

had been targeted using theSTELLAR WIND authorities - no detailsabout the special authorization.

39. TSIISI/INF) Digital NetworkIntelligence DNI) metadata acquired underPresidential authoriza tion pre-I 7 July 2004metadata)



TOP SECRETIISI/ORCONINOFORN


Reason

1.4 c)

1.4 c)



25 Years* (SIINF) Specific individualSTELLAR WIND Terrorism

targets will be classified TOPSECRETIISTL W/SII/OCI NF.However, large entities such asa terrorist group do not requirecompartmentation. The STL WProgram Manager OfficePMO) documents, such as

PMO memos, revealing groupstargeted and effective dates

25 Years*

remain STL W c ompartmented.

TSIISI/INF) The pre-I 7 July2004 metadata repository isembargoed and remains in theSTL W compartment. Accessto it requires coordination withNSA OGC as it may implicatecertain FISA court orders.

U//FOUO) This data is not online and is sequestered.

U) See Annex A for additionaldetails.

7


19/37


40. TSIISI/INF) Dialed NumberRecognition metadata acquired under

Presidential authorization pre 24 May 2006metadata archive)


lassificationIMarki

TOP SECRET//SII/NOFORN

Reason

1.4 c)



25 Years* U//FOUO) Informationcurrently marked as STL W

such as reports, databaserecords, etc.) remainscompartmented untilappropriate action is takenunder Executive Order 12958,as amended. Program specificsconcerning output and analyticresults may be downgraded toTOP SECRET//SII/ORCONINOFORN, but informationmay not be removed from theSTL W compar tment without

approval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DlPM, S 2Information Sharing Services,and NSA OGe . The NSAOGC can be used as an initialPOC/contact point.

TS//SI/INF) Access to the pre-May 2006 metadata archive isat the TSI/SII/OCINF level.However, the data must betraceable by authorization e.g.,Presidential Directive).

U) See Annex A for additionaldetails.

8


20/37

TOP SECRETIISIIIORCONINOFORN


41. TSIISI/INF) Content Analysis using TOP SECRET//STLW/ 1.4 c) 25 Years* U//FOUO) Target Office willSTELLAR WIND derived information to SI//ORCONINOFORN add ORCON and NOFORN

develop lead information or to report on the caveats to all intelligenceactivities of specific terrorism-related products derived fromentities. STELLAR WIND-authorized

accesses.

U//FOUO) Informationcurrently marked as STL Wsuch as reports, database

records, etc.) remainscompartmented untilappropriate action is takenunder Executive Order 12958,as amended. Program specificsconcerning output and analyticresults may be downgraded toTOP SECRET/ISIIIORCON/NOFORN, b ut informationmay not be removed from theSTL W compar tment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM, S 12Information Sharing Services,and NSA OGe . The NSAOGC can be used as an initialPOC/contact point.

TS//SI/INF) Access to dataidentified by STELLAR WINDSIGINT Address hereafterSIGAD US3170) will be



21/37


42. TSIISI/INF) The SIGINT addressSIGAD) US3170 when associated with the

STELLAR WIND program and contentcollection.



TOP SECRETIISIIINOFORN

Reason

1.4 c)



25 Years*

Remarks

allowed on a case-by-casebasis by the STL W Program

Manager. Reporting derivedfrom this collection must beclearly identified as to source.

2


22/37



43. TS//SIIINF) Unevaluated, unminimized TOP SECRET//STLW/ 1.4 c) 25 Years* U//FOUO) Informationcontent intercept alone, identified with SII/ORCONINOFORN currently marked as STL W

SIGAD US3170, without knowledge of such as reports, databaseaccess techniques. records, etc.) remains

compartmented untilappropriate action is takenunder Executive Order 12958,as amended. Program specificsconcerning output and analyticresults may be downgraded toTOP SECRET//SI//ORCON/NOFORN, but informationmay not be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM S 2Information Sharing Services,and NSA OGe . The NSAOGC can be used as an initialPOC/contact point.

TS/ SIIINF) Access to dataidentified by SIGAD US3170will be allowed on a case-by-case basis by the STL WProgram Manager. Reportingderived from this collectionmust be clearly identified as tosource.



23/37



44. TS/ISIIINF) Processed traffic labeled TOP SECRETIISTLW/ 1.4 c) 25 Years* U) See Remark for 43.with SIGAD US3170 such as verbatim SII/ORCONINOFORN

transcripts, transcription notes or otherrelated information) that does not disclosespecific methods or techniques as associatedwith STELLAR WIND authorizations.

45. TSIISIIINF) Program traffic, acquired TOP SECRETIISII/ 1.4 c) 25 Years* UIIFOUO) Access to programfrom accesses but never disseminated and not NOFORN material such as this should beassociated with SIGAD 3170, such as coordinated with NSA OGCunevaluated, unminimized, verbatim and the appropriate SIGINTtranscript or gisted traffic that does not authority. The NSA OGe candisclose specific methods or techniques as be used as an initialassociated with authorizations POC/contact point.

46. UIIFOUO) Association of specific TOP SECRET/ISTLWI 1.4 c) 25 Years* UIIFOUO) Informationtasking to a specific STELLAR WIND data SII/ORCONINOFORN currently marked as STL Wsource. remains compartmented until

appropriate action is takenunder Executive Order 12958,as amended. Informat ion maynot be removed from theSTL W compartment withoutapproval from an appropriateOriginal Classification

Authority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM, S 2Information Sharing Services,and NSA OGe . The NSAOGC can be used as an initialPOC/contact point.



24/37


47. TS//SIIINF) Infonn ation that reveals thespecific telephone number or email address

of a targeted terrorism-related entity orindividual tasked with STELLAR WINDauthorities.

48. U//FOUO) Analyst Holdings hardcopyand softcopy)- Documentation marked asSTELLA R WIND.


lassification

TOP SECRET//STLW/SI//ORCONINOFORN

TOP SECRET//STLW/SII/ORCONINOFORN

Reason

1.4 c)

1.4 c)



25 Years*

25 Years*

Remarks

U//FOUO) Infonnationcurrently marked as STL W

remains compartmented untilappropriate action is takenunder Executive Order 12958,as amended. In fonnatio n maynot be removed from theSTL W compartm ent withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM, S 12

Infonnation Sharing Services,and NSA OGe . The NSAOGC can be used as an initialPOC/contact point.

U//FOUO) The records reviewand administrative debriefingprocess will be used to helpinfonn analysts on what stepsto take concerning theirpersonal records.

U//FOUO) Continue to protectas STLW. See Annex B.

3


25/37

TOP SECRETIISII ORCONINOFORN

Description o Information lassifi cation Reason Declassification RemarksIMarkings Date

49. U//FOUO) Any document related to TOP SECRETIISTL W 1.4 c) 5 Years* UIIFOUO) These documentsSTL W Program Management decisions SI//ORCONINOFORN will be available from the

Program Memos, Due Diligence Notes, etc.) portal only to STL W PMOpersonnel or to other STL Wauthorized and clearedindividuals.

50. TSIISIIINF) Documentation concerning TOP SECRETIISII/ 1.4 c) 25 Years* TSIISI/INF) Remove from theFISA PRITT and FISA BR court orders NOFORN STL W compartment - see thesuch as: appropriate NSA/CSS

Declarations FISAIP AAIF AA and ECI

Applications WPG classification guide. Court Orders Primary and Secondary) Reports or updates TSIISII NF) Court Orders,

Associated motions required reporting,Applications, Declarations, andassociated motions containNSA ECI information, but arenot marked as such because oguidelines on how courtdocuments are marked andhandled. Therefore, theyrequire additional controls andprotection and must be handledinternally as ECI.

