How Does NSA Internet Surveillance Work?

TL;DR

NSA surveillance works through overlapping collection programs, corporate data systems, network interception, direct company requests, packet injection, malware delivery, and intelligence sharing. Because digital services continuously create searchable transaction records, metadata can reveal movements, contacts, purchases, and interests, making it surveillance rather than harmless technical information. Effective countermeasures must frustrate nation-state adversaries and raise the cost of wholesale collection.

Transcript

Hey there. Good a- good afternoon. Thanks for having me. Thanks for coming. Uh, this'll be a fun topic. What I, what I like best about the, uh, all the documents and the programs and sort of reading about all the details are the code names. I think code names are pretty cool. I think there are not enough code names in our life. I think that's, that... Read More

Key Insights

• NSA surveillance is built from overlapping programs that can collect similar information through different technical methods, corporate relationships, and legal authorities. MUSCULAR, direct interception of user connections, and PRISM illustrate separate routes for obtaining Google and Yahoo user data.
• MUSCULAR is a program for collecting Google user data by eavesdropping on trunk links between data centers. The talk says this was probably conducted with help from Level 3 Communications, the provider associated with those links and identified by the code name Little.
• PRISM is a program for obtaining Google and Yahoo user data by asking the companies to provide it directly. It differs from covert interception of data-center links and from surveillance of connections between individual users and web servers through backbone providers.
• QUANTUM is a real-time response capability connected to internet eavesdropping. TURMOIL allows surveillance equipment to communicate back to the wire, while QUANTUMINSERT injects packets and QUANTUMCOOKIE induces a user to disclose cookies for de-anonymization.
• FOXACID is an internet-based exploit orchestrator that serves malware to selected users. The resulting implants perform various functions, and some described implants are designed to remain effective after an operating-system reinstallation or to cross an air gap.
• The NSA's stated mentality is to collect, know, and exploit everything. The talk traces this approach from Cold War surveillance of the Soviet Union to the post-September 11 mission of preventing another attack by seeking awareness of everything that happens.
• Digital surveillance is enabled by transaction records created whenever computers process activities. Falling storage and processing costs make saving everything easier than selecting what to preserve, while searchable records and cloud computing expand the digital footprints available to companies and government agencies.
• Metadata is surveillance because it can reveal where someone went, whom they spoke with, what they purchased, and what they viewed. Large surveillance databases also enable forms of analysis that would not be possible without collecting and retaining records at massive scale.

Questions & Answers

Q: How does the NSA collect data from internet services?

The NSA collects internet-service data through several overlapping routes. MUSCULAR intercepts trunk links between Google data centers, while another unnamed approach monitors links between users and web servers with probable assistance from backbone providers. PRISM uses a different method by asking companies to provide user data directly. These approaches operate through distinct technical capabilities, corporate relationships, and legal authorities.

Q: What is the difference between MUSCULAR and PRISM?

MUSCULAR and PRISM obtain service-provider data through different mechanisms. MUSCULAR collects Google user data by eavesdropping on trunk links connecting data centers, probably with assistance from Level 3 Communications. PRISM instead collects Google and Yahoo user data by asking those companies to provide it directly. The distinction is between intercepting network infrastructure and receiving information from the companies themselves.

Q: How does the NSA use packet injection for surveillance?

The QUANTUM family of programs enables real-time responses to intercepted internet traffic rather than passive collection alone. TURMOIL allows equipment on a network link to send information back onto the wire. QUANTUMINSERT performs packet injection, possibly through DNS injection, redirects, or rejected TCP traffic. QUANTUMCOOKIE sends a packet that prompts a user to reveal cookies, supporting de-anonymization.

Q: What is FOXACID and how does it deliver malware?

FOXACID is described as an exploit orchestrator positioned on the internet. It serves malware to individual users through a collection of tools and implants with separate code names. These implants place code on a target computer to perform various tasks. Some are designed to survive operating-system reinstallation, while others are intended to cross air gaps separating computers from the internet.

Q: Why does the NSA use multiple surveillance programs?

Multiple programs make surveillance robust across technical, corporate, legal, and political dimensions. The talk identifies three different ways to collect Google user data and argues that similar redundancy should be expected for cell phone and other internet data. When one method or authority does not apply, another program, partnership, capability, or authority may still provide access to the desired information.

Q: How do intelligence agencies and allied countries share surveillance?

Surveillance information and technology can move among organizations and countries. The talk names the NSA, CIA, FBI, NRO, and DEA, and describes the NSA sharing data with the DEA. It also discusses cooperation among the Five Eyes: the United States, Canada, the United Kingdom, Australia, and New Zealand. Additional intelligence groupings include arrangements called the Eight Eyes and Thirteen Eyes.

Q: Why does modern technology enable mass surveillance?

Modern computing continually produces transaction records as a byproduct of processing communication, social activity, and other behavior. Storage and processing costs keep falling, so saving everything can become easier than deciding what to preserve. Searchable data, extensive digital footprints, and cloud computing place large collections of personal information under corporate control, where government surveillance can obtain access overtly or covertly.

Q: Why is metadata considered a form of surveillance?

Metadata can describe a person's movements, associations, purchases, and interests even when it does not include conversation content. The talk compares it to a private detective's surveillance report showing where a subject went, whom the subject met, what the subject bought, and what the subject examined. For that reason, calling collected information metadata does not make the resulting observation insignificant.

Summary & Key Takeaways

• The NSA uses multiple programs to obtain similar information through different routes. MUSCULAR intercepts links between data centers, PRISM obtains information directly from companies, and other operations monitor connections between users and web servers. These overlapping technical methods, corporate relationships, and legal authorities make the surveillance system politically, legally, and technically robust.

• Programs such as TURMOIL and QUANTUM extend surveillance beyond passive collection by allowing systems to inject packets and respond to intercepted traffic in real time. FOXACID acts as an exploit orchestrator that serves malware to selected users, while implants may survive operating-system reinstallation or cross air gaps, demonstrating the breadth of the described technical capabilities.

• Mass surveillance benefits from ordinary information technology because computer processes generate transaction records, storage and processing costs keep falling, and cloud computing places personal information under other parties' control. Corporate surveillance built for services and advertising therefore supplies infrastructure that government agencies can access overtly or covertly, creating a public-private surveillance partnership.