database.wiki

=== A-PLUS ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== ACRIDMINI ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[AGILITY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== AGILEVIEW ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm|cryptome.org - NSA X-Keyscore Member of Cyberespionage Family]
=== AGILITY ===
""Short Description"" : stores intercepted voice communications
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[gsm]] [[voip]] 
""Compartments"" : 
""Related items"" : [[OCEANARIUM]] [[PINWALE]] [[NUCLEON]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm|cryptome.org - NSA X-Keyscore Member of Cyberespionage Family]
=== AIGHANDLER ===
""Short Description"" : Geolocation analysis
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[geolocation]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm|cryptome.org - NSA X-Keyscore Member of Cyberespionage Family]
=== AIRBAG ===
""Short Description"" : [[JTRIG]] laptop capability for field operations
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== AIRGAP/COZEN ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm|cryptome.org - NSA X-Keyscore Member of Cyberespionage Family]
=== AIRWOLF ===
""Short Description"" : YouTube profile, comment and video collection.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[youtube]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ALAMITO ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[mexico]] 
""Compartments"" : 
""Related items"" : [[LIFESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== ALLIUMARCH ===
""Short Description"" : [[JTRIG]] UIA via the tor network
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[tor]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ALTEREGOQFD ===
""Short Description"" : A “Question filled Dataset”
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== AMBASSADORSRECEPTION ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document. Encrypt itself, delete all emails, encrypt all files, make screen shake, no more log on. Conduct a denial of service attack on the victim computer.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]] [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[JTIR]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== AMBULANT ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian - PROJECT BULLRUN ]
=== ANCESTRY ===
""Short Description"" : tool for discovering the creation date of Yahoo selectors
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[yahoo]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ANCHORY ===
""Short Description"" : NSA software system which provides web access to textual intelligence documents / Main repository of finished NSA SIGINT reports going back three years from agencies like [[NSA]], [[CIA]], [[DIA]], State and Foreign Broadcast Information Systems like [[Reuters]] News Service, Cryptologic Intelligence Reports.
""Category"" : program
""Alias"" : [[ANCH]] 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[MAUI]] [[OCEANARIUM]] 
""Related items (Parents)"" : [[MAUI]] 
""Related items (Children)"" : [[BELLTOPPER]] [[SOLIS]] 
""Status"" : unknown
""Links"" : 
* [https://muckrock.s3.amazonaws.com/foia_files/7-17-13_MR6022RES.pdf| www.muckrock.com -7-17-13_MR6022RES.pdf]
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== ANGRYNEIGHBOR ===
""Short Description"" : A family of bugs implemented as RF retro reflectors. These communicate with the use of an external radar wave generator such as [[CTX4000]] or [[PHOTOANGLO]]. The signals are then processed by a system such as [[VIEWPLATE]], (for the [[VAGRANT]] video signal). Known implementations: [[LOUDAUTO]] (ambient audio). [[DROPMIRE]] (printer/fax), [[RAGEMASTER]] (video), [[SURLYSPAWN]] (keyboard/mouse).
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[CW]] [[SURLYSPAWN]] [[RAGEMASTER]] [[DROPMIRE]] [[LOUDAUTO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[CTX4000]] [[CW]] [[LOUDAUTO]] [[PHOTOANGLO]] [[SURLYSPAWN]] [[TAWDRYYARD]] [[NIGHTWATCH]] [[VIEWPLATE]] 
""Status"" : active
""Links"" : 
* [http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969-2.html|spiegel.de - Inside TAO: Documents Reveal Top NSA Hacking Unit]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ANGRYPIRATE ===
""Short Description"" : is a tool that will permanently disable a target's account on their computer.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ANTICRISISGIRL ===
""Short Description"" : targeted website monitoring using passive . Customised Piwik installation, and is integrated into GTEs passive capabilities
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/02/18/snowden-docs-reveal-covert-surveillance-and-pressure-tactics-aimed-at-wikileaks-and-its-supporters/|Snowden Documents Reveal Covert Surveillance and Pressure Tactics Aimed at WikiLeaks and Its Supporters]
=== ANTOLPPROTOSSGUI ===
""Short Description"" : ANTO LP PROTOSS GUI was spotted on [[IRONCHEF]] diagram.
""Category"" : program
""Alias"" : [[ANTO LP PROTOSS GUI]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[PROTOSS]] [[ANTO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== APERIODIC ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian]
=== APERTURESCIENCE ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== APEX ===
""Short Description"" : Collection via TURMOIL of HAMMERSTEIN exfil of VPN traffic, and HAMMERCHANT exfil of targeted VoIP
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[vpn]] [[voip]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TURMOIL]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== AQUADOR ===
""Short Description"" : Merchant ship tracking tool
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== ARCA ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== ARKSTREAM ===
""Short Description"" : malicious BIOS flashing program, known to be associated with [[DEITYBOUNCE]] and [[SWAP]].
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[bios]] 
""Compartments"" : 
""Related items"" : [[DEITYBOUNCE]] [[SWAP]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ARSONSAM ===
""Short Description"" : is a tool to test the effect of certain types of PDU SMS messages on phones / network. Also includes PDU SMS Sumb Fuzz testing.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[sms]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ARTEMIS ===
""Short Description"" : An undetermined program for Geospatial analysis
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ENTOURAGE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ARTIFICE ===
""Short Description"" : A [[SIGAD]] (SIGINT Activity Designator) known as [[STORMBREW]], for example, relies on two unnamed corporate partners described only as [[ARTIFICE]] and [[WOLFPOINT]]. According to an NSA site inventory, the companies administer the NSA’s “physical systems,” or interception equipment, and “NSA asks nicely for tasking/updates.”
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[NOFORN]] 
""Related items"" : [[WOLFPOINT]] [[STORMBREW]] 
""Related items (Parents)"" : [[STORMBREW]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html|washingtonpost.com - NSA tracking cellphone locations worldwide, Snowden documents show]
* [http://electrospaces.blogspot.fr/2014/01/slides-about-nsas-upstream-collection.html|electrospaces.blogspot.fr - Slides about NSA's Upstream collection]
* [https://www.documentcloud.org/documents/813849-sso2.html#document/p1| www.documentcloud.org - FAA reports by provider]
=== ASPHALT ===
""Short Description"" : Proof-of-concept system based on collecting everything. Mentionned on [[TARMAC]] slide-show presentation and Glenn Greenwald's No Place To Hide document..
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[TARMAC]] 
""Related items (Parents)"" : [[TARMAC]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== ASSOCIATION ===
""Short Description"" : Tactical SIGINT social network database
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== ASTRALPROJECTION ===
""Short Description"" : Remote GSM secure covert internet proxy using TOR hidden services.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[gsm]] [[tor]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== AUNTIE ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian - nsa-bullrun-2-16-guardian-13-0905.pdf]
=== AUTOSOURCE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm|cryptome.org -NSA X-Keyscore Member of Cyberespionage Family]
=== AXLEGREASE ===
""Short Description"" : The covert banking link for CPG
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BABYLON ===
""Short Description"" : is a tool that bulk quieries web mail addresses and verifies ether they can be signed up for. A green tick indicates that is currently in use. Verification can currently be done for Hotmail and Yahoo.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[email]] [[hotmail]] [[yahoo]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BACONRIDGE ===
""Short Description"" : Installation of [[TAO]] in St. Antonio, TX. 270 personnel, 210 workstations.
""Category"" : compartment
""Alias"" : [[BOD]] 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/fotostrecke/nsa-dokumente-die-abteilung-tao-der-nsa-fotostrecke-105355-14.html|Der Spiegel - Geheimdokumente: Die Spezialabteilung [[TAO]] der NSA stellt sich vor]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== BADGER ===
""Short Description"" : mass delivery of email messaging to support an information operations campaign.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[email]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BALLOONKNOT ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== BANANAGLEE ===
""Short Description"" : A software exploit made by Digital Network Technologies ([[DNT]]) for Juniper Netscreen ns5xt, ns50, ns200, ns500, ISG 1000, ssg140, ssg5, ssg20, SSG 320M, SSG 350M, SSG 520, SSG 550, SSG 520M, SSG 550M firewalls. Also works on Cisco PIX 500 series and ASA 5505, 5510, 5520, 5540, and 5550 series firewalls. Used for exfiltrating data from target networks.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[cisco]] [[router]] [[juniper]] 
""Compartments"" : 
""Related items"" : [[TAO]] [[JETPLOW]] [[SOUFFLETROUGH]] [[FEEDTROUGH]] [[GOURMETTROUGH]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== BANISTER ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[colombia]] 
""Compartments"" : 
""Related items"" : [[LIVESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== BANYAN ===
""Short Description"" : NSA tactical geospatial correlation database
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== BEACHHEAD ===
""Short Description"" : Computer exploit delivered by the [[FERRETCANNON]] system.
""Category"" : attack vector
""Alias"" : [[BEACH HEAD]] 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FERRETCANNON]] [[FOXACID]] 
""Related items (Parents)"" : [[FERRETCANNON]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2013/10/the_nsas_new_ri.html|schneier.com - The NSA's New Risk Analysis]
=== BEARSCRAPE ===
""Short Description"" : can extract WiFi connection history (MAC and timing) when supplied with a copy of the registry structure or run on the box
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[wifi]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BEARTRAP ===
""Short Description"" : Bulk retrieval of public Bebo profiles from member or group ID
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[bebo]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BELLTOPPER ===
""Short Description"" : NSA software system like [[ANCHORY]] but without dividing data into database groups. [[BELLTOPPER]] place data into one database.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[SOLIS]] 
""Related items (Parents)"" : [[ANCHORY]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://muckrock.s3.amazonaws.com/foia_files/7-17-13_MR6022RES.pdf|muckrock.com - 7-17-13_MR6022RES.pdf]
=== BERRYTWISTER ===
""Short Description"" : A sub-system of [[FRUITBOWL]]
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[FRUITBOWL]] 
""Related items (Parents)"" : [[FRUITBOWL]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BERRYTWISTER+ ===
""Short Description"" : A sub-system of [[FRUITBOWL]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[FRUITBOWL]] 
""Related items (Parents)"" : [[JTRIG]] [[FRUITBOWL]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BINOCULAR ===
""Short Description"" : [[BINOCULAR]] is an integrated NSA signals intelligence source data broadcast service system, integrating nine separate Ultra High Frequency (UHF) transmissions, transmitted through the Global Broadcast System satellite network.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[cw]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.fas.org/irp/program/disseminate/binocular.htm|fas.org - BINOCULAR ]
=== BIRDSONG ===
""Short Description"" : Automated posting of twitter updates
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[twitter]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[SYLVESTER]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BIRDSTRIKE ===
""Short Description"" : Twitter monitoring and profile collection
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BLACKFOOT ===
""Short Description"" : coverterm to the bugging of French mission to the United Nations in New York
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[france]] 
""Compartments"" : [[TOP SECRET]] 
""Related items"" : [[HIGHLANDS]] [[VAGRANT]] [[GENIE]] [[DROPMIRE]] [[WABASH]] [[PBX]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|theguardian.com - New NSA leaks show how US is bugging its European allies]
* [http://www.bbc.co.uk/news/world-europe-24628947| http://www.bbc.co.uk - US National Security Agency 'spied on French diplomats]
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
=== BLACKHEART ===
""Short Description"" : collection from FBI implant.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|www.schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== BLACKNIGHT ===
""Short Description"" : spotted on Washigton post document from June 1'th 2014
""Category"" : [[program]]
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== BLACKPEARL ===
""Short Description"" : This program was mentioned in context of Petrobras - the largest oil company of Brazil - story. BLACKPEARL extracts data from private networks.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dni]] [[gsm]] [[crypto]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://secure.huffingtonpost.com/zachary-graves/the-nsas-war-against-encr_b_3901328.html| secure.huffingtonpost.com]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== BLARNEY ===
""Short Description"" : BLARNEY is a communications surveillance program, started in 1978 and operated under FISA. The collection takes place at top-level telecommunications facilities within the United States, choke points through which most traffic will flow, including wireless. This type of surveillance is referred to as "[[UPSTREAM]] collection". Among the facilities associated with BLARNEY are AT&T's Room 641A in San Francisco, California, revealed in 2006 by Mark Klein, and another in New Jersey. Like its counterparts, BLARNEY was expanded after the September 11 attacks. Information collected from BLARNEY is shared with many agencies in the United States, including the CIA, NSA, FBI and DOJ, it is also shared with the Five Eyes and NATO. A number of private companies also have access.Key Targets are : Diplomatic establishment, counterterrorism, Foreign Government, Economic
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[FISA]] [[TOP SECRET]] [[COMINT]] [[NOFORN]] [[FOUO]] 
""Related items"" : [[UPSTREAM]] [[XKEYSCORE]] 
""Related items (Parents)"" : [[UPSTREAM]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/Blarney_%28code_name%29|en.wikipedia.org - Blarney]
* [http://online.wsj.com/article/SB10001424127887324108204579022874091732470.html|wsj.com - New Details Show Broader NSA Surveillance Reach]
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf||SSO - The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== BLEAKINQUIRY ===
""Short Description"" : metadata database of potentially exploitable VPNs
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[vpn]] [[metadata]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TOYGRIPPE]] [[XKEYSCORE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== BLINDDATE ===
""Short Description"" : Software included on [[SPARROW-II]] mini computers. Also seen in another context on [[QFIRE]] slide as part of a “[[TAO]] covert network.”.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[STRAITBIZARRE]] [[QUANTUM]] [[QFIRE]] [[TAO]] [[NEPTUNETHUNDER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== BLUEANCHOR ===
""Short Description"" : Partner providing a network access point for the [[YACHTSHOP]] program.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[YACHTSHOP]] [[UPSTREAM]] 
""Related items (Parents)"" : [[YACHTSHOP]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR|en.wikipedia.org - OAKSTAR]
=== BLUEZEPHYR ===
""Short Description"" : subprogram of [[OAKSTAR]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[UPSTREAM]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR| en.wikipedia.org - OAKSTAR]
=== BOMBAYROLL ===
""Short Description"" : [[JTRIG]]'s legacy UIA standalone capability
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BOMBBAY ===
""Short Description"" : is the capabilty to increase website hits/rankings.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[website]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BOTANICREALTY ===
""Short Description"" : Collaboration between TEC and MSOC System Development and Signals Development Lab. It's a solution to collect a video network. The video is unencrypted and, for a period of two months, encrypted. In the first hours on run, over 1000 collects, totalling hundreds of hours of video, have been made.
""Category"" : program
""Alias"" : [[UNCANNY]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[video]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[LADYLOVE]] [[HIGHPRIDE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Compiled documents by Cryptome of Der Spiegel documents]
* [http://www.spiegel.de/international/the-germany-file-of-edward-snowden-documents-available-for-download-a-975917.html|Non-compiled documents from Der Spiegel]
=== BOUNDLESSINFORMANT ===
""Short Description"" : BOUNDLESSINFORMANT is a big data analysis and data visualization system used by the NSA to give managers summaries of the NSA's world wide data collection activities. According to a Top Secret heat map display also published by The Guardian and produced by the Boundless Informant program, almost 3 billion data elements from inside the United States were captured by the NSA over a 30-day period ending in March 2013.Data analyzed by BOUNDLESSINFORMANT includes electronic surveillance program records ([[dni]]) and telephone call metadata records ([[dnr]]) stored in an NSA data archive called [[GM-PLACE]]. It does not include FISA data, according to the FAQ memo. [[PRISM]] ([[US-984XN]]), which was revealed at the same time as BOUNDLESSINFORMANT, is one source of DNR data. According to the map, BOUNDLESSINFORMANT summarizes data records from 504 separate [[dnr]] and [[dnr]] collection sources (SIGADs). In the map, countries that are under surveillance are assigned a color from green, representing least coverage to red, most intensive.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[dni]] [[dnr]] [[phone]] 
""Compartments"" : [[TOP SECRET]] [[NOFORN]] [[FOUO]] [[FISA]] 
""Related items"" : [[PRISM]] [[FASCIA]] 
""Related items (Parents)"" : [[ACRIDMINI]] [[LUTEUSICARUS]] [[HEADMOVIES]] [[APERTURESCIENCE]] [[CROSSEYEDSLOTH]] [[KOALAPUNCH]] [[BALLOONKNOT]] [[MAGNUMOPUS]] [[WAXTITAN]] [[WILDCOUGAR]] [[MURPHYSLAW]] [[DARKFIRE]] [[CHOCOLATESHIP]] [[SCREAMINGHARPY]] [[WILDCHOCOBO]] [[CHAOSOVERLORD]] [[SHAREDTAFFY]] [[POTBED]] [[DARKTHUNDER]] [[JEEPFLEA]] [[TROPICPUMA]] [[SHARPSHADOW]] [[HIGHCASTLE]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://en.wikipedia.org/wiki/Boundless_Informant|en.wikipedia.org - Boundless Informant]
* [http://www.theguardian.com/world/2013/jun/08/nsa-boundless-informant-global-datamining|The Guardian - Boundless Informant: the NSA's secret tool to track global surveillance data]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== BOXINGRUMBLE ===
""Short Description"" : Programm of Bots
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : [[TAO]] 
""Compartments"" : 
""Related items"" : [[QUANTUMDNS]] 
""Related items (Parents)"" : [[DEFIANTWARRIOR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409-2.html|The Digital Arms Race: NSA Preps America for Future Battle]
=== BRANDYSNAP ===
""Short Description"" : [[JTRIG]] UIA contingency at Scarborough
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknow
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BRAVENICKEL ===
""Short Description"" : Spotted on a document, leaked by the spiegel in december 2014: optical muxes for copying shape of optical signals to an passive collector, one could do some selection process.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== BROADOAK ===
""Short Description"" : GCHQ's database of target info on TLS events.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[ssl]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== BRUNEAU ===
""Short Description"" : Name of an operation to bug the italian UN mission, introducing spywares in foreign embassies.
""Category"" : mission
""Alias"" : [[HEMLOCK]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[italy]] 
""Compartments"" : 
""Related items"" : [[GENIE]] [[DROPMIRE]] [[LIFESAVER]] [[HEMLOCK]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|TheGuardian - New NSA leaks show how US is bugging its European allies]
=== BSR ===
""Short Description"" : Base Station Router, use for intercepting GSM cell phone signals. Ships with laptop and accessories, networkable with other units via 802.11. Supports [[CANDYGRAM]] and [[LANDSHARK]] capabilities.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[phone]] 
""Compartments"" : 
""Related items"" : [[CANDYGRAM]] [[LANDSHARK]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== BTUBE ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[GALLANTWAVE]] [[TUBE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== BUFFALOGREEN ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== BUGSY ===
""Short Description"" : Google+ collection (circles, profiles, etc.)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BULLDOZER ===
""Short Description"" : PCI bus malicious hardware, installed via [[INTERDICTION]], possibly connected to a Wi-Fi card or a subverted router and collect metadata and content from targeted systems.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[pci]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[INTERDICTION]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [[http://www.theregister.co.uk/2013/12/31/nsa_weapons_catalogue_promises_pwnage_at_the_speed_of_light/?page=2|TheRegistry]
=== BULLRUN ===
""Short Description"" : BULLRUN - the successor to the program called [[MANASSAS]], both named after American Civil War battles - is a clandestine, highly classified decryption program run by the NSA. The British signals intelligence agency Government Communications Headquarters (GCHQ) has a similar program codenamed [[EDGEHILL]]. Access to the program is limited to a group of top personnel at the Five Eyes (FVEY), NSA and the signals intelligence agencies of Britain, Canada, Australia, and New Zealand. Signals that cannot be decrypted with current technology may be retained indefinitely while the agencies continue to attempt to decrypt them: "Documents show that the N.S.A. has been waging a war against encryption using a battery of methods that include working with industry to weaken encryption standards, making design changes to cryptographic software, and pushing international encryption standards it knows it can break." (The New York Times)
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[APERIODIC]] [[AMBULANT]] [[AUNTIE]] [[PAINTEDEAGLE]] [[PAWLEYS]] [[PITCHFORD]] [[PENDLETON]] [[PICARESQUE]] [[PIEDMONT]] 
""Related items (Parents)"" : [[OSCAR]] 
""Related items (Children)"" : [[APERIODIC]] [[AMBULANT]] [[AUNTIE]] [[PAINTEDEAGLE]] [[PAWLEYS]] [[PITCHFORD]] [[PENDLETON]] [[PICARESQUE]] [[PIEDMONT]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-brief-propublica-13-0905.pdf|cryptome.org - BULLRUN's briefing sheet]
* [https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%29|en.wikipedia.org - Bullrun (decryption program)]
* [http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html?_r=0|New York Times: Secret Documents Reveal N.S.A. Campaign Against Encryption]
* [http://www.theguardian.com/world/interactive/2013/sep/05/nsa-project-bullrun-classification-guide|The Guardian : Project Bullrun – classification guide to the NSA's decryption program]
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org - guardian]
* [http://www.propublica.org/article/the-nsas-secret-campaign-to-crack-undermine-internet-encryption|Propublica : The NSA's secret campaign to crack, undermine internet security]
=== BULLSEYE ===
""Short Description"" : "The Naval Security Group worldwide CLASSIC BULLSEYE (now [[FLAGHOIST]]) network is part of the DOD Worldwide High Frequency Direction Finding System for strategic intelligence collection and emitter location. High-Frequency Direction-Finding intercepts and locates voice and message traffic transmitted on short-wave channels."
""Category"" : program
""Alias"" : [[FLAGHOIST]] 
""Family"" : collect
""Agency"" : [[NSA]] [[NAVSECGRU]]
""Tags"" : [[radio]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.fas.org/irp/program/collect/classic_bullseye.htm | fas.org - AN/FRD-10 CLASSIC BULLSEYE]
=== BUMBLEBEEDANCE ===
""Short Description"" : [[JTRIG]] operational VM / Tor architecture
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[tor]] [[vm]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BUMPERCAR+ ===
""Short Description"" : is an automated system developped by [[JTRIG]] CITD to support [[BUMPERCAR]] operations. [[BUMPERCAR]] operations are used to disrupt and deny Internet-based terror videos or other material. The technique employs the services provided by upload providers to report offensive materials.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[video]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BURLESQUE ===
""Short Description"" : is the capabilty to send spoofed SMS text messages.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[sms]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BYSTANDER ===
""Short Description"" : is a categorisation database accessed via web service
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== BYZANTINEANCHOR ===
""Short Description"" : BA, a subset of [[BYZANTINEHADES]], refers to a group of associated computer network intrusions with an apparent nexus to China.je n (Source : Cablegate)
""Category"" : program
""Alias"" : [[BA]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[china]] 
""Compartments"" : 
""Related items"" : [[BYZANTINECANDOR]] 
""Related items (Parents)"" : [[BYZANTINEHADES]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
=== BYZANTINECANDOR ===
""Short Description"" : Refers to a certain class of hacking by Chinese actors. BYZANTINECANDOR is a subset of [[BYZANTINEHADES]] relating to intrusion, including by means of social engineering involving delivering malicious payloads by email. (Source : Cablegate)
""Category"" : attack vector
""Alias"" : [[BC]] [[email]] 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[china]] 
""Compartments"" : 
""Related items"" : [[BYZANTINEHADES]] [[BYZANTINEANCHOR]] 
""Related items (Parents)"" : [[BYZANTINEHADES]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
* [http://www.theguardian.com/world/2010/dec/04/wikileaks-cables-china-cyber-warfare | theguardian.com - WikiLeaks cables reveal fears over Chinese cyber warfare]
=== BYZANTINEHADES ===
""Short Description"" : “a cover term for a series of related computer network intrusions with a believed nexus to China, has affected U.S. and foreign governments as well as cleared defense contractors since at least 2003” Believed to be Chinese state-sponsored (the PLA in particular). Though the evidence is tenuous. (ca 2009). In general, victims of Chinese-affiliated hacking are legitimate businesses, including defense contractors. They have been successful in exfiltrating large volumes of confidential emails and other sensitive documents. (Source : Cablegate)
""Category"" : program
""Alias"" : [[BH]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[china]] 
""Compartments"" : 
""Related items"" : [[BYZANTINECANDOR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BYZANTINEANCHOR]] [[BYZANTINECANDOR]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
=== CADENCE ===
""Short Description"" : Collection mission system for tasking
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[PRISM]] [[GAMUT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== CANDYGRAM ===
""Short Description"" : Mimics GSM cell tower. The program works with a Windows XP laptop and a cell phone, that communicate with the unit via SMS messages. CANDYGRAM can target 200 phone numbers simultaneously.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[sms]] [[windows]] [[os]] [[gsm]] [[phone]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[DRTBOX]] [[STINGRAY]] [[NEBULA]] [[CYCLONE]] [[TYPHON]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/2| digitaltrends.com - TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too ]
* [http://securityledger.com/wp-content/uploads/2013/12/nsa-ant-candygram.jpg | securityledger.com - nsa-ant-candygram.jpg ]
=== CANNONLIGHT ===
""Short Description"" : US Army Counter Intelligence Database
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : US Army
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://books.google.fr/books?id=SPcHq8wftrsC&pg=SA5-PA12&dq=%22CANNON+LIGHT%22+us+army&hl=en&sa=X&ei=VF3xUpmCEMmg0QXD14HQBA&redir_esc=y#v=onepage&q=%22CANNON%20LIGHT%22%20us%20army&f=false|books.google.fr - "CANNON LIGHT" us army]
=== CAPTIVATEDAUDIENCE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== CARBOY ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Bude (UK)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[uk]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : [[JACKKNIFE]] [[TIMBERLINE]] [[CORALINE]] [[SCS]] [[MOONPENNY]] [[GARLICK]] [[LADYLOVE]] [[SOUNDER]] [[LEMONWOOD]] [[SHOALBAY]] [[SNICK]] [[STELLAR]] [[SCALPEL]] [[IRONSAND]] 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== CASPORT ===
""Short Description"" : access identification tool used to control product dissemination
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== CASTANET ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 166 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== CCDP ===
""Short Description"" : [[GCHQ]] Communications Capabilities Development Program. Formerly known as Interception Modernisation Programme (IMP). initiative to create a ubiquitous mass surveillance scheme for the United Kingdom. It would involve the logging of every telephone call, email and text message between every inhabitant of the UK and communications within social networking platforms such as Twitter and Facebook.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[facebook]] [[twitter]] [[email]] [[phone]] [[uk]] 
""Compartments"" : 
""Related items"" : [[IMP]] [[TEMPORA]] [[MTI]] [[GTE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/Communications_Capabilities_Development_Programme|Wikipedia - Communications Capabilities Development Programme]
* [http://www.telegraph.co.uk/technology/internet/9090617/Phone-and-email-records-to-be-stored-in-new-spy-plan.html|The Telegraph - Phone and email records to be stored in new spy plan]
=== CDRDIODE ===
""Short Description"" : It is the name for a protecting device that enables the intercepted data to flow to NSA without enabling an attacker to use the same way to compromise NSA or travel further toward identification. The tentative explanation is that when some data come from the low side (insecure) toward the high side (secure) of the NSA infrastructure so that it can be read by analaysts at the NSA Remote Operation Center ([[ROC]]), then it needs to go through that CDRDIODE.
""Category"" : program
""Alias"" : [[CDR Diode]] 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[WISTFULTOLL]] [[STRAITBIZARRE]] [[SEAGULLFARO]] [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://www.youtube.com/watch?v=R8QFPf2RMCQ|LeakSourceNews - Jacob Appelbaum: NSA's FoxAcid/Quantum Programs at the european parliament - 10/15/2013]
=== CERBERUS ===
""Short Description"" : [[JTRIG]]'s legacy UIA desktop, soon to be replaced with [[FORESTWARRIOR]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[FORESTWARRIOR]] [[CERBERUSSTATISTICSCOLLECTION]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : [[CERBERUSSTATISTICSCOLLECTION]] 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CERBERUSSTATISTICSCOLLECTION ===
""Short Description"" : collect on-going usage information about how many users utilise [[JTRIG]]'s UIA capability, what sites are the most frequently visited etc. This is in order to provide [[JTRIG]] infrastructure and ITServices management information statistics.
