A NEMESIS in the skyPAN, MENTOR 4, and close encounters of the SIGINT kindby Marco Langbroek
|
| PAN was to become the classified satellites buff’s pet mystery: who owns PAN, and what purpose it has, remained highly mysterious for a long time. |
New documents from the Snowden files published by The Intercept on September 6, 2016, however, changed the game. With the information from these leaked documents in the open, keeping things within an inner circle no longer seems necessary. The documents confirm some long-standing suspicions. Here is what we know.
Initially it was all a mystery. The PAN launch had no NRO number, and unlike what normally happens, no government agency came forward claiming ownership of the satellite. A launch patch surfaced that showed a rocket emerging from an exhaust cloud featuring a suggestive question mark. The patch also featured the phrase “Palladium At Night”—PAN—which was equally enigmatic and unrevealing. Later, it was rumored that the acronym originally stood for “Pick A Name” (I have it from a good source that this is actually true.)
 PAN Patch. from the collection of the author |
Its pre-launch history, from the inception of PAN as project P360 to the launch of the satellite in 2009, had been unusual too. At the time of launch, it was known that PAN was created in record time from off-the-shelf commercial components. Lockheed Martin released information that the satellite bus is its A2100, one used for many commercial communication satellites. Lockheed acquired the contract to build PAN in October 2006: the satellite was launched a mere three years later. A very fast and unusual track for a classified satellite indeed!
After launch, the enigma became even bigger. PAN was placed in a geostationary orbit and observations by amateur satellite trackers (including this author) from Europe and South Africa revealed very unusual behavior. Every few months—usually once every six months—PAN moved to a new position. In a mere four years time, it moved at least nine times to various longitudes scattering between 33 and 52.5 degrees east (see my blog post “Imaging Geostationary satellites, and PAN’s past relocations”). This costs fuel, and it is something you normally do not do with a geostationary satellite, as liberally spending fuel drastically shortens the satellite’s operational lifetime. In late 2013, the relocations suddenly stopped and PAN has remained at longitude 47.7 degrees east. This active stationkeeping at this longitude means it must still be operational, although the satellite obviously has ended its previous roving state. All very mysterious! What was this spacecraft doing?
 Diagram of PAN movements 2009–2016, based on amateur observations. |
Initially, in 2009, some analysts speculated that PAN was a dedicated communications satellite, perhaps for the CIA, used either for communications with operatives in enemy territory or perhaps as an on-orbit relay station for UAV (drone) operations. The fact that South African amateur tracker Greg Roberts discovered that PAN was operative in radio frequencies on the same frequencies as military communication satellites in the UFO (Ultra High Frequency Follow-On) constellation initially seemed to bolster this idea.
In reality, PAN is not a communications satellite but a signals intelligence (SIGINT) spacecraft: a spacecraft eavesdropping on, in this case, other satellites. Amateur satellite trackers first formulated this idea a few years ago, based on the unusual behavior of the satellite. They noted that each time PAN moved to a new location, it was placed close to a commercial geosynchronous satellite for satellite telephony. All these satellites had something in common: their spot beams served particular regions on this earth. This suggested that PAN is eavesdropping on phone communications in these areas. Perhaps related, there was a dramatic rise in drone strikes that started around the time PAN became operational, specifically in Yemen. This opened up the question whether PAN (and a second satellite launched in 2009, as we will see later) was perhaps instrumental in geolocating targets for drone strikes through monitoring of the target’s satellite telephone communications. At that time, the small team of amateur trackers thought it best not to go public with their discoveries, for fear of interfering with the satellite’s mission: discussion was carefully kept within a small inner circle.
 PAN parked near the commercial satellite Yahsat 1B, May 2016. Photograph by the author. |
But things are out in the open now. On September 6, 2016, The Intercept published a number of new documents from the Snowden files, in the context of an inquiry into “targeted killings” (drone strikes) and the role and function in these of Menwith Hill, a large US-British SIGINT base in Yorkshire, UK (“Inside Menwith Hill. The NSA’s British Base at the Heart of U.S. Targeted Killing” by The Intercept, September 6, 2016). One of these documents, a copy from the internal NSA newsletter SID Today from January 2009, discusses two SIGINT satellites in unusual roles that were to be launched in 2009 and controlled from Menwith Hill. While the program names have been blacked out, the context and listed expected launch dates make very clear that the document concerns PAN as well as another SIGINT satellite, the ORION satellite Mentor 4 (USA 202). An artist impression in the document shows a satellite that is clearly similar to the Lockheed A2100 bus.
