The Surveillance Machine: A Catalogue of What Governments Actually Built

Article two in the BioJejak series on web security and encryption. The first article argued that most organisations quietly gave away control of their systems. This one shows the scale of what that control-less infrastructure is exposed to, and then catalogues the programs in detail.

Why this article

The first article in this series made a single argument: over twenty years we handed our data and our systems to third parties we do not control. The obvious next question is who sits on the other side of that arrangement, and how much they can actually see. This article answers it from the public record, not from speculation. Its purpose is first to give you a feel for the scope and breadth of state surveillance, so that the catalogue that follows reads as a picture of one coherent machine rather than a list of strange code names, and then to lay out the programs themselves. It is long and reference-like by design. Read the framing, then treat the catalogue as a map you can come back to.

Where the record comes from

In 2013 Edward Snowden, a contractor working inside the United States National Security Agency, copied a large body of classified material and handed it to journalists. Reporting followed in the Guardian, the Washington Post, Der Spiegel, the Intercept and others, from 2013 through 2018. The documents that were actually published, several hundred of them, are collected in the public Snowden Surveillance Archive, which in the edition used here holds 474 documents. They describe the signals-intelligence programs of the NSA and its "Five Eyes" partners: the United Kingdom's GCHQ, Canada's CSE, Australia's ASD and New Zealand's GCSB.

Two things are worth holding in mind throughout. The documents mostly date from roughly 2007 to 2013, so they are a snapshot that is now well over a decade old, and capability of this kind does not shrink with time. And they are only the published, redacted subset. The full picture was larger than what follows.

The scope, in plain terms

This is the part worth sitting with before the list. What the documents describe is not the targeted surveillance of a handful of named suspects. It is an architecture built to collect as much as possible, by default, and to decide what mattered afterwards. The phrase that captured the ambition, which appears in the Menwith Hill material in the archive, was "collect it all."

The breadth is easier to grasp by dimension than in prose:

• Cables. Tapping the fibre-optic backbone and the undersea cables that carry the world's traffic (programs such as FAIRVIEW and STORMBREW in the United States, TEMPORA in the United Kingdom), taking a copy of enormous volumes of data as it flows.
• Companies. Direct, legally compelled access to the large US internet firms (PRISM), reaching stored email, chats, files and calls at the source.
• Encryption. A dedicated effort (BULLRUN) to defeat the cryptography that protects traffic, including covertly influencing commercial products and public standards.
• Hacking. Computer intrusion at industrial scale (the TAO unit, the QUANTUM techniques, an automated implant system called TURBINE) backed by a catalogue of hardware and firmware implants (the ANT catalog).
• Mobile and location. Mapping the world's mobile networks (AURORAGOLD), harvesting text messages (DISHFIRE), tracking location and travelling companions across billions of records (FASCIA, CO-TRAVELER), and in at least one case recording the content of an entire country's phone calls (MYSTIC).
• Metadata. The connective tissue, who contacted whom, when and from where, stored and chained in vast databases (MARINA, MAINWAY) and summarised into global heat maps (BOUNDLESS INFORMANT).

The funding tells you it was not a fringe activity. The classified US intelligence "black budget" for fiscal year 2013, itself among the leaked documents, came to about 52.6 billion dollars, of which the NSA's share was roughly 10.8 billion dollars. This was a core, richly resourced function of the state.

The point for this series is simple. If you run on infrastructure you do not control, this is the environment that infrastructure sits in. It is documented, not imagined, and it is the backdrop against which every later article about owning your systems should be read.

How to read the catalogue

The catalogue is organised by function into sixteen sections and two appendices. Each entry gives the program name, the agency or directorate that ran it, a short description, detailed information drawn from the documents, and the originating published document, cited by its archive filename (date, outlet and a short slug) so you can locate it yourself.

A few cautions on precision. Many documents are partial or redacted, so a program's full scope is sometimes only implied. A single codeword can name a program, a database, a tool, a cover term for a particular cable, or a security compartment, and the text notes which sense applies. Where a capability is clearly described but carries no codename in the released material, it is listed in section sixteen under an assigned label (Unidentified Project N). The agencies, for reference: NSA (United States), GCHQ (United Kingdom), CSE or CSEC (Canada), ASD or DSD (Australia), GCSB (New Zealand), with "Five Eyes" meaning all five together. Use what follows as a map, not a cover-to-cover read.

1. Bulk collection and corporate access (Special Source Operations)

Special Source Operations (SSO) is the NSA division that runs collection through corporate partnerships and cable access. It is split into two lines: PRISM (data obtained from U.S. internet companies under legal process) and Upstream (collection from the internet backbone and cables).

• PRISM (NSA, SIGAD US-984XN). Court-compelled collection of stored and live communications directly from major U.S. internet companies (Microsoft, Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, Apple). Described internally as "the SIGAD used most in NSA reporting." The PRISM dataflow routed tasking through PRINTAURA and the FBI's Data Intercept Technology Unit (DITU), with content feeding TRAFFICTHIEF, PINWALE (stored content), NUCLEON (voice), MAINWAY and MARINA (metadata). A dedicated analyst guide covers Skype collection under PRISM. Sources: 20130606-thewashingtonpost__prism, 20130608-theguardian__prism, 20130629-thewashingtonpost__prism, 20131022-lemonde__prism_april_2013, 20141228-derspiegel__guide_for_analysts_on_how_to_use_the_prism_skype_collection, 20140430-theintercept__prism_olympics.
• Upstream. Collection of communications as they transit fiber-optic cables and internet backbone, as distinct from PRISM. The published overview pairs Upstream (FAIRVIEW, STORMBREW, BLARNEY, OAKSTAR) with PRISM and tells analysts "you should use both." Sources: 20130710-thewashingtonpost__upstream, 20130608-theguardian__prism.
• FAIRVIEW (NSA SSO, SIGAD US-990). A large corporate-partner cable access program. The site books and dataflow charts show FAIRVIEW feeding processing systems (PINECONE SCIF, CONVEYANCE, NUCLEON, MAILORDER) and distributing to the main databases. Sources: 20161116-theintercept__fairview_site_book, 20161116-theintercept__fairview_dataflow_charts_april_2012, 20161116-theintercept__sso_corporate_overview.
• BLARNEY (NSA SSO). FISA-based corporate access program with its own site book and TDY handbook for travel to collection sites. Reported on April 2013 traffic. Sources: 20161116-theintercept__blarney_program_overview, 20161116-theintercept__blarney_site_book, 20161116-theintercept__blarney_report_april_2013.
• STORMBREW (NSA SSO, SIGAD US-983). Cable/chokepoint access run with a corporate partner, including international transit switch collection. Associated cover terms in the SSO maps: SILVERZEPHYR (US-3273), MADCAPOCELOT (US-3140), BLUEZEPHYR (US-3277). Sources: 20180320-theintercept__second_look_sso_20mar2012_wstormbrewmap, 20131104-thewashingtonpost__sso_overview.
• OAKSTAR (NSA SSO). An umbrella of corporate-partner accesses with weekly operational reporting and a travel handbook. Sub-accesses named in the weeklies and SSO maps include MONKEYROCKET (US-3206), SHIFTINGSHADOW (US-3217), ORANGECRUSH (US-3230), ORANGEBLOSSOM (US-3251), YACHTSHOP (US-3247), SILVERZEPHYR, DANCINGOASIS (US-3171), SPINNERET (US-3180) and MOONLIGHTPATH (US-3145). Sources: 20180320-theintercept__pages_from_oakstar_site_book_v1_0, 20180320-theintercept__pages_from_oakstar_weekly_2013_03_08 (and the other OAKSTAR weeklies).
• MONKEYROCKET (NSA SSO / OAKSTAR sub-program). A foreign access tied to counterterrorism and, per later reporting, to deanonymizing internet and Bitcoin users; the OAKSTAR weeklies track its equipment handoff and authority-to-operate. Sources: 20180320-theintercept__pages_from_oakstar_weekly_2013_03_29, 20180320-theintercept__entry_from_sso_news.
• SILVERZEPHYR / ORANGEBLOSSOM (NSA SSO International Transit Switch Collection). Programs authorized to collect transit traffic passing through U.S. gateways where both ends are foreign. Source: 20130816-thewashingtonpost__sid_oversight.
• DANCINGOASIS, SPINNERET, MOONLIGHTPATH, SHIFTINGSHADOW, ORANGECRUSH, YACHTSHOP, MADCAPOCELOT, BLUEZEPHYR (NSA SSO cover terms). Named accesses/cables within FAIRVIEW/STORMBREW/OAKSTAR, each with its own SIGAD. Sources: 20131014-thewashingtonpost__sso_collection_optimization, 20180320-theintercept__second_look_sso_20mar2012_wstormbrewmap.
• WINDSTOP (NSA + Second Party). A collective of collection accesses run with second-party (Five Eyes) partners against foreign targets; MUSCULAR and INCENSER sit under it. Sources: 20131104-thewashingtonpost__windstop, 20131104-thewashingtonpost__sso_overview.
• MUSCULAR (NSA/GCHQ, DS-200B). Collection from the internal fiber links between Google and Yahoo data centers, upstream of the companies' encryption, operated jointly with GCHQ. Internal notes record analysts complaining about its huge volume (roughly a quarter of the daily collect) versus modest value, and a proposal to throttle older Yahoo content. Sources: 20131030-thewashingtonpost__muscular, 20131030-thewashingtonpost__muscular_smiley, 20131126-thewashingtonpost__microsoft_monkey_puzzle.
• INCENSER (NSA/GCHQ, SIGAD DS-300). A high-volume cable access delivered via the GCHQ NIGELLA access and the GERONTIC partner; traffic viewable in XKEYSCORE through the GCHQ_INCENSER database. Source: 20141125-suddeutschezeitung__ptc_glossary, 20131104-thewashingtonpost__sso_overview.
• LITHIUM, ARTIFICE, SERENADE, STEELKNIGHT (NSA SSO corporate cover terms). Cover names used in corporate reporting so that the actual partner company is masked. Sources: 20131101-theguardian__corporate_reporting, 20161116-theintercept__sso_corporate_overview.
• RAMPART-A (NSA, third-party cable access). Referenced in the ECI listing as a tightly controlled "fact of" collection capability. Source: 20141010-theintercept__exceptionally_controlled_information_listing.
• SKIDROWE (NSA). A low-speed DNI (digital network intelligence) processing solution replacing WEALTHYCLUSTER2, feeding satellite/cable survey. Components include WEALTHYCLUSTER to TURNWEALTHY. Source: 20161116-theintercept__skidrowe_program.
• WEALTHYCLUSTER / WEALTHYCLUSTER2 (NSA). DNI content processing systems used to sessionize and select traffic at scale. Sources: 20161116-theintercept__skidrowe_program, 20131104-thewashingtonpost__windstop.

