Title: SSO Collection Optimization overview

Release Date: 2013-10-14

Document Date: 2012-01-01

Description: This NSA Special Source Operations presentation describes the agency’s collection of webmail address books and contact lists: see the Washington Post article NSA collects millions of e-mail address books globally, 14 October 2013.

Document: TOP SECRET//SI//NOFORN

SSO Collection Optimization

Core SSO Team:

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Address Books

• Email address books for most major webmail are collected as
stand-alone sessions (no content present*)

• Address books are repetitive, large, and metadata-rich

• Data is stored multiple times (marina/mainway, pinwale, clouds)

• Fewer and fewer address books attributable to users, targets

• Address books account for ~ 22% of SSO's major accesses (up
from ~ 12% in August)

Access(10 Jan 12) Total Sessions Address Books " Provider Collected A;ributed A;ributed%
US-3171 1488453 237067 (16% of traffic) Yahoo 444743 11009 2.48%
DS-200B 938378 311113 (33% of traffic) Hotmail 105068 1115 1.06%
US-3261 94132 2477 (3% of traffic) Gmail 33697 2350 6.97%
US-3145 177663 29336 (16% of traffic) Facebook 82857 79437 95.87%
US-3180 269794 40409 (15% of traffic) Other 22881 1175 5.14%
US-3180 (16 Dec 11) TOTAL 289318 3257738 91964 (32% of traffic) 712366 (22% of traffic) TOTAL 689246 95086 13.80%

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Address Books

• Enabled in SCISSORS for various SSO sites:

- JPMQ (metadata: QMPJ) - DS-200B (MUSCULAR) 29 Feb 2012

- DGOT (metadata: TOGD) - US-3171 (DANCINGOASIS) 13 Mar 2012

- DGOD (metadata: DOGD) - US-3171 (DANCINGOASIS) 13 Mar 2012

- SPNN (metadata: NNPS) - US-3180 (SPINNERET) 03 May 2012

- EGLP (metadata: PLGE) - US-3145 (MOONLIGHTPATH) 08 May 2012

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Address Books

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Address Books

40000

AUC-393

35000

AUC-395

CAC-'JSCG

?. :j:j 00

DS-200A

DS-200B

25000

DS-200X

DS-300

rnnon

DS-410

D S 800

15000

NZC-333

UKC-125

UKC-206D

1 Li: J LI LI

UKC-215

UKC-302A

5000

UKJ-260D





US-3101M

US-3105

US-3145

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

Selector Detasks

Emergency Detasks

140
120
100
80
60
40
20
0

Nov-11 Dec-11 Jan-12 Feb-12 Mar-12 Apr-12 May-12

TOP SECRET//SI//NOFORN

TOP SECRET//SI//NOFORN

So What?

• Store less of the wrong data

- 20% reduction (so far) in content to long-term repositories

- Data still resides at site for SIGDEV

• Increase data variety

- Hole left by “wrong data” filled with more “right data”

- More signals and case notations can be tasked at site

• Shifting collection philosophy at NSA

- “Memorialize what you need” versus “Order one of
everything off the menu and eat what you want”

WIKI: https://wiki.nsa.ic.gov/wiki/Collection_Optimization
XKEYSCORE: fingerprint/defeats/atrouter and fingerprint/defeats/atxks

TOP SECRET//SI//NOFORN


e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh