'· • REF ID:A57052 

MEMO ROUTING SLIP I .• EVER USE FOR APPROVALS, DISAPPROVALS, 

CONCURRENCE:S. OR SIMILAR ACTIONS 

1 NAME OR TITLE CIRCULATE 

Colonel. Marcy ORGANIZATION AND LOCATION DATE x COORDINATION 

DD/PROD 

2 FILE 

Col.mt.el Rerrelko 

x INF'ORMA TION 

DD/CrMSF.C 

3 

~ NECl!SSARY 

RAIM FROST ACTIOH 

NaTE AND RETUllH 

4 SEE ME 

SIGNATURE 

REMARKS 

-2014 

ORGANIZATION AND LOCATION 

Special. Assistant 

DD FORM 9 5 Replaces D.A. A.GO Form 8911, 1 A.pr 48, and .A.Jl'RQ I FEB 50 ll'orm 12. 10 Nov 4.7, whlob. mlloll' tie uaed. 
' ..- - - ... REF ID:A57052 

SECURITY CLASSIFICATJON W llDV) 

DISPOSITION FORM 

FILE NO. 

> ' 

I SUBJECT Compromises at COMmT Due to Inef'f'ective 

COMSEC 

TO Chief' of Sta.f'f' FROM S/ ASST, Mr~i~~ DATE 3 November 

COMSEC (Col. Herre'1.ko) 

Us PROD {Col. Marcy)~cre,f!!!:l)O ~tf't ry) 

References: a USCIB: 3.5/851 21 October 1z;4 

b rsm/338/54, 1 October 1954L}:~cl.. 1 ot Ref'. Car/ 

COMMENT NO. 1 

c CIB #000273 Lincl. 2 of Ref'. (ar/ . d Part III of BSA Serial 0004o71 3 Sept 1954 /J:Acl. l. at Ref'. {c 

e NSC J.68, 20 October 1953 

f' DOD Directive: Communications Security (COMSEC), 24 Apr 1954 

g BSCID Bo. 9 Revised, 21f. October l.952 

l. Reference (a) cites once again the probl.em of inettective communicatio 

security. Its inclosures recommend preventive alld corrective actions. 

2. !.• In Bef'erence (c) the Director is quoted as saying: 

"Errors in this category are ordinarily due to partial ignorance 

of' the ruJ.es or insuf'f'icient training and experieDCe in their application, and 

-less frequently' to inattention or carelessness. Additional. trainiJJs and 

experience, therefore, can be expected to resul.t in a degree of' technical 

competence that could virtually eliminate this type of' error." 

E,. .Again the Director ia quoted f'roa Reference ( c) : 

"••• preventive and corrective action in the future should place 

increased and continued emphasis on specific guides and criteria far the trainiJ.'lg and indoctrination of personnel, and on the basic responsibility of command 

to develop in subordinates a deep aense of personal reeponsibility for the 

maintenance ot cOD111.UDicationa security." 

3. Consistent with the Director1a indicated sentiments iD the matter, 

Reference (d) cites additional action contemplated by BSA to improve communications aecurity in the C<MIBT ele:meata under bis operational. and technical. 

control. l3e.sically these are i 

!:.• Issuance or detailed check lists tor field uae. 

b. Imnediate ins:pection. of activities b7 the o.:rticers 1n Charge or 

b;y Camnanding otficera, :toll.owed by similar inapections nery six months, 

utilisi»g the check list• of !:.• 

~· U.DOtticial Traiaing Yi•it Teams provided by lfSA on a qua1itiedperacmnel-available basis f'or explanation and discussion of the check list and 

its uae at the f'ield stations. ("Requests far training visits would be addrease 

to the Director, NSA1 via the Head of the Service Cryptologic Agency conceraed.N) 

DJ? 1i~~~~ 96 REt>lACES."METCiPMSECRET 

a' . Jtl- I 

ta--alllll... oQo U I GOV'E'ANllll'NT lllllNTIN• O'P'P1CI 
.. 

/ 

' I/ 

. ... 

d. The establishment of' COMSEC training cri terie. for the guide.nee 

of' CoDID8.Ilding Officers and Officers in Charge of' COMINT activities. 

' 

4. Referring to the corresponding sub-paragraphs of para.graph 3 above, the 

following comments are of'f'ered: 

a. Expanded, re-worked, and more inclusive check lists than those now 

in existence for field use is undoubtedly a f'ine idea. These check lists should 

be reviewed on a continuing basis. 

b. An OIC of CCMSEC functions whose persona1 and continuing SOP 

does not include an almost daily inspection of check list procedures is not 

doing his job. A once-secure procedure, whether governed by a check list or 

not,·is not necessarily selt-perpetuating--even on a day-to-day basis. This 

recommendation contains no new force. Furthermore, if the OIC • s ever got the 

idea that inspections on a six-month basis were su:f'f'icient 1 it could be damaging. 

If' the purpose of this recommendation is only to get a six-month report on COMSEC 

procedures from the field, then it has merit. 

c. The idea of getting qualified NSA. COMSEC people out to the field 

to explaiii and ·discuss is good, but this recommendation is weak. It is to be 

an unotticie.l program on a personnel-available basis, utilized on the request 

ot the field activity; thus, it would constitute a hit-or-miss proposition at 

best. 

d. Good. The training cri terie. shouJ.d include sufficient cryptanalytic 

knowledge-to assure that CClfSEC people a.re consciously aware that improperly 

used cryptosystems can be read. 

5. NSA'a mission is such, and the compromises of' COM!Ifr due to inef'f'ective 

communications security are such that the serious dangers to COMINT security can 

be reduced or elimimted only by some liSA actions beyond those which are already 

beiDg taken by the respective Services. The idea that NBA actions would be 

super:f'luous in this situation is now a proven f'a.ll.a.cy. It appears that NSA has 

little choice in the matter. We should and must assume a position of' consistent, 

continuing, and agressive leadership in the realm of COMSEC and especie.14" as 

regards the security of our COMINT communications. Where the tools needed to 

accomplish the mission are inadequate or lacking, they must be manufactured. 

This is e11pec1a.lly true as f a.r as training and ins.11ection functions are concerned. 

6. In accordance with the foregoing, the following suggestions are made: 

a. Initiate action as soon as possible to have NSC 168 amended to 

include c<iJsEc training as a directly stated NBA responsibility. 

~· Carry out the actions indicated in Reference (d) pertaining to the 

issuance of detailed check lists and the establishment of COMSEC training criteria. 

£.• Send appropriate letters to the Services and the Cryptologic .Agencies, 

encouraging them (:pe.rticular:cy the .Army and the Air Force) to make cryptosecurity 

the primar,y duty of' the responsib1e otf'icer rather than an additional duty as is 

too often the case. 

TOP SECRET 
... 

/ 

... -f'~ _REF ID:A57052 e 

\;)f=' StECF<ET 

d. Send appropriate letters to the Services and Cryptologic Agencies 

to encour&ge a vigorous and continual on-the-Job education of the operators 

and the responsible ot:ricers in the existence, availability and proper uae of 

the AFSAGS1 JANAPS, OI's, etc., and the ma.chin.es themselves. -

-e. Recognize the f'act that BSA bas a world-wide, dual operational 

mission by deliberately assigning a C<JrfSEC expert to each NSA overseas head.quarters 

and charging him with the appropriate responsibilities so that he may advise and 

instruct the responsible cryptosecurity officers on the specific nature and causes 

ot violations and the many tools and publications available to help prevent 

breaks i:t utilized properly. This NSA man could run a quarterly critique, based 

on the violations listed in the quarterly COMSEC Violations Reports, and trace 

each break to the operator and me.chine concerned and give on-the-spot guidance 

on the proper use of the available tools to avoid the possibility of such breaks 

in the future~ DSA is already charged (Ref'. f'.) with providing technical 

guidance and support for cr,yptosecurity training conducted by the military d.epa.rtmentsJ 

f. Cause a tactful. study to be ma.de of the IG functions of the 

Cryptologic Agencies to determine z 

(J.) To what extent they include inspection and assistance 

1.n the implementation of the operational and technical 

directives of IfSA, aJJd 

(2) What steps need to be ta.ken to develop a well--directed, 

coordinated, and continuing IG inspection and assistance 

syste:m. executed by the Cryptologic Agencies and guided 

by the NSA Inspector General to assure the implementation 

of all BSA's operational and technical directives. 

S.• Take the steps indicated as a result of !,(2). 

[fn regard to inspections of' COMSEC activities, the pertinent DOD 

Directive (Ret'erence f) now merely states: 11Nothing in this directive shall 

be construed to give the 'Board or any of its representatives the right to 

inspect the operation of COMSEC in aizy" military department without approval. by 

the head thereof. ':J 

7. Some of the actions mentioned above are undoubtedly being carried out in 

some degree in one place or another. However, I do not believe there is a deliberate, 

well conceived, over-a.11 ett'ort with a siDgleness ot purpose designed specifically 

to :promote a vigorous and continual program ot real. leadership and follow-up action 

to reduce the compromises of CCIUJ.'fr and other classified material attributable to 

ineffective communications-security measures and actions. Tb.is is a major pa.rt 

ot NSA's mission, stated explicitl:a' or implied in the pertinent directives; we 

shoul.d take vigorous action to carry out that part of our mission. 

<M~~ g,~,a·L-. WILLIAM F • FRIEDMAN 

Special Assistant