Title: ANT Product Data

Description: These pages from an NSA internal catalogue describe the tools available to the agency in 2008: see the Der Spiegel article NSA’s Secret Toolbox: Unit Offers Spy Gadgets for Every Need, 30 December 2013

Document: S3222_DEITYBOUNCE.jpg:
SECRET//COMINT//REL TO USA, FVEY

DEITYBOUNCE

ANT Product Data

(TS//SI//REL) DEITYBOUNCE provides software application persistence on Dell
PowerEdge servers by exploiting the motherboard BIOS and utilizing System
Management Mode (SMM) to gain periodic execution while the Operating System
loads.

06/20/08

(TS//SI//REL) This technique supports multi-processor systems with RAID hardware
and Microsoft Windows 2000, 2003, and XP. It currently targets Dell PowerEdge
1850/2850/1950/2950 RAID servers, using BIOS versions A02, A05, A06, 1.1.0,
1.2.0, or 1.3.7.

(TS//SI//REL) Through remote access or interdiction, ARKSTREAM is used to re-
flash the BIOS on a target machine to implant DEITYBOUNCE and its payload (the
implant installer). Implantation via interdiction may be accomplished by non-
technical operator though use of a USB thumb drive. Once implanted,
DEITYBOUNCE’s frequency of execution (dropping the payload) is configurable and
will occur when the target machine powers on.

Status: Released / Deployed. Ready for
Immediate Delivery

Unit Cost: $0

i

i

POC:

S32221,

>nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108

SECRET//COMINT//REL TO USA, FVEYS3222_DROPOUTJEEP.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

DROPOUTJEEP

ANT Product Data

(TS//SI//REL) DROPOUTJEEP is a STRAITBIZARRE based software implant for
the Apple iPhone operating system and uses the CHIMNEYPOOL framework.

DROPOUTJEEP is compliant with the FREEFLOW project, therefore it is supported 10/01/08
in the TURBULENCE architecture. ,

(U//FOUO) DROPOUTJEEP - Operational Schematic

(TS//SI//REL) DROPOUTJEEP is a software implant for the Apple iPhone that
utilizes modular mission applications to provide specific SIGINT functionality. This
functionality includes the ability to remotely push/pull files from the device, SMS
retrieval, contact list retrieval, voicemail, geolocation, hot mic, camera capture, cell
tower location, etc. Command, control, and data exfiltration can occur over SMS
messaging or a GPRS data connection. All communications with the implant will be
covert and encrypted.

(TS//SI//REL) The initial release of DROPOUTJEEP will focus on installing the
implant via close access methods. A remote installation capability will be pursued
for a future release.

Unit Cost: $ 0

Status: (U) In development

POC: U//FOUO S32222, j^^B§)nsa^ov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_FEEDTROUGH.cleaned.jpg:
TOP SECRET//COMINT//REL USA, FVEY

FEEDTROUGH

ANT Product Data

(TS//SI//REL) FEEDTROUGH is a persistence technique for two software implants, DNT’s
BANANAGLEE and CES’s ZESTYLEAK used against Juniper Netscreen firewalls.

06/24/08

Command Control, and Data Exfiltration using
DNT Implant Communications Protocol (typical)

«

PC

«

FC

PC

M

PC

Typical Target
Firewall or Router

MPU/CPU
I Operating System
Sfitem BIOS
PERSISTING! IMPLANT ONT payU»
NSA

Remote Operations Center

Target Network

(S//SI//REL) Persistence Operational Scenario

»

(TS//SI//REL) FEEDTROUGH can be used to persist two implants, ZESTYLEAK and/or
BANANAGLEE across reboots and software upgrades on known and covered OS’s for the
following Netscreen firewalls, ns5xt, ns25, ns50, ns200, ns500 and ISG 1000. There is no
direct communication to or from FEEDTROUGH, but if present, the BANANAGLEE implant
can receive and transmit covert channel comms, and for certain platforms, BANANAGLEE
can also update FEEDTROUGH. FEEDTROUGH however can only persist OS’s included
in it’s databases. Therefore this is best employed with known OS’s and if a new OS comes
out. then the customer would need to add this OS to the FEEDTROUGH database for that
particular firewall.

(TS//SI//REL) FEEDTROUGH operates every time the particular Juniper firewall boots. The
first hook takes it to the code which checks to see if the OS is in the database, if it is, then a
chain of events ensures the installation of either one or both implants. Otherwise the firewall
boots normally. If the OS is one modified by DNT, it is not recognized, which gives the
customer freedom to field new software.

Status: (S//SI//REL) FEEDTROUGH has on the shelf solutions for all of the listed platforms.
It has been deployed on many target platforms

POC:

S32222,

nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL USA, FVEYS3222_GINSU.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

GINSU

ANT Product Data

(TS//SI//REL) GINSU provides software application persistence for the ONE implant,
KONGUR, on target systems with the PCI bus hardware implant, BULLDOZER.

06/20/08

OMNIGAT

Transmitter/

Receiver

KONGUR-Implanied
Computer on Network B'

KONGUR-Implanted
Computer on Network A'

BULLDOZER-tmplanted
Computer on Network A'

(TS//SI//REL) GINSU Extended Concept of Operations

t

I

(TS//SI/REL) This technique supports any desktop PC system that contains at least
one PCI connector (for BULLDOZER installation) and Microsoft Windows 9x, 2000,
2003, XP, or Vista.

(TS//SI//REL) Through interdiction, BULLDOZER is installed in the target system as
a PCI bus hardware implant. After fielding, if KONGUR is removed from the system
as a result of an operating system upgrade or reinstall, GINSU can be set to trigger
on the next reboot of the system to restore the software implant.

Status: Released / Deployed. Ready for Unit Cost: $0

Immediate Delivery

POC: . S32221, (5)nsa.ic.gov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_GOPHERSET.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

GOPHERSET

ANT Product Data

(TS//SI//REL) GOPHERSET is a software implant for GSM (Global System for
Mobile communication) subscriber identify module (SIM) cards. This implant pulls
Phonebook, SMS, and call log information from a target handset and exfiltrates it to
a user-defined phone number via short message service (SMS).

10/01/08

(U//FOUO) GOPHERSET - Operational Schematic

(TS//SI//REL) Modern SIM cards (Phase 2+) have an application program interface
known as the SIM Toolkit (STK). The STK has a suite of proactive commands that
allow the SIM card to issue commands and make requests to the handset.
GOPHERSET uses STK commands to retrieve the requested information and to
exfiltrate data via SMS. After the GOPHERSET file is compiled, the program is
loaded onto the SIM card using either a Universal Serial Bus (USB) smartcard
reader or via over-the-air provisioning. In both cases, keys to the card may be
required to install the application depending on the service provider's security
configuration.

Unit Cost: $0

Status: (U//FOUO) Released. Has not been deployed.

POC: U//FOUOI 1 S32222, ^^■^nsa^ov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_GOURMETTROUGH.jpg:
TOP//SECRET//COMINT//REL TO USA, FVEY

GOURMETTROUGH

ANT Product Data

(TS//SI//REL) GOURMETTROUGH is a user configurable persistence implant for
certain Juniper firewalls. It persists DNT’s BANANAGLEE implant across reboots
and OS upgrades. For some platforms, it supports a minimal implant with
beaconing for OS’s unsupported by BANANAGLEE.___________________________________

(TS//SI//REL) GOURMETTROUGH Persistence Implant Concept of Operations

(TS//SI//REL)For supported platforms, DNT may configure BANANAGLEE without
ANT involvement. Except for limited platforms, they may also configure PBD for
minimal implant in the case where an OS unsupported by BANANAGLEE is booted.

Status: GOURMETTROUGH is on the shelf and has been deployed on many
target platforms. It supports nsg5t, ns50, ns25, isglOOO(limited). Soon- ssgl40,
ssg5,ssg20

i

i

Unit Cost: $0

POC:

S32222,

nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP//SECRET//COMINT//REL TO USA, FVEYS3222_HALLUXWATER.cleaned.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

HALLUXWATER

ANT Product Data

(TS//SI//REL) The HALLUXWATER Persistence Back Door implant is installed on a
target Huawei Eudemon firewall as a boot ROM upgrade. When the target reboots,
the PBD installer software will find the needed patch points and install the back door
in the inbound packet processing routine.

06/24/08

i

(TS//SI//REL) HALLUXWATER Persistence Implant Concept of Operations

I

(TS//SI//REL) Once installed, HALLUXWATER communicates with an NSA operator
via the TURBOPANDA Insertion Tool (PIT), giving the operator covert access to
read and write memory, execute an address, or execute a packet.