""Category"" : program
""Alias"" : [[CERBERUS STATISTICS COLLECTION]] 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[CERBERUS]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CHALKFUN ===
""Short Description"" : Analytic tool, used to search the [[FASCIA]] database
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FASCIA]] 
""Related items (Parents)"" : [[FASCIA]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html|washingtonpost.com- NSA tracking cellphone locations worldwide, Snowden documents show]
* [http://www.wikileaks-forum.com/nsa/332/snowden-leak-chalkfun-fascia-and-nsa-targeted-device-location-verification/25826/|wikileaks-forum.com - CHALKFUN and FASCIA Documents- Snowden Leak: CHALKFUN - FASCIA and NSA Targeted Device Location Verification]
* [http://apps.washingtonpost.com/g/page/national/nsa-report-on-privacy-violations-in-the-first-quarter-of-2012/395/|apps.washingtonpost.com - NSA report on privacy violations in the first quarter of 2012]
=== CHANGELING ===
""Short Description"" : Ability to spoof any email address and send email under that identity
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[email]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CHAOSOVERLORD ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== CHASEFALCON ===
""Short Description"" : Major program of the Global Access Operations (GAO)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.linkedin.com/in/mastersontech | linkedin.com - John Masterson, CDR, CSSRSr. DoD/Intel Recruiter at Independent Contractor ]
=== CHEWSTICK ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FALLENORACLE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm | cryptome.org - NSA X-Keyscore Member of Cyberespionage Family]
=== CHIMNEYPOOL ===
""Short Description"" : Software based malware toolkit “Framework”, likely written in C/C++ (according to resumes posted online)
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : [[DROPOUTJEEP]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[DROPOUTJEEP]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.spiegel.de/static/happ/netzwelt/2014/na/v1/pub/img/Handy/S3222_DROPOUTJEEP.jpg| spiegel - Slide on DROPOUTJEEP]
=== CHINESEFIRECRACKER ===
""Short Description"" : Overt brute login attemps against online forums
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[forum]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CHIPPEWA ===
""Short Description"" : CHIPPEWA seems to be a communication network
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/interactive/2013/sep/11/nsa-israel-intelligence-memorandum-understanding-document| theguardian.com - NSA and Israeli intelligence: memorandum of understanding – full document]
=== CHOCOLATESHIP ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== CIMBRI ===
""Short Description"" : CIMBRI seems to be a metadata database
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] 
""Compartments"" : 
""Related items"" : [[MAINWAY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://electrospaces.blogspot.fr/2013/09/an-nsa-eavesdropping-case-study.html|electrospaces - An NSA eavesdropping case study ]
=== CINDER ===
""Short Description"" : ESP-like protocols that use non-RFC defined fields
""Category"" : program
""Alias"" : [[CINDERHASH]] [[CINDERTRACK]] 
""Family"" : collect
""Agency"" : undefined
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== CINEPLEX ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/nsa-x-keyscore-family.htm | NSA X-Keyscore Member of Cyberespionage Family]
=== CLEANSWEEP ===
""Short Description"" : Masquerade Facebook Wall posts for individuals or entire coutries.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[facebook]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CLUMSYBEEKEEPER ===
""Short Description"" : Some work in progress to investigate IRC effects
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[irc]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== COALCAR ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] 
""Compartments"" : 
""Related items"" : [[LONGHAUL]] 
""Related items (Parents)"" : [[GECC]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== COASTLINE ===
""Short Description"" : reporting tool to receive and report on near real-time intelligence for forward deployed troops
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [ http://www.scmagazineuk.com/watching-the-watchmen/article/306005/| www.scmagazineuk.com - Watching the Watchmen ]
=== COBALTFALCON ===
""Short Description"" : [[US-3354]], Subprogram of [[OAKSTAR]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[UPSTREAM]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR| en.wikipedia.org - OAKSTAR]
* [http://electrospaces.blogspot.fr/2014/01/slides-about-nsas-upstream-collection.html|electrospaces.blogspot.fr - UPSTREAM collection]
=== COMMONDEER ===
""Short Description"" : A software based malware, used by the NSA.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : [[SEASONEDMOTH]] [[VALIDATOR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2: The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== CONCRETEDONKEY ===
""Short Description"" : is the capability to scatter an audio message to a large number of telephones, or repeatedly bomb a target number withe the same message
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[phone]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CONDUIT ===
""Short Description"" : is a database of C2C identifiers for Intelligence Community assets acting online, either under alias or in real name
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CONJECTURE ===
""Short Description"" : A RF communication protocol used by [[HOWLERMONKEY]] devices.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[HOWLERMONKEY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== CONNONBALL ===
""Short Description"" : is the capabilty to send repeated text messages to a single target.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[gsm]] [[sms]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CONTRAOCTAVE ===
""Short Description"" : Collection mission tasking tool
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[OCTAVE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
* [http://theweek.com/article/index/245360/solving-the-mystery-of-prism|theweek.com -Solving the mystery of PRISM - The Week]
=== CONVEYANCE ===
""Short Description"" : [[CONVEYANCE]] is a final layer of filtering to reduce the intake of information about Americans, it provides filtering for [[PRISM]] and filtering the voice content processed by S3132. The CONVEYANCE's informations are stocked in [[NUCLEON]].
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[SI]] [[ORCON]] [[NOFORN]] 
""Related items"" : [[PRISM]] [[NUCLEON]] [[FALLOUT]] 
""Related items (Parents)"" : [[SCISSORS]] 
""Related items (Children)"" : [[NUCLEON]] 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/|washingtonpost.com - NSA slides explain the PRISM data-collection program]
* [https://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|en.wikipedia.org - Slide of PRISM collection dataflow]
=== CORALINE ===
""Short Description"" : [[SIGINT]] for locating cellphone in Sabana Seca (PR)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : [[JACKKNIFE]] [[TIMBERLINE]] [[CORALINE]] [[SCS]] [[MOONPENNY]] [[CARBOY]] [[GARLICK]] [[LADYLOVE]] [[SOUNDER]] [[LEMONWOOD]] [[SHOALBAY]] [[SNICK]] [[STELLAR]] [[SCALPEL]] [[IRONSAND]] 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/|nsa.gov1.info/dni/]
=== CORALREEF ===
""Short Description"" : spotted on [[TURBINE]]'s document about "APEX VPN exploitation".
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[METROTUBE]] [[TURMOIL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== CORNERKICK ===
""Short Description"" : spotted on a document from DNAC (Digital Network Crypt Applications),  the documents leaked in december 2014 by the Spiegel. They are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[GALLANTWAVE]] [[LONGHAUL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== COTRAVELER ===
""Short Description"" : set of tools for finding unknown associates of intelligence targets by tracking movements based upon cell phone locations.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html|washingtonpost.com - NSA tracking cellphone locations worldwide, Snowden documents show]
* [http://www.theguardian.com/world/2013/dec/04/nsa-storing-cell-phone-records-daily-snowden | the guardian.com - NSA storing cell phone records daily snowden]
=== COTS ===
""Short Description"" : Commercial Off the Shelf. When a description of a bug says it is COTS-based, it means that the components are commercially available, giving the NSA deniability as to their true source. (Unless you just happen to be looking at the NSA's leaked product catalog. )
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== COTTONMOUTH-I ===
""Short Description"" : COTTONMOUTH-I (CM-I) will provide air-gap bridging software persistence capability "in-field" reprogrammability, and covert communications with a host software implant over the USB. The RF link will enable command and data infiltration and exfiltration. CM-1 will also communicate with Data Network Technologies (DNT) software ([[STRAITBIZARRE]] through a covert channel implemented on the USB, using this communication channel to pass commands and data between hardware and software implants. CM-1 will be a [[GENIE]]-compliant based on [[CHIMNEYPOOL]]. CM-1 conceals digital components ([[TRINITY]]), USB 1.1 FS hub, switches, and [[HOWLERMONKEY]] (HM) RF Transceiver within the USB Séries-A cable connector. [[MOCCASIN]] is the version permanently connected to a USB keyboard. Another version can be made with an unmodified USB connector at the other end. CMH-I has the ability to communicate to other CM devices over the RF link using an over-the-air protocol called [[SPECULATION]].
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[CHIMNEYPOOL]] [[STRAITBIZARRE]] 
""Related items (Parents)"" : [[CHIMNEYPOOL]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 - The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://www.nytimes.com/2014/01/15/us/nsa-effort-pries-open-computers-not-connected-to-internet.html|New York Times - N.S.A. Devises Radio Pathway Into Computers]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== COTTONMOUTH-II ===
""Short Description"" : COTTONMOUTH-II (CM-II) will provide air-gap bridging software persistence capability "in-field" reprogrammability, and covert communications with a host software implant over the USB. The RF link will enable command and data infiltration and exfiltration. CM-1 will also communicate with Data Network Technologies (DNT) software ([[STRAITBIZARRE]] through a covert channel implemented on the USB, using this communication channel to pass commands and data between hardware and software implants. CM-I will be a [[GENIE]]-compliant based on [[CHIMNEYPOOL]]. CM-1 conceals digital components ([[TRINITY]]), USB 2.0 HS hub, switches, (...?)
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[CHIMNEYPOOL]] [[STRAITBIZARRE]] 
""Related items (Parents)"" : [[CHIMNEYPOOL]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 - The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== COTTONMOUTH-III ===
""Short Description"" : COTTONMOUTH-III (CM-III) is a dual-stacked USB port/RJ45 ethernet jack combo, (the kind that are soldered directly onto a motherboard), providing a covert RF relay across airgapped systems. Like CM-I, and many other systems, it is written with the [[CHIMNEYPOOL]] framework, and communicates via [[STRAITBIZARRE]]. It can communicate with other CM devices with the SPECULATION Protocol. It also integrates [[TRINITY]], and the [[HOWLERMONKEY]] RF transceiver.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[ethernet]] [[usb]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[TRINITY]] [[HOWLERMONKEY]] [[SPECULATION]] [[CHIMNEYPOOL]] [[STRAITBIZARRE]] 
""Related items (Parents)"" : [[CHIMNEYPOOL]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 - The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== COUNTRYFILE ===
""Short Description"" : A sub-system of [[JAZZFUSION]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[JAZZFUSION]] 
""Related items (Parents)"" : [[JTRIG]] [[JAZZFUSION]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CREST ===
""Short Description"" : Database that automatically translates foreign language intercepts in English
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== CRISSCROSS ===
""Short Description"" : see [[PROTON]]
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[PROTON]] [[ICREACH]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/08/proton-clearwater-lexis-nexis.htm | cryptome - PROTON, CLEARWATER and Lexis-Nexis ]
=== CROSSBEAM ===
""Short Description"" : the CROSSBEAM module consists of a standard ANT architecture embedded computer, a specialized phone component, a customized voice controller suite and and optional DSP ([[ROCKYKNOB]]) if using Data Over Voice to transmit data”. Communicates over GSM. Compatible with [[CHIMNEYPOOL]] framework. Appears to be a [[WAGONBED]] controller board mated with a Motorola G20 GSM module. CROSSBEAM is a reusable CHIMNEYPOOL-compliant GSM communications module capable of collecting and compressing voice, data. CROSSBEAM can receive GSM voice, record voice data, and transmit the received information via connected modules or 4 differents GSM data modes (GPRS, Circuit Switched Data, Data Over Voice and DTMF) back to a secure facility. THe CROSSBEAM module consists of a standard ANT architecture embedded computer, a specialized phone component, a customized software controller suite and an optional DSP (ROCKYKNOB) if using Data Over Voice to transmit data.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[phone]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[WAGONBED]] [[CHIMNEYPOOL]] [[ROCKYKNOB]] 
""Related items (Parents)"" : [[ROC]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : Active
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.spiegel.de/static/happ/netzwelt/2014/na/v1/pub/img/Mobilfunk/S3223_CROSSBEAM.jpg| spiegel.de - Slide on CROSSBEAM]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== CROSSEYEDSLOTH ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== CRUMPET ===
""Short Description"" : CRUMPET Covert network (CCN) is a sample drawing included Printers, servers, and computers. All allegedly airgapped. (But not actually, due to covertly installed hardware)
""Category"" : program
""Alias"" : [[ccn]] 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRONCHEF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== CRYOSTAT ===
""Short Description"" : is a [[JTRIG]] tool that runs against data held in [[NEWPIN]]. It then displays this data in a chart to show links between target.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[NEWPIN]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CRYPTOENABLED ===
""Short Description"" : collection derived from AO's efforts to enable crypto.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.lemonde.fr/international/article/2013/10/22/la-diplomatie-francaise-sur-ecoute-aux-etats-unis_3500717_3210.html|LeMonde.fr - La diplomatie Française sur écoute aux États-unis]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== CSE ===
""Short Description"" : Exchange designator for Canada’s Communications Security Establishment (CSE).
""Category"" : five eyes
""Alias"" : [[UNIFORM]] 
""Family"" : agence
""Agency"" : CSE
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ALPHA]] [[ECHO]] [[INDIA]] [[OSCAR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== CTX4000 ===
""Short Description"" : The CTX4000 is a portable continuous wave (CW) radar unit. It can be used to illuminate a target system to recover different off net information. Primary uses include [[VAGRANT]] and [[DROPMIRE]] collection. The CTX4000 provides the means to collect signals that otherwise would not be collectable, or would be extremely difficult to collect and process.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[cw]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[VAGRANT]] [[DROPMIRE]] [[PHOTOANGLO]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/ctx4000_nsa_exp.html|schneier.com - NSA Exploit of the Day]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de To Protect And Infect Part 2 - The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== CULTWEAVE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== CUSTOMS ===
""Short Description"" : Customs opportunities (not [[LIVESAVER]] )
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== CW ===
""Short Description"" : Continuous Wave aka [[CW]] is a continuous radio signal (like [[CTX4000]] or [[PHOTOANGLO]]) sent toward a target so that the reflected radio wave is modulated by the signal to intercept. It's the default interception mechanism of NSA for both voice, PS2 and USB keyboard keypresses, exfiltered data, network traffic and any kind of data the NSA is interested to extract from a target. It's a very advanced attack where a Radar sends a [[CW]] toward a target covertly equipped with a eavesdropping bug called a [[RETROREFLECTOR]] which will modulate the original [[CW]] signal and re-radiate this modulated [[CW]] so that it can be picked up by the emitting Radar. The benefit of such technique is that there is no need for the eavesdropping bug to generate radio signal, and therefore, no need for huge batteries or power. It also means that the bug can be turned on and off remotely, providing easy way to turn off the bug when a bug sweep detection team is trying to located it. The downside is that it's dangerous for health as the Radar signal between 1Ghz and 6Ghz can be harmful to human and cause illness and cancer, as it did numerous times in the past since the first time it was detected in the US Embassy in Moscow, Russia.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[usb]] 
""Compartments"" : 
""Related items"" : [[ANGRYNEIGHBOR]] [[RAGEMASTER]] [[VAGRANT]] [[PHOTOANGLO]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
* [http://www.emfacts.com/2012/06/john-goldsmith-on-scientific-misconduct-and-the-lilienfeld-study-an-oldie-but-still-relevant-today/ | emfacts.com - John Goldsmith on scientific misconduct and the Lilienfeld study (An oldie but still relevant today)]
* [http://www.ehjournal.net/content/11/1/85| ehjournal.net - Microwaves in the cold war: the Moscow embassy study and its interpretation. Review of a retrospective cohort study]
* [http://emrstop.org/index.php?option=com_content&view=article&id=118:they-have-known-about-microwave-radiation-harm-for-decades&catid=31:emf-politics-a-research-analyses&Itemid=40| ermstop.org - They have known about microwave radiation harm for decades]
* [http://www.scribd.com/doc/13616226/The-Moscow-Embassy-incident| scribd.com - The Moscow Embassy incident]
* [http://www.wikileaks.org/plusd/cables/1976MOSCOW01437_b.html#efmAtaAwK| wikileaks.org - MOSCOW SIGNAL - APPROACH TO GROMYKO]
=== CYBERCOMMANDCONSOLE ===
""Short Description"" : A centralised suite of tools, statistics and viewers for tracking current operations across the Cyber community
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== CYCLONE ===
""Short Description"" : EGSM base station router, used for collection GSM cell phone signals. Shops with laptop and accessories for command and control, uses the same GUI as the [[TYPHON]]. Controllable via 802.11 wifi.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[phone]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[TYPHON]] [[CANDYGRAM]] [[DRTBOX]] [[NEBULA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== DANCINGBEAR ===
""Short Description"" : Obtains the location of wifi access points
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[wifi]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DANCINGOASIS ===
""Short Description"" : [[SSO]] collection program, Location information. SIGAD pour [[FASCIA]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FASCIA]] [[SCISSORS]] 
""Related items (Parents)"" : [[FASCIA]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/new-documents-show-how-the-nsa-infers-relationships-based-on-mobile-location-data/ | washingtonpost - New documents show how the NSA infers relationships based on mobile location data]
* [http://apps.washingtonpost.com/g/page/world/how-the-nsa-tried-to-collect-less/518/| washingtonpost - SCISSORS: How the NSA collects less data]
* [http://www.spiegel.de/international/world/secret-nsa-documents-show-how-the-us-spies-on-europe-and-the-un-a-918625.html | spiegle.de - Codename 'Apalachee': How America Spies on Europe and the UN ]
* [http://www.matthewaid.com/post/73733098307/new-detailed-analysis-of-how-nsa-and-its-foreign| matthewaid.com - New Detailed Analysis of How NSA and Its Foreign Partners Intercept Undersea Fiber Optic Cable Traffic]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== DANDERSPRITZ ===
""Short Description"" : Described as an “intermediate redirector node.” Another tool made by Digital Network Technologies (DNT). Spoofs IP and MAC address.
""Category"" : attack vector
""Alias"" : [[DANDERSPRIT]] 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[DANDERSPRIT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== DAREDEVIL ===
""Short Description"" : Implant /Shooter, spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] [[TAO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== DARKFIRE ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== DARKQUEST ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== DARKSUNRISE ===
""Short Description"" : Automatic identification of bidirectionnal VPNs, VPNs of Interest. Find all VPNs that talk to a base VPN
""Category"" : program
""Alias"" : [[NKB]] 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : Coming fall 2012
""Links"" : 
=== DARKTHUNDER ===
""Short Description"" : A SIGAD used by [[TAO]], and thus [[QUANTUM]], [[FOXACID]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== DEADPOOL ===
""Short Description"" : URL shortening service
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DECODEORDAIN ===
""Short Description"" : Find all e-mail addresses that correlate to a single Skype account
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[email]] 
""Compartments"" : [[TOP SCRET]] [[COMINT]] [[NOFORN]] 
""Related items"" : [[MARINA]] 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== DEERSTALKER ===
""Short Description"" : Ability to aid-geolocation of Sat Phones / GSM phones via a silent calling to the phone.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[geolocation]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DEITYBOUNCE ===
""Short Description"" : DEITYBOUNCE provides software application persistence on Dell PowerEdge servers by exploiting the motherboard BIOS and utilizing System Management Mode (SMM) to gain periodic execution while the Operating System loads. This technique supports multi-processor systems with RAID hardware and Microsoft Windows 2000, 2003, and XP. It currently targets Dell PowerEdge 1850/2850/1950/2950 RAID servers, using BIOS versions A02, A05, A06, 1.1.0, 1.2.0, or 1.3.7. Through remote access or [[INTERDICTION]], [[ARKSTREAM]] is used to reflash the BIOS on a target machine to implant DEITYBOUNCE and its payload (the implant installer).Can be installed by non-technical user with USB thumb drive. Once implanted, DEITYBOUNCE's frequency of execution (dropping the payload) is configurable and will occur when the target machine powers on.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[windows]] [[bios]] [[os]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[ARKSTREAM]] [[INTERDICTION]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/nsa_exploit_of.html|schneier.com - DEITYBOUNCE: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-deitybounce.jpg?w=1208&h=1562|leaksource - ANT Product Data]
* [https://www.schneier.com/blog/archives/2013/12/more_about_the.html|schneier.com - More about the NSA's Tailored Access Operations Unit]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/8||TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
=== DEVILSHANDSHAKE ===
""Short Description"" : ECI data technique
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DEWSWEEPER ===
""Short Description"" : USB (Universal Serial Bus) hardware host tap that provides [[COVERT]] link over US link into a target network. Operates w/RF relay subsystem to provide wireless Bridge into target network.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[usb]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.documentcloud.org/documents/807030-ambassade.html#document/p1|LeMonde.fr - Snowden's docs]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== DIALD ===
""Short Description"" : External internal redial and monitor daemon
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DIKTER ===
""Short Description"" : SIGINT Exchange Designator for Norway. See also ALPHA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== DIRTYEVIL ===
""Short Description"" : [[JTRIG]]'s research network
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DISCOROUTE ===
""Short Description"" : designed to suck up and database router configuration files seen in passively collected telnet sessions. NAC's router configuration database. Acquire, parse, database and display configurations files from network device. END GOAL: find more information about the network
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[telnet]] [[vpn]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/document/2014/03/20/hunt-sys-admins/|The Intercept - I Hunt Sys Admins]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== DISHFIRE ===
""Short Description"" : DISHFIRE is an SMS repository, storing over 194 million text messages a day, according to the NSA. The database includes names, geocoordinates, missed calls, SIM card changes, roaming info, travel info, and financial info. The Dishfire collection is indiscriminate, collecting "pretty much everything it can," according to an NSA presentation. An NSA program called Prefer then extracts "useful information" through message recomination and metadata extraction from stored content. GCHQ was also given full access to DISHFIRE, including UK citizens' data which GCHQ is not legally allowed to collect on its own.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[sms]] [[metadata]] [[phone]] 
""Compartments"" : [[SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[PREFER]] [[SPYDER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active (according to NSA spokesperson quoted in both Channel 4 and The Guardian articles)
""Links"" : 
* [http://www.channel4.com/news/intercept-text-messages-spy-nsa-gchq-british-phone|Channel 4 - UK and US spied on text messages of Brits]
* [http://www.theguardian.com/world/interactive/2014/jan/16/nsa-dishfire-text-messages-documents|NSA Dishfire presentation on text message collection]
* [http://www.theguardian.com/world/2014/jan/16/nsa-collects-millions-text-messages-daily-untargeted-global-sweep|The Guardian - NSA collects millions of text messages daily in 'untargeted' global sweep]
* [https://www.schneier.com/blog/archives/2014/01/nsa_collects_hu.html|schneier.com - NSA Collects Hundreds of Millions of Text Messages Daily]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== DISTANTFOCUS ===
""Short Description"" : DISTANTFOCUS pod is a new system for tactical [[SIGINT]] and precision geolocation for UAV
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : CIA
""Tags"" : [[uav]] [[geolocation]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[UAV]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/|theintercept.org - The NSA’s Secret Role in the U.S. Assassination Program]
=== DISTILLERY ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[GHOSTMACHINE]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== DIVERSITY ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== DOBIE ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[south africa]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== DOCKETDICTATE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== DOGCOLLAR ===
""Short Description"" : A type of Question-Focussed Dataset based on the Facebook display name cookie
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[facebook]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm | cryptome.org - NSA codenames]
=== DOGHANDLER ===
""Short Description"" : [[JTRIG]]'s development network
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DOORS ===
""Short Description"" : Used for maintainng all LONGHAUL's requirements processes
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[LONGHAUL]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== DRAGGABLEKITTEN ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TAO]] [[MHS]] [[XKEYSCORE]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/document/2014/03/12/menwith-hill-station-leverages-xkeyscore-quantum-yahoo-hotmail/|Menwith Hill Station Leverages XKeyscore for Quantum Against Yahoo and Hotmail]
=== DRAGON'SSHOUT ===
""Short Description"" : paltalk group chat collection
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[paltalk]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== DRAGONFLY ===
""Short Description"" : Password-authenticated key exchange (pake) protocol, suspected of containing an NSA backdoor. It has been proposed to Crypto Forum Research Group (CFRG), which helps the Internet Engineering Task Force (IETF) review the applicability and uses of cryptographic mechanisms, and give crypto advice to the organization's various Working Groups.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://arstechnica.com/security/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/ | ArsTechnica - Critics: NSA agent co-chairing key crypto standards body should be removed]
* [http://motherboard.vice.com/blog/an-nsa-agent-is-co-chairing-a-project-to-encrypt-the-web | Vice - An NSA Agent Is Co-Chairing a Project to Encrypt the Web]
* [http://www.net-security.org/secworld.php?id=16178 | Net-security.org - NSA employee will remain as co-chair on crypto standards group]
=== DREAMYSMURF ===
""Short Description"" : GCHQ's targeted tool against individual smartphones, which has the ability to stealthily activate a phone that is apparently turned off.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[GCHQ]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[NOSEYSMURF]] [[TRACKERSMURF]] [[PARANOIDSMURF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data|Angry Birds and 'leaky' phone apps targeted by NSA and GCHQ for user data]
=== DROPMIRE ===
""Short Description"" : Passive collection of emanations using antenna. (Using bugging encrypted fax machine (The Guardian)) [[DROPMIRE]] aimed at surveillance of foreign embassies and diplomatic staff, including those of NATO allies. NSA leaks show how US is bugging its European allies. The report reveals that at least "38 foreign embassies" were under surveillance, some of which as far back as 2007.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[VAGRANT]] [[CTX4000]] [[PHOTOANGLO]] [[MAGOTHY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://en.wikipedia.org/wiki/Dropmire | en.wikipedia.org - Dropmire]
* [[http://www.guardian.co.uk/world/2013/jun/30/nsa-leaks-us-bugging-european-allies | The Guardian - New NSA leaks show how US is bugging its European allies]
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1 | lemonde.fr - docs]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html |schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== DROPOUTJEEP ===
""Short Description"" : DROPOUTJEEP is a [[STRAITBIZARRE]] based software implant for the Apple iPhone operating system and uses the [[CHIMNEYPOOL]] framework. DROPOUTJEEP is compliant with the [[FREEFLOW]] project, therefore it is supported in the [[TURBULENCE]] architecture. DROPOUTJEEP is a software implant for the Apple iPhone that utilizes modular mission applications to provide specific SIGINT functionality. This functionality includes the ability to remotely push/pull files from the device, SMS retrieval, contact list retrieval, voicemail, geolocation, hot mic, camera capture, cell tower location, etc. Command, control, and data exfiltration can occur over SMS messaging or a GPRS data connection. All communications with the implant will be covert and encrypted.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[sms]] [[geolocation]] [[phone]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[STRAITBIZARRE]] [[CHIMNEYPOOL]] [[TURBULENCE]] [[FREEFLOW]] 
""Related items (Parents)"" : [[STRAITBIZARRE]] [[CHIMNEYPOOL]] 
""Related items (Children)"" : 
""Status"" : Active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 - The militarization of the Internet, by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://www.spiegel.de/static/happ/netzwelt/2014/na/v1/pub/img/Handy/S3222_DROPOUTJEEP.jpg| www.spigel.de - Slide on DROPOUTJEEP]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== DRTBOX ===
""Short Description"" : program for intercepting mobile communication networks. France in the NSA's crosshair : phone networks under surveillance. Subprograms: [[US-985D]] - France, [[US-987LA]] and [[US-987LB]] - Germany.
""Category"" : program
""Alias"" : [[LOPER]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[france]] 
""Compartments"" : 
""Related items"" : [[CANDYGRAM]] [[CYCLONE]] [[Hx9]] [[TYPHON]] [[EBSR]] [[NEBULA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.lemonde.fr/technologies/article/2013/10/21/france-in-the-nsa-s-crosshair-phone-networks-under-surveillance_3499741_651865.html?xtmc=drtbox&xtcr=1 | lemonde.fr - France in the NSA's crosshair : phone networks under surveillance]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf |cryptome.org - NSA's catalog]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://electrospaces.blogspot.fr/2013/11/drtbox-and-drt-surveillance-systems.html | electrospaces.blogspot.fr - DRTBOX and DRT surveillance systems]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== DRUID ===
""Short Description"" : non-English speaking “Third Parties.” Such intelligence was classified with the designator DRUID and was shared with third parties, countries with NATO or defense treaty relationships with the United States, with SIGINT Exchange Designators of [[DIKTER]] (Norway), [[SETTEE]] (South Korea), [[DYNAMO]] (Denmark), [[RICHTER]] (Germany), and [[ISHTAR]] (Japan). Other intelligence was shared between First and Second Parties and “Fourth Parties” that were mainly neutral or special category partners.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|http://www.intrepidreport.com/archives/8588]
=== DSD ===
""Short Description"" : Exchange designator for Australia’s Defense Signals Directorate (DSD).
""Category"" : five eyes
""Alias"" : [[ECHO]] 
""Family"" : agence
""Agency"" : DSD
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ALPHA]] [[INDIA]] [[OSCAR]] [[UNIFORM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== DYNAMO ===
""Short Description"" : [[SIGINT]] Exchange Designators of Denmark
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588 | intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== EBSR ===
""Short Description"" : Low power 802.11/GPS/RF/handset base station router, it collects data from mobile networks. The NSA agent can see the data with a control laptop.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[TYPHON]] [[CANDYGRAM]] [[DRTBOX]] [[CYCLONE Hx9]] [[NEBULA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== ECI ===
""Short Description"" : ECI (Extremely Compartimented Intelligence) is an undeterminded group of NSA partners
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[BULLRUN]] [[PAINTEDEAGLE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.eff.org/files/2013/11/15/20130905-guard-bullrun.pdf|eff.org - 20130905-guard-bullrun.pdf]
* []http://cryptome.org/doe-dir/doe-m-205-1-6.pdf| crypthome.org -doe-m-205-1-6.pdf]
=== EDGEHILL ===
""Short Description"" : EdgeHill is a counterencryption program, named for the first battle of the English Civil War of the 17th century. By 2010, the Edgehill program was unscrambling VPN traffic for 30 targets and had set a goal of an additional 300. Among the full extent of decoding capabilities from the the Five Eyes' top analysts, EdgeHill represents the British effort.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[crypto]] 
""Compartments"" : 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== EGOTISTICALGIRAFFE ===
""Short Description"" : EGOTISTICALGIRAFFE (EGGI) is a NSA program for exploiting the TOR network. / EGGI exploits a type confusion vulnerability in E4X, which is an XML extension for JavaScript. This vulnerability exists in Firefox 11.0 to 16.0.2, as well as Firefox 10.0 ESR -- the Firefox version used until recently in the Tor browser bundle. The vulnerability was then fixed by Mozilla. NSA were confident that they would be able to find a replacement Firefox exploit that worked against version 17.0 ESR.
""Category"" : attack vector
""Alias"" : [[EGGI]] 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] [[TS]] [[SI]] 
""Related items"" : [[EGOTISTICALGOAT]] [[ERRONEOUSINGENUITY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : inactive due to Firefox's updates
""Links"" : 
* [http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document | TheGuardian.com - 'Peeling back the layers of Tor with EgotisticalGiraffe' – read the document]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html |Schneier on Security : How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== EGOTISTICALGOAT ===
""Short Description"" : EGOTISTICALGOAT (EGGO) is a NSA tool for exploiting the TOR network.
""Category"" : attack vector
""Alias"" : [[EGGO]] 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] [[TS]] [[SI]] 
""Related items"" : [[EGOTISTICALGIRAFFE]] [[ERRONEOUSINGENUITY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document | TheGuardian.com - 'Peeling back the layers of Tor with EgotisticalGiraffe' – read the document]
* [http://www.wikileaks-forum.com/nsa/332/secret-nsa-documents-show-campaign-against-tor-encrypted-network/23769/ | Secret NSA documents show campaign against Tor encrypted network]
* [http://cryptome.org/2014/01/nsa-codenames.htm | cryptome.org - NSA codenames]
=== EINSTEIN ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 166 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== ELATE ===
""Short Description"" : is a suite tools for monitoring target use of the UK auctions eBay,. These tools are hosted on an internet server, and results are retreived by encrypted email.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[ebay]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ELEGANTCHAOS ===
""Short Description"" : Analysis of datas. spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== ENDUE ===
""Short Description"" : A [[COI]] for sensitive decrypts of the [[BULLRUN]] program
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[COI]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-brief-propublica-13-0905.pdf|cryptome.org - nsa-bullrun-brief-propublica-13-0905.pdf|http://cryptome.org/2013/09/nsa-bullrun-brief-propublica-13-0905.pdf|cryptome.org - nsa-bullrun-brief-propublica-13-0905.pdf]
=== ENTOURAGE ===
""Short Description"" : Application for the [[HOLLOWPOINT]] platform, including band-specific antennas and a laptop for the command and control. Controllable via gibabit Ethernet Future plans (circa 2008) included WiFi, WiMAX and LTE.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[wifi]] [[ethernet]] [[gsm]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[HOLLOWPOINT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-brief-propublica-13-0905.pdf|cryptome.org| nsa-bullrun-brief-propublica-13-0905.pdf]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== EPICFAIL ===
""Short Description"" : attacks against dumb Tor users (those don't protect their communications ?)
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
=== ERRONEOUSINGENUITY ===
""Short Description"" : ERRONEOUSINGENUITY (ERIN) is a NSA tool for exploiting the TOR network.
""Category"" : attack vector
""Alias"" : [[ERIN]] 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] [[TS]] [[SI]] 
""Related items"" : [[EGOTISTICALGIRAFFE]] [[EGOTISTICALGOAT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document | TheGuardian.com - 'Peeling back the layers of Tor with EgotisticalGiraffe' – read the document]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ESOC ===
""Short Description"" : European Security Operations Center
""Category"" : site
""Alias"" : [[European Security Operations Center]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== EVENINGEASEL ===
""Short Description"" : Program for surveillance of phone and text communications from Mexico's cell phone network.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[mexico]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/international/world/nsa-hacked-email-account-of-mexican-president-a-928817.html | DerSpiegel - NSA Accessed Mexican President's Email]
=== EVILOLIVE ===
""Short Description"" : Collects internet traffic and metadata.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theverge.com/2013/6/27/4470442/nsa-surveillance-programs-bulk-collection-of-internet-metadata | TheVerge - NSA expanded bulk collection of internet data under newly uncovered surveillance programs]
=== EWALK ===
""Short Description"" : hardware inject does packet injection on the target network
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
=== EXCALIBUR ===
""Short Description"" : acquires a Paltalk UID and/org email adress from a Screen Name
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[paltalk]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== EXOPUMP ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] [[metadata]] 
""Compartments"" : 
""Related items"" : [[TUBE]] [[PRESSUREWAVE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== EXPOW ===
""Short Description"" : [[GCHQ]]'s UIA capability provided by [[JTRIG]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== FA ===
""Short Description"" : CNE (hacking) technique used against Tor users
""Category"" : attack vector
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FACELIFT ===
""Short Description"" : Codeword related to NSA's [[SSO]] division
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[email]] 
""Compartments"" : 
""Related items"" : [[SSO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/aug/09/nsa-loophole-warrantless-searches-email-calls#zoomed-picture | theguardian.com - NSA loophole allows warrantless search for US citizens' emails and phone calls]
=== FAIRVIEW ===
""Short Description"" : FAIRVIEW (US-990) is a secret [[mass surveillance]] programme run by the NSA, aimed at collecting phone, internet and e-mail data in bulk from the computers and mobile telephones of foreign countries' citizens. According to the revelations, the NSA had collected 2.3 billion separate pieces of data from Brazilian users in January 2013 alone.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : 
""Related items"" : [[UPSTREAM]] [[OAKSTAR]] 
""Related items (Parents)"" : [[UPSTREAM]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://en.wikipedia.org/wiki/Fairview_%28surveillance_program%29| en.wikipedia.org - Fairview (surveillance program) ]
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf||SSO - The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== FALLOUT ===
""Short Description"" : spotted on [[PRISM]]'s slide
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[ORCON]] [[NOFORN]] 
""Related items"" : [[PRISM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|Slide of PRISM collection dataflow, on en.wikipedia.org]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== FASCIA ===
""Short Description"" : FASCIA is the NSA's enormous database containing trillions of device-location records that are collected from a variety of sources.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[geolocation]] [[dnr]] [[metadata]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[NOFORN]] 
""Related items"" : [[CHALKFUN]] [[SCISSORS]] [[BOUNDLESSINFORMANT]] 
""Related items (Parents)"" : [[BOUNDLESSINFORMANT]] 
""Related items (Children)"" : [[DANCINGOASIS]] [[MARINA]] [[CHALKFUN]] 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html|washingtonpost.com - NSA tracking cellphone locations worldwide, Snowden documents show]
* [http://www.theguardian.com/world/interactive/2013/jun/08/boundless-informant-nsa-full-text | www.theguardian.com - Boundless Informant: NSA explainer – full document text]
* [http://cryptome.org/2013/12/nsa-fascia.pdf|cryptome.org - FASCIA - Example of Current Volumes and limits]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== FASHIONCLEFT ===
""Short Description"" : spotted on [[TURBINE]]'s document about "APEX VPN exploitation".
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[HAMMERSTEIN]] [[TURMOIL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== FASTSCOPE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[HOMINGPIGEON]] [[NYMROD]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2013/07/more_nsa_codena.html | More NSA Code Names]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== FATYAK ===
""Short Description"" : public data collection from linkedin
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[linkedin]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== FEEDTROUGH ===
""Short Description"" : FEEDTROUGH is a persistence technique for two software implants, DNT's [[BANANAGLEE]] and CES's [[ZESTYLEAK]] used against Juniper Netscreen firewalls. FEEDTROUGH can be used to persist two implants, [[ZESTYLEAK]] and/or [[BANANAGLEE]] across reboots and software upgrades on known and covered OS's for the following Netscreen firewalls, ns5xt, ns25, ns50, ns200, ns500 and ISG 1000. There is no direct communication to or from FEEDTROUGH, but if present, the [[BANANAGLEE]] implant can receive and transmit covert channel comms, and for certain platforms, [[BANANAGLEE]] can also update FEEDTROUGH. FEEDTROUGH however can only persist OS's included in its databases. Therefore this is best employed with known OS's and if a new OS comes out, then the customer would need to add this OS to the FEEDTROUGH database for that particular firewall.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BANANAGLEE]] [[ZESTYLEAK]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/feedtrough_nsa.html|Bruce Schneier - FEEDTROUGH: NSA Exploit of the Day]
* [ http://leaksource.files.wordpress.com/2013/12/nsa-ant-feedthrough.jpg| leaksource.files.wordpress.com - Slide on FEEDTROUGH]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FERRETCANNON ===
""Short Description"" : A system that injects malware, associated with [[FOXACID]].
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] 
""Related items (Parents)"" : [[FOXACID]] 
""Related items (Children)"" : [[BEACHHEAD]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FET ===
""Short Description"" : A Field-Effect Transistor (FET) is a type of transistor commonly used for weak-signal amplification (for example, for amplifying wireless signals).The device can amplify analog or digital signals. It can also switch DC or function as an oscillator.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FINKDIFFERENT ===
""Short Description"" : (FIDI) A Firefox exploit, successful against 10 ESR, but failed against tbb-firefox
""Category"" : attack vector
""Alias"" : [[FIDI]] 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[browser]] [[tor]] 
""Compartments"" : 
""Related items"" : [[EGOTISTICALGIRAFFE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown but certainly inactive
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FIREWALK ===
""Short Description"" : FIREWALK is a bidirectional network implant, capable of passively collecting Gigabit Ethernet traffic and injecting Ethernet packets onto the same target network.” Integrates [[TRINITY]] and [[HOWLERMONKEY]]. Provides direct or indirect covert RF link to Remote Operations Center via a VPN. The version in the catalog requires soldering to a motherboard. Note: unit physically appears nearly identical to [[COTTONMOUTH-III]]. Perhaps a subclass of [[RADON]].
""Category"" : process
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[ethernet]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[HOWLERMONKEY]] [[DANDERSPRITZ]] [[TRINITY]] [[RADON]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
=== FISHBOWL ===
""Short Description"" : FISHBOWL is a mobile phone architecture developed by the NSA to provide a secure Voice over IP (VoIP) capability using commercial grade products that can be approved to communicate classified information. It is the first phase of NSA's Enterprise Mobility Architecture. The initial version was implemented using Google's Android operating system, modified to ensure central control of the phone's configuration at all times. To minimize the chance of compromise, the phones use two layers of encryption protocols, IPsec and SRTP, and employ NSA's Suite B encryption and authentication algorithms.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[os]] [[android]] [[phone]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://en.wikipedia.org/wiki/Fishbowl_%28secure_phone%29 | en.wikipedia.org - ]
* [http://www.theverge.com/2012/3/2/2838729/nsa-project-fishbowl-secure-android-devices-network|.theverge.com - NSA talks Project Fishbowl: secure Android devices on a secure network]
=== FLEMING ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[slovakia]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== FLUXBABBIT ===
""Short Description"" : Hardware based bug for Dell PowerEdge 1950 and 2950 servers using Xeon 5100 and 5300 processors. Installation requires intercepting the server (via [[INTERDICTION]], while it is enroute to its destination, disassembling it and installing the hardware. FLUXBABBIT hardware implant and provides software application persistence on Dell PowerEdge servers by exploiting the JTAG debugging interface of the server's processors
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[exploit]] 
""Compartments"" : 
""Related items"" : [[GODSURGE]] 
""Related items (Parents)"" : [[INTERDICTION]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog/servers/index.html | nsa.gov1.info - Ant catalog server]
=== FLYINGPIG ===
""Short Description"" : GCHQ SSL/TLS exploitation knowledgebase and tool used for MITM attacks against Petrobras. "FLYING PIG" that was started up in response to an increasing use of SSL encryption by email providers like Yahoo, Google, and Hotmail. The FLYING PIG system appears to allow it to identify information related to the usage of the anonymity browser Tor (it has the option to query "Tor events") and also allows spies to collect information about specific SSL encryption certificates.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[crypto]] [[petrobras]] [[brazil]] [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html |schneier.com - [Bruce Schneier] New NSA Leak Shows MITM Attacks Against Major Internet Services]
=== FOGGYBOTTOM ===
""Short Description"" : The NSA has a diverse arsenal of malware tools, each highly sophisticated and customizable for different purposes. One implant, codenamed UNITEDRAKE, can be used with a variety of “plug-ins” that enable the agency to gain total control of an infected computer.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[email]] 
""Compartments"" : 
""Related items"" : [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== FORESTWARRIOR ===
""Short Description"" : Desktop replacement for [[CERBERUS]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[SPICEISLAND]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== FOURSCORE ===
""Short Description"" : repository for tasked, full-take VPN collection (PPTP). Try to avoid relying on [[XKEYSCORE]] workflows due to legal and logistical issues.
""Category"" : program
""Alias"" : [[VDG]] 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[vpn]] [[pptp]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[MAILORDER]] [[SCISSORS]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== FOXACID ===
""Short Description"" : FOXACID identifies TOR users on the Internet and then executes an attack against their Firefox web browser.
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : [[tor]] [[tao]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [[STORMBREW]], [[FAIRVIEW]], [[OAKSTAR]] and [[BLARNEY|]]
* [[OAKSTAR]] [[QUANTUM]] [[STORMBREW]] [[FAIRVIEW]] [[OAKSTAR]] [[BLARNEY|]] [[TURBULENCE]] [[TURMOIL]] [[TUMULT]] [[XKEYSCORE]]
* [https://www.aclu.org/files/natsec/nsa/20140130/%28TS%29%20NSA%20Quantum%20Tasking%20Techniques%20for%20the%20R&T%20Analyst.pdf|aclu.org - NSA Quantum Tasking Techniques for the R&T Analyst]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - [Bruce Schneier] How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID]
* [http://arstechnica.com/security/2013/10/nsa-repeatedly-tries-to-unpeel-tor-anonymity-and-spy-on-users-memos-show/|ArsTechnica - NSA repeatedly tries to unpeel TOR anonymity and spy on users, memos show]
* [http://www.slate.com/blogs/future_tense/2013/10/04/tor_foxacid_flying_pig_nsa_attempts_to_sabotage_countersurveillance_tool.html|Slate.com - How the NSA Is Trying to Sabotage a U.S. Government-Funded Countersurveillance Tool]
* [http://www.spiegel.de/fotostrecke/qfire-die-vorwaertsverteidigng-der-nsa-fotostrecke-105358.html|Spiegel.de - NSA-Geheimdokumente: "Vorwärtsverteidigung" mit QFIRE]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FOXSEARCH ===
""Short Description"" : perhaps a database of all targets to be exploited with [[FOXACID]]
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FOXTRAIL ===
""Short Description"" : perhaps a link with [[FOXACID]] or [[FOXSEARCH]] ?
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FOXACID]] [[FOXSEARCH]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== FRA ===
""Short Description"" : 
""Category"" : program
""Alias"" : [[Forsvarets Radioanstalt]] [[Sweden]] 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-se-fra-relationship.pdf|crpytome.org - NSA intelligence relationship with Sweden]
=== FREEFLOW ===
""Short Description"" : “[[DROPOUTJEEP]] and [[TOTEGHOSTLY 2.0]] is compliant with the [[FREEFLOW]] project, therefor it is supported in the [[TURBULANCE]] architecture.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[DROPOUTJEEP]] [[FREEFLOW]] [[TURBULANCE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FREEZEPOST ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FRIEZERAMP ===
""Short Description"" : A communications protocol that certain infected devices use to communicate with the NSA. It involves HTTPS link. see also: [[TOTEGHOSTLY]]
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FRONTO ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== FRUITBOWL ===
""Short Description"" : [[CERBERUS]] UIA replacement and new tools infrastructure - Primary domain for generic user/tools access and Tor split into 3 sub-systems
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[tor]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[SPICEISLAND]] 
""Related items (Children)"" : [[NUTALLERGY]] [[BERRYTWISTER]] 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== FUNNELOUT ===
""Short Description"" : mentioned in context of tor exploitation
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== FUSEWIRE ===
""Short Description"" : Provides 24/7 monitoring of Vbulliten forums for target postings/online activity. Also allows staggered postings to be made
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[vbulliten]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GALAXY ===
""Short Description"" : Find/fix/finish program of locating signal-emitting devices of targets
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[ENTOURAGE]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== GALLANTWAVE ===
""Short Description"" : tittle of a document with the logo of DNAC (Digital Network Crypt Applications) on it
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[LONGHAUL]] [[CORNERKICK]] [[BULLRUN]] 
""Related items (Parents)"" : [[PLATINUMRING]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== GAMBIT ===
""Short Description"" : Deployable pocket-sized proxy server.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GAMUT ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== GARLICK ===
""Short Description"" : [[SIGINT]] for locating cellphone in Bude (UK)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
=== GATEWAY ===
""Short Description"" : Ability to artificially increase traffic to a website
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GCHQ ===
""Short Description"" : Exchange designator for UK's Government Communications Headquarters ([[GCHQ]]). Used during sharing of intercepted civilian communications.
""Category"" : five eyes
""Alias"" : [[ALPHA]] 
""Family"" : agence
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ECHO]] [[INDIA]] [[OSCAR]] [[UNIFORM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== GCSB ===
""Short Description"" : Exchange designator for New Zealand’s Government Communications Security Bureau (GCSB).
""Category"" : five eyes
""Alias"" : [[INDIA]] 
""Family"" : agence
""Agency"" : GCSB
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ALPHA]] [[ECHO]] [[OSCAR]] [[UNIFORM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== GECKO-II ===
""Short Description"" : [[IRONCHEF]] example included A hardware implant (MRRF or GSM), IRONCHEF persistence backdoor, “Software implant [[UNITEDRAKE]] Node”
""Category"" : process
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[IRONCHEF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
=== GENESIS ===
""Short Description"" : GENESIS is a modified Motorola handset, a spectrum analyzer tool, collecting and locating signals. Informations are downloaded to a laptop via ethernet port.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== GENIE ===
""Short Description"" : implants of spywares. Multi-stage operation: jumping the airgap etc.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BLACKFOOT]] [[WABASH]] [[BRUNEAU]] [[HEMLOCK]] 
""Status"" : projected ?
""Links"" : 
* [http://leaksource.wordpress.com/2013/08/31/codename-genie-nsa-to-control-85000-implants-in-strategically-chosen-machines-around-the-world-by-year-end/|leaksource - Codename GENIE: NSA to Control 85,000 “Implants” in Strategically Chosen Machines Around the World by Year End]
* [http://www.lemonde.fr/international/article/2013/10/22/la-diplomatie-francaise-sur-ecoute-aux-etats-unis_3500717_3210.html|LeMonde.fr - la diplomatie française était sur écoute aux Etats-Unis]
* [http://rt.com/usa/nsa-cyber-operations-classified-247/|rt.com - Snowden leaks: NSA conducted 231 offensive cyber-ops in 2011, hailed as 'active defense']
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== GENTE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== GEOFUSION ===
""Short Description"" : related to Petrobras story
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== GESTATOR ===
""Short Description"" : Amplification of a given mesage, normally video, on popular multimedia websites, like Youtube.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[video]] [[youtube]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GHOSTMACHINE ===
""Short Description"" : [[GHOSTMACHINE]] is the NSA's [[SSO]] (Special Source Operations) cloud analytics platform.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[DISTILLERY]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
* [http://cryptome.org/2013/12/nsa-ghost-machine.pdf|Cryptome.org - nsa-ghost-machine]
=== GILGAMESH ===
""Short Description"" : The NSA geolocation system used by JSOC is known by the code name GILGAMESH. Under the program, a specially constructed device is attached to the drone. As the drone circles, the device locates the SIM card or handset that the military believes is used by the target. That, in turn, allows the military to track the cell phone to within 30 feet of its actual location, feeding the real-time data to teams of drone operators who conduct missile strikes or facilitate night raids.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[uav]] [[gsm]] [[drone]] [[geolocation]] [[phone]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[UAV]] 
""Related items (Children)"" : [[UAV]] 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/|theintercept.org - The NSA’s Secret Role in the U.S. Assassination Program]
=== GINSU ===
""Short Description"" : GINSU provides software application persistence for the CNE implant, [[KONGUR]], on target systems with the PCI bus hardware implant, [[BULLDOZER]]. This technique supports any desktop PC system that contains at least one PCI connector (for [[BULLDOZER]] installation) and Microsoft Windows 9x, 2000, 20003, XP, or Vista. Through interdiction, [[BULLDOZER]] is installed in the target system as a PCI bus hardware implant. After fielding, if [[KONGUR]]. is removed from the system as a result of an operation system upgrade or reinstall, GINSU can be set to trigger on the next reboot of the system to restore the software implant.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[windows]] [[os]] [[pci]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[BULLDOZER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/ginsu_nsa_explo.html|www.schneier.com - GINSU: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-ginsu.jpg|leaksource.wordpress.com - TAO's Catalog Page with Graphic]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== GLASSBACK ===
""Short Description"" : Technique of getting IP adress by pretending to be a spammer and ringing them Target does not need to answer.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GLITTERBALL ===
""Short Description"" : Online Gaming Capabilities for Sensitives Operations. Currently Second Life.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[second life]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GM-PLACE ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== GNETWORKGNOME ===
""Short Description"" : Tool used to extract and correlate information from variety of NAC, SSG, SSO, NTOC and other metadata databases
""Category"" : program
""Alias"" : [[GNETWORK GNOME]] 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[metadata]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== GODFATHER ===
""Short Description"" : public data collection from facebook
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[facebook]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GODSURGE ===
""Short Description"" : runs on the [[FLUXBABBIT]] hardware implant and provides software application persistence on Dell PowerEdge servers by exploiting the JTAG debugging interface of the server's processors.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[FLUXBABBIT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org -NSA's catalog]
* [http://www.theregister.co.uk/2013/12/31/nsa_weapons_catalogue_promises_pwnage_at_the_speed_of_light/?page=2|TheRegister - How the NSA hacks PCs, phones, routers, hard disks 'at speed of light': Spy tech catalog leaks]
=== GOODFELLA ===
""Short Description"" : generic framework for public data collection from online social networks.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[social network]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== GOPHERSET ===
""Short Description"" : Malware for GSM Phase 2+ SIM cards that use the SIM Toolkit (STK). Exfiltrates phonebook, SMS, and call logs, via SMS, to a predefined phone number. Installed either via a USB sim card reader, or remotely (over the air provisioning)
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[usb]] [[sms]] [[phone]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/9|www.digitaltrends.com -TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
=== GOURMETTROUGH ===
""Short Description"" : GOURMETTROUGH is a user configurable implant for certain Juniper firewalls. It persists DNT's [[BANANAGLEE]] implant across reboots and OS upgrades. For some platforms, it supports a minimal implant with beaconing for OS's unsupported by [[BANANAGLEE]]. For supported platforms, DNT may configure without ANT involvement. Except for limited platforms, they may also configure PBD for minimal implant in the case where an OS unsupported by [[BANANAGLEE]] is booted. GOURMETTROUGH is on the shelf and has been deployed on many target platforms. It supports nsg5t, ns50, ns25, isg1000 (limited). Soon- ssg140, ssg5, ssg20
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BANANAGLEE]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/gourmettrough_n.html|.schneier.com - Bruce Schneier's Blog GOURMETTROUGH: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-gourmettrough.jpg|leaksource.files.wordpress.com - Slide on GOURMETTROUGH]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== GRANDMASTER ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) page 90
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[WEALTHYCLUSTER]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== GREATEXPECTATIONS ===
""Short Description"" : NSA version of [[QUICKANT]] ([[GCHQ]] tor analytics/knowledgebase)
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : [[QUICKANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== GROK ===
""Short Description"" : GROK is used to log keystrokes.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== GTE ===
""Short Description"" : Global Telecoms Exploitation is reportedly a secret British telephonic mass surveillance programme run by [[GCHQ]], it's a subprogram of [[TEMPORA]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[MTI]] 
""Related items (Parents)"" : [[TEMPORA]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://en.wikipedia.org/wiki/Global_Telecoms_Exploitation|Wikipedia - Global Telecoms Exploitation]
* [http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa|The Guardian - GCHQ taps fibre-optic cables for secret access to world's communications]
=== GUMFISH ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== GURKHASSWORD ===
""Short Description"" : Beaconed Microsoft Office Documents to elicite a targets IP address
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[microsoft]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== HACIENDA ===
""Short Description"" : is a port scanning tool designed to scan an entire country or city. It uses [[GEOFUSION]] to identify IP locations. Banners and content are pulled back on certains ports. Content is put into the [[EARTHLING]] database, and all other scanned data is sent to GNE and is available through [[GLOBALSURGE]] and fleximart.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[GLOBALSURGE]] [[EARTHLING]] [[GEOFUSION]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : [[EARTHLING]] [[GEOFUSION]] 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
* [http://www.heise.de/ct/artikel/NSA-GCHQ-The-HACIENDA-Program-for-Internet-Colonization-2292681.html|NSA/GCHQ: The HACIENDA Program for Internet Colonization]
=== HALLUXWATER ===
""Short Description"" : Persistent Back Door implant installed on a target Huawei Eudemon firewall as a boot ROM upgrade. When the target reboots, the PBD installer software will find the needed patch points and install the back door in the inbound packet processing routine. The program communicates with an NSA operator via [[TURBOPANDA]].
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[huawei]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] [[FOUO]] 
""Related items"" : [[TURBOPANDA]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/halluxwater_nsa.html|Bruce Schneier's Blog: HALLUXWATER: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-halluxwater.jpg|Slide on HALLUXWATER]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== HAMMERCHANT ===
""Short Description"" : 
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
* [https://www.aclu.org/files/natsec/nsa/vpn-and-voip-exploitation-with-hammerchant-and.pdf|vpn-and-voip-exploitation-with-hammerchant]
=== HAMMERMILL ===
""Short Description"" : HAMMERMILL Insertion Tool (HIT) is command and control system, designed by DNT for exploited Huawei routers
""Category"" : program
""Alias"" : [[HIT]] 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[huawei]] 
""Compartments"" : 
""Related items"" : [[HEADWATER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-headwater.jpg|leaksource - TAO's Page Catalog with Graphics]
=== HAMMERSTEIN ===
""Short Description"" : 
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
* [https://www.aclu.org/files/natsec/nsa/vpn-and-voip-exploitation-with-hammerchant-and.pdf|vpn-and-voip-exploitation-with-hammerchant]
=== HAPPYFOOT ===
""Short Description"" : This program helps the NSA to map Internet addresses to physical locations more precisely than is possible with traditional Internet geolocation services. It utilizes leaked location-based information from mobile apps and services.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[browser]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/|washingtonpost.com | NSA uses Google cookies to pinpoint targets for hacking]
=== HAPPYHOUR ===
""Short Description"" : spotted on a document leaked by the Spiegel on 2015-01-17. This program appear in an interactive operations with the USS Annapolis (18 novembre 2011).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[BLINDDATE]] [[HAPPYHOUR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== HAVOK ===
""Short Description"" : Real-time website cloning technique allowing on-the-fly alterations. Seems to have replaced [[TANNER]].
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[TANNER]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== HAWKEYE ===
""Short Description"" : one of the world’s largest databases, and the firm’s 312 terabyte HAWKEYE database, containing every domestic telephone communication from 2001.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== HC12 ===
""Short Description"" : an earlier micro-computer design the NSA used in bugs.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[JUNIORMINT]] [[TRINITY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://nsa.imirhil.fr/documents/20131230-appelbaum-nsa_ant_catalog.pdf|nsa.imirhil.fr - appelbaum-nsa_ant_catalog]
=== HEADMOVIES ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== HEADWATER ===
""Short Description"" : HEADWATER is a Persistent Backdoor (PDB) software implant for selected Huawei routers. The implant will enable covert functions to be remotely executed within the router via an Internet connection.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[huawei]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[TAO]] [[TURBOPANDA]] [[HAMMERMILL]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/headwater_nsa_e.html|Bruce Schneier's Blog - HEADWATER: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-headwater.jpg|leaksource - TAO's Page Catalog with Graphics]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== HEMLOCK ===
""Short Description"" : Name of an operation to bug the italian ambassy in Washington, introducing spywares in foreign embassies.
""Category"" : mission
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[italy]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] 
""Related items (Parents)"" : [[GENIE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|TheGuardian-New NSA leaks show how US is bugging its European allies]
=== HEROICSAND ===
""Short Description"" : Release of [[LONGHAUL]].  spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[LONGHAUL]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== HIGHCASTLE ===
""Short Description"" : for voice processing and analysis and reporting
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== HIGHLANDS ===
""Short Description"" : Collection from Implants
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[KATEEL]] [[POCOMOKE]] [[MERCED]] [[PERDIDO]] [[MAGOTHY]] [[BLACKFOOT]] [[WABASH]] [[NAVARRO]] [[POWELL]] [[KLONDIKE]] [[NASHUA]] [[OSAGE]] [[OSWAYO]] [[HEMLOCK]] [[MULBERRY]] [[FLEMING]] [[DOBIE]] [[NAVAJO]] [[PANTHER]] 
""Related items (Parents)"" : [[GENIE]] [[BLACKFOOT]] [[WABASH]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|.schneier.com - Code Names for NSA Exploit Tools]
* [http://www.lemonde.fr/international/article/2013/10/22/la-diplomatie-francaise-sur-ecoute-aux-etats-unis_3500717_3210.html|LeMonde.fr- Espionnage de la NSA : la diplomatie française était sur écoute aux Etats-Unis]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== HIGHPRIDE ===
""Short Description"" : Spot in document dealing with BOTANICREALTY aiming at powning a specific kind of video network. The attacked stream seems to travel on waves due to frequency and carrier analysis done. The given interception point is located in a so called place "LADYLOVE" (The NSA satellite intercept station at Misawa, Japan (since 1982)).
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[radio]] 
""Compartments"" : [[TOP SECRET]] [[COMIN]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[SALTYDOGS]] 
""Related items (Parents)"" : [[BOTANICREALTY]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== HIGHTIDE ===
""Short Description"" : see [[SKYWRITER]] ?
