Working Against the Tide - The Black Vault
Working Against the Tide - The Black Vault
Working Against the Tide - The Black Vault
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
...mt:uL~~~~~~~• .s--IJ 1SOUTH EAST AS IA~rlcdPart OneTHIS DOCUMENT CONTAINS CODEWORD MATERIAL
TOP SECRET UIUBRA NOFOItNCRYPTOLOGIC HISTORY SERIESSOUTHEAST ASIA<strong>Working</strong> <strong>Against</strong> <strong>the</strong> <strong>Tide</strong>(COMSEC Monitoring and Analysis)PART ONEI (b)(3)-P.L. 86-36Hiram M. Wolfe, III, ASARaymond P. Schmidt, NAVSECGRUThomas N. Thompson, AFSSJune 1970TOP ~':CR':T U~IBftA NOFOftN
SECURITY NOTICEAlthough <strong>the</strong> information contained in this journal ranges in securityclassification from UNCLASSIFIED to TOP SECRET CODEWORD,<strong>the</strong> overall security classification assigned to this issue is TOP SECRETUMBRA. <strong>The</strong> "No Foreign Nations" (NOFORN) caveat has beenadded to guard against inadvertent disclosure of portions of <strong>the</strong> textwhich discuss topics normally held to NOFORN channels.While <strong>the</strong> TSCW NOFORN classification by itself requires carefulhandling, additional caution should be exercised with regard to <strong>the</strong>present journal and o<strong>the</strong>rs in <strong>the</strong> series because of <strong>the</strong> comprehensivetreatment and broad range of <strong>the</strong> subject matter.TOP SECRET UMBRAHOFORH---.._------ -_.--
TOf SECRET UMBRAnOFOIUlCRYPTOLOGIC HISTORY SERIESSou<strong>the</strong>ast AsiaSponsorsVice Adm. Noel Gayler, USNMaj. Gen. Charles]. Denholm, USARear Adm. Ralph E. Cook. USNMaj. Gen. Carl W. Stapleton. USAFDirector, NSACommanding General, USASACommander. NAVSECGRUCommander. AFSSJoint StaffJuanita M. MoodyWilliam D. GerhardLawton L. Srernbeck,Hiram M. Wolfe, IIIRaymond P. SchmidtBob W. Rush,Thomas N. ThompsonMary Ann BaconChiefGeneral EditorASAASANAVSECGRUAFSSAFSSEditorTOf SECRET UMBRAHOFORH
'fOP SECRE'f UMBRA?WFORNForewordImportant as it is in peacetime, communications security becomes evenmore important in wartime. Ultimately, we must reckon wartime failureto secure communications against a background of u.s. casualties and ofbattles won and lost. As it did in World War II and <strong>the</strong> Korean War,<strong>the</strong> United States in Sou<strong>the</strong>ast Asia has failed to provide communicationssecurity of a sufficiently high degree to deny tactical advantages to <strong>the</strong>enemy. Once more <strong>the</strong> United States has lost men and materiel as aresult.<strong>Working</strong> <strong>Against</strong> <strong>the</strong> <strong>Tide</strong> is <strong>the</strong> story of <strong>the</strong> attempts of u.S.COMSEC monitors and analysts to bring security to <strong>the</strong> voluminouswartime communications. As <strong>the</strong> title suggests, it is not a success story. Itoutlines, instead, <strong>the</strong> problems confronting COMSEC specialists indealing with communication-prone Americans at all levels of command.It gives insight into and documentation for <strong>the</strong> damage done to <strong>the</strong>United States and her allies as <strong>the</strong> enemy's SIGINT organizationcapitalized on American laxity in communications security. <strong>The</strong> storydescribes <strong>the</strong> technology applied in Sou<strong>the</strong>ast Asia to overcome COMSECdeficiencies and <strong>the</strong> manner in which that technology evolved during <strong>the</strong>war-particularly as monitoring adapted to a new methodology termedCOMSEC surveillance. It fur<strong>the</strong>r tells of u.s. attempts to applymonitoring knowledge in communications cover and deception operationsagainst <strong>the</strong> enemy. <strong>The</strong> volume contains, finally, useful lessons for allwho must communicate in wartime.In addition to <strong>the</strong> present version of <strong>the</strong> COMSEC story, <strong>the</strong> jointNSA-SCA history staff is preparing a NOFORN SECRET-level,noncodeword edition. This will make possible a broad distribution of <strong>the</strong>material through normal military channels where study of <strong>the</strong> lessonslearned will do <strong>the</strong> most good.NOEL GAYLERVice Admiral, U.S. NavyDirector, NSA'fOP SECRET UMBRA?WFORH
TOP SECRET mdBRAHOfOIU4Preface<strong>The</strong> authors of <strong>Working</strong> <strong>Against</strong> <strong>the</strong> <strong>Tide</strong> drew upon a wide variety ofsource materials in presenting <strong>the</strong>ir composite picture of monitoring andanalysis in Sou<strong>the</strong>ast Asia. While <strong>the</strong> major part of <strong>the</strong>se sources was for<strong>the</strong> years to 1968, <strong>the</strong> authors also used source documents from <strong>the</strong> 1968and 1969 period when <strong>the</strong> materials were particularly germane to <strong>the</strong>topics under discussion. Important source materials included SCAmonitoring reports, operational messages, reports issued by <strong>the</strong> militarycommands, briefings, special studies, SIGINT, and author interviewswith commanders. One primary source of information was <strong>the</strong> SCAhistorical publications. <strong>The</strong> authors drew upon accounts provided by unithistorians of components of <strong>the</strong> 509th ASA Group and <strong>the</strong> 6922d AFSSSecurity Wing. From <strong>the</strong>se, <strong>the</strong> authors extracted sufficient informationto treat in brief form <strong>the</strong> operations conducted by ASA and AFSSCOMSEC units. Persons desiring information in greater detail on thoseoperations may contact <strong>the</strong> historical offices of ASA and AFSS. AlthoughNAVSECGRU has not published corresponding historical works, it didprepare for this publication papers that contained somewhat greater detailthan that which appears in <strong>the</strong> present publication; <strong>the</strong>se more detailedpapers are also available for examination.<strong>The</strong> authors have many debts to acknowledge. Within ASA, specialthanks are due to Col. Julian W. Wells and Lt. Col. Robert H. Bye foradvice and source materials. Maj. Andrew J. Allen, II, Mr. John Exum,Mr. NormanJ. Foster, Mrs. Beverley K. Jordan, Mr. Robert C. Massey,Mr. Michael E. Mclntire, and Mr. Paul R. Singleton all contributed inone way or ano<strong>the</strong>r to <strong>the</strong> preparation of this publication. SP5 James A.Rambo and SP4 Frank K. Ayco of <strong>the</strong> historical division also made directand valuable contributions. Within NAVSECGRU, Lt. Comdr. WilliamE. Denton, Lt. William D. Kahl, CWO-2 Larry D. Poppe, CTCSThomas E. Perry, CTC John O. Storti, Mr. Nicolas F. Davies, Mr.Richard J. Dennissen, and Mrs. Dorothy L. Prezis gave of <strong>the</strong>ir time andknowledge in preparing sections relating to NAVSECGRU COMSECoperations. At AFSS, Mr. Harry V. Hoechten, Lt. Col. Herbert R.TOP SECRET UMBRAUOfiOIU4
viiiMorris, Jr., Mr. Glenn F. Clamp, CMsgt Melvin D. Porter, and Capt.John D. Dowdey deserve special mention for <strong>the</strong>ir hel and comments.At NSA Mr. Howard C. Barlowread <strong>the</strong> draft manuscript and provided comments. Finally, <strong>the</strong>'L...--:------Iauthors wish to thank Mrs. Ida Ryder, who cheerfully typed <strong>the</strong> draftmanuscript and countless changes many times before it reached finalform.A few source footnotes appear in text, mainly where <strong>the</strong> authors haveused directly quoted material. A fully documented version of <strong>Working</strong><strong>Against</strong> <strong>the</strong> <strong>Tide</strong> is available in P2, NSA. Requests for additional copiesof this publication should be directed to P2, NSA.<strong>The</strong> authors and associated members of <strong>the</strong> NSA/SCA .history teamassume sole responsibility for <strong>the</strong> use made of <strong>the</strong> comments and criticismoffered and for any errors of fact or interpretation of <strong>the</strong> sources availableto <strong>the</strong>m.May 1970IIHiram M. Wolfe, IIIRaymond P. SchmidtThomas N. Thompson(b) (3)-P.L. 86-36TOP SECRET UMBRltUOFORU
TOP SECREr UMBRA!Wfieft!qContentsChapterPART ONEI. THE PROBLEM.Division of Responsibilities.Enemy SIGINT Threat.Major ProblemsPage12211II.CONVENTIONAL COMSEC MONITORING.Army Security Agency .Naval Security GroupAir Force Security Service19215472PART TWOIII. COMSEC SURVEILLANCE . 87<strong>The</strong> Concept . 87SILVER BAYONET. 90Guam 96MARKET TIME 109GAME WARDEN. 116ARC LIGHT. 119PURPLE DRAGON 128IV. COMMUNICATIONS COVER AND DECEPTION. 139Communications Cover . 140Communications Deception . 141V. LESSONS LEARNED. 155COMSEC Education . 155<strong>The</strong> CC&D Paradox. 159New Concepts for Old Problems. 159Full Treatment for <strong>the</strong> Patient. 163Better Systems, Better COMSEC . 163Command Emphasis. 167rep S:BCR:B'f UNIBltAI~OPORN
xLIST OF ABBREVIATIONSINDEX.169173MapsMajor SCA Units Having COMSEC MissionsGuam.18100ChartsCommunications Circuits Monitored in Guam Survey. 99132133Tables136COMSEC Personnel World-Wide, FY 1967 . 21USASA COMSEC Resources in SEA, 1 January 1968 . 28USASA COMSEC Positions in SEA, 1964-68 . 31Transmissions Monitored by ASA, 1966-67 . 35COMSEC Violations in <strong>the</strong> FFV II Area, November 1966-June 1967 . 39Reported Rates of Violations, 1966-67 . 42Detachment 5 Mobile Operations, 1966 . 76Seventh Air Force Classification of Information. 81Warning Time Revealed in Teletype Transmissions. 126Illustrations<strong>The</strong> COMSEC Monitor at Work.Captured Enemy Communications Equipment.North Vietnamese Intercept Operator at Work •.Enemy SIGINT Personnel .404th ASA Detachment Operations Building .404th ASA Detachment Officers' Billets .xu4592627TOP SECRET UMBRAHOFORH(b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403 (b) (3)-P.L. 86-36
'fOF S£CR£'f UMBRAUOFORN<strong>The</strong> COMSEC Monitor at Work (Charcoal by Specialist 5 WayneA. Salge, a member of <strong>the</strong> ASA Combat Artists Program.)'fOF S£CR£'f UMBRAtriOFORU
TOt" ~I;;CRET UMBRA HOFORf,qCHAPTER I<strong>The</strong> ProblemWithout intelligence, one is vulnerable; without security,one is defenseless.-Ancient military axiomA nation's success in military operations often rises and falls on <strong>the</strong>basis of how well it communicates. When a nation does not secure itscommunications effectively, its enemies intercept and read itscommunications and win <strong>the</strong>reby military and diplomatic advantages.In Sou<strong>the</strong>ast Asia, <strong>the</strong> United States and its Allies required electricalcommunications in great volume. <strong>The</strong> enemy controlled or had access to alarge part of <strong>the</strong> disputed land area and could destroy or tap land lines.<strong>The</strong>refore, radio was <strong>the</strong> most frequent vehicle for communications. Ifanaccurate measure of <strong>the</strong> volume of <strong>the</strong>se communications-those passedby <strong>the</strong> hundreds by U.S. Army, Navy, Air Force, and Allied units-werepossible, that measure would suggest <strong>the</strong> sands of <strong>the</strong> sea itself. It was <strong>the</strong>responsibility of <strong>the</strong> communications security (COMSEC) community tokeep <strong>the</strong> enemy from using <strong>the</strong>se transmissions to <strong>the</strong> disadvantage of <strong>the</strong>United States and its Allies. <strong>The</strong> responsibility was an awesome one. <strong>The</strong>COMSEC community had to cope with an ocean tide of problems.Providing communications security for U.S. forces in Sou<strong>the</strong>ast Asiaentailed many diverse functions and required many cooperative actions on<strong>the</strong> part of <strong>the</strong> Armed Services and U.S. COMSEC agencies. Designing,manufacturing, and distributing cryptornaterials to satisfy U.S. needs andin some cases those of our Allies, testing U.S. communications facilitiesfor conformity to physical and radiation standards (TEMPEST), trainingU.S. and Allied communicators in COMSEC practices, monitoring andanalyzing U.S. communications in order to evaluate <strong>the</strong> effectiveness ofCOMSEC measures-<strong>the</strong>se and o<strong>the</strong>r functions constituted <strong>the</strong> broadU.S. program to bring security to U.S. and Allied communications. As<strong>the</strong> heart of Service COMSEC activity, monitoring and analysis not onlyTOt" SECRET UMBRAHOFORH
'fOP S£ER£'f UhtBRAHOfORH2 WORKING AGAINST THE TIDErequired <strong>the</strong> greatest percentage of manpower but also provided <strong>the</strong> basisfrom which many COMSEC improvements stemmed.Division ofResponsibilities<strong>The</strong> Services had full responsibility for COMSEC monitoring andanalysis, though NSA exerted some influence through its annual reviewof <strong>the</strong> Consolidated Cryptologic Program and o<strong>the</strong>r measures. In April1967, Mr. Howard C. Barlow, chief of NSA's COMSEC organization,described <strong>the</strong> division of responsibilities in this manner: NSA's role wasand should remain that of a wholesaler of COMSEC material-doctrineof use, cryptoprinciples, <strong>the</strong> operation of an integrated NSA-SCA R&Dprogram, and production of crypto-equipment, keylists, codes,maintenance manuals, and all instructional and procedural documentsthat went along with <strong>the</strong> systems. <strong>The</strong> Service Cryptologic Agencies(SCA's), in contrast, were retailers of <strong>the</strong> cryptornaterials and had fullresponsibility for <strong>the</strong> security of <strong>the</strong> communications of <strong>the</strong>ir ownServices-including monitoring and associated analytic functions. <strong>The</strong>Services also formulated <strong>the</strong>ir own requirements, both qualitative andquantitative, and determined for <strong>the</strong>mselves <strong>the</strong> acceptability of NSA'sproducts.Enemy SICINT ThreatAs in World War II and <strong>the</strong> Korean conflict, <strong>the</strong> U.S. and Alliedcommunications in Sou<strong>the</strong>ast Asia were deficient in security, and anactive enemy SIGINT organization was taking full advantage of this toacquire valuable intelligence. <strong>The</strong> prupose of U.S. COMSEC monitoringand analysis operations in Sou<strong>the</strong>ast Asia, simply, was to deny thatadvantage to <strong>the</strong> enemy by improving communications security practices.But COMSEC representatives often had difficulty convincing U.S. as wellas Allied military commanders that <strong>the</strong> enemy had <strong>the</strong> ability to interceptand make tactical use of Allied communications. Unconvincedcommanders did not always react positively to recommendations forCOMSEC improvements.<strong>The</strong> enemy SIGINT threat was real enough. According to <strong>the</strong>communists <strong>the</strong>mselves, <strong>the</strong>y collected almost all <strong>the</strong> Republic of'fOP S£ERE'f UMBR1\l'JOFORflJ
'fOf ~r:CKr:'f UMBKA UOfORN'THE PROBLEM 3Vietnam Armed Forces (RVNAF) and U.S. traffic passed on selectedRepublic of Vietnam (RVN) traffic lanes, and <strong>the</strong>y also monitoredspecific tactical RVN communications just before and during attacks. Asearly as September 1963, <strong>the</strong> Guidance Committee of <strong>the</strong> VietnameseCommunist's Central Office for South Vietnam transmitted a directivewith instructions to intercept, country-wide, enemy (RVNAF)communications.During 1964-65, <strong>the</strong> Vietnamese Communists conducted successfultactical SIGINT operations against <strong>the</strong> RVNAF. Often using U.S.equipment captured from Army of <strong>the</strong> Republic of Vietnam (ARVN)units, <strong>the</strong>y intercepted RVNAF plain language communications, <strong>the</strong>irmost lucrative source of intelligence. <strong>The</strong>y also were able to read <strong>the</strong> lowgradeSLIDEX cryptosystem in which <strong>the</strong> RVNAF encrypted all orsensitive portions of many communications, as well as o<strong>the</strong>r low-gradesystems. <strong>The</strong>y gave, on <strong>the</strong> o<strong>the</strong>r hand, no known attention to RVNcommunications encrypted in <strong>the</strong> KL-7 or PYTHON (one-time tape)systems that <strong>the</strong> United States provided to South Vietnam.<strong>The</strong> Viet Cong in this early period are not believed to have targetedEnglish-language communications regularly. <strong>The</strong>y did intercept U.S.Special Forces messages, but those collected at <strong>the</strong> time were transmittedthrough RVNAF communications channels. This apparent lack ofSIGINT targeting of U.S. communications, it was believed, resulted fromViet Cong inexperience, lack of English linguists, and consideration of<strong>the</strong> Republic of Vietnam as <strong>the</strong> main enemy. It was even likely that <strong>the</strong>ycould gain all <strong>the</strong> intelligence <strong>the</strong>y needed on <strong>the</strong> growing U.S. presencein Vietnam from RVNAF communications.While <strong>the</strong> Viet Cong may have emphasized RVN communicationsduring 1964 and 1965, <strong>the</strong> North Vietnamese were enjoying somesuccess against U.S. Navy communications. In <strong>the</strong> very first week ofregular bombing of North Vietnam, U.S. COMSEC revealed that navalcommunications were possibly giving flight information to <strong>the</strong> enemy. ANavy COMSEC unit intercepted a plain language transmission from <strong>the</strong>USS Hancock on 11 February 1965 indicating <strong>the</strong> imminent launch ofaircraft and <strong>the</strong> carrier's intention of conducting recovery operationsfollowing an air strike against shore targets. <strong>The</strong> COMSEC unitimmediately reported <strong>the</strong> possible compromise of this combat'fOP SECRE'f UMBRAUOfORH
TOP Sti€RtiT UMfiftA!\'Of'(7ftH'4 WORKING AGAINST THE TIDECommunications Equipment Captured From an Enemy SIGINTUnit. (Top, left to right: a homemade transmitter, a homemadereceiver, two U.S. AN/PRC-25's, and a U.S. AN/PRe-n.Bottom, left to right: radio receiver parts, antenna parts, wire,headphone, and a CHICOM R-139 receiver with headphone.)TOP S~CR~T UMBRA: UOFORU
TOP S~€R~T UMBRA UOFORUTHE PROBLEM 5North Vietnamese Intercept Operator at Work (Captured photograph)information to <strong>the</strong> carrier strike force and to <strong>the</strong> Commander in Chief,Pacific Fleet (CINCPACFLT)../TOP e~€R~TUMBRAHOfOItN'(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'fOP SrCRr'f UMBRAN'Ot'ORrq'6 WORKING AGAINST THE TIDEBen Thuy directed North Vietnamese naval units to use camouflage andsystematically disperse before <strong>the</strong> morning of 11 February.In 1966 and 1967, as <strong>the</strong> dimension of <strong>the</strong> war grew and <strong>the</strong> enemywidened <strong>the</strong> scope of his SIGINT operations, he continued to rivet hisattention on <strong>the</strong> plain language communications of <strong>the</strong> RVNAF and,increasingly, on those of <strong>the</strong> U.S. forces. Ralliers and defectors attested to<strong>the</strong> intelligence content and value of intercepted Vietnamese and Englishplain language messages. Interrogation of <strong>the</strong>se men revealed that <strong>the</strong>enemy often did not have a sufficient number of English languagespecialists for <strong>the</strong> work at hand. One rallier, Nguyen Van Lee, whodefected in 1967 after ten years with <strong>the</strong> Viet Cong, was very muchimpressed not only with <strong>the</strong> amount of information his unit was able tointercept but also with <strong>the</strong> accuracy of information from <strong>the</strong> NorthVietnamese Central Research Directorate, which managed VietnameseCommunist SIGINT operations. He claimed that over a lO-year periodhis unit had never been taken by surprise. Nor were Viet Cong such asNguyen Van Lee alone in <strong>the</strong>ir work\ISince <strong>the</strong> Vietnamese Communists did not differentiate SIGINT fromo<strong>the</strong>r intelligence, it was often difficult to label examples of knownenemy-obtained intelligence as being of strictly SIGINT derivation.<strong>The</strong>re were, never<strong>the</strong>less, many cases in which SIGINT was/beyonddoubt <strong>the</strong> source of<strong>the</strong> intelligence.U.S. forward air controllers (FACs) were certain, for example, that<strong>the</strong> enemy often had prior warning of incoming U.S. aircraft flights andthat <strong>the</strong> forewarnings must have come from his intercept of U.S. voicecommunications. This was true particularly of night operations. FACsreported that enemy ground vehicles had been observedto move off roadsand turn off <strong>the</strong>ir lights following U.S. air-to-air orair-to-ground-to-airvoice communications. For low-flying aircraft, noise could have provided<strong>the</strong> tip-off. However, <strong>the</strong> controllers found it hard to believe that noise of<strong>the</strong>ir aircraft could be detected when aircraft were operating in a "loiter"TOP SECRET UMBRAPWfOR?J(b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403(b) (3)-P.L. 86-36
TOP SECRET UMBRA?q8fi8It?qTHE PROBLEM 7configuration. Fur<strong>the</strong>r, FAC and strike crews working at night observedthat after <strong>the</strong>y discussed <strong>the</strong> geographical direction of an imminent strike,enemy defensive weapons often were oriented in <strong>the</strong> direction of <strong>the</strong>coming attack. Occasional voice spoofing by <strong>the</strong> FAC and strike forcecommunicators confirmed <strong>the</strong> observation.Communist foreknowledge of U.S. air strikes, including <strong>the</strong> B-52bomber operations, also came from ARVN and U.S. ground-to-groundvoice communications. Enemy SIG INT operators often interceptedARVN warnings to pro-ARVN province chiefs of forthcoming air strikesin <strong>the</strong>ir areas. Of many examples showing how poor U.S. COMSECpractices limited <strong>the</strong> effectiveness of <strong>the</strong> B-52 program, <strong>the</strong> one below isperhaps typical. <strong>The</strong> Americans were discussing" heavy artillery" (B-52strikes) in plain English over a radio one day at 0855:1st American: You know heavy artillery warning yet?2d American: Negative.1st American: At coord XT 550 600 315/31 until 1130 hours.<strong>The</strong> document recording this conversation, which gives up to two hoursand thirty-five minutes advance knowledge of a B-52 strike atunenciphered geographic coordinates, is not from a U.S. monitoringreport from an early period in <strong>the</strong> war, but from enemy SIGINT materialcaptured by <strong>the</strong> 1st U.S. Infantry Division only a few months before thisjournal went to press.While <strong>the</strong> enemy was exploiting to <strong>the</strong> maximum Allied plainlanguage communications, he was not entirely ignoring encryptedmessages. Captured documents showed that communications encrypted inwidely used "homemade" codes and <strong>the</strong> U.S.-produced AN seriesoperations code were under cryptanalytic study. <strong>The</strong>re was no evidence,as of January 1968, that <strong>the</strong> enemy was able to exploit messagesencrypted in <strong>the</strong> AN-series code. <strong>The</strong>re was, for that matter, no evidencethat enemy SIGINT agencies were reading any messages encipheredin cryptosystems approved by U.S. cryptologic agencies beyond <strong>the</strong>occasional solving of misused manual systems. <strong>The</strong>re was considerableevidence, on <strong>the</strong> o<strong>the</strong>r hand, that <strong>the</strong> enemy was exploiting U.S. communicationsencrypted in home-grown tactical codes through cryptanalysis,and off-line systems through traffic analysis.TOP SECRET UMBRAU8fORU
TOP SECRET Uhf BRAH'Of'Olttq8 WORKING AGAINST THE TIDEBesides working on U.S. communications passively for intelligence ofvalue to his operations, <strong>the</strong> enemy's experience with <strong>the</strong>secommunications was such that he could imitate <strong>the</strong>m when it suited hispurpose. To win tactical advantage, <strong>the</strong> enemy intruded actively on U.S.nets ei<strong>the</strong>r to deceive <strong>the</strong> U.S. operators with false information or toobtain accurate tactical information from <strong>the</strong>m. <strong>The</strong>se ruses often workedbecause U.S. operators usually failed to apply proper au<strong>the</strong>nticationprocedures.As valuable as tactical and strategic intelligence was, imitativecommunications deception (ICD) was <strong>the</strong> capstone of <strong>the</strong> enemy'sSIGINT operations. Through <strong>the</strong> successful use of lCD, <strong>the</strong> enemyrevealed <strong>the</strong> success of his own SIGINT operations against U.S.communications. One example involved an attack against <strong>the</strong> U.S. airbase at Da Nang. After killing a U.S. base guard without being detected,<strong>the</strong> Viet Cong used <strong>the</strong> guard's unsecured telephone and, speakingEnglish, briefly announced that <strong>the</strong> far end of <strong>the</strong> base was beingattacked. No au<strong>the</strong>ntication was demanded. When <strong>the</strong> guards rushed offto <strong>the</strong> far end of <strong>the</strong> field, <strong>the</strong> Viet Cong attacked according to plan withlittle resistance. <strong>The</strong> damage to <strong>the</strong> base and its planes was estimated tobe around $15,000,000. In ano<strong>the</strong>r instance, <strong>the</strong> Viet Cong, with goodEnglish and good communications procedures, lured heliborne troops intoa trap by using designated call signs on proper frequencies and <strong>the</strong>nguiding <strong>the</strong> aircraft into a properly marked landing zone-but not <strong>the</strong>right one. <strong>The</strong> deception was not recognized as such until <strong>the</strong> helicopterswere fired upon during <strong>the</strong>ir landing approach.At Pleiku, by tapping a field telephone circuit supporting <strong>the</strong> perimeterdefenses of a large storage area, <strong>the</strong> Viet Cong on ano<strong>the</strong>r occasionexpertly imitated <strong>the</strong> Spanish accent of a guard sergeant. Stating that hewas preparing hot food, <strong>the</strong> imitator asked for a count of <strong>the</strong> number oftroops in each of <strong>the</strong> operating bunkers. Fortunately, this time <strong>the</strong>deception was recognized as such.<strong>The</strong> 509th Army Security Agency (ASA) Group in Vietnam made alist of known Vietnamese Communist attempts at deception against U.S.Army units for <strong>the</strong> period 1 January 1964 through July 1967. <strong>The</strong> listgave 73 incidents of lCD, of which 23 were at least partly successful,most of <strong>the</strong>m in <strong>the</strong> 1966-67 period. <strong>The</strong>re were examples ofmisdirection of friendly air and artillery strikes, which on six occasionsTOP SECRET UMBR1\nOFORn
TOP SECRET UMBRAPiOFORPiTHE PROBLEM 9Captured Photograph, Believed toPassing Material to Couriers.'V'I_-:.t P ,Represent a SIGINT Analystdiverted <strong>the</strong> fire on to friendly positions. In o<strong>the</strong>r instances, <strong>the</strong> enemygained advantage by giving false cease-fire orders. <strong>The</strong> United States lostat least 8 helicopters during this period as a result of <strong>the</strong> enemy'ssuccessful communications deception. In addition, <strong>the</strong> survey detailedover 100 cases of Viet Cong and North Vietnamese Army (NVA)jamming of U.S. communications. In <strong>the</strong> first four months of 1967, IIIMarine Amphibious Force (MAF) units experienced over 40 attempts atcommunications deception. <strong>The</strong>se had <strong>the</strong> objective of misdirecting airstrikes and artillery missions.<strong>The</strong> incidence of enemy ICD efforts against U.S. forces, especially in Iand II Corps Tactical Zones, increased several fold in 1968. For example,on 6 January 1968 in nor<strong>the</strong>rn Tay Ninh Province <strong>the</strong>re occurred whatbecame known as <strong>the</strong>"Australian ICD Incident." It is one of <strong>the</strong> mostsustained and better-documented examples during <strong>the</strong> war of an enemyattempt-fortunately unsuccessful-at imitative communications'fOP SECRE'f UMBRAPiOFORP.
TOP SECRET UMBRAnOFORn10 WORKING AGAINST THE TIDEdeception. While a battalion of <strong>the</strong> 2d Brigade, U.S. 25th InfantryDivision, was conducting a search and destroy mission, an intruderentered <strong>the</strong> battalion command net and for nearly ten hours was engagedin a running tactical exchange of information. <strong>The</strong> intruder, purportingto be of an Australian unit operating near <strong>the</strong> 2d Brigade battalion,declared that he wanted to establish liaison so as not to interfere with <strong>the</strong>U.S. battalion's operations. <strong>The</strong> intruder gave his position as "about 23meters" to <strong>the</strong> north of <strong>the</strong> battalion, and stated he was from <strong>the</strong>"Australian 173d Unit" on a separated search and destroy mission.Although <strong>the</strong> intruder's accent seemed to be Australian, although hehad entered <strong>the</strong> battalion net using <strong>the</strong> battalion's call sign, and althoughhis methods conformed to normal Allied operational transmissionsprocedures, his responses to challenges and au<strong>the</strong>ntications were evasive.Lt. Col. John M. Henchman, <strong>the</strong> U.S. battalion commander, suspectedan enemy ICD ruse. <strong>The</strong> "Australian" could not be as close as 23 metersto <strong>the</strong> battalion, did not know <strong>the</strong> au<strong>the</strong>ntication code, and could not orwould not give his exact location and direction of movement, firstpleading a different set of maps from those used by Colonel Henchman'sbattalion, <strong>the</strong>n stating that his unit was lost.Instructing his radioman to keep <strong>the</strong> exchange with <strong>the</strong> "Australian"going, Colonel Henchman, using o<strong>the</strong>r communications, checked andfound that <strong>the</strong>re were no Australian units in Tay Ninh Province and nounit called <strong>the</strong> Australian 173d existed. He <strong>the</strong>reupon plotted severallocations from which <strong>the</strong> intruder could be transmitting and called downartillery fire on <strong>the</strong> areas. Finally reflecting in his transmissions thatHenchman had had a near miss, <strong>the</strong> intruder asked that <strong>the</strong> artillery ceasefiring on "friendly forces." A few more rounds of"friendly fire" and <strong>the</strong>"Australian" suddenly broke off and presumably left <strong>the</strong> scene. Asubsequent examination of <strong>the</strong> area of <strong>the</strong> enemy's operation broughtmoderate contacts with Viet Cong and uncovered some empty enemy basecamp installations, but no "Australian."<strong>The</strong> result of this enemy ICD attempt was negligible. Incoming trafficthat would have used <strong>the</strong> battalion command net was interrupted forabout ten hours while <strong>the</strong> "Australian" was kept on <strong>the</strong> net at ColonelTOP SECRET UldBRAH'OFORH
TOP 8HERHT UMBRA?(OFORHTHE PROBLEM 11Henchman's pleasure, but battalion operations continued to be directedon alternate company nets. *<strong>The</strong> enemy's success in posing as a valid U.S. net subscriber was indirect proportion to his intimate knowledge of U.S. communicationsprocedures, frequencies, and <strong>the</strong> personalities of those whocommunicated. <strong>The</strong> only way <strong>the</strong> enemy had of acquiring such deepfamiliarity with U.S. communications was through his own successfulSIGINT operations.Major ProblemsA wide variety of COMSEC problems were related to monitoring andanalysis. While some affected one Service more than ano<strong>the</strong>r, most weregeneral in nature. <strong>The</strong>re were also problems not specifically related toCOMSEC but that none<strong>the</strong>less posed major constraints on <strong>the</strong> conduct ofa monitoring and analysis program.<strong>The</strong> Short- Tour Dilemma<strong>The</strong> I-year tour policy prevailing in Vietnam presented a majorchallenge to communications security. With a change in communicatorsevery twelve months, COMSEC units each year saw <strong>the</strong>ir modest gainsdissipate. COMSEC specialists <strong>the</strong>mselves rotated in and out of Vietnamannually, and suitably trained personnel often were not available to man<strong>the</strong> positions, write <strong>the</strong> reports, and give <strong>the</strong> educational briefings.During most of <strong>the</strong> war years to <strong>the</strong> end of 1967, <strong>the</strong> Army SecurityAgency and Air Force Security Service (AFSS) had no field expertise forexecuting or even planning communications cover and deception(CC&O) projects. <strong>The</strong> MARKET TIME CC&O operation** showed• ASA monitors recorded <strong>the</strong> complete exchange of communications in this incident, 16pages in all. Colonel Henchman presented a special report of <strong>the</strong> episode at <strong>the</strong>Headquarters, USASA, Annual SIGSEC Work Shop, 3 December 1969.Coincidentally, ABC newsmen and TV crews were at <strong>the</strong> battalion CP at <strong>the</strong> time of <strong>the</strong>lCD, and <strong>the</strong>y filmed and taped <strong>the</strong> incident, later released, in part, as an ABC 45minute special on <strong>the</strong> Vietnam War about March 1968. Interview with Maj. Andrew].Allen, II, SIGSEC Br., ODCSOPS, Hq USASA.• "See below. pp. 144-48.TOP 8HERHT UMBRAnOFOR?q
TOP SECRET UMBRAnOFORn12 WORKING AGAINST THE TIDEthat <strong>the</strong> Navy Beach Jumpers needed additional training. <strong>The</strong> I-yeartour worked against high standards for U.S. communicators andCOMSEC specialists alike.<strong>Working</strong> With AlliesAno<strong>the</strong>r problem with which COMSEC analysts had to deal seemed tohave no real solution. Early in <strong>the</strong> war, monitoring revealed <strong>the</strong> problemof achieving operational security at <strong>the</strong> tactical level when <strong>the</strong> COMSECof our Allies was poor .1,In <strong>the</strong> early 1960's, <strong>the</strong> United States rejected several SouthVietnamese requests for COMSEC support. <strong>The</strong> United States first hadto decide on <strong>the</strong> extent of its involvement in Sou<strong>the</strong>ast Asia, what SouthVietnamese and o<strong>the</strong>r Allied officials it could trust, and to what extent itought to give COMSEC assistance to Allies having limited COMSECsophistication and lax physical and personnel security practices: <strong>The</strong>United States also needed assurance that, once cryptomaterials were givento an Ally, <strong>the</strong> Americans would have full cooperation of <strong>the</strong> Ally in <strong>the</strong>secure use of those materials.In mid-1964 <strong>the</strong> United States supplied M-209 cryptomachines toRVN and ROK forces for use at battalion level, and in January 1965 itdistributed <strong>the</strong> AN-series operations code for encryption ar any echelon(replacing <strong>the</strong> SLIDEX). Although RVNAF and ROK COMSECmalpractices did decrease noticeably after <strong>the</strong> South Vietnamese andKorean forces began using U.S.-produced cryptematerials, U.S.authorities in <strong>the</strong> 1964-68 period never achieved aneffective means ofconvincing <strong>the</strong> South Vietnamese that cryptosystemsof <strong>the</strong>ir own designand production were insecure. <strong>The</strong> Americans could/hot share cryptologictechniques with <strong>the</strong> South Vietnamese as <strong>the</strong>y could with a second partycountry such as Australia, and this limitation /made U.S. COMSECadvice somewhat less convincing than it might o<strong>the</strong>rwise have been.While overcoming <strong>the</strong> problems of timely and effective release of U.S.cryptornaterials to an Ally was not <strong>the</strong> responsibility of field monitoringTOP SECRET UMBRANOFORN(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403 (b) (3)-18 USC 798
TQP SECRET UMBRAUOFORH'THE PROBLEM 13and analysis personnel, it was <strong>the</strong>ir monitoring and analysis operationsthat most effectively documented Allied deficiencies and set <strong>the</strong> stage forIthat assistance.IIVague GuidelinesU.S. and Allied commanders varied in <strong>the</strong>ir use of classificationprocedures and employed diverse criteria in categorizing information forencryption and electrical transmission. Without specific guidance, aCOMSEC analyst supporting a commander had no fixed scale on whichto evaluate monitored communications. Despite <strong>the</strong> issuance from time totime of specific essential elements of friendly information (EEFI), <strong>the</strong>analyst frequently could not tell if existing regulations required securetransmission and encryption of <strong>the</strong> monitored information-usually plainlanguage-that he had in hand. <strong>The</strong> monitor and analyst accordinglyhad to rely extensively upon <strong>the</strong>ir own judgment. Since <strong>the</strong>.averagecommunicator tended to believe that he had erred only when Serviceregulations prohibited his action, <strong>the</strong> monitor and analyst often found<strong>the</strong>mselves without a convincing arguing point. <strong>The</strong> extent of thisproblem varied during <strong>the</strong> period 1964-67, but it was neverresolved.<strong>The</strong> Preference for Plain Language CommunicationBy tradition, <strong>the</strong> military depended upon communicating in plainlanguage-especially in <strong>the</strong> voice mode-and <strong>the</strong> tradition was hard tochange, especially when change normally required additional time,trouble, and expense. Thus any recommendations to securecommunications met rebuff after rebuff. On many occasions COMSECunits recommended use of voice ciphony at a time when <strong>the</strong> equipmentwas not available in sufficient supply for issue in Vietnam. In <strong>the</strong> absenceof equipment, <strong>the</strong>y had to recommend manual systems, <strong>the</strong> only o<strong>the</strong>rencryption possibility.In Vietnam, especially during <strong>the</strong> early years, <strong>the</strong> U.S. stockedwarehouses with manual systems generally suitable for securing U.S.communications in <strong>the</strong> war zone. COMSEC monitors quickly showedthat, instead of using <strong>the</strong>se materials, U.S. communicators continued topass altoge<strong>the</strong>r too much sensitive material in plain language. WhileTOP SEERET UlvlBRAr,OFORU(b) (1)-(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
14 WORKING AGAINST THE TIDECOMSEC analysts on occasion achieved limited improvement, <strong>the</strong>problem remained. At times, COMSEC analysts singled out unprotectedlanes over which unusual volumes of sensitive information passed in plainlanguage and recommended allocation of crypto-equipment to stem <strong>the</strong>flow. At o<strong>the</strong>r times, COMSEC analysts tried to attain reasonablesecurity along with continued use of plain language communications bycreating an awareness of what was and what was not sensitiveinformation. Unfortunately, <strong>the</strong>re was no blotter large enough to dry upsensitive, exploitable plain language communications in Vietnam.<strong>The</strong> Amateur CryptographerMany a U.S. serviceman became an amateur cryptographer, producinghis own codes designed to serve a particular need. His intention was notto obtain personal privacy in communication but to achieve easy-to-usesystems for his unit's communications. In working with <strong>the</strong> easy-to-usehomemade codes, communicators avoided <strong>the</strong> more complex and timeconsumingcryptographic procedures sometimes inherent in approvedsystems. Not realizing that <strong>the</strong>ir systems afforded at best only marginalsecurity, <strong>the</strong> communicators regularly encrypted sensitive information in<strong>the</strong>m. Commanders failed to prevent <strong>the</strong> use of <strong>the</strong> unapprovedcryptographic systems over <strong>the</strong>ir communications links, and COMSECspecialists often were unable to persuade commanders to discontinue <strong>the</strong>iruse.SCA specialists demonstrated over and over <strong>the</strong> cryptanalyticvulnerability of <strong>the</strong> home-grown variety of cryptographic systems, but tolittle avail-<strong>the</strong>ir continued appearance on <strong>the</strong> scene has constituted oneof <strong>the</strong> major COMSEC headaches of <strong>the</strong> war. Even as late as <strong>the</strong> springof 1969, <strong>the</strong> U.S. Air attache in Laos, who was coordinating semicovertU.S. air and o<strong>the</strong>r operations in that country, was sending most of hismessages in a code he had made up for himself. Air Force SecurityService COMSEC analysts monitoring <strong>the</strong> attache's transmissions foundthat <strong>the</strong>y could completely reconstruct his code within 8 to 10 hours aftereach change. Since <strong>the</strong> attache changed codes only every five weeks, mostof his messages were susceptible to immediate enemy SIGINTexploitation. <strong>The</strong> appearance and reappearance of codes of this typedemanded constant COMSEC alertness.TOP SECRET UMBRAHOFORf',
TOP SECRET UMBRAUOf01U4THE PROBLEM 15Lack ofCommand EmphasisA commander's attitude toward COMSEC obviously had its effectupon <strong>the</strong> COMSEC status of his unit. Not all commanders placed <strong>the</strong> :emphasis on COMSEC required to deny advantages to <strong>the</strong> enemy. Col.Tom M. Nicholson, Signal Officer, 1st Cavalry Division (Air Mobile),from September 1965 to January 1966, having a good understanding ofCOMSEC matters, elaborated on some of <strong>the</strong> attitudes and problems<strong>the</strong>n confronting a U.S. commander:With regard to COMSEC, it was not good in Vietnam. But, until we canresolve <strong>the</strong> problem of sufficient frequencies and multiple allocations for tacticalunits, we won't be able to do much toward <strong>the</strong> basis of COMSEC application. If<strong>the</strong>re were enough frequencies, with alternates allocated to various commands,<strong>the</strong>n we might be able to change frequencies. Until this is possible it is useless,from a COMSEC viewpoint, to change SOI-SSI and call-signs without changingfrequencies. In Vietnam, <strong>the</strong>re were not enough available ...; <strong>the</strong>refore, <strong>the</strong>frequencies never changed, <strong>the</strong> call-signs were not practicably changeable, and<strong>the</strong> first basic principle of COMSEC was defeated. Fur<strong>the</strong>r, any attempt topreserve <strong>the</strong> loss of OB information through COMSEC applications in anyforeign area in which USF operates, where part of <strong>the</strong> people are hostile orunsympa<strong>the</strong>tically motivated, would be an exercise in futility.<strong>The</strong> extent of communications usage and reliance in SVN, withmultinets-for example, MEDIVAC and troop transport helicopter companiesoperating within hourly time-frames, hundreds of miles apart, in support ofmany international units <strong>the</strong>y did not even know, for which <strong>the</strong>y could notpossibly carry or use all <strong>the</strong> SOl's involved-e-cornpelled <strong>the</strong> use of non-changingcall-signs. For example, we changed all call-signs in <strong>the</strong> 1st Cavalry Divisionwhere <strong>the</strong>re were many air/ground, artillery, transport, logistic, administrativeand command nets involved. <strong>The</strong> resulting confusion hampered our operations.We ordered a change back to <strong>the</strong> known call-signs to regain operationaleffectiveness. Fur<strong>the</strong>r COMSEC problems were derived from <strong>the</strong> aviators of airsupport elements where rapid reaction operational capability was a necessity. Forexample, a GI could get MEDIVAC immediately in certain areas in SVN bycalling "DUSTOFF" on a frequency known by all. We couldn't afford tochange that, for <strong>the</strong> soldier-officer-user could not, in emergency, keep up withor look up a new frequency and call-sign when <strong>the</strong> choppers were needed. It ispossible that "DUSTOFF" was monitored by <strong>the</strong> enemy; however, its use savedmany lives.TOP SECRET UMBRAHOfORf4
TOP SECRET UMBRArWfORH16 WORKING AGAINST THE TIDETo a great extent, however, clear voice was employed with a reasonabledegree of security consciousness or awareness. Voice communications were usedprimarily by officer-communicators from platoon to division levels. <strong>The</strong>y had anawareness of <strong>the</strong> probability of enemy intercept and, generally, spoke in <strong>the</strong>clear only within an operational time-frame-a few hours or that day-fromwhich <strong>the</strong> enemy could not gain sufficient information to react against our speedand mobility. When discussing forthcoming operations or events of <strong>the</strong> futuremore than 24 hours away, <strong>the</strong>y used secure means, courier, or codes. All of ourprimary operational communications were passed on KW- 7-secured (LLTTRA TTl circuits from battalion to FFV levels, and between Operations Centersat superior, subordinate or lateral battalions, brigades and divisions. Thus, for<strong>the</strong> more important traffic, we had good security. I know of no instances whereCO MSEC weaknesses contributed to enemy exploitation of USF, or changes ofUSF operations/plans.*COMSEC monitors and analysts had an advisory role only and nopower <strong>the</strong>mselves to effect changes. For a variety of reasons commandersfrequently ignored, or read sympa<strong>the</strong>tically without action, <strong>the</strong> findingsof <strong>the</strong> COMSEC units. When <strong>the</strong> commanders did not appreciate <strong>the</strong>significance of COMSEC-and many of <strong>the</strong>m had not learned of <strong>the</strong>importance of COMSEC in tactical operations before being assigned toVietnam-<strong>the</strong>y did not adequately support monitoring and analysisoperations. A forceful Intelligence or Signal staff officer fully sold oncommunications security could partially compensate when <strong>the</strong>commander failed to be involved personally, but barring <strong>the</strong> presence of aCOMSEC-oriented staff officer, disinterest on <strong>the</strong> part of <strong>the</strong> commandercould obviously have only an unfavorable effect on <strong>the</strong> COMSEC statusof his command and an adverse psychological effect upon <strong>the</strong> monitors.Under <strong>the</strong>se circumstances, attempts to introduce sound COMSECpractices seemed a thankless task.*Interviews conducted by H. M. Wolfe, III, 1967-68, with various officers who hadheld commands in Vietnam. Hereafter cited as Wolfe, Interviews. This and laterquotations are used simply to reflect prevailing attitudes of <strong>the</strong> period and should in noway be taken as criticism of those concerned.TOF SECRET UMBRArWfORH
"".CHINA~:( LAOS/ r......,I ./'" """,.J \l..,"" ,,\, .. ",Udorn -"',THAILANDro:t'71Korattill,UTOP SECRET Uf;fBRJ'l:tWfORf,
'TOY SfCRf'T UMBRAHOFORHCHAPTER IIConventional COMSEC MonitoringIn conventional COMSEC operations <strong>the</strong> monitor places himself in <strong>the</strong>role of <strong>the</strong> enemy. Selectively, he intercepts <strong>the</strong> communications of hisown Service and <strong>the</strong>n reports on <strong>the</strong> intelligence he has-and <strong>the</strong> enemycould have-gleaned from <strong>the</strong>m. When all goes well-when <strong>the</strong> U.S.command takes <strong>the</strong> action implicit in or recommended by <strong>the</strong> monitor'sreport-<strong>the</strong> monitor has earned his keep.Maj. Jerry L. Brown, COMSEC officer at <strong>the</strong> ASA Field Station, PhuBai IIduring <strong>the</strong> first part of 1968 recalled one instancewhen a compromise. was reported in time to perhaps save <strong>the</strong> life of <strong>the</strong>Deputy Chief, Military Assistance Command, Vietnam, Lt. Gen.Creighton W. Abrams.During <strong>the</strong> formation of MACV FWD, Gen. Abrams made a helicopter tripfrom Saigon to Hue-Phu Bai. <strong>The</strong> details of <strong>the</strong> flight, including time, altitude,route and passengers, were. transmitted in <strong>the</strong> clear on an RTP link. OurCOMSEC monitors picked it.up and reported it immediately. As a result, <strong>the</strong>flight plan was changed. However, an accompanying craft was not notified of<strong>the</strong> change, and it was shot at <strong>the</strong> whole way from Saigon to Phu Bai-anunusual effort by <strong>the</strong> VC, who, did not usually shoot at helicopters on suchflights. This I believe was a certain. example of enemy SIGINT use.*Here several important aspects of a successful monitoring operation comeinto play. Having only limited \coverage of U.S. communications (2percent to 6 percent at best), <strong>the</strong> 'monitor had heard and recognized aCOMSEC violation, reported it without delay, and realized success when<strong>the</strong> U.S. command changed GeneralAbrams' flight plan. Dramatically,<strong>the</strong> command's failure to warn <strong>the</strong>. accompanying aircraft led to ademonstration of <strong>the</strong> enemy's use ofSIGINT.·Wolfe, Interviews.TOP\5EERET UMBRAHOFORH(b) (1)-_._- (b) (3) - P . L . 8 6 - 3 6(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAPWFORH20 WORKING AGAINST THE TIDEAs early as 1959, questions arose concerning <strong>the</strong> communicationssecurity status of <strong>the</strong> U.S. Military Assistance Advisory Group's(MAAG) communications nets in South Vietnam. During an annualinspection of <strong>the</strong> MAAG cryptocenter at Saigon in 1960, <strong>the</strong> ASAPacific inspecting officer discussed COMSEC with <strong>the</strong> Signal Officer,MAAG Vietnam. Later, at <strong>the</strong> prompting of his Signal officer, <strong>the</strong> Chief,MAAG Vietnam, Maj. Gen. Charles J. Timmes, asked ASA Pacific tosend a COMSEC monitoring team to South Vietnam to sample MAAGcommunications. Late in 1960 a 6-man team arrived on TOY fromOkinawa. <strong>The</strong> team's monitoring revealed that <strong>the</strong>re was practically noapplication of COMSEC within South Vietnam on <strong>the</strong> uncovered U.S.RVN radio nets operated in support of MAAG. <strong>The</strong> team learned thatsome advisors had not once used <strong>the</strong>ir one-time encryption pads during<strong>the</strong>ir entire tour. In o<strong>the</strong>r instances where <strong>the</strong> pads were used, <strong>the</strong> volumeof "unclassified" clear-text transmissions was sufficient to provide muchusable intelligence to a hostile SIG INT organization. Investigationrevealed that no SCA had been tasked to provide COMSEC assistance inSou<strong>the</strong>ast Asia. <strong>The</strong> monitoring team <strong>the</strong>n reported its findings toGeneral Timmes and <strong>the</strong> Chief of USASAPAC, Col. Robert T. Walker.To improve <strong>the</strong> situation, Colonel Walker issued crypto-equipment toMAAG teams, stressed <strong>the</strong> use of one-time pads, recommended <strong>the</strong>encrypted for transmission only (EFTO) policy, and established controlfor continuing callsign and frequency assignments in Vietnam.In <strong>the</strong> early 1960's, each SCA developed in Sou<strong>the</strong>ast Asia aCOMSEC organization scaled to <strong>the</strong> need for monitoring <strong>the</strong>communications of its own Service, <strong>the</strong> Army Security Agency in additionguarding for <strong>the</strong> joint communications of MAAG and MACV.Responsibility for COMSEC at <strong>the</strong> COMUSMACV level rested at firstin <strong>the</strong> J-6 staff, and in mid-1965 shifted to <strong>the</strong> J-2 staff section, whichin 1967 added a position for a COMSEC officer (MOS 9630). WhileSCA specialists often had o<strong>the</strong>r COMSEC functions to perform, by andlarge monitors and analysts predominated in <strong>the</strong> Sou<strong>the</strong>ast Asian as wellas world-wide COMSEC organization. (See table, p. 21.)TOP S£CR£T UJ'vfBRAHOFORH
TOP S£ER£T UbfBRAnOFORnCONVENTIONAL COMSEC MONITORING 21COMSEC Personnel World-Wide(FY 1967)MonitoringAnalysis and transcribingDoctrine (Hq)Technical guidanceCC&DELSECMaintenanceAdministration and logisticsArmyPers %NavyPers %Air ForcePers %Total personnelArmy Security AgencyOrganizationOf <strong>the</strong> Service Cryptologic Agencies, ASA developed <strong>the</strong> largest andmost complex COMSEC organization in Vietnam, over <strong>the</strong> yearsevolving from one stage to ano<strong>the</strong>r, each more complex than <strong>the</strong> last, asU.S. troop levels increased. After <strong>the</strong> 1960 TDY visit of <strong>the</strong> ASACOMSEC team to Vietnam, <strong>the</strong> 400th USASA Special Operations Unit(SOU) (Provisional) (covername, 3d Radio Research Unit) was <strong>the</strong> firstASA organization assigned SIGINT functions in South Vietnam.Arriving in May 1961 and at first staffed with onlyl ~he 400thSOU in <strong>the</strong> early days of its existence had no format COMSEC sectionbut did perform COMSEC operations in <strong>the</strong> Saigon. area, monitoringtelephone circuits on <strong>the</strong> RVNAF-MAAG. switchboard andrecommending COMSEC improvements to <strong>the</strong> MAAG Vietnam )-6staff. It also had responsibility for <strong>the</strong> security of CRITICOMM circuitsin Sou<strong>the</strong>ast Asia. In September 1961 <strong>the</strong> ASA unit was redesignated <strong>the</strong>82d Special Operations Unit.TOP S£ER£T UMBRAnOFORH(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
ITOP SECRET UMBRAUOFORN22 WORKING AGAINST THE TIDEOn 12 October 1961 six enlisted CO MSEC specialists from <strong>the</strong> lO4thUSASA Security Detachment on Okinawa arrived in Saigon on TOY.After a short stay in <strong>the</strong> MAAG headquarters compound, <strong>the</strong> men movedinto 82d SOU facilities at Tan Son Nhut Air Base. With three positionsthat <strong>the</strong>y brought with <strong>the</strong>m, <strong>the</strong> men monitored <strong>the</strong> telephone,radiotelephone, teletype, and manual Morse communications of MAAGVietnam. <strong>The</strong> men formed <strong>the</strong> nucleus for <strong>the</strong> 82d SOO's COMSECsection. Headquarters, USASA, formalized <strong>the</strong> 82d's COMSEC missionby an operations plan in December 1961 under which <strong>the</strong> commandingofficer of <strong>the</strong> 82d SOU assumed responsibility for <strong>the</strong> full scope ofCOMSEC support to both <strong>the</strong> Chief, MAAG Vietnam, and <strong>the</strong> Republicof Vietnam Armed Forces.With this modest beginning, <strong>the</strong> 82d SOU's COMSEC sectiongradually expanded its monitoring of MAAG and MACV militarycommunications. By <strong>the</strong> summer of 1962, <strong>the</strong> section had monitoredapproximately 60,000 radiotelephone and teletype messages and reportednumerous transmission security (TRANSEC) violations and dangerouspractices to MACV. After <strong>the</strong> introduction into Vietnam of <strong>the</strong> POLLUXoff-line cryptosystem for general use by U.S. military units in <strong>the</strong> springof 1962, it began <strong>the</strong> task of examining encrypted communications andreporting on practices found dangerous to security.Soon, <strong>the</strong> COMSEC section of necessity began operations with mobileequipment to cover <strong>the</strong> widely dispersed communications of U.S. advisorypersonnel. <strong>The</strong> first mobile operation, in November 1961 by a 2-manteam with a TPHZ-3 position, monitored <strong>the</strong> ARVN I Corps MAAGAdvisory Team I (Da Nang) communications. In later months, similaroperations supported o<strong>the</strong>r advisory teams at o<strong>the</strong>r locations. By <strong>the</strong> endof 1962, COMUSMACV had levied fur<strong>the</strong>r requirements on <strong>the</strong> 82dSOU to provide COMSEC coverage of <strong>the</strong>JUSMAAG in Thailand.Activation on 1 March 1963 of <strong>the</strong> lOlst USASA SecurityDetachment (SO) (covernarne, 7th Radio Research Unit) represented asecond stage in <strong>the</strong> developing ASA COMSEC organization in Sou<strong>the</strong>astAsia. Assigned to <strong>the</strong> 82d SOU and having a strength oflIt l1e 101st was organized initially into three/sections-headquarters,security monitoring, and control and analysis. <strong>The</strong> 101stexercised technicalcontrol over all U.S. Army COMSEC operations inSou<strong>the</strong>ast Asia until abolltmid-1966, when <strong>the</strong>/arriving ASA battalionsITOP SECRET UMBRA?401'6ItIq(b) (1)(b) (3)-50 USC 403~~-~~~=~~-(b) (3) -18 USC 798(b) (3)-P.L. 86-36
TOP SECRET UMBRA!WfORHCONVENTIONAL COMSEC MONITORING 23assumed control of <strong>the</strong> tactical COMSEC functions of <strong>the</strong> ASA directsupport units (DSU's). Headquarters of <strong>the</strong> 101st SO was at <strong>the</strong> siteof <strong>the</strong> Joint General Staff Compound (Camp Tran Hung Dao, Saigon).'Functioning as a subordinate of <strong>the</strong> 82d SOU and assuming all COMSEC functions of <strong>the</strong> latter's COMSEC section, <strong>the</strong> 101st SecurityDetachment coped with an expanding mission that by <strong>the</strong>n includedCOMSEC responsibility for MACV, MACTHAI, and <strong>the</strong> Joint U.S.Military Assistance Advisory Group in Thailand, as well as advisory andtraining support to <strong>the</strong> RVN Army.With <strong>the</strong> establishment of <strong>the</strong> 10 1st Security Detachment, ASA alsoexpanded its mobile operations. By <strong>the</strong> end of 1963, as many asDmobile teams were operating in such locations as Da Nang, My Tho,BanMe Thuot, Nha Trang, Can Tho, Pleiku, Qui Nhon, and Kontum.Dispersal of <strong>the</strong> teams to <strong>the</strong> various combat tactical zones (CTZ's)permitted <strong>the</strong> COMSEC specialists to cover, on a recurring basis, <strong>the</strong>communications passed by ARVN corps MAAG advisor teams and byusers of <strong>the</strong> MACV country-wide wire, teletype, and radio circuits.Many problems attended <strong>the</strong> deployment of <strong>the</strong> mobile units. Roadtransportation was difficult even when armed convoys were not necessary.Air travel was hard to schedule. Although mobile monitoring teamoperations represented a major portion of <strong>the</strong> 101st SO's COMSECoperations during fiscal year 1965, <strong>the</strong> various problems infielding <strong>the</strong>teams caused a loss of much effective monitoring time. By July 1964 <strong>the</strong>101st SO strength stood atDfficers and men, and more equipmentbecame available. Later, teams established "permanent" detachments ineach CTZ, reducing <strong>the</strong> need for short-term mobile operations. MACVgenerally provided air transport, albeit at low priority, to move teams tobases near <strong>the</strong>ir monitoring locations.In 1965 tasks assigned <strong>the</strong> 101st Security Detachment nearly exceededits capabilities, despite <strong>the</strong> long hours <strong>the</strong> men of<strong>the</strong> unit worked. At thattime <strong>the</strong> 101st was supporting MACV and four major commands withcommunications complexes serving division-sized units in addition tonearly 30 o<strong>the</strong>r switchboards. By mid-1965 at least.Dmore men wereassigned and ano<strong>the</strong>r Dcame on TOY from <strong>the</strong> 104th SecurityDetachment, Okinawa, to help.satisfy <strong>the</strong> growing requirements. In thismanner, <strong>the</strong> 101st Security Detachment was gradually acquiring bothadditional specialists and more equipment', to c;pe with an expandingI.dTQP sBcirH UMBRAPJOfORPJ(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOP SECRET UMBRAIq(jJJi(jJftIq24 WORKING AGAINST THE TIDEI Ithose of 1963.mission. By early summer of 1966 manpower and positions were double509th ASA Group In view of <strong>the</strong> burgeoning commitment of U.S.Army forces to Vietnam, USASA undertook a major upgrading of itsorganization in Vietnam in mid-1966. It discontinued <strong>the</strong> 82d SOU andorganized <strong>the</strong> 509th ASA Group, a level of ASA organization needed tosupport a field army. <strong>The</strong> \\ 509th Group had COMINT, EUNT,ELSEC,* and electronic warfare (EW) as well as COMSEC functions.<strong>The</strong> group-level of organization called for a strength oflICOMSEC spaces\ with tasks directed toward minimizingorder of battle information divulged; determining <strong>the</strong> approximateamount of intelligence information available to <strong>the</strong> enemy throughinsecure communications practices and procedures; determiningcommunications security violations that might compromise plannedoperations, <strong>the</strong>reby-permitting <strong>the</strong>' enemy to take counteraction; makingrecommendations to help evaluate and remedy deficiencies incommunications security; assessing <strong>the</strong> physical security status ofcryptographic facilities and distribution points; and developingcommunications data tosupport manipulative communications deceptionoperations.Components of <strong>the</strong> 509th working on <strong>the</strong> expanding COMSECrequirements were <strong>the</strong> 101st Security Detachment and <strong>the</strong> COMSECelements of <strong>the</strong> 303d and 313th ASA Battalions and <strong>the</strong>ir direct supportunits.101st Security Detachment Headquarters, l O'lst Security Detachment,and <strong>the</strong> 1st Platoon werewith <strong>the</strong>.509th Group at Tan Son Nhut.<strong>The</strong> 10 1st headquarters operational personnel were divided into <strong>the</strong>509th Group COMSEC Section and <strong>the</strong> 101st SD Operations Sectionwith two advisors attached to J-2MACV. <strong>The</strong> 101st controlled 14 to18 COMSEC positions.<strong>The</strong> 2d Platoon was colocated withi<strong>the</strong> 330th ASA OperationsCompany (330th RRC) near Pleiku., <strong>The</strong> 3d Platoon was near <strong>the</strong>headquarters of <strong>the</strong> 303d ASA Battalion (Corps) at Long Binh. <strong>The</strong> 4thII*Army uses <strong>the</strong> expression Signal Security (SIGSEC) to include COMSEC andelectronic security (ELSE C) , <strong>the</strong> security of noncommunications signals.(b) (1)(b) (3)-50 USC 403___ (b) (3) -18 USC 798(b) (3)-P.L. 86-36
LTOP SECRET UMBRA HOfORHIi~;;CONVENTIONAL COMSEC MONITORING 25Platoon was in Can Tho. Detachment I of <strong>the</strong> lOIst SD worked in <strong>the</strong>MACTHAI-]USMAAG compound in Bangkok, Thailand, and an adhoc Capital Monitoring Team of two positions and six men, formed bydirection of MACV, covered switchboards in <strong>the</strong> Saigon-Cholonheadquarters complex.<strong>The</strong> 101st had responsiblity for all aspects of COMSEC for MACV,including monitoring and analysis; review of all locally generatedcryptosignal publications; inspection and approval of all cryptofacilities;COMSEC briefings, lectures, training, and command visits; investigationof cryptosecurity violations and deficiencies; passive ELSEC support; andspecialized training for and assistance to <strong>the</strong> RVNAF on <strong>the</strong> U.S.cryptosystems loaned to <strong>the</strong>m.313th and 303d ASA Battalions and <strong>the</strong> Direct Support Units ASAorganization provided for <strong>the</strong> attachment of direct support units to Armytactical commands for direct SIGINT and COMSEC support to <strong>the</strong> unitcommanders. COMSEC specialists comprised 10 to 20 percent of <strong>the</strong>DSU strength, though frequently ASA commanders, under pressure toprovide more SIGINT coverage, temporarily had to divert COMSECspecialists to SIGINT tasks.ASA DSU's began arriving in Sou<strong>the</strong>ast Asia during <strong>the</strong> latter half of1965, ei<strong>the</strong>r with or shortly after <strong>the</strong> tactical units to which <strong>the</strong>y wereattached. From 4 DSD's operating in 1965, <strong>the</strong> number expanded to 16by 1968. <strong>The</strong> lOlst Security Detachment (on 15 December 1967redesignated <strong>the</strong> USASA Company, Saigon) directed and helped <strong>the</strong>DSU's in <strong>the</strong>ir work with Field Force Vietnam (FFV) headquarters and<strong>the</strong> divisions and brigades that <strong>the</strong>y supported. <strong>The</strong> DSU's issuedmonitoring reports both to <strong>the</strong> supported commands and to higher ASAand command authorities.In February 1966 <strong>the</strong> 313th ASA Battalion (13th RRU), with about60 percent of its authorized strength, began COMSEC support toHeadquarters, I Field Force Vietnam (FFV I). It established liaisonchannels within FFV I and began coordinating <strong>the</strong> work of itssubordinate DSU's at <strong>the</strong> division and brigade level, gradually relieving<strong>the</strong> 10 1st Security Detachment of this responsibility. <strong>The</strong> 313th alsoconcentrated on FFV I headquarters telephone switchboards and radiocircuits. After May 1966, <strong>the</strong> 303d ASA Battalion (l7th RRU) beganparallel COMSEC support to Headquarters, FFV II at Long Binh. <strong>The</strong>TOP SECRET UMBRAUOFORU
TOP SECRET UMBRAHOfORH26 WORKING AGAINST THE TIDE404th ASA Detachment (Airborne) Operations Building, BienHoa, 1967headquarters companies of <strong>the</strong> 303d and 313th ASA Battalions each hadauthorization for a Security Platoon (SIGSEC) of .1I Imen and operated from I Ipositioo'-s,----:'i-n-ad"":'d"":'t:"'"·tt:"'"·o-n-t-operformingawider scope of COMSEC analysis and advisory functions.Subordinated to <strong>the</strong> 303d and 313th Battalions were <strong>the</strong> DSUcompanies and detachments. <strong>The</strong> companies gave COMSEC support todivision commands, usually had an officer and aboutD men forCOMSEC functions, and operated from I Ipositions. <strong>The</strong> DSUdetachments and platoons gave COMSECassistance /at brigade andbattalion levels. Generally, platoons had aboutOCOMSEC specialistsIlAs an exception, heavy separate detachments served <strong>the</strong>Armored Cavalry regiment and mechanized brigades. Each heavyseparate detachment hadaCOMSEC officer,1IIn fiscal year 1967 large-scale COMSEC
TOP SECRET UMBRANOFORtqCONVENTIONAL COMSEC MONITORING 27404th ASA Detachment (Airborne) Officers' Billets, Bien Hoa,19671967. In June of that year, authorized COMSEC spaces in <strong>the</strong> 509thGroup totaleOby-. October 1967 <strong>the</strong> total had increased t..o../Oofwhich about were present. <strong>The</strong> COMSEC element of <strong>the</strong> 509th,reaching full strength in 1968, was <strong>the</strong> largest organization of its typeever to support a U.S. fieldarmy.OperationsASA's COMSEC units, particularly COMSEC elements of <strong>the</strong> directsupport units, usually operated in or near <strong>the</strong> command posts of <strong>the</strong> forces<strong>the</strong>y supported. Close association of<strong>the</strong> COMSEC unit with <strong>the</strong> militarycommander and his staff, usually <strong>the</strong>\G-2 or S-2 and <strong>the</strong> Signal officer,had, of course, many advantages. Nor<strong>the</strong> least among <strong>the</strong>m, it kept <strong>the</strong>military commander apprised of <strong>the</strong> COMSEC status of communicationsunder his control, facilitated procedural changes urged by <strong>the</strong> COMSEC'fOP S£ERE'f UMBRAHOFORN(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
'fOP S£ER£'f UMBRArq'OfORN'28 WORKING AGAINST THE TIDEUSASA COMSEC Resources in SEA, I January 1968Unit Designation a Unit Cover Name a Arrived SEA Supported CommandUSASA Company, Saigonuoi« SO) IOlst RRC (7th RRU) Mar 63 COMUSMACV & USARV313th ASA Bn (Corps) 313th RR Bn (13th RRU) Apr 66 IFFV371st ASA Co (AM Div) 371st RRC (10th RRU) Sep 65 l st Air Cav Div374th ASA Co (InfDiv) 374th RRC (Det; 14th RRU) Aug 66 4th InfDiv404th ASA Det (Abn) 404th RRD (Det I, 3d RRU) Jun 65 173d Abn Bde (Sep)406th ASA Det (Abn) 406th RRD (Det 3, 3d RRU) ]u165 l st Bde, 10IstAbnDiv408th ASA Det (Inf Bde) Americal DSC (Prov) Americal Div408th RRD Aug 66 196th Inf Bde415th ASA Det (InfBde) 415th RR Det Dec 67 11th InfBde (Sep)60lst ASA Det (InfBde) 60lst RR Det Oct 67 198th Inf Bde (Sep)303d ASA Bn (Corps) 303d RR Bn (17th RRU) May 66 II FFV265th ASA Co (Abn Div) 265th RRC Dec 67 10 l st Abn InfDiv335th Div Support Co (In£) 335th RRC Jan 67 9th InfDiv337th ASA Co (Inf Div) 337th RRC (Ll rh RRU) Aug 65 l st InfDiv372d ASA Co (InfDivl 372d RRC (16th RRU) Jan 66 25th InfDiv409th ASA Det (Armd) 409th RR Oet Sep 66 lith Arm Cav Regt856th ASA Oet (Inf Bde) 856th RR Oet Dec 66 I 99th Inf Bde (Sep)ASA Field Station, Bangkok(83d SOU) U.S. Field Station, Bangkok Sep 59 COMUSMACTHAIa Earlier names shown paren<strong>the</strong>tically.Actual strength; authorized strength in paren<strong>the</strong>ses.All officer personnel and 6 enlisted men of 10 I st SO were COMSEC surveillance specialists.a Positions and personnel from ASA Company, Saigon; <strong>the</strong> Bangkok field station's aurhorizarions forCOMSEC was never filled.specialists, and permitted immediate command reaction to any majorcompromises reported. Fur<strong>the</strong>r, <strong>the</strong> continual person-to-personrelationship was indispensable in promoting COMSEC awareness andpersonnel and unit education and training.Platoons of <strong>the</strong> 10Ist Security Detachment dispatched COMSECteams to cover COMUSMACV and ARVN advisors' communications,TOP SECRET UMBRANOFORU
TOP SECRET UMBRANOt'ORfq-CONVENTIONAL COMSEC MONITORING 29-ContinuedTotal CO/\1SEC Personnel'BaseLocationCOMSECPositions Officers' E/\1 Monitors AnalystsSaigon(Tan Son Nhut)Nha TrangAnKhePleikuPhu HiepPhan RangChu LaiChu LaiChu LaiLong BinhBien HoaBear CatLai KheCuChiXuan LocI~MI Iif:"Cat LaiBangkokTotalsoften deploying <strong>the</strong>m from <strong>the</strong>ir platoon bases for extended periods oftime. A team of <strong>the</strong> 2d Platoon, Pleiku, for example, was in Nha Trangin January 1967, in Da Lat in February, in Phan Thier in March, and atCam Ranh Bay in April, without returning to <strong>the</strong> base camp. Although<strong>the</strong> platoon base sites normally had access to ASA CRITICOMMcircuits, communications with detached teams often were delayed.TOP 5B€IHH UMBRAPJOfORU(b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403(b) (3)-P.L. 86-36
TOP SBERBT UMBRAtWFORH30 WORKING AGAINST THE TIDECollection Although ASA monitors used many types of equipment,<strong>the</strong>re were four basic types of positions: MRPZ-3, MJRZ-3, TPHZ-3,and MRQZ-3.* With this equipment, <strong>the</strong> monitors could copy MM,radiotelephone, radioteletype, multichannel, conventional telephone,FM single sideband, and o<strong>the</strong>r communications in <strong>the</strong> .5-2,000 MHzrange. ICoverage ASA specialists spot-monitored encrypted communicationsto check cryptographic systems and transmission practices for conformityto prescribed procedures. Although machine-enciphered communications(KW-7, KW-26, KY-8 ciphony family, and so forth) did not receivecryptanalytic or traffic analytic attention, COMSEC specialists throughliaison with cryptocenters were able to demonstrate cryptonettingvulnerabilities. Brought to <strong>the</strong> attention of appropriate authorities, thisresulted in recurrent major cryptonet realignments. Ra<strong>the</strong>r thanmonitorin machine enciphered communications,*MRPZ-3 is a 3/4-ton, truck-mounted, manual Morse and radiotelephone position,covering frequencies .5-100 MHz; MJRZ-3 is a 3/4-ton, truck-mounted, multichannelmonitor position capable of covering 12 channels-4 channels/simultaneously-infrequencies 30-2,000 MHz; TPHZ-3 is a 3/4-ton, truck-mounted, conventionaltelephone monitor position, with a 30-line capacity, recording one line at a time;and MRQZ-3 is a 3/4-ton, truck-mounted, manual Morse/and radiotelephone FMsingle sideband, air-to-ground communications monitor position/operating in frequencies.5-400 MHz.TOP SBERBT UMBRlrtWFORt4(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
...'fOP SfJERfJ'f UMBRAUOfOKf4CONVENTIONAL COMSEC MONITORING 31Unit"USASA Security Co, SaigonUSASA FS Bangkok404th ASA Det405th ASA Det303d ASA Bn, HHC313th ASA Bn, HHC337th ASA Co371st ASA Co372d ASACo403d ASA SOD406th ASA Det335th ASA Co374th ASA Co408th ASA Det409th ASA Det856th ASA Det265th ASA Det415th ASA Det601 st ASA DetTotalsUSASA COMSEC Positions in SEA, FY 1964-68a Only units of 509th ASAGroup with COMSEC elements listed. List does notreflect subordination, but is generally chronological. Where units have had severaldesignations, <strong>the</strong> latest designation is used.b Does not reflect <strong>the</strong> withdrawal of COMSEC positions from DSU's later in CY68, as realigned under <strong>the</strong> COMSEC surveillance concept."Read figures as "Authorized/Actual (Employed)." Actual varied with availabilityand mission requirements during annual periods.d Inactivated in FY 1966.e Reactivated in support ofa different unit in FY 1968.f Eliminated in 1967.'fOP S£E.RfJ'f UMBRAPJOFORU(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOP SECRET UMBRAUOfOftfq32 WORKING AGAINST THE TIDEConventional Radio Receivers (R-392 above, R-744 below)used with four basic Army equipment configurations.TOP SECRET UMBRAHOfOftfq
TOP SECRET Uf\lftHMNOfORNCONVENTIONAL COMSEC MONITORING 33MRPZ-3 COMSEC Position at Diep Hoa, with sandbaggedshelter at right and generator trailer at left. Such positions areconnected with field analysis centers.ASA COMSEC elements routinely monitored single-channel, nonmultiplexedradio (AM and FM), radiotelephone and landline (wire)telephone, and multiplexed telephone and radiotelephone transmissions.<strong>The</strong>y monitored wire communications by parch-in at communicationsterminals, single-channel radio communications by radio receptionmethods, and multiplexed communications by both methods.\TOP ~liC~T UMBRA UOFOR~l(b) (1)-(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798,!.oJ
TOP SECRET UldBRA34UOfORUWORKING AGAINST THE TIDE<strong>Against</strong> <strong>the</strong> <strong>Tide</strong><strong>The</strong> direct support units gave an account of COMSECweaknesses andstatus in written reports and in briefings to commanders and <strong>the</strong>ir staffs.If a specific commander's communications compromised a plannedoperation, ASA personnel were at hand to convey <strong>the</strong>/ necessary warning.Face-to-face presentation of <strong>the</strong> evidence, even replaying monitoredtapes, at times was not only <strong>the</strong> quickest but also <strong>the</strong> most effective meansto convey <strong>the</strong> warning. While commanders did! not always heed <strong>the</strong>warnings, most of <strong>the</strong>m, when convinced, appreciated <strong>the</strong> support.TOP SECRET UMBRAUOfORU(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRANOFORtJCONVENTIONAL COMSEC MONITORING 35Radio telephoneConventional telephoneRadio teletypeTotalsTransmissions Monitored by ASA19661,430,059228,6056,4041,665,06819676,606,539559,21417,8107,183,563Lt. Col. Grail L. Brookshire, S-2 of <strong>the</strong> 11th Armored Cavalry fromSeptember 1966 through June 1967, recalled one instance in which hisregiment revised its plans when monitoring showed that transmittingover insecure communications, an attached ARVN unit had given <strong>the</strong>time and place of <strong>the</strong> attack.<strong>The</strong> commander of <strong>the</strong> 303d ASA Battalion from April 1967 to April1968, Lt. Col. Norman J. Campbell, reported an incident when aCOMSEC warning went unheeded. While discussing operational matterswith a subordinate unit over a VHF-linked desk phone at Headquarters,1st Infantry Division, one of <strong>the</strong> staff officers remarked-aside, butaudibly enough for <strong>the</strong> COMSEC monitor to hear-that a specificoperation was to take place in a location "35 kilometers north of heretomorrow." Although this likely compromise was brought to <strong>the</strong> staffofficer's attention, <strong>the</strong> plans were not changed since <strong>the</strong> landing zone and<strong>the</strong> area were suitable for <strong>the</strong> operation. On landing, <strong>the</strong> assault force metunexpectedly heavy resistance; U.S. losses were approximately 58 menkilled and 82 wounded. Colonel Campbell regarded <strong>the</strong> outcome as <strong>the</strong>results of an enemy reaction to a security breach.O<strong>the</strong>r incidents continued to reinforce <strong>the</strong> knowledge that, given achance, <strong>the</strong> enemy would use U.S. communications to plan his tacticalmoves. For example, a heliborne senior commander contacted a groundpatrol and, on FM in <strong>the</strong> clear, ordered a rendezvous at a specificcrossroad location. Thirty minutes after <strong>the</strong> patrol arrived <strong>the</strong>re, it washit by Viet Cong, who had not been known previously to be in that area.While <strong>the</strong> encounter may have been a coincidence, Lt. Col. Richard B.Blauvelt of <strong>the</strong> 303d ASA Battalion, which covered <strong>the</strong> incident insupport of Field Forces Vietnam II, stated that <strong>the</strong> "COMSEC breachpossibly caused /those/ U.S. casualties." He told of many similariiIIIII-,'IjlI,i'IITOP SECRET UMBRAfqGfiGKfq
TOP SECRET UMBRAIq'OFORh'36 WORKING AGAINST THE TIDEUSASA Company, Saigon, COMSEC Specialists analyzing, transcribing,and reporting on U.S. communications, Tan Son Nhut.instances happening shortly after detected COMSEC violations, not all ofwhich could have been tactical coincidence,II IpWI of VC captured in <strong>the</strong> DELTA area, . . . indicatedthat <strong>the</strong> VC usuall were ti ed-off from 3-4 da s in advance oLanIReporting While direct channels were open to disclosecompromisesendangering U.S. tactical operations, COMSEC specialists also usedvarious types of reports to convey <strong>the</strong>COMSEC lesson to<strong>the</strong> militarycommands <strong>the</strong>y served. At <strong>the</strong> direct support unit level, analysts at firstprepared draft reports and forwarded <strong>the</strong>m to/higher authority for*Wolfe, Interviews.TOP SECRET UMBRl,tWFORN(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOF SECRET utdBRAHOfORHCONVENTIONAL COMSEC MONITORING 37fpublication, but after March 1967, as did o<strong>the</strong>r echelons of ASA'sCOMSEC organization, <strong>the</strong> DSU's issued <strong>the</strong>ir own publications.In contrast to lower echelon DSU's, <strong>the</strong> battalions served as majorcontrol points for field analysis of monitored communications and forpreparation of individual and summarized field COMSEC reports basedon items from subordinate units. <strong>The</strong> battalions forwarded <strong>the</strong>ir reports,in turn, to <strong>the</strong> 101st Security Detachment, which reported to MACV ando<strong>the</strong>rs.ASA specialists classified COMSEC malpractices, using two basickinds of reports: <strong>the</strong> Transmission Security Violation Report (TSVR) foractual security violations, and <strong>the</strong> Practice Dangerous to Security Report(PDSR) for a broader category of procedural violations that might leadto enemy exploitation. <strong>The</strong>se <strong>the</strong>y issued as "spot reports" or periodicallyas required at successive command levels. A third report form, <strong>the</strong>Transmission Security Analysis Report (TSAR), was published on anaperiodic basis, usually on completion of a task period, mission, oroperation.At <strong>the</strong> end of each month, <strong>the</strong> ASA Company, Saigon (and itspredecessor) consolidated all monitoring reports of its subelements into<strong>the</strong> special Transmission Security Summary Report (TSSR) for )-2MACV. <strong>The</strong> 303d and 313th ASA Battalions sent <strong>the</strong>ir reports to <strong>the</strong>Field Forces Vietnam and each quarter consolidated all analysis andreports into a quarterly summation for COMUSMACV. <strong>The</strong> quarterlyreport was especially useful at o<strong>the</strong>r levels of command and providedinput to <strong>the</strong> Headquarters, USASA, annual report to <strong>the</strong> Department of<strong>the</strong> Army. ASA personnel did not assess intelligence losses. <strong>The</strong>y reportedonly <strong>the</strong> information of possible intelligence value to <strong>the</strong> enemy that <strong>the</strong>yhad observed in monitoring. "<strong>The</strong> primary mission of COMSECmonitoring is to evaluate <strong>the</strong> effectiveness of measures taken to maintainand improve COMSEC and to identify or define security weaknesses ormalpractices." *<strong>The</strong> reporting system produced literally thousands of examples ofdeficiencies. In 1965-68 <strong>the</strong> instances noted in <strong>the</strong>se many warnings to*CGUSASA Msg to DIRNSA, tAOPS-E (M) 7132835, sub: Status of COMSECSurveillance Activities (D) AGI Nr. 35364 DTG 1222102 May 67,CONFIDENTIAL.TOP S£ER£T UMBRAnOFORn
'fOP SECRET UMBRANOFORN38 WORKING AGAINST THE TIC<strong>the</strong> commands, and <strong>the</strong> thousands more that undoubtedly wenundetected, represented a veritable flood of intelligence for enem,SIGINT exploitation and tactical application, a flood that spelled defeator lossesduring many U.S. combat operations.In that flood are examples from <strong>the</strong> period before large-scale U.S.commitment to Vietnam began, from <strong>the</strong> later periods, and from alllevels of <strong>the</strong> U.S. military command. Like <strong>the</strong> perennial Asian flu, poorCOMSEC practices affected without discrimination all echelons; like<strong>the</strong> flu, it also attacked every wave of Americans arriving in Vietnam.In 1964 a 101st Security Detachment mobile team monitored MAAGAdvisory Team 75. It also monitored <strong>the</strong> ARVN 7th Division operationsand intelligence (0&1) net, <strong>the</strong> BLUEBIRD Advisor Groupswitchboard, and <strong>the</strong> FM air-to-ground net used by <strong>the</strong> advisory team.Team specialists identified nine COMSEC violations. COMSEC reportsoutlined <strong>the</strong> violations and noted <strong>the</strong> intelligence compromised.Monitoring revealed in this case <strong>the</strong> location of an artillery battery,expected time of attack by friendly aircraft 30 minutes before <strong>the</strong> strike,<strong>the</strong> imminence and objectives of an air reconnaissance mission, <strong>the</strong>expected time of arrival of Chief MAAG in <strong>the</strong> My Tho area and <strong>the</strong>mode of travel to be used by him and his party, <strong>the</strong> compromise of <strong>the</strong>grid coordinate encryption system contained in <strong>the</strong> MAAG-ARVN 7thDivision standing operating instructions, and <strong>the</strong> disclosure of operatingfrequencies and call signs. <strong>The</strong> monitors recommended increased use of<strong>the</strong> encrypted for transmission only policy, better COMSEC education forBLUEBIRD switchboard users, use of <strong>the</strong> grid coordinate encryptionsystem, employment of prescribed au<strong>the</strong>ntication procedures, andreduction of unnecessary chatter during transmissions.Compromise of tactical information occurred at every echelon, even at<strong>the</strong> highest levels. In late summer of 1965, ASA monitors, for example,recorded a conversation that passed over an unsecured conventionaltelephone line between Saigon and Da Nang and revealed information ontroop movements of value to <strong>the</strong> enemy. <strong>The</strong> offenders were a generaland a colonel. (See illustration, p. 40.) ASA monitors prepared a TSVRon <strong>the</strong> violation just as <strong>the</strong>y would have for compromises occurring atlower echelons. (See illustration, p. 41.) Correlating information showedthat o<strong>the</strong>r communications had also compromised <strong>the</strong> operation. Aboutninety minutes before <strong>the</strong> conversion between <strong>the</strong> general and <strong>the</strong>'fOP SECRE'f UhtBftArmFOftH'
TOP SECRET UMBRArq-OflORHCONVENTIONAL COMSEC MONITORING 39COMSEC Violations in <strong>the</strong> FFV II Area, November 1966-June 1967CategoryNumberUse ofunauthorized codes 312Linkage ofcall signs to frequency or unit 32Compromises of authorized codes 21Types of disclosures of classified informationUnit locations and coordinates in clear 104Communications and general matters 120Reports (cps, intel, after-action, etc.) 73Plans and operations (OPLANS, OPREPS, objectives, etc.) 71Movements (units, convoys, equipment, etc.) 51Results of enemy action 20Personnel matters and unit strengths 17VIP itineraries 16Logistical information and critical shortages 11Unit capabilities 7Unit identifications 2Experimental equipment 1Cryptoviolations 1Number of transmissions monitored:Radio telephone 1,847,852Conventional telephone 182,418colonel, monitors had recorded a conversation between a )-3 MACVrep~esentativeand ano<strong>the</strong>r colonel. This too had disclosed information onclassified movements and plans for <strong>the</strong> same military operation and was<strong>the</strong> subject of a separate violation report.<strong>The</strong> earlier conversation revealed that <strong>the</strong> 173d Airborne Brigade hadbeen alerted to move as reserve in support of RVNAF forces engaging aregiment of <strong>the</strong> NVA 320th Division. While <strong>the</strong> specific coordinates of<strong>the</strong> planned move were not revealed, <strong>the</strong> enemy would have been able todetermine <strong>the</strong> approximate location since he knew where his own unitwas fighting. What remedial action, if any, resulted from <strong>the</strong> twomonitoring reports cannot be ascertained from available records.Management Data As did <strong>the</strong> o<strong>the</strong>r SCA's, ASA specialists workedhard to get at <strong>the</strong> basic causes of <strong>the</strong> thousands of compromises <strong>the</strong>ydetected in monitoring. COMSEC specialists needed more than anisolated incident here and <strong>the</strong>re to convince some military commandersthat <strong>the</strong>y had a problem. Accordingly, <strong>the</strong> specialists studied violationsTOP SECRET UMBRArq-OflORH
'fOP SECRE'f UMBRAHOFORH40 WORKING AGAINST THE TIDEEnclosure (Monitored Telephone Conversation)J-3 SPECIALISTCOLONEL j. . .j PLEASE.ONE MOMENT SIR.COLONEL...GO AHEAD SIR.HELLO.THIS IS GENERAL j. . .jTHIS IS /. ./ SIR.YEH.I'M CALLING WITH RESPECT TO THE SITUATION IN 2 CORPS.YES.GENERAL THROCKMORTON HAS ORDERED AH BUTCH TO MOVEA.S.A.P. NOW THIS WAS BASED ON SEVERAL CONSIDERATIONS. IT WASTHE STRONG RECOMMENDATION OF COLONEL MATAXIS, IT WAS ASTRONG RECOMMENDATION OF GENERAL TONG, WAS BASED ON AGOOD TENTATIVE IDENTIFICATION OF A NEW PAVN UNIT IN THEAREA.I SEE.AND IT WAS BASED ON A FACT THAT ARVN ALREADY HAS SIXGENERAL RESERVE BATTALIONS COMMITTED UP THERE ....YES.SO GENERAL DEPUY RECOMMENDED THIS COURSE OF ACTION .OKAY.TO GENERAL THROCKMORTON AND THEY WILL MOVE WITH TWOBATTALIONS AS SOON AS POSSIBLE AND A DECISION ON THE THIRDTO BE MADE LATER ON AS THE SITUATION DEVELOPES.YES.AND THEIR MISSION WILL BE TO CONDUCT OPERATIONS WEST OFPLEIKU IN SUPPORT OF THE CG OF 2 CORPS.WELL AH I THINK, WELL I THINK YOU'VE TOLD ME AH ENOUGH IFNOT TOO MUCH.RIGHT.AH WHAT IS THE GENERAL SITUATION UP THERE NOW, ARE THEYSTILL IN CONT ACT?YES SIR, AH, THEY'VE HAD ABOUT A HUNDRED AND FIFTYCASUALTIES! THIS IS THE LAST WORD WE RECEIVED.I SEE, ARE THEY GETTING PLENTY OF AIRSTRIKES THERE?SIR-ARE THEY GETTING PLENTY OF AIRSTRIKES?AH THE WEATHER RIGHT NOW IS BAD, SO THEy'RE JUST NOTGETTING MUCH.TOP 5£ER£T UMBRA1fOFORH
TOP SECRET UPdBRAPWFORP.CONVENTIONAL COMSEC MONITORING 41YES.GENERAL DEPUY IS ON HIS WAY UP THERE AND GENERAL TONG IS ONHIS WAY UP THERE AND THEY WILL MEET AND THEY'LL PROBABLYBE SOME MORE FALL OUT OF IT AS SOON AS THEY GET UP THERE.RIGHT, WHAT ABOUT VC AH CASUALTIES?AH WE HAVE NO WORD ON THAT./END OF CONVERSATION/IAPVCSSUBJECT: Transmission Security Violation Report (U)TO:CommanderUS Military Assistance Command, VietnamATTN: MACJ2, CI & S BranchAPO US Forces 962431. (C) <strong>The</strong> following violation was committed by a member of your command at<strong>the</strong> time and date indicated below. This report is submitted for your information andany action deemed necessary.a. Monitored Circuit: Trunk Circuit between DaNang and Saigon.b. Parties Involved: General ... and Colonel ....c. Time and Date of Violation: 1036H - 1038H, 10 August 1965.d. Type of Transmission: Conventional Telephone Conversation.e. Type of Violation: Disclosure of Classified Movements and Plans.£. Violation of: APPENDIX III, AR 380-5.g. Monitored Conversation: See Inclosure.2. (C) <strong>The</strong> information disclosed in this conversation can be linked with <strong>the</strong> informationdisclosed during <strong>the</strong> conversation monitored between 0905H and 0908H,10 August which was previously reported. <strong>The</strong> information disclosed indicates that<strong>the</strong> 173d Airborne Brigade will deploy to Pleiku and will operate as a reserve toRVNAF Forces engaged with a Regiment of <strong>the</strong> 320th PAVN Division west ofPleiku.FOR THE COMMANDER:InclasJAMES]. SINGSANKCaptain, AGCAdjutantTOP SECRET UMBRAUOFORN
TOP SECRET UMBRAPWFORti42 WORKING AGAINST THE TIDEYear1965Nr. a1966 1,4301967 6,607Reported Rates of Violations(Per 1,000 transmissions)R/T Conv Telephone RTTYTSV PDS Nr. a TSV PDS Nr. a TSV PDS.7.3.8 229.2 55914. .51.9 1.16 5.518 .74.9.7AverageViolation RatesPer 1,0002.93 b3.3.65a Expressed in thousands.b Average violation rate (incompletely reported) for <strong>the</strong> last half of 1965.NB. Above figures based on total monitoring, which reflected less than 6 percent of<strong>the</strong> total communications passed. <strong>The</strong>se statistics are not a valid indicator ofCOMSEC status, but provide only an indication of likely trends and averages.and classified <strong>the</strong>m by type. <strong>The</strong>y <strong>the</strong>n were able to give <strong>the</strong> commandersinvolved information in depth with respect to <strong>the</strong> COMSEC status of<strong>the</strong>ir units so that <strong>the</strong> commanders would have at hand management dataon which to take corrective actions.ASA analysts had specific guidelines for identifying violations-AR380-5 among <strong>the</strong>m-and from such guidelines classified <strong>the</strong> violations.<strong>The</strong> table on page 39, for example, shows <strong>the</strong> number of violations soclassified for FFV II transmissions between November 1966 and June1967. From this, it is easy to see that use of unauthorized codes was amajor problem.In ano<strong>the</strong>r study ASA specialists, also working within FFV II, reviewed18,000 conventional telephone and 285,000 RTP transmissions for <strong>the</strong>first six months of 1967. From <strong>the</strong>se <strong>the</strong>y identified 83 transmissionsecurity violations and 35 practices dangerous to security. <strong>The</strong> percentagerates of violations against total transmissions monitored ranged from alow of .053 in February to a high of 1.57 in April. ASA was able toevaluate this violation rate as "fairly good," based on its largerframework of experience.Any comparison of violations for different periods of time always, ofcourse, involves certain limitations. Never<strong>the</strong>less, ASA did find itinstructive to show observed rates of violations-transmission securityviolations (TSV) and practices dangerous to security (PDS)-per 1,000transmissions in <strong>the</strong> several communications modes ASA monitorsTOP SECRET UfdBRAHOFORH
TOP SECRET UMBRAHOfORHCONVENTIONAL COMSEC MONITORING 43emphasized. <strong>The</strong> table on page 42 gives <strong>the</strong> results of <strong>the</strong> ASA quarterlymonitoring summary reports for all communications monitored inVietnam during 1966-67. Over-all rates of violations showed asignificant and welcome drop between 1966 and 1967. At this time aviolation rate above 2 violations per 10,000 transmissions (.2 per 1,000)was considered excessive.An Example ofCause and Effect In 1967 COMSEC analysts did ayear-long study of <strong>the</strong> 25th Division's voice radio communications,correlated COMSEC actions with <strong>the</strong> COMSEC status of <strong>the</strong> division,and showed that communications could be made secure in relation to <strong>the</strong>\cryptomaterials' availability, quality, and employment, and to commandemphasis. <strong>The</strong> study showed that <strong>the</strong> violation rate per 10,000 voiceradio transmissions was: January, 1.6; February, not reported; March,2.1; April, 1.5; May, .5; June .4; July 9.8; August, 22.3; September,8.0; October, 3.4; November, 1.4; and December, 1.3.<strong>The</strong> drop in April-June period corresponded to <strong>the</strong> issuance of <strong>the</strong>KAC·P/Q, NSA-produced operations codes, which were an improvementover those previously used. When <strong>the</strong> new codes were issued,ASA conducted classes in <strong>the</strong>ir use, and subsequent monitoring showedthat <strong>the</strong> communicators were at first using <strong>the</strong>m for encoding communications.However, <strong>the</strong> division communicators complained that<strong>the</strong> system was too complicated, and monitoring in June-August revealedthat homemade codes-SHACKLE, point-of-origin, and an unnamedcode, all of which offered little resistance to cryptanalysis-were onceagain being used.COMSEC analysts alerted <strong>the</strong> 25th Division's commanding general,Maj. Gen. F. K. Mearns, to <strong>the</strong> significant rise in communicationssecurity malpractices. General Mearns informed <strong>the</strong> DSU and his staffthat he would personally review all transmission security violations andthat disciplinary action would be in order for offenders. This positivecommand emphasis had immediate results-in September <strong>the</strong> rate ofviolations declined. During <strong>the</strong> decline, monitoring showed an increaseduse of <strong>the</strong> KAC-P/Q codes and a reduction in <strong>the</strong> use of unauthorizedcodes. A contributing factor to this decline was <strong>the</strong> publication anddistribution, throu hout <strong>the</strong> division, of a -6 MACV am hlet'fOP SECRE'f UMBRA/ HDfORU(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
ITOP S£ER£T UMBRAf,qofORH44 WORKING AGAINST THE TIDEIfindings. In October, <strong>the</strong> division began to use KY-8ciphony equipment, and this too improved security. In November andDecember, monitoring revealed extensive use of <strong>the</strong> KAC-P/Q codesand increasing use of<strong>the</strong> KY-8.While no record ofviolation rates for <strong>the</strong> 25th Division's conventionaltelephone conversations are available for 1967, a graph of <strong>the</strong>m wouldappear almost identical to that of monitored radiotelephone and FMcommunications. A physical inspection of <strong>the</strong> telephone lines in Octoberof that year revealed, incidentally, evidence of unauthorized wiretapping.Following that revelation, use of <strong>the</strong> telephone dropped to a very low rateand almost no violations came to <strong>the</strong> attention of monitors. For <strong>the</strong>benefit of <strong>the</strong> 25th Division, ASA listed <strong>the</strong> most frequent violations: <strong>the</strong>use of unauthorized codes; disclosure of locations in <strong>the</strong> clear; disclosureof future plans for operations (not found after October); and <strong>the</strong> mostfrequent practice dangerous-to security, complete failure to au<strong>the</strong>nticatecombined with extremely \long, rambling, conventional telephoneconversations and lengthy radiotelephone transmissions.<strong>The</strong> monitoring during 1967 reflected <strong>the</strong> communications of a veryactive division-<strong>the</strong> 25th was. involved in ten major operations. <strong>The</strong>microwave and troposcatter systems serving <strong>the</strong> division (over whichmuch tactical clear text was transmitted) included 50-kilowatt transmitterswhose main beam extended 640 miles, with side lobes of410 miles and a back lobe of 300 miles. Thus, <strong>the</strong> Pleiku-Da Nangpattern extended into mainland China, while transmissions from 1, 10,and 50-kilowatt transmitters at o<strong>the</strong>r sites could be heard in Laos,Cambodia, North Vietnam, and o<strong>the</strong>rhostile areas.<strong>The</strong>re were from time to time concerted actions to demonstrate <strong>the</strong>need for COMSEC safeguards against a particular source of COMSECweakness. For example, to correct <strong>the</strong> ever-present COMSEC problem ofsecuring call signs General Denholm, CGUSASA, directed that <strong>the</strong> fixedsuffix, one-callword principle be field tested in Vietnam so that ASAcould evaluate its worth. In <strong>the</strong> experiment, <strong>the</strong> 25th Division used aperiodically changing suffix call word,\..<strong>the</strong> 1st Cavalry Division(Airmobile) used a similar fixed suffix callword but without periodicchange, and <strong>the</strong> 1st Infantry Division employed a periodically changingnet call word with a periodically changing suffix call word. Within threeTOP S£ER£T UMBRAHOFORH(b) (1)(b) (3)-P.L. 86-36____ (b) (3) -50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAptOFORnCONVENTIONAL COMSEC MONITORING 45IAPV77SUBJECT: Callword Study (U)23 July 19664. (C) RECOMMENDATIONS: <strong>The</strong> following recommendations are based on<strong>the</strong> conclusion of this study that no reliance should be placed on radical callwordallocation systems as a means to prevent interception, analysis, or intrusion offriendly radio voice communications. Adherance to standard, historical solutions tocallsign security are <strong>the</strong> best means to impede <strong>the</strong> actual initial net reconstructionand subsequent derivation of order-of-battle from detailed traffic analysis-regardlessof <strong>the</strong> callword allocation systems employed.a. Assign callwords and expanders to nets and within nets in a random manner.b. Change callwords and expanders within tactical commands as frequentlyas operational conditions permit, daily if possible, at <strong>the</strong> start of each new operationas a minimum.c. Change callwords simultaneously with each change of frequency.d. Maintain uniformity of appearance of callwords and expanders withinmajor tactical commands by using authorized callword allocations and manners ofcallword expansion.e. Insure that callwords are not compromised by use in conjunction withsuperseded calls, telephone switching designators, aircraft tail numbers, or withcorresponding plain-text unit designations.FREDERICK B. LOTHROPCaptain, AISCommandingdays, ASA analysts reconstructed <strong>the</strong> nets of all three divisions. Despite<strong>the</strong> popularity enjoyed by <strong>the</strong> one-callword principle, ASA analystswarned against its use. <strong>The</strong> lOist Security Detachment report on <strong>the</strong>results of <strong>the</strong> experiment (see above) went to )-2 MACV, G-2and SIGO USARV, and <strong>the</strong> 303d and 313th ASA Battalions.One of <strong>the</strong> most serious COMSEC weaknesses was <strong>the</strong> ever-presenthomemade code. <strong>The</strong> point-of-origin code, used to hide true mapcoordinates, was one of <strong>the</strong> continual offenders. In many cases ASACOMSEC analysts, to persuade commanders that such codes were indeedinsecure, broke <strong>the</strong>m, often in less than 30 minutes, using only monitoredoperational traffic. In one instance, when ASA COMSEC analysts brokea division's complete point-of-origin code from normal traffic in less thanTOP 8£ER£T UMBRAnOFORn
TOP SECRET UbfBRAp',OFORn46 WORKING AGAINST THE TIDEtll{' ... 'tC"~ b2jf '~t. "t~ £>7"F.'M?,Enemy Intercept of u.s. 1st Infantry Division Communications.(Note that <strong>the</strong> intercept operator has converted and penned in <strong>the</strong>actual coordinates beside <strong>the</strong> copied point-of-origin code. Source:ASA T AREX unit.)
TOP ~r:eKr:'f UlvfBRA NOrORNCONVENTIONAL COMSEC MONITORING 47TIME OFINTERCEPrU.S. cOMMUNIdATORSDATEVOICENErD2/220745 Stroy 91 Stroy A6h0850 C66 800848 C80 80A660';120 Ey.poider ?7F"0';130 stroy A66 n0955 B66"1000 B661015 B66c66You have new CHi+Affirmative+ .We found 2 mines at 665320 $ld 664322+J.fy 26 aLement, ret-ur-n my locatiQn ahJ'J.t 02minutes+Pres my location is from ATN (Ut.l 11.2) +Inbound your location. eta 10 minutes.your 66 available~++Roger. my 66 is standfng bytJ.fy lead element move into operationtPres my location is from AR11(Lo.5 Dl.9)«585341) )CV is atCP'l' 35-
TOP SECRET UMBRAHOfORH48 WORKING AGAINST THE TID:three hours, <strong>the</strong> shaken commander acknowledged <strong>the</strong> obvious andapplied, at least for a time, greater COMSEC emphasis and enforcement.Although ASA specialists always emphasized that such codes were.insecure, an on-<strong>the</strong>-spot demonstration was often necessary to convince<strong>the</strong>"doubting Thomas." Unfortunately, <strong>the</strong> doubting Thornases are stillin evidence. In December 1969 a captured enemy SIGINT soldier statedthat Vietnamese Communist analysts not only learned U.S. trooplocations through exploitation of locally produced U.S. point-of-origingrid codes but that, at least within his team, <strong>the</strong>y were able to convertinstantly <strong>the</strong> intercepted coded equivalents to <strong>the</strong> true 6-digit coordinates.Education and Training In addition to producing COMSEC reportsand management data to bring about positive COMSEC actions, ASAunits attempted to educate commanders and communicators. Following<strong>the</strong> transfer of COMSEC responsibility from J-6 to <strong>the</strong> J-2 MACV inmid-1965, a Headquarters, USASA, 2-man SIGSEC advisorteam-Maj. George D. Reichard and Maj. George V. Jarrett-spentthree months TDY with J-2 MACV to help develop a COMSECprogram for MACV. Using <strong>the</strong> results of local COMSEC monitoring andreporting, Majors Reichard and Jarrett drafted COMSEC regulationsand directives, which MACV and USARV <strong>the</strong>n issued. During <strong>the</strong>ir1965 TDY and ano<strong>the</strong>r one in <strong>the</strong> following year, <strong>the</strong> two men visited allmajor commands in South Vietnam and, through interviews withcommanders and staffs, gained a better knowledge of attitudes towardCOMSEC and explored <strong>the</strong> need for COMSEC education. <strong>The</strong>y alsostudied status reports to determine which deficiencies required priorityattention in COMSEC education. J-2 MACV itself advocated a vigorouseducational program as a means of eliminating <strong>the</strong> malpractices beingbrought to light by such studies as that made of <strong>the</strong> SILVERBAYONET operation in 1965.*From early 1966 on, ASA COMSEC units emphasized COMSECeducation. COMSEC teams visited all levels of command from battalionupward, providing guidance, training lectures, and educational classes. In<strong>the</strong>ir presentations, <strong>the</strong> teams made effective use of translated documents,interrogation reports, and o<strong>the</strong>r materials received from ASA's SIGINT"See below pp. 90-95.TOP SECRET UMBR1\HOfORH
.\.'fOP SECRET UldBRJ'tNOFORNCONVENTIONAL COMSEC MONITORING 49and target exploitation (T AREX) organization in Vietnam. With <strong>the</strong>se,ASA instructors illuminated <strong>the</strong> increasing enemy SIGINT threat andgave concrete examples of <strong>the</strong> enemy's tactical use of u.s. COMSECweaknesses. At times <strong>the</strong> teams played taped recordings of U.S.communications breaches to illustrate <strong>the</strong> danger to U.S. lives. <strong>The</strong>y alsotrained officers, troops, and communicators in <strong>the</strong> proper use of<strong>the</strong> KACseries of codes and demonstrated methods of employing KY-8 ciphony insecure nets, always encouraging maximum use of <strong>the</strong> KY-8's.General William C. Westmoreland, COMUSMACV, backed <strong>the</strong>ASA COMSEC program, issuing directives that ordered COMSECimprovements and gave <strong>the</strong> basis for moving through progressiveeducational steps toward stated COMSEC goals. Helped by a graduallyincreasing command interest, ASA COMSEC specialists educatedthousands of persons, from generals to radiotelephone operators, incommunications security.<strong>The</strong> 509th ASA Group's COMSEC elements over <strong>the</strong> yearsestablished close contacts and working relationships with commanders,Signal officers, intelligence staff officers, and tactical communicators atall levels. In spite of <strong>the</strong> hectic combat environment, which was thus notconducive to formal education programs, <strong>the</strong>y continued to instruct in <strong>the</strong>application of ciphony, cryptonetting, and o<strong>the</strong>r subjects. <strong>The</strong>y alsohelped commanders prepare for secure communications as one aspect ofplanning military operations. In addition, COMSEC advisors drafted for<strong>the</strong> commanders command letters, directives, and guidance materials foruse in standing operating procedures.By 1968 <strong>the</strong> 509th ASA Group had given organizational status to itseducational teams, calling <strong>the</strong>m COMSEC Assistance and AdvisoryTeams (CAAT). <strong>The</strong> teams, each made up of at least six experiencedCOMSEC NCO's, visited <strong>the</strong> divisions, in turn, spending from 7 to 14days with each, conducting with staff officers a thorough review of allCOMSEC matters, and applying preplanning or surveillance techniquesto improve communications in forthcoming military actions.In 1968 and <strong>the</strong>reafter, improvement over <strong>the</strong> COMSEC status of1965-66 was evident. COMSEC surveillance and CAAT operationswere meeting <strong>the</strong> continuing COMSEC challenges and bringing aboutsome measure of relief.'fOP SECRE'f UMBRArmfiORfq
TOP SECRET UMBRAUOFORU50 WORKING AGAINST THE TIDEConvincing <strong>the</strong> Commanders <strong>The</strong> Army Security Agency found awide variety of responses to <strong>the</strong>ir efforts to obtain communications securityin Vietnam. Some understanding commanders applied COMSECsafeguards conscientiously; o<strong>the</strong>r commanders did not. Until SILVERBAYONET in October 1965, most U.S. Commanders in Vietnamshowed only a marginal interest in COMSEC, since <strong>the</strong>y doubted that <strong>the</strong>enemy could conduct successful SIGINT operations. <strong>The</strong>se commandersreasoned that U.S. superiority in training, firepower, and mobility madeCOMSEC of little importance.Commanders during <strong>the</strong> early months of combat were often frustratedin <strong>the</strong>ir efforts even to find <strong>the</strong> elusive enemy, and at least one officer saidthat he hoped that <strong>the</strong> enemy would use intelligence gained from insecureU.S. communications-at least <strong>the</strong>n he might attack and thus showhimself. Lt. Gen. Harry W. O. Kinnard, commander <strong>the</strong> l st CavalryDivision (AM) from September 1965 to May 1966, exemplified <strong>the</strong>thinking at <strong>the</strong> time:<strong>The</strong> DSU and my Signal Officer offered much advice and guidance in this/COMSEC/ area. But, I'm afraid I didn't let <strong>the</strong>m help me much. It wasimpracticable to change SOl-SSI and codes often in <strong>the</strong> division, because <strong>the</strong>rewere so many nets involved, and normal tactical employment required rapidchanging of control of battalions, even companies, from one subordinatecommand to ano<strong>the</strong>r, at any time in operations. Our communications gave us <strong>the</strong>capability to react and adjust rapidly and flexibly, and I could not afford to riskcommunications (hence tactical) confusion by using changing codes and calls indifferent subordinate commands. I am convinced that, even though <strong>the</strong> enemymay have gained some OB information from our communications ... <strong>the</strong>ywere not able to glean sufficient usable information from monitoring our nets toreact to <strong>the</strong>ir advantage, for our deployments and tactical reactions were toorapid for <strong>the</strong>m to apply what <strong>the</strong>y may have gleaned. This was <strong>the</strong> choice I hadto make, and I decided that tactical speed and mobility from stablecommunications was more important than possible tactical voice COMSECloss.*O<strong>the</strong>rs, including Maj. Gen. Richard T. Knowles of <strong>the</strong> l st CavalryDivision (I965-66) and Maj. Gen. William E. DePuy, commander of*Wolfe, Interviews.TOP SECRET UMBRAlJOFORU
,LTOP SECRET UMBRArq'OfORIqCONVENTIONAL COMSEC MONITORING 51n lJ) ;.)A,'lt'LE i1£;').:iAGE;.; ANO i·IET/ivO Of (;ui'lr'u,)IJlul.1.1.il'il'1vNLY.U;iEO:IN GENERAL. THE 11th ARMORED CAY RtGT 00£;.; NCTHAVE SET i4ESSAGE FO~MArS VI ITH THE EXCEPT ION Of n/ FEWMESSAGES . STlt.tSAHU ARTILLERY FIRE.K£«AS IN THE TiXT _. HEAVY ART I LL£HYtiTHE 345/44NAUTJCAL HILESHS At·KNOWLEDGE IN,. .'1'«AS IN 'rsxr - I Ii _o."'L I ,.)[1 fJ' .. BAD S'rATlO~S ARTILL£RY w"RNH.G.fiRING ~QOM LEAR TO'GRID XU72.3415 MIG,HT :)HOT 2130 fi.n1900 DEGREES. ~fGHT RANGE 12-5 12M.~ .Page From Enemy SIGINT Instruction Manual1st Infantry Division (1966-67), expressed similar views on COMSEC,sharing in <strong>the</strong> belief that <strong>the</strong> enemy could not acquire much help fromunsecured U.S. tactical voice communications. Each also thought <strong>the</strong> U.S.battlefield maneuverability demanded rapid communications and anonchanging SOLICOMSEC officials at <strong>the</strong> time1--__:--"""":"'""""":""" ---:----.,;-:------1were also placing unwarranted reliance on <strong>the</strong> availability (and assumedproper use) of manual codes that were not yet tailored for Vietnam.<strong>The</strong> situation changed slowly as COMSEC agencies and/Armycommanders gained experience in Vietnam. NSA began production ofmanual codes tailored to Vietnam field requirements. AsA TAREXcollection helped reveal <strong>the</strong> hostile SIG INT threat, providing a steadystream of examples of enemy SIGINT successes against <strong>the</strong> United Statesand its Allies. ASA in-country monitoring highlighted for <strong>the</strong>TOP SECRET" UMBRAHOfORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798iII,Ii
TOP 8BERBT UMBRAHOfOftfq52 WORKING AGAINST THE TIDEcommanders <strong>the</strong> danger of communications deficiencies, and COMSECpersonnel at <strong>the</strong> DSU level worked directly with <strong>the</strong> commands. Capt.Leo M. Melanson, commander of <strong>the</strong> 371st ASA Company, in 1968spoke of <strong>the</strong> way in which <strong>the</strong> DSU's operated to bring about COMSECchanges within <strong>the</strong> commands:/In/ <strong>the</strong> field of COMSEC, its ... varying degrees of success among <strong>the</strong>Divisions in Vietnam can be, and are, directly attributable to <strong>the</strong> Company'srelationship, /not only with <strong>the</strong> command and <strong>the</strong> G2 but / with <strong>the</strong> DivisionSignal Officer /DSOj. Once /he is/ aware that part of <strong>the</strong> Radio ResearchCompany's mission is to assist <strong>the</strong> Division in /COMSEC/ and actuallybelieves it, <strong>the</strong>n a successful program can be achieved <strong>the</strong> 1st CavalryDivision /had/ continually and blantantly used <strong>the</strong> point of origin code. It wasnot until <strong>the</strong> DSO was won over to <strong>the</strong> COMSEC side that <strong>the</strong> practice wasstopped completely. Extensive education of ... operators at all levels in <strong>the</strong>use of <strong>the</strong> KAC-Q/P codes, terminating with a command message, finished <strong>the</strong>point of origin code's use in <strong>the</strong> Division. *As a result of similar COMSEC operations, it eventually became easierto influence most U.S. ground commanders. For example, in early 1967<strong>the</strong> 325th ASA Company, with <strong>the</strong> help of <strong>the</strong> 303d ASA Battalion,monitored for five days <strong>the</strong> 9th U.S. Infantry Division's nets in <strong>the</strong>Mekong Delta area. Without using any of <strong>the</strong> available operationalinformation, <strong>the</strong> 325th analysts reconstructed from <strong>the</strong> normal tacticalvoice nets about 95 percent of <strong>the</strong> division's total operation-organization,units, personalities, nets, call signs, frequencies, plans and intentions,movements, and objectives. As a result, Maj. Gen. GeorgeG. O'Connor became a firm believer and a stringent enforcer ofCOMSEC practices. His 9th Division became one of <strong>the</strong> most securedivisions in Vietnam during that period.Referring to <strong>the</strong> value of COMSEC indoctrination, Maj. Gen. John R.Deane, Jr., commander of <strong>the</strong> 173d Airborne Brigade (Separate) fromDecember 1966 through August 1967, stated:I believe that <strong>the</strong> U.S. COMSEC posture in general in SVN was very poor. Iam a firm believer in good COMSEC practices and applications. However, I wasnot aware of any drastic actions against COMSEC violators ... <strong>the</strong> DSUregularly reported on COMSEC violations and advised me concerning <strong>the</strong>*Wolfe, Interviews.'fOP StlCftf'f UMBRAHOfORH
TOP 5BERBT UMBRAPJOfORnCONVENTIONAL COMSEC MONITORING 53picture of friendly operations that had been gleaned from COMSEC analysis,and <strong>the</strong> dangers <strong>the</strong>reof if similarly gleaned by enemy COMINT. I used <strong>the</strong>ireducational capabilities to <strong>the</strong> maximum practicable in <strong>the</strong> command.He <strong>the</strong>n spoke of problems in <strong>the</strong> Army COMSEC program:Directives to enforce COMSEC by stringent penalties on individual violatorswill encourage people to absorb <strong>the</strong> regulations and training afforded, and givenby ASA all <strong>the</strong> time. If we had better security motivation and if COMSEC hadmore teeth in it, <strong>the</strong>n <strong>the</strong>re would not be so much loss of tactical informationfrom clear voice traffic. However, <strong>the</strong>re is a practical and economic limit towhich we can afford to give every radio an accompanying piece of COMSECequipment. . . . In general, I've seen no great development in COMSECstatus since WW II. Although <strong>the</strong>re have been improvements in COMSECequipment, <strong>the</strong>re is a practical limit to <strong>the</strong> amount of COMSEC equipment thatwe need, or which can be carried by <strong>the</strong> combat soldier. In SVN, <strong>the</strong> use of even<strong>the</strong> KY-38 was not practicable for manpack on <strong>the</strong> soldier in activecombat. . . . <strong>The</strong>re are still major problems that need to be resolved. *Lt. Col. John L. Heiss, III, SSO J-2 MACV (1966-67), revealedunusual sensitivity to <strong>the</strong> need for COMSEC:In most operations USF did not want to get ARVN forces involved, for thiswas a definite weak link. Our worst weakness was <strong>the</strong> tendency to talk toomuch, or talk around classified matters on telephones. Our telephone . . .system was a weakness and, although I have no hard evidence, I can't helpbut believe that <strong>the</strong> VC attempted to exploit this weakness, I suspect that astudy of <strong>the</strong> background of some of <strong>the</strong> ambushes we suffered may representenemy exploitation of U.S. COMSEC weaknesses. *However, despite better education in COMSEC procedures, <strong>the</strong>availability of some secure voice equipment, issuance of better codes to fillrequirements, a sizable U.S. monitoring program, and a more generalacceptance by many commanders of <strong>the</strong> existence of a viable hostileSIG INT threat, significant security malpractices continued, althoughdiminished in volume. <strong>The</strong>se were especially <strong>the</strong> unnecessary orincautious use of unsecured voice communications, use of unauthorizedand insecure home-grown codes, improper use of call signs, and lack of·Wolfe, Interviews.1=QP 81KRBT UMBRAHOFORfq
TOP S£ER£T UMBRAHOFORH54 WORKING AGAINST THE TIDEau<strong>the</strong>ntication. <strong>The</strong> weaknesses continued largely because too manycommanders and <strong>the</strong>ir communicators still did not know about or wereunwilling to follow operationally acceptable COMSEC practices. To <strong>the</strong>secommanders and communicators <strong>the</strong> fastest possible communications,unencumbered by security practices and equipment, were a necessity ofwar. Education of commanders in COMSEC remained, <strong>the</strong>refore, as amajor problem.OrganizationNaval Security GroupAt <strong>the</strong> time of <strong>the</strong> Gulf of Tonkin incidents in August 1964, <strong>the</strong> NavyCOMSEC organization in <strong>the</strong> Western Pacific (WESTPAC) was alreadywell established. Permanent COMSEC components were at <strong>the</strong> NavalCommunications Station Guam (COMSEC 701), <strong>the</strong> NAVSECGRUActivity Kamiseya, Japan (COMSEC 702), and <strong>the</strong> NavalCommunications Station Philippines (COMSEC 703), and were mannedbyIlof which a team of an officer andDenlisted men were on temporary additional duty afloat with <strong>the</strong> SeventhFleet. <strong>The</strong> afloat team had begun in January 1963 to assist/ <strong>the</strong>Commander, Seventh Fleet, embarking on assigned ships. At first <strong>the</strong>team was designated COMSEC Team ALF A, later COMSEC/TeamOne.In July 1963 <strong>the</strong> Navy was planning for <strong>the</strong> establishment of aCOMSEC component (COMSEC 704)\at <strong>the</strong> NAVSECGRU ActivityHanza, Okinawa, in order to have a permanent COMSEC listening postmore responsive to Seventh Fleet requirements. Okinawa layclose to <strong>the</strong>Communist Bloc countries near which Seventh Fleet ships operated.COMSEC 704 began operations in June 1965 and was fuHy operationalby <strong>the</strong> end of <strong>the</strong> following month.To cope with a rapidly changing communications situation inSou<strong>the</strong>ast Asia, <strong>the</strong> Navy rearranged its COMSEC organization in <strong>the</strong>Pacific during <strong>the</strong> winter and spring of 1965. <strong>The</strong>/new organizationemphasized traffic analysis of monitored communications and centralizedreporting on a broad geographical basis. Under v<strong>the</strong> reorganization,COMSEC components called collection and reporting centers performedTOP S£ER£T UMBRA HOfOlUq(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798_________ (b) (3)-P.L. 86-36
TOP SECRET UMBRA?lOfOR1'JCONVENTIONAL COM SEC MONITORING 55monitoring and first echelon reporting, <strong>the</strong>n forwarded raw trafficimmediately to a processing and reporting center (PRe), where detailedanalysis took place. NAVSECGRU Activity Kamiseya served as <strong>the</strong>processing and reporting center for <strong>the</strong> Western Pacific.COMSEC Team Vietnam +Gf- <strong>The</strong> Western Pacific COMSECreorganization came simultaneously with <strong>the</strong> establishment of atemporary Navy COMSEC team at Da Nang. In early March 1965 aNAVSECGRU officer inspected alternative locations in <strong>the</strong> Da Nangarea to determine <strong>the</strong> best site for COMSEC operations, investigating <strong>the</strong>availability of working areas and equipment for a COMSEC unit thatwould be known as COMSEC Team Vietnam "t€tand have one officerand four enlisted men. COMSEC Team Vietnam (£1 began operationson 31 March 1965 in support of Brig. Gen. Frederic Karch,Commanding General, Ninth Marine Expeditionary Brigade (MEB) andNavy and Marine Corps units in SVN.<strong>The</strong> team was to operate for a 90-day period. After it becameoperational, however, <strong>the</strong> Naval Communications Station Philippinesrecommended that it be continued beyond 30 June 1965 if GeneralKarch still needed COMSEC monitoring. Vice Adm. Roy L. Johnson,Commander, Seventh Fleet, supported <strong>the</strong> recommendation, provided <strong>the</strong>COMSEC status of Marine and naval communications warranted it.With <strong>the</strong> accelerating tempo of military operations at <strong>the</strong> time, no onedoubted that <strong>the</strong> team was needed. <strong>The</strong> team had already identified anumber of COMSEC deficiencies, in particular: permanent assignment ofcode names or nicknames to specific locations for landing zones, <strong>the</strong>rebyincreasing <strong>the</strong> likelihood of <strong>the</strong>ir recovery by <strong>the</strong> enemy; failure to utilizeau<strong>the</strong>ntication at any time; shortage ofoperations codes and improper useof those available; and use of nonapproved, locally generated codes.On 29 May 1965 Commanding General, Fleet Marine Force, Pacific(FMFPAe), Lt. Gen. Victor H. Krulak, noted that <strong>the</strong> COMSEC teamat Da Nang had done an outstanding job in helping to tighten security onradio nets of deployed Marine units. <strong>The</strong> COMSEC support provided toNavy and Marine Corps units at Da Nang amply demonstrated <strong>the</strong> valueof continuing an active COMSEC program after 30 June. GeneralKrulak stated fur<strong>the</strong>r that <strong>the</strong> Marine Corps First Radio Battalion wouldcontinue that COMSEC assistance. <strong>The</strong>refore, effective 5 July 1965, <strong>the</strong>TOP SECRET UMBRArmt'Oftfq------~--
TOP SeCReT UMBRAPWFORH56 WORKING AGAINST THE TIDENavy COMSEC Monitoring Position AshoreNavy COMSEC Team Vietnam (C) was deactivated and its tasks wereassumed by a recently formed Marine COMSEC team of <strong>the</strong> First RadioBattalion, Fleet Marine Force, Pacific.Sub Unit One, First Radio Battalion Elements of <strong>the</strong> First RadioBattalion had operated in South Vietnam as early as 1962, givingemphasis to SIG INT. In March 1965 Detachment J of <strong>the</strong> First RadioBattalion was established in support of <strong>the</strong> Ninth MEB, and includedDC()MSEC positions among its resources. This detachment carriedon <strong>the</strong> COM~EC...function-.s. that had been performd.d b, COMSEC TeamVietnam (C). <strong>The</strong>Dpositions were increased t in January 1966when Detachment}was deactivated and its men and equipment becamepart of Sub Unit One;.First.Radio BattalionI IIIW~ile<strong>the</strong> originalDerachment J had reported to its parentcommand in Hawaii,th~?~w subunit came under <strong>the</strong> direct operationalcontrol of General Krulak. <strong>The</strong> Airettsupport role of Sub Unit OneTOP SeCReT UMBRl'\PWFORPi(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'fOP SECRE'f UMBRAHOfORHCONVENTIONAL COMSEC MONITORING 57Navy COMSEC Monitoring Position Ashorecorresponded somewhat to that of ASA direct support units <strong>the</strong>n beingadministered by senior-level ASA echelons but under <strong>the</strong> operationalcontrol of <strong>the</strong> Army commanders to whom <strong>the</strong>y gave assistance.COMSEC 705 <strong>The</strong> need for communications security in Sou<strong>the</strong>astAsia continued to grow with <strong>the</strong> expansion of communications. InSeptember 1965 AdmiralJohnson, by <strong>the</strong>n Commander in Chief, PacificFleet, expressed a need for continuous COMSEC monitoring of newnaval circuits <strong>the</strong>n being activated at Da Nang. Accordingly, an officerand six enlisted men formed a unit, designated COMSEC Team, NavalSupp'ort Activity Da Nang, that went into operation in October 1965withDmonitoring positions and an indefinite tenure. Its mission wasto provide CO¥SEC support to local naval elements and to determinepossible intelligenceIosses through communications. Specific tasks wereto provide COMSEC support to Naval Support Activity Da Nang and tonaval units in <strong>the</strong> South China Sea and to monitor and evaluate naval'fOP SECRE'f UMBRAHOfORH(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
'fot" SECRET UMBRAl'JOFORU58 WORKING AGAINST THE TIDEcommunications. By December 1965,Dadditional enlisted billets hadbeen approved and action taken to fill <strong>the</strong>m. In June 1966 <strong>the</strong> team wasredesignated Detachment Delta, Naval Communications StationPhilippines, and assigned <strong>the</strong> Navy title COMSEC 705.Thus, by December 1965 NTY C10MSEC personnel in <strong>the</strong> WesternPacific numberedDofficers and .enlisted men; COMSEC elementstotaled 5 COMSEC components plus a.team afloat.COi\1SEC Team Saigon In 1966 naval operations extended southwardfrom Da Nang. COMSEC Survey-Team Saigon (one officer and oneenlisted man) was formed in <strong>the</strong> spring of 1966 to conduct a survey ofMARKET TIME communications.*Using <strong>the</strong> men and facilities ofano<strong>the</strong>r specialist team aboard <strong>the</strong> USS Jamestown for monitoring ando<strong>the</strong>r Navy COMSEC units, <strong>the</strong> survey team had access to a total ofI Ipositions. <strong>The</strong> results were startling. <strong>The</strong> COMSEC deficienciesuncovered. not only stimulated COMSEC improvement through <strong>the</strong>distributiori.of more suitable operations codes but also emphasized <strong>the</strong>need for Navy COMSEC teams in <strong>the</strong> area. While <strong>the</strong>re was a concentratedspecial survey to improve MARKET TIME communicationssecurity in <strong>the</strong> first three months of 1966, MARKET TIME operations<strong>the</strong>mselves continued throughout <strong>the</strong> war, and monitoring of U.S.MARKET TlMlivcomrnunications continued to be a significant partof Navy COMSEC operations.COi\1SEC Team Thr~e (Delta) \\In February 1960enlisted menwere ordered on temporary additional duty (TAD) atVung Tau in SouthVietnam to establish COMSEC Team Delta. Headed by a chief pettyofficer, <strong>the</strong> team was activated, initially for 45 days, at <strong>the</strong> CoastalSurveillance Center, Vung Tau, its mission being to provide COMSECsupport to <strong>the</strong> commander of Task Force 115 and. his units in Sou<strong>the</strong>astAsia, and to naval elements involved in <strong>the</strong> MARKET TIME operations.<strong>The</strong> team also was charged with reporting on <strong>the</strong> advisability ofestablishing a permanent COMSEC\unit at <strong>the</strong> mouth of <strong>the</strong> Mekong*MARKET TIME was a covername given to operations taking place in <strong>the</strong> offshorewaters of South Vietnam. For <strong>the</strong> survev. see below. pp.109-16.TOP SECRET UMBRAl'JOFORU(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798- __~~(b) (3)-P.L. 86-36
'fOP :5ECIU:'f UMBHAtWFORP:iCONVENTIONAL COMSEC MONITORING 59USMC Sub Unit One COMSEC MonitorRiver Delta. <strong>The</strong> work of <strong>the</strong> team was of value to <strong>the</strong> chief of <strong>the</strong> NavalAdvisory Group in Saigon who, in March, took special note of <strong>the</strong>assistance provided by Team Delta in <strong>the</strong> MARKET TIME survey. Heconfirmed that <strong>the</strong> requirement for a COMSEC unit to monitor sou<strong>the</strong>rnMARKET TIME and Mekong River Delta area communicationscontinued to exist. He stated fur<strong>the</strong>r that <strong>the</strong> COMSEC Team Deltawould be invaluable in helping Task Forces 115 and 116 to maintain anaccurate picture of <strong>the</strong>ir communications security. <strong>The</strong>refore, in April of1966, <strong>the</strong> team shifted operations from a temporary structure to aspecially configured COMSEC van at Vung Tau, and in July wasredesignated COMSEC Team Three.In January 1967 Admiral Johnson noted that <strong>the</strong> COMSEC TeamThree had been especially effective in maintaining securecommunications for Navy tactical commanders. Information receivedfrom COMSEC 705 and NAVSECGRU Activity Karniseya substantiatedTOP SECRET UMBRAHOFOHH
'fOP SECRE'f UMBRANOrORN60 WORKING AGAINST THE TIDECOMSEC 705 Location at Foot of Monkey Mountain<strong>the</strong> fact that termination of operations at Vung Tau would seriouslycurtail naval COMSEC control in <strong>the</strong> delta area.Although several attempts were made to establish COMSEC TeamThree as a permanent component, each request for additional billets metwith Defense Department disapproval. Because <strong>the</strong> team had provenitself to be a valuable COMSEC asset to in-country forces, however, itcontinued its existence wit~.e... rsonnel on temporary duty from COMSEC705's sparse allowance ofUenlisted men.COMSEC Team Two (Bravo) In January 1966 Vice Adm. John T.Hyland, Commander, Seventh Fleet, pointed out <strong>the</strong> desirability ofembarking a COMSEC team with-naval amphibious forces in Sou<strong>the</strong>astAsia. Admiral Johnson agreed thar. a full time COMSEC team wouldhelp maintain communications security and could give technicalassistance as needed for manipulative cover and deception in amphibiousoperations. First designated COMSEC Team Bravo and shortly <strong>the</strong>reafterTOP g~ER~T UMBRA PWrORH(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOP SECRET UMBRAPJOfORPiCONVENTIONAL COMSEC MONITORING 61COMSEC Specialists Assembling an Antenna, Monkey Mountainas COMSEC Team Two, <strong>the</strong> unit began operations in June 1966 withone officer and Omen, monitoring and evaluating amphibious forcecommunications. Although it was initially planned that <strong>the</strong> team beassigned to Task Force 76, for transfer with <strong>the</strong> staff as it rotated amongflagships, COMSEC Team Two was in practice used in support of TaskGroup 76.5 (Group Bravo) and occasionally Task Group 76.4 (GroupAlpha).COMSEC Team Fille COMSEC Team Five was organized on 24March 1967 and (SSired to Beach Jumper Unit (BJU) One. This teamof an officer and enlisted menhad an assigned mission to exchangetechniques, knowledge, and experience with <strong>the</strong> beach jumper unitthrough an exchange in personnel. As a result of this venture, bothCOMSEC and BJU perseonnel.gained.a keener awareness of <strong>the</strong> complexitiesinherent in <strong>the</strong> communications deception operations in which<strong>the</strong> beach jumper units were involved. Although <strong>the</strong> team was deacti-TOP. SECRET UMBRAHOFOfth T(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOP 5BERBT UMBRAHOfORH62 WORKING AGAINST THE TIDEvated on 22 May 1967, permanent COMSEC components continuedto provide COMSEC technical assistance for BJU operations and servedas points of contact for mutual exchange of information. Ano<strong>the</strong>rresult of Team Five's exchange of personnel was <strong>the</strong> establishment oftwo permanent COMSEC billets in <strong>the</strong> BJU personnel allowance, bothof which were filled in <strong>the</strong> fourth quarter of fiscal year 1969.COMSEC Team Four COMSEC Team Four, with a chief pettyofficer andDenlisted men, commenced limited COMSEC operationson 25 April 1967\and became fully operational during May. Personnelfor <strong>the</strong> team were provided TAD from various permanent PacificCOMSEC compone.nts. <strong>The</strong> team operated from a truck-mountedvan-suPfiedl ',b.Y <strong>the</strong>\N... aval Communications Station Philippines-thatcontained monitoring positions and was based at Vinh Long in <strong>the</strong>Mekong Deltaxarea. Team Four's mission was to provide COMSECsupport in <strong>the</strong> Mekong River Delta to Riverine Task Force 117 and toextend service also.to GAME WARDEN, Task Force 116. In February1968, during <strong>the</strong> ret offensive, a mortar shell demolished <strong>the</strong> van and,although <strong>the</strong>re wereno casualties, operations had to be suspended untilMarch 1969, when anew van was installed on a barge in <strong>the</strong> MekongRiver.COMSEC 706 As axresult of a preliminary study conducted inDecember 1965, NAVSECGRU Activity Kamiseya recommended that aCOMSEC component be established at <strong>the</strong> Naval CommunicationsStation Cam Ranh Bay. Planning for a permanent component <strong>the</strong>re withI Ibillets received approvalof <strong>the</strong> Secretary of Defense in November1966, but difficulties in procuring\ and installing equipment delayedactivation of<strong>the</strong> unit for over a year.\As COMSEC 706, <strong>the</strong> unit finallybecame operational on 5 January 1968, with <strong>the</strong> mission of providingCOMSEC close support to Pacific Fleet naval commanders in Sou<strong>the</strong>astAsia.At <strong>the</strong> end of 1967, NaVYCOMSElcperonnel authorized for <strong>the</strong>Western Pacific were Dofficersand .....enlisted men, of whi('hDofficers andDenlisted men were~ctually enboard.TOP SECRET utdBRAHOfOlH
'fOP SECRE'f UIofBRAshore'facilities for HFcommunicationsshore facilities for HF communicationsshore facilities for HF communicationsVHF communicationsfmfORfqCONVENTIONAL COMSEC MONITORING 63OperationsNAVSECGRU's COMSEC organization monitored and analyzed longhaulnaval communications passed between shore stations and ships at seaand air squadrons. Marine Corps direct support units monitored andreviewed <strong>the</strong> communications passed by Marine units operating innor<strong>the</strong>rn South Vietnam.Monitoring and analysis were <strong>the</strong> major aspects of NAVSECGRU'sCOMSEC operations in <strong>the</strong> war zone and, as in <strong>the</strong> case of Army, by far<strong>the</strong> greater number of Navy personnel assigned to COMSEC duties spent<strong>the</strong>ir time largely on <strong>the</strong>se functions. Navy COMSEC personnel werethus working on such tasks as: conducting COMSEC surveys; monitoringand analyzing naval communications and preparing CommunicationsImprovement Memoranda; measuring frequencies and preparing offfrequencyreports; training personnel in cryptographic andcommunications procedures, in message drafting, and in physical securitywith emphasis on intelligence losses from unprotected circuits; andhelping communicators to prepare and revise operations plans, operationsorders, and communications plans and to identify and solvecommunications problems as <strong>the</strong>y arose.<strong>The</strong> Navy increased its COMSEC organization to keep pace with <strong>the</strong>growing volume of communications during <strong>the</strong> period 1964 to 1968.From a force ofDmen andDpositions, <strong>the</strong> Navy's Western P~cificCOMSEC organization expanded during this period to.Dmen andDpositions-Dmonitoring,Dfrequency measuring, andDradio fingerprintingpositions.<strong>The</strong> afloat COMSEC Teams; One and Two continued to monitor bypatching from <strong>the</strong> host ship a minimum of two CW and/or voiceradiocircuits to <strong>the</strong> operati!lgspace\ being occupied by <strong>the</strong> teams. <strong>The</strong>COMSEC monitoring equipment used by Navy and. Marine COMSECelements ineluded:EquipmentUseR-390ASP-600R-274BR-1279 with CV-1750range extenderR-389 low frequency communicationsTQP\ ei~CRBT UMBRA ~WFORH(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
'fOP SnERn'f U1dBRANOFORN64 WORKING AGAINST THE TIDEInitially, NAVSECGRU had problems with <strong>the</strong> equipment it placedashore in Vietnam. Navy receivers were more suitable for use on ships orin permanent installations than <strong>the</strong>y were for use in tents and small vanswhere dust, mud, rain, and heat affected <strong>the</strong>ir operation. Dust, forexample, penetrated <strong>the</strong> equipment and caused malfunctions. During <strong>the</strong>time that <strong>the</strong> Navy's COMSEC Team Vietnam (C) was operating at DaNang, it was without maintenance personnel, and malfunctioningequipment was shelved, awaiting assignment of repair personnel whocame later.For <strong>the</strong> most part, <strong>the</strong> Navy kept its COMSEC monitoring elementsthat were stationed in <strong>the</strong> Vietnam area fully manned at authorizedstrength. Personnel to man <strong>the</strong> positions came from <strong>the</strong> more permanentNaval COMSEC establishments in Hawaii, Japan, and Guam, and as aresult <strong>the</strong>se components far<strong>the</strong>r from <strong>the</strong> war zone continuously had tooperate below authorized strength. Despite <strong>the</strong> full manning of <strong>the</strong>elements ashore in Vietnam, personnel very frequently worked 16-hourshifts.<strong>The</strong> Navy's COMSEC organization concentrated on communicationspassed during Seventh Fleet naval and naval air, MARKET TIMEcoastal surveillance, naval gunfire support, special mission positiveidentification radar advisory zone (PIRAZ) and search and rescue(SAR), GAME WARDEN, and amphibious operations. While <strong>the</strong>volume of traffic collected changed from time to time, <strong>the</strong> Navymonitored, according to estimates, a relatively high percentage of <strong>the</strong>communications passed. One estimate made in <strong>the</strong> summer of 1966, for.example, gave <strong>the</strong>se figures:Type ofCommunicationsTF77TF76TF 73 (underway replenishment)TF 115TF 116TG 70.8 (naval gunfire support)TF 72 (patrol aircraft)Ship. to-shoreAir-to-groundHarbor commonEstimated Percentage ofTotal Traffic Monitored1852530202510402350TOP SECRE'f UMBRAHOFORfq:
------------------------~~-·---·~--LITOP SECRET UtdBRAHOl'OlU4CONVENTIONAL COMSEC MONITORING 65<strong>The</strong> geographic location of NAVSECGRU COMSEC componentspermitted reasonably good coverage of high frequency transmissions offorces operating in Sou<strong>the</strong>ast Asia. <strong>The</strong> afloat COMSEC Teams One andTwo randomly sampled VHF and UHF communications employed byunits of <strong>the</strong> Seventh Fleet, patching into <strong>the</strong>se communications throughlines leading to <strong>the</strong>ir COMSEC space. Shore-based COMSECcomponents monitored VHF and UHF naval communications in <strong>the</strong>irimmediate areas and long-haul communications of ships moving into andout of <strong>the</strong> war zone.Sub Unit One, First Radio Battalion Sub Unit One had COMSECpositions at <strong>the</strong> various locations of its detachments during <strong>the</strong> years1964-68. In early 1966 it had 2 positions at Chu Lai, 2 at Da Nang,and 1 at Phu Bai. In <strong>the</strong> fall of 1968 it had 2 at Camp Carroll, 2 at DongHa, 1 at Hill 327 near Da Nang, and 1 at Vandergrift Fire Support Base.While <strong>the</strong> subunit usually hadc:=JCOMSEC positions in operation, attimes it became necessary to task <strong>the</strong>se positions with SIGINT missions.Sub Unit One detachment commanders worked closely with G-2 andS-2 officers in <strong>the</strong> supported USMC units to arrange for tasking of <strong>the</strong>COMSEC monitors. By and large, Marine COMSEC specialists monitoredlow-level tactical FM radio nets, which <strong>the</strong>y regarded as thosemost likely to compromise U.S. tactical intentions. <strong>The</strong>y also monitoredradio relay circuits, using a r... rycom e...lective voltmeter on loan from<strong>the</strong> NSAPAC Representative Whenever possible, communicationsof units engaged in combat or active patrol had priority. Instatic situations, monitors sampled radio transmissions at combat bases.Marine units kept <strong>the</strong>ir positions engaged 16 hours a day, and fromabout 1966 on <strong>the</strong>y copied and analyzed approximately 4,000 transmissionseach week.<strong>Against</strong> <strong>the</strong> <strong>Tide</strong>Navy and Marine COMSEC specialists employed much <strong>the</strong> sameprocedures as did those of <strong>the</strong> Army and Air Force in alertingcommanders and communicators to dangerous practices and in pointing<strong>the</strong> way to improved COMSEC. <strong>The</strong>y conveyed <strong>the</strong>ir message in face-tofacepresentations, briefings, and spot and general reports.TOP SECRET UMBRAnOI'ORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'TOr' SECIUi'T UMBRANOrOlHJ66 WORKING AGAINST THE TIDEle. o M s Ec Intercept Vans and Operations Tent,----- Chu LaiPerson-to-person presentations seemed, for <strong>the</strong> most part, to be <strong>the</strong>most effective means of settling many of <strong>the</strong> problems that arose. Beforeits functions were assumed by Sub Unit One, Navy's COMSEC TeamVietnam had established, procedures to deal directly with in-countryMarine communicators. <strong>The</strong> team participated in weekly communicationsofficers' conferences conducted by <strong>the</strong> III Marine AmphibiousForce communications electronics officer, in this way dealing directlywith both <strong>the</strong> communicationsvofficers and <strong>the</strong>ir senior NCO·s. <strong>The</strong>NCO's took measures to prevent'.recurrence of violations in <strong>the</strong>ir unitcommunications and, when time permitted, trained <strong>the</strong>ir own operatorsin <strong>the</strong> field.Sub Unit One continued <strong>the</strong> practiceof person-to-person presentations.<strong>The</strong> unit made regular use of live examples in briefings to communicatorsand Signal officers of Marine field units, giving about 200 a year. <strong>The</strong>TOP SECRET UMBRlrNOrORN(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAHOFORHCONVENTIONAL COMSEC MONITORING 67• 1_____....IOperations Building at Hill 327, Da Nangunit's briefing program', did much to overcome <strong>the</strong> "electronic spystigma often borne by a COMSEC organization. Briefers generallyoverlooked minor procedural errors and emphasized combat-associatedsecurity lapses that endangered <strong>the</strong> lives of <strong>the</strong> Marines. As a result ofperson-to-person COMSEC\service, better rapport resulted. Unitcommanders at times even requested orientation lectures for <strong>the</strong>ir units.Sub Unit One COMSEC reports, when <strong>the</strong>se were made, also had abetter reception.Navy COMSEC specialists were.also at work on a person-to-personbasis. <strong>The</strong>y, too, used actual examples of operational communicationsdeficiencies in <strong>the</strong>ir educational briefings for naval personnel ashore andafloat.Both Marine and Navy COMSEC specialists spot-reported significantviolations affecting <strong>the</strong> tactical posture offriendly units. Navy specialistsinformed <strong>the</strong> Commander, Carrier Striking Force, Seventh Fleet, forTOP SECRET UMBRAHOFORN(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBKAfq-()p()ltfq-68 WORKING AGAINST THE TIDEexample, of information <strong>the</strong>y had monitored from <strong>the</strong> Navy's air trafficcoordination circuits that revealed strike plans and o<strong>the</strong>r intelligence.Marine Corps spot reports reaching <strong>the</strong> Special Security Officer, IIIMAF, often were in time to cancel or postpone Marine tacticaloperations.Besides <strong>the</strong> spot reports, <strong>the</strong>re were periodic COMSEC status reportsthat went to Navy and Marine Corps commanders. Marine specialists at<strong>the</strong> platoon level at first reported violations monthly through <strong>the</strong> Marinechain of command; later reports were made twice monthly. <strong>The</strong> reportswent to <strong>the</strong> 1st and 3d Marine Divisions and <strong>the</strong> l st Marine AirWing. Sub Unit One also issued a monthly report to MACV describing<strong>the</strong> emphasis placed on communications security during <strong>the</strong> month, <strong>the</strong>number of transmissions monitored, and <strong>the</strong> number of violations found.While only a rough measure of actual violations occurred, <strong>the</strong>se SubUnit One reports provided an indication of COMSEC status reliableenough for value judgments. During <strong>the</strong> last three months of 1968, <strong>the</strong>average number of monitored transmissions for each month remainedapproximately <strong>the</strong> same, yet <strong>the</strong> detected violations in October were 519,while for December only 216 violations were detected. MarineCOMSEC analysts attributed this reduction in violations to increasedemphasis during <strong>the</strong> period on <strong>the</strong> lecture method to improve security andto <strong>the</strong> establishment of closer working relationships between <strong>the</strong> platoonsproviding <strong>the</strong> COMSEC support and <strong>the</strong> supported G-2 and S-2 officers.When he was in command of III Marine Amphibious Force, Lt. Gen.Lewis W. Walt kept abreast of reports on <strong>the</strong> COMSEC status of Marineunits and took note when he could of progress made by <strong>the</strong> subunit. In aletter of 28 November 1966 to <strong>the</strong> commanding general of <strong>the</strong> FleetMarine Force Pacific, General Krulak, and o<strong>the</strong>rs, he wrote:It has been noted with pleasure that <strong>the</strong> communications security posture of<strong>the</strong> III Marine Amphibious Force has shown marked improvement during <strong>the</strong>past 11 months. This is apparent in <strong>the</strong> fact that <strong>the</strong> number of significantcommunication security violations committed each week by III MarineAmphibious Force units, air and ground, has decreased by 75 percent sinceJanuary 1966. This improvement can only be attributed to extensive commandinterest and concern shown at all echelons of command, increased use ofavailable cryptographic aids, and to <strong>the</strong> efforts of Sub Unit One, First RadioBattalion in presenting over 200 periods of instruction on this subject to IIIMarine Amphibious Force Units.TOP SECRET UMBRA?WFORN
'TOfl ~:f:CR:f:'T UMBRA HOFORHCONVENTIONAL COMSEC MONITORING 69Navy COMSEC reports also prompted command actions of one kindor ano<strong>the</strong>r. A major report, <strong>the</strong> quarterly COMSEC Traffic AnalysisReport, not restricted to but incorporating <strong>the</strong> Sou<strong>the</strong>ast Asia naval.COMSEC reports, gave wide circulation to <strong>the</strong> COMSEC problems inSou<strong>the</strong>ast Asia and <strong>the</strong> Western Pacific in general and provided <strong>the</strong> basisfor initiating corrective COMSEC actions. Within WESTPAC <strong>the</strong>reports helped in a variety of COMSEC management steps. <strong>The</strong> analysisof monitored circuits, as reported, helped managers to determinepriorities in <strong>the</strong> assignment to voice nets of short-supply secure ciphonyequipment. Monitored findings helped also in <strong>the</strong> assignment of nonvoicecrypto-equipment to provide cryptocover. For example, in)anuary 1967COMSEC 702, at Karniseya, issued a traffic analysis report that resulted. in authorization for on-line cryptocover of one of <strong>the</strong> communicationslinks of <strong>the</strong> Naval Tactical Data System serving many of<strong>the</strong> Navy's shipsin <strong>the</strong> war area. When reports on a MARKET TIME communicationssurvey revealed a major netting problem and limited code vocabularies,COMSEC managers were able to press for improvements in operationscodes and to recommend <strong>the</strong> use of improved codes in particular cases,such as communications giving naval gunfire shore targets.Most important, <strong>the</strong> many reports prompted command actions directedtoward WESTPAC communications discipline. For example, <strong>the</strong>commander of <strong>the</strong> Seventh Fleet issued a general message reiterating andexplaining encrypt-for-transmission-only requirements. At <strong>the</strong> next higherlevel, <strong>the</strong> commander in chief of <strong>the</strong> Pacific Fleet advised subordinatecommanders that unclassified messages originated by shore establishmentsconcerning WESTPAC ships often disclosed movements orindicated impending arrival of ships in Western Pacific ports.Generally, commanders reacted to spot monitoring reports andrecommendations in a spirit of cooperation. But, as in <strong>the</strong> case of Army,NAVSECGRU COMSEC specialists found that not all commandersappreciated <strong>the</strong> support. Some high-ranking officers resented reportsconcerning <strong>the</strong>ir commands' errors appearing in electrical messages withmultiple addresses. <strong>The</strong> resentment was more pronounced when <strong>the</strong>monitoring reports called attention over and over to <strong>the</strong> samemalpractices. Marine and Navy commanders often felt that goodCOMSEC practices alone could not protect <strong>the</strong>ir military operations since<strong>the</strong> enemy did not need to intercept U.S. communications to obtainTQP ~~(;R~T m f8RA HOFOlUf
TOP SECRET UlolBR,'HOfOfUq70 WORKING AGAINST THE TIDEKW-26 and KW-37R in Detachment 5 Cryptocenter, USSConstellation, Gulf of Tonkinintelligence on naval and Marine components-<strong>the</strong> location of anaircraft carrier standing offshore was obvious, and <strong>the</strong> presence of fighteraircraft in support of ground operations told <strong>the</strong> enemy where <strong>the</strong> U.S.forces were. Application of strict COMSEC techniques <strong>the</strong>refore seemedto have no real purpose.TOP SECRET UMBRAUOfORU
-'-"~"~--~~-,~"'-~--l,\TOP SECRET UMBRA!q0fi0Rrq-CONVENTIONAL COMSEC MONITORING 71KL-47 in Detachment 5 Cryptocenter, USS Constellation, Gulfof TonkinTo develop better rapport with commanders, monitors did not alwaysfollow strictly <strong>the</strong> basic instructions to report significant COMSECmalpractices electrically and with multiaddresses. <strong>The</strong> monitorspreferred, instead, to report repetitive errors in weekly newsletters or inwritten monthly reports, which were less offensive.TOP SECRET UMBRAHOf0R!q- -- -- -- ----
TOF SECRET UMBRAfWfORH'72 WORKING AGAINST THE TIDEAir Force Security ServiceOrganizationHeadquarters, AFSS, at Kelly Air Base in Texas, controlled <strong>the</strong> AirForce COMSEC programs. Its Pacific headquarters, <strong>the</strong> Pacific SecurityRegion (PACSCTYRGN) at Wheeler Air Base, Hawaii, operated anumber of security wings (SW) in various parts of <strong>the</strong> Pacific. Of <strong>the</strong>se,<strong>the</strong> 6922d Security Wing at Clark Air Base, Philippines, toge<strong>the</strong>r withits several detachments, was <strong>the</strong> one principally involved in <strong>the</strong> VietnamWar in <strong>the</strong> years to 1968.PACSCTYRGN also controlled o<strong>the</strong>r resources not administrativelycommitted to a particular operating security wing, including a mobileTRANSEC* team equipped with an HF position (AG-2761), aUHF/VHF position (AG-88711), a radiotelephone position(AG-274), and a COMSEC hut. PACSCTYRGN's Detachment 2 atHickam Air Base, Hawaii, performed second echelon analysis andreporting and had direct operational control over <strong>the</strong> 6922d'sdetachments in Saigon, and in Korat, Thailand. After November 1967,Detachment 2 moved from Hickam to <strong>the</strong> PACSCTYRGN headquarterslocation at Wheeler.<strong>The</strong> Air Force organization for COMSEC monitoring and analysis inSou<strong>the</strong>ast Asia grew slowly in <strong>the</strong> early period of U.S. involvement. Aftersome token monitoring of Air Force communications at Tan Son Nhut inSeptember 1962, not much was done until two AFSS COMSECspecialists monitored VHF, UHF, and HF single sidebandcommunications at Bien Hoa in November and December 1964. <strong>The</strong>irmonitoring showed that a si nificant amount of intelli ence was beinpassed unprotectedon <strong>the</strong> type of aircraft operating out of Bien Hoa Air Base;"----:---;-----'and on <strong>the</strong> command and control system used in operations.*Air Force personnel use TRANSEC in a manner to be more inclusive than <strong>the</strong>definition, "measures designed to protect <strong>the</strong> intentionally transmitted signal fromintercept and exploitation by means o<strong>the</strong>r than cryptanalysis." Air Force use frequentlyequates to <strong>the</strong> broader term communications security (COMSECY. To avoid confusionin this volume, COMSEC will be used throughout this section except, of course, whereTRANSEC appears in quotes.(b) (1)(b) (3)-P.L. 86-36TOP SECRET UMBRA HOFORH(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP S£ER£T UMBRAUOfOftf.qCONVENTIONAL COMSEC MONITORING 73Before <strong>the</strong> end of 1964, <strong>the</strong> Pacific Air Force (PACAF) authorized anadditional COMSEC study, and Detachment 2, PACSCTYRGN,undertook <strong>the</strong> work. Although at first only a test was scheduled in orderto establish <strong>the</strong> need for improvements, so flagrant were <strong>the</strong> manyviolations observed during <strong>the</strong> test period that Detachment 2 concluded<strong>the</strong> 2d Air Division (forerunner of <strong>the</strong> Seventh Air Force) tacticalcommunications were receiving only marginal security protection. AirForce COMSEC analysts in Hawaii processed <strong>the</strong> intercepted tapes andalmost immediately broke <strong>the</strong> PALMER JOHN operational codeproduced by <strong>the</strong> 2d Air Division and used by it to pass strike coordinates,times over target, aircraft call signs, and so forth. <strong>The</strong> analysts also notedinsecure transmission of two messages relating to projected air strikes, aswell as <strong>the</strong> itinerary of a forthcoming field trip by <strong>the</strong> 2d Air Divisioncommander, Maj. Gen. Joseph H. Moore. As a result of <strong>the</strong> test,USAFSS recommended <strong>the</strong> establishment of a permanent COMSECelement in Sou<strong>the</strong>ast Asia. As an interim solution, <strong>the</strong> Air Force approveduse ofa mobile COMSEC H-l van for <strong>the</strong> area.Detachment 5, 6922d Security Wing As outgrowth of <strong>the</strong>se earlyactions, on 8 April 1965 PACSCTYRGN deployed al kOMSECteam and a mobile H-l van to <strong>the</strong> Tan Son Nhut Air Base near Saigon.<strong>The</strong> deployment was on a TDY basis pending a request to General JohnP. McConnell, <strong>the</strong> Chief of Staff, USAF, for a personnel ceiling increasein South Vietnam permitting ~ ICOMSEC team.Obtaining <strong>the</strong> ceiling increase, AFSS activated Detachment 5, 6922dSecurity Wing, at Tan Son Nhut in July 1965 to provide close tacticaltransmission secritYIs'.upport to <strong>the</strong> 2d A.ir Divisio.. n. Initial strength wasone officer and airmen. Equipment approved for <strong>the</strong> detachmentincluded c=JI-IF positions (AG-2761), one UHF/VHF position(AG-88711), one radiotelephone position (AG-274), and onetranscribe position (AG-4).Completion of a semipermanent facility for <strong>the</strong> unit enabled <strong>the</strong>detachment to expand monitoring to <strong>the</strong> extent of doubling of telecornmonitoring lines and adding ·.·...mu'. ltichao.·.· ..•....nel .• monit..ring Iequipment.Initially <strong>the</strong> new building containedDHF (8761) VHF/UHF(887-EII),c=Jtel~phone(AG-275), and Dtranscribe positions(AG-4). One more telephone positioncame\at<strong>the</strong>end of 1967.Government Note'fG·p :n:Cftf:'f UMBRAUOfORH(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
'fOfi :3ECKE'f UI\>fBKi\HOFORH74 WORKING AGAINST THE TIDEDetachment 7, 6922d Security Wing, Buildings, KaratDetachment 7, 6922d Security Wing In preparation for a visit toSaigon in July 1965 by Secretary of Defense Robert S. McNamara,MACV proposed to ask for an increase in COMSEC resources for allthree Services. For this, <strong>the</strong> recently activated Detachment 5, 6922dSecurity Wing, supplied <strong>the</strong> following assessment of additional Air Forcerequirements: "We needOm.... 0... re R/T (radiotelephone) positions andone more HF position pluDmore personnel. To cover South Vietnamadequately at leastDmore TRANSEC units ofDpersonnel, each with 1HF and one R/T position, would-be necessary." <strong>The</strong> Secretary reactedfavorably.In specific reply to a 1 September 1965 CINCPAC request for Serviceand SCA review of monitoring requirements, <strong>the</strong> Thirteenth Air Forcerecommended establishing monitors.in Korat, Thailand, using mobilevans. <strong>The</strong> plan called for a team not toe~(:.eedDmen with equipmentfor monitoring troposcatter, HF, and UHF/VHF communications.TOP SECRET UMBRA NOFORH (b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOP SECRET UMBRAHOFORHCONVENTIONAL COMSEC MONITORING 75iI{I l[=~.Detachment 7, 6922d Security Wing, Positions, Koratf~~Among locations considered-Takhli, Udorn, and Korat-e-Korat was<strong>the</strong> best location for collection of radiotelephone communications. AFSSwould use mobile vans to collect UHF and VHF singals in <strong>the</strong> immediateareas of Takhli and Udorn.Detachment 7, 6922d Security Wing, began operations at Korat AirBase on 1 April 1966 supporting, through tactical COMSEC monitoring,<strong>the</strong> Deputy Commander, 7/13 Air Force, * in operations conducted inand from Thailand. On 4 May <strong>the</strong> unit had only one officer andD"Seruor U.S. Air Force commander in Thailand. <strong>The</strong> title denotes his administrativeand logistic relationship to Thirteenth Air Force, based in <strong>the</strong>/Philippines, and hisoperational relationship to <strong>the</strong> Seventh Air Force, which had headquarters at Tan SonNhut Air Base, South Vietnam.TOP SECRET UMBRAPWFORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'fOP SECRE'f UMBRA NOFORN76 WORKING AGAINST THE TIDEDetachment S Mobile Operations, 1966DatePlace21 Feb-6 Mar Da Nang AB2 Apr-IS Apr Bien Hoa AB1Jun-lOJun Da Nang AB29 Aug-7 Sep Monkey Mt, site of6924th SS17 Nov-26 Nov Monkey Mt. site of6924th SS17 Nov-26 Nov 6924th SS main site17 Nov-26 Nov Da Nang ABCommunications Targetednonractical VHF frequencies of air basenontactical VHF frequencies of air baseUSAF VHF/UHF tactical frequenciesUSAF VHF/UHF frequenciesVHF/UHF frequenciesHF frequenciestelephone exchangeairmen, but by 30 June <strong>the</strong> number of airmen had increased tGThiswas still below <strong>the</strong> authorized strength ofone officer andDairmen.By <strong>the</strong> end of 1967,DAFSS men were monitoring and analyzingcommunications in Vietnam and Thailand. O<strong>the</strong>r Air Force COMSECelements in Japan, on Okinawa, in <strong>the</strong> Philippines, in Hawaii, and atKelly Air Base helped monitor and analyze SEA communications.AFSS considered its monitoring resources as of 1967 to be basicallyadequate for Sou<strong>the</strong>ast Asia requirements. Never<strong>the</strong>less, during much of<strong>the</strong> time personnel and equipment strengths were less than authorized.Many Air Force circuits were not checked, even periodically, during <strong>the</strong>entire 1964-67 period. <strong>The</strong> effect of personnel shortages is illustrated bya Detachment 7 report in 1967:One common problem Det wide, and one which adversely affected <strong>the</strong>operations, was <strong>the</strong> untimely replacernent. of personnel. On 21 April 1967,c::::::::Jpersonnel (NCOs and airmen) were relieved of dutyto effect a 24 April1967 poncaI!. Consequently, on 22 April 1967, trick operations were frozen toa two shift concept of 12 hours on, and 12 hours off <strong>The</strong> 6922 SCTY WGresponded to <strong>the</strong> situation with TDY assistance from Det4, 6922 SCTY WG,and Det 7 was able to return to a three shift concept on 26 April 1967.Although this assistance lasted for 59 days, losses. continued to exceedreplacements, and additional'
TOP 5BCRBT UMBRAnOFORnCONVENTIONAL COMSEC MONITORING 77OperationsAs in <strong>the</strong> case of Army and Navy operations, AFSS monitors selectedcircuits that <strong>the</strong>y regarded <strong>the</strong> most profitable sources of intelligence to<strong>the</strong> enemy SIGINT organizations. <strong>The</strong>y gave little attention to on-lineencryption. Detachment 5 and 7 specialists concentrated, instead, on closerangemonitoring of unsecured radio circuits used by ground crews toservice aircraft. <strong>The</strong>se circuits and <strong>the</strong> communications of unit protocolofficers normally revealed intelligence useful to an enemy.<strong>The</strong> Seventh Air Force established essential elements of information(EEl's) to guide <strong>the</strong> monitoring and reporting of <strong>the</strong> COMSECdetachments. <strong>The</strong> EEl's called for reports on violations whenevermonitored communications revealed information on prestrikearrangements, logistics, communications disruption (jamming orsaturation of secure circuits), tactical methods, aircraft performance, pilotand unit capabilities, or o<strong>the</strong>r sensitive data.Both Detachment 5 and Detachment 7 had mobile monitor teams.Detachment 5's 1966 record of its mobile operations, as reflected in <strong>the</strong>table on page 76, was representative.In December 1965 PACSCTYRGN directed <strong>the</strong> 6988th to provide aCOMSEC monitor for a COMSEC testIIDetachment 2, PACSCTYRGN, in its Aptil1966Ievaluation of <strong>the</strong> results of this I Imonitoring recommendedcontinual employment of a COMSEC rnonitorj IHeadquarters, AFSS, agreed to <strong>the</strong> continual operation'] II I \\ • / iii//L...-__...ICOMSEC monitors.......... \\ ..• iii // Icollected plain .language i communicationspassing over VHF/UHF guardand tactical voice channels, whichcarriedinformation on strikes, MIG andSAMalerts,bombdamageassessments,I'fOP SECRE'TUMBRAnOFORn(b) (1)_(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAl'WfORH78 WORKING AGAINST THE TIDEDetachment 5,6922d Security Wing, Analysts at Work, TanSon Nhuttargets, air refueling, and air-to-air coordination. After some experiencewith <strong>the</strong>se communications, <strong>the</strong> monitors focused on frequencies usedduring air-to-air refueling operations as communications on <strong>the</strong>seappeared to be continually revealing <strong>the</strong> general direction of outgoingfighter-bombers.~S.e..p. tember 1966 Detachment 2, PACSCTYRGN, called <strong>the</strong>L-..JCOMSEC monitorin <strong>the</strong> rimar source of its" most lucrativefindings."<strong>The</strong> COMSEC collectionL,-------......~-----------:'brought attention to communications weaknesses concerning /alertsystems, special navigation-techniques, tactics, and command and controlcommunications-all of which were of high interest to enemy SIGINTunits·1 . / / ICOMSEC,providing information on forward area air communications thatTOP SECRET UfdBRA fWfORIq(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403..........,,.,....,_,,...,.-.-.__~-..... ...,.....__-_--(b) (3) -18 USC 7 9 8
"fOF SECRE"f UMBRAHOfORHCONVENTIONAL COMSEC MONITORING 79KW -26 and KY-8 Crvpto-equipment In Seventh Air ForceOperations Area, Tan Son Nhutcontrolled strikes in nor<strong>the</strong>rn South Vietnam and <strong>the</strong> demilitarized zone(DMZ) and information on search and rescue communications.When <strong>the</strong> AFSS began its COMSEC support of <strong>the</strong> 2d Air Division,<strong>the</strong> command had asked for reports directly from <strong>the</strong> monitoringdetachments within 6 to 14 hours of intercept. In 1964 and 1965, AFSSCOMSEC units were not capable of real-time reporting of monitoredCOMSEC weaknesses-reports that would have permitted <strong>the</strong> Air Forceto change plans when strike operations, target areas, and so'forth hadbeen compromised. However, during those years some elements of <strong>the</strong> 2dAir Division did not feel that real-time reporting of COMSEC violationswas necessary since <strong>the</strong>y did not believe that operational plans should bealtered on <strong>the</strong> basis of reported COMSEC violations. In July 1966Detachment 5 listed some 25 monitored events that perhaps should havecaused a change in plans if an immediate reporting system had beenemployed. Minimum required reporting time was <strong>the</strong>n 4 hours, andregular reporting was possible only during normal duty hours. Under<strong>the</strong>se conditions, reports often were received too late to affect operations."fOF S£ER£"f UbfBRlt~JOfOlUf
80 WORKING AGAINST THE TIDEIn mid-1966 Detachment 5 recommended that <strong>the</strong> reports ofmonitored activity, both in-country and out-of-country, be reported"immediately" to appropriate tactical commands and that officials beauthorized to alter plans on <strong>the</strong> basis of <strong>the</strong>se reports. <strong>The</strong> Air Forceaccepted <strong>the</strong>se recommendations. In February 1967 AFSS accordinglybegan sending"immediate" reports of detected violations to all levels ofAir Force command down to air division. AFSS also began to include <strong>the</strong>names of communications violators when <strong>the</strong>y were so requested by <strong>the</strong>command element involved.AFSS employed various types of reports for notifying commands ofCOMSEC breakdown and for <strong>the</strong> COMSEC units' own use. Perhaps <strong>the</strong>most basic of <strong>the</strong> reports going to <strong>the</strong> commands was <strong>the</strong> TransmissionSecurity Message Report (TSMR), <strong>the</strong> vehicle for immediate reporting.Detachment 7 issued 77 of <strong>the</strong>se in 1967 alone. A variation of <strong>the</strong>TSMR, <strong>the</strong> Prestrike Report, came into use for situations in whichinformation on a forthcoming air strike had been divulged 1 hour and 45minutes or more before <strong>the</strong> strike. When voice ciphony circuits wereavailable, AFSS units used <strong>the</strong>m in communicating <strong>the</strong> COMSECmessage to <strong>the</strong> military command concerned. Such reporting made itpossible to change plans and thus offset possible enemy action predicatedon <strong>the</strong> compromised information. Once a month, AFSS units forwarded aTSMR recap electrically to commanders and senior AFSS echelons,noting any actions taken by Air Force operational commands as a resultof <strong>the</strong> monitors' reports.Ano<strong>the</strong>r report going to Air Force operational commands was <strong>the</strong>Transmission Security Monthly Summary (TSMS), a report giving <strong>the</strong>state of COMSEC, noting infractions of procedures by specified elements.In addition to its wide dissemination to Air Force operating elements, thisreport went to PACSCTYRGN, which also used it in dealing withcommand personnel.While <strong>the</strong>se various reports were for use primarily by operationalpersonnel, ano<strong>the</strong>r category of reports had <strong>the</strong> objective of aiding <strong>the</strong>monitoring effort itself. This category included a Daily Activity Summary(DASUM), a report forwarded electrically to PACSCTYRGN. For moreimmediate reporting, a TRANSEC Item of Interest (TIOI) went fromdetachment elements to higher authority when an observed practiceTOP gr:CRr:T U:MBRAPWFORH.wrrrr
CONVENTIONAL COMSEC MONITORINGTOP SECRET UMBRAf40fORf481Seventh Air Force Classification of InformationPlanned or Completed Missions (In-Country) Classified DeclassifySorties scheduled Yes after strikeTarget coordination Yes 1 hour priorTarget description Yes 1 hour priorTime over target Yes 1 hour priorNumber ofaircraft in flight Yes 1 hour priorType of mission Yes after strikeSpecial type missions Yes indefiniteOrdnance being carried Yes 1 hour priorRequest for strikes Yes 1 hour priorRequest for reconnaissance Yes 1 hour priorStrike resultsNoReconnaissance results Yes indefiniteappeared dangerous but not sufficiently alarming to warrant notification ofoperating forces. Similar to <strong>the</strong> TIOI was <strong>the</strong> TRANSEC InterimSummary (TSIS), which provided higher headquarters with apreliminary evaluation of a particular observed communication practice.TRANSEC Analysis Notes (TAN's) also documented COMSEC findingsuseful for those working within <strong>the</strong> COMSEC speciality.Although PACAF and subordinate organizations down to divisionlevel had authority to determine whe<strong>the</strong>r a monitored transmission wasor was not a security violation, <strong>the</strong> lack of guidelines for monitors causedmany problems. Issued EEl's should have helped resolve this problem,but <strong>the</strong>y could not do so completely. <strong>The</strong> Seventh Air Force guides to <strong>the</strong>proper classification of information show <strong>the</strong> complexity of decisionmaking in this regard. (See table above.) Obviously, a one-hour-priorto-strikecriterion was arbitrary ra<strong>the</strong>r than truly denotative ofoperational sensitivity. Since most strike requests were made within <strong>the</strong>one-hour period, <strong>the</strong> classification guide for <strong>the</strong> most part permitted suchinformation to be sent as unclassified.TOP SECRET UftfBRAHOfORH
TOP SECRET UMBRAfq-OPOltfq-82WORKING AGAINST THE TIDE<strong>Against</strong> <strong>the</strong> <strong>Tide</strong>AFSS monitors acquired sensitive information on a number of actionsand very often operational commanders were able to take correctivemeasures on <strong>the</strong> basis of monitoring reports. One subject of especialconcern was VIP movements. When President Lyndon B.Johnson in <strong>the</strong>fall of 1966 went to <strong>the</strong> Pacific and made an unannounced visit toSou<strong>the</strong>ast Asia, Air Force monitoring uncovered many indications thathis movements were being passed in unprotected communications.Reports containing this evidence went to General McConnell, USAFChief of Staff, who ordered <strong>the</strong> passing of such information only oversecured lines.At o<strong>the</strong>r times monitors reported vital operational informationrevealed in Air Force communications. Through monitoring andanalysis, Detachment 5 reconstructed <strong>the</strong> entire geographic grid systembeing used for area target identification along with <strong>the</strong> code namesassigned to identify <strong>the</strong> grid blocks. <strong>The</strong> code names were not changeduntil all targets in a particular geographical area had been hit-often amatter of months. Since MACV and operations personnel used <strong>the</strong> codenames in unsecured communications as much as a month before actual airstrikes, enemy foreknowledge was obviously possible. In each strike <strong>the</strong>MACV air operations personnel, using unsecured communications, called<strong>the</strong> SAC liaison officer in Saigon about 36 hours before a strike and inapproximately one-third of <strong>the</strong> conversations used <strong>the</strong> target code name.<strong>The</strong> top RVN command used unsecured communications when calling<strong>the</strong> U.S. and Allied field forces to alert <strong>the</strong>m to forthcoming RVN airstrikes and also included target identifications through use of <strong>the</strong> codename approximately one-third of <strong>the</strong> time. Detachment 5's report toMACV and SAC in September 1966 outlined <strong>the</strong> dangers of using codenames in this fashion.From mid-1966 through January 1967, monitored U.S. communicationsdisclosed U.S. involvement in <strong>the</strong> Thai counterinsurgencyoperations (COIN). Unsecured communications disclosed <strong>the</strong> types ofU.S. aircraft involved and an increased participation. At <strong>the</strong> time <strong>the</strong>rewas no public acknowledgment that U.S. forces were engaged in COINoperations in Thailand.TOP SECRET UldBRAHOfORH
~..TOP SECRET UMBRAHOFORHCONVENTIONAL COMSEC MONITORING 83In <strong>the</strong> spring of 1967, AFSS monitored VHFjUHF unsecuredcommunications at <strong>the</strong> Nakhon Phanom Air Base in Thailand and foundfrequent references to TACAN azimuth and range positioning, thusdisclosing <strong>the</strong> orbits and operational areas of flareships, FACs, and strikeand o<strong>the</strong>r aircraft. Unsecured HF communications contained informationrevealing details on special force and air commando componentsoperating within Laos-including air strike activity in support of LaotianGovernment troops. Six specific recommendations for COMSECimprovement were forwarded with <strong>the</strong> report of findings.In <strong>the</strong> fall of 1967, AFSS teams prepared eleven separate reportssetting forth evidence of <strong>the</strong> misuse or possible compromise of KAC-J, adigital au<strong>the</strong>ntication code used for encrypting coordinates and o<strong>the</strong>rnumerals in direct support operations. AFSS headquarters sent three of<strong>the</strong>se reports to General McConnell to support <strong>the</strong> need for a replacementcode. In March 1968, General John D. Ryan, <strong>the</strong> commander in chiefofPACAF also expressed his concern over <strong>the</strong> situation to Seventh Air Forceand o<strong>the</strong>rs:TRANSEC message reports (TSMRS) submitted by Det 5, 6922 SW, duringJan and Feb 68 indicate KAC-J code being compromised when encodedcoordinates passed in air strike are later given in plain text in BOA report.PACSCTYRGN cryptanalysts confirm that KAC-J code can be recoveredbecause of this ops procedure. Fur<strong>the</strong>r, complete compromise occurs whenpreviously encrypted coordinates and TOTS are confirmed by FAC in <strong>the</strong> clearjust prior to air strike to eliminate possibility of errors in target locations. *In November 1967, following a Detachment 7 semiannual briefing atKorat Air Base, monitors studied two 388th Tactical Fighter Wingtelephone circuits. <strong>The</strong> monitors were able to recover a substantial part of<strong>the</strong> daily F-I05 and support aircraft status reports and a fair amount of<strong>the</strong> sorties-flown portion of<strong>the</strong> reports.While <strong>the</strong> list of examples is extensive, <strong>the</strong>re were extenuatingcircumstances. Lack of sufficient cryptosecurity equipment to encryptvoice communications during <strong>the</strong> years 1964-67 made impossible <strong>the</strong>*CINCPACAF Msg to 7th Air Force and o<strong>the</strong>rs, sub: 7AF FAC Code, DTG 2102432Mar 68, SECRET.TOP SECRET UMBRAHOFORH
84 WORKING AGAINST THE TIDEsecuring by crypto-equiprnent of every voice link over which sensitiveinformation was being passed. Corrective action for voice communicationstended to be in <strong>the</strong> nature of advising <strong>the</strong> operators as towhat should and what should not be transmitted in <strong>the</strong> clear, ofsuggesting alternate means of communications that would be secure, andof assuring that appropriate manual cryptosysterns were available andprocedures for <strong>the</strong>ir use were understood. As of September 1967, 1,733voice channels were in use in <strong>the</strong> all- Service Sou<strong>the</strong>ast Asia WidebandSystem (SEAWBS). This system, with a 2,775·voice·channel capabilityconsisted of <strong>the</strong> Vietnam BACK PORCH and <strong>the</strong> Thailand "PhilcoTrope" systems. At least 660 channels of <strong>the</strong> system were clearlyvulnerable to intercept from fixed SIGINT sites within North Vietnam.General McConnell and commanders at lower levels often took strongaction to reduce COMSEC violations. In September 1965 GeneralMcConnell approved <strong>the</strong> releasing of <strong>the</strong> names of COMSEC violators to<strong>the</strong>ir commands (down to <strong>the</strong> division level), a new procedure tha<strong>the</strong>lped to curb violations. At a lower command level, <strong>the</strong> Seventh AirForce in 1966 established a TRANSEC Review Board, which maderegular use of monitor reports to improve various aspects of COMSEC.Despite <strong>the</strong>se and o<strong>the</strong>r Air Force actions, <strong>the</strong>re were far too manyinstances where <strong>the</strong> Vietnamese Communists temporarily evacuated <strong>the</strong>irpersonnel from a target area just before aircraft arrived over <strong>the</strong> target.Not all of <strong>the</strong>se evacuations were directly attributable to a lack ofCOMSEC, but enough instances came to light during monitoring andanalysis of Air Force communications to suggest that poor COMSEC wasa major factor.TOP SECRET UMBRAPWFORN
SOUTH EAST ASIAPart TwoTHIS DOCUMENT CONTAINS CODEWORD MATERIAL
I OP ~F:CI{l~'} U?HBRA NOFORNCRYPTOLOGIC HISTORY SERIES·SOUTHEAST ASIA<strong>Working</strong> <strong>Against</strong> <strong>the</strong> <strong>Tide</strong>(COlVlSEC Monitoring and Analysis)PART TWOTOP SECRET UMBRA NOFORN
Of SEeKEr UMBKArq;OfOKf..SECURITY NOTICEAlthough <strong>the</strong> information contained in this journal ranges in securityclassification from UNCLASSIFIED to TOP SECRET CODEWORD,<strong>the</strong> overall security classification assigned to this issue is TOP SECRETUMBRA. <strong>The</strong> "No Foreign Nations" (NOFORN) caveat has beenadded to guard against inadvertent disclosure of portions of <strong>the</strong> textwhich discuss topics normally held to NOFORN channels.While <strong>the</strong> TSCW NOFORN classification by itself requires carefulhandling, additional caution should be exercised with regard to <strong>the</strong>present journal and o<strong>the</strong>rs in <strong>the</strong> series because of <strong>the</strong> comprehensivetreatment and broad range of <strong>the</strong> subject matter.rOf SECREr UMBRANOFORN
TOP SECRET UMBRA~JOFORpqTOP SECRET UMBRA~lOF9R~1
TOP SfERfT UMBRAPWFORtfCHAPTER IIICOMSEC Surveillance<strong>The</strong> ConceptIn <strong>the</strong> mid-1960's, COMSEC specialists began to encourage a newapproach to <strong>the</strong> problem of insecure communications, one in which <strong>the</strong>rules of <strong>the</strong> game in monitoring were considerably altered. <strong>The</strong> newapproach, termed surveillance, called for <strong>the</strong> inclusion of COMSECsafeguards in planning military operations, thus averting, except foroperator error or o<strong>the</strong>r unforeseen circumstances, most securitymalpractices. COMSEC analysts worked with <strong>the</strong> communicationsplanners and o<strong>the</strong>rs fully knowledgeable in operations. Most important,<strong>the</strong>y had access to information that would assist <strong>the</strong>m. As normallypracticed under conventional monitoring procedures, monitors andanalysts worked in relative isolation from operational planners and hadlittle access to information about frequencies, call signs, and schedulesemployed by U.S. units unless it had been acquired from previousmonitoring.Initiated in art as a result of a visit by NSA COMSEC specialist Mr.86-36 to CINCPAC in <strong>the</strong> summer of 1965 and outlined in anIb) (3) -P.L.NSA letter of 23 December 1965 to <strong>the</strong> three Services, COMSECsurveillance had as its immediate objective <strong>the</strong> correction of communicationsmalpractices in <strong>the</strong> Pacific war area, with world-wide applicationas its longer range goal. In December 1965 Admiral Sharp, CINCPAC,issued to his commanders a directive on surveillance that outlined <strong>the</strong> roleof <strong>the</strong> COMSEC surveillance specialist.Coordinate with commanders' staffs to determine what traffic must flowduring planning and implementation phases;Amalgamate information derived with that available through previousCOMSEC monitoring and analysis;Determine <strong>the</strong> participating communications facilities and <strong>the</strong> relativespeed and security of all communications involved;TOP g~CRBT UMBRA nOrORP,
TOP SECRET UMBRArqOfiOlt!q88 WORKING AGAINST THE TIDEPrepare recommendations for handling operational traffic (e.g., communicationsprocedures and use of cryptornaterials):Conduct selective monitoring during <strong>the</strong> operation to test <strong>the</strong> effectivenessof previous actions;Advise participants of results with recommendations for change.*As <strong>the</strong> first NSA COMSEC representative to be permanently stationedin <strong>the</strong> Pacific and serving as a member of <strong>the</strong> Headquarters, NSA Pacific(NSAPAC) staff, I (b) (3)-P.L. 86-36 I helped introduce andpromote COMSEC surveillance. Changing over to <strong>the</strong> new approach was,however, a slow process, in part because of <strong>the</strong> shortage of qualifiedCOMSEC specialists. Most of <strong>the</strong> COMSEC monitors in Sou<strong>the</strong>ast Asia,in fact, were still using <strong>the</strong> traditional approach at <strong>the</strong> end of 1967.While improvement of COMSEC was <strong>the</strong> goal of both conventionalmonitoring and surveillance, <strong>the</strong> new approach was more preventative,and conventional monitoring more curative. Under <strong>the</strong> new concept,COMSEC units de-emphasized broad monitoring coverage andintensified selective monitoring to achieve specific goals. COMSECpersonnel served more frequently as advisors and preplanners. By <strong>the</strong> endof 1967, SCA's began to identify some COMSEC personnel assurveillance specialists, distinguishing <strong>the</strong>m from o<strong>the</strong>rs working strictlyas monitors and analysts. In conventional monitoring <strong>the</strong> COMSECanalyst, working in isolation from <strong>the</strong> communications operator, oftenhad an "electronic spy" or policeman's image. As a surveillance specialist,he became a member of <strong>the</strong> team who helped prevent and overcomecommunications security problems. <strong>The</strong> COMSEC surveillance conceptreached its best application to that date in <strong>the</strong> PURPLE DRAGONoperational security survey of 1966-67.** <strong>The</strong> cutting edge of COMSECsurveillance was that it represented command recognition of <strong>the</strong>importance of COMSEC and, in so doing, facilitated change inprocedures when COMSEC considerations demanded <strong>the</strong>m.In <strong>the</strong> years to 1968 <strong>the</strong> SCA's, NSA, and <strong>the</strong> military commandsundertook six major COMSEC monitoring or surveillance operations toattain specific objectives. One dealt with Army communications in·CINCPAC 040354Z Dec 65.• •Seepp. 128-38.TOP SECRET UPdBRliP'lOFOlUJ
"Of SfC:Kf'T UMB:KAHOfORHCOMSEC SURVEILLANCE 89•I,·f..Close Cooperation Between ASA COMSEC Personnel andInfantrymenVietnam, two concerned Navy communications in <strong>the</strong> offshore watersand riverways of South Vietnam, and three examined <strong>the</strong> communicationsof all three Services.<strong>The</strong> six studies, here presented in rough chronological order, show tosome degree <strong>the</strong> increasing trend toward <strong>the</strong> use of COMSECsurveillance as opposed to conventional monitoring, although it is notalways possible to distinguish one from <strong>the</strong> o<strong>the</strong>r. <strong>The</strong> Guam study, <strong>the</strong>second in <strong>the</strong> series, was a Navy-Air Force-NSA operation employing <strong>the</strong>NIGHTSTICK concept-inspecting all communications in a given areasimultaneously for over-all COMSEC evaluation. This represented, ofcourse, a departure from <strong>the</strong> isolated, single-Service study normal inconventional monitoring. Although CINCPAC and NSA weredeveloping <strong>the</strong> surveillance concept during <strong>the</strong>se years, <strong>the</strong> key element ofprecommunications COMSEC planning was largely absent from <strong>the</strong>Guam study and from <strong>the</strong> SILVER BAYONET, MARKET TIME, and'TOP SECRET UMBRA~JOFmUJ
