This page from GCHQ’s internal GCWiki provides a guide to the NSA’s XKeyScore tool: see the Der Spiegel article The NSA in Germany: Snowden’s Documents Available for Download, 18 June 2014.

This presentation gives an overview of the NSA’s programmes targeting the fibre optic cables that carry much of the world’s internet traffic. One slide gives a breakdown of which data sources form the basis of Presidential daily briefings. Another shows that the access point used to collect Yahoo and Google cloud data (MUSCULAR) is operated […]

This NSA Special Source Operations slide from 25 April 2013 shows that GCHQ’s INCENSER access continued after Vodafone acquired corporate partner Cable & Wireless the previous year: see the Süddeutsche Zeitung article Snowden-Leaks: How Vodafone-Subsidiary Cable & Wireless Aided GCHQ’s Spying Efforts, 25 November 2014.

This Boundless Informant slide shows the number of WINDSTOP records collected day-by-day between 10 December 2012 and 8 January 2013. WINDSTOP covers at least four NSA collection systems that depend on Five Eyes partners; the MUSCULAR project to intercept traffic from Google and Yahoo data centres is representated by the code DS-200B. In the given […]

This three-page memo is an internal guide to the NSA’s Boundless Informant tool, which allows the agency’s Global Access Operations to assess its collection capabilities by means of metadata record counts: see the Guardian article Boundless Informant: the NSA’s secret tool to track global surveillance data, 8 June 2013.

An internal Special Source Operations document describes the volume of user account information obtained from Yahoo data centres amid internal NSA complaints about its limited intelligence value: see the Washington Post article NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say, 30 October 2013.

This NSA Special Source Operations presentation describes the agency’s collection of webmail address books and contact lists: see the Washington Post article NSA collects millions of e-mail address books globally, 14 October 2013.

This undated page from NSA’s internal WikiInfo describes VALIANTSURF “the coverterm for the development of Data Network Cipher (DNC) exploitation capabilities in TURMOIL”: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

An undated NSA slide shows that the agency collects Hotmail address books. Two further slides indicate that Hotmail and Windows Live Messenger messages have been intercepted, although it is not clear that this did not happen on the public internet: see the Washington Post article Microsoft, suspecting NSA spying, to ramp up efforts to encrypt […]

This 24 November 2009 email from a GCHQ employee to NSA colleagues indicates that Monkey Puzzle, a tool associated with the datacentre-targeting Muscular project, has interfaces tailored to Google, Yahoo and Microsoft data: see the Washington Post article Microsoft, suspecting NSA spying, to ramp up efforts to encrypt its Internet traffic, 27 November 2013. Download […]

Slides from an undated Special Source Operations presentation include references to data structures and formats that could only have been obtained from the internal systems of Yahoo and Google: see the Washington Post article How we know the NSA had access to internal Google and Yahoo cloud data, 4 November 2013.