D Thoelke Buchw713od0e1

Principles of
Radio Intelligence
Solutions for modern COMINT systems
on the basis of TRS
Company Confidential
Principles of Radio Intelligence
MEDAV GmbH
Grfenberger Strae 32-34
91080 Uttenreuth
Germany
+49 9131 583-0
+49 9131 583-11
info@medav.de
www.medav.de
Document
w713od.0e1 - Version V1.2, 17 July 2013
Author
Volkhard Thoelke
Copyright
This document is protected by copyright laws.
Trademarks
For better legibility, in this document marking of trademarks is waived. This should not mislead to
the assumption that these trademarks are to be used freely by anybody.
Contact for Errors or Complaints
When editing this document, greatest importance was attached to completeness and correctness.
Even so, if you find an error or incompleteness, please contact
MEDAV GmbH, +49 9131 583-0, info@medav.de
The document is subject to change without prior announcement.
Page 2/58
MEDAV GmbH 2013 Specification subject to change
w713od.0e1
Contents
List of diagrams ....................................................................................................................................... 4
1.
2.
Intelligence its contribution to national security ........................................................................... 5

1.1.
Tasks of radio intelligence .................................................................................... 7
1.2.
Potential capabilities and limits of radio intelligence ............................................ 8
Radio intelligence in detail .............................................................................................................. 9

2.1.
Terms of reference ............................................................................................... 9
2.2.
Basic requirements ............................................................................................. 10
2.3.
Structure ............................................................................................................. 15
2.4.
Tasks/functions................................................................................................... 18
2.4.1.
2.4.1.1.
Acquisition Control ............................................................................................. 19
2.4.1.2.
Search ................................................................................................................ 19
2.4.1.3.
Technical Analysis ............................................................................................. 24
2.4.1.4.
Acquisition/Processing ....................................................................................... 26
2.4.1.5.
Significance of direction-finding/location-finding for searching, identification and

evaluation .......................................................................................................... 29
2.5.
Intelligence processing and target knowledge ................................................... 31
2.5.1.
Overview............................................................................................................. 31
2.5.2.
Report pre-processing ........................................................................................ 33
2.5.3.
Preliminary (Report) Analysis ............................................................................. 34
2.5.4.
Evaluation of reports and reporting .................................................................... 37
2.5.5.
Processing target knowledge ............................................................................. 39
2.6.
3.
Intelligence Gathering ........................................................................................ 18
Military radio intelligence .................................................................................... 41
2.6.1.
Tasks and special features of tactical radio intelligence .................................... 42
2.6.2.
Tactical radio intelligence (COMMS ESM) ......................................................... 43
2.7.
Mission management ......................................................................................... 47
2.8.
Networking and Communication ........................................................................ 49
2.9.
Data storage ....................................................................................................... 50
Elements of an IT Infrastructure for automated signal processing systems .............................. 51

3.1.
Motivation: continuous adaptation ...................................................................... 51
3.2.
Autonomous high-availability systems ............................................................... 52
3.3.
Hardware errors.................................................................................................. 52
3.4.
Software errors ................................................................................................... 53
3.5.
Configuration ...................................................................................................... 53
3.6.
Boot process....................................................................................................... 54
3.7.
Software distribution ........................................................................................... 54
3.8.
Scheduling .......................................................................................................... 55
3.9.
Monitoring and management.............................................................................. 56
3.10.
Software maintenance ........................................................................................ 56
3.11.
Maintenance ....................................................................................................... 57
w713od.0e1
Page 3/58
List of diagrams
Figure 1: Radio intelligence an important source of intelligence .......................................................... 7
Figure 2: Overview of radio intelligence ................................................................................................ 16
Figure 3: Overview of IG ........................................................................................................................ 18
Figure 4: IG - searching ......................................................................................................................... 22
Figure 5. IG - Acquisition/Processing ................................................................................................... 27
Figure 6: An overview of IP .................................................................................................................. 32
Figure 7: IP pre-processing ................................................................................................................ 33
Figure 8: IP preliminary analysis ........................................................................................................... 36
Figure 9: Analysis and reporting ............................................................................................................ 38
Figure 10: Military COMINT / radio intelligence ..................................................................................... 41
Page 4/58
w713od.0e1
1. Intelligence its contribution to national security

The global political changes in the wake of the dissolution of the Warsaw Pact and the end of the
East-West conflict did not, as hoped, result in greater peace and security the world over. On the
contrary, they have been followed by the development of numerous regional conflict zones with
ethnic crises and wars.
There has also been a sharp increase in numerous other activities and disputes in many areas of
the world that could jeopardise the security of the international community. As a result, national
security interests are now no longer exclusively concerned with the military threat to their own
countries, and instead the main priorities of national security authorities are now the activities of
terrorist organisations, paramilitary forces, criminal structures in the fields of drugs and human
trafficking and operations involving weapons proliferation, money laundering and white-collar
crime.
This development has led to a reassessment of the security situation in numerous countries and to
a subsequent re-alignment of national security policies with far-reaching consequences for military
organisations, police and security services.
Intelligence obtained on the forces, structures and activities listed above has always played a
decisive roll in the evaluation and improvement of national security situations. Intelligence for the
purposes of defence is intended to help identify the enemys capabilities (potential), objectives,
plans and preparations as early and reliably as possible to enable suitable pre-emptive action or
countermeasures to be initiated in good time. Where this is not possible, the intelligence should at
least monitor the day-to-day activities of the enemy and provide precise situation reports. These
reports can be used as the basis for the implementation of appropriate emergency action and
countermeasures.
All the malevolent forces and organisations mentioned above rely heavily on technology for open
and conspiratorial communications for the command and control and coordination of their
operations. These command and control links are used to plan, prepare and perform actions that
jeopardise our security. Since these forces and organisations are usually active on a supraregional level, the necessary command and control links are also established on a supra-regional,
and often even global, level.
This is precisely the starting point with regard to the use of technology to gather intelligence on the
communications channels used. As military forces and the other types of forces mentioned above
all require a high degree of mobility for their operations, their command and control links, i.e. their
communication links, have also been adapted to meet these requirements.
w713od.0e1
Page 5/58
Mobile communications are only possible using radio technology. This covers a wide spectrum of
radio services and frequency ranges, from HF radio to satellite radio, and more recently, following
the introduction of wireless data transmission systems, even the use of LAN technology (WLAN).
All of these should be the targets of intelligence gathering.
Radio intelligence, which is generally of a passive nature, and hence cannot be detected by the
enemy, can be used to identify the enemys command and control links, and in many cases,
penetrate these links as unauthorised users. However, the usage habits and rules vary greatly
according to the type radio service or the (user) organisation. Consequently, the methods and
equipment used to detect command and control links and gather intelligence relevant to the
mission also vary greatly. The requirements in terms of reconnaissance technology and
reconnaissance personnel are correspondingly high.
The following chapters endeavour to provide a comprehensive overview of radio intelligence (RI)
and to describe the tasks, methods and diverse functional areas in a process-based and general
manner. It is not be possible to go into detail with regard to the numerous methods and strategies
for the acquisition and evaluation of the wide variety of possible communications/signals relevant
to the mission in radio intelligence. This goes beyond the scope of this work and would also violate
the provisions of national security.
Chapter 2.5 deals exclusively with military radio intelligence and its special features plus the
aspects
it
has
in
common
with
the
radio
intelligence
employed
in
other
national
organisations/services.
Page 6/58
w713od.0e1
1.1.
Tasks of radio intelligence
Intelligence generally exploits a wide variety of potential sources. These range from human
sources (HUMINT) right up to airborne or satellite photographic and radar intelligence (IMINT,
SATINT, etc). Within this broad spectrum encompassing the most diverse range of tasks, radio
intelligence represents one important cornerstone of communications intelligence (COMINT).
Figure 1: Radio intelligence an important source of intelligence

The task of radio intelligence services is to use the medium of radio to find and obtain intelligence
from the command and control links of the targets in question these could be military or
paramilitary organisations as well as terrorist or criminal forces within the focus area of the security
services. Intelligence on these organisations aims at providing timely information on the command
and control and organisational structures and interrelationships and, if possible, their objectives,
plans and current activities.
One of the objectives of radio intelligence is to make important contributions to the assessment of
ones own threat and security situation and, by means of early identification, provide time for preemptive action or suitable countermeasures in the sense of timely interventions. In this way, if
employed successfully at the correct time, radio intelligence can also make a contribution to
conflict and crisis management.
w713od.0e1
Page 7/58
1.2.
Potential capabilities and limits of radio intelligence
As mentioned, radio intelligence obtains information on the enemy from the enemys radio
communications. Therefore, a basic precondition for this type of intelligence is to find and acquire
the radio communications. In addition to reception, the acquisition task also includes rendering the
signal useful for analysis, to obtain information on the enemy within the remit of the
reconnaissance mission.
This basic task is dependent upon numerous factors:
physical parameters, such as frequency, distance to the emitter, time of day/year
(especially in the HF range), reception level, quality of the radio channel, etc.
operational or technical factors, such as transmitter emission direction, transmit level,
type of radio service, transmission mode, encryption etc.
strategic factors, such as the potential own resources, means of camouflage and hence
possible proximity to the enemy, duration of the acquisition mission, manned or unmanned
use of the reconnaissance technology, etc.
The results of the acquisition and the information directly produced from this are consequently very
different. Frequently, the only intelligence obtained is on the operational parameters of the radio
communications. This is generally the case with encrypted traffic. Nevertheless, when interpreted
correctly, operational findings can also provide information on the strategic background that gave
rise to the radio communications. Such findings are also important for supplementing or updating
ones own target knowledge. This target knowledge is in turn a basic precondition for successful
radio intelligence as it provides decisive (advance) knowledge and hence assists in the detection,
classification, processing and analysis of the radio traffic relevant to the mission.
In conjunction with the target knowledge and supplementary information from other sources,
experienced analysts can often use operational parameters of radio communications to deduce
details of enemy structures, objectives, activities and potential capabilities. This underlines the fact
that, although radio intelligence is important, it is still only one source of intelligence. Only the
pooling and joint/ combined analysis of all relevant information from all available sources can
provide a comprehensive and sufficiently reliable picture of the situation.
Here, we should mention an important principle of reconnaissance:
The information and findings obtained from intelligence on objectives, plans, preparation and
performance of activities that pose a threat to security and on the enemys potential capabilities are
exclusively the result of ones own analyses and evaluations. There always remains an
unquantifiable uncertainty factor that necessitates the continuous checking and updating of the
results of the reconnaissance.
Page 8/58
w713od.0e1
2. Radio intelligence in detail