2. Databases, analytics and metadata systems

• XKEYSCORE (NSA, with Five Eyes). The NSA's most widely used digital-network exploitation system: a distributed set of collection sites each holding a rolling buffer (about three days of all unfiltered traffic, metadata indexed for longer), queryable by selectors (email, phone, cookies) and by "soft selectors" such as language or behavior. Used to find targets, reconstruct sessions, and cue hacking (MHS leverages XKEYSCORE for QUANTUM). Shared in parts with German services. Sources: 20130731-theguardian__xkeyscore_training_slides, 20130911 and 20131211 SVT XKEYSCORE slides, 20140618-derspiegel__details_on_xkeyscore_from_an_internal_gchq_website, 20140312-theintercept__mhs_leverages_xkeyscore_for_quantum.
• PINWALE (NSA). The principal stored-content database for digital network intelligence; holds months of intercepted content, searchable by standing queries that run daily for dissemination. Sources: 20171130-theintercept__pinwale_slides, 20141228-derspiegel__guide_for_analysts_on_how_to_use_the_prism_skype_collection.
• MARINA (NSA). The main internet metadata repository (contact chaining, pattern-of-life). Used alongside XKEYSCORE for target geolocation and activity. Was transitioning to a system called CLOUDRUNNER as of 2013. Sources: 20131014-thewashingtonpost__sso_collection_optimization_overview, 20180320 OAKSTAR weeklies, 20160906-theintercept__new_technique_geolocates_targets_active_at.
• MAINWAY (NSA). Telephony metadata repository used for storage, contact chaining and analysis of large volumes of call records, dating to the President's Surveillance Program; originally viewed through the "SIGINT Navigator" tool. Sources: 20130627-theguardian__nsa_oig_2009_report, 20130629-thewashingtonpost__prism.
• NUCLEON (NSA). Voice-content database; PRISM and other voice (including Skype) is routed here. Sources: 20130629-thewashingtonpost__prism, 20141228 PRISM Skype guide, 20140318 MYSTIC data-collection description.
• FASCIA (NSA). Massive repository of device/location metadata (DNR). Figures in the documents show billions of records (for example five billion received by FASCIA), underpinning cell-location and co-traveler analysis. Sources: 20131204-thewashingtonpost__fascia, 20131210-thewashingtonpost__cotraveler_overview.
• DISHFIRE (NSA/GCHQ). Database of SMS text messages collected worldwide (counts of roughly 194 million SMS per day in one slide), with the PREFER tool decoding content into structured tags. Sources: 20140116-theguardian__dishfire_presentation, 20130816-thewashingtonpost__sid_oversight.
• TRAFFICTHIEF (NSA, part of the TURBULENCE architecture). A real-time alerting/selection database of events on tasked selectors, fed from SSO and used to cue analysts and operations. Sources: 20130629-thewashingtonpost__prism, 20160906-theintercept__mhs_databases_as_of_14_august_2008.
• OCTAVE (NSA). A tasking/collection database (traditional SIGINT tasking) used to enrich tower and IMSI data, often cited beside FASCIA and OCTSKYWARD. Sources: 20131210-thewashingtonpost__cotraveler_overview, 20130816-thewashingtonpost__sid_oversight.
• TOYGRIPPE (NSA). Repository of VPN (IPsec) metadata profiles; IPsec metadata is converted to "TGIF" format and pushed here to profile VPNs for exploitation. Sources: 20140312-theintercept__vpn_and_voip_exploitation_with_hammerchant_and_hammerstein, 20141228 VPN/VALIANTSURF documents.
• ASSOCIATION, BANYAN, BROOMSTICK, CULTWEAVE, HOMEBASE, SPOTBEAM (NSA). Target-development and geospatial metadata databases listed as the standard toolset of language and target branches alongside MARINA, MAINWAY, PINWALE and XKEYSCORE. Sources: 20160906-theintercept__mhs_databases_as_of_14_august_2008, 20140825 ICREACH memo.
• CADENCE, CONVEYANCE, SCISSORS, MAILORDER (NSA SSO dataflow). Tasking and routing components: CADENCE is a selector-tasking system; SCISSORS sorts/labels collected sessions and blocks unwanted traffic (for example ownerless address books); CONVEYANCE and MAILORDER move/store content toward PINWALE. Sources: 20161116-theintercept__fairview_dataflow_charts_april_2012, 20130629-thewashingtonpost__prism, 20171130-theintercept__u_re_ehsanul_sadequee_fisa_request.
• JUGGERNAUT, LOPER (NSA). Technology/collection types feeding BOUNDLESS INFORMANT counts (telephony and other access types), used to add granularity to the metadata statistics. Source: 20131122-dagbladet__boundless_informant_faq.
• BOUNDLESS INFORMANT (NSA). A metadata summarizing and visualization tool that counts every DNI and DNR record from GM-PLACE (post-FALLOUT and post-TUSKATTIRE ingest) by organization, country and cover term, drawing the "heat maps" of collection by nation. FALLOUT (DNI) and TUSKATTIRE (DNR) are its ingest processors. Sources: 20130608-theguardian__boundless_informant_capabilities, 20130608-theguardian__boundless_informant_faq, 20140618-derspiegel__faqs_on_the_boundless_informant_program.
• FALLOUT, TUSKATTIRE (NSA). Ingest/normalization processors that feed metadata into BOUNDLESS INFORMANT and onward (FALLOUT for DNI, TUSKATTIRE for DNR); FALLOUT also routes IPsec metadata to TOYGRIPPE. Sources: 20130608/20131122 BOUNDLESS INFORMANT FAQs.
• NYMROD (NSA, Center for Content Extraction T1221). A name-matching system that finds people and places in databases and documents when a target's name is garbled or misspelled. Source: 20140618-derspiegel__explanation_of_nymrod...
• GHOSTMACHINE (NSA). A large analytic engine/framework (cloud-scale) hosting analytics such as OCTAVE feeds and QFD (query-focused dataset) results. Sources: 20140430-theintercept__ghostmachine, 20131210-thewashingtonpost__ghost_machine.
• DISTILLERY (NSA/GCHQ). A streaming analytic architecture (built on IBM InfoSphere Streams) for live, in-stream processing of data; GCHQ prototyped its use. Sources: 20160202-boingboing__gchq_malware, 20141228-derspiegel__national_information_assurance_research_laboratory_niarl_tundra.
• SYNAPSE (NSA). A data model/"knowledge" framework for contact chaining and entity relationships used in SIGINT analysis. Source: 20130928-thenewyorktimes__syanpse (filename as published), 20140218-theintercept__discovery_sigint_targeting_scenarios_and_compliance.
• SPCMA (NSA). "Special Procedures governing Communications Metadata Analysis": the authority and tooling that let trained analysts chain through U.S.-person identifiers in metadata without those identifiers being treated as the target. Sources: 20130928-thenewyorktimes__contact_chaining, 20140218-theintercept__discovery_sigint_targeting_scenarios_and_compliance.
• CLOUDRUNNER (NSA). The successor environment MARINA metadata was migrating to (noted in OAKSTAR weekly metrics). Source: 20180320 OAKSTAR weeklies.