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== HOLLOWPOINT ===
""Short Description"" : GSM/UTMS/CSMA2000/FRS signal platform. Operates In the 10MHz to 4GHz range. Includes receiver and antenna. Can both transmit and receive.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[ENTOURAGE]] [[NEBULA]] [[GALAXY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://nsa.imirhil.fr/documents/20131230-appelbaum-nsa_ant_catalog.pdf|nsa.imirhil.fr - appelbaum-nsa_ant_catalog]
=== HOMEBASE ===
""Short Description"" : Tactical tasking tool for digital network identification
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== HOMEPORTAL ===
""Short Description"" : A central hub for all JTRIG [[CERBERUS]] tools
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== HOMINGPIGEON ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FASTSCOPE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== HOSTELPENALTY ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[POISONNUT]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== HOWLERMONKEY ===
""Short Description"" : HOWLERMONKEY (CM) is a COTS-based transceiver. Covert short to medium range RF. Designed to be integrated with a larger device, like RJ45. Communicates over [[SPECULATION]] and [[CONJECTURE]] protocols. Known products that include HOWLERMONKEY are: [[COMMONMOUTH-1]] [[COMMONMOUTH-2]] [[FIREWALK]] [[SUTURESAILOR]] [[YELLOWPIN]]
""Category"" : attack vector
""Alias"" : [[CM]] 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[FIREWALK]] 
""Status"" : unknown
""Links"" : 
* [http://www.dailytech.com/Businesses+Deny+Helping+NSA+Plant+Bugs+in+Americans+Gadgets/article34022.htm|dailytech.com - Businesses Deny Helping NSA Plant Bugs in Americans' Gadgets]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== HUSHPUPPY ===
""Short Description"" : [[GCHQ]] Tool, related to exploitation
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf||cryptome.org - NSA's catalog]
=== HUSK ===
""Short Description"" : Secure one-to-one web based dead-drop messaging platform
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== IBIS ===
""Short Description"" : Spoted on nsa fy13 semiannual report
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/07/nsa-fy13-semiannual-report.pdf | nsa-fy13-semiannual-report-1.pdf]
=== ICE ===
""Short Description"" : is an advanced IP havesting technique
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== ICREACH ===
""Short Description"" : ICREACH is a search engine for information on the private communications of foreigners and, it appears, millions of records on American citizens who have not been accused of any wrongdoing. .ICREACH has been accessible to more than 1,000 analysts
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [NSA]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[PROTON]] [[CRISSCROSS]] [[GLOBALREACH]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : since 2007
""Links"" : 
* [https://firstlook.org/theintercept/2014/08/25/icreach-nsa-cia-secret-google-crisscross-proton/ | The Surveillance Engine : How the NSA built its Own Secret Google]
=== ICREAST ===
""Short Description"" : [[COMINT]] [[NOFORN]] program collecting metadata from cellular users spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[voip]] [[metadata]] 
""Compartments"" : 
""Related items"" : [[PROTON]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== IHUNTSYSADMINS ===
""Short Description"" : List of different methods used by NSA operators in order to get into some valuable computers by first target administrator of the network their belong to.
""Category"" : mission
""Alias"" : [[I HUNT SYSADMINS]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[QUANTUM]] [[DISCOROUTE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/|The Intercept - I hunt sysadmins]
* [http://cryptome.org/2014/03/nsa-hunt-sysadmins.pdf|Cryptome - PDF for I hunt sysadmins ]
=== IMP ===
""Short Description"" : [[GCHQ]] Abandonned in 2009, the new name is Communications Capabilities Development Program ([[CCDP]]).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[email]] 
""Compartments"" : 
""Related items"" : [[CCDP]] [[TEMPORA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[CCDP]] 
""Status"" : inactive
""Links"" : 
* [http://www.telegraph.co.uk/technology/internet/9090617/Phone-and-email-records-to-be-stored-in-new-spy-plan.html|The Telegraph - Phone and email records to be stored in new spy plan]
* [https://en.wikipedia.org/wiki/Interception_Modernisation_Programme|Wikipedia - Interception Modernisation Program]
* [https://nsa.imirhil.fr/documents/csec-br-spy.pdf|nsa.imirhil.fr - csec-br-spy]
=== IMPERIALBARGE ===
""Short Description"" : For connecting two target phone together in a call
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[phone]] [[gsm]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== INCENSER ===
""Short Description"" : a subprogram of [[WINDSTOP]] who collected over 14 billion records in the same period.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[WINDSTOP]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://electrospaces.blogspot.fr/2014/11/incenser-or-how-nsa-and-gchq-are.html|INCENSER, or how NSA and GCHQ are tapping internet cables ]
* [http://cryptome.org/2013/10/nsa-windstop-muscular-incenser.pdf | cryptome.org - nsa-windstop-muscular-incenser.pdf]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [https://nsa.imirhil.fr/documents/nsa-cable-spy-types.pdf|nsa.imirhil.fr - nsa-cable-spy-types]
* [https://nsa.imirhil.fr/documents/nsa-windstop-muscular-incenser.pdf|nsa.imirhil.fr - nsa-windstop-muscular-incenser]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== INDRA ===
""Short Description"" : spotted on the "NSA Worldwide SIGINT Defense Cryptologic Platform map"
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[NOFORN]] 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://nsa.gov1.info/dni/| nsa.gov1.info/dni/ - INDRA / FORNSAT]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== INSPECTOR ===
""Short Description"" : Tool for monitoring domain information and site avaibility.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== INTELINK ===
""Short Description"" : The IntelLINK intelligence network links information in the various classified databases of the US intelligence agencies (e.g. FBI, CIA, DEA, NSA, USSS, NRO) to facilitate communication and the sharing of documents and other resources.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.fas.org/irp/program/disseminate/intelink.htm| fas.org - Intelink]
* [https://www.intelink.gov| intelink.gov ]
* [http://ra.intelink.gov/eligibilitycriteria.pdf | intelink.gov - intelink management directive]
=== INTERDICTION ===
""Short Description"" : So-called "off-net" operations include tampering with your hardware while it is being shipped. They call this process [[INTERDICTION]].
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ARKSTREAM]] [[TAO]] [[INTERDICTION]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[BULLDOZER]] 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://nsa.imirhil.fr/documents/no-place-to-hide.pdf|nsa.imirhil.fr - no-place-to-hide]
=== INTERQUAKE ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) Terrestrial Environmental Knowledge Base
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== IRATEMONK ===
""Short Description"" : provides software application persistence on desktop and laptop computers by implanting the hard drive firmware to gain execution throught Master Boot Record (MBR) substitution. This technique supports systems without RAID hardware that boot from a variety of Western Digital, Seagate, Maxtor and Samsung hard drives on FAT, NTFS, EXT3 and UFS file systems. Through remote access or [[INTERDICTION]], [[UNITEDRAKE]], or [[STRAITBAZZARE]] are used in conjunction with [[SLICKERVICAR]] to upload the hard drive firmware onto the target machine to implant IRATEMONK and its payload (the implant installer). Once implanted, IRATEMONK's frequency of execution (dropping the payload) is configurable and will occur when the target machine powers on.
""Category"" : attack vector
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[windows]] [[os]] [[hard drive]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] [[FVEY]] 
""Related items"" : [[UNITEDRAKE]] [[STRAITBAZZARE]] [[SLICKERVICAR]] 
""Related items (Parents)"" : [[INTERDICTION]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://www.schneier.com/blog/archives/2014/01/iratemonk_nsa_e.html|IRATEMONK: NSA Exploit of the Day]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== IRONCHEF ===
""Short Description"" : IRONCHEF provides access persistence to target systems by exploiting the motherboard BIOS and utilizing System Management Mode (SMM) to communicate with a hardware implant that provides two-way RF communication.This technique supports the HP Proliant 380DL G5 server, onto which a hardware implant has been installed that communicates over the I2C Interface ([[WAGONBED]]). Through [[INTERDICTION]], IRONCHEF, a software CNE implant and the hardware implant are installed onto the system. If the software CNE implant is removed from the target machine, IRONCHEF is used to access the machine, determine the reason for removal of the software, and then reinstall the software from a listening post to the target system.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[bios]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[WAGONBED]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf||cryptome.org -NSA's catalog]
* [https://www.schneier.com/blog/archives/2014/01/nsa_exploit_of_1.html|IRONCHEF: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-ironchef.jpg|IRONCHEF - ANT product data]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/11|TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
=== IRONSAND ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in New Zealand
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== ISHTAR ===
""Short Description"" : SIGINT Exchange Designators of Japan
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== ISLANDHIDEAWAY ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[SCARLETFEVER]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== ISLANDTRANSPORT ===
""Short Description"" : “Enterprise Message Service”, as part of the [[QUANTUMTHEORY]] system [[IVORY]].
""Category"" : process
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[QUANTUMTHEORY]] 
""Related items (Children)"" : 
""Status"" : Retired
""Links"" : 
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [http://electrospaces.blogspot.com/p/nicknames-and-codewords.html|electrospaces.blogspot.com - US Nicknames and Codewords]
=== JACKKNIFE ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Yakima (USA)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[fornsat]] [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== JAZZFUSION ===
""Short Description"" : [[BOMBAYROLL]] replacement which will also incorporate new collectors - Primary domain for dedicated connections split into 3 sub-systems
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[BOMBAYROLL]] 
""Related items (Parents)"" : [[SPICEISLAND]] 
""Related items (Children)"" : [[COUNTRYFILE]] [[TECHNOVIKING]] 
""Status"" : unknow
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== JAZZFUSION+ ===
""Short Description"" : A sub-system of [[JAZZFUSION]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[JAZZFUSION]] 
""Related items (Parents)"" : [[JTRIG]] [[JAZZFUSION]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== JEDI ===
""Short Description"" : [[JTRIG]] will shortly be rolling out a [[JEDI]] pod to everydesk of every member of an Intelligence Production Team. The challenge is to scale up to over 1,200 users whilist remaining agile, efficent and responsive to customer needs.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[JEDI]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== JEDIMINDTRICK ===
""Short Description"" : Release of [[LONGHAUL]]. spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[LONGHAUL]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== JEEPFLEA ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== JETPLOW ===
""Short Description"" : JETPLOW is a firmware persistence implant for Cisco PIX Series and ASA (Adaptive Security Appliance) firewalls. It persists DNT's [[BANANAGLEE]] software implant. JETPLOW also has a persistent back-door capability.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[cisco]] [[router]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BANANAGLEE]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/jetplow_nsa_exp.html|schneier.com - JETPLOW: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-jetplow.jpg| leaksource.files.wordpress.com - Slide on JETPLOW]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== JILES ===
""Short Description"" : is a [[JTRIG]] bespoke web browser
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[browser]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== JTRIG ===
""Short Description"" : A program for discrediting a target. The target is invited to go to a certain URL. Then, JTRIG has the ability to change some things. For example, JTRIG can change the photo on a social networking service. JTRIG emails/text the colleagues, neighbours, friends of the target.
""Category"" : agence
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]] [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[GCHQ]] 
""Related items (Children)"" : [[AMBASSADORS RECEPTION]] 
""Status"" : unknown
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the book of Glenn Greenwald "No Place to Hide"]
=== JTRIGRADIANTSPLENDOUR ===
""Short Description"" : is a "Data Diode" connecting the [[CERBERUS]] network with GCNET.
""Category"" : program
""Alias"" : [[JTRIG RADIANT SPLENDOUR]] 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== JUGGERNAUT ===
""Short Description"" : Picks up all signals from mobile networks. The NSA's signal-processing system for ingesting telephony information, including SS7 signaling - a technical term for the method by which cell-phone networks communicate with each other.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[gsm]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/fotostrecke/photo-gallery-nsa-documentation-of-spying-in-germany-fotostrecke-99672-4.html|spiegel.de - Photo Gallery: NSA Documentation of Spying in Germany]
* [http://apps.washingtonpost.com/g/page/world/ghostmachine-the-nsas-cloud-analytics-platform/644/#document/p2/a135401l | washingtonpost.com - GHOSTMACHINE: The NSA's cloud analytics platform]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== JUNIORMINT ===
""Short Description"" : A generic, programmable miniature computer. For use in concealed bugs. Specs: 400Mhz ARM 9 microcontroller, 32 MB Flash, 64 MB SDRAM, 128MB DDR2 and an “XC4VLX25 10752 Slice” FPGA. Implant digital core, either mini printed circuit board or ultra-mini Flip Chip Module, contains ARM9 micro-controller, FPGA Flash SDRAM and DDR2 memories
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[tao]] [[ant]] [[integrated circuit]] 
""Compartments"" : 
""Related items"" : [[MAESTRO II]] [[TRINITY]] [[SPARROW II]] [[TAO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/4|www.digitaltrends.com -TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== KAMPUS ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== KATEEL ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[brazil]] 
""Compartments"" : 
""Related items"" : [[LIFESAVER]] [[HIGHLANDS]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== KEYCARD ===
""Short Description"" : Identify, select and task target in VPN session
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[TURMOIL]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== KEYRUT ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== KLONDYKE ===
""Short Description"" : Name of an operation to bug the greek embassy in Washington.
""Category"" : mission
""Alias"" : [[KLONDIKE]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[greece]] 
""Compartments"" : 
""Related items"" : [[GENIE]] [[POWELL]] [[HIGHLANDS]] [[LIFESAVER]] [[PBX]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|TheGuardian - New NSA leaks show how US is bugging its European allies]
=== KOALAPUNCH ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 29 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== KONGUR ===
""Short Description"" : malware payload, known to be deployed via KONGUR (?) Software implant restorable by [[GINSU]] after OS upgrade or reinstall
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[BULLDOZER]] 
""Related items (Parents)"" : [[GINSU]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://nsa.imirhil.fr/documents/20131230-appelbaum-nsa_ant_catalog.pdf|nsa.imirhil.fr - appelbaum-nsa_ant_catalog]
=== LADYLOVE ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Misawa (JP)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== LANDINGPARTY ===
""Short Description"" : Tool for auditing dissemination of [[VIKINGPILLAGE]] data.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[VIKINGPILLAGE]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== LANDSHARK ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[EBSR]] [[CANDYGRAM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://www.eff.org/document/20131230-appelbaum-nsa-ant-catalog|www.eff.org - 20131230-Appelbaum-NSA ANT Catalog]
=== LEGION-JADE ===
""Short Description"" : GCHQ cover term, somehow associated with [[FLYINGPIG]], which is a tool used for exploitation. It is probable that this term is also related to exploitation in some way.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FLYINGPIG]] [[HUSHPUPPY]] [[BYZANTINECANDOR]] [[BYZANTINEHADES]] [[BYZANTINEANCHOR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== LEGION-RUBY ===
""Short Description"" : GCHQ cover term, somehow associated with [[FLYINGPIG]], which is a tool used for exploitation. It is probable that this term is also related to exploitation in some way.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FLYINGPIG]] [[HUSHPUPPY]] [[BYZANTINECANDOR]] [[BYZANTINEHADES]] [[BYZANTINEANCHOR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== LEMONWOOD ===
""Short Description"" : [[SIGINT]] for locating cellphone in Thailand
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
=== LFS-2 ===
""Short Description"" : A processing system for [[VAGRANT]] signals returned by the [[PHOTOANGLO]] system. Requires an external monitor to display the signal.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[PHOTOANGLO]] [[NIGHTWATCH]] [[VAGRANT]] 
""Related items (Parents)"" : [[VAGRANT]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://nsa.imirhil.fr/documents/20131230-appelbaum-nsa_ant_catalog.pdf|nsa.imirhil.fr - appelbaum-nsa_ant_catalog]
=== LHR ===
""Short Description"" : [[LONGHAUL]] (?) Relay
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://nsa.imirhil.fr/documents/nsa-scissors.pdf|nsa.imirhil.fr - nsa-scissors]
* [https://nsa.imirhil.fr/documents/nsa-smartphones.pdf|nsa.imirhil.fr - nsa-smartphones]
=== LIFESAVER ===
""Short Description"" : Imaging of the Hard Drive.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[BRUNEAU]] [[KATEEL]] [[POCOMOKE]] [[BANISTER]] [[PERDIDO]] [[POWELL]] [[KLONDIKE]] [[NASHUA]] [[OSAGE]] [[ALAMITO]] [[YUKON]] [[WESTPORT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org -NSA's catalog]
* [https://nsa.imirhil.fr/documents/no-place-to-hide.pdf|nsa.imirhil.fr - no-place-to-hide]
=== LITHIUM ===
""Short Description"" : Facility to filter and gather data at a major (foreign?) telecommunications company
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://online.wsj.com/article/SB10001424127887324108204579022874091732470.html?mod=WSJEurope_hpp_LEFTTopStories | wsj.com - New Details Show Broader NSA Surveillance Reach]
=== LOCKSTOCK ===
""Short Description"" : An eight year/$51M Time & materiel contract with General Dynamics, located in Annapolis Junction, MD. for the support of the LOCKSTOCK collection system used by MYSTIC and RAM-M. Processes all MYSTIC data for other NSA accesses.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[MYSTIC]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/05/19/data-pirates-caribbean-nsa-recording-every-cell-phone-call-bahamas/|The Intercept : Data Pirates of the Caribbean: The NSA Is Recording Every Cell Phone Call in the Bahamas]
=== LONGHAUL ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== LONGRUN ===
""Short Description"" : Spoted on HACIENDA documents
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[HACIENDA]] [[OLYMPIA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.heise.de/ct/artikel/NSA-GCHQ-The-HACIENDA-Program-for-Internet-Colonization-2292681.html | NSA/GCHQ: The HACIENDA Programm for Internet Colonization - slide 19]
=== LONGSHOT ===
""Short Description"" : File-upload and sharing website
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== LOPERS ===
""Short Description"" : [[LOPERS]] is a software application for Public Switched Telephone Networks.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/fotostrecke/photo-gallery-nsa-documentation-of-spying-in-germany-fotostrecke-99672-4.html|spiegel.de - Photo Gallery: NSA Documentation of Spying in Germany]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== LOUDAUTO ===
""Short Description"" : Audio-based RF retro-reflector. Provides room audio from targeted space using radar and basic post-processing. LOUDAUTO's current design maximizes the gain of the microphone. This makes it extremely useful for picking up room audio. It can pick up speech at a standard, office volume from over 20' away. (NOTE: Concealments may reduce this distance.) It uses very little power (~15 uA at 3.0 VDC), so little, in fact, that battery self-discharge is more of an issue for serviceable lifetime than the power draw from this unit. The simplicity of the design allows the form factor to be tailored for specific operation requirements. All components at COTS and so are non-attributable to NSA.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[tao]] [[ant]] [[microphone]] 
""Compartments"" : [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[ANGRYNEIGHBOR]] [[VARGANT]] [[CTX4000]] [[PHOTOANGLO]] [[DROPMIRE]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/loudauto_nsa_ex.html|schneier.com - NSA Exploit of the Day]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://nsa.imirhil.fr/documents/20131230-appelbaum-nsa_ant_catalog.pdf|nsa.imirhil.fr - appelbaum-nsa_ant_catalog]
=== LUMP ===
""Short Description"" : A system that finds the avatar name from a SecondLife AgentlD
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[second life]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== LUTEUSICARUS ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) pages : 29 and 33. United Kingdom and USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== MADCAPOCELOT ===
""Short Description"" : Subprogram of [[STORMBREW]] ([[UPSTREAM]]) - DNI and metadata through [[XKEYSCORE]], [[PINWALE]] and [[MARINA]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dni]] [[russia]] [[EU]] 
""Compartments"" : 
""Related items"" : [[STORMBREW]] [[PINWALE]] [[MARINA]] [[XKEYSCORE]] 
""Related items (Parents)"" : [[STORMBREW]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/STORMBREW|STORMBREW on en.wikipedia.org]
* [http://electrospaces.blogspot.fr/2014/01/slides-about-nsas-upstream-collection.html|electrospaces.blogspot.fr - UPSTREAM]
=== MAESTRO-II ===
""Short Description"" : A generic, programmable miniature computer. For use in concealed bugs. Specs: 66Mhz ARM 7 microcontroller, 4 MB Flash, 8 MB SDRAM an “XC2V500 500k gates” FPGA. Roughly the same size as a dime.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[tao]] [[ant]] [[integrated circuit]] 
""Compartments"" : 
""Related items"" : [[JUNIORMINT]] [[TRINITY]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog/computers/index.html#MAESTRO-II|nsa.gov1.info/dni/nsa-ant-catalog]
=== MAGNETIC ===
""Short Description"" : sensor collection of magnetic emanations. Tempest style attack.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] 
""Related items"" : [[NASHUA]] [[MULBERRY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== MAGNUMOPUS ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 29 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== MAGOTHY ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[EU]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] [[MINERALIZ]] [[DROPMIRE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== MAILORDER ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== MAINCORE ===
""Short Description"" : Main core is a database which contains informations about millions of Americans citizens, including NSA intercepts of bank and credit card transactions and the results of surveillance efforts, coming from others agencies as such as FBI and CIA, and collected and stored without warrants or court ordersThe Main Core database is believed to have originated with the Federal Emergency Management Agency (FEMA) in 1982, following Ronald Reagan's Continuity of Operations plan outlined in the National Security Directive (NSD) 69 / National Security Decision Directive (NSDD) 55, entitled "Enduring National Leadership," implemented on September 14, 1982.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[PROMIS]] [[PRISM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://en.wikipedia.org/wiki/Main_Core| en.wikipedia.org]
=== MAINWAY ===
""Short Description"" : MAINWAY is a database maintained by the NSA containing metadata for hundreds of billions of telephone calls made through the four largest telephone carriers in the United States: AT&T and Verizon. It is estimated that the database contains over 1.9 trillion call-detail records. The records include detailed call information (caller, receiver, date/time of call, length of call, etc.) for use in traffic analysis and social network analysis, but do not include audio information or transcripts of the content of the phone calls. Similar programs exist or are planned in other countries, including Sweden (Titan traffic database) and Great Britain (Interception Modernisation Programme)
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[metadata]] 
""Compartments"" : 
""Related items"" : [[FALLOUT]] [[PRISM]] [[MARINA]] 
""Related items (Parents)"" : [[FALLOUT]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://en.wikipedia.org/wiki/MAINWAY|en.wikipedia.org - MAINWAY]
* [http://www.usatoday.com/news/washington/2006-05-10-nsa_x.htm|USA Today - NSA has massive database of Americans' phone calls]
* [https://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|en.wikipedia.org - Slide of PRISM collection dataflow]
* [http://cryptome.org/2013/09/nsa-syanpse.htm|cryptome.org - the SYANPSE data model]
* [https://www.aclu.org/sites/default/files/assets/stellarwind-classification-guide.pdf|Stellarwind classification guide on ACLU website]
* [https://www.aclu.org/sites/default/files/assets/content_acquisition_optimization.pdf|Content Acquisition Optimization on ACLU website]
=== MALIBU ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== MARINA ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[email]] [[dni]] [[webcam]] [[metadata]] [[VoIP]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[ORCON]] [[NOFORN]] 
""Related items"" : [[PRISM]] [[FALLOUT]] [[PINWALE]] [[MAINWAY]] 
""Related items (Parents)"" : [[FALLOUT]] 
""Related items (Children)"" : [[XKEYSCORE]] 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|en.wikipedia.org - Slide of PRISM collection dataflow]
* [https://en.wikipedia.org/wiki/MARINA|en.wikipedia.org - MARINA]
* [http://www.theguardian.com/world/2013/sep/30/nsa-americans-metadata-year-documents|theguardian.com - "NSA stores metadata of millions of web users for up to a year, secret files show"]
* [http://www.spiegel.de/fotostrecke/nsa-dokumente-so-uebernimmt-der-geheimdienst-fremde-rechner-fotostrecke-105329.html|spiegel.de - NSA-Dokumente: So übernimmt der Geheimdienst fremde Rechner]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No Place To Hide Documents by Greenwald]
=== MASTERSHAKE ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== MATCHCRIMP ===
""Short Description"" : spotted on a document leaked by the Spiegel on 2015-01-17. This program appear in an interactive operations with the USS Annapolis (18 novembre 2011).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TAO]] 
""Related items (Parents)"" : [[ROC]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== MAUI ===
""Short Description"" : Multimedia Acces user interface, central repository of phone number database called ANCHORY/MAUI (MAUI provides a web based interface to ANCHORY).
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : 
""Related items"" : [[ANCHORY]] [[OCEANARIUM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[ANCHORY]] 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
* [https://www.documentcloud.org/documents/740163-anchory.html#document/p1|techdirt.com - Freedom of information act]
=== MERCED ===
""Short Description"" : Close Access SIGAD spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[bulgaria]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== MESSIAH ===
""Short Description"" : Electronic intelligence processing and analytical database - Exchange of data for human operators is handled by automated message handling systems.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[WHAMI]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== METAWAVE ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== METROTUBE ===
""Short Description"" : spotted on [[TURBINE]]'s document about "APEX VPN exploitation" and analytic.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[PRESSUREWAVE]] [[TOYGRIPPE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== METTLESOME ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== MIDDLEMAN ===
""Short Description"" : TAO covert network, i.e. a network that secretly connects airgapped computers to the internet.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== MINERALIZE ===
""Short Description"" : collection from LAN Implant.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[NOFORN]] 
""Related items"" : [[MAGOTHY]] [[MULBERRY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== MINIATUREHERO ===
""Short Description"" : Active skype capability. Provision of real time call records (SkypeOut and SkypetoSkype) and bidirectional instant messaging. Also contact lists.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== MIRAGE ===
""Short Description"" : spotted on the JTRIG's document, page 8.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== MIRROR ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== MJOLNIR ===
""Short Description"" : A custom Tor client library meant to be indistinguishable from the original Tor client, but which allows an unlimited number of servers within the Tor circuit. This was to allow for DoS attacks on the Tor network. It was also hypothesized that MJOLNIR would be able to be used for MITM attacks by forging certificates. The library was created and tested by persons during a 2006 CES summer program who set up an internal Tor network to analyze traffic. Mjolnir was the “Hammer of Thor”.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[tor]] [[mitm]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://apps.washingtonpost.com/g/page/world/nsa-research-report-on-the-tor-encryption-program/501/|washingtonpost.com - NSA report on the Tor encrypted network]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://mailman.stanford.edu/pipermail/liberationtech/2013-October/011741.html|stanford.edu - 49-page analysis of Tor is superficial - Andy Isaacson]
* [http://freehaven.net/anonbib/#congestion-longpaths|freehaven.net - A practical congestion attack on Tor using long paths - Usenix Security 2009 paper]
=== MOBILEHOOVER ===
""Short Description"" : is a tool to extract data from field forensics' reports created by Celldek, Cellebrite, XRY, Snoopy and USIM detective. These reports are transposed into a Newpin XML format to upload to [[NEWPIN]]
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[NEWPIN]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== MOCCASIN ===
""Short Description"" : a version of [[COTTONMOUTH]] permanently attached to a USB keyboard.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[usb]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== MOLTEN-MAGMA ===
""Short Description"" : CGI HTTP Proxy with ability to log all traffic and perform HTTPS Man in the Middle
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[mitm]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== MONKEYCALENDAR ===
""Short Description"" : software implant for GSM subscriber identify module (SIM) cards. This implant pulls individual user's calls and geolocation information form a target handset and exfiltrates it to a user-defined phone number via SMS.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[geolocation]] [[phone]] [[malware]] [[tao]] [[ant]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] 
""Related items"" : [[GOPHERSET]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/3|digitaltrends.com - TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
* [http://www.theregister.co.uk/2013/12/31/nsa_weapons_catalogue_promises_pwnage_at_the_speed_of_light/?page=2|TheRegister - How the NSA hacks PCs, phones, routers, hard disks 'at speed of light': Spy tech catalog leaks]
=== MONKEYROCKET ===
""Short Description"" : Sub-program of [[OAKSTAR]]. Counterterrorism in the Middle East, Europe, and Asia DNI metadata and content
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[dni]] 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[UPSTREAM]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR|en.wikipedia.org - OAKSTAR]
=== MONSTERMIND ===
""Short Description"" : The program would automate the process of hunting for the beginnings of a foreign cyberattack. Software would constantly be on the lookout for traffic patterns indicating
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[nsa]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/08/new_snowden_int.html | new Snowden Interview in Wired]
=== MOONLIGHTPATH ===
""Short Description"" : [[MOONLIGHTPATH]] is a Special Sources Operations ([[SSO]]) program, maintained by the NSA, it's a collection program to query metadatas, started in September, 2013
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/27/nsa-online-metadata-collection|theguardian.com - How the NSA is still harvesting your online data]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== MOONPENNY ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Harrogate (UK)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[geolocation]] [[phone]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/|nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== MOUTH ===
""Short Description"" : Tool for collection for downloading a user's files from Archive.org
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== MSOC ===
""Short Description"" : Misawa Cryptologic Operation Center or Misawa Security Operation Center based in Misawa (Japan). Base ruled by the air force intelligence service
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[US Air Force]]
""Tags"" : [[japan]] 
""Compartments"" : 
""Related items"" : [[WORDGOPHER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf]| No Place To Hide Documents by Greenwald]
=== MTI ===
""Short Description"" : Mass surveillance project led by the [[GCHQ]]. Capable of vacuuming signals from up to 200 fibre-optic cables at all physical points of entry into Great Britain
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[GTE]] [[TEMPORA]] [[IMP]] [[CCDP]] 
""Related items (Parents)"" : [[TEMPORA]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.theguardian.com/commentisfree/2013/jun/21/gchq-mastery-internet-mastery-everyone|The Guardian - GCHQ revelations: mastery of the internet will mean mastery of everyone ]
* [http://www.theguardian.com/uk/2013/jun/21/gchq-mastering-the-internet|The Guardian - Mastering the internet: how GCHQ set out to spy on the world wide web]
* [https://en.wikipedia.org/wiki/Mastering_the_Internet|en.wikipedia.org - Mastering_the_Internet]
=== MUGSHOT ===
""Short Description"" : Automatically understand everything important aboit CNE target networks from passive and active sources. Automatically understand everything important about all machines on the Internet from passive and active sources.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[HACIENDA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [ http://www.heise.de/ct/artikel/NSA-GCHQ-The-HACIENDA-Program-for-Internet-Colonization-2292681.html | NSA-GCHQ The HACIENDA Program for Internet Colonization]
=== MULBERRY ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[japan]] 
""Compartments"" : 
""Related items"" : [[MINERALIZ]] [[HIGHLANDS]] [[MAGNETIC]] [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== MULLENIZE ===
""Short Description"" : Working together, CT and CNE have devised a method to carry out large scale ‘staining’ as a means to identify individual machines linked to that IP address. Carried out as Op MULLENIZE, this operation is beginning to yield positive results, particularly in xxxxxxx. User Agent Staining is
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/10/gchq-mullenize.pdf|Cryptome.org - op MULLENIZE and beyond]
=== MURPHYSLAW ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) pages : 29 and 33. United Kingdom and USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== MUSCULAR ===
""Short Description"" : MUSCULAR (DS-200B), located in the United Kingdom, is the name of a surveillance programme jointly operated by GCHQ and the NSA. GCHQ (primary operator of the program) and the NSA have secretly broken into the main communications links that connect Yahoo and Google data centers around the world. Substantive information about the program was made public at the end of October, 2013. MUSCULAR is one of at least four other similar programs that rely on a trusted 2nd party, programs which together are known as [[WINDSTOP]]. In a 30-day period from December 2012 to January 2013, MUSCULAR was responsible for collecting 181 million records. It was however dwarfed by another [[WINDSTOP]] program known (insofar) only by its code [[DS-300]] and codename [[INCENSER]], which collected over 14 billion records in the same period.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[yahoo]] [[google]] 
""Compartments"" : [[NOFORN]] [[REL TO USA]] [[REL TO GBR]] [[SI]] [[NOFORN]] 
""Related items"" : [[WINDSTOP]] [[INCENSER]] [[TURMOIL]] [[XKEYSCORE]] 
""Related items (Parents)"" : [[WINDSTOP]] 
""Related items (Children)"" : [[TURMOIL]] 
""Status"" : active
""Links"" : 
* [https://en.wikipedia.org/wiki/MUSCULAR|en.wikipedia.org - MUSCULAR]
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf||cryptome.org - SSO The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
* [http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html|washingtonpost.com - NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== MUSKET ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== MUSKETEER ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== MUSTANG ===
""Short Description"" : provide covert access to the locations of GSM cell towers.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[gsm]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== MUTANTBROTH ===
""Short Description"" : [[GCHQ]]'s tool for identifying targets from data returned by [[QUANTUM]] products
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== MYSTIC ===
""Short Description"" : the NSA had developed the capability to record and store an entire nation’s phone traffic for 30 days. The Post reported that the capacity was a feature of MYSTIC, which it described as a “voice interception program”. the NSA was actively using MYSTIC to gather cell-phone metadata in Bahamas, Mexico, Kenya, the Philippines and Afghanistan.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[SSO]] [[NUCLEON]] [[RETRO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[SOMALGET]] [[BASECOAT]] [[DUSKPALLET]] [[EVENINGEASEL]] [[LOCKSTOCK]] [[VENATOR]] 
""Status"" : active
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-surveillance-program-reaches-into-the-past-to-retrieve-replay-phone-calls/2014/03/18/226d2646-ade9-11e3-a49e-76adc9210f19_story.html|NSA surveillance program reaches ‘into the past’ to retrieve, replay phone calls]
* [https://www.schneier.com/blog/archives/2014/03/mystic_the_nsas.html | MYSTIC: The NSA's Telephone Call Collection Program]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [https://firstlook.org/theintercept/article/2014/05/19/data-pirates-caribbean-nsa-recording-every-cell-phone-call-bahamas/|Data Pirates of the Caribbean: The NSA Is Recording Every Cell Phone Call in the Bahamas]
* [https://wikileaks.org/WikiLeaks-statement-on-the-mass.html | WikiLeaks statement on the mass recording of Afghan telephone calls by the NSA]
=== NAMEJACKER ===
""Short Description"" : A web service and admin console for the translation of usernames between network. For use with gateways and other such technologies.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== NASHUA ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[india]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] [[MAGNETIC]] [[VAGRANT]] [[LIFESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== NAVAJO ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[vietnam]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== NAVARRO ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[georgia]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== NCSC ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== NEBULA ===
""Short Description"" : A base station router, for intercepting mobile telephone calls and data transmissions. Uses the [[TYPHON]] GUI. Networkable and controllable via 802.3 and 802.11. The document (published on 2007) says the LTE capability is under development.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[TYPHON]] [[CYCLONE]] [[DRTBOX]] [[CANDYGRAM]] [[EBSR]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== NECTAR ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== NEPTUNETHUNDER ===
""Short Description"" : spotted on a document leaked by the Spiegel on 2015-01-17. This program appear in an interactive operations with the USS Annapolis (18 novembre 2011).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[BLINDDATE]] [[HAPPYHOUR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== NEVIS ===
""Short Description"" : is a tool developed by NTAC to search disk images for signs of possible Encryption products. CMA have further developed this tool to look for signs of Steganography
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[crypto]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== NEWPIN ===
""Short Description"" : is a database of C2C identifiers obtained from a variety of unique sources, and a suite of tools for exploring this data
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== NEWTONSCRADLE ===
""Short Description"" : [[GCHQ]]-run Tor nodes
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== NIAGARAFILES ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) pages : 29 and 33. United Kingdom and USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[BOUNDLESSINFORMANT]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== NIGHTCRAWLER ===
""Short Description"" : public online group against dodgy websites
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== NIGHTSTAND ===
""Short Description"" : An active 802.11 wireless exploitation and injection tool for payload /exploit delivery into otherwise denied target space. NIGHTSTAND is typically used in operations where wired access to the target is not possible. Standalone tool currently running on an x86 laptop loaded with Linux Fedora Core 3. Exploitable targets include Win2k, WinXP, WinXPSP1, WinXPSP2 running internet explorer versions 5.0-6.0. NIGHTSTAND packet injection can target one client or multiple targets on a wireless network. Attack is undetectable by the user. Use of external amplifiers and antennas in both experimental operational scenarios have resulted in successful NIGHTSTAND attacks from as far away as eight miles under ideal environmental conditions. Presumably, the NSA can use this "injection tool" in all the same ways it uses [[QUANTUM]]. For example, it can redirect users to [[FOXACID]] servers in order to attack their computers.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[exploit]] [[internet explorer]] [[wifi]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] [[FOUO]] 
""Related items"" : [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/nightstand_nsa.html|schneier.com - NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-nightstand.jpg|leaksource.wordpress.com - TAO Catalog Page with Graphic]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
=== NIGHTWATCH ===
""Short Description"" : Specialized system for processing, reconstructing and displaying video signals collected by [[VAGRANT]]. And returned to a [[CTX4000]] or a [[PHOTOANGLO]] system. According to [[TAO]] Catalog, it should be obsolete, replaced by [[VIEWPLATE]].