(TS//SI//REL) HALLUXWATER provides a persistence capability on the Eudemon
200, 500, and 1000 series firewalls. The HALLUXWATER back door survives OS
upgrades and automatic bootROM upgrades.

Status: (U//FOUO) On the shelf, and has been deployed.
POC: I I, S32222,1 1.1

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3222_HEADWATER.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

HEADWATER

ANT Product Data

(TS//SI//REL) HEADWATER is a Persistent Backdoor (PBD) software implant for
selected Huawei routers. The implant will enable covert functions to be remotely
executed within the router via an Internet connection.

06/24/08

“1

(TS//SI//REL) HEADWATER Persistence Implant Concept of Operations

(TS//SI//REL) HEADWATER PBD implant will be transferred remotely over
the Internet to the selected target router by Remote Operations Center
(ROC) personnel. After the transfer process is complete, the PBD will be
installed in the router's boot ROM via an upgrade command. The PBD will
then be activated after a system reboot. Once activated, the ROC
operators will be able to use DNT's HAMMERMILL Insertion Tool (HIT) to
control the PBD as it captures and examines all IP packets passing through
the host router.

(TS//SI//REL) HEADWATER is the cover term for the PBD for Huawei
Technologies routers. PBD has been adopted for use in the joint NSA/CIA
effort to exploit Huawei network equipment. (The cover name for this joint
project is TURBOPANDA.)

Status: (U//FOUO) On the shelf ready for deployment.
POC:| I, S32222, | I,I

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108S3222_IRATEMONK.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

IRATEMONK

ANT Product Data

(TS//SI//REL) IRATEMONK provides software application persistence on desktop
and laptop computers by implanting the hard drive firmware to gain execution
through Master Boot Record (MBR) substitution.

06/20/08

i

i

(TS//SI//REL) This technique supports systems without RAID hardware that boot
from a variety of Western Digital, Seagate, Maxtor, and Samsung hard drives. The
supported file systems are: FAT, NTFS, EXT3 and UFS.

(TS//SI//REL) Through remote access or interdiction, UNITEDRAKE, or
STRAITBAZZARE are used in conjunction with SLICKERVICAR to upload the hard
drive firmware onto the target machine to implant IRATEMONK and its payload (the
implant installer). Once implanted, IRATEMONK’s frequency of execution (dropping
the payload) is configurable and will occur when the target machine powers on.

Status: Released / Deployed. Ready for Unit Cost: $0

Immediate Delivery

POC:

S32221,

nsa.ic.gov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_IRONCHEF.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

IRONCHEF

ANT Product Data

(TS//SI//REL) IRONCHEF provides access persistence to target systems by
exploiting the motherboard BIOS and utilizing System Management Mode (SMM) to
communicate with a hardware implant that provides two-way RF communication.

07/14/08

(TS//SI//REL) IRONCHEF Extended Concept of Operations

i

I

(TS//SI/REL) This technique supports the HP Proliant 380DL G5 server, onto which
a hardware implant has been installed that communicates over the l2C Interface
(WAGONBED).

(TS//SI//REL) Through interdiction, IRONCHEF, a software CNE implant and the
hardware implant are installed onto the system. If the software CNE implant is
removed from the target machine, IRONCHEF is used to access the machine,
determine the reason for removal of the software, and then reinstall the software
from a listening post to the target system.

Status: Ready for Immediate Delivery Unit Cost: $0

POC: S32221, nsa.ic.gov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_JETPLOW.cleaned.jpg:
*

-A~,

Öl*

TOP SECRET//COMINT//REL TO USA, FVEY

JETPLOW

ANT Product Data

(TS//SI//REL) JETPLOW is a firmware persistence implant for Cisco PIX Series and
ASA (Adaptive Security Appliance) firewalls. It persists DNT's BANANAGLEE
software implant. JETPLOW also has a persistent back-door capability.

06/24/08

(TS//SI//REL) JETPLOW Persistence Implant Concept of Operations

(TS//SI//REL) JETPLOW is a firmware persistence implant for Cisco PIX Series and
ASA (Adaptive Security Appliance) firewalls. It persists DNT’s BANANAGLEE
software implant and modifies the Cisco firewall’s operating system (OS) at boot
time. If BANANAGLEE support is not available for the booting operating system, it
can install a Persistent Backdoor (PBD) designed to work with BANANAGLEE’s
communications structure, so that full access can be reacquired at a later time.
JETPLOW works on Cisco’s 500-series PIX firewalls, as well as most ASA firewalls
(5505, 5510, 5520, 5540, 5550).

(TS//SI//REL) A typical JETPLOW deployment on a target firewall with an exfiltration
path to the Remote Operations Center (ROC) is shown above. JETPLOW is
remotely upgradeable and is also remotely installable provided BANANAGLEE is
already on the firewall of interest.

Status: (C//REL) Released. Has been widely deployed. Current
availability restricted based on OS version (inquire for details).

I

I

POC:

S32222,

>nsa.ic.qov

Unit Cost: $0

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3222_MONKEYCALENDAR.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

MONKEYCALENDAR

ANT Product Data

(TS//SI//REL) MONKEYCALENDAR is a software implant for GSM (Global System
for Mobile communication) subscriber identify module (SIM) cards. This implant
pulls geolocation information from a target handset and exfiltrates it to a user-
defined phone number via short message service (SMS).

TOP SECRET//COMINT

(U//FOUO) MONKEYCALENDAR - Operational Schematic

10/01/08

i

i

(TS//SI//REL) Modern SIM cards (Phase 2+) have an application program interface
known as the SIM Toolkit (STK). The STK has a suite of proactive commands that
allow the SIM card to issue commands and make requests to the handset.
MONKEYCALENDAR uses STK commands to retrieve location information and to
exfiltrate data via SMS. After the MONKEYCALENDAR file is compiled, the
program is loaded onto the SIM card using either a Universal Serial Bus (USB)
smartcard reader or via over-the-air provisioning. In both cases, keys to the card
may be required to install the application depending on the service provider’s
security configuration

Unit Cost: $0

Status: Released, not deployed.

POC: U//FOUOI I, S32222.1 ■^^■(Snsa^oy

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_SOUFFLETROUGH.jpg:
*

-A-,

Ôl*

w

TOP SECRET//COMINT//REL TO USA, FVEY

SOUFFLETROUGH

ANT Product Data

(TS//SI//REL) SOUFFLETROUGH is a BIOS persistence implant for Juniper SSG
500 and SSG 300 series firewalls. It persists DNT’s BANANAGLEE software
implant. SOUFFLETROUGH also has an advanced persistent back-door capability.

06/24/08

(TS//SI//REL) SOUFFLETROUGH Persistence Implant Concept of Operations

(TS//SI//REL) SOUFFLETROUGH is a BIOS persistence implant for Juniper SSG
500 and SSG 300 series firewalls {320M, 350M, 520, 550, 520M, 550M}. It persists
DNT’s BANANAGLEE software implant and modifies the Juniper firewall’s operating
system (ScreenOS) at boot time. If BANANAGLEE support is not available for the
booting operating system, it can install a Persistent Backdoor (PBD) designed to
work with BANANAGLEE’s communications structure, so that full access can be
reacquired at a later time. It takes advantage of Intel’s System Management Mode
for enhanced reliability and covertness. The PBD is also able to beacon home, and
is fully configurable.

(TS//SI//REL) A typical SOUFFLETROUGH deployment on a target firewall with an
exfiltration path to the Remote Operations Center (ROC) is shown above.
SOUFFLETROUGH is remotely upgradeable and is also remotely installable
provided BANANAGLEE is already on the firewall of interest.

Status: (C//REL) Released. Has been deployed. There are no
availability restrictions preventing ongoing deployments.

i

i

POC:

S32222,

»nsa.ic.qov

Unit Cost: $0

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3222_SWAP.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

ANT Product Data

SWAP

(TS//SI//REL) SWAP provides software application persistence by exploiting the

(TS//SI//REL) This technique supports single or multi-processor systems running
Windows, Linux, FreeBSD, or Solaris with the following file systems: FAT32, NTFS,
EXT2, EXT3, or UFS 1.0.

(TS//SI//REL) Through remote access or interdiction, ARKSTREAM is used to re-
flash the BIOS and TWISTEDKILT to write the Host Protected Area on the hard
drive on a target machine in order to implant SWAP and its payload (the implant
installer). Once implanted, SWAP’s frequency of execution (dropping the payload) is
configurable and will occur when the target machine powers on.

