MUSCULAR is one of at least four other similar programs that rely on a trusted 2nd party, programs which together are known as WINDSTOP. In a 30-day period from December 2012 to January 2013, MUSCULAR was responsible for collecting 181 million records. It was however dwarfed by another WINDSTOP program known only by its code DS-300 and codename INCENSER, which collected over 14 billion records in the same period.
Operational details
According to the leaked document the NSA's acquisitions directorate sends millions of records every day from internal Yahoo! and Google networks to data warehouses at the agency's headquarters at Fort Meade, Maryland. The program operates via an access point known as DS-200B, which is outside the United States, and it relies on an unnamed telecommunications operator to provide secret access for the NSA and the GCHQ. According to the Washington Post, the MUSCULAR program collects more than twice as many data points compared to the better known PRISM. Unlike PRISM, the MUSCULAR program requires no warrants. Because of the huge amount of data involved, MUSCULAR has presented a special challenge to NSA's Special Source Operations. For example, when Yahoo! decided to migrate a large amount of mailboxes between its data centers, the NSA's PINWALE database was quickly overwhelmed with the data coming from MUSCULAR. Closely related programmes are called INCENSER and TURMOIL. TURMOIL, belonging to the NSA, is a system for processing the data collected from MUSCULAR. According to a post-it style note from the presentation, the exploitation relied on the fact that data was transmitted unencrypted inside Google's private cloud, with "Google Front End Servers" stripping and respectively adding back SSL from/to external connections. According to the Washington Post: "Two engineers with close ties to Google exploded in profanity when they saw the drawing." After the information about MUSCULAR was published by the press, Google announced that it was working on deploying encrypted communication between its datacenters.
Reactions and countermeasures
In early November 2013, Google announced that it was encrypting traffic between its data centers. In mid-November, Yahoo! announced similar plans. In December 2013, Microsoft announced similar plans and used the expression "advanced persistent threat" in their press release, which the press immediately interpreted as comparison of the NSA with the Chinese government-sponsored hackers.