3. Metadata sharing across agencies

• ICREACH (NSA). A bulk SIGINT metadata sharing platform giving other U.S. agencies (CIA, FBI, DEA and others) query access to communications metadata on a wholesale basis, successor in spirit to CRISSCROSS/PROTON. Delivered through the IC shared space on INTELINK via the GLOBALREACH federated query service. Sources: 20140825-theintercept__sharing_communications_metadata_across_the_usic_icreach, 20140825-theintercept__dni_decision_memorandum_on_icreach, 20140825-theintercept__icreach_black_budget_extract.
• CRISSCROSS / PROTON (NSA, with CIA and DEA). The earlier shared telephony-metadata databases and the analytic environment that preceded ICREACH; a point paper traces their history for the Director. Source: 20140825-theintercept__crisscrossproton_point_paper, 20140825-theintercept__metadata_sharing_memorandum.
• GLOBALREACH (NSA). The federated query service used to provide IC analysts "one-stop" access to the shared contact metadata, with PKI-based accounts and auditing; linked to a partition of FASCIA II for HCS-channel data. Source: 20140825-theintercept__icreach_sharing_sigint_comms_metadata_with_the_intel_community_memo.

4. Computer Network Exploitation: TAO, QUANTUM and the exploitation chain

Tailored Access Operations (TAO), later part of the Computer Network Operations (CNO) mission, is the NSA's hacking arm. Its Remote Operations Center (ROC) runs active operations. The broad initiative to put implants on large numbers of machines is GENIE; TURBINE automates the command and control of those implants at scale; TURMOIL is the passive sensor layer; together they sit in the TURBULENCE architecture.

• QUANTUM (NSA TAO). A family of "man-on-the-side" techniques that race the real server to answer a target's request first, redirecting or injecting from a privileged position on the backbone. Tasking splits into QUANTUMTHEORY (R&T analysts, deploys a stage-one implant VALIDATOR, successor COMMONDEER) and QUANTUMNATION (TOPI analysts, deploys a stage-zero implant SEASONEDMOTH/SMOTH that self-deletes in 30 days). Sources: 20131230-derspiegel__tao_quantum_tasking, 20131230-derspiegel__tao_quantum_theory, 20140312-theintercept__the_nsa_and_gchqs_quantumtheory_hacking_tactics.
• QUANTUMINSERT (NSA TAO). The best-known QUANTUM method: HTML redirection of a target's browser to a FOXACID exploit server. Sources: 20140312-theintercept__quantum_insert_diagrams, 20140312-theintercept__multiple_methods_of_quantum.
• QUANTUM sub-techniques. QUANTUMBOT (hijacks IRC botnets; QUANTUMBOT2 combines with Q-BISCUIT for web botnets); QUANTUMBISCUIT (redirection on keyword/cookie values); QUANTUMDNS (DNS redirection at the root); QUANTUMHAND (exploits a target who uses Facebook); QUANTUMSKY (denies access to a web page via RST-packet spoofing, in use since 2004); QUANTUMCOPPER (file download/upload corruption); QUANTUMPHANTOM (hijacks arbitrary IPs). Source: 20150117-derspeigel__overview_of_methods_for_nsa_integrated_cyber_operations, 20140312-theintercept__multiple_methods_of_quantum.
• FOXACID (NSA TAO). The exploit-server infrastructure that QUANTUMINSERT redirects targets to; standard operating procedures cover server setup, tag use and man-in-the-middle tools (SECONDDATE, MAGIC SQUIRREL, MAGICBEAN) and payload delivery. Sources: 20160819-theintercept__foxacid_overall_briefing_third_revision_redacted, 20160819-theintercept__foxacid_server_sop_redacted.
• TURBINE (NSA TAO). The automated command-and-control system for implants ("industrial-scale exploitation"): it talks to active and passive sensors/shooters, performs maintenance on router implants, and lets an app profile run across all TAO holdings. Sources: 20140312-theintercept__turbine_industrial_scale_exploitation, 20140315-theintercept__turbine_intelligence_command_and_control.
• TURMOIL (NSA). The passive SIGINT sensor layer (Layer 3+ event detection) in the TURBULENCE architecture; it detects packets (including IKE/ESP for VPNs), extracts metadata, and routes to downstream systems (FALLOUT, TOYGRIPPE), and hosts the VPN decryption services. Sources: 20140312-theintercept__turbine_and_turmoil, 20141228 VPN documents.
• TURBULENCE / TUMULT (NSA). TURBULENCE is the overarching sensor-and-attack architecture; TUMULT is the demux/Layer-2 stage in front of the TURMOIL sensor. Sources: 20131230-derspiegel__qfire, 20141228-derspiegel__decryption_of_vpn_connections_within_the_valiantsurf_program.
• GENIE (NSA TAO). The programmatic initiative to place and manage large numbers of implants; ANT implants are described as "GENIE-compliant" on the CHIMNEYPOOL framework. Sources: 20130830-cryptome__congressional_budget_2013, 20131230-jacobappelbaum__nsa_ant_catalog.
• QFIRE (NSA Technology Directorate). A pilot bringing QUANTUM "shooting" forward to the sensor edge ("forward-based defense") to cut response latency. Source: 20131230-derspiegel__qfire.
• VALIDATOR / COMMONDEER / SEASONEDMOTH (SMOTH) (NSA TAO implants). Stage-one and stage-zero implants delivered by QUANTUM; VALIDATOR hooks the target and OLYMPUS/UNITEDRAKE then load a fuller trojan. Source: 20131230-derspiegel__tao_quantum_tasking.
• OLYMPUS (NSA TAO implant). A mid-tier trojan implant loaded onto hooked targets, slated to be replaced by UNITEDRAKE. Source: 20131230-derspiegel__tao_quantum_theory.
• UNITEDRAKE (NSA TAO implant framework). A modular implant/collection framework with plug-ins (for example WISTFULTOLL for WMI/registry forensic harvesting); used with STRAITBIZARRE. Sources: 20131230-jacobappelbaum__nsa_ant_catalog, 20150117 CNO documents.
• STRAITBIZARRE / DAREDEVIL (NSA TAO). Implant/"shooter" platforms used in QUANTUMTHEORY operations. Source: 20140312-theintercept__the_nsa_and_gchqs_quantumtheory_hacking_tactics.
• SECONDDATE (NSA TAO). A man-in-the-middle tool that hijacks web requests to push targets to exploitation; FOXACID SOP mandates a specific MSGID for all SECONDDATE operations. Sources: 20160819-theintercept__introduction_to_baddecision_redacted, 20160819-theintercept__foxacid_server_sop_redacted.
• BADDECISION (NSA TAO). An 802.11 (Wi-Fi) CNE tool using a true man-in-the-middle and frame injection to redirect wireless users into exploitation. Source: 20160819-theintercept__introduction_to_baddecision_redacted.
• NIGHTSTAND (NSA TAO). An active 802.11 wireless exploitation and injection tool for delivering payloads into denied target space over the air. Sources: 20131230-jacobappelbaum__nsa_ant_catalog, 20160819-theintercept__introduction_to_wlan_cne_operations_redacted.
• HAMMERCHANT / HAMMERSTEIN (NSA TAO, router implants). Implants on routers that exfiltrate VoIP (HAMMERCHANT monitors SIP/H.323 and ships targeted RTP) and VPN/ESP traffic (HAMMERSTEIN) to TURMOIL for reconstruction and decryption. Source: 20140312-theintercept__vpn_and_voip_exploitation_with_hammerchant_and_hammerstein.
• FASHIONCLEFT (NSA). The protocol/interface used to exfiltrate data from implants and trojans back to the NSA. Sources: 20150117-derspeigel__technical_description_of_the_fashioncleft_protocol.
• FERRETCANNON (NSA TAO). A delivery category referenced in FOXACID SOP that fires JSOC/CIA tools (for example BEACHHEAD) and OLYMPUS/UNITEDRAKE payloads. Source: 20160819-theintercept__foxacid_server_sop_redacted.
• SHOTGIANT (NSA, Operation). Operation targeting the Chinese manufacturer Huawei: objectives were to exploit Huawei products that targets use, retain access to those communication lines, and understand whether Huawei's infrastructure aids the Chinese state. Source: 20140322-thenewyorktimes__operation_shotgiant_objectives.
• PUZZLECUBE (NSA TAO). The TAO tasking database for implants (implant config files, encryption keys), queried as part of the exploitation/collection chain. Source: 20160819-theintercept__foxacid_server_sop_redacted, 20150117 FASHIONCLEFT document.
• WHARPDRIVE (NSA SSO/TAO). A clandestine access capability referenced (a "WHARPDRIVE incident") in an SSO presentation. Source: 20140618-derspiegel__report_on_a_wharpdrive_incident_in_an_sso_presentation.

