Title: OAKSTAR Weekly Update – 29 March 2013

Release Date: 2018-03-20

Document Date: 2012-03-01

Description: This internal NSA technical update from March 2013 provides metrics about the information from the access point codenamed MONEYROCKET, which was the NSA’s source for tracking Bitcoin users: see the Intercept article The NSA Worked To “track Down” Bitcoin Users, Snowden Documents Reveal, 20 March 2018.

Document: TOP SECRET//COMINT//NOFORN

OAKSTAR Weekly Update

Program Highlights Week of: March 23-29, 2013

ETS:

Derived From: NSA/CSSM 1-52
Dated: 20070108
Declassify On: 20320108

TOP SECRET//COMINT//NOFORN

* AD'

TOP SECRET//COMINT//NOFORN

MONKEYROCKET: (U//FOUO) Submitted ticket to Property for handcarry DD1149
for handoff of equipment to ETC technician coming to NBP320 next week to take back
to site. Awaiting finalized paperwork from property team.

TOP SECRET//COMINT//NOFORN

TOP SECRET//COMINT//NOFORN

(U//FOUO) Received phone call from TS, that he is hoping to grant ATO

for MONKEYROCKET-CONNECTION within a few weeks. He has been tied up in the
higher priority of MYSTIC.

(U//FOUO) Tweaked some scripts to enhance data flow.

ODD:

Overview:

(S) OAKSTAR 2013 serialized product report totals: 416 reports and 2506 GISTs.
(S) There is one open/active REMEDY ticket for OAKSTAR.

BLUEZEPHYR: Day 2263...

TOP SECRET//COMINT//NOFORN

TOP SECRET//COMINT//NOFORN

MONKEYROCKET: Day 246

(U) 2013 = 1 report (they were 1 of 43 sources for the report, but hey, it’s the 1st).

TOP SECRET//COMINT//NOFORN

TOP SECRET//COMINT//NOFORN

i/i

TJ

L.

o

u


OL

(0

*->

(0

T>

4->


3000000

2250000

1500000

750000

MONKEYROCKET Metrics for March

2013

J____3 5 7 9 11 13 15 17 19 21 23 25 27 29 31

209,000 files not being
forward 21-22 MAR

No records sent from

O APSROOOOOOOZO01

♦ APSRO0OOOOOZO02
O APSROOOOOOOZ003

♦ APSRO0OOOOOZOO4

♦ APSROOOOOOOZ005

♦ APSROOOOOOOZOQ6

(TS//NF) Met with SSG11 and S2F on the MR access. The following topics
were discussed:

• Checking to see if the DTG/Port/IP Address could be assessed to validate if it hits
against the BITCOIN Targets

• Checking to see if the partner does any user validation

• The relationship between BITCOIN targets and the MONKEYROCKET data

• Additional data that is not found in XKS-central, but can be made available to the
customer

o The following files were sent to the customer for analysis:

- Mac_address.csv

- Password_hash_history.csv

- Provider user full.csv

- User_sessions full.csv

As of right now, MONKEYROCKET is offering a sole source for SIGDEV for the
BITCOIN Targets. We requested feedback and any mission highlights they have or will
have. (SNM)

TOP SECRET//COMINT//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh