Snowden Doc Search

DNI Processing of RINGBILL Access

Document

Release Date: 2016-11-16 Document Date: 2013-04-23

This NSA technical memo from April 2013 describes deployments of agency personnel to the facility codenamed TITANPOINTE: see the Intercept article Titanpointe: The NSA’s Spy Hub in New York, Hidden in Plain View, 16 November 2016.

TOP SECRET//COMINT//REL TO USA, FVEY (Report generated on:4/23/2013 7:00:17AM ) Blarney-40-12 Work in Progress ECP Lead: Title of Change: DNI Processing of RINGBILL Access Site(s): TIT...

United Nations DNI Collection Enabled

Document

Release Date: 2015-08-15 Document Date: 2012-04-18

This 18 April 2012 post from the NSA internal newsletter SSO Weekly reveals that AT&T (FAIRVIEW) cooperated with the NSA, under the terms of a FISA court order, to enable the agency to surveil the internet traffic going to and from the United Nations headquarters in New York: see the New York Times article AT&T […]

(TS//SI//NF) United Nations DNI Collection Enabled By on 2012-04-18 0853 (TS//SI//NF) FAIRVIEW and BLARNEY engineers collaborated to enable the delivery of 700Mbps of paired packet switched t...

XKEYSCORE, Cipher Detection, and You!

Document

Release Date: 2013-12-11 Document Date: 2008-08-21

This presentation from NSA’s Mathematics Research Group, dated 21 August 2008 provides an introduction to the XKeyScore system’s data sources and fingerprinting capabilities: see the SVT article FRA part of top-secret hacker project, 11 December 2013.

xks-cipher-detection-and-you-p1-normal.gif: TOP SECRET//COMINT//REL TO USA, FVEY , Cipher Detection, and You! Mathematics Research Group 21 August 2008 TOP SECRET//COMINT//REL TO USA, F...

Advanced HTTP Activity Analysis

Document

Release Date: 2015-07-01 Document Date: 2009-01-01

This 114-page NSA training presentation from 2009 explains how agency analysts can exploit HTTP traffic within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

Advanced HTTP Activity Analysis 2009 Goal The goal of this training is to get you familiar with basic HTTP traffic and understand how to target and expliot it using X-KEYSCORE Ag...

BYZANTINE HADES: An Evolution of Collection

Document

Release Date: 2015-01-17 Document Date: 2010-06-01

This June 2010 NSA presentation for the SIGDEV conference describes efforts to trace a suspected Chinese cyber attack: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL (S//REL)BYZANTINE HADES: An Evolution of Collection NTOC, V225 SIGINT Development Conference June 2010 TOP SECRET//COMINT//REL TO...

XKeyScoreTabs XKS Development

Document

Release Date: 2014-06-18

This page from GCHQ’s internal GCWiki provides a guide to the NSA’s XKeyScore tool: see the Der Spiegel article The NSA in Germany: Snowden’s Documents Available for Download, 18 June 2014.

XKeyscoreTabs XKS Development Jump to: navigation. search N BWS Getting __ . I Using an ---- „ XKevscure Account Training XKS Development XKS Cuntacts Requirem...

Dragons, Shrimp, and XKEYSCORE: Tales from the Land of Brothers Grimm

Document

Release Date: 2014-06-18 Document Date: 2012-04-13

This internal NSA post dated 13 April 2012 from the European Cryptologic Center in Darmstadt, Germany recounts an “XKS training blitz”: see the Der Spiegel article New NSA Revelations: Inside Snowden’s Germany File, 18 June 2014.

(U//FOUO) Dragons, Shrimp, and XKEYSCORE; Tales from the Land of Brothers Grimm European Cryptologic Center, SIGDEV (F22) Run Date: 04/13/2012 (S//REL) The European Cryptologic Center ...

X-KEYSCORE as a SIGDEV tool

Document

Release Date: 2015-07-01 Document Date: 2009-01-01

This 2009 NSA presentation describes some of the plug ins available and the way the tool relates to other NSA methods for searching internet metadata, with XKeyScore having the broadest capability: see the book No Place To Hide, 13 May 2014.

xks-as-a-sigdev-tool-p1-normal.gif: X-KEYSCORE as a SIGDEV tool 2009 ■EBTxks-as-a-sigdev-tool-p2-normal.gif: What is X-KEYSCORE?xks-as-a-sigdev-tool-p3-normal.gif: TOP SECRET//COMINT//ORC...

For Media Mining, the Future is Now!

Document

Release Date: 2015-05-05 Document Date: 2006-08-01

This 1 August 2006 post from the internal NSA newsletter SIDToday describes advances in the agency’s text-to-speech capability: see the Intercept article The Computers are Listening: How the NSA Converts Spoken Words Into Searchable Text, 5 May 2015. sidtoday-future-is-now-final

(U) For Media Mining, the Future Is Now! FROM: Human Language Technology (S23) Run Date: 08/01/2006 (TS//SI) In the first article on the Human Language Technology Program Management Offi...

FASHIONCLEFT Interface Control Document

Document

Release Date: 2015-01-17 Document Date: 2009-06-15

This internal NSA document dated 15 June 2009 describes a protocol the agency uses to exfiltrate data from its computer network exploitation operations: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

Classification: TOP SECRET//COMINT//X1 // COMINT // XI FASHIONCLEFT Interface Control Document Updated: 15 June 2009 Document Number: TAO.DNT_SE07_005_V1.1 28 March 2005 FASHIONCLE...

APEX Active/Passive Exfiltration

Document

Release Date: 2015-01-17 Document Date: 2009-08-01

This NSA TURBULENCE presentation dated August 2009 explains the APEX method of combining passive with active methods to exfiltrate data from networks attacked: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

Active/Passive Exfiltration "go apex" STDP: S32354 & T112, NCSC/C91 August 2009 OP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20291123 TOP SECRET//COMHMT//REL TO USA. AUS. CAN....

VPN SigDev Basics

Document

Release Date: 2014-12-28

This undated NSA presentation describes how to perform attacks against VPNs: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL (TS//SI//REL)VPN SigDev Basics S31244 - OTTERCREEK Derived From: NSA/CSSM 1-52 Dated: 20070108 ______Declassify On: 20341101 TOP S...

Content acquisition optimisation

Document

Release Date: 2013-10-14

This Special Source Operations presentation describes the NSA’s problems with overcollection of data from email address books and buddy lists: see the Washington Post article NSA collects millions of e-mail address books globally, 14 October 2013.

TOP SECRET//SI//NOFORN Content Acquisition Optimization TOP SECRET//SI//NOFORN TOP SECRET//SI//NOFORN Yahoo Webmessenger • Update data sent to individuals logged into Yahoo's Instan...

SIGDEV: Is It Time for a ‘Target Reboot’?

Document

Release Date: 2015-11-18 Document Date: 2011-03-23

This 23 March 2011 article from the internal NSA newsletter SIDToday describes an analyst’s surprise at discovering that the agency was collecting internal communications from Venezuelan energy company Petróleos de Venezuela (PDVSA): see the Intercept article Overwhelmed NSA Surprised To Discover Its Own Surveillance “Goldmine” on Venezuela’s Oil Executives, 18 November 2015.

sigdev-is-it-time-for-a-target-reboot-p1-normal.gif: DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL Welcome! Saturday, 10 Nov 2012 ...

FAIRVIEW Dataflow Diagrams

Document

Release Date: 2015-08-15 Document Date: 2012-04-01

This April 2012 NSA presentation uses an AT&T specific term – Common Backbone or CBB – to refer to the Internet backbone of the corporate partner it codenames FAIRVIEW: see the New York Times article AT&T Helped U.S. Spy on Internet on a Vast Scale, 15 August 2015.

Dataflow Diagrams April 2012 Note: Please refer to previous diagrams for decommissioned systems. Derived From: NSA/CSSM 1-52 Dated: 20070108 Declassify On: 20361101 TOP SECRET//COMIN...

