A new Snowden leak, detailed in a long, fascinating piece in The Intercept, explains the NSA’s TURBINE initiative, intended to automate malicious software infections. These infections — called “implants” in spy jargon — have historically been carried out on a narrow, surgical scale, targeted at people of demonstrated value to spies, due to the expense and difficulty of arranging the attacks.
But TURBINE, which was carried out with other “Five Eyes” spy agencies as part of the NSA’s $67.6M “Owning the Net” plan, is intended to automate the infection process, allowing for “millions” of infections at once.
The article mentions an internal NSA message-board posting called “I hunt sys admins,” sheds some light on the surveillance practices at the NSA. In the post, an NSA operative explains that he targets systems administrators at companies, especially telecoms companies, as a “means to an end” — that is, infiltrating the companies’ networks. As Glenn Greenwald and Ryan Gallagher point out, this admission shows that malware attacks are not targeted solely or even particularly at people suspected of terrorism or other crimes — rather, they are aimed at the people who maintain the infrastructure of critical networks and systems to allow the NSA to control those systems.
The malware that TURBINE implants can compromise systems in a variety of ways, including hijacking computer cameras and microphones, harvesting Web-browsing history and email traffic, logging passwords and other keystrokes, etc.
The implants being deployed were once reserved for a few hundred hard-to-reach targets, whose communications could not be monitored through traditional wiretaps. But the documents analyzed by The Intercept show how the NSA has aggressively accelerated its hacking initiatives in the past decade by computerizing some processes previously handled by humans. The automated system – codenamed TURBINE – is designed to “allow the current implant network to scale to large size (millions of implants) by creating a system that does automated control implants by groups instead of individually.”
In a top-secret presentation, dated August 2009, the NSA describes a pre-programmed part of the covert infrastructure called the “Expert System,” which is designed to operate “like the brain.” The system manages the applications and functions of the implants and “decides” what tools they need to best extract data from infected machines.
How the NSA Plans to Infect ‘Millions’ of Computers with Malware [Ryan Gallagher and Glenn Greenwald/First Look]