 Depiction of PAN/NEMESIS from the leaked document. |
In the document, PAN’s mission is described as: “Foreign Satellite (FORNSAT) collection from space – targetting commercial satellite uplinks not normally accessible via conventional means.” The document adds that PAN: “will provide the Office of FORNSAT a ‘site in the sky’ when denied a site on the ground for collection.”
In other words: PAN is a SIGINT satellite, one that is targeting other satellites, as amateur observers already suspected. An unusual one moreover, one that for several years moved from commercial satellite to commercial satellite, creeping up close to them to secretly eavesdrop on the communications these satellites relayed.
| PAN is a SIGINT satellite, one that is targeting other satellites, as amateur observers already suspected. An unusual one, moreover. |
The newly published document reveals that PAN is part of a program with the somewhat ominous code name NEMESIS, after the goddess of vengeance from Greek mythology. This codename was known from a 2013 NRO budget overview with code names and budgets that had been leaked by Snowden earlier through the Washington Post, but the name NEMESIS at that time had been difficult to connect to a known satellite system, even though some privately did suspect a link to PAN.
PAN, however, was and is not the only US classified satellite in the habit of creeping up close to and eavesdropping on commercial communication satellites. The document published by The Intercept discusses a second satellite with a somewhat similar mission. It concerns a satellite in the ORION series of SIGINT satellites, with a launch date in January 2009.
This launch date clearly identifies the satellite as Mentor 4 (USA 202), an ADVANCED ORION satellite launched on January 18, 2009. It happens to be one of my pet objects, one I frequently observe—it is the brightest geostationary object in my Dutch sky. The document has an interesting artist’s impression of this SIGINT satellite shedding some light on what it looks like. It shows a satellite fitted with a huge umbrella-shaped antenna on a long pole. It had long been rumored that the Mentor/ADVANCED ORION satellites, claimed to be “the largest satellite in the World” by then NRO director Bruce Carlson in 2010, have such a giant deployable mesh antenna—perhaps as much as 100 meters wide—and that this is the reason why they appear so bright in the sky. Although a scale is missing in the image, it indeed looks to be huge.
 Depiction of an ORION/Mentor SIGINT satellite from the leaked document. |
Amateur observations from 2009 onwards have shown that Mentor 4, after insertion in a near-geosynchronous orbit somewhere near longitude 100 degreest east on January 18, 2009, initially drifted westwards at a rate of about 0.8 degrees per day. This drift lasted several weeks. The satellite next stabilized in a geosynchronous position at 44 degrees east in May 2009. This fits well with what is now revealed by the leaked document, which also sheds some light on what it was doing during these initial weeks. The document states that the satellite would initially slowly drift westwards while surveying line-of-sight microwave emitters in China, until reaching its final destination. During its drift westwards, Menwith Hill in the UK at some point would take over from the initial ground control station near Alice Springs (i.e., the Pine Gap Joint Defense Facility.) This would happen after 59 days, according to the document. With an initial in orbit placement at 100 degrees east, it makes sense that Pine Gap in Australia is the initial control station, as at this initial longitude the satellite is out of reach of Menwith Hill. Handover of control from Pine Gap to Menwith Hill 59 days after launch corresponds to March 18, 2009, when, according to amateur tracking data, the drifting Mentor 4 was near longitude 61 degrees east, about halfway Pine Gap in Australia and Menwith Hill in the UK as can be seen in the map below.
 Position of Mentor 4 halfway Menwith Hill and Pine Gap, 59 days after launch. |
The document states that the satellite would drift westwards until it would reach its destination and then shift to a new mission, designated “Thuraya collection.” This again fits information gleaned from amateur observations. In its eventual position at 44 degree east, Mentor 4 was (and is) parked very close to the commercial geosynchronous telephony satellite Thuraya 2. To the author, it quickly became apparent that this close proximity of Mentor 4 to Thuraya 2 was no coincidence. Thuraya 2 has an orbital inclination that is not near zero but instead is several degrees (2.8 degrees in 2009 and 4.7 degrees currently.) As a result of the satellite’s non-zero orbital inclination, it makes a daily “analemma” in the sky, a small figure eight in north-south direction, as the satellite daily oscillates a few degrees in latitude. Mentor 4 was placed in a very similarly inclined orbit: its orbital inclination matches that of Thuraya 2 to within 0.1 degree. The position of the ascending node of the orbit is also very similar to that of Thuraya 2. As a result, and as our observations show, it makes the same daily analemma in the sky as Thuraya 2, closely shadowing the latter’s daily movement. This is very apparent in my photographic imagery of the satellite pair over the past years: the two satellites are always close to each other, in a standard relative configuration. To me, such behaviour clearly could not be coincidence: it strongly suggested that Mentor 4 was dedicatedly eavesdropping on Thuraya 2.
