w

NO PLACE

EDWARD SNOWDEN, THE NSA, AND

THE U.S. SURVEILLANCE STATE

GLENN GREENWALD

METROPOLITAN BOOKS HENRY HOLT NEW YORK

Metropolitan Books

Henry Holt and Company, LLC

Publishers since 1866 175 Fifth Avenue

New York, New York 10010

www.henryholt.com

Metropolitan Books® and liiJ® are registered trademarks of

Henry Holt and Company, LLC.

Copyright© 2014 by Glenn Greenwald

All rights reserved.

ISBN: 978-1-62779-073-4

Library of Congress Control Number: 2014932888

Henry Holt books are available for special promotions and

premiums. For details contact: Director, Special Markets.

First Edition 2014

Designed by Kelly S. Too

Printed in the United States of America

1 3 5 7 9 10 8 6 4 2

3

COLLECT IT ALL

The archive of documents Edward Snowden had assembled was stunning

in both size and scope. Even as someone who had spent years writing

about the dangers of secret US surveillance, I found the sheer vastness

of the spying system genuinely shocking, all the more so because it had

clearly been implemented with virtually no accountability, no transpar­

ency, and no limits.

The thousands of discrete surveillance programs described by the ar­

chive were never intended by those who implemented them to become

public knowledge. Many of the programs were aimed at the American

population, but dozens of countries around the planet-including de­

mocracies typically considered US allies, such as France, Brazil, India,

and Germany-were also targets of indiscriminate mass surveillance.

Snowden's archive was elegantly organized, but its size and complex­

ity made it extremely difficult to process. The tens of thousands of NSA

documents in it had been produced by virtually every unit and subdivi­

sion within the sprawling agency, and it also contained some files from

closely aligned foreign intelligence agencies. The documents were star­

tlingly recent: mostly from 2011 and 2012, and many from 2013. Some

even dated from March and April of that year, just months before we met

Snowden in Hong Kong.

NO PLACE TO HIDE 91

The vast majority of the files in the archive were designated "top secret:' Most of those were marked "FVEY;' meaning that they were approved for distribution only to the NSA's four closest surveillance allies, the "Five Eyes" English-speaking alliance composed of Britain, Canada, Australia, and New Zealand. Others were meant for US eyes only, marked "NOFORN" for "no foreign distribution:' Certain docu­ ments, such as the PISA court order allowing collection of telephone records and Obama's presidential directive to prepare offensive cyber­ operations, were among the US government's most closely held secrets.

Deciphering the archive and the NSA's language involved a steep learning curve. The agency communicates with itself and its partners in an idiosyncratic language of its own, a lingo that is bureaucratic and stilted yet at times boastful and even snarky. Most of the documents were also quite technical, filled with forbidding acronyms and code names, and sometimes required that other documents be read first before they could be understood.

But Snowden had anticipated the problem, providing glossaries of acronyms and program names, as well as internal agency dictionaries for terms of art. Still, some documents were impenetrable on the first, second, or even third reading. Their significance emerged only after I had put together different parts of other papers and consulted with some of the world's foremost experts on surveillance, cryptography, hacking, the history of the NSA, and the legal framework governing American spying.

Compounding the difficulty was the fact that the mountains of docu­ ments were often organized not by subject but by branch of the agency where they had originated, and dramatic revelations were mixed in with large amounts of banal or highly technical material. Although the Guard­ ian devised a program to search through the files by keyword, which was of great help, that program was far from perfect. The process of digest­ ing the archive was painstakingly slow, and many months after we first received the documents, some terms and programs still required further reporting before they could be safely and coherently disclosed.

Despite such problems, though, Snowden's files indisputably laid bare a complex web of surveillance aimed at Americans (who are explicitly be­ yond the NSA's mission) and non-Americans alike. The archive revealed

92 GLENN GREENWALD

the technical means used to intercept communications: the NSA's tap­

ping of Internet servers, satellites, underwater fiber-optic cables, local

and foreign telephone systems, and personal computers. It identified

individuals targeted for extremely invasive forms of spying, a list that

ranged from alleged terrorists and criminal suspects to the democrati­

cally elected leaders of the nation's allies and even ordinary American

citizens. And it shed light on the NSA's overall strategies and goals.

Snowden had placed crucial, overarching documents at the front of

the archive, flagging them as especially important. These files disclosed

the agency's extraordinary reach, as well as its deceit and even crimi­

nality. The BOUNDLESS INFORMANT program was one of the first

such revelations, showing that the NSA counts all the telephone calls and

emails collected every day from around the world with mathematical

exactitude. Snowden had placed these files so prominently not only be­

cause they quantified the volume of calls and emails collected and stored

by the NSA-literally billions each day-but also because they proved

that NSA chief Keith Alexander and other officials had lied to Congress.

Repeatedly, NSA officials had claimed that they were incapable of pro­

viding specific numbers-exactly the data that BOUNDLESS INFOR­

MANT was constructed to assemble.

For the one-month period beginning March 8, 2013, for example,

a BOUNDLESS INFORMANT slide showed that a single unit of the

NSA, Global Access Operations, had collected data on more than 3

billion telephone calls and emails that had passed through the US tele­

communications system. ("DNR;' or "Dialed Number Recognition;' re­

fers to telephone calls; "DNI;' or "Digital Network Intelligence;' refers

to Internet-based communications such as emails.) That exceeded the

collection from the systems each of Russia, Mexico, and virtually all the

countries in Europe, and was roughly equal to the collection of data from

China.

Overall, in just thirty days the unit had collected data on more than

97 billion emails and 124 billion phone calls from around the world.

Another BOUNDLESS INFORMANT document detailed the interna­

tional data collected in a single thirty-day period from Germany (500

million), Brazil (2.3 billion), and India (13.5 billion). And yet other files

NO PLACE TO HIDE 93

showed collection of metadata in cooperation with the governments of

France (70 million), Spain (60 million), Italy (47 million), the Nether­

lands ( 1.8 million), Norway (33 million), and Denmark (23 million).

Despite the NSA's statutorily defined focus on "foreign intelligence:'

the documents confirmed that the American public was an equally im­

portant target for the secret surveillance. Nothing made that clearer than

the April 25, 2013, top secret order from the PISA court compelling

Verizon to turn over to the NSA all information about its American cus­

tomers' telephone calls, the "telephony metadata:' Marked "NOFORN:'

the language of the order was as clear as it was absolute:

IT IS HEREBY ORDERED that, the Custodian of Records shall produce to the

National Security Agency (NSA) upon service of this Order, and continue production

on an ongoing daily basis thereafter for the duration of this Order, unless otherwise

ordered by the Court, an electronic copy of the following tangible things: all call detail

records or "telephony metadata" created by Verizon for communications (i) between

the United States and abroad; or (ii) wholly within the United States, including local

telephone calls.

. . . continued

94 GLENN GREENWALD

Telephony metadata includes comprehensive communications routing information,

including but not limited to session identifying information (e.g., originating and

terminating telephone number, International Mobile Subscriber Identity (IMSI) number,

International Mobile station Equipment Identity (IMEi) number, etc.), trunk identifier,

telephone calling card numbers, and time and duration of call.

This bulk telephone collection program was one of the most signifi­

cant discoveries in an archive suffused with all types of covert surveil­

lance programs-from the large-scale PRISM (involving collection of

data directly from the servers of the world's biggest Internet companies)

and PROJECT BULLRUN, a joint effort between the NSA and its British

counterpart, the Government Communications Headquarters (GCHQ),

to defeat the most common forms of encryption used to safeguard on­

line transactions, to smaller-scale enterprises with names that reflect the

contemptuous and boastful spirit of supremacy behind them: EGOTIS­

TICAL GIRAFFE, which targets the Tor browser that is meant to enable

anonymity in online browsing; MUSCULAR, a means to invade the pri­

vate networks of Google and Yahoo!; and OLY MPIA, Canada's program

to surveil the Brazilian Ministry of Mines and Energy.

Some of the surveillance was ostensibly devoted to terrorism sus­

pects. But great quantities of the programs manifestly had nothing to do

with national security. The documents left no doubt that the NSA was

equally involved in economic espionage, diplomatic spying, and suspi­

cionless surveillance aimed at entire populations.

Taken in its entirety, the Snowden archive led to an ultimately simple

conclusion: the US government had built a system that has as its goal the

complete elimination of electronic privacy worldwide. Far from hyper­

bole, that is the literal, explicitly stated aim of the surveillance state: to

collect, store, monitor, and analyze all electronic communication by all

people around the globe. The agency is devoted to one overarching mis­

sion: to prevent the slightest piece of electronic communication from

evading its systemic grasp.

NO PLACE TO HIDE 95

This self-imposed mandate requires endlessly expanding the NS.A's

reach. Every day, the NSA works to identify electronic communications

that are not being collected and stored and then develops new technolo­

gies and methods to rectify the deficiency. The agency regards itself as

needing no specific justification to collect any particular electronic com­

munication, nor any grounds for regarding its targets with suspicion.

What the NSA calls "SIG INT" -all signals intelligence-is its target.

And the mere fact that it has the capability to collect those communica­

tions has become one rationale for doing so.

A military branch of the Pentagon, the NSA is the largest intelligence

agency in the world, with the majority of its surveillance work conducted

through the Five Eyes alliance. Until the spring of 2014, when contro­

versy over the Snowden stories became increasingly intense, the agency

was headed by four-star general Keith B. Alexander, who had overseen

it for the previous nine years, aggressively increasing the NS.A's size and

influence during his tenure. In the process, Alexander became what re­

porter James Bamford described as "the most powerful intelligence chief

in American historf'

The NSA "was already a data behemoth when Alexander took over;'

Foreign Policy reporter Shane Harris noted, "but under his watch, the

breadth, scale, and ambition of its mission have expanded beyond any­

thing ever contemplated by his predecessors:' Never before had "one

agency of the U.S. government had the capacity, as well as the legal au­

thority, to collect and store so much electronic information:' A former

administration official who worked with the NSA chief told Harris that

''Alexander's strategy" was clear: "I need to get all of the data:' And, Har­

ris added, "He wants to hang on to it for as long as he can:'

Alexander's personal motto, "Collect it an;· perfectly conveys the

central purpose of the NSA. He first put this philosophy into practice

in 2005 while collecting signals intelligence relating to the occupation

of Iraq. As the Washington Post reported in 2013, Alexander grew dis­

satisfied with the limited focus of American military intelligence, which

targeted only suspected insurgents and other threats to US forces, an ap-

96 GLENN GREENWALD

proach that the newly appointed NSA chief viewed as too constraining.

"He wanted everything: Every Iraqi text message, phone call, and e-mail

that could be vacuumed up by the agency's powerful computers:' So the

government deployed technological methods indiscriminately to collect

all communications data from the entire Iraqi population.

Alexander then conceived of applying this system of ubiquitous sur­

veillance-originally created for a foreign population in an active war

zone-to American citizens. "And, as he did in Iraq, Alexander has

pushed hard for everything he can get;' the Post reported: "tools, re­

sources, and the legal authority to collect and store vast quantities of raw

information on American and foreign communications:' Thus, "in his

eight years at the helm of the country's electronic surveillance agency,

Alexander, 6 1, has quietly presided over a revolution in the government's

ability to scoop up information in the name of national securitY:'

Alexander's reputation as a surveillance extremist is well document -

ed. In describing his "all-out, barely legal drive to build the ultimate spy

machine;' Foreign Policy called him "the cowboy of the NSA:' Even Bush­

era CIA and NSA chief General Michael Hayden-who himself oversaw

the implementation of Bush's illegal warrantless eavesdropping program

and is notorious for his aggressive militarism-often had "heartburn"

over Alexander's no-holds-barred approach, according to Foreign Policy.

A former intelligence official characterized Alexander's view: "Let's not

worry about the law. Let's just figure out how to get the job done:' The

Post similarly noted that "even his defenders say Alexander's aggressive­

ness has sometimes taken him to the outer edge of his legal authoritY:'

Although some of the more extreme statements from Alexander-such

as his blunt question "Why can't we collect all the signals, all the time?:·

which he reportedly asked during a 2008 visit to Britain's GCHQ-have

been dismissed by agency spokespeople as mere lighthearted quips taken

out of context, the agency's own documents demonstrate that Alexander

was not joking. A top secret presentation to the 2011 annual conference

of the Five Eyes alliance, for instance, shows that the NSA has explicitly

embraced Alexander's motto of omniscience as its core purpose:

NO PLACE TO HIDE 97

SECRET/meL TO USA. AUi, CAN, GBR. NZU/2032810I

New Collection Posture

Worl< with GCHQ, share with Misawa

Analysis of data at scale: ELEGANTCHAOS

Automated FORNSAT survey - DARKQUEST

Increase volume of signals:

Scale XKS and use MVR techniques

Sl:CRET,/RH TO USA. AUS, CAN GBR, NZU/20320108

ASPHALT/A-PLUS

A 2010 document presented to the Five Eyes conference by the GCHQ­ referring to its ongoing program to intercept satellite communications, code-named TARMAC-makes it clear that the British spy agency also uses this phrase to describe its mission:

TOP SECRET//COMINT/REL TO USA, FVEY

Why TARMAC?

• MHS has a growin g FORNSAT mission. -SHAREDVISION mission. ..... � -SigDev ("Difficult Signal s c ollect ion"). � �--A

"'"' s

'- P-H -A

-' L-T-("_C_o_ll_e _ct

"'"' i '-t A-1-1"-p-ro-o-f- -o -f-c-"on_ c_e_p_t -sy-s -te-m-}.-1

Even routine internal NSA memoranda invoke the slogan to justify ex­ panding the agency's capabilities. One 2009 memo from the technical director of the NSA's Mission Operations, for example, touts recent im­ provements to the agency's collection site in Misawa, Japan:

98 GLENN GREE NWALD

Future Plans (U)

(TS//SI//REL) In the future, MSOC hopes to expand the number of WORDGOPHER platforms to enable demodulation of thousands of additional low-rate carriers.

These targets are ideally suited for software demodulation. Additionally, MSOC has developed a capability to automatically scan and demodulate signals as they activate on the satellites. There are a multitude of possibilities, bringing our enterprise one step closer to "collecting it all."

Far from being a frivolous quip, "collect it all" defines the NSA's as­ piration, and it is a goal the NSA is increasingly closer to reaching. The quantity of telephone calls, emails, online chats, online activities, and tel­ ephonic metadata collected by the agency is staggering. Indeed, the NSA frequently, as one 2012 document put it, "collects far more content than is routinely useful to analysts:' As of mid-2012, the agency was process­ ing more than twenty billion communications events (both Internet and telephone) from around the world each day:

Example of Current Volumes and Limits

5

Total MetaDNI Record� Deleted

• Total Records Tramferred to MARINA

O Record� 1n DPS flVl Bdck1og

• Jotal lJNH Record� Hece1wd by fASCIA

NO PLACE TO HIDE 99

For each individual country, the NSA also produces a daily breakdown quantifying the number of calls and emails collected. The chart below, for Poland, shows more than three million telephone calls on some days, for a thirty-day total of seventy-one million:

POLAND . Last 30 Days

� Signal Profile

0

The domestic total collected by the NSA is equally stunning. Even prior to Snowden's revelations, the Washington Post reported in 2010 that "every day, collection systems at the N ational Security Agency intercept and store 1.7 billion emails, phone calls, and other types of communica­ tions" from Americans. William Binney, a mathematician who worked for the NSA for three decades and resigned in the wake of 9/ 11 in protest over the agency's increasing domestic focus, has likewise made numer­ ous statements about the quantities of US data collected. In a 2012 in­ terview with Democracy Now!, Binney said that "they've assembled on the order of 20 trillion transactions about U.S. citizens with other U.S. citizens:'

After Snowden's revelations, the Wall Street Journal reported that the overall interception system of the NSA "has the capacity to reach roughly 75% of all U.S. Internet traffic in the hunt for foreign intelligence, in­ cluding a wide array of communications by foreigners and Americans:' Speaking anonymously, current and former NSA officials told the Jour­ nal that in some cases the NSA "retains the written content of emails

. .

