Upstream collection is a term used by the National Security Agency of the United States for intercepting telephone and Internet traffic from the Internet backbone, i.e. major Internet cables and switches, both domestic and foreign. Besides the Upstream collection, NSA also gathers information from Internet communications through arrangements with Internet companies under the program codenamed PRISM. Both the Upstream programs and PRISM are part of the Special Source Operations division, which is responsible for collection in cooperation with corporate partners.
Programs
One of the slides of a presentation about the PRISM-program describes Upstream as "collection of communications on fiber cables and infrastructure as data flows past" and says the Upstream collection is conducted under the following four major surveillance programs:
The FAIRVIEW, BLARNEY and STORMBREW programs are for collecting data at facilities in the United States, whereas OAKSTAR is an umbrella for eight different programs used for collection outside the US. Under all four programs, the collection takes place in cooperation with commercial telecommunication companies, both inside and outside the US. Upstream collection programs allow access to very high volumes of data. According to one anonymous official speaking to a Wall Street Journal reporter, first, a pre-selection is done by the telecommunication providers themselves, who select traffic that most likely contains foreign communications. Then the data is passed on to the NSA, where a second selection is made by briefly copying the traffic and filtering it by using so-called "strong selectors" like phone numbers, e-mail or IP addresses of people and organizations in which NSA is interested. However, William Binney, a former high-ranking NSA official who is now a whistleblower, publicly maintains that the NSA seeks to "collect it all" with minimal filtering. Internet data collected by Upstream programs can be processed and searched through the XKEYSCORE indexing and analysing system.
Operational details
According to former and current US government officials, there are more than a dozen major US based Internet switching stations where this kind of filtering takes place, which is not only near the sites where the main undersea Internet cables enter the US. An actual example of a facility where NSA taps Internet backbone cables is Room 641A in the San Francisco switching station of AT&T, which was revealed in 2006. One of the devices used to filter the Internet traffic is the Semantic Traffic Analyzer or STA 6400 made by Boeing subsidiary Narus. For collection of data from Internet cables and switches outside the United States, the NSA also has secret agreements with foreign Internet providers, especially in Europe and the Middle East. The costs for this cooperation made by these companies are paid by NSA under its Corporate Partner Access program, just like the expenses of the American telecommunication companies. The total costs for this program were estimated at 278 million US dollar for the fiscal year 2013. Upstream collection is conducted under four different legal authorizations:
In a Foreign Intelligence Surveillance Court order from October 3, 2011, it was said that the Upstream collection accounts for approximately 9% of the total number of 250 million Internet communications which NSA collects under the authority of section 702 FAA every year. During the first half of 2011, NSA acquired some 13.25 million Internet communications through Upstream collection. Although this is a relatively small amount, the order says Upstream collection is significant because it contains certain types of valuable foreign intelligence information, it still involves the collection of millions of Internet communications each year, and it is impossible for NSA to exclude domestic communications being collected due to technical difficulties.