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[VIEWPLATE]] [[TAO]] [[VAGRANT]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] [[TAO]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/nightwatch_nsa.html|schneier.com - NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-nightwatch.jpg|leaksource.wordpress.com - TAO Catalog Page with Graphics]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== NINJACOVE ===
""Short Description"" : release of [[LONGHAULL]]  spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[LONGHAUL]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== NITESTAND ===
""Short Description"" : spotted on a document leaked by the Spiegel on 2015-01-17. This program appear in an interactive operations with the USS Annapolis (18 novembre 2011).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== NKB ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) pages : 29 and 33. United Kingdom and USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== NORMALRUN ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== NOSEYSMURF ===
""Short Description"" : GCHQ's targeted tools against individual smartphones, who has an ability to make the phone's microphone 'hot', to listen in to conversations.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[GCHQ]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[TRACKERSMURF]] [[DREAMYSMURF]] [[PARANOIDSMURF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data|Angry Birds and 'leaky' phone apps targeted by NSA and GCHQ for user data]
=== NSA ===
""Short Description"" : Exchange designator for the United States' National Security Agency (NSA).
""Category"" : five eyes
""Alias"" : [[OSCAR]] 
""Family"" : agence
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ALPHA]] [[ECHO]] [[INDIA]] [[UNIFORM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BULLRUN]] [[TAO]] [[UPSTREAM]] 
""Status"" : active
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
* [http://en.wikipedia.org/wiki/National_Security_Agency|National Security Agency]
=== NUCLEON ===
""Short Description"" : [[NUCLEON]] seems to be one of the database maintained by the NSA which store interceted telephone calls and spoken words or text message from a phone or a smartphone. At this time it isn't possible to know if this program is only a storage or a database or a big data tool.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[phone]] 
""Compartments"" : 
""Related items"" : [[PRISM]] [[CONVEYANCE]] [[AGILITY]] [[PINWALE]] 
""Related items (Parents)"" : [[CONVEYANCE]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.washingtonpost.com/investigations/us-surveillance-architecture-includes-collection-of-revealing-internet-phone-metadata/2013/06/15/e9bf004a-d511-11e2-b05f-3ea3f0e7bb5a_story_1.html|washingtonpost.com - U.S. surveillance architecture includes collection of revealing Internet, phone metadata]
* [https://en.wikipedia.org/wiki/PRISM|en.wikipedia.org - Slide of PRISM collection dataflow]
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== NUTALLERGY ===
""Short Description"" : [[JTRIG]] tor web browser - Sandbox IE replacement and [[FRUITBOWL]] sub-system
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[tor]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[FRUITBOWL]] 
""Related items (Parents)"" : [[FRUITBOWL]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== NYMROD ===
""Short Description"" : NYMROD name-matching system, can accept queries consisting of personnal names, perform a "fuzzy" match of the input name to one or more sets of stored names, and return a list of potential matches for presentation to the user.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FASTSCOPE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== OAKSTAR ===
""Short Description"" : [[OAKSTAR]] is a secret internet surveillance program of the National Security Agency (NSA) of the United States. It was disclosed in 2013 as part of the leaks by former NSA contractor Edward Snowden.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[UPSTREAM]] 
""Related items (Children)"" : [[MONKEYROCKET]] [[SHIFTINGSHADOW]] [[ORANGECRUSH]] [[YACHTSHOP]] [[ORANGEBLOSSOM]] [[SILVERZEPHYR]] [[BLUEZEPHIR]] [[COBALTFALCON]] 
""Status"" : active
""Links"" : 
* [http://en.wikipedia.org/wiki/OAKSTAR|en.wikipedia.org - OAKSTAR]
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf|cryptome.org - SSO The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== OCEAN ===
""Short Description"" : optical collection system for Raster-Based computer screens
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== OCEANARIUM ===
""Short Description"" : database for SIGINT from NSA and intelligence sharing partners around the world
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ANCHORY]] [[AGILITY]] [[PINWALE]] [[NUCLEON]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== OCELOT ===
""Short Description"" : Actual name: [[MADCAPOCELOT]], a sub-program of [[STORMBREW]] for collection of internet metadata about Russia and European counterterrorism. [[MADCAPOCELOT]] uses [[DNI]] from [[XKEYSCORE]], [[PINWALE]] and [[MARINA]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dni]] [[russia]] [[UE]] 
""Compartments"" : 
""Related items"" : [[STORMBREW]] [[XKEYSCORE]] [[PINWALE]] [[MARINA]] 
""Related items (Parents)"" : [[STORMBREW]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://commons.wikimedia.org/wiki/File:US-3140_MADCAPOCELOT_-_crop.jpg|commons.wikimedia.org - US-3140 MADCAPOCELOT - crop.jpg]
=== OCTAVE ===
""Short Description"" : collection mission tasking tool
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== OCTSKYWARD ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== OILSTOCK ===
""Short Description"" : Air Force/Navy tool to track ships in real time
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== OLYMPIA ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== OLYMPUS ===
""Short Description"" : OLYMPUS is an exploitation system that uses a software implant on a Microsoft Windows based target PC to gain complete access to the targeted PC. The target, when connected to the Internet, will contact a Listening Post (LP) located at an NSA/USSS facilities, which is online 24/7, and get ist commands automatically. There commands include directory listings, retrieving files, performing netmaps, etc. The results of the commands are then returned to the LP, where the data is collected and forwarded to CES and analysis and production elements.
""Category"" : attack vector
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[windows]] [[os]] 
""Compartments"" : 
""Related items"" : [[VALIDATOR]] [[SOMBERKNAVE]] [[VALIDATOR]] [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
=== OLYMPUSFIRE ===
""Short Description"" : An exploitation system, that uses malware to completely control a target Windows PC. Maintained by a NSA-run Listening Post.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[windows]] [[os]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
=== OMNIGAT ===
""Short Description"" : Field network component
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[GINSU]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ONEROOF ===
""Short Description"" : Main tactical SIGINT database, with raw and unfiltered intercepts
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== ONIONBREATH ===
""Short Description"" : Relates to [[GCHQ]] efforts against Tor hidden services
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : [[GCHQ]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== OPTICNERVE ===
""Short Description"" : OPTIC NERVE was a web interface to display Yahoo! webcam images from a selected target. The program collected an image every 5 minutes. The program had a filter that deleted nudity images. 20% of the collected images were with people showing their private parts to another people. The document says it only collected images on Yahoo!. In one six-month period in 2008 alone, the agency collected webcam imagery – including substantial quantities of sexually explicit communications – from more than 1.8 million Yahoo user accounts globally.
""Category"" : program
""Alias"" : [[OPTIC NERVE]] 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[yahoo]] [[webcam]] 
""Compartments"" : 
""Related items"" : [[CAPTIVATEDAUDIENCE]] [[GCHQ]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [http://www.theguardian.com/world/2014/feb/27/gchq-nsa-webcam-images-internet-yahoo|Optic Nerve: millions of Yahoo webcam images intercepted by GCHQ]
=== ORANGEBLOSSOM ===
""Short Description"" : Sub-program of [[OAKSTAR]] for collection from an international transit switch. Incorpored in [[ORANGECRUSH]] for the [[OAKSTAR]] part and its DNR capability.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dnr]] 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[UPSTREAM]] [[ORANGECRUSH]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR|en.wikipedia.org - OAKSTAR]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== ORANGECRUSH ===
""Short Description"" : Subprogram of [[OAKSTAR]]. Foreign access point through [[PRIMECANE]], and 3rd party partner collect data on Voice, fax, DNI, DNR, and metadata. ORANGECRUSH is only known to the Poles as BUFFALOGREEN. Forwarding metadata from third-parts site in Poland.
""Category"" : program
""Alias"" : [[buffalogreen]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dns]] [[dni]] [[poland]] 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[UPSTREAM]] [[PRIMECANE]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://archive.org/details/NSA-Slides-O-Globo-Brazil|"US-3230-ORANGECRUSH.jpg" ]
* [https://en.wikipedia.org/wiki/OAKSTAR|en.wikipedia.org - OAKSTAR]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== OSAGE ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[india]] 
""Compartments"" : 
""Related items"" : [[LIFESAVER]] [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== OSMJCM-II ===
""Short Description"" : spotted in [[COTTONMOUTH-II]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== OSN ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== OSWAYO ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[india]] 
""Compartments"" : 
""Related items"" : [[VAGRANT]] [[HIGHLANDS]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== OUTWARD ===
""Short Description"" : is a collection of DNS lookup, WHOIS lookup and other networks tools
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[dns]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== PACKAGEGOODS ===
""Short Description"" : tracks the “traceroutes” through which data flows around the Internet. Has access to 13 covered servers in unwitting data centers around the globe. The data centers are located in (non exhaustive) Germany, Poland, Denmark, South Africa and Taiwan as well as Russia, China and Singapore.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[germany]] [[polan]] [[denmark]] [[south africa]] [[taiwan]] [[russia]] [[china]] [[singapore]] 
""Compartments"" : 
""Related items"" : [[TREASUREMAP]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://leaksource.wordpress.com/2013/11/23/nsa-programs-treasure-map-near-real-time-interactive-map-of-internet-any-device-anywhere-all-the-time-packaged-goods-tracks-traceroutes-accessed-13-servers-in-unwitting-data-centers/|LeakSource - (NSA Programs) Treasure Map: Near Real-Time Interactive Map of Internet, Any Device, Anywhere, All the Time; Packaged Goods: Tracks Traceroutes, Accessed 13 Servers in Unwitting Data Centers]
* [http://cryptome.org/2013/11/nsa-treasuremap.htm|Cryptome - NSA Treasuremap]
=== PACKETWRENCH ===
""Short Description"" : 
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FERRETCANNON]] [[FOXACID]] 
""Related items (Parents)"" : [[FERRETCANNON]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2013/10/the_nsas_new_ri.html|Schneier.com - The NSA's New Risk Analysis]
=== PAINTEDEAGLE ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/Global_surveillance_by_category | wikipedia - Global surveillance by category]
=== PANOPLY ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== PANTHER ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[vietnam]] 
""Compartments"" : 
""Related items"" : [[HIGHLANDS]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== PARANOIDSMURF ===
""Short Description"" : Capability of the GCHQ's 'Smurf family' spywares to hide themselves (the Smurf family is a collection of GCHQ's targeted tools against individual smartphones).
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[GCHQ]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[NOSEYSMURF]] [[TRACKERSMURF]] [[DREAMYSMURF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data|Angry Birds and 'leaky' phone apps targeted by NSA and GCHQ for user data]
=== PARCHDUSK ===
""Short Description"" : PARCHDUSK is a spying program used in 2007 and 2008 in Iraq and Afghanistan. Productions Operation of NSA's TAO division.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[iraq]] [[afghanistan]] 
""Compartments"" : 
""Related items"" : [[SHARPFOCUS]] [[OLYMPUS]] [[FOXACID]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [http://cryptome.org/2014/01/nsa-tao-intro.pdf |cryptome.org - Photo Gallery: NSA's TAO Unit Introduces Itself ]
=== PATHFINDER ===
""Short Description"" : [[PATHFINDER]] is a [[SIGINT]] analysis tool made by the Science Applications International Corporation (SAIC), a new US company headquartered in (McLean, Virginia) that provides government services and information technology support.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian - nsa-bullrun-2-16-guardian-13-0905.pdf]
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== PAWLEYS ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian - nsa-bullrun-2-16-guardian-13-0905.pdf]
=== PBX ===
""Short Description"" : Public branch exchange switch
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[WABASH]] [[KLONDIKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== PEDDLECHEAP ===
""Short Description"" : subprogram of [[FERRETCANNON]] and [[FOXACID]].
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FERRETCANNON]] [[FOXACID]] 
""Related items (Parents)"" : [[FERRETCANNON]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2013/10/the_nsas_new_ri.html| schneier.com - The NSA's New Risk Analysis]
=== PENDLETON ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian - nsa-bullrun-2-16-guardian-13-0905.pdf]
=== PERDIDO ===
""Short Description"" : Name of an operation to bug the EU mission in United Nations, introducing spywares in foreign embassies.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[EU]] 
""Compartments"" : 
""Related items"" : [[GENIE]] [[DROPMIRE]] [[HIGHLANDS]] [[LIFESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|TheGuardian - New NSA leaks show how US is bugging its European allies]
=== PHOENIX ===
""Short Description"" : spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== PHOTOANGLO ===
""Short Description"" : Replaces [[CTX4000]], a continuous radar Wave generator, for the [[ANGRYNEIGHBOR]] family of retro-reflector bugs, including [[VAGRANT]], [[DROPMIRE]] and [[LOADAUTO]]. The signals are then sent to a processing system such as [[NIGHTWATCH]] or [[VIEWPLATE]] (which process and display the signals from the [[VAGRANT]] monitor-cable bug). The [[LFS-2]] is listed as another type of processing system. A joint NSA/GCHQ project.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[cw]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[ANGRYNEIGHBOR]] [[VAGRANT]] [[DROPMIRE]] [[LOADAUTO]] [[NIGHTWATCH]] [[VIEWPLATE]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/photoanglo_nsa.html | schneier.com - PHOTOANGLO: NSA Exploit of the Day]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== PHOTONTORPEDO ===
""Short Description"" : A technique to actively grab the IP address of a MSN messenger user.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[chat]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== PICARESQUE ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org/guardian - nsa-bullrun-2-16-guardian-13-0905.pdf]
=== PICASSO ===
""Short Description"" : GSM handset, carried by a witting operator for bugging calls and location information within its range. Includes a panic button for the operator. Data exfil done with a regular phone via SMS.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[phone]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== PIEDMONT ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org - guardian]
=== PINWALE ===
""Short Description"" : PINWALE is the code name for an NSA database of archived foreign and domestic emails it has collected under its SIGINT efforts. It is searchable by monitored NSA analysts. Its existence was first revealed by an NSA analyst who was trained to use it during 2005. However, according to ''Homeland Security Today'', Pinwale has in it much more than email, it also contains other forms of Internet data, and other forms of digital communications as well. Its software has built-in protections against collecting from any of the Five Eyes members. Unlike its successor [[XKEYSCORE]], targets for PINWALE have to be approved beforehand by the United States Foreign Intelligence Surveillance Court ([[FISC]]).
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[email]] 
""Compartments"" : [[FISC]] [[TOP SECRET]] [[SI]] [[ORCON]] [[NOFORN]] 
""Related items"" : [[SCISSORS]] [[PRISM]] [[XKEYSCORE]] [[TRAFFICCHIEF]] 
""Related items (Parents)"" : [[SCISSORS]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.nytimes.com/2009/06/17/us/17nsa.html|nytimes.com - E-Mail Surveillance Renews Concerns in Congress]
* [https://en.wikipedia.org/wiki/Pinwale|PINWALE en.wikipedia.org]
* [https://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|en.wikipedia.org - Slide of PRISM collection dataflow ]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== PISTRIX ===
""Short Description"" : image hosting and sharing website
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== PITBULL ===
""Short Description"" : Capability, under development, enabling large scale delivery of a tailored message to users of instant Messaging services.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[chat]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== PITCHFORD ===
""Short Description"" : An undetermined, highly confidential compartiment mentioned in the [[BULLRUN]] documents.
""Category"" : compartment
""Alias"" : 
""Family"" : ECI
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[ECI]] [[TOP SECRET]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[BULLRUN]] 
""Related items (Parents)"" : [[BULLRUN]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/09/nsa-bullrun-2-16-guardian-13-0905.pdf|cryptome.org - guardian]
=== PLATINUMRING ===
""Short Description"" : Timeouts fixed by [[SCARLETFEVER]] for [[GALLANTWAVE]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[SCARLETFEVER]] [[GALLANTWAVE]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== PODRACE ===
""Short Description"" : [[JTRIG]]'s MS update farm
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== POISONARROW ===
""Short Description"" : Safe malware download capability
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== POISONEDDAGGER ===
""Short Description"" : Effects against Gigatribe, built by ICTR, deployed by [[JTRIG]]
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== POISONNUT ===
""Short Description"" : also known as the Virtual Private Network Attack Orchestrator is a messafe driven cryptologic exploitation service for VPNs with the main focus on IPSec. The list of POISONNUT clients includes [[TURMOIL]] [[WEALTHYCLUSTER]], and the TEe. Each POISONNUT client can connect to it using [[ISLANDTRANSPORT]]. Once connected, they send and receive XML messages encrypted with [[ISLANDEAWAY]].
""Category"" : program
""Alias"" : [[Virtual Private Network Attack Orchestrator]] [[VAO]] [[Heritage VAO]] 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[vpn]] [[ipsec]] [[31c3]] 
""Compartments"" : 
""Related items"" : [[VULCANDEATHGRIP]] 
""Related items (Parents)"" : [[LONGHAUL]] [[ISLANDHIDEAWAY]] 
""Related items (Children)"" : [[TURMOIL]] [[WEALTHYCLUSTER]] [[CORALREEF]] 
""Status"" : unknown
""Links"" : 
=== POKOMOKE ===
""Short Description"" : Brazil's United Nations Mission in New-York
""Category"" : mission
""Alias"" : [[POCOMOKE]] 
""Family"" : collect
""Agency"" : undefined
""Tags"" : [[brazil]] 
""Compartments"" : 
""Related items"" : [[VAGRANT]] [[HIGHLANDS]] [[LIFESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|Cryptome.org - NSA's codenames]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== POPEYESEAR ===
""Short Description"" : Visualization Techniques for Computer Network Defense. Interface provides Google-like search syntax and intuitive point-and-click control.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[RENOIR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== POTBED ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== POWELL ===
""Short Description"" : Name of an operation to bug the greek UN mission, introducing spywares in foreign embassies.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[greece]] 
""Compartments"" : 
""Related items"" : [[GENIE]] [[KLONDYKE]] [[LIFESAVER]] [[HIGHLANDS]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|TheGuardian - New NSA leaks show how US is bugging its European allies]
=== PPM ===
""Short Description"" : Pulse Position Modulate
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== PREDATORSFACE ===
""Short Description"" : Targeted Denial of Service against Web Servers.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== PREFER ===
""Short Description"" : The NSA's program to perform automatic analysis on the text-message data and metadata.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2014/jan/16/nsa-collects-millions-text-messages-daily-untargeted-global-sweep|TheGuardian - NSA collects millions of text messages daily in 'untargeted' global sweep]
* [https://www.schneier.com/blog/archives/2014/01/nsa_collects_hu.html|schneier.com - NSA Collects Hundreds of Millions of Text Messages Daily]
=== PRESSUREWAVE ===
""Short Description"" : spotted on [[TURBINE]]'s document about "APEX VPN exploitation".
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[METROTUBE]] [[TURMOIL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== PRIMATE ===
""Short Description"" : is a [[JTRIG]] tool that aims to provide the capability to identify trends in seized computer media data and metadata
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== PRINTAURA ===
""Short Description"" : part of the [[PRISM]] program. Software which would automatically gather a list of tasked PRISM selectors every weeks to provide to the FBI or CIA. PRINTAURA volunteered to gather the detailed data related to each selector from multiple locations and assemble it in usable form.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : [[TRAFFICTHIEF]] 
""Status"" : active (like [[PRISM]])
""Links"" : 
* [https://en.wikipedia.org/wiki/File:Prism-slide-6.jpg| en.wikipedia.org - Slide of PRISM]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== PRISM ===
""Short Description"" : PRISM is not about bulk or mass surveillance, but for collecting communications of specifically identified targets. NSA also has no "direct access" to the servers of companies like Microsoft, Facebook and Google - it's a unit of the FBI that actually picks up the data. In total, ca. 227 million internet communications are collected under the PRISM program each year, contributing to reports about terrorism and a wide variety of other national security issues. Anually, NSA analysts write more than 20.000 PRISM-based reports, which is ca. 15% of all intelligence reports the agency produces.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[microsoft]] [[yahoo]] [[google]] [[facebook]] [[paltalk]] [[youtube]] [[skype]] [[aol]] [[apple]] [[email]] [[video]] [[picture]] [[voip]] [[webcam]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[ORCON]] [[NOFORN]] 
""Related items"" : [[TRAFFICTHIEF]] [[MARINA]] [[MAINWAY]] [[FALLOUT]] [[PINWALE]] [[CONVEYANCE]] [[NUCLEON]] [[UPSTREAM]] 
""Related items (Parents)"" : [[NSA]] 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] [[CARBOY]] [[XKEYSCORE]] 
""Status"" : active
""Links"" : 
* [http://electrospaces.blogspot.fr/2014/04/what-is-known-about-nsas-prism-program.html|http://electrospaces.blogspot.fr - What is known about NSA's PRISM program]
* [http://en.wikipedia.org/wiki/PRISM_(surveillance_program)|en.wikipedia.org - Prism]
* [http://www.theverge.com/2013/7/17/4517480/nsa-spying-prism-surveillance-cheat-sheet| theverge.com - Everything you need to know about PRISM A cheat sheet for the NSA's unprecedented surveillance programs]
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf|SSO - The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/11/ms-onedrive-nsa-prism.htm|Cryptome says there's also Microsoft OneDrive in PRISM]
=== PROTEIN ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== PROTON ===
""Short Description"" : SIGINT database for time-sensitive targets/counterintelligence.Fields in the database : Called & calling numbers, date, time & duration of call. 149 billion of call Events, for date range 2000-2006.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] 
""Compartments"" : 
""Related items"" : [[CRISSCROSS]] [[ICREACH]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== PROTOSS ===
""Short Description"" : Possibly a bridge between the airgapped system and the Internet
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[FIREWALK]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
=== PYLON ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== QFD ===
""Short Description"" : Question Filled Dataset
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== QFIRE ===
""Short Description"" : System used for infecting computers. Involves both [[TURMOIL]], [[TURBINE]], and additional infrastructure. Co-opted routers, according to Jacob Appelbaum, these may in cases be unwitting home or business routers, that have been “pwned”. The Goal seems to be to reduce latency, and therefor increase the success rate of [[QUANTUMINSERT]]/[[FOXACID]] attacks. Eliminate trans-Atlantic/Pacific latency. Consolidated low-latency [[QUANTUMTHEORY]], capability under development for forward-based defense.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[router]] 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] [[TURMOIL]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : [[TURMOIL]] [[TURBINE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2]
* [http://www.dailytech.com/Tax+and+Spy+How+the+NSA+Can+Hack+Any+American+Stores+Data+15+Years/article34010.htm| dailytech.com - Tax and Spy: How the NSA Can Hack Any American, Stores Data 15 Years]
* [http://www.wikileaks-forum.com/nsa/332/snowden-leak-nsa-qfire-16-slides/26507/|wikileaks-forum.com - Forward-based Defense with QFIRE June 3 , 2011]
* [https://www.eff.org/document/20131230-spiegel-qfire|Slides about QUANTUM, QFIRE and TURBULENCE]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== QIM/JMSQ ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[WISTFULTOLL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== QUANTUM ===
""Short Description"" : To trick targets into visiting a [[FOXACID]] server, the NSA relies on its secret partnerships with US telecoms companies. As part of the [[TURMOIL]] system, the NSA places secret servers, codenamed [[QUANTUM]], at key places on the Internet backbone for a man-in-the-middle (or a man-in-the-side). The NSA uses these fast [[QUANTUM]] servers to execute a packet injection attack, which surreptitiously redirects the target to the [[FOXACID]] server.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[tor]] [[mitm]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[OSCAR]] 
""Related items (Children)"" : [[QUANTUMINSERT]] [[QUANTUMBOT]] [[QUANTUMBOT2]] [[QUANTUMCOOKIE]] [[QUANTUMCOPPER]] [[QUANTUMDEFENSE]] [[QUANTUMDNS]] [[QUANTUMINSERT]] [[QUANTUMNATION]] [[QUANTUMSKY]] [[QUANTUMSPIM]] [[QUANTUMSQUEEL]] [[QUANTUMSQUIRREL]] [[QUANTUMTHEORY]] [[QUANTUMPHANTOM]] [[QUANTUMHAND]] [[QUANTUMSMACKDOWN]] 
""Status"" : active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID ]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf| cryptome.org NSA QUANTUM tasking techniques]
* [http://arstechnica.com/security/2013/10/nsa-repeatedly-tries-to-unpeel-tor-anonymity-and-spy-on-users-memos-show/|ArsTechnica - NSA repeatedly tries to unpeel Tor anonymity and spy on users, memos show]
* [http://www.slate.com/blogs/future_tense/2013/10/04/tor_foxacid_flying_pig_nsa_attempts_to_sabotage_countersurveillance_tool.html|Slate.com - How the NSA Is Trying to Sabotage a U.S. Government-Funded Countersurveillance Tool]
* [http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html|Spiegel.de - Britain's GCHQ Hacked Belgian Telecoms Firm]
* [http://www.nytimes.com/2014/01/15/us/nsa-effort-pries-open-computers-not-connected-to-internet.html?smid=tw-share&_r=1|nytimes.com - N.S.A. Devises Radio Pathway Into Computers]
* [https://www.aclu.org/files/natsec/nsa/20140130/%28TS%29%20NSA%20Quantum%20Tasking%20Techniques%20for%20the%20R&T%20Analyst.pdf | ACLU - NSA Quantum Taskin Techniques for the R&T Analyst]
=== QUANTUMBISCUIT ===
""Short Description"" : Redirection based on keywork. Most HTML values
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== QUANTUMBOT ===
""Short Description"" : hijack IRC bot. Finds computers belonging to botnets, and hijacks the command and control channel. Over 140.000 bot co-opted
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[irc]] 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf| cryptome.org - NSA QUANTUM tasking techniques]
* [http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409-2.html|The Digital Arms Race: NSA Preps America for Future Battle]
=== QUANTUMBOT2 ===
""Short Description"" : Combination of Q-BOT/Q-BISCUIT for web based. Command and controlled botnets
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== QUANTUMCOOKIE ===
""Short Description"" : force cookies onto target browsers
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[browser]] 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : attack vector
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID] by Bruce Schneier]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf|cryptome.org - NSA QUANTUM tasking techniques]
=== QUANTUMCOPPER ===
""Short Description"" : File download/upload disruption and corruption, a.k.a the great firewall of earth (like the Great Firewall of China)
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf|cryptome.org - NSA QUANTUM tasking techniques]
* [http://cryptome.org/2014/03/nsa-more-than-one-way.pdf|There is more than one way to QUANTUM]
=== QUANTUMDEFENSE ===
""Short Description"" : spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUMTHEORY]] [[QUANTUM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== QUANTUMDNS ===
""Short Description"" : DNS injection and/or redirection based off of A records queries.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dns]] 
""Compartments"" : 
""Related items"" : [[QUANTUM]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : Activity from October 2010
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== QUANTUMHAND ===
""Short Description"" : Exploits the computer of target who uses Facebook
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[facebook]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL USA]] [[FVEY]] 
""Related items"" : [[QUANTUM]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/03/nsa-more-than-one-way.pdf|There is more than one way to QUANTUM]
=== QUANTUMINSERT ===
""Short Description"" : It appears to be a method with which the person being targeted, without their knowledge, is redirected to websites that then plant malware on their computers that can then manipulate them. Some of the employees whose computers were infiltrated had "good access" to important parts of Belgacom's infrastructure, and this seemed to please the British spies, according to the slides.