TOP SECRETIISIIIORCONINOFORN 24


26/37


53. TSIISI/INF) STLW counterterrorisminformation contained in the Requests For

Information RFI) segment o he Numbersdatabase, currently marked STL W

54. TSIISI/INF) Digital NetworkIntelligence DNI) Metadata Reports -Includes all metadata reporting derived fromspecial authorization or FISA courtauthorization and currently marked



TOP SECRETIISTL W SI/ ORCONI

NOFORN

TOP SECRETIISTLWISII/ORCONINOFORN

Reason

1.4 c)

1.4 c)

T P SECRETIISI IORCONINOFORN


25 Years* U//FOUO) Restrict access tothe legacy RFI information on

the portal to all but a cadreo

cleared SIGINT IntelligenceDirectorate Counterterrorismpersonnel. RFIs will be used toidentifY information needed tobe reviewed and subsequentlyremoved from the STL Wcompartment.

25 Years*

U//FOUO) Informationcurrently marked as STL Wremains compartmented until

appropriate action is takenunder Executive Order 12958,as amended. Information maynot be removed from theSTL W c ompartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManage r PM) or DIPM, S 12Information Sharing Services,and NSA OGC). The NSAOGC can be used as an initialPOC/contact point.

TSIISIIINF) Although theDirector o NationalIntelligence decision seeintroduction section o thisguide) allowed NSA to remove

27


27/37

TOP SECRET SII ORCONINOFORN


STELLAR WIND. certain data from the STL Wcompartment, not all legacy

data to include reporting) wasautomatically removed fromthe STL W compartment.Consequently there is reportingin the STL W databases that seligible to be removed from thecompartment, but was not. Thedata still carries a STL Wmarking and must be protectedas such until it s formallyremoved from thecompartment. Consequently, its necessary to restrict access to

existing reports to all but acadre of cleared SIGINTIntelligence DirectorateCounterterrorism personnel.Additional RFI can be used toidentify information needed tobe reviewed and subsequentlyremoved from th e STL Wcompartment. Distribution maybe expanded. f reporting sremoved from the S TL Wcompartment and reissued,procedures must be in place sothat the source of heinformation can be readilydetermined.

U//FOUO) Informationcurrently marked as STL Wremains compartmented untilappropriate action is taken

TOP SECRETIISI ORCONINOFORN 28


28/37



under Executive Order 12958,as amended. Infonnation may

not be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM, S 2Infonnation Sharing Services,and NSA OGe . The NSAOGC can e used as an initialPOC/contact point.

U//FOUO) MaintainSTELLAR WIND controls onexisting reports. Remove fromthe STL W compartment andrelease in new fonnat ifrequired. Individual reportsmay e reclassified to TOPSECRET//SI//ORCONINOFORN, but mustbe cancelled and reissued, inthe new fonnat, at the newclassification, afterdecompartmentation. Tearlinescannot be re-distributedwithout reissuing the originalreport.

55. TS//SI/INF) Dialed Number TOP SECRET//STLW/ 1.4 c) 25 Years* TS//SI/INF) Although theRecognition DNR) Metadata Reports SI//ORCONINOFORN Director of NationalIncludes all metadata reporting derived from Intelligence decision seespecial authorization or FISA court introduction section of his



29/37



authorization and currently marked guide) allowed NSA to removeSTELLARWIND certain data from the STL W

compartment, not all legacydata to include reporting) wasautomatically removed fromthe STL W compartment.Consequently there is reportingin the STL W databases that iseligible to be removed from thecompartment, but was not. Thedata still carries a STL Wmarking and must be protectedas such until it is formallyremoved from the

compartment. Consequently, itis necessary to restrict access toexisting reports to all but acadre of cleared SIGINTIntelligence DirectorateCounterterrorism personnel.Additional RFI can be used toidentify information needed tobe reviewed and subsequentlyremoved from the STL Wcompartment. Distribution maybe expanded. f reporting sremoved from the S TL Wcompartment and reissued,procedures must be in place sothat the source o f heinformation can be readilydetermined.

U//FOUO) Informationcurrently marked as STL Wremains compartmented until



30/37

TOP SECRET SI O RCONINOFORN


appropriate action is takenunder Executive Order 12958,

as amended. Information maynot be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM, S 12Information Sharing Services,and NSA OGe . The NSAOGC can be used as a n initial

POC/contact point

UIIFOUO) MaintainSTELLAR WIND controls onexisting reports. Remove fromthe STL W compartment andrelease in new format ifrequired. Individual reportsmay be reclassified to TOPSECRETIISIIIORCONINOFORN, but must

e cancelled and reissued, inthe new format, at the newclassification, afterdecompartmentation. Tearlinescannot be re-distributedwithout reissuing the originalreport.

