Some numbers about NSA's data collection

(Updated: February 6, 2015)

Today it's exactly one year ago the Snowden-leaks started. Among the many highly classified documents which were disclosed during the past year are various charts that provide us with actual numbers about the amount of data the National Security Agency (NSA) is collecting.

Here we will take a look at those numbers and see what we can learn from them by comparing various sources and from breaking them down into NSA-divisions, countries and collection programs. As still only fragmented parts have been published, this overview cannot provide completeness or full accuracy (estimates are shown as round numbers).

Numbers related to:
- BOUNDLESSINFORMANT
- NSA volumes and limits
- GCHQ metadata collection
- NSA collection by country
- NSA collection by division
- SSO Collection programs
- Shared by 2nd party partner agencies
- Shared by 3rd party partner agencies

 
BOUNDLESSINFORMANT

The most detailed numbers about NSA's data collection are from the BOUNDLESSINFORMANT tool, which is used by NSA officials to view the metadata volumes collected from specific countries or by specific programs.

A worldwide overview is provided by a heat map which was published by The Guardian on June 11, 2013. It displays the figures over a 30-day period ending in March 2013:

NSA worldwide total: Internet records (DNI): Telephony records (DNR):

221.919.881.317 97.111.188.358 124.808.692.959

This total of 221 billion telephony and internet records a month equals 2,6 trillion a year and 7,3 billion a day. However, the actual number of what NSA collects worldwide might be higher - see the update below.

The BOUNDLESSINFORMANT worldwide overview for March 2013
(click to enlarge)

 
NSA volumes and limits

The BOUNDLESSINFORMANT tool seems to be very accurate, but there's another chart that gives different numbers. It's from a 2012 presentation for the SIGINT Development conference of the Five Eyes community and shows the volumes and limits of NSA metadata collection. The chart was published by The Washington Post on December 4, 2013 and again in Greenwald's book 'No Place To Hide' on May 13, 2014.

Chart showing the volumes and limits of NSA metadata collection
between January and June 2012
Redactions by Greenwald or the press, explanations added by the author
(click to enlarge)

This chart shows the numbers of:
- telephony metadata which are received by FASCIA, which is NSA's main ingest processor for telephony metadata;
- internet metadata that are transferred to MARINA, which is a huge NSA database that can store internet metadata for up to a year;
- internet metadata that had to be deleted because there was apparently not enough storage space.

Except for the deleted metadata, the charts shows ca. 10,4 billion internet metadata (DNI) a day, which makes 312 billion a month or 3,7 trillion a year. There are ca. 4,5 billion telephony metadata (DNR) a day, which makes 135 billion a month or 1,6 trillion a year. If we compare these numbers with those from BOUNDLESSINFORMANT, we see a big difference:

Internet metadata (DNI): Telephony metadata (DNR):

Volumes and Limits (a month, 1st half 2012) 312.000.000.000 135.000.000.000

BOUNDLESSINFORMANT (a month, 1st half 2013) 97.111.188.358 124.808.692.959

There's a difference of 11 billion telephony metadata between both charts, but an even bigger gap exists between the internet metadata: the Volumes and Limits chart shows 215 billion more than BOUNDLESSINFORMANT. This discrepancy wasn't noticed in the press reportings, nor in Greenwald's book, so at the moment there's no clear explanation for this.

Update:
A possible explanation for the discrepancies between these numbers can be found in a FAQ document for the BOUNDLESSINFORMANT tool, which says the numbers shown in the "map view" are lower than in the so-called "org view" of the tool because for the latter, also records are counted that doesn't contain the country identifiers which are needed to be counted in the "map view".
This would also explain the far bigger difference between the numbers of internet metadata, because for internet communications it is often much more difficult to attribute them to a particular country than for telephone conversations (which always contain country and region codes). This means the Volumes and Limits slide provides the more realistic numbers.

Telephony metadata

After being processed by FASCIA, the telephony metadata go to MAINWAY, which is another huge NSA database that keeps these kind of data for at least five years. In 2006 it was estimated that MAINWAY contained 1,9 trillion (1.900.000.000.000) call detail records.

For comparison: in 2007, AT&T's Daytona system, which is used to manage its call detail records (CDR's) supported 2,8 trillion records. In 2012, T-Mobile USA Inc. upgraded to an IBM Netezza 1000 platform with a capacity of 2 petabytes. This is used for loading 17 billion records a day, making 510 billion a month and more than 6 trillion a year.

If we assume the telecom providers and NSA use "records" in the same sense, than this shows that the telecommunication companies produce far more phone call metadata than NSA collects. As T-Mobile USA alone apparently creates 4 times more records as presented in NSA's BOUNDLESSINFORMANT tool, the domestic telephone metadata collection under section 215 Patriot Act cannot be included in the numbers we've seen so far.

Update #1:
Also interesting is that according to slides about the Hemisphere project, some 4 billion telephone metadata records are collected every day from any carrier that uses AT&T switches in response to grand jury subpoenas in counter-narcotics investigations.

Update #2:
During a parliamentary hearing in Germany, an official of BND explained that one cell phone creates between 100 and 200 pieces of metadata a day. For 4.5 billion cell phone users worldwide that would equal some 450 to 900 billion pieces of metadata. It's not yet clear whether NSA counts metadata in the same way, like the NSA's "records" are comprised of multiple pieces, for example.

 
GCHQ metadata collection

Even more metadata seem to be collected by NSA's British partner agency GCHQ, which according to this slide from 2011 collects 50 billion metadata per day. This makes 1,5 trillion a month and an astonishing 18 trillion (18.000.000.000.000) a year!

This (partial) slide was published in Greenwald's book No Place To Hide, but without any further explanation, so we don't know whether GCHQ is able to actually store everything or has to delete large amounts, like NSA. From the slide itself it seems that the number of 50 billion refers to internet metadata alone, which would make this number even more remarkable.

According to a report by The Guardian, GCHQ also collects 600 million telephony metadata a day, which makes 18 billion a month - a small number compared to the internet metadata this agency receives:

Internet metadata per month: Telephony metadata per month:

BOUNDLESS INFORMANT 97 bln. 124 bln.

Volumes and Limits 312 bln. 135 bln.

GCHQ 1500 bln. 18 bln.

For indexing and searching the content of internet communications, GCHQ uses the TEMPORA system, which is capable of processing the traffic from 46 fiber-optic cables of 10 gigabits per second. This makes that 21 petabytes of data flow past these systems every day.


 
NSA collection by country

The main BOUNDLESSINFORMANT interface with the heat map also lists the names of the countries which provide the highest numbers of data. These can be sorted in three different ways: Aggregate, DNI (internet) and DNR (telephony), each resulting in a slightly different top-5. The following aggregated totals (so both DNI and DNR) are known:

NSA worldwide total: Pakistan: Afghanistan: Iran: Jordan: India: Saudi Arabia: Iraq: Egypt: ... United States: ... Brazil:

221.919.881.317 (100%) 27.275.944.618  (12%) 24.293.973.693  (11%) 15.834.475.801   (7%) 14.374.155.469   (6%) 12.616.915.557   (5%) 11.367.867.117   (5%) 10.487.011.026   (4%) 9.064.623.040   (4%) ...           3.095.553.478           ...           2.300.000.000

These numbers indicate from which countries NSA gathers most data, but the exact meaning of the numbers has still not been clarified. We do know that BOUNDLESSINFORMANT counts metadata records, but what these records exactly are (for example: how many records are created by one phone call?), and how they are attributed to a specific country is not clear.

Communications by definition have two ends: the originating and the receiving end. When both ends are in the same country, it's easy to attribute it to that particular country. But when the originating and the receiving ends are in a different country, how is such a communication registered? Maybe for both countries, although that would make many of them appear in these numbers twice.


United States

Edward Snowden saw the heat map with the 3 billion attributed to the United States as a proof that NSA was conducting domestic surveillance, although the heat map itself cannot provide sufficient evidence for that. The 3 billion could very well relate to foreign communications which are just transiting the US or to the American end of for example phone calls where the other end is a foreign suspect. Somewhat more information could have been provided by the bar charts for the US, but these haven't been published.

The number of 3.095.553.478 for the United States is the aggregated total. The number of internet records (DNI) for the US is 2.892.343.446, which leaves just 203.210.032 telephony records (DNR) or 0,065% of the aggregated total. In a table this looks like this:

United States total: Internet records (DNI): Telephony records (DNR):

3.095.553.478 per month 2.892.343.446 per month 203.190.032 per month

This tiny share for telephone metadata is rather strange given the fact that NSA is collecting all American phone records, but does not so with internet metadata. This seems to indicate that these domestic phone records are not counted by BOUNDLESSINFORMANT and that the internet records are from communications with at least one end foreign.


 
NSA collection by division

With a BOUNDLESSINFORMANT chart about the NSA's Special Source Operations (SSO) division published in Greenwald's book, we can also compare the number of data collected by this division with the total number of NSA data collection. We see that SSO, which is responsible for tapping the world's main fiber optic cables, accounts for 72% of all data:

NSA worldwide total: Special Source Operations (SSO): Other NSA divisions:

221.919.881.317 (100%) 160.168.000.000  (72%) 61.751.000.000  (28%)

This leaves the remaining 28% of the data to be collected by NSA's other main divisions: Global Access Operations (GAO), which operates mobile collection platforms like satellites, planes, drones and ships, and Tailored Access Operations (TAO), which collects data by hacking into foreign computer networks. The remaining 28% could also encompass data collected by the joint NSA/CIA Special Collection Service (SCS) units and by 3rd Party partner agencies.

BOUNDLESSINFORMANT chart about the SSO division
(click to enlarge)

 

SSO Collection programs

From the BOUNDLESSINFORMANT chart about Special Source Operations we can see how the total number of data collected by this division breaks down into the 5 biggest collection programs. From other charts we also know the numbers collected by some other programs, and these are added here too:

SSO worldwide total: DANCINGSOASIS (US-3171): SPINNERET (US-3180, part of RAMPART-A): MOONLIGHTPATH (US-3145, part of RAMPART-A): INCENSER (DS-300, part of WINDSTOP): AZUREPHOENIX (US-3127, part of RAMPART-A): ... FAIRVIEW (US-990): ... SOMALGET (US-3310, part of MYSTIC): ... ACIDWASH (part of MYSTIC): ... MUSCULAR (DS-200B, part of WINDSTOP): Other programs in total:

160.168.000.000 (100%) 57.788.148.908  (36%) 23.003.996.216  (14%) 15.237.950.124   (9%) 14.100.359.119   (9%) 13.255.960.192   (8%) ...          6.142.932.557          ...          3.000.000.000          ...          1.050.000.000          ...          181.280.466          26.412.000.000

This listing shows that roughly one third of the data from telecommunication cables are collected by just on single program: DANCINGOASIS. Another third part is intercepted by the programs ranking second, third and fourth, but despite their weight, we still don't know more about them than just their names. Finally, the last third part of this type of collection is divided into numerous smaller and very small programs, a number of which have been disclosed through the Snowden-documents.

Update:
On June 18, 2014 the Danish newspaper Information and Greenwald's website The Intercept broke a story saying that SPINNERET, MOONLIGHTPATH and AZUREPHOENIX are all part of the RAMPART-A program, which encompasses access to fiber-optic cables abroad, in cooperation with 3rd Party partner agencies from at least five different countries.

According to a FAQ document, the BOUNDLESSINFORMANT tool doesn't count data which are collected under FISA authority, so numbers about the famous PRISM program are excluded. However, another source (pdf) says that under PRISM, more than 227 million "internet communications" are collected annually, which is ca. 19 million a month, but it is not known whether these "internet communications" are the same kind of records as presented by BOUNDLESSINFORMANT.

 
Processing and storing

Metadata from a number of big and important SSO collection programs are processed by a system codenamed SHELLTRUMPET. As can be read in the document below, this system processed almost 500 billion metadata records in 2012, which gives an average of 41,6 billion a month, but by the end of 2012 SHELLTRUMPET was already processing 2 billion call detail records a day, which would make 60 billion a month:

MUSCULAR contributes 60 gigabyte of data to the PINWALE database for internet content every day, which is 1,8 terabyte a month. As BOUNDLESSINFORMANT counts 181 million records for MUSCULAR, this would mean that 1 million internet metadata records represent almost 10 gigabyte of (content) data.

This correlation can be used to make a very rough estimate of the total amount of internet data collected by NSA. The worldwide total of 97 billion internet records a month would then equal some 961 terabyte of data each month or 11,5 petabyte a year (some numbers to compare are here; the new NSA data center in Bluffdale, Utah can store an estimated 12 exabytes, which is 12.000 petabytes).


 
Shared by 2nd party partner agencies

The very close working relationship between NSA and the 2party partner agencies from the Five Eyes community leads to a regular exchange of data, of which the most productive facilities can be seen in a BOUNDLESSINFORMANT chart that was published by Der Spiegel:

DS-300 (INCENSER): ... DS-800: DS-204A: UKC-302A: UKC-215: ... DS-200B (MUSCULAR):

14.100.359.119 ... 4.412.803.504 1.691.419.171 1.245.109.650 937.317.036 ... 181.280.466

The SIGAD codes starting with DS denote some kind of joint collection program, those starting with UKC stand for civilian operated facilities of the British signals intelligence agency GCHQ.


 
Shared by 3rd party partner agencies

NSA also gets data provided by 3rd Party partner agencies. These are counted by the BOUNDLESSINFORMANT tool too, as we know from charts about a number of European countries:

Germany (US-987LA): ? (US-985HA) Germany (US-987LB): Poland (US-916A): France (US-985D): Spain (US-987S): Italy (US-987A3005): Norway (US-987F): Denmark (?): The Netherlands (US-985Y):

471.258.864 181.115.922 81.786.967 71.819.443 70.271.990 60.506.610 45.893.570 33.186.042 23.000.000 1.831.506

The total number of data received from these nine countries is slightly more than 1 billion a month, which is just a tiny 0,0045% of NSA's overall collection as counted by the BOUNDLESSINFORMANT tool.

Initially, Glenn Greenwald reported in various European newspapers that these numbers represented the phone calls of European citizens intercepted by NSA. But gradually it came out that his interpretation was wrong.

The charts actually show numbers of metadata that were collected from foreign communications by European military intelligence agencies in support of military operations abroad. These data were subsequently shared with partner agencies, most likely through the SIGDASYS system of the SIGINT Seniors Europe (SSEUR) group, which is led by NSA.

> See also: NSA's foreign partnerships

Links and Sources
- Syncsort.com: How Hadoop is Transforming Telecom
- Secret-bases.co.uk: Secret Data Centres, including GCHQ's Tempora and NSA's PRISM projects
- Cryptome.org: Numbers of reports generated by various NSA programs (pdf)
- Forbes.com: Blueprints Of NSA's Ridiculously Expensive Data Center In Utah Suggest It Holds Less Info Than Thought

NSA's largest cable tapping program: DANCINGOASIS

(Updated: June 7, 2015)

On May 13, Glenn Greenwald published his book 'No Place To Hide' about the Snowden-disclosures. It doesn't contain substantial new revelations, but from one of the original documents in it we can determine that NSA's largest cable tapping program is codenamed DANCINGOASIS, something which was not reported on earlier.

Here we will combine information from a number of other documents and sources to create a somewhat more complete picture of the DANCINGOASIS program.


Special Source Operations

In Greenwald's book and on his website, the following chart from NSA's BOUNDLESSINFORMANT tool was published. Although these charts are not always easy to interpret, we can rather safely assume that this one gives the overview for NSA's Special Source Operations (SSO) division, which is responsible for collecting data from major telephony and internet cables and switches.

During the one month period between December 10, 2012 and January 8, 2013, a total of more than 160 billion metadata records were counted, divided into 93 billion DNI (internet) data and 67 billion DNR (telephony) data:

In the "Most Volume" section we see that the program which collects most data is identified by the SIGINT Activity Designator (SIGAD) US-3171, a facility that is also known under the codename DANCINGOASIS, which is sometimes abbreviated as DGO.

During the one month period covered by the chart, this program collected 57.7 billion data records, which is more than twice as much as the program that is second: US-3180, which is codenamed SPINNERET. Third is US-3145 or MOONLIGHTPATH and fourth DS-300 or INCENSER. This chart will be analysed in general in a separate article.

> See also: INCENSER, or how NSA and GCHQ are tapping internet cables

Numbers

Previously it seemed that it was INCENSER that collected the biggest number of data. A BOUNDLESSINFORMANT chart published in November 2013 said that this program gathered some 14 billion metadata a month. Now we know that DANCINGOASIS is collecting almost 4 times as much: more than 57 billion records each month, or 684 billion every year.

Comparing some numbers learns us that DANCINGOASIS (57 bln.) accounts for more than a third of everything the SSO division collects (160 bln.). It is also far more than what is collected under FAIRVIEW (6 bln.), which is one of the big domestic cable tapping programs that NSA operates in cooperation with US telecom providers.

Comparing DANCINGOASIS with the total number of data that is collected worldwide during one month early 2013 (221 bln.), as presented in the BOUNDLESSINFORMANT heat map, we see that DANCINGOASIS alone seems to account for almost a quarter of the entire NSA data collection.

Given this large share, it could be that DANCINGOASIS is an umbrella program which encompasses various smaller sub-programs. However, DANCINGOASIS is different from MYSTIC, which is an umbrella program containing facilities that monitor at least five entire countries, as was revealed recently by The Intercept. The part of MYSTIC that stores all phone calls of two countries, codenamed SOMALGET, processes only about 3 billion telephony metadata every month.

> See also: Some numbers about NSA's data collection

Whereabouts

Strangely enough we haven't (yet) read about DANCINGOASIS in media reports, nor in the book of Glenn Greenwald, and also we haven't seen any slides or documents that specifically deal with this program.

Update:
On July 9, 2014, Glenn Greenwald indicated on Reddit, that it was part of the agreement with Snowden not to publish anything about Afghanistan and other military operations, so this might be the reason why Greenwald didn't publish anything about DANCINGOASIS.

But in the book 'Der NSA Komplex' written by two journalists from the German magazine Der Spiegel, there's more information. It says that the DANCINGOASIS program started in May 2011 and monitors a fiber optic cable between Western Europe and the Far East.*

It is not clarified what kind of targets DANCINGOASIS collection is used for, but given the enormous amounts of data (57 billion), it has to be from top priority countries from the Middle East. According to the BOUNDLESSINFORMANT heat map, NSA collected more than 27 billion data a month from Pakistan, 24 billion from Afghanistan, 15 billion from Iran and 13 billion from Jordan - all countries that are along the fiber optic cables between Europe and the Far East.


Blocking address books

Such a huge collection of communications inevitably comes with data that are useless, like for example address books from e-mail accounts that are not related to target persons. Because the number of these address books grew steadily, NSA started to block these from being ingested by installing the SCISSORS selection system.

This is shown in slides published by The Washington Post on October 15, 2013. We see that SCISSORS was enabled for DANCINGOASIS (US-3171) on March 13, 2012:

 

The slide on the right shows two codes associated with content collected under DANCINGOASIS: DGOT and DGOD. Similar codes for metadata are written reverse: TOGD and DOGD respectively.


Processing

The systems which are used to process the data from DANCINGOASIS are listed in the "Top 5 Tech" section of the SSO chart. Of the four most important systems, three are used for processing internet data: XKEYSCORE (42 bln.), TURMOIL (23 bln.) and FALLOUT (12 bln.), with LOPERS (41 bln.) being a system for processing data derived from telephone networks.

This means that there are two options regarding what kind of data are collected under the DANCINGOASIS program:

- Either 100% derived from the internet and then being processed by a combination of the XKEYSCORE, TURMOIL and FALLOUT systems;

- Or a mix of internet and telephony data, which are processed partly by the internet processing systems and partly by LOPERS.

Clarity about this can only be provided by the yet unpublished BOUNDLESSINFORMANT chart about the DANCINGOASIS specifically, but the fact that data from this collection facility end up in two separate databases (see below) could indicate that one receives internet data and another telephone communications.


Data filtering

The cable intercepted by DANCINGOASIS transfers 25 petabyte of communications data each day. Between 3 and 6 petabyte of them are being scanned by NSA computers. These systems search the data for keywords that are determined by NSA's targeting offices and are derived from the topics in the Strategic Mission List (pdf) and the National Intelligence Priorities Framework, as approved by the White House.

Based upon an unpublished NSA presentation from March 22, 2013 titled "Cyber Threats and Special Sources Operations", the Spiegel book says that between 10 and 40 percent of the data (both content and metadata) collected under the DANCINGOASIS program are filtered out and stored in two databases: 43 gigabyte in one and 132 gigabyte in another database, every day.*

This means that 175 gigabyte of data is stored daily, which is 0,000007% of the 25 petabyte that is transmitted by the cable. The 175 gigabyte makes 5,2 terabyte a month and 63 terabyte a year. Whether the 57,7 billion records collected under DANCINGOASIS also equal 5,2 terabyte of digital storage space seems a bit questionable however.

The book doesn't provide the names of the databases, so probably it aren't the known ones like PINWALE, MAINWAY and MARINA. Therefore, the data from DANCINGOASIS might be stored in the NSA's new cloud systems, the names of which NSA likes to keep secret for some reason or another.

Because of similar capacity limits across a range of collection programs, the NSA is leaping forward with cloud-based collection systems and a huge new "mission data repository" in Utah.


Metadata processing

According to the excerpt of an NSA document published in the book of Glenn Greenwald, metadata records from DANCINGOASIS are processed by a system codenamed SHELLTRUMPET. This system "began as a near-real time metadata analyser in December 2007 for a CLASSIC collection system":

On December 21, 2012 SHELLTRUMPET had processed its 1 trillionth metadata record. Almost half of this volume was processed during 2012, and half of that volume, so one quarter of a trillion (250 billion) metadata records, came from DANCINGOASIS.*



Reporting

A system that collects a huge amount of data does not automatically contribute to equal numbers of intelligence reports. We can see this in a slide about results from NSA's Upstream collection during the fiscal year 2010/2011.

In the chart, US-3171, the SIGAD of DANCINGOASIS, ranks 6th with some 5452 so called "Serialized Product Reports". Data collected under section 702 FAA authority (PRISM and the domestic Upstream cable tapping) led to almost 4 times more reports:

With a blue bar, DANCINGOASIS is listed as a "SSO Non-Corporate Program", which means the collection is done without cooperation of a commercial telecommunications company. Although this does not exclude foreign government or foreign partner agency cooperation, it's remarkable that NSA is able to collect these huge amounts of data from a fiber optic cable without the help of the operating companies.

Update:
On June 4, 2015, the New York Times published a slide about SSO cyber operations, which indicates that DANCINGOASIS became operational in June 2011. The remark "Need I see more?" seems to confirm the importance of this very large cable access program:

Dutch government tried to hide the truth about metadata collection

(Updated: March 8, 2014)

On February 4, the Dutch government admitted that it was not NSA that collected 1,8 million metadata from phone calls of Dutch citizens, but actually their own military intelligence service MIVD. They gathered those data from foreign communications and subsequently shared them with partner agencies like NSA.

Just like everyone else, the Dutch interior minister was mislead by how Glenn Greenwald erroneously interpreted the data shown in screenshots from the NSA tool BOUNDLESSINFORMANT. This let him misinform the Dutch public and parliament too, and only after being faced with a lawsuit, he finally disclosed the truth. Here's the full story.


How it started

The first charts from the BOUNDLESSINFORMANT tool were published by the German magazine Der Spiegel on July 29, 2013. Next to a bigger chart about Germany was a smaller one about the Netherlands, but this was completely overseen by Dutch media.

Only after the French paper Le Monde came with a big story about alleged NSA eavesdropping on French citizens on October 20, 2013, the Dutch IT website Tweakers.net published on October 21 about the screenshot that was in Der Spiegel several months before:

The report by Tweakers.net was correct in explaining that the chart only shows metadata, but the headline initially read "NSA intercepted 1.8 million phonecalls in the Netherlands". It was the first time a news medium correctly presented the BOUNDLESSINFORMANT chart as showing metadata instead of content.

But as the initial headline had immediatly been copied by other media, many people, including politicians, got the idea that NSA was actually eavesdropping on a vast number of Dutch phone calls. After discussing this on Twitter, Tweakers corrected the title by adding "metadata" and "per month".

> See also: BOUNDLESSINFORMANT only shows metadata



A talkative minister

On the night of October 22, the Dutch interior minister Ronald Plasterk was asked about these revelations in the late night talk show Pauw & Witteman. He gave a clear explanation about what metadata are used for, and guessed that with around 60.000 phone calls per day between the Netherlands and the United States, this would make 1,8 million calls per month - apperently assuming that numbers of metadata equals phone calls.

He said that he wasn't yet certain whether it was actually NSA that collected those metadata from Dutch phonecalls, but that a European group of experts was established to clarify this with the Americans. The minister said that it would not be acceptable if NSA was monitoring Dutch citizens without asking permission from the Dutch government before doing so.

According to a statement by the interior minister during the parliamentary debate on February 11, 2014, it was only by now that AIVD and MIVD started communicating with NSA about the exact origins of these particular data. It would last 4 weeks to get this clear - rather quick, according to the minister.

(286e minuut)

Before this bilateral investigation was initiated, it seems that the Dutch government was relying on the work of a multinational group of experts on behalf of 27 European countries. This ad hoc EU-US Working Group was established in July 2013 to examine the NSA spying programs. Their final report (pdf) was published on November 27.

Besides this group of experts, the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament also started an inquiry in September 2013, presented preliminary conclusions on December 18 and a final report (pdf) on February 21.

Dutch interior minister Ronald Plasterk in the talk show Pauw & Witteman
(October 22, 2013 - in Dutch)

Almost one week later, on October 28, the Spanish paper El Mundo also published a screenshot from BOUNDLESSINFORMANT. The article, written by Glenn Greenwald and a Spanish journalist, once again said the chart proved that NSA had spied on 60 million phonecalls from Spain in one month.

This was the standard interpretation that Greenwald gave to BOUNDLESSINFORMANT charts for Germany, France, Spain, Norway, Afghanistan and Italy. He used them to demonstrate the claim made by Edward Snowden, that NSA is eavesdropping on innocent people everywhere in the world.

By framing the public debate in this way, most people, including politicians, assumed these claims were true, and therefore it was for example the Dutch interior minister, responsible for the civilian intelligence and security service AIVD, who was asked for explanation. Only people familiar with Dutch intelligence knew that SIGINT collection is actually done by the NSO, which is part of the military intelligence agency MIVD.



NSA strikes back

On October 29, NSA director Keith Alexander testified before a hearing of the House intelligence committee. He forcefully denied that NSA was collecting millions of phone calls from European countries by saying "Those screenshots that show or at least lead people to believe that we, NSA, or the US, collected that information is false".

Instead, data shown in charts from the Snowden document were collected not just by the NSA itself, but were also "provided to NSA by foreign partners," Alexander said. "This is not information that we collected on European citizens. It represents information that we and our NATO allies have collected in defense of our countries and in support of military operations". The next day, this statement was also sent to European partner agencies, including AIVD.

The same day, the Wall Street Journal reported that according to US officials, the metadata records for France and Spain were not collected by the NSA, but by French and Spanish intelligence services. The metadata were gathered outside their borders, like in war zones, and then shared with NSA.

Then, interior minister Plasterk was invited to appear in the Dutch television news magazine Nieuwsuur on October 30. According to a reconstruction by the newspaper NRC Handelsblad, he was advised by Defense minister Hennis-Plasschaert not to go, because her department, responsible for Dutch SIGINT collection through the MIVD, was irritated by Plasterk's willingness to talk about this issue.

Before going to Nieuwsuur, Plasterk had a meeting with Marc Kuipers, the deputy director of his own AIVD and asked him about the metadata. He was told that there was no hard evidence that the statement of NSA was correct, and Kuipers reportedly denied that the 1,8 million metadata were collected by Dutch agencies. As their research started just a week before, AIVD apparently wasn't sure yet about the exact origins of these data (it took the German BND only a week to find out that they collected the 'German' metadata *)

During the Nieuwsuur broadcast, minister Plasterk showed the letter (pdf) with the statement from general Alexander, but completely misinterpreted it as being a confirmation that the number of 1,8 million metadata were actually collected by NSA - something that was not acceptable for him. He also strongly denied that the 1,8 million were collected by Dutch agencies and subsequently shared with NSA.

Dutch interior minister Ronald Plasterk in the television
magazine Nieuwsuur, October 30, 2013

A few weeks later, NRC Handelsblad announced that they would soon start disclosing Snowden documents related to the Netherlands. NSA watchers expected that one of the first disclosures would be the complete BOUNDLESSINFORMANT screenshot, including the bottom part showing the technical specifications. But that didn't happen. NRC published two articles, on November 23 and November 30, but both contained more background information than spectacular new revelations about the Netherlands.

Most surprising was that the BOUNDLESSINFORMANT screenshot wasn't published. Maybe it had something to do with the fact that this weblog explained on November 23, that Greenwald's interpretation of these charts was not correct, which became clear after comparing two screenshots published by Greenwald in a Norwegian paper in the days before.

A few days later, on November 27, I published my research revealing that the DRTBox technique used to collect the metadata shown in the charts about France, Spain, Italy, Norway and Afghanistan is mainly used for short-range radio and cell phone interception during military operations.



Not NSA, but MIVD

These analysis not only support the official statement by NSA, but also confirm what the intelligence agencies from Germany and Norway had said earlier: that the metadata shown in the charts were collected by them as part of military operations abroad, and not by NSA (exactly the same was said by the Danish military intelligence service, anticipating on a chart about Denmark that never came).

After an investigation of exactly 4 weeks, experts from AIVD and MIVD, who compared actual data collected by the SIGINT unit NSO with data in the systems of their counterparts from NSA, concluded that there was a "perfect match". This was shared with defense minister Hennis and interior minister Plasterk on November 22. Prime minister Mark Rutte was informed during a regular meeting on December 10.

After it became clear that the metadata were not collected by NSA, but by the Dutch agency MIVD, the whole issue automatically became something that was not in the interest of the state to disclose (although not a formal state secret). The interior and the defense minister argued about whether to inform parliament and the public, like in Germany and Norway, but ultimately decided not to do so, following the standard practice to Never Say Anything about the modus operandi of the intelligence and security services.

This is a rather strange argumentation, as "collecting and sharing (meta)data" doesn't reveal any specific methods or operations. Both practices are regularly mentioned in the public reports of MIVD and the oversight committee CTIVD. But as almost no one reads these, the parliament and the people still thought it was NSA that monitored their phone calls.

Presently, it's still not clear whether or not the government informed the parliamentary intelligence oversight committee (CIVD or Commissie Stiekem), because ministers and members aren't even allowed to mention which topics were discussed during the committee meetings.

UPDATE:
According to NRC Handelsblad, defense minister Hennis informed the parliamentary oversight committee on December 12, by saying that the telephony data were collected by Dutch services and shared with NSA. Because she didn't link this to minister Plasterk's statement from October 30, apparently none of the members of the committee was aware of the political impact...

The headquarters of the AIVD in Zoetermeer
(photo: ANP)

Citizens against the State

But then there was a lawsuit on behalf of a coalition of citizens and organizations against the Dutch state, as represented by the interior minister. It aims at stopping Dutch intelligence agencies acquiring data from NSA that might be obtained illegally if Dutch and European law would apply. Furthermore, the coalition demands that the state informs the citizens whose illegally obtained data have been used.

Faced with the possibility of a court ruling that acquiring foreign intelligence might be illegal, which would de facto end the intelligence sharing relationships with foreign countries, the Dutch government was forced to reply. So on February 4, 2014, the state advocate came with a response (pdf), which contains two interesting points:

- The demands are mainly based upon press reports speaking of intercepted phone calls, which is incorrect, because in fact it's not about content, but about metadata. These are collected by the state, lawfully acquired in the context of international cooperation and subsequently passed on to other countries. (par. 6.2)

- Dutch intelligence services are using data derived from undirected interception of cablebound communications by foreign agencies. This method is (still) prohibited in the Netherlands, but legal in the US, and therefore the state sees this as lawful acquisitions. (par. 2.17 - revealing that this is apparently one of the things that the Dutch get in return for the metadata they share)

Misleading the parliament

Now that the state advocate had disclosed the true nature of the 1,8 million, the interior and the defense minister also had to inform the parliament and the public. This was done by a short official statement saying:

"The graph in question points out circa 1.8 million records of metadata that have been collected by the National Sigint Organization (NSO) in the context of counter-terrorism and military operations abroad. It is therefore expressly data collected in the context of statutory duties. The data are legitimately shared with the United States in the light of international cooperation on the issues mentioned above."

This was exact the opposite of what interior minister Plasterk had said during the Nieuwsuur broadcast on October 30 and subsequently to parliament. He was accused of lying or at least witholding crucial information and now had to fear for his position.

On Saturday, February 8, the newspaper NRC Handelsblad published out of the blue the long-awaited complete BOUNDLESSINFORMANT screenshot regarding the Netherlands, including the bottom part which was seen now for the first time since the initial publication by Der Spiegel in August 2013:

The BOUNDLESSINFORMANT screenshot for the Netherlands
(picture by NRC Handelsblad - click to enlarge)

> See for all details about this chart: BOUNDLESSINFORMANT: metadata collection by Dutch MIVD instead of NSA


On February 11, there was a parliamentary debate about the whole issue. Interior minister Plasterk sincerely apologized for his misleading statements on October 30, saying that he just wanted to make sure to the public that it was not his own AIVD that eavesdropped on Dutch citizens.

This statement was hardly convincing, and many parliament members were not satisfied with the fact that he didn't correct his statement after he was informed about the truth on November 22. Both the interior and the defense minister continuously replied that it was not in the interest of the state to provide any more information.

Given this overstretched secrecy, it almost seemed a slip of the tongue when minister Plasterk explained that because "under different programs, different types of metadata are shared" it was not so easy to attribute the 1,8 million to collection by MIVD.

After a debate of almost 8 hours, most opposition parties voted against the interior minister, but that wasn't enough to force a resignation. However, the whole affair weakened his position, he can't afford new mistakes anymore.



Conclusion

With claims made by Edward Snowden that NSA is monitoring innocent civilians all over the world being spread by media for months, it's understandable that the BOUNDLESSINFORMANT charts were seen as evidence for American spying on European countries. Glenn Greenwald presented them in that way to major European newspapers and supported his interpretation by a FAQ document saying that this tool shows "How many records (and what type) are collected against a particular country".

But now that it has become clear this interpretation was false, it also reveals that Greenwald apparently relied solely on these few documents, and was unaware of what the charts really show. I think we have to assume that Snowden also had no idea about their factual context, let alone any experience with the program - if he had, it would be even worse.

The whole story about BOUNDLESSINFORMANT not only backfired upon Snowden and Greenwald, but also upon several European governments, for example the Spanish and the French ones, who fiercly protested against the alleged US spying on their countries, and of course the Dutch one, where interior minister Plasterk was almost forced to resign because of the misinterpretation of the BOUNDLESSINFORMANT chart.



Links and Sources
- Le Monde/BugBrother: La NSA n’espionne pas tant la France que ça
- DeCorrespondent.nl: Cees Wiebes over de internationale gevolgen van Plasterkgate
- Jan Dirk Snel: De Tweede Kamer heeft zelf boter op het hoofd – Over de zogenaamde affaire-Plasterk
- NetKwesties.nl: Onjuiste geheimhouding regering over AIVD/MIVD
- Cyberwar.nl: Broken oversight & the 1.8M PSTN records collected by the Dutch National Sigint Organization
- DutchNews.nl: The Netherlands, not USA, gathered info from 1.8 million phone calls
- NRC.nl: NSA hielp Nederland met onderzoek naar herkomst 1,8 miljoen
- Defensie.nl: MIVD: Interceptie van telecommunicatie
- VoiceOfRussia.com: Denmark admits to tapping phones in conflict zones abroad

BOUNDLESSINFORMANT: metadata collection by Dutch MIVD instead of NSA

(Updated: March 15, 2014)

Today, the Dutch newspaper NRC Handelsblad finally published the complete BOUNDLESSINFORMANT screenshot that shows data related to the Netherlands.

This came after a surprising revelation by the Dutch government that the 1,8 million metadata shown in that screenshot were not from Dutch citizens and intercepted by NSA, but actually from a legitimate collection against foreign targets by the Dutch military intelligence agency MIVD which was passed on to the Americans.

Here, I will analyse the chart and compare it with similar charts about various other countries that were published earlier. More about the background, which caused some severe political problems for the Dutch interior minister, can be read here!

The BOUNDLESSINFORMANT screenshot for the Netherlands
(picture by NRC Handelsblad - click to enlarge)

The first thing that catches the eye is that the screenshot is shown here on paper, together with another sheet with an orange bar bearing a classification marking and a cardboard folder. The sheets look like as if they became wet and also show some white paint brush-like stains (all previous screenshots were published as digital files).

Probably these effects were photoshopped by the paper to make it look extra special. For example, the classification marking on the second sheet seems fake, as it reads: TOPSECRET//S//NOFORN, where in reality Top Secret are two separate words and the compartment for this kind of information is not S, but SI for Special Intelligence.

That said, we now take a look at the information in the screenshot itself. In the upper part there's the bar chart which was already published back in August 2013 by Der Spiegel. The green bars show that only DNR (Dialed Number Recognition, which is telephony) metadata were collected. In the lower part, which was published for the first time today, there are three sections with some details about this collection:

- Signal Profile - Most Volume - Top 5 Techs -

Signal Profile

This section has a pie chart which can show various types of communication. In this case, all metadata were collected from PSTN, which stands for Public Switched Telephone Network. This is the traditional telephone infrastructure, consisting of telephone lines, (undersea) fiber optic cables, microwave transmission links, cellular networks, and communications satellites, all interconnected by switching centers.

In this case, MIVD collected the metadata from PSTN traffic using their satellite station near Burum, which is operated by the signals intelligence unit NSO. This station is conveniently situated next to a big commercial ground station operated by Stratos Global, which provides access to Inmarsat, and Castor, providing access to Intelsat, Eutelsat, Gazprom, RSCC, SES (Astra), Telesat, and Arabsat satellites.

Whereas nowadays almost all intercontinental communications pass undersea fiber optic cables, some less-developed countries like Afghanistan, Sudan, Somalia, Cuba and North-Korea, and remote regions in Russia, China and Africa apparently still use Intelsat satellite links for their international telecommunications. A number of these countries are also linked to Intersputnik satellites.

An example given by the NRC newspaper is that of calls made by Somali people from call shops in a Dutch city like Rotterdam to the Somali capital Mogadishu. If these calls travel through satellite links, the MIVD is able to collect their metadata. The agency only gathers communications that are related to terrorism and those that are necessary to support international military operations.

The Burum teleport, with the NSO intercept station (left) and the
ground station operated by Stratos Global and Castor (right)
(photo: Castor - click to enlarge)

According to a reply from the Dutch government, the 1,8 million metadata were collected by the MIVD from phonecalls, including some sms and fax messages, that "originated and/or terminated" in foreign countries. After all communication data with a Dutch phone number were filtered out, the remaining data were "shared with partner agencies".

This means, these data weren't just shared with NSA on a bilateral basis, but also in multinational military intelligence sharing groups like the 9-Eyes and the 14-Eyes, which is actually called SIGINT Seniors Europe. Both groups consist of the Five Eyes plus a number of 3rd Party nations.

In response to parliamentary questions, the Dutch government seemed to suggest that the 1,8 million metadata equals 1,8 million "unique moments/types of communication". This contrary to earlier and widespread assumptions that 1 phone call creates multiple metadata records.


Most Volume

In the screenshot we can see that the metadata records were collected through a facility designated by the SIGAD US-985Y.

According to NRC, Dutch government sources say that this SIGAD does not designate a single facility, but rather "metadata collected by MIVD that are shared with NSA".

This means that these data could be derived from multiple collection platforms and not just from the satellite intercept station near Burum, although the Dutch government said that in this case the 1,8 million metadata were collected through satellite interception. Besides Burum, the Dutch SIGINT unit NSO also has a high-frequency radio intercept station near Eibergen and some mobile signals intelligence units which can be deployed during foreign operations.

US-985Y is from the same range as US-985D, which is the SIGAD in the screenshot about the collection of metadata related to France, and also near the range of US-987 SIGADs which are used for collection by Spanish, Norwegian, German and Italian agencies. Interestingly, it was Der Spiegel noticing already in August 2013, that SIGADs like the US-987 series were among those assigned by NSA to the SIGINT activities of 3rd Party partner agencies.

If the Dutch interpretation is correct, we have to assume that also the SIGADs for other countries do not designate a particular physical interception facility, but rather a foreign agency as the single source of shared data, with divisions not according to collection facilities, but according to data types like metadata, content, phone and internet. This makes some sense, as it's not up to NSA to assign designations to individual foreign collection platforms.

The headquarters of the Dutch military intelligence agency MIVD,
which is located in the Frederikkazerne in The Hague
(photo: GPD)

Top 5 Techs

This section of the screenshot mentions the technical systems or programs used to collect or process the data. Here, only a single system was used, called CERF CALL.

Sources contacted by NRC say this stands for "Contact Event Record Call", which refers in a more technical way to (telephony) metadata. "Contact" and "event" are terms which are also seen in other NSA documents related to metadata, so that seems to make sense.

It was strange that there was no word for the letter F, but some research revealed that the F most likely stands for Format. In several job vacancies CERF can be seen as listed among a number of other NSA data formats like CSDF and ASDF. We can assume now that CERF = Contact Event Record Format.

The same tech was also in the BOUNDLESSINFORMANT screenshot about Germany, where CERF CALL MOSES1 was the fourth biggest one. Maybe CERF is used for collected metadata in general and CALL specifies that for telephony metadata (although in NSA-speak, telephony is always designated as DNR). An additional codeword like MOSES1 could then be used to further specify these data sets.

Seeing CERF in the Dutch chart came somewhat as a surprise, because in almost all screenshots that followed the German one (France, Spain, Italy, Norway and a chart about Afghanistan) we saw DRTBOX, which is a technique used for handling metadata derived from mobile communication systems (PCS).

DRTBOX refers to surveillance devices made by DRT, which are used to locally intercept radio and cell phone communications, and are widely used in war zones like Afghanistan. This also provides a very strong indication that the metadata for those other countries were collected during or in support of military operations abroad.

The satellite intercept station of MIVD near Burum
(photo: ANP)

We should also be aware of the possibility that the BOUNDLESSINFORMANT screenshot doesn't show everything that the Dutch agency MIVD shares with NSA, as in this one there are only telephony metadata. This is the lesson that was learned from the screenshot about Afghanistan, which was published by Glenn Greenwald in a Norwegian paper last November.
That chart also shows just telephony metadata from one single source, but communications from Afghanistan are of course intercepted by numerous collection facilities. This means that such a document bearing the name of a particular country doesn't necessarily contains everything what's collected from or by that nation.
This problem arises from the fact that these screenshots are published without their original context, so we don't know which selections in the BOUNDLESSINFORMANT interface were made prior to resulting in the output we see in these charts. Unfortunately, Glenn Greenwald isn't able or willing to answer these kind of questions.


> More background of this story: Dutch government tried to hide the truth about metadata collection


UPDATE

On March 5, 2014, the Dutch paper NRC Handelsblad came with a follow-up story, which provided more context to the Dutch collection of metadata.

It says the Netherlands has been sharing intercepted telecommunications with the US since 2006. This partnership accelerated after the Dutch started their ISAF mission in the Afghan province of Uruzgan in 2006 and it continued after this mission ended in 2011. According to NRC there is still a steady flow of millions of telephony metadata from MIVD to NSA.

The paper presents the following example: When in August 2012 the Dutch navy ship HMS Rotterdam was the flagship for the NATO anti-piracy operation OCEAN SHIELD, this vessel was also intercepting the communications of Somali pirates. This was made possible because NSA had provided the covert Dutch SIGINT team on the ship with a special interception system.

NSA's access to the pirates’ communication had collapsed after the latter switched to land-based communications, which couldn't be intercepted by the Americans. Therefore the metadata provided by the Dutch were very welcome. A combination of the interception of Somali pirate communications from aboard the Dutch ship and through the Dutch satellite intercept station in Burum lead to successful mapping of pirate networks:

Note that the grey text in the bottom right corner says that this slide originally was classified as TOP SECRET//SI//NOFORN, but apperently later this was lowered to SECRET//SI//REL TO USA, NLD, probably to share it with the Dutch.

The diagram from the slide is also shown in a larger version. Some connections and icons have Dutch labels, so this seems to be generated by a software tool used by the Dutch MIVD. Probably it's Sentinel Visualizer or Analyst's Notebook or a similar software program, but it also resembles the SYNAPSE data model used by NSA.

Links and Sources
- DeCorrespondent.nl: Op dit grasveldje in de Achterhoek luistert Nederland de Taliban af
- NRC.nl: The secret role of the Dutch in the American war on terror
- NetKwesties.nl: Onjuiste geheimhouding regering over AIVD/MIVD
- Cyberwar.nl: Broken oversight & the 1.8M PSTN records collected by the Dutch National Sigint Organization
- DutchNews.nl: The Netherlands, not USA, gathered info from 1.8 million phone calls
- NRC.nl: NSA hielp Nederland met onderzoek naar herkomst 1,8 miljoen
- Defensie.nl: MIVD: Interceptie van telecommunicatie

The BOUNDLESSINFORMANT interface

(Updated: January 3, 2014)

A previous article on this website showed that the charts in the NSA's BOUNDLESSINFORMANT tool are not so easy to interpret as it may seem. Screenshots from this tool were published by a number of European newspapers saying that they are proving that NSA is intercepting phonecalls from these countries. This article will show and examine a new image which literally provides context to these screenshots.


In a less known follow-up article from November 4 on the website of the spanish paper El Mundo there are four slides from a powerpoint presentation about BOUNDLESSINFORMANT. Three of the slides were published earlier, but the fourth one was never shown before. This new slide shows a screenshot of an Internet Explorer browser window with the BOUNDLESSINFORMANT tool in it:

For the first time, this screenshot reveals what the actual BOUNDLESSINFORMANT interface looks like. It shows that the bar charts and the details below it, as published by the newspapers, appear in a pop-up window above the world map of the global overview.


The global overview window

The presentation slide shows that the main screen of this tool is the global overview, which was initially published by The Guardian in June and later by some other media too. Here's a high resolution version of this screen (click for a bigger version):

On the left side we see the overall numbers for DNI (internet), DNR (telephony), SIGADs, Case Notations and Processing Systems for the last 30 days. This time period can be changed, probably by using the slide button underneath this list, next to the dark grey box. It seems that 30 days is its maximum. In the slide screenshot this time period is 7 days, which can be seen in the pop-up window and explains the smaller numbers in the list at the left side of the map.

The lower part of the screen shows a Top 5 of countries and their total numbers of DNI and DNR records. These total amounts of data can be sorted in three different ways: Aggregate, DNI and DNR, which can be selected with the radio buttons above the map. Each option results in a slightly different top 5 of countries, which is also reflected in the colors of the heat map. These three versions were published by the Indian paper The Hindu last September.

Next to these radio buttons is a search box with a button named "Country View", which is maybe for entering a country name. Finally, there are two buttons in the upper right corner to switch between the two main viewing modes of this tool:

- The Map View, which "allows users to select a country on a map and view the metadata volume and select details about the collection against that country".

- The Org View, which "allows users to view high level metrics by organization [NSA divisions] and then drill down to a more actionable level - down to the program and cover term".

According to a Frequently Asked Questions (FAQ) paper for BOUNDLESSINFORMANT from June 2012, this tool can graphically display information about collected metadata in a map view, bar chart and simple table. The map view can be seen in the main window with the global overview, the bar charts appear in a pop-up window. How the simple table view looks like is not known.

The Map View pop-up window

In the Map View, users can click on a country from the world map and then a pop-up window appears. According to the BOUNDLESSINFORMANT FAQ paper this window shows "the collection posture (record counts, type of collection, and contributing SIGADS or sites) against that particular country in addition to providing a graphical display of record count trends". These elements are in the screenshot of this window:

Unfortunately the resolution of the slide is too low to make everything readably, but still we can see that in this screen there's a lot more than in the images which were published by the various newspapers. For comparison, here's the screenshot that was shown in Norwegian media (click for a bigger version):

Comparing these two screenshots reveal that the images shown in the papers are just a part of the actual pop-up window. We recognize the four sections with the different charts, but there are also some minor differences. The slightly different layout may have been caused by the different time period: 30 days gives in a much wider bar chart than 7 days.

Apart from that, we see that in the screenshots from the newspapers the whole frame is missing. The example from the presentation has "SIGAD" with a symbol next to it in the upper left corner, but we don't know if that's standard, or that it indicates a specific view mode.

Below this are a search box and a scroll box with a relatively long list of options - unfortunately impossible to read, but it's not a list of SIGADs. The display section has two tabs, the active one white, the other one black, indicating that there are apparently two main options for presenting the information.

Left of the bar chart there's a section that could be titled "Active Summary" and seems to contain symbols and headers very similar to those below the bar chart. Probably one can select different kinds of details about the data collection to be shown. The images from the papers have "Top 5 Techs" in the lower section at the right side, but in the pop-up example something different is shown, ineligble again.

Another small difference is in the "Signal Profile" section: the pop-up screen shows four different types of communication systems (maybe DNI, DNR and two others), but the screenshots from the papers have seven. As the presentation is from July 2012 and the images in the papers are from early 2013, maybe during that period more options were added to the tool.

Screenshot from a Brazilian television report, showing some files opened in a TrueCrypt window on the laptop of Glenn Greenwald. In the upper left corner we see an unpublished screenshot from BOUNDLESSINFORMANT with three bar chart sections, apparently about Computer
Network Exploitation (CNE), which is computer hacking by the TAO division
(click to enlarge)

Multiple options

All this shows that in the Map View alone there are more options to select than just clicking a country and getting one standard overview of NSA's collection against that country - that's how Glenn Greenwald and the newspapers brought it.

The fact that there are more ways to select and present the information already became clear by analysing the screenshots published by the papers. For at least five countries (France, Spain, Norway, Afghanistan and Italy) the charts only show one technique, DRTBOX.

If NSA really spies on these countries, it's unlikely they use only one system and collect only telephone (meta)data. Therefore, it seems more as if in this case DRTBOX was used as the primary selector, resulting in charts showing how many data this system processed from different SIGADs and different countries.

A more complete overview of data collection against a country is given by the screenshot for Germany, which shows multiple systems collecting both internet and telephone data. Also interesting to see is that there are not only such charts about countries, but also about collection programs like WINDSTOP (which could be from the 'Org View' mode).


Conclusion

Now that we have a picture of the complete BOUNDLESSINFORMANT interface, we've seen that this tool has many options to present information about NSA's (meta)data collection.

The screenshots published in various European newspapers were cut out from their original pop-up windows, which makes that we are missing their context. We can't see what options there were and which selections were made to present the information as we see it.

We don't know who cut out the charts: was it Edward Snowden, or someone else at NSA (for preparing a presentation), or was it Glenn Greenwald? These questions are of some importance, because these screenshots are used as evidence for rather grave accusations.

Until now, neither Glenn Greenwald, nor editors of some of the involved newspapers were willing to answer any questions about the origins of these screenshots. Instead, Greenwald still sticks to his own initial interpretation and lets papers publish that over and over.



Links and Sources
- The Guardian: BOUNDLESSINFORMANT - Frequently Asked Questions
- Wikipedia: Boundless Informant