Status: Released / Deployed. Ready for Unit Cost: $0

Immediate Delivery

POC: S32221, nsa.ic.gov

motherboard BIOS and the hard drive’s Host Protected Area to gain periodic
execution before the Operating System loads.

06/20/08

Interactive OPS Console

I

I

(TS//SI//REL) SWAP Extended Concept of Operations

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_TOTECHASER.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

TOTECHASER

ANT Product Data

(TS//SI//REL) TOTECHASER is a Windows CE implant targeting the Thuraya 2520
handset. The Thuraya 2520 is a dual mode phone that can operate either in SAT or
GSM modes. The phone also supports a GPRS data connection for Web browsing,
e-mail, and MMS messages. The initial software implant capabilities include
providing GPS and GSM geo-location information. Call log, contact list, and other
user information can also be retrieved from the phone. Additional capabilities are
being investigated.

Thin«îy.i GSM
Phone

GSM Network

HVT

TOP SECRET SI 20201123

GPS - Current Fix , Last Fix. Last 10
GSM MCC, MNC, LAC, liming Adv
Identity - IMSI, IMEI
Call Log - Out, In, Missed
Contact List Names, Phone Numbers

Collection

TOP SECRET SI 20201123

(U//FOUO) TOTECHASER - Operational Schematic

(TS//SI//REL) TOTECHASER will use SMS messaging for the command, control,
and data exfiltration path. The initial capability will use covert SMS messages to
communicate with the handset. These covert messages can be transmitted in
either Thuraya Satellite mode or GSM mode and will not alert the user of this
activity. An alternate command and control channel using the GPRS data
connection based on the TOTEGHOSTLY implant is intended for a future version.

(TS//SI//REL) Prior to deployment, the TOTECHASER handsets must be modified.
Details of how the phone is modified are being developed. A remotely deployable
TOTECHASER implant is being investigated. The TOTECHASER system consists
of the modified target handsets and a collection system.

i

i

(TS//SI//REL) TOTECHASER will accept configuration parameters to determine
how the implant operates. Configuration parameters will determine what information
is recorded, when to collect that information, and when the information is exfiltrated.
The configuration parameters can be set upon initial deployment and updated
remotely.

Unit Cost: $

Status:

POC: U//FOUO

I, S32222,

l@nsa.gov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3222_WISTFULTOLL.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

WISTFULTOLL

ANT Product Data

(TS//SI//REL) WISTFULTOLL is a UNITEDRAKE and STRAITBIZZARE plug-in
used for harvesting and returning forensic information from a target using Windows
Management Instrumentation (WMI) calls and Registry extractions.

06/20/08

I

I

(TS//SI//REL) This plug-in supports systems running Microsoft Windows 2000,
2003, and XP.

(TS//SI//REL) Through remote access or interdiction, WISTFULLTOLL is executed
as either a UNITEDRAKE or STRAITBAZZARE plug-in or as a stand-alone
executable. If used remotely, the extracted information is sent back to NSA through
UNITEDRAKE or STRAITBAZZARE. Execution via interdiction may be
accomplished by non-technical operator though use of a USB thumb drive, where
extracted information will be saved to that thumb drive.

Status: Released / Deployed. Ready for Unit Cost: $0

Immediate Delivery

POC:

S32221,

@nsa.ic.qov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3223_COTTONMOUTH-I.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

COTTONMOUTH-I

ANT Product Data

(TS//SI//REL) COTTONMOUTH-I (CM-I) is a Universal Serial Bus (USB) hardware implant
which will provide a wireless bridge into a target network as well as the ability to load exploit
software onto target PCs.

08/05/08

(TS//SI//REL) CM-I will provide air-gap bridging, software persistence capability, "in-field'* re-
programmability, and covert communications with a host software implant over the USB. The
RF link will enable command and data infiltration and exfiltration. CM-I will also communicate
with Data Network Technologies (DNT) software (STRAITBIZARRE) through a covert
channel implemented on the USB, using this communication channel to pass commands and
data between hardware and software implants. CM-I will be a GENIE-compliant implant
based on CHIMNEYPOOL.

(TS//SI//REL) CM-I conceals digital components (TRINITY), USB 1.1 FS hub, switches, and
HOWLERMONKEY (HM) RF Transceiver within the USB Series-A cable connector.
MOCCASIN is the version permanently connected to a USB keyboard. Another version can
be made with an unmodified USB connector at the other end. CM-I has the ability to
communicate to other CM devices over the RF link using an over-the-air protocol called
SPECULATION. cottonmouth conop

INTERNET Scenario

High SkJo

la* Sc*

Status: Availability - January 2009 Unit Cost: 50 units: $1,015K

POC:

ALT POC:

, S3223,
, S3223,

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3223_COTTONMOUTH-II.jpg:
*

-A~,

cfy?

®4\*

TOP SECRET//COMINT//REL TO USA, FVEY

COTTONMOUTH-II

ANT Product Data

(TS//SI//REL) COTTONMOUTH-II (CM-II) is a Universal Serial Bus (USB) hardware Host
Tap, which will provide a covert link over USB link into a targets network. CM-II is intended
to be operate with a long haul relay subsystem, which is co-located within the target
equipment. Further integration is needed to turn this capability into a deployable system.

08/05/08

$

(TS//SI//REL) CM-II will provide software persistence capability, “in-field” re-programmability,
and covert communications with a host software implant over the USB. CM-II will also
communicate with Data Network Technologies (DNT) software (STRAITBIZARRE) through a
covert channel implemented on the USB, using this communication channel to pass
commands and data between hardware and software implants. CM-II will be a GENIE-
compliant implant based on CHIMNEYPOOL.

(TS//SI//REL) CM-II consists of the CM-I digital hardware and the long haul relay concealed
somewhere within the target chassis. A USB 2.0 HS hub with switches is concealed in a
dual stacked USB connector, and the two parts are hard-wired, providing a intra-chassis link.
The long haul relay provides the wireless bridge into the target’s network.

COTTONMOUTH - II (CM-II) CONOP
ANT Covert Network Scenario

I

I

Status: Availability - September 2008

POC:

ALT POC:

S3223,

S3223,

!5)nsa.ic.qov
©nsa.ic.qov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3223_COTTONMOUTH-III.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

COTTONMOUTH-III

ANT Product Data

(TS//SI//REL) COTTONMOUTH-I (CM-I) is a Universal Serial Bus (USB) hardware implant,
which will provide a wireless bridge into a target network as well as the ability to load exploit
software onto target PCs.

08/05/08

(TS//SI//REL) CM-III will provide air-gap bridging, software persistence capability, “in-field"
re-programmability, and covert communications with a host software implant over the USB.
The RF link will enable command and data infiltration and exfiltration. CM-III will also
communicate with Data Network Technologies (DNT) software (STRAITBIZARRE) through a
covert channel implemented on the USB, using this communication channel to pass
commands and data between hardware and software implants. CM-III will be a GENIE-
compliant implant based on CHIMNEYPOOL.

(TS//SI//REL) CM-III conceals digital components (TRINITY), a USB 2.0 HS hub. switches,
and HOWLERMONKEY (HM) RF Transceiver within a RJ45 Dual Stacked USB connector.
CM-I has the ability to communicate to other CM devices over the RF link using an over-the-
air protocol called SPECULATION. CM-III can provide a short range inter-chassis link to
other CM devices or an intra-chassis RF link to a long haul relay subsystem.

COTTONMOUTH CONOP
INTERNET Scenario

Status: Availability - May 2009

Unit Cost: 50 units: $1,248K

POC:

ALT POC:

, S3223,
, S3223,

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3223_CROSSBEAM.jpg:
TOP SECRET//COMINT//REL FVEY

CROSSBEAM

ANT Product Data

(TS//SI//REL) CROSSBEAM is a GSM module that mates a modified commercial
cellular product with a WAGONBED controller board.

08/05/08

wA^Aei
WAGONBED 2 Digit * ContfolWr Uodutt

(TS//SI//REL) CROSSBEAM is a reusable CHIMNEYPOOL-compliant GSM
communications module capable of collecting and compressing voice data.
CROSSBEAM can receive GSM voice, record voice data, and transmit the received
information via connected modules or 4 different GSM data modes (GPRS, Circuit
Switched Data, Data Over Voice, and DTMF) back to a secure facility. The
CROSSBEAM module consists of a standard ANT architecture embedded computer,
a specialized phone component, a customized software controller suite and an
optional DSP (ROCKYKNOB) if using Data Over Voice to transmit data.

CROSSBEAM Voice Handling

DTMF. DO/
CSO. GPRS

CROSSEEAM

CROSSBEAM Data Handling

Commercial Network

NSA/ROC

CROSSBEAM

Status: Limited Supply Available Unit Cost: $4k

Delivery: 90 days for most configurations

I

I

POC:

ALT POC:

S3223,

, S3223,

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL FVEYS3223_FIREWALK.jpg:
TOP SECRET//COMINT//REL FVEY

FIREWALK

ANT Product Data

(TS//SI//REL) FIREWALK is a bidirectional network implant, capable of passively collecting
Gigabit Ethernet network traffic, and actively injecting Ethernet packets onto the same
target network.

iff

fREWALK
IPWITY VC V 4

08/05/08

(TS//SI//REL) FIREWALK is a bi-directional 10/100/1000bT (Gigabit) Ethernet network
implant residing within a dual stacked RJ45 / USB connector. FIREWALK is capable of
filtering and egressing network traffic over a custom RF link and injecting traffic as
commanded; this allows a ethernet tunnel (VPN) to be created between target network and
the ROC (or an intermediate redirector node such as DNT's DANDERSPRITZ tool.)
FIREWALK allows active exploitation of a target network with a firewall or air gap protection.
(TS//SI//REL) FIREWALK uses the HOWLERMONKEY transceiver for back-end
communications. It can communicate with an LP or other compatible HOWLERMONKEY
based ANT products to increase RF range through multiple hops.

- DO - DANDERCPRIT. zpootz IP & MAC Addr
HM - HOWLERMONKRY

- LHR . Long Haul Relay

I

I

Status: Prototype Available - August 2008 unit Cost: 50 Units $537K

POC:

ALT POC:

, S3223,

, S3223,

nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL FVEYS3223_HOWLERMONKEY.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

HOWLERMONKEY

ANT Product Data

(TS//SI//REL) HOWLERMONKEY is a custom Short to Medium Range Implant RF
Transceiver. It is used in conjunction with a digital core to provide a complete
implant.

08/05/08

HOWLERMONKEY -
SUTURESAILOR

1.23" (31.25 mm)
x 0.48" (12.2 mm)

HOWLERMONKEY - YELLOWPIN

2" (50.8 mm) x 0.45" (11.5 mm)

(Actual Size)

HOWLERMONKEY -

Front
Back

SUTURESAILOR

1.20" (30.5 mm)
x 0.23" (6 mm)

HOWLERMONKEY -
FIREWALK

0.63" (16 mm) x
0.63" (16 mm)

(TS//SI//REL) HOWLERMONKEY is a COTS-based transceiver designed to be
compatible with CONJECTURE/SPECULATION networks and STRIKEZONE
devices running a HOWLERMONKEY personality. PCB layouts are tailored to
individual implant space requirements and can vary greatly in form factor.

Status: Available - Delivery 3 months Unit Cost: 40 units: $750/ each

25 units: $1,000/ each

POC:

ALT POC:

, S3223,
, S3223,

@nsa.ic.gov
Q)nsa.ic.qov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3223_JUNIORMINT.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

JUNIORMINT

ANT Product Data

(TS//SI//REL) JUNIORMINT is a digital core packaged in both a mini Printed Circuit Board
(PCB), to be used in typical concealments, and a miniaturized Flip Chip Module (FCM), to
be used in implants with size constraining concealments.

(TS//SI//REL) JUNIORMINT uses the TAO standard implant architecture. The architecture
provides a robust, reconfigurable, standard digital platform resulting in a dramatic performance
improvement over the obsolete HC12 microcontroller based designs. A mini Printed Circuit
Board (PCB) using packaged parts will be developed and will be available as the standard
platform for applications requiring a digital core. The ultra-miniature Flip Chip Module (FCM)
will be available for challenging concealments. Both will contain an ARM9 microcontroller,
FPGA, Flash. SDRAM and DDR2 memories.

uController Flash SDRAM FPGA DDR2
ARM 9 32 MBytes MT48H16M32LF XC4VLX25 MT47H64M16
400 Mhz 64 MBytes 10752 Slice 128 MBytes

◄-

◄-

◄-



JSARTs
USB !

RMII/MII

xu.'ACiorC'V

SPI

ÇftttiiCr • F44I or/#*M9 hf:*-A?V5
APV * à c* SDRA.V ns:
lib r/
ARM9

AT91SAM9G20

400 MHz

1.0V core
1.8V* 3.3V I/O

SPI

64MB
32MB SDRAM
Flash 16MX32 k9tiK>ttW32ll 1AVUO


FBI

.QRti9D.il. Expanded
w Flash

NAND /
SDcard
Flash

conhg

◄-

◄-

JTAG

I2C

FPGA

XC4VLX25

Virtex 4/5

12V/ I.OVecre
1 8V-3.3V UO

m*OSl**

I Cr SMT



128MB

DDR2

MMX 16

MUrMtKMIU

1.8V VO

3D Stack
Component

EBI



I

I

Status: Availability - mini-PCB and Dev Board by April 2009

Availability - FCM by June 2010 Unit Cost: Available Upon Request

POC:

ALT POC:

S3223,
, S3223,

nsa.ic.gov
@nsa.ic.qov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3223_MAESTRO-II.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

MAESTRO-II

ANT Product Data

(TS//SI//REL) MAESTRO-II is a miniaturized digital core packaged in a Multi-Chip Module
(MCM) to be used in implants with size constraining concealments.

08/05/08

(TS//SI//REL) MAESTRO-II uses the TAO standard implant architecture. The architecture
provides a robust, reconfigurable, standard digital platform resulting in a dramatic
performance improvement over the obsolete HC12 microcontroller based designs. A
development Printed Circuit Board (PCB) using packaged parts has been developed and is
available as the standard platform. The MAESTRO-II Multi-Chip-Module (MCM) contains an
ARM7 microcontroller, FPGA, Flash and SDRAM memories.

uController Flash SDRAM FPGA
ARM 7 66 Mhz AT49BV322A 4 MBytes MT48LC2M32 8 MBytes XC2V500 500k gates

*dd*JfU*dotiUlrvvt MAESTRO

Status: Available - On The Shelf

Unit Cost: S3-4K

POC:

ALT POC:

!, S3223,
, S3223,

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3223_SOMBERKNAVE.jpg:
TOP SECRET//COMINT//REL FVEY

SOMBERKNAVE

ANT Product Data

(TS//SI//REL) SOMBERKNAVE is Windows XP wireless software implant
that provides covert internet connectivity for isolated targets.

08/05/08

(TS//SI//REL) SOMBERKNAVE is a software implant that surreptitiously routes
TCP traffic from a designated process to a secondary network via an unused
embedded 802.11 network device. If an Internet-connected wireless Access
Point is present, SOMBERKNAVE can be used to allow OLYMPUS or
VALIDATOR to “call home” via 802.11 from an air-gapped target computer. If
the 802.11 interface is in use by the target, SOMBERKNAVE will not attempt
to transmit.

(TS//SI//REL) Operationally, VALIDATOR initiates a call home.
SOMBERKNAVE triggers from the named event and tries to associate with an
access point. If connection is successful, data is sent over 802.11 to the ROC.
VALIDATOR receives instructions, downloads OLYMPUS, then disassociates
and gives up control of the 802.11 hardware. OLYMPUS will then be able to
communicate with the ROC via SOMBERKNAVE, as long as there is an
available access point.

im

ROC

I

I

Status: Available - Fall 2008

Unit Cost: $50k

POC:

ALT POC:

I, S3223,

I, S3223,

nsa.ic.gov
S)nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL FVEYS3223_TRINITY.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

TRINITY

ANT Product Data

(TS//SI//REL) TRINITY is a miniaturized digital core packaged in a Multi-Chip Module
(MCM) to be used in implants with size constraining concealments.

08/05/08

(TS//SI//REL) TRINITY uses the TAO standard implant architecture. The architecture
provides a robust, reconfigurable, standard digital platform resulting in a dramatic
performance improvement over the obsolete HC12 microcontroller based designs. A
development Printed Circuit Board (PCB) using packaged parts has been developed and is
available as the standard platform. The TRINITY Multi-Chip-Module (MCM) contains an
ARM9 microcontroller, FPGA, Flash and SDRAM memories.

