NSA Nicknames and Codewords

(Updated: September 23, 2024)

Below is a listing of almost 1400 nicknames and codewords related to US Signals Intelligence (SIGINT) and Communications Security (COMSEC). Most of them are from the National Security Agency (NSA), some are from other government or military agencies.


A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A B C D E F G H I J K L M N

O P Q R S T U V W X Y Z


> There's a separate listing of NSA's TAO Division Codewords

NICKNAMES are generally unclassified. NSA uses single word nicknames, but at other agencies they usually consist of two separate words, with the first word selected from alphabetical blocks that are assigned to different agencies by the Joint Staff. Usually, nicknames are printed using all capital letters.

CODEWORDS are always classified and always consist of a single word. Active codewords, or their three-letter abbreviations, which identify a classification compartment always need to be shown in the classification or banner line. Normally, codewords are printed using all capital letters.

It's not always clear whether we see a nickname or a codeword, but terms mentioned in public sources like job descriptions can be considered unclassified nicknames.


Similar lists are available on this website for GCHQ, CSE and BND. See also the lists of abbreviations of SIGINT and COMSEC, and general telephony and internet terms.

See also the summaries of NSA covernames compiled by Christopher Parsons.

Please keep in mind that a listing like this will always be work in progress!

(this list has been copied on some other websites and forums, but only this one is being updated frequently)





A
ABNER I - General-purpose cryptanalytic computer (delivered to the US Army's ASA in 1952) *
ACIDWASH - Covert access point for a mobile phone network in Afghanistan, part of the MYSTIC program * *
ACORN - Compartment for Top Secret COMINT information (1950-1951) *
ACCORDIAN - Type 1 Cryptographic algorithm used in a number of crypto products
AETHER - ONI tool "to correlate seemingly disparate entities and relationships, to identify networks of interest, and to detect patterns" *
AGENT LOGIC - Alerting tool, included in the RT-RG architecture *
AGILITY - Alternative document viewer to the UIS Text Presenter, ideal for viewing Windows applications (MS Office, Adobe PDF) in their native format *
AGILEVIEW - NSA internet information tool or database
AIRGAP - Database which deals with priority DoD missions, and/or for access to the public internet *
AIRHANDLER (AH) - SIGINT collection package on the PREDATOR drone, like AST-221A,* handled by NSA/CSS Georgia and JSSO Digby *
AIRSTEED - Cell phone tracking program of the Global Access Operations (GAO) *
AIRWOLF - ?
ALAMITO - The mission of Mexico at the United Nations in New York *
ALBATROSS - Soviet cipher system of the 1940s and maybe 1950s
ALPHA - Retired SIGINT Exchange Designator for Great Britain
ALTEREGO - A type of Question-Focused Dataset based on E.164
AMBERJACK - SIGINT/EW collection and exploitation system
AMBLE - Retired SIGINT product codeword
AMBULANT (AMB) - SI-ECI compartment related to the BULLRUN program
AMULETSTELLAR - Cover name for a foreign actor that engaged spearphising attacks against US targets *
ANARCHIST - Joint NSA-GCHQ program to intercept video from Israeli drones from an RAF facility on Cyprus *
ANCHORY - NSA software system which provides web access to textual intelligence documents
APALATCHEE - The EU mission in New York
APERIODIC - SI-ECI compartment related to the BULLRUN program
APEX - See Abbreviations listing
APPLE1 - Upstream collection site
APPLESAUCE - Civilian(CIA)-run station on Cyprus (1950s)
APRIL FLOWERS - SSO access capability supporting the Athens Olympics in 2004 *
APRIL STRAWBERY - Small-scale program that researched vulnerabilities in computer networks running critical infrastructure *
APSTARS - NSA tool that provides "semantic integration of data from multiple sources in support of intelligence processing" *
AQUADOR - Merchant ship tracking tool
ARCA - SIGINT Exchange Designator for ?
ARGON - The KH-5 reconaissance satellites (1961-1964) as well as a classification compartment of the defunct BYEMAN Control System (BCS).
ARGYLEALIEN - Method to cause a loss of data by exploiting zeroization of hard-drives *
ARKSTREAM - Implant used to reflash BIOS, installed by remote access or intercepted shipping
ARMADA SWEEP - Ship-based collection system for electronic communications data *
ARMOR - System related to the Predator drone *
ARTEMIS - SIGINT and Direction Finding system, probably for cell phones
ARTIFICE - Covername for a corporate partner for domestic long-distance cable access (presumably Verizon/MCI) *
ASPHALT - Software modem, increasing the volume of satellite signals *
ASPHALT-PLUS (A-PLUS) - See above
ASSOCIATION - NSA database/tool for metadata from personal communication systems (PCS), inluding GSM,* derived from FASCIA *
ATALANTA - EU anti-piracy operation
ATLAS - Cryptanalytic computer using magnetic drum storage technology, built by Engineering Research Associated (ERA, delivered to the US Navy for 1 million US dollar in 1950) *
AUNTIE - SI-ECI compartment related to the BULLRUN program
AURORAGOLD (AG) - Repository of data about international GSM/UMTS networks *
AUTO ASSOCIATION - Second party database
AUTOSOURCE - NSA tool or database
AQUACADE - A class of SIGINT spy satellites (formerly RHYOLITE)
AZUREPHOENIX - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program *