""Category"" : attack vector
""Alias"" : [[QUANTUM INSERT]] 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[mitm]] [[malware]] [[belgium]] [[belgacom]] 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : [[VALIDATOR]] [[QUANTUMBISCUIT]] 
""Status"" : attack vector
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID] by Bruce Schneier]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf|cryptome.org - NSA QUANTUM tasking techniques]
* [https://www.schneier.com/blog/archives/2013/11/another_quantum.html | schneier.com - Another QUANTUMINSERT Attack Example]
=== QUANTUMNATION ===
""Short Description"" : QUANTUMNATION can be used with [[TAO]]. QUANTUMNATION is a man-on-the-side capability which can be used for 1 month unless there's a request to extend his life. NSA uses it first to have initial access to the target computer.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[FOXACID]] [[VALIDATOR]] [[COMMONDEER]] [[TAO]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : [[COMMONDEER]] 
""Status"" : active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf| cryptome.org - NSA QUANTUM tasking techniques]
=== QUANTUMPHANTOM ===
""Short Description"" : Hijacks any IP addresses on QUANTUMable passive coverage to use as covert infrastructure.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL USA]] [[FVEY]] 
""Related items"" : [[QUANTUM]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/03/nsa-more-than-one-way.pdf|There is more than one way to QUANTUM]
=== QUANTUMSANDAM ===
""Short Description"" : Future evolution of [[QUANTUMSMACKDOWN]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUMSMACKDOWN]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409-2.html|The Digital Arms Race: NSA Preps America for Future Battle]
=== QUANTUMSKY ===
""Short Description"" : Denies access to webpage by spoofing the target with TCP segment with RST flags set.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMIN]] [[REL USA]] [[FVEY]] 
""Related items"" : [[QUANTUM]] [[FOXACID]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf| cryptome.org - NSA QUANTUM tasking techniques]
* [http://cryptome.org/2014/03/nsa-more-than-one-way.pdf|There is more than one way to QUANTUM]
=== QUANTUMSMACKDOWN ===
""Short Description"" : Prevent targets from downloading implants to DoD computers while capturing malicious payload for analysis
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL USA]] [[FVEY]] 
""Related items"" : [[QUANTUM]] [[CLOUDSHIELD]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/03/nsa-more-than-one-way.pdf|There is more than one way to QUANTUM]
=== QUANTUMSPIM ===
""Short Description"" : Instant Messaging (MSN chat, XMPP), spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== QUANTUMSQUEEL ===
""Short Description"" : Injection into MySQL persistent database connections, spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUMTHEORY]] [[QUANTUM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== QUANTUMSQUIRREL ===
""Short Description"" : Truly covert infrastructure, be any IP in the world, spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf |2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== QUANTUMTHEORY ===
""Short Description"" : Extremely powerful CNE/CND/CNA network effects are enabled by integrating passive and active systems. QUANTUMTHEORY has a huge set of exploits including first stage exploits which die 30 days after the implantation.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[mitm]] 
""Compartments"" : [[TOP SECRET]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] 
""Related items"" : [[QUANTUM]] [[FOXACID]] [[SEASONMOTH]] 
""Related items (Parents)"" : [[QUANTUM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de -To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum]
* [https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html|schneier.com - How the NSA Attacks Tor/Firefox Users With QUANTUM and FOXACID] by Bruce Schneier]
* [http://cryptome.org/2013/12/nsa-quantum-tasking.pdf| cryptome.org - NSA QUANTUM tasking techniques]
* [https://www.eff.org/document/20131230-spiegel-qfire| eff.org - Slides about QUANTUM, QFIRE and TURBULENCE]
* [http://www.spiegel.de/fotostrecke/photo-gallery-how-the-nsa-infiltrates-computers-fotostrecke-105339-2.html | Spiegel - How the nsa infiltrates computers ]
=== QUICKANTQFD ===
""Short Description"" : [[GCHQ]] tor analytics/knowledgebase
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== QUINCY ===
""Short Description"" : is an enterprise level suite of tools for the exploitation of seized media
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== RADON ===
""Short Description"" : Bi-directional host tap that can inject Ethernet packets onto the same targets. Allows bi-directional exploitation of Denies networks using standard on-net tools.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[ethernet]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.lemonde.fr/international/article/2013/10/22/la-diplomatie-francaise-sur-ecoute-aux-etats-unis_3500717_3210.html| LeMonde.fr - Espionnage de la NSA : la diplomatie française était sur écoute aux Etats-Unis]
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1| docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html| schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== RAGEMASTER ===
""Short Description"" : provides a target for RF flooding and allows for easier collection of the [[VAGRANT]] video signal. The current RAGEMASTER unit taps the red video line on the VGA cable. It was found that, empirically, this provides the best video return and cleanest readout of the monitor contents. When the RAGEMASTER is illuminated by a radar unit, the illuminating signal is modulated with the red video information. This information is re-radiated, where it is picked up at the radar, demodulated, and passed onto the processing unit, such as a [[LFS-2]] and an external monitor.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[rf]] [[video]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[NIGHTWATCH]] [[GOTHAM]] [[VIEWPLATE]] 
""Related items (Parents)"" : [[TAWDRYYARD]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html | media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf | cryptome.org - NSA's catalog]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== RAGTIME ===
""Short Description"" : RAGTIME is the code name of four secret surveillance programs conducted by the NSA. These special programs are conducted under the code name RAGTIME (also abbreviated as RT), and are divided into several subcomponents (RAGTIME-A, RAGTIME-B, RAGTIME-C, and RAGTIME-P). It's said that about 50 companies have provided data to this domestic collection program.
""Category"" : program
""Alias"" : [[RT]] [[RGT]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://apps.washingtonpost.com/g/page/national/nsa-report-on-privacy-violations-in-the-first-quarter-of-2012/395/| apps.washingtonpost.com - NSA report on privacy violations in the first quarter of 2012]
* [http://www.washingtonian.com/blogs/dead_drop/surveillance-state/ragtime-codename-of-nsas-secret-domestic-intelligence-program-revealed-in-new-book.php| washingtonian.com - Ragtime: Code name of NSA - Secret Domestic Intelligence Program]
=== RAM-M ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== RAMPART ===
""Short Description"" : RAMPART is a [[NSA]] operational branches that intercept heads of state and their closest aides. Known divisions are RAMPART-A, RAMPART-I and RAMPART-T, which focuses on foreign governments.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/international/world/secret-nsa-documents-show-how-the-us-spies-on-europe-and-the-un-a-918625.html| Der Spiegel - Codename 'Apalachee': How America Spies on Europe and the UN]
=== RANA ===
""Short Description"" : is a system developed by ICTR-CISA providing CAPTCHA-solving via a web service on [[CERBERUS]], this is intended for use by [[BUMPERCAR+]] and possibly in future by SHORTFALL but anyone is welcome to use it.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== RANDOMIZERS ===
""Short Description"" : Analytics on randomizer of Open SSL and /dev/random.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== RC-10 ===
""Short Description"" : new name of the [[SHARKFIN]] program, high-capacity/high-speed vacuum cleaner, sweeps up all-source communications intelligence (COMINT) from a variety of communication methods and systems.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== REAPER ===
""Short Description"" : [[CERBERUS]] -> [[GCNET]] Import gateway Interface System
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== REMATION-II ===
""Short Description"" : Joint NSA/GCHQ anti-Tor Workshop ca 2012
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : undefined
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== RENOIR ===
""Short Description"" : Device characterization database and one of the enrichments to [[NKB]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[NKB]] [[TOYGRIPPE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== REQUETTE ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[taiwan]] 
""Compartments"" : 
""Related items"" : [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== RESERVOIR ===
""Short Description"" : Facebook application allowing collection of various information.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[facebook]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== RETRO ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-surveillance-program-reaches-into-the-past-to-retrieve-replay-phone-calls/2014/03/18/226d2646-ade9-11e3-a49e-76adc9210f19_story.html|NSA surveillance program reaches ‘into the past’ to retrieve, replay phone calls]
=== RETROREFLECTOR ===
""Short Description"" : a term for a special kind of mirror that always sends a signal directly back on the path it comes from, regardless of the angle.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== RETURNSPRING ===
""Short Description"" : Spotted on [[IRATEMONK]], [[WISTFULTOLL]] diagrams
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[WISTFULTOLL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== RICHTER ===
""Short Description"" : SIGINT Exchange Designators of Germany
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[germany]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== ROADBED ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== ROC ===
""Short Description"" : NSA [[TAO]] Remote Operation Center [[ROC]] is their intelligence exploitation centers. It is supposed to be distributed around the world, with suspected locations such as Dagger Complex, Griesheim, Darmstadt, Germany, Fort Meade, Maryland. [[TAO]] has also expanded to NSA Hawaii (Wahiawa, Oahu), NSA Georgia (Fort Gordon, Georgia), NSA Texas (Medina Annex, San Antonio, Texas), and Buckley Air Force Base, Denver.
""Category"" : compartment
""Alias"" : [[Remote Operation Center]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/Office_of_Tailored_Access_Operations| en.wikipedia.org - TAO ]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ROCKYKNOB ===
""Short Description"" : Optional Digital Signal Processing (DSP) Module for [[CROSSBEAM]].
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[CROSSBEAM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== ROLLINGTHUNDER ===
""Short Description"" : Distributed denial of service using P2P, built by [[ICTR]], deployed by [[JTRIG]]
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[p2p]] [[ddos]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== RONIN ===
""Short Description"" : Database of tor events
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== RORIPA ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== ROYALCONCIERGE ===
""Short Description"" : identifies potential diplomatic Hotel reservations. Automated bulk contact chaining between Reservation email adresses and "gov.xx" addresses. Possible extentions: "favourite" hotels, counter-intelligence/foreign relations support, [[XKEYSCORE]] fingerprinting, car hire...
""Category"" : program
""Alias"" : [[ROYAL CONCIERGE]] 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[email]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] 
""Related items"" : 
""Related items (Parents)"" : [[XKEYSCORE]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2013/11/gchq-royal-concierge.jpg|cryptome.org on ROYAL CONCIERGE]
=== ROYALNET ===
""Short Description"" : Analytics to find other netstrings related to your target. Analytics to find likely to carry your target's communications
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== S2C42 ===
""Short Description"" : A program for spying on Brazilian President Dilma Rousseff and her key advisers. The results are text messages from her and her key advisers.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : [[brazil]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== SALTYDOGS ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[BOTANICREALTY]] [[LADYLOVE]] [[HIGHPRIDE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== SALVAGERABBIT ===
""Short Description"" : The NSA has a diverse arsenal of malware tools, each highly sophisticated and customizable for different purposes. One implant, codenamed [[UNITEDRAKE]], can be used with a variety of “plug-ins” that enable the agency to gain total control of an infected computer. An implant plug-in named SALVAGERABBIT, used to exfiltrates data from removable flash drives that connect to an infected computer.
""Category"" : program
""Alias"" : [[protocols]] [[crypto]] [[vpn]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== SARATOGA ===
""Short Description"" : spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf |2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== SARDINE ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== SCALPEL ===
""Short Description"" : [[SIGINT]] for locating cellphone in Nairobi
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[geolocation]] [[gsm]] [[kenya]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
=== SCARLETEMPEROR ===
""Short Description"" : Targeted denial of service against targets phones via call bombing.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[phone]] [[gsm]] [[ddos]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SCARLETFEVER ===
""Short Description"" : it's a second [[LONGHAUL]] capability that enables Data Network Session Cipher (DNSC) recovery. The list of SCARLETFEVER clients includes  [[TURMOIL]]  [[WEALTHYCLUSTER]], and the TEe. Each POISONNUT client can connect to it  using [[ISLANDTRANSPORT]]. Once connected, they send and receive XML  messages encrypted with [[ISLANDEAWAY]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[ssl]] [[vpn]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[LONGHAUL]] [[ISLANDTRANSPORT]] 
""Related items (Children)"" : [[TURMOIL]] [[WEALTHYCLUSTER]] [[PLATINUMRING]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== SCHOOLMONTANA ===
""Short Description"" : SCHOOLMONTANA provides persistence for DNT implants. The DNT implant will survive an upgrade or replacement of the operating system -- including physically replacing the router's compact flash card. Currently, the intended DNT Implant to persist is VALIDATOR, which must be run as a user process on the target operating system. The vector of attack is the modification of the target's BIOS. The modification will add the necessary software to the BIOS and modify its software to execute the SCHOOLMONTANA implant at the end of its native System Management Mode (SMM) handler. SCHOOLMONTANA must support all modern versions of JUNOS, which is a version of FreeBSD customized by Juniper. Upon system boot, the JUNOS operating system is modified in memory to run the implant, and provide persistent kernel modifications to support implant execution.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[bios]] [[dnt]] [[tao]] [[ant]] [[junos]] 
""Compartments"" : 
""Related items"" : [[SIERRAMONTANA]] [[STUCCOMONTANA]] [[VALIDATOR]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/schoolmontana_n.html| schneier.com - SCHOOLMONTANA: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-schoolmontana.jpg| Slide on SCHOOLMONTANA]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SCISSORS ===
""Short Description"" : subprogram of [[PRISM]] and [[PRINTAURA]].
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[SI]] [[ORCON]] [[NOFORN]] 
""Related items"" : 
""Related items (Parents)"" : [[PRINTAURA]] 
""Related items (Children)"" : [[FALLOUT]] [[CONVEYANCE]] [[PINWALE]] 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|en.wikipedia.org - Slide of PRISM collection dataflow ]
=== SCRAPHEAPCHALLENGE ===
""Short Description"" : perfect spoofing of emails from Blackberry targets
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[blackberry]] [[email]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SCREAMINGEAGLE ===
""Short Description"" : is a tool that processes kismet data into geolocation information
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[kismet]] [[geolocation]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SCREAMINGHARPY ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== SCS ===
""Short Description"" : [[SIGINT]] for locating cellphone in Brasilia (BR)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[geolocation]] [[brazil]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
=== SEABOOT ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== SEAGULLFARO ===
""Short Description"" : High-side server shown in [[UNITEDRAKE]] internet cafe monitoring graphic. Spotted on [[IRATEMONK]], [[WISTFULTOLL]] diagrams.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[WISTFULTOLL]] [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SEASONEDMOTH ===
""Short Description"" : A class of malware that is programmed to automatically die with in 30 days. (unless instructed to extend its life). During this period of 30 days, harvest all activity by the target
""Category"" : attack vector
""Alias"" : [[SMOTH]] 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : [[VALIDATOR]] [[COMMONDEER]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.aclu.org/files/natsec/nsa/20140130/%28TS%29%20NSA%20Quantum%20Tasking%20Techniques%20for%20the%20R&T%20Analyst.pdf|aclu.org - NSA Quantum Tasking Techniques for the R&T Analyst]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://www.theregister.co.uk/Print/2013/12/31/nsa_weapons_catalogue_promises_pwnage_at_the_speed_of_light/| theregister.co.uk]
=== SEBACIUM ===
""Short Description"" : An ICTR developed to identify P2P file sharing activity of intelligence value. Logs are accessible via [[DIRTYRATS]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[DIRTYRATS]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SECONDDATE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[NOFORN]] 
""Related items"" : [[TAO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== SEMESTER ===
""Short Description"" : SIGINT targeting and reporting systems called
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== SENTINEL ===
""Short Description"" : SENTINEL is a NSA security filter for [[SYBASE]] databases which provides multi-level security down to the row level.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[SYBASE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.nsa.gov/public_info/_files/cryptologs/cryptolog_136.pdf| nsa.gov - cryptolog]
=== SENTRYCONDOR ===
""Short Description"" : Sub-programm of [[SENTRYEAGLE]]  about computer network operations and attacks
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : 
""Related items (Parents)"" : [[SENTRYEAGLE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SENTRYEAGLE ===
""Short Description"" : Joint program between the [[NSA]] and  the [[JFCC]]-NW (Joint Functionnal Component Command - Network Warfare) with a core secrets level (the highest and most sensitive level of information) for the protection of America's cyberspace along with other US and foreign agencies/elements. They combine the "full capabilities of authorized Computer Network Operations capabilities (SIGINT, CNE, information assurance, CND, network warfare, CNA and all supporting activities". The program and its subordinate programs protect the combined facts related to NSA/CSS and JFCC-NW's abilities to conduct [[CNO]] operations.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[SENTRYHAWK]] [[SENTRYFALCON]] [[SENTRYOSPREY]] [[SENTRYRAVEN]] [[SENTRYCONDOR]] 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SENTRYFALCON ===
""Short Description"" : Sub-programm of [[SENTRYEAGLE]]  about computer network defense
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : 
""Related items (Parents)"" : [[SENTRYEAGLE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SENTRYHAWK ===
""Short Description"" : Sub-programm of [[SENTRYEAGLE]] for activities involving computer network exploitation, or spying
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : 
""Related items (Parents)"" : [[SENTRYEAGLE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SENTRYOSPREY ===
""Short Description"" : Sub-programm of [[SENTRYEAGLE]]  in cooperation with the [[CIA]] and other intelligence agencies. According to the briefing document’s description of Sentry Osprey, the  NSA “employs its own HUMINT assets (Target Exploitation—TAREX) to  support SIGINT operations.”
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : [[TAREX]] 
""Related items (Parents)"" : [[SENTRYEAGLE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SENTRYOWL ===
""Short Description"" : Sub-programm of [[SENTRYEAGLE]] about collaborations with private companies
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : 
""Related items (Parents)"" : [[SENTRYEAGLE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SENTRYRAVEN ===
""Short Description"" : Sub-programm of [[SENTRYEAGLE]] to break encryption systems
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : 
""Related items (Parents)"" : [[SENTRYEAGLE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
=== SEPENTSTONGUE ===
""Short Description"" : for fax message broadcasting to multiple numbers.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[fax]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SERUM ===
""Short Description"" : Spotted on [[IRATEMONK]] diagram
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SETTEE ===
""Short Description"" : SIGINT Exchange Designators of South Korea
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[korea]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== SFL ===
""Short Description"" : The SIGINT Forensics Laboratory was developed within NSA. It has been adapted by JTRIG as its email extraction and first-pass analysis of seized media solution
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[email]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SHADOWCAT ===
""Short Description"" : End-to-End encrypted access to a VPS over SSH using the TOR network.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[tor]] [[ssh]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SHAREDTAFFY ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== SHAREDVISION ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TARMAC]] 
""Related items (Parents)"" : [[TARMAC]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== SHARKFIN ===
""Short Description"" : Sweeps up all-source communications intelligence at high speed and volumes, renamed [[RC-10]]
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== SHARPFOCUS ===
""Short Description"" : SHARPFOCUS is a spying program used in 2007 and 2008 in Iraq and Afghanistan. Productions Operation of NSA's TAO division.
""Category"" : program
""Alias"" : [[SF2]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[iraq]] [[afghanistan]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[OLYMPUS]] [[PARCHDUSK]] [[FOXACID]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.spiegel.de/fotostrecke/photo-gallery-nsa-s-tao-unit-introduces-itself-fotostrecke-105372-4.html|spiegel.de - Photo Gallery: NSA's TAO Unit Introduces Itself]
=== SHARPSHADOW ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== SHELLTRUMPET ===
""Short Description"" : SHELLTRUMPET is a NSA metadata processing program which show the NSA's metadata collection scale.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TRAFFICHIEF]] [[DANCINGOASIS]] [[OAKSTAR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/27/nsa-online-metadata-collection|theguardian.com - How the NSA is still harvesting your online data]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|No Place To Hide Documents by Greenwald]
=== SHENANIGANS ===
""Short Description"" : In addition to the [[GILGAMESH]] system used by [[JSOC]], the CIA uses a similar NSA platform known as SHENANIGANS. The operation utilizes a pod on aircraft that vacuums up massive amounts of data from any wireless routers, computers, smartphones or other electronic devices that are within range.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : CIA
""Tags"" : [[gsm]] [[wifi]] [[phone]] [[wifi]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/|theintercept.org - The NSA’s Secret Role in the U.S. Assassination Program]
=== SHIFTINGSHADOW ===
""Short Description"" : Subprogram of [[OAKSTAR]], targeting DNR metadata and voice; "Timing Advances" and geolocation, on Afghanistan communications: MTN Afghanistan, Roshan GSM Network, AWCC
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[geolocation]] [[gsm]] [[dnr]] [[geolocation]] [[afghanistan]] 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[UPSTREAM]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR| en.wikipedia.org - OAKSTAR ]
=== SHOALBAY ===
""Short Description"" : [[SIGINT]] for locating cellphone in Darwin (AU)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[geolocation]] [[phone]] [[australia]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
=== SHORTSHEET ===
""Short Description"" : CNE (hacking) technique used against Tor users
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[tor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SIERRAMONTANA ===
""Short Description"" : SIERRAMONTANA provides persistence for DNT implants. The DNT implant will survive an upgrade or replacement of the operating system -- including physically replacing the router's compact flash card. Currently, the intended DNT Implant to persist is VALIDATOR, which must be run as a user process on the target operating system. The vector of attack is the modification of the target's BIOS. The modification will add the necessary software to the BIOS and modify its software to execute the SIERRAMONTANA implant at the end of its native System Management Mode (SMM) handler. SIERRAMONTANA must support all modern versions of JUNOS, which is a version of FreeBSD customized by Juniper. Upon system boot, the JUNOS operating system is modified in memory to run the implant, and provide persistent kernel modifications to support implant execution. SIERRAMONTANA is the cover term for the persistence technique to deploy a DNT implant to Juniper M-Series routers
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[bios]] [[dnt]] [[tao]] [[ant]] [[junos]] 
""Compartments"" : 
""Related items"" : [[SCHOOLMONTANA]] [[STUCCOMONTANA]] [[VALIDATOR]] [[TAO]] [[FOXACID]] 
""Related items (Parents)"" : [[STUCCOMONTANA]] 
""Related items (Children)"" : 
""Status"" : (ETA 30 November 2008)
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://www.schneier.com/blog/archives/2014/01/sierramontana_n.html|schneier.com - SIERRAMONTANA: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-sierramontana.jpg|leaksource.wordpress.com - SIERRAMONTANA TAO's catalog page]
=== SILENTMOVIE ===
""Short Description"" : targeted denial of service against SSH services
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[ssh]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SILVERBLADE ===
""Short Description"" : Reporting of extremist material on DAILYMOTION.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[video]] [[dailymotion]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SILVERFOX ===
""Short Description"" : List provided to industry of live extremist material files hosted on FFUs
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SILVERLORD ===
""Short Description"" : Disruption of video-based websites hosting extremist content through concerted target discovery and content removal
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[video]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SILVERSPECTER ===
""Short Description"" : Allows batch Nmap scanning over TOR
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[tor]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SILVERZEPHYR ===
""Short Description"" : Subprogram of [[OAKSTAR]], Network access point through [[STEELKNIGHT]] partner: targeting South, Central and Latin America DNR (metadata, voice, fax), DNI (content, metadata)
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[dns]] [[dni]] [[dnr]] [[metadata]] [[latin america]] 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[STEELKNIGHT]] [[UPSTREAM]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR| en.wikipedia.org - OAKSTAR]
* [http://en.wikipedia.org/wiki/File:SilverZephyr.jpg| en.wikipedia.org - SilverZephyr.jpg]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== SKYSCRAPER ===
""Short Description"" : Production and dissemination of multimedia via the web in the course of information operations.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SKYWRITER ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== SLAMMER ===
""Short Description"" : is a data index repository that provides analysts with the ability to query data collected from the internet from various JTRIG sources, such as [[EARTHLING]] or [[HACIENDA]], web pages saved by analysts etc.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SLICKERVICAR ===
""Short Description"" : A tool known to be used somewhere in the process of uploading malicious HD firmware
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SLIPSTREAM ===
""Short Description"" : Ability to inflate page views on websites
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SMOKEYSINK ===
""Short Description"" : spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== SNEAKERNET ===
""Short Description"" : Not a codename, a term for the “network communication protocol” involving someone physically carrying storage media between machines.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SNICK ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Oman
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[geolocation]] [[oman]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== SNOOPY ===
""Short Description"" : is a tool to extract mobile phone data from a copy of the phone's memory (usually supplied as an image file extracted through FTK)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[phone]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SODAWATER ===
""Short Description"" : A tool for regularly downloading gmail messages and fowarding them onto [[CERBERUS]] mailboxes
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[email]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SOLIS ===
""Short Description"" : SIGINT On-Line Information System
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SOMALGET ===
""Short Description"" : The [[NSA appears to have used access legally obtained in cooperation with the U.S. Drug Enforcement Administration to open a backdoor to the country’s cellular telephone network, enabling it to covertly record and store the “full-take audio” of every mobile call made to, from and within the Bahamas and several other countries, including Mexico, the Philippines, Kenya and Afghanistan. [[MYSTIC]] provides the access, the metadata and the voice; SOMALGET provides the massive amounts of storage needed to archive all those calls so that analysts can listen to them at will after the fact.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[bahamas]] [[mexico]] [[philippines]] [[kenya]] [[afghanistan]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[MYSTIC]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/05/19/data-pirates-caribbean-nsa-recording-every-cell-phone-call-bahamas/|Data Pirates of the Caribbean: The NSA Is Recording Every Cell Phone Call in the Bahamas]
* [http://www.numerama.com/magazine/29421-informer-peut-il-tuer-wikileaks-prendra-le-risque-d-ici-mercredi.html|Informer peut-il tuer ? Wikileaks prendra le risque d'ici mercredi]
* [http://www.numerama.com/magazine/29473-nsa-wikileaks-revele-le-nom-du-pays-dont-tous-les-appels-ont-ete-captes.html|NSA : Wikileaks révèle le nom du pays dont tous les appels ont été captés]
=== SOMBERKNAVE ===
""Short Description"" : [[SOMBERKNAVE]] software based malware, intended to bridge airgaps by using an unused 802.11 wireless interface. For Windows XP. Allows other malware to “call home” In particular, the [[VALIDATOR]] and [[OLYMPUS]] trojans.trojans.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[wifi]] [[malware]] [[windows]] [[os]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[OLYMPUS]] [[VALIDATOR]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/12| TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
* [https://www.schneier.com/blog/archives/2014/02/somberknave_nsa.html|SOMBERKNAVE: NSA Exploit of the Day]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== SOUFFLETROUGH ===
""Short Description"" : SOUFFLETROUGH is a BIOS persistence implant for Juniper SSG 500 and SSG 300 firewalls. It persists DNT's [[BANANAGLEE]] software implant. [[BANANAGLEE]] also has an advanced persistent back-door capability. SOUFFLETROUGH is a BIOS persistence implant for Juniper SSG 500 and SSG 300 series firewalls (320M, 350M, 520, 550, 520M, 550M). It persists DNT's [[BANANAGLEE]] software implant and modifies the Juniper firewall's operating system (ScreenOS) at boot time. If [[BANANAGLEE]] support is not available for the booting operating system, it can install a Persistent Backdoor (PBD) designed to work with [[BANANAGLEE]]'s communications structure, so that full access can be reacquired at a later time. It takes advantage of Intel's System Management Mode for enhanced reliability and covertness. The PDB is also able to beacon home, and is fully configurable. A typical SOUFFLETROUGH deployment on a target firewall with an exfiltration path to the Remote Operations Center (ROC) is shown above. SOUFFLETROUGH is remotely upgradeable and is also remotely installable provided [[BANANAGLEE]] is already on the firewall of interest.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[bios]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[BANANAGLEE]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/souffletrough_n.html| schneier.com - SOUFFLETROUGH: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-souffletrough.jpg| leaksource - TAO Catalog's Page with Graphics]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SOUNDER ===
""Short Description"" : [[SIGINT]] for locating cellphone in Cyprus
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[geolocation]] [[cyprus]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== SOUTHWINDS ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== SPACEROCKET ===
""Short Description"" : is a programme covering insertion of media into target networks. [[CRINKLECUT]] is a tool developped by ICTR-CISA to enable JTRIG track images as part of SPACEROCKET.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CRINKLECUT]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SPARROW-II ===
""Short Description"" : An embedded computer system running [[BLINDDATE]] tools. SPARROW-II is a fully functional WLAN collection system with integrated Mini PCI slots for added functionality such as GPS and multiple Wireless Network Interface Cards. Application [[SW]]: [[BLINDDATE]]
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[wifi]] [[gps]] [[pci]] [[tao]] [[ant]] 
""Compartments"" : [[FOUO]] 
""Related items"" : [[TRINITY]] [[JUNIORMINT]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[BLINDDATE]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://www.schneier.com/blog/archives/2014/01/sparrow_ii_nsa.html|schneier.com - SPARROW II: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-sparrow-ii.jpg|leaksource.wordpress.com - TAO's Catalog Page with Graphic]
=== SPECULATION ===
""Short Description"" : RF communication protocol, used by [[HOWLERMONKEY]] devices, Including [[COTTONMOUTH-I]] [[COTTONMOUTH-III]], [[FIREWALK]].
