SIGINT and the Khe Sanh Campaign

 Part One: Preliminairies 

Editor's Note

To commemorate the 50th anniversary of the 1968 Tet Offensive, the Defense Intelligence Agency (DIA) released a trove of contemporary documentation, including "spot reports" generated by tactical SIGINT units, as well as more detailed analyses produced later in Washington. Among the latter is an NSA study entitled Focus on Khe Sanh. Originally classified Top Secret UMBRA, even a half-century later there are the inevitable redactions, some of them nearly blanking out entire pages. Nonetheless, this monograph presents a remarkable case study of SIGINT as it was applied in the most highly visible battle of the war. Of course not every situation warranted the resources devoted to the defense of Khe Sanh, but the SIGINT tools and techniques described here were employed in hundreds of operations, large and small, throughout the war. 

The original narrative runs to about 90 pages. Considerable "picking and choosing" has been done in order to emphasize those portions of the story most relevant to ARDF/EC-47 operations while maintaining a sense of the overall SIGINT effort. Summaries of material not directly copied are presented in italics. Editorial clarifications are in brackets. In the original text, excerpts of reports are indented and shown in smaller font, per typesetting convention. In this web version, such excerpts are instead enclosed in quotation marks.

The narrative often uses SIGINT Activity Designators (SIGAD) when referring to units or their  locations. USM indicated a “military” (Army Security Agency) entity, USN a Naval Security Group (including USMC) station. USN-414 (Da Nang) was the principal USN/USMC control, with subordinate detachments of Sub-unit One of the 1st Radio Battalion, USMC, at various field locations in I CTZ. The Khe Sanh detachment was USN-414J4. (J1 was at Chu Lai, J2 on Hill 327 west of Da Nang, J3 at Dong Ha, and J5 at Camp Carroll.) USM-808 was ASA’s 8th Radio Research Field Station at Phu Bai. (See article entitled “The Point of No Return” for background on the Phu Bai station.) Other ASA Collection Management Authorities (CMA) mentioned are USM-604 at Nha Trang, supporting I FFV, and USM-626 at Bien Hoa, supporting II FFV and MACV directly. USAFSS (6994th Security Squadron) EC-47 units, not mentioned, were USA-561 at Tan Son Nhut, USA-562 at Nha Trang, and USA-562 at Pleiku. 

Except as indicated above, the extracts which follow were transcribed verbatim from the scanned document, which may be read on-line or downloaded in its entirely at: https://www.intelligence.gov/assets/documents/tet-documents/nsa/DocId_6622331.pdf   

*     *     *
Focus on Khe Sanh

Theodore Lukacs
December 1969

On 12 August 1967 Col. David E. Lownds assumed command of the 26th Marines, at that time attached to the Marine 3d Division. Colonel Lownds thus became responsible for the base on the Khe Sanh plateau. Since the Khe Sanh area was relatively quiet at the time, the rest of the summer was spent improving the Khe Sanh defenses. The airstrip was converted from a dirt runway into an all-weather airstrip; fortifications on the surrounding hills were strengthened, and bunkers and trenches within the base perimeter were reinforced to take heavy artillery bombardment. Among the bunkers built to withstand bombardment were those for a detachment for Sub Unit One, 1st Marine Radio Battalion. The detachment, known as USN-414J4, arrived at Khe Sanh on 22 August and was destined to play a leading role in the defense of Khe Sanh. 

SIGINT Support System for Khe Sanh 

Operations undertaken by the Army Security Agency (ASA), the Naval Security Group (NAVSECGRU), the Air Force Security Service (USAFSS), and the National Security Agency made a significant contribution to the defeat of the enemy at Khe Sanh by providing vital support to the tactical commanders involved. The cryptologic agencies furnished detailed information on the enemy's preattack buildup of forces, kept the local commanders supplied with timely, tactically exploitable intelligence during the defense of Khe Sanh, and traced the dispersal of the enemy attack forces. 

