This presentation from NSA’s Mathematics Research Group, dated 21 August 2008 provides an introduction to the XKeyScore system’s data sources and fingerprinting capabilities: see the SVT article FRA part of top-secret hacker project, 11 December 2013.

This GCSB presentation dated 22 April 2010 details some of the systems available at the agency’s Waihopai base: see the Sunday Star Times article Snowden files: Inside Waihopai’s domes, 8 March 2015.

This undated page from NSA’s internal WikiInfo describes POISONNUT, “the Virtual Private Network Attack Orchestrator (VAO)”: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

This page from GCHQ’s internal GCWiki provides a guide to the NSA’s XKeyScore tool: see the Der Spiegel article The NSA in Germany: Snowden’s Documents Available for Download, 18 June 2014.

This internal NSA document dated 6 November 2009 describes work the agency has done with a corporate partner codenamed SILVERZEPHYR to develop collection capabilities in Brazil and Columbia: see the book No Place To Hide, 13 May 2014.

This April 2012 NSA presentation uses an AT&T specific term – Common Backbone or CBB – to refer to the Internet backbone of the corporate partner it codenames FAIRVIEW: see the New York Times article AT&T Helped U.S. Spy on Internet on a Vast Scale, 15 August 2015.

This undated NSA wiki page describes LONGHAUL, an “end-to-end attack orchestration and key recovery service for Data Network Cipher and Data Network Session Cipher traffic”: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

This NSA classification guide from 2004 outlines the sensitivity of various aspects of the agency’s WHIPGENIE relationships with US corporate partners: see the Intercept article Core Secrets: NSA Saboteurs in China and Germany, 10 October 2014.

This article, dated 22 May 2006 and taken from the internal NSA newsletter Foreign Affairs Digest, describes a meeting between agency personnel and officers from Germany’s BND: see the Der Spiegel article New NSA Revelations: Inside Snowden’s Germany File, 18 June 2014.

This undated NSA presentation describes the Spin 9 system for decrypting VPN data: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.

This undated page from NSA’s WikiInfo describes SCARLETFEVER, “a message driven cryptologic exploitation service for DNSC traffic”: see the Der Spiegel story Prying Eyes: Inside the NSA’s War on Internet Security, 28 December 2014.