NSA Electronic Key Management System (EKMS) Trend Analysis

This file is available on a Cryptome DVD offered by Cryptome. Donate $25 for a DVD of the Cryptome 10-year archives of 35,000 files from June 1996 to June 2006 (~3.5 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. Archives include all files of cryptome.org, cryptome2.org, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org. Cryptome offers with the Cryptome DVD an INSCOM DVD of about 18,000 pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985. No additional contribution required -- $25 for both. The DVDs will be sent anywhere worldwide without extra cost.

15 August 2006

Source: https://ekm.netwarcom.navy.mil/netwarcom/nnwc-nipr/ncms/guides/alcoms/04306.txt

UNCLAS  //NO2280//
ALCOM 043/06
COMMO - ENSURE SEPARATE COPY TO EKMS MANAGERS
MSGID/GENADMIN/NCMS WASHINGTON DC/-/MAY/2006//
SUBJ/ELECTRONIC KEY MANAGEMENT SYSTEM (EKMS) TREND ANALYSIS
UPDATE #1/2006//
POC/B. SEMPLE/CDR/NCMS WASHINGTON DC/-/TEL:DSN:857-9938
/TEL:COMM:240-857-9938/EMAIL:NIPR:BERNADETTE.SEMPLE(AT)NAVY.MIL/
EMAIL:SIPR:BERNADETTE.SEMPLE(AT)NAVY.SMIL.MIL//
POC/H. ROYAL/GG-13/NCMS WASHINGTON DC/-/TEL:DSN:857-7807
/TEL:COMM:240-857-7807/EMAIL:NIPR:HAYWOOD.ROYAL(AT)NAVY.MIL/
EMAIL:SIPR:HAYWOOD.ROYAL(AT)NAVY.SMIL.MIL//
POC/M. PIECHURA/LCDR/NCMS WASHINGTON DC/-/TEL:DSN:857-7703
/TEL:COMM:240-857-7703/EMAIL:NIPR:MICHAEL.PIECHURA(AT)NAVY.MIL/
EMAIL:SIPR:MICHEAL.PIECHURA(AT)NAVY.SMIL.MIL//
POC/R. BYRD/ENS/NCMS WASHINGTON DC/-/TEL:DSN:857-7808
/TEL:COMM:248-857-7808/EMAIL:NIPR:RICHARD.BYRD1(AT)NAVY.MIL//
POC/P. JOHNSON/GG-13/NCMS WASHINGTON DC/-/TEL:DSN:857-7706
/TEL:COMM:240-857-7706/EMAIL:NIPR:PAMELA.JOHNSON(AT)NAVY.MIL//
EMAIL:SIPR:PAMELA.JOHNSON(AT)NAVY.SMIL.MIL//
RMKS/

1. THIS ALCOM IS THE FIRST IN A SERIES OF MESSAGES FOR
CALENDAR YEAR 2006 THAT WILL PROVIDE EKMS MANAGERS WITH UPDATES
ON SIGNIFICANT TOPICS IN THE EKMS/COMSEC ARENA. THIS UPDATE
WILL IDENTIFY COMMON TRENDS SEEN VIA COMSEC INCIDENT MESSAGES,
CMS ADVICE & ASSISTANCE (A&A) 18-MONTH TRAINING VISITS AND 
TROUBLE CALLS TO DCMS WASHINGTON DC.

2. OVER THE PAST 3 YEARS, THE DISCIPLINE AND RIGOR OF COMSEC
ACCOUNT MANAGEMENT HAVE ATROPHIED, AND THE NUMBER OF COMSEC 
INCIDENTS/PRACTICES DANGEROUS TO SECURITY (PDS) HAS INCREASED.

THE FOLLOWING STATISTICS ARE PROVIDED:

2003 - 350 COMSEC Incidents
2004 - 424 COMSEC Incidents/72 PDS's
2005 - 493 COMSEC Incidents/99 PDS's

3. THE FIRST CALENDAR YEAR 2006, DEPARTMENT OF NAVY (DON) COMMANDS
REPORTED 109 COMSEC INCIDENTS TO NSA AND/OR DCMS FOR EVALUATION. 
76 WERE NOT ATTRIBUTED TO COMBAT SITUATIONS/AIRCRAFT MISHAPS
AND ARE DISCUSSED BELOW. STATISTICS AND TRENDS:

