This undated NSA technical document provides configuration information for TRAFFICTHIEF, the live alerts element of XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This 114-page NSA training presentation from 2009 explains how agency analysts can exploit HTTP traffic within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This presentation gives an overview of the NSA’s programmes targeting the fibre optic cables that carry much of the world’s internet traffic. One slide gives a breakdown of which data sources form the basis of Presidential daily briefings. Another shows that the access point used to collect Yahoo and Google cloud data (MUSCULAR) is operated […]

This 49-page March 2009 NSA presentation explains how to conduct searches within XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This presentation from NSA’s Mathematics Research Group, dated 21 August 2008 provides an introduction to the XKeyScore system’s data sources and fingerprinting capabilities: see the SVT article FRA part of top-secret hacker project, 11 December 2013.

This undated NSA document provides a decision tree for the analysis of email addresses, IP addresses, cookies and phone numbers in XKeyScore and other agency tools: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

Nineteen slides from a 41-slide April 2013 NSA presentation describing the PRISM collection of data via internet service providers, “the SIGAD most used in NSA reporting.” Slides have been published gradually by several media organisations: see the Washington Post article NSA slides explain the PRISM data-collection program, 6 June 2013.

This 31 December 2012 post from the NSA’s intranet describes the scale of the metadata records handled by the SHELLTRUMPET analysis tool: see the book No Place To Hide, 13 May 2014.

This presentation from the 2010 SIGDEV Conference describes the contribution made by GCHQ to the development of Quantum techniques: see the Intercept article How the NSA Plans to Infect ‘Millions’ of Computers with Malware, 12 March 2014.

This NSA TURBULENCE presentation dated August 2009 explains the APEX method of combining passive with active methods to exfiltrate data from networks attacked: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

This 2009 NSA presentation describes some of the plug ins available and the way the tool relates to other NSA methods for searching internet metadata, with XKeyScore having the broadest capability: see the book No Place To Hide, 13 May 2014.

This NSA presentation from March 2009 shows how VOIP intercepts are handled in XKeyScore: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.