New details from the Snowden files found by the Libroot collective

More than 12 years after the start of the Snowden revelations in June 2013, there are still new details to be found in the ca. 1200 highly classified documents that have been released to the public.

The latest finds are the result of mostly technical analysis conducted by a collective called Libroot. Since December last year, they are publishing the results in a series of postings on their website.

The Libroot collective

The new results from analyzing the Snowden documents are published on the website Libroot.org, which is aimed at "spying back" at the NSA under the motto "surveillance in the crosshairs".

It's not known who are behind the Libroot website but they describe themselves as "a collective focused on exposing and resisting surveillance and oppressive digital infrastructures. We create tools, research, and archives that defend digital autonomy." Libroot works on various projects, some of which are published on their website.

One of their projects is called "Going Through Snowden Documents", for which the Libroot collective "systematically reviews each available document with particular attention to small details and information that has received little or no public attention since the initial 2013 disclosures."



Going Through Snowden Documents

So far, "Going Through Snowden Documents" resulted in seven postings, which are summarized below (when new postings appear, they will be added). The titles of these summaries link to the original postings on the Libroot website. Each of these postings is very detailed and interesting, so I highly recommend reading them in full.

Part 1: CNE analysis in XKEYSCORE (December 9, 2025)

In their first posting, the Libroot collective analyzed an NSA presentation titled CNE Analysis in XKEYSCORE from 2009. This presentation was part of a large set of slide decks about the XKEYSCORE system which were published by The Intercept in July 2015 but were never analyzed individually.

Libroot looked specifically at the screenshots shown in this presentation. This revealed evidence that the NSA hacked the computer network of the Chinese company Norinco or North Industries Corporation, which is one of the world's largest state-owned defense contractors.

Other targets of NSA hacking operations were the mail servers of the Mexican federal law enforcement agencies Secretaría de Seguridad Pública (SSP) and Policía Federal Preventiva (PFP).

Yet another screenshot included in the XKS presentation shows that NSA compromised a laptop that likely belonged to someone working in Iranian transportation or customs infrastructure.

Finally, the presentation includes some codewords which were not yet included in my extensive listing of NSA Nicknames and Codewords (but have been added now):

- GREENCHAOS: A collection source feeding CNE data into XKEYSCORE?
- SHADOWQUEST: A collection source feeding CNE data into XKEYSCORE?
- TUCKER: An exploitation framework comparable to UNITEDRAKE, with sub-projects including OLYMPUS, EXPANDINGPULLY and UNIX.
- TURBOCHASER: An NSA database for profiles and future tasking, appearing alongside MARINA.
- WAYTIDE: A collection source feeding CNE data into XKEYSCORE?

Part 2: Central and South American politics (December 11, 2025)

This analysis by the Libroot collective is about two NSA presentations about operations to intercept the communications of Brazilian president Dilma Rousseff and the Mexican presidential candidate Enrique Peña Nieto.

> See also on this weblog: An NSA eavesdropping case study

One of the slides from those presentations listed "Geopolitical Trends: Key Challenges" but was almost fully redacted when it was published. Libroot, however, was able to reconstruct the full content of that slide based upon screenshots from Brazilian television.

In this posting, Libroot also provides a full transcription of a letter from the US State Department to NSA director Keith Alexander. This letter was shown shortly on Brazilian television and only a small section had been published in Glenn Greenwald's book No Place to Hide from 2014.

Part 3: Compromised telecommunications providers (December 25, 2025)

The third analysis by Libroot is about the NSA's TREASURE MAP presentation, which was published by Der Spiegel in September 2014. The TREASURE MAP tool provides "a near real-time, interactive map of the global Internet".

Besides the networks that make up the internet, TREASURE MAP also shows in which networks NSA and GCHQ have access points. Der Spiegel had already identified some satellite and internet providers that had been compromised.

By close examination, Libroot found another 20 major telecommunications providers across three continents which appeared to have been compromised. A list of those providers is in the posting on the Libroot website.