B
BABBLEQUEST - Operational speech technologies *
BACCHUS - ASA-provided electromechanical cipher equipment for South Korean forces (1953)
BADASS - (unexplained compartment) *
BADGIRL - ? *
BALLOONKNOT - TAO computer hacking project *
BAMBOOSPRING - ?
BANCROFT - KY-67 voice encryption system
BANISTER - The Columbian trade bureau in New York *
BANYAN - NSA tactical geospatial correlation database?
BANYAN - Database for (landline) telephone metadata * and/or calling-tree analysis tool which contains all FASCIA II call records *
BASECOAT - Program targeting the mobile phone network on the Bahamas (sigad: US-3310A) *
BASILHAYDEN - Joint GCSB-NSA operation (proposed) to tap communications between the Chinese consulate and its passport office in Auckland, New Zealand (GCSB codename: FROSTBITE) *
BASTE - Retired SIGINT product codeword
BATCAVE - Digital hideout for NSA hackers who emerge to steal another county's software code *
BATON - Type 1 Block cipher algorithm, used with many crypto products
BAYBRIDGE - Circuit for the exchange of metadata and analytic information * related to the NSA's European Cryptologic Center (ECC) *
BEACHMAN - Some kind of military program *
BEAMER - ?
BEGGAR SHADOW - Navy airborne SIGINT missions
BELLMASTER - Probably a user interface system, 1980s *
BELLTOPPER - NSA database *
BELLVIEW - SIGINT reporting tool; for in-depth geospatial metadata analysis *
BIGBIRD - A cable modernization effort, which began in 2004 to support a more focused, agile collection, a more cost-effective cover, and access to new higher priority cable systems; part of the FAIRVIEW/SSO broad access, focused collection strategy.*
BIGDIPPER - Billing records data flow within BR FISA collection under FAIRVIEW *
BIG LOOK - ELINT systems on Navy EC-121s to detect SAM radars (Vietnam War)
BIGOT - List of personnel cleared for access to highly sensitive information or operations
BIG RIB - airborne telemetry collection program using RB-57 aircraft based in Adana, Turkey (1965-?)
BILLYCAN III & IV - Some kind of SIGINT operations, 1980s *
BINOCULAR - Former NSA intelligence dissemination tool
BIRCHWOOD - Upstream collection site
BIRDBATH - Collection system alongside the Mexican border, with front-end sites where, among others, iDEN collection boxes were installed *
BITTERSWEET - first "advisory warning" (COMINT-provided alert) plan for airborne SIGINT missions (1952)
BLACKBOOK - ODNI tool for large-scale semantic data analysis *
BIRDWATCHER - Automated survey system *
BLACKAXE - ECI compartment *
BLACKBELT - A FAIRVIEW access * *
BLACKFOOT - The French mission at the United Nations in New York *
BLACKHAWK - Program for surveillance of the Turkish mission at the UN in New York
BLACKHEART - Collection through FBI implants *
BLACKMAGIC - Demodulation software on the SCARAB computer, used in 2001 aboard the EP-3E aircraft *
BLACKNIGHT - Filtering & Selection tool * to be replaced by COURIERSKILL *
BLACKPEARL - NSA database with SIGINT 5-tuple (TCP/IP), identified routers, routing protocols, and SIGINT access points, maybe also case notations * * *
BLACKWATCH - NSA reporting tool
BLADERUNNER - ? *
BLARNEY - Collection of foreign phone and internet communications within the US under FISA authority (since 1978) * *
