This undated GCHQ reference document enumerates the processes and tools analysts use for computer network exploitation: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

This page from GCHQ’s internal GCWiki, last updated on 1 May 2012 documents progress in a variety of the agency’ projects: see Facing Data Deluge, Secret U.K. Spying Report Warned of Intelligence Failure, 7 June 2016.

This undated GCHQ presentation describes SOCIAL ANTHROPOID, a “converged comms database” that analyses metadata from emails, instant messenger chats, social media connections and conversations, together with “telephony” metadata from phone calls, mobile phone locations, text and multimedia messages: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 […]

This undated page from GCHQ’s internal GCWiki shows some of the background to the agency’s attack on Dutch SIM manufacturer Gemalto, specifically the harvesting of facebook cookies associated with the firm’s staff: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 September 2015.

This GCHQ research paper dated 12 November 2010 discuss some of the agency’s attacks against iPhone handsets: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.