TOF SECRET UZdBRAfq-OfORH90 WORKING AGAINST THE TIDEGAME WARDEN studies undertaken in 1965 and <strong>the</strong> first part of1966.For <strong>the</strong> mid-1966 ARC LIGHT study, Admiral Sharp, CINCPAC,'specifically requested <strong>the</strong> application of <strong>the</strong> surveillance concept, and at<strong>the</strong> end of that study expressed his dissatisfaction with <strong>the</strong> methods as'applied. In CINCPACs PURPLE DRAGON operation, <strong>the</strong> Servicessuccessfully employed <strong>the</strong> surveillance concept, involving <strong>the</strong> COMSECspecialists in <strong>the</strong> preplanning stages of <strong>the</strong> operation and giving <strong>the</strong>maccess to all necessary information. PURPLE DRAGON demonstratedfully <strong>the</strong> merit of <strong>the</strong> surveillance concept.SILVER BAYONET<strong>The</strong> first special COMSEC study involved <strong>the</strong> Army's SILVERBAYONET operation of late 1965. In <strong>the</strong> fall of that year <strong>the</strong> NorthVietnamese 325th Division entered South Vietnam and attacked <strong>the</strong>U.S. Special Forces Camp at Plei Me on 19-20 October. <strong>The</strong> 1st CavalryDivision, launching a relief and pursuit operation called SILVERBA YONET against two regiments of <strong>the</strong> 325th Division, engaged <strong>the</strong>enemy in <strong>the</strong> Ia Drang river valley near <strong>the</strong> Chu Pong Massif, very closeto <strong>the</strong> Cambodian border. As <strong>the</strong> engagement developed, <strong>the</strong> NorthVietnamese Army forces turned out to be larger than anticipated and, incontrast to <strong>the</strong> Viet Congs normal casual attire, were wearing militaryuniforms. <strong>The</strong> enemy fought tenaciously and, in contrast to most VietCong actions, held its ground. Between 16 and 24 November, <strong>the</strong>North Vietnamese forces introduced a third regiment and succeeded indrawing a task force from <strong>the</strong> 1st Cavalry Division's 3d Brigade into ahammer-and-anvil ambush. U.S. losses were heavy. Were it not for U.S.air support, including tactical employment of B-52 aircraft from Guam,and for <strong>the</strong> 1st Cavalry'S air mobility, <strong>the</strong> outcome might well have beena U.S. disaster. <strong>The</strong> majority of. <strong>the</strong> U.S. losses during <strong>the</strong> operation-326killed and 602 wounded in action-s-were inflicted in <strong>the</strong>2-day period of <strong>the</strong> ambush. Postoperations studies showed that <strong>the</strong>North Vietnamese were prepared for <strong>the</strong> battle with supply dumps, ahospital, and a rest, recuperation, and replacement camp just across <strong>the</strong>border in Cambodia.TOP 8BCRET UMBRAnOFORn
TOP SECRET UltfBR1"NOFORHCOMSEC SURVEILLANCE 91During SILVER BAYONET <strong>the</strong> 371st ASA Company and additionalASA COMSEC units gave <strong>the</strong> l sr Cavalry Division limited monitoringsupport, but <strong>the</strong> 371 st was unable to deploy its COMSEC personnel and.equipment with <strong>the</strong> division when it originally moved out because <strong>the</strong>company could not get air transportation. On 23 November, whenSILVER BAYONET was almost over, one COMSEC position diddeploy to <strong>the</strong> forward Division Tactical Operations Center (DTOC) atPleiku, where it monitored 18 to 24 hours a day for two days. <strong>The</strong>position <strong>the</strong>n moved back as <strong>the</strong> DTOC returned to its base camp at AnKhe in Binh Dinh Province. Thus <strong>the</strong> volume of traffic from close-inmonitoring was small in comparison with <strong>the</strong> material actually sent. Inaddition to <strong>the</strong> two days at <strong>the</strong> divisional center, for <strong>the</strong> entire period of<strong>the</strong> engagement o<strong>the</strong>r COMSEC personnel monitored <strong>the</strong> division'sradiotelephone communications from <strong>the</strong> base camp at An Khe, fromwhich <strong>the</strong> ASA specialists could hear only one side of <strong>the</strong> conversationbecause of <strong>the</strong> two-channel send-receive techniques <strong>the</strong> divisionemployed.For its communications, <strong>the</strong> 1st Cavalry Division had <strong>the</strong> on-lineKW-7 with AN/MRC-95 radios to secure teletype communicationsbetween battalion, brigade, and division tactical operations centers. OfflineKL-7 equipment" was at <strong>the</strong> division and lower echelons down tocompany. <strong>The</strong> division had AN/VRC-47 and AN/PRC-25 radios forradiotelephone communications. On <strong>the</strong>se, all traffic went out in plaintext unless encrypted in <strong>the</strong> manual systems available. <strong>The</strong> division didmake some use of an operations code, a numerical code, a map coordinatecode, and an au<strong>the</strong>ntication system of KAG-24.Monitoring of 1st Cavalry Division communications showed that <strong>the</strong>division did not make full use of <strong>the</strong> cryptomaterials it had at hand, nordid it exercise discretion in what it sent out in clear language. Although<strong>the</strong> division had secure KL-7 equipment, records show that <strong>the</strong>cavalrymen did not use it during this period, nor did <strong>the</strong>y use manualsystems to good effect. Commenting on SILVER BAYONET, one ASAofficer unofficially stated that he did not think any codes were used after"<strong>The</strong> KL-7 equipment provides much faster encryption and decryption of normal textthan do manual codes. Normally, if a communicator were going to encrypt at all, hewould select <strong>the</strong> KL-7 ra<strong>the</strong>r than a manual code.TOP SECRET U:MBRlt~mfOR~I
TOP SECRET UMBRAHOfORHWORKING AGAINST THE TIDEKL-7 Off-line Cryptographic Equipment (center), which Cavalrymendid not use in SILVER BAYONET.<strong>the</strong> first shot was fired. * ASA noted in a later official assessment,however, that <strong>the</strong> KW-7 on-line equipment was used to full advantage.But, even here, study of <strong>the</strong> KW-7 traffic for <strong>the</strong> period did not reveal<strong>the</strong> significant traffic volume peaks to be expected in an operation of <strong>the</strong>scope of SILVER BAYaNEy. Thus some question arises as to whe<strong>the</strong>ror not <strong>the</strong> on-line equipment was used to maximum advantage.Since KL-7's were not used for intrabattalion and lower echeloncommunications, <strong>the</strong>se had to be encrypted by manual systems, many ofwhich were cryptographically insecure, being of local construction andnot authorized by ASA or NSA.*Maj. Gen. John R. Deane, Jr., who held command positions in South Vietnam in1966 and 1967, made <strong>the</strong> following related statement on <strong>the</strong> use of manual systems:"We made use of <strong>the</strong> codes and COMSEC equipment available to encode operationalmessages, plans and preparation in advance of forthcoming operations, although, once inaction, we used voice radio largely without formal codes to gain reaction time. We usedconvenience codes and coded location references, but generally, <strong>the</strong> use of <strong>the</strong> KACpencil-and-paper OPCODES took too long for tactical requirements."TOP SECRET UMBRANOFORN
TOP SECRET UMBRA140fiORI4COMSEC SURVEILLANCE 93A 10 1st Security Detachment COMSEC study of communicationsmonitored just before, during, and just after SILVER BAYONET gave alarge number of instances in which sensitive information passed in <strong>the</strong>.dear and in which o<strong>the</strong>r insecure practices abounded. <strong>The</strong> study analyzedSIL VER BAYONET communications for three periods. During <strong>the</strong> firstperiod, 1-23 October, ASA units monitored 10,902 transmissions inthree types of communication: radiotelephone, radioteletype, and CWo<strong>The</strong>se revealed a high rate of disclosures of classified information such asU.S. identifications of enemy locations, frequency allocations, plans,t>perations, logistical information, and classified equipment capabilities.Communicators did not use au<strong>the</strong>ntication even though such systemswere available. <strong>The</strong>re were many incidents, for example, of operatorsaccepting plain language cancellations of spot reports and of establishinginitial communications contact without offering or presenting a challengefor station or message au<strong>the</strong>ntication. l st Cavalry Division units did notchange frequencies and call words, and communicators at all echelonsappeared to have little knowledge of which types of information wouldaid <strong>the</strong> enemy.During <strong>the</strong> second period, 24 October-20 November, <strong>the</strong> ASAspecialists monitored 28,023 radiotelephone transmissions and observedagain many disclosures of classified information, including troopmovements and friendly locations, compromises of call words andfrequencies, and failure to use prescribed au<strong>the</strong>ntication procedures. Inone very serious case, a U.S. operator was requested to transmit <strong>the</strong>locations of all his units and to make contact with his South Vietnamesecounterpart and ask him to do <strong>the</strong> same. <strong>The</strong> exact location of thatcommand and three subordinate units went out in an unauthorized,insecure map coordinate code commonly used throughout <strong>the</strong> division.<strong>The</strong> operator had given <strong>the</strong> requested information without a challengefor au<strong>the</strong>ntication. Within 20 minutes <strong>the</strong> ASA COMSEC element,without <strong>the</strong> use of collateral information, deciphered <strong>the</strong> coordinates. Ingeneral, <strong>the</strong> COMSEC weaknesses in <strong>the</strong> second period of monitoringwere much <strong>the</strong> same as those of <strong>the</strong> first period. COMSEC reports for <strong>the</strong>first period had no significant effect on communications practices.In <strong>the</strong> third period of monitoring, 21 November-20 December, ASAunits collected 35,000 radiotelephone transmissions. Analysis of <strong>the</strong>seshowed only a marginal improvement, though <strong>the</strong> division units were no
'TOP Sr:CRr:'T UMBRAHOfORH94 WORKING AGAINST THE TIDElonger in heavy combat. Au<strong>the</strong>ntication was used more frequently, andcommunicators and commanders appeared to be more aware of <strong>the</strong> needfor COMSEC but, as in <strong>the</strong> first two periods, classified information on .friendly locations, plans, and operations still appeared in unsecuredcommunications. During this period it was pointed out to <strong>the</strong> divisionthat <strong>the</strong>re were insufficient callword assignments to <strong>the</strong> division's radiostations, which resulted in <strong>the</strong> compromise or linking of <strong>the</strong> call words,nets, and frequencies in use. Also during <strong>the</strong> period, an unauthorizedoperations code appeared, as did an unauthorized version of a mapcoordinate code. As an interim corrective measure, ASA advised <strong>the</strong>division to use KAG-21 codes for map coordinates until such time as <strong>the</strong>KAC-j, an NSA-produced code for encrypting numerals and forau<strong>the</strong>ntication, became available to <strong>the</strong> division.<strong>The</strong> Ia Drang battle received wide attention in <strong>the</strong> U.S. press. Within<strong>the</strong> cryptologic community-at ASA's Washington headquartersespecially-SILVER BAYONET brought about a searching review of<strong>the</strong> status of COMSEC in Army tactical units. Generally, COMSECanalysts recognized that deficiencies observed in SIL VER BAYONETwere not unique to <strong>the</strong> 1st Cavalry Division but were, with variations,prevalent throughout Army tactical units.SILVER BAYONET dramatically underscored <strong>the</strong> dangers inherentin unsecured voice communications and <strong>the</strong> already recognized need forgetting <strong>the</strong> KY-8 ciphony equipment distributed. SILVER BAYONETmonitoring undoubtedly contributed to <strong>the</strong> JCS decision that all availableKY -8 equipment would be sent to Vietnam.In addition to those improvements in 1st Cavalry Divisioncommunications noted, actions were taken some weeks later to achievelong-range improvement. On 31 December ASA reviewed <strong>the</strong>cryptoholdings of <strong>the</strong> 1st Cavalry Division to determine if any shortage ofcrypto-equipment or keying material existed. ASA did not find anyshortages for <strong>the</strong> period of SILVER BAYONET itself, except that oneKW- 7 was not operational. <strong>The</strong> division held 90 KW-7'sand 31KL-7' s. By March 1966 ASA Headquarters was able to report to NSAthat <strong>the</strong> division no longer used <strong>the</strong> "very insecure alphabetical gridreference code." ASA also reported that <strong>the</strong> division was using'TOP Sr:CRr:'T UMBRAfWfORfq-
'fOil :5ECRE'f UMBRAnOrORnCOMSEC SURVEILLANCE 95au<strong>the</strong>ntication more frequently, although still not to <strong>the</strong> extent desired.About <strong>the</strong> same time, ASA began producing, in coordination with <strong>the</strong> l stCavalry Division, a new numeral and au<strong>the</strong>ntication system combiningSystem 3 of KAC-24 and System VIII of KAC-21. <strong>The</strong> 1st CavalryDivision put <strong>the</strong> new system, KAC-Q, into use after NSA approved it.ASA also sent <strong>the</strong> division a number of authorized codes. <strong>The</strong>se included400 copies of <strong>the</strong> KAC-F segmented tactical operations code (96 editionsof <strong>the</strong> code shipped on 12 January 1966 and later shipsments made toallow an 8-month supply) and 1,000 copies of <strong>the</strong> KAC-J seriescombination numerical code and au<strong>the</strong>ntication system (shipped for <strong>the</strong>division requirements on 6 December 1965 with a total of 32 editionsper month, allowing for daily supersession). ASA also sent a total of 36KY-8 ciphony sets (for arrival by 15 January 1966). ASA recognized arequirement from <strong>the</strong> division for a total of 82 ciphony sets. Beingassigned priority, <strong>the</strong> 1st Cavalry Division was <strong>the</strong> first tactical commandin South Vietnam to receive <strong>the</strong>se. On 3 March 1966, <strong>the</strong> ASAHeadquarters SIGSEC Division, in a briefing to NSA COMSECpersonnel on <strong>the</strong> status of Army tactical COMSEC in Vietnam, reviewedmany of <strong>the</strong> corrective steps taken, centering attention on <strong>the</strong> 1st CavalryDivision and SILVER BAYONET. Documenting its facts withmonitored findings, <strong>the</strong> SIGSEC Division ended with <strong>the</strong> statement that<strong>the</strong> COMSEC status of U.S. Army units in Vietnam was "pitifully poor."Thus, <strong>the</strong> monitoring and analysis during SILVER BAYONETrevealed many deficiencies. <strong>The</strong> analytic findings were a significant,praiseworthy achievement but, for those acquainted with <strong>the</strong>n prevailingArmy communications practices, <strong>the</strong> findings should not have beensurprising. Never<strong>the</strong>less, partially as a result of timing and <strong>the</strong> U.S.reaction to this major engagement, <strong>the</strong> monitored results were very usefulat <strong>the</strong> tactical level and at all echelons of <strong>the</strong> cryptologic community.Within COMSEC circles, <strong>the</strong> Army's COMSEC practices received widepublicity. Although major improvement in <strong>the</strong> reduction of insecuritieswas to await arrival of KY-8 equipment, SILVER BAYONET arouseda general feeling in those controlling U.S. COMSEC that something mustbe done. It was obvious to <strong>the</strong> COMSEC community that poor U.S.COMSEC practices were one of <strong>the</strong> causes for <strong>the</strong> enemy success at IaDrang.TOP SBERBT UMBRAnOrORPq
TOF :5fKRnT UMBRA96fqOFORHWORKING AGAINST THE TIDEGuamIn <strong>the</strong> fall of 1965 and in early 1966, <strong>the</strong> Navy and Air Force.undertook a major COMSEC study of communications being passed bymilitary installations on <strong>the</strong> island of Guam in <strong>the</strong> Mariana Islands. NSAhelped <strong>the</strong> Navy and Air Force in that part of <strong>the</strong> study dealing withcompromising emanations (TEMPEST). In all, more thanD=OMSECtrainedpeople participated. <strong>The</strong> objective was to discover communicationsdeficiencies that might be <strong>the</strong> cause of enemy. foreknowledgeof SAC B-52 strikes in Vietnam and <strong>the</strong>n to make appropriatechanges in communications practices. A more narrow objective was<strong>the</strong> determination of what intelligence, o<strong>the</strong>r than that from visualobservation, might be available to <strong>the</strong> Soviet SIGINT trawlerson regular patrol just beyond <strong>the</strong> 3-mile limit off of Apra, <strong>the</strong> majorharbor of Guam. <strong>The</strong> Soviet SIGINT vessel lzmeritel, or ano<strong>the</strong>r trawler,had been on station continuously in <strong>the</strong>se waters since late November1964. During much of this period <strong>the</strong> USS Proteus, a nuclear submarinetender, was in <strong>the</strong> harbor and may have been of interest to <strong>the</strong> Russians.Guam served as a key communications center for much of <strong>the</strong> Navy'soperations in Sou<strong>the</strong>ast Asia and during <strong>the</strong> early years of <strong>the</strong> war was<strong>the</strong> only staging area for SAC B-52 bombing flights over Vietnam. <strong>The</strong>island's small size made it relatively easy to study <strong>the</strong> totalcommunications environment. In contrast to several previous COMSECsurveys concentrating only on monitoring and analysis of plaintextcommunications, analysts during this study also. inspected encryptedcommunications in order to evaluate <strong>the</strong> total communications withregard to space radiation, conduction of intelligence-bearing signals onpower and signal lines, and <strong>the</strong> unintended coupling of signals throughinadequate attention to Red/<strong>Black</strong> criteria.* <strong>The</strong> analysts did not testthrough cryptanalysis <strong>the</strong> security of encrypted traffic.AFSS, NAVSECGRU, and NSA participants in <strong>the</strong> study coordinated<strong>the</strong>ir work. In keeping with <strong>the</strong> requirement to study all military-relatedcommunications on Guam, an AFSS mobile detachment examined Armyelements <strong>the</strong>re, especially those of <strong>the</strong> 515th Army Ordnance Company*Red/<strong>Black</strong> criteria designate types of equiprnentv . systems, and areas suitablefor processing ofclassified information (Red) and not suitable (<strong>Black</strong>).TOP SECRET UfffBRA HOFORH (b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
'TOil SnCltE'T UMBRAHOI'ORHCOMSEC SURVEILLANCE 97Soviet Trawler lzmeritel Off Apra, Guam, 1966and <strong>the</strong> Strategic Communications ionospheric scatter facilities. In itsreview of Army communications, <strong>the</strong> AFSS detachment noted that 15channels of <strong>the</strong> ionospheric scatter facility were passing traffic inencrypted form and one, carrying unclassified NASA traffic, was in cleartext. <strong>The</strong>se and o<strong>the</strong>r Army communications, <strong>the</strong> major part of whichpassed over Navy channels, appeared satisfactory. Primary focus of<strong>the</strong> study would be on Navy and Air Force communications.Naval CommunicationsCoordinating with <strong>the</strong> AFSS mobile detachment on Guam, <strong>the</strong> Navy'sCOMSEC component on Guam, COMSEC 701, conducted a 6-weeksurvey (l November-lO December 1965) ofinternal and external Guamcircuits. COMSEC 701 assigned thirty men to <strong>the</strong> survey, some of whomcame from o<strong>the</strong>r Navy COMSEC units.In monitoring Navy unclassified communications, COMSEC 701employed three COMSEC single sideband positions and one VHF/UHF'TOr SECRE'T UMBRAHOFORH
"OF gECRE" UMBRANOFORH98 WORKING AGAINST THE TIDEpositron. In addition, COMSEC 701 installed four audio and four DClines connecting COMSEC spaces with <strong>the</strong> Naval CommunicationsStation Guam Circuit Control in order to monitor uncovered microwaveand landline links. In all, <strong>the</strong> COMSEC unit sampled 42 uncoveredcircuits, 30 of which had off-island terminals. Of <strong>the</strong> latter, about adozen were ships and aircraft. *<strong>The</strong> monitoring team found that landline and microwave circuitsyielded budget figures for specific projects, cargo and movement detailsfor various ships, relationships between aircraft squadrons and carriers towhich <strong>the</strong>y were assigned, disposition and posture of tactical combataircraft, and information on special airborne missions in Vietnam.References to ship-to-shore frequencies and antenna bearings, <strong>the</strong>COMSEC unit found, were passing in <strong>the</strong> clear over order wires.Although <strong>the</strong> study called for broad monitoring coverage,radioteletype equipment was in too short supply to cover all links. Tocompensate, NAVSECGRU requested copies of teletype monitor logs.Accurate monitor rolls were often difficult to obtain, since <strong>the</strong>y wereoften edited by communications personnel before <strong>the</strong>y were given to <strong>the</strong>COMSEC unit. COMSEC monitoring gets its best results, of course,when communicators are unaware of <strong>the</strong> monitoring.<strong>The</strong> COMSEC unit found only a few unauthorized communicationspractices that truly weakened transmission security. It discovered severalunnecessary transmissions that could have aided enemy traffic analysisand identified <strong>the</strong> circuits carrying those transmissions. It also turned upmany errors in <strong>the</strong> classification of messages.To improve COMSEC, <strong>the</strong> NAVSECGRU COMSEC unitrecommended that commands located close to <strong>the</strong> naval CommunicationsCenter make more use of couriers instead of depending on uncoveredcommunications; that general use be made of air mail letters ra<strong>the</strong>r thanelectrical communications when practical; and that order wires becovered when appropriate cryptographic equipment became available.<strong>The</strong> COMSEC team observed that alternate covered routes for sensitivetraffic were not <strong>the</strong>n available. <strong>The</strong> only practical countermeasure againstpossible clandestine wire tapping and unauthorized microwavemonitoring appeared to be <strong>the</strong> securing of all circuits."See chart. page ')9. for pertinent links in <strong>the</strong> Guam communications complex.TOP SECRET UMBRANOFORN
TOP SECRET UMBRAHOfORP,COMSEC SURVEILLANCE 99Communications Circuits Monitored in <strong>the</strong> Guam COMSECSurveyCOMSEC 701 also reported in its recommendations that physicalsecurity on Guam lacked proper emphasis. Sensitive naval communicationsactivities needed fences, lights, acoustic conduit seals, positivesecondary disconnect devices for telephones, and tighter control overpublic works maintenance personnel. All telephone lines on Guampassed through <strong>the</strong> Island Central Telephone Exchange, to whichuncleared local and foreign repairmen and operators had access. Amalpractice mentioned in connection with physical security was <strong>the</strong>occasional insecure disposal of unclassified and EFTO messages in aDempster Dumpster along with unclassified trash.In summary, while many physical and communication securityweaknesses identified in <strong>the</strong> Navy's survey had been previously known,COMSEC reindocrrination of personnel was desirable. As a result of <strong>the</strong>survey, COMSEC 701 was to make periodic sample surveys on a smallscale to maintain vigilance over Navy circuits.TOP SECRET UMBRAHOfORH
TOF SECRET UldBRAHOFORH100 WORKING AGAINST THE TIDEAir Force CommunicationsAFSS directed <strong>the</strong> Air Force Special Communications Center (AFSCC)to monitor and analyze <strong>the</strong> transmissions of SACs 3d Air Division,Andersen Air Force Base, Guam, beginning on 30 October 1965.AFSCCs equipment capability permitted only two VHF, three UHF, andsix telephone links to be monitored at anyone time. During <strong>the</strong>monitoring, which lasted through 30 November, <strong>the</strong> specialists alsocovered two common user and fourteen dedicated telephone circuits. Alltoge<strong>the</strong>r, <strong>the</strong> AFSCC unit examined VHF/UHF radio usage of fourteenAir Force elements.TOP SECRET UMBRAHOfOORfq
COMSEC SURVEILLANCE'fOP SECRE'f UMBRAHOfOftHWIAntenna Field at <strong>the</strong> Naval Radio Station, Barrigada<strong>The</strong> monitors uncovered a large number of COMSEC malpracticesand forwarded 25 transmission security message reports. A summaryreport stated that <strong>the</strong> operation had disclosed "considerable informationon <strong>the</strong> tactics and procedures employed by <strong>the</strong> ARC LIGHT B-52Bomber Force as well as <strong>the</strong> planning and operational support necessaryfor <strong>the</strong> conduct of <strong>the</strong> bombing raids on selected targets in RVN."<strong>The</strong> monitors gained a clear picture of launch times for B-52 strikesfrom (1) traffic analysis of a prestrike encrypted MACV transmission ofa TOP SECRET (FLASH) message to <strong>the</strong> Strategic Air Command(SAC), CINCPAC, JCS, 3d Air Division, and possibly <strong>the</strong> Joint StrategicTarget Planning Staff; (2) voluminous cleartext transmissions by aircraftand munitions maintenance personnel on VHF radio nets approximatelyan hour before launch time, including identification of launch aircraft bytail numbers with statements such as "a goer must be ready by 0900";(3) cleartext communications of a 4242d Strategic Wing plane toAndersen Air Force Base, Kadena Air Base, and Saigon during a wea<strong>the</strong>rscouting mission of <strong>the</strong> SAC air refueling area some 20 hours beforeTOP 8ECltET UMBRAHOfORH
102 WORKING AGAINST THE TIDEbombers were due over target; and (4) cleartext transmissions on radiocircuits just before mission launch informing aircraft coming intoAndersen AFB that <strong>the</strong> base would be closed for approximately 45minutes for" high priority" traffic.<strong>The</strong> monitors also turned up o<strong>the</strong>r sensitive information such as <strong>the</strong>Strategic Air Command's consideration of a proposal to permit ARCLIGHT B-52's to perform low-altitude optical bombing and <strong>the</strong> specificidentification of equipment to be installed to make this possible, as well asSACs plans to introduce a B-52D aircraft into <strong>the</strong> ARC LIGHTprogram so as to increase <strong>the</strong> internal bomb load capacity.<strong>The</strong>re were few instances where a sensitive item of information cameonly from one conversation. More frequently, disclosure of a particularitem resulted from numerous attempts to talk around classifiedinformation over unsecured communications channels. This practice.prevailed in long-haul communications such as those from Guam toOkinawa, Hawaii, and SAC headquarters in Nebraska as well as in onbasechannels.Even before <strong>the</strong> AFSCC survey was completed <strong>the</strong> Air Force, on 10November 1965, began to use new procedures on <strong>the</strong> munitionsmaintenance net to eliminate from radio communications <strong>the</strong> use ofaircraft tail numbers, <strong>the</strong> upload start and completion times, and personalnames. Later tests showed <strong>the</strong> procedures were effective in eliminatingthis information, which had allowed continuity on <strong>the</strong> B-52 uploadoperations, as well as specifying <strong>the</strong> aircraft to participate in <strong>the</strong> missions.Similar changes in procedures were recommended for <strong>the</strong> aircraft maintenancenetwork.<strong>The</strong> Air Force had o<strong>the</strong>r COMSEC recommendations to consider aswell: (l) making secure voice communications facilities available to allechelons to <strong>the</strong> maximum; (2) providing on-base approved circuits forcoordinating classified activities when voice security equipment was notavailable; (3) using secure teletype (classified or unclassified EFTO)messages when possible in lieu of voice communications; and (4)establishing procedures for <strong>the</strong> use of operational codes to pass recurringreports (wea<strong>the</strong>r, aircraft departures, and so forth) for which securecommunications were not available.TOP SECRET UMBRAPfOFORH
TOP SECRET UMBRAPfOFORUCOMSEC SURVEILLANCE 103In summary, <strong>the</strong> Air Force had found a number of insecurecommunications practices that made vital intelligence available to <strong>the</strong>enemy. While <strong>the</strong> Air Force was unable to correct all <strong>the</strong> deficiencies thatwere brought to light, it did correct many of <strong>the</strong>m. In one of thoseextremely rare occurrences, <strong>the</strong> enemy confirmed <strong>the</strong> effectiveness of atleast one of <strong>the</strong> COMSEC corrective actions taken as a result of <strong>the</strong>survey. Immediately after being informed of <strong>the</strong> vulnerability of <strong>the</strong>wea<strong>the</strong>r report from <strong>the</strong> SAC wea<strong>the</strong>r scout aircraft, SAC directed thatsuch transmissions cease and that <strong>the</strong> wea<strong>the</strong>r reports be filed in securecommunications channels after <strong>the</strong> aircraft returned from its mission.Some time later, a defector from one of <strong>the</strong> Soviet SIGINT trawlersreported that one of <strong>the</strong> most reliable advance indicators of B-52 strikeshad been <strong>the</strong> SAC wea<strong>the</strong>r scout reports; he added that <strong>the</strong>se reports haddisappeared in November 1965 and, after that, such extensive priorknowledge of <strong>the</strong> B-52 strikes had not been available to <strong>the</strong> Russians.NSA TEMPEST TestsAt <strong>the</strong> request of <strong>the</strong> Chief of Naval Operations and <strong>the</strong> Chief of Staffof <strong>the</strong> U.S. Air Force, an NSA team conducted several phases of an onsiteTEMPEST test between 30 January and 18 February 1966. (Navyand Air Force units participated in o<strong>the</strong>r phases of <strong>the</strong> survey.) <strong>The</strong> NSAteam was to monitor selected microwave circuits and HF circuits andtest <strong>the</strong>ir vulnerability, with particular emphasis on cipher-signalanomalies susceptible to exploitation. Defined as electrical irregularitiesduring encryption of signals that result from modulation, coupling, oro<strong>the</strong>r cause, <strong>the</strong> anomalies might permit an alert enemy to recover plainlanguage or o<strong>the</strong>r data useful to him.<strong>The</strong> NSA team worked aboard <strong>the</strong> USS Charles Berry in an S-44-typeshelter containing equipment for monitoring, recording, demodulating,demultiplexing, and analyzing signals in <strong>the</strong> MF-SHF range (500KHz-I0 GHz). While maintaining a watch over communications in <strong>the</strong>VHF/UHF range, <strong>the</strong> team also concentrated for four days onmicrowave links. <strong>The</strong> Charles Berry was stationed near <strong>the</strong> SovietSIG INT trawler off Apra harbor for part of <strong>the</strong> test and <strong>the</strong>n worked itsway around <strong>the</strong> island for four days, staying three miles offshore.TOP SECRKf' UMBRAfmt
TOP SECRET UMBRAPifOFORN104 WORKING AGAINST THE TIDEDuring this time, <strong>the</strong> NSA team obtained over 77 ,000 feet of magnetictape recordings.*While in <strong>the</strong> vicinity of <strong>the</strong> trawler, <strong>the</strong> team heard no microwavesignals. Off <strong>the</strong> north end of <strong>the</strong> island, however, it was able to hearthree links when <strong>the</strong> ship's roll brought <strong>the</strong> team's antennas into directline with <strong>the</strong> transmitters. Under laboratory conditions, NSA laterevaluated HF communications intercepted by a NAVSECGRU team alsoon board <strong>the</strong> ship and found that no signals could be definitely identifiedas compromising cipher-signal anomalies. While making <strong>the</strong> shipboardsurvey, <strong>the</strong> NSA team noted that Air Force ground maintenance crews ofAndersen Air Force Base could be heard from any point around <strong>the</strong>island. <strong>The</strong> communications were in plain language, and <strong>the</strong> NSAanalysts could thus predict B-52 mission launchings"at least two hoursprior to take-off."In addition to <strong>the</strong> operations aboard <strong>the</strong> Charles Berry, <strong>the</strong> NSA teamtested on land, monitoring <strong>the</strong> Finegayan-Barrigada microwave link from<strong>the</strong> naval radio station, recording each active link for later analysis. <strong>The</strong>team discovered that a high ambient noise level was modulating <strong>the</strong>microwave signal and masking normal anomalies, and <strong>the</strong>refore it couldnot definitely identify any compromising cipher-signal anomalies. <strong>The</strong>team also tested with negative results <strong>the</strong> communications of <strong>the</strong>Commander, Naval Forces, Marianas station on Nimitz Hill, <strong>the</strong> navalstation at Apra harbor, and <strong>the</strong> naval air station at Agana.Using a land position, <strong>the</strong> NSA team inspected <strong>the</strong> plain languagevoice circuits of <strong>the</strong> Air Force 1958th Communications Squadrontransmitter site at Barrigada. <strong>The</strong> voice microphones for <strong>the</strong>se circuitsoccupied <strong>the</strong> same spaces as teletypewriters, which were processingclassified plaintext traffic, and it was suspected that audio-acoustic signalswere present on <strong>the</strong> voice circuits. <strong>The</strong> NSA team failed to achieveconclusive results because of intercept limitations.*National Security Agency L:]A/1alytic Studies, Special Report No.4, sub:COMSEC Survey Guam, dated 23 June 1966;SECRJ~T.(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36'fOP SECRE'f UMBRAHOFORH'
'fOil :3ECRE'f UMBRAHOfORHCOMSEC SURVEILLANCE 105NSA's TEMPEST Shelter and Power Generator Used in <strong>the</strong> GuamStudyNavy TEMPEST Tests<strong>The</strong> U.S. Naval Security Engineering Facility undertook <strong>the</strong> Navy'sTEMPEST survey and prepared a number of technical reports in which itmade recommendations for improvements.At <strong>the</strong> NAVSECGRU headquarters at Finegayan <strong>the</strong> Navy team, <strong>the</strong> use of I
TOP SECRET UMBRAHorORH106 WORKING AGAINST THE TIDEfilters, better grounding, and filters on telephone lines leavingcommunications spaces.*At <strong>the</strong> Communications Center and <strong>the</strong> 0 erations Control Center of<strong>the</strong> Naval Forces, Marianas, <strong>the</strong> team<strong>The</strong>~t-ea-m--no-t~e""T'"t""a~t~tTh-e"""To-o-r-s""':'t-o""':'t-w-o-co-p-p-e-r--s"'ih""'i...,eli""di'"e'd-r-o-o-m-s...,.h-o-u""':si-n-g-c ....... ryptoequipmentwere always open./'-- ...IIMarines guarded inside <strong>the</strong> buildings, but <strong>the</strong>re was no physicalsecurity such as a fence outside <strong>the</strong> buildings. <strong>The</strong> team recommendedthat a security fence (preferably patrolled) be installed a minimum offifteen feet from <strong>the</strong> buildings\ -...,_-..., ...,..At <strong>the</strong> Naval Communications Station at Finegayan.]<strong>The</strong> Naval Air Communications Facility at Agana, neatly completed,was being constructed in accordance with DCAC C175-6A installationcriteria. From a TEMPEST point of view, <strong>the</strong> facility was/<strong>the</strong>most secure"<strong>The</strong> sources for <strong>the</strong> Navy TEMPEST tests are V.S. Naval/Security EngineeringReports: No. 131O-0025!RAS:va, Serial 310-0045, sub: TEMPEST Survey of NavalSecurity Guam, M.l. (D), 21 February 1966, SECRET; Noi 1,1O-0025!DAS:va,Serial 310-0039, sub: TEMPEST Survey of Communications Spaces-at V.S. NavalStation. Guam (V), 10 February 1966, SECRET; No. 131O-0025!RAS:va, Serial 3100046. subj: TEMPEST Survey of Commander, Naval Forces, M.I., CommunicationsSpaces (V), 21 February 1966, SECRET; No. 131O-00251RAS:.jp, Serial 310-0085.sub: TEMPEST Survey of Naval Communications Station.iFinegavan, Guam, M.I., 27April 1966, SECRET; No. 131O-0025!RAS:va, Serial/ 310~0047, sub: TEMPESTSurvey of Naval Air Station Communication Spaces, Guam. M.l. (V). 21 February1966, SECRET; and No. 1310-0025!DAS:eg, .Serial 31O-TR-007!67, sub:TEMPEST Survey of VSS PROTEVS Secure Cornrriunications Systems (V), 16February 1967, SECRET.TOP SECRET UMBRA tWFORH (b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAnOFORnCOMSEC SURVEILLANCE 107of <strong>the</strong> facilities surveyed on Guam. However, <strong>the</strong> team did recommendthat filters be placed on <strong>the</strong> KW-26 equipment.<strong>The</strong> team also surveyed <strong>the</strong> secure communications systems of <strong>the</strong> USS .Proteus while it was tied up to a pier in Apra harbor. <strong>The</strong> ship's twoactive KW-26 and its AUTODIN (KG-13) circuits were connected toland lines,\\1...-- _While <strong>the</strong> various reports show that not all was secure fromintelligence exploitation, <strong>the</strong> reasonable expectation of enemyexploitation was, in most cases, ra<strong>the</strong>r remote. From a COMSEC point ofview, <strong>the</strong> Navy TEMPEST survey team's operations were quitesuccessful.Air Force TEMPEST TestsAs <strong>the</strong>ir part in <strong>the</strong> TEMPEST survey <strong>the</strong> U.S. Air Force SecurityService, during November 1965, tested Air Force communicationsfacilities on Guam for compliance with "<strong>the</strong> intent of Federal StandardNo. 222," <strong>the</strong> TEMPEST specifications for equipment usage./AFSStested a frequency range from 15 kilohertz to 1 gigahertz, documentingits findings and making specific recommendations in three report£. * Noneof <strong>the</strong> facilities tested was completely free of TEMPEST problems. AllService communications centers tended, with few exceptions, to containsome hazards to security as a result of equipment design and <strong>the</strong> methodof installation. <strong>The</strong> Air Force Guam surveys helped determine' specifically<strong>the</strong> extent of <strong>the</strong>se hazards.AFSS surveyed <strong>the</strong> facilities of <strong>the</strong> 3d Air Division (SAC), including<strong>the</strong> communications centers of <strong>the</strong> 27th CommunicationsSquadron and<strong>the</strong> Special Security Office, as well as <strong>the</strong> electronic data processingequipment of <strong>the</strong> Data Services Division.'·USAFSS TEMPEST Test Reports: 1958th Communications Squadron (AFCS),Andersen AFB, Project 65-2; and 3d Air Division, Andersen AFB, Project 65-2; AirForce Systems Command, Operating Location 10. All three dated November 1965 andmarked SECRET.(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'TOF SECItET UMBItAHOfOItH108 WORKING AGAINST THE TIDEAFSS also examined <strong>the</strong> facilities of <strong>the</strong> 1958th CommunicationsSquadron at Andersen, including <strong>the</strong> PACAF Communications Networkrelay center, ano<strong>the</strong>r relay communications center, and a terminallocated in Building T -2500 Although <strong>the</strong> last named showed noelectric field radiation, <strong>the</strong>l/IAt <strong>the</strong> PACAF Communications Network relavcenter, <strong>the</strong> I• All fig"," gi"n below for secure 'On" are for radii.'TOF SECltE'T UMBItAfWfOltf4pi(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRANOFORNCOMSEC SURVEILLANCE 109:'J)'While microwave transmissrons in~--~----~-----"""":""plain language could sometimes be heard at <strong>the</strong> three-mile limit,<strong>the</strong>y were not intercepted in <strong>the</strong> location customarily occupied by<strong>the</strong> Soviet SIGINTtrawler. Although by <strong>the</strong> end of 1967 TEMPESTcorrective measures, consistent with funding and equipment limitations,were made for all Navy facilities on <strong>the</strong> island, <strong>the</strong> rehabilitation of <strong>the</strong>Naval Communications Station GuamL...~~--------'wasnot completed untilearly 1969. <strong>The</strong> Guam findings also gave added incentive to generalcorrective measures in Air Force facilities.MARKETT/MEDuring <strong>the</strong> first three months of 1966, Navy COMSEC elementsundertook a major study of communications of <strong>the</strong> U.S.-Vietnam TaskForce 115 MARKET TIME operation.* With headquarters in Saigonand composed of both U.S. and RVN forces, <strong>the</strong> task force .conductedsurveillance, visit and search, naval gunfire, psychological warfare, and'""<strong>The</strong> primary sources for this MARKET TIME account were .a report of <strong>the</strong>Commanding Officer, U.S. Naval Security Group Activity Karniseya, Japan, and areport of <strong>the</strong> Officer in Charge, Communications Security Survey Team, Saigon. Bothreports were enclosures to J-6 Memorandum for DIRNsAi and o<strong>the</strong>rs, sub:Communications Security Survey of MARKET TIME .Commurucations, SerialJ-6M-128-66, dated 27 May 1966, CONFIDENTIAL. /A Navy publication,"Communications Security (COMSEC) Traffic Analysis Report for First Quarter CY.1966," is an excellent source for identifying <strong>the</strong> types of MARKET TIME intelligenceinformation detected through monitoring.TOP SEC'!'tET UMBRANOFORPri(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
"fOP SEClU:"f UMBRAUOFORU110 WORKING AGAINST THE TIDEo<strong>the</strong>r operations to secure <strong>the</strong> coastal regions and major rivers. TaskForce 115 controlled its units through coastal surveillance centers at DaNang, Qui Nhon, Nha Trang, Vung Tau, and An Thoi. Operationsextended along <strong>the</strong> coast of South Vietnam from <strong>the</strong> 17th parallel to <strong>the</strong>Cambodian border in <strong>the</strong> Gulf of Thailand. Since almost all ship-toshoreand ship-to-ship communications were on uncovered voice circuits,<strong>the</strong>y were highly vulnerable to enemy exploitation. <strong>The</strong> enemy mightthus be obtaining intelligence that would allow him to avoid beingintercepted by <strong>the</strong> MARKET TIME forces when he shipped supplies tocommunist forces in South Vietnam.<strong>The</strong> enemy was well aware of <strong>the</strong> intelligence potential in maritimecommunications.'IFor <strong>the</strong> MARKET TIME COMSEC survey, <strong>the</strong> Navy had a teamofficer and one traffic analyst at Saigon; <strong>the</strong> analysis section of <strong>the</strong>Processing and Reporting Center, COMSEC 702, in Kamiseya, Japan;andDmonitoring positions and an analysis section at each of <strong>the</strong>NavyCOMSECunits located in Guam, at Da Nang, at VungTau, onOkinawa, and aboard <strong>the</strong> USS Jamestown. <strong>The</strong> Jamestown monitoredVHF/UHF frequencies and augmented shore station HE/monitoring.COMSEC 703 in <strong>the</strong> Philippines allottedDmonitoring positions andan analysis section. In all, approximatelyOOMSECspecialists wereIdirectly involved in <strong>the</strong> study,TOP SeCReT UMBRApmrORN(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