5. The ANT catalog (TAO Advanced/Access Network Technology implants)

A single 2008-era catalog (published 30 December 2013) lists roughly fifty hardware and software implants and surveillance gadgets offered by the ANT unit to TAO operators. They are built to GENIE-compliant frameworks (CHIMNEYPOOL, FREEFLOW) and families such as STRAITBIZARRE and COTTONMOUTH. Source for all items in this section: 20131230-jacobappelbaum__nsa_ant_catalog (cross-referenced where noted).

• DROPOUTJEEP. Software implant for the Apple iPhone (STRAITBIZARRE-based, CHIMNEYPOOL framework) giving remote access to files, SMS, contacts, voicemail, geolocation and microphone/camera.
• MONKEYCALENDAR. Software implant for GSM SIM cards that pulls handset geolocation and exfiltrates it by covert SMS.
• GOPHERSET. SIM-card implant that extracts phonebook, SMS and call logs via SMS.
• CANDYGRAM. A GSM "telephone tripwire" that mimics a target network's cell tower (900/1800/1900 MHz) and texts a watch phone when a target handset enters its area.
• CyLON / cell-site simulators (TYPHON HX, CYCLONE Hx9, EBSR, NEBULA). Portable base stations/network-in-a-box devices for GSM/UMTS collection and geolocation.
• COTTONMOUTH-I/-II/-III. USB hardware implants that provide a covert wireless bridge into a target network and can load exploits.
• IRONCHEF. BIOS/System Management Mode implant giving persistence and two-way RF communication with a hardware implant.
• DEITYBOUNCE. Persistence implant for Dell PowerEdge servers via BIOS/SMM.
• IRATEMONK. Hard-drive firmware implant (loaded via SLICKERVICAR with UNITEDRAKE or STRAITBIZARRE) that maintains persistence on Western Digital, Seagate, Maxtor and Samsung drives.
• SOUFFLETROUGH, SCHOOLMONTANA, SIERRAMONTANA, GOURMETTROUGH. BIOS/firmware implants for Juniper firewalls and routers.
• FEEDTROUGH. Persistence technique for two implants (BANANAGLEE and ZESTYLEAK) against Juniper NetScreen firewalls.
• HEADWATER. Persistent backdoor for selected Huawei routers.
• HALLUXWATER. Backdoor for Huawei Eudemon firewalls.
• JETPLOW. Firmware persistence for Cisco PIX and ASA firewalls (listed in the catalog alongside the above).
• RAGEMASTER. A hardware "retro-reflector" implant on a monitor's VGA cable that lets the screen image be recovered remotely (part of the ANGRYNEIGHBOR family; collected via VAGRANT/DROPMIRE-style techniques).
• SURLYSPAWN, TAWDRYYARD, LOUDAUTO, NIGHTWATCH. Retro-reflector/keystroke and radar-illuminated collection gadgets (ANGRYNEIGHBOR family): keystroke monitor, beacon, room-audio, and a portable unit to reconstruct VAGRANT screen signals.
• NIGHTSTAND. Wireless (802.11) exploitation and injection unit (see section 4).
• WAGONBED, TRINITY, MAESTRO-II, JUNIORMINT. Implant hardware modules/ "miniaturized" computer cores used to build the above.
• SOMBERKNAVE. Software implant that lets an otherwise air-gapped Windows machine beacon out over an unused 802.11 interface.
• ENTOURAGE, GENESIS, NEBULA, TYPHON, WATERWITCH. Handset/geolocation and direction-finding tools; GENESIS is a modified handset for covert SIGINT survey and geolocation in hostile environments.
• FIREWALK, HOWLERMONKEY. RF-communication implants (an Ethernet/USB implant and a general-purpose RF transceiver) used to bridge implanted machines to the outside.

6. Defeating encryption (BULLRUN and the CES exploitation chain)

• BULLRUN (NSA). The umbrella effort to defeat the encryption used in network communications, drawing on cryptanalysis, computer network exploitation, interdiction, covert relationships with industry, and influence over standards. Extremely sensitive; handled under its own classification guide and ECI compartments (for example PAWLEYS). The companion GCHQ effort is EDGEHILL. Sources: 20130905-theguardian__bullrun, 20130905-theguardian__sigint_enabling, 20141228-derspiegel__gchq_briefing_on_the_bullrun_program.
• SIGINT Enabling Project (NSA). The budget line that funds covert work to insert vulnerabilities, influence commercial products and shape standards so that traffic remains exploitable. Source: 20130905-theguardian__sigint_enabling.
• VALIANTSURF (NSA). The cover term for developing Data Network Cipher (DNC, i.e. VPN) exploitation inside TURMOIL for the TURBULENCE DNC thread. Source: 20141228-derspiegel__decryption_of_vpn_connections_within_the_valiantsurf_program.
• GALLANTWAVE (NSA). The decryption engine/service that decrypts VPN traffic within LONGHAUL. Sources: 20141228-derspiegel__explanation_of_the_gallantwave_that_decrypts_vpn_traffic_within_longhaul.
• LONGHAUL (NSA, Cryptanalysis and Exploitation Services). The end-to-end attack orchestration and key-recovery service; the "attack orchestrator" POISONNUT and DNC metrics run on dedicated TURMOIL hosts ("CA Servers") and talk to LONGHAUL over the ISLANDTRANSPORT message bus. Sources: 20141228 VPN documents.
• POISONNUT (NSA). The VPN Attack Orchestrator (and DNC metrics service) that drives decryption within LONGHAUL. Source: 20141228-derspiegel__explanation_of_the_poisennut_product_and_its_role_when_attacking_vpn.
• KEYCARD (NSA). The tasking/lookup service that TURMOIL queries per IKE/ESP session to decide whether an IP is targeted for decryption (tasking labeled "TRANSFORM" to avoid the word "decrypt"). Source: 20141228 VPN documents.
• APEX (NSA). The component that reconstructs and reinjects VoIP/VPN packets (IKE, ESP, RTP) to the TURMOIL VPN components across the three "Spin" phases of VPN exploitation. Source: 20140312-theintercept__vpn_and_voip_exploitation_with_hammerchant_and_hammerstein.
• SPIN9 (NSA). An end-to-end VPN attack program/phase referenced in the VPN exploitation chain. Source: 20141228-derspiegel__explanation_on_the_spin9_program_on_end_to_end_attacks_on_vpn.
• MALIBU (NSA). The architecture used to exploit VPN communications (IKE/ESP metadata and transform flows feeding stage-one processing). Source: 20141228-derspiegel__malibu_architecture_overview_to_exploit_vpn_communication.
• SCARLETFEVER (NSA). An SSL/TLS attack capability in the Transform/DNC product set. Source: 20141228-derspiegel__decryption_of_vpn_connections_within_the_valiantsurf_program.
• PRESSUREWAVE (NSA). The metadata/content object store ("PWV") used by legacy analytics; application sessions are delivered here via format conversion (EXOPUMP) for analysis and pushed on to TOYGRIPPE. Source: 20141228 VPN documents.
• METROTUBE, ISLANDTRANSPORT / ISLANDHIDEAWAY, TUBE (NSA). The messaging/transport fabric that moves events and metadata between the exploitation components. Source: 20141228 VPN documents.
• BLUESNORT (NSA/IAD). A network-defense sensor that receives decrypted traffic reinjected by TURMOIL to detect malicious activity. Source: 20141228-derspiegel__bluesnort_program_on_net_defense_from_encrypted_communications.
• TUNDRA (NSA, NIARL). A research project into a new statistical technique for codebook (block-cipher, including AES) cryptanalysis. Source: 20141228-derspiegel__national_information_assurance_research_laboratory_niarl_tundra.
• WOLFRAMITE (NSA/GCHQ, mobile encryption). Definition and prototyping of an attack on GSM A5/3 mobile encryption. Source: 20141204-theintercept__wolframite_encryption_attack.
• OPULANT PUP (NSA, mobile encryption). A companion mobile-encryption attack effort reported with WOLFRAMITE. Source: 20141204-theintercept__opulant_pup_encryption_attack.
• FLYING PIG (GCHQ). A GCHQ database of SSL/TLS session metadata (used, among other things, to analyze encrypted connections and target certificate authorities). Source: 20141228-derspiegel__analysis_from_ssl-tls_connections_through_gchq_in_the_flying_pig_database.

7. Mobile networks, SMS and geolocation

• MYSTIC (NSA SSO). A program capable of recording the content of an entire country's telephone calls and replaying them (a 30-day rolling "retrospective retrieval" buffer, the voice tool being RETRO). Country accesses are given their own cover terms. Sources: 20140318-thewashingtonpost__mystic_program, 20140318-thewashingtonpost__description_of_data_collection_under_mystic, 20140519-theintercept__mystic.
• SOMALGET (NSA, MYSTIC sub-program). The full-take, full-content collection capability under MYSTIC deployed where the NSA records all call audio; documents place its accesses in the Bahamas and one other country. Source: 20140519-theintercept__somalget.
• SCALAWAG, ACIDWASH, OILYRAG, DUSKPALLET, EVENINGEASEL (NSA, MYSTIC country cover terms). Per-country MYSTIC accesses (for example SCALAWAG/US-3310BG, which over-collected beyond its bandwidth). Sources: 20140519-theintercept__sso_mystic_charts, 20140318-thewashingtonpost__description_of_data_collection_under_mystic.
• CO-TRAVELER (NSA). An analytic suite that finds unknown associates of a target by correlating cell-location data (who travels together, who turns phones on/off together). Sources: 20131210-thewashingtonpost__cotraveler_overview, 20131204-thewashingtonpost__fascia.
• CHALKFUN (NSA, with the Australian "DSD Co-Travel" analytic). A FASCIA-based analytic used in CO-TRAVELER to compute co-location. Source: 20131210-thewashingtonpost__cotraveler_overview.
• HAPPYFOOT (NSA). An analytic that aggregates leaked location-based-service and location-aware-app data to map IP addresses to physical geolocations. Source: 20131210-thewashingtonpost__location_cookies.
• AURORAGOLD (NSA, Wireless Portfolio Management Office). An effort to gather and analyze data on the world's GSM/UMTS mobile networks (including intercepting internal GSMA and carrier IR.21 documents) to anticipate and exploit new mobile technologies. Related mechanism IR21 is a technology-warning feed. Sources: 20141204-theintercept__auroragold_project_overview, 20141204-theintercept__auroragold_working_group, 20141204-theintercept__ir21_a_technology_warning_mechanism.
• DISHFIRE / PREFER. See section 2 (SMS database and content-tagging tool).
• OCTSKYWARD, SEDB (NSA). Cell-tower and summary databases (the SIGINT Emitter Database, tower query-focused datasets) used with OCTAVE and FASCIA to turn IMSIs into locations. Source: 20160906-theintercept__new_technique_geolocates_targets_active_at.
• VICTORYDANCE (NSA/CIA). A mission in Yemen that mapped the Wi-Fi fingerprint of nearly every major town, supporting drone and other operations. Source: 20140211-theintercept__drones_intercepting_communications.
• GILGAMESH / SHENANIGANS (NSA). Airborne geolocation capabilities (a drone-mounted device that mimics a cell tower to locate SIMs, and an airborne survey of wireless signals) described in reporting on using communications intercept to find targets. Source: 20140211-theintercept__drones_intercepting_communications.
• WOLFRAMITE / OPULANT PUP. Mobile encryption attacks (see section 6).
• DRTBOX (NSA, "DRT box"). A direction-finding/collection appliance (from Digital Receiver Technology) whose record counts appear in BOUNDLESS INFORMANT statistics for France and others. Source: 20131021-lemonde__boundless_informant_france.
• Converged-device analysis / "Mobile Theme" (NSA/GCHQ). Analytic programs targeting data from smartphones by correlating device identifiers (IMEI/IMSI) with network and app data. Sources: 20140127-thenewyorktimes__converged_analysis_on_smartphone_devices, 20140127-thenewyorktimes__mobile_theme_briefing.

8. FORNSAT and satellite collection (Menwith Hill and partner sites)

Foreign satellite collection (FORNSAT) intercepts the downlinks of commercial and other satellites. Menwith Hill Station (MHS) in England is the hub for much of what follows.

• APPARITION (NSA/MHS). A precision geolocation capability for foreign VSAT (very small aperture terminal) satellite links; reached initial operating capability at Misawa, Japan. Sources: 20160906-theintercept__apparition_becomes_a_reality_new_corporate_vsat, 20160906-theintercept__apparition_ghosthunter_tasking_info.
• GHOSTHUNTER (NSA/GCHQ, MHS and SOUNDER). A VSAT geolocation and mapping system (works with APPARITION), used for higher-priority and operational tasking, including geolocating internet cafes. Sources: 20160906-theintercept__ghosthunter_goes_global, 20160906-theintercept__ghosthunter_and_the_geolocating_of_internet_cafes, 20160906-theintercept__ghosthunter_tasking_process.
• ELEGANT CHAOS / "collect it all" (ASPHALT, BLACKTOP, TARMAC) (NSA/MHS). The MHS "collect-it-all / survey-it-all / process-it-all" stack: ASPHALT collects, BLACKTOP surveys, TARMAC processes, feeding analysis at scale (ELEGANTCHAOS). Sources: 20160906-theintercept__elegant_chaos_collect_it_all_exploit_it_all, 20160906-theintercept__mhs_initiatives_maximizing_our_access.
• DARKQUEST (NSA/MHS). An automated FORNSAT survey system (paired with STORMFORCE modems and TORUS antennae) for surveying satellite signals at scale. Source: 20160906-theintercept__elegant_chaos_collect_it_all_exploit_it_all.
• ROADBED (NSA). A FORNSAT survey database recording satellite "CASNs" and digraphs (which satellite a given intercept came from). Source: 20160906-theintercept__traffic_series_is_your_collection_surveyed_or.
• MOONPENNY, LADYLOVE, JACKNIFE, CARBOY (NSA/GCHQ CARD sites). The lead FORNSAT collection and processing sites: MOONPENNY (Menwith Hill), LADYLOVE (Misawa), JACKNIFE (west-coast USA), CARBOY (Bude, UK). Source: 20160906-theintercept__apparition_ghosthunter_tasking_info.
• NOSEYPARKER, ASPHALT (NSA/MHS protocol exploitation). DNR/DNI protocol-exploitation feeds forwarded to knowledge bases from MHS access. Source: 20160906-theintercept__mhs_initiatives_maximizing_our_access.
• FALLOWHAUNT (NSA). A FORNSAT architecture for exploitation targeting VSAT, scalable to site needs. Source: 20180301-theintercept__fornsat_technologies_nsa.
• CANYONDUST (NSA). A FORNSAT coverage/analysis capability (coverage-region documentation). Source: 20180301-theintercept__canyondust_coverage_regions_nsa.
• RAINFALL / Pine Gap (NSA/NRO, Australia). Satellite-intelligence collection associated with the Pine Gap facility (joint Defence Facility), handled under the TALENT KEYHOLE compartment. Sources: 20170819-theintercept__rainfall_pine_gap_classification_guide, 20170819-theintercept__pine_gap_site_profile, 20170819-theintercept__nro_sigint_guide_pine_gap.
• MASTERSHAKE (NSA). A database ingesting MHS/FORNSAT output. Source: 20160906-theintercept__apparition_becomes_a_reality_new_corporate_vsat.

9. GCHQ (United Kingdom) programs

• TEMPORA (GCHQ). GCHQ's bulk interception of fiber-optic cables, described internally as "the world's largest XKEYSCORE": over 1,000 machines processing more than 40 billion items, buffered and made available to qualified NSA users. Sources: 20140618-derspiegel__report_on_the_nsas_access_to_tempora, 20140618-derspiegel__gchq_report_on_the_technical_abilities_of_tempora.
• OPTIC NERVE (GCHQ). Bulk collection of still images from Yahoo webcam video chats (one image every few minutes from millions of accounts), with a significant fraction containing nudity. Source: 20140227-theguardian__gchq_optic.
• SQUEAKY DOLPHIN (GCHQ). Broad real-time monitoring and analysis of social-media activity (YouTube views, Facebook likes, Blogger) for "psychology"-style situational awareness. Source: 20140127-nbc__squeaky_dolphin.
• ROYAL CONCIERGE (GCHQ). Monitoring of hotel-reservation confirmations to track the travel of diplomats and other targets and to enable operations against them. Sources: 20131117-derspiegel__royal_concierge, 20140404-theintercept__gchq_full_spectrum_cyber_effects.
• JTRIG (GCHQ, Joint Threat Research Intelligence Group). The unit for covert online effects: a large wiki of tools and techniques for propaganda, deception, denial, disruption and "honey trap" operations, including targeting hacktivists and using social media against targets. Sources: 20140714-theintercept__jtrigall, 20140207-nbc__gchq_honey_trap_cyber_attack_background_on_jtrig, 20140224-theintercept__training_for_covert_online_operations.
• HACIENDA (GCHQ, JTRIG/CITD). A port-scanning and reconnaissance tool used to map entire countries or subnets, identifying exploitable services and operational relay boxes. Source: 20140815-heiseonline__hacienda_program.
• PRESTON (GCHQ). A lawful-intercept collection and processing architecture (warranted interception) with its own business processes and feeds into TERRAIN/HAUSTORIUM. Sources: 20160606-theintercept__preston_architecture, 20160606-theintercept__preston_business_processes, 20160606-theintercept__preston_study.
• MILKWHITE (GCHQ). An enrichment service/program (part of the Communications Capability Development Programme) sharing mobile and communications data with other UK agencies (for example HMRC). Sources: 20160606-theintercept__milkwhite, 20160606-theintercept__communications_capability_development_programme.
• MUTANT BROTH (GCHQ). A database/analytic that stores target-detection events (for example cookies and GTP convergence data) from mobile network traffic, used to find and track devices. Sources: 20141214-theintercept__gchq_mobile_networks_in_my_noc_world, 20160606-theintercept__mobile_apps_checkpoint_meeting_archives.
• KARMA POLICE (GCHQ). A program to build a profile of the web-browsing habits of internet users (referenced across the mobile/NOC material). Source: 20160606-theintercept__mobile_apps_checkpoint_meeting_archives.
• OP SOCIALIST (GCHQ). The operation that hacked the Belgian telecom Belgacom and its GRX roaming exchange, using MERION ZETA CNE access to engineers' machines, to enable mobile interception. Sources: 20130920-derspiegel__belgacom, 20141214-theintercept__gchq_mobile_networks_in_my_noc_world.
• OP WYLEKEY, OP INTERACTION (GCHQ). Exploitation of international mobile billing clearing houses (WYLEKEY) and development of knowledge of mobile gateways (INTERACTION). Source: 20141214-theintercept__gchq_mobile_networks_in_my_noc_world.
• SALAMANCA (GCHQ). A telephone call-record event dataset (classified STRAP2 CHORDAL) collecting call records from many sources, used in contact analysis with FIVE ALIVE and HRMap. Source: 20160202-boingboing__gchq_malware.
• GERONTIC (GCHQ, partner/access cover term). A GCHQ cable-access relationship (Cable and Wireless/Vodafone-linked) that delivers traffic (for example the NIGELLA access feeding INCENSER). Sources: 20141125-suddeutschezeitung__mti_access_project_weekly_status (series), 20141125-suddeutschezeitung__ptc_glossary.
• DAPINO GAMMA (GCHQ CNE). Operations against the SIM-card manufacturer Gemalto to steal encryption keys (Ki values) at scale, enabling decryption of mobile communications. Sources: 20150219-theintercept__dapino_gamma_cne_presence_wiki, 20150219-theintercept__dapino_gamma_gemalto_yuaawaa_wiki, 20150219-theintercept__where_are_these_keys.
• CCNE (GCHQ "mobile network CNE"). Email-address harvesting and statistics from exploitation of core mobile networks (trial data Jan to Mar 2010), including PCS harvesting at scale. Sources: 20150219-theintercept__ccne_email_harvesting_jan10_mar10_trial, 20150219-theintercept__pcs_harvesting_at_scale.
• NAC / MyNOC (GCHQ Network Analysis Centre). Quarterly reviews of network-exploitation operations (NOC = network operations), documenting CNE access to targets. Sources: 20141214-theintercept__gchq_nac_review_* (four quarters).
• LOVELY HORSE (GCHQ). A project to monitor and ingest open-source/social-media feeds (including security researchers' Twitter accounts) for cyber-defense awareness. Source: 20150204-theintercept__lovely_horse.
• FULL-SPECTRUM CYBER EFFECTS (GCHQ). The doctrine document setting out effects operations (deny, disrupt, degrade, deceive) including SALAMANCA and ROYAL CONCIERGE. Source: 20140404-theintercept__gchq_full_spectrum_cyber_effects.
• STARGATE / CSEC CNE requirements (GCHQ/CSEC). Network CNE requirements documentation. Source: 20141214-theintercept__gchq_stargate_cne_requirements.

10. CSE / CSEC (Canada) programs

• LEVITATION (CSE). A behavior-based target-discovery project that analyzes records of file downloads/uploads from free file-hosting sites to find targets. Sources: 20150128-cbc__cse_presentation_on_the_levitation_project, 20150128-theintercept__cse_presentation_on_the_levitation_project.
• OLYMPIA (CSE). CSE's network-knowledge engine with automated tradecraft, used to map and find vulnerable devices on target networks (used in LONGRUN-type operations). Sources: 20141204-theintercept__nsa_gchq_csec_network_tradecraft_advancement, 20150128 LEVITATION presentations.
• WARRIORPRIDE (CSE/Five Eyes). A scalable, portable CNE platform unified across the Five Eyes (the FBI/GCHQ naming varies), with REPLICANTFARM as a signature-based alerting module built on its output. Sources: 20150117-derspeigel__csec_document_on_the_handling_of_existing_trojans_when_trojanizing_computers, 20150117-derspeigel__sample_code_of_malware_program_from_five_eyes_alliance.
• EONBLUE / CSEC sensors. Network-defense/sensor tradecraft referenced in the CSEC network tradecraft advancement material. Source: 20141204-theintercept__nsa_gchq_csec_network_tradecraft_advancement.

11. Network mapping and situational awareness

• TREASURE MAP (NSA, NTOC Office of Technology Development V45). A near-real-time, interactive map of the global internet "to map any device, anywhere, all the time," correlating router, autonomous-system and endpoint data for situational awareness and operational planning. Sources: 20140914-derspiegel__treasure_map_presentation, 20140914-derspiegel__treasure_map_announces_a_new_release.
• FOXTRAIL (NSA). A database of passively intercepted domain WHOIS records (and related internet-registry data) used for network geolocation and analysis. Source: 20150204-theintercept__open_source_for_cyber_defence_progress.
• RONIN (NSA, NTOC). A system tracking network nodes/relays ("last seen" node tracking), used in cyber-defense and anonymity-network work. Sources: 20131004-theguardian__tor_stinks, 20150204 cyber-defense material.
• PACKAGED GOODS / network reconnaissance. Traceroute and routing reconnaissance referenced alongside TREASURE MAP (mapping transit of target traffic). Source: 20140914-derspiegel__treasure_map_presentation.

