DocumentRelease Date: 2014-03-12
Slides from an NSA Turbulence presentation describe two of the agency’s specialised implants, aimed at compromising virtual private networks (VPNs) and online telephony (VOIP): see the Intercept article How the NSA Plans to Infect ‘Millions’ of Computers with Malware, 12 March 2014.
TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123 APEX VPN Phases ► VPN Phase 1: IKE Metadata Only (Spin 15) - IKE packets are exfiled to TURMOIL APEX. ■ APEX reconstructs/r...
DocumentDocument Date: 2012-10-01Release Date: 2013-12-10
This 24 page white paper dated 1 October 2012 describes and evaluates some of the Co-Traveller tools the NSA and partner agencies uses to analyse phone location data: see the Washington Post article New documents show how the NSA infers relationships based on mobile location data, 10 December 2013.
TOP SECRET//COMINT//REL TO USA, FVEY Summary of DNR and DNI Co-Travel Analytics S2I5 1 October 2012 Contact information TOP SECRET//COMINT//REL TO USA, FVEY TOP SECRET//COMINT//R...
DocumentRelease Date: 2014-12-28
This undated NSA presentation from the agency’s Information Technology Directorate, aimed at analysts, describes techniques for decrypting IPSec VPN traffic: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.
This Briefing is Classified TOP SECRET//COMINT//REL USA, FVEY Analytic Challenges from Active-Passive Integration S324 This Briefing is Classified TOP SECRET//COMINT//REL USA,FVEY DER...
DocumentRelease Date: 2013-11-04
This presentation gives an overview of the NSA’s programmes targeting the fibre optic cables that carry much of the world’s internet traffic. One slide gives a breakdown of which data sources form the basis of Presidential daily briefings. Another shows that the access point used to collect Yahoo and Google cloud data (MUSCULAR) is operated […]
TOP SECRET//COMINT//NOFORN Special Source Operations r The Cryptologic Provider of Intelligence from GlobalHigh-Capacity Telecommunications Systems P TOP SECRET//COMINT//NOFORN TO...
DocumentRelease Date: 2013-12-04
These two slides show the extent and types of information recorded in the NSA’s DNR (phone record) database. Selectors specified include Location Area Code (LAC), Cell Tower ID (CellID), Visitor Location Register (VLR), handset serial number (IMEI) and full phone number (MSISDN): see the Washington Post article NSA tracking cellphone locations worldwide, Snowden documents show, […]
TOP SECRET//COMINT//REL TO USA, FVEY Example of Current Volumes and Limits 25,000,000, 000 ■ Total MetaDNI Records Deleted ■ Total Records Transferred to MARINA □ Records in...
DocumentDocument Date: 2009-03-01Release Date: 2015-07-01
This 49-page March 2009 NSA presentation explains how to conduct searches within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.
xks-search-forms-p1-normal.gif: XKEYSCORE Search Forms March 2009 El • *1 ... ■ OK l 1001 SECRET//COMINT//REL TO USA, AUS, CAN, GBR, MZL 1-52 DATED: 20...
DocumentDocument Date: 2012-04-01Release Date: 2015-08-15
This April 2012 NSA presentation uses an AT&T specific term – Common Backbone or CBB – to refer to the Internet backbone of the corporate partner it codenames FAIRVIEW: see the New York Times article AT&T Helped U.S. Spy on Internet on a Vast Scale, 15 August 2015.
flip Dataflow Diagrams April 2012 Note: Please refer to previous diagrams for decommissioned systems. Derived From: NSA/CSSM 1-52 Dated: 20070108 Declassify On: 20361101 Corporate...
BUGCATCHER, CADENCE, CLEARSIGHT, COURIERSKILL, DISHFIRE, FAIRVIEW, FALLOUT, FASCIA, FISHWAY, GATEKEEP, HIGHDECIBEL, MAILORDER, MAINWAY (MW), MARINA, MESA, PINECONE, PINWALE, RAGTIME (RGT), RIMROCK, SCISSORS, TOPROCK, WEALTHYCLUSTER (WC), XKEYSCORE (XKS), YANKEE
DocumentRelease Date: 2015-09-25
This undated page from GCHQ’s internal GCWiki provides a definition of “event”, the term the agency uses to refer to a metadata record, showing the variety of data collected: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 September 2015.
events-p1-normal.gif: SECRET STRAP 1 COMiNT The maximum classification allowed on GCWiki is TOP SECRET STRAP1 COMINT. Click to report inappropriate content. For GCWiki help contact: webtea...
DocumentDocument Date: 2010-11-01Release Date: 2015-09-25
This GCHQ presentation from November 2010 shows that the agency was logging 30 billion metadata records per day by that year: see the Intercept article Profiled: From Radio to Porn, British Spies Track Web Users’ Online Identities, 25 September 2015.
operational-engineering-nov-2010-p1-normal.gif: •¿events Events Product Centre W: CHQ SECRET STRAP1operational-engineering-nov-2010-p2-normal.gif: »¿events Agenda «Welcome «Im...
DocumentRelease Date: 2014-06-18
This undated NSA document gives updates on various activities of the US-German Joint SIGINT Activity during 2007: see the Der Spiegel article Snowden-Dokumente: Hier sitzt die NSA in Deutschland, 18 June 2014. jsa
TOP SECRET//COMINT//RELTO USA, FVEY (U//FOUO) TEC Successfully Installs BOTANICREALTY at LADYLOVE (USJ-799) (TS//SI//REL) In response to a request from S2B, MSOC System Development and Sign...
Algeria (DZA/DZ), Germany (DEU/DE), Lebanon (LBN/LB), Monaco (MCO/MC), Poland (POL/PL), Russia (RUS/RU), Tajikistan (TJK/TJ), United Arab Emirates (ARE/AE), United States (USA/US)
DocumentDocument Date: 2012-09-06Release Date: 2013-06-08
This three-page memo is an internal guide to the NSA’s Boundless Informant tool, which allows the agency’s Global Access Operations to assess its collection capabilities by means of metadata record counts: see the Guardian article Boundless Informant: the NSA’s secret tool to track global surveillance data, 8 June 2013.
UNCLASSIFIED//FOR OFFICIAL USE ONLY BOUNDLESSINFORMANT - Frequently Asked Questions_09-06-2012 (U/FOUO) Questions 1 ) What is BOUNDLESSINFORMANT? What is its purpose? 2) Who are the in...
DocumentRelease Date: 2014-03-18
This extract from the NSA’s Special Source Operations division’s weekly memo describes the operation of SCALAWAG, the SIGAD (or collection address) associated with the MYSTIC collection of bulk telephony data: see the Washington Post article NSA surveillance program reaches ‘into the past’ to retrieve, replay phone calls, 18 March 2014.
(U) Tasking of SCALAWAG (TS//SI//REL TO USA, FVEY) SCALAWAG/US-3310BG has long since reached the point where it was collecting and sending home far more than the bandwidth could handle. Over ...
DocumentDocument Date: 2005-07-06Release Date: 2014-08-25
This memorandum dated 6 July 2005 describes features of the intelligence sharing systems that preceded ICREACH: see the Intercept article The Surveillance Engine: How the NSA Built Its Own Secret Google, 25 August 2014.
SECRET//NOFORN//MR UNITED STATES GOVERNMENT memorandum TAC-0xx-05 DATE: 06 July 2005 REPLY TO ATTN OF: TD/TAC SUBJECT: Sharing of MetaData across the IC —Dissemination of SIGINT ...
DocumentDocument Date: 2009-08-01Release Date: 2015-01-17
This NSA TURBULENCE presentation dated August 2009 explains the APEX method of combining passive with active methods to exfiltrate data from networks attacked: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.
Active/Passive Exfiltration "go apex" STDP: S32354 & T112, NCSC/C91 August 2009 OP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123 TOP SECRET//COMHMT//REL TO USA. AUS. CAN....
DocumentDocument Date: 2006-02-26Release Date: 2014-08-25
This NSA Point Paper dated 22 February 2006 provides a history of the CRISSCROSS and PROTON information sharing systems that preceded ICREACH: see the Intercept article The Surveillance Engine: How the NSA Built Its Own Secret Google, 25 August 2014.
TOP SECRET//COMINT//ORCON/NOFORN//MR POINT PAPER SUBJECT: CRISSCROSS/PROTON PURPOSE: Provide DIRNSA information on subject. BACKGROUND: 22 Feb 06 (U) History of CRISSCROSS/PROTON...