This December 2009 NSA presentation explains how keyword selection works within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This presentation from NSA’s Mathematics Research Group, dated 21 August 2008 provides an introduction to the XKeyScore system’s data sources and fingerprinting capabilities: see the SVT article FRA part of top-secret hacker project, 11 December 2013.

Four slides taken from a 24 April 2013 NSA presentation detail how SECONDDATE man-in-the-middle attacks were used against targets in Pakistan and Lebanon: see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.

This 2009 NSA presentation describes some of the plug ins available and the way the tool relates to other NSA methods for searching internet metadata, with XKeyScore having the broadest capability: see the book No Place To Hide, 13 May 2014.

This 2006 post from the internal NSA newsletter SIDToday describes the opening of VICTORYGARDEN, a “state-of-the-art FORNSAT site”: see the Intercept article Norway Used NSA Technology for Potentially Illegal Spying, 1 March 2018.

This 49-page March 2009 NSA presentation explains how to conduct searches within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This 23 March 2011 article from the internal NSA newsletter SIDToday describes an analyst’s surprise at discovering that the agency was collecting internal communications from Venezuelan energy company Petróleos de Venezuela (PDVSA): see the Intercept article Overwhelmed NSA Surprised To Discover Its Own Surveillance “Goldmine” on Venezuela’s Oil Executives, 18 November 2015.

This NSA presentation from March 2009 shows how VOIP intercepts are handled in XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This 27-page NSA document, authored by a consultant from contractor Booz Allen Hamilton, provides a step-by-step guide to using XKeyScore, together with screenshots: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This 60-page NSA presentation from 27 August 2009 explains the use of different kinds of metadata tags in XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This undated NSA document provides a decision tree for the analysis of email addresses, IP addresses, cookies and phone numbers in XKeyScore and other agency tools: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This undated NSA technical document provides an overview and configuration instructions for the tasking tool CADENCE, which can be integrated with XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This 2010 NSA presentation describes Project Camberdada, an attempt to subvert popular antivirus software by means of surveilling email traffic: see the Intercept article Popular Security Software Came Under Relentless NSA and GCHQ Attacks, 22 June 2015.

This 13 September 2010 presentation from the NSA’s OTP VPN Exploitation Team explains the work of the division: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

This April 2012 NSA presentation uses an AT&T specific term – Common Backbone or CBB – to refer to the Internet backbone of the corporate partner it codenames FAIRVIEW: see the New York Times article AT&T Helped U.S. Spy on Internet on a Vast Scale, 15 August 2015.

These three undated NSA Special Source Operation slides supply details on selected RAMPART-A cable access sites: see the Intercept article How Secret Partners Expand NSA’s Surveillance Dragnet, 18 June 2014.

This 26-page NSA document, originally presented at 2012’s Five Eyes SIGDEV conference, gives a detailed overview of the agency’s information gathering on world mobile phone networks. Some intercepted technical and contact details have been redacted: see the Intercept article Operation Auroragold: How the NSA Hacks Cellphone Networks Worldwide, 4 December 2014.

This undated NSA technical document provides detailed information for performing searches within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.s

This NSA presentation from April 2009 explains how analysts can make use of document metadata available through XKeyScore, together with worked examples and screenshots: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This undated NSA presentation, presented together with speaking notes, provides an introduction to the main cable access programmes facilitated by the agency’s corporate partners and specifies the relevant SIGADs: see the book No Place to Hide, 13 May 2014.

This undated page from NSA’s internal WikiInfo describes VALIANTSURF “the coverterm for the development of Data Network Cipher (DNC) exploitation capabilities in TURMOIL”: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.