Guardian: "XKeyscore: NSA tool collects 'nearly everything a user does on the internet'"

[leveymg]

40. You get into the system by being within the database of any agency, US or foreign, that feeds into

the system. The system is partially automated, so that it "reads" all traffic across the network (including CALEA compliant switches and routers, and cable traffic) and if a tagged number or URL or email address is picked up, or a suspicious pattern is detected (e.g., a cluster of persons talking to each other on trak phones, encrypted communications, etc.), it sends an alert. That's the automated profiling step that usually starts a manual search by an analyst. That's one way.

Another way you can get into the NSA database is by the subsequent action of an analyst (NSA employee or contractor) who uses these tools to search up to three hops out for additional evidence. The analyst is supposed to justify a subsequent search step by a targeted party being outside the US. But, the automated profiling step red flags all activity its algorithms have been programmed to treat as suspicious. The analyst's job is to try to confirm the suspicious activity involves a foreign person abroad, and if possible the nature of the threat posed prior to seeking a warrant, which kicks the case to another agency for follow-up investigation.