The Unofficial XKEYSCORE User Guide

Document

Release Date: 2015-07-01

This 27-page NSA document, authored by a consultant from contractor Booz Allen Hamilton, provides a step-by-step guide to using XKeyScore, together with screenshots: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

unofficial-xks-user-guide-p1-normal.gif: TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL//20320108 The Unofficial XKEYSCORE User Guide E92 - ADET Consultant, Booz Allen Hamilton Th...

DNI 101 How Do I Begin Analyzing a Target’s Email Address?

Document

Release Date: 2015-07-01

This undated NSA document provides a decision tree for the analysis of email addresses, IP addresses, cookies and phone numbers in XKeyScore and other agency tools: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

TOP SECRET//COMINT//20291123 DNI101 How Do I Begin Analyzing a Target's Email Address? TOP SECRET//COMINT//20291i23 [ =Tool/Database^ What Things Are Found Doing DNI Analysis and What...

CNE Analysis in XKeyScore

Document

Release Date: 2015-07-01 Document Date: 2009-10-15

This NSA presentation from 15 October 2009 explains how analysts can exploit the products of the agency’s CNE hacking operations within XKeyScore and provides examples with screenshots: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

CNE Analysis in XKEYSCORE 15 October 2009 xkeyscore@nsa.ic.gov l@nsa.ic.gov) y >M 1-5 TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL DERIVED F ROM: Ñ WCSSM 1-52 DATED: 2...

An Easy Way to Win: Using SIGINT to Learn about New Viruses (Project Camberdada)

Document

Release Date: 2015-06-22 Document Date: 2010-01-01

This 2010 NSA presentation describes Project Camberdada, an attempt to subvert popular antivirus software by means of surveilling email traffic: see the Intercept article Popular Security Software Came Under Relentless NSA and GCHQ Attacks, 22 June 2015.

TOP SECRET//COMINT//REL TO USA, AUS, CAN, GBR, NZL An Eas Using S about P fwmuuuu IGINT to Learn iew Viruses Project CAMBERDADA ByHH, 1412 (IAD) V252|| Derived From: NSA/CSSM...

NSA’s Offensive and Defensive Missions: The Twain Have Met

Document

Release Date: 2015-01-17 Document Date: 2011-04-26

This 26 April 2011 SIDToday post from the NSA/CSS Threat Operations Center (NTOC) Hawaii describes how the NSA has developed its capabilities in collecting “other people’s sigint”, for instance in exploiting Chinese operations against the United Nations: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015. […]

SIDToday - NSA's Offensive and Defensive Missions: The Twain Have Met DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS TOP SECRET // SI / TK // REL TO USA AUS CAN GBR NZL (U//FOUO) NSA's O...

Intro to the VPN Exploitation Process

Document

Release Date: 2014-12-28 Document Date: 2010-09-13

This 13 September 2010 presentation from the NSA’s OTP VPN Exploitation Team explains the work of the division: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

TOP SECRET//COMINT//REL USA, AUS, CAN, GBR, NZL Intro to the VPN Exploitation Process OTP VPN Exploitation Team S31176 September 13, 2010 TOP SECRET//COMINT//REL USA, AUS, CAN, G...

RAMPART-A Sites

Document

Release Date: 2014-06-18

These three undated NSA Special Source Operation slides supply details on selected RAMPART-A cable access sites: see the Intercept article How Secret Partners Expand NSA’s Surveillance Dragnet, 18 June 2014.

TOP SECRET//COMINT//NOFORN RAMPART A Sites Five sites, 4 with a Trusted 3rd Party Partner ■ US-3127!VH AZUREPHOENIX**4mb BW/1 Ogb/day ■ US-3145/KX MOONLIGHTPATH** - ~2mb BW/5gb/day ...

Special Source Operations overview

Document

Release Date: 2013-11-04

This presentation gives an overview of the NSA’s programmes targeting the fibre optic cables that carry much of the world’s internet traffic. One slide gives a breakdown of which data sources form the basis of Presidential daily briefings. Another shows that the access point used to collect Yahoo and Google cloud data (MUSCULAR) is operated […]

TOP SECRET//COMINT//NOFORN Special Source Operations r The Cryptologic Provider of Intelligence from GlobalHigh-Capacity Telecommunications Systems P TOP SECRET//COMINT//NOFORN TO...

SSO FAIRVIEW Overview

Document

Release Date: 2015-08-15

This undated NSA Special Source Operations presentation describes the agency’s relationship with corporate partner AT&T, codenamed FAIRVIEW: see the New York Times article AT&T Helped U.S. Spy on Internet on a Vast Scale, 15 August 2015.

TOP SECRET//SI/OC//NOFORN CAIDVICUU SSO FAIRVIEW Overview TOP SECRET//SI/OC//NOFORN • (U) FAIRVIEW DEFINED • (U) OPERATIONAL AUTHORITIES/CAPABILITIES • (U) STATS: WHO IS USING D...

Web Forum Exploitation using XKEYSCORE

Document

Release Date: 2009-07-01

This NSA presentation from July 2009 describes the kinds of information drawn from online forums that can be accessed in XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

web-forum-exploitation-using-xks-p1-normal.gif: OPSECRET//COMINT//REL TO USA, AUS. CAN, GBR, NZL Web Forum Exploitation using XKEYSCORE S2I7 July 2009 TOP SECRET//COMINT//REL TO USA,...

User-agents: Why and How and How to

Document

Release Date: 2015-07-01 Document Date: 2010-07-01

This NSA presentation from July 2010 explains the User-agent options within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

user-agents-p1-normal.gif: TOP SECRET//COMINT//REL TO USA. FVEY (S//SI//REL) User-agents: Why and How and How to The overall classification of this briefing to TOP SECRET//COMINT//REL TO US...

AURORAGOLD Working Group

Document

Release Date: 2014-12-04 Document Date: 2012-06-06

This 26-page NSA document, originally presented at 2012’s Five Eyes SIGDEV conference, gives a detailed overview of the agency’s information gathering on world mobile phone networks. Some intercepted technical and contact details have been redacted: see the Intercept article Operation Auroragold: How the NSA Hacks Cellphone Networks Worldwide, 4 December 2014.

SECRET//SI//REL TO FVEY (U//FOUO) AURORAGOLD Working Group (S//SI//REL) Shaping understanding of the global GSm/uMTS/LTE landscape SIGDEV Conference - 6 June 2012 This briefing is cl...

Project Muscular

Document

Release Date: 2013-10-30 Document Date: 2013-02-28

An internal Special Source Operations document describes the volume of user account information obtained from Yahoo data centres amid internal NSA complaints about its limited intelligence value: see the Washington Post article NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say, 30 October 2013.

SECRET//SI//REL USA, GBR OUO) WINDSTOP/2P System Highlights MUSCULAR • Minor circuit move, not collection suite move (so-2013-00762) • XKS FP updates across TU systems / NArchiv...

SSO Collection Optimization overview

Document

Release Date: 2013-10-14 Document Date: 2012-01-01

This NSA Special Source Operations presentation describes the agency’s collection of webmail address books and contact lists: see the Washington Post article NSA collects millions of e-mail address books globally, 14 October 2013.

TOP SECRET//SI//NOFORN SSO Collection Optimization Core SSO Team: TOP SECRET//SI//NOFORN TOP SECRET//SI//NOFORN Address Books • Email address books for most major webmail are col...

SSO Corporate Portfolio Overview

Document

Release Date: 2015-08-15

This undated NSA presentation, presented together with speaking notes, provides an introduction to the main cable access programmes facilitated by the agency’s corporate partners and specifies the relevant SIGADs: see the book No Place to Hide, 13 May 2014.

SSO Corporate Portfolio Overview Derived From: NSA/CSSM 1-52 Dated: 20070108 Declassify On: 20361201 Agenda 2 What is SSO Corporate access collection? (TS//SI//NF) Access an...

e-Highlighter