To enhance SIGINT support for tactical ground commanders in South Vietnam, the Director, NSA (DIRNSA), in 1965 and 1966 had designated three field processing stations (USM-604, USM-626, and USM-808) of the 509th USASA Radio Research Group as Collection Management Authorities (CMA's) and made them directly responsible for the effective steerage of U.S. collection facilities targeted against enemy communications, primarily within broad geographic areas. In this division, USM-808 (8th USASA Radio Research Field Station) at Phu Bai, the northernmost of the three 509th Group CMA's and the largest station in Southeast Asia, was responsible for enemy communications originating in North Vietnam, the DMZ area, the two northern provinces of South Vietnam (Quang Tri and Thua Thien), North Vietnamese military and overland infiltration communications in Laos, and the communications linking Hanoi to the headquarters of major commands in South Vietnam. USM-808 was, accordingly, the CMA for enemy communications associated with the battle for Khe Sanh. 

ACRP 

Collection of enemy communications in the northern provinces and adjoining areas by USM-808 and the USMC DSU's was augmented by ASA and USAFSS airborne communications reconnaissance program (ACRP) aircraft flying out of Da Nang and Phu Bai. During the operations at Khe Sanh, ACRP platforms were the primary source of intercept on enemy low-level tactical manual Morse communications. For these communications, the enemy used low-power, 2-watt transmitters and passed exploitable traffic of exceptional intelligence value, in contrast to the unreadable traffic transmitted over the higher power 15-watt radio links employed at higher echelons. The ACRP aircraft's capability of intercepting the low-level enemy communications far outstripped that of the ground stations. Even USN-414J4 at Khe Sanh often had difficulty intercepting these communications because of the nature of the terrain and other hearability factors. 

SENTINEL SARA, an Air Force C-47 airborne tactical collection platform under operational control of the Seventh Air Force, was the most productive of the ACRP aircraft during the battle. SENTINEL SARA (earlier known as DRILL PRESS) had shown a remarkable capability for intercepting the low-level tactical Morse communications ever since its introduction into the DMZ area in September 1966. The USAFSS C-47 COMPASS DART platform. an airborne radio direction finding (ARDF) aircraft with supplemental manual Morse communications facilities. also provided collection of enemy low-level Morse. Under the tactical callsign "Crazy Cat," ASA's 1st Radio Research Company at Camranh Bay flew ex-USN P2V Neptune patrol bombers modified as SIGINT platforms (CEFLIEN LION). The Crazy Cats also provided much valuable intercept, including exploitable messages that helped to solve new enemy crypto systems.

ARDF 

The airborne radio direction finding (ARDF) program, like the airborne collection program, was an excellent example of effective interservice cooperation. The ARDF program ... constituted a major component of the in-country SIGINT system, since by the time of the battle for Khe Sanh, ARDF fixes had come to be recognized as the most important single source of tactical intelligence. Under the control of J-2 MACV and operated by ASA's 509th Group at Saigon and the Seventh Air Force, the ARDF Coordination Center managed the in-country ARDF program, assigning and allocating ASA and USAFSS platforms in accordance with J-2 MACV priorities In close support of U.S. forces at Khe Sanh. USM-808 provided the tasking and support for the ARDF missions.

ARDF platforms provided most of the enemy unit locations, the principal exceptions being enemy units in North Vietnam, locations of which were obtained through medium range direction finding (MRDF) operations. The NSA author states that ASA's 138th Aviation Company, based at Da Nang but often operating out of Phu Bai, " flew most ARDF missions in the I Corps Tactical Zone." In terms of sorties flown that may be true. The number of fixes made by platform type is impossible to determine; indeed it may not have been recorded at the time. In any case, supported units received target locations "within 10-30 minutes of the time the fix was taken." 

