XKeyscore

Workings

According to an NSA slide presentation about XKeyscore from 2013, it is a "DNI Exploitation System/Analytic Framework". DNI stands for Digital Network Intelligence, which means intelligence derived from internet traffic.

Edward Snowden said about XKeyscore: "It's a front end search engine" in an interview with the German Norddeutscher Rundfunk.

XKeyscore is a "piece of Linux software that is typically deployed on Red Hat servers. It uses the Apache web server and stores collected data in MySQL databases".

XKeyscore is considered a "passive" program, in that it listens, but does not transmit anything on the networks that it targets. But it can trigger other systems, which perform "active" attacks through Tailored Access Operations which are "tipping", for example, the QUANTUM family of programs, including QUANTUMINSERT, QUANTUMHAND, QUANTUMTHEORY, QUANTUMBOT and QUANTUMCOPPER and Turbulence. These run at so-called "defensive sites" including the Ramstein Air Force base in Germany, Yokota Air Base in Japan, and numerous military and non-military locations within the US. Trafficthief, a core program of Turbulence, can alert NSA analysts when their targets communicate, and trigger other software programs, so select data is "promoted" from the local XKeyscore data store to the NSA's "corporate repositories" for long-term storage.

Data sources

XKeyscore consists of over 700 servers at approximately 150 sites where the NSA collects data, like "US and allied military and other facilities as well as US embassies and consulates" in many countries around the world. Among the facilities involved in the program are four bases in Australia and one in New Zealand.

According to an NSA presentation from 2008, these XKeyscore servers are fed with data from the following collection systems:

1. F6 (Special Collection Service) – joint operation of the CIA and NSA that carries out clandestine operations, including espionage on foreign diplomats and leaders
2. FORNSAT – which stands for "foreign satellite collection", and refers to intercepts from satellites
3. SSO (Special Source Operations) – a division of the NSA that cooperates with telecommunication providers

In a single, undated slide published by Swedish media in December 2013, the following additional data sources for XKeyscore are mentioned:

1. Overhead – intelligence derived from American spy planes, drones, and satellites
2. Tailored Access Operations – a division of the NSA that deals with hacking and cyberwarfare
3. FISA – all types of surveillance approved by the Foreign Intelligence Surveillance Court
4. Third party – foreign partners of the NSA such as the (signals) intelligence agencies of Belgium, Denmark, France, Germany, Italy, Japan, the Netherlands, Norway, Sweden, etc. However the Netherlands is out of any cooperation concerning intelligence gathering and sharing for illegal spying.

From these sources, XKeyscore stores "full-take data", which is scanned by plug-ins that extract certain types of metadata (like phone numbers, e-mail addresses, log-ins, and user activity) and indexes them in metadata tables, which can be queried by analysts. XKeyscore has been integrated with MARINA, which is NSA's database for internet metadata.

However, the system continuously gets so much Internet data that it can be stored only for short periods of time. Content data remains on the system for only three to five days, while metadata is stored for up to thirty days. A detailed commentary on an NSA presentation published in The Guardian in July 2013 cites a document published in 2008 declaring that "At some sites, the amount of data we receive per day (20+ terabytes) can only be stored for as little as 24 hours."

Types of XKeyscore

According to a document from an internal GCHQ website which was disclosed by the German magazine Der Spiegel in June 2014, there are three different types of the XKeyscore system:

• Traditional: The initial version of XKeyscore is fed with data from low-rate data signals, after being processed by the WEALTHYCLUSTER system. This traditional version is not only used by NSA but also at many intercept sites of GCHQ.
• Stage 2: This version of XKeyscore is used for higher data rates. The data is first processed by the TURMOIL system, which sends 5% of the internet data packets to XKeyscore. GCHQ only uses this version for collection under the MUSCULAR program.
• Deep Dive: This latest version can process internet traffic at data rates of 10 gigabits per second. Data that could be useful for intelligence purposes is then selected and forwarded by using the "GENESIS selection language". GCHQ also operates a number of Deep Dive versions of XKeyscore at three locations under the codename TEMPORA.

Capabilities

For analysts, XKeyscore provides a "series of viewers for common data types", which allows them to query terabytes of raw data gathered at the aforementioned collection sites. This enables them to find targets that cannot be found by searching only the metadata, and also to do this against data sets that otherwise would have been dropped by the front-end data processing systems. According to a slide from an XKeyscore presentation, NSA collection sites select and forward less than 5% of the internet traffic to the PINWALE database for internet content.

Because XKeyscore holds raw and unselected communications traffic, analysts can not only perform queries using "strong selectors" like e-mail addresses, but also using "soft selectors", like keywords, against the body texts of e-mail and chat messages and digital documents and spreadsheets in English, Arabic and Chinese.

This is useful because "a large amount of time spent on the web is performing actions that are anonymous" and therefore those activities can't be found by just looking for e-mail addresses of a target. When content has been found, the analyst might be able to find new intelligence or a strong selector, which can then be used for starting a traditional search.

Besides using soft selectors, analysts can also use the following other XKeyscore capabilities:

• Look for the usage of Google Maps and terms entered into a search engine by known targets looking for suspicious things or places.
• Look for "anomalies" without any specific person attached, like detecting the nationality of foreigners by analyzing the language used within intercepted emails. An example would be a German speaker in Pakistan. The Brazilian paper O Globo claims that this has been applied to Latin America and specifically to Colombia, Ecuador, Mexico and Venezuela.
• Detect people who use encryption by doing searches like "all PGP usage in Iran". The caveat given is that very broad queries can result in too much data to transmit back to the analyst.
• Showing the usage of virtual private networks (VPNs) and machines that can potentially be hacked via TAO.
• Track the source and authorship of a document that has passed through many hands.
• On July 3, 2014 ARD revealed that XKeyscore is used to closely monitor users of the Tor anonymity network, people who search for privacy-enhancing software on the web, and readers of Linux Journal.

The Guardian revealed in 2013 that most of these things cannot be detected by other NSA tools, because they operate with strong selectors (like e-mail and IP addresses and phone numbers) and the raw data volumes are too high to be forwarded to other NSA databases.

In 2008, NSA planned to add a number of new capabilities in the future, including access to VoIP and other, unspecified network protocols and additional forms of metadata such as Exif tags, which often include geolocation (GPS) data.

Contribution to U.S. security

The NSA slides published in The Guardian during 2013 claimed that XKeyscore had played a role in capturing 300 terrorists by 2008, which could not be substantiated as the redacted documents do not cite instances of terrorist interventions.

A 2011 report from the NSA unit in the Dagger Complex (close to Griesheim in Germany) said that XKeyscore made it easier and more efficient to target surveillance. Previously, analysts often accessed data NSA was not interested in. XKeyscore allowed them to focus on the intended topics, while ignoring unrelated data. XKeyscore also proved to be outstanding for tracking active groups associated with the Anonymous movement in Germany, because it allows for searching on patterns, rather than particular individuals. An analyst is able to determine when targets research new topics or develop new behaviors.

To create additional motivation, the NSA incorporated various gamification features. For instance, analysts who were especially good at using XKeyscore could acquire "skilz" points and "unlock achievements." The training units in Griesheim were apparently successful, and analysts there had achieved the "highest average of skilz points" compared with all other NSA departments participating in the training program.

Usage by foreign partners of the NSA

Germany

According to documents Der Spiegel acquired from Snowden, the German intelligence agencies BND (foreign intelligence) and BfV (domestic intelligence) were also allowed to use the XKeyscore system. In those documents, the BND agency was described as the NSA's most prolific partner in information gathering. This led to political confrontations, after which the directors of the German intelligence agencies briefed members of the German parliamentary intelligence oversight committee on July 25, 2013. They declared that XKeyscore has been used by the BND since 2007 and that the BfV has been using a test version since 2012. The directors also explained that the program is not for collecting data, but rather only for the analysis of collected data.

Sweden

As part of the UKUSA Agreement, a secret treaty was signed in 1954 by Sweden with the United States, the United Kingdom, Canada, Australia and New Zealand (called the Five Eyes) for the purpose of intelligence collaboration and data sharing. According to documents leaked by Snowden, the National Defence Radio Establishment (FRA) has been granted access to XKeyscore.

Denmark

In an ongoing scandal, XKeyscore was part of the main package and the reason a new datacenter was needed, built in Sandager. In the 2020s, due to anti-American sentiment causing whistleblowers in the layers of Danish defense, the truth came out about the real usage in Danish state media. NSA gave FE access to their suite of spying software from NSA, in favor of spying on American allies such as Germany's Angela Merkel and Boris Johnson amongst a few in newer times. This deal has been ongoing since the visit to Copenhagen by President Bill Clinton in 1997, facilitated by then Danish Prime minister, Poul Nyrup Rasmussen.

According to whistleblowers from the Danish secret police, and judicial evidence later presented in Danish court, the US has been and still is carrying out a massive spying operation on the western countries in Europe, with Denmark's help.

The whistleblower itself was later leaked to be then-head of the Danish Intelligence Service, Lars Findsen. Additionally he leaked in court and through evidence presented in court, that there is an ongoing mass-surveillance program by NSA, not just on the American people themselves, but also of the world, facilitated through multiple American "private" companies such as IBM and Google. Additionally, making use of high tech tools such as AI packet sniffing, aggressive red hatting, and other IT methods.

Japan

The classified documents leaked by Snowden also indicate that in April 2013, NSA had secretly provided the XKeyscore system to the DFS of Defense Intelligence Headquarters.