A. STATISTICS

    1. LOST/MISSING MATERIAL: 35 
    2. UNAUTHORIZED ACCESS: 15
    3. LOSS OF CONTROL/ACCOUNTABILITY: 13
    4. USE OF WRONG KEYING SEGMENT: 5
    5. USE OF SUPERCEDED KEYING MATERIAL: 4
    6. UNSECURED VAULT: 4

B. TRENDS

    1. LOST/MISSING MATERIAL. THE MAJORITY OF THE LOSSES OCCUR 
AT THE LOCAL ELEMENT. MAJORITY OF THE MATERIAL REPORTED 
LOST ARE HAND-HELD RADIOS AND OTHER PORTABLE DEVICES. WITHIN THE
LOCAL ELEMENT COMSEC MATERIAL CHANGES HANDS MANY TIMES AT WATCH
TURNOVERS. THE EXCHANGES ARE NOT DOCUMENTED OR TRACKED. THE LOSS
IS DETECTED WHEN AN INVENTORY OR SPOT CHECK IS HELD. AT THE 
WATCHSTATION: ESTABLISH OR RE-EMPHASIZE PROCEDURES THAT REQUIRE
EXCHANGES OF COMSEC MATERIAL BTWN WATCHSTANDERS TO BE DOCUMENTED
IN THEIR LOGBOOKS. IMMEDIATELY REPORT PROBLEMS TO THE CHAIN OF
COMMAND.

    2. UNAUTHORIZED ACCESS. NUMBER ONE CAUSE: SECURITY CLEARANCE 
DISCREPANCIES. THE EKMS MANAGER/COMMAND SECURITY MANAGER MUST
WORK TOGETHER TO ENSURE INTERIM CLEARANCES ARE CHECKED; EXPIRED
CLEARANCES ARE DETECTED; AND ALCON IN THIS PROCESS ARE SHARING
INFORMATION.

    3. LOSS OF CONTROL/ACCOUNTABILITY. NUMBER ONE CAUSE: SHIPPING 
VIOLATIONS (USE OF WRONG SHIPPING METHOD OR IMPROPERLY PREPARED
PACKAGES). ENSURE SHIPMENTS OF COMSEC MATERIAL ARE PROPERLY 
ADDRESSED, SEALED, CONTAIN SF-153 PAPERWORK, AND CLEARED 
PERSONNEL ARE HANDLING THE MATERIAL WHEN THE BOXES ARE TURNED
IN FOR SHIPMENT, OR OPENED UPON RECEIPT. 

    4/5. USE OF THE WRONG KEYING SEGMENT/USE OF SUPERCEDED
KEYING MATERIAL ARE RELATED. ENSURE WATCHSTANDERS HAVE CURRENT
EFFECTIVE/SUPERCESSION INFORMATION, STATUS BOARDS ARE CURRENT,
AND EQUIPMENT IS LABELED WITH CORRECT CIRCUIT INFORMATION. 

    6. UNSECURED VAULT: NUMBER ONE CAUSE: ONE PERSON, ACTING
ALONE, FAILS TO SPIN COMBO DIAL OR CHECK DOOR.
4. THE FOLLOWING WERE OBSERVATIONS BY CMS A&A TEAMS DURING
18-MONTH TRAINING VISITS AND WHILE ANSWERING PHONE CALLS.

A. COMMANDING OFFICER'S UNANNOUNCED SPOT CHECKS ARE NOT BEING
CONDUCTED. REFER TO EKMS 1, ANNEX D (THE COMMANDING OFFICERS
EKMS HANDBOOK). COMMANDING OFFICERS AND EKMS MANAGERS 
MUST ENSURE THAT THESE SPOT-CHECKS ARE CONDUCTED AT LEAST
QUARTERLY.

B. EKMS ALTERNATE MANAGERS NOT INVOLVED WITH THE ACCOUNT. 
ALTERNATE MANAGERS ARE JOINTLY RESPONSIBLE TO HIS/HER 
COMMANDING OFFICER FOR THE PROPER MANAGEMENT AND SAFEGUARDING
OF COMSEC MATERIAL HELD BY THE COMMAND. REFER TO EKMS 1, ART 
460.

C. UNAUTHORIZED ACCESS TO COMSEC MATERIAL. ACCESS TO              
CLASSIFIED COMSEC MATERIAL REQUIRES A SECURITY CLEARANCE 
EQUAL TO OR HIGHER THAN THE CLASSIFICATION OF THE MATERIAL
INVOLVED. ADDITIONALLY, ACCESS LISTS ARE NOT BEING 
UPDATED. ACCESS LISTS MUST BE UPDATED WHENEVER THE 
STATUS OF AN INDIVIDUAL CHANGES OR AT LEAST ANNUALLY. 
EKMS 1, ART 505 (d)(2) PERTAINS.

