Your Source for Leaks Around the World!

GHOSTMACHINE: NSA’s Cloud Analytics Platform

In Archive, NSA, NSA Files, Surveillance on December 15, 2013 at 9:49 AM


via Ashkan Soltani/Barton Gellman/WashingtonPost:

Excerpts from slides describing the National Security Agency’s Special Source Operations cloud analytics platform, code-named GHOSTMACHINE.

What is HADOOP?: An open-source software framework for storage and large-scale data processing originally derived from academic papers by Google. This system underlays many of the largest data-processing projects in the world today, including the NSA.

TUSKATTIRE: This is the NSA’s system for cleaning and processing call-related data (DNR or Dialed Number Recognition).

FASCIA limit: The top line indicates the current limit of the amount of data the NSA’s FASCIA location database can ingest – about 5 billion records per day.

JUGGERNAUT: The NSA’s signal-processing system for ingesting telephony information, including SS7 signaling – a technical term for the method by which cell-phone networks communicate with each other.

How much data does FASCIA collect?: This indicates that more than 27 terrabytes of location data was collected by the database over a period of about 7 months.

OPC/DPC pairs: These refer to the originating and destination points that typically transfer traffic from one provider’s internal network to another’s.

STORMBREW: The code name for a sigad, or signal-collection location, that collects data from 27 OPC/DPC pairs.

FAIRVIEWThis is a sigad that collects data from 860 OPC/DPC pairs.

NSA surveillance programs are identified by “SIGADs,” short for “signals intelligence activity designators.” Internal NSA support documents reviewed by The Washington Post indicate that location information is collected via at least 10 SIGADs, including: DANCINGOASIS, FAIRVIEW, MYSTIC, OAKSTAR, RAMPART-A, RAMPART-M, RESOLUTETITAN, STORMBREW, TIMBERLINE, and WINDSTOP. Three of the SIGADs are believed to be located in the United States: FAIRVIEW, STORMBREW and TIMBERLINE which is at Sugar Grove Research Station in West Virginia.


via Ryan Gallagher/TheIntercept:

GHOSTMACHINE, a massive cloud database used by the NSA to analyze metadata and store, according to one document in the Snowden archive, “100s of billions of entries.”

Slides via (DOCUMENT) NSA SIGDEV: Identifier Lead Triage with ECHOBASE


2012-olympics-ghostmachineRelated: Olympic Option: NSA/GCHQ London 2012 Surveillance Program

  1. […] GHOSTMACHINE: NSA’s Cloud Analytics Platform […]


  2. […] surveillance effort. The NSA was funneling troves of intercepted data to GCHQ from a system called GHOSTMACHINE, a massive cloud database used by the NSA to analyze metadata and store, according to one document […]


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: