Title: OAKSTAR Weekly Update – 29 March 2013
Release Date: 2018-03-20
Document Date: 2012-03-01
Description: This internal NSA technical update from March 2013 provides metrics about the information from the access point codenamed MONEYROCKET, which was the NSA’s source for tracking Bitcoin users: see the Intercept article The NSA Worked To “track Down” Bitcoin Users, Snowden Documents Reveal, 20 March 2018.
Document: TOP SECRET//COMINT//NOFORN
OAKSTAR Weekly Update
Program Highlights Week of: March 23-29, 2013
ETS:
Derived From: NSA/CSSM 1-52
Dated: 20070108
Declassify On: 20320108
TOP SECRET//COMINT//NOFORN
* AD'
TOP SECRET//COMINT//NOFORN
MONKEYROCKET: (U//FOUO) Submitted ticket to Property for handcarry DD1149
for handoff of equipment to ETC technician coming to NBP320 next week to take back
to site. Awaiting finalized paperwork from property team.
TOP SECRET//COMINT//NOFORN
TOP SECRET//COMINT//NOFORN
(U//FOUO) Received phone call from TS, that he is hoping to grant ATO
for MONKEYROCKET-CONNECTION within a few weeks. He has been tied up in the
higher priority of MYSTIC.
(U//FOUO) Tweaked some scripts to enhance data flow.
ODD:
Overview:
(S) OAKSTAR 2013 serialized product report totals: 416 reports and 2506 GISTs.
(S) There is one open/active REMEDY ticket for OAKSTAR.
BLUEZEPHYR: Day 2263...
TOP SECRET//COMINT//NOFORN
TOP SECRET//COMINT//NOFORN
MONKEYROCKET: Day 246
(U) 2013 = 1 report (they were 1 of 43 sources for the report, but hey, it’s the 1st).
TOP SECRET//COMINT//NOFORN
TOP SECRET//COMINT//NOFORN
i/i
TJ
L.
o
u
OL
(0
*->
(0
T>
4->
3000000
2250000
1500000
750000
MONKEYROCKET Metrics for March
2013
J____3 5 7 9 11 13 15 17 19 21 23 25 27 29 31
209,000 files not being
forward 21-22 MAR
No records sent from
O APSROOOOOOOZO01
♦ APSRO0OOOOOZO02
O APSROOOOOOOZ003
♦ APSRO0OOOOOZOO4
♦ APSROOOOOOOZ005
♦ APSROOOOOOOZOQ6
(TS//NF) Met with SSG11 and S2F on the MR access. The following topics
were discussed:
• Checking to see if the DTG/Port/IP Address could be assessed to validate if it hits
against the BITCOIN Targets
• Checking to see if the partner does any user validation
• The relationship between BITCOIN targets and the MONKEYROCKET data
• Additional data that is not found in XKS-central, but can be made available to the
customer
o The following files were sent to the customer for analysis:
- Mac_address.csv
- Password_hash_history.csv
- Provider user full.csv
- User_sessions full.csv
As of right now, MONKEYROCKET is offering a sole source for SIGDEV for the
BITCOIN Targets. We requested feedback and any mission highlights they have or will
have. (SNM)
TOP SECRET//COMINT//NOFORN