Infiltration

There is ample evidence that the British State spies on Muslims under the excuse of countering terrorism. But has this covert infiltration been a success in winning the war on terror? Or has it made the general public lose its confidence in the British police and MI5 for gratuitously targeting the whole Muslim community rather than the extremist groups? 

In 2007 when the UK troops were bogged down in the quagmire of Iraq and Afghanistan, the government put into place the counter-terrorism strategy called Preventing Violent Extremism - Prevent in short. 

In 2010, the strategy gained momentum to aggressively confront Islamist ideology. This allowed the State to freely go around, intercept, investigate or scrutinize anybody they wish based on the fine grain of intelligence that they may pose a likely threat to the State national security. 

This way in today’s UK, the innocent people who have had no involvement in terrorism fall victim to intrusive surveillance, deportation or incarceration without charge or trial.

Cops Are An Occupying Army and We Are The Enemy

The war on terror has essentially turned police into occupying armies in some American communities of color.

“I remember it being drilled into me as a police officer, as a sergeant and then as a lieutenant: partnership, problem-solving, and prevention – the three Ps,” 

“In the early 2000s, particularly after 9/11, we saw a paradigm shift from community policing and problem-oriented principles to the war on terror, and we became Homeland Security police.”

This shift toward “homeland security” had quickly destroyed the relationships police had worked nearly two decades to build.

“I think what has happened as a direct result of that, is that those relationships that we forged, and worked so hard to attain and to maintain in the late 1980s and early 1990s, began to erode because the police were seen, particularly in communities of color, as an army of occupation.”

“If you dress police officers up as soldiers and you put them in military vehicles and you give them military weapons, they adopt a warrior mentality.” 

“We fight wars against enemies, and the enemies are the people who live in our cities – particularly in communities of color.”

“We weren’t included in the discussion, we didn’t know anything about it, and I think Ferguson has brought that into the glare of the public spotlight.”

“I see the police conducting themselves in a highly militaristic fashion on routine patrol activities — and I know that’s what they’re doing because I come from that world.” 

“What I experience and what people on the street experience is a palpable, tangible sense of fear, and that is that we are unsafe if police need semiautomatic rifles to protect us and to keep us safe.”

“What we saw in that aftermath was the unilateral suspension of the United States Constitution, and particularly the Fourth Amendment.”

“We saw for the first time that I can recall in the United States of America house-to-house searches.”

“and what I said to some colleagues of mine, who work in the news media, that when we fail to object to what’s going on now, and we did, we forfeited our right to do so in the future — and we have.”

Free People Claim Their Rights

Your rights are yours by the very nature of your birth. You have them whether a document or a government says so or not. And while governments at every level will always work to limit or destroy your rights, it’s up to you – and others – to defend them.

How to do that? Thomas Jefferson had what I believe to be the most important advice on this front:

“A free people claim their rights, as derived from the laws of nature, and not as the gift of their chief magistrate.”

Spy Copters, Lasers, and Break-In Teams

Between 2006 and 2009, surveillance helicopters conducted daily flights over northwest Washington, D.C., taking high-resolution photographs of the new Chinese Embassy being constructed on Van Ness Street. The aircraft belonged to the Federal Bureau of Investigation, which wanted to determine where the embassy's communications center was being located. But the Chinese construction crews hid their work on this part of the building by pulling tarpaulins over the site as it was being constructed.

The FBI also monitored the movements and activities of the Chinese construction workers building the embassy, who were staying at a Days Inn on Connecticut Avenue just north of the construction site, in the hopes of possibly recruiting one or two of them. According to one Chinese diplomat, his fellow officials detected individuals who they assumed to be FBI agents covertly monitoring the construction materials and equipment being used to build the embassy, which were stored on the University of the District of Columbia's soccer field across the street from where the Chinese Embassy currently stands. The diplomat added that Chinese security officials assumed that the FBI agents were trying to determine whether it was possible to plant eavesdropping devices inside the construction materials stored at the site.

In recent weeks, the U.S. National Security Agency's efforts to monitor foreign diplomats have become the stuff of worldwide headlines. But the FBI has been in the business of spying on diplomats and breaking their codes for far longer than the NSA has. The surveillance of the Chinese Embassy was just one piece of a far larger espionage operation. The FBI not only endeavors to steal or covertly compromise foreign government, military, and commercial computer, telecommunications, and encryption systems being used in the United States, but the FBI and NSA work closely to intercept the communications of all diplomatic missions and international organizations located on American soil. In some important respects, the FBI's cryptologic work is more secretive than that being performed by the NSA because of the immense diplomatic sensitivity of these operations if they were to ever be exposed publicly.

The Bureau of Investigation, the predecessor to today's FBI, has been monitoring diplomatic communications since at least 1910, when it periodically solved Mexican government and revolutionary group cable traffic coming in and out of the United States. And for over a century, the FBI and its predecessors have been aggressive practitioners of the age-old art of stealing codes and ciphers. In June 1916, Bureau of Investigations agents surreptitiously obtained a copy of the new Mexican consular code by picking the pockets of a Mexican diplomatic courier while he cavorted with "fast women" in one of the innumerable border fleshpots along the Rio Grande.