12. Other agencies and partner programs

• SANDKEY (NSA/DEA). A joint DEA/NSA program intercepting the communications of maritime vessels (narcotics interdiction), tipped off by informants on a boat's movements. Source: 20140610-cryptome__dea-nsa-sandkey.
• DEA Warfighter / DEA support (NSA/DEA). NSA SIGINT support to the DEA's counter-narcotics mission. Source: 20140519-theintercept__dea_warfighter.
• Identity Intelligence / Biometrics (NSA, S2). An NSA effort to fuse biometric and biographic data (facial images, fingerprints, iris) with SIGINT to identify targets. Source: 20140531-thenewyorktimes__identity-intelligence.
• SPEARGUN (NSA/GCSB, New Zealand). A project to tap a submarine cable landing in New Zealand (Southern Cross) for metadata collection. Source: 20140914-theintercept__speargun_underway, 20140914-theintercept__speargun_phase_one.
• SATC (NSA, Brazil). Collection activity against Brazil (including the state oil company and government), reported from a BOUNDLESS INFORMANT-style breakdown. Source: 20130903-oglobo__satc.
• Directorate of Terrorist Identities (NCTC/NSA watchlisting). Watchlist guidance and the DTI "strategic accomplishments" documents that govern how identities are nominated to terrorism watchlists. Sources: 20140723-theintercept__watchlist_guidance_march_2013_1, 20140805-theintercept__directorate_of_terrorist_identities_strategic_accomplishments_2013.

13. Counter-intrusion and "fourth-party" collection

"Fourth-party collection" means the NSA watching, or riding on, another country's hacking so as to steal its take or use its tools.

• BYZANTINE HADES (NSA). The umbrella name for a set of Chinese state computer-network intrusions that the NSA tracked, countered (via TUTELAGE) and exploited. Sources: 20150117-derspeigel__analysis_of_chinese_methods..., 20150117-derspeigel__nsa_program_tutelage_to_instrumentalize_third_party_attack_tools.
• TUTELAGE (NSA). An active network-defense system that detects and blocks incoming attacks (for example BYZANTINE HADES) and can also turn third-party attack tools to the NSA's own use. Source: 20150117-derspeigel__nsa_program_tutelage_to_instrumentalize_third_party_attack_tools.
• TRANSGRESSION (NSA). A program to discover, analyze and exploit foreign computer-network attack and exploitation (CNA/CNE) operations, i.e. riding other actors' intrusions. Source: 20150117-derspeigel__overview_of_the_transgression_program...
• SNOWGLOBE (NSA/CSE). Analysis attributing a sophisticated espionage malware (later known publicly as Babar) to a French government actor, examined for whether it could be turned to NSA interests. Sources: 20150117-derspeigel__nsa_example_snowglobe..., 20140321-lemonde__french_intelligence_email_spying_operation.
• MAKERSMARK, VOYEUR (NSA). "Fourth-party" leads: MAKERSMARK tracks a Russian-linked actor's tools; VOYEUR is an Iran-linked lead. Source: 20150117-derspeigel__combination_of_offensive_and_defensive_missions_how_fourth-party_missions_are_being_performed.
• DEFIANTWARRIOR (NSA). Use of compromised third-party computers ("bots," fed from BOXINGRUMBLE) as disposable operational infrastructure/relays. Source: 20150117-derspeigel__overview_on_the_nsa_use_of_bots_and_the_defiantwarrior_program.
• QUANTUMTHEORY at SARATOGA (NSA TAO). A recorded operational success: QUANTUMTHEORY's first week at the SARATOGA access exploited a Pakistani target for TAO's R&T organization. Source: 20160819-theintercept__sso_news_excerpt_redacted.

14. Anonymity networks (Tor) targeting

• EGOTISTICAL GIRAFFE (NSA). Exploitation of the Tor Browser Bundle by attacking vulnerable Firefox versions, after using QUANTUM/FOXACID to get a target onto an exploit server. Source: 20131004-theguardian__egotistical_giraffe.
• EGOTISTICAL GOAT (EGGO) / ERRONEOUS INGENUITY (ERIN) (NSA). Named Firefox exploit techniques used against Tor users for specific browser-version ranges. Source: 20131004-theguardian__egotistical_giraffe.
• TOR STINKS (NSA/GCHQ). A briefing assessing the difficulty of deanonymizing Tor users at scale and the partial techniques available (traffic analysis, running nodes, cueing from QUANTUM). Source: 20131004-theguardian__tor_stinks.
• MJOLNIR (NSA/GCHQ). A tool/framework for building Tor circuits and manipulating Tor traffic (including a Windows GUI) used in Tor research. Source: 20131004-thewashingtonpost__tor.
• MULLENIZE (GCHQ). A technique for "staining" individual users (user-agent staining) so their traffic can be told apart within shared connections. Source: 20131004-thewashingtonpost__gchq_mullenize.
• Tor hidden-service and deanonymization analytics (NSA/GCHQ). Analysis of the security of Tor hidden services and potential techniques to deanonymize Tor users. Sources: 20141228-derspiegel__analytics_on_security_of_tor_hidden_services, 20141228-derspiegel__potential_technique_to_deanonymise_users_of_tor_network.

15. Compartments, cover terms and classification systems

These are not collection programs in themselves; they are the control markings that protect the programs above. They appear throughout the archive and are worth cataloguing because they map the hidden structure.

• STELLARWIND (NSA). The umbrella codename for the post-9/11 warrantless President's Surveillance Program (bulk phone and internet metadata and content), governed by its own classification guide. Sources: 20140311-thenewyorktimes__classification_guide_for_stellarwind_program_0, 20130627-theguardian__nsa_oig_2009_report.
• RAGTIME (NSA). The compartment/cover for certain FISA and Protect America Act collection (sub-labels such as RAGTIME-C), controlling who may see raw FISA/PAA traffic. Sources: 20140311-thenewyorktimes__classification_guide_for_fisa..., 20171130-theintercept__fisa_guide.
• SENTRY EAGLE (NSA/JFCC-NW). The top-level compartment protecting the NSA's computer-network-operations secrets, with subordinate "Sentry" programs (for example SENTRY HAWK, FALCON, OSPREY, RAVEN, CONDOR, OWL) covering CNE, CNA, cryptanalysis, SIGINT-enabling and TAREX. Sources: 20141010-theintercept__sentry_eagle_brief_sheet, 20141010-theintercept__cno_core_secrets_security_structure, 20141010-theintercept__cno_core_secrets_slide_slices.
• ECI (Exceptionally Controlled Information). A tier of extra-sensitive compartments above normal TS/SI. The archive includes an ECI listing and specific ECI guides: WHIPGENIE (SSO relationships with U.S. corporate partners), PAWLEYS (a BULLRUN-related cryptanalysis compartment), AMBULANT, APERIODIC, PAINTEDEAGLE, PITCHFORD, PENDLETON, PICARESQUE, PIEDMONT, REFRACTOR and others. Sources: 20141010-theintercept__exceptionally_controlled_information_listing, 20141010-theintercept__eci_compartments, 20141010-theintercept__eci_whipgenie_classification_guide, 20141010-theintercept__eci_pawleys_classification_guide.
• WHIPGENIE (NSA ECI). The compartment protecting SSO's relationships with U.S. corporate partners (the "fact of" the partnerships). Source: 20141010-theintercept__eci_whipgenie_classification_guide.
• PAWLEYS (NSA ECI). The compartment protecting the most sensitive BULLRUN cryptanalysis sources and methods. Source: 20141010-theintercept__eci_pawleys_classification_guide.
• TAREX (NSA Target Exploitation). A program conducting clandestine and covert HUMINT-enabled collection (physical access, supply-chain interdiction support) in support of SIGINT. Source: 20141010-theintercept__tarex_classification_guide.
• TALENT KEYHOLE (U.S. IC). The control system for space-based (satellite) collection; it marks the Pine Gap and Menwith Hill satellite material. Sources: 20170819 Pine Gap documents, 20160906-theintercept__menwith_satellite_classification_guide.
• GAMMA (NSA/GCHQ). A control marking for especially sensitive SIGINT (used, for example, on some CNE-derived and partner material). Sources: 20150219 DAPINO GAMMA documents, 20131014-thewashingtonpost__sso_collection_optimization_overview.
• STRAP 1 / STRAP 2 / STRAP 3 (GCHQ). The UK's internal sensitivity tiers (STRAP3 highest), seen on most GCHQ documents, sometimes with further codewords (for example CHORDAL on SALAMANCA). Sources: throughout the GCHQ set (for example 20160606 PRESTON documents).
• PINECONE (NSA). An SSO processing/selection compartment-marked environment (RGT-A/RGT-C) in the FAIRVIEW dataflow. Source: 20161116-theintercept__fairview_dataflow_charts_april_2012.
• CNO Core Secrets (NSA). The body of the most sensitive facts about NSA's cryptologic and CNO capabilities (including SIGINT-enabling of commercial products), protected under SENTRY EAGLE. Source: 20141010-theintercept__cno_core_secrets_slide_slices.