56. TSIISIIINF) NSNCS S disseminated TOP SECRETIISTLWI 1.4 c) 25 Years* TSIISIIINF) Although theserialized STL W product derived from SIIIORCONINOFORN Director of NationalSTELLAR WIND and currently marked Intelligence decision see

TOP SECRETIISI ORCONINOFORN 3


31/37


Description o Information lassifi cation Reason Declassification RemarksIMarkings Date

STELLAR WIND introduction section of hisguide) allowed NSA to remove

certain data from the STL Wcompartment, not all legacydata to include reporting) wasautomatically removed fromthe STL W compartment.Consequently there s reportingin the S TL W databases that iseligible to be removed from thecompartment, but was not. Thedata still carries a STL Wmarking and must be protectedas such until it s formally

removed from thecompartment. Consequently, itis necessary to restrict access toexisting reports to all but acadre of cleared SIGINTIntelligence DirectorateCounterterrorism personnel.Additional RFI can be used toidentify information needed tobe reviewed and subsequentlyremoved from the STL Wcompartment. Distribution maybe expanded. f reporting sremoved from the S TL Wcompartment and reissued,procedures must be in place sothat the source of heinformation can be readilydetermined.

U//FOUO) Informationcurrently marked as STL W



32/37




Reason



Remarks

remains compartmented untilappropriate action is takenunder Executive Order 12958,as amended. Informat ion maynot be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINTauthority STL W ProgramManager PM) or DIPM S 2Information Sharing Services,and NSA OGC). The NSA

OGC can be used as an initialPOC/contact point.

U//FOUO) MaintainSTELLAR WIND controls onexisting reports. Remove fromthe STL W compartment andrelease in new format irequired. Individual reportsmay be reclassified to TOPSECRET//SII/ORCONINOFORN, but mustbe cancelled and reissued, inthe new format, at the newclassification, afterdecompartmentation. Tearlinescannot be re-distributedwithout reissuing the originalreport.

33


33/37


Description of Information lassification Reason Declassification RemarksIMarkings Date

57. TS//SIIINF) STLW PMO TOP SECRETIISTLW 1.4 c) 25 Years* U//FOUO) Remains protectedcounterterrorism documentation such as SIIIORCONINOFORN under the STL W compartment.

Program Memorandum or other Program Infonnation currently markedManagement Office documentation currently as STL W remainsmarked STELLAR WIND. compartmented until

appropriate action is takenunder Executive Order 12958,as amended. Infonnation maynot be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINT

authority STL W ProgramManager PM) r DIPM, S 2Infonnation Sharing Services,and NSA OGC). The NSAOGC can be used as an initialPOC/contact point.



34/37


Description of Information lassification Reason Declassification RemarksIMarkings Date

58. U//FOUO) NSA OGe documentation TOP SECRET//STLW/ 1.4 c) 25 Years* U//FOUO) Remains protectedcurrently marked STELLARWIND. SI/ ORCONINOFORN under the STL W compartment.

Information currently markedas STL W remainscompartmented untilappropriate action is takenunder Executive Order 12958,as amended. Information maynot be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINT

authority STL W ProgramManager PM) or DIPM, S 2Information Sharing Services,and NSA OGe . The NSAOGC can be used as an initialPOC/contact point.



35/37


Description o Information Classification Reason Declassification RemarksIMarkings Date

59. U//FOUO) NSA IG documentation TOP SECRET//STLW/ 1.4 c) 25 Years* U//FOUO) Remains protectedcurrently marked S TELLAR WIND. SII/ORCONINOFORN under the STL W c ompartment.