Part 4: Intelligence facilities inside the US (January 10, 2026)

Libroot also found out that in two documents from the Snowden trove some entire sections had been deleted, presumably by people from Greenwald's media outlet The Intercept. In both cases, the deleted sections were about intelligence facilities inside the US, while information about similar facilities abroad was not redacted.

The first document is apparently from the Menwith Hill Satellite Classification Guide and was published by The Intercept in September 2016. Deleted from this document was text saying that "Classic Wizard Reporting and Testing Center" is an unclassified cover name for the Potomac Mission Ground Station (PMGS). This facility is located at the Naval Research Laboratory (NRL) in Washington DC and functions as a Mission Ground Station (MGS) for NRO surveillance satellites.

The second document is titled NRO SIGINT Guide Pine Gap and was published by The Intercept in collaboration with the Australian Broadcast Corporation (ABC) in August 2017. Deleted from this document was text saying that "Aerospace Data Facility" (ADF) is the unclassified cover name of the Consolidated Denver Mission Ground Station (CDMGS). This facility is located at Buckley Space Force Base in Aurora, Colorado, which is also home to one of the NSA's regional Cryptologic Centers.

> See also on this weblog: The NSA's regional Cryptologic Centers

Part 5: Various redaction failures (January 17, 2026)

In their fifth posting, Libroot presents some additional redaction failures which they stumbled upon by conducting forensic analysis on PDF files from the Snowden trove. These failures are not very significant or spectacular, as in general the journalists redacted the files they published quite professionally.

The redaction failures include a total of some 20 usernames of NSA employees, as well as IP and email addresses of foreign targets. The NSA usernames, or Security Identifiers (SIDs), all consist of two initials followed by the first four or five letters of someone's surname. For example, Snowden's username at the NSA was "ejsnowd".

> See also on this weblog: E-mails from inside the NSA bureaucracy

Part 6: UNAMI router configurations (April 17, 2026)

This posting is about some screenshots included in an NSA presentation titled VPN SigDev Basics, which was published by Der Spiegel in December 2014. These screenshots show the interface of the NSA's DISCOROUTE program, which is a "project to acquire, parse, database and display configuration files from network devices."

In these screenshots, Libroot noticed a search for crypto keys from routers used by the United Nations Assistance Mission for Iraq (UNAMI). According to Libroot, this strongly indicates that the NSA had collected the full configuration data of at least eleven network routers used by UNAMI.

Part 7: NSA presentation containing sensitive data (May 5, 2026)

The seventh posting by Libroot is about an NSA presentation from early or mid-2012 titled What Your Mother Never Told You About SIGDEV Analysis, which was published by Der Spiegel in December 2014 as part of a long story about internet encryption.

Libroot was able to undo almost every redaction in that presentation, which revealed the full names of at least 14 NSA employees, as well as IP addresses and names of companies and organizations that had been targeted by the agency (which Libroot didn't publish).

In the same NSA presentation is a screenshot which contains another screenshot, but so tiny that it was almost invisible. When restored to its original size, it appeared to be the NSA's internal WikiInfo page about TNS (Target Network Service).

The screenshots also contain some new NSA codewords:

- BLACKBEACH: (related to BLACKPEARL?)
- BLACKSAND: (related to BLACKPEARL?)
- DARKSUNRISE: VPN exploitation tool released in Fall 2012.
- POTLUCK: (internal NSA or IC search engine?)
- SHADOWNET: Tool for exploitation of VPN communications.*
- TROPICNET: ?

On their website, Libroot writes that their examination of all the published documents leaked by Edward Snowden "will hopefully be complete and made public in mid-to-late 2026."

Trump risked a compromise of his strike against Venezuela

(Updated: January 14, 2026)

On January 3, 2026, the United States conducted a remarkable strike against Venezuela, during which president Maduro and his wife were captured and exfiltrated to New York.

At his private residence Mar-a-Lago, US president Trump monitored this operation from a room that looks hardly secure enough to prevent adversaries from eavesdropping.

Left to right: Hegseth, Ratcliffe, Rubio and Trump at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)

Right after the strike had been absolved, Trump's team released several photos via X (formerly Twitter) and their own social media platform Truth Social. The images show how the US president and his national security team monitored the operation and the communications equipment they used.

Present were president Donald Trump, Secretary of Defense Pete Hegseth, Secretary of State Marco Rubio, CIA Director John Ratcliffe, Chairman of the Joint Chiefs of Staff general Dan Caine, White House Deputy Chief of Staff Stephen Miller, as well as some other staff members.



The communications equipment

Among the communications equipment in the photos we see a Cisco 8832 IP Conference Phone and at least two Cisco 8841 IP phones with a black box attached to their back. All these phones were modified by Advanced Programs, Inc. (API) in order to provide some TEMPEST protection and appliance to the TSG Standards.

> See also: Preventing telephone manipulation: the TSG standards

However, those technical measures are of little use when a phone is off hook or when the speakerphone is enabled and all kind of people (and antennas) can simply listen in to what is said.

Left to right: Ratcliffe, Trump and Rubio at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)

In the photo below we see Chairman of the Joint Chiefs of Staff working on a laptop which has two yellow labels and is connected with cables that are yellow as well. Yellow is the color code for the classification level Top Secret/Sensitive Compartmented Information (TS/SCI), which indicates that the device is connected to JWICS, the highly secured network for intelligence information and communication.

In another photo we can see that at his right hand, Cain also has another laptop. That one had a red label and was connected with a red cable. Red is the color code for the classification level Secret, which means that laptop was connected to the SIPRNet, which is the primary network for classified military communications.

> See also: US military and intelligence computer networks

Left to right: Caine, Ratcliffe and Hegseth at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)

On the wall behind defense secretary Hegseth is a large videoscreen. The bright green bar along the top side shows that it's connected to a military or government network for unclassified information (most likely NIPRNet). At the moment of the photo, the screen showed an internet browser with on three tabs the web interface of X and "Venezuela" typed into the search bar of the front tab.

Note that Hegseth is working on a laptop that has no color label to indicate a classification level, it has only a gray label with some bar codes. This brings to mind the situation of early last year, when Hegseth had a computer in his Pentagon office that was directly connected to the public internet so he could use the Signal app for backdoor communications with the White House.

> See also: How US defense secretary Hegseth circumvents the official DoD communications equipment

No SCIF at Mar-a-Lago?

The most remarkable thing about the meeting on January 3, is its location. According to CNN, Trump and his team met in "a discreet of the club, away from guests". The photo below shows that it was a small building with a wooden roof that looks almost like a garage or a storage room, with the area where all the highly sensitive information came in "sealed off" only by very thin black curtains:

Left to right: Ratcliffe, Trump, Rubio and Miller at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)

Normally, these kind of meetings should at least take place in a Physically Protected Space (PPS), but preferably in a Sensitive Compartmented Information Facility (SCIF). Such a SCIF can be a room, a suite of rooms or a whole building that is protected in such a way that highly classified information can be stored, processed, viewed and/or discussed without being intercepted by outsiders.



Risks at Mar-a-Lago

Already during Trump's first term as president it was noticed that there was apparently no permanent SCIF at Mar-a-Lago. When on April 6, 2017, the US conducted airstrikes against Syria, Trump and his team sat packed around a narrow table in a small side room, looking at a secured Cisco EX90 video teleconferencing screen, with on the table some devices that were never identified.

> Read more: Mysterious devices in Trump's pop-up situation room

Trump and his team of policy makers at Mar-a-Lago, April 6, 2017
(White House photo - click to enlarge)

According to Trump's press secretary at the time, the room used on April 6, 2017 was a SCIF. That wasn't very convincing because everything seemed to be hastily arranged for the occasion. At best, the room was a (temporary) Secure Working Area (SWA), which is an accredited facility "used for discussing, handling, and/or processing SCI, but where SCI will not be stored."

Mar-a-Lago isn't just Trump's private residence, but also a club resort that is open to paying members and ticketed guests, staffed by workers without the same security clearances as White House staff. Although the Secret Service screens guests before they enter, they don't determine who can access the club. All this makes the place vulnerable to infiltration and/or eavesdropping by foreign intelligence.