Status: Special Order due vendor selected. unit Cost: 100 units: $625K

POC:

ALT POC:

S3223,
, S3223,

nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated:20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEYS3224_CANDYGRAM.jpg:
SECRET//COMINT//REL TO USA, FVEY

CANDYGRAM

GSM Telephone Tripwire

(S//SI//REL) Mimics GSM cell tower of a target network. Capable of operations at
900,1800, or 1900 MHz. Whenever a target handset enters the CANDYGRAM
base station’s area of influence, the system sends out an SMS through the external
network to registered watch phones.

06/20/08

(S//SI//REL) CANDYGRAM Operational Concept

(S//SI//REL) Typical use scenarios are asset validation, target tracking and
identification as well as identifying hostile surveillance units with GSM handsets.
Functionality is predicated on apriori target information.



(S//SI//REL) System HW

• GPS processing unit

• Tri-band BTS radio

• Windows XP laptop and cell phone*
•9” wide x 12 " long x 2 " deep

• External power (9-30 VDC).

‘Remote control software can be used
with any connected to the laptop (used
for communicating with the
CANDYGRAM unit through text
messages (SMS).

(S//SI//REL) SW Features

• Configurable 200 phone number
target deck.

• Network auto-configuration

• Area Survey Capability

• Remote Operation Capability

• Configurable Network emulation

• Configurable RF power level

• Mutli-Units under single C&C

• Remote restart

• Remote erasure (not field
recoverable)

Status: Available 8 mos ARO

POC:

S32242,

Unit Cost: approx S40K

nsa.ic.gov

SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_CTX4000.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

CTX4000

ANT Product Data

(TS//SI//REL TO USA.FVEY) The CTX4000 is a portable continuous wave (CW)
radar unit. It can be used to illuminate a target system to recover different off net
information. Primary uses include VAGRANT and DROPMIRE collection.

8 Jul2008

(TS//SI//REL TO USA.FVEY) The CTX4000 provides the means to collect signals
that otherwise would not be collectable, or would be extremely difficult to collect
and process. It provides the following features:

• Frequency Range: 1 - 2 GHz.

• Bandwidth: Up to 45 MHz

• Output Power: User adjustable up to 2 W using the internal amplifier; external
amplifiers make it possible to go up to 1 kW.

• Phase adjustment with front panel knob

• User-selectable high- and low-pass filters.

• Remote controllable

• Outputs:

• Transmit antenna
•I & Q video outputs

• DC bias for an external pre-amp on the Receive input connector

• Inputs:

• External oscillator



• Receive antenna

Unit Cost: N/A

Status: unit is operational. However, it is reaching the end of its service life. It is
scheduled to be replaced by PHOTOANGLO starting in September 2008.

POC:| |, S32243,| |,| l@nsa.ic.qov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_CYCLONE_Hx9.jpg:
SECRET//COMINT//REL TO USA, FVEY

CYCLONE Hx9

Base Station Router

(S//SI//FVEY) EGSM (900MGz) macro-class Network-ln-a-Box (NIB) system. Uses
the existing Typhon GUI and supports the full Typhon feature base and applications.

(S//SI//REL) Operational Restrictions > (S//SI//REL) Enclosure:
exist for equipment deployment. . ^ ™ y q-

> (S//SI//REL) Features:

• EGSM 900MHz
•Macro-class (+43dBm)

• Approximately 8 lbs

• Actively cooled for extreme
environments

> (S//SI//REL) Cyclone Hx9 System Kit:

• Cyclone Hx9 System

• AC/DC power converter

• Antenna to support MS, GPS. WIFI. &
RF

• LAN, RF, & USB cables

• Pelican Case

• 32+Km Range

• Optional Battery Kits

• Highly Mobile and Deployable

• Integrated GPS, MS. & 802.11

• Voice & High-speed Data

• GSM Security & Encryption

>(S//SI//REL) Advanced Features:

• GPS - Supporting Typhon
applications

• GSM Handset Module - Supports
auto-configuration and remote
command and control features.

• (Field Kit only) Control Laptop and
Accessories

^(S//SI//REL) Separately Priced Options:

• 800 WH Lilon Battery Kit
(S//SI//REL) Base Station Router Platform:

• Overlay GSM cellular communications
supporting up to 32 Cyclone Mx9
systems providing full mobility and
utilizing a VoIP back-haul.

• GPRS data service and associated
application

• 802.11 - Supports high speed
wireless LAN remote command and
control

Unit Cost: $70K for two months

Status: Just out of development, first production runs ongoing. Derived From: nsa/cssm 1-52

Dated: 20070108

S32242, ^^^^Cpnsa.IC.CjOV Declassify On: 20320108

SECRET//COMINT//REL TO USA, FVEYS3224_EBSR.jpg:
SECRET//COMINT//REL TO USA, FVEY

Low Power GSM Active

Interrogator

(S//SI//REL) Multi-purpose, Pico class, tri-band active GSM base station with
internal 802.11/GPS/handset capability.

01/27/09

(S//SI//REL) Operational Restrictions
exist for equipment deployment.

> (S//SI//REL) Features:

• LxT Model: 900/1800/1900MHZ

• LxU Model: 850/1800/1900MHZ

> (S//SI//REL) EBSR System Kit:

• EBSR System

• AC/DC power converter

• Antennas to support MS,
GPS, WIFI, & RF

• LAN, RF, & USB cables

• Pelican Case

• (Field Kit only) Control Laptop
and Accessories

• Pico-class (lWatt) Base station

• Optional Battery Kits

>(S//SI//REL) Separately Priced Options:

• 90 WH Lilon Battery Kit

• Highly Mobile and Deployable

• Integrated GPS, MS, & 802.11

• Voice & High-speed Data

• SMS Capability

> (S//SI//REL) Enclosure:

> (S//SI//REL) Base Station Router
Platform:

• Multiple BSR units can be
interconnected to form a macro
network using 802.3 and 802.11
back-haul.

• 1.9 ”H x 8.6”W x 6.3”D • Supports Landshark/Candygram

• Approximately 3 lbs capabilities.

• Actively cooled for extreme
environments

Status: Unit Cost: $40K

POC: I I, S32242, |

SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_ENTOURAGE.jpg:
bixl

ëm

SECRET//COMINT//REL TO USA, FVEY

ENTOURAGE

(S//SI//REL) Direction Finding on

HollowPoint Platform

(S//SI//REL) Direction Finding application operating on the HOLLOWPOINT
platform. The system is capable of providing line of bearing for GSM/UMTS/
CDMA2000/FRS signals. A band-specific antenna and laptop controller is needed to
compliment the HOLLOWPOINT system and completes the ground based system.

01/27/09

(S//SI//REL) HOLLOWPOINT SDR Platform and Antenna

(S//SI) The ENTOURAGE application leverages the 4 Software Defined Radio
(SDR) units in the HOLLOWPOINT platform. This capability provides an "Artemis-
like" capability for waveforms of interest (2G,3G,others). The ENTOURAGE
application works in conjunction with the NEBULA active interrogator as part of the
Find/Fix/Finish capabilities of the GALAXY program.

> (S//SI//REL) Features: > (S//SI//REL) Enclosure:

• Software Defined Radio System • 1.8"H x 8.0"W x 8.CTD

• Operating range 10MHz - 4GHz • Approximately 3 lbs

• 4 Receive paths, all synchronized

• 1 Transmit path

• DF capability on
GSM/UMTS/CDMA2000/ FRS
signals

• Gigabit Ethernet

• Integrated GPS

• Highly Mobile and Deployable

• 15 Watts

• Passively cooled

> (S//SI//REL) Future Developments:

• WiMAX
•WiFi

• LTE

I

I

Status: The system is in the final testing stage and Unit Cost: $70K
will be in production Spring 09.

POC:

, S32242,

nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108

SECRET//COMINT//REL TO USA, FVEYS3224_GENISIS.jpg:
SECRET//COMINT//REL TO USA, FVEY

*

-A~,

Ó ¡X

W

GENESIS

Covert SIGINT Transceiver

(S//SI//REL) Commercial GSM handset that has been modified to include a
Software Defined Radio (SDR) and additional system memory. The internal SDR
allows a witting user to covertly perform network surveys, record RF spectrum, or
perform handset location in hostile environments.

01/27/09

(S//SI//REL) GENESIS Handset

(S//SI//REL) The GENESIS systems are designed to support covert operations in
hostile environments. A witting user would be able to survey the local environment
with the spectrum analyzer tool, select spectrum of interest to record, and download
the spectrum information via the integrated Ethernet to a laptop controller. The
GENESIS system could also be used, in conjunction with an active interrogator, as the
finishing tool when performing Find/Fix/Finish operations in unconventional
environments.