USN-414J4 received and processed hundreds of ARDF fixes during the campaign, either directly from ARDF platforms or by FLASH precedence from [SIGINT ground sites.] While analysts were plotting fixes received from the ARDF aircraft, USN-414J4 passed the fix information to the Marine S-2 at Khe Sanh. The S-2 relayed the information to the Marine gun positions in the form of target data when the radius of fix was sufficiently small. Under good conditions. the time lag between the instant the ARDF aircraft fixed the position of an enemy unit and the time the first artillery shells were in the air was approximately 10 minutes.

On a less timely but nonetheless effective basis, the ARDF results were often used to target the air strikes that played such an important role in the enemy's ultimate defeat. ARDF information was of inestimable tactical value to the defenders at Khe Sanh. Colonel Lownds noted that he combined his personal knowledge of the local situation with SIGINT-derived enemy locations to gain insight into the enemy's strategy. In Lownds' own words: “COMINT played an important part in giving me current, accurate intelligence about possible and actual enemy movements.”

SIGINT Production and Dissemination 

The intelligence produced by the various components of the extensive SIGINT service varied from recurring, serialized reports issued by NSA and the CMA's to reports on target activity passed by the DSU's and CMA's on an as-soon-as-possible basis to tactical commanders and other interested recipients. NSA received SIGINT and technical data from the CMA's and DSU's, collated and analyzed the total production received from the field, and issued aperiodic reports on given subjects and one major periodic SIGINT product--the daily Southeast Asia Summary (SEAS). One primary continuing source of SIGINT incorporated in the SEAS was the twice-daily COMINT summary produced by USM-808. The SEAS was distributed to more than 100 consumers, including, at the national level, the White House; State Department; Assistant Chief of Staff for Intelligence, Department of the Army; the Joint Chiefs of Staff; [redacted]; and the National Indications Center. SEAS also reached the Commander-in-Chief, Pacific (CINCPAC), and Service component commands at the Pacific theater level. In South Vietnam, the summary was distributed to Headquarters, MACV; to the various Service commands; to U.S. Army divisions and Navy and Air Force units of comparable echelon; to major SIGINT units; and to others. 

In the DMZ area and South Vietnam's two northern provinces, timely tactical intelligence primarily came from the various USMC and ASA DSU's and, following analysis and processing, from USM-808 in the form of high precedence intelligence reports, tactical reports (TACREP's) and SIGINT summaries. SIGINT produced by the DSU's and USM-808 reached tactical SIGINT recipients within several minutes to several hours through SIGINT communications links. Concurrently, it was reported to NSA via the Southeast Asia SIGINT joint communications system—the CRITICOMM network—or by direct joint operational communications (OPSCOMM) circuits.

Arrangements at Khe Sanh 

In the fall of 1966, USN-414J sent a mobile short range direction finding (SRDF) team to the Khe Sanh area for several weeks, but no permanent SIGINT operations were conducted at Khe Sanh until USN-414J established a detachment there on 22 August 1967. SIGINT produced by USN-414J4 went directly to the [staff intelligence officer] or to the base commander, Colonel Lownds. Because Colonel Lownds had been cleared for COMINT for nearly ten years, he was well aware of what it could do for him. During the Khe Sanh defense the USN-414J4 complement ranged from a high of approximately 25 to a low of 14. At the time of the opening of hostilities, USN-414J4 had three manual Morse positions, one communications security position, and one ARDF support position. The detachment also maintained SRDF sites on Hills 881 South and 950 before the early skirmishes. However, these hills soon became untenable for the SRDF operators and they withdrew to the base.

The Buildup

As the war there progressed in the early and mid-1960s, the NVA communicators grew ever more sophisticated in the encipherment of their messages, with the result that fewer and fewer of the intercepted messages-particularly those passed on high-level nets-could be deciphered by U.S. analysts. Since a major portion of the enemy's communications were transmitted in high-grade cryptographic systems, rather than in the low and medium-grade systems that cryptanalysts were routinely solving, the SIGINT community came to rely heavily on those versed in traffic analysis. By the fall of 1967 traffic analysts had acquired enough experience in following NVA communications first to recognize the indicators—in the form of deviations from the norm—that presaged unit movements, and then to deduce the possible designations, destinations, and missions of the deploying NVA units. Using this process, analysts at USN-414J, USM-808, and NSA ascertained vital order of battle intelligence on NVA units moving southward toward Khe Sanh. It was in large part this hard intelligence on which the U.S. commanders made the plans to repulse the enemy on the Khe Sanh plateau. 

325C Division, Spring-Summer 1967 

Two major actions comprised the enemy buildup near Khe Sanh between late October 1967 and January 1968: [1] the staging of NVA 325C Division components from Laos and [2] the northern DMZ and the deployment of the NVA 304th and 320th Divisions from North Vietnam. The prelude to the first action was the withdrawal of various units of the 325C Division from the eastern and central DMZ areas, where they had operated during the spring and summer of 1967. U.S. commanders used SIGINT to follow 325C Division units during their various moves in the DMZ area. In February 1967 the 95C Regiment, 325C Division, deployed from North Vietnam to a base area in Laos, west of Khe Sanh. As early as mid-April, one component of the division … was located in the Khe Sanh area itself. By 17 April the NVA battalion had been joined by [another] … and less than a week later the remainder of the 29th Regiment had infiltrated through the DMZ into South Vietnam and had turned east coward Con Thien. (See previous article, "Eye" Corps, July-December 1967, for the Con Thien battles.)

In October units of the 325C Division in the Camp Carroll area began to withdraw. SIGINT showed that [subordinate units] returned to Laos. Reports also revealed that tactical communications facilities serving the 101D Regiment, 325C Division, began operating at a sharply reduced level following the substantial losses it incurred in a 26 October clash several kilometers south of Con Thien. The regiment's tactical communications were inactive during the first week of November, suggesting that the regiment had withdrawn from combat during that week. There were strong indications that elements of the 90th Regiment, which had resumed tactical communications on 30 October, were replacing the 101D Regiment in that tactical zone.

Thus, by early November 1967 SIGINT had shown that elements of the 325C Division were disengaging from the central and eastern DMZ areas. The 325C Division's 101D Regiment had withdrawn northward from the eastern DMZ area, and its 95C Regiment and the 8th Battalion of its 29th Regiment had returned to their base camp in Laos. The return of [these units] to the area of Laos opposite Khe Sanh marked the first phase in the enemy buildup in the Khe Sanh area.

304th and 320th Divisions Begin Deploying 

By the end of October 1967, the volume of communications of the NVA 304th and 320th Divisions, stationed in Military Region (MR) 3 of North Vietnam, had dropped noticeably, and in November the two divisions virtually ceased normal communications activity. The 304th was the first of the two divisions to be singled out by SIGINT analysts as exhibiting communications characteristics indicative of deployment. On 18 November NSA noted that the 304th was preparing to deploy, citing as evidence the gradual cessation of its normal communications and a 12 November identification of a new communications group serving the division headquarters and at least two of its regiments. The 304th Division's departure from normal communication suggested to the analysts that the division was on the move. 

On 21 November NSA provided further information on the deployment of the 304th: "The most recent communications posture assumed by the probable 304th Infantry Division indicated that the division ... is now in deployment. SIGINT also suggests that the subordinates of the division are deploying under radio silence." The 304th Division apparently had left its antiaircraft artillery battalion behind, following the precedent established by other divisions deploying from North Vietnam in the past. The suggestion that subordinates of the 304th Division were observing radio silence was prompted by the apparent inactivation of the communications group chat was first reported on 12 November. By 18 November only one of the division's subordinates remained active on that facility. In addition, the 304th Division had activated a broadcast facility on 13 November that allowed it to pass messages to its subordinates, but provided no means for the subordinates to reply. The division headquarters still communicated with Headquarters, Military Region 3 South, but had terminated communications with Hanoi on 15 November.¹ 