2.1.
Terms of reference
The basic mission of radio intelligence is to identify from the numerous emissions in the entire
spectrum of possible frequency ranges those radio communications that are important for ones
own reconnaissance and to acquire, process and analyse them with the aim of obtaining the
required information and knowledge about the enemy from this traffic. Particular importance is
attached to the chains of command, that are the enemys command and control links, since these
generally provide important knowledge on the enemys activities and plans and hence can make
an important contribution to ones assessment of the situation.
These terms of reference are not only applicable to intelligence on military organisations/units.
They are equally applicable to intelligence on terrorist or criminal organisations, the only difference
being that the command and control and communication behaviour in these areas is clearly
different from that used by the military and hence sometimes other approaches to acquisition and
analysis are necessary.
However, the basis objective of all radio intelligence is the same in all operations. Its mission is to
gain intelligence from the radio communications of the target groups in question in terms of:
their location (groups or individual) or place of deployment (troops)
their strength, their capabilities/ their potential
their objectives and concrete plans
their preparations and on
the implementation of all actions or measures affecting national security and the
security of national forces.
One of the main tasks in connection with the above targets is the early detection (early
identification) of enemy plans and preparations. If this is successful, there will be time and
opportunity to take appropriate pre-emptive action. This is an important precondition for crisis
management.
In the military field, radio intelligence is also understood as an early warning system with a focus
on tactical events on the battlefield to provide the military commander with important information on
the tactical situation and hence on the threat situation (see also chapter 2.5).
w713od.0e1
Page 9/58
2.2.
Basic requirements
Two factors determine the efficiency of ones own radio intelligence:

a suitable, high-performance technical infrastructure
experienced and well trained personnel
Technical infrastructure:
Since, from both a technical and a strategic point of view, radio intelligence has to cover a broad
spectrum of tasks, the technology and infrastructure required may vary greatly for different terms of
reference. This means that the preparation of a radio intelligence system for a successful operation
is heavily dependent upon the mission in question and the associated strategic framework. This in
turn places high requirements on the development and design of modern radio intelligence
systems, and in particular on the flexibility that enables them to be adapted simply, rapidly and
inexpensively to the changing tasks and requirements.
Chapter 3 describes in detail the innovative way in which MEDAV has dealt with this requirement in
its system solutions.
The following is a list of the basic capability requirements for modern radio intelligence systems:
High performance reception technology,
able to detect signals relevant to the mission, even in radio intelligence locations that are
frequently unfavourable for reception technology, and to acquire them in a quality sufficient
for subsequent signal processing. Important influential factors here are antenna gain and
the dynamic response of the receivers.
High probability of acquisition
Frequently, radio intelligence gatherers have little or no knowledge of the times at which the
enemy will be active or which radio system, operating mode and frequency will be used.
When searching over large frequency ranges with numerous emissions, only high-capacity,
automatic wideband receivers are able to identify the majority of communications relevant
to the mission at any time, classify them as such and make them accessible to a
processing component.
Direction-finding or location-finding ability:
Generally, the large number of emissions detected means that wideband detection systems
rapidly reach the limit of their capabilities when classifying emissions with the aim of
selecting only those relevant to the mission, unless effective selection or exclusion criteria
(filters) are used at an early stage in the processing chain to reduce the number of
emissions sent for further processing.
Page 10/58
w713od.0e1
In the majority of missions, particularly in strategic radio intelligence, specific information is

already available on the known or suspected locations (for target persons/target groups) or
the target areas (for military forces) thanks to prior findings (target knowledge).
The
determination of the direction from which a detected emission is received is therefore a very
effective selection criterion at the start of the signal processing chain. This filter is even
more reliable and effective but also much more complex if it is possible to identify the
location of the majority of the signals (see Chapter 2.4.1.5 for further details).
Direction-finding/bearing and location-finding are also important tools for identifying the
emitters detected, that is in the assignment of the transmitters as belonging to the targeted,
i.e. sought users.
High-capacity computer and storage technology:
Due to the large number of signals and complex processing tasks, the operation of
wideband detection systems has to be automated to a large extent. Automation and the
high number of signals to be classified and processed require a high level of computing
power with a flexible load distribution to enable the system to respond appropriately to the
frequently changing load situations.
Wideband HF detection technology necessitates the intermediate storage of the frequency
interval/range to be processed (time signal). This requirement is met by means of a ring
memory with a high memory depth. The wideband radio intelligence systems from MEDAV
have, as standard, an intermediate storage capacity of several hours.
This dimensioning enables the entire frequency range specified for the mission to be
processed without signal losses. Intermediate storage means that signals classified as low
priority can be processed later and those with an inadequate classification or processing
result can be processed several times (possibly with the assistance of an experienced
operator and suitable analytical tools), until a satisfactory result is obtained.
However, searching for and processing signals in higher frequency ranges
(>30 MHz)
requires other technical approaches and strategies, as the frequency range sought is
generally too extensive for intermediate storage techniques alone(see also Chapter
2.4.1.2).
w713od.0e1
Page 11/58
Suitable classification and processing procedures:

Modern communications technology is making increasing use of complex digital
transmission modes that guarantee high transmission integrity and quality. With their
numerous protocol layers, low channel-adapted transmit levels, high-capacity encryption
procedures and variable usage of the selected frequency band, these modern transmission
modes place high requirements on the capabilities of the radio intelligence systems
required to detect and classify these signals, and if applicable group them together correctly
and process them like an authorised receiver.
MEDAV specialises in the development of systems that enable unauthorised participants
(gatherers) to acquire and process communications of this type.
Modularity and standardisation:
The frequently changing demands on radio intelligence systems and constantly and rapidly
changing technology require the hardware and software to be highly flexible and adaptable.
It has to be possible to upgrade and retrofit systems quickly without any serious problems
at a justifiable expense for different missions and to upgrade them in line with technological
advances.
This is ensured through the use of commercially available standard computer technology, a
high degree of hardware and software modularisation and through the use of standard
software modules and software interfaces (e.g. CORBA).
High-capacity communications means:
The number and locations of the sensors (antennas and detection systems) should be
selected in accordance with the special features of the targeted radio services frequency
ranges used, range and directional characteristics of the emissions, physical distribution of
the emitters in question etc. and the basic operating parameters. Regardless of whether
they are manned or unmanned, suitable, high-capacity communications means should be
provided for the command and control of these sensors and the transmission of all the
results obtained to the responsible organisational unit for further processing and analysis.
Page 12/58
w713od.0e1
Suitable analytical tools:

Radio intelligence and other sources generally provide very different types of raw material
to be sent for analysis. The increasing use of encryption in modern radio services usually
makes it impossible to identify the content of these radio communications.
Nevertheless, if equipped with suitable (software) tools and methods, an experienced
analyst can obtain a large amount of mission-relevant information on the enemy from
intelligence on the technical details of the radio communications. To do this, analysts must
be in possession of suitable and up-to-date target knowledge and analytical procedures
specific for the task in question. Such capabilities can automatically select the
raw/operational data collected, correlate them with corresponding data from the target
knowledge and supply the analysts with the intermediate results and indications required for
their analyses and situation reports. In special cases, automatic processing can also supply
important triggers for urgent reports/warnings.
In many cases, analysts are even able to determine the content of the radio
communications in the mission. Once again, suitable tools can assist and take the strain off
analysts in their routine tasks thematic screening of the material, translation, provision of
suitable target knowledge and information from other sources, report generation, etc.
Details of information processing (analysis) are given in Chapter 2.4.2.
Personnel:
The second important basic requirement for successful and efficient radio intelligence is the
training and provision of sufficient personnel able to meet the high standards relating to diverse
specialist qualifications and with the necessary experience for the tasks assigned to them.
Modern radio intelligence gatherers are required to satisfy the following requirements profile:
As far as the collection (acquisition) and processing of intelligence is concerned, it is only
possible to gain the required detailed knowledge of the communications behaviour of the
specific target group after many years of experience. Information/knowledge of this kind is
a decisive precondition for effective mission control and the reliable interpretation or
analysis of the results of the acquisition.
The rapid technological changes in radio intelligence technology have resulted in a
significant change in the specialist technical requirements profile for the personnel
responsible for acquisition and analysis. It is now much more demanding and much more
complex. While previously their tasks and capabilities focused on the professional handling
of a series of manually operated search and drop receivers, reliable classification of a
signal using the gatherers eyes, ears and analysis experience etc, nowadays personnel
must also have a high degree of IT know-how and skills.
w713od.0e1
Page 13/58
In addition to their traditional functions, the operators of modern radio intelligence systems
will in future also have to configure and, to a limited degree, manage extremely complex,
networked computer technology and software structures for an extremely wide range of
operational scenarios.
The operators, in particular the gatherers, have to understand the extensively automated
operational sequences in the system (workflow) and be able to interpret the results of the
individual functions correctly and, if necessary, correct them.
The main workhorse used by gatherers and analysts today is the PC, which is used to
control numerous virtual devices, tools and functional sequences.
Gatherers are now primarily concerned with the monitoring and control of the extensively
automated search and acquisition/processing systems. The actual tasks involved in the
gathering of intelligence detection, segmentation, classification and processing of the
signals are performed automatically by the system. However, gatherers/operators must
also be able to investigate on site all signals/transmission modes that the automatic radio
intelligence system is unable to classify and/or process (demodulate and decode) with the
analytical tools available. The aim of this important and demanding task is to determine the
parameters required for automatic further processing and transfer them to the system. If
this is not possible, the signals are recorded with the analytical results achieved and
submitted to an extensive external investigation in a central analytical unit (see also
Chapter 2.4.1.3).
Page 14/58
w713od.0e1
2.3.
Structure
The basic task of radio intelligence the detection, acquisition and processing of communications
relevant to the mission in all the radio services and frequency ranges used by the enemy also
defines its structure.
Although it is true that the different services and frequency bands determine the procedure,
technology and tools required for the reconnaissance mission in question, the functional
sequences, that is the structure, of radio intelligence are in principle the same.
Figure 2 (page 16) provides a rough overview of this structure and shows the interrelationships and
interdependencies of the main functional areas.
The following is a short introduction to these areas. A more detailed description may be found in
subsequent chapters:
The mission describes the intelligence interest of ones own command and control with its
specific objectives and points of emphasis.
From this, mission control derives the individual measures/missions required to carry out
the mission and forwards them to the organisational units responsible Intelligence
Gathering (IG), Intelligence Processing (IP) and the central reporting department assigned
to mission control.
Mission control monitors performance of the mission and results and, if necessary for the
task in question, assigns supplementary missions to the above-listed organisational units.
Intelligence Gathering is the sensor area of radio intelligence. With the aid of suitable
acquisition and direction-finding technology adapted to the reconnaissance mission in
question, and taking into account the different operational procedures adapted for the
particular terms of reference, IG searches for radio communications relevant to the mission.
If possible IG determines their bearings (or at least provides a rough assessment of the
direction by means of a directional receive antenna) and classifies and acquires the radio
communications (including demodulation and decoding if required). The results are
forwarded/reported in a form suitable for computer processing and analysis. Technical
analysis (TA) is an important special task for Intelligence Gathering. Signals that are
potentially important for the mission, which the acquisition system is unable to classify or
process, are investigated using suitable analytical tools. The object of on site signal
analysis is to identify the reasons for these system malfunctions as soon as possible after
their occurrence and facilitate the processing of signals of this kind by making suitable
modifications to the configuration of the system modules affected. If these attempts are
unsuccessful, the signals are stored and analysed in greater detail in a central analytical
unit by signals specialists with more powerful tools
w713od.0e1
Page 15/58
Figure 2: Overview of radio intelligence
Intelligence Processing with its analysis of the raw reports provided by the intelligence
gathering service and other accessible sources is the analytical area of COMINT/radio
intelligence. Usually, this unit also processes reports from the other COMINT units and
analyses them jointly.
The raw/acquired reports prepared by Intelligence Gathering could contain information on
the signalling techniques and/or operational parameters and/or the content of the radio
communications acquired. However, even without any knowledge of the contents of the
radio messages, it is also often possible to obtain important information on the enemy in
question from the operational sequences and relationships with the aid of suitable target
knowledge. In certain cases, special features of the signalling techniques used in the radio
communications can provide important information on the activity of the intelligence targets.
Page 16/58
w713od.0e1
Ideally, these results are supplemented by detailed knowledge of the enemys plans and
activities if the radio intelligence has been able to obtain direct access to the content of the
transmitted messages (clear text, content of conversations) or if similar results have been
obtained from other sources.
The results of intelligence processing are:
reports with the information obtained on the targeted enemy (individual reports,
group reports, daily reports, etc.)
contributions to situation reports
if required, also contributions to analyses or forecasts of the enemys capabilities

and plans
The messages and reports are usually composed and structured (formatted) in a form
suitable for further processing by computer.
All messages and reports are notified or forwarded to the central reporting section.
The precondition for reliable and efficient analysis is the availability of up-to-date, verified
and comprehensive target knowledge. This must provide as complete and up-to-date a
picture as possible of the targeted enemy with radio intelligence focusing on the enemys
communication behaviour.
w713od.0e1
Page 17/58
2.4.
Tasks/functions
2.4.1.
Intelligence Gathering
Intelligence Gathering incorporates the following functional units:

Acquisition control
Search
Processing with compilation of the acquisition/raw reports
Technical analysis,
These are described in more detail below (see also Figure 3).
Figure 3: Overview of IG
Page 18/58
w713od.0e1
2.4.1.1.
Acquisition Control
The reconnaissance mission usually comprises a basic mission derived from the long-term national
security policy and numerous individual missions with specifically targeted subjects or time slots,
determined by current events and developments affecting national interests and ones security
situation. Acquisition Control is then responsible, taking into account the specified priorities, for
defining the (acquisition) missions for the suitable acquisition systems or workstations in
Intelligence Gathering.
Missions of this type are usually valid for one shift of duty or one day, but they may extend for
longer periods. Acquisition Control provides all available and necessary documents for the
performance of the acquisition missions.
These documents are mission-related extracts from the target knowledge and supplementary
databases maintained by IG. They contain all previous communications-related knowledge on the
intelligence target and further helpful data for the configuration of the acquisition systems and the
evaluation of the results of the acquisition.
Acquisition Control is also tasked with monitoring the mission performance and, if required,
correcting or following up the work of individual functional units. To perform this task it has, in
principle, direct (control) access to all important functional units or workstations involved in
searching and processing.
2.4.1.2.
Search
Searching for radio communications relevant to the mission is one of the most important and
demanding tasks of radio intelligence. The productive radio communications relative to the
reconnaissance mission can only provide the required information if they are detected, classified
and processed by the system. Therefore, success and effectiveness are primarily measured
against the probability of acquisition of signals/communications relevant to the mission.
With the large number of active emitters and frequencies/channels, the chance of the radio
communications being found and acquired in time (in particular modern digital transmission
modes, which have to be acquired from the start of the transmission, including the preamble with
the synchronisation or the protocol chat) is primarily dependent upon:
prior knowledge and
the technical capabilities of the search systems/components
w713od.0e1
Page 19/58
Prior knowledge includes all information on the communications facilities of the selected targets
and their communications habits, such as the main frequencies and modes used, the structures of
the communications relationships and radio networks, their preferred transmission times, call
names/call signs, etc.
Information of this kind is part of the target knowledge and is used for the (pre-) configuration of the
search systems in a way most likely to achieve success.
Ones own technical capabilities are dependent upon:
the degree of automation of the search system. A high degree of automation permits
continuous operation and a sufficient acquisition/classification capacity.
the wideband capability of the (automatic) search systems. Preferably, they should be able
to cover all the frequency ranges used by the targeted radio services. However, by using
suitable scanning modes, comparable results can be obtained with automated search
systems with bandwidths covering only part of the spectrum to be monitored.
the ability of the (automatic) search systems to efficiently reduce the amount of work/data
required for searching and classification. The exclusion at an early stage of detected
signals from further processing by taking into account/correlating the directional information
(obtained by means of directionally selective receive antennas or direction-finding) and
location-finding results (ideal case) or features of signals that are already available as the
result of the detection with the corresponding data/specifications available from the
prior/target knowledge, drastically reduces the number of signals that have to be subjected
to a time-consuming computer classification process in the automated search systems (for
details see Chapter 2.4.1.5).
the ability of the (automated) search systems to classify all signals/modes relevant to the
mission even in the event of a high signal volume.
the capabilities and capacities of the automated search systems to temporarily store the
frequency ranges (time signal) to be processed. In each case this must be done completely
and for a sufficient length of time for the required signal processing (detection,
classification) and for the processing to be applied to the search results (demodulation, if
necessary, decoding). In some circumstances also for any post-processing of the signals
that may be required.
In strategic HF intelligence, it is possible to intermediately store the entire band with a
storage depth of several hours. MEDAV offers according systems.
Page 20/58
w713od.0e1
In higher frequency ranges (VHF, UHF and above), it is generally no longer possible to
store the entire spectrum to be covered. Here, suitable strategies have to be employed to
enable continuous classification and parallel processing of the greatest possible number of
signals relevant to the mission.
Radio services in the VHF/UHF range and above usually make use of wide areas of the
frequency spectrum. Unlike the HF band, at present it is not possible to completely digitise
and store the frequency ranges used by these services. In this case, it is the receiver
resources and procedure used during the search that determine the chances of detecting
and being able to classify as many radio communications relevant to the mission as
possible. The following approach is one example from the large number of possible search
and acquisition strategies of how, despite the large number of frequency ranges to be
covered, it is still possible to guarantee a high probability of acquisition.
Rapidly scanning wideband receivers search the assigned frequency ranges with a high
speed and detect, measure and segment all detectable signals. If the bandwidth and (if
appropriate) result of segmentation features correspond to the search profile, downstream
wideband receivers record them for a sufficient amount of time for classification. Due to the
limited (propagation) ranges of the radio signals at the location of the reconnaissance
receivers, the signal scenario is generally very clear in these frequency ranges. The
majority of the signals detected may therefore be put into intermediate storage by the
slower downstream wideband receivers in the length required for classification,
notwithstanding the time required for the recording. All signals classified as relevant to the
mission can be sent for processing usually processing chains with traditional drop
receivers.
In the tactical area of military radio intelligence (COMMS ESM), the result of the
classification in conjunction with the directional information frequently triggers a warning
message to the responsible (affected) military commander (see also Chapter 2.5).
The functional process is on principle as follows (see also Figure 4).
w713od.0e1
Page 21/58
Figure 4: IG - searching
The automated search system receives its search missions with the documents required
for performance.
The automated system detects all emissions in the targeted frequency ranges above
specified threshold levels.
The subsequent spectral signal measurement provides the centre frequencies,
bandwidths and the signal/receive levels.
It is practical to perform the segmentation at this point i.e. the identification of grouped
spectral ranges in the time and frequency domain.
Taking into account the available directional information/direction-finding results (or even
better the locating results), if the search missions contain suitable directional or location
specifications, it is possible to exclude all signals that do not conform to this mission profile
from further processing at an early stage. However, intermediate storage or suitable search
systems/strategies facilitate the classification of all detected signals even without this
direction filter. However, this significantly increases the required computing power and
classification time. It may be assumed that if there is no direction selection, the number of
incorrectly classified signals will rise and this in turn will increase the time required for
checking and post-processing.
Page 22/58
w713od.0e1
If the signal parameters and features are available from detection and segmentation, all
signals that do not conform to the parameter/feature profile specified in the search
mission can also be excluded from the further processing in a further reduction step.
This option is also available during the further classification process.
All detections conforming to the mission profile are sent for signal classification
(determination of the type of modulation or the transmission mode). The initial findings and
indications have already been provided by detection and segmentation.
However, traditional interactive analytical procedures are not suitable for automatic
classification processes. A much more promising method is a mode forecast derived from
the available prior knowledge (in 70% of all previous cases, the enemy always used mode
xyz) and from the parameters/features obtained during detection and segmentation.
These forecasts are used as the basis for switching suitable demodulators to the signals in
question in the expectation that one of them will provide a positive result.
In the military field, this procedure makes use of tactical radio intelligence (COMMS ESM).
As a rule, only signals with specific (known) signal features are sought and processed.
If a suitable demodulator is found, the signal is generally demodulated in order to perform
automatic mode classification on the basis of the symbol stream. This uses similar
strategies to those used for automatic signal classification.
If the transmission mode/type of modulation including the encoding procedure is uniquely
defined, the signal is transferred, together with the signal and mode parameters required for
the processing, via IG/Acquisition Control to Acquisition/Processing in a pre-specified
message format.
One constant and important task of the search (and hence also processing) is the provision of
information for supplementing and updating the target knowledge. To do so, it is necessary to
systematically survey (using reconnaissance technology) important target areas or target groups
for details of the communications structures and communication behaviour, the type of
communications facilities (supplementary) used and whether any changes to the facilities,
structures and operational principles have been identified (updating). The information obtained is
reported to the analytical unit where it is incorporated in the target knowledge.
However, the search process may also be tasked with identifying possible new targets/target areas
(e.g. in the case of the development of new crisis regions or potential conflicts) in order to provide
suitable target knowledge for future reconnaissance missions. This saves preparation time and
increases the ability of ones radio intelligence forces to make a cold start in the event of possible
future missions to cover these targets.
w713od.0e1
Page 23/58
In strategic radio intelligence (HF) at least, the wideband capability of the automated search
systems means that there is no longer any need for sophisticated search strategies, such as the
case for example when searching with a limited number of narrowband search receivers. The
frequency ranges to be monitored are virtually contiguous and may be searched for without
interruption by automatic systems. However, this places high requirements on the automatic
classification, signal processing and memory capacity to ensure that even high signal volumes can
be processed (i.e. classified) automatically, with sufficient reliability/quality (high hit rate and low
error rate) and reported with the required signal/procedural parameters for setting the parameters
of the processing components.
In tactical radio intelligence in higher frequency ranges (> 30 MHz) however, it is highly probable
that suitable search strategies will be required in order to be able to detect, classify and process
the highest possible proportion of signals relevant to the mission (see the information on page 24
and 25).
However, wideband search technology does not necessarily exclude the possibility of using
traditional, narrowband search receivers - it may be expedient to use them to supplement
wideband automated search systems:
in order to close frequency gaps with expected low signal volumes for which no wideband
resources are available
or to search for radio communications important to the mission from regions on the
boundaries of the reception technology (in individual cases, the receive level may be too
low for fault-free signal processing in a wideband automatic system, but not for an optimally
tuned narrowband receiver).
2.4.1.3.
Technical Analysis
During searching, signals are frequently detected with techniques and operational parameters that
suggest that they may be extremely relevant to the mission, but which the classifier is unable to
identify, or identify sufficiently reliably, and hence cannot be processed. Signals of this kind are
forwarded with a corresponding analysis mission to Technical Analysis (TA) where they are
investigated and the reasons for the failed/faulty classification determined. The complete signals
are stored in their original form (time signal) for as long as required and can, after successful
analysis and suitable parameterisation in the processing system, be subsequently processed
without signal loss using the results of the analysis.
Technical analysis is an indispensable component of all COMINT systems and hence of all radio
intelligence systems. The integrated high-capacity measuring and analytical tools can be used
(interactively) by suitable personnel to investigate/analyse the aforementioned signals and also
unknown signals using the methods of signal and mode analysis. The task and objective of
Page 24/58
w713od.0e1
technical analysis is, on the one hand, to determine the necessary signal and mode parameters for
fault-free processing in the case of (in principle) known signals. These results are used for followup control and the assignment of new parameters for the processing components. On the other
hand, in the case of unknown signals, TA is used to precisely determine all the signal features
required for the development of suitable procedures to automatically classify and process these
radio communications.
In addition, experienced gatherers can use technical analytical tools to survey the signal scenarios
in frequency ranges that are potentially relevant to the mission and search for new/unknown
signals that appear to conform to the mission profile from the features identified (free searching at
the search and measuring station).
Another important task for TA personnel usually experienced and specially trained gatherers is
the comparative investigation and classification of individual signals/radio communications
processed by automatic systems, in particular in cases where there is cause to doubt the reliability
of the results. Such comparisons are used to check the automatic search and processing
components and to monitor their efficiency and reliability. Since, in strategic HF intelligence, all
signals are available for hours in the ring-memory; this checking can be performed without
problems and with no time pressure. In higher frequency ranges, it is necessary to record signal
samples of a sufficient length for purposes of analysis.
In the event of systematic deviations, analytical tools can be used to determine the reasons and to
reset the parameters and follow-up the system components in question as appropriate.
Recorded signals that cannot be analysed successfully with the measuring and analytical tools at
the TA workstation (search and measuring station) are forwarded to a central, better equipped and
more scientifically orientated analytical unit where they are investigated in more detail using more
specialised analytical tools/procedures.
The objective of this technical scientific analysis is to determine all the signal and mode features
required to develop suitable procedures to automatically search for and process these signals.
When using wideband technology for searching and processing, the recording and analytical tools
should also have a wideband capability.
w713od.0e1
Page 25/58
2.4.1.4.
Acquisition/Processing
The task of Processing (from the point of view of signal and mode technology) is the correct
processing of all the signals/radio communications identified by the search classification process
as relevant to the mission. The objective of this processing usually demodulation and, if required,
decoding, in special cases the identification of additionally required signal and operational
parameters is to obtain all accessible information/contents significant for analysis/evaluation from
the intercepted radio communications.
In principle, Acquisition/Processing with its numerous (individual) reports only supplies a multitude
of tiny fragments of signal-specific information regarding the radio operations and/or contents. Only
the sum total of the individual reports supplemented by additional information from other sources
enables the subsequent analysis/evaluation to derive a sufficiently precise and reliable picture of
the strategic relationships, backgrounds and sequences of the intercepted radio communications
from the extensive pieces of partial information.
Functional sequence: (see also Figure 5 on page 27)
The individual acquisition/processing tasks are derived directly from the search result
reports with the parameters derived from detection, segmentation and classification.
IG/Acquisition Control automatically generates the tasks for the numerous processing
channels and controls the allocation of resources. With each individual task, all the settings
required for correct parameterisation of the individual components in the processing chain
in question are provided.
Although acquisition/processing is largely automatic, operators/gatherers do have the
option of intervening in the automatic sequence via their workstation using an MMI tailormade for these tasks (suitable screen masks permitting all required checking and control
functions) for purposes of control or correction.
Depending upon the specifications of the mission management, the wideband (usually in
the HF range) or narrowband (exceptionally in the HF range with special signal/receive
ratios and usually in frequencies higher than HF) receiver resources are controlled with
the required processing components on the basis of the above-listed parameters/settings
and switched to the relevant signals. In special cases (known frequencies and transmission
modes; high priority for complete acquisition) wideband or narrowband processing
resources
may
also
be
permanently
preconfigured
to
such
communications/frequencies (cast-iron mission).
Page 26/58
w713od.0e1
radio
Figure 5. IG - Acquisition/Processing
In HF intelligence one decisive advantage of wideband technology, even for processing, is
that all signals in the wideband time signal are stored for a suitably long time. This enables
the processing chains implemented in the wideband chain to be applied to the start of the
targeted signals regardless of the time required for the preliminary classification and
assignment, in each case without signal loss and with complete processing. Technology of
this type can be used to avoid the problematic and undesirable signal losses that occur with
modern digital transmission modes with their preambles, using traditional, narrowband
radio intelligence systems.
Due to the large amount of memory required, this procedure can only be carried out to a
limited extent (if at all) above the HF range.
With the processing task in question, System Control provides each processing channel
with the resources/system components required for complete processing.
With traditional, narrowband technology, an available drop receiver is generally locked
onto the targeted signal by means of an antenna matrix. The required demodulator is either
already integrated in the receiver or located downstream from the IF output. The other
components are used for the further processing of the demodulated signals and divided
according to the type of signal and mode into recording, audio, decoder, modem
components, etc. They are frequently hardwired as hardware components. In the case of
modern computer-based systems, the components are generally implemented as freely
switchable software modules.
w713od.0e1
Page 27/58
Modern wideband HF search and processing systems such as those developed and
marketed by MEDAV no longer recognise the clear distinction between search and
processing components. The wideband tuner digitised signals are recorded continuously for
several hours in high-capacity ring memories and are available to all search procedures
(detection, segmentation and classification) and processing procedures (demodulation,
decoding) and, if required, signal analysis (technical analysis) without signal losses.
In the case of analogue (non-encoded) procedures (usually voice communications), the
symbol stream of the demodulated signals is sent directly for audio processing. In the
simplest case, this is a recording module that sends the content to a translator familiar with
the language in question with the required time delay. In addition to the voice/non-voice
identification, tried and tested modern language recognition facilities developed by MEDAV
can also identify the language being used. This facilitates the automatic assignment of
voice recordings to the correct translator in each case. Other high-capacity tools such as
topic spotting, word spotting and speaker identification are now available.
Digitally encoded signals/procedures are sent to suitable decoders in accordance with the
specifications for their classification - these may be closely coupled to the associated
demodulators especially with modern modes. The results (usually voice, data or ASCII text)
are now available for report preparation.
The provision of direction-finding/location-finding results on, if possible, all the radio
communications acquired and processed is also an important element of processing, at
least for signals where the sender cannot be uniquely identified. The directionfinding/location-finding results in conjunction with the prior knowledge/ target knowledge are
therefore also used for the identification of the acquired emitters (for details, see Chapter
2.4.1.5).
The information obtained from the results of the search, direction-finding/location-finding,
signal classification and processing like the technical parameters for the signal acquired,
the encoding procedure used, the operational parameters obtained from the analysed and
identified operational sequences and relationships and ideally the content of the messages
in code or clear text are inserted in computer report forms as well as attached as annexes
by the gatherer, but also increasingly automatically. The data are sent as acquisition/raw
reports via the data links provided to the evaluation unit (IP), and in special cases
(warnings/urgent reports) also immediately to the responsible units.
Page 28/58
w713od.0e1
In principle, gatherers have the same analytical tools for processing as for searching. They
can use these tools at their leisure and with a time delay to investigate all signals that
cannot be processed or cannot be processed with sufficient quality despite the fact that
they have been classified successfully. If the analysis was able to identify the causes of the
malfunctions and it is possible to successfully re-set the parameters of the
function/processing modules, the signal can be re-extracted from the memory and
completely reprocessed.
In military strategic radio intelligence, processing is performed according to the sequences listed
above. However, the tactical discipline COMMS ESM differs in its priorities and in parts of the
signal processing. Here, the detection and classification of a specific signal is in many cases
adequate for a (warning) report or for the initiation of countermeasures.
Current and reliable indications of an acute threat can only be obtained from specific procedural
and operational features or sequences and from voice communications. The same applies to a
limited extent to encrypted radio communications.
Depending upon the nature and scope of the indicators required for the identification of a current
threat, the signals are further processed individually in the processing unit. They are demodulated
and, if required, decoded (digital modes) and analysed with regard to the above-mentioned
indicators. This is generally performed automatically, but in individual cases, an experienced
operator will have to evaluate/analyse the intercepted radio communications (for example, in the
case of radio voice communications). This situation similarly applies to tactical radio intelligence for
identifying or updating the tactical scenario (that is without any acute threat).
2.4.1.5.
Significance of direction-finding/location-finding for searching,

identification and evaluation
The introduction of wideband technology for searching has increased the number of detected
emissions several-fold compared to the use of a limited number of narrowband search receivers in
traditional search systems. In particular with short-wave radio (HF), when wideband search heads
are used, the number of detections is usually so high that sometimes it is not possible to
automatically classify all the signals received with the computer power available, unless suitable
strategies to relieve the situation, i.e. to reduce the number of emissions, are taken. One of the
most important approaches to searching is to minimise the number of signals to be forwarded for
time-consuming computer classification. Minimisation is achieved by means of suitable
exclusion/filter criteria (in steps) at the earliest possible stage of processing. Ideally, all that
remains should be signals with a high relevance to the mission.
w713od.0e1
Page 29/58
The only way to achieve a reduction of this kind is to supply the known signal features, operational
sequences/features and other information useful for classification when the search missions are
assigned. These may be parameters such as (transmission) time, direction or location, frequency,
bandwidth etc. When the relevant features/parameters are identified by the system, these selection
or exclusion criteria lead, in different stages of the signal processing during the search, to the
exclusion of all signals that do not conform to the specified features.
In particular, the early correlation of the directional information for the individual emissions detected
with the specified directional data effectively reduces the number of signals requiring further
processing during the classification process.
Approximate directional information can be obtained using directionally selective receive antennas
(LP antennas or circular array antennas). More precise determinations of direction- and locationfinding can only be achieved with suitable direction-finding systems/bases.
In addition to reducing the data/effort during searching, the reliable identification of the targeted
emitters/radio stations with the aid of the direction-finding/location-finding results is of great
importance for processing (IG) and analysis (IP).
High-capacity direction-finding and location-finding systems are, consequently, indispensable
components of all radio intelligence systems, regardless of whether they are implemented in
narrowband, wideband or mixed technology. However, because of their high signal volume,
wideband searching and processing components also require direction-finding/location-finding
systems that are adapted to the capacity and bandwidths.
The only exceptions to this rule are radio intelligence systems for very specific tasks/operations in
which the limited spectrum of tasks or operations does not require or permit directionfinding/location-finding.
Suitable procedures in direction-finding systems signal assignment/comparison by means of a
comparison of parameters must ensure that the direction-finding/ location-finding results can also
be correctly assigned to the signals acquired and processed by the search/processing system.
Any location-finding results available are always a component of the acquisition reports. They
assist the analysts not only in the identification/confirmation of the emitters/radio stations and
hence of the users or organisations, but also they make it possible to determine the location/area
of the units and people targeted.
Page 30/58
w713od.0e1
2.5.
Intelligence processing and target knowledge
2.5.1.
Overview
Radio intelligence is only one important cornerstone of communications intelligence (COMINT).

All COMINT units, and hence numerous extremely different sources supply the results of their
acquisition/processing to central Intelligence Processing (IP), frequently also referred to as
COMINT analysis. These are transmitted as formatted reports due to the different sources,
usually also in different formats on the available communications links in as near real-time as
possible and stored in IP for further processing. The form of further processing, the scope of
automated and partially automated processing steps, is determined on the one hand by the
quantity and type of the reports and the ratio between operational and content-related
results/information and on the other by the configuration of the computer-based processing and
analytical tools in the IP organisation.
Due to its special function as an early warning system, tactical radio intelligence (COMMS ESM)
does not undergo the analysis process described in this chapter. Chapter 2.5 deals with its special
features.
In principle, the following functional or processing sequence has proven to be expedient: (see also
Figure 6 on page 39)
In report pre-processing, incoming data/reports of the most diverse types and formatting
are automatically recorded and stored in their original form (long-term) so they can be
suitably prepared for further processing later.
In the preliminary analysis, as the first (usually automatic) analysis/ evaluation step, the
thematic assignment and therefore thematically correct storage is determined from
operational data/information and content in the reports. This ensures that the reports are
provided appropriately for the respective tasks or distributed to the responsible analytical
areas/analysts in each case.
In addition, report material from all sources is pooled according to subject/task area and
supplemented by any further information belong to the same subject area (added value).
The reports prepared in this way and supplemented by additional information/knowledge
are available to the operators/analysts in the incoming report areas assigned to them for
processing and evaluation => analysis.
w713od.0e1
Page 31/58
In principle, analysts can use their (prior) knowledge of and experience with the intelligence
targets assigned to them together with the operational information and possibly even the
content of the supplemented reports supplied to them to identify the activities and hence
frequently also the plans of their intelligence targets and evaluate them correctly. The
evaluation of the events and their sequence enables analysts to obtain important
information or knowledge for the assessment of the situation, to assess the potential risk
with sufficient reliability and if necessary issue the necessary indications for suitable
(counter) measures.
Analysts use the information and findings obtained from the analysis process to produce
individual reports and situation reports according to the type of information, if required
including analyses for their customers.
Figure 6: An overview of IP
If the information on the reconnaissance targets in question is confirmed with sufficient

certainty (long-term observation; evaluation of all sources), it is used to update and
supplement the target knowledge.
Another important task of analysis is fine-tuning the intelligence gathering if there are gaps
in raw reports or individual mission areas require consolidation/augmentation.
Page 32/58
w713od.0e1
2.5.2.
Report pre-processing
The total number of reports sent to the communications intelligence (COMINT) analytical area (IP)
originates from numerous sources with extremely different volumes. A not insignificant proportion
comes from radio intelligence/acquisition. Therefore, Intelligence Processing is where reports are
brought together from ones COMINT facilities/sources and from all cooperating national and
international partners with the same security interests and reconnaissance targets.
Pre-processing comprises the following processing steps: (see also Figure 7)
During storage, as a first processing step, the incoming reports are logged - here they
may be assigned to the sender with details of the time received, the tactical time, the type
of report and the reconnaissance target. Other details are possible.
After logging and storage, the reports are prepared in several steps for the subsequent
evaluation processes according to their nature, origin and type. In high-capacity, modern
evaluation systems, the processing operations are performed automatically. However, the
scope of computerised pre-processing is heavily dependent upon the nature of the reports,
the requirements on the automatic processing and the degree of automation achieved by
Intelligence Processing.
In another step, all reports that do not conform to ones own processing format (mainly
partner reports) are automatically converted to ensure a uniform data format suitable for the
automated evaluation processes.
XML/HTML has been found to be a particular suitable report format, since all known report
formats may be depicted / converted without loss and because XML/HTML provides the
ideal conditions for the use of Internet technologies for data preparation/representation,
transport and provision.
Figure 7: IP pre-processing
w713od.0e1
Page 33/58
In a further processing step to make the handling of the material simpler and easier for the
analyst, the reports should be cleaned of formal ballast that is of no relevance for the
subsequent processing and content analysis/evaluation (peeling). However, the report is
also retained and stored in its original version.
Foreign language report contents in text form can be translated into ones own language by
means of another automatic process. However, the translations usually have to be revised
by suitable foreign language experts. Audio files from voice traffic sometimes also require
translation by personnel with foreign language training.
The reports prepared/pre-processed in this way are now available to Preliminary (Report)
Analysis for the subsequent processing and analysis steps.
2.5.3.
Preliminary (Report) Analysis
The following processing sequence describes preliminary analysis: (see also Figure 8 on page 36)
The numerous reports prepared by pre-processing are analysed in another extensively
automated processing step for pre-specified features and content to an extent that enables
the assignment of the individual reports to the predefined subject/mission areas and
hence also to the relevant analysts. This process is dependent in each case on the nature
of the reports and the acquisition results in them in accordance with the formatting
regulations. For example, the content of reports relating to communications/radio
parameters and also messages in reports may contain clues regarding the user/the
organisation and the strategic background of the communications acquired (here: radio
messages).
This ensures the thematic assignment of the reports and their task-specific provision to
the responsible analyst.
This processing step actually corresponds to the first step in a traditional analysis process.
It can and should take place automatically, but the analysis system must provide the
opportunity and tools to enable the analyst responsible to monitor the results or the
assignment process and, if necessary, make corrections.
The thematic assignment creates the conditions for pooling reports belonging to the same
subject/target groups and supplementing them for the analysis by additional knowledge
from the available databases in the sense of added value. This enables analysts to obtain
a more comprehensive/extended picture of their reconnaissance targets and to evaluate
the individual reports more accurately and assign them to the previous results/findings in a
more appropriate way.
Page 34/58
w713od.0e1
Added value can be indicative findings concerning technical and/or operational features of
the radio networks in the mission focus, information relevant to the mission on the target
groups/people, their activities and habits, contacts, relationships, capabilities and potential,
their previously known locations and movement patterns and any other activities/findings
that may be relevant for the analyst in relation to the reconnaissance targets etc. This
information is frequently based on findings from intelligence sources, but can also come
from open sources.
For use in (preliminary) analysis, this information has to be prepared for computer
processing, correctly formatted and stored in such a way that the aforementioned
supplementary processes and targeted search requests are available in their entirety to the
analysts on a topic-related basis.
The reports prepared in this way and supplemented by basic knowledge and up-to-date
findings are called up by the responsible analysts on their workstation computers.
If long-term observations of the radio networks of the targeted enemy identify rules in the
sense of regular behaviour or procedures, these are useful for the target knowledge and
may also be used to derive a description of the enemys normal behaviour in radio
operations. This normal behaviour can generally be described so that automatic processes
are able to identify (from the reports supplied with the large amount of intelligence on the
radio parameters), a standard behaviour or, in the event of deviating radio parameters, a
deviation from the norm. The latter case is an important indicator of special activities on
the part of the observed/detected enemy and will be notified immediately to the responsible
analyst in each case by the latest at the start of his shift - in a special report.
If the reports contain known indicators enabling direct conclusions to be drawn regarding
the activities of the reconnaissance target, the preliminary analysis will identify these
indicators immediately after receipt of the report even before an analyst has screened the
material.
w713od.0e1
Page 35/58
Figure 8: IP preliminary analysis

When recognised, these indicators automatically trigger urgent reports or warning
reports according to pre-programmed sequences that are forwarded directly to Monitoring
and Control of ones own COMINT/radio intelligence service usually the Mission Control
and Reporting Unit with its Control Centre (CC) which is constantly on standby and
there put into a format suitable for display that ensures that the shift staff are immediately
made aware of the information.
If the results of ones own radio intelligence contain pre-specified indicators, these should
be identified by the intelligence gathering service immediately during/after acquisition. The
search/test procedures used should in principle conform to those used by the intelligence
processing service and trigger the same immediate action/urgent reports.
Page 36/58
w713od.0e1
2.5.4.
Evaluation of reports and reporting
Analysts can call up from the memory area assigned to their field of responsibility an overview over
all newly arrived reports that have been prepared and supplemented as described above.
Depending on the nature of the reports and the configuration or availability of the analysis and
evaluation tools, analysts can select different material presentation formats. The following lists
some of the numerous forms of presentation:
o
Original report text (in the relevant report format with all report elements)
Prepared/peeled report text with only the report elements relevant for analysis
Graphical representation of radio networks identified
Depiction of changes to these radio networks
Frequency of communications
Graphical representation of contacts identified (who is communicating with whom)
Deviations from the norm if it is possible to describe normal behaviour following lengthy
monitoring phases
Representation of the communications/radio situation and, if appropriate, also the tactical

situation
Temporal correlation of identified and reported activities
etc.
Experienced analysts can generally use the wide variety of findings provided and supplementary
information (added value) on the assessment of individual processes and their interrelationships
for analytical purposes to obtain a realistic picture of the activities of their reconnaissance targets.
These findings are linked to the results of previous reconnaissance efforts against the same target
and used to draw up a current situation report or update the existing report. The analysts
detailed knowledge of the reconnaissance target, its basic plans, objectives and procedures,
potential and capabilities, previous behaviour etc. enable them to produce a reliable assessment
of the situation and in individual cases also contribute important information/indicators for suitable
(counter) measures.
The results of the analysis are summarised in reports that relate primarily to individual or
associated subjects/processes. In the event of long-term observation/ reconnaissance, when
required or on request, analysts combine a large number of messages and findings to produce
situation reports and analyses. In addition to the identified procedures, these usually contain
assessments and forecasts regarding the enemys potential and plans and other relevant
comments on the reconnaissance target. The analysts reports provide important contributions to
the final reports summarising of the central analysis by the reconnaissance/intelligence service in
question.
w713od.0e1
Page 37/58
Figure 9: Analysis and reporting

Intelligence operators have a variety of tools for the production of reports, which provide templates
(standard form), relieve them of the task of making formal or routine entries, incorporate extracts
from reports and support and integrate maps and graphics, etc.
Intelligence Processing usually has a permanently manned monitoring and standby service (control
centre => CC). The CC has access to all incoming reports and monitors all outgoing reports. Its
tasks include preparing daily summary reports providing an overview of the COMINT/radio
intelligence situation (changes) and of any events/findings during the last 24 hours worthy of
reporting.
At the start of each days shift, the CC issues an up-to-date situation report on the COMINT/radio
intelligence situation with the identified communications/radio activities and the changes to the
reconnaissance targets and reports on the special events during the previous night/shift.
The CC ensures that time-critical reports (e.g. urgent reports) are forwarded immediately to the
specified addresses and, if required, the specified alert measures triggered.
However, in larger COMINT organisations, the CC may also be integrated in a higher-ranking
central control area in the organisational unit Mission Control and Reporting which, as a
central COMINT command and control body is also responsible for monitoring and pooling all
reports issued and for mission control as far as intelligence gathering and intelligence processing is
concerned (see also Figure 9).
Page 38/58
w713od.0e1
2.5.5.
Processing target knowledge
Target knowledge includes all information on a reconnaissance target (this could be individuals,
groups, criminal organisations, armed civilian or paramilitary/military units and organisations,
enemy services etc.) which is necessary or useful for finding and acquiring the communications
links (here: radio communications) of the target/enemy at justifiable expense and to process and
analyse them so that the components of the traffic relevant to the intelligence services may be
extracted and interpreted correctly.
Target knowledge may be divided into three main groups:
a. Information on the communications equipment used by the enemy and on the operational
sequences of its communications. This may be information obtained by radio intelligence
on the enemys radio devices/systems, frequency plans and frequency usage (history), the
transmission modes used, call names, signs or numbers used, its radio networks, its
technical and operational radio operations and sequences, etc.
b. Confirmed information obtained on the targeted individuals, groups, organisations, units.
This could include personal data on target persons, information on organisational and
command and control structures, locations, deployment, equipment, capabilities and habits,
command and control principles and sequences, command structures, etc.
c. Technical and/or operational features of the radio communications, allowing reliable
conclusions regarding strategic backgrounds/measures. This target knowledge forms in
particular the basis for tactical radio intelligence (COMMS ESM).
The above-listed examples are only a limited selection of the numerous possible types of target
knowledge. The communications facilities, sequences, habits and features, the properties
important for the analysis and the handling sequences differ according to the nature of the
reconnaissance target. This leads to a multiplicity of extremely different individual types of target
knowledge required for successful reconnaissance on the targets in question. Therefore, every
target places very specific requirements on COMINT/radio intelligence and on the target
knowledge to be compiled.
One basic principle is that, in addition to high-capacity and suitable sensor technology, precise,
comprehensive and up-to-date target knowledge is the key to successful reconnaissance on
enemy communications/radio traffic.
w713od.0e1
Page 39/58
However, the development of reliable and sufficient target knowledge requires long-term
observation and evaluation of the enemys radio communications with ones own radio intelligence
facilities. The information obtained in this way may be supplemented by assured information from
other sources. Here, it is important that the target knowledge is updated and where possible and
required also supplemented a task which is permanently assigned to each analyst for their field
of responsibility; in larger COMINT organisations, there is frequently also a special target
knowledge group.
New information relevant to the target knowledge can only results in changes or supplements to
the target knowledge database if the operator/analyst responsible for the relevant mission area has
released these reconnaissance results as reliably classified and suitable for the database. This
usually only happens when the information/findings have been confirmed numerous times from the
same or different sources. These relationships are then treated as permanent or reliable target
knowledge. Before this, they may be used with caution as temporary target knowledge. From a
practical point of view, reports based on temporary target knowledge should be provided with
suitable comments or notes regarding the use of information that has not yet been
assured/confirmed.
The availability of reliable, suitable and sufficient target knowledge primarily determines ones own
capabilities to identify new targets successfully at short notice. Therefore, all COMINT/radio
intelligence organisations should build up the required stock of target knowledge on potential future
reconnaissance targets prospectively and in plenty of time. It is necessary to keep intelligence
gathering and intelligence processing resources available for this purpose at all times.
In principle, the scope and quality of the target knowledge decide the cold start capability of the
COMINT/radio intelligence forces in short-notice operations for which there are no lengthy
preparation times/phases.
Page 40/58
w713od.0e1
2.6.
Military radio intelligence
Reconnaissance is of great importance for the military command and control and for the protection
of ones own troops. In peacetime and times of tension, it is used to provide early intelligence on
potential enemy preparations for military mobilisation and attacks in the sense of an early warning
system. In wartime, strategic reconnaissance is primarily used for identifying the situation and
building on this to assess the situation. It is therefore an essential element of operational
planning. In the modern combat environment (tactical level), in addition to events relevant to the
situation, reconnaissance can identify acute threats to ones forces immediately and report this to
the responsible military commander. This provides the time and opportunity for suitable
countermeasures.
EloKa
(EW)
Fm/EloAufkl
EloSM
EloUM
(SIGINT)
(ECCM)
(ESM)
FmAufkl
(COMINT)
.
EloAufkl
(ELINT)
takt. FuAufkl
takt. RadAufkl
(COMMS ESM)
(RADAR ESM)
EloGM
(ECM)
Figure 10: Military COMINT / radio intelligence

Unlike in other fields of national reconnaissance, in the military environment, signals intelligence (=
SIGINT) is deemed to be part of electronic warfare (= EW), see also Figure 10 on page 50.
EW is divided into the strategic component SIGINT with its COMINT portion and into tactical
measures, that is the mission areas assigned to combat: electronic support measures (= ESM),
electronic countermeasures (= ECM) and electronic counter-countermeasures (= ECCM).
This Chapter deals exclusively with tactical radio intelligence (COMMS ESM) in the military
mission.
w713od.0e1
Page 41/58
2.6.1.
Tasks and special features of tactical radio intelligence
As the name implies the function of ESM is to support tactical commanders in

