Title: Microsoft data

Release Date: 2013-11-27

Description: An undated NSA slide shows that the agency collects Hotmail address books. Two further slides indicate that Hotmail and Windows Live Messenger messages have been intercepted, although it is not clear that this did not happen on the public internet: see the Washington Post article Microsoft, suspecting NSA spying, to ramp up efforts to encrypt […]

Document: TOP SECRET//SI//NOFORN

Address Books

• Email address books for most major webmail are collected as
stand-alone sessions (no content present*)

• Address books are repetitive, large, and metadata-rich

• Data is stored multiple times (marina/mainway, pinwale, clouds)

• Fewer and fewer address books attributable to users, targets

• Address books account for ~ 22% of SSO's major accesses (up
from ~ 12% in August)

Access(10 Jan 12) Total Sessions Address Books " Provider Collected A;ributed A;ributed%
US-3171 1488453 237067 (16% of traffic) Yahoo 444743 11009 2.48%
DS-200B 938378 311113 (33% of traffic) Hotmail 105068 1115 1.06%
US-3261 94132 2477 (3% of traffic) Gmail 33697 2350 6.97%
US-3145 177663 29336 (16% of traffic) Facebook 82857 79437 95.87%
US-3180 269794 40409 (15% of traffic) Other 22881 1175 5.14%
US-3180 (16 Dec 11) TOTAL 289318 3257738 91964 (32% of traffic) 712366 (22% of traffic) TOTAL 689246 95086 13.80%

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Serendipity -
New Protocols

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Serendipity - HTTP Demux

**eoc2c

GU0XlHdS/4k8YUAcliiPGd/Nvri0vYalboluzcaFdZcyfpHeg9rFTIytsjXoUyZnngI417JMAJHZ9M9ZXYwZU9qxvBw0LKZGBYlsvC43iUBvCrf4elcP2Pxs35+L
Cache-Control: no-cache

POST /gateway/gateway.dll?Action=poll£Lifespan=60SSessionID=868216649.1709645966 HTTP/1.1

Host: baymsgl030124. gateway.messenger. 1 ive. com

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

X-Requested-Session-Content-Type: text/html
Content-Type: text/html; charset=utf-8
Pragma: No-Cache, no-cache
X-HSN-Auth: Use-Cookie

Referer: http://baymsgl030124.gateway.messenger.1ive.com/xmlProxy.htm?vn=9.090515.0 £domain=1ive.com
Content-Length: 0

Cookie: wlidperf=latency=14338ithroughput=0; mkt0=en-AF; wla42=cHJveHktYmF5LnB2dCljb250YUN0cy5tc24uY29tfGJ5MSoxLDgzMTYzNjIIN
Cache-Control: no-cache

NENE

**eotxt

TOP SECRET//SI//NOFORN


e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh