NSA / Snowden Surveillance Infrastructure — Research Reference

The foundation layer. Everything in the modern AI control grid is built on top of this.

2026-03-15 10 min read Research file
Contents

The foundation layer. Everything in the modern AI control grid is built on top of this.

PRISM

NSA program collecting data directly from servers of nine US tech companies under Section 702 FISA. “The number one source of raw intelligence used for NSA analytic reports” — 91% of NSA’s internet traffic acquired under 702.

Companies and join dates: Microsoft (Sep 2007), Yahoo (Mar 2008), Google (Jan 2009), Facebook (Jun 2009), PalTalk (Dec 2009), YouTube (Sep 2010), Skype (Feb 2011), AOL (Mar 2011), Apple (Oct 2012).

Data collected: Emails, chat (video/voice), videos, photos, stored data, VoIP, file transfers, video conferencing, notifications of target activity, online social networking details.

XKeyscore

NSA’s real-time internet search system. Training slides: “collects nearly everything a typical user does on the internet.” Analysts could search by name, phone, IP, keywords, language, browser type. No warrant or supervisor approval — just a form. In a single 30-day period, collected “at least 41 billion total records.” 700+ servers at ~150 sites worldwide.

Section 702 Reauthorization (April 2024)

Congress passed RISAA (H.R. 7888). House 273-147, Senate 60-34 (midnight before expiration). Expanded the definition of “electronic communications service provider” so broadly that critics said it could compel any business with Wi-Fi to assist NSA surveillance.

Senator Ron Wyden: “one of the most dramatic and terrifying expansions of government surveillance authority in history.”

Biden signed it the same day.

Section 702 Lapses — and Keeps Running (2026)

The 2024 renewal bought two years. The 2026 fight ended with the statute expiring and the surveillance continuing anyway.

  • The court went first. On March 17, 2026 a FISA Court judge renewed the procedures for the program’s annual certifications, raising concerns about the filtering tools agencies use on raw 702 data. The administration asked Congress for a clean 18-month extension (Nextgov).
  • The House passed three years, no warrant. On April 29, 2026 the House voted 235-191 to renew 702 for three years, with oversight tweaks but no warrant requirement for searches of Americans’ communications (The Hill).
  • The Senate stalled, and the statute expired on June 12, 2026 (EFF). The Senate’s motion to proceed to a long-term reauthorization had failed 47-52 (Tech Times).
  • Collection did not stop. Because the March certifications run until roughly March 2027, collection and the FBI’s warrantless queries continue without the statute. As of the Brennan Center’s September 17, 2026 update, Congress had not reauthorized; its analysis is that the authority will not lapse in practice if Congress acts by March 2027 (Brennan Center).

That is the ratchet in its purest form: the legislature declined to renew the power, and the power runs on regardless, on the strength of a court certification issued before the vote.

The FISA Court

Approval rate: 1979-2012: 33,942 applications submitted, 12 denied (33,930 approved) — 99.97%. Stanford Law Review notes ~24.4% involved substantive changes after inquiry, but the structural critique remains: proceedings entirely secret, only the government is represented, no adversarial process.

FBI improper searches of the 702 database: Over 278,000 non-compliant queries total. In 2022 alone: 8,000+ improper queries (~20/day). Searched on 100+ BLM protesters, January 6 suspects, journalists, a sitting member of Congress. FISA Court issued opinions in 2018, 2019, 2020, 2022 decrying “persistent and widespread” violations.

Snowden’s Disclosures (2013)

Timeline: April 2012: begins downloading. June 5, 2013: first publication (Verizon bulk collection). June 6: PRISM revealed. June 9: identifies himself. June 14: Espionage Act charges. June 23: flies to Moscow. Now living in Russia with wife and two sons, Russian citizenship September 2022.

Impact: 2014 Pulitzer Prize (Guardian + WaPo). USA FREEDOM Act (June 2015) ended bulk phone metadata collection. PCLOB found Section 215 bulk collection illegal. Tech companies encrypted data center links.

Upstream Collection / MUSCULAR

Room 641A: AT&T installed fiber optic splitters at 611 Folsom Street, San Francisco (2003) duplicating all data traffic into a secret room. Revealed 2006 by technician Mark Klein. EFF filed Hepting v. AT&T.

MUSCULAR (DS-200B): Joint NSA/GCHQ program tapping unencrypted fiber links between Google and Yahoo data centers worldwide — outside US territory, avoiding FISA. In 30 days (Dec 2012-Jan 2013), collected 181 million records.

The smiley face: Leaked NSA slide showed “SSL Added and Removed Here” with a hand-drawn smiley face — the point where data traveled unencrypted between Google’s internal data centers. Two Google engineers “exploded in profanity.”

Administration Continuity

Bush: Initiated warrantless wiretapping (Stellar Wind). Congress retroactively legalized via FISA Amendments Act 2008, granted telecoms retroactive immunity.

Obama: Campaigned on reform. In practice: expanded drone targeting, 2011 rule changes tripled NSA searches of Americans’ communications (the 2011 FISA Court rule change permitting NSA searches of §702 data for Americans’ communications: ProPublica; Brennan Center. The count: in 2013 NSA “conducted about 9,500 queries of its 702 metadata” with US-person identifiers and approved “198 so-called U.S. person identifiers” for content queries (Threatpost, 1 Jul 2014, on the ODNI letter to Sen. Wyden); in 2016, “An estimated 5,288 U.S. person search terms … were used to retrieve the unminimized contents of communications obtained under Section 702, with an estimated 30,355 queries of metadata using these search terms” (ODNI, Statistical Transparency Report for CY2016, as quoted by Lawfare); 4,672 content terms and 23,800 metadata queries in 2015 (ODNI CY2015 Statistical Transparency Report, p. 5, PDF).) January 2017 (final days): issued new rules allowing NSA to share raw, unminimized signals intelligence with all 16 intelligence agencies — previously NSA filtered and masked American identities first. EFF: “expanding surveillance powers on his way out.”

Trump: Signed the FISA Amendments Reauthorization Act on January 19, 2018 — eight days after tweeting, on the morning of the House vote (January 11), questioning FISA (GovTrack, S. 139 / Pub.L. 115-118: “Signed by the President on Jan. 19, 2018”).

Biden: Signed April 2024 RISAA expanding 702. ACLU noted Biden had previously stated 702 would violate civil liberties.

Executive Order 12333

Signed by Reagan, December 4, 1981. Primary legal authority for NSA collection outside the US. No judicial oversight, no warrants, no Congressional reporting for overseas collection. The vast majority of NSA surveillance operates under this, not FISA. EPIC says EO 12333 activities have “never been subject to meaningful oversight by either courts or Congress” (EPIC).

Five Eyes

US, UK, Canada, Australia, New Zealand. Formalized 1946 (UKUSA Agreement). Agencies: NSA, GCHQ, CSE, ASD, GCSB. Share all signals intelligence by default.

The circumvention problem: Privacy International: “intelligence-sharing arrangements are shrouded in secrecy, allowing for arbitrary or unlawful intrusions on the right to privacy which circumvent domestic legal restrictions on state surveillance.” No legal framework in any of the five countries specifically governs what can be shared — the arrangements operate on executive agreements, not statutes.

The constitutional asymmetry: the circumvention works because the five members’ constitutions differ, and the alliance lets each borrow what the others lack. The United States has a Fourth Amendment to route around — much of the swap’s value is laundering domestic collection through a partner who faces no such rule. The United Kingdom has no entrenched privacy right to launder past; parliamentary sovereignty lets it authorize collection outright, as it later did in the Investigatory Powers Act 2016. Same alliance, opposite legal shapes — the American constitution supplies the motive to offshore, the British constitution the permission to collect.

Current Five Eyes cyber output on AI: On 22 June 2026 the UK’s National Cyber Security Centre published “The AI shift in cyber risk: why leaders must act now,” co-signed by CISA’s Acting Director and by the NSA’s Cyber Security Directorate and the Australian, Canadian and New Zealand cyber agencies; it says “The timeline is not years, it is months” (NCSC, 22 Jun 2026). On 7 July 2026 the NCSC’s Cyber Shield post sought engagement from “academia, Critical National Infrastructure (CNI) organisations, frontier labs, the cyber defence sector and others” (NCSC, Cyber Shield, 7 Jul 2026). See UK NCSC.

NSA → AI Transition

Utah Data Center (Bluffdale): Completed 2014, $1.5B. Exabyte-scale storage. Cray XC30 supercomputer (100+ petaflops). Designed to store “all forms of communication.”

NSA AI Security Center (AISC): NSA uses AI/ML for speaker identification, machine translation (90+ languages), speech-to-text, pattern detection.

Palantir: Founded 2003, initial CIA funding via In-Q-Tel. Government contracts ~55% of revenue. Pentagon Project Maven expanded to $1B+ Palantir contract. Processes enforcement databases, biometrics, financial records, travel history.

Biden’s October 2024 AI NSM: Directed NSA to develop classified AI model testing capability within 120 days.

The structural continuity: Same legal authorities (702, EO 12333), same physical infrastructure (fiber taps, data centers), same institutional relationships (Five Eyes, FISA Court) now feed AI analysis systems. The transition is from human analysts searching XKeyscore to ML models processing the same data streams at scale.

Key Document Archives

researchthe-ratchetsurveillancensasection-702five-eyes
← OlderResearch: Prompt Injection — The Unfixable Flaw Newer →Nation-State Healthcare Espionage — Research Reference

Get updates on the Evil Robots series

Newsletter essays on AI escape, deception, and the humans who built them.