1 00 G L E N N G R E E N W A L D

sent between citizens within the U.S. and also tilters domestic phone calls made with Internet technology:'

Britain's GCHQ similarly collects s uch a great quantity of communi­ cations data that it can barely store what it has. As one 201 l document prepared by the British p ut it:

So fixated is the N SA on collecting it all that the Snowden archive is sprinkled with celebratory internal memos heralding partic ular collec­ tion milestones. This December 20 1 2 entry from an internal messaging board, for instance, proudly proclaims that the SHELLTRUMPET pro­ gram has processed its one trillionth record:

( S//SI //REL TO USA, FVEY) SHELLTRUMPET P rocesses it\ ' s One T r i l l ion t h Metadata Record

By ( NAME AEOACTEO } on 2012-12-31 0738

( S//SI//REL TO USA , FVEY) On Decembe r 2 1 , 2 0 1 2 SHELLTRUMPET p roces sed i t s One T r i l l io n t h metadata reco rd . SHELLTRUMPET began a � a nea r- real-t ime metadata analyzer on Dec 8, 2007 t o r a CLASSIC co l lec t ion system. In i t s f i v e yea r h i s t o r y , nume rous o t he r s y s tems f rom a c r o s s t h e Agency have come t o use SHELLTRUMPET ' s p rocess ing capa b i l i t ies tor pe r f o rmance monit o r i n g , d i rect E41a i l t ip a l e r t ing , TRA F F I CTHIEF t ipping , a n d Rea l-Time Reg io n a l Gat eway ( RTRG ) f i lte ring and ingest . Though it took f ive yea rs to get t o the one t ril lion ma r k , a l m o s t h a l f o f t h is volume was p roces sed in t h is calenda r yea r , and h a l f of that volume was f rom SSO ' s DANCINGOASI S . SHELLTRUMPET i s c u r rent ly p roces s ing Two Bil lion c a l l even t s/day f rom select 550 ( Ram41 , OAKSTAR , MYSTIC and NCSC enabled s y stems ) , MUSKETEER, and Second Pa rt y s y s tems . We wi ll be expanding it s reach into o t he r 550 sys tems ove r the course of 2 0 1 3 . The f r i l l 1on rec o rd s p rocessed have res u l t ed in ove r 35 M i l l ion t ips t o TRA F F I C TH I E F .

NO PLACE TO H IDE 1 0 1

To collect such vast quantities o f communications, the NSA relies o n a

multitude of methods. These include tapping directly into fiber-optic

lines (including underwater cables) used to transmit international com­

munications; redirecting messages into NSA repositories when they

traverse the US system, as most worldwide communications do; and

cooperating with the intelligence services in other countries. With

increasing frequency, the agency also relies on Internet companies and

telecoms, which indispensably pass on information they have collected

about their own customers.

While the NSA is officially a public agency, it has countless overlap­

ping partnerships with private sector corporations, and many of its core

functions have been outsourced. The NSA itself employs roughly thirty

thousand people, but the agency also has contracts for some sixty thou­

sand employees of private corporations, who often provide essential ser­

vices. Snowden himself was actually employed not by the NSA but by the

Dell Corporation and the large defense contractor Booz Allen Hamilton.

Still, he, like many other private contractors, worked in the NSA offices,

on its core functions, with access to its secrets.

According to Tim Shorrock, who has long chronicled the NSA-cor­

porate relationship, "70 percent of our national intelligence budget is be­

ing spent on the private sector:' When Michael Hayden said that "the

largest concentration of cyber power on the planet is the intersection

of the Baltimore Parkway and Maryland Route 32;' Shorrock noted, "he

was referring not to the NSA itself but to the business park about a mile

down the road from the giant black edifice that houses NSA's headquar­

ters in Fort Meade, Md. There, all of NS.A's major contractors, from Booz

to SAIC to Northrop Grumman, carry out their surveillance and intel­

ligence work for the agency:'

These corporate partnerships extend beyond intelligence and defense

contractors to include the world's largest and most important Internet

corporations and telecoms, precisely those companies that handle the

bulk of the world's communications and can facilitate access to private

exchanges. After describing the agency's missions of "Defense (Protect

1 02 GLENN GR E ENWALD

U.S. Telecommunications and Computer Systems Against Exploitation)" and "Offense (Intercept and Exploit Foreign Signals);' one top secret NSA document enumerates some of the services supplied by such cor­ porations:

These corporate partnerships, which provide the systems and the ac­ cess on which the NSA depends, are managed by the NSA's highly secret Special Sources Operations unit, the division that oversees corporate partnerships. Snowden described the SSO as the "crown jewel" of the organization.

BLARNEY, FAIRVIEW, OAKSTAR, and STORMBREW are some of the programs overseen by the SSO within its Corporate Partner Access (CPA) portfolio.

NO P L A C E TO HIDE

Special Sou rce Operations Corporate Partner Access

Briefed by:[ NAME REDACTED J

1 0 3

A s part of these programs, the NSA exploits the access that certain

telecom companies have to international systems, having entered into

contracts with foreign telecoms to build, maintain, and upgrade their

networks. The US companies then redirect the target country's commu­

nications data to NSA repositories.

The core purpose of BLARNEY is depicted in one NSA briefing:

I< 11• , t 1 l<t I f I •\II' J ,11H 1t{, • I I

Rela tionships & A uthorities

• Leverage unique key corporate partnerships to gain access to

high-capacity international fiber-optic cables, switches and/or routers throughout the world

BLARNEY relied on one relationship in particular-a long-standing

partnership with AT&T Inc., according to the Wall Street Journal's re­ porting on the program. According to the NSA's own files, in 20 1 0 the list

of countries targeted by BLARNEY included Brazil, France, Germany,

Greece, Israel, Italy, Japan, Mexico, South Korea, and Venezuela, as well

as the European Union and the United Nations.

1 04 GLENN GREENWALD

FAIRVIEW, another SSO program, also collects what the NSA touts

as "massive amounts of data" from around the world. And it, too, relies

mostly on a single "corporate partner" and, in particular, that partner's

access to the telecommunications systems of foreign nations. The NSA's

internal summary of FAIRVIEW is simple and clear:

U n iq u e Aspects

,c ") ' A

Access to massive amou nts of data

Controlled by variety of legal authorities

Most accesses are controlled by partner

U S -990 FA I RV I EW

(l ))

(TS//SI } US-990 ( PDDG-UY) - key corporate partner with access to international cables, routers, and switches.

(TS/ISi ) Key Targets: G lobal

According to NSA documents, FAIRV IEW "is typically in the top five

at NSA as a collection source for serialized production"-meaning on­

going surveillance-"and one of the largest providers of metadata:' Its

overwhelming reliance on one telecom is demonstrated by its claim that

"approximately 75% of reporting is single source, reflecting the unique

NO PLACE TO HIDE 1 05

access the program enjoys to a wide variety of target communications:'

Though the telecom is not identified, one description of the FAIRV IEW

partner makes clear its eagerness to cooperate:

FAIRVIEW - Co rp p a r t n e r s ince 1985 with access to int . cables , routers , swit ches . The p a r t n e r operates in t h e U . S . , but has acce s s to info rmat ion that t ra n s i t s the nat ion and t h rough its �o rporate rela t ion s h ips p rov ide un ique accesses to other te lecoms and ISPs . Agg res s ively involved in shaping t ra f f ic t o run s ig n a l s of i n t e re s t past ou r mon ito r s .

Thanks to such cooperation, the FAIRV IEW program collects vast

quantities of information about telephone calls. One chart, which covers

the thirty-day period beginning December 1 0, 20 1 2, shows that just this

program alone was responsible for the collection of some two hundred

million records each day that month, for a thirty-day total of more than

six billion records. The light bars are collections of "DNR" (telephone

calls), while the dark bars are "DNI" (Internet activity):

FAIRVIEW - last 30 Days

.. - � Signal Profile

To collect these billions of phone records, the SSO collaborates with

the NSA's corporate partners as well as with foreign government agen­

cies-for instance, the Polish intelligence service:

1 06 GLENN GREENWALD

(TS//SI//N F ) ORANGECRUSH, pa rt of the OAKSTAR p rog ram under SSO ' s corporate portfolio, began fo rwa rding metadata f rom a t h i rd party partner site ( Polan d ) to NSA repositories a s of 3 Ma rch and content a s of 25 March . This p rogram is a collabo rative effo rt between 550, NCSC , ETC , FAD, an NSA Corporate Pa rt ner and a d ivision of t he Polish Gove rnment . ORANGECRUSH is only known to the Poles as BUFFALOGREEN . This mult i-group partne r s h ip began in May 2009 and will incorporate the OAKSTAR p roj ect of ORANGEBLOSSOM and its DNR capabilit y . The new access will p rovide S IGINT f rom comme rcial links managed by the NSA Corporate Pa rtner and is anticipated to include Afghan National Army, Middle Ea s t , limited African continent , and Eu ropean commun ication s . A notification has been posted t o SPRINGRAY and t h is collection is available to Second Pa rties via TICKETWINDOW .

The OAKSTAR program similarly exploits the access that one of the

NSA's corporate partners (code-named STEELKNIGHT) has to foreign

telecommunications systems, using that access to redirect data into the

NSA's own repositories. Another partner, code-named SILV ERZEPHYR,

appears in a November 1 1, 2009, document describing work done with

the company to obtain "internal communications" from both Brazil and

Colombia:

SILVERZEPHYR FAA DNI Acces s I n it ia t ed at NSAW ( TS//SI//N F )

By I NAME REDACTEo J o n 2009-11-06 0918

( TS//51//NF ) On Thu rsday, 11/5/09 , the SSO-OAKSTAR SILVERZEPHYR ( SZ ) access began forwa rd ing FAA DNI rec o rd s to NSAW v ia t h e FAA WealthyCluster2/Tellu rian system installed at t he p a rtne r ' s s ite. SSO coo rd inated wit h the Data F low Of fice and forwa rded nume rou s sample f iles to a test pa rt it ion for va lidation , wh ich was completely successfu l. SSO will cont inue to monit o r the f low and collect ion to ens u re a ny anoma l ies a re identified and corrected as requ i red . SI LVERZEPHYR will cont inue to p rovide customers with autho rized , t ran s it DNR co llect ion . SSO is working wit h the pa rtner to gain access to an addit ional 80Gbs of DNI data on the i r pee ring netwo rk, bund led in 10 Gbs inc rements . The OAKSTAR team , a long with support f rom NSAT and GNDA , j ust completed a 12 day SIGINT s u rvey at s ite , wh ich identif ied over 200 new lin ks . Du ring the s u rvey, GNDA wo rked wit h the pa rtne r to test the output of their ACS system. OAKSTAR is also wo rking with NSAT to examine snapshots ta ken by the partner in B ra z il and Colombia , both of wh ich may contain int e rnal communications for those coun t ries .

NO P LACE TO HIDE 1 0 7

Meanwhile, the STORMBREW program, conducted in "close part­

nership with the FBI;' gives the NSA access to Internet and telephone

traffic that enters the United States at various "choke points" on US soil.

It exploits the fact that the vast majority of the world's Internet traffic

at some point flows through the US communications infrastructure-a

residual by-product of the central role that the United States had played

in developing the network. Some of these designated choke points are

identified by cover names:

I 11· ,II HI I 1 , •\ff\ J H• •I{\ ,.

S TORMBREW At a Glance

Seven Access ites - nternationtd ''Choke oints "

Ii 11•,1 t Ill I I , •\II\ \,t 11·1 lk', JO • I I tn

According to the NS A, STORMBREW "is currently comprised of

very sensitive relationships with two U.S. telecom providers ( cover terms

ARTIFICE and WOLFPOINT):' Beyond its access to US-based choke

points, "the STORMBREW program also manages two submarine cable

landing access sites; one on the USA west coast (cover term, BRECK­

ENRIDGE), and the other on the USA east coast (cover term QUAIL­

CREEK):'

As the profusion of cover names attests, the identity of its corpo-

1 08 G L E N N G R E E N W A L D

rate partners is one of the most closely guarded secrets in the NSA. The

documents containing the key to those code names are vigilantly safe­

guarded by the agency and Snowden was unable to obtain many of them.

Nonetheless, his revelations did unmask some of the companies coop­

erating with the NSA. Most famously, his archive included the PRISM

documents, which detailed secret agreements between the NSA and the

world's largest Internet companies-Facebook, Yahoo!, Apple, Google­

as well as extensive efforts by Microsoft to provide the agency with access

to its communications platforms such as Outlook.

Unlike BLARNEY, FAIRV IEW, OAKSTAR, and STORMBREW,

which entail tapping into fiber-optic cables and other forms of infra­

structure ("upstream" surveillance, in NSA parlance), PRISM allows the

NSA to collect data directly from the servers of nine of the biggest Inter­

net companies:

TOP SECRET//SI//ORCON//NOFIIII � Hotmall' Gougle � � talk� You(B G"" 1· 1 • · · -....7 .. HOOF .- "" .,., , � I :J i.� AOL :,.. mail .a

(Ts11su1NF) FAA 702 Operations Two Types of Collection

U pstream • Collection of communications on fiber cables

and infrastructure as data flows past. FAIRVIEW, STORMBREW, BLARNEY, OAKSTAR

• Collection directly from the servers of these U.S. Service Providers: Microsoft, Yahoo, Google

Facebook, PalTalk, AOL, Skype, YouTube A le. TOP SECRET//SI//ORCON 'NOFORN

NO PLACE TO HIDE 1 09

The companies listed on the PRISM slide denied allowing the NSA

unlimited access to their servers. Facebook and Google, for instance,

claimed that they only give the NSA information for which the agency

has a warrant, and tried to depict PRISM as little more than a trivial

technical detail: a slightly upgraded delivery system whereby the NSA

receives data in a "lockbox" that the companies are legally compelled to

provide.

But their argument is belied by numerous points. For one, we know

that Yahoo! vigorously fought in court against the NSXs efforts to force

it to join PRISM-an unlikely effort if the program were simply a trivial

change to a delivery system. (Yahoo!'s claims were rejected by the PISA

court, and the company was ordered to participate in PRISM.) Second,

the Washington Post's Bart Gellman, after receiving heavy criticism for

"overstating" the impact of PRISM, reinvestigated the program and con­

firmed that he stood by the Post's central claim: "From their workstations

anywhere in the world, government employees cleared for PRISM access

may 'task' the system" -that is, run a search-"and receive results from

an Internet company without further interaction with the company's

staff:'

Third, the Internet companies' denials were phrased in evasive and

legalistic fashion, often obfuscating more than clarifying. For instance,

Facebook claimed not to provide "direct access;' while Google denied

having created a "back door" for the NSA. But as Chris Soghoian, the

ACLU's tech expert, told Foreign Policy, these were highly technical terms

of art denoting very specific means to get at information. The companies

ultimately did not deny that they had worked with the NSA to set up a

system through which the agency could directly access their customers'

data.

Finally, the NSA itself has repeatedly hailed PRISM for its unique

collection capabilities and noted that the program has been vital for in­

creasing surveillance. One NSA slide details PRISM's special surveillance

powers:

1 1 0 G L E N N G R E E N W A L D

t o P SHRI t s, OR< o , ,rn .... _ Hotmall C o .,�ll' CM I � YAHOO' •

'1 1 -(

A <TS11su1NF) FAA 702 Operations �

Why Use Both: PRISM vs. Upstream

PRISM

DNI Selectors 9 U.S. based service v providers v

DNR Selectors {S) Coming soon v Access to Stored Communications v {S) (Search) Real-Time Collection

v v (Surveillance)

"Abouts" Collection {S) v Voice Collection Vvoice over IP v Direct Relationship with

{S)only through FBI v Comms Providers

Upstream

Worldwide sources

Worldwide sources

You(m

Hll'SI ( Rf I ' I ORCO'- \iO FORT\

Another details the wide range of communications that PRISM en­

ables the NSA to access:

t Ol'SH RH SI ORt ON NOl i!:I

� Hotmall Co ,oic C l) ,1, ,-:r

A M II ' ' YAHOO' • .

t.lif \'Ii Youiill:l!I AOL :- mail ti

� (TS//SUINF) P R I SM Collection Details Current Providers

Microsoft (Hotmail, etc.) Google

• Yahoo! • Facebook

Pa!Talk • YouTube

Skype • AOL • A le

What Will You Receive in Collection (Surveillance and Stored Comms)?

It varies by provider. In general: E-mail

Chat - video, voice

Videos

Photos

Stored data

VoIP

File ttansfers

Video Conferencing

Notifications of target activity - logins, etc.

Online Social Networking details

Special Requests

Complete list and details on PRISM web page: Go PRISMFAA l l ) l' ' H F l I "ii t !R. )'\ '<1 11 1 11{'.

NO PLA C E TO H I D E 1 1 1

And another NSA slide details how the PRISM program has steadily and substantially increased the agency's collection:

1orsr rnr 1 s1 OR�w, -:<rni!::I !'.'. Hotmau Col ,glc , • ,� •GM i 1 • . . . "''AEo0r • .. ,,·, •.;;.J

(TS//Su!Nr> Uniq:: Selectors Tasked to PRISM (US-984XN) in FY20 1 2

.,• l

Al I P rovi d e rs

Strong Growth In FY12 Tasking: > Skype up 248%

> Facebook up 131%

> Google up 63%

/ I t / / /

tai-"' You(B AOL �• mail Jl

I Toul Sel«un I New Sdccton

IOPSH RI r SL''ORCON 'IOfORN

On its internal messaging boards, the Special Source Operation divi­ sion frequently hails the massive collection value PRISM has provided. One message, from November 1 9, 201 2, is entitled "PRISM Expands Im­ pact: FY1 2 Metrics":

(TS//SI//Nf) PRISM ( US-984XN ) expanded its impact on NSA ' s reporting mission in fY12 t h rough inc reased tasking , collection and operational improvement s . Here a re some highlights of the FY12 PRISM p rogram:

PRISM is the most cited collection source in NSA 1st Party end-product repo rting. Hore NSA product repo rts were based on PRISM than on any other s ingle SIGAD for all of NSA ' s 1st Party repo rting during FY12 : cited in 15 . 1\ of all repo rts ( up f rom 14\ in fYll ) . PRISM was c ited in 13 . 4\ of all 1st, 2nd , and 3rd Party NSA reporting ( up f rom 1 1 . 9\ in fYll ) , and is also the top cited SIGAD overall

Number of PRISM-based end-product repo rts issued in FY12: 2 4 , 096, up 27\ f rom FYll

Single-source repo rting percentage in FY12 and FY11 : 74\ Number of product reports de r ived f rom PRISM collection and c ited as

sources in a rt icles in the President ' s Dai ly Brief in FY12 : 1, 477 ( 18\ of all SIGINT reports cited as sources in PDB a rticles - highest single SIGAD for NSA ) ; In fYl l : 1 , 152 ( 15\ of a l l SIGINT repo rts c ited as sources in PDB artic les - highest single SIGAD for NSA)

Number of Essential Elements of Information contributed to in FY12 : 4, 186 ( 32\ of all E E i s for a l l Information Need s ) ; 220 EEis add ressed so le ly by PRISM

Tasking : The number of tasked selectors rose 32\ in FY12 to 45 , 406 as of Sept 2012

G reat success in Skype collection and processing; unique, high value targets acquired

Expanded PRISM taskable e-mail domains f rom only 40, to 2 2 , 000

1 1 2 GLENN GREENWALD

Such congratulatory proclamations do not support the notion of PRISM

as only a trivial technicality, and they give the lie to Silicon Valley's deni­

als of cooperation. Indeed, the New York Times, reporting on the PRISM program after Snowden's revelations, described a slew of secret negotia -

tions between the NSA and Silicon Valley about providing the agency

with unfettered access to the companies' systems. "When government

officials came to Silicon Valley to demand easier ways for the world's

largest Internet companies to turn over user data as part of a secret sur­

veillance program, the companies bristled;' reported the Times. "In the end, though, many cooperated at least a bif' In particular:

Twitter declined to make it easier for the government. But other com­

panies were more compliant, according to people briefed on the nego­

tiations. They opened discussions with national security officials about

developing technical methods to more efficiently and securely share the

personal data of foreign users in response to lawful government requests.

And in some cases, they changed their computer systems to do so.

These negotiations, the New York Times said, "illustrate how intri­ cately the government and tech companies work together, and the depth

of their behind-the-scenes transactions:' The article also contested the

companies' claims that they provide the NSA only with access that is

legally compelled, noting: "While handing over data in response to a

legitimate PISA request is a legal requirement, making it easier for the

government to get the information is not, which is why Twitter could

decline to do so:'

The Internet companies' claim that they hand over to the NSA just

the information that they are legally required to provide is also not par­

ticularly meaningful. That's because the NSA only needs to obtain an

individual warrant when it wants to specifically target a US person. No

such special permission is required for the agency to obtain the com­

munications data of any non-American on foreign soil, even when that person is communicating with Americans. Similarly, there is no check or limit on the NSA's bulk collection of metadata, thanks to the govern-

NO PLACE TO HIDE 1 1 3

ment's interpretation of the Patriot Act-an interpretation so broad that even the law's original authors were shocked to learn how it was being used.

The close collaboration between the NSA and private corporations is perhaps best seen in the documents relating to Microsoft, which reveal the company's vigorous efforts to give the NSA access to several of its most used online services, including SkyDrive, Skype, and Outlook.com.

SkyDrive, which allows people to store their files online and access them from various devices, has more than 250 million users worldwide. "We believe it's important that you have control over who can and can­ not access your personal data in the cloud;' Microsoft's SkyDrive web­ site proclaims. Yet as an NSA document details, Microsoft spent "many months" working to provide the government with easier access to that data:

( TS//SI//NF ) 550 HIGHL IGHT - Mic rosoft Skyd r ive Collect ion Now Pa rt o f PRISM Standa rd Sto red Comm u n icat ions Collect ion

By ( NAME REDACTED ) on 2013-03-08 1500

( TS//SI//N F ) Beg inn ing on 7 March 2013 , PRISM now col lect s Mic rosoft Skyd rive data as pa rt of PRISM ' s s t a nd a rd Sto red Communications col lect ion p a c kage f o r a t a s ked F I SA Amendmen t s Act Sect ion 702 ( FAA702 l selecto r . This means that a n a l y s t s will no l o n g e r have t o make a s p e c i a l request t o 550 f o r t h i s - a p rocess step t h a t m a n y analyst s m a y not have known about . This new capabilit y w i l l result in a much mo re complete a n d timely collect ion response f rom 550 for ou r Enterp rise c ustome r s . This s u ccess is t he res u l t o f the FBI wo rking for many mon t h s wit h Mic rosoft t o get t h i s t a s k ing and c o l lect ion solut ion e s t a b l ished . •skyD r ive is a c loud se rvice t hat a l lows u s e r s to s t o re and access thei r f i les on a va riety o f devices . The u t ility a l s o includes f ree web app s uppo rt f o r Mic rosoft O f f ice p rog ram s , s o t he user is able t o c reate , ed it , and view Wo rd , Powe rPoint , Excel f i les without h a v ing MS O f f ice actually instal led on t h e i r device . • ( s ou rce : 5314 w i k i )

In late 2011, Microsoft purchased Skype, the Internet-based telephone and chat service with over 663 million registered users. At the time of its purchase, Microsoft assured users that "Skype is committed to respecting your privacy and the confidentiality of your personal data, traffic, and communications content:' But in fact, this data, too, was readily avail­ able to the government. By early 20 1 3, there were multiple messages on

1 1 4 GLENN GREE NWALD

the NSA system celebrating the agency's steadily improving access to the communications of Skype users:

( TS//SI//N F ) New Skype Sto red Comms C a pa b i l it y For PRISM

By I NAME Rl!llACTeo J on 2013-04-03 0631

( TS//SI//N F ) PRISM has a new collection capab i l ity : Skype sto red commun icat ions . Skype s t o red communications will contain u n ique data which is not collected v ia n o rma l real-time su rve i l lance c o l lec t io n . 550 expects to receive buddy l i st s , c redit c a rd info, call data re cord s , u s e r account info, and other mat e r i a l . On 29 March 2013 , 550 fo rwa rded approximately 2000 Skype selectors fo r s t o red communications to be ad J ud i cated in SV41 and the Electronic Communications S u rveillance Unit ( ECSU ) at FBI . SV41 had been working on adj udication f o r the highest p riority selectors ahead of t ime and had about 100 ready for ECSU to evaluate. I t could take seve ral weeks for SV 41 t o wo rk t h rough a l l 2000 selectors to get them a p p roved, and ECSU will likely take longer to g ra n t the a p p rova l s . As of 2 Ap r i l , ESCU had app roved over 30 selec t o rs to be sent to Skype for collect ion . PRISM Skype collection has ca rved out a v ital n i c he in NSA repo rting in less than two yea rs with te r ro r ism, S y r ian oppo s it ion and regime, and exec/ spec ial se ries repo r t s being t he top top ic s . Over 2 8 0 0 repo rts h a v e b e e n i s s u ed s ince A p r i l 2011 based on PRISM Skype c o l le c t i o n , with 76% of t hem being s i ngle sou rce .

( TS//SI//N F ) 550 Expands PRISM Skype Targeting Capability

By [ NAME REDACTE�::J on 2013-04-03 0629

( TS//SI//N F ) On 15 March 2013 , SSO ' s PRISM p rog ram began tas king a l l Mic rosoft PRISM selectors t o Skype because Skype a l lows u s e r s t o log in u s i ng account iden t i f ie rs in addition to Skype u s e rname s . U n t i l now, PRISM would not collect any Skype data when a u s e r logged in u s ing anyth ing other t h a n t he Skype u s e rname which resulted in m i s s ing col lect ion ; t h i s act ion w i l l mit igate t hat . In fact , a u s e r can c reate a Skype account u s ing any e-ma i l add res s with any domain in t he wo rld . UTT does not c u r rently a l low analysts to task these non-M i c rosoft e-mail add re s ses to PRISM, howev e r , 5 5 0 intends to f ix t hat t h i s summe r . In the meant ime, NSA, FBI a n d D e p t of J u s t ice coordinated over the last s i x mon t h s to gain app roval for PRINTAURA to send a l l c u r rent and f u t u re M i c rosoft PRISM selectors to Skype . T h i s resulted in a b o u t 9800 selectors b e i n g s e n t t o Skype and succes s f u l c o l lection has been received which otherwise would have been m i s sed ,

Not only was all this collaboration conducted with no transparency, but it contradicted public statements made by Skype. ACLU technology expert Chris Soghoian said the revelations would surprise many Skype customers. "In the past, Skype made affirmative promises to users about their inability to perform wiretaps;' he said. "It's hard to square Micro­ soft's secret collaboration with the NSA with its high-profile efforts to compete on privacy with Google:'

In 2012, Microsoft began upgrading its email portal, Outlook.com, to merge all of its communications services-including the widely used

NO PLACE TO H I DE 1 1 5

Hotmail-into one central program. The company touted the new Out­ look by promising high levels of encryption to protect privacy, and the NSA quickly grew concerned that the encryption Microsoft offered to Outlook customers would block the agency from spying on their com­ munications. One SSO memo from August 22, 2012, frets that "using this portal means that email emerging from it will be encrypted with the default setting" and that "chat sessions conducted within the portal are also encrypted when both communicants are using a Microsoft en - crypted chat client:'

But that worry was short-lived. Within a few months, the two enti­ ties got together and devised methods for the NSA to circumvent the very encryption protections Microsoft was publicly advertising as vital for protecting privacy :

( TS// S I / /NF ) M ic ro soft releases new se rvice , affects FAA 702 collect ion

By c�AME REDACTED: ) On 2012-12-26 0811

( TS / / S I / /NF ) On 31 J u ly, M i c rosoft ( M S ) began enc rypting web-based chat with t he int roduct ion o f the new o u t loo k . com serv ice . This new Secure Socket Laye r ( SS L ) enc ryption effectively cut o f f collect ion of the new se rvice f o r FAA 702 and likely 12333 ( to some deg ree ) f o r the I ntelligence Community ( IC ) . MS , wo rking with t he FBI , developed a s u rveillance capability t o deal with the new SSL . These solut ions were successfully tested and went live 12 Dec 2012 . The SSL solu t io n was appl ied to a l l c u r rent FISA and 702/ PRISM requi rements - no changes to UTT tas king p rocedures were req u i red . The SSL s o lu t io n does not collect s e rve r-based voice / v ideo or f ile t ra n s f e rs . The MS legacy col lection sys tem will rema in in place to collect voice/video and f i le t ra n s f e rs . As a result t h e re wil l b e some dupl icate collect ion o f text-based chat f rom t h e new a n d legacy systems which will be add ressed at a later dat e . An inc rease in collectio n volume as a result o f t h is solut ion has a l ready been noted by CES .

Another document describes further collaboration between Microsoft and the FBI, as that agency also sought to ensure that new Outlook features did not interfere with its surveillance habits: " The FBI Data Intercept Technology Unit (DIT U ) team is working with Microsoft to understand an additional feature in Outlook.com which allows users to create email aliases, which may affect our tasking process . . . . There are compartmented and other activities underway to mitigate these prob­ lems."

1 1 6 G L E N N G R E E N W A L D

Finding this mention of FBI surveillance in Snowden's archive of in­

ternal NSA documents was not an isolated occurrence. The entire intelli­

gence community is able to access the information that the NSA collects:

it routinely shares its vast trove of data with other agencies, including

the FBI and the CIA. One principal purpose of the NSA's great spree of

data collection was precisely to boost the spread of information across

the board. Indeed, almost every document pertaining to the various col­

lection programs mentions the inclusion of other intelligence units. This

2012 entry from the NSA's SSO unit, on sharing PRISM data, gleefully

declares that "PRISM is a team sport!":

( TS//SI//NF ) Expanding PRISl1 Sha r ing W i t h FBI and C I A

_By ( s . .. \11· xw,vTu_ J o n 2812-88-31 8947

( TS//SI//NF ) Spe c ia l Source Ope rat ions ( SSOl has recen t ly expanded sha rino with t he federal Bureau of lnve s t ioat ions ( FB I I and t he Cen t ra l I n t e l ligence Aoency ( C I A ! on PRISM operat ions v ia two p ro j ec t s . Through these e f fo r t s , SSO has c reated an env i ronment o f shar ing and teaming a c ross t he I n t e l l igence (Ofllfflun i t y on PRISM ope ra t 1ons . F 1 r s t , SSO ' s PRINTAURA t eam solved a problem t o r the S igna l s I n te l l ioence D i re c t o rate ( S I D I b y wr 1 t ing sof tware wh ich would a u t oma t ica l ly gat he r a list o f t asked PRISM selec t o r s every t wo weeks t o provide to the FBI and C I A . This enables our pa r t ne r s t o see wh ich selec t o rs t he Nat iona l Secu r i t y Agency (NSA) has t as ked t o PRI SM . The F B I and C I A t hen can request a copy o f PRISM c o l le c t ion t r011 any selec t o r , as a l lowed under the 2898 Foreign I n t e l l igence Surve i l lance Act ( F ISA) Afflendments Ac t law. P r io r t o PRINTAURA ' s wo r k , SID had been p roviding t he F B I and CIA w i t h incomplete and inaccu rate l i s t s , preventing our pa rt ners f rom 111ak 1ng f u l l use o f t he PRISN program. PRINTAURA voluntee red to gather the det a i led data related t o each selec t o r f rom mu l t ip l e locat ions a n d ass�ble i t in a usable f o rm . I n t he second projec t . t he PRISM M i s s ion Program Manager ( MPl'I ) recen t ly began sending ope rat ion a l PRISM news and gu idance to t h e FBI and CIA so t hat t h e i r ana l y s t s could t as k t he PRI SM system prope r l y , be aware ot out ages and change s , and opt imize t h e i r use of PRI SM . The MPM coord inated an ag reement f rom the SIO Foreign I n t e l l igence Surve i l lance Ac t Amendmen t s Act ( FAA ) Team t o share this i n f o rma t ion week l y , which has been we l l-received and apprec iated . These two act iv i t ies unde rscore t he po i n t that PRISN i s a team s po rt !

"Upstream" collection (from fiber-optic cables) and direct collection

from the servers of Internet companies (PRISM) account for most of the

records gathered by the NSA. In addition to such sweeping surveillance,

NO PLACE TO HIDE 1 1 7

though, the NSA also carries out what it calls Computer Network Exploi­ tation (CNE), placing malware in individual computers to surveil their users. When the agency succeeds in inserting such malware, it is able, in NSA terminology, to "own" the computer: to view every keystroke en­ tered and every screen viewed. The Tailored Access Operations (TAO) division responsible for this work is, in effect, the agency's own private hacker unit.

The hacking practice is quite widespread in its own right: one NSA document indicates that the agency has succeeded in infecting at least fif­ ty thousand individual computers with a type of malware called "Quan­ tum Insertion:' One map shows the places where such operations have been performed and the number of successful insertions:

. . TOP �Cf\E'TI/COMINT//flft. TO USA. AUS, CAN GU"1, NZl

Driver 1 : Worldwide SIG INT/Defense Cryptologic Platform

L TO FVEY

'"°"" IROHSANO -· CAA80'( TIMBERUH

Using Snowden documents, the New York Times reported that the NSA has in fact implanted this particular software "in nearly 1 00,000 com­ puters around the world:' Although the malware is usually installed by

1 1 8 G L E N N G R E E N WA L D

"gaining access t o computer networks, the NSA h a s increasingly made use of a secret technology that enables it to enter and alter data in com­ puters even if they are not connected to the Internet:'

Beyond its work with compliant telecoms and Internet companies, the NSA has also colluded with foreign governments to construct its far­ reaching surveillance system. Broadly speaking, the NSA has three dif­ ferent categories of foreign relationships. The first is with the Five Eyes group: the US spies with these countries, but rarely on them, unless requested to by those countries' own officials. The second tier involves countries that the NSA works with for specific surveillance projects while also spying on them extensively. The third group is comprised of countries on which the United States routinely spies but with whom it virtually never cooperates.

Within the Five Eyes group, the closest NSA ally is the British GCHQ. As the Guardian reported, based on documents provided by Snowden, "The U.S. government has paid at least £100m to the U K spy agency GCHQ over the last three years to secure access to and influence over Britain's intelligence gathering programs:' Those payments were an in­ centive to GCHQ to support the NSA's surveillance agenda. "GCHQ must pull its weight and be seen to pull its weight;' a secret GCHQ strat­ egy briefing said.

The Five Eyes members share most of their surveillance activities and meet each year at a Signals Development conference, where they boast of their expansion and the prior year's successes. Former NSA deputy director John Inglis has said of the Five Eyes alliance that they "practice intelligence in many regards in a combined way-essentially make sure that we leverage one another's capabilities for mutual benefit:'

Many of the most invasive surveillance programs are carried out by the Five Eyes partners, a substantial number of these involving the GCHQ. Of special note are the British agency's joint efforts with the NSA to break the common encryption techniques that are used to safeguard personal Internet transactions, such as online banking and retrieval of medical records. The two agencies' success in setting up backdoor access

NO PLACE TO H ID E 1 1 9

to those encryption systems not only allowed them to peer at people's private dealings, but also weakened the systems for everyone, making them more vulnerable to malicious hackers and to other foreign intel­ ligence agencies.

The GCHQ has also conducted mass interception of communications data from the world's underwater fiber-optic cables. U nder the program name Tempora, the GCHQ developed the "ability to tap into and store huge volumes of data drawn from fibre-optic cables for up to 30 days so that it can be sifted and analysed;' the Guardian reported, and the "GCHQ and the NSA are consequently able to access and process vast quantities of communications between entirely innocent people:' The in­ tercepted data encompass all forms of online activity, including "record­ ings of phone calls, the content of email messages, entries on Facebook, and the history of any internet user's access to websites:'

The GCHQ's surveillance activities are every bit as comprehensive­ and unaccountable-as the NSA's. As the Guardian noted:

The sheer scale of the agency's ambition is reflected in the titles of its two principal components: Mastering the Internet and Global Telecoms Exploitation, aimed at scooping up as much online and telephone traf­ fic as possible. 1his is all being carried out without any form of public acknowledgement or debate. Canada is also a very active partner with the NSA and an energetic

surveillance force in its own right. At the 2012 SigDev conference, the Communications Services Establishment Canada ( CSEC) boasted about targeting the Brazilian Ministry of Mines and Energy, the agency in Bra­ zil that regulates the industry of greatest interest to Canadian companies:

• •

•

AND THEY SAID TO THE

TITANS: « WATC H OUT

OLYMPIANS IN THE

HOUSE ! »

CSEC - Advanced Network Tradecraft

SD ConferenC'e .June 20 1 2

I I I

OLYMPIA & THE CASE STUDY

mtl.­ �

/JI }°If/'/ I

CSEC's Network Knowledge Engine

Various data sources

C h a i ned enrichments Automated analysis

Brazilian Ministry of Mines and Energy (MME)

New target to develop

Limited access/target k nowledge

TOP SEC'HET II SI

N O P L A C E TO H I D E 1 2 1

There i s evidence o f widespread CSEC/NSA cooperation, including

Canada's efforts to set up spying posts for communications surveillance

around the world at the behest and for the benefit of the NSA, and spying

on trading partners targeted by the US agency.

•

TOP SECRET//SI//REL USA, FVEY

National Security Agency/ Central Security Service

Information Paper

Subject: (U/IFOUO) NSA Intelligence Relatlonshlp with Canada' Communications Security Establishment Canada (CSEC)

TOP SECRET//Si//REL TO USA, CAN

(U) What NSA provides to the partner:

(U) What the partner provides to NSA:

(TS//SI///REL TO USA, CAN) CSEC offers resources for advanced collectio analysis, and has opened covert sites at the request of NS C shares unique geographic access to areas unavailable to the U.S. provides cryptographic products, cryptanalysis, technology, and its investment in R&D projects of mutual interest.

3 April 2013

1 22 G L E N N G R E E N W A L D

The Five Eyes relationship is so close that member governments place

the NSA's desires above the privacy of their own citizens. The Guard­

ian reported on one 2007 memo, for instance, describing an agreement

"that allowed the agency to 'unmask' and hold on to personal data about

Britons that had previously been off limits:' Additionally, the rules were

changed in 2007 "to allow the NSA to analyse and retain any British citi­

zens' mobile phone and fax numbers, emails and IP addresses swept up

by its dragnet:'

Going a step further, in 2011 the Australian government explicitly

pleaded with the NSA to "extend" their partnership and subject Austra­

lian citizens to greater surveillance. In a February 21 letter, the acting

deputy director of Australia's Intelligence Defence Signals Directorate

wrote to the NSA's Signals Intelligence Directorate, claiming that Aus­

tralia "now face[s] a sinister and determined threat from 'home grown'

extremists active both abroad and within Australia:' He requested in­

creased surveillance on the communications of Australian citizens

deemed suspicious by their government:

While we have invested significant analytic and collection effort of Ollf own to find and cxpl01t these communications, the difficulties we face in obtaining regular and reliable acc,;,ss Lo such communications impacts on our ability to detect and prevent terrorist acts and diminishes our capacity tu protect th,;, lifo muJ s,1fcty of Australian citizens and those of our close friends and allies.

We have enjoyed a long and very productive panncrship with NSA in obtaining minimised access to United States warranted collection against our highcsl value terrori�t targets in Indonesia. This access has been critical to DSD's effo1is to disrupt and contain the operulional capabilities of terrorists in our region as highlighted by the recent arrest of fugitive Bali bomber Umar Patek.

We would ve1y much welcome the oppo11unity tu extend thal partnership with NSA tu cover the increasing number of Australians involved in international exlr,;,mist activities - in particular Australians involved with A()AP

Beyond the Five Eyes partners, the NSA's next level of cooperation is

with its Tier B allies: countries that have some limited cooperation with

the agency and are also targeted themselves for aggressive, unrequested

surveillance. The NSA has clearly delineated these two levels of alliances:

NO PLACE TO H I DE

CONFIDENTIAL//NOFORN//20291 123 · ·--- -·---�-- ------� TIER A Australia

Comprehensive Cooperation

TIER B

Focused Cooperation

Canada New Zealand ynited Kingdom·- - - -

--< Austria B elgium Czech Republic Denmark Germany Greece Hungary Iceland Ital y Japan Luxemberg N etherlands N orway Poland Portugal South K orea Spain Sweden Switzerland Turkey

1 2 3

Using different designations (referring to Tier B as Third Parties), a more

recent NSA document-from the Fiscal Year 20 1 3 "Foreign Partner

Review" -shows an expanding list of NSA partners, including interna­

tional organizations such as NATO:

TOP SECRET// COMINT //REL USA, AUS, CAN, GBR, NZL

Appro ved SIG/NT Partners .�. -�� -:)·\ '- �'!3: . --- . ' .,. ' ' ···-· Second Parties Third Parties

Australia Algeria Israel Spain Canada Austria Italy Sweden

New Zealand Belgium Japan Taiwan United Kingdom Croatia Jordan Thailand

Czech Republic Korea Tunisia Denmark Macedonia Turkey Ethiopia Netherlands UAE

Coal itions Multi-lats Finland Norway France Pakistan

AFSC . Germany Poland NATO Greece Romania SSEUR Hungary Saudi Arabia SSPAC India Singapore

1 24 GLENN GREENWALD

As with the GCHQ, the NSA often maintains these partnerships by

paying its partner to develop certain technologies and engage in surveil­

lance, and can thus direct how the spying is carried out. The Fiscal Year

2012 "Foreign Partner Review " reveals numerous countries that have re­

ceived such payments, including Canada, Israel, Japan, Jordan, Pakistan,

Taiwan, and Thailand:

0 - - · - · - - · -

�,? .,/ �/ --� ./ .ff .,�/ /� q>/ ��� .,

,._/ / ,._/'

In particular, the NSA has a surveillance relationship with Israel that of­

ten entails cooperation as close as the Five Eyes partnership, if not some­

times even closer. A Memorandum of Understanding between the NSA

and the Israeli intelligence service details how the United States takes the

unusual step of routinely sharing with Israel raw intelligence containing

the communications of American citizens. Among the data furnished to

Israel are "unevaluated and unminimized transcripts, gists, facsimiles,

telex, voice, and Digital Network Intelligence metadata and content:'

What makes this sharing particularly egregious is that the material

is sent to Israel without having undergone the legally required process

of "minimization:' The minimization procedures are supposed to ensure

NO PLA C E TO HI DE 1 2 5

that when the NSA's bulk surveillance sweeps up some communications data that even the agency's very broad guidelines do not permit it to collect, such information is destroyed as soon as possible and not dis­ seminated further. As the law is written, the minimization requirements already have plenty of loopholes, including exemptions for "significant foreign intelligence information" or any "evidence of a crime:' But when it comes to disseminating data to Israeli intelligence, the NSA has appar­ ently dispensed with such legalities altogether.

The memo flatly states: "NSA routinely sends ISN U [the Israeli SI­ GINT N ational Unit] minimized and unminimized raw collection:'

Highlighting how a country can both cooperate on surveillance and be a target at the same time, an NSA document recounting the history of Israel's cooperation noted "trust issues which revolve around previous ISR operations;' and identified Israel as one of the most aggressive sur­ veillance services acting against the United States:

(TS//SI//REL) There are also a few surprises ... France targets the US DoD through technical intelligence collection, and I srael also targets us. On the one hand, the I sraelis are extraordinarily good SIGINT partners for us, but on the other, they target us to learn our positions on Middle East problems. A N I E [National Intelligence Estimate] ranked them as the third most aggressive intelligence service against the US.\

The same report observed that, despite the close relationship between American and Israeli intelligence agencies, the extensive information provided to Israel by the United States produced little in return. Israeli intelligence was only interested in collecting data that helped them. As the NSA complained, the partnership was geared "almost totally" to Is­ rael's needs.

Balancing the S I G I NT exchange equally between U S a n d Israeli needs h a s been a constant challenge in the last decade, it arguably tilted heavily in favor o f Israeli security concerns. 9 / 1 1 came, and went, with NSA's only true Third Party CT relationship being driven almost totally by the needs of the p artner.I

1 2 6 GLENN GREENWALD

Another rung lower, below the Five Eyes partners and second-tier

countries such as Israel, the third tier is composed of countries who are

often targets but never partners of US spying programs. Those predict­

ably include governments viewed as adversaries, such as China, Rus­

sia, Iran, Venezuela, and Syria. But the third tier also includes countries

ranging from the generally friendly to neutral, such as Brazil, Mexico,

Argentina, Indonesia, Kenya, and South Africa.

When the NSA revelations first came out, the US government tried to

defend its actions by saying that, unlike foreign nationals, American citi­

zens are protected from warrantless NSA surveillance. On June 18, 2013,

President Obama told Charlie Rose: "What I can say unequivocally is

that if you are a U.S. person, the NSA cannot listen to your telephone

calls . . . by law and by rule, and unless they . . . go to a court, and obtain

a warrant, and seek probable cause, the same way it's always been:' The

GOP chairman of the House Intelligence Committee, Mike Rogers, simi­

larly told CNN that the NSA "is not listening to Americans' phone calls.

If it did, it is illegal. It is breaking the law:'

This was a rather odd line of defense: in effect, it told the rest of the

world that the NSA does assault the privacy of non -Americans. Privacy

protections, apparently, are only for American citizens. This message

prompted such international outrage that even Facebook CEO Mark

Zuckerberg, not exactly known for his vehement defense of privacy,

complained that the US government "blew it" in its response to the NSA

scandal by jeopardizing the interests of international Internet compa­

nies: "The government said don' t worry, we're not spying on any Ameri­

cans. Wonderful, that's really helpful for companies trying to work with

people around the world. Thanks for going out there and being clear. I

think that was really bad:'

Aside from being a strange strategy, the claim is also patently false. In

fact, contrary to the repeated denials of President Obama and his top of­

ficials, the NSA continuously intercepts the communications of Ameri­

can citizens, without any individual "probable cause" warrants to justify

such surveillance. That's because the 2008 PISA law, as noted earlier, al-

NO PLACE TO HIDE 1 2 7

lows the NSA-without an individual warrant-to monitor the content of any American's communications as long as those communications are exchanged with a targeted foreign national. The NSA labels this "inci­ dental" collection, as though it's some sort of minor accident that the agency has been spying on Americans. But the implication is deceitful. As Jameel Jaffer, the deputy legal director of the ACLU, explained:

The government often says that this surveillance of Americans' commu­ nications is "incidental;' which makes it sound like the NSA's surveil­ lance of Americans' phone calls and emails is inadvertent and, even from the government's perspective, regrettable.

But when the Bush administration officials asked Congress for this new surveillance power, they said quite explicitly that Americans' com­ munications were the communications of most interest to them. See, for example, FISA for the 2 1 st century, Hearing Before the S. Comm. On the Judiciary, 109th Cong. (2006) (statement of Michael Hayden), that certain communications "with one end in the United States" are the ones "that are most important to us:'

The principal purpose of the 2008 law was to make it possible for the government to collect Americans' international communications-and to collect those communications without reference to whether any party to those communications was doing anything illegal. And a lot of the government's advocacy is meant to obscure this fact, but it's a crucial one: The government doesn't need to "target" Americans in order to col­ lect huge volumes of their communications.

Yale Law School professor Jack Balkin concurred that the PISA law of 2008 effectively gave the president the authority to run a program "simi­ lar in effect to the warrantless surveillance program" that had been se­ cretly implemented by George Bush. "These programs may inevitably include many phone calls involving Americans, who may have absolutely no connection to terrorism or to Al Qaeda:'

Further discrediting Obama's assurances is the subservient posture of the PISA court, which grants almost every surveillance request that the NSA submits. Defenders of the NSA frequently tout the PISA court

1 28 GLENN GRE E NWALD

process as evidence that the agency is under effective oversight. However,

the court was set up not as a genuine check on the government's power

but as a cosmetic measure, providing just the appearance of reform to

placate public anger over surveillance abuses revealed in the 1970s.

The uselessness of this institution as a true check on surveillance

abuses is obvious because the FISA court lacks virtually every attribute

of what our society generally understands as the minimal elements of a

justice system. It meets in complete secrecy; only one party-the govern­

ment-is permitted to attend the hearings and make its case; and the

court's rulings are automatically designated "Top Secret:' Tellingly, for

years the FISA court was housed in the Department of Justice, making

clear its role as a part of the executive branch rather than as an indepen -

dent judiciary exercising real oversight.

The results have been exactly what one would expect: the court almost

never rejects specific NSA applications to target Americans with surveil­

lance. From its inception, F ISA has been the ultimate rubber stamp. In

its first twenty-four years, from 1978 to 2002, the court rejected a total of

zero government applications while approving many thousands. In the

subsequent decade, through 2012, the court has rejected just eleven gov­

ernment applications. In total, it has approved more than twenty thou -

sand requests.

One of the provisions of the 2008 FISA law requires the executive

branch annually to disclose to Congress the number of eavesdropping

applications the court receives and then approves, modifies, or rejects.

The disclosure for 2012 showed that the court approved every single one

of the 1,788 applications for electronic surveillance that it considered,

while "modifying" -that is, narrowing the purview of the order-in just

40 cases, or less than 3 percent.

NO PLACE TO H IDE 1 29

Applidations Made to the Foreign Intelligence Surveillance Court During Calendar Year �12 (section 107 of the Act, 50 U.S.C. § 1 807) During calendar year 2012, the Government made 1,856 applications to the Foreign Intelligence S-iµveillance Court (the "FISC'') for authority to conduct electronic surveillanceand/or physical- searches for foreign intelligence purposes. The 1,856 applications include applications made solely for electronic surveillance, applications made solely for physi,cal search, and combined applications requesting authority for electronic surveillance and physica1 search. Of these, 1 ,789 applications included requests for authority to conduct electronic survefflance. Of th� 1,789 applications, one was withdrawn by the Government. The FISO did not deny any appiifatioos in whole or in part.

Much the same was true of 201 1 , when the NSA reported 1,676 applica­ tions; the FISA court, while modifying 30 of them, "did not deny any applications in whole, or in part:'

The court's subservience to the NSA is demonstrated by other sta­ tistics as well. Here, for instance, is the FISA court's reaction over the last six years to various requests made by the NSA under the Patriot Act to obtain the business records-telephone, financial or medical-of US persons:

Thus, even in those limited cases when approval from the FISA court is needed to target someone's communications, the process is more of an empty pantomime than a meaningful check on the NSA.

1 30 GLENN GREENWALD

Another layer of oversight for the NSA is ostensibly provided by the

congressional intelligence committees, also created in the aftermath of

the surveillance scandals of the 1970s, but they are even more supine

than the PISA court. While they are supposed to conduct "vigilant legis­

lative oversight" over the intelligence community, those committees are

in fact currently headed by the most devoted NSA loyalists in Wash­

ington: Democrat Dianne Feinstein in the Senate and Republican Mike

Rogers in the House. R ather than offer any sort of adversarial check on

the NSA's operations, the Feinstein and Rogers committees exist primar­

ily to defend and justify anything the agency does.

As the New Yorker's Ryan Lizza put it in a December 2013 article,

instead of providing oversight, the Senate committee more often "treats

senior intelligence officials like matinee idols:' Observers of the commit­

tee's hearings on NSA activities were shocked by how the senators ap­

proached the questioning of NSA officials who appeared before them.

The "questions" typically contained nothing more than long monologues

by the senators about their recollections of the 9/ 1 1 attack and how vital

it was to prevent attacks in the future. The committee members waved

away the opportunity to interrogate those officials and perform their

oversight responsibilities, instead propagandizing in defense of the NSA.

The scene perfectly captured the true function of the intelligence com­

mittees over the last decade.

Indeed, the chairs of the congressional committees have sometimes

defended the NSA even more vigorously than the agency's officials

themselves have done. At one point, in August 2013, two members of

Congress-Democrat Alan Grayson of Florida and Republican Morgan

Griffith of Virginia-separately approached me to complain that the

House Permanent Select Committee on Intelligence was blocking them

and other members from accessing the most basic information about the

NSA. They each gave me letters they had written to the staff of Chairman

Rogers requesting information about NSA programs being discussed in

the media. Those requests were rebuffed again and again.

In the wake of our Snowden stories, a group of senators from both par­

ties who had long been concerned with surveillance abuses began efforts

to draft legislation that would impose real limits on the NSA's powers.

NO PLACE TO H ID E 1 3 1

But these reformers, led by Democratic senator Ron Wyden of Oregon, ran into an immediate roadblock: counterefforts by the NSA's defenders in the Senate to write legislation that would provide only the appearance of reform, while in fact retaining or even increasing the NSA's powers. As Slate's Dave Weigel reported in November:

Critics of the NSA's bulk data collection and s�rveillance programs have never been worried about congressional inaction. They've expected Congress to come up with something that looked like reform but ac­ tually codified and excused the practices being exposed and pilloried. That's what's always happened-every amendment or reauthorization to the 200 1 U SA Patriot Act has built more back doors than walls.

"We will be up against a 'business-as- usual brigade'-made up of in­ fluential members of the government's intelligence leadership, their al­ lies in thinktanks l sic] and academia, retired government officials, and sympathetic legislators;' warned Oregon Sen. Ron Wyden last month. "Their endgame is ensuring that any surveillance reforms are only skin­ deep . . . . Privacy protections that don't actually protect privacy are not worth the paper they're printed on:'

The "fake reform" faction was led by Dianne Feinstein, the very senator who is charged with exercising primary oversight over the NSA. Fein­ stein has long been a devoted loyalist of the US national security industry, from her vehement support for the war on Iraq to her steadfast backing of B ush-era NSA programs. ( Her husband, meanwhile, has major stakes in various military contracts. ) Clearly, Feinstein was a natural choice to head a committee that claims to carry o ut oversight over the intelligence community but has for years performed the opposite function.

Thus, for all the government's denials, the NSA has no substantial constraints on whom it can spy on and how. Even when such constraints nominally exist-when American citizens are the surveillance target­ the process has become largely hollow. The NSA is the definitive rogue agency: empowered to do whatever it wants with very little control, transparency, or accountability.

1 3 2 GLENN GREENWALD

Very broadly speaking, the NSA collects two types of information: con­

tent and metadata. "Content" here refers to actually listening to people's

phone calls or reading their emails and online chats, as well as reviewing

Internet activity such as browsing histories and search activities. "Meta­

data" collection, meanwhile, involves amassing data about those com­ munications. The NSA refers to that as "information about content (but

not the content itself):'

Metadata about an email message, for instance, records who emailed

whom, when the email was sent, and the location of the person sending

it. When it comes to telephone calls, the information includes the phone

numbers of the caller and the receiver, how long they spoke for, and often

their locations and the types of devices they used to communicate. In

one document about telephone calls, the NSA outlined the metadata it

accesses and stores:

Comm u n ications Metadata Fields i n

IC REAC H

(SI/NF) NSA populates these fields in PROTON:

• Called & calling numbers, date, time & duration of call

(S//SI//REL) ICREACH users will see telephony metadata* in the following fields:

DATE & TIME

D U RATION - Length of Call

CALLED NUMBER

CALLING NUMBER

CALLED FAX (CSI) - Called Subscriber

I D

TRANSMITTING FAX (TSI) -

Transmitting Subscriber ID

IMSI - International Mobile Subscriber

Identifier

TMSI - Temporary Mobile Subscriber

Identifier

IMEI - International Mobile Equipment

Identifier

MSISDN - Mobile Subscriber Integrated

Services Digital Network

MON - Mobile Dialed Number

C L I - Call Line Identifier (Caller ID)

DSME - Destination Short Message

Entity

OSME - Originating Short Message

Entity

VLR - Visitor Location Register

SECRET//COMINT//NOfORN//20320108

NO P LACE TO H IDE 1 3 3

Th e U S government has insisted that much o f the surveillance revealed in the Snowden archive involves the collection of "metadata, not content;' trying to imply that this kind of spying is not intrusive-or at least not to the same degree as intercepting content. Dianne Feinstein has explicitly argued in USA Today that the metadata collection of all Americans' tele­ phone records "is not surveillance" at all because it "does not collect the content of any communication:'

These disingenuous arguments obscure the fact that metadata surveil­ lance can be at least as intrusive as content interception, and often even more so. When the government knows everyone you call and everyone who calls you, plus the exact length of all those phone conversations; when it can list every single one of your email correspondents and every location from where your emails were sent, it can create a remarkably comprehensive picture of your life, your associations, and your activities, including some of your most intimate and private information.

In an affidavit filed by the ACLU challenging the legality of the NSA's metadata collection program, Princeton computer science and public af­ fairs professor Edward Felten explained why metadata surveillance can be especially revealing:

Consider the following hypothetical example: A young woman calls her

gynecologist; then immediately calls her mother; then a man who, dur­

ing the past few months, she had repeatedly spoken to on the telephone

after 1 1 pm; followed by a call to a family planning center that also offers abortions. A likely storyline emerges that would not be as evident by

examining the record of a single telephone call.

Even for a single phone call, the metadata can be more informative than the call's content. Listening in on a woman calling an abortion clinic might reveal nothing more than someone confirming an appointment with a generic-sounding establishment ("East Side Clinic" or "Dr. Jones's office"). But the metadata would show far more than that: it would reveal the identity of those who were called. The same is true of calls to a dating service, a gay and lesbian center, a drug addiction clinic, an HIV special­ ist, or a suicide hotline. Metadata would likewise unmask a conversation

1 34 GLENN GREENWALD

between a human rights activist and an informant in a repressive regime, or a confidential source calling a journalist to reveal high-level wrong­ doing. And if you frequently call someone late at night who is not your spouse, the metadata will reveal that, too. What's more, it will record not only all the people with whom you communicate and how often, but also all the people with whom your friends and associates communicate, cre­ ating a comprehensive picture of your network of contacts.

Indeed, as Professor Felten notes, eavesdropping on calls can be quite difficult due to language differences, meandering conversations, the use of slang or deliberate codes, and other attributes that either by design or accident obfuscate the meaning. "The content of calls are far more difficult to analyze in an automated fashion due to their unstructured nature;' he argued. By contrast, metadata is mathematical: clean, precise, and thus easily analyzed. And as Felten put it, it is often "a proxy for content":

Telephony metadata can . . . expose an extraordinary amount about our habits and our associations. Calling patterns can reveal when we are awake and asleep; our religion, if a person regularly makes no calls on the Sabbath, or makes a large number of calls on Christmas day; our work habits and our social aptitude; the number of friends we have; and even our civil and political affiliations.

In sum, writes Felten, "mass collection not only allows the government to learn information about more people, but it also enables the govern­ ment to learn new, previously private facts that it could not have learned simply by collecting the information about a few, specific individuals:'

Concern about the many uses that the government could find for this kind of sensitive information is especially justified because, contrary to repeated claims from President Obama and the NSA, it is already clear that a substantial number of the agency's activities have nothing to do with antiterrorism efforts or even with national security. Much of the Snowden archive revealed what can only be called economic espionage: eavesdropping and email interception aimed at the Brazilian oil giant Petrobras, economic conferences in Latin America, energy companies

NO PLACE TO HIDE 1 3 5

in Venezuela and Mexico, and spying by the NSA's allies-including

Canada, Norway, and Sweden-on the Brazilian Ministry of Mines and

Energy and energy companies in several other countries.

One remarkable document presented by the NSA and the GCHQ

detailed numerous surveillance targets that were plainly economic in

nature: Petrobras, the SWIFT banking system, the Russian oil company

Gazprom, and the Russian airline Aeroflot.

TOP SECRET//SI//REL TO USA. FVtY

P rivate N etworks a re I m portant

0 Many ta rgets use p rivate networks.

Goo•le Infrastructure SWIFT Network REDACTED REDACTED

REDACTED Gazprom

Aeroflot REDACTED

French MFA REDACTED

Warid Telecom Petrobras

REDACTED REDACTED

0 Evidence in Su rvey: 30%-40% of traffic i n

BLACKPEARL has at least o n e endpoint private.

TOP SECR£T//S1//RR TO USA, fVfY

For years, President Obama and his top officials vehemently de­

nounced China for using its surveillance capabilities for economic ad­

vantage while insisting that the United States and its allies never do any

such thing. The Washington Post quoted an NSA spokesperson saying

that the Department of Defense, of which the agency is a part, '"does

engage' in computer network exploitation;' but "does ***not*** engage

in economic espionage in any domain, including 'cyber "'

[ emphatic as­

terisks in the original] .

That the NSA spies for precisely the economic motive it has denied

is proven by its own documents. The agency acts for the benefit of what

it calls its "customers;' a list that includes not only the White House, the

1 36 GLENN GREENWALD

State Department, and the CIA, but also primarily economic agencies, such as the US Trade Representative and the Departments of Agricul­ ture, Treasury, and Commerce:

In its description of the BLARNEY program, the NSA lists the types of information it is supposed to provide to its customers as "counter terror­ ism;' "diplomatic" -and "economic":

Jl:H'�HK .. I l()\fl\; I \(Jt<tlt'\. I' "'1 1 l

BLARNEY AT A GLANCE Why: Started in 1978 to provide FISA authorized access to communications of

foreign establishments, agents of foreign powers, and terrorists

Edemal Customen Infonnation Requirements Collection Access and Techniques (Who) (What)

(How)

0..-..... Qi S- C...- l'l'oliktallon --- DNI Stroo« Stk:cwn C.ntw..........,._ Counter fmorwu .Ji" DKK Stn-11 Sc:kctc)fl l'- - (/N M,,oi,,,, Owionwl< b' !)�1 Clmw ... .. .t:ooN,tmc I OXR Circuill -�- Mwtuy Mobile Wirtle$i !\alx.'IWll�nzhCetlltr �u:ndon tM:...alXM\$

'-

NO PLA C E TO H I D E

U S-984 B LARN EY

(TS/ISi ) US-984 (PDDG: AX) - provides collection against D N R and D N I F I SA Court Order authorized com mu n ications.

(TS//SI ) Key Targets: Diplomatic establishment, counterterrorism, Foreign Government, Eco nomic

1 3 7

F urther evidence of the NSA's economic interest appears in a PRISM doc ument showing a "sampling" of the "Reporting Topics" for the week of Febr uary 2-8, 20 1 3 . A list of the types of information gathered from various countries clearly includes economic and financial categories, among them "energy;' "trade;' and "oil":

TOP ,1 CRL r;•s1 OR�'ON11N0F i!m

� Hotmall' Cot ,glc , � talk• Youlill CM II . . , "'A'" YoOF •' .._ ,\'; •,

:.r I.I � AOL :l,•m•il _a

• Mex100

• arCObes

• Energy

(Ts11svr..F) A Week in the Life of PRISM Reporting Sampling of Reporting Topics from 2-8 Feb 2013

• lntornal security • Poh�cal Affairs

• Japan • Trade • Israel

• Venezuela • Military procurement • 011

1 38 GLENN GREENWALD

One 2006 memorandum from the global capabilities manager of the

agency's International Security Issues (ISi) mission spells out the NSA's

economic and trade espionage-against countries as diverse as Belgium,

Japan, Brazil, and Germany-in stark terms:

(U) NSA Washington Mission

(U) Regional

(fS//SI) ISi is responsible for 1 3 individual nation states in three continents . Onesignificant tie that binds all these countries together is their importance to U.S. economic, trade, and defense concerns. The Western Europe and Strategic Partnerships division primarily focuses on foreign policy and trade activities of Belgium, France, Germany, Italy, and Spain, as well as Brazil, Japan and Mexico. (fS//SI) The Energy and Resource branch provides unique intelligence on worldwide energy production and development in key countries that affect the world economy. Targets of current emphasis are and the Reporting has included the monitoring of international investment in the energy sectors of target countries, electrical and Supervisory Control and Data Acquisition (SCADA) upgrades, and computer aided designs of projected energy projects.

Reporting on a group of GCHQ documents leaked by Snowden, the New

York Times noted that its surveillance targets often included financial in­ stitutions and "heads of international aid organizations, foreign energy

companies and a European Union official involved in antitrust battles

with American technology businesses:' It added that the US and British

agencies "monitored the communications of senior European Union of­

ficials, foreign leaders including African heads of state and sometimes

their family members, directors of United Nations and other relief pro­

grams [such as UNICEF] , and officials overseeing oil and finance min­

istries:'

The reasons for economic espionage are clear enough. When the

United States uses the NSA to eavesdrop on the planning strategies of

other countries during trade and economic talks, it can gain enormous

advantage for American industry. In 2009, for example, Assistant Secre­

tary of State Thomas Shannon wrote a letter to Keith Alexander, offering

his "gratitude and congratulations for the outstanding signals intelli-

NO PLACE TO HIDE 1 3 9

gence support" that the State Department received regarding the Fifth

Summit of the Americas, a conference devoted to negotiating economic

accords. In the letter, Shannon specifically noted that the NSXs surveil­

lance provided the United States with negotiating advantages over the

other parties:

The more than 100 reports we received from the NSA gave us deep insight into the plans and intentions of other Summit participantsJ and ensured that our diplomats were well prepared to advise President Obama and Secretary Clinton on how to deal with contentious issues, such as Cuba, and interact with difficult counterparts, such as Venezuelan President Chavez.

The NSA is equally devoted to diplomatic espionage, as the docu­

ments referring to "political affairs" demonstrate. One particularly egre­

gious example, from 20 1 1, shows how the agency targeted two Latin

American leaders-Dilma Rousseff, the president of Brazil, along with

"her key advisers"; and Enrique Pena Nieto, then Mexico's leading presi­

dential candidate (and now its president), along with "nine of his close

associates" -for a "surge" of especially invasive surveillance. The docu­

ment even features some of the intercepted text messages sent and re­

ceived by Nieto and a "close associate":

TOP SECRET//COMIHT//REl TO USA. GM. AUS, CAN, NZ1.

{ U//FO UO) S2C42 su rge effort

( U ) Goal

(TS//SI//REL) An increased understanding of the commu nication methods and associated selectors of Braz i l i a n President Dilma Rousseff and her key advisers.

TOP SECRET//COMINT//R!L TO USA. G M, AUS, CAN, N21.

1 40 GLENN GREENWALD

TOP SfCRfl/ /COMINT/ /REL TO USA. GBR, AUS, CAN, NZL

( U/ /FO U O } S2C41 surge effort

(TS//51//REL) NSA's Mexico Leadershi p Team (S2C41) cond ucted a

two-week target development s u rge effort against one of Mexico's

leading presidential candidates, E nrique Pena Nieto, and nine of h i s

close associates. N i eto is considered b y most pol itical pundits t o b e

t h e likely w i n n e r o f t h e 2 0 1 2 Mexican presidential elections w h i c h a re

to be held in J uly 2012. SATC leveraged graph ana lysis in the

development surge's ta rget development effort.

TOP SECRET/ /COMINT/ /REL TO USA, GSR, AUS, CAN, NZL

� S!Clt0/ /(0MINT//llfl TI)USA, GH. AUS, CAN. Nl.L

(U) Results

u (S//S1//REL)85489 Text messages

I nteresti ng M essages

,o, HCIU"l //COMI/IIT//lt(l fO USA, G•� MIS, CAN, Mll

NO PLACE TO HIDE

TOP SECRnl/COMIHT//Rf!L l O USA. GM.AUS, CAN , NZl.

(U) Conclusion

:J (S//RE L) Contact graph-enha n ced fi ltering is a

simple yet effective tech n iq ue, which may

allow you to find previously u nobta i nable

resu lts a nd e m power a n alytic d iscovery

cl (TS//SI// R E L) Tea ming w ith S2C, SATC was

able to successfu lly apply this tech n iq u e

aga in st high-profile, OPSEC-savvy Brazilian and

Mexican targets.

T OP SECJlf'l//COMlNT//REL TO USA , G M,. AUS, CAN, NZl

1 4 1

One can speculate about why political leaders o f Brazil and Mexico

were NSA targets. Both countries are rich in oil resources. They are a big

and influential presence in the region. And while they are far from adver­

saries, they are also not America's closest and most trusted allies. Indeed,

one NSA planning document-entitled "Identifying Challenges: Geo­

political Trends for 2014-2019"-list both Mexico and Brazil under the

heading "Friends, Enemies, or Problems?" Others on that list are Egypt,

India, Iran, Saudi Arabia, Somalia, Sudan, Turkey, and Yemen.

But ultimately, in this case as in most others, speculation about any

specific target is based on a false premise. The NSA does not need any

specific reason or rationale to invade people's private communications.

Their institutional mission is to collect everything.

If anything, the revelations about NSA spying on foreign leaders

are less significant than the agency's warrantless mass surveillance of whole populations. Countries have spied on heads of state for centuries,

including allies. This is unremarkable, despite the great outcry that

ensued when, for example, the world discovered that the NSA had for

many years targeted the personal cell phone of German chancellor

Angela Merkel.

More remarkable is the fact that in country after country, revelations

1 42 GLENN GREENWALD

that the NSA was spying on hundreds of millions of their citizens pro­

duced little more than muted objections from their political leadership.

True indignation came gushing forward only once those leaders under­

stood that they, and not just their citizens, had been targeted as well.

Still, the sheer scale of diplomatic surveillance the NSA has practiced

is unusual and noteworthy. In addition to foreign leaders, the United

States has also, for example, spied extensively on international organi­

zations such as the United Nations to gain diplomatic advantage. One

April 201 3 briefing from SSO is typical, noting how the agency used its

programs to obtain the UN secretary general's talking points prior to his

meeting with President Obama:

TOP SECRET//SI//NOFORN

( U ) OPERATIONAL

H I GH LIGHT

(TS//SI//N F) B LARN EY Team assists

S2C52 analysts i n i m p l ementi ng

Xkeyscore fi ngerp ri nts that yield

access to U . N . Secreta ry Ge neral ta l k i ng poi nts prior to meeti ng with

POT U S .

TOP SECRET//SI//NOFORN

NO P LACE TO HIDE 1 43

Numerous other documents detail how Susan Rice, then ambassador to the U N and now President Obama's national security adviser, repeat­ edly requested that the NSA spy on the internal discussions of key mem­ ber states to learn their negotiation strategies. A May 2010 SSO report describes this process in connection with a resolution being debated by the U N that involved imposing new sanctions on Iran.

( S/ / S I ) BLARNEY Team P rovides Ou t s t an d i ng Suppo rt to Enable lN Sec u r i t v Coun c i l C o l le c t ion

By N A M E REDACTED o n 2010-05-28 1430

( TS/ / S I / /NF ) W i t h the lN vote on sanct ions aga inst I ran a pp roaching a n d seve r a l count ries r id i n g the fence o n mak ing a dec is io n , Ambassado r Rice reached out t o NSA reques t ing S I GINT on those cou n t r ie s so t h a t s he could deve lop a s t ra tegy . With t he requ i reme n t t h a t t h i s be done rapidly and w i t h in ou r lega l a u t ho r i t i e s , t h e BLARNEY team j umped in t o wo rk wi t h o rgan izat ions and p a r t n e rs bot h in te rna l and external t o NSA .

( TS//SI//NF ) As OGC , SV a nd the TOPis aggress ively wo rked t h rough the lega l paperwo r k to exped ite f o u r new NSA F ISA court o rde rs for Gabo n , Uganda , N ig e r ia and Bos n i a , BLARNEY Ope ra t ions D iv is io n personne l were beh i nd t he scenes gathe ring data determining what s u rvey i n f o rma t io n was ava i lable or c o u ld be obta ined v ia t h e i r long standing F B I c o n t ac t s . As t hey worked t o obtain i n f o rma t ion o n bot h t he lN M iss ions in NY and t h e Emba s s ies in DC , t h e t a rget deve lopment team g reased the skids with app rop r ia t e data f low personnel and all p repa rat ions were made t o ensu re data could f low to t he TOPis a s soon as pos s i b l e . Severa l personnel, one f rom leg a l team and one f rom t a rget deve lopment t eam we re cal led in on Satu rday 22 May to support the 24 hou r d r i l l lega l paperwo rk exe r c i s e doing t he i r pa rt to ensu re t he o rd e r s were ready fo r the NSA D i re c t o r ' s s ignat u re ea rly Monday mo rning 24 May .

( S/ / S I ) Wit h OGC and SV push ing h a r d to exped i t e t hese f o u r o rde rs , t hey wen t f rom t h e NSA D i re c t o r f o r s ignat u re t o DoD f o r SECDEF s ig n a t u re and t h e n t o DOJ f o r s ig n a t u re b y the F I SC j udge i n rec o rd t im e . A l l f o u r o rders we re s igned by t he j udge on Wednesday 26 May ! Once t h e o rd e r s were received by t h e BLARNEY lega l team, they s p rung into act ion pars ing t hese fou r o rde rs plus another Nno rma l " renewal in one day . Pa r s i n g f ive cou rt o rde rs in one day - a BLARNEY reco rd ! As the BLARNEY legal team was b u s i l y pars ing cou rt o rde rs t he BLARNEY access management t eam was wo rking w i t h the FBI to pas s t a sking i n f o rmat ion a n d coordinate t h e engagement w i t h t e lecolMlu n icat ions p a r t ne r s .

1 44 GL ENN GR E ENWALD

A similar surveillance document from August 2010 reveals that the Unit­

ed States spied on eight members of the UN Security Council regarding a

subsequent resolution about sanctions on Iran. The list included France,

Brazil, Japan, and Mexico-all considered friendly nations. The espio­

nage gave the US government valuable information about those coun­

tries' voting intentions, giving Washington an edge when talking to other

members of the Security Council.

I O l ' S I Cl{ l - 1 , (0 M I N I !N O H > R N

August 20 1 0

(U//FOUO) Silent Success: S I G I NT Synergy Helps Shape US

Foreign Policy

(TS//SI//NF) At the outset of these lengthy negotiations, NSA had sustained collection against France

Japan, Mexico, Brazil

(TS//SI//REL) In late spring 2010, eleven branches across five Product Lines teamed with NSA enablers to provide the most current and accurate information to USUN and other customers on how UNSC members would vote on the Iran Sanctions Resolution. Noting that Iran continued its non­ compliance with previous UNSC resolutions concerning its nuclear program, the U N imposed further sanctions on 9 June 2010. SIG INT was key in keeping USUN informed of how the other members of the UNSC would vote.

(TS/ /SI/ /REL) The resolution was adopted by twelve votes for, two against (Brazil and Turkey), and one abstention from Lebanon. According to USUN, SIGINT "helped me to know when the other Permreps [Permanent Representatives] were telling the truth .... revealed their real position on sanctions ... gave us an upper hand in negotiations ... and provided information on various countries 'red lines."1

To facilitate diplomatic spying, the NSA has gained various forms of

access to the embassies and consulates of many of its closest allies. One

2010 document-shown here with some countries deleted-lists the na­

tions whose diplomatic structures inside the United States were invaded

by the agency. A glossary at the end explains the various types of surveil­

lance used.

NO P LACE TO H I D E 1 45

1 0 Sep 201 0

C L O S E A C C E S S S I G A D S

C L O S E A C C E S S S I G A D S

A l l Close Access domestic col lection uses t h e US-3 1 36 S I G A D with a u n i q ue

two-letter suffix for each target location a n d m i ss i o n . Close Access overseas

G E N I E co l l ection has been assigned the US-3 1 3 7 S I G A D with a two- letter suf­

fix.

(Note: Ta rgets marked with a n * have either been dropped or are slated to be dropped i n the near future. Please check with TAO/RTD/ROS (96 1 - 1 578s) regarding authorities

status.)