D.  EMERGENCY ACTION PLAN/EMERGENCY DESTRUCTION PLAN NOT 
UPDATED RANKS NUMBER ONE THIS QUARTER. EKMS MANAGERS ARE 
RESPONSIBLE FOR MAINTAINING A WRITTEN AND UP TO DATE EAP/EDP
PLAN FOR THE SAFEGUARDING OF CLASSIFIED MATERIAL IN THE EVENT
OF AN EMERGENCY (I.E. NATURAL DISASTER, TERRORIST ATTACK 
OR HOSTILE ACTION).  

GUIDELINES ARE PROVIDED IN EKMS 1, ANNEX M.

E. EKMS MANAGERS ARE NOT MAINTAINING THEIR FILES. EACH EKMS
ACCOUNT WILL ESTABLISH AND MAINTAIN THE FOLLOWING 
COMSEC-RELATED FILES: CHRONOLOGICAL FILE, CORRESPONDENCE/
MESSAGE AND DIRECTIVES FILES, GENERAL MESSAGE FILE AND LOCAL
CUSTODY FILE. REFER TO EKMS 1, CHAP 7, PARA 703.

F.  VISITOR LOGBOOK ENTRIES.  A VISITOR LOG BOOK IS REQUIRED
TO BE MAINTAINED FOR A MINIMUM OF ONE YEAR. ALL PERSONS NOT
ON THE LOCAL ACCESS LIST SHOULD BE RECORDED IN THIS LOG.

G.  LMD/KP PLATFORM MAINTENANCE.  MAINTENANCE FUNCTIONS ARE 
REQUIRED TO BE COMPLETED ON A REGULAR BASIS. 
REFER TO EKMS 1, ANNEX W, PARA 10 (T), ANNEX W, PARA 10 (W) 
AND ART 1185, PARA E.

H. ACCOUNTABILITY RE-INIT 1 AND 2 KEYS. BOTH KEYS ARE 
REQUIRED TO BE ENTERED INTO LCMS IAW ALCOM 060/03 AND 
EKMS 1, ART 1185(d). 

I. KP CHANGEOVERS ARE NOT BEING PERFORMED. KP CHANGEOVERS 
MUST BE CONDUCTED EVERY 3 MONTHS. FAILURE TO PERFORM A KP 
CHANGEOVER IS A NON-REPORTABLE PDS. REFER TO EKMS 1, 
ART 1005(a)(11)(a).

J. EKMS MANAGERS ARE NOT VERIFYING THE COMPLETENESS AND 
ACCURACY OF SF 153'S. THE ACCURACY OF ACCOUNTING REPORTS
IS AN EXTREMELY IMPORTANT ASPECT OF ACCOUNT MANAGEMENT.
PRIOR TO FORWARDING A REPORT, THE COMPLETENESS AND 
ACCURACY OF INFORMATION MUST BE VERIFIED. REFER TO EKMS 1,
ANNEX T, PARA 4.

K. IMPROPERLY COMPLETED SF-700'S. THE NAME(S) AND ADDRESSES
OF THE INDIVIDUAL(S) AUTHORIZED ACCESS TO THE COMBINATIONS
MUST BE RECORDED ON THE FRONT OF THE ENVELOPE. SEE RECALL
IS NOT AUTHORIZED ON THE FRONT OF THE SF-700 FORM. REFER
TO EKMS 1, CHAP 5, PARA 515 (f).

5. MANY OF THE DISCREPANCIES IDENTIFIED ABOVE CAN BE FOUND
AND RESOLVED DURING A ROUTINE CMS A&A TRAINING VISIT. THESE
TRAINING VISITS ARE A GOOD WAY FOR COMMANDING OFFICERS TO
BE SURE THAT THEIR EKMS ACCOUNTS ARE BEING MANAGED PROPERLY
AND ARE HIGHLY RECOMMENDED PRIOR TO THE REQUIRED 24 MONTH
EKMS INSPECTION.

6. ADDITIONAL INFORMATION CAN BE OBTAINED FROM THE LISTED
POCS OR FROM YOUR SERVICING CMS A&A TEAM.

7. THIS ALCOM IS CANCELLED FOR RECORD PURPOSES 31DEC06.//