 Mentor 4 parked close to Thuraya 2, May 2016. Note how bright Mentor 4 is compared to the other satellites. Photograph by the author. |
 Close synchronization of daily oscillation in latitude of Thuraya 2 and Mentor 4 on a given day. |
| The very close placement and closely synchronized co-orbital movement of Mentor 4 with regard to Thuraya 2 is unique, in the sense that it is behavior different from both earlier and later satellites in the ORION series. |
The newly published document now confirms this. It states that the satellite’s initial mission during the first 1.5 months after launch was “a survey of the People’s Republic of China (PRC) line-of-sight microwave towers and emitters” while drifting westwards. After arrival at its longitude of destination (redacted in the published document, but our observations show this to be 44 degrees east), it would switch to a “new primary mission,” taking over this mission from an earlier satellite. That new primary mission was “Thuraya collection and Afghanistan/Pakistan exfiltration.” The first confirms that the close placement near, and apparent co-orbital shadowing of, the commercial Thuraya 2 satellite is indeed intentional: Mentor 4 is indeed eavesdropping on Thuraya 2. The second relates to a more typical mission of ORION SIGINT satellites: collecting radio signals from a wide geographic region on Earth. The document also mentions (in the byline with the illustration) that the satellite was expected to be fully operational around mid-May of 2009. This tallies with the observed moment of Mentor 4’s arrival near 44 degrees east. It arrived there in late April of 2009, although it did not fully stabilize there until July 2009 (see diagram below.)
Like PAN’s orbital behavior, the behaviour of Mentor 4 is unusual for a SIGINT satellite. The very close placement and closely synchronized co-orbital movement of Mentor 4 with regard to Thuraya 2 is unique, in the sense that it is behavior different from both earlier and later satellites in the ORION series: none of these shadow another satellite this closely.
This does tell us something, as the leaked document nevertheless states that Mentor 4 took over the task of “Thuraya collection” from another satellite. This previous coverage by another satellite however was of a different nature.
 Longitude changes over 2009–2011 of Mentor 4 and Mentor 2, based on amateur observations. |
The previous satellite in question is almost certainly another, earlier ORION satellite: Mentor 2 (USA 139), which, according to amateur observations, was stationed at 44 degrees east until mid-2009. The diagram above shows how the longitudes of Mentor 2 and Mentor 4 changed from 2009 to 2011. It shows that in early July of 2009, shortly after Mentor 4 had reached 44 degrees east, Mentor 2 left 44 degrees east and started to move westwards until it eventually stabilized at 14.5 degrees west in late August of 2010 (it later moved again and is currently located at 26 degrees west.)
This fits the information in the leaked document. The document mentions that after Mentor 4 had taken over the Thuraya covering mission, the spacecraft previously involved in this task would drift “0.1 degree a day west, continuing the PRC survey for approximately 200 more days”, until it would “take on a new mission targetting Latin America, Middle East and North Africa.” The latter fits with Mentor 2’s eventual new position at 14.5 degrees west, where it indeed covers all these areas. Amateur observations also show that during the first 200 days of its drift, Mentor 2 indeed drifted at a stable rate of about 0.1 degree per day, the rate mentioned in the leaked document. After day 200, it continued moving, but the drift rate changed.
 Mentor 2: pre mid-2009 position (red) and new position post mid-2010 (white). Footprints (potential area of coverage) are indicated as well. |
While it was tasked with eavesdropping on Thuraya 2 until Mentor 4 took over this job mid-2009, Mentor 2 did not shadow Thuraya 2 as closely as Mentor 4 does. It had a much wider separation, and its orbital inclination was over twice the value of that of Thuraya 2. Its daily movement was not as closely synchronized with Thuraya 2 as that of Mentor 4. The changed behavior of Mentor 4 compared to its predecessor Mentor 2 suggests that Mentor 4 does something new regarding the nature of its eavesdropping on Thuraya 2, something which requires a much closer distance and more careful co-orbital synchronization.
| CLIO is surrounded by as much mystery as PAN and, according to Lockheed, it is also based on the A2100 bus. It is therefore believed to be a second PAN, i.e. a NEMESIS, by analysts. |
In this sense, Mentor 4 behaves similar to PAN, which also moves up close to its target. PAN and Mentor 4 therefore appear to be two variants on one idea: Mentor 4 dedicatedly covering one satellite while, from 2009 to 2013, PAN operated in a roving role, visiting various satellites. Noting this partly similar, partly complementary behavior, I had already started to suspect a link between PAN and Mentor 4 a few years ago. I therefore find it extremely interesting that both are mentioned in the same document, one discussing “collection efforts for the intelligence community into areas not previously explored.”