S I G A D US-3 1 36

S U F F I X TARG ET/COU NTRY LOCAT I O N COVERT E R M M I S S I O N

B E Brazil/Emb Wash,DC KATEEL LIFESAVER

51 B ra z i l/E m b Wash,DC KATEEL H I G H LANDS

VQ B razi l/UN New York POCO M O K E H I G H LANDS

HN B razil/UN New York POCOMOKE VAG RANT

LJ Brazil/UN New York POCOMOKE LIFESAVER

YL * B u lga ria/E m b Wash, DC M E RCED H I G H LANDS

QX * Colomb ia/Trad e B u reau New York BANISTER LIF ESAVER

DJ EU/UN New York PERDIDO H I G H LANDS

ss E U/UN New York PERDIDO LIFESAVER

K D E U/Emb Wash, DC MAGOTHY H I G H LANDS

1 0 E U/E m b Wash, DC MAGOTHY M I N ERALIZ

XJ E U/E m b Wash,DC MAGOTHY DROPMIRE

OF Fra nce/UN New York B LACKFOOT H I G H LANDS

vc France/UN New York B LACKFOOT VAG RANT

UC France/Emb Wash, DC WABASH HIG H LANDS

LO France/Emb Wash, DC WABASH PBX

NK * Georgia/E m b Wash, DC NAVARRO H I G H LANDS

BY * Georgia/Emb Wash, DC NAVARRO VAGRANT

RX Greece/UN New York POWELL H I G H LANDS

H B Greece/UN New York POWELL LIF ESAVER

CD Greece/E m b Wash, D C K LO N D I K E HIG H LANDS

PJ G reece/E m b Wash,DC KLON D I K E LIFESAVER

1 46 G L E N N G R E E N W A L D

J N Greece/E m b Wash, DC KLO N D I K E PBX

M O * Ind ia/UN New York NAS H U A H I G H LA N DS

QL * I nd ia/UN New York NAS H U A MAG N ETIC

ON * I n d i a/UN New York NAS H U A VAGRANT

IS * I nd ia/UN New York NAS H U A LIF ESAVER

ox * l nd i a/Emb Wash.DC OSAGE LIFESAVER

CQ * lnd ia/Emb Wash, DC OSAGE H I G H LANDS

TQ * l nd i a/Emb Wash, DC OSAGE VAG RANT

cu * lnd ia/EmbAnx Wash, DC OSWAYO VAGRANT

OS * l nd i a/EmbAnx Wash, DC OSWAYO H I G H LA N DS

SU * ltaly/E m b Wash, DC B R U N EAU LIF ESAVER

MV * ltaly/Emb Wash, DC H E M LOCK H I G H LA N DS

I P * Japan/UN New York M U LB E RRY M I N ERALIZ

HF * Japan/UN New York M U L B E RRY H I G H LA N DS

BT * Japan/UN New York M U LB E RRY MAGN ETIC

R U * J a pan/UN New York M U LB E RRY VAG RANT

LM * Mexico/UN New York ALAMITO LIF ESAVER

ux * Slovakia/Emb Wash, DC F L E M I N G H I G H LA N DS

SA * Slovakia/Emb Wash, DC F L E M I N G VAGRANT

XR * South Africa/ U N & Consulate New York D O B I E H I G H LANDS

RJ * South Africa/ UN & Consulate New York D O B I E VAGRANT

YR * South Korea/UN New York S U LP H U R VAGRANT

TZ * Ta iwan/TECO New York R E Q U ETIE VAG RANT

VN * Venezuela/Emb Wash, DC Y U KO N LIF ESAVER

U R * Venezuela/UN New York WESTPORT LIFESAVER

N O * Vietnam/UN New York NAVAJO H I G H LANDS

OU * Vietnam/UN New York NAVAJ O VAG RANT

GV * Vietnam/Emb Wash, DC PANTH E R H I G H LANDS

SIGAD US-3 1 37

G E N E R A L T E R M D E S C R I P T I O N S

H I G H LANDS: Collection from I m p l a nts

VAG RANT: Col l ection of Computer Screens

MAG N ETIC: Sensor Collection of Mag netic Ema nations

M I N E RALI Z E : Col lection from LAN I m p l a nt

OCEAN: Optical Collection System for Raster-Based Computer Screens

NO PLACE TO H I DE

LIFESAVE R : I m a g i n g of the H a rd Drive

G E N I E : M u lti-stage operation; j u m p i n g the a i rg a p etc.

B LACKH EART: Collection from an F B I I m p l a nt

PBX: Pub lic Branch Exchange Switch

CRYPTO ENABLED: Collection derived from AO's efforts to e n a b l e crypto

DROPM I R E : passive col lection of ema nations using an antenna

CUSTOMS: Customs opportunities (not LIFESAVER)

1 47

DROPM I R E : Laser pri nter col lection, purely prox i m a l access ( * * NOT** i m p l a nted)

DEWSWE E PE R: USB ( U n iversal Serial Bus) h a rdware h ost tap that provides COVERT

l i n k over USB l i n k i nto a target network. Operates w/RF relay su bsystem to pro­

vide wi reless Bridge into target network.

RADO N : B i -d irect i o n a l host ta p that can i nject Ethernet packets onto the same tar­

get. Al lows b i - d i rectional exploitation of Denied networks using sta n d a rd on-net

tools.

Some of the NSA's methods serve all agendas-economic, diplomatic,

security, and obtaining an all-purpose global advantage-and these are

among the most invasive, and hypocritical, in the agency's repertoire. For

years, the US government loudly warned the world that Chinese routers

and other Internet devices pose a "threat" because they are built with

backdoor surveillance functionality that gives the Chinese government

the ability to spy on anyone using them. Yet what the NSA's documents

show is that Americans have been engaged in precisely the activity that

the United States accused the Chinese of doing.

The drumbeat of American accusations against Chinese Internet de­

vice manufacturers was unrelenting. In 2012, for example, a report from

the House Intelligence Committee, headed by Mike Rogers, claimed that

Huawei and ZTE, the top two Chinese telecommunications equipment

companies, "may be violating United States laws" and have "not followed

United States legal obligations or international standards of business

behavior:' The committee recommended that "the United States should

view with suspicion the continued penetration of the U.S. telecommuni­

cations market by Chinese telecommunications companies:'

The Rogers com mittee voiced fears that the two companies were en-

1 48 G L E N N G R E E N W A L D

abling Chinese state surveillance, although it acknowledged that it had

obtained no actual evidence that the firms had implanted their routers

and other systems with surveillance devices. Nonetheless, it cited the

failure of those companies to cooperate and urged US firms to avoid pur­

chasing their products:

Private-sector entities in the United States are strongly encouraged to

consider the long-term security risks associated with doing business

with either ZTE or Huawei for equipment or services. U.S. network

providers and systems developers are strongly encouraged to seek other

vendors for their projects. Based on available classified and unclassified

information, Huawei and ZTE cannot be trusted to be free of foreign

state influence and thus pose a security threat to the United States and

to our systems.

The constant accusations became such a burden that Ren Zhengf ei,

the sixty-nine-year-old founder and CEO of Huawei, announced in No­

vember 2013 that the company was abandoning the US market. As For­ eign Policy reported, Zhengfei told a French newspaper: "'If Huawei gets

in the middle of U.S-China relations: and causes problems, 'it's not worth

it:"

But while American companies were being warned away from suppos­

edly untrustworthy Chinese routers, foreign organizations would have

been well advised to beware of American-made ones. A June 2010 report

from the head of the NSA's Access and Target Development department

is shockingly explicit. The NSA routinely receives-or intercepts-rout­

ers, servers, and other computer network devices being exported from

the United States before they are delivered to the international custom­

ers. The agency then implants backdoor surveillance tools, repackages

the devices with a factory seal, and sends them on. The NSA thus gains

access to entire networks and all their users. The document gleefully ob­

serves that some "SIGINT tradecraft . . . is very hands-on (literally!)":

NO PLACE TO HID E

I ( l J ' \ I l Ii i I ( ( 1 \ l l '; I , OJ O R ,

.June 2 0 1 0

( ll ) Stealthy Techniques Can Crack Some of SIGI NT's Hardest Targets

By ( l f i.'FOUO> ! ...., .. o,creo I. C h ief. Access and Target Development (S3261 ) ( TS!!SJ;!NF) Not a l l S I G I N T tradecraft involves accessing signals and networks from thousands of mi les away . . I n fact. sometimes it is very hands-on ( l iteral l y ' ). Herc ·s how it works: shipments of computer network

IMAGE REDACTED

devices ( servers. routers. etc ) being del i vered to our targets throughout the world are interceptetl. Next, they are retlirected to n secret locntion where Tailored Access Opcrations1Access Operations (AO - S326) employees, with the support of the Remote Operat ions Center ( S32 I ). enable the instnllnlion of bencon implnnts directly i nto our targets· electronic devices. These devices are then re-packaged and plt1ced bt1ck into trm,sit to the original dest ination. All of this happens with the support of I ntell igence Community partners and the technical wizards in TAO.

1 49

(TS//SI//N F ) Such operations i nvolving supply-chain interdiction are some of the most productive operations i n TAO, because they pre-position access points into hard target networks around the world.

(TS//SI//N F ) Left: I ntercepted packages are opened carefu l ly; Right: A "load station" i m plants a beacon

Eventually, the implanted device connects back to the NSA infrastruc­

ture:

(TS//S I//N F ) In one recent case, after several months a beacon i mplanted through supply­ chain interdiction cal led back to the NSA covert i n frastructure. This call back provided us access to fu rther exploit the device and survey the network.

1 50 G L E N N G R E E N WA L D

Among other devices, the agency i ntercepts and tampers with routers and servers manufactured by Cisco to direct large amounts of I nternet traffic back to the NSA's repositories. (There is no evidence in the docu­ ments that Cisco is aware of, or condoned, these i nterceptions.) In April 201 3, the agency grappled with technical difficulties involving the inter­ cepted Cisco network switches, which affected the BLARNEY, FA I R­ VIEW, OAKSTAR, and STORMBREW programs:

jNewCrossProgram CrossProgram- 1 - 1 3

Title o f Change: Submitter: Site{s}:

Description of Change:

Reason for Change:

Mission Impact:

Additional Info:

Last CCB Entry:

Programs Affected:

TOP S E C RET//COMINT// R E L TO USA. FVEY

(RP port gpr,Pr.,fr,(I on 41 1 1 1201 :, 1 1 1 05PM )

Active ECP Count: �

New ECP Lead: I NAME REDACTED J Update Software on all Cisco ONS Nodes

™"§±@) Approval Priority: APPLE1 CLEVERDEVICE Project(s}:

HOMEMAKER DOGHUT OUARTFRPOUNDFR

OUEENSI AND SCAL I ION SPORTCOAT

SUBSTRATUM TITAN POINTE SUBSTRATUM BIRCHWOOD MAYTAG FAGI F F D F N Com ms/Network Comms/NP,twork Com ms/Network Comms/Nptwork

SubSystem(s):

Uctate software on alt Cisco Optical Network Sw1tt::hes

C-Rout,ne No Project(s) Entered

No Subsystemfs) Entered

All of our Cisco ONS SONET multiplexers are experiencing a software bug that causes them to mterm11tenlly drop out The mission impact is unknown While the existing bug doesn't appear to affect traffic. applying the new software update could Unfortunately, there 1s now way to be sure. We can't simulate the bug 1n our tab and so it's 1mposs1ble to predict exactly what wHI happen when we apply the software update We propose to update one or the nodes m NBP-320 first to determine ,t the update goes smoothly.

Recently we tried to rec;et the standby manager card 1n tt1e HOMEMAKER node. When that failed. we attempted to physically reseat 11. Since 11 w::is the standby card. we did not expect that would cause any prohlems HowPver. upon reseating the card. the entire ONS crashed ;in d we lost all traffic throuqh the box It took more than an hour tn rf'cover from this fa1lurP.

The worst casP scenano 1s that we have to blow rtway the enllre confiqurat1on and start from scrntch Pnm to c:tartmq Otir upqradP we w,11 save lhP r.onfigurallon so that if we have to configure the box from scratch. we can s1rnply uplortdP the saved confiquralton We i:>st1matP that wP w,H bP down for no more than an hour for each nodP in the systPm

3126/20 1 3 8 1 6 13 AM I NAME REDACTED I We have IPS!p.cj the upqrade 111 our lab and 11 works well However, we can't

repeat the buq 1n our lab c:o we don't know 1f we w,11 encounter problems whPn we attempt 10 upqrade a node that 1s aNectPd by thP bug 04/10/13 1 6 08 1 1 [NAME REDACTED I 09 Apr Bla

(i ey CCB - Blarney EC:P board approved

ECP lead NAME REDACTED J Blarney F airview Or1kc;t�r SlormhrPw

NO PLACE TO HIDE 1 51

It is quite possible that Chinese firms are implanting surveillance mecha­ nisms in their network devices. But the United States is certainly doing the same.

Warning the world about Chinese surveillance could have been one of the motives behind the U S government's claims that Chinese devices cannot be trusted. But an equally important motive seems to have been preventing Chinese devices from supplanting American-made ones, which would have limited the NSA's own reach. In other words, Chinese routers and servers represent not only economic competition but also surveillance competition: when someone buys a Chinese device instead of an American one, the NSA loses a crucial means of spying on a great many communication activities.

If the quantity of collection revealed was already stupefying, the NSA's mission to collect all the signals all the time has driven the agency to expand and conquer more and more ground. The amount of data it cap­ tures is so vast, in fact, that the principal challenge the agency complains about is storing the heaps of information accumulated from around the globe. One NSA document, prepared for the Five Eyes SigDev Confer­ ence, set forth this central problem:

I ToP SECREl11C01.11NT,'REL rous.-. rvev

1 ·1 he C h al lmgc

Collection is outpacing our ability to ingest, process and store to the "norms" to which we have become accustomed.

The story goes back to 2006, when the agency embarked on what it called "Large Scale Expansion of NSA Metadata Sharing:' At that point, the NSA predicted that its metadata collection would grow by six hun­ dred billion records every year, growth that would include one to two billion new telephone call events collected every single day:

1 5 2 GLENN GREENWALD

SE.OEf/Ja»,INT//RB. TO USA., l"VEV/120320108

Large Scale Expansion of NSA Metadata Sharing '

(S//51//REL) Increases NSA communications metadata sharing from 50 billion records to 850+ billion records (grows by 1 -2 billion records per day)

••• ...

...

j 300 '" 200

100

Yearly Growth

[

Projected O N I • D N I ( 1 Projected PSTN CJ PSTN

*(Cl/REL) Includes Call Events from -zn• Party SIG/NT Partners (est. 126 Billion records)

SffRET//COMJNTI/Rfl TO USA, FVEY/f20]2010fl

By May 2007, the expansion had evidently borne fruit: the amount of

telephone metadata the agency was storing-independent of email and

other Internet data, and excluding data the NSA had deleted due to lack

of storage space-had increased to 1 50 billion records:

(SI/N F) C a l l Events in P ROTO N*

•Total Call Events in N S A PROTON* est. 1 49 Billion

Of those:

•Total Call Events Non-NSA

•Tota l Call Events Non-NSA, Non-NOFORN, Non-HCS

• For date range 2000-2006. as of early July 2006; some data has been aged off system

est. 1 01 Billion

est. 92,000

[ - -

• NOll.ftSA Ev.nta NOT Sh1rHbl• I w,1h 5 E.,., (NOfORN I HCS)

e NOll .fllSA Ev•nt1. $haruble with ) 5 Eyu (Non-HOf'ORN I Hon-HCS) I

c.ECR.fT//NOfOA.N//20320108 --------------- �- -��-

NO PLACE TO HIDE 1 5 3

Once Internet-based communications were added to the mix, the total number of communication events stored was close to 1 trillion (this data, it should be noted, was then shared by the NSA with other agencies).

To address its storage problem, the NSA began building a massive new facility in Bluffdale, Utah, that has as one of its primary purposes the retention of all that data. As reporter James Bamford noted in 20 1 2, the Bluffdale construction will expand the agency's capacity by adding "four 25,000-square-foot halls filled with servers, complete with raised floor space for cables and storage. In addition, there will be more than 900,000 square feet for technical support and administration:' Considering the size of the building and the fact that, as Bamford says, "a terabyte of data can now be stored on a flash drive the size of a man's pinky;' the implica­ tions for data collection are profound.

The need for ever-larger facilities is particularly pressing given the agency's current invasions into global online activity, which extend far beyond the collection of metadata to include the actual content of emails, Web browsing, search histories, and chats. The key program used by the NSA to collect, curate, and search such data, introduced in 2007, is X­ KEYSCORE, and it affords a radical leap in the scope of the agency's surveillance powers. The NSA calls X-KEYSCORE its "widest-reaching" system for collecting electronic data, and with good reason.

A training document prepared for analysts claims the program cap­ tures "nearly everything a typical user does on the internet;' including the text of emails, Google searches, and the names of websites visited. X-KEYSCORE even allows "real-time" monitoring of a person's online activities, enabling the NSA to observe emails and browsing activities as they happen.

Beyond collecting comprehensive data about the online activities of hundreds of millions of people, X-KEYSCORE allows any NSA analyst to search the system's databases by email address, telephone number, or identifying attributes such as an IP address. The range of information available and the basic means an analyst uses to search it are illustrated in this slide:

1 54 GLENN GREENW ALD

Pl u g - i ns extract a n d i n d e x m etadata i nto ta b l es

TOP SECRET//COM!NT//REL TO USA, AUS, CAN, GBR, NZL

Another X-KEYSCORE slide lists the various fields of information that

can be searched via the program's "plug-ins:' Those include "every email

address seen in a session;' "every phone number seen in a session" (in­

cluding "address book entries"), and "the webmail and chat activity ":

TOP SECRET//COM!NT//REL TO , " ''\'' . .

- 1· n s : .:. · i� ;. �} AJll.c,

r Plug-in

E-mail Addresses

Extracted Files

Full Log

HTIP Parser

Phone Number

User Activity

DESCRIPTION

Indexes every E-mail address seen In a session by both usemame and domain

Indexes every file seen i n a session by both filename and extension

Indexes every DNI session collected. Data is Indexed by the standard N-tupple ( IP, Port, Casenotation e

::;; t .: c·

--== Indexes the dlent-slde HTTP traffic (examples to follow

Indexes the Webmail and Chat activity to include username, budd list machine s ecific cookies etc.

TOP SECRET//COM!NT//REL TO USA, AUS, CAN, GBR, NZL

NO PLA C E TO H IDE 1 5 5

Th e program also offers the ability t o search and retrieve embedded doc­

uments and images that were created, sent, or received:

y ·

Pl ug-in

User Activity

4111C NZl.//2029 1123

"' n s

D E SC RI PTION

Indexes the Webmail and Chat activity to lndude usemame, buddylist, machine specific cookies etc.

==========� A Proc does the exploitation

:::=�=== = ====

Document meta� data

Extracts embedded properties of Microsoft Office and Adobe PDF files, such as Author, Organization, date created etc.

Other NSA slides openly declare the all-encompassing global ambi­

tion ofX- KEYSCORE:

1 56 G L E N N G R E E N W A L D

Why are we interested in HTTP?

· Almost all web - browsing uses HTIP : • Internet surfing • Webmail (Yahoo/Hotmail/Gmail/etc. ) • OSN (Facebook/MySpace/etc.) • Internet Searching (Google/Bing/etc.) • Online Mapping (Google Maps/Mapquest/etc.)

The searches enabled by the program are so specific that any NSA analyst is able not only to find o ut which websites a person has visited but also to assemble a comprehensive list of all visits to a particular website from specified computers:

XKS HTTP Activity Search

Another common query is analysts who want to see all traffic from a given IP addre ss (or IP addresses) to a specific website.

XKS I ITTP Activity Search

• For example let' s say we want to see all traffic from IP Address 1 . 2 . 3 . 4 to the website \I ·., ,1. . 'hi,,· . ,

• While we c a n j ust put the I P address and the "host" into the search form, remember what we saw before about the various host names for a given website

NO PLACE TO HIDE 1 57

Most remarkable is the ease with which analysts can search for what­ ever they want with no oversight. An analyst with access to X-KEY­ SCORE need not submit a request to a supervisor or any other authority. Instead, the analyst simply fills out a basic form to "justify" the surveil­ lance, and the system returns the information requested.

• Enter usernames and domains into query Seard\: Email Addresses

O..letme I C.r,, "' Siar! ;'l'.)()Q 'Y: 2'3 0000 : SIOp

oooma,n �!It,., ' .. flt I Mulitlple usemames from

SAME domain can be OR' d

In the first video interview he gave when in Hong Kong, Edward Snowden made an audacious claim: "I, sitting at my desk, could wire­ tap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email:' US officials vehemently denied that this was true. Mike Rogers expressly accused Snowden of "lying;' add­ ing, "It's impossible for him to do what he was saying he could do:' But X-KEYSCORE permits an analyst to do exactly what Snowden said: tar­ get any user for comprehensive monitoring, which includes reading the content of their emails. Indeed, the program lets an analyst search for all emails that include targeted users in the "cc" line or mention of them in the body of the text.

The NSA.'s own instructions for searching through emails demon­ strate just how simple and easy it is for analysts to monitor anyone whose address they know:

1 58 GLENN G R E ENWALD

Email Addresses Query:

One of the most common queries is (you guessed i t ) an Email Address Query searching for an email address. To create a query for a specific email address, you have to till in the name of the query, justify it and set a date range then you simply fil l in the email address(es) you want to search 011 and submit.

That would look something like this. Ftlidf • Adv ancec:I FMtllw • 9- � 5-i:h l"teb CINr S..thVauft A..io.:IL.stSMrchV-..iK

Search: Emall Addreue� Quary Name: e.bvphod

Justification: ct IDl'get m n &Ince

Miranda Number:

O.tetime: l Monlh ., Start: 20C6- 12-24 :-'! 00.00 :

Email usemarne abu1,hod

@Domarn: yohoo com

One of X-KEYSCORE's most valuable functions to the NSA is its ability to surveil the activities on online social networks (OSNs), such as Facebook and Twitter, which the agency believes provide a wealth of information and "insight into the personal lives of targets:"

The methods for searching social media activity are every bit as simple as the email search. An analyst enters the desired user name on, say, Face­ book, along with the date range of activity, and X-KEYSCORE then re­ turns all of that user's information, including messages, chats, and other private postings.

N O P L A C E TO H I D E

o,t,um,: 1 Day v St•rt. �21 .... oo oo � Stoc,; 2009-09-22 ..,

s .. rchFor

1 59

Perhaps the most remarkable fact about X-KEYSCORE is the sheer

quantity of data that it captures and stores at multiple collection sites

around the world. "At some sites;' one report states, "the amount of data

we receive per day (20+ terabytes) can only be stored for as little as 24

hours based on available resources:' For one thirty-day period beginning

in December 2012, the quantity of records collected by X-KEYSCORE

just for one unit, the SSO, exceeded forty-one billion:

SSO - Last 30 Days

� Signal Profile

'

* Most Volume ' M -----......

,. ,,,, ,, .... � XKEYSCORE: 1 ,996,304 , 1 49

Records

* Top 5 Techs

X-KEYSCORE "stores the full-take content for 3-5 days, effectively

'slowing down the internet:" -meaning that "analysts can go back and

recover sessions:' Then "content that is 'interesting' can be pulled out of

1 60 GLENN GREENWALD

X-KEYSCORE and pushed to Agility or PINWALE;' storage databases

that provide longer retention.

-UHr ActMty" meta-data with front end 1\11 take feeds and back-end Mlleeted feeds

Plnwale

MARINA

/-- ----- Unique-----

fi'ont end full take feeds XKeyscore

TOP SECRETI/COMINT//ORCON,RfL TO USA, AUS, CAN, G&R •l'KI NZlJ/20291123

X-KEYSCORE's ability to access Facebook and other social media sites is

boosted by other programs, which include BLARNEY, allowing the NSA

to monitor a "broad range of Facebook data via surveillance and search

activities":

(TS//Sl//N F ) BLARNEY Exploits the Social Network via Expanded Facebook Collect ion

By I _ .. ...,, •• ) on 2011-83-14 0737

( TS//SI//N f ) 550 IIIGHLIGHT - BLARNEY Exploits the Social Network via Expanded Facebook Collect ion

( TS//SI//NFJ On 11 March 2011, 81.AJ\'jEY beoan delivery of substantia l ly illproved and •ore coniplete Facebook conten t . This is a ..ajor leap f orward in NSA ' s ability t o exploit Facebook usino FISA and FAA authorities. This effort was initiated in partnership with the FBI s ix months ago to address an unreliable and incoaplete Facebook collection system. NSA i s now able to access a broad range of Facebook data via su rveillance and search activities. OPis are excited about receiving •any content fields, such as cha t , o n a sustained basis t h a t had previously only been occasional l y available. Some content will be con,pletely new including subscriber video s . Taken together, the new Facebook collect ion will provide a robust SIGINT opportunity against our t a rgets - f rom geolocatlon based on their IP addresses and user agent , to collection of a l l of their private aessages and profile information. Multiple elements a c ross NSA partnered to ensure the successful del ivery of this data. An NSA representat ive at FBI coordinated the rapid developaent of the col lect10n system; SSO ' s PRINTAURA te.., wrote new software and made configuration changes; CES modif ied their protocol exploitation systems and the Technology D i rectorate fast­ t racked upgrades to their data presentation tools so that OPis could v iew the data prope rly.

NO P LACE TO H ID E 1 6 1

I n the UK, meanwhile, the GCHQ's Global Telecommunications Ex­ ploitation (GTE) division has also devoted substantial resources to the task, detailed in a 2011 presentation to the annual Five Eyes conference.

The GCHQ has paid special attention to weaknesses in Facebook's secu­ rity system and to obtaining the kind of data that Facebook users attempt to shield:

1 62 GLENN GREENWALD

In particular, the GCHQ has found vulnerabilities in the network's sys­

tem for storing pictures, which can be used to gain access to Facebook

IDs and album images:

NO PLA C E TO H ID E 1 63

Beyond social media networks, the NSA and the GCHQ continue to look for any gaps in their s urveillance net, any communications that re­ main outside their grasp, and then develop ways to bring them under the agencies' watchful eye. One seemingly obscure program demonstrates this point.

Both the NSA and GCHQ have been cons umed by their perceived need to monitor Internet and phone communications of people on com­ mercial airline flights. Because these are rerouted via independent satel­ lite systems, they are extremely difficult to pinpoint. The idea that there is a moment when someone can use the Internet or their phone without

1 64 GLENN GRE E NWALD

detection-even for just a few hours while flying-is intolerable to the

surveillance agencies. In response, they have devoted substantial resourc­

es to developing systems that will intercept in-flight communications.

At the 2012 Five Eyes conference, the GCHQ presented an intercep­

tion program named Thieving Magpie, targeting the increasingly avail­

able use of cell phones during flights:

The proposed solution envisioned a system to ensure complete "global

coverage" :

NO P L A C E TO H I D E 1 6 5

Substantial headway has been made to ensure that certain devices are susceptible to surveillance on passenger jets:

1 66 GLENN G R E ENWA L D

A related NSA document presented at the same conference, for a pro­ gram entitled Homing Pigeon, also describes efforts to monitor in-air communications. The agency's program was to be coordinated with the GCHQ, and the entire system made available to the Five Eyes group.

TOP SECRET/iCOMINT//REL TO USA, f'..VEY

( U ) ANALYTIC DRIVER (CONT.)

O ( S//SI// R E L FVEY) An a lyti c Qu estion

G iven a GSM h a ndset detected o n a known a i rcraft fl i ght, what is the l i kely ide ntity ( o r ide ntiti es) o f the h a ndset s u bscri ber ( a n d vice­ versa ) ?

D(TS//S I//R E L FVEY) Proposed Process

Auto correlation of GSM h a n dsets to s u bscri b e rs obse rved on two or more fl ights.

TOP SECAETI/COMINT//REL TO USA, FVEY

TOP SECRETIICOMINT/IREl TU USA. FVEY

( U ) GOI NG FORWARD

O (TS//51// R E L FVEY) SATC w i l l complete deve l o pment once a rel i a b l e T H I EV I NG M AG P I E d ata feed has been esta blished

0 (TS//51// R E L FVEY) Once the QFD is c o m plete, it w i l l be ava i l a ble t o FVEY users a s a R ESTful w e b service, J E M A compone nt, and a l ight weight web page

0 (TS//51// R E L FVEY) If the 52 QFD Review P a n e l el ects to ask for H O M I N G P I G EO N to be made pers i stent, its natural home wou l d be incorporation i nto FASTSCO P E

TOP SECRETJ!COMINT//REL TO USA. FVEY

NO PLACE TO HIDE 1 67

There is remarkable candidness, within parts of the NSA, about the true purpose of building so massive a secret surveillance system. A Power­ Point presentation prepared for a group of agency officials discussing the prospect of international Internet standards gives the unvarnished view. The author of the presentation is an "NSA/SIGINT National In­ telligence Officer (SINIO) for Science and Technology;' a self-described "well trained scientist and hacker:'

The blunt title of his presentation: "The Role of National Interests, Money, and Egos:' These three factors together, he says, are the primary motives driving the United States to maintain global surveillance domi­ nation.

/fFOUO

Oh Yeah . . .

• Put Money, National Interest, and Ego together, and now you' re talking about shaping the world writ large.

What country doesn 't want to make the world a better place . . . for itself?

U/IFOUO

He notes that US dominance over the Internet has given the country sub­ stantial power and influence, and has also generated vast profit:

.,_J,l·-----r.is;::;====== SECRET//REL TO USA, FVEY

What' s the Threat?

• Let' s be blunt - the Western World (especially the US) gained influence a nd made a lot of money via the d rafting of earlier standards.

JThe US was the major player in shaping today's I nternet. This resulted i n pervasive exportation of American culture as well as technology. It also resulted in a lot of money being made by US entities.

1 68 GLENN GRE ENWALD

Such profit and power have also inevitably accrued, of course, to the

surveillance industry itself, providing another motive for its endless ex­

pansion. The post-9/ 1 1 era has seen a massive explosion of resources

dedicated to surveillance. Most of those resources were transferred from

the public coffers (i.e., the American taxpayer) into the pockets of private

surveillance defense corporations.

Companies like Booz Allen Hamilton and AT&T employ hordes of

former top government officials, while hordes of current top defense of­

ficials are past (and likely future) employees of those same corporations.

Constantly growing the surveillance state is a way to ensure that the gov­

ernment funds keep flowing, that the revolving door stays greased. That

is also the best way to ensure that the NSA and its related agencies retain

institutional importance and influence inside Washington.

As the scale and ambition of the surveillance industry has grown,

so has the profile of its perceived adversary. Listing the various threats

supposedly facing the United States, the NSA-in a document entitled

"National Security Agency: Overview Briefing"-includes some predict­

able items: "hackers;' "criminal elements;· and "terrorists:' Revealingly,

though, it also goes far broader by including among the threats a list of

technologies, including the Internet itself:

I nte rn et

W i reless

H ig h -S peed

C i rc u i ts

Pagers

Facs i m i l e

Sate l l ite

NO PLACE TO HIDE 1 69

The Internet has long been heralded as an unprecedented instrument

of democratization and liberalization, even emancipation. But in the eyes

of the US government, this global network and other types of commu­

nications technology threaten to undermine American power. Viewed

from this perspective, the NSA's ambition to "collect it all" at last be­

comes coherent. It is vital that the NSA monitor all parts of the Internet

and any other means of communication, so that none can escape US

government control.

Ultimately, beyond diplomatic manipulation and economic gain,

a system of ubiquitous spying allows the United States to maintain its

grip on the world. When the United States is able to know everything

that everyone is doing, saying, thinking, and planning-its own citi­

zens, foreign populations, international corporations, other government

leaders-its power over those factions is maximized. That's doubly true

if the government operates at ever greater levels of secrecy. The secrecy

creates a one-way mirror: the US government sees what everyone else in

the world does, including its own population, while no one sees its own

actions. It is the ultimate imbalance, permitting the most dangerous of all

human conditions: the exercise of limitless power with no transparency

or accountability.

Edward Snowden's revelations subverted that dangerous dynamic by

shining a light on the system and how it functions. For the first time,

people everywhere were able to learn the true extent of the surveillance

capabilities amassed against them. The news triggered an intense, sus­

tained worldwide debate precisely because the surveillance poses such a

grave threat to democratic governance. It also triggered proposals for re­

form, a global discussion of the importance of lnternet freedom and pri­

vacy in the electronic age, and a reckoning with the vital question: What

does limitless surveillance mean for us as individuals, in our own lives?