This undated presentation from the NSA’s Expeditionary Access Operations discusses how malware techniques are used in the field: see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.

Assessment Reports bundle all available signals intelligence alongside an analyst’s interpretation of these intercepts as evidence. A report produced by the NSA’s Libya team in 2002 zeroed in on a Libyan intelligence officer, Mohamed Ismail. Years later, the report proved crucial when he was implicated in a plot to assassinate the Saudi crown prince, which in turn led to the conviction of an American co-conspirator, Abdurahman al-Amoudi.

This 18 May 2010 article from the NSA internal newsletter SIDToday outlines how the agency is reacting to the growth of mobile phone services on board commercial aircraft: see the Intercept article American and British Spy Agencies Targeted In-flight Mobile Phone Use, 7 December 2016.

This document lists the 193 governments, intragovernmental organisations and other entities which the NSA was granted the legal authority to intercept communications “about” for foreign intelligence purposes in August 2010: see the Washington Post article Court gave NSA broad leeway in surveillance, 30 June 2014.

This internal NSA post from September 2006 describes the evolution of the European Security Operations Center and the focus of the US-German collaboration in signals intelligence: see the Der Spiegel article Terrorverdächtige: NSA nutzte Erkenntnisse aus Deutschland-Filiale für Tötungen, 15 June 2014.

This 26-page NSA document, originally presented at 2012’s Five Eyes SIGDEV conference, gives a detailed overview of the agency’s information gathering on world mobile phone networks. Some intercepted technical and contact details have been redacted: see the Intercept article Operation Auroragold: How the NSA Hacks Cellphone Networks Worldwide, 4 December 2014.

A plot by Libyan dictator Moammar Gadhafi to assassinate the Saudi Crown Prince was revealed by an alleged terrorist during interrogation and corroborated using signals intelligence. 

This short extract from a GCHQ Network Analysis Centre report covering the period July-September 2011 describes “offensive cyber operations” against Iran, Argentina and Libya: see the Intercept article Britain Used Spy Team to Shape Latin American Public Opinion on Falklands, 2 April 2015.

In this 2005 article from the internal NSA newsletter SIDToday, an NSA employee credits the agency with securing the conviction of Abdurahman Alamoudi in the Eastern District of Virgina: see the Intercept article NSA Secretly Helped Convict Defendants in U.S. Courts, 30 November 2017.

This agreement, dated 15 July 1999, includes a preamble describing the development of signals intelligence cooperation between the US and Israel since the 1950s: see the Intercept article Cash, Weapons and Surveillance: the U.S. is a Key Party to Every Israeli Attack, 4 August 2014.

This undated presentation from the NSA’s European Cryptologic Center explains some of the activities of the agency’s main European base: see the Der Spiegel article Terrorverdächtige: NSA nutzte Erkenntnisse aus Deutschland-Filiale für Tötungen, 15 June 2014.