Upstream collection

Upstream collection is a term used by the National Security Agency (NSA) of the United States for intercepting telephone and Internet traffic from the Internet backbone, i.e. major Internet cables and switches, both domestic and foreign. Besides the Upstream collection, NSA also gathers information from Internet communications through arrangements with Internet companies under the program codenamed PRISM. Both the Upstream programs and PRISM are part of the Special Source Operations (SSO) division, which is responsible for collection in cooperation with corporate partners.

One of the slides of a presentation about the PRISM-program describes Upstream as "collection of communications on fiber cables and infrastructure as data flows past" and says the Upstream collection is conducted under the following four major surveillance programs:

• FAIRVIEW
• BLARNEY
• STORMBREW
• OAKSTAR

The FAIRVIEW, BLARNEY and STORMBREW programs are for collecting data at facilities in the United States, whereas OAKSTAR is an umbrella for eight different programs used for collection outside the US. Under all four programs, the collection takes place in cooperation with commercial telecommunication companies, both inside and outside the US.

Upstream collection programs allow access to very high volumes of data. A first pre-selection is done by the telecommunication providers themselves, who select the Internet traffic that most likely contains foreign communications. Then the data is passed on to the NSA, where a second selection is made by briefly copying the traffic and filtering it by using so-called "strong selectors" like phone numbers, e-mail or IP addresses of people and organizations in which NSA is interested. Internet data collected by Upstream programs can be processed and searched though the XKEYSCORE indexing and analysing system.

According to former and current US government officials, there are more than a dozen major US based Internet switching stations where this kind of filtering takes place, which is not only near the sites where the main undersea Internet cables enter the US. An actual example of a facility where NSA taps Internet backbone cables is Room 641A in the San Francisco switching station of AT&T, which was revealed in 2006. One of the devices used to filter the Internet traffic is the Semantic Traffic Analyzer or STA 6400 made by Boeing subsidiary Narus.

For collection of data from Internet cables and switches outside the United States, the NSA also has secret agreements with foreign Internet providers, especially in Europe and the Middle East. The costs for this cooperation made by these companies are paid by NSA under its Corporate Partner Access program, just like the expenses of the American telecommunication companies. The total costs for this program were estimated at 278 million US Dollar for the fiscal year 2013.

Upstream collection is conducted under four different legal authorizations:

• EO 12333
• Transit
• FISA
• FAA

In a Foreign Intelligence Surveillance Court (FISC) order from October 3, 2011, it was said that the Upstream collection accounts for approximately 9% of the total number of 250 million Internet communications which NSA collects under the authority of section 702 FAA every year. During the first half of 2011, NSA acquired some 13.25 million Internet communications through Upstream collection. Although this is a relatively small amount, the order says Upstream collection is significant because it contains certain types of valuable foreign intelligence information, it still involves the collection of millions of Internet communications each year, and it is impossible for NSA to exclude domestic communications being collected due to technical difficulties.

External links

• Top Level Telecommunications: Slides about NSA's Upstream collection