NSA’s XKeyscore: One-Click Realtime Access to Whatever You’re Doing on the Internet

The map of XKeyscore servers from a 2008 presentation (Image from theguardian.com)

More details of NSA spying have appeared in the Guardian this morning, presumably from paperwork/details supplied by Edward Snowden.

A huge program called Xkeyscore, which in 2008 was on 750 servers on 150 sites around the globe, served as the point of entry for most of the information that was collected by the NSA.

The information is not just metadata – depersonalized analytical usage statistics that allow spies to spot patterns – but includes almost all types of personal information. Using any piece of personal data on a subject – an email address, or the IP address of a computer – an agent could look up all online user activities, such as Google map searches, website visits, documents sent through the internet or online conversations. The service operates both, in real time, and using a database of recently stored information.All that appears to have been necessary to log into the system is to fill in a compulsory line on a form that gave a reason for why a certain person needed to be investigated. The form was not automatically scanned by the system or a supervisor, and did not require a US legal warrant, as long as the person whose name was typed in was a foreigner (even if his interactions were with a US citizen).

The slides appear to vindicate security specialist Edward Snowden’s claims made during the original video he recorded in Hong Kong last month.

“I, sitting at my desk, could wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email,”he alleged then.(source)

In a statement made to the Guardian the NSA did not deny either the use or capabilities of the system, they just sought to defend their use of it saying:

“NSA’s activities are focused and specifically deployed against – and only against – legitimate foreign intelligence targets in response to requirements that our leaders need for information necessary to protect our nation and its interests,”(source)

With just a short form to be filled in to gain access to the Xkeyscore system the operator could then trawl through billions of emails and online chat sessions, or check sites visited by specific computers by using IP addresses.