operations/combat in the command and control and protection of troops under their command.
Here, COMMS ESM is primarily concentrated on radio communications, because radio is the
preferred command and control tool in modern combat. RADAR ESM, the second cornerstone of
ESM, is aimed at enemy target acquisition and target tracking systems, but will not be dealt with
further here.
Tactical radio intelligence (COMMS ESM) is tasked with supporting military operations/combat by
acquiring the enemys tactical radio communications and assessing/analysing them in order to
identify from them the up-to-date threat situation for ones own forces at an early stage and
reliably enough for suitable counter-countermeasures and/or countermeasures to be taken in due
time. COMMS ESM (like RADAR ESM) can, therefore, function as an effective early warning
instrument whereby the time factor between detection and classification and warning/reporting
plays a decisive role. This is also what delimits it from COMINT and is the reason for the
sometimes differing operational sequences, despite comparable requirements and terms of
reference.
COMINT, on the other hand, has a clearly strategic function in military operations. It has been
assigned the task of finding enemy communications/radio traffic and networks and intercepting
them with the aim of reliably identifying the enemys strategic plans, preparations and activities at
an early stage. At the same time, the boundaries between strategic and tactical radio intelligence
can be extremely fluid at times of war.
Strategic COMINT/radio intelligence is also used to develop the required target knowledge for
successful tactical radio intelligence and the other disciplines of communications intelligence.
Page 42/58
w713od.0e1
2.6.2.
Tactical radio intelligence (COMMS ESM)
Combat at sea, in the air and on land is generally performed using mobile weapons carriers or
units whose commanders are primarily reliant on radio communications to control and coordinate
the combat operations due to the requirement for high mobility (military ships, air and ground
radio). Therefore, COMMS ESM systems are directed towards the acquisition of these military
radio communications with their special signalling techniques and operational parameters, rules
and frequency bands.
As already mentioned, COMMS ESM is used for reconnaissance on the current combat situation
and hence provides important information on the status and development of the military situation. It
assists the tactical commander with the assessment of the situation and with the timely
identification of acute threats to ones forces from the enemy. This early warning function requires
the threat factors identified by radio intelligence to be reported immediately to the responsible
unit/military commander. For this reason, complex, analytical and hence time-consuming
processing and analysis of the intercepted traffic in a central analytical area (which is usually
located a long distance from the sensors or acquisition units), is neither sensible nor possible.
However, this requires an approach to reconnaissance that differs in parts from that used in
traditional COMINT.
Indicator details of the radio communications to be targeted for the mission of tactical radio
intelligence (COMMS ESM) in the form of technical transmission features, (radio) operational
sequences and special features/rules and the tactical sequences/background that triggered the
radio communications acquired and could possibly pose a threat to ones own forces must be
precisely known. Since any more extensive evaluation up to an analysis of the content and a
linkage with findings from other sources is generally not practical or possible for temporal and
structural reasons, in special cases the above-listed features or indicators must be sufficient and
reliable on their own to provide evidence of an acute threat to ones own forces.
The target knowledge required to do this and to develop detailed knowledge is, however, a task of
strategic radio intelligence (COMINT).
The functional sequences in radio intelligence in the fields of COMINT and COMMS ESM apart
from the time factor between detection and reporting are essentially the same. In both areas,
there is a requirement to find the signals or communications relevant to the mission with as few
gaps as possible and classify them on the basis of their technical transmission features (signal
type). However, the two disciplines differ to some extent in the evaluation of the
signals/communications.
COMMS ESM can usually identify the nature of the radio services (e.g. ship radio, air radio/aircraft
radio, ground radio) from the signal type alone. Since (radio) operational sequences are
standardised in military radio communications and hence follow fixed rules, the technical
w713od.0e1
Page 43/58
transmission features and operational sequences identified usually enable conclusions to be drawn
regarding the type of weapons carrier or military unit and frequently also regarding the
strategic/tactical operations in question e.g. tank battalion on the offensive, group of ships in a
particular attack manoeuvre, target alignment of a fighter bomber by an FAC (forward air
controller), etc. This is frequently enough for identification and evaluation.
Another important component of COMMS ESM is direction-finding, in exceptional cases also
location-finding, if a mobile DF basis can be operated and used. It indicates the direction or
sometimes even the location or the distance of the target/ threat identified this information is
indispensable for taking the correct decisions and countermeasures.
Further time-consuming analysis of signals is frequently not possible due to the immediacy of the
threat. The above-listed results or findings of tactical radio intelligence have to be reported
immediately to the responsible military commanders (warnings) to enable them to react in good
time and with suitable measures to the enemy activities identified.
Therefore, COMMS ESM also differs in part from COMINT in its reconnaissance priorities, job
handling, required prior knowledge/target knowledge, system configuration and in the
processing/evaluation of the intercepted signals/communications. The decisive feature or
difference, however, is the ability of tactical radio intelligence in certain cases to use the detection,
classification and direction-finding of enemy radio communications to obtain sufficiently reliable
information on the current events on the battlefield and frequently also on immediate threats from
enemy forces and hence enable the appropriate reactions to be taken.
The COMINT task searching in the mission (searching for known emitters) has similar
preconditions to those of COMMS ESM. A large amount of information is already held about the
enemy and its radio procedures and special operational features. Therefore, once again the known
(classified) signal type provides the first usable indication of the user and hence the targeted
enemy.
The locating results, the target knowledge and additional findings from previous reconnaissance
activities and from other sources can be used in the subsequent, time-consuming analysis process
to identify the enemy behind the radio communications. At the same time, it is also possible to
obtain information on military events at a strategic level.
In the field of non-military reconnaissance, however, it is not so much operational standards in the
development of radio communications, but rather the known habits of the reconnaissance target
when using its communications facilities/radio services, which in conjunction with the locationfinding provide indications of its identity and frequently also its activities.
However, with COMINT, the time between acquisition and reporting is usually much greater than it
is with radio intelligence for COMMS ESM.
Page 44/58
w713od.0e1
However, tactical radio intelligence is not exclusively restricted to the above-mentioned early
warning function. In principle, it also has the mission of contributing to the reconnaissance on the
current military situation in the assigned field of operation. The operational principles and functional
sequences are again in principle comparable with those of strategic radio intelligence; only the
focus now is the reconnaissance of radio services in higher frequency ranges (VHF, UHF and
above) that are primarily used for command and control in battle/combat. These are primarily
tactical ships, air and ground radio. Since intercepted enemy radio communications are not
necessarily an indicator of an acute threat, they can, if required, also be evaluated in a longer
time-frame, similar to evaluation/intelligence processing for COMINT. The results will usually also
be incorporated in the presentation of the up-to-date situation (local battlefield situation).
However, in tactical radio intelligence, the analysts have to be stationed on site near the acquisition
equipment, similar to so-called immediate analysis also called preliminary analysis in strategic
radio intelligence, which is usually performed directly next to the stationary acquisition equipment.
Obviously, these reports are also incorporated in the reporting system used by the
SIGINT/COMINT forces.
As mentioned at the start, in battle, the command and control of modern, highly-mobile units and
weapon systems/carriers is mainly performed using (tactical) VHF and UHF radio and coordinated
within combined arms combat. However, COMMS ESM systems must also be able if necessary
to find tactical HF links and uplinks for mobile satellite radio sets, or at least find their bearings and
classify them uniquely (satellite radio). We can no longer exclude the possibility that land-based
units will in future also use WLAN technology for command post communications, possibly even as
command and control facilities. The latter application is also conceivable for seaborne units.
Consequently, future COMMS ESM systems must also be prepared for these requirements.
The high mobility of motorised troops, the speed of modern weapons carriers and the long ranges
of their weapon systems means that the reconnaissance radius or area to be covered must extend
to a long way in front of ones own forces and the time available to react appropriately to enemy
activities is frequently very short. This requires COMMS ESM systems to have high receiver
dynamic range to guarantee a sufficient reception range or penetration range and the ability to
perform an immediate classification and assessment/evaluation of signals relevant to the mission.
The capacity of a COMMS ESM system is consequently measured against how completely, quickly
and reliably it is able to sweep the operational area for tactically relevant radio communications,
classify and evaluate the signals and report the findings derived there from to the customers.
w713od.0e1
Page 45/58
In addition, to the above-listed technical capabilities of COMMS ESM systems, high demands are
placed on mobility, camouflage and the usable operational spectrum of the platforms on which the
systems (including their receive and DF antennas) are installed. The limited acquisition range in
higher frequency ranges and hence the required proximity to the reconnaissance targets/enemy
makes the use of unmanned platforms/systems necessary in many cases. Operations of this kind
require COMMS ESM systems with a high degree of automation and adapted remote control
functions such as, for example, MEDAVs MOFAS system.
The technical equipment/systems used for COMINT and for COMMS ESM tasks are in principle
the same. The same also applies to the functional sequences in searching and processing. With
suitable hardware and mobile operational platforms, it is possible to carry out both tactical and
(although limited in its range and direction-finding/location-finding ability) strategic radio
intelligence. Only the operational principles, to some extent the processing and evaluation routines
and the reporting chains differ as a result of the different requirements.
One special feature of airborne and seaborne COMMS ESM systems is the basic
capability/possibility of finding the bearings of stationary and slow targets with sufficient accuracy
over several readings, taking into account ones own course (GPS-based). For this, it is necessary
to synchronise the exact times (TOAs) of the individual DF readings with the relevant coordinates
and project the associated DF values onto these coordinates. The bearing directions/beams
produce sufficiently precise location-finding.
COMMS ESM systems on their mobile operation platforms are usually integrated in the operational
command and control systems. In the case of modern forces, these are in turn connected to a
high-ranking command and control as a result of their high-capacity CI functions to which the
information from reports sent by the reconnaissance sensors are forwarded without delay and
prepared into (real-time) situation reports for the forces involved in the combat activities.
In NATO, this is called Network Centric Warfare (NCW), a completely new and extremely highcapacity information infrastructure for situation reports, command and control and coordination of
the weapons usage of mixed NATO units.
Page 46/58
w713od.0e1
2.7.
Mission management
Successful reconnaissance provides its customers who could be the government/ministries, the
security organisations or the military with important information and decision-making aids.
However, the intelligence forces can only meet the specific information requirements of the abovelisted areas/organisations if the reconnaissance requirements/missions also reflect the relevant
reconnaissance interest in detail and in a prioritised way.
When the mission is assigned, a distinction is made between permanent (long-term) and shortterm (determined by immediate events of relevance to security) reconnaissance requirements.
The organisation/authorities responsible for the reconnaissance service in question formulate a
permanent reconnaissance mission according to the specifications in the security policy or
reconnaissance interests, which takes into account the capabilities of the assigned intelligence
service (here: COMINT/radio intelligence). Depending upon the current situation or event and
depending upon the specific reconnaissance requirement, it also draws up individual
reconnaissance requirements (missions) that usually have a time limit.
The responsible command and control area of the intelligence/reconnaissance service converts the
above-listed requirements/missions into a form suitable for communications intelligence, assigns
the priorities and sends them to the COMINT command and control/mission control area. There,
the relevant missions for intelligence gathering, and hence, in principle also for intelligence
processing with target knowledge processing are drawn up and assigned to the areas/forces
offering the best conditions for a successful fulfilment of the mission. These missions take into
account the capabilities and special features of the reconnaissance medium in question (here:
radio intelligence) and are usually based on target people, groups or areas. They are essentially
more detailed than the reconnaissance requirements and state precisely which information on the
individual targets is of interest.
Intelligence Gathering uses these primarily strategic reconnaissance missions to generate specific
acquisition missions and provides the documents/target knowledge extracts required for their
performance. These acquisition missions are sent to the relevant day and night shifts in
Intelligence Gathering. They may also be valid for lengthy periods.
In traditional radio intelligence, which is still manually controlled by the gatherers, the individual
missions are sent to the workstations suitable/equipped for the transmission modes to be detected.
Semi- or fully automatic acquisition/processing systems automatically provide the sources/system
components required for each individual mission. Dynamic provision is only performed for handling
the up-to-date search/acquisition mission in each case.
w713od.0e1
Page 47/58
Intelligence Processing or Central Mission Control checks constantly whether ones own reporting
system (raw/acquisition reports from Intelligence Gathering and the outgoing, processed reports =>
finished intelligence) is always providing the required information and findings for the specified
target and without significant gaps. If necessary, mission management introduces suitable changes
to ones own Intelligence Gathering in order to rectify the gaps or shortcomings identified.
Page 48/58
w713od.0e1
2.8.
Networking and Communication
Radio intelligence systems or organisations usually consist of several remote acquisition

components/outstations and DF stations and the central analysis and control area. For control and
smooth and effective cooperation between the individual components or areas, reliable
communications links are necessary whose capacity/data throughput is essentially determined by
the capacity of the components/areas to be connected and hence on the expected data volume.
The type of communications links to be provided in individual cases is primarily dependent upon
the operational principles of the radio intelligence systems in question. In principle, it is expedient
to connect stationary systems/equipment to each other by fixed, terrestrial networks. If the
communications infrastructure is inadequately configured and there are large distances to cover,
stationary satellite links (VSAT) are suitable in principle. The network structure should have a
redundant design so that in the event of the failure of individual links, communications can be
maintained via alternative lines or communications facilities. The links are usually permanently
switched, although, particularly for additional/alternative lines, dial-up connections are equally
suitable.
Mobile radio intelligence systems are usually also connected to each other by mobile
communication systems/facilities. INMARSAT, THURAJA, GSM and traditional HF or VHF radio
networks for highly mobile radio intelligence systems, such as for example MEDAVs MOFAS
system have been found to be suitable.
In particular, the individual, geographically separate areas (this applies to remote acquisition
equipment and automatic DF stations with wideband technology) must be able to work
autonomously for a limited time in the event of the failure of the communications links, after
receiving their missions and the documents/target knowledge extracts required for their fulfilment.
The temporarily stored acquisition or DF reports are transmitted with a corresponding time delay to
the relevant customers after the restoration of links, new missions are accepted and the target
knowledge relating to the mission is updated if required.
In this electronic data processing age, mission control, reporting, provision of the DF and locatingfinding results and the documents/target knowledge take place over the Internet and suitable WAN
technologies.
In the acquisition and DF stations and during analysis and mission control, the numerous system
components, modules and workstations are networked by means of high-capacity and if possible,
uniform LAN technology. This provides the conditions for the (frequently virtual) interconnection of
the system components to form a processing/production chain, for the operator-assisted or
automatic configuration and control of the individual components, for the provision of the
documents/target knowledge and to transport the results to the communication interface.
w713od.0e1
Page 49/58
2.9.
Data storage
A distinction is made between results data and target knowledge data for the purposes of data
storage. In principle, results consist of:
records of the radio communications acquired (original signal)
technical data on acquired and classified signals
operational data/knowledge of the radio communications detected
contents of the radio communications exploited
These data are usually only stored temporarily for analysis and reporting and for possible postprocessing. Some of them are incorporated in the acquisition reports and in the IP reports and are
hence held in long-term storage. The above-listed results data remain available to Intelligence
Gathering and Intelligence Processing until they are either permanently archived or deleted after
pre-specified periods (this may be several months).
With the target knowledge data, a distinction is made between temporary/ provisional target
knowledge and the permanent target knowledge that is confirmed data that has been released by
the responsible analyst for the target knowledge database.
Temporary target knowledge also described as strategic knowledge is data/ findings relevant
to the target knowledge, which are obtained during acquisition or analysis and supply important
operational communications/radio and/or strategic findings for COMINT/radio intelligence, but
which still require confirmation by means of other reconnaissance results.
These data will be retained and provided until the responsible analyst has incorporated them in the
permanent target knowledge or discarded them.
If required, strategic knowledge should be available to all connected acquisition stations and the
relevant analytical areas (sometimes only selectively) and replicated between them close to the
event.
The actual (permanent) target knowledge database is stored for lengthy periods. However,
permanent only means that these data remain valid until they are updated or supplemented during
the continuous maintenance of the target knowledge database by the analytical/target knowledge
group. They are made available to Intelligence Gathering in the form of extracts (documents)
relevant for the acquisition missions and in comprehensive form to the analysts for their reporting.
As a result of networking and the use of high-capacity and comfortable Internet technologies, the
target knowledge may be stored centrally or decentrally. Decentral target knowledge provides
greater autonomy for the individual areas in the event of the failure of the communications links.
However, it does require suitable technology and mechanisms for data replication.
Page 50/58
w713od.0e1
3. Elements of an IT Infrastructure for automated signal