> (S//SI//REL) Features: (S//SI//REL) Future Enhancements:

• Concealed SDR with Handset
Menu Interface

• Spectrum Analyzer Capability

• Find/Fix/Finish Capability

• Integrated Ethernet

• External Antenna Port

• Internal 16 GB of storage

• Multiple Integrated Antennas

Status: Current GENESIS platform available.
Future platforms available when developments are
completed.

POC: , S32242,

• 3G Handset Host Platform

• Additional Host Platforms

• Increased Memory Capacity

• Additional Find/Fix/Finish
Capabilities

• Active Interrogation Capabilities



i

Unit Cost: $15K

nsa.ic.gov

SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_LOUDAUTO.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

LOUDAUTO

ANT Product Data

(TS//SI//REL TO USA,FVEY) Audio-based RF retro-reflector. Provides room
audio from targeted space using radar and basic post-processing.

(U) Capabilities

(TS//SI//REL TO USA,FVEY) LOUDAUTO’s
current design maximizes the gain of the
microphone. This makes it extremely useful for
picking up room audio. It can pick up speech at
a standard, office volume from over 20' away.
(NOTE: Concealments may reduce this distance.)
It uses very little power (-15 uA at 3.0 VDC), so
little, in fact, that battery self-discharge is more of
an issue for serviceable lifetime than the power
draw from this unit. The simplicity of the design
allows the form factor to be tailored for specific
operational requirements. All components at
COTS and so are non-attributable to NSA.

07 Apr 2009

(U) Concept of Operation

TS//SI//REL TO USA,FVEY) Room audio is picked up by the microphone and
converted into an analog electrical signal. This signal is used to pulse position
modulate (PPM) a square wave signal running at a pre-set frequency. This
square wave is used to turn a FET (field effect transistor) on and off. When
the unit is illuminated with a CW signal from a nearby radar unit, the
illuminating signal is amplitude-modulated with the PPM square wave. This
signal is re-radiated, where it is picked up by the radar, then processed to
recover the room audio. Processing is currently performed by COTS
equipment with FM demodulation capability (Rohde & Schwarz FSH-series
portable spectrum analyzers, etc.) LOUDAUTO is part of the
ANGRYNEIGHBOR family of radar retro-reflectors.

Unit Cost: $30

Status: End processing still in development

POC:| S32243, I |@nsa.ic.qov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_NEBULA.jpg:
SECRET//COMINT//REL TO USA, FVEY

NEBULA

Base Station Router

(S//SI//FVEY) Multi-Protocol macro-class Network-ln-a-Box (NIB) system.
Leverages the existing Typhon GUI and supports GSM, UMTS, CDMA2000
applications. LTE capability currently under development.

(S//SI//REL) Operational
Restrictions exist for equipment
deployment.

> (S//SI//REL) Features:

• Dual Carrier System

• EGSM 900MHz

• UMTS 2100MHz

• CDMA2000 1900MHz

• Macro-class Base station

• Optional Battery Kits

'r (S//SI//REL) Enclosure:

• 8.5"H x 13.0' W x 16.5”D

• Approximately 45 lbs

• Actively cooled for extreme
environments

> (S//SI//REL) NEBULA System Kit:

• NEBULA System

• 3 Interchangeable RF bands

• AC/DC power converter

• Antenna to support MS, GPS,
WIFI, &RF

• LAN, RF, & USB cables

• Pelican Case

• (Field Kit only) Control Laptop
and Accessories

r'(S//SI//REL) Separately Priced Options:

01/27/09

i

i

• Highly Mobile and Deployable * 1500 WH Lilon Battery Kit

• Integrated GPS. MS, & 802.11 ^ (S//SI//REL) Base Station Router Platform:

• Voice & High-speed Data

^(S//SI//REL) Advanced Features:

• GPS - Supporting NEBULA
applications

• Multiple BSR units can be
interconnected to form a macro network
using 802.3 and 802.11 back-haul.

• Future GPRS and HSDPA data
service and associated applications

• Designed to be self-configuring
with security and encryption features

• 802.11 - Supports high speed
wireless LAN remote command and
control

Status:

Unit Cost: $250K

POC:

S32242,

nsa.ic.gov

SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_NIGHTSTAND.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

NIGHTSTAND

Wireless Exploitation / Injection Tool

(TS//SI//REL) An active 802.11 wireless exploitation and injection tool for
payload/exploit delivery into otherwise denied target space. NIGHTSTAND is
typically used in operations where wired access to the target is not possible.

(TS//SI//REL) NIGHTSTAND - Close Access Operations •
Battlefield Tested • Windows Exploitation • Standalone System

System Details

> (U//FOUO) Standalone tool currently
running on an x86 laptop loaded with
Linux Fedora Core 3.

> (TS//SI//REL) Exploitable Targets
include Win2k, WinXP, WinXPSPl,
WINXPSP2 running internet Explorer
versions 5.0-6.0.

> (TS//SI//REL) NS packet injection can
target one client or multiple targets on a
wireless network.

> (TS//SI//REL) Attack is undetectable by
the user.

NIGHTSTAND Hardware

(TS//SI//REL) Use of external amplifiers and antennas in both
experimental and operational scenarios have resulted in successful
NIGHTSTAND attacks from as far away as eight miles under ideal
environmental conditions.

I

I

Unit Cost: Varies from platform to platform

Status: Product has been deployed in the field. Upgrades to the system continue to
be developed.

POC: ¡¡^^■1, S32242, | [5)nsa.ic.aov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_NIGHTWATCH.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

NIGHTWATCH

ANT Product Data

(TS//SI//REL TO USA,FVEY) NIGHTWATCH is a portable computer with

(TS//SI//REL TO USA,FVEY) The current
implementation of NIGHTWATCH consists of
a general-purpose PC inside of a shielded
case. The PC has PCI digitizing and clock
cards to provide the needed interface and
accurate clocking required for video
reconstruction. It also has:

• horizontal sync, vertical sync and video
outputs to drive an external, multi-sync
monitor.

• video input

• spectral analysis up to 150 kHz to provide for indications of horizontal and
vertical sync frequencies

• frame capture and forwarding

• PCMCIA cards for program and data storage

• horizontal sync locking to keep the display set on the NIGHTWATCH display.

• frame averaging up to 2A16 (65536) frames.

(U) Concept of Operation

(TS//SI//REL TO USA,FVEY) The video output from an appropriate collection
system, such as a CTX4000, PHOTOANGLO, or general-purpose receiver, is
connected to the video input on the NIGHTWATCH system. The user, using the
appropriate tools either within NIGHTWATCH or externally, determines the
horizontal and vertical sync frequencies of the targeted monitor. Once the user
matches the proper frequencies, he activates "Sync Lock" and frame averaging
to reduce noise and improve readability of the targeted monitor. If warranted, the
user then forwards the displayed frames over a network to NSAW, where
analysts can look at them for intelligence purposes.

Unit Cost: N/A

Status: This system has reached the end of its service life. All work concerning
the NIGHTWATCH system is strictly for maintenance purposes. This system is
slated to be replaced by the VIEWPLATE system.

S32243, nsa.ic.gov

specialized, internal hardware designed to process progressive-scan (non- 24 Jul 2008

interlaced) VAGRANT signals.

(U) Capability Summary

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_PHOTOANGLO.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

PHOTOANGLO

ANT Product Data

(TS//SI//REL TO USA,FVEY) PHOTOANGLO is a joint NSA/GCHQ project to
develop a new radar system to take the place of the CTX4000.

24 Jul2008

(U) Capabilities

(TS//SI//REL TO USA,FVEY) The planned capabilities for this system are:
•Frequency range: 1 - 2 GHz, which will be later extended to 1 - 4 GHz.
•Maximum bandwidth: 450 MHz.

•Size: Small enough to fit into a slim briefcase.

•Weight: Less than 10 lbs.

•Maximum Output Power: 2 W
•Output:

•Video

•Transmit antenna
•Inputs:

•External oscillator
•Receive antenna

(U) Concept of Operation

(TS//SI//REL TO USA,FVEY) TS//SI//REL TO USA,FVEY) The radar unit
generates an un-modulated, continuous wave (CW) signal. The oscillator is
either generated internally, or externally through a signal generator or cavity
oscillator. The unit amplifies the signal and sends it out to an RF connector,
where it is directed to some form of transmission antenna (horn, parabolic dish,
LPA, spiral). The signal illuminates the target system and is re-radiated. The
receive antenna picks up the re-radiated signal and directs the signal to the
receive input. The signal is amplified, filtered, and mixed with the transmit
antenna. The result is a homodyne receiver in which the RF signal is mixed
directly to baseband. The baseband video signal is ported to an external BNC
connector. This connects to a processing system, such as NIGHTWATCH, an
LFS-2, or VIEWPLATE, to process the signal and provide the intelligence.