T'OF SECRET' UMBRAHOFORHCOMSEC SURVEILLANCE 111COMSEC 705 Operations Area, Monkey Mountain<strong>The</strong> COMSEC team officer in Saigon was to ensure <strong>the</strong> closest possibleliaison with <strong>the</strong> MARKET TIME operational commander in compliancewith CINCPAC orders: (l) to determine what traffic must flow duringplanning and actual operations; (2) to apply information regardingcommunications weaknesses and strengths gained by previousmonitoring; (3) to determine what facilities were passing traffic andwhat additional facilities were available; (4) to recommend <strong>the</strong> preferredmeans of passing traffic and <strong>the</strong> best communications procedures andcryptographic aids to employ; (5) to conduct selective monitoring toevaluate recommended changes; and (6) to advise operationalparticipants and make any additional recommendations.<strong>The</strong> COMSEC components were to monitor and analyze MARKETTIME communications and to submit first echelon traffic analysis reportsto <strong>the</strong> Chief, Naval Advisory Group, Saigon-so that he could
TOP SECRET UMBRAHOfORfq-112 WORKING AGAINST THE TIDEimmediately apply important findings to operations-and to <strong>the</strong>COMSEC 702 Processing and Reporting Center. To <strong>the</strong> extent practical,<strong>the</strong> reports sent to Kamiseya went electrically since ordinary mail tookfrom 20 to 30 days in transit and would <strong>the</strong>refore arrive too late to be ofvalue in current operations. <strong>The</strong> COMSEC 702 PRC prepared secondechelon reports based on an analysis of all traffic- both mail andelectrically forwarded-that <strong>the</strong> participating COMSEC componentsmonitored.In this reporting scheme, <strong>the</strong> COMSEC units furnished <strong>the</strong> COMSEC702 PRC with monitoring logs and a narrative of <strong>the</strong> intelligencerecovered concerning <strong>the</strong> specific monitor logs. <strong>The</strong> center <strong>the</strong>n issuedCOMSEC spot reports electrically to any units violating specificcommunication security procedures. On 17 February, <strong>the</strong> commander ofTask Force 115 listed four areas in which disclosures could be serious:pending operations in MARKET TIME, intended movements onMARKET TIME patrols, geographical or grid positions or immediatearea of operauons while underway, and underway replenishment operations.<strong>The</strong> PRC and o<strong>the</strong>r collection and reporting centers were to issuereports when any of <strong>the</strong> above disclosures was observed in MARKETTIME communications. While <strong>the</strong> PRC was unable to produce reportstimely enough to affect current operations, <strong>the</strong> reports did provide usefulinformation for general study of U.S. Navy communications procedures.<strong>The</strong> PRC recommended procedures, based upon <strong>the</strong> MARKET TIMEexperience, that would in <strong>the</strong> future allow more current second echelonreporting. <strong>The</strong>se recommendations included <strong>the</strong> electrical transmission ofall first echelon traffic analysis reports to <strong>the</strong> PRC from which secondechelon reports would be prepared on a weekly basis.<strong>The</strong> MARKET TIME COMSEC analysts found that a wealth ofvitalintelligence was being revealed over communications nets, HF voicecircuits being <strong>the</strong> worst offenders. Just a few days after monitoringstarted, <strong>the</strong> analysts had almost completely recovered Task Force 115'sorder of battle. <strong>The</strong>y were not only able to pinpoint <strong>the</strong> majority of <strong>the</strong>MARKET TIME vessels each day but also to recover patrol patterns andto predict positions hours in advance. All types of sensitive informationwere being passed on uncovered frequencies. Especially detrimental was<strong>the</strong> reporting of ship positions using <strong>the</strong> unsecured UTM gridTOP SECRET UMBRAP
'fOP Sr:CRr:'f UMBRA~mFORHCOMSEC SURVEILLANCE 113coordinates, which not only gave current locations but also identifiedforthcoming operations. Information on naval gunfire support missionswent unprotected in several cases in such a manner as to pinpoint <strong>the</strong>intended target as much as ten hours in advance and to identify <strong>the</strong>location of <strong>the</strong> destroyer scheduled to fire <strong>the</strong> mission. <strong>The</strong> analysts alsomonitored sensitive information on underway replenishment, actionreports, casualties, and <strong>the</strong> arrival and training of new units.<strong>The</strong> compromise of intelligence was so prevalent that during <strong>the</strong> earlyphases of <strong>the</strong> survey a CTF 115 message went to all MARKET TIMEand associated units stating: "CTF 115 receives daily analysis ofMARKET TIME traffic monitored by COMSEC units. <strong>The</strong> scope andaccuracy of <strong>the</strong>se analyses, which are being made by outside observersusing only such information as anyone can obtain by monitoring ourcircuits, is indeed sobering. For example, more detailed informationregarding daily operations is often available from /this/ analysis thanfrom official reports submitted by MARKET TIME units."* <strong>The</strong>message shows not only that <strong>the</strong> COMSEC monitoring teams had done<strong>the</strong>ir work well but also that <strong>the</strong> commander of TF 115 had taken heed.<strong>The</strong> survey drew attention to a variety of COMSEC problems. Mostarose at least in part as a result of MARKET TIME's inherentorganizational complexity and varied communications structures. <strong>The</strong>task force incorporated elements of <strong>the</strong> U.S. Seventh Fleet, variousaviation units, and U.S. Coast Guard and South Vietnamese vessels ofvarious sizes. <strong>The</strong> U.S. vessels ranged in size from destroyers to Swiftboats. Many of <strong>the</strong> participants had limited crypto-equipment, or none atall, and <strong>the</strong>refore had to use low-level manual systems. To acquireadequate communications netting, even <strong>the</strong> better equipped U.S. shipsoften had to use <strong>the</strong> communications modes and systems of <strong>the</strong> morepoorly equipped participants. Thus it was difficult to communicate, letalone to communicate securely.<strong>The</strong> COMSEC team officer at Saigon and <strong>the</strong> Navy's COMSEC 702element in Japan noted <strong>the</strong>se many problems and supported*Commanding Officer, NAVSECGRU Activity Kamiseya report, title: CommunicationsSurvey of MARKET TIME, 18 April 1966.'fOP SECRr:'f UMBRArq'OfORPq1
'TOfl Sf:CRf:'T UMBRArmfORH114 WORKING AGAINST THE TIDErecommendations and actions taken during <strong>the</strong> course of <strong>the</strong> survey.Specific problems and actions taken included:a. Establishment of restrictions on <strong>the</strong> storage and handling ofcryptomaterial was a problem for <strong>the</strong> South Vietnamese and/or smallerU.S. vessels.. b. Codes available for U.s. use (KAC-132 and KAC-138) werenot suited, by vocabulary, for this type of operation. KAC-132 wasrestricted, moreover, to large U.S. vessels. KAC-138, a numeral code,was available to encrypt position coordinates (<strong>the</strong> code was authorized tobe used in this manner, mixing <strong>the</strong> code groups and plain text); however,it was restricted to use for reporting while within sight of land or foreignvessels. ClNC Pacific Fleet lifted <strong>the</strong> restriction on KAC-138. Also,starting on 10 March, with CINC Pacific Fleet approval, U.S.MARKET TIME participants began using KAC-140, an operationscode designed for Vietnam.c. Analysis of traffic encoded in KAC-140, upon its introduction,revealed that many units were habitually using stereotype expressions at<strong>the</strong> beginning and end of encrypted text. For example, many reportsstarted with <strong>the</strong> words, "Contact Report Posit," and it was commonpractice to end with <strong>the</strong> encrypted group for "period." Such practicesweakened <strong>the</strong> security of <strong>the</strong> code and consumed unnecessary manhoursin <strong>the</strong> coding process. COMSEC 702 recommended that all task forceunits ensure that <strong>the</strong>ir communications personnel be "thoroughlyindoctrinated in correct communications procedures and trained with <strong>the</strong>specific equipment that will be used." Such training service could be hadby addressing <strong>the</strong> COMSEC elements at Da Nang and Vung Tau.d. Because of <strong>the</strong> lack of cryptofacilities, especially on-line, it wasoperationally impracticable, and often impossible, for MARKET TIMEunits to establish secure rendezvous positions or submit late requirementsto <strong>the</strong> replenishment ship. As a result, <strong>the</strong> major part of this information,including <strong>the</strong> times of rendezvous and units involved, was being passed inan exploitable manner. It was recommended that CINC Pacific Fleetauthorize encrypted call signs for passing traffic encoded in KAC-132.<strong>The</strong> authority was granted and Commander, Seventh Fleet, establishedinstructions for passing such communications on <strong>the</strong> area underwayreplenishment net.'TOP Sf:CRf:'T UMBRAHOfiORfq
COMSEC SURVEILLANCE 115e. KAC-140 provided <strong>the</strong> first effective code system to protectMARKET TIME operations. However, since its terminology was notextensive enough for detailed fast reporting, <strong>the</strong> survey team officerrecommended that a new code be designed to fulfill MARKET TIMEsurface and air requirements. NSA produced a new code, KAC-183,which came into use later in 1966.Largely as a result of <strong>the</strong> COMSEC actions taken, officials estimatedthat <strong>the</strong> volume of intelligence information subject to compromise onMARKET TIME circuits was reduced by at least 80 percent. Advocationof <strong>the</strong> minimize communications principle and o<strong>the</strong>r COMSECtechniques put forth in COMSEC lectures and training also helped. <strong>The</strong>practice of sending geographic positions with <strong>the</strong> UTM grid given inplain language almost completely disappeared.Changes in <strong>the</strong> Navy's COMSEC organization and procedures alsoresulted. An additional eight persons would service MARKETTIME/GAME WARDEN monitoring and analysis requirements at <strong>the</strong>NAVSECGRU Activity facilities in Kamiseya. <strong>The</strong> Naval AdvisoryGroup, Saigon, staff would make periodic visits to all coastal surveillancecenters and in-port units to discuss COMSEC policies and problems.Upon receipt of <strong>the</strong> Navy MARKET TIME COMSEC surveillancereports, <strong>the</strong> Communications-Electronics Directorate, J-6, of <strong>the</strong> U.S.Joint Staff, commented favorably on <strong>the</strong> operation, characterizing <strong>the</strong>reports as "an exemplary demonstration of what can be accomplished atrelatively low-level tactical echelons with a well-planned and wellexecutedcommunications security operation." NSA also termed <strong>the</strong> study"an exemplary demonstration of <strong>the</strong> effective utilization of COMSECsurveillance resources." **J-6 Memorandum for Director of National Security Agency and o<strong>the</strong>rs, sub:Communications Security Survey of MARKET TIME Communications, SerialJ-6M-128-66, 27 May 1966, CONFIDENTIAL.NSA Memorandum for <strong>the</strong> Director for Communications-Electronics, Joint Staff, sub:Communications Security Survey of MARKET TIME Communications, Serial N1042,21 July 1966, SECRET.'fOF !iECRE'f Ui\fBRAtmfORH
TOP SECRET UMBRAPWrORH116 WORKING AGAINST THE TIDE<strong>The</strong> COMSEC survey improved only U.S. COMSEC. Since SouthVietnamese ships participated in MARKET TIME operations, ideally,<strong>the</strong> survey should have examined COMSEC problems on Vietnamese'circuits, but this was not done. *Improvements in COMSEC as a result of <strong>the</strong> MARKET TIME surveywere not permanent. A Navy COMSEC traffic analysis report forOctober-December 1966 showed that old problems nei<strong>the</strong>r die nor fadeaway:Plain language traffic passed on MARKET TIME circuits continues to revealintelligence information such as: estimated times of arrivals and departures,positions, patrol reliefs and times of relief, operating areas, and current andintended operations.GAME WARDENGAME WARDEN was <strong>the</strong> unclassified name for an extended seriesof naval operations designed to prevent Viet Cong infiltration andresupply across <strong>the</strong> Mekong River Delta and in <strong>the</strong> Rung Sat SpecialZone-<strong>the</strong> major shipping channels to Saigon. In GAME WARDEN<strong>the</strong> U.S. Navy River Patrol Force, toge<strong>the</strong>r with units of <strong>the</strong> RVN Navy,had a mission similar to that of <strong>the</strong> MARKET TIME forces, but with<strong>the</strong> added hazard of being constantly within range of weapons along <strong>the</strong>river banks. <strong>The</strong> patrols were to prevent men, equipment, and food fromreaching Viet Cong strongholds in <strong>the</strong> Central Highlands of SouthVietnam. Task Force 116 units engaged in GAME WARDEN usedsmall craft such as river patrol boats (PBR's), which were served byHF CW/SSB and VHF/UHF voice radio circuits. COMSEC unitsmonitored <strong>the</strong>se circuits from <strong>the</strong> onset ofGAME WARDEN.Two COMSEC teams supported Task Force 116. <strong>The</strong> first wasCOMSEC Team Three, located in <strong>the</strong> Coastal Surveillance Center, VungTau, at <strong>the</strong> mouth of <strong>the</strong> main channel entrance to Saigon. CINC PacificFleet exercised operational control of <strong>the</strong> team, <strong>the</strong> Naval AdvisoryGroup at Saigon providing working spaces, billeting, and messagefacilities and exercising administrative control. Additional administrative*NSAPACREP Vietnam (C) Msg to DIRNSA, F46D-1365, sub: MARKET TIMECOMSEC SurveyJan thru Mar 1966, 120629Z October 1969, CONFIDENTIAL.TOP SECRET UMBRAPWrORH
,ITOP S£ER£T UMBRA~WFORf,COMSEC SURVEILLANCE 117and logistical support came from COMSEC 705 at Da Nang. From <strong>the</strong>time of its activation in February 1966 through <strong>the</strong> end of December1967, COMSEC Team Three operated with six men and a chief pettyofficer.<strong>The</strong> second COMSEC unit assigned to support Task Force 116 wasTeam Four, which began operations on 25 April 1967 from Vinh Long,South Vietnam. Team Four had seven men and a chief petty officer, allon 150 days' temporary assignment.Both COMSEC teams providing support to GAME WARDENperformed two major functions. First, <strong>the</strong>y gave practical and effectiveCOMSEC assistance and guidance to communications operators on allNavy circuits in <strong>the</strong> area; second, <strong>the</strong>y identified communicationsweaknesses and proposed corrective action for all U.S. forces using <strong>the</strong>frequencies that <strong>the</strong>y monitored.Both teams made daily first echelon traffic analysis reports onsignificant items of interest via electrical means to <strong>the</strong> Processing andReporting Center at Karniseya, to <strong>the</strong> commanders of Task Force 116and 117, and to Commander, Naval Forces Vietnam, with informationcopies mailed to <strong>the</strong> Chief of Naval Operations and CINC Pacific Fleet.COMSEC TIMELY (rapid reporting of selected EEFI) and SPOTreports went electrically to appropriate addresses. Each month <strong>the</strong> chiefpetty officer in charge of each team submitted a letter report ofoperationsto CINC Pacific Fleet, with information copies going to Commander,Naval Forces Vietnam, PRC Kamiseya, and o<strong>the</strong>r Navy commands.Also, a TRANSEC report summarizing COMSEC team activities went toCOMSEC 705 at Da Nang for submission to <strong>the</strong> Commander, NavalForces Vietnam, and subsequently to COMUSMACV.Most of <strong>the</strong> naval vessels engaged in GAME WARDEN were smallwith limited communications capabilities. Cryptofacilities were nearlynonexistent, requiring <strong>the</strong> use of low-level code systems for transmittingclassified information. One of <strong>the</strong> communications weaknesses identified,<strong>the</strong>refore, was attributable to <strong>the</strong> lack of an adequate cryptographicsystem for protecting information contained in operational reports.Although some units had <strong>the</strong> KAC-132, it was not suitable because of itslarge size and terminology, and <strong>the</strong> COMSEC teams <strong>the</strong>reforerecommended KAC-140, <strong>the</strong> operations code designed for Vietnam useand approved by CINC Pacific Fleet for use by MARKET TIME andTOP S£ER£T UfdBRA~WfORH- -- --------------------~
TOP SECRET UftlBRAUOfORU118 WORKING AGAINST THE TIDEGAME WARDEN. It was available from COMUSMACV. Not onlydid KAC-140 permit secure transmission of operational reports but it-Iso provided a common cryptochannel among MARKET TIME,GAME WARDEN, USMACV, and USARV units operating in <strong>the</strong>area. COMSEC first echelon traffic analysis reports reflected a significantreduction in <strong>the</strong> availability of intelligence information to <strong>the</strong> monitorsafter KAC-140 came into use. KAC-140 accorded security to <strong>the</strong>secommunications until a new cryptographic system could be devised.KAC-140 was replaced 'on 1 August 1966 by KAC-183, which hadcryptographic features and vocabulary more appropriate to <strong>the</strong>seoperations.Monitoring continued to uncover many instances of specificinformation of direct value to <strong>the</strong> enemy. <strong>The</strong> Chief of Naval Operations'Quarterly Traffic Analysis Report for October-December 1966 gaverepresentative examples of unsecured GAME WARDEN communications:On 12 December PBR "PORPOISE 23" reported that she was aground andwas attempting to free herself. At 23332 <strong>the</strong> PBR advised "BOLD LAD" thatshe saw no hope of getting off until high tide and that she could use a case of CRations. If this PBR had been visually sighted by <strong>the</strong> Viet Cong and <strong>the</strong>y hadreceived <strong>the</strong> previous transmission, <strong>the</strong>y would know that <strong>the</strong> PBR was going tobe vulnerable for several hours.At 0112452 December "SHARK 8" (PBR) observed spotlights on <strong>the</strong> bankof a river and called "MOON RIVER," reporting <strong>the</strong> position as "KVQHX2." At 13142 "MOON RIVER" requested permission from "BOLDLAD" (Army) to fire on coordinates XS 925695, <strong>the</strong>reby linking <strong>the</strong> encodedcoordinates (KVQ HX2) to <strong>the</strong> unencoded positions coordinates, XS 925695.At 0516042 CTE 116.2.1.2 (located at Can Gio) transmitted his 041800H.051800H OPSUM to "MOON RIVER" (Nha Be); <strong>the</strong> OPSUM revealedthat 20 PBRs were used for patrol, 12 from Cat Lo and eight from Can Gio.<strong>The</strong> GAME WARDEN force included <strong>the</strong> following ships: TUTUILA(AGR 4), COMSTOCK, VERNON COUNTY, WESTCHESTERCOUNTY, 3 PACVs, 23 MSBs, 9 MSLs, and at least 92 PBRs.O<strong>the</strong>r communications problems on which Teams Three and Fourworked were <strong>the</strong> uncovered links between ships and <strong>the</strong>ir fire spottersTOP SECRET UMBRAPWfORU
TOP SECRET UMBRAf40f'OlmCOMSEC SURVEILLANCE 119ashore. Until made secure cryptographically, <strong>the</strong>se links were susceptible ..to enemy exploitation.As a result of COMSEC operations in <strong>the</strong> Saigon area, naval.commanders gained a better awareness of o<strong>the</strong>r communicationsweaknesses. COMSEC units were called upon to brief naval forces, usingrecent examples of problems and weaknesses to drive home <strong>the</strong>ir lessons.For example, COMSEC Team Three at Vung Tau participated inbriefings and debriefings of units attached to Task Group 115.3.Team members learned that personal visits with communicators weremore rewarding than sending impersonal reports of discrepancies by mail.Once <strong>the</strong> offending operator realized that <strong>the</strong> COMSEC team wasinterested in helping him improve his procedures, his training movedalong more rapidly. This lesson had been learned long before GAMEWARDEN, but GAME WARDEN gave two COMSEC teams <strong>the</strong>opportunit- to apply training and education concepts in an environmentofactual need.ARC LIGHTFirst Year ofCOMSEC OperationsIn June 1965 Strategic Air Command B-52's began missions overSouth Vietnam, a program having <strong>the</strong> unclassified nickname ARCLIGHT. <strong>The</strong> SAC bombers traveled approximately 2,500 nautical milesin-bound from <strong>the</strong>ir base on Guam and completed <strong>the</strong>ir round trips inapproximately 12 hours flying time, including <strong>the</strong> time required for inflightrefueling. Each B-52 carried 51 bombs or 16 tons, and it was notunusual to have as many as 30 planes on a single raid. Acting onrecommendations from in-country units and his immediate staff, COMUSMACV initiated <strong>the</strong> requests for ARC LIGHT strike missions. transmitting<strong>the</strong>m to CINCPAC, who in turn requested final approval from<strong>the</strong> Joint Chiefs of Staff. When <strong>the</strong> JCS gave approval. a request forexecution went to <strong>the</strong> 3d Air Division at Andersen Air Force Base onGuam.It took an enormous volume of communications to initiate, approve,and execute a strike mission, and while some communications used toarrange <strong>the</strong> strikes were basically secure, o<strong>the</strong>rs equally necessary,'fOf S~Cft:~'f UMBRA nOFO:R~l
TOP S£CR£T UMBRAHOFORrq-120 WORKING AGAINST THE TIDEincluding those to notify U.S. front line units of an impending strike, didnot have proper protection. From <strong>the</strong> beginning of ARC LIGHT, U.S.officials were aware from ASA and AFSS monitoring reports that manyof <strong>the</strong> communications were insecure. Some U.S. officials reasoned thatany tip-off from <strong>the</strong> planes after <strong>the</strong>y were airborne would not give <strong>the</strong>communists time to take positive action. O<strong>the</strong>rs were not convinced that<strong>the</strong> Vietnamese Communists had a SIGINT capability sufficient toexploit U.S. communications. Still o<strong>the</strong>rs showed concern and were tryingto resolve various aspects of <strong>the</strong> COMSEC problem. As time went on,considerable evidence accumulated showing that this enormous volume ofcommunications with its full measure of COMSEC deficiencies wasworking against <strong>the</strong> objectives of <strong>the</strong> ARC LIGHT program. <strong>The</strong>Services, acting individually, attacked ARC LIGHT COMSEC problemsand registered some success in eliminating deficiencies,As <strong>the</strong> only U.S. COMSEC specialists in Vietnam at <strong>the</strong> beginning of1965, <strong>the</strong> 101st ASA Security Detachment monitors, among o<strong>the</strong>rthings, reported insecurities on air operations nets connecting <strong>the</strong> 2d AirDivision with higher headquarters. Additional Army monitoring reportsthroughout 1965, along with Air Force reports, continued to showextensive use of plain language concerning <strong>the</strong> planning and coordinationof air operations. In summer of 1966, <strong>the</strong> 10 1st Security Detachmentreponed on disclosures of planned ARC LIGHT strikes in <strong>the</strong> course ofmonitoring Capital Operations Center switchboard communicationswith air planning commands. From <strong>the</strong>se and o<strong>the</strong>r in-country communications,ASA developed considerable information to document<strong>the</strong> COMSEC weaknesses associated with SAC air strikes. Employing allconventional telephone and radio monitoring positions at <strong>the</strong>ir disposal,ASA monitors determined that at times strike requests were passing up tocorps level in <strong>the</strong> clear and that communications giving 48 hours advancenotice to friendly troops operating in <strong>the</strong> strike areas also lackedprotection. From its monitoring of in-country communications, ASAfound that traffic reflected <strong>the</strong> enemy could have had from a minimumof one hour to at least 24 hours advance notification of a planned B-52strike; that 21 transmissions monitored revealed strike objectives,participants, locations, times, and prestrike and follow-on operations;that implementing and coordinating procedures for strike planning andcommand and control were revealed in great detail; that traffic patternsTOP S£CR£T UMBRAHOFORH
,.TOP SECRET UMBRAHOfOORHCOMSEC SURVEILLANCE 121established were exploitable-reliable predictions of impending strikescould be based on conversations referring to FLASH messages confirming<strong>the</strong> target, giving or changing <strong>the</strong> time over target, or changing <strong>the</strong> targetlocation-and that portions of a TOP SECRET contingency plan for <strong>the</strong> "defense of South Vietnam were given when it was revealed that GuambasedB-52's were <strong>the</strong> major striking force, with a reaction timeestimated at 12 hours.During this period, <strong>the</strong> Air Force was accumulating similar evidencefrom AFSS monitoring of ARC LIGHT-related communications.Following <strong>the</strong> Guam study (late 1965-early 1966), AFSS monitored to<strong>the</strong> extent it could Air Force communications pertinent to groundadministration, air-to-air coordination, air space requirements and flightplan arrangements, wea<strong>the</strong>r reconnaissance, tower directions, preflighttesting of equipment, refueling operations, and in-flight reporting.It was necessary operationally for in-flight B-52's to communicate,but <strong>the</strong> B-52's at <strong>the</strong> time had nothing authorized or on board forencryption except <strong>the</strong> manual general encryption code, KAC-72, andTRITON cryptomaterial for au<strong>the</strong>ntication. <strong>The</strong>re was no ciphonyequipment. When ARC LIGHT flights began, pilots transmitted in plainlanguage while going to and returning from strikes, but after a fewmonths <strong>the</strong> pilots were ordered to maintain radio silence at least while enroute to <strong>the</strong>ir targets.<strong>The</strong> Air Force tried in o<strong>the</strong>r ways to curtail insecurities in ARCLIGHT communications. It provided KY-3 and KY-9 ciphonyequipment at Kadena Air Base, Okinawa, and at Andersen Air Base,Guam, to protect flight information and discontinued <strong>the</strong> practice ofpassing prestrike wea<strong>the</strong>r Combat Aircraft Report (COMBAR)information from KC-135 aircraft via HF single sideband transmitters.<strong>The</strong> Air Force also dealt with <strong>the</strong> major problem of altitude and airreservations. Before SAC missions could be launched toward Sou<strong>the</strong>astAsia, <strong>the</strong> Air Force had to receive altitude reservations (ALTREV's)from <strong>the</strong> host countries over which <strong>the</strong> SAC aircraft had to fly. Toarrange this, SAC requested altitude reservations from <strong>the</strong> Manila AreaControl Center (ACe) through <strong>the</strong> Sou<strong>the</strong>ast Asia Military Air RouteFacility (SEAMARF). <strong>The</strong> Manila ACC <strong>the</strong>n transmitted Notices toAirmen (NOTAM's) over unsecured commercial channels to allinterested ACC's, giving <strong>the</strong> specific air reservation information. <strong>The</strong>TOP S~CRET UMBRAHOFORH
TOP SECRET UMBRAHOFORH122 WORKING AGAINST THE TIDENOTAM's went to <strong>the</strong> ACes at Hong Kong, Saigon, Bangkok, Taipei,Singapore, and, sometimes, to <strong>the</strong> Australians. After a NOTAM wasacknowledged by all ACes, <strong>the</strong> Manila ACC granted <strong>the</strong> requestedaltitude reservation. SAC aircraft could be launched only after Manila'sfinal approval was received. This procedure, allowing as it did <strong>the</strong> releaseof premission information at least six to nine hours before time-overtargetof a mission, hardly met COMSEC requirements. <strong>The</strong> unsecuredcommunications involved in <strong>the</strong>se arrangements presented <strong>the</strong> enemywith a windfall of information.On 21 April 1966, to tighten <strong>the</strong> security aspects of obtaining altitudereservations, SEAMARF, SAC, <strong>the</strong> Thirteenth Air Force, and <strong>the</strong> PacificAir Force agreed on a number of procedures to reduce <strong>the</strong> ALTREVinformation in NOTAM's and to make more use of secured channels forcoordination. It was hoped that <strong>the</strong> new ACC notification procedures,including ALTREV's, would be protected from unsecured transmission(except for local telephone systems at terminal points) untilapproximately two hours before SAC aircraft reached <strong>the</strong> proximity ofeach country's flight identification boundary. While <strong>the</strong> various partiesinvolved in <strong>the</strong> arrangements for <strong>the</strong> most part met <strong>the</strong>ir obligations,prior warning time did not achieve <strong>the</strong> 2-hour goal <strong>the</strong> Air Force wanted.CINCPAC's ARC LIGHT SurveyIn mid-1966 SCA monitoring reports outlining ARC LIGHTcommunications insecurities took on added si~nificance.lCiting DIA Intelligence Bulletin #200-66, which gave tangibleevidence of <strong>the</strong> enemy's exploitation of U.S. communications onforthcoming B-52 bombing missions, Admiral Sharp, CINCPAC, on 28July 1966 sent a brief, pointed message to <strong>the</strong> Joint Chiefs of Staff.Noting that he considered communications security a. vital part ofmilitary operations, especially when trying to preserve an element ofsurprise in air strikes, Admiral Sharp stated that he needed a tri-Service,concentrated COMSEC survey, along <strong>the</strong> lines of <strong>the</strong> recent Navy surveyin <strong>the</strong> MARKET TIME area. He wanted a survey of at least 30 days, tobegin no later than 15 September.TOP SECRET UMBRAHOFOR'I',q(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
COMSEC SURVEILLANCETOP SECRET UldBRAnOFOan<strong>The</strong>)CS approved <strong>the</strong> request, and Admiral Sharp promulgated ordersto CINCUSARPAC, CINCPACFLT, CINCPACAF, COMUSMACV,and COMUSMACTHAI. <strong>The</strong> survey was to identify and correct any·communications malpractices involving ARC LIGHT strikes that couldresult in tip-off and advance warning to Vietnamese Communists units.Admiral Sharp set times for <strong>the</strong> submission of five periodic reports thatwould include recommendations for improvement and corrective actionstaken. <strong>The</strong> reports would go to General Hunter Harris,)r., CINC PacificAir Force, whom Admiral Sharp designated as executive agent for <strong>the</strong>survey. General Harris, in turn, was to prepare a final report by <strong>the</strong> endof October for submission to Admiral Sharp.<strong>The</strong> tri-Service monitoring and analysis elements to conduct <strong>the</strong> surveywere:Elements1. Det 2, PAC Security Region (USAFSSin support of PACAF)2. 6922d SecurityWing3. Det 5, 6922d Security Wing4. Det 7, 6922d Security Wing5. Det 1, 6988th Security Sq6. Det 1, 6927th Security Group7. 509th ASA Group (ASA in support ofCOMUSMACV)8. Det 1, lOIst Security Detachment(ASA in support ofCOMUSMACTHAI)9. NAvCOMMSTA Guam(NAVSECGRU in support ofCINCP ACFLT)10. COMSEC 705 (NAVSECGRU insupport of CINCPACFLT).11. Commander, Task Element 70.7.7.1(NAVSECGRU in support ofCINCP ACFLT)12. Commander, Task Element 70.7.7.2(NAVSECGRU in support ofCINCPACFLT)PositionsD(including those for <strong>the</strong>elements 2-6 listed on left)Dradio and.DconventionaJtelephoneunknownunknown123--gTOP SECRET UMBRAPWFORU(b) (1)~(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOfl SECRET UMBRAHOFORlq124 WORKING AGAINST THE TIDEAdmiral Sharp's directive contained specific EEFl and areas of specialinterest. <strong>The</strong>se were:EEFIa. How much time do enemy intelligence organizations have to react to ARCLIGHT tip-off? Indicate <strong>the</strong> first mention of ARC LIGHT strikes in monitoredtraffic. Indicate dates and times prior to strikes where amplifying informationcould have been obtained from traffic.b. To what extent do communications prior to <strong>the</strong> ARC LIGHT strikesreveal strike objectives, participants, locations, times, equipment, or follow-onoperations?c. Is classified information transmitted in <strong>the</strong> clear over unprotected circuits?d. What information is revealed concerning ARC LIGHT operations by <strong>the</strong>implementing and coordinating procedures required for strike planning?e. What transmission security procedures have been most effective in securityARC LIGHT information? Give examples of use, changing frequencies,au<strong>the</strong>nticators, call signs, or voice codes.f. Has information been disclosed concerning command and controlprocedures, circuits, personnel, or locations?g. Are '<strong>the</strong>re indications that tip-off may occur through o<strong>the</strong>r thancommunications weaknesses?h. To what extent do communications traffic patterns give advanced warningof pending strikes?i. What o<strong>the</strong>r information of special significance was disclosed ei<strong>the</strong>r prior to,during, or after <strong>the</strong> ARC LIGHT strikes?Areas ofSpecial Interesta. Assessment of previous strikes,b. Target selection and subsequent coordination,c. Logistics of launch, recover, and alternate air bases,d. Coordination of SAR,e. Route coordination (FAA, Navy, Army, etc.),f. Clearance of friendly forces in strike areas (Army, Marines, Navy, allies),g. Wea<strong>the</strong>r reporting.*·CINCPAC Msg, sub: ARC LIGHT TRANSEC Survey (C), 151845Z August 1966,SECRET.TOP S£CR£T UftfBRAHOflORlq
TOP SECRET UMBRl,PiOFORP'JCOMSEC SURVEILLANCE 125During <strong>the</strong> 30-day survey, SCA monitoring units covered a majority ofthose circuits known to carry ARC LIGHT information. <strong>The</strong> 509th ASAGroup in Vietnam blanketed common-user lines of <strong>the</strong> major trunks,Field Force and subordinate unit switchboards, and VHF/UHF, AM,and FM radio nets in Vietnam as well as COMUSMACTHAI localswitchboard circuits to Thailand air bases. N AVSECGRU elementsmonitored 66 tactical and air coordination voice circuits emphasizingvoice communications in and out of Da Nang (Airborne Command PostPANAMA and so forth) and Guam, TTY, and o<strong>the</strong>r circuits. PACSCTYRGN covered 86 voice, TTY, and o<strong>the</strong>r circuits, concentratingon such long-haul voice communications as Guam to PhilippineIslands, Vietnam, and Okinawa, and SAC Omaha to Okinawa.Upon receiving reports from <strong>the</strong> survey participants, General Harrisprepared for Admiral Sharp a final report outlining recommendationsmade and actions taken. * <strong>The</strong> report presented voluminous evidence ofinsecurity in ARC LIGHT communications. Perhaps <strong>the</strong> most tellingargument for <strong>the</strong> need of COMSEC improvement was a list of over 50monitored teletype transmissions that were related to actual time-overtargetand demonstrated actual warning time available to <strong>the</strong> enemy. (Fora partial list, see table, page 126.)<strong>The</strong> COMSEC analysts, in fulfillment of EEFI, believed <strong>the</strong>y hadaccumulated evidence of mission compromise in teletype communicationsfor 26 of a suspected 30 ARC LIGHT strikes during <strong>the</strong> 30-dayperiod. ** <strong>The</strong> final report characterized <strong>the</strong> sensitive information derivedfrom ARC LIGHT communications in this way:~--------An average of approximately seven and one-half hours prior warning of eachARC LIGHT strike is available from teletype monitor. Of those warning timesprovided it was often <strong>the</strong> case that amplifying information could have beenobtained from in-country telephone or radio-telephone monitors. Thisamplifying information included hints of such things as strike objectives,participants, locations, times and/or follow-on operations. In addition to thisinformation <strong>the</strong>re were o<strong>the</strong>r disclosures which provided analysts with a limited*PACAF, Final TRANSEC Analysis Report, 15 September-14 October 1966(SECRET, NOFORN), 28 October 1966.**Actually B-52 strikes were averaging about 50 missions a month: 59 in Septemberand 44 in October, 1966 (DIA SEA Military Fact Book for 1966).TOP SECRET UMBRAPiOFORn
TOP SECRET UMBRANOfOlW126 WORKING AGAINST THE TIDEWarning Time Revealed in Teletype TransmissionsOriginator Time a/Transmittal Time-Over- Target Warning Time aKadena 151110Z Sep 152205Z 10+55Saigon 151550ZSep 152205Z 6+15Saigon 170200Z Sep 170630Z 4+30Kadena 172346Z Sep 180720Z 7+34Saigon 180319Z Sep 180720Z 4+01Clark 201635Z Sep 202215Z 5+30Kadena 201750Z Sep 202215Z 4+25Saigon 202100ZSep 202215Z 1+15Clark 210530Z Sep 211947Z 14+55Kadena 210636Z Sep 211947Z 13+11a Hours plus minutes.insight into <strong>the</strong> coordinating procedures required for ARC LIGHT strikeplanning. <strong>The</strong> coordination of this data provided over an extended period oftime could possibly lead toan eventual compilation of ARC LIGHT data:targets, priority assigned to different types of targets, equipment used, etc.,which could eventually restrict <strong>the</strong> effectiveness of <strong>the</strong> overall ARC LIGHTprogram."Recommendations in <strong>the</strong> final report were not as impressive as were<strong>the</strong> insecurities found on all sides. <strong>The</strong> major part of <strong>the</strong> intelligenceinformation obtained and recorded in <strong>the</strong> report had seemingly beenpassed in violation of <strong>the</strong> Pacific Command regulation concerning <strong>the</strong> useof EFTO procedures. This was noted,' but <strong>the</strong> report made norecommendation as to how those violations could be corrected. <strong>The</strong>report did recommend that SAC, SEAMARF, <strong>the</strong> Thirteenth Air Force,and <strong>the</strong> Pacific Air Force develop a method of completely securinginformation on altitude reservations, and that, where applicable, everymethod at <strong>the</strong> disposal of user agencies be employed to ensure that codesystems were used in accordance with authorized procedures. <strong>The</strong> reportrecommended a review of guidance documents governing <strong>the</strong> discussionof any information pertinent to ARC LIGHT missions to determine*PACAF. Final TRANSEC Analysis Report, cited.TOP SECRET UMBRAUOFORf.
COMSEC SURVEILLANCETOP SIJERIJT UMBRArWFORN127II111uillwhe<strong>the</strong>r <strong>the</strong>y did or did not specifically prohibit <strong>the</strong> transmission ofintelligence similar to that noted. If not, <strong>the</strong> report recommended morespecific guidance. <strong>The</strong> report also recommended stern penalties forviolators.CINCPAC subordinates took follow-on actions, apparently as a directresult of <strong>the</strong> joint monitoring operation. General Westmoreland,COMUSMACV, directed that those command elements cited in <strong>the</strong> finalreport for having divulged ARC LIGHT information conduct investigationsinto <strong>the</strong> areas of insecurity. General Westmoreland alsospelled out for subordinate units policies and classification guidelines forARC LIGHT in order to dispel apparent confusion on <strong>the</strong> subject. Forexample, <strong>the</strong> AFSS had reported in September that its Detachment 5, inmonitoring unsecured communications, had reconstructed <strong>the</strong> entiregeographic grid system being used for area target identification alongwith associated code names for discriminating grid blocks. <strong>The</strong> AFSSdetachment at Tan Son Nhut informed MACV and SAC that <strong>the</strong>y wouldhave to discontinue using <strong>the</strong> seldom-changed code names to identifytarget areas if any COMSEC improvement were to be realized.*<strong>The</strong> U.S. Army Vietnam (USARV) gave subordinates 30 days toimprove <strong>the</strong>ir COMSEC and report actions taken. USARV emphasizeduse of low-level codes, available secure circuits, and couriers as steps toovercome <strong>the</strong> voice problem and directed commanders in particular tomake use of available secure voice. Despite <strong>the</strong>se and o<strong>the</strong>r measures, <strong>the</strong>basic COMSEC problems continued without a significant reduction.In reviewing <strong>the</strong> ARC LIGHT survey, Admiral Sharp was unable tofind much comfort in <strong>the</strong> results. <strong>The</strong> 30-day survey had been asuccessful tri-Service attack on a specific communications problem, and ithad revealed an abundance of information as to what was causing <strong>the</strong>problem. In this, it had established a precedent for future tri-Serviceactions, but it had produced no effective solution to <strong>the</strong> complex problem.Admiral Sharp was also displeased with <strong>the</strong> manner in which <strong>the</strong>survey had proceeded. In December 1965 he had promulgated <strong>the</strong> joint"<strong>The</strong>se codenames were not changed for months-until all targets in a particulargeographical area had been hit. Such usage in unsecured communications as much as amonth in advance of actual strike allowed enemy foreknowledge with ample time tominimize <strong>the</strong> damage or plan counteraction.TOP g~ERET UMBRAnOFORr.