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[rf]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[HOWLERMONKEY]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SPICEISLAND ===
""Short Description"" : JTRIG's new infrastructure. [[FORESTWARRIOR]] [[FRUITBOWL]] [[JAZZFUSION]] and other JTRIG systems will form part of the SPICE ISLAND infrastructure.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : [[FORESTWARRIOR]] [[FRUITBOWL]] [[JAZZFUSION]] 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SPINNERET ===
""Short Description"" : Metadata collection's program
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/27/nsa-online-metadata-collection| The Guardian]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== SPRINGBISHOP ===
""Short Description"" : This program collect images and profiles from [[facebook]] via a [[mitm]] between client and cdn servers. spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[facebook]] [[akamai]] [[mitm]] [[jtrig]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== SPRINGRAY ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TICKETWINDOW]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== SQUEAKYDOLPHIN ===
""Short Description"" : broad real-time monitoring of online activity of : youtube video views, URL's 'liked' on facebook, blogspot/blogger visits
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[facebook]] [[youtube]] [[blogger]] [[twitter]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://leaksource.info/2014/01/27/squeaky-dolphin-gchq-pilot-program-collects-data-from-social-media-sites-in-real-time-via-cable-taps/ | Squeaky Dolphin: GCHQ Pilot Program Collects Data from Social Media Sites in Real-Time via Cable Taps - leaksource.info]
* [https://firstlook.org/theintercept/article/2014/02/18/snowden-docs-reveal-covert-surveillance-and-pressure-tactics-aimed-at-wikileaks-and-its-supporters/|Snowden Documents Reveal Covert Surveillance and Pressure Tactics Aimed at WikiLeaks and Its Supporters]
* [http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data|Angry Birds and 'leaky' phone apps targeted by NSA and GCHQ for user data]
=== SSG ===
""Short Description"" : Spotted on [[IRATEMONK]], [[WISTFULTOLL]] diagrams
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[WISTFULTOLL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SSO ===
""Short Description"" : Special Site Operation, a physical place from where NSA executes attacks such as [[QUANTUMINSERT]]. Typically an US Embassy with either one or several of these: antennas, network connections, radio patch antennas, etc...
""Category"" : compartment
""Alias"" : [[Special Site Operation]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[mots]] 
""Compartments"" : 
""Related items"" : [[QUANTUMINSERT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf||SSO - The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
=== STEALTHMOOSE ===
""Short Description"" : is a tool that disrupt target's windows machine. Logs of how long and when the effect is active
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[windows]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== STEELFLAUTA ===
""Short Description"" : [[SSO]] Corporate/ [[TAO]] (Tailored Access Operations) Shaping
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== STEELKNIGHT ===
""Short Description"" : NSA's corporate partners
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[SILVERZEPHIR]] [[UPSTREAM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR| en.wikipedia.org - OAKSTAR]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== STELLAR ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Geraldton (AU)
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[geolocation]] [[autralia]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/ | nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== STELLARWIND ===
""Short Description"" : [[STELLARWIND]] is the code name of a Sensitive Compartmented Information security compartment for information collected under the President's Surveillance Program (PSP). This was a program by the United States National Security Agency (NSA) during the presidency of George W. Bush and revealed by Thomas Tamm to the The New York Times in 2008. The operation was approved by President George W. Bush shortly after the September 11 attacks in 2001. STELLARWIND was succeeded during the presidency of Barack Obama by four major lines of intelligence collection in the territorial United States together capable of spanning the full range of modern telecommunications. The program's activities involved data mining of a large database of the communications of American citizens, including email communications, phone conversations, financial transactions, and Internet activity.
""Category"" : program
""Alias"" : [[STLW]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[email]] [[phone]] 
""Compartments"" : 
""Related items"" : [[BLARNEY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [[EVILOLIVE|]]
* [http://en.wikipedia.org/wiki/Stellar_Wind_(code_name)| en.wikipedia.org - Stellar Wind (code name)]
=== STOCKCAR ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[LONGHAUL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== STORMBREW ===
""Short Description"" : [[STORMBREW]] is an umbrella program involving surveillance of telecommunications. It falls under the category of "[[UPSTREAM]] collection," meaning that data is pulled directly from fiber-optic cables and top-level communications infrastructure. There is also a SIGAD of the same name, which is described as a "key corporate partner." A map shows that the collection is done entirely within the United States. This corporate partner has servers in Washington, California, Texas, Florida, and in or around New York, Virginia, and Pennsylvania. [[UPSTREAM]] collection programs allow access to very high volumes of data, and most of the pre-selection is done by the providers themselves, before the data is passed on to the NSA.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[fiber]] 
""Compartments"" : 
""Related items"" : [[MADCAPOCELOT]] [[STORMBREW]] [[PINWALE]] [[MARINA]] [[UPSTREAM]] [[XKEYSCORE]] 
""Related items (Parents)"" : [[UPSTREAM]] 
""Related items (Children)"" : [[MADCAPOCELOT]] [[ARTIFICE]] 
""Status"" : unknown
""Links"" : 
* [http://en.wikipedia.org/wiki/STORMBREW| en.wikipedia.org - STORMBREW]
* [http://cryptome.org/2013/12/nsa-cable-spy-types.pdf||SSO - The cryptologic provider of Intelligence from Global High-Capacity Telecommunications Systems]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== STRAITBIZARRE ===
""Short Description"" : Software made By Digital Network Technologies (DNT) for controlling and receiving data from “implants”. Also involved somewhere in the process of uploading malicious HD firmware (works with a tool called [[SLICKERVICAR]] to accomplish this)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== STRIKEZONE ===
""Short Description"" : “[[HOWLERMONKEY]] is a COTS- based transceiver designed to be compatible with [[CONJECTURE]]/[[SPECULATION]] networks and [[STRIKEZONE]] devices running a [[HOWLERMONKEY]] personality.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[HOWLERMONKEY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm| cryptome.org - NSA codenames]
=== STRONGMITE ===
""Short Description"" : somewhere on the [[ROC]] side of operations...
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[IRONCHEF]] [[TAO]] 
""Related items (Parents)"" : [[ROC]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== STUCCOMONTANA ===
""Short Description"" : provides persistence for [[DNT]] implants. The [[DNT]] implant will survive an upgrade or replacement of the operating system - including physically replacing the router's compact flash card. Currently, the intended DNT Implant to persist is [[VALIDATOR]], which must be run as a user process on the target operating system. The vector of attack is the modification of the target's BIOS. The modification will add the necessary software to the BIOS and modify its software to execute the [[SIERRAMONTANA]] implant at the end of its native System Management Mode (SMM) handler. [[STUCCOMONTANA]] must support all modern versions of JUNOS, which is a version of FreeBSD customized by Juniper. Upon system boot, the [[JUNOS]] operating system is modified in memory to run the implant, and provide persistent kernel modifications to support implant execution. [[STUCCOMONTANA]] is the cover term for the persistence technique to deploy a DNT implant to Juniper T-Series routers.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[bios]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : [[VALIDATOR]] [[SIERRAMONTANA]] 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum]
* [https://www.schneier.com/blog/archives/2014/01/stuccomontana_n.html|schneier.com - NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-sierramontana.jpg|leaksource.wordpress.com - TAO Catalog Page with Graphics]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf| cryptome.org - NSA's catalog]
=== STUXNET ===
""Short Description"" : A jointly US/Isreali written piece of malware intended to infect, and physically destroy five Iranian organizations, with the probable target widely suspected to be uranium enrichment infrastructure in Iran . (which it did) Also spilled on to non-targeted SCADA systems, causing “collateral damage”. Using 0-day exploits, it infected Personal Computers near the targeted Installation: then it waited several months to infect a USB-key which will be connected on the internal-network of the target. After that, a payload dedicated to Siemens Systems is enabled
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[malwarel]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://en.wikipedia.org/wiki/Stuxnet| en.wikipedia.org - Stuxnet]
=== SULPHUR ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[south korea]] 
""Compartments"" : 
""Related items"" : [[VAGRANT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== SUNBLOCK ===
""Short Description"" : Ability to deny functionality to send/receive email or view material online
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[email]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SURLYSPAWN ===
""Short Description"" : SURLYSPAWN has the capability to gather keystrokes without requiring any software running on the targeted system. It also only requires that the targeted system be touched once. The retro-reflector is compatible with both USB ans PS/2 keyboards. The simplicity of the design allows the form factor to be tailored for specific operational requirements.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[ANGRYNEIGHBOR]] [[TAO]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de - To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf| cryptome.org - NSA's catalog]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/7|TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== SURPLUSHANGAR ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== SURPLUSHANGER ===
""Short Description"" : High -> Low diodes, spotted on [[QUANTUMTHEORY]]'s presentation.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/03/nsa-gchq-quantumtheory.pdf | 2010 sigint development conferences - nsa-gchq-quantumtheory.pdf]
=== SURREY ===
""Short Description"" : Main NSA requirements database, where targets and selectors are "validated" by NSA managers
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== SUTURESAILOR ===
""Short Description"" : A particular device that includes a [[HOWLERMONKEY]] component
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[HOWLERMONKEY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf| cryptome.org - NSA's catalog]
=== SWAMPDONKEY ===
""Short Description"" : is a tool that will silently locate all predefined types of file and encrypt them on a targets machine
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== SWAP ===
""Short Description"" : SWAP provides software application persistence by exploiting the motherboard BIOS and the hard drive's Host Protected Area to gain periodic execution before the Operating System loads. This technique supports single or multi-processor systems running Windows, Linux, FreeBSD, or Solaris with the following file systems: FAT32, NTFS, EXT2, EXT3, or UFS1.0. Through remote access or [[INTERDICTION]], [[ARKSTREAM]] is used to reflash the BIOS and [[TWISTEDKILT]] to write the Host Protected Area on the hard drive on a target machine in order to implant SWAP and its payload (the implant installer). Once implanted, SWAP's frequency of execution (dropping the playload) is configurable and will occur when the target machine powers on.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[bios]] [[windows]] [[os]] [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL]] 
""Related items"" : [[ARKSTREAM]] [[TWISTEDKILT]] [[TUNINGFORK]] [[INTERDICTION]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/02/swap_nsa_exploi.html|SWAP: NSA Exploit of the Day]
* [http://www.prepperpodcast.com/phone-calls-listening/20131231025312_9-nsa-swap/|prepperpodcast.com - It’s not just your phone calls – it’s YOU they are listening to]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
=== SYLVESTER ===
""Short Description"" : Framework for automated interaction / alias management on social networks
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[social network]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TALENTKEYHOLE ===
""Short Description"" : Control system for space-based collection platforms. This control system is for products of overhead collection systems, such as satellites and reconnaissance aircraft, and contains compartments, which are identified by a classified codeword. The original TALENT compartment was created in the mid-1950s for the U-2. In 1960, it was broadened to cover all national aerial reconnaissance and the KEYHOLE compartment was created for satellite intelligence.
""Category"" : program
""Alias"" : [[TK]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[CHESS]] [[RUFF]] [[ZARF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[CHESS]] [[RUFF]] [[ZARF]] 
""Status"" : old?
""Links"" : 
* [http://electrospaces.blogspot.fr/2013/09/the-us-classification-system.html|electrospaces - Top Level Telecommunications]
=== TANGLEFOOT ===
""Short Description"" : is a bulk search tool which queries a set of online ressources. This allows analysts to quickly check the online presence of a target
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TANNER ===
""Short Description"" : A technical programme allowing operators to log on to a [[JTRIG]] website to grab OP adresses of Internet Cafe's. Replaced by [[HAVOK]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[HAVOK]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TAO ===
""Short Description"" : The NSA's TAO (Tailored Access Operations) hacking unit is considered to be the intelligence agency's top secret weapon. It maintains its own covert network, infiltrates computers around the world and even intercepts shipping deliveries to plant back doors in electronics ordered by those it is targeting. [...] During the middle part of the last decade, the special unit succeeded in gaining access to 258 targets in 89 countries -- nearly everywhere in the world. In 2010, it conducted 279 operations worldwide.
""Category"" : compartment
""Alias"" : [[Tailored Access Operations]] 
""Family"" : agence
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ROC]] [[GENIE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[ROC]] 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/international/world/the-nsa-uses-powerful-toolbox-in-effort-to-spy-on-global-networks-a-940969.html|spiegel.de - Inside TAO: Documents Reveal Top NSA Hacking Unit]
* [https://www.schneier.com/blog/archives/2013/12/more_about_the.html|schneier.com - More about the NSA's Tailored Access Operations Unit]
* [http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking/|washingtonpost.com | NSA uses Google cookies to pinpoint targets for hacking]
=== TAREX ===
""Short Description"" : the [[CORE SECRETS]] involves an array of clandestine activities in the real world by [[NSA]] agents working with their colleagues at the [[CIA]], [[FBI]], and [[Pentagon]]. The agency also participates in a variety of [[HUMINT]] programs that are grouped under the codename [[SENTRYOSPREY]]. According to the briefing document’s description of Sentry Osprey, the NSA employs its own HUMINT assets (Target Exploitation - TAREX) to support SIGINT  operations.
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : [[core secrets]] [[south korea]] [[germany]] [[china]] 
""Compartments"" : [[CORE SECRETS]] [[ECI]] [[SAP]] 
""Related items"" : [[SENTRYOSPREY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/10/10/core-secrets/|The Intercept - Core Secrets: NSA Saboteurs in China and Germany]
* [https://firstlook.org/theintercept/document/2014/10/10/target-exploitation-classification-guide/|The Intercept - Target Exploitation Classification Guide]]
=== TARGETPROFILER ===
""Short Description"" : A tool that lists which targets are vulnerable to exploits, and which.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[QUANTUMNATION]] [[QUANTUMTHEORY]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TARMAC ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== TAWDRYYARD ===
""Short Description"" : Beacon RF retro-reflector. Provides return when illuminated with radar to provide rough positional location. TAWDRYYARD is used as a beacon, typically to assist in locating and identifying deployed [[RAGEMASTER]] units. Current design allows it to be detected and located quite easily within a 50' radius of the radar system being used to illuminate it. TAWDRYYARD draws as 8 mu;A at 2.5V (20mu;W) allowing a standard lithium coin cell to power it for months or years. The simplicity of the design allows the form factor to be tailored for specific operational requirements. Future capabilities being considered are return of GPS coordinates and a unique target identifier and automatic processing to scan a target area for presence of TAWDRYYARDs. All components are COTS and so are non-attributable to NSA.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[tao]] [[ant]] 
""Compartments"" : [[TS]] [[SI]] [[REL TO USA]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[ANGRYNEIGHBOUR]] [[TAO]] 
""Related items (Children)"" : [[RAGEMASTER]] 
""Status"" : End processing still in development
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/tawdryyard_nsa.html|schneier.com - TAWDRYYARD: NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-tawdryyard.jpg|leaksource.wordpress.com - TAO's Catalog Page with Graphic]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de -To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [https://commons.wikimedia.org/wiki/File:NSA_TAWDRYYARD.jpg|wikimedia.org - NSA TAWDRYYARD]
=== TECHNOVIKING ===
""Short Description"" : A sub-system of [[JAZZFUSION]]
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[JAZZFUSION]] 
""Related items (Parents)"" : [[JTRIG]] [[JAZZFUSION]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TEMPORA ===
""Short Description"" : Clandestine security electronic surveillance program trialled in 2008, established in 2011 and operated by the [[GCHQ]]. Data is extracted from over 200 fibre-optic cables and processed; full data is preserved for three days while metadata is kept for 30 days. No distinction is made in the gathering of the data between innocent people or targeted suspects. Includes recordings of telephone calls, the content of email messages, Facebook entries and the personal internet history of users.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[facebook]] [[email]] [[phone]] 
""Compartments"" : 
""Related items"" : [[MTI]] [[Global Telecoms Exploitation]] [[CCDP]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[MTI]] [[Global Telecoms Exploitation]] 
""Status"" : active
""Links"" : 
* [https://en.wikipedia.org/wiki/Tempora|Wikipedia - Tempora]
* [http://lexpansion.lexpress.fr/high-tech/operation-tempora-comment-les-britanniques-depassent-les-americains-pour-espionner-internet_390971.html|L'Express - "Operation Tempora": comment les Britanniques dépassent les Américains pour espionner Internet]
* [http://abonnes.lemonde.fr/europe/article/2013/06/26/berlin-demande-a-londres-des-explications-sur-son-programme-d-espionnage-tempora_3436728_3214.html|Le Monde - Berlin demande à Londres des explications sur son programme d'espionnage "Tempora" ]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== THESPIS ===
""Short Description"" : SIGINT Exchange Designators with Third or Fourth Parties.
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.intrepidreport.com/archives/8588|intrepidreport.com - Senate delivers fatal end-of-term blow to Constitution]
=== THIEVINGMAGPIE ===
""Short Description"" : Using on-board GSM/GPRS services to tracks targets. Able to identify Blackberry PIN and associated email adresses on GPRS events, tasked content into datastores, unselected to [[XKEYSCORE]]. They can confirm that targets selectors are on board, if the target use data, they can also recover email address's, facebook's IDs, Skype addresses... A specific aircraft can be tracked approximately every 2 minutes whilst in flight.
""Category"" : program
""Alias"" : [[THIEVING MAGPIE]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[blackberry]] [[gsm]] [[gprs]] [[skype]] [[email]] [[facebook]] [[plane]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] [[STRAP1]] 
""Related items"" : [[SOUTHWINDS]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== THINTREAD ===
""Short Description"" : THINTREAD is the name of a project that the NSA pursued during the 1990s. The program involved wiretapping and sophisticated analysis of the resulting data, but according to the article, the program was discontinued three weeks before the September 11, 2001 attacks due to the changes in priorities and the consolidation of U.S. intelligence authority. The "change in priority" consisted of the decision made by the director of NSA General Michael V. Hayden to go with a concept called [[TRAILBLAZER]], despite the fact that THINTREAD was a working prototype that protected the privacy of U.S. citizens.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TRAILBLAZER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [http://en.wikipedia.org/wiki/ThinThread|en.wikipedia.org - ThinThread]
=== TICKETWINDOW ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[SPRINGRAY]] [[ORANGECRUSH]] [[BUFFALOGREEN]] [[ORANGEBLOSSOM]] [[OAKSTAR]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== TIGERFIRE ===
""Short Description"" : Spoted on nsa fy13 semiannual report
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : undefined
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/07/nsa-fy13-semiannual-report.pdf | nsa-fy13-semiannual-report-1.pdf]
=== TIMBERLINE ===
""Short Description"" : [[SIGINT]] ([[FORNSAT]]) for locating cellphone in Sugar Grove (USA)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[geolocation]] [[usa]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[REL TO USA]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] [[FVEY]] 
""Related items"" : 
""Related items (Parents)"" : [[PRISM]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://nsa.gov1.info/dni/|nsa.gov1.info/dni/]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== TLN ===
""Short Description"" : Twisty Lobby Number. (not really well explained in doc)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TOPHAT ===
""Short Description"" : A version of the [[MUSTANG]] and [[DANCINGBEAR]] techniques that allow us to pull back cell tower and wifi locations targeted against particular areas
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[wifi]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[DANCINGBEAR]] [[MUSTANG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TOPI ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== TORNADOALLEY ===
""Short Description"" : is a delivery method (Excel Spreadsheet) that can silently extract and run an executable on a target's machine.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[windows]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TORUS ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== TOTECHASER ===
""Short Description"" : Software-based malware for Thuraya 2520 satellite-cellular handsets running Windows CE. Designed to exfiltrate GPS and GSM geolocation data, as well as the call log and contact list, and other data via covert SMS messages. SMS messages are also the means by which the attacker controls the phone. Implementation requires modifying the phone itself, not yet deployed as of Oct 2008. Saw on ANT Catalog.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[gps]] [[sms]] [[os]] [[geolocation]] [[phone]] [[windows]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[TOTEGHOSTLY]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/4|digitaltrends.com - TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
=== TOTEGHOSTLY ===
""Short Description"" : Malware for Windows Mobile -based handsets. Written using DNT's [[CHIMNEYPOOL]] framework, and controlled via [[STRAITBIZARRE]]. Used to infiltrate and exfiltrate files, SMS, contact lists, geolocation via SMS or GPRS data connection. From or to the victim device The attacker has the ability to control the camera and microphone, and also send other commands to the device. The encrypted protocol it uses to communicate is referred to as [[FRIEZERAMP]].
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[malware]] [[windows]] [[sms]] [[os]] [[geolocation]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[STRAITBIZARRE]] [[CHIMNEYPOOL]] [[FREEFLOW]] [[GENIE]] [[FRIEZERAMP]] [[TOTECHASER]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TOYGRIPPE ===
""Short Description"" : spotted on [[TURBINE]]'s document about "APEX VPN exploitation". Network knowledge. VPN Analytics about endpoint
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[METROTUBE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== TRACERFIRE ===
""Short Description"" : An Office Document that grabs the targets Machine info, files, etc and posts it back to GCHQ.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TRACKERSMURF ===
""Short Description"" : GCHQ's targeted tools against individual smartphones, to geolocate the user with high-precision.
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[GCHQ]]
""Tags"" : [[gsm]] [[geolocation]] 
""Compartments"" : 
""Related items"" : [[NOSEYSMURF]] [[DREAMYSMURF]] [[PARANOIDSMURF]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data|Angry Birds and 'leaky' phone apps targeted by NSA and GCHQ for user data]
=== TRAFFICTHIEF ===
""Short Description"" : According to an [[XKEYSCORE]] presentation, TRAFFICTHIEF is a database of "Meta-data from a subset of tasked strong-selectors", a example of a strong selector is an email address. In other words, it would be a database of the metadata associated with names, phone numbers, email addresses, etc., that the intelligence services are specifically targeting.
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[metadata]] [[email]] [[phone]] 
""Compartments"" : 
""Related items"" : [[XKEYSCORE]] [[PRINTAURA]] [[PRISM]] [[PINWALE]] [[MARINA]] 
""Related items (Parents)"" : [[PRINTAURA]] [[TURBULENCE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/File:Prism-slide-7.jpg|en.wikipedia.org - Slide of PRISM collection dataflow]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== TRAILBLAZER ===
""Short Description"" : TRAILBLAZER was a United States NSA program intended to develop a capability to analyze data carried on communications networks like the Internet. It was intended to track entities using communication methods such as cell phones and email. It ran over budget, failed to accomplish critical goals, and was cancelled.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[phone]] [[email]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [http://en.wikipedia.org/wiki/Trailblazer_Project|en.wikipedia.org - Trailblazer Project]
=== TREASUREMAP ===
""Short Description"" : a near real-time, interactive map of the global Internet. It is a massive Internet mapping, analysis and exploration engine. It collects Wi-Fi network and geolocation data, and between 30 million and 50 million unique Internet provider addresses. The program can map “any device, anywhere, all the time.” Intelligence officials say "it only maps foreign and Defense Department networks".
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[geolocation]] [[wifi]] 
""Compartments"" : 
""Related items"" : [[Packaged Goods]] [[SIGINT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html|Der Spiegel -  The NSA Breach of Telekom and Other German Firms]
* [https://firstlook.org/theintercept/2014/09/14/nsa-stellar/|The Intercept - Map of the Stars: The NSA and GCHQ Campaign Against German Satellite Companies]
* [http://leaksource.wordpress.com/2013/11/23/nsa-programs-treasure-map-near-real-time-interactive-map-of-internet-any-device-anywhere-all-the-time-packaged-goods-tracks-traceroutes-accessed-13-servers-in-unwitting-data-centers/|LeakSource - (NSA Programs) Treasure Map: Near Real-Time Interactive Map of Internet, Any Device, Anywhere, All the Time; Packaged Goods: Tracks Traceroutes, Accessed 13 Servers in Unwitting Data Centers]
* [http://cryptome.org/2013/11/nsa-treasuremap.htm|cryptome.org - NSA TreasureMap]
* [http://nation.time.com/2013/11/23/new-document-shows-nsa-wanted-more-more-more-power/|The Time - New Document Shows NSA Wanted More, More, More Power]
* [http://www.nytimes.com/2013/11/23/us/politics/nsa-report-outlined-goals-for-more-power.html?_r=0|The New York Times - N.S.A. Report Outlined Goals for More Power]
=== TRINITY ===
""Short Description"" : A microcomputer, designed to be part of a bug. Specs: 100Mhz ARM 9 Microcontroller, 4MB flash, 96MB SDRAM. Smaller than a penny. Known to be a component of [[COTTONMOUTH-I]], [[COTTONMOUTH-III]], [[FIREWALK]] and [[TAO]]
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[tao]] [[ant]] [[integrated circuit]] 
""Compartments"" : 
""Related items"" : [[MAESTRO II]] [[FIREWALK]] [[TAO]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== TROJANCLASSICXXI ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 33 / 200 pages)
""Category"" : program
""Alias"" : [[TROJAN CLASSIC XXI]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[BOUNDLESSINFORMANT]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== TROPICPUMA ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== TUBE ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] 
""Compartments"" : 
""Related items"" : [[EXOPUMP]] [[TURMOIL]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== TUMULT ===
""Short Description"" : associated with [[TURBULANCE]]. Somehow involved with [[QUANTUMTHEORY]]. Not precicely clear.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TURBULANCE]] [[QUANTUM]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TUNDRA ===
""Short Description"" : research of a new statistic for codebook analysis. Electronic codebooks, such as the Advanced Encryption Standard (AES), are both widely used and difficult to attack cryptanalytically. NSA has only a handful of in house techniques. The TUNDRA project investigated a potentially new technique - the Tau statistic - to determine its usefulness in codebook analysis.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== TUNGSTEN ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : [[POISONNUT]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== TUNINGFORK ===
""Short Description"" : spotted on [[DIETYBOUNCE]], [[IRATEMONK]], and SWAP diagrams A combination of a malicious BIOS modification and a malicious Hard Disk firmware modification (in the host protected area) used to maintain software based malware on the victim computer. Appears to work on a variety of systems running Windows, Linux, FreeBSD or Solaris. The file system may be FAT32, NTFS, EXT2, EXT3, or UFS 1.0.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[bios]] [[windows]] [[os]] [[linux]] [[freebsd]] [[solaris]] 
""Compartments"" : 
""Related items"" : [[SWAP]] [[DIETYBOUNCE]] [[IRATEMONK]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TURBINE ===
""Short Description"" : Deep Packet Injection, works with [[TURMOIL]]. System used for infecting computers. TURBINE provides centralized automated command/control of a large network of active implants
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TRAILBLAZER]] [[TURMOIL]] 
""Related items (Parents)"" : [[TURBULENCE]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://www.dailytech.com/Tax+and+Spy+How+the+NSA+Can+Hack+Any+American+Stores+Data+15+Years/article34010.htm|dailytech.com - Tax and Spy: How the NSA Can Hack Any American, Stores Data 15 Years]
* [http://www.wikileaks-forum.com/nsa/332/snowden-leak-nsa-qfire-16-slides/26507/|wikileaks-forum.com - Forward - based Defense with QFIRE]
* [http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security|The Guardian - nsa-gchq-encryption-codes-security]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog]
* [https://www.eff.org/document/20131230-spiegel-qfire|eff.org - Slides about QUANTUM, QFIRE and TURBULENCE]
=== TURBOPANDA ===
""Short Description"" : Cover term for joint CIA/NSA project to exploit Huawei network Huawei equipment
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[huawei]] 
""Compartments"" : 
""Related items"" : [[HALLUXWATER]] [[HEADWATER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TURBOPANDAInsertionTool ===
""Short Description"" : TURBOPANDA Insertion Tool (PIT) is a command and control system for exploited Huawei firewalls
""Category"" : program
""Alias"" : [[TIT]] [[TURBOPANDA Insertion Tool]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[huawei]] [[firewall]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TURBULENCE ===
""Short Description"" : TURBULENCE is a project started circa 2005. It was developed in small, inexpensive "test" pieces rather than one grand plan like its failed predecessor, the [[TRAILBLAZER]]. It also includes offensive cyber-warfare capabilities, like injecting malware into remote computers. The United States Congress criticized the project in 2007 for having similar bureaucratic problems as the [[TRAILBLAZER]] Project. TURBULENCE includes nine core programs, with intriguing names such as [[TURMOIL]], [[TUTELAGE]] and [[TRAFFICTHIEF]]
""Category"" : program
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[malware]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[TURMOIL]] [[TURBINE]] [[TUTELAGE]] [[TRAFFICTHIEF]] [[DROPOUTJEEP]] 
""Status"" : unknown
""Links"" : 
* [http://en.wikipedia.org/wiki/Turbulence_(NSA)|en.wikipedia.org - Turbulence (NSA)]
* [http://www.netrootsmass.net/2008/09/253-turbulence-an-nsadhs-intrusive-cyber-surveillance-program/|netrootsmass.net - Turbulence, an NSA/DHS intrusive cyber surveillance program]
* [http://cryptome.org/2012/08/nsa-turbulence.pdf|cryptome.org - NSA document released under FOIA]
* [http://articles.baltimoresun.com/2007-02-11/news/0702110034_1_turbulence-cyberspace-nsa/2|The Baltimore Sun - Costly NSA initiative has a shaky takeoff]
* [https://www.eff.org/document/20131230-spiegel-qfire|eff.org - Slides about QUANTUM, QFIRE and TURBULENCE]
=== TURMOIL ===
""Short Description"" : TURMOIL is involved in the process of decrypting communications by using Deep Packet Inspection ( DPI - Passive dragnet surveillance sensors). High-speed passive collection systems intercept foreign target satellite, microwave, and cable communications as they transit the globe.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[dpi]] 
""Compartments"" : 
""Related items"" : [[QFIRE]] [[MUSCULAR]] 
""Related items (Parents)"" : [[MUSCULAR]] [[TURBULENCE]] [[WEALTHYCLUSTER]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum.]
* [http://www.dailytech.com/Tax+and+Spy+How+the+NSA+Can+Hack+Any+American+Stores+Data+15+Years/article34010.htm|Dailtytech.com - Tax and Spy: How the NSA Can Hack Any American, Stores Data 15 Years]
* [http://www.wikileaks-forum.com/nsa/332/snowden-leak-nsa-qfire-16-slides/26507/|wikileaks-forum.com - Snowden Leak - NSA QFIRE 16 Slides]
* [http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security|The Guardian - nsa-gchq-encryption-codes-security]
* [https://www.eff.org/document/20131230-spiegel-qfire|eff.org - Slides about QUANTUM, QFIRE and TURBULENCE]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== TURTLEPOWER ===
""Short Description"" : Decryption of payloads, decompression and unrar files
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[vpn]] [[ipsec]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[POISONNUT]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== TUSKATTIRE ===
""Short Description"" : This is the NSA’s system for cleaning and processing call-related data (DNR or Dialed Number Recognition).
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[dnr]] 
""Compartments"" : 
""Related items"" : [[CERF]] [[POPTOP]] [[DRT]] [[SIGDASYS]] [[AST128]] [[JUGGERNAUT]] [[SEADIVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : [[CERF]] [[POPTOP]] [[DRT]] [[SIGDASYS]] [[AST128]] [[JUGGERNAUT]] [[SEADIVER]] 
""Status"" : unknown
""Links"" : 
* [https://leaksource.wordpress.com/2013/12/15/ghostmachine-nsas-cloud-analytics-platform/|LeakSource - GHOSTMACHINE: NSA Cloud Analytics Platform]
* [http://cryptome.org/2013/12/nsa-ghost-machine.pdf|cryptome.org - nsa ghost machine]
=== TUTELAGE ===
""Short Description"" : Part of the [[TURBULENCE]] program. NSA's own defense system against hacking.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[nids]] 
""Compartments"" : 
""Related items"" : [[TURBULENCE]] 
""Related items (Parents)"" : [[TURBULENCE]] 
""Related items (Children)"" : 
""Status"" : certainly active
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://www.eff.org/document/20131230-spiegel-qfire|eff.org - Slides about QUANTUM, QFIRE and TURBULENCE]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== TWDRYYARD ===
""Short Description"" : Relationship with [[TAWDRYYARD]] explained by Bruce Schneier on his blog.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[TAWDRYYARD]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2014/01/tawdryyard_nsa.html|schneier.com - tawdryyard_nsa.html|https://www.schneier.com/blog/archives/2014/01/tawdryyard_nsa.html|schneier.com - tawdryyard_nsa.html]
=== TWILIGHARROW ===
""Short Description"" : Remote GSM secure covert internet proxy using VPN services
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[gsm]] [[vpn]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== TWISTEDKILT ===
""Short Description"" : a hard drive firmware updating program used to install malicious firmware of a victim hard drive
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[malware]] [[hard drive]] 
""Compartments"" : 
""Related items"" : [[SWAP]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== TYPHONHX ===
""Short Description"" : TYPHON HX is a GSM base station router. Used to collect call logs from targeted phones. Administrated with a OMAP laptop via SMS, but is otherwise a standalone unit. There is no apparent ability to network these together, though other units, running the same software can do so (CYCLONE Hx9).
""Category"" : program
""Alias"" : [[TYPHON HX]] 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[phone]] [[sms]] 
""Compartments"" : [[S]] [[SI]] [[FVEY]] 
""Related items"" : [[CYCLONE Hx9]] [[CANDYGRAM]] [[DRTBOX]] [[NEBULA]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's codenames (.ods)]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== UAV ===
""Short Description"" : Unmanned aerial vehicle. A drone. The NSA is using complex analysis of electronic surveillance, rather than human intelligence, as the primary method to locate targets for lethal drone strikes – an unreliable tactic that results in the deaths of innocent or unidentified people. In one tactic, the NSA “geolocates” the SIM card or handset of a suspected terrorist’s mobile phone, enabling the CIA and U.S. military to conduct night raids and drone strikes to kill or capture the individual in possession of the device.
""Category"" : attack vector
""Alias"" : [[SkyRaper]] [[Predator]] [[Reaper]] 
""Family"" : hardware
""Agency"" : [[CIA]]
""Tags"" : [[uav]] [[geolocation]] [[drone]] [[phone]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [https://firstlook.org/theintercept/article/2014/02/10/the-nsas-secret-role/|theintercept.org - The NSA’s Secret Role in the U.S. Assassination Program]
=== UNDERPASS ===
""Short Description"" : Change outcome of online polls (previously known as [[NUBILO]])
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[NUBILO]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== UNITEDRAKE ===
""Short Description"" : A program similar to [[STRAITBIZARRE]], used for uploading malicious HDD firmware, works with [[SLICKERVICAR]]. Known components include a GUI, a database, and a server, and a manned listening post. It includes a trojan of the same name. Digital Network Technologies (DNT), a private company, actively maintains the listening posts for [[UNITEDRAKE]], as well as design and deploy malware.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[trojan]] [[firmware]] 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[FERRETCANNON]] [[FOXACID]] 
""Related items (Parents)"" : [[FERRETCANNON]] 
""Related items (Children)"" : [[CAPTIVATEDAUDIENCE]] 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2013/10/the_nsas_new_ri.html|Schneier.com - The NSA's New Risk Analysis]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== UPSTREAM ===
""Short Description"" : The UPSTREAM program is a telecommunication interception facility operated by [[AT&T]] for the NSA that commenced operations in 2003 and was exposed in 2006. Room 641A is located in the SBC Communications building at 611 Folsom Street, San Francisco, three floors of which were occupied by AT&T before SBC purchased AT&T. The room was referred to in internal AT&T documents as the SG3 [Study Group 3] Secure Room. It is fed by fiber optic lines from beam splitters installed in fiber optic trunks carrying Internet backbone traffic and, as analyzed by J. Scott Marcus, a former CTO for GTE and a former adviser to the FCC, has access to all Internet traffic that passes through the building, and therefore "the capability to enable surveillance and analysis of internet content on a massive scale, including both overseas and purely domestic traffic." Former director of the NSA's World Geopolitical and Military Analysis Reporting Group, William Binney, has estimated that 10 to 20 such facilities have been installed throughout the United States. [[TEMPORA]] is the [[GCHQ]]'s UPSTREAM.
""Category"" : program
""Alias"" : [[Room 641A]] 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[NSA]] [[OSCAR]] 
""Related items (Children)"" : [[FAIRVIEW]] [[BLARNEY]] [[STORMBREW]] [[OAKSTAR]] [[PRISM]] [[XKEYSCORE]] 
""Status"" : unknown
""Links"" : 
* [http://www.wired.com/science/discoveries/news/2006/05/70908|Wired.com - AT&T Whistle-Blower's Evidence]
* [http://en.wikipedia.org/wiki/UPSTREAM|en.wikipedia.org - Room 641A]
* [http://electrospaces.blogspot.fr/2014/01/slides-about-nsas-upstream-collection.html| electrospaces.blogspot.fr]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf|Documents from the Glenn Greenwald's book "No Place to Hide"]
=== VAGRANT ===
""Short Description"" : collection of computer Screens. The monitor cables are rigged with an RF retro reflector, ([[RAGEMASTER]]). [[VAGRANT]] collection therefor requires a continuous RF generator such as [[CTX4000]] or [[PHOTOANGLO]], and a system to process and display the returned video signal such as [[NIGHTWATCH]], [[GOTHAM]], [[LS-2]] (with an external monitor), or [[VIEWPLATE]]. Known to be deployed in the field , as of September 2010 at the following embassies: Brazil's UN Mission in NY ([[POKOMOKE]]), France's UN Mission in NY ([[BLACKFOOT]]), India's Embassy and annex in DC, and India's UN Mission in New York. India's embassies were slated to be detasked, at the time of the document. Context of documents seems to suggest, but does not definitively prove that the coverterm VAGRANT only applies to the signal itself.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[rf]] [[brazil]] [[france]] [[india]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[BLACKFOOT]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
* [https://www.schneier.com/blog/archives/2013/10/code_names_for.html|schneier.com - Code Names for NSA Exploit Tools]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== VALIANTEAGLE ===
""Short Description"" : VALIANTEAGLE is a major system acquisition that will incrementally provide more efficient planning, management, and execution of CNO to support growing and diverse Computer Network Exploitation (CNE), Computer Network Defense (CND) and CNA (Computer Network Attack) mission requirements.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[REL TO USA]] [[FVEY]] 
""Related items"" : [[GENIE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.spiegel.de/international/world/new-snowden-docs-indicate-scope-of-nsa-preparations-for-cyber-battle-a-1013409-2.html| The Digital Arms Race: NSA Preps America for Future Battle]
=== VALIANTSURF ===
""Short Description"" : General term for the development of Data Network Cipher (DNC) exploitation capabilities in [[TURMOIL]] for integration into the [[TURBULENCE]] DNC thread. VALIANTSURF is the preferred reference for all TURBULENCE DNC exploitation capaibilites.
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] [[ipsec]] [[ptpp]] 
""Compartments"" : [[TOP SECRET]] [[SI]] [[ORCON]] [[REL TO USA]] [[FVEY]] 
""Related items"" : [[XKEYSCORE]] [[FALLOUT]] [[LONGHAUL]] [[GALANTWAVE]] 
""Related items (Parents)"" : [[TURMOIL]] [[TURBULENCE]] 
""Related items (Children)"" : [[TUBE]] [[MALIBU]] [[WAIMEA]] 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== VALIDATOR ===
""Short Description"" : A software based malware item designed to run on certain Juniper routers (J, M, and T Series) running the JUNOS operating system. It must be maintained by means of a malicious BIOS modification. A typical use case involves the exfiltration of data from the victimized system. A separate document describes VALIDATOR as a backdoor used against Windows systems (win 98-2003). In this instance, it will identify the system, and if it is truly a target, invite a more sophisticated trojan in, such as [[UNITEDRAKE]] or [[OLYMPUS]]. This trojan has been used to de-anonymize tor users. A third version of VALIDATOR works for Apple iOS devices. The [[QUANTUMNATION]] states that the success rate against iOS devices is 100%.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] [[bios]] [[windows]] [[os]] [[apple]] 
""Compartments"" : 
""Related items"" : [[FOXACID]] [[SCHOOLMONTANA]] [[SIERRAMONTANA]] [[STUCCOMONTANA]] [[SOMBERKNAVE]] [[OLYMPUS]] [[UNITEDRAKE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2] The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.spiegel.de/fotostrecke/nsa-dokumente-so-knackt-der-geheimdienst-internetkonten-fotostrecke-105326-13.html|Spiegel.de - NSA-Dokumente: So knackt der Geheimdienst Internetkonten]
=== VICTORYDANCE ===
""Short Description"" : The VICTORYDANCE mission was a joint interagency effort between CIA and NSA. The mission lasted 6 months (during which 43 flights were flown) and mapped the Wi-Fi fingerprint of nearly every major town in Yemen
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]] [[CIA]]
""Tags"" : [[wifi]] [[yemen]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : inactive
""Links"" : 
* [https://www.aclu.org/sites/default/files/assets/intercept-drones.pdf|Intercept drones]
=== VIEWER ===
""Short Description"" : A programme that (hopefully) provides advance tip off of the kidnappers IP address for HMG personnel.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== VIEWPLATE ===
""Short Description"" : Replacement for the [[NIGHTWATCH]] system. If it's the same, it's a specialized system for processing, reconstructing and displaying video signals collected by [[VAGRANT]]. And returned to a [[CTX4000]] or a [[PHOTOANGLO]] system
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[NIGHTWATCH]] [[PHOTOANGLO]] 
""Related items (Parents)"" : [[ANGRYNEIGHBOR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA's codenames (.ods)]
* [https://www.schneier.com/blog/archives/2014/01/nightwatch_nsa.html|schneier.com - NSA Exploit of the Day]
* [http://leaksource.files.wordpress.com/2013/12/nsa-ant-nightwatch.jpg|leaksource.wordpress.com - TAO Catalog Page with Graphics]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== VIKINGPILLAGE ===
""Short Description"" : Distributed network for the automatic collection of encrypted/compressed data from remotely hosted [[JTRIG]] projects
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== VIPERSTONGUE ===
""Short Description"" : is a tool that will silently Denial of Service on a Satellite Phone or a GSM Phone.
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[gsm]] [[phone]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== VULCANDEATHGRIP ===
""Short Description"" : repository for tasked, full-take VPN collection (IPsec)
""Category"" : program
""Alias"" : [[VDG]] 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[vpn]] [[ipsec]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[MAILORDER]] [[SCISSORS]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== VULCANMINDMELD ===
""Short Description"" : repository for tasked, full-take VPN collection (SSL)
""Category"" : program
""Alias"" : [[VDG]] 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[vpn]] [[ssl]] [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[MAILORDER]] [[SCISSORS]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== WABASH ===
""Short Description"" : coverterm givent to the bugging of French embassy in Washington DC
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[france]] 
""Compartments"" : [[TOP SECRET]] 
""Related items"" : [[HIGHLANDS]] [[PBX]] [[GENIE]] [[DROMIRE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://www.theguardian.com/world/2013/jun/30/nsa-leaks-us-bugging-european-allies|The Guardian]
* [www.lemonde.fr/international/article/2013/10/22/la-diplomatie-francaise-sur-ecoute-aux-etats-unis_3500717_3210.html|LeMonde.fr - La diplomatie francaise sur écoute aux etats-unis]
* [https://www.documentcloud.org/documents/807030-ambassade.html#document/p1|docs by lemonde.fr]
=== WAGONBED ===
""Short Description"" : a malicious hardware device that provides covert 2-way RF communications on the I2C channel of HP Proliant 380DL G5 servers. [[WAGONBED]] 2 can be mated with a Motorola G20 GSM module to form [[CROSSBEAM]].
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] 
""Compartments"" : 
""Related items"" : [[CROSSBEAM]] [[IRONCHEF]] [[FLUXBABBIT]] [[GODSURGE]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== WARPATH ===
""Short Description"" : Mass delivery of SMS messages to support an information operation campaign
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] [[gsm]] [[phone]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== WATCHTOWER ===
""Short Description"" : [[GCNET]] -> [[CERBERUS]] export gateway interface system
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] [[CERBERUS]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== WATERWITCH ===
""Short Description"" : Low-power handheld device geolocating target handsets, used in conjunction with [[TYPHON]] or similar systems to provide more precise location information.
""Category"" : program
""Alias"" : 
""Family"" : target
""Agency"" : [[NSA]]
""Tags"" : [[gsm]] [[geolocation]] [[tao]] [[ant]] 
""Compartments"" : [[S]] [[SI]] 
""Related items"" : [[TYPHON]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html| cryptome.org - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [http://cryptome.org/2013/12/nsa-catalog-appelbaum.pdf|cryptome.org - NSA's catalog (.pdf)]
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.digitaltrends.com/web/nsa-malware-code-names/#/6||TURBOPANDA, RAGEMASTER, and 13 other NSA codenames that prove spies laugh, too]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== WAXTITAN ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) pages : 29 and 33. United Kingdom and USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WEALTHYCLUSTER ===
""Short Description"" : Quote from page 90 of the "NSA Spiegel document leak on June 2014" : "NSA analysts discussed NSA's "hunt versus gather" philosophy, our multi-stage selection and filtering process, and the evolution of DNI targeting systems from GRANDMASTER to WEALTHYCLUSTER, and in the future, TURMOIL. BND appeared especially interested in the TURMOIL approach of scanning and making judgments at the packet level prior to sessioning."
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dni]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[TURMOIL]] [[GRANDMASTER]] 
""Status"" : unknown
""Links"" : 
* [http://articles.baltimoresun.com/2007-02-11/news/0702110034_1_turbulence-cyberspace-nsa/2|Costly NSA initiative has a shaky takeoff Baltimore Sun article]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WEBCANDID ===
""Short Description"" : 
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
=== WESTPORT ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[venezuela]] 
""Compartments"" : 
""Related items"" : [[LIFESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== WHISTLINGDIXIE ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) page: 33. USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WHITETAMALE ===
""Short Description"" : Operation against the Mexican Public Security Secretariat
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[mexico]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
=== WHIZBANG ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 66 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : process
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WILDCHOCOBO ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WILDCOUGAR ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 29 / 200 pages)
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : [[BOUNDLESSINFORMANT]] 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WILLOWVIXEN ===
""Short Description"" : 
""Category"" : attack vector
""Alias"" : 
""Family"" : network
""Agency"" : [[NSA]]
""Tags"" : [[email]] [[backdoor]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://firstlook.org/theintercept/article/2014/03/12/nsa-plans-infect-millions-computers-malware/ | How the NSA Plans to Infect ‘Millions’ of Computers with Malware - theguardian.com]
=== WINDFARM ===
""Short Description"" : R&D offsite facility
""Category"" : compartment
""Alias"" : 
""Family"" : process
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : unknow
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== WINDSTOP ===
""Short Description"" : collect of data, like [[dni]] and [[dnr]], most volume by [[DS-300]] ([[INCENSER]]) and [[DS-200B]] ([[MUSCULAR]])
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[dnr]] [[dni]] 
""Compartments"" : [[SECRET]] [[SI]] [[REL TO USA]] [[REL TO UK]] 
""Related items"" : [[XKEYSCORE]] [[TURMOIL]] [[WEALTHYCLUSTER]] 
""Related items (Parents)"" : [[MUSCULAR]] 
""Related items (Children)"" : [[INCENSER]] [[MUSCULAR]] 
""Status"" : active
""Links"" : 
* [https://en.wikipedia.org/wiki/MUSCULAR| en.wikipedia.org -MUSCULAR ]
* [http://cryptome.org/2013/12/nsa-windstop.pdf|Cryptome.org - WINDSTOP]
=== WINTERLIGHT ===
""Short Description"" : designated as a Quantum operations, joint task between USA and Sweden (FRA).
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[usa]] [[sweden]] 
""Compartments"" : 
""Related items"" : [[QUANTUM]] [[XKEYSCORE]] [[TAO]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2013/12/nsa-se-fra-xkeyscore.pdf|USA - Sweden about Intelligences]
* [http://www.svt.se/ug/fra-part-of-top-secret-hacker-project|svt.se - FRA part of top-secret hacker project]
=== WIRDWATCHER ===
""Short Description"" : spotted on the Spiegel documents (2014 - 06 - 18 / 200 pages) pages : 29 and 33. United Kingdom and USA
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
=== WISTFULTOLL ===
""Short Description"" : A plugin for [[UNITEDRAKE]] and [[STRAITBIZARRE]] that extracts WMI and registry information from the victim machine. Also available as a stand-alone executable. Can be installed either remotely, or by USB thumb drive. In the latter case, exfiltrated data will be stored on that same thumb drive. Works on Windows 2000, XP, and 2003.
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[usb]] [[windows]] [[os]] [[tao]] [[ant]] 
""Compartments"" : 
""Related items"" : [[IRATEMONK]] [[STRAITBIZARRE]] [[SEAGULLFARO]] [[UNITEDRAKE]] [[RETURNSPRING]] 
""Related items (Parents)"" : [[TAO]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://www.theregister.co.uk/2013/12/31/nsa_weapons_catalogue_promises_pwnage_at_the_speed_of_light/?page=2|TheRegister - How the NSA hacks PCs, phones, routers, hard disks 'at speed of light': Spy tech catalog leaks]
* [https://www.schneier.com/blog/archives/2014/02/wistfultoll_nsa.html|WISTFULTOLL: NSA Exploit of the Day]
* [http://nsa.gov1.info/dni/nsa-ant-catalog|nsa.gov1.info/dni/nsa-ant-catalog]
=== WOLFPOINT ===
""Short Description"" : A [[SIGAD]] known as [[STORMBREW]], for example, relies on two unnamed corporate partners described only as [[ARTIFICE]] and [[WOLFPOINT]]. According to an NSA site inventory, the companies administer the NSA’s “physical systems,” or interception equipment, and “NSA asks nicely for tasking/updates.”
""Category"" : compartment
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : [[ARTIFICE]] [[STORMBREW]] 
""Related items (Parents)"" : [[STORMBREW]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html|Washingtonpost.com - NSA tracking cellphone locations worldwide, Snowden documents show]
=== WOLVERINESTAKE ===
""Short Description"" : release of [[LONGHAULL]]  spotted on some document leaked in december 2014 by the Spiegel. The documents are about breaking crypto (vpn, ssl/tls, ...).
""Category"" : program
""Alias"" : 
""Family"" : database
""Agency"" : [[NSA]]
""Tags"" : [[31c3]] 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : [[LONGHAUL]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|Der Spiegel - Attacks on VPN, SSL, TLS, SSH, Tor]
=== WORDGOPHER ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== WRANGLER ===
""Short Description"" : Electronic intelligence intercept raw database
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : 
""Related items"" : 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://www.theatlantic.com/technology/archive/2013/08/an-educated-guess-about-how-the-nsa-is-structured/278697/|theatlantic.com - An Educated Guess About How the NSA Is Structured]
=== WURLITZER ===
""Short Description"" : Distribute a file to multiple file hosting websites
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[GCHQ]]
""Tags"" : [[jtrig]] 
""Compartments"" : 
""Related items"" : [[JTRIG]] 
""Related items (Parents)"" : [[JTRIG]] 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [https://firstlook.org/theintercept/2014/07/14/manipulating-online-polls-ways-british-spies-seek-control-internet/|Hacking Online Polls and Other Ways British Spies Seek to Control the Internet]
=== XKEYSCORE ===
""Short Description"" : XKEYSCORE is a formerly secret computer system used by the NSA for searching and analyzing Internet data about foreign nationals across the world. The program is run jointly with other agencies including Australia's [[DSD]], and New Zealand's [[GCSB]]. XKEYSCORE is an NSA data-retrieval system which consists of a series of user interfaces, backend databases, servers and software that selects certain types of metadata that the NSA has already collected using other methods. see all traffic from a given IP address to a specific website. A part of the source code was leaked on June 2014. Now, we know that XKEYSCORE can spy on Tor and Tails users. The program class then these users as "extremists".
""Category"" : program
""Alias"" : [[XKS]] 
""Family"" : process
""Agency"" : [[NSA]] [[GCHQ]]
""Tags"" : [[protocols]] [[vpn]] [[phone]] [[gsm]] 
""Compartments"" : [[TOP SECRET]] [[COMINT]] [[REL TO USA]] [[FVEY]] [[REL TO AUS]] [[REL TO CAN]] [[REL TO GBR]] [[REL TO NZL]] 
""Related items"" : [[TAO]] [[FORNSAT]] [[SSO]] [[F6]] [[FISA]] 
""Related items (Parents)"" : [[UPSTREAM]] [[PRISM]] [[MARINA]] 
""Related items (Children)"" : [[THIEVINGMAGPIE]] [[ROYALCONCIERGE]] 
""Status"" : unknown
""Links"" : 
* [https://www.schneier.com/blog/archives/2013/08/xkeyscore.html|schneier.com - XKeyscore]
* [http://en.wikipedia.org/wiki/XKeyscore|en.wikipedia.org - XKeyscore]
* [http://www.nsa.gov/public_info/press_room/2013/30_July_2013.shtml|nsa.gov -Press Statement on 30 July 2013 from the NSA]
* [http://www.washingtonpost.com/world/national-security/governments-secret-order-to-verizon-to-be-unveiled-at-senate-hearing/2013/07/31/233fdd3a-f9cf-11e2-a369-d1954abcb7e3_story.htmlWashingtonpost.com - | washingtonpost.com -Phone Records Program Released]
* [http://theweek.com/article/index/247684/whats-xkeyscore|theweek.com - What's XKEYSCORE?]
* [http://www.guardian.co.uk/world/2013/jun/27/nsa-online-metadata-collection|guardian.co.uk - NSA online - metadata collection]
* [http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-program-full-presentation|The Guardian - nsa-xkeyscore-program-full-presentation]
* [http://arstechnica.com/tech-policy/2013/08/nsas-internet-taps-can-find-systems-to-hack-track-vpns-and-word-docs/|arstechnica.com - NSA's Internet Taps Can Find Systems to Hack, Track VPNs and Word Docs]
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
* [http://cryptome.org/2014/06/nsa-spiegel-snowden-14-0618.pdf|cryptome.org NSA spiegel snowden documents leak on June the 18th 2014]
* [http://daserste.ndr.de/panorama/xkeyscorerules100.txt|ndr.de Leaked source code about Tor users]
=== YACHTSHOP ===
""Short Description"" : Subprogram of [[OAKSTAR]] targeting Worldwide DNI Metadata, Access through [[BLUEANCHOR]] partner, contributor to [[MARINA]].
""Category"" : program
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[dni]] 
""Compartments"" : 
""Related items"" : [[OAKSTAR]] [[MARINA]] [[UPSTREAM]] 
""Related items (Parents)"" : [[OAKSTAR]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [https://en.wikipedia.org/wiki/OAKSTAR| en.wikipedia.org - OAKSTAR]
=== YELLOWPIN ===
""Short Description"" : a particular device that includes a [[HOWLERMONKEY]] component
""Category"" : attack vector
""Alias"" : 
""Family"" : hardware
""Agency"" : [[NSA]]
""Tags"" : 
""Compartments"" : [[FVEY]] [[REL TO USA]] [[COMINT]] 
""Related items"" : [[HOWLERMONKEY]] 
""Related items (Parents)"" : [[HOWLERMONKEY]] 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]
* [http://media.ccc.de/browse/congress/2013/30C3_-_5713_-_en_-_saal_2_-_201312301130_-_to_protect_and_infect_part_2_-_jacob.html|media.ccc.de - To Protect And Infect Part 2 The militarization of the Internet by Jacob Appelbaum.]
* [https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_ant_catalog.pdf |eff.org - Appelbaum NSA ANT Catalog]
=== YUKON ===
""Short Description"" : spotted on the Glenn Greenwald's No Place To Hide document.
""Category"" : mission
""Alias"" : 
""Family"" : collect
""Agency"" : [[NSA]]
""Tags"" : [[venezuela]] 
""Compartments"" : 
""Related items"" : [[LIFESAVER]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : active
""Links"" : 
* [http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPlaceToHide-Documents-Uncompressed.pdf| No place to hide, by Glenn Greenwald]
=== ZESTYLEAK ===
""Short Description"" : a software exploit made by CES for Juniper Netscreen ns5xt, ns50, ns200, ns500, ISG 1000 firewalls
""Category"" : attack vector
""Alias"" : 
""Family"" : software
""Agency"" : [[NSA]]
""Tags"" : [[router]] [[juniper]] 
""Compartments"" : 
""Related items"" : [[FEEDTROUGH]] 
""Related items (Parents)"" : 
""Related items (Children)"" : 
""Status"" : unknown
""Links"" : 
* [http://cryptome.org/2014/01/nsa-codenames.htm|cryptome.org - NSA codenames]