Page 1 sur 6

12/29/2013 09:18 AM

Inside TAO

Documents Reveal Top NSA Hacking Unit

By SPIEGEL Staff The NSA's TAO hacking unit is considered to be the intelligence agenc 's top secret !eapon" It maintains its o!n covert net!ork# in$iltrates computers around the !orld and even intercepts shipping deliveries to plant back doors in electronics ordered b those it is targeting" In January 2010, numerous homeowners in San Antonio, Texas, stood a!!"ed in !ront o! their #"osed $ara$e doors% They wanted to dri&e to wor' or head o!! to do their $ro#ery sho((in$, ut their $ara$e door o(eners had $one dead, "ea&in$ them stranded% )o matter how many times they (ressed the uttons, the doors didn*t ud$e% The (ro "em (rimari"y a!!e#ted residents in the western (art o! the #ity, around Mi"itary +ri&e and the interstate hi$hway 'nown as ,oo( -10% In the .nited States, a #ountry o! #ars and #ommuters, the mysterious $ara$e door (ro "em /ui#'"y e#ame an issue !or "o#a" (o"iti#ians% ."timate"y, the muni#i(a" $o&ernment so"&ed the ridd"e% 0au"t !or the error "ay with the .nited States* !orei$n inte""i$en#e ser&i#e, the )ationa" Se#urity A$en#y, whi#h has o!!i#es in San Antonio% 1!!i#ia"s at the a$en#y were !or#ed to admit that one o! the )SA*s radio antennas was road#astin$ at the same !re/uen#y as the $ara$e door o(eners% 2m arrassed o!!i#ia"s at the inte""i$en#e a$en#y (romised to reso"&e the issue as /ui#'"y as (ossi "e, and soon the doors e$an o(enin$ a$ain% It was than's to the $ara$e door o(ener e(isode that Texans "earned 3ust how !ar the )SA*s wor' had en#roa#hed u(on their dai"y "i&es% 0or /uite some time now, the inte""i$en#e a$en#y has maintained a ran#h with around 2,000 em("oyees at ,a#'"and Air 0or#e 4ase, a"so in San Antonio% In 2005, the a$en#y too' o&er a !ormer Sony #om(uter #hi( ("ant in the western (art o! the #ity% A ris' (a#e o! #onstru#tion #ommen#ed inside this enormous #om(ound% The a#/uisition o! the !ormer #hi( !a#tory at Sony 6"a#e was (art o! a massi&e ex(ansion the a$en#y e$an a!ter the e&ents o! Se(t% 11, 2001% On%&all Digital 'lumbers 1ne o! the two main ui"din$s at the !ormer ("ant has sin#e housed a so(histi#ated )SA unit, one that has ene!ited the most !rom this ex(ansion and has $rown the !astest in re#ent years 77 the 1!!i#e o! Tai"ored A##ess 1(erations, or TA1% This is the )SA*s to( o(erati&e unit 77 somethin$ "i'e a s/uad o! ("um ers that #an e #a""ed in when norma" a##ess to a tar$et is "o#'ed% A##ordin$ to interna" )SA do#uments &iewed y S6I282,, these on7#a"" di$ita" ("um ers are in&o"&ed in many sensiti&e o(erations #ondu#ted y Ameri#an inte""i$en#e a$en#ies% TA1*s area o! o(erations ran$es !rom #ounterterrorism to #y er atta#'s to traditiona" es(iona$e% The do#uments re&ea" 3ust how di&ersi!ied the too"s at TA1*s dis(osa" ha&e e#ome 77 and a"so how it ex("oits the te#hni#a" wea'nesses o! the IT industry, !rom Mi#roso!t to 9is#o and :uawei, to #arry out its dis#reet and e!!i#ient atta#'s% The unit is ;a'in to the wunder'ind o! the .S inte""i$en#e #ommunity,; says Matthew Aid, a historian who s(e#ia"i<es in the history o! the )SA% ;8ettin$ the un$etta "e; is the )SA*s own des#ri(tion o! its duties% ;It is not a out the /uantity (rodu#ed ut the /ua"ity o! inte""i$en#e that is im(ortant,; one !ormer TA1 #hie! wrote, des#ri in$ her wor' in a do#ument% The (a(er seen y S6I282, /uotes the !ormer unit head statin$ that TA1 has #ontri uted ;some o! the most si$ni!i#ant inte""i$en#e our #ountry has e&er seen%; The unit, it $oes on, has ;a##ess to our &ery hardest tar$ets%; A Unit (orn o$ the Internet +e!inin$ the !uture o! her unit at the time, she wrote that TA1 ;needs to #ontinue to $row and must "ay the !oundation !or inte$rated 9om(uter )etwor' 1(erations,; and that it must ;su((ort

file:///C:/Users/Gomes/AppData/Local/Temp/Low/ 3L!"#$1%&tm

30/12/2013

Page 2 sur 6

9om(uter )etwor' Atta#'s as an inte$rated (art o! mi"itary o(erations%; To su##eed in this, she wrote, TA1 wou"d ha&e to a#/uire ;(er&asi&e, (ersistent a##ess on the $"o a" networ'%; An interna" des#ri(tion o! TA1*s res(onsi i"ities ma'es #"ear that a$$ressi&e atta#'s are an ex("i#it (art o! the unit*s tas's% In other words, the )SA*s ha#'ers ha&e een $i&en a $o&ernment mandate !or their wor'% +urin$ the midd"e (art o! the "ast de#ade, the s(e#ia" unit su##eeded in $ainin$ a##ess to 258 tar$ets in 89 #ountries 77 near"y e&erywhere in the wor"d% In 2010, it #ondu#ted 2=9 o(erations wor"dwide% Indeed, TA1 s(e#ia"ists ha&e dire#t"y a##essed the (rote#ted networ's o! demo#rati#a""y e"e#ted "eaders o! #ountries% They in!i"trated networ's o! 2uro(ean te"e#ommuni#ations #om(anies and $ained a##ess to and read mai"s sent o&er 4"a#' erry*s 42S emai" ser&ers, whi#h unti" then were e"ie&ed to e se#ure"y en#ry(ted% A#hie&in$ this "ast $oa" re/uired a ;sustained TA1 o(eration,; one do#ument states% This TA1 unit is orn o! the Internet 77 #reated in 199=, a time when not e&en 2 (er#ent o! the wor"d*s (o(u"ation had Internet a##ess and no one had yet thou$ht o! 0a#e oo', >ouTu e or Twitter% 0rom the time the !irst TA1 em("oyees mo&ed into o!!i#es at )SA head/uarters in 0ort Meade, Mary"and, the unit was housed in a se(arate win$, set a(art !rom the rest o! the a$en#y% Their tas' was #"ear !rom the e$innin$ 77 to wor' around the #"o#' to !ind ways to ha#' into $"o a" #ommuni#ations tra!!i#% Recruiting the )eeks To do this, the )SA needed a new 'ind o! em("oyee% The TA1 wor'ers authori<ed to a##ess the s(e#ia", se#ure !"oor on whi#h the unit is "o#ated are !or the most (art #onsidera "y youn$er than the a&era$e )SA sta!! mem er% Their 3o is rea'in$ into, mani(u"atin$ and ex("oitin$ #om(uter networ's, ma'in$ them ha#'ers and #i&i" ser&ants in one% Many resem "e $ee's 77 and a#t the (art, too% Indeed, it is !rom these &ery #ir#"es that the )SA re#ruits new hires !or its Tai"ored A##ess 1(erations unit% In re#ent years, )SA +ire#tor ?eith A"exander has made se&era" a((earan#es