Little has changed in the intervening century. Despite the creation of the NSA in 1952 to centralize in one agency all U.S. government signals intelligence (SIGINT) collection and processing work, the FBI, which did not respond to requests for comment for this story, has never ceased its own independent cryptologic efforts, especially when those efforts have been aim at diplomats on American soil.

***

The number of foreign government targets that the FBI monitors inside the United States is huge and growing. State Department records show that 176 countries maintain embassies in Washington, not including Cuba and Iran, which the U.S. government does not have diplomatic relations with but which maintain interest sections inside the Swiss and Pakistani embassies, respectively.

In addition, 115 of the 193 members of the United Nations maintain diplomatic missions of varying sizes in New York City. There are also 62 consulates in Los Angeles, 52 in Chicago, 42 in San Francisco, 38 in Houston, 35 in Miami, and 26 in Boston and Atlanta.

All told, there are almost 600 foreign government embassies, consulates, missions, or representative offices in the United States, all of which are watched to one degree or another by the counterintelligence officers of the FBI. Only eight countries do not maintain any diplomatic presence in the United States whatsoever, the most important of which is nuclear-armed North Korea.

Every one of these embassies and consulates is watched by the FBI's legion of counterintelligence officers to one degree or another. But some countries' receive the vast majority of the FBI's attention, such as Russia, China, Libya, Israel, Egypt, Syria, Jordan, Lebanon, Saudi Arabia, Iraq, Afghanistan, India, Pakistan, and Venezuela. The Cuban and Iranian interests section in Washington -- and their missions to the United Nations in New York -- of course receive special attention as well.

Unsurprisingly, most of the FBI's surveillance is technical in nature. For example, with substantial technical assistance from the NSA and the "big three" American telecommunications companies (AT&T, Verizon, and Sprint), the FBI taps the phones (including cell phones) of virtually every embassy and consulate in the United States. The FBI also intercepts the home phones and emails of many diplomats. The FBI's Washington and New York field offices have special wiretap centers that specialize in collecting all telephone, email, instant messaging, text messaging, and cellular telephone traffic coming in and out of all high-priority diplomatic targets in the United States 24 hours a day, seven days a week. According to a former Justice Department source, over the past decade these extremely sensitive intercepts have identified a number of spies working for governments that were caught in the act of stealing U.S. government secrets, as well as a larger number of cases involving the theft of industrial secrets from American companies.

Since 1978, all electronic communications, both plaintext and encrypted, between these embassies and their home countries have been routinely intercepted by the NSA's BLARNEY fiber-optic-cable intercept program. The NSA provides copies of all these intercepts, including telephone calls and emails, to the FBI's secretive signals-intelligence unit, the Data Intercept Technology Unit (DITU) at the Quantico Marine Corps base in Northern Virginia, and to the FBI's electronic-eavesdropping centers in Washington and New York.

The FBI also uses a wide range of vehicles and airborne surveillance assets to monitor the movements and activities of foreign diplomats and intelligence operatives in Washington and New York. Some of the vans, aircraft, and helicopters used by the FBI for this purpose are equipped with equipment capable of intercepting cell-phone calls and other electronic forms of communication. And when that doesn't work, the FBI calls in the burglars.

Another important part of the FBI's surveillance effort is dedicated to trying to surreptitiously get inside these diplomatic establishments on behalf of the NSA, which increasingly depends on the FBI to penetrate the computer and telecommunications networks used by these embassies and compromise their information security systems.

The FBI perfected this clandestine technique, known as the Surreptitious Entry Program operation, during Cold War intelligence-gathering operations directed at the Soviet Union and its Eastern European allies. These missions remain highly classified because of the diplomatic sensitivity surrounding breaking into the embassies of friends and enemies alike. In one instance during the 1960s, FBI agents reportedly drove a garbage truck into the central courtyard of the Czech Embassy in the middle of the night and spirited away one of the embassy's cipher machines for study by the NSA's code breakers.

The FBI is still conducting these highly sensitive operations. Specially trained teams of FBI agents are still periodically breaking into foreign embassies and consulates in the United States, primarily in New York and Washington. In New York, a special team of FBI burglars is based in a converted warehouse in Long Island City in Queens, according to a former FBI employee who worked there. The nondescript facility is large enough that the FBI can build mock-ups of the exteriors and interiors of embassies being targeted for break-ins. The FBI has a similar facility in Northern Virginia, where full-size mock-ups of embassies in Washington are constructed to train FBI teams prior to conducting black-bag jobs of the facilities.

To facilitate these operations, the FBI has a huge library of architectural drawings, floor plans, building permits, and any other documents that it can lay its hands on concerning the layouts of every embassy and consulate in the United States. Many of these documents were obtained in close conjunction with the diplomatic security staff of the State Department and the uniformed branch of the Secret Service, which is responsible for providing security for foreign diplomatic establishments in the United States. The FBI also interviews the repair and maintenance personnel who service the leased computers and telecommunications equipment used by a host of embassies and other diplomatic establishments in Washington and New York.