Unit Cost: $40k (planned)

Status: Development. Planned IOC is 1st QTR FY09.

POC:| B S32243, | |,| Bg)nsa.ic.qov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_PICASSO.jpg:
SECRET//COMINT//REL TO USA, FVEY

*

■blip

MÄ&

PICASSO

GSM HANDSET

(S//SI//REL) Modified GSM (target) handset that collects user data, location
information and room audio. Command and data exfil is done from a laptop and
regular phone via SMS - (Short Messaging Service), without alerting the target.

06/20/08

(S//SI) Target Data via SMS:

• Incoming call numbers

• Outgoing call numbers

• Recently registered networks

• Recent Location Area Codes (LAC)
•Cell power and Timing Advance
information (GEO)

•Recently Assigned TMSI, IMSI
•Recent network authentication
challenge responses

• Recent successful PINs entered into
the phone during the power-on cycle
•SW version of PICASSO implant

•' Hot-mic’ to collect Room Audio

• Panic Button sequence (sends location
information to an LP Operator)

• Send Targeting Information (i.e.
current IMSI and phone number when it
is turned on - in case the SIM has just
been switched).

•Block call to deny target service.

GSM Network

i



Control l *c*op end
Normal Phom

income* C*i H.trtoect
Ou*gcog Cel Nuafeer»

LAC*

Cel Ro«««

Recant TVS»» M IMS!»
Nafaortt A»«r*'fe:aton

Roc*** SuccttiV P«»
CASSO SMTVMon

(S//SI//REL) Handset
Options

•Eastcom 760c+

•Samsung E600, X450
•Samsung C140

•(with Arabic keypadflanguage option)

(S//SI) PICASSO Operational Concept

(S//SI//REL) Uses include asset
validation and tracking and target
templating. Phone can be hot
mic’d and has a “Panic Button”
key sequence for the witting user.

Status: 2 weeks ARO (10 or less)
Unit Cost: approx $2000

ftOHEAOO I

co reo c«

i

i

POC:|

S32242,

nsa.ic.gov

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108

SECRET//COMINT//REL TO USA, FVEYS3224_RAGEMASTER.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

RAGEMASTER

ANT Product Data

(TS//SI//REL TO USA.FVEY) RF retro-reflector that provides an enhanced radar
cross-section for VAGRANT collection. It's concealed in a standard computer video
graphics array (VGA) cable between the video card and video monitor. It’s typically
installed in the ferrite on the video cable.

(U) Capabilities

(TS//SI//REL TO USA.FVEY) RAGEMASTER provides a target for RF flooding
and allows for easier collection of the VAGRANT video signal. The current
RAGEMASTER unit taps the red video line on the VGA cable. It was found that,
empirically, this provides the best video return and cleanest readout of the
monitor contents.

24 Jul 2008

(U) Concept of Operation

(TS//SI//REL TO USA.FVEY) The RAGEMASTER taps the red video line
between the video card within the desktop unit and the computer monitor,
typically an LCD. When the RAGEMASTER is illuminated by a radar unit, the
illuminating signal is modulated with the red video information. This information
is re-radiated, where it is picked up at the radar, demodulated, and passed
onto the processing unit, such as a LFS-2 and an external monitor,
NIGHTWATCH, GOTHAM, or (in the future) VIEWPLATE. The processor
recreates the horizontal and vertical sync of the targeted monitor, thus allowing
TAO personnel to see what is displayed on the targeted monitor.



Unit Cost: $ 30

Status: Operational. Manufactured on an as-needed basis. Contact POC for
availability information.

POC: I I, S32243, | |, I l@nsa.ic.gov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_SPARROW_II.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

SPARROW II

Wireless Survey - Airborne Operations - UAV

(TS//SI//REL) An embedded computer system running BLINDDATE
tools. Sparrow II is a fully functional WLAN collection system with
integrated Mini PCI slots for added functionality such as GPS and
multiple Wireless Network Interface Cards._________________________

(U//FOUO) System Specs

Processor: IBM Power PC 405GPR
Memory: 64MB (SDRAM)

16MB (FLASH)

Expansion: Mini PCI (Up to 4
devices) supports USB, Compact
Flash, and 802.11 B/G

OS: Linux (2.4 Kernel)

Application SW: BLINDDATE

Battery Time: At least two hours

SPARROW II Hardware

(TS//SI//REL) The Sparrow II is a capable option for deployment where
small size, minimal weight and reduced power consumption are required.
PCI devices can be connected to the Sparrow II to provide additional
functionality, such as wireless command and control or a second or third
802.11 card. The Sparrow II is shipped with Linux and runs the
BLINDDATE software suite.

Unit Cost: $6K

Status: (S//SI//REL) Operational Restrictions exist for equipment deployment.

S32242, | | I Bffinsa.ic.qov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_SURLYSPAWN.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

SURLYSPAWN

ANT Product Data

(TS//SI//REL TO USA,FVEY) Data RF retro-reflector. Provides return
modulated with target data (keyboard, low data rate digital device) when
illuminated with radar.

(U) Capabilities

(TS//SI//REL TO USA,FVEY) SURLYSPAWN
has the capability to gather keystrokes without
requiring any software running on the targeted
system. It also only requires that the targeted
system be touched once. The retro-reflector is
compatible with both USB and PS/2 keyboards.

The simplicity of the design allows the form
factor to be tailored for specific operational
requirements. Future capabilities will include
laptop keyboards.

(U) Concept of Operation

(TS//SI//REL TO USA,FVEY) The board taps into the data line from the
keyboard to the processor. The board generates a square wave oscillating at
a preset frequency. The data-line signal is used to shift the square wave
frequency higher or lower, depending on the level of the data-line signal. The
square wave, in essence, becomes frequency shift keyed (FSK). When the
unit is illuminated by a CW signal from a nearby radar, the illuminating signal
is amplitude-modulated (AM) with this square wave. The signal is re-radiated,
where it is received by the radar, demodulated, and the demodulated signal is
processed to recover the keystrokes. SURLYSPAWN is part of the
ANGRYNEIGHBOR family of radar retro-reflectors.

07 Apr 2009

i

i

Unit Cost: $30

Status: End processing still in development

POC: I I, S32243,1 I, I Bg)nsa.ic.qov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_TAWDRYYARD.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

TAWDRYYARD

ANT Product Data

(TS//SI//REL TO USA.FVEY) Beacon RF retro-reflector. Provides return
when illuminated with radar to provide rough positional location.

(U) Capabilities

(TS//SI//REL TO USA.FVEY) TAWDRYYARD is
used as a beacon, typically to assist in locating
and identifying deployed RAGEMASTER units.
Current design allows it to be detected and located
quite easily within a 50' radius of the radar system
being used to illuminate it. TAWDRYYARD draws
as 8 pA at 2.5V (20pW) allowing a standard lithium
coin cell to power it for months or years. The
simplicity of the design allows the form factor to
be tailored for specific operational requirements.
Future capabilities being considered are return of
GPS coordinates and a unique target identifier and
automatic processing to scan a target area for
presence of TAWDRYYARDs. All components are
COTS and so are non-attributable to NSA.

07 Apr 2009

(U) Concept of Operation

(TS//SI//REL TO USA.FVEY) The board generates a square wave operating
at a preset frequency. This square wave is used to turn a FET (field effect
transistor) on and off. When the unit is illuminated with a CW signal, the
illuminating signal is amplitude-modulated (AM) with the square wave. This
signal is re-radiated, where it is picked up by the radar, then processed to
recover the clock signal. Typically, the fundamental is used to indicate the
unit's presence, and is simply displayed on a low frequency spectrum
analyzer. TAWDRYYARD is part of the ANGRYNEIGHBOR family of radar
retro-reflectors.

Unit Cost: $30

Status: End processing still in development

POC: S32243, | |@nsa.ic.gov

TOP SECRET//COMINT//REL TO USA, FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_TYPHON_HX.jpg:
SECRET//COMINT//REL TO USA, FVEY

TYPHON HX

GSM Base Station Router

(S//SI//FVEY) Base Station Router - Network-ln-a-Box (NIB) supporting GSM
bands 850/900/1800/1900 and associated full GSM signaling and call control.

06/20/08

Typhon Hx BSR

Typhon BSR

(S//SI//FVEY) Tactical SIGINT elements
use this equipment to find, fix and finish
targeted handset users.