at ma3or ha#'er #on!eren#es in the .nited States% Sometimes, A"exander wears his mi"itary uni!orm, ut at others, he e&en dons 3eans and a t7shirt in his e!!ort to #ourt trust and a new $eneration o! em("oyees% The re#ruitment strate$y seems to ha&e orne !ruit% 9ertain"y, !ew i! any other di&isions within the a$en#y are $rowin$ as /ui#'"y as TA1% There are now TA1 units in @ahiawa, :awaiiA 0ort 8ordon, 8eor$iaA at the )SA*s out(ost at 4u#'"ey Air 0or#e 4ase, near +en&er, 9o"oradoA at its head/uarters in 0ort MeadeA and, o! #ourse, in San Antonio% 1ne trai" a"so "eads to 8ermany% A##ordin$ to a do#ument datin$ !rom 2010 that "ists the ;,ead TA1 ,iaisons; domesti#a""y and a road as we"" as names, emai" addresses and the num er !or their ;Se#ure 6hone,; a "iaison o!!i#e is "o#ated near 0ran'!urt 77 the 2uro(ean Se#urity 1(erations 9enter B2S19C at the so7#a""ed ;+a$$er 9om("ex; at a .S mi"itary #om(ound in the 8riesheim su ur o! +armstadt% 4ut it is the $rowth o! the unit*s Texas ran#h that has een uni/ue"y im(ressi&e, the to( se#ret do#uments re&iewed y S6I282, show% These do#uments re&ea" that in 2008, the Texas 9ry(to"o$i# 9enter em("oyed !ewer than D0 TA1 s(e#ia"ists% 4y 2015, the num er is (ro3e#ted to $row to 2=0 em("oyees% In addition, there are another 85 s(e#ia"ists in the ;Ee/uirements F Tar$etin$; di&ision Bu( !rom 13 s(e#ia"ists in 2008C% The num er o! so!tware de&e"o(ers is ex(e#ted to in#rease !rom the 2008 "e&e" o! three to 38 in 2015% The San Antonio o!!i#e hand"es atta#'s a$ainst tar$ets in the Midd"e 2ast, 9u a, Gene<ue"a and 9o"om ia, not to mention Mexi#o, 3ust 200 'i"ometers B12- mi"esC away, where the $o&ernment has !a""en into the )SA*s #rosshairs% Targeting *e+ico Mexi#o*s Se#retariat o! 6u "i# Se#urity, whi#h was !o"ded into the new )ationa" Se#urity 9ommission at the e$innin$ o! 2013, was res(onsi "e at the time !or the #ountry*s (o"i#e, #ounterterrorism, (rison system and order (o"i#e% Most o! the a$en#y*s near"y 20,000 em("oyees wor'ed at its head/uarters on A&enida 9onstituyentes, an im(ortant tra!!i# artery in Mexi#o 9ity% A "ar$e share o! the Mexi#an se#urity authorities under the aus(i#es o! the Se#retariat are