Information currently markedas STL W remainscompartmented untilappropriate action is takenunder Executive Order 12958,as amended. Informat ion maynot be removed from theSTL W compartment withoutapproval from an appropriateOriginal ClassificationAuthority and in coordinationwith the appropriate SIGINT

authority STL W ProgramManager PM) or DIPM S 2Information Sharing Services,and NSA OGC). The NSAOGC can be used as an initialPOC/contact point.

*25 years: Declassification in 25 years indicates that the information is classified for 25 years from the date a document is created or 25 years from the date of hisoriginal classification decision, whichever is later.

U) ANNEX A

TSIISIIINF) FISA PRITT and BR

TS//SI/INF) Information acquired under court authorization via FISA PRITT or FISA BR, but currently marked STLW e.g. FISA PRITT or FISA Rinformation commingled in databases with other STL W information, or otherwise controll ed as STL W due to overlapping authorizations), is eligible to beremoved from the STL W compartment. However, information may not be removed from the STL W compartment without appropriate action by an originalclassification authority under Executive Order 12958, as amended, or coordination with the STL W Program Manager PM) or D/PM, S 2 Information Sharing



36/37


Services, and OGC. The NSA OGC can be used as an initial POC/contact point. Although compar tmented controls may be removed from the FISA PRITT andFISA BR information currently marked STL W court ordered access controls and classificat ion guidelines must continue to be observed. Users should note thatclassification guidance for FISAlPAAIFAAIFAA information can be found in an NSAlCSS FISAlPAAlFAA guide.

TS//SI/INF) For example, the FISA/PAA/FAA classif ication guide should be consulted when deriving classification for FISA PRITT or FISA BR informationcurrently marked STL W such as:

TS//SI/INF) FISA PRITT initiated 17 July 2004)1. TS/ SI/ NF FISA PRITT information collected, stored, processed under FISA authorization.2. TS//SI/INF) FISA PRITT targeting information - email address forms, query requests and approvals, selectors queried, query results, alert lists.3. TS//SI/INF) FISA PRITT-related Mainway databases, realms data flows and all related technical data, collection statistics, and software.4. TS//SI/INF) FISA PRITT-related working aids, briefing materials, query logs, etc.

TS//SI/INF) BR FISA initiated 24 May 2006)1. TS/ SI/ NF FISA R information collected, stored, processed under FISA authorization.2. TS//SI/INF) FISA R targeting information - address forms, query requests and approvals, selectors queried, query results, alert lists, etc.3. TS//SI/INF) FISA BR-related Mainway Databases, realms data flows and all related technical data, collection statistics, and software.

4. TS//SI/INF) FISA BR-related Working Aids, briefing materials, query logs, etc.

U) ANNEX B

U) Preservation Requirements and Other Related IssuesU//FOUO) Documentation you have originated memos, analytic summaries, etc.) - do not destroy/remove/delete. Please contact the SID PMO for questions.

Your records may constitute valuable temporary or permanent records and may be transferred to a designated official or records officer, records include documentscreated regarding STL W policies, decisions, procedures and essential operational, logistical and support transactions.

U//FOUO) SIGINT Reporting -You are authorized to retain published reporting marked with the STL W caveat, however further dissemination of theinformation contained in those reports must be coordinated through the SIGINT Intelligence Directorate Counterterrorism R I process and accurately sourced tothe original STL W report number/title.



37/37


TSIISIIIREL TO USA, FVEY) Other STL W information - Record Retention Order - In addition to your obligations under Federal Records Act and NSA Policy,you are reminded that Judge Vaughn Walker, USDJ, issued a Preservation order on November 6 2007 relating to litigation challenging the surveillance activitiesauthorized by the President after the attacks of September 11, 2001. You should preserve and retain any hardcopy or electronic - including email) information,documents or data that may be relevant to that litigation. If you have any questions about this obligation, you should contact your Office of General Counsel.

SIINF) NSA-generated materials submitted to a court in support of ongoing litigation which contains facts that reveal scope and scale of the PresidentiallyAuthorized Program should be handled as STLW. Note: Many litigation documents were marked as TSP instead ofSTLW. These documents, and supportingfacts, relate directly to the special authorizat ion and remain STL W compartmented.


Documents

STELLARWIND Classification Guide