processing systems
3.1.
Motivation: continuous adaptation
The requirements and tasks currently levied on acquisition systems are changing all the time. The
procurement of new equipment is usually out of the question for budget reasons, and moreover
would probably not be possible in the timeframes in which the adaptation is required.
A modern acquisition system must, therefore, be simple to adapt and expand in order to be able
to satisfy changing requirements throughout its service life. The normal product cycles of the
components used are many times shorter than the systems service life. A guaranteed supply of
identical components not only means high storage costs, but in the case of expansion measures,
the procurement of obsolete technology that is much less efficient than the components available
on the market.
As a safe investment and to secure supplies, concepts are required that take into account
technological advances and in the end permit the use of heterogeneous system solutions. This can
be achieved by using a very limited number of basic hardware components whose (if possible,
limited) interface requirements and guarantees may be assured long term. This permits enhanced
efficiency as a result of technical developments in the case of expansions and replacement
purchases. This also significantly reduces the high storage costs for spare parts.
The hardware available is used productively in the system and not packed away in the spares
store. Optimum system performance is achieved with the existing configuration. The system design
and system management tools must support this process.
w713od.0e1
Page 51/58
3.2.
Autonomous high-availability systems
Acquisition systems are hermetic and complete. They employ the fewest possible defined
interfaces to communicate with their environments. The interfaces enable the system to be
conditioned suitably for the mission and the processing results to be provided by the system. They
support the required monitoring, maintenance and further development.
The prime objective to produce (acquisition) results should be achieved with the optimum (i.e.
lowest) amount of effort and be permanently assured.
The system structure is relatively simple: a small number of central computers provide the
interfaces to the environment and are used to control and monitor the system. If necessary, these
system computers are connected in failover pairs to ensure the high availability required at this
point. The majority of computers conduct the actual processing tasks. The system computers
monitor and control these processing computers.
The essential factor is to assign top priority to a high level of system availability even at the design
stage. Experience has shown that measures introduced retrospectively to increase availability are
expensive but limited in terms of effectiveness. Since errors cannot be completely avoided, the
objectives of system architecture include (a) minimising the impact of any errors, (b) guaranteeing
the functions of system components not directly affected by an error and in this way (c) maintaining
the functioning of the overall system wherever possible, albeit possibly with a temporary reduction
in efficiency. (This means optimum system performance with the current configuration see
above).
3.3.
Hardware errors
The frequency of errors in electronic components follows what is known as the bathtub curve: early
outages are followed by a constant, very low failure rate which only increases again after a lengthy
period as a component approaches the end of its useful life.
Mechanically moving components have a much higher failure probability and should, therefore, be
avoided when possible. Typical failures in computer systems occur, for example, in fans and hard
disks. If their use is unavoidable, they should be monitored, and any errors identified and reported.
Computers made of components equipped to meet this requirement are commercially available.
The downtime in the event of errors can be minimised by using detailed solutions that ensure the
systems are easy to repair.
Page 52/58
w713od.0e1
3.4.
Software errors
In the case of software errors, the system design should again limit the propagation of those errors.
A group of loosely interlinked software components has been found to be expedient. Central
functions must be provided on fail-safe computers.
One useful strategy to limit the impact of errors is, where possible, to prevent sequential
requirements being processed by the same process, but to stop the task in question after a specific
time or after a specific number of requests and replace it with a new process. This often prevents
the accumulation of small errors and hence achieves an overall much more stable system
performance.
3.5.
Configuration
The hardware configuration used in a system operated under the described conditions at the
present time is a known configuration. It will only be changed as part of maintenance or expansion
measures. There is therefore no need to take account of dynamic changes during the routine
management of the system configuration. One obvious solution is to use a central configuration database from which the partial configurations, i.e. the individual configuration files required for the
individual services (e.g. DHCP, DNS, TFTP, PXE, etc.) may be automatically generated.
The services used determine the information to be held in the configuration database. The actual
system does not make many requests and the performance requirements are not high.
We use OpenLDAP to store and call up the configuration data. This permits well-structured data
and facilitates the compilation and management of partial configurations for groups of identical or
similar components. The configuration information is interactively managed using graphical tools,
such as gq. The configuration data may be accessed with other tools, which may be supplied by
the customer, for example.
w713od.0e1
Page 53/58
3.6.
Boot process
The processing computers do not have a local bootable storage medium and file system. Instead,
the operating system is booted by the PXE implementation included in all modern BIOS systems
for network bootstrapping. (However, for maintenance purposes, another boot image may be
loaded, for example one that permits hardware tests.)
The software needed for operation is also loaded over the network by the server. The processing
computers file system only exists in their RAM. The data used over the network are suitably
mounted in the processing computers file system and released for read access only. When the
operating system is started, each processing computer mounts its own remote file systems.
Protocol messages and alarms are sent over the network to the system computers. The usual
protocols (syslog, SNMP) are used.
The omission of the system disk does away with one of the few mechanically moved, and hence
susceptible, components of the processing computer.
3.7.
Software distribution
No software is installed on the processing computer. Following a reset, a processing computer is

always in its initial state. This means that it is always able to adopt a completely new task after a
reboot (where this is permitted by the system configuration).
The distribution of the system software may take the following form:
The software is held on the designated computer (boot server). The directory tree is exported by
NFS. This may be performed in parallel for different versions of the software. The processing
computers mount the directories configured for them during the boot process. This makes the
software available on the computers.
In the case of parallel directory trees (and compatible software), this procedure enables the system
to run a mixed operation with different software versions. For example, some of the processing
computers can be using a new software version, while the rest of the system still continues to use
the older version. Only when the new version has been released will the instruction for mounting
the file system be changed to the new version so that from now on only this version will be used.
This completes the distribution of the software: from this point onwards, all newly booted
processing computers will use the new version.
It is also simple to access an older version: if the software version is stored on an interchangeable
medium (CD, DVD), it is even possible to run the old version from this medium if it is mounted and
exported by NFS.
Page 54/58
w713od.0e1
3.8.
Scheduling
The compute nodes transmit the frame data required for planning the computation tasks to the
scheduling unit. The scheduler determines the sequence and assignment to the compute nodes in
which the tasks are then executed on the basis of the following data:
expected task runtime
task priority
availability of the input data
available compute nodes
current and planned load on the compute nodes
availability of exclusively useable critical resources
The core of the scheduler is a priority-control queue for the tasks. The priority of a task and hence
its position in the queue may change during its waiting time to take account of changed basic
conditions.
When a task is handed over to a compute node, it is removed from the main queue and transferred
to job monitoring. If task monitoring detects that the task cannot be processed to the end, because
the compute node is out of service for example, the task is returned to the main queue. However,
this is not performed without observing rules, such as, for example, a maximum number of
attempted calculations. The rules are there to protect the system, by sequentially terminating tasks
that can (data pending) not be processed for example, and to prevent the continuous loading of the
system with such tasks.
Tasks that use limited resources (e.g. external modems) are processed by regrouping them into
their own queue. The queue operates in a similar way to the main queue, but the tasks from this
queue are processed on the relevant compute node with a priority bonus in order to ensure the
effective utilisation of the limited resources.
Tasks for which the raw data is no longer available are removed from the queue. Details of this
process step are logged.
w713od.0e1
Page 55/58
3.9.
Monitoring and management
Monitoring system performance is one of the main conditions for assuring processing.
Each computer runs a process (Monit) to monitor the local operating state. This collects and
examines data such as main memory occupancy, CPU load, network throughput for the entire
computer and the individual computer tasks. In the event of limit violations, it sends the
corresponding alarms messages to the higher-ranking entity.
The monitoring computers collect and condense status and alarm messages and monitor the other
computers in the system. To do this, they test the communications with these other computers and
check the achievability of specific services assigned for the specific computer on the computers.
The data produced are available to the administrator via a web-based application.
The application is based on the network management system OpenNMS. Expansions cover the
visualisation of the status information, even for lengthy periods. In practice, it has been found to be
expedient to use RRDTools as a database and visualisation library. This ensures the automatic
compaction of older status data.
In the event of computer outages, limit violations or other defined system states, external
management systems can be alarmed, for example by SNMP traps.
The data determined can be made available for external evaluation processes or management
tools. This may be performed by both SNMP and by entries in an (external) database.
3.10. Software maintenance

Software maintenance is simplified by measures for versioning complete states and running
several version states in parallel in the system. This makes it possible to test a software version in
isolation and then transfer it to processing without further error-prone measures. All that is
required is to change a configuration entry in the relevant computer class; all computers belonging
to this class will then adopt the new status on the next reboot.
Page 56/58
w713od.0e1
3.11. Maintenance
Current commercially available computers configured for use in a server environment offer
interfaces to a central management system.
In particular, it is possible to dispense with the usual console switches, since the consoles may be
accessed directly via the LAN interface. This enables a large proportion of maintenance to be
performed over the LAN. Only cleaning and replacement work requires direct access to the
computers.
In addition to cost savings on first installation and expansions, there is no need for the distribution
of video signals, which are themselves a source of electromagnetic interference.
w713od.0e1
Page 57/58
MEDAV GmbH Grfenberger Str. 32-34 91080 Uttenreuth Germany Homburger Platz 3 98693 Ilmenau Germany
Phone: +49 9131 583-0 Fax: +49 9131 583-11 info@medav.de www.medav.de
Page 58/58
w713od.0e1

D Thoelke Buchw713od0e1

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

D Thoelke Buchw713od0e1

Uploaded by

Copyright:

Available Formats

Principles of

Principles of Radio Intelligence

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

Intelligence its contribution to national security ........................................................................... 5

Tasks of radio intelligence .................................................................................... 7

Potential capabilities and limits of radio intelligence ............................................ 8

Radio intelligence in detail .............................................................................................................. 9

Terms of reference ............................................................................................... 9

Basic requirements ............................................................................................. 10

Acquisition Control ............................................................................................. 19

Technical Analysis ............................................................................................. 24

Significance of direction-finding/location-finding for searching, identification and

Intelligence processing and target knowledge ................................................... 31

Report pre-processing ........................................................................................ 33

Preliminary (Report) Analysis ............................................................................. 34

Evaluation of reports and reporting .................................................................... 37

Processing target knowledge ............................................................................. 39

Intelligence Gathering ........................................................................................ 18

Military radio intelligence .................................................................................... 41

Tasks and special features of tactical radio intelligence .................................... 42

Tactical radio intelligence (COMMS ESM) ......................................................... 43

Mission management ......................................................................................... 47

Networking and Communication ........................................................................ 49

Data storage ....................................................................................................... 50

Elements of an IT Infrastructure for automated signal processing systems .............................. 51

Motivation: continuous adaptation ...................................................................... 51

Autonomous high-availability systems ............................................................... 52

Software errors ................................................................................................... 53

Software distribution ........................................................................................... 54

Monitoring and management.............................................................................. 56

Software maintenance ........................................................................................ 56

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

1. Intelligence its contribution to national security

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

Tasks of radio intelligence

Figure 1: Radio intelligence an important source of intelligence

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

Potential capabilities and limits of radio intelligence

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

2. Radio intelligence in detail

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

Two factors determine the efficiency of ones own radio intelligence:

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

In the majority of missions, particularly in strategic radio intelligence, specific information is

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

Suitable classification and processing procedures:

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

Suitable analytical tools:

MEDAV GmbH 2013 Specification subject to change

Principles of Radio Intelligence

MEDAV GmbH 2013 Specification subject to change