'fOP SECRE'f UMBRAHOFORH128 WORKING AGAINST THE TIDENSA-CINCPAC concept for COMSEC surveillance, but <strong>the</strong> COMSECunits had employed only conventional monitoring techniques duringARC LIGHT survey. <strong>The</strong> admiral believed that COMSEC surveillanc..techniques were not generally understood and felt that <strong>the</strong> stumblingblock to <strong>the</strong>ir full use had been <strong>the</strong> failure of <strong>the</strong> various Services to issuenecessary technical guidance. He asked <strong>the</strong> JCS to correct <strong>the</strong> situation.CINCPAC needed a procedure for bridging <strong>the</strong> gap between those whoidentified communications security deficiencies and recommendedchanges and those who had to make <strong>the</strong> changes.In <strong>the</strong> PURPLE DRAGON survey, which followed on <strong>the</strong> heels ofARC LIGHT and had much <strong>the</strong> same objectives, CINCPAC was toapply <strong>the</strong> surveillance concept to achieve that end.PURPLE DRAGONAt <strong>the</strong> same time that Admiral Sharp was developing his plans for <strong>the</strong>ARC LIGHT survey to determine from which sources forewarning ofB-52 strikes could be acquired,1 rIn September 1966 JCS approved a plan that D IA had developed Incollaboration with <strong>the</strong> Joint Staff, <strong>the</strong> Services, and NSA. <strong>The</strong> plan calledupon CINCPAC to execute a 4-month field survey to ascertain <strong>the</strong>sources for enemy forewarnings. On 10 December 1966 <strong>the</strong> JCSapproved CINCPACs subsequent implementation plan, nicknamedPURPLE DRAGON. Admiral Sharp described <strong>the</strong> objective oiPURPLE DRAGON as <strong>the</strong> improvement of operationalieffectivenes~through operational security. To ensure <strong>the</strong> success/ of PURPIJDRAGON, Admiral Sharp assumed direct operational control an.established a PURPLE DRAGON control group iunder Col. Jam;:Chance, USAF, on <strong>the</strong>J-3 CINCPAC staff.<strong>The</strong> PURPLE DRAGON plan was first to identify all recurring cstereotyped indicators of forthcoming air operations, largely throug;'fOP SECRE'f UMBRAHOFORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
COMSEC SURVEILLANCETOP SECRET UMBRAUOFOH:fq'129Jeep-mounted KY-8 Ciphony Deviceexhaustive examination of U.S. communications passed prior to <strong>the</strong> airoperations. Once <strong>the</strong> communications and o<strong>the</strong>r indicators had beenestablished, CINCPAC would develop procedures to deny <strong>the</strong>information to <strong>the</strong> enemy. Along with <strong>the</strong> study of U.S. communications,PURPLE DRAGON specialists would consider <strong>the</strong> military operations<strong>the</strong>mselves and counterintelligence.<strong>The</strong> PURPLE DRAGON survey examined three categories of airactions: drones, air operations over North Vietnam, and air operationsover South Vietnam. SAC employed drones in a program nicknamedBLUE SPRINGS (later BUMBLE BUG, BUMPY ACTION) to obtainreconnaissance photography in high risk areas of Communist China andNorth Vietnam. DC-OD's usually launched <strong>the</strong> drones over Laos or <strong>the</strong>Gulf of Tonkin, and CH-3C helicopters recovered <strong>the</strong>m in midair in <strong>the</strong>vicinity of Da Nang. All air strike operations over North Vietnam,whe<strong>the</strong>r by <strong>the</strong> Navy or <strong>the</strong> Air Force, had <strong>the</strong> nickname ROLLINGTOP SECRET UM8RA~JOfOR~J,-- ,----------------------- --------it'llm~i:';~III.II·~.,~rri!f~~I lillI~~!I 'llHi'~Ii"IIi
1=QP e~CRBT UMBRA nOFORn130 WORKING AGAINST THE TIDETHUNDER. <strong>The</strong> third category, ARC LIGHT, was, of course, <strong>the</strong>B-52 strikes over South Vietnam.PURPLE DRAGON operated with seven independent teams, eachfavorably located to carry out its assigned tasks. <strong>The</strong> Air Force had oneteam at Tan Son Nhut and ano<strong>the</strong>r at Udorn to study ROLLINGTHUNDER operations. Each had an operations officer, acommunications security officer, and members of <strong>the</strong> Air Force Office ofSpecial Investigation. <strong>The</strong> Navy manned ano<strong>the</strong>r team for ROLLINGTHUNDER coverage, using <strong>the</strong> Seventh Fleet as its base, with personnelin positions corresponding to those of <strong>the</strong> two Air Force teams. A thirdAir Force team, based at Kadena Air Base, Okinawa, covered bothROLLING THUNDER and ARC LIGHT operations. Ano<strong>the</strong>r AirForce team covered ARC LIGHT from Guam. Still ano<strong>the</strong>r Air Forceteam was at Bien Hoa to cover BLUE SPRINGS operations. <strong>The</strong>se teamsincluded SAC, AFSS, Office of Special Investigation, and PACAFofficers. <strong>The</strong> remaining team was with MACV in Saigon. It coveredflight route package #1,* forward air control (FAC) missions, and ARCLIGHT operations. In all, 39 men drawn from <strong>the</strong> Army, Marine Corps,and Air Force served on <strong>the</strong> Saigon team. Significant to <strong>the</strong> success ofPURPLE DRAGON were <strong>the</strong> chiefs of <strong>the</strong> teams, each a senior airoperations officer familiar with <strong>the</strong> air operations being investigated.In addition to <strong>the</strong> seven teams, a CINCPAC )-3 staff unit of 5 menworked at CINCPAC headquarters on <strong>the</strong> three operational aspects ofPURPLE DRAGON-operations survey, communications-electronics,and counterintelligence. Technical assistance for <strong>the</strong> )-3 unit came from<strong>the</strong> offices of NSA Pacific and <strong>the</strong> Defense Intelligence Agency.PURPLE DRAGON was to focus on what an enemy SIGINTorganization might obtain and also on <strong>the</strong> damage that could be donethrough spy and o<strong>the</strong>r agent activity.1TOP SHCRET UMBRAnOFORti/(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
COMSEC SURVEILLANCETOP 5BCRBT UMBRAPWFORP,131II !IIIIiIIIIiiTOP SECRET UMBRAPWfORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
(b) (1)(b) (3)-P.L. 86-36(b) (3)-18 USC 798(b) (3)-50 USC 403I
"Oli :5f:CKf:" UMBKAf(OfOKH'134 WORKING AGAINST THE TIDECorrective ActionsIn <strong>the</strong> three types of air operations <strong>the</strong> PURPLE DRAGON teamsexamined, <strong>the</strong> element of surprise was too frequently lost and along withit <strong>the</strong> effectiveness of <strong>the</strong> operations. Of major concern was <strong>the</strong> increasedthreat to <strong>the</strong> lives of <strong>the</strong> ARC LIGHT and ROLLING THUNDERcrews and <strong>the</strong> safe return of <strong>the</strong> planes and drones. In each of <strong>the</strong> threetypes, PURPLE DRAGON initiated some specific corrective action.BLUE SPRINGS In studying drone operations, <strong>the</strong> Air Force/teamat Bien Hoa found that pre-operations planning messages were goVng viaHF single sideband from Bien Hoa Air Base to Da Nang Air Base withBLUE SPRINGS information encoded in KAC-72, a SAC world-wideoperations code. Disagreement existed among <strong>the</strong> specialists as towhe<strong>the</strong>r <strong>the</strong> Chinese Communists were actually decoding <strong>the</strong> messages oronly relating <strong>the</strong>m by traffic analytic considerations (lengths, timing,addresses, and so forth) to <strong>the</strong> drone reconnaissance missions. Byobserving only <strong>the</strong> message lengths and external characteristics of HFSSB transmissions encoded in KAC-72, PURPLE DRAGON personnelin December 1966 were able to accurately predict 18 of <strong>the</strong> 24 missions<strong>the</strong>y tested. Of <strong>the</strong> 6 missions not predicted, 3 were canceled, one wasplanned 42 hours in advance, and <strong>the</strong> planning messages for 2 went bylandline telephone instead of by HF SSB radio.<strong>The</strong>re was also a general upgrading of COMSEC materials forBLUESPRINGS communications. COMSEC improvement included <strong>the</strong>replacement, on 1 June, of KAC-72 with KAC-154:Anew code,KAC-227, later came into use for communications formerly passed inKAC-72 but was not introduced specifically for communications*See page 141.TOP SECRET UMBRl.nOFORPi(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'f'Ofi gr:Cltr:'f' UMBRAHOFORHCOMSEC SURVEILLANCE 135associated with <strong>the</strong> drone program. For continued cover on <strong>the</strong> BienHoa-Da Nang link, <strong>the</strong> Air Force introduced a new code, KAC-238. InJanuary 1968 <strong>the</strong> Air Force began using a KW-26 securedteletypewriter circuit, a still better method for <strong>the</strong>se communications.Later in 1968, <strong>the</strong> Air Force installed a HY-2/KG-13 secure voicesystem for use between Bien Hoa and Da Nang for operationalcommunications.L...-__---I1.<strong>The</strong> PURPLE DRAGON survey was highly successful,<strong>the</strong>refore, in tightening BLUE SPRINGS security. <strong>The</strong> resulting increasein operational effectiveness was equally dramatic: <strong>the</strong> recovery rate of <strong>the</strong>drones increased from 35 percent to 70 percent by November 1967.*ARC LIGHTII!\'"--- ----'I.To achieve this success, <strong>the</strong> Air Forcehad to curtail <strong>the</strong> dissemination of information to civil aircraft trafficcontrol authorities. Instead ofpassing altitude reservation requests in <strong>the</strong>clear several hours in advance to both Manila and Saigon, <strong>the</strong> Air Forcebegan transmitting <strong>the</strong>m only to Saigon and <strong>the</strong>n only in classified formas an immediate action.<strong>The</strong> PURPLE DRAGON teams dealt with <strong>the</strong> basic/problems ofgeneral broadcast NOTAM's bydiminating <strong>the</strong> need .for <strong>the</strong>m. Airtraffic control centers at Hong Kong, Manila, Taipei,/and Bangkok had"Some briefers attributed an even greater percentage increase/in recovery of drones to<strong>the</strong> COMSEC measures taken. <strong>The</strong> percentages .l;iven were/supplied by AFSS. O<strong>the</strong>rfactors such as <strong>the</strong> weapon firepower of <strong>the</strong> various enemy/areas photographed wouldalso affect <strong>the</strong> percentage of <strong>the</strong> recovery.'TOP,SECRE'T UMBRAPWfORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798•. ,0.)
(b) (1)1....- (b) (3) - P. L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAfWfORfqCOMSEC SURVEILLANCE 137been including in <strong>the</strong>ir unclassified NOTAM's not only flight informationfor overflight of South Vietnam but also <strong>the</strong> estimated time ofplane arrival (ETA) at PointJuliet, a common rendezvous for planes overwater between Guam and South Vietnam. Using this information,PURPLE DRAGON analysts had been able to swing a time arc andpredict with more than 80 percent accuracy <strong>the</strong> location and time-overtargetof ARC LIGHT strikes. PURPLE DRAGON recommendationseventually led to <strong>the</strong> establishing of a corridor for entry into and exitfrom South Vietnam air space and to <strong>the</strong> declaring of a block of airaltitude reservations on 24-hour reserve for SAC B-52's.To offset <strong>the</strong> problem of releasing strike information to native villagerswith <strong>the</strong> probability that <strong>the</strong> data would reach <strong>the</strong> enemy, certain areasknown to be basically without friendly elements were declared" free areasfor aircraft bombing." <strong>The</strong> result was that friendly forces stayed out of<strong>the</strong> free areas, except under special arrangement, and no notices of strikeswere issued to local authorities. <strong>The</strong> Air Force also discontinued <strong>the</strong>practice of having B-52's call in launch reports (unencrypted over singlesideband) to SAC headquarters each time a bomber departed Guam.As a result of <strong>the</strong>se steps, PURPLE DRAGON enjoyed success inrestoring <strong>the</strong> element of surprise to SAC's B-52 missions, a goal notachieved as a result of <strong>the</strong> earlier Guam study or of CINCPAC's ARCLIGHT survey. <strong>The</strong> chart on <strong>the</strong> opposite page documents <strong>the</strong> PURPLE DRAGON success.ROLLING THUNDER <strong>The</strong> PURPLE DRAGON teams workingon ROLLING THUNDER could not bring about <strong>the</strong> dramaticimprovements that those working on <strong>the</strong> drone and B-52 programsachieved. Although PURPLE DRAGON analysts identified severalforewarning indicators that <strong>the</strong> enemy might have exploited inROLLING THUNDER, IIL....-~-~ffhePURPLE/DRAGONteams none<strong>the</strong>less suggested a number of general actions to improveROLLING THUNDER operational and communications security.<strong>The</strong>se included reducing <strong>the</strong> number of recipients offlight information;IITOP S£€RET UMBRAfqOfelm(b) (1)(b) (3)-P.L. 86-36(b) (3)-18 USC 798(b) (3)-50 USC 403
TOP SECRET UMBRAnOFORn\)'2, WORKING AGA\N~'t 'tHE 'tlD"Eshifting, when possible, from unencrypted to encrypted communications;revising callsign usage; applying communications cover; revising codeprocedures; checking adherence to Red/<strong>Black</strong> criteria; and providingCOMSEC education.Admiral Sharp, CINCPAC, forged in PURPLE DRAGON a viableapproach to attaining operational security (OPSEC) for air operations.By assigning COMSEC specialists to military operational staff elements,Admiral Sharp assured himself of COMSEC results. PURPLEDRAGON monitoring was in accordance with established guidelines forsurveillance. Upon <strong>the</strong> completion of PURPLE DRAGON, AdmiralSharp asked <strong>the</strong> )CS to approve <strong>the</strong> establishment of a ermanent 0 erationssecurity function on <strong>the</strong> CINCPAC staffapprove an arp create an unit m<strong>the</strong> )-3 staff. While <strong>the</strong> PURPLE DRAGON field teams no hmgllrexisted, it became standard practice for about a third of <strong>the</strong> )-3 OPSECstaff to be on duty at field locations or in travel between <strong>the</strong>m.<strong>The</strong> effectiveness of <strong>the</strong> operations security approach, in/whichCOMSEC surveillance played a major role and in which/ commandemphasis on COMSEC was assured, led to a World-Wide OperationsSecurity Conference held at Arlington Hall Station from 30 Aprilthrough 2 May 1968. <strong>The</strong> purpose of <strong>the</strong> conference/was to makeinformation on CINCPACs PURPLE DRAGON op.erations securityprogram generally available and to promote use of <strong>the</strong>/operations securityconcept in o<strong>the</strong>r commands and o<strong>the</strong>r geographic areas.(b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403(b) (3)-P.L. 86-36TOP SECRET UMBRA~10fOlU'1
TQP ~eC::ReT UHIJ:R A ~IQfQR~1CHAPTER IVCommunications Cover and DeceptionCommunications cover and communications deception consist of twoseparate but related techniques. Communications cover is <strong>the</strong> technique ofconcealing or altering <strong>the</strong> characteristics of communications patterns for<strong>the</strong> purpose of denying to <strong>the</strong> enemy information that would be of valueto him. Communications deception is <strong>the</strong> deliberate use of communicationsto mislead <strong>the</strong> enemy and acquire a security, military, orpolitical advantage.Authorized communications cover and deception (CC&O) programsin Vietnam were administered and operated by a relatively small numberof COMSEC specialists who normally were in close touch withmonitoring and analysis programs and who used <strong>the</strong> product of <strong>the</strong>monitoring operations in planning CC&O operations. <strong>The</strong> specialists alsoused <strong>the</strong> findings of <strong>the</strong> monitors, I Jin alteringoperations underway and in evaluating <strong>the</strong>m when completed. To assuresecurity for <strong>the</strong>ir programs, CC&O specialists tended to compartment<strong>the</strong>ir functions or at least apply very rigidly <strong>the</strong> need-to-know principle.At <strong>the</strong> tactical level, operational commanders had responsibility forCC&O.Within all three Services, CC&O expertise was scarce in <strong>the</strong> war zone.Until late 1966 no one in <strong>the</strong> Army on regular duty status in Vietnamwas qualified to conduct a good communications deception effort. Thoseavailable after that time who did have <strong>the</strong> necessary experience workedprimarily on o<strong>the</strong>r COMSEC tasks. Beach jumper units undertookCC&O functions for <strong>the</strong> Navy in <strong>the</strong> war zone. <strong>The</strong> Air Force did nothave CC&O specialists permanently stationed in <strong>the</strong> war zone. HigherAFSS headquarters personnel-or those on. TOY in <strong>the</strong> wararea-supervised those CC&O operations conducted during this period.In comparison with known enemy employmentof CC&D, U.S. forcesmade very little use of communications deception and ignored in largemeasure <strong>the</strong> possibility of using CC&O techniques to mislead enemySIGINT operations, and hence enemy tactical reactions.TOP SECRET UfoftiRAfqOflOftfq(b) (1)(b) (3)-P.L. 86-36__ ..(b) (3) -18 USC 798(b) (3)-50 USC 403
TOP SECRET UMBRANOFORN140 WORKING AGAINST THE TIDEBJU COMSEC Van at Hill 327, Da NangNSA played a minor role in CC&D operations. It participated in <strong>the</strong>review of communications cover plans for operations in Vietnam andprovided advice, through Headquarters, NSAPAC, on CC&D applicationby <strong>the</strong> Services.Communications CoverWhile <strong>the</strong> average COMSEC specialist applies his COMSEC skillsprimarily within a limited phase of electrical communications, <strong>the</strong>communications cover specialist employs a wide range of communicationssecurity techniques. In achieving cover, he considers <strong>the</strong> best applicationof (l) available cryptosystems for a specific communications requirement,(2) any nonelectrical communications, (3) techniques to minimize <strong>the</strong>intelligence vulnerability of communications, and (4) radio silence.'TOt" :3ECRE'T UfI>fBRJ'tNOFORN
Tefl SIKIU:'f' Ul'dBRANOFORNCOMMUNICATIONS COVER AND DECEPTION 141One often-recommended communications cover technique involves <strong>the</strong>flattening out of peaks and valleys in <strong>the</strong> volumes of communicationspassed by using dummy traffic or by minimizing <strong>the</strong> volume of messagesnormally passed as a result of crisis or just before an operation. Thisflattening of traffic volumes automatically appeared on many circuits inVietnam as a result of near full-circuit utilization in <strong>the</strong> passing of validtraffic. However, flattening was at times used intentionally. <strong>The</strong> AirForce employed communications cover, to give one example, for SACBLUE SPRINGS drone reconnaissance flights during 1967. To smoothout traffic patterns over an HF single sideband communications linkbetween Bien Hoa and Da Nang, which was apparently beingintercepted by <strong>the</strong> Chinese Communists, <strong>the</strong> control element sent aminimum of three transmissions daily. All of <strong>the</strong>se were encoded inKAC-72 and consisted of a minimum of 45 groups. Communicators sentdummy messages ending with <strong>the</strong> phrase, "This is a sample message."Before <strong>the</strong> use of this cover, it was believed that <strong>the</strong> timing, length, andover-all characteristics of <strong>the</strong> occasional valid mission orders served as tipoffsto enemy analysts. *Communications DeceptionCommunications deception is of two types. Imitative communicationsdeception (ICD) involves intruding on an enemy's communications withsignals or message traffic in imitation of his own communications for <strong>the</strong>purpose of deceiving him. This kind of deception requires great technicaland linguistic skill and is difficult to achieve convincingly. <strong>The</strong>re is noavailable record of any of <strong>the</strong> Services using ICD in Vietnam.Manipulative communications deception (MCD), <strong>the</strong> second type ofdeception, is <strong>the</strong> use of one's own communications so as to cause anenemy to derive, and accept through his SIG INT, false information thatwould be disadvanteous to him. U.S. forces did employ this technique inVietnam with mixed success. On some occasions U.S. forces combinedcommunications cover with manipulative communications deception andreferred to <strong>the</strong> results as manipulative communications cover anddeception (MCCD).*Seealsop.134.above.TOP 8ECRET UMBRANOFORH
TOP 8BERBT UMBR1\nOFOR~J142 WORKING AGAINST THE TIDEArmyMCD<strong>The</strong> Army seldom used MCD during <strong>the</strong> years to 1968; it was neverused by a major Army command. More often than not, according to509th ASA Group sources, <strong>the</strong> Army applications consisted primarily ofhomemade efforts attempted below division level and did not involvecryptologically trained personnel. Commanders simply composed andtransmitted clear-text bogus messages over <strong>the</strong>ir own command radiosand nets in an attempt to mislead <strong>the</strong> enemy concerning U.S. intentions.Army commanders rarely involved ASA specialists in <strong>the</strong>se MCDattempts. <strong>The</strong>re were, however, three Army MCD operations worthy ofnote.<strong>The</strong> first was conducted between 29 March and 14 April 1966 by <strong>the</strong>3d Brigade of <strong>the</strong> 1st Infantr Division durin 0 eration ABILENE inpDuring <strong>the</strong> last days of <strong>the</strong> operation, <strong>the</strong> enemy had evaded/~~~----Iall offers ofbattle, strongly suggesting that he might be engaging in closeinintercept of U.S. communications. <strong>The</strong> commanding officer of <strong>the</strong> 3dBrigade, assisted by <strong>the</strong> 337th ASA Company, drew up a communicationsdeception. plan to lure <strong>the</strong> enemy, if he was monitoring, backinto <strong>the</strong> area of operations for an ambush. <strong>The</strong> plan was to make <strong>the</strong>enemy think <strong>the</strong> brigade had left <strong>the</strong> area. Thus, two U.S. companiesstayed in concealed positions and maintained radio silence, while <strong>the</strong>remainder of <strong>the</strong> force obviously, and with normal communications,withdrew from <strong>the</strong> area.xusing several clear-text messages to .reveal <strong>the</strong>withdrawal. <strong>The</strong> two companies were positioned for ready .reacrion incase <strong>the</strong> ruse succeeded. When <strong>the</strong> enemy did not reoccupy <strong>the</strong> area afterthree days, <strong>the</strong> stay-behind U.S, units also withdrew.A second MCD attempt involved <strong>the</strong> 11th Armored Cavalry in 1967.One squadron of <strong>the</strong> regiment, apparently without assistance from itsDSU, <strong>the</strong> 409th ASA Detachment; tried a similar ruse. <strong>The</strong> squadronsent out a bogus message in clear text to which <strong>the</strong> enemy, if listening,might have reacted. <strong>The</strong> message, from <strong>the</strong> regimental commander to <strong>the</strong>2d Squadron, advised <strong>the</strong> squadron of indications that <strong>the</strong> enemy mightbe operating in <strong>the</strong> Quang Buan rubber plantation-near which, infact, an enemy force was suspected-and directed <strong>the</strong> 2d Squadron toTOP SECRET UMBRAHOFORH(b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403(b) (3)-P.L. 86-36
TOP e~CR~T UM8H:A ~lOfOlH',COMMUNICATIONS COVER AND DECEPTION 143Truck-mounted ASA Reporting and Analysis Centersend a troop to support infantry in that area for <strong>the</strong> next 36 hours. It washoped that <strong>the</strong> troop would draw a major ambush in <strong>the</strong> area, for whicha squadron reaction force was ready nearby. Again, however, <strong>the</strong>re was nosuccess. <strong>The</strong> 303d ASA Battalion first became aware of this MCDattempt when it monitored and investigated <strong>the</strong> clear-text message, whichappeared to <strong>the</strong> ASA unit to have been a gross violation,<strong>The</strong> third MCD operation did have a successful outcome. <strong>The</strong> 303dASA Battalion in 1967 wanted to test <strong>the</strong> extent of VC interception by aplanted, controlled breach of COMSEC. Lt. Col. Norman J. Campbell,<strong>the</strong> 303d commander at <strong>the</strong> time, reported:After losing some time attempting to approach <strong>the</strong> Corps (II FFV) staff onsuch an attempt (<strong>the</strong>y opined <strong>the</strong>y'd have to clear it with MACV, which wouldtake quite a bit of staffi"ng!), <strong>the</strong> CG, 199th Infantry Brigade (BG Forbes),said he could do this with us, <strong>The</strong>refore, in an operation working with <strong>the</strong> DSU(856th RR Det}, he ordered a battalion in <strong>the</strong> field to send a message by usual
'fot" SfCRf'f UMBRAuorORP~144 WORKING AGAINST THE TIDEcommunication, ordering several companies to remain out in separate fieldlocations one night, ra<strong>the</strong>r than returning to <strong>the</strong> battalion base. At <strong>the</strong> sametime, he ordered <strong>the</strong> companies, by discrete instructions, to disregard <strong>the</strong>message and surreptitiously return to <strong>the</strong> battalion base. This worked,apparently, proving that <strong>the</strong> VC were monitoring <strong>the</strong> nets, for <strong>the</strong> VC attacked<strong>the</strong> supposedly weakened battalion base that night, but since all three companieswere in, <strong>the</strong> VC got clobbered and later relocated. At Corps, LTG Weyandthought this was a good start at /applying/ communications deception planningat Corps level which would be useful tactically to trap fur<strong>the</strong>r VC reactions, andsent such a recommendation cable to MACV. However, not much appeared tohave been done in this respect before I left SVN.This is <strong>the</strong> only Army MCD operation in Vietnam in 1964-67 forwhich <strong>the</strong>re is evidence of success.Navy MCCDIn April 1965, withJCS authorization, Admiral Sharp encouraged <strong>the</strong>use of manipulative communications cover and deception in support oftactical operations against <strong>the</strong> Vietnamese Communists. GeneralWestmoreland, over-all coordinator for <strong>the</strong> operations, and <strong>the</strong> threeClNCPAC Service component commanders had authority to plan andconduct MCCD operations in accordance with <strong>the</strong> guidelines thatClNCPAC set down. <strong>The</strong> CINCPAC directive specifically encourageduse of MCCD on <strong>the</strong> MACV-CTF 77 coordination circuits. CINCPacific Fleet assigned to <strong>the</strong> commander of <strong>the</strong> Seventh Fleet <strong>the</strong> Navyresponsibility for planning and conducting MCCD operations in <strong>the</strong>Sou<strong>the</strong>ast Asia area.In June 1965 <strong>the</strong> commander of <strong>the</strong> Seventh Fleet held a conferencewith representatives from <strong>the</strong> Task Force 77 and 71 staffs, tacticaldeception units, and COMSEC units to discuss plans for using MCCD inNavy tactical operations. Although <strong>the</strong>y did not adopt <strong>the</strong> plan, <strong>the</strong>representatives for a while considered a concept for <strong>the</strong> use of MCCD inMARKET TIME operations that would lure into a trap <strong>the</strong> enemy'slarge wooden junks and steel hull cargo vessels approaching fromseaward. <strong>The</strong> concept called for <strong>the</strong> formation of a rigid outer barrierpatrol by ships available to <strong>the</strong> commander of Task Force 71. After agiven period of time, when it could be assumed that <strong>the</strong> NorthTOP 5£ER£T UMBRAPWrORU
'fOP SECRE'f UMBRAUOFORUCOMMUNICATIONS COVER AND DECEPTION 145Vietnamese had discovered <strong>the</strong> barrier pattern by analyzing uncoveredcommunications, <strong>the</strong> ships would leave <strong>the</strong>ir patrol stations under totalelectronic silence and take up positions to close <strong>the</strong> weak points in <strong>the</strong>barrier. During this maneuver a tactical deception unit would maintain acommunications picture indicating that <strong>the</strong> rigid barrier pattern wascontinuing. While this concept had merit and many supporters, it wasnever fully tested because <strong>the</strong>re was no firm intelligence on <strong>the</strong> mannerby which <strong>the</strong> North Vietnamese controlled <strong>the</strong> junks and cargo vessels.<strong>The</strong> Navy conferees adopted no particular concept as a result of <strong>the</strong>MCCD meeting in June 1965, but one positive result was arecommendation that went first to CINC Pacific Fleet and <strong>the</strong>n to CINCPacific concerning communications and coordination control for MCCD.As a result, CINCPacific modified its policy in August 1965, delegatingresponsibility for coordinating MCCD operations to Service componentcommanders and enabling Service components fur<strong>the</strong>r to delegateapproval authority for MCCD to lower echelon tactical commanders.Although <strong>the</strong> initial MARKET TIME deception concept was neveradopted as such, <strong>the</strong> commander of Task Force 71 employed a similarMCCD concept in MARKET TIME operations on several occasionsduring July 1965. <strong>The</strong> objective of <strong>the</strong> plan was to determine if changesin <strong>the</strong> location and pattern of <strong>the</strong> ships patrolling <strong>the</strong> outer barrier wouldresult in corresponding changes in <strong>the</strong> infiltration patterns. Informationderived from <strong>the</strong> operation would help in preparing follow-on deceptionplans.On 20 July Task Force 71 had eight destroyer escorts on patrol in <strong>the</strong>nor<strong>the</strong>rn portion of <strong>the</strong> seaward barrier, a thin defense for a large area.Through MCCD, <strong>the</strong> task force commander hoped to simulate <strong>the</strong>presence of eight additional Destroyer Squadron 19 ships in this nor<strong>the</strong>rnarea. <strong>The</strong> communications pattern was to give a picture of a strong linealpatrol in <strong>the</strong> nor<strong>the</strong>rn area.Two tactical deception teams, aboard two nor<strong>the</strong>rn patrol ships, had<strong>the</strong> task of manipulating <strong>the</strong> communications of <strong>the</strong> Nor<strong>the</strong>rn MARKETTIME Coordination and Reporting Net in order to present a picture of<strong>the</strong> strong lineal patrol. <strong>The</strong> net was an uncovered voice net on whichoperational and numerical codes rarely appeared and most traffic was in<strong>the</strong> clear. During <strong>the</strong> first deception period tactical units shifted to analternate frequency so that <strong>the</strong> regular frequency carried only deceptiveTOP SECRET UMBRAtiOFORU
TOP SECRET UMBRArmf10RH146 WORKING AGAINST THE TIDEtraffic. During <strong>the</strong> second period <strong>the</strong> tactical units remained on <strong>the</strong>regular frequencies and deception traffic was superimposed on <strong>the</strong> circuit.<strong>The</strong> deception script called for <strong>the</strong> traffic to be predominantly plain text,with a small volume of encoded traffic to match actual traffic normallytransmitted on <strong>the</strong> net.To achieve realism, <strong>the</strong> tactical deception teams used <strong>the</strong> actual voicecall signs of eight Destroyer Squadron 19 ships. <strong>The</strong> ships were actuallyjust entering <strong>the</strong> WESTPAC area and would not be involved in anyoperations in MARKET TIME during <strong>the</strong> deception operation. For <strong>the</strong>period of deception, <strong>the</strong> commander of Destroyer Squadron 19 was torefrain from using <strong>the</strong>se call signs on o<strong>the</strong>r than line-of-sight circuits.<strong>The</strong> COMSEC unit at <strong>the</strong> Naval Communications Station Philippineswas to monitor <strong>the</strong> Nor<strong>the</strong>rn MARKET TIME Coordinating andReporting Net and associated area circuits and report by message to <strong>the</strong>task force commander any discrepancies or variations in previouslyobserved patterns or procedures that would inform <strong>the</strong> enemy that <strong>the</strong>operations were of a MCCD nature.During <strong>the</strong> first few days of <strong>the</strong> deception operation, <strong>the</strong> COMSECunit did detect and report deviations from previously observed patternsand departures from realism-misuse of operational and numericalcodes, employment of dummy codes and au<strong>the</strong>ntication systems ra<strong>the</strong>rthan actual systems, improper preparation of deception messages,referencing of HFDF positions not coinciding with reported positions,citing of unrealistic underway replenishment schedules and times, ando<strong>the</strong>r irregularities suggestive of communications deceptions. <strong>The</strong>COMSEC monitoring reports also showed, as a by product, that <strong>the</strong>entire barrier operation, including positions, movements, patrol areas,and future plans, was susceptible to reconstruction through intercept andanalysis of communications going over <strong>the</strong> Nor<strong>the</strong>rn MARKET TIMEnet.Perhaps <strong>the</strong> major reason for possible failure of <strong>the</strong> operation was alack of continuous liaison between <strong>the</strong> comma nders of DestroyerSquadron 19 and Task Force 71 during <strong>the</strong> MCCD period. Unknown to<strong>the</strong> commander of TF 71, two of <strong>the</strong> ships of <strong>the</strong> destroyer squadron wentto Subic Bay and were transmitting on <strong>the</strong> Subic Harbor CommonNet-a medium frequency net-when <strong>the</strong> deception operation started.<strong>The</strong>refore, <strong>the</strong> same voice call signs were appearing at <strong>the</strong> same time onTOP SECRET UltfBRAn0f10Rh'
TOP SECRET UMBRAHOFORHCOMMUNICATIONS COVER AND DECEPTION 147<strong>the</strong> Subic Harbor Common Net and <strong>the</strong> MARKET TIME circuits, apoint <strong>the</strong> enemy could hardly fail to notice.By 24 July, <strong>the</strong> end of <strong>the</strong> first deception period, Task Force 71 hadcorrected most of <strong>the</strong> deficiencies, and <strong>the</strong> stage was set for ano<strong>the</strong>rMCCD attempt. ClNC Pacific Fleet issued new, completely fictitiousvoice call signs for use by <strong>the</strong> deception teams in <strong>the</strong> second phase of <strong>the</strong>deception operation. <strong>The</strong> commander of Task Force 71 objected to thison <strong>the</strong> ground that it would be immediately apparent to an enemy analystthat <strong>the</strong>se were deceptive calls, but ClNC Pacific Fleet overruled <strong>the</strong>objections. <strong>The</strong>refore, on 27 July 1965, eight new voice call signsappeared on <strong>the</strong> communications net as hypo<strong>the</strong>tical ships. Upon <strong>the</strong>appearance of <strong>the</strong>se eight new voice call signs, <strong>the</strong> COMSEC unitimmediately tagged <strong>the</strong>m as deceptive, based on observation of <strong>the</strong>previous deception effort.O<strong>the</strong>r than <strong>the</strong> obviously fictitious voice call signs being used, <strong>the</strong>second attempt at deception proceeded very well. <strong>The</strong> lessons learnedfrom <strong>the</strong> first attempt were put to good use. <strong>The</strong> general opinion was that<strong>the</strong> second attempt could have been quite successful had not <strong>the</strong> enemyalready been alerted to look for deception because of <strong>the</strong> errors madeduring <strong>the</strong> first operation. Through use of more sophisticated COMSECtechniques such as HFDF, frequency measurement, and observation andcomparison of background noise associated with <strong>the</strong> voice, <strong>the</strong> COMSECunit was able to determine that transmissions purportedly originatingfrom five different units were all emanating from a single platform.<strong>The</strong> result of <strong>the</strong> July deception operation was inconclusive. Novariation in <strong>the</strong> infiltration patterns of <strong>the</strong> North Vietnamese junks cameto light. However, <strong>the</strong> MCCD operation probably achieved, as aminimum, CINCPAC's secondary objective of reducing <strong>the</strong> credibility of<strong>the</strong>se communications and consequently making analysis by <strong>the</strong> enemymore difficult.On 30 July 1965 <strong>the</strong> commander of Task Force 115, a jointcommander under COMUSMACV, assumed responsibility for <strong>the</strong>MARKET TIME operations and discontinued deception activity.Although many recommendations for <strong>the</strong> use of deception were madeand considered, <strong>the</strong> Navy undertook no o<strong>the</strong>r significant MCeDoperation in <strong>the</strong> years up to 1968, primarily because of a lack of securityin communications, lack of security from visual observation, and rules ofTOP SECRET UMBRAUOFORU
TOP SECRET UMBRA?WfOlm148 WORKING AGAINST THE TIDEengagement requiring detailed coordination with <strong>the</strong> South Vietnamesebefore each actual operation. However, <strong>the</strong> Navy did institute a broadCC&D educational program designed to reach all command levelsresponsible for CC&D operations.<strong>The</strong>re is no documentary evidence at hand to indicate that <strong>the</strong> MarineCorps conducted any major MCCD operations during this period. InOctober 1966 <strong>the</strong> commander of <strong>the</strong> III Marine Amphibious Forcedrafted an order setting forth basic policy and procedures for <strong>the</strong>employment of deception in support of ground tactical operations, alongwith specific examples and operational areas in which deception could beemployed. <strong>The</strong> order was submitted through General Westmoreland toAdmiral Sharp but was never approved for execution.<strong>The</strong> Navy learned several valuable lessons for evaluating its MCCDoperations in 1965. Although <strong>the</strong> Navy did have <strong>the</strong> ability to undertaketactical MCCD (and lCD, for that matter) with its trained tacticaldeception units, a general knowledge of how to use <strong>the</strong>se assets wascompletely lacking among commanders, <strong>the</strong>ir planning and operationalstaffs, and personnel at all levels. <strong>The</strong> primary lesson learned was that <strong>the</strong>same men who conduct real operations must plan and conduct MCCDoperations, and <strong>the</strong> commanders must assume MCCD responsibilityra<strong>the</strong>r than assigning it to <strong>the</strong> technical tactical deception units.Deception operations must also be completely realistic and must begenuinely integrated with actual operations.Air Force M CCDIn World War II and <strong>the</strong> Korean War, enemy aircraft aggressivelycontested Allied control of <strong>the</strong> skies; however, in <strong>the</strong> Vietnam War <strong>the</strong>air over North Vietnam was relatively free from challenge by enemyaircraft. Most American planes shot down fell to antiaircraft fire andsurface-to-air (SAM) missiles. Until 2 January 1967, <strong>the</strong> entire 23months of <strong>the</strong> air war had produced only 27 air-to-air" kills" against <strong>the</strong>North Vietnamese, and only 10 U.S. aircraft had fallen prey to enemyMIG's. Shying away from dogfights, North Vietnamese pilots preferredto harass U.S. fighter-bombers on <strong>the</strong>ir runs over North Vietnam,TOP SECRET UMBRAIqOfiOltIq
, ,TOP SECRET UMBRAHOFORHCOMMUNICATIONS COVER AND DECEPTION 149attempting to make <strong>the</strong> U.S. planes jettison <strong>the</strong>ir bomb loads short of <strong>the</strong>targets or to burn extra fuel in evasive maneuvers.In December 1966 <strong>the</strong> Seventh Air Force planned an aerial ambush, .Operation BOLO, to force a confrontation with <strong>the</strong> enemy's bestaircraft-<strong>the</strong> MIG-21 Fishbed fighters. * BOLO involved bo<strong>the</strong>lectronic (radar) and manipulative communications deception. <strong>The</strong>essential feature of <strong>the</strong> plan, implemented on 2 January 1967, was adeception that would cause <strong>the</strong> enemy to assume that a flight of <strong>the</strong> U.S.1,600-mile-per-hour F-4C Phantom fighters was actually a flight of <strong>the</strong>slower moving U.S. F-I05 bombers against which <strong>the</strong> MIG-21 had abetter than equal chance in air-to-air combat.<strong>The</strong> plan of operation was to fly <strong>the</strong> superior U.S. F-4C's from basesin Thailand and South Vietnam, using flight paths, speeds, andcommunications duplicating those of <strong>the</strong> well-established flightcharacteristics of <strong>the</strong> slower F-105's. It was hoped that <strong>the</strong> deceptionwould be effective until <strong>the</strong> F-4C's were in visual contact with <strong>the</strong>MIG-21 's rising to meet <strong>the</strong>m. When <strong>the</strong> engagement took place, o<strong>the</strong>rF-4C's, including some that had flown up along <strong>the</strong> Gulf of Tonkin,were to guard known North Vietnamese airfields for 53 minutes toprevent <strong>the</strong> enemy aircraft from returning to <strong>the</strong>m.In all, 52 F-4C's and 24 F-105's flew to North Vietnam in OperationBOLO using <strong>the</strong> Laos and Gulf routes. <strong>The</strong> first three flights throughLaos proceeded to <strong>the</strong> nor<strong>the</strong>rn tip of <strong>the</strong> mountains located north ofPhuc Yen to engage <strong>the</strong> Phuc Yen MIG cover air patrol. Two flightsfrom Da Nang hovered northwest of Haiphong in case MIG's tried torun in that direction. Also, SAM suppression flights (IRON HAND)trolled for SAM's northwest of Phuc Yen and north and sou<strong>the</strong>ast ofKep.Arranging deception for <strong>the</strong> operation was not easy. Extreme cautionwas necessary to keep from compromising plans through loose talk oro<strong>the</strong>r action such as necessary relocation of aircraft. To <strong>the</strong> extentpractical, <strong>the</strong> F-4C's were physically disguised to simulate <strong>the</strong> larger"Two primary sources were used for this description. <strong>The</strong> one, a special historical studywritten by <strong>the</strong> historian at <strong>the</strong> PACSCTYRGN soon after Operation BOLO, wasforwarded by a USAF letter to NSA, sub: Material for NSA/SCA Cryptologic History,3 July 1969, TOP SECRET Codeword. <strong>The</strong> o<strong>the</strong>r was a USAFSS draft input to <strong>the</strong>History project, Vol V, Part III, Chapter 3, TOP SECRET Codeword, undated.TOP SECRET UMBRAHOFORf,
TOP SECRET UMBRAPWfORPf150 WORKING AGAINST THE TIDEF-105's on <strong>the</strong> enemy radar screens. While in flight, <strong>the</strong> F-4Cs flew atspeeds and altitude normal to those of <strong>the</strong> F-105's. <strong>The</strong> F-4Cs achievedcommunications deception by using F-105 call signs and standardcommunications frequencies. At <strong>the</strong> time, <strong>the</strong> F-4Cs and <strong>the</strong> F-105'sboth operated in flight without ciphony; for <strong>the</strong> most part, all communicationswere in plain language.For certain essential information <strong>the</strong> regular practice was to use redand yellow color codes, which allowed for low-grade encryption ofinformation such as <strong>the</strong> status of enemy aircraft. For <strong>the</strong> BOLOoperation, planners introduced several changes. One was <strong>the</strong> use of new"one-operation" code communications systems. North Vietnameseairfields used by MIG aircraft were each given a code name. Also, fourspecial code words, each with a specific meaning, were assigned to <strong>the</strong>operation: LAS VEGAS meant situation as expected, MIG's reacting;EL PASO meant situation not as expected, MIG's quiet; LOSANGELES meant MIG's disengaging; and NEW YORK meantChinese aircraft coming over border.<strong>The</strong> geographic reference plotting system (GEOREF) '" was to be usedto give MIG locations and consisted of two letters for GEOREF blockdesignation and two numbers (rounded off at <strong>the</strong> l O's digit). Headings ofenemy MIG's were to be given only to <strong>the</strong> nearest 10 degrees and givenin two digits. When a MIG heading was unknown, a two-digit numberhigher than 36 would be used. MIG altitudes were to be given inthousand-foot increments and passed as two digits. When <strong>the</strong> altitudewas unknown, an exceedingly high number would be passed, forexample, 99. Insertion within <strong>the</strong> GEOREF of odd (l or 3) and even"In <strong>the</strong> geographic reference plotting system, <strong>the</strong> world is divided into 288 15-degreequadrangles. Each of <strong>the</strong>se 15-degree quadrangles is identi fied by a two-characterdesignator (row and column coordinates). Each of <strong>the</strong>se I5-degree quadrangles isbroken down into I-degree quadrangles, which are again identified by two-characterdesignators. Characters used for <strong>the</strong>se identification purposes are <strong>the</strong> letters A throughQ, omitting <strong>the</strong> letters I and O. When reporting a GEOREF position, <strong>the</strong> I-degreequadrangle is followed by <strong>the</strong> longitude minute coordinates of <strong>the</strong> position within <strong>the</strong> 1degree quadrangle. Two I5-degree GEOREF quadrangles (UH and VH) cover <strong>the</strong>majority of <strong>the</strong> Sou<strong>the</strong>ast Asian area of interest.TOP SECRET UMBRAN'OfOR14
'fOfl :5f:CItt:'f tJMBItAHOFOItHCOMMUNICATIONS COVER AND DECEPTION 151numbers (2 or 4) indicated, respectively, launch and recovery of MIG's.Some specific examples of possible use were:ETHAN BRAVO (daily MIG call word) AG 2715 would mean "MIG'sover mountain heading 270 degrees at 15,000 feet."ETHAN BRAVO Chicago YG 44 99 88 would mean "MIG's landingKep."ETHAN BRAVO Frisco AG 33 85 99 would mean "MIG·s scramblingfrom Phuc Yen."'fOfl SECH:E'f UMBIt/,UOFORU(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOF SECRET UMBRAf(OfORH152 WORKING AGAINST THE TIDE'fOil S:ECR:ET UMBRAUOfORU(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAHOFORfqCOMMUNICATIONS COVER AND DECEPTION 153Operation BOLO, as is frequently <strong>the</strong> case when MCCD is employed,required that communications facilities be used in an unusual manner andthat <strong>the</strong>re be no pre-operation practice. <strong>The</strong> revised alert warning and.special code usage also added complexity for communicators during <strong>the</strong>relatively short time of operation when tension of battle was at its peak.Postoperation analysis indicated that <strong>the</strong> special techniques for achievingsecurity of communications did not cause any significant difficulty.PACSCTYRGN commended its Sou<strong>the</strong>ast Asia units for <strong>the</strong> initiative<strong>the</strong>y displayed in response to Operation BOLO, saying that <strong>the</strong> actionsdemonstrated <strong>the</strong> unique capability of AFSS to support tactical airoperations. I ,IL..;---;------:-"""":"'"----;---r-.,....,........---r---;---r--..,.....-....,...J,I Equal praise/isdue those who planned and initiated <strong>the</strong> deception without which <strong>the</strong>MIG kill would have been impossible. Accounting for 7 MIG-21's irv12minutes-in effect destroying one-third of <strong>the</strong> enemy's MIG~21inventory-was a remarkable feat.A number of o<strong>the</strong>r BOLO-type missions were flown over <strong>the</strong> ensuingmonths, <strong>the</strong> first on 23 January 1967, but ei<strong>the</strong>r <strong>the</strong>re was a pattern thatalerted <strong>the</strong> North Vietnamese or o<strong>the</strong>r factors went wrong. Whatever <strong>the</strong>reason, none of <strong>the</strong> later missions achieved <strong>the</strong> success of BOLO,Although all <strong>the</strong> Services engaged in communications cover anddeception operations in <strong>the</strong> 1965-67 period, <strong>the</strong> sum total/could not becalled a success. However, through <strong>the</strong>ir failure and occasional successes,<strong>the</strong> Services did develop some basic <strong>the</strong>ories upon which <strong>the</strong>y couldpredicate later CC&D operations. CC&D operations) should not beattempted by communications specialists acting alone; <strong>the</strong>y need <strong>the</strong> fullknowledge and cooperation of appropriate operations personnel, a clearlydefined purpose, and a reasonable chance of achieving desired results.Even though CC&D operations might not require much time, expense, oreffort on <strong>the</strong> part of communicators, often, especially for CC&D of aTOP 8£CR£T UldBR/.HOFORH(b) (1)- (b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
154 WORKING AGAINST THE TIDEmore strategic nature, <strong>the</strong>y mean putting hard-to-hide military resources(troops, ships, or planes) into a deceptive posture to correspond with falsecommunications fed to <strong>the</strong> enemy, deployments that could be expensiveand time consuming and could require resources, often in short supply,that conventional operational requirements make unobtainable. Inaddition, good CC&D operations need an effective meansIDofe~aluating <strong>the</strong> enemy's response during and./fo"Tll""o-w-l-n-g-t"'Th-edeception.Caution must also be used to prevent <strong>the</strong> enemy fromoverreacting.(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798TOP SECRET UMBRAtWFORH
TOP SECRET UfdBRAHOFORHCHAPTER VLessons LearnedCOMSEC EducationOne major lesson learned from COMSEC monitoring in Vietnam isthat a commander's attitude toward COMSEC determines in largemeasure <strong>the</strong> degree of COMSEC awareness within his organization.Ironically, for one reason or ano<strong>the</strong>r it was often difficult to convince acommander that <strong>the</strong> enem had an effective SIGINT 0 eration tar eteda ainst him.More often than not, it was onlyL.....,...---T"""".....,.....................................----,....,..............w en t e u imp ications 0 C MSEC deficiencies became apparent-sometimespainfully apparent-e-tc him through COMSEC monitoringreports that <strong>the</strong> commander in Vietnam took steps to improve hisCOMSEC practices.<strong>The</strong> U.S. COMSEC community should of course take all steps possibleto indoctrinate <strong>the</strong> U.S. tactical commander in CO,MSEC before hisarrival in <strong>the</strong> war zone and should not relegate this task to comparativelylow-ranking COMSEC personnel working in <strong>the</strong> field. <strong>The</strong> U.S.COMSEC organizations have numerous examples from monitoring andanalysis with which to demonstrate <strong>the</strong> consequences of poor COMSECpractices to <strong>the</strong> commander's complete satisfactibn./<strong>The</strong>y need to con-TOP&6CRET .UMBRAlWFORH(b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403(b) (3)-P.L. 86-36
TOP SECRET UMBRAH8f'8RN'156 WORKING AGAINST THE TIDEP>,~.k~l)tr;~\~~Vietnamese Communist Intercept of U.S. Clear-text Communications.<strong>The</strong> communications give information on future U.S.air strikes (A/S). (Source: ASA TAREX unit.)TOP SECRET UMBRAPWf8RH
'fOP SECRE'f' UltfBRA1,OfOR-ULESSONS LEARNED 157U.S. COMMUNICATORS(calls1gn &suffix)Decot 351835 Fire 90Vague 90Ban:U.t 90.11VOICENET1/1 6\113 have r'enult ViR stroy AO, he .!ill r-elgyfor yout-I~ 9th CQ counterpart 16 in contact at thistimetnequcst poaL td.on Als at coord 51451,.5, oldbase area tomorrow mo~~ning+1250 Sluch 171255 "Fire 3i7~12-69 'D2/282We have mission at :J~,J()' fo .. pnt A.I.,> e.~.5739 you have ~rlenQ)y' areat+You give one Slel'1' ccordinat,e, we ha'J'ilfriendly at coord 57;13'13 you have friendlya,:'e&\-+We have friendly is at 51.l!J.9 grid-!- . =._We took up base camp at 58::14 :1+1530 B60A66 80B66Decot 33""80 B66Sluch 13 Strey 52OWL 83 Stro:r 80D2/2 ,.;>l~ 36 now closed th:.s lvcat.ion, <strong>the</strong>y foundbunker at 662305+~ 26 found 1 wa:l~t at 6533Z3t)Ty 26 at (00.6 '00.2) r\l':ohs"'b-y fir~'f;6- WI~!y 16 CloSEd I1\Y location+Sluggard 13 cover l'~cat1on rf,y 26 found5 bunker also I"J 26 e ct. up AP at th ~\t;lWe .tant free fire at. 584328?++Negative free fir~lwLllput A/s at 5836 gr1d+Will put A/s at 588356 to <strong>the</strong> Et+You contact wi.t.h rriY 1'1'1 endly+066?++At Il\Y 1QcatioJl-;-Typescript of InterceptTOP SBCRBT UltfBRAlWfORt,
TOP SECRET UMBRAHOFORH158 WORKING AGAINST THE TIDEvmce <strong>the</strong> commanders that <strong>the</strong> enemy has an active, sophisticatedSIGINT program in <strong>the</strong> war zone,..... ---'<strong>The</strong>y need to assure that <strong>the</strong> commander going toVietnam understands that COMSEC is, in fact, <strong>the</strong> only weapon hehas against <strong>the</strong> enemySIGINT organization.<strong>The</strong> COMSEC community has taken a few steps to achieve thisindoctrination for service personnel. It has arranged for improvedbriefing materials for use in COMSEC education of higher level Serviceofficers. <strong>The</strong> Army and NSA have exchanged prepared briefing aids foruse in briefings of this kind, and <strong>the</strong> National Cryptologic School atNSA, starting about 1967,\has been offering courses to Service personnelthat highlight <strong>the</strong> enemy SIGINT threat and stress <strong>the</strong> importance ofcommunications security. <strong>The</strong> NSA school courses have been ofsignificant value to those vwho have attended, but unfortunatelyattendance has generally been limited to those already serving incryptologic positions; few prospective commanders of combat units haveattended. NSA and SCA headquarters have also prepared educationalbriefings for use by CINCPAC\ and CONUS-based commands. <strong>The</strong>reremains, however, no uniform.Acornprehensive COMSEC educationalprogram for tactical commanders.Despite <strong>the</strong> various constructive 'efforts <strong>the</strong> COMSEC community hasmade, it has still failed to convince-some tactical commanders that <strong>the</strong>yneed COMSEC at all. As late as May 1969, NSA received' word that aU.S. Army brigade commander in South Vietnam had requested "that allCOMSEC support to his unit be discontinued." *<strong>The</strong> COMSEC community must also give attention to Servicecommunicators. When commanders 'are COMSEC-c'onscious, <strong>the</strong>ircommunicators generally adhere to prescribed routines. When <strong>the</strong>commander is not so predisposed, Servicecommunicators who are awareof <strong>the</strong> implications of COMSEC can stillhelp protect! communications.Here again awareness of <strong>the</strong> enemy's SIGINT operations can provide <strong>the</strong>Inecessary conditioning for acceptanCe of ~bMSEC advice."From a "FACT SHEET," sub: COMSEC Support tolst Bde, 5th Inf Div, preparedby Maj. W. F. Gress, 20 May 1969, CONFIDENTIAL. .'fOP SfCRf'f UhfBRAlqOfORN'(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
.lLESSONS LEARNED 159--- J/As in <strong>the</strong> case of <strong>the</strong> commanders, <strong>the</strong> ideal would be.to indoctrinate communicators before <strong>the</strong>y arrive in <strong>the</strong> war zone.<strong>The</strong> CC&D ParadoxEvents have shown that <strong>the</strong> U.S. Services were not well prepared toemploy communications cover and deception. When CC&D operationswere tried, <strong>the</strong> deception techniques, difficult to apply successfully evenunder optimum conditions, worked best when <strong>the</strong>y involved. SCApersonnel and when operations staffs and commanders planning <strong>the</strong>CC&D had direct responsibility for conducting it.It is of interest to note that, except for some "home-grown" deceptionoperations planned and conducted without consultation with SCApersonnel, <strong>the</strong> Services often seemed reluctant even to use ei<strong>the</strong>r imitativecommunications deception or manipulative communications deception.Paradoxically, <strong>the</strong> enemy practiced !CD with frequent success. <strong>The</strong> U.S.appears to have lost a good opportunity to put <strong>the</strong> enemy at a militarydisadvantage through communications deception at <strong>the</strong> tactical level.Success in deception such as that achieved by <strong>the</strong> Air Force in OperationBOLO, which accounted for <strong>the</strong> loss of one-third of <strong>the</strong> NVNMIG-21 's, certainly should have stimulated o<strong>the</strong>r major U.S. deceptionoperations.<strong>The</strong> Armed Forces in Vietnam also had only limited success inapplying communications cover. General overloading of communicationscircuits, a common situation during at least <strong>the</strong> early war years, inhibited<strong>the</strong> application of communications cover on most traffic lanes. Forsuccessful communications cover operations COMSEC specialistsobviously must first have a communications structure with enoughflexibility to permit <strong>the</strong> alterations required.New Concepts for Old ProblemsAt <strong>the</strong> beginning of U.S. combat involvement in Vietnam, <strong>the</strong> conceptin monitoring called for <strong>the</strong> U.S. specialist to duplicate what an enemySIGINT analyst might attempt. If <strong>the</strong> U.S. analyst failed to makeTOP SeCRET UMBRAtmFORt.-------_.- .~-(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TQP SBGlUIT UMBRAl'fOrORU160 WORKING AGAINST THE TIDETIMEOFINTERCEPr:1{;'u .s. COMMUNI~ATORSVOICE1calls1gn & suffix) I MESSAGE DATE !lET~"L£yo - 4.J s:5"'73 c'i: {2c~...J. P.II ~ ~ w;{Q d ..Q.b< "'~ -';:'!!f!iC
TOP 6~CR~T UMBRA nOrORf',LESSONS LEARNED 161:;:IMBOFINTERCEPl'U.S. CO~;ICATORS(callsign & sUffix) MlliSAGE DATE066 Fire 90 At 559368 found bunker and tunnel ldllcheck in <strong>the</strong> area tomorl'011 morning+D2/282~NET0935 Train 11 Stroy 11Paicher 11 IIAction 111040 Stroy 11 Stroy 6622-11--1969 - 3/11Request u~gent dustoff for 3 u.s. wounded(2 ~"b. 1 litter) by bit boobr trap atcoord. 778344 contact on <strong>the</strong> ground 081 +We have 6RP cut at this time +Lead cv is at cpt 78. tail cv is at cpt x +Reference from Flame at coord, 6937 hespotted base carr~ and movement. he \1antsNight Hawk took up 1 lima size from Trainelement search area +0905 Sluch 14 Fire 90------Fire 82 Sluch 140910 Sluch 14 Fire 90Fire 066s0930 Fire 90 stroy ABo0935 Race 6 Fire 900950 Fire 066 901005 90 C66s90 C66s13-12-1969 D2/282Come up on your post. give me location forput A/s at 1030 hour++Roger w31t:t·-LOCation put A/S a';. 573408+You have friendly near at that 1eationA/s++We have F at 2 to 5 clicks to <strong>the</strong> Wareal"iY 54 element AP 1 brocken for coordinationstroy A element sWeep+Road sweep t eam sp return your locationyet?++Affirmative , road t'weep to 00 return D54Loc atd.on«Request du~tofi f"r 1 VN remal", at ncrlocati.orc:-At coord 557367 'I~ found 1 t14"mol 130Mbunker.J-;'}!y A elem'Jr.t sp r:iY :i.ocat~.0!4at this. ct~r~etYour 51.;. element. will work'.ng inte> sa.also your- cP. 46 and 62 eler.:lE
TOP SECRET UMBRAUOfiORH162 WORKING AGAINST THE TIDEheadway in an attack on U.S. communications, <strong>the</strong>n all was presumedwell. However, such was seldom <strong>the</strong> case since <strong>the</strong> COMSEC analystnearly always recovered sensitive information from <strong>the</strong> U.S.communications. In a sense, <strong>the</strong> COMSEC analyst <strong>the</strong>refore became apoliceman writing out tickets for violations. One lesson learned in <strong>the</strong>early period was that this traditional COMSEC concept had limitationsand that better use could be made of <strong>the</strong> specialized COMSEC skills. Forbetter use of <strong>the</strong>se skills, a closer working relationship between <strong>the</strong>COMSEC specialist and command, staff, and communications personnelbecame necessary.Without changing its objective of securing U.S. communications, <strong>the</strong>COMSEC community has gradually been moving toward a new modusoperandi-COMSEC surveillance. Under <strong>the</strong> new concept, analysts arenot limited to reviewing monitored communications, but have access toall operational information-operational plans, communications modes,cryptographic systems, and o<strong>the</strong>r data-to help <strong>the</strong>m in planning with<strong>the</strong> Service communicators for secure communication. COMSECofficials, after much consideration, designated a substantial number ofCOMSEC personnel as surveillance specialists. Monitoring <strong>the</strong>reforebecame as much a review of how well field-level COMSEC specialists hadplanned as it was a check on how well communicators <strong>the</strong>mselves adheredto COMSEC procedures. COMSEC surveillance bridged <strong>the</strong> gap betweencommunicator and COMSEC specialist and helped erase <strong>the</strong> image of<strong>the</strong> policeman. <strong>The</strong> new approach proved highly successful in <strong>the</strong>PURPLE DRAGON survey and o<strong>the</strong>r joint undertakings to achieveoperational security for U.S. forces in Sou<strong>the</strong>ast Asia. While not all SCAand NSA personnel were in agreement, by 1968 <strong>the</strong>re was generalrecognition that COMSEC objectives could best be achieved through <strong>the</strong>new approach.Monitoring, however, will always be needed in one form or ano<strong>the</strong>r.COMSEC specialists can arrange for secure equipment, educatecommanders in <strong>the</strong> importance of communications security, instructcommunicators in <strong>the</strong> use of codes, ciphers, and machines, enter intoplanning for communications support of <strong>the</strong> military operations, andparticipate in command actions to improve over-all operational security.But unless communications are monitored in order to measure <strong>the</strong>effectiveness of steps taken in <strong>the</strong> name of COMSEC, <strong>the</strong> Services willTOP SECRET UMBRAUOFORH
TOP SECRET UMBRANOfOftfqLESSONS LEARNED 163have no means of evaluating <strong>the</strong> extent to which <strong>the</strong>ir communicationsmay be feeding information to a SIGINT-hungry enemy. Despitesophistication in <strong>the</strong> design and manufacture of cryptomaterials, <strong>the</strong>United States will remain vulnerable to enemy SIGINT activity until <strong>the</strong>U.S. Services develop a commensurate sophistication and commandemphasis in <strong>the</strong> use of those cryptomaterials.Full Treatment for <strong>the</strong> PatientThis review of monitoring and analysis operations to 1968 has shownthat <strong>the</strong> greatest COMSEC improvement has resulted when <strong>the</strong>re was acombined Service attack on a single problem of general concernhe PURPLE DRAGON, Guam,and MARKET TIME operations produced results far more meaningfulthan would have been <strong>the</strong> case had each Service performed its monitoringfunctions alone. <strong>The</strong> assigning of an operations name or nickname to rheoperation and <strong>the</strong> designation of an executive agent from among <strong>the</strong>Services, as in ARC LIGHT, or a joint command as in PURPLEDRAGON, seem to act as catalysts upon <strong>the</strong> participants.Assumption of control at a joint command level brought <strong>the</strong> mostadvantages. It made possible more specific tasking for COMSECanalysts,improved exchange of COMSEC technology among <strong>the</strong> Services, andbrought forth more comprehensive reporting by field elements forcryptologic and Service officials at higher levels of command. It alsobrought a more complete component command emphasis to correctdeficient communications practices of all kinds, thus overcoming <strong>the</strong>usual practice of treating one symptom of a disease but allowing <strong>the</strong>patient to die of ano<strong>the</strong>r. Finally it caused a wider appreciation of <strong>the</strong>quality and quantity of intelligence that <strong>the</strong> enemy could gain through laxCOMSEC practices-this, a direct result of more comprehensive reviewof communications by all Services working on common/objectives.Better Systems, Better COMSEC<strong>The</strong> 1965-67 Vietnam experience was no different from o<strong>the</strong>r recentwar experiences in one major respect. So long as a communications system'fOP SEGRE'f UMBRAlWfORN(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'fOF SIKRl':'f UMBRAI40FORH164 WORKING AGAINST THE TIDE...u-.~(.f:~Tlf~...:(.>,."/It'A ~~l{(I!IIJ ....'-1"""" ~.. C ear-text Communitacticaloperations. ..Meetuse of KY-8 ciphonyTOP SECRET UIIlIBRAHOFOlU4
TOP SEERETUMBRArWfORHLESSONS LEARNED 165"TIMEOFINTERcEPru .S. COMMUNICATORS(callsign & suffix)1125 V,'lgue 90 Bandi t 901130 Stroy 80 n1146IIIIII"11 II1150 Ba:ndit 90 Bandit 90Fi.l·e 90Vag
'f'OF StKRf:'f' UMBRAHOFORU166 WORKING AGAINST THE TIDEplaces main reliance on individual restraint by Americans, it will fail in<strong>the</strong> long run to have sufficient COMSEC to deny advantages of one kindor ano<strong>the</strong>r to an enemy. As Americans, we do not appear to learn from.past mistakes. Three primary COMSEC problems existed in World WarII: unnecessary transmissions and operator chatter, excessive use of cleartext when suitable codes and ciphers were available, improper use ofauthorized codes and transmission procedures. That our enemies tookadvantage of our laxity in World War II is well documented. GermanSIGINT operations accounted for much of <strong>the</strong> cunning of GeneralRommel, <strong>the</strong> "Desert Fox" of North Africa during World War II.German SIGINT operations help to explain <strong>the</strong> German successes in<strong>the</strong>ir air defense against Allied bombing from England, in <strong>the</strong> heavyAmerican losses at Salerno in 1943, and in Field Marshal vonRundstedt's 1944-45 winter campaign known as <strong>the</strong> Battle of <strong>the</strong>Bulge.While U.S. SIGINT played an important role in <strong>the</strong> Battles ofMidway and <strong>the</strong> Coral Sea in <strong>the</strong> Pacific, Japanese SIGINT-interceptfrom plain language messages-was forecasting <strong>the</strong> attacks thatAustralian and American forces were planning for <strong>the</strong> Pacific islands.Despite <strong>the</strong> documentation from World War II, similar documentationfrom <strong>the</strong> Korean War, and abundant evidence from Vietnam, too manyAmerican military commanders still fail to believe in <strong>the</strong> enemy's knownSIGINT capabilities, and <strong>the</strong>refore still fail to appreciate <strong>the</strong> value ofgood COMSEC practices.<strong>The</strong> greatest COMSEC weakness of all results from <strong>the</strong> Americanpenchant for transmitting a great deal of information rapidly, oftenwithout adequate consideration of intelligence value, at times withoutconsideration even for <strong>the</strong> need of <strong>the</strong> communication. In thiscircumstance, <strong>the</strong>re were only two realistic approaches to achieveCOMSEC improvements. <strong>The</strong> first was to employ more, easier-to-use,cryptosystems to reduce sharply <strong>the</strong> amount of information being sent in<strong>the</strong> clear. <strong>The</strong> second was to introduce "a whole series of newtransmission systems" to make U.S. traffic difficult to intercept.Introduction of several newly designed manual systems along with <strong>the</strong>KW- 7 and KY-8 family of voice equipment helped to reduce <strong>the</strong>volume of clear-text transmissions, and this brought a measure of relief.Nothing was done, however, to introduce communications or crypto-.'f'OF Sf:ERE'F UMBRAnOFORn
LESSONS LEARNEDTOP SECRET UMBRAnorOM,'167equipment of low interceptability. Nei<strong>the</strong>r <strong>the</strong> KY-8 nor <strong>the</strong> KW-7equipment has traffic flow security safeguards, although both do allowencryption of message heading information of value to enemy analysts.<strong>The</strong> use of on-line teletype and voice ciphony (KY-8) reduced <strong>the</strong>chance of human error and made possible <strong>the</strong> desired fast but protectedcommunications required by commanders in tactical operations. <strong>The</strong>latter was not available, however, for all authorized levels of commandrequiring communications. As in <strong>the</strong> case of <strong>the</strong> 25th Division, *introduction of such easy-to-use, on-line equipment brought decisiveimprovement in COMSEC. <strong>The</strong> Vietnam experience revalidated <strong>the</strong>formula "better systems, better COMSEC."Command Emphasis<strong>The</strong> most important of lessons learned, implicit in much of whatappears in <strong>the</strong>se pages, is that command emphasis on COMSEC ismandatory. <strong>The</strong> historical record shows <strong>the</strong> obvious: commanders whoemphasize COMSEC have secure communications; those who do not,have insecure communications. Command emphasis takes on manyforms-a commander personally reviewing COMSEC violation reports, acommander reprimanding offenders, a senior command releasing <strong>the</strong>names of violators, and so forth-but whatever <strong>the</strong> form, commandemphasis must balance initiatives put forth by <strong>the</strong> COMSEC communityif <strong>the</strong> United States is to offset <strong>the</strong> losses resulting from enemy SIGINToperations.A commander who gambles with COMSEC gambles with <strong>the</strong> lives of<strong>the</strong> men he commands.*See pp. 43-45 above.TOP .seCReT UAfSRAP'10rOR~1
'TOF :ffiER:E'T UMBRAlWfORUList of AbbreviationsACCarea control centerAFAFSCCALTREVAMARARVNASABJUCAATCC&DCINCPACFLTCINCUSARPACCOMBARCOMSECCTFCTZDATSUMDIADRVDSUDTOCEEFIEElEFTOELSECETAEWFAAFACAir ForceAir Force Special Communications Centeraltitude reservationairmobile; amplitude modulationArmy RegulationArmy of <strong>the</strong> Republic of VietnamArmy Security Agencybeach jumper unit (Navy)COMSEC Assistance Advisory Teamcommunications cover and deceptionCommander in Chief, Pacific FleetCommander in Chief, U.S. Army, PacificCombat Aircraft Reportcommunications securityCommander, Task Force (Navy)corps tactical zoneDaily Activity SummaryDefense Intelligence AgencyDemocratic Republic of Vietnamdirect support unitDivisional Tactical Operations Centeressential elements of friendly informationessential elements of informationencrypted for transmission onfyelectronic securityestimated time of arrivalelectronic warfareFederal Aviation Administrationforward air controller'TOF SECRET UMBRAnOFOR~'(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAnOFORn170 WORKING AGAINST THE TIDEFFVFMFPACFSHFDFHOC!CDJCSJUSMAAGMAAGMACTHAIMACVMAFMARBKSMCCDMCDMEBMEDIVACMSTSONASNAVFACNAVSECGRUNAVSTANCSNOTAMNRSNSAPACNSCNSDNVANVNOBOPSECPACAFPACSCTYRGNField Force VietnamFleet Marine Force, PacificFederal Standardhigh frequency direction findinghours ofcoverageimitative communications deceptionJoint Chiefs ofStaffJoint U.S. Military Assistance AdvisoryGroup (Thailand)Military Assistance Advisory Group(Vietnam)Military Assistance Command, ThailandMilitary Assistance Command, VietnamMarine Amphibious ForceMarine barracksmanipulative communications and coverdeceptionmanipulative communications deceptionMarine Expeditionary Brigademedical evacuationMilitary Sea Transport Service, OfficeNaval Air StationNaval FacilityNaval Security GroupNaval StationNaval Communications StationNotices to AirmenNaval Radio StationNational Security Agency, PacificNaval Supply CenterNaval Supply DepotNorth Vietnamese ArmyNorth Vietnamorder of battleoperations securityPacific Air ForcePacific Security Region (Air Force)TOP SECRET UMBRAf'ofOFOft:f41 __-
TOP SECRET UMBRAPiOFORPiLIST OF ABBREVIATIONS 171PBRPDSPDSRPRCPWIROKRRCRRUR/TRTPRVNRVNAFSACSAMsexSDSEAMARFSEAWBSSIGOSIGSECSOlSOUSSSSBSSBNSSGSSISVNSWTADTAREXTFnOITRANSECTSARTSISTSMRpatrol boat, riverpractices dangerous to securityPractices Dangerous to Security Reportprocessing and reporting centerprisoner of war interrogationRepublic of Korearadio research companyradio research unitradiotelephoneradioteleprinterRepublic ofVietnamRepublic of Vietnam Armed ForcesStrategic Air Commandsurface-to-air missileService Cryptologic Agencysecurity detachmentSou<strong>the</strong>ast Asia Military Air Route FacilitySou<strong>the</strong>ast Asia Wideband Systemsignal officersignal securitysignal operation instructionsspecial operations unitsecurity squadron (Air Force)single sidebandnuclear power ballistic missile submarineSpecial Support Groupstanding signal instructionsSouth Vietnamsecurity wing (Air Force)temporary additional dutytarget exploitationtask forceTRANSEC Item of Interesttransmission securityTransmission Security Analysis ReportTRANSEC Interim ReportTransmission Security Message ReportTOP 8liiCRliiT UMBRAnOFORn
TOP SECRET UhfBRAUOFORU172 WORKING AGAINST THE TIDETSMSTSSRTSVTSVRTTYUSARVVCWESTPACWGWWIITransmission Security Monthly ReportTransmission Security Summary Reporttransmission security violationTransmission Security Violation Reportteletypewriteru.S. Army VietnamViet Cong; Vietnamese CommunistWestern Pacificwing (Air Force)World War IITOP SECRET Ui\JfBRAfiiOfiORfq
TOP SECRET UMBRAtJOFORUIndexABILENE, Operation: 142iAb"m,. Lt, Goo, (Cd:h,"" W" 19Air Force Security ServiceCOMSEC monitoring equipment:72, 73, 74, 75COM SEC operations: 77-84, 89,96-97, 100-03, 107-09, 120,121, 123, 125, 127, 130, 134,139, 149-53COMSEC organization: 20, 72-76COMSEC strength: 73, 74, 75-76SpecialCommunications Center:100-03Air Force Security Service unitsPACSCTYRGN Detachment 2:72,73,76,77,78, 1236922d Security Wing: 72,1236922d Security Wing Detachment4: 766922d Security Wing Detachment5: 72, 73, 74, 77, 79-80, 82,123,1276922d Security Wing Detachment7: 72, 74-76, 77, 80, 83, 1236927th Security Group Detachment1: 1236988th Security Squadron: 776988th Security Squadron Detachment1: 123Air Force units. Seea/so Air ForceSecurity Service units.Pacific Air Force: 73, 122Seventh Air Force: 73,75,77,81,84Thirteenth Air Force: 74, 75, 1222d Air Division: 73,79,1203d Air Division: 100, 107-09, 1198th Tactical Fighter Wing: 151,152-53388th Tactical Fighter Wing: 834242d Strategic Wing: 101-021958th Communications Squadron:104Air operations. See ARC LIGHT;B-52's; BLUE SPRINGS;ROLLING THUNDER.Altitude reservations (ALTREV's):121-22,135Analysis. See Monitoring and analysis.ARC LIGHT, Operation. See B-52's,operations by.ARC LIGHT COMSEC studiesSeptember-October 1966: 12228, 163December 1966-March 1967:128,129,130,131,135,137Area control centers (ACes): 121-22Army Security AgencyCOMSEC education by: 48-54COMSEC operations: 19, 20, 22,23,25,27-45,48,49,51,91-95,120,123,125,130,139,142,143,158COMSEC organization: 20,21-27COMSEC strength: 20,21,22,23,24,25,26-27monitoring equipment: 22, 30TAREX: 44,49,51,158Army Security Agency units509th Group: 8, 24-25, 27, 49,123,125,142j03d Battalion: 24-27,35,37,52, 143-44TOP SECRET UMBRAtJOFORU(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
TOP 5HERHT UMBRl,174HOFORPoi'WORKING AGAINST THE TIDE313th Battalion: 24-27,37USASA Company, Saigon: 25, 37325th Company: 52337th Company: 142371st Company: 52,91-92WIst Security Detachment:22-25,28-29,37,38,45,93,120,123104th Security Detachment: 22,23409th Detachment: 142856th Detachment: 143-4482d Special Operations Unit: 21,22,24400th SpecialOperations Unit(Prov.): 21Capital Monitoring Team: 25COMSEC Assistance and AdvisoryTeams (CAAT's): 49DSU's, general: 23-27,37,52Army units. Seealso Army SecurityAgency units; Field ForcesVietnam.U.S. Army Vietnam: 127l st Cavalry Division: 44-45,50,52,90-95l st Infantry Division: 35, 44-45,1429th Infantry Division: 5225th Infantry Division: 9-11,43-45,48173d Airborne Brigade (Separate):39,52-53199th Infantry Brigade (Separate):143-44l l th Armored Cavalry: 35,142-43Advisory Team 75: 38"Australian ICD Incident": 9-11B-52'soperations by: 90,96,101,11920,121-22,128,129B-5L.::2-::D~'s-:-1~0~2~-------~IBACK PORCH: 84Barlow, Howard c.: 2Blauverr, Lt. Col. Richard B.: 35-36BLUEBIRD Advisory Group: 38BLUE SPRINGS: 129, 130, 134~35,141BOLO: 149-53,159Brookshire, Lt. Col. Grail L.: 35Brown, Maj. Jerry L.: 19BUMBLE BUG. See BLUE SPRINGS.BUMPY ACTION. See BLUESPRINGS.C-130's: 77-79Campbell, Lc. Col. Norman].: 35,143-44Captial Operations Center (Saigon): 120Carter, Lt. Gen. Marshall S.: 128Central Office for South Vietnam(COSVN): 3Chance, Col.James: 128CharlesBerry, USS: 103,104Chausteur, Maj. John: 152China. See Communist China.Coast Guard, U.S.: 113Codes. See Cryptosysterns.COIN: 82Combat Aircraft Report (COMBAR):121Command emphasis.See Communicationssecurity, commanders'attitudes toward.Communications, monitoring of. SeeMonitoring and analysis;Violations, causes of.Communications cover and deception(CC&D) operationsAir Force: 139, 148-53TOP SECRET UMBRAHOFORH(b) (1)(b) (3)-50 USC 403(b) (3)-18 USC 798(b) (3)-P.L. 86-36
'fOP SECRE'f UMBRAHOf'OR:f4INDEX 175Army: 139.142-44compared with enemy CC&D:139-40definition of: 139electronicdeception: 149evaluation of: 153-54.159ICD, enemy: 8-11ICD, U.S.: 141Marine Corps: 148MCCD: 11-12.141.144-53MCD: 141.142-44Navy: 11-12.139,144-48responsibility for: 144CommunicationsImprovementMemoranda: 63Communicationssecurity (COMSEC).generalcommanders' attitudes toward: 2.15-16,19.30.34.39.42.43.45.48-49.50-54.55,67,68-71.83,84.88.91,92.93,94,113.119,120,122,127,128,155,158,166,167conventional monitoring: 1-84,91-128division of responsibility: 2during various wars, compared:2,53.163,166evaluation of: 155, 158-59, 162-63, 166-67functionsof: 1shortages of equipment: 98shortages of personnel: 11, 76, 88status of. 1960: 20status of, March 1966: 95status of, 1968,: 49,68strength: 11,20,21,22,23.24,25,26-27,54,55.58.62.63,64,73,74,75-76,88surveillance: 49,87-90,128-38.162-63Compromises, security. See Violations.COMSEC Traffic Analysis Report: 69ConsolidatedCryptologicProgram(CCP): 2CRITICOMM, securityof: 21CryptosysternsAN series: 7,12for BOLO: 150-51compared with those of WorldWar II: 53HY-2/KG-13: 135KAC-F: 95KAC-J: 83,94,95KAC-P/Q: 43,44KAC-Q: 95KAC-Q/P: 52KAC-21: 95KAC-24: 95KAC-72: 121,134KAC-132: 114.117KAC-138: 114KAC-140: 114,115,117-18KAC-154: 134KAC-183: 115,118KAC-227: 134KAC-238: 135KAG-21: 94KAG-24: 9l;KG-13: 107KL-7: 3.91.92.94KW-7: 30, 91. 92, 94, 166-67KW-26:JO, 105-06. 107. 108,135KY-3: 121KY-8: /30,44,49,94.95,166-67KY-9!. 121KY-,8: 53M-209: 12TOP .:SEERET UMBRAPJOFORl'J(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET UMBRAr"OfORN'176 WORKING AGAINST THE TIDEmanpack: 53manual: 13one-time pads: 20PALMER JOHN: 73POLLUX: 22PYTHON: 3SHACKLE: 43shortages of: 83-84. 113. 114.117,121SLIDEX: 3. 12TRITON: 121unauthorized: 7. 14. 44. 45. 48,52.53,55.92,93,94Daily Activity Summary (DASUM): 80Deane. Maj. Gen. John R., Jr.: 52-53Defense Intelligence Agency (DIA),and PURPLE DRAGON:128,130Denholm, Maj. Gen. Charles].: 33-34,44DePuy, Maj. Gen. William E.: 50-51F-4Cs: 149.150.151,152F-105's: 149,150,152Field Forces VietnamI: 25,37II: 25,35-36,37,39,42Fingerhut, Walter c.. 88Fisher, Robert A.: 87Forbes, Brig. Gen. Robert c.: 143GAME WARDENCOMSEC study of: 116-19operations: 64,115,116Geographic reference plotting system,defined: 150nGuam COMSEC study: 89,96-109Hancock, USS: 3Harris, General Hunter,Jr.: 123,125Heiss, Lt. Col.John L., III: 53Henchman, Lt. Col.John M.: 10-11Hyland, Vice Adm.JohnT.: 60Education, COMSECmethods: 34. 43-44, 49, 51-52.. 65-67,68,158problems: 50-54,155,158-59programs: 48-49,99,114,115,Imitative communications deception(ICD). See Communicationscover and deception, lCD,'--- I::~;,,~~E~~.~~cD' USEquipment, crypto-. See Cryptosystems.Equipment, monitoringAir Force: 72. 73, 74, 75Army: 22,30Navy and Marine Corps: 63, 64,65Jame.rtown, USS: 58,110Jarrett. Maj. George V.: 48johnsori.Lyndon B.: 82Johnson, Admiral Roy L.: 55, 57, 59,60TOP SECRET UMBRA UOFORU (b) (1)(b) (3)-18 USC 798(b) (3)-50 USC 403(b) (3)-P.L. 86-36
==TdP ~~Cfl:~'f UMBfl:1t UOfORP,INDEX 177Joint Chiefs of Staffand ARC LIGHT COMSECstudy: 122,123and PURPLE DRAGON: 128Joint U.S. Military Assistance AdvisoryGroup aUSMAAG), Thailand:22,23,25IKarch, Brig. Gen. Frederic: 55IKinnard, Lt. Gen. Harry W.O.: 50Knowles, Maj. Gen. Richard T.: 50Korean War, COMSE(: in: 2, 166Krulak, Lt. Gen. Victor H.: 55, 56,68Lessons learned: 155,158-59,16263, 166-67___IMalpractices, COMSEC. See Violations.Manipulative communications deception(MCD). See Communicationscoverand deception, MCCDand MCD.Marine CorpsCOMSEC operations: 55-57,63,65,66-68MCCD operations: 148Marine Corps unitsFleet Marine Force, Pacific: 55Ninth Marine ExpeditionaryBrigade: 55III Marine Amphibious Force: 9,66,68,1481st Marine Division: 683d Marine Division: 681st Marine Air Wing: 68First Radio Battalion: 55-56Sub Unit One, First Radio Battalion:56-57,63,65,66-68MARKET TIMECOMSEC survey: 58, 59, 69, 89,109-16MCCD operations: 11-12,144-47tactical operations: 58, 59, 64,109-10McConnell, GeneralJohn P.: 73,82,83,84McNamara, Robert S.: 74Mearns, Maj. Gen. F. K.: 43Melanson, Capt. Leo M.: 52MIG-21's: 149,150,151,152,159Military Assistance AdvisoryGroup(MAAG), Vietnam, COMSECinspectionof: 20Military Assistance Command, Thailand(MACTHAI), COMSEC operationsfor: 23, 25Military Assistance Command, Vietnam(MACV)COMSEC for: 20,22,23,25,28-29,34and increased COMSEC strength:74, 75J-2, and COMSEC: 48Monitoring and analysisIof Air Force ground administration:121AFSS: 72, 73, 76, 77, 83, 89, 96,100-03, 107-09, 120, 121,125,134of air-to-air coordination: 121of air spacerequirements: 121ASA: 22, 23, 25, 29, 30, 33, 34,\ 35,42,43~45,48,91-95,\ 120-21,125,143\ communications not monitored:30,77ITOP SECRET UMBRAnOfORn(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'f~Jl ~f:elt~"f UMBRA nOFOlUJ178concept of conventional: 159, 162concept of surveillance: 87-90,128,162ofcontrol tower directions: 121of encrypted material: 22, 30, 89,96equipment for: 22,30,63-65,72-75ofFM: 30,34ofHF: 72,73,74,83,103,110,112,116,134of in-flight reporting: 121of manual Morse: 22, 30, 93, 116Marine Corps: 65and MCCD operations: 146of MF-SHF range: 103-04of microwave range: 34, 98, 103,104mobile: 22,23,29,30multichannel: 30, 73Naval Security Engineering Facility:105-07NAVSECGRU: 54-55, 58, 6465,67-68,89,96-99,104,109-19,125,130NSA: 89,96,103-04,109percentage of coverage: 19, 34, 64premanent detachments: 23of preflight testing of equipment:121quantity of: 22,34,42,65,93of plain English: 77,91,96,112,125of radio, general: 33, 35, 43-45,48,65,77,100,120,125of radiotelephone: 19, 22, 25, 30,33,44,73,75,91,93of radioteletype: 22,30,33,34,93,125of refueling operations: 121and refusal to change plans: 19,35WORKING AGAINST THE TIDEof single sideband: 30,34,72,97,116,134successful, causes change of plans:19,35,68of telephone: 22, 25, 30, 33, 35,44,73,98,100,120,125oftroposcatter: 34,74of UHF: 72, 73, 74, 75, 76, 77,83,97,98, 103, 110, 116, 125of VHF: 72, 73, 74, 75, 76, 77,97,99, 101,103,110,116,125of wea<strong>the</strong>r reconnaissance: 121Moore, Maj. Gen. Joseph H.: 73National Cryptologic School: 158National Security Agencyand CC&D operations: 140COMSEC responsibility of: 2and COMSEC surveillance: 87,88,89,128and Guam COMSEC study: 89,96, 103-04, 109and PURPLE DRAGON: 128,130Naval Security GroupCOMSEC education by: 63, 6567,68COMSEC operations: 54-55, 58,63-71, 89, 96-99, 104, 10507,109-19,123, 125, ~39,144, 146COMSEC organization: 20, 54-62COMSEC strength: 54,55,58,62,63,64monitoring equipment: 63, 64, 65Naval Security Group unitsafloat: 54,58,60-61,63,104,110COMSEC 701: 54,97-99COMSEC 702: 54, 69, 110,112-15'f~fi ~f:eKf:'f UMBKA HOfORH
!LTOP SeClUH· UMBRAnOFORPJINDEX 179COMSEC 703: 54, 146COMSEC 704: 54COMSEC 705: 57-58,59-60,117COMSEC 706: 62COMSEC Team, Naval SupportGroup DaNang: 57-58COMSEC Team One (Alpha): 54,63,65COMSEC Team Two (Bravo):60-61,63,65COMSEC Team Three (Delta):58-60,116-19,123COMSEC Team Four: 62,117-19COMSEC Team Five: 61-62COMSEC Team Saigon: 58COMSEC Team Vietnam (C):55-56,64,66Detachment Delta, Naval CommunicationsStation Philippines:58NAVSECGRU Activity Hanza:54NAVSECGRU Activity Kamiseya:54,55,59-60,62,115NAVSECGRU Headquarters,Finegayan: 105-06shore-based: 54,55-60,62,64,65,~7-99, 104, 105-07,109-19Naval units. Seealso Naval SecurityGroup units.Beach jumper Unit One: 61-62Destroyer Squadron 19: 146Naval Advisory Group, Saigon:59,111-12,115,116Naval Air Communications FacilityAgana: 106-07Naval Communications StationCam Ranh Bay: 62Naval Communications StationFinegayan: 106Naval Communications StationGuam: 54,106, 123Naval Communications StationPhilippines: 54,55,62Naval Forces, Marianas: 106Naval Security Engineering Facility:105-07Seventh Fleet: 54, 55, 113Task Force 71: 144,145-47Task Force 76: 61Task Force 77: 144Task Force 115: 58, 59, 109-10,112-13,147Task Force 116: 59, 62, 116, 117Task Force 117: 62,117Task Group 76.4: 61Task Group 76.5: 61Task Element 70.7.7.1: 123Task Element 70.7.7.2: 123Nicholson, Col. Tom M.: 15-16NIGHTSTICK: 89North Vietnam. See Vietnamese Communistthreat.North Vietnamese Central ResearchDirectorate: 6Notices to airmen (NOTAM's): 12122,135,137O'Connor, Maj. Gen. George G.: 52Office ofSpecial Investigation (AF):130Olds, Col. Robin: 151,152Operational security (OPSEC): 138Philco Tropo system: 84Positive identification radar advisoryzone (PIRAZ): 64Practice Dangerous to Security Report(PDSR): 37TOP SECRET UMBRAPfOrORtl
1=QP 8~CR::ET UMBRA UOFORH180Prestrike Report: 80Proteus, USS: 96, 107PURPLE DRAGON COMSEC study:88,90,128-38,163Ranger, USS: 5Red/<strong>Black</strong> criteria: 96Reichard, Maj. George D.: 48Reporting, of malpractices. See a/soreports by name.AFSS: 72,77,79-81,82,83ASA: 36-43Marine Corps: 68NAVSECGRU: 54-55,63,67,68,69-71, 112, 117, 118Republic of Korea, cryptosystemsfor:12Republic of VietnamCOMSEC of: 2-3,6,7,12,20,22,23,25,28-29,38,82and GAME WARDEN: 116and MARKET TIME: 109-10,113,116ROLLING THUNDER: 128-29,131,134,137-38Ryan, GeneralJohn D.: 83Search and rescue (SAR) operations: 64ServiceCryptologic Agencies. See AirForce Security Service; ArmySecurity Agency; Naval SecurityGroup.Sharp, Admiral U. S. G.: 87-88,90,122,123,124,125,127-28,138, 144, 145, 148SILVER BAYONETCOMSEC study: 48, 50,89,91-95operations: 90,94Sou<strong>the</strong>ast Asia Military Air RouteFacility (SEAMARF): 121-22,127WORKING AGAINST THE TIDEStrategic Air Command. See ARCLIGHT; B-52's.Surveillance, COMSECand COMSEC studies: 128-38concept of: 87-90,128,162evaluation of: 49, 162-63TAREX (target exploitation): 44,49,51, 158TEMPEST: 1,96, 103-09Tet offensive (1968), and navalCOMSEC operations: 62ThailandCOMSEC operations in: 22counterinsurgency operations(COIN): 82Timmes, Maj. Gen. Charles].: 20TRANSEC Analysis Notes (TAN's): 81TRANSEC Interim Summary (TSIS):81TRANSEC Item of Interest (TIOI):80-81TRANSEC Review Board (Seventh AF):84Transmission Security Analysis Report(TSAR): 37Transmission Security Message Report(TSMR): 80, 83Transmission Security Monthly Summary(TSMS): 80,101Transmission Security Summary Report(TSSR): 37Transmission Security Violation Report(TSVR): 37,38,41Viet Congo See Vietnamese Communistthreat.TOP SECRET UMBRAUOFORH(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
'fOP SECRE'f UMBRANOFORt,INDEX 181Vietnamese Communist threatIjamming: 9SIGINT operations: 1, 2-11,19,35-36, 43-44, 49, 122, 139,155,158,159and VC COMSEC practices: 110Violations. See also Reporting, of malpractices.Violations, causescipher-signal anomalies: 103, 104communications structures: 113,117correction of: 20, 38, 43-44, 4849,65-71,82,84,94-95,102-03, 104-05, 106, 107,108,109,113-14,115,116,117-18,121,122,126-27,131,134-35,137-38,162,163, 166-67daily F-105 reports: 83data processing equipment: 10708EFTO procedures: 126equipment design and installation:105, 106, 107excessive communications: 44, 53,166failure to au<strong>the</strong>nticate: 8, 44, 54,55,93improper use of codes: 55, 58, 83,114, 116lack of command emphasis: 2,15-16, 35-36, 43, 45, 48, 5054, 55, 67, 69-71, 91, 93,94,120,155,158,167long-term use of code names: 55,82,127organizational complexity: 113refusal to use cryptosystems: 20,91-92, 166shortages of cryptosystems: 83-84,113,114,117,121short-tour dilemma: 11unauthorized codes: 7, 14,44,45;48,52,53,55,92,93,94unencrypted communications: 3,5,6-7,19,20,44,91,93,98,101-02,104,116,120-21,166vague guidelines: 13,81Violations, information revealedin action reports: 113on aircraft operational areas: 83on air operations, general: 3, 5,6-7, 38,68,73,77, 78-79, 82,83, 96, 98, 101-02, 104, 120,125,126,128,134,135,137on air reconnaissance: 38, 72on air refueling: 78on air tactics: 78on air-to-air coordination: 78on antenna bearings: 98on bomb damage assessments: 77on budget figures: 98on call signs: 38, 44-45, 52, 53,73,93,94on carrier-air squadron relationships:98on casualties: 113on classifiedequipment capabilities:93on command and control systems:72on frequencies: 38, 52, 93, 94, 98on grid coordinates: 38, 73, 82,93,94,112-13,118,127on locations of units: 38, 39,44,93,94on logistics: 93on medical evacuation: 15On MIG alerts: 77On naval order of battle: 112, 118on orbits: 83'fOPSECRE'f UMBRAtfOFORU(b) (1)(b) (3)-P.L. 86-36(b) (3)-50 USC 403(b) (3)-18 USC 798
TOP SECRET U~fBRA182f;iOFORHWORKING AGAINST THE TIDEreporting on: 34, 36-43, 54-55,63, 67, 68, 69-71, 72, 77, 7981,82,83, 112, 117, 118, 123,125on SAM alerts: 77on search and rescue: 79on ships' movements and cargo: 98on special navigation techniques:78on TACAN azimuths: 83on tactical plans, general: 35, 3839,44,52,93,94,102, 116,120-21,134on tactical operations, general: 93,94, 116, 118-19on time-over-target: 73,83on troop movements: 113on troop training: 113on types of aircraft: 72on underway replenishment: 113on VIP trips: 19,38,73,82Violations, rates of: 42-43,44Violations, sources ofAir Force: 8,14,72,73,77-78,82,83,101-03,104,107-09,120-21,125,126,127,134,135,137Army: 15,19,20,35',38-39,40-41,43-45,48,52,53,54,91-95,125,127MACV: 127Marine Corps: 68Navy: 3,5,55,58,68,98,105,106,107,112-13,114,116,118RVN: 2-3,6, 12,35,38,53,82,110TEMPEST: 103-09Walker, Col. Robert T.: 20Walt, Lt, Gen. Lewis W.: 68Westmoreland, General William C.;49,127,144,148Weyand, Lt. Gen. Frederick c.: 144Wiretappingenemy: 44guarding against: 98World War II, COMSEC in: 2,53, 166World-Wide Operations Security Conference,1968: 138'TOF SfKR:E'T UftfBRAHOFORH