Since the 9/11 terrorist attacks, the tempo of FBI clandestine operations designed to steal, compromise, or influence foreign computer, telecommunications, or encryption systems has increased by several orders of magnitude. According to a former Justice Department official, over the past decade clandestine human-intelligence operations run by the FBI's Washington and New York field offices have been enormously successful in compromising a wide range of computer systems and encryption technology used by foreign governments and corporate entities. In a number of important cases, these FBI operations have allowed the NSA's code-breakers to penetrate foreign encryption systems that had defied the ability of the code-breakers to solve through conventional cryptanalytic means. For example, the FBI was able to give the NSA the daily changes in cipher keys for an encryption system used by a country in the developing world. In another case, the FBI was able to covertly insert spyware into the operating system of a computer being used by a foreign mission in New York, allowing the NSA to read the plaintext versions of cables before they were encrypted.

***

But by far the most productive and sensitive intelligence source about what is going on inside embassies and consulates in the United States is a joint FBI-NSA electronic-eavesdropping program known as Close Access SIGINT. It enables the FBI and NSA to listen to what is transpiring inside these buildings by using a wide range of covert technical sensors that are monitored in real time from covert listening posts located in close proximity to the targets.

Some of these operations involve spyware software that has been covertly planted inside the computer systems of embassies and consulates, which allows the NSA's computer-hacking organization, the Office of Tailored Access Operations (TAO), to read in real time everything that is being stored on individual computers or on the computer network itself. Some of these implants are designed and operated by TAO. Others are designed by the FBI's SIGINT unit, the DITU. Some sensors periodically copy the contents of computer hard drives; another sensor takes screen shots of documents being processed or reviewed on compromised computer systems. The FBI is also using sophisticated laser and acoustic systems to image and record the sounds of what is being typed on computers, according to a source with access to the trove of documents leaked to the media by former NSA contractor Edward Snowden.

To pick up the signals from these clandestine sensors, the FBI uses front companies to lease office space within line of sight of nearly 50 embassies and consulates in Washington and New York. In other instances, the FBI and NSA have installed disguised receivers on building rooftops near these embassies to pick up the data signals from clandestine sensors implanted inside these embassies and consulates. Some of these disguised receivers can clearly be seen on the rooftop of a building located within line of sight of the Chinese, Israeli, and Pakistani embassies on Van Ness Street in northwest Washington. It's a neighborhood that's awfully familiar to the FBI and its eavesdroppers.

By Matthew M. Aid

Catalog Advertises NSA Toolbox

After years of speculation that electronics can be accessed by intelligence agencies through a back door, an internal NSA catalog reveals that such methods already exist for numerous end-user devices.

When it comes to modern firewalls for corporate computer networks, the world's second largest network equipment manufacturer doesn't skimp on praising its own work. According to Juniper Networks' online PR copy, the company's products are "ideal" for protecting large companies and computing centers from unwanted access from outside. They claim the performance of the company's special computers is "unmatched" and their firewalls are the "best-in-class." Despite these assurances, though, there is one attacker none of these products can fend off -- the United States' National Security Agency.

Specialists at the intelligence organization succeeded years ago in penetrating the company's digital firewalls. A document viewed by SPIEGEL resembling a product catalog reveals that an NSA division called ANT has burrowed its way into nearly all the security architecture made by the major players in the industry -- including American global market leader Cisco and its Chinese competitor Huawei, but also producers of mass-market goods, such as US computer-maker Dell.

A 50-Page Catalog

These NSA agents, who specialize in secret back doors, are able to keep an eye on all levels of our digital lives -- from computing centers to individual computers, and from laptops to mobile phones. For nearly every lock, ANT seems to have a key in its toolbox. And no matter what walls companies erect, the NSA's specialists seem already to have gotten past them.

This, at least, is the impression gained from flipping through the 50-page document. The list reads like a mail-order catalog, one from which other NSA employees can order technologies from the ANT division for tapping their targets' data. The catalog even lists the prices for these electronic break-in tools, with costs ranging from free to $250,000.

In the case of Juniper, the name of this particular digital lock pick is "FEEDTROUGH." This malware burrows into Juniper firewalls and makes it possible to smuggle other NSA programs into mainframe computers. Thanks to FEEDTROUGH, these implants can, by design, even survive "across reboots and software upgrades." In this way, US government spies can secure themselves a permanent presence in computer networks. The catalog states that FEEDTROUGH "has been deployed on many target platforms."

Master Carpenters

The specialists at ANT, which presumably stands for Advanced or Access Network Technology, could be described as master carpenters for the NSA's department for Tailored Access Operations (TAO). In cases where TAO's usual hacking and data-skimming methods don't suffice, ANT workers step in with their special tools, penetrating networking equipment, monitoring mobile phones and computers and diverting or even modifying data. Such "implants," as they are referred to in NSA parlance, have played a considerable role in the intelligence agency's ability to establish a global covert network that operates alongside the Internet.

Some of the equipment available is quite inexpensive. A rigged monitor cable that allows "TAO personnel to see what is displayed on the targeted monitor," for example, is available for just $30. But an "active GSM base station" -- a tool that makes it possible to mimic a mobile phone tower and thus monitor cell phones -- costs a full $40,000. Computer bugging devices disguised as normal USB plugs, capable of sending and receiving data via radio undetected, are available in packs of 50 for over $1 million.

'Persistence'

The ANT division doesn't just manufacture surveillance hardware. It also develops software for special tasks. The ANT developers have a clear preference for planting their malicious code in so-called BIOS, software located on a computer's motherboard that is the first thing to load when a computer is turned on.

This has a number of valuable advantages: an infected PC or server appears to be functioning normally, so the infection remains invisible to virus protection and other security programs. And even if the hard drive of an infected computer has been completely erased and a new operating system is installed, the ANT malware can continue to function and ensures that new spyware can once again be loaded onto what is presumed to be a clean computer. The ANT developers call this "Persistence" and believe this approach has provided them with the possibility of permanent access.

Another program attacks the firmware in hard drives manufactured by Western Digital, Seagate, Maxtor and Samsung, all of which, with the exception of the latter, are American companies. Here, too, it appears the US intelligence agency is compromising the technology and products of American companies.

Other ANT programs target Internet routers meant for professional use or hardware firewalls intended to protect company networks from online attacks. Many digital attack weapons are "remotely installable" -- in other words, over the Internet. Others require a direct attack on an end-user device -- an "interdiction," as it is known in NSA jargon -- in order to install malware or bugging equipment.

There is no information in the documents seen by SPIEGEL to suggest that the companies whose products are mentioned in the catalog provided any support to the NSA or even had any knowledge of the intelligence solutions. "Cisco does not work with any government to modify our equipment, nor to implement any so-called security 'back doors' in our products," the company said in a statement. Contacted by SPIEGEL reporters, officials at Western Digital, Juniper Networks and Huawei also said they had no knowledge of any such modifications. Meanwhile, Dell officials said the company "respects and complies with the laws of all countries in which it operates."

Many of the items in the software solutions catalog date from 2008, and some of the target server systems that are listed are no longer on the market today. At the same time, it's not as if the hackers within the ANT division have been sleeping on the job. They have continued to develop their arsenal. Some pages in the 2008 catalog, for example, list new systems for which no tools yet exist. However, the authors promise they are already hard at work developing new tools and that they will be "pursued for a future release."

By Jacob Appelbaum, Judith Horchert and Christian Stöcker

The NSA's TAO Hacking Unit

The NSA's TAO hacking unit is considered to be the intelligence agency's top secret weapon. It maintains its own covert network, infiltrates computers around the world and even intercepts shipping deliveries to plant back doors in electronics ordered by those it is targeting.

For quite some time now, the intelligence agency has maintained a branch with around 2,000 employees at Lackland Air Force Base, also in San Antonio. In 2005, the agency took over a former Sony computer chip plant in the western part of the city. A brisk pace of construction commenced inside this enormous compound. The acquisition of the former chip factory at Sony Place was part of a massive expansion the agency began after the events of Sept. 11, 2001.

On-Call Digital Plumbers

One of the two main buildings at the former plant has since housed a sophisticated NSA unit, one that has benefited the most from this expansion and has grown the fastest in recent years -- the Office of Tailored Access Operations, or TAO. This is the NSA's top operative unit -- something like a squad of plumbers that can be called in when normal access to a target is blocked.

According to internal NSA documents viewed by SPIEGEL, these on-call digital plumbers are involved in many sensitive operations conducted by American intelligence agencies. TAO's area of operations ranges from counterterrorism to cyber attacks to traditional espionage. The documents reveal just how diversified the tools at TAO's disposal have become -- and also how it exploits the technical weaknesses of the IT industry, from Microsoft to Cisco and Huawei, to carry out its discreet and efficient attacks.

The unit is "akin to the wunderkind of the US intelligence community," says Matthew Aid, a historian who specializes in the history of the NSA. "Getting the ungettable" is the NSA's own description of its duties. "It is not about the quantity produced but the quality of intelligence that is important," one former TAO chief wrote, describing her work in a document. The paper seen by SPIEGEL quotes the former unit head stating that TAO has contributed "some of the most significant intelligence our country has ever seen." The unit, it goes on, has "access to our very hardest targets."

A Unit Born Of The Internet

Defining the future of her unit at the time, she wrote that TAO "needs to continue to grow and must lay the foundation for integrated Computer Network Operations," and that it must "support Computer Network Attacks as an integrated part of military operations." To succeed in this, she wrote, TAO would have to acquire "pervasive, persistent access on the global network." An internal description of TAO's responsibilities makes clear that aggressive attacks are an explicit part of the unit's tasks. In other words, the NSA's hackers have been given a government mandate for their work. During the middle part of the last decade, the special unit succeeded in gaining access to 258 targets in 89 countries -- nearly everywhere in the world. In 2010, it conducted 279 operations worldwide.

Indeed, TAO specialists have directly accessed the protected networks of democratically elected leaders of countries. They infiltrated networks of European telecommunications companies and gained access to and read mails sent over Blackberry's BES email servers, which until then were believed to be securely encrypted. Achieving this last goal required a "sustained TAO operation," one document states.

This TAO unit is born of the Internet -- created in 1997, a time when not even 2 percent of the world's population had Internet access and no one had yet thought of Facebook, YouTube or Twitter. From the time the first TAO employees moved into offices at NSA headquarters in Fort Meade, Maryland, the unit was housed in a separate wing, set apart from the rest of the agency. Their task was clear from the beginning -- to work around the clock to find ways to hack into global communications traffic.

Recruiting The Geeks

To do this, the NSA needed a new kind of employee. The TAO workers authorized to access the special, secure floor on which the unit is located are for the most part considerably younger than the average NSA staff member. Their job is breaking into, manipulating and exploiting computer networks, making them hackers and civil servants in one. Many resemble geeks -- and act the part, too.

Indeed, it is from these very circles that the NSA recruits new hires for its Tailored Access Operations unit. In recent years, NSA Director Keith Alexander has made several appearances at major hacker conferences in the United States. Sometimes, Alexander wears his military uniform, but at others, he even dons jeans and a t-shirt in his effort to court trust and a new generation of employees.

The recruitment strategy seems to have borne fruit. Certainly, few if any other divisions within the agency are growing as quickly as TAO. There are now TAO units in Wahiawa, Hawaii; Fort Gordon, Georgia; at the NSA's outpost at Buckley Air Force Base, near Denver, Colorado; at its headquarters in Fort Meade; and, of course, in San Antonio.

One trail also leads to Germany. According to a document dating from 2010 that lists the "Lead TAO Liaisons" domestically and abroad as well as names, email addresses and the number for their "Secure Phone," a liaison office is located near Frankfurt -- the European Security Operations Center (ESOC) at the so-called "Dagger Complex" at a US military compound in the Griesheim suburb of Darmstadt.

But it is the growth of the unit's Texas branch that has been uniquely impressive, the top secret documents reviewed by SPIEGEL show. These documents reveal that in 2008, the Texas Cryptologic Center employed fewer than 60 TAO specialists. By 2015, the number is projected to grow to 270 employees. In addition, there are another 85 specialists in the "Requirements & Targeting" division (up from 13 specialists in 2008). The number of software developers is expected to increase from the 2008 level of three to 38 in 2015. The San Antonio office handles attacks against targets in the Middle East, Cuba, Venezuela and Colombia, not to mention Mexico, just 200 kilometers (124 miles) away, where the government has fallen into the NSA's crosshairs.

Mexico's Secretariat of Public Security, which was folded into the new National Security Commission at the beginning of 2013, was responsible at the time for the country's police, counterterrorism, prison system and border police. Most of the agency's nearly 20,000 employees worked at its headquarters on Avenida Constituyentes, an important traffic artery in Mexico City. A large share of the Mexican security authorities under the auspices of the Secretariat are supervised from the offices there, making Avenida Constituyentes a one-stop shop for anyone seeking to learn more about the country's security apparatus.

Operation WHITETAMALE

That considered, assigning the TAO unit responsible for tailored operations to target the Secretariat makes a lot of sense. After all, one document states, the US Department of Homeland Security and the United States' intelligence agencies have a need to know everything about the drug trade, human trafficking and security along the US-Mexico border. The Secretariat presents a potential "goldmine" for the NSA's spies, a document states. The TAO workers selected systems administrators and telecommunications engineers at the Mexican agency as their targets, thus marking the start of what the unit dubbed Operation WHITETAMALE.

Workers at NSA's target selection office, which also had Angela Merkel in its sights in 2002 before she became chancellor, sent TAO a list of officials within the Mexican Secretariat they thought might make interesting targets. As a first step, TAO penetrated the target officials' email accounts, a relatively simple job. Next, they infiltrated the entire network and began capturing data.

Soon the NSA spies had knowledge of the agency's servers, including IP addresses, computers used for email traffic and individual addresses of diverse employees. They also obtained diagrams of the security agencies' structures, including video surveillance. It appears the operation continued for years until SPIEGEL first reported on it in October.

The technical term for this type of activity is "Computer Network Exploitation" (CNE). The goal here is to "subvert endpoint devices," according to an internal NSA presentation that SPIEGEL has viewed. The presentation goes on to list nearly all the types of devices that run our digital lives -- "servers, workstations, firewalls, routers, handsets, phone switches, SCADA systems, etc." SCADAs are industrial control systems used in factories, as well as in power plants. Anyone who can bring these systems under their control has the potential to knock out parts of a country's critical infrastructure.

The most well-known and notorious use of this type of attack was the development of Stuxnet, the computer worm whose existence was discovered in June 2010. The virus was developed jointly by American and Israeli intelligence agencies to sabotage Iran's nuclear program, and successfully so. The country's nuclear program was set back by years after Stuxnet manipulated the SCADA control technology used at Iran's uranium enrichment facilities in Natanz, rendering up to 1,000 centrifuges unusable.

The special NSA unit has its own development department in which new technologies are developed and tested. This division is where the real tinkerers can be found, and their inventiveness when it comes to finding ways to infiltrate other networks, computers and smartphones evokes a modern take on Q, the legendary gadget inventor in James Bond movies.

Having Fun At Microsoft's Expense

One example of the sheer creativity with which the TAO spies approach their work can be seen in a hacking method they use that exploits the error-proneness of Microsoft's Windows. Every user of the operating system is familiar with the annoying window that occasionally pops up on screen when an internal problem is detected, an automatic message that prompts the user to report the bug to the manufacturer and to restart the program. These crash reports offer TAO specialists a welcome opportunity to spy on computers.

SPIEGEL ONLINE

The original Microsoft error message exploited by the NSA

When TAO selects a computer somewhere in the world as a target and enters its unique identifiers (an IP address, for example) into the corresponding database, intelligence agents are then automatically notified any time the operating system of that computer crashes and its user receives the prompt to report the problem to Microsoft. An internal presentation suggests it is NSA's powerful XKeyscore spying tool that is used to fish these crash reports out of the massive sea of Internet traffic.

The automated crash reports are a "neat way" to gain "passive access" to a machine, the presentation continues. Passive access means that, initially, only data the computer sends out into the Internet is captured and saved, but the computer itself is not yet manipulated. Still, even this passive access to error messages provides valuable insights into problems with a targeted person's computer and, thus, information on security holes that might be exploitable for planting malware or spyware on the unwitting victim's computer.

Although the method appears to have little importance in practical terms, the NSA's agents still seem to enjoy it because it allows them to have a bit of a laugh at the expense of the Seattle-based software giant. In one internal graphic, they replaced the text of Microsoft's original error message with one of their own reading, "This information may be intercepted by a foreign sigint system to gather detailed information and better exploit your machine." ("Sigint" stands for "signals intelligence.")

SPIEGEL ONLINE

An NSA internal slide: "This information may be intercepted by a foreign SIGINT system to gather detailed information and better exploit your machine."

One of the hackers' key tasks is the offensive infiltration of target computers with so-called implants or with large numbers of Trojans. They've bestowed their spying tools with illustrious monikers like "ANGRY NEIGHBOR," "HOWLERMONKEY" or "WATERWITCH." These names may sound cute, but the tools they describe are both aggressive and effective.

According to details in Washington's current budget plan for the US intelligence services, around 85,000 computers worldwide are projected to be infiltrated by the NSA specialists by the end of this year. By far the majority of these "implants" are conducted by TAO teams via the Internet.

Increasing Sophistication

Until just a few years ago, NSA agents relied on the same methods employed by cyber criminals to conduct these implants on computers. They sent targeted attack emails disguised as spam containing links directing users to virus-infected websites. With sufficient knowledge of an Internet browser's security holes -- Microsoft's Internet Explorer, for example, is especially popular with the NSA hackers -- all that is needed to plant NSA malware on a person's computer is for that individual to open a website that has been specially crafted to compromise the user's computer. Spamming has one key drawback though: It doesn't work very often.

Nevertheless, TAO has dramatically improved the tools at its disposal. It maintains a sophisticated toolbox known internally by the name "QUANTUMTHEORY." "Certain QUANTUM missions have a success rate of as high as 80%, where spam is less than 1%," one internal NSA presentation states.

A comprehensive internal presentation titled "QUANTUM CAPABILITIES," which SPIEGEL has viewed, lists virtually every popular Internet service provider as a target, including Facebook, Yahoo, Twitter and YouTube. "NSA QUANTUM has the greatest success against Yahoo, Facebook and static IP addresses," it states. The presentation also notes that the NSA has been unable to employ this method to target users of Google services. Apparently, that can only be done by Britain's GCHQ intelligence service, which has acquired QUANTUM tools from the NSA.

A favored tool of intelligence service hackers is "QUANTUMINSERT." GCHQ workers used this method to attack the computers of employeesat partly government-held Belgian telecommunications company Belgacom, in order to use their computers to penetrate even further into the company's networks. The NSA, meanwhile, used the same technology to target high-ranking members of the Organization of the Petroleum Exporting Countries (OPEC) at the organization's Vienna headquarters. In both cases, the trans-Atlantic spying consortium gained unhindered access to valuable economic data using these tools.

The insert method and other variants of QUANTUM are closely linked to a shadow network operated by the NSA alongside the Internet, with its own, well-hidden infrastructure comprised of "covert" routers and servers. It appears the NSA also incorporates routers and servers from non-NSA networks into its covert network by infecting these networks with "implants" that then allow the government hackers to control the computers remotely. (Click here to read a related article on the NSA's "implants".)

In this way, the intelligence service seeks to identify and track its targets based on their digital footprints. These identifiers could include certain email addresses or website cookies set on a person's computer. Of course, a cookie doesn't automatically identify a person, but it can if it includes additional information like an email address. In that case, a cookie becomes something like the web equivalent of a fingerprint.

A Race Between Servers

Once TAO teams have gathered sufficient data on their targets' habits, they can shift into attack mode, programming the QUANTUM systems to perform this work in a largely automated way. If a data packet featuring the email address or cookie of a target passes through a cable or router monitored by the NSA, the system sounds the alarm. It determines what website the target person is trying to access and then activates one of the intelligence service's covert servers, known by the codename FOXACID.

This NSA server coerces the user into connecting to NSA covert systems rather than the intended sites. In the case of Belgacom engineers, instead of reaching the LinkedIn page they were actually trying to visit, they were also directed to FOXACID servers housed on NSA networks. Undetected by the user, the manipulated page transferred malware already custom tailored to match security holes on the target person's computer.

The technique can literally be a race between servers, one that is described in internal intelligence agency jargon with phrases like: "Wait for client to initiate new connection," "Shoot!" and "Hope to beat server-to-client response." Like any competition, at times the covert network's surveillance tools are "too slow to win the race." Often enough, though, they are effective. Implants with QUANTUMINSERT, especially when used in conjunction with LinkedIn, now have a success rate of over 50 percent, according to one internal document.

Tapping Undersea Cables

At the same time, it is in no way true to say that the NSA has its sights set exclusively on select individuals. Of even greater interest are entire networks and network providers, such as the fiber optic cables that direct a large share of global Internet traffic along the world's ocean floors.

One document labeled "top secret" and "not for foreigners" describes the NSA's success in spying on the "SEA-ME-WE-4" cable system. This massive underwater cable bundle connects Europe with North Africa and the Gulf states and then continues on through Pakistan and India, all the way to Malaysia and Thailand. The cable system originates in southern France, near Marseille. Among the companies that hold ownership stakes in it are France Telecom, now known as Orange and still partly government-owned, and Telecom Italia Sparkle.

The document proudly announces that, on Feb. 13, 2013, TAO "successfully collected network management information for the SEA-Me-We Undersea Cable Systems (SMW-4)." With the help of a "website masquerade operation," the agency was able to "gain access to the consortium's management website and collected Layer 2 network information that shows the circuit mapping for significant portions of the network."

It appears the government hackers succeeded here once again using the QUANTUMINSERT method.

The document states that the TAO team hacked an internal website of the operator consortium and copied documents stored there pertaining to technical infrastructure. But that was only the first step. "More operations are planned in the future to collect more information about this and other cable systems," it continues.

But numerous internal announcements of successful attacks like the one against the undersea cable operator aren't the exclusive factors that make TAO stand out at the NSA. In contrast to most NSA operations, TAO's ventures often require physical access to their targets. After all, you might have to directly access a mobile network transmission station before you can begin tapping the digital information it provides.

Spying Traditions Live On

To conduct those types of operations, the NSA works together with other intelligence agencies such as the CIA and FBI, which in turn maintain informants on location who are available to help with sensitive missions. This enables TAO to attack even isolated networks that aren't connected to the Internet. If necessary, the FBI can even make an agency-owned jet available to ferry the high-tech plumbers to their target. This gets them to their destination at the right time and can help them to disappear again undetected after as little as a half hour's work.

Responding to a query from SPIEGEL, NSA officials issued a statement saying, "Tailored Access Operations is a unique national asset that is on the front lines of enabling NSA to defend the nation and its allies." The statement added that TAO's "work is centered on computer network exploitation in support of foreign intelligence collection." The officials said they would not discuss specific allegations regarding TAO's mission.

Sometimes it appears that the world's most modern spies are just as reliant on 

conventional methods of reconnaissance as their predecessors.

Take, for example, when they intercept shipping deliveries. If a target person, agency or company orders a new computer or related accessories, for example, TAO can divert the shipping delivery to its own secret workshops. The NSA calls this method interdiction. At these so-called "load stations," agents carefully open the package in order to load malware onto the electronics, or even install hardware components that can provide backdoor access for the intelligence agencies. All subsequent steps can then be conducted from the comfort of a remote computer.

These minor disruptions in the parcel shipping business rank among the "most productive operations" conducted by the NSA hackers, one top secret document relates in enthusiastic terms. This method, the presentation continues, allows TAO to obtain access to networks "around the world."

Even in the Internet Age, some traditional spying methods continue to live on.

REPORTED BY JACOB APPELBAUM, LAURA POITRAS, MARCEL ROSENBACH, CHRISTIAN STÖCKER, JÖRG SCHINDLER AND HOLGER STARK

Former FBI Agent Mike German On The NSA

Mike German is a 16-year veteran of the FBI, where he served as a special agent in domestic terrorism. His work led him to resign in 2004 after the implementation of the 9/11 Commission’s reforms. He now works for the ACLU, and shared his experiences upholding his oath with The Daily Caller.

Was your work for the FBI what made you decide that their practices weren’t right?

Absolutely. I had been working for the FBI for 16 years and domestic terrorism for 12 years. What I understood was that the rules that are designed to protect privacy also help the government focus on people who are real threats. It works both ways. This idea that we trade our privacy for more security is just false. Spying on you won’t help the government find a terrorist. It’s a waste of resources, a waste of effort that also violates our rights.

What steps did you take to combat the abuse of civil liberties?

I tried to challenge the system from within, but they don’t like that. They made it very uncomfortable, so I finally realized it was time to work on the outside. I went to Congress and Sen. [Chuck] Grassley and Sen. [Patrick] Leahy, and now I work for the ACLU.

Was there a specific incident that occurred that made you want to leave the FBI?

There was a specific case that I was working on, and I’m still not allowed to talk about it in great detail. But it was a case where, again, the way that the government was putting out why they didn’t connect the dots on 9/11 was they didn’t have enough collection before the event. But as the 500-page book by the 9/11 commission shows, they actually had an awful lot information. It’s the mismanagement that causes the problem and it’s that mismanagement that leads not just to intelligence failures, but to violations of rights. Trying to point that out — that it’s really how the government manages its information — is really the important thing for Congress to focus on.

What do you have in mind specifically to manage information better? 

Focus security resources where you have evidence of wrongdoing, and use methods that are transparent and accountable. Name another government program where a lack of accountability leads to effective outcomes — there isn’t one. The intelligence community spends billions of dollars and has no evidence to show its methods are effective. They repeatedly fail, but the response is always to give them more authority and less oversight. No wonder they keep failing. So much of what the intelligence community is doing now is based on myths. The 9/11 failures had nothing to do with criminal investigations and everything to do with mindless intelligence collection (in fact the CIA prevented FBI agents investigating the Cole bombing of getting evidence they sought, leading one agent to write that “one day someone will die” because of their obstruction) yet the reaction was to give more resources to expand intelligence initiatives rather than criminal investigations. Criminal investigations, based on reasonable suspicion and probable cause, supported by criminal prosecutions are effective and have the added benefit of strengthening the rule of law and the legitimacy of government counterterrorism measures.

Multiple terrorists have still reached their targets during the Obama administration. Why do you think people still defend the NSA after their practices clearly haven’t worked?

One of the things that I hear a lot is that “Well, nothing as bad as 9/11 has happened since 9/11.” But that argument would have worked on Sept. 10, 2001. They would have said, “Nothing’s happened in a while, things must be going well.” But what makes things go well is when there’s public accountability and to make sure this is actually what the government is doing. Snowden’s information shows this is not just a violation of our rights, but a waste of resources. Our founders recognized the way to make a safe, secure and free nation, and we need to go back to that.

Can you give a few examples for your assertion that the Bill of Rights is a good guide for police work?

Yes, I actually wrote a book about this called “Thinking Like a Terrorist.” Basically, the Constitution and the Bill of Rights works to improve security by focusing law enforcement resources on criminal activity, rather than activity the police just don’t like, and by limiting the use of techniques that tend to produce unreliable evidence. By protecting behaviors that governments often find threatening, like political organizing by oppositional groups, the First Amendment keeps police away from activities that often get them distracted from crime prevention. By limiting their use of intrusive tools to cases where they have evidence of wrongdoing, verified by an independent magistrate, the Fourth Amendment forces police to focus their efforts appropriately and compels accountability, which makes the police more efficient and effective. By prohibiting coercion, the Fifth Amendment limits false confessions. By requiring counsel, the Sixth Amendment ensures that contrary evidence is discovered and presented to prevent false convictions, which would allow the real bad guys to go unpunished. All of this makes the police more effective, but the real strength of these tools is that they give the citizenry confidence in the legitimacy of police activities, which makes them more likely to cooperate and support government initiatives. Moreover, the lack of these protections make the citizenry angry, leading to less cooperation with the police, or even violence against them.

I often tell a story about a case I worked on as an undercover agent in an anti-government militia group in Washington state. It ended with a six-week trial that was attended by a lot of people who supported the militia group ideologically. One man who was an elder in the group (but didn’t know the defendants and wasn’t involved in the investigation) came up to me after the trial ended, but before the verdict was returned, and asked to shake my hand. He said he sat through the entire trial and was convinced that these defendants would have hurt someone, which would have hurt his movement, so he wanted to thank me for stopping them. Here was someone predisposed to hate the government, thanking the undercover agent who infiltrated the movement because our transparent and open criminal justice process allowed him to see the evidence, appropriately challenged in an adversarial process, and become convinced against his prejudices that the defendants were guilty. That’s how a government demonstrates its legitimacy, which builds a stronger and more stable democracy.

How does violating rules to protect privacy lead to less security, rather than just violations of people’s privacy?

Like I briefly said above, a government that routinely violates the rights of its citizens brews resentment and resistance. If a group has no way of getting its message heard through legitimate means, they will choose disobedience. If the government overreacts to the disobedience it courts more unrest and even violence. This cycle of violence and reprisal is what terrorists try to exploit. They hope their heinous acts of violence provoke an overbroad government response that treats entire communities as suspect, as this unfair discrimination then tends to develop real grievances the terrorist can then exploit. Strict adherence to the law, including defending constitutional rights, inoculates the government against such unfair collective punishment. Unfortunately, some in government fear providing such protection is a weakness, and they tend to play into the terrorists’ hands.

If the point about doing better data mining of a smaller database is true, why are the decision makers so bent on just collecting more data? Do they have a different intelligence philosophy?

It is clear that there is a disconnect between the policy makers and the agents and analysts that actually do the work. The latest Washington Post story about the NSA intercepting content transfers between Google and Yahoo data centers includes a document in which the analysts complain that the volume of useless data from this program is overwhelming them, and request termination of the program. Similarly the [Director of National Intelligence] and FBI continue to try to expand “suspicious activity reporting” programs, even though a George Washington University survey found analysts at the fusion centers that review this material call it “white noise” that impedes their intelligence analysis. In explaining how Umar Farouk Abdulmutaliab slipped through the cracks and almost blew up a plane, [National Counterterrorism Center] NCTC Director Michael Leiter complained that the NCTC receives 5,000 pieces of information a day, and the Webster Commission that reviewed the FBI’s investigation of Maj. Nidal Hasan before the Fort Hood shooting said the investigation was hampered by workload issues caused by a “data explosion” within the FBI. Yet, rather than admit that the collection programs aren’t helping, they continue to argue to expand their agencies’ powers.

Are there career rewards for simply collecting more useless data? Are they really just looking for dirt on domestic political enemies?

They seem to be operating under the premise that they should expand their power and collect all the information they can possibly collect now, just in case it might be useful in the future. Any data management professional would tell you this is a bad idea, but they are not held accountable so there’s no negative consequences for collecting information that isn’t useful. Meanwhile, the agents and analysts are buried under the data explosion. History has repeatedly found that information collected is used in all sorts of ways that weren’t intended when it was originally collected, and agencies and governments always see any opposition to their policies as threats to security, so you can expect that’s the way it will be used.

(Faith Braverman)