On 23 November NSA reported on the impending deployment of the 320th Division: “The manual Morse communications complex serving the probable PAVN [NVA] 320th Infantry Division has been unobserved since 14 November. Communications between the probable 320th Infantry Division and PAVN High Command ceased on 18 November; however, communications between the division headquarters and HQ, MR 3 North have continued through 22 November.” On 30 November NSA [updated] indications of deployment of the NVA 304th and 320th Divisions: “SIGINT now indicates that a major deployment by PAVN ground force units from MR 3 is currently underway. The two units involved are the probable PAVN 304th and 320th Infantry Divisions from MR 3 South and North, respectively.”

The 325C Division 

By early December it was apparent that an enemy buildup of major proportions was underway in the Khe Sanh area. The 30 November SEAS reviewed definite SIGINT warnings of the growing concentration of enemy forces in the area, noting that several enemy elements, including those of the NVA 95C Regiment, 325C Division, were concentrating in the Laos-Quang Tri Province border area. On 12 December analysts reported that there were now nine NVA radio terminals in an area west of Khe Sanh. Their report identified three as the 95C Regiment of the 325C Division and two regimental echelons subordinates of the 304th Division.

On 16 December SIGINT showed that a detached element of Headquarters, 325C Division, had arrived in the Khe Sanh area by 13 December. In the past, activation of a detached element by the 325C Division Headquarters had generally been followed by relocation of the division headquarters or of major subordinate elements of the division. The appearance of a detached element in December 1967 and its identification in the Khe Sanh area indicated to analysts that major 325C Division elements, possibly including the division headquarters, were enroute to the area. A report on 27 December also indicated that for two days the detached element had been communicating with a new, major headquarters in the Khe Sanh area. 

By the end of December, intercept of communications passed by elements associated with the 325C Division showed that the enemy was collecting intelligence in the Khe Sanh area. On 4 January USM-808 revealed that these troops, which had provided similar support in the Con Thien area in August and September 1967 were mentioning elements of all three 325C regiments in their reconnaissance reports on the Khe Sanh area. On 7 January other reports showed that enemy intelligence activity was particularly heavy in the area of Hills 595 and 845 northwest of Khe Sanh. By mid-January Headquarters, 325C Division and all three subordinate regiments had been identified in the Khe Sanh area. When the 325C Division ceased communicating with its detached element, analysts inferred that the two formations were again together [making radio communication unnecessary.] ARDF fixes on the division's 29th, 95C, and 101C Regiments confirmed the presence of all three 325C regiments in the Khe Sanh area.

The Stage is Set

The new [enemy HQ first noted in late November] soon emerged as the controlling authority for North Vietnamese forces deployed around Khe Sanh and in the adjacent areas of North Vietnam and Laos. However, until the new headquarters was arbitrarily designated the Khe Sanh Area Front (KSAF) in a SIGINT report of 31 January, it continued to be referenced as a "major headquarters in Laos." On 17 January, NSA supplied amplifying information: The Khe Sanh Area Front was an NVA High Command subordinate that since 29 November 1967 had been active on the Hanoi-controlled network serving major NVA and Viet Cong commands in South Vietnam and adjacent border areas. ARDF fixes indicated that the KSAF was approximately 50 kilometers northwest of Khe Sanh in Laos.² 

By mid-January, the 304th and 320th Divisions were completing their deployment. On 12 January USM-808 reported that Hanoi had passed messages to an element of the 320th Division. As of 19 January, major combat elements of the 304th, 320th, and 325C Divisions were menacing Khe Sanh. The 304th and 325C Divisions seemed to pose the primary threat. Reviewing in depth the SIGINT and other intelligence relating to the buildup of North Vietnamese units, MACV concluded that the enemy intended to launch a major offensive in the Khe Sanh area.

— Click here for Part Two —