There is more circumstantial evidence that might support this idea of a link. As mentioned earlier, the PAN/NEMESIS program was the result of a very quick development for an urgent need, using “on-the-shelf” commercial parts, with its inception somewhere short before 2006. It is interesting to note that Mentor 4 was initially scheduled for launch in 2005, but was then postponed to 2009. It strikes me that the launch postponement happened around the time of the inception of the PAN/NEMESIS program. I wonder if Mentor 4 was postponed because it was decided to fit it with a PAN/NEMESIS-like piggyback package or modification, for a PAN/NEMESIS-like role with regard to Thuraya 2 in addition to a more typical ORION SIGINT role.
I would like to note that while Mentor 4 is called an ORION in the document, this does not exclude it from being a NEMESIS platform as well. These codenames sometimes refer to packages rather than complete satellites, and in that sense satellites can have dual roles (in the case of Mentor 4 confirmed by the leaked document) and dual codenames attached. An example is USA 184, a satellite in a highly elliptical orbit that is both a TRUMPET-FO (its main mission) SIGINT satellite and a SBIRS infrared early warning satellite, as it has a piggyback SBIRS package.
Interestingly, the 2011–2013 NRO budget that was earlier leaked mentions a NEMESIS 2 in the budget overview. It is tempting to see this as a reference to Mentor 4, but it might instead refer to CLIO, a classified satellite launched in late 2014. CLIO is surrounded by as much mystery as PAN and, according to Lockheed, it is also based on the A2100 bus. It is therefore believed to be a second PAN, i.e. a NEMESIS, by analysts.
| The second of the leaked documents mentions yet another role: collecting economic information. |
So what kind of data does Mentor 4 collect from Thuraya 2? One of the documents leaked outlines the typical kinds of data gathered by an ORION satellite. It mentions that the ORION system was originally developed with a focus on FISINT (Foreign Instrumentation Signals Intelligence, such as missile telemetry signals) in mind, but is currently used mainly for gathering military COMINT (voice communications). Apart from COMINT and FISINT, data gathered includes MASINT (Measurement and Signature Intelligence), technical ELINT (Electronic Signals Intelligence), satellite uplinks, crosslinks and downlinks, and PROFORMA/RSBN (intelligence from computer-based data, such as internet IPs). Given Mentor 4’s dedicated coverage of Thuraya 2, collecting satellite uplink and/or downlink data, including COMINT and PROFORMA, will clearly be an important goal. Apart from the content of these communications, geolocating the source will in all likelihood also be an important aspect.
The leaked documents contain a few more interesting facts. While we have mostly talked about a role for Space-based SIGINT in the context of the drone war, counter-insurgency, and military conflict, the second of the leaked documents mentions yet another role: collecting economic information.
While economic information can be of legitimate military interest, it also has a potential strategic commercial value. This feeds my privately-held concern about whether the close eavesdropping on certain commercial telecommunications satellites also collects useful information from the viewpoint of industrial espionage. For non-US (e.g. European) companies and industries that might be the target of such espionage, this is something to consider. When you use your Thuraya satellite telephone or a satellite-based Internet connection to discuss your latest prospective bids for, say, building a harbor in Saudi Arabia, oil prospection in Jordan, or securing a large order of airliners from Qatar with the main office back home, the US government might be listening in and forwarding the info to interested US rival companies, to the latter’s benefit.
This is not hypothetical: it is a topic which has been of particular concern for the European Union, enough to mount an investigation after suspicions this was actually happening. The newly-published documents mentioning the gathering of economic information by US SIGINT satellites are therefore a reminder for non-US industries to make sure they use high-grade encryption when communicating sensitive strategic business information by phone, via video conference, or by email. It is also a warning that efforts by some European governments to restrict the use of encryption technologies by civilians is an unwise move that could actually harm these countries’ own economic interests.