Precedents

By contrast, when president Barack Obama and his national security team monitored the killing of Osama bin Laden on May 1, 2011, they did so from a small room that was part of the highly secured complex of the White House Situation Room:

President Obama and his national security team watching the killing of
Osama bin Laden in the White House Situation Room, May 1, 2011.
(White House photo by Pete Souza - click to enlarge)

However, when Obama was on vacation at the Blue Heron Farm in Chilmark on the island of Martha's Vineyard, Massachusetts in August 2011, his secure and non-secure telephone equipment was installed in a living room that didn't seem very secure, with doors and windows open when calls were conducted:

> Read more: Obama on vacation

President Obama with John Brennan and some other assistents, August 26, 2011
(White House photo by Pete Souza - click to enlarge)

Much better was the situation under president George W. Bush, who had a special building on his ranch in Crawford, Texas, that was equipped as a SCIF. The space was modeled like a conference room in the White House, with comfortable chairs and all the necessary communications equipment for secure and non-secure phone calls as well as for secure video teleconferencing:

George W. Bush in the SCIF on his ranch in Texas, December 29, 2004.
(White House photo)

Links and sources
- Politico: Who was in Trump’s Mar-a-Lago war room for Maduro’s ouster
- CNN: Mar-a-Lago is a familiar place for Trump to manage high-stakes military operations
- The New York Times: C.I.A. Source Inside Venezuelan Government Helped Track Maduro
- Wikimedia Commons: Photos of Donald Trump monitoring U.S. military operations in Venezuela

AT&T's very rare Security-Plus Telephone

Since 1987, AT&T advertised a new secure telephone that operated according to the STU-III standard of the NSA. This was the Security-Plus Telephone, which is probably one of the rarest devices from the STU-III family. Already in 1992, AT&T replaced the Security-Plus Telephone by a completely different model that became more commonly used.

Advertisement from 1987 for AT&T's Security-Plus Telephone

The STU-III standard

STU-III stands for Secure Telephone Unit - Third Generation. This was a standard from the NSA for secure telephone equipment capable of encrypting voice calls (and data) up to the highest classification level.

The STU-III standard was developed from 1985 to 1986 by NSA in cooperation with the Government Electronics Group (GEG) of Motorola. In 1986, three companies were selected for the production of telephone sets based upon this standard: Motorola, RCA and AT&T.

Under the new standard, they could manufacture devices not much larger than a conventional desktop telephone set, where previous voice encryption systems, like the STU-I, required equipment as large as a small fridge.

> See also: President Reagan using a STU-II telephone

Probably the best known and most widely used STU-III telephone set was the version manufactured by Motorola and sold under the brand name SECTEL:

Motorola's STU-III SECTEL 2500 secure telephone
(photo: Crypto Museum - click to enlarge)

AT&T's Security-Plus Telephone

The first STU-III phone made by AT&T was called the "Security-Plus Telephone". There's very little information about this particular phone, but from the advertisement from 1987 we can learn that:

- It's was "the only STU-III with a 4.8 Kb/s transmission rate";
- It accomodated up to 32 crypto-ignition keys per terminal;
- The same crypto-ignition key could be used in more than one terminal;
- It had four independent key sets to handle multiple programs and security levels;
- It could handle clear as well as secure data;
- It provided a remote interface to data processing equipment.


In an advertisement from 1988 the phone is called "Security-Plus Communications Terminal" and it's emphasized that the 4.8 Kb/s transmission rate offered a better voice quality compared to STU-III devices that only had a 2.4 Kb/s data rate. However, Motorola's Sectel 1500 was also able to provide 4.8 Kb/s transmission, and even 9.6 Kb/s, ensuring a the best voice quality of all available STU-III phones.

Part of another advertisement for AT&T's Security-Plus Communications Terminal
(published in the Airforce Magazine, June 1988 - click to enlarge)

The AT&T Security-Plus phones shown in the advertisements appear to be fully black, but their actual color might have been burgundy, as suggested in an anonymous comment on this weblog from January 2013:

"There was one "version/flavor" of the US STU-III phone from AT&T that was Burgundy Red with an "R" type handset. It was the same size as the Boat Anchor / Big White Monster AT&T Security Plus STU-III with "K" handset (in Misty Cream). [...] The later AT&T/LucentTech/General Dynamic phones were white."

The AT&T Security-Plus Telephone in "Misty Cream" was/is on display in the NSA's National Cryptologic Museum (NCM), which is open for public. Some photos made by visitors provide a closer look at this very rare encryption device, which in the museum seems not to have been identified by name:

AT&T's Security-Plus Telephone on display at the National Cryptologic Museum
(photo: Flickr/Austin Mills (CC BY-SA 2.0) - click to enlarge)

AT&T's Security-Plus Telephone on display at the National Cryptologic Museum
(photo: Flickr/Austin Mills (CC BY-SA 2.0) - click to enlarge)

Another photo of the AT&T Security-Plus Telephone was posted on the Twitter-account of the National Cryptologic Museum on October 16, 2024. This photo gives a good impression of how large this phone from the STU-III family actually was:

Finally, a small drawing from an unknown source shows the basic parts and functions of the AT&T Security-Plus Telephone:

AT&T's new secure phone

In 1992, AT&T replaced its Security-Plus Telephone by a completly new STU-III phone. This telephone set had no specific name, but only a numerical designator indicating its encryption level. For example, model 1100 for Type 1 encryption, model 2100 for Type 2 encryption and model 4100 for Type 4 encryption. This made the device available for a wide range of users, ranging from US intelligence agencies to foreign customers.

AT&T's new secure telephone, here the 4100 version
(photo: Crypto Museum - click to enlarge)

This new design was less futuristic and almost similar to AT&T's series of common desktop phones for the commercial market. These became known as the MLX-series and were used in offices all over the world (see photo below). Later, these phones were sold under the newer brand names Lucent and Avaya.

While AT&T's new STU-III phone was significantly smaller than the Security-Plus Telephone, it was still larger and much heavier (ca. 3.5 kg) than the conventional office phones from the MLX series. This because the bottom part of the secure phone was made of die-cast aluminium in order to shield most of the electronic components.

A common AT&T/Lucent/Avaya MLX office phone

Some context

There's some irony in the fact that AT&T manufactured these STU-III phones for securing voice and data communications up to the highest level. Because at the same time, this company was a very close and even willing partner of the NSA when it came to intercepting (foreign) telephone and internet traffic.

> See also: FAIRVIEW: Collecting foreign intelligence inside the US

The same applies of course to the NSA itself, which on one hand develops sophisticated encryption methods and standards (like STU-III) for protecting American secrets, while on the other hand takes all efforts necessary to collect foreign communications that are of interest for US foreign policy and military operations.

The STU-III made by RCA

Somewhat surprisingly, the phone in the AT&T advertisement from 1987 looks much more like the STU-III phone that was manufactured by RCA, an American electronics company that was founded in 1919 as Radio Corporation of America. RCA's STU-III unit was the largest of the three versions (measuring ca. 34 x 31 x 13 cm), but also the one that was least commonly used.

RCA's STU-III secure telephone (photo: Crypto Museum)

A close look shows that the arrangement of the buttons on RCA's STU-III phone is a bit different from those in the AT&T advertisement, but the general design and button layout is much closer than the eventual unit sold by AT&T.

Links and sources
- Crypto Museum: STU III Third generation secure telephone unit
- Web page by Jerry Proc: STU III (Secure Telephone and KSD-64)
- Granite Island Group: Secure Communications Systems
- Wikimedia Commons: Voice encryption devices in the National Cryptologic Museum

Preventing telephone manipulation: the TSG standards

(Updated: September 10, 2025)

Telephone conversations can be intercepted by tapping cables, but the telephone set itself can also be manipulated in order to secretly turn it into a listening device. To prevent the latter, the US Telephone Security Group (TSG) published several standards to enhance the security of landline/desktop phones.