(S//SI) Target GSM handset registers with
BSR unit.

(S//SI) Operators are able to geolocate
registered handsets, capturing the user.

(S//SI//REL) The macro-class Typhon is a Network-ln-a-
Box (NIB), which includes all the necessary architecture to
support Mobile Station call processing and SMS
messaging in a stand-alone chassis with a pre-
provisioning capability.

(S//SI//REL) The Typhon system kit includes the amplified
Typhon system, OAM&P Laptop, cables, antennas and
AC/DC power supply.

(U//FOUO) An 800 WH Lilon Battery kit is offered
separately.

I

I

(U) A bracket and mounting kit are available upon
request.

(U) Status: Available 4 mos ARO

(S//SI//REL) Operational Restrictions
exist for equipment deployment.

POC:

S32242,

|(5)nsa.ic.qov

SECRET//COMINT//REL TO USA. FVEY

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108S3224_WATERWITCH.jpg:
TOP SECRET//COMINT//REL TO USA, FVEY

WATERWITCH

Handheld Finishing Tool

(S//SI) Hand held finishing tool used for geolocating targeted handsets
in the field.

07/30/08

(S//SI) Features:

• Split display/controller for
flexible deployment
capability

• External antenna for DFing
target; internal antenna for
communication with active
interrogator

• Multiple technology
capability based on SDR (s//si) waterwitch Handset df set

Platform; currently UMTS, with GSM and CDMA2000 under
development

• Approximate size 3” x 7.5” x 1.25” (radio), 2.5” x 5” x 0.75”
(display); radio shrink in planning stages

• Display uses E-Ink technology for low light emissions

(S//SI) Tactical Operators use WATERWITCH to locate
handsets (last mile) where handset is connected to Typhon or
similar equipment interrogator. WATERWITCH emits tone and
gives signal strength of target handset. Directional antenna on
unit allows operator to locate specific handset.

I

I

Status: Under Development. Available FY-2008 Unit Cost:
LRIP Production due August 2008

POC:| I.S32242, | |, I B@)nsa.ic.qov

Derived From: NSA/CSSM 1-52

Dated: 20070108

Declassify On: 20320108

TOP SECRET//COMINT//REL TO USA, FVEY

Release Date: 2013-12-30

Document Path: http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_DEITYBOUNCE.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_DROPOUTJEEP.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_FEEDTROUGH.cleaned.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GINSU.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GOPHERSET.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GOURMETTROUGH.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_HALLUXWATER.cleaned.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_HEADWATER.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_IRATEMONK.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_IRONCHEF.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_JETPLOW.cleaned.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_MONKEYCALENDAR.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_SOUFFLETROUGH.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_SWAP.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_TOTECHASER.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_WISTFULTOLL.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-I.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-II.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-III.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_CROSSBEAM.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_FIREWALK.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_HOWLERMONKEY.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_JUNIORMINT.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_MAESTRO-II.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_SOMBERKNAVE.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_TRINITY.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CANDYGRAM.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CTX4000.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CYCLONE_Hx9.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_EBSR.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_ENTOURAGE.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_GENISIS.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_LOUDAUTO.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NEBULA.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NIGHTSTAND.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NIGHTWATCH.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_PHOTOANGLO.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_PICASSO.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_RAGEMASTER.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_SPARROW_II.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_SURLYSPAWN.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_TAWDRYYARD.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_TYPHON_HX.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_WATERWITCH.jpg

Article Link: http://www.spiegel.de/international/world/nsa-secret-toolbox-ant-unit-offers-spy-gadgets-for-every-need-a-941006.html
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_DEITYBOUNCE.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_DROPOUTJEEP.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_FEEDTROUGH.cleaned.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GINSU.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GOPHERSET.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GOURMETTROUGH.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_HALLUXWATER.cleaned.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_HEADWATER.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_IRATEMONK.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_IRONCHEF.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_JETPLOW.cleaned.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_MONKEYCALENDAR.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_SOUFFLETROUGH.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_SWAP.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_TOTECHASER.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_WISTFULTOLL.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-I.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-II.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-III.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_CROSSBEAM.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_FIREWALK.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_HOWLERMONKEY.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_JUNIORMINT.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_MAESTRO-II.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_SOMBERKNAVE.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_TRINITY.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CANDYGRAM.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CTX4000.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CYCLONE_Hx9.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_EBSR.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_ENTOURAGE.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_GENISIS.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_LOUDAUTO.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NEBULA.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NIGHTSTAND.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NIGHTWATCH.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_PHOTOANGLO.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_PICASSO.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_RAGEMASTER.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_SPARROW_II.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_SURLYSPAWN.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_TAWDRYYARD.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_TYPHON_HX.jpg
http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_WATERWITCH.jpg

Links

#1 http://www.spiegel.de/international/world/nsa-secret-toolbox-ant-unit-offers-spy-gadgets-for-every-need-a-941006.html Show in Doc Search Show in New Window
#2 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_DEITYBOUNCE.jpg Show in Doc Search Show in New Window
#3 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_DROPOUTJEEP.jpg Show in Doc Search Show in New Window
#4 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_FEEDTROUGH.cleaned.jpg Show in Doc Search Show in New Window
#5 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GINSU.jpg Show in Doc Search Show in New Window
#6 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GOPHERSET.jpg Show in Doc Search Show in New Window
#7 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_GOURMETTROUGH.jpg Show in Doc Search Show in New Window
#8 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_HALLUXWATER.cleaned.jpg Show in Doc Search Show in New Window
#9 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_HEADWATER.jpg Show in Doc Search Show in New Window
#10 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_IRATEMONK.jpg Show in Doc Search Show in New Window
#11 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_IRONCHEF.jpg Show in Doc Search Show in New Window
#12 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_JETPLOW.cleaned.jpg Show in Doc Search Show in New Window
#13 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_MONKEYCALENDAR.jpg Show in Doc Search Show in New Window
#14 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_SOUFFLETROUGH.jpg Show in Doc Search Show in New Window
#15 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_SWAP.jpg Show in Doc Search Show in New Window
#16 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_TOTECHASER.jpg Show in Doc Search Show in New Window
#17 http://edwardsnowden.com/wp-content/uploads/2013/12/S3222_WISTFULTOLL.jpg Show in Doc Search Show in New Window
#18 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-I.jpg Show in Doc Search Show in New Window
#19 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-II.jpg Show in Doc Search Show in New Window
#20 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_COTTONMOUTH-III.jpg Show in Doc Search Show in New Window
#21 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_CROSSBEAM.jpg Show in Doc Search Show in New Window
#22 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_FIREWALK.jpg Show in Doc Search Show in New Window
#23 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_HOWLERMONKEY.jpg Show in Doc Search Show in New Window
#24 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_JUNIORMINT.jpg Show in Doc Search Show in New Window
#25 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_MAESTRO-II.jpg Show in Doc Search Show in New Window
#26 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_SOMBERKNAVE.jpg Show in Doc Search Show in New Window
#27 http://edwardsnowden.com/wp-content/uploads/2013/12/S3223_TRINITY.jpg Show in Doc Search Show in New Window
#28 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CANDYGRAM.jpg Show in Doc Search Show in New Window
#29 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CTX4000.jpg Show in Doc Search Show in New Window
#30 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_CYCLONE_Hx9.jpg Show in Doc Search Show in New Window
#31 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_EBSR.jpg Show in Doc Search Show in New Window
#32 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_ENTOURAGE.jpg Show in Doc Search Show in New Window
#33 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_GENISIS.jpg Show in Doc Search Show in New Window
#34 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_LOUDAUTO.jpg Show in Doc Search Show in New Window
#35 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NEBULA.jpg Show in Doc Search Show in New Window
#36 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NIGHTSTAND.jpg Show in Doc Search Show in New Window
#37 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_NIGHTWATCH.jpg Show in Doc Search Show in New Window
#38 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_PHOTOANGLO.jpg Show in Doc Search Show in New Window
#39 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_PICASSO.jpg Show in Doc Search Show in New Window
#40 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_RAGEMASTER.jpg Show in Doc Search Show in New Window
#41 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_SPARROW_II.jpg Show in Doc Search Show in New Window
#42 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_SURLYSPAWN.jpg Show in Doc Search Show in New Window
#43 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_TAWDRYYARD.jpg Show in Doc Search Show in New Window
#44 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_TYPHON_HX.jpg Show in Doc Search Show in New Window
#45 http://edwardsnowden.com/wp-content/uploads/2013/12/S3224_WATERWITCH.jpg Show in Doc Search Show in New Window

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh