Tailored Access Operations

Tailored Access Operations

Abbreviation	TAO
Formation	c. 1997–2001[1]
Type	Advanced persistent threat
Purpose	Cyberespionage, cyberwarfare
Headquarters	Fort Meade
Region	United States
Methods	Zero-days, spyware
Official language	English
Parent organization	S3 Data Acquisition

National Security Agency surveillance
Map of global NSA data collection as of 2007[update], with countries subject to the most data collection shown in red
Programs Pre-1978 ECHELON MINARET SHAMROCK PROMIS Since 1978 Upstream collection BLARNEY FAIRVIEW Main Core ThinThread Genoa Since 1990 RAMPART-A Since 1998 Tailored Access Operations Since 2001 OAKSTAR STORMBREW Trailblazer Turbulence Genoa II Total Information Awareness President's Surveillance Program Terrorist Surveillance Program Since 2007 PRISM Dropmire Stateroom Bullrun MYSTIC Databases, tools etc. PINWALE MARINA Main Core MAINWAY TRAFFICTHIEF DISHFIRE XKeyscore ICREACH BOUNDLESSINFORMANT GCHQ collaboration MUSCULAR Tempora
Legislation Safe Streets Act Privacy Act of 1974 FISA ECPA Patriot Act Homeland Security Act Protect America Act of 2007 FISA Amendments Act of 2008
Institutions FISC Senate Intelligence Committee National Security Council
Lawsuits ACLU v. NSA Hepting v. AT&T Jewel v. NSA Clapper v. Amnesty Klayman v. Obama ACLU v. Clapper Wikimedia v. NSA US v. Moalin
Whistleblowers William Binney Thomas Drake Mark Klein Thomas Tamm Russ Tice Edward Snowden
Publication 2005 warrantless surveillance scandal Global surveillance disclosures (2013–present)
Related Cablegate Surveillance of reporters Mail tracking UN diplomatic spying Insider Threat Program Mass surveillance in the United States Mass surveillance in the United Kingdom
Concepts SIGINT Metadata
Collaboration United States CSS CYBERCOM DOJ FBI CIA DHS IAO Five Eyes CSEC GCHQ ASD GCSB Other DGSE BND
v t e

The Office of Tailored Access Operations (TAO), now Computer Network Operations, and structured as S32,^[1] is a cyber-warfare intelligence-gathering unit of the National Security Agency (NSA).^[2] It has been active since at least 1998, possibly 1997, but was not named or structured as TAO until "the last days of 2000," according to General Michael Hayden.^[3][4][5]

TAO identifies, monitors, infiltrates, and gathers intelligence on computer systems being used by entities foreign to the United States.^[6][7][8][9]

TAO is reportedly "the largest and arguably the most important component of the NSA's huge Signals Intelligence Directorate (SID),^[10] consisting of more than 1,000 military and civilian computer hackers, intelligence analysts, targeting specialists, computer hardware and software designers, and electrical engineers. The office is currently known as Office of Computer Network Operations (OCNO). ".^[4]

A document leaked by former NSA contractor Edward Snowden describing the unit's work says TAO has software templates allowing it to break into commonly used hardware, including "routers, switches, and firewalls from multiple product vendor lines".^[11] TAO engineers prefer to tap networks rather than isolated computers, because there are typically many devices on a single network.^[11]

TAO's headquarters are termed the Remote Operations Center (ROC) and are based at the NSA headquarters at Fort Meade, Maryland. TAO also has expanded to NSA Hawaii (Wahiawa, Oahu), NSA Georgia (Fort Eisenhower, Georgia), NSA Texas (Joint Base San Antonio, Texas), and NSA Colorado (Buckley Space Force Base, Denver).^[4]

• S321 – Remote Operations Center (ROC) In the Remote Operations Center, 600 employees gather information from around the world.^[12][13]
• S323 – Data Network Technologies Branch (DNT) : develops automated spyware
  • S3231 – Access Division (ACD)
  • S3232 – Cyber Networks Technology Division (CNT)
  • S3233 –
  • S3234 – Computer Technology Division (CTD)
  • S3235 – Network Technology Division (NTD)
• Telecommunications Network Technologies Branch (TNT) : improve network and computer hacking methods^[14]
• Mission Infrastructure Technologies Branch: operates the software provided above^[15]
• S328 – Access Technologies Operations Branch (ATO): Reportedly includes personnel seconded by the CIA and the FBI, who perform what are described as "off-net operations", which means they arrange for CIA agents to surreptitiously plant eavesdropping devices on computers and telecommunications systems overseas so that TAO's hackers may remotely access them from Fort Meade.^[4] Specially equipped submarines, currently the USS Jimmy Carter,^[16] are used to wiretap fibre optic cables around the globe.
  • S3283 – Expeditionary Access Operations (EAO)
  • S3285 – Persistence Division

Details^[17] on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host.^[18] This enables an NSA computer to generate false geographical location and personal identification credentials when accessing the Internet utilizing QUANTUMSQUIRREL.^[19]

From 2013 to 2017,^[20] the head of TAO was Rob Joyce, a 25-plus year employee who previously worked in the NSA's Information Assurance Directorate (IAD). In January 2016, Joyce had a rare public appearance when he gave a presentation at the Usenix’s Enigma conference.^[21]

The NSA ANT catalog is a 50-page classified document listing technology available to the United States National Security Agency (NSA) Tailored Access Operations (TAO) by the Advanced Network Technology (ANT) Division to aid in cyber surveillance. Most devices are described as already operational and available to US nationals and members of the Five Eyes alliance. According to Der Spiegel, which released the catalog to the public on December 30, 2013, "The list reads like a mail-order catalog, one from which other NSA employees can order technologies from the ANT division for tapping their targets' data." The document was created in 2008.^[22] Security researcher Jacob Appelbaum gave a speech at the Chaos Communications Congress in Hamburg, Germany, in which he detailed techniques that the simultaneously published Der Spiegel article he coauthored disclosed from the catalog.^[22]

The TAO has developed an attack suite they call QUANTUM. It relies on a compromised router that duplicates internet traffic, typically HTTP requests, so that they go both to the intended target and to an NSA site (indirectly). The NSA site runs FOXACID software which sends back exploits that load in the background in the target web browser before the intended destination has had a chance to respond (it's unclear if the compromised router facilitates this race on the return trip). Prior to the development of this technology, FOXACID software made spear-phishing attacks the NSA referred to as spam. If the browser is exploitable, further permanent "implants" (rootkits etc.) are deployed in the target computer, e.g. OLYMPUSFIRE for Windows, which gives complete remote access to the infected machine.^[23] This type of attack is part of the man-in-the-middle attack family, though more specifically it is called man-on-the-side attack. It is difficult to pull off without controlling some of the Internet backbone.^[24]

There are numerous services that FOXACID can exploit this way. The names of some FOXACID modules are given below:^[25]

By collaboration with the British Government Communications Headquarters (GCHQ) (MUSCULAR), Google services could be attacked too, including Gmail.^[25]

Finding machines that are exploitable and worth attacking is done using analytic databases such as XKeyscore.^[26] A specific method of finding vulnerable machines is interception of Windows Error Reporting traffic, which is logged into XKeyscore.^[27]

QUANTUM attacks launched from NSA sites can be too slow for some combinations of targets and services as they essentially try to exploit a race condition, i.e. the NSA server is trying to beat the legitimate server with its response.^[28] As of mid-2011, the NSA was prototyping a capability codenamed QFIRE, which involved embedding their exploit-dispensing servers in virtual machines (running on VMware ESX) hosted closer to the target, in the so-called Special Collection Sites (SCS) network worldwide. The goal of QFIRE was to lower the latency of the spoofed response, thus increasing the probability of success.^[29]

COMMENDEER [sic] is used to commandeer (i.e. compromise) untargeted computer systems. The software is used as a part of QUANTUMNATION, which also includes the software vulnerability scanner VALIDATOR. The tool was first described at the 2014 Chaos Communication Congress by Jacob Appelbaum, who characterized it as tyrannical.^[30][31][32]

QUANTUMCOOKIE is a more complex form of attack which can be used against Tor users.^[33]

Suspected, alleged and confirmed targets of the Tailored Access Operations unit include national and international entities like China,^[4] Northwestern Polytechnical University,^[34] OPEC,^[35] and Mexico's Secretariat of Public Security.^[27]

The group has also targeted global communication networks via SEA-ME-WE 4 – an optical fibre submarine communications cable system that carries telecommunications between Singapore, Malaysia, Thailand, Bangladesh, India, Sri Lanka, Pakistan, United Arab Emirates, Saudi Arabia, Sudan, Egypt, Italy, Tunisia, Algeria and France.^[31] Additionally, Försvarets radioanstalt (FRA) in Sweden gives access to fiber optic links for QUANTUM cooperation.^[36][37]

TAO's QUANTUM INSERT technology was passed to UK services, particularly to GCHQ's MyNOC, which used it to target Belgacom and GPRS roaming exchange (GRX) providers like the Comfone, Syniverse, and Starhome.^[27] Belgacom, which provides services to the European Commission, the European Parliament and the European Council discovered the attack.^[38]

In concert with the CIA and FBI, TAO is used to intercept laptops purchased online, divert them to secret warehouses where spyware and hardware is installed, and send them on to customers.^[39] TAO has also targeted internet browsers Tor and Firefox.^[24]

According to a 2013 article in Foreign Policy, TAO has become "increasingly accomplished at its mission, thanks in part to the high-level cooperation it secretly receives from the 'big three' American telecom companies (AT&T, Verizon and Sprint), most of the large US-based Internet service providers, and many of the top computer security software manufacturers and consulting companies."^[40] A 2012 TAO budget document claims that these companies, on TAO's behest, "insert vulnerabilities into commercial encryption systems, IT systems, networks and endpoint communications devices used by targets".^[40] A number of US companies, including Cisco and Dell, have subsequently made public statements denying that they insert such back doors into their products.^[41] Microsoft provides advance warning to the NSA of vulnerabilities it knows about, before fixes or information about these vulnerabilities is available to the public; this enables TAO to execute so-called zero-day attacks.^[42] A Microsoft official who declined to be identified in the press confirmed that this is indeed the case, but said that Microsoft cannot be held responsible for how the NSA uses this advance information.^[43]

• Advanced persistent threat
• Cyberwarfare in the United States
• Equation Group
• Magic Lantern (software)
• MiniPanzer and MegaPanzer
• PLA Unit 61398
• Stuxnet
• Syrian Electronic Army
• Unit 8200
• WARRIOR PRIDE

• Inside TAO: Documents Reveal Top NSA Hacking Unit
• NSA 'hacking unit' infiltrates computers around the world – report
• NSA Tailored Access Operations
• NSA Laughs at PCs, Prefers Hacking Routers and Switches
• N.S.A. Devises Radio Pathway Into Computers
• Getting the 'Ungettable' Intelligence: An Interview with TAO's Teresa Shea