file:///C:/Users/Gomes/AppData/Local/Temp/Low/ 3L!"#$1%&tm

30/12/2013

Page 3 sur 6

su(er&ised !rom the o!!i#es there, ma'in$ A&enida 9onstituyentes a one7sto( sho( !or anyone see'in$ to "earn more a out the #ountry*s se#urity a((aratus% Operation ,HIT-TA*A.That #onsidered, assi$nin$ the TA1 unit res(onsi "e !or tai"ored o(erations to tar$et the Se#retariat ma'es a "ot o! sense% A!ter a"", one do#ument states, the .S +e(artment o! :ome"and Se#urity and the .nited States* inte""i$en#e a$en#ies ha&e a need to 'now e&erythin$ a out the dru$ trade, human tra!!i#'in$ and se#urity a"on$ the .S7Mexi#o order% The Se#retariat (resents a (otentia" ;$o"dmine; !or the )SA*s s(ies, a do#ument states% The TA1 wor'ers se"e#ted systems administrators and te"e#ommuni#ations en$ineers at the Mexi#an a$en#y as their tar$ets, thus mar'in$ the start o! what the unit du ed 1(eration @:IT2TAMA,2% @or'ers at )SA*s tar$et se"e#tion o!!i#e, whi#h a"so had An$e"a Mer'e" in its si$hts in 2002 e!ore she e#ame #han#e""or, sent TA1 a "ist o! o!!i#ia"s within the Mexi#an Se#retariat they thou$ht mi$ht ma'e interestin$ tar$ets% As a !irst ste(, TA1 (enetrated the tar$et o!!i#ia"s* emai" a##ounts, a re"ati&e"y sim("e 3o % )ext, they in!i"trated the entire networ' and e$an #a(turin$ data% Soon the )SA s(ies had 'now"ed$e o! the a$en#y*s ser&ers, in#"udin$ I6 addresses, #om(uters used !or emai" tra!!i# and indi&idua" addresses o! di&erse em("oyees% They a"so o tained dia$rams o! the se#urity a$en#ies* stru#tures, in#"udin$ &ideo sur&ei""an#e% It a((ears the o(eration #ontinued !or years unti" S6I282, !irst re(orted on it in 1#to er% The te#hni#a" term !or this ty(e o! a#ti&ity is ;9om(uter )etwor' 2x("oitation; B9)2C% The $oa" here is to ;su &ert end(oint de&i#es,; a##ordin$ to an interna" )SA (resentation that S6I282, has &iewed% The (resentation $oes on to "ist near"y a"" the ty(es o! de&i#es that run our di$ita" "i&es 77 ;ser&ers, wor'stations, !irewa""s, routers, handsets, (hone swit#hes, S9A+A systems, et#%; S9A+As are industria" #ontro" systems used in !a#tories, as we"" as in (ower ("ants% Anyone who #an rin$ these systems under their #ontro" has the (otentia" to 'no#' out (arts o! a #ountry*s #riti#a" in!rastru#ture% The most we""7'nown and notorious use o! this ty(e o! atta#' was the de&e"o(ment o! Stuxnet, the #om(uter worm whose existen#e was dis#o&ered in June 2010% The &irus was de&e"o(ed 3oint"y y Ameri#an and Israe"i inte""i$en#e a$en#ies to sa ota$e Iran*s nu#"ear (ro$ram, and su##ess!u""y so% The #ountry*s nu#"ear (ro$ram was set a#' y years a!ter Stuxnet mani(u"ated the S9A+A #ontro" te#hno"o$y used at Iran*s uranium enri#hment !a#i"ities in )atan<, renderin$ u( to 1,000 #entri!u$es unusa "e% The s(e#ia" )SA unit has its own de&e"o(ment de(artment in whi#h new te#hno"o$ies are de&e"o(ed and tested% This di&ision is where the rea" tin'erers #an e !ound, and their in&enti&eness when it #omes to !indin$ ways to in!i"trate other networ's, #om(uters and smart(hones e&o'es a modern ta'e on H, the "e$endary $ad$et in&entor in James 4ond mo&ies% Having /un at *icroso$t's -+pense 1ne exam("e o! the sheer #reati&ity with whi#h the TA1 s(ies a((roa#h their wor' #an e seen in a ha#'in$ method they use that ex("oits the error7(roneness o! Mi#roso!t*s @indows% 2&ery user o! the o(eratin$ system is !ami"iar with the annoyin$ window that o##asiona""y (o(s u( on s#reen when an interna" (ro "em is dete#ted, an automati# messa$e that (rom(ts the user to re(ort the u$ to the manu!a#turer and to restart the (ro$ram% These #rash re(orts o!!er TA1 s(e#ia"ists a we"#ome o((ortunity to s(y on #om(uters% @hen TA1 se"e#ts a #om(uter somewhere in the wor"d as a tar$et and enters its uni/ue identi!iers Ban I6 address, !or exam("eC into the #orres(ondin$ data ase, inte""i$en#e a$ents are then automati#a""y noti!ied any time the o(eratin$ system o! that #om(uter #rashes and its user re#ei&es the (rom(t to re(ort the (ro "em to Mi#roso!t% An interna" (resentation su$$ests it is )SA*s (ower!u" I?eys#ore s(yin$ too" that is used to !ish these #rash re(orts out o! the massi&e sea o! Internet tra!!i#% The automated #rash re(orts are a ;neat way; to $ain ;(assi&e a##ess; to a ma#hine, the (resentation #ontinues% 6assi&e a##ess means that, initia""y, on"y data the #om(uter sends out into the Internet is #a(tured and sa&ed, ut the #om(uter itse"! is not yet mani(u"ated% Sti"", e&en this (assi&e a##ess to error messa$es (ro&ides &a"ua "e insi$hts into (ro "ems with a tar$eted

file:///C:/Users/Gomes/AppData/Local/Temp/Low/ 3L!"#$1%&tm

30/12/2013

Page 4 sur 6

(erson*s #om(uter and, thus, in!ormation on se#urity ho"es that mi$ht e ex("oita "e !or ("antin$ ma"ware or s(yware on the unwittin$ &i#tim*s #om(uter% A"thou$h the method a((ears to ha&e "itt"e im(ortan#e in (ra#ti#a" terms, the )SA*s a$ents sti"" seem to en3oy it e#ause it a""ows them to ha&e a it o! a "au$h at the ex(ense o! the Seatt"e7 ased so!tware $iant% In one interna" $ra(hi#, they re("a#ed the text o! Mi#roso!t*s ori$ina" error messa$e with one o! their own readin$, ;This in!ormation may e inter#e(ted y a !orei$n si$int system to $ather detai"ed in!ormation and etter ex("oit your ma#hine%; B;Si$int; stands !or ;si$na"s inte""i$en#e%;C 1ne o! the ha#'ers* 'ey tas's is the o!!ensi&e in!i"tration o! tar$et #om(uters with so7#a""ed im("ants or with "ar$e num ers o! Tro3ans% They*&e estowed their s(yin$ too"s with i""ustrious moni'ers "i'e ;A)8E> )2I8:41E,; ;:1@,2EM1)?2>; or ;@AT2E@IT9:%; These names may sound #ute, ut the too"s they des#ri e are oth a$$ressi&e and e!!e#ti&e% A##ordin$ to detai"s in @ashin$ton*s #urrent ud$et ("an !or the .S inte""i$en#e ser&i#es, around 85,000 #om(uters wor"dwide are (ro3e#ted to e in!i"trated y the )SA s(e#ia"ists y the end o! this year% 4y !ar the ma3ority o! these ;im("ants; are #ondu#ted y TA1 teams &ia the Internet% Increasing Sophistication .nti" 3ust a !ew years a$o, )SA a$ents re"ied on the same methods em("oyed y #y er #rimina"s to #ondu#t these im("ants on #om(uters% They sent tar$eted atta#' emai"s dis$uised as s(am #ontainin$ "in's dire#tin$ users to &irus7in!e#ted we sites% @ith su!!i#ient 'now"ed$e o! an Internet rowser*s se#urity ho"es 77 Mi#roso!t*s Internet 2x("orer, !or exam("e, is es(e#ia""y (o(u"ar with the )SA ha#'ers 77 a"" that is needed to ("ant )SA ma"ware on a (erson*s #om(uter is !or that indi&idua" to o(en a we site that has een s(e#ia""y #ra!ted to #om(romise the user*s #om(uter% S(ammin$ has one 'ey draw a#' thou$h: It doesn*t wor' &ery o!ten% )e&erthe"ess, TA1 has dramati#a""y im(ro&ed the too"s at its dis(osa"% It maintains a so(histi#ated too" ox 'nown interna""y y the name ;H.A)T.MT:21E>%; ;9ertain H.A)T.M missions ha&e a su##ess rate o! as hi$h as 80J, where s(am is "ess than 1J,; one interna" )SA (resentation states% A #om(rehensi&e interna" (resentation tit"ed ;H.A)T.M 9A6A4I,ITI2S,; whi#h S6I282, has &iewed, "ists &irtua""y e&ery (o(u"ar Internet ser&i#e (ro&ider as a tar$et, in#"udin$ 0a#e oo', >ahoo, Twitter and >ouTu e% ;)SA H.A)T.M has the $reatest su##ess a$ainst >ahoo, 0a#e oo' and stati# I6 addresses,; it states% The (resentation a"so notes that the )SA has een una "e to em("oy this method to tar$et users o! 8oo$"e ser&i#es% A((arent"y, that #an on"y e done y 4ritain*s 89:H inte""i$en#e ser&i#e, whi#h has a#/uired H.A)T.M too"s !rom the )SA% A !a&ored too" o! inte""i$en#e ser&i#e ha#'ers is ;H.A)T.MI)S2ET%; 89:H wor'ers used this method to atta#' the #om(uters o! em("oyees at (art"y $o&ernment7he"d 4e"$ian te"e#ommuni#ations #om(any 4e"$a#om, in order to use their #om(uters to (enetrate e&en !urther into the #om(any*s networ's% The )SA, meanwhi"e, used the same te#hno"o$y to tar$et hi$h7 ran'in$ mem ers o! the 1r$ani<ation o! the 6etro"eum 2x(ortin$ 9ountries B1629C at the or$ani<ation*s Gienna head/uarters% In oth #ases, the trans7At"anti# s(yin$ #onsortium $ained unhindered a##ess to &a"ua "e e#onomi# data usin$ these too"s% The NSA's Shado! Net!ork The insert method and other &ariants o! H.A)T.M are #"ose"y "in'ed to a shadow networ' o(erated y the )SA a"on$side the Internet, with its own, we""7hidden in!rastru#ture #om(rised o! ;#o&ert; routers and ser&ers% It a((ears the )SA a"so in#or(orates routers and ser&ers !rom non7 )SA networ's into its #o&ert networ' y in!e#tin$ these networ's with ;im("ants; that then a""ow the $o&ernment ha#'ers to #ontro" the #om(uters remote"y% B9"i#' here to read a re"ated arti#"e on the )SA*s ;im("ants;%C In this way, the inte""i$en#e ser&i#e see's to identi!y and tra#' its tar$ets ased on their di$ita" !oot(rints% These identi!iers #ou"d in#"ude #ertain emai" addresses or we site #oo'ies set on a (erson*s #om(uter% 1! #ourse, a #oo'ie doesn*t automati#a""y identi!y a (erson, ut it #an i! it in#"udes additiona" in!ormation "i'e an emai" address% In that #ase, a #oo'ie e#omes somethin$ "i'e the we e/ui&a"ent o! a !in$er(rint%

file:///C:/Users/Gomes/AppData/Local/Temp/Lo /!3L"#$%1&'tm

30/12/2013

Page % sur 6

A Race (et!een Servers 1n#e TA1 teams ha&e $athered su!!i#ient data on their tar$ets* ha its, they #an shi!t into atta#' mode, (ro$rammin$ the H.A)T.M systems to (er!orm this wor' in a "ar$e"y automated way% I! a data (a#'et !eaturin$ the emai" address or #oo'ie o! a tar$et (asses throu$h a #a "e or router monitored y the )SA, the system sounds the a"arm% It determines what we site the tar$et (erson is tryin$ to a##ess and then a#ti&ates one o! the inte""i$en#e ser&i#e*s #o&ert ser&ers, 'nown y the #odename 01IA9I+% This )SA ser&er #oer#es the user into #onne#tin$ to )SA #o&ert systems rather than the intended sites% In the #ase o! 4e"$a#om en$ineers, instead o! rea#hin$ the ,in'edIn (a$e they were a#tua""y tryin$ to &isit, they were a"so dire#ted to 01IA9I+ ser&ers housed on )SA networ's% .ndete#ted y the user, the mani(u"ated (a$e trans!erred ma"ware a"ready #ustom tai"ored to mat#h se#urity ho"es on the tar$et (erson*s #om(uter% The te#hni/ue #an "itera""y e a ra#e etween ser&ers, one that is des#ri ed in interna" inte""i$en#e a$en#y 3ar$on with (hrases "i'e: ;@ait !or #"ient to initiate new #onne#tion,; ;ShootK; and ;:o(e to eat ser&er7to7#"ient res(onse%; ,i'e any #om(etition, at times the #o&ert networ'*s sur&ei""an#e too"s are ;too s"ow to win the ra#e%; 1!ten enou$h, thou$h, they are e!!e#ti&e% Im("ants with H.A)T.MI)S2ET, es(e#ia""y when used in #on3un#tion with ,in'edIn, now ha&e a su##ess rate o! o&er 50 (er#ent, a##ordin$ to one interna" do#ument% Tapping Undersea &ables At the same time, it is in no way true to say that the )SA has its si$hts set ex#"usi&e"y on se"e#t indi&idua"s% 1! e&en $reater interest are entire networ's and networ' (ro&iders, su#h as the !i er o(ti# #a "es that dire#t a "ar$e share o! $"o a" Internet tra!!i# a"on$ the wor"d*s o#ean !"oors% 1ne do#ument "a e"ed ;to( se#ret; and ;not !or !orei$ners; des#ri es the )SA*s su##ess in s(yin$ on the ;S2A7M27@27-; #a "e system% This massi&e underwater #a "e und"e #onne#ts 2uro(e with )orth A!ri#a and the 8u"! states and then #ontinues on throu$h 6a'istan and India, a"" the way to Ma"aysia and Thai"and% The #a "e system ori$inates in southern 0ran#e, near Marsei""e% Amon$ the #om(anies that ho"d ownershi( sta'es in it are 0ran#e Te"e#om, now 'nown as 1ran$e and sti"" (art"y $o&ernment7owned, and Te"e#om Ita"ia S(ar'"e% The do#ument (roud"y announ#es that, on 0e % 13, 2013, TA1 ;su##ess!u""y #o""e#ted networ' mana$ement in!ormation !or the S2A7Me7@e .ndersea 9a "e Systems BSM@7-C%; @ith the he"( o! a ;we site mas/uerade o(eration,; the a$en#y was a "e to ;$ain a##ess to the #onsortium*s mana$ement we site and #o""e#ted ,ayer 2 networ' in!ormation that shows the #ir#uit ma((in$ !or si$ni!i#ant (ortions o! the networ'%; It a((ears the $o&ernment ha#'ers su##eeded here on#e a$ain usin$ the H.A)T.MI)S2ET method% The do#ument states that the TA1 team ha#'ed an interna" we site o! the o(erator #onsortium and #o(ied do#uments stored there (ertainin$ to te#hni#a" in!rastru#ture% 4ut that was on"y the !irst ste(% ;More o(erations are ("anned in the !uture to #o""e#t more in!ormation a out this and other #a "e systems,; it #ontinues% 4ut numerous interna" announ#ements o! su##ess!u" atta#'s "i'e the one a$ainst the undersea #a "e o(erator aren*t the ex#"usi&e !a#tors that ma'e TA1 stand out at the )SA% In #ontrast to most )SA o(erations, TA1*s &entures o!ten re/uire (hysi#a" a##ess to their tar$ets% A!ter a"", you mi$ht ha&e to dire#t"y a##ess a mo i"e networ' transmission station e!ore you #an e$in ta((in$ the di$ita" in!ormation it (ro&ides% Sp ing Traditions .ive On To #ondu#t those ty(es o! o(erations, the )SA wor's to$ether with other inte""i$en#e a$en#ies su#h as the 9IA and 04I, whi#h in turn maintain in!ormants on "o#ation who are a&ai"a "e to he"( with sensiti&e missions% This ena "es TA1 to atta#' e&en iso"ated networ's that aren*t #onne#ted to the Internet% I! ne#essary, the 04I #an e&en ma'e an a$en#y7owned 3et a&ai"a "e to !erry the hi$h7te#h ("um ers to their tar$et% This $ets them to their destination at the ri$ht time and #an he"( them to disa((ear a$ain undete#ted a!ter as "itt"e as a ha"! hour*s wor'%

file:///C:/Users/Gomes/AppData/Local/Temp/Lo /!3L"#$%1&'tm

30/12/2013

Page 6 sur 6

Responding to a query from SPIEGEL, NSA officials issued a statement saying, "Tailored Access perations is a unique national asset t!at is on t!e front lines of ena"ling NSA to defend t!e nation and its allies#" T!e statement added t!at TA $s "%or& is centered on computer net%or& e'ploitation in support of foreign intelligence collection#" T!e officials said t!ey %ould not discuss specific allegations regarding TA $s mission# Sometimes it appears t!at t!e %orld$s most modern spies are (ust as reliant on con)entional met!ods of reconnaissance as t!eir predecessors# Ta&e, for e'ample, %!en t!ey intercept s!ipping deli)eries# If a target person, agency or company orders a ne% computer or related accessories, for e'ample, TA can di)ert t!e s!ipping deli)ery to its o%n secret %or&s!ops# T!e NSA calls t!is met!od interdiction# At t!ese so*called "load stations," agents carefully open t!e pac&age in order to load mal%are onto t!e electronics, or e)en install !ard%are components t!at can pro)ide "ac&door access for t!e intelligence agencies# All su"sequent steps can t!en "e conducted from t!e comfort of a remote computer# T!ese minor disruptions in t!e parcel s!ipping "usiness ran& among t!e "most producti)e operations" conducted "y t!e NSA !ac&ers, one top secret document relates in ent!usiastic terms# T!is met!od, t!e presentation continues, allo%s TA to o"tain access to net%or&s "around t!e %orld#" E)en in t!e Internet Age, some traditional spying met!ods continue to li)e on#
REPORTED BY JACOB APPELBAUM, LAURA POITRAS, MARCEL ROSENBACH, CHRISTIAN STCKER, JRG SCHINDLER AND HOLGER STARK

URL: !ttp+,,%%%#spiegel#de,international,%orld,t!e*nsa*uses*po%erful*tool"o'*in*effort*to*spy*on* glo"al*net%or&s*a*-./-0-#!tml Related SPIEGEL ONLINE lin !: S!opping for Spy Gear 1atalog Ad)ertises NSA Tool"o' 234,4-,4/356 !ttp+,,%%%#spiegel#de,international,%orld,/,3738,-./--.,//#!tml 9riendly 9ire :o% G1:; <onitors Germany, Israel and t!e E= 234,4/,4/356 !ttp+,,%%%#spiegel#de,international,%orld,/,3738,-./357,//#!tml il Espionage :o% t!e NSA and G1:; Spied on PE1 233,33,4/356 !ttp+,,%%%#spiegel#de,international,%orld,/,3738,-54>>>,//#!tml 9res! Lea& on =S Spying NSA Accessed <e'ican President$s Email 23/,4/,4/356 !ttp+,,%%%#spiegel#de,international,%orld,/,3738,-4883>,//#!tml ;uantum Spying G1:; =sed 9a&e Lin&edIn Pages to Target Engineers 233,33,4/356 !ttp+,,%%%#spiegel#de,international,%orld,/,3738,-54843,//#!tml Ally and Target =S Intelligence ?atc!es Germany 1losely 2/8,34,4/356 !ttp+,,%%%#spiegel#de,international,%orld,/,3738,-30/4-,//#!tml Related inte"net lin ! #$a!%in&t'n P'!t#: @eric!t A"er 1y"er*Attac&en 4/33 !ttp+,,%%%#%as!ingtonpost#com,%orld,national*security,us*spy*agencies*mounted*453* offensi)e*cy"er*operations*in*4/33*documents*s!o%,4/35,/8,5/,d/-/a0ae*33-e*33e5*".c"* fd>ce/.3d83.Bstory#!tml SPIEGEL NLINE is not lia"le for t!e content of e'ternal %e" pages#

( SPIEGEL ONLINE )*+, All Rig!ts Reser)ed Reproduction only allo%ed %it! t!e permission of SPIEGELnet Gm":

file:///C:/Users/Gomes/AppData/Local/Temp/Low/ 3L!"#$1%&tm

30/12/2013