New NSA Slides Reveal Tailored Access Run AmokEva Galperin and Yan Zhu The NSAs Tailored Access Operations Unit, which develops and deploys malware tools, has been described in a Der Spiegel report as a squad of plumbers that can be called in when normal access to a target is blocked, implying that they are a last resort for use when other methods of surveillance fail, but new slides reveal the explosive growth of TAOs data collection via malware implants and plans to scale the number of infected computers from the tens of thousands potentially into the millions using a system called TURBINE. According to the leaked documents, TURBINE enables exploitation on an industrial scale, by automating onerous tasks such as the collection of surveillance data from infected systems. Furthermore, evidence suggesting that NSA exploits Internet chokepoints for man-in-the-middle attacks and develops software to manage millions of Computer Network Attack implants at once demonstrates that their intent is to compromise computer security on a massive scale, rather than a tailored approach. With the help of TURBINE, the NSAs spyware network has grown from a few hundred implants in 2004, to somewhere between 85,000 and 100,000 implants around the world. Even if you believe that there may be a few hundred key systems with information vital to national security that the NSA cannot reach in any other wayeven if you believe there are up to 100,000 such systemspushing that number up into the millions stretches credulity to the breaking point. It appears that TURBINE is neither necessary for nor proportionate to the governments aims and that the NSA intends to recapitulate their mass surveillance program by installing spyware on every computer they can get their hands on. Even Mark Zuckerberg is concerned, to the extent of calling President Obama on the phone to complain. Zuckerberg is right to be angry at NSA for undermining the security that users expect from his company: according to The Intercept, NSA has set up fake Facebook servers and uses Facebooks cookies and other identifying data to associate a targets identity with the targets active device for malware delivery. When our engineers work tirelessly to improve security, writes Zuckerberg, we imagine were protecting you against criminals, not our own government. In this context, the distinction between governments and criminals has become meaningless: an attacker is an attacker, and every website that wants to protect the privacy and security of its users ought to take note. Slides reveal that a man-in-the-middle capability called SECONDDDATE quietly redirects web browsers from the site they think theyre visiting to NSA malware servers called FOXACID. The Intercept reports that SECONDDATE is tailored not only for surgical surveillance attacks on individual suspects. It can also be used to launch bulk malware attacks against computers. EFF has the following recommendations for website operators who wish to protect their users from this kind of man-in-the-middle attack: NSA has issued a confused press statement that dodged the issues and denied claims never made in The Intercepts article, adding that it keeps its foreign intelligence operations . . . as tailored as possible and that it never targets any user of global Internet services without appropriate legal authority. EFF is skeptical, and users and website operators should be as well. 