16. Unidentified programs (described in the documents, no codename released)

Where the archive describes a distinct capability or operation but the released pages give it no cover term, it is listed here under an assigned label. The label is mine, for reference only; it is not an NSA codename.

• Unidentified Project 1: Radicalizer reputation targeting. A document identifies six "radicalizers" (none accused of terrorism) and proposes discrediting them by exposing online sexual activity ("viewing sexually explicit material online") and other personal vulnerabilities gathered through SIGINT. No program codename is given. Source: 20131126-thehuffingtonpost__radicalizers_pornography.
• Unidentified Project 2: Advertising-cookie target pinpointing. Slides show the NSA using commercial tracking cookies, notably Google's "PREF" cookie, to single out a target's browser and hand that identifier to TAO for QUANTUM exploitation. The cookie-to-target technique is described but not separately codenamed (the related location analytic is HAPPYFOOT). Source: 20131210-thewashingtonpost__location_cookies.
• Unidentified Project 3: Airport Wi-Fi traveler tracking (CSE). A CSE trial used IP-session metadata from a Canadian airport's public Wi-Fi to track travelers' devices as they reappeared at other airports and hotspots over the following days, as a proof of concept for a tool to find a target from a single observed identifier. No codename is given (tradecraft later tied to CSE's network-analysis engine). Source: 20140131-cbc__csec_airport_wifi_tracking.
• Unidentified Project 4: ASD 3G bulk collection and data sharing (Australia). Documents show the Australian Signals Directorate collecting from 3G mobile networks in the region and offering to share bulk metadata, including data on ordinary (non-target) citizens, with partners. No single codename appears. Sources: 20131117-theguardian__dsd_3g, 20131202-theguardian__dsd_data.
• Unidentified Project 5: Leaky mobile-app data exploitation. A joint NSA/GCHQ effort to pull personal data (location, device identifiers, profile data) from the traffic of "leaky" smartphone apps such as Angry Birds and from ad/analytics networks. The broad effort is described across briefings but no one codename is attached in these pages (it sits alongside the mobile "surge" and WARRIORPRIDE). Sources: 20140128-theguardian__leaky_phone_apps_1, 20140128-theguardian__leaky_phone_apps_2.
• Unidentified Project 6: Microsoft cloud access ("Monkey Puzzle"). SSO material describes engineering access around Microsoft services (Outlook.com/Hotmail SSL, SkyDrive, Skype) so that content remains collectable; "Monkey Puzzle" appears as an internal nickname rather than a formal program name. Sources: 20131126-thewashingtonpost__microsoft_cloud_exploitation, 20131126-thewashingtonpost__microsoft_monkey_puzzle.
• Unidentified Project 7: Online virtual-world exploitation. Reporting and documents describe intelligence collection inside multiplayer games and virtual worlds (World of Warcraft, Second Life, Xbox Live), including deploying operatives and collecting player data. No single program codename is released. Source: 20131209-thenewyorktimes__nsa_games.
• Unidentified Project 8: COP15 Copenhagen conference interception. A document describes the plan and capability to collect communications of delegations around the 2009 Copenhagen climate summit. No codename appears on the released page. Source: 20140130-informationdk__cop15_interception_document.
• Unidentified Project 9: G20 Toronto summit collection. Documents show NSA collection around the 2010 G20 summit in Toronto, run with Canadian support. Described as an operation without a released codename. Source: 20131202-cbc__g20.
• Unidentified Project 10: "Follow the Money" financial collection (reported codename TRACFIN). A branch nicknamed "Follow the Money" collects credit-card and bank-transaction data into a financial database that outside reporting names TRACFIN; the codename is not legible in the archived page, so the capability is listed here. Source: 20130916-derspiegel__credit_card_transactions.
• Unidentified Project 11: Embassy and mission close-access collection. Close-access collection against foreign embassies, missions and EU offices is documented through techniques and SIGADs (for example DROPMIRE against an EU cryptofax, HIGHLANDS, VAGRANT, WABASH), but the overall close-access campaign is described by technique and SIGAD rather than one program name. Sources: 20130630-theguardian__dropmire, 20131021-lemonde__close_access_sigads, 20131027-derspiegel__embassy.
• Unidentified Project 12: Mobile-handset "find" / silent-call geolocation (STALKER tool). A Five Eyes capability to geolocate satellite and GSM phones by placing a silent call to the handset is described, with a tool component named STALKER but no overarching program codename. Sources: 20150128 LEVITATION presentations, 20140714-theintercept__jtrigall.

Where this leads: taking control back

Read in one sitting, the catalogue can feel like a counsel of despair. It is the opposite. Almost every program in it depends on a specific, ordinary weakness: data handed to a third party, a cable left unencrypted, a standard quietly weakened, a device bought through a supply chain nobody checked, a phone that trusts its carrier. Each of those is a choice, and each can be made differently.

The third article in this series takes exactly that view. It sets out how an organisation, or a state, that takes its own security seriously would structure its communications to deny these programs their footholds: owning the hardware and the cryptographic keys, controlling the physical path, and facing the uncomfortable truth that the only channel none of this can reach is the one that is never electronic at all. If this article is the threat, the next one is the response.

Appendix A: Special Source Operations cover-term index

A quick cross-reference of the SSO "cover terms" (each masks a cable, access or partner), with their SIGADs where the documents give them.

• FAIRVIEW: US-990 (Upstream corporate partner).
• STORMBREW: US-983 (Upstream corporate partner / chokepoints).
• BLARNEY: FISA corporate access.
• OAKSTAR: umbrella; sub-accesses below.
• SILVERZEPHYR: US-3273. ORANGEBLOSSOM: US-3251. ORANGECRUSH: US-3230. SHIFTINGSHADOW: US-3217. MONKEYROCKET: US-3206. YACHTSHOP: US-3247. DANCINGOASIS: US-3171. SPINNERET: US-3180. MOONLIGHTPATH: US-3145. MADCAPOCELOT: US-3140. BLUEZEPHYR: US-3277. SCALAWAG (MYSTIC): US-3310BG.
• Corporate cover names (company masked): LITHIUM, ARTIFICE, SERENADE, STEELKNIGHT.
• Second-party joint accesses: MUSCULAR (DS-200B), INCENSER (DS-300), WINDSTOP (collective).

Sources: 20131104-thewashingtonpost__sso_overview, 20131014-thewashingtonpost__sso_collection_optimization, 20180320-theintercept__second_look_sso_20mar2012_wstormbrewmap, 20161116-theintercept__sso_corporate_overview.

Appendix B: How this catalogue was produced

Text was extracted from all 474 PDFs with pdftotext; the 27 image-only documents were run through tesseract OCR. A concordance of capitalized codename candidates was built across the full corpus, ranked by how many documents each term appeared in, and then each candidate was read back in context in its source files. Codenames that are plainly OCR noise were discarded; terms that are classification markings or agency names (for example TOP SECRET, COMINT, NOFORN, SIGINT) were excluded from the program list and, where structural, summarized in section 15. Entries are grounded in the archive files cited on each line. Because some documents are redacted or are single pages pulled from larger originals, a few programs are described only as far as the released pages allow.

Previous article: How We Gave Away Control of Our IT. Part two of a three-part series.

Sources are the published documents of the Snowden Surveillance Archive (2013 to 2018), cited on each entry by date, outlet and slug. The documents mostly date from 2007 to 2013 and are a redacted, partial subset.