BLAZING SADDLES - CSE tool? *
BLEAKINQUIRY - Metadata database of potentially exploitable VPNs *
BLUEANCHOR - Partner providing a network access point for the YACHTSHOP program
BLUEFISH (BLFH) - Compartment of the KLONDIKE control system
BLUESASH - IAD program to provide warnings of attacks on DoD networks * used by NTOC operational analysts *
BLUE SKY - Airborne COMINT program in Far East (1952-?)
BLUESMOKE - Repository containing Snort rules
BLUESNORT - TURMOIL type or site? *
BLUESTREAM - Cryptologic collection system aboard US Navy ships
BLUEZEPHYR - Sub-program of OAKSTAR
BOGART - General-purpose cryptanalytic computer from the early 1950s using transistors *
BOOKISHMUTE - NSA hacking tool or code included in the Shadow Brokers leak *
BOOTY - Retired SIGINT product codeword
BORESIGHT - New High Frequency Direction Finding system (2012) *
BORGERKING - Something related to Linux exploits *
BOUNDLESSINFORMANT - DNI and DNR metadata visualization tool *
BOURBON - Joint NSA and GCHQ program for breaking Soviet encryption codes (1946-?)*
BOXINGRUMBLE - Network attack that was countered by QUANTUMDNS *
BRAVO - Unclassified designator for the BYEMAN control system for classified information about the National Reconnaissance Office (1961-2005) *
BRAZEN - NSA access to the public internet, in 2004 replaced by OUTPARKS *
BREAKTHROUGH - Program under which 20 legacy software systems of the NSA were outsourced to private contractors, led by Computer Sciences Corp. (CSC, 1998) *
BRICKTOP - Project to learn about new malware by intercepting e-mail from several security companies (2009) *
BRIDE - Second codename for what eventually became VENONA *
BRIDGEBOUNCE - Something related to Norway *
BRODIE - Some kind of SIGINT operation, 1980s *
BROKENRECORD - NSA tool
BROADSIDE - Covert listening post in the US embassy in Moscow
BROOMSTICK - ?
BRUNEAU - The Italian embassy in Washington DC *
BRUTUS - Tool or program related to MARINA *
BUCKSHOT YANKEE - Operation to remove the computer worm Agent.btz from infected classified and unclassified DoD networks (2008-2009) *
BUFFALOGREEN - The name ORANGECRUSH was known to Polish partners *
BUGCATCHER - Internet (DNI) transit cable access under the FAIRVIEW program *
BULLDOZER - PCI bus hardware implant on intercepted shipping
BULLRUN - An NSA COI for decryption of network communications
BULLSEYE - NSG High-Frequency Direction-Finding (HF-DF) network (now called CROSSHAIR)
BYEMAN (BYE) - Retired SCI control system for overhead collection systems (1961-2005)

C
CADENCE - Tasking tool and database for internet communications; provides a transparent interface to manage dictionaries in BLACKNIGHT/SHIPMASTER, COURIERSKILL, and other site dictionary systems *
CAJABLOSSOM - Automated system for analysing and profiling internet browsing histories
CAKEBREAD - Codename for Osama bin Laden
CALIX - System used at the Waihopai satellite intercept station *
CALYPSO - Remote Collection Facilities (RCFs) for VHF radio (and SATCOM?) signals in Afghanistan *
CAMBERDADA - Project using SIGINT collection to learn about new malware *
CAMELUS - Project to relocate NSA's HF Remote Collection Facility on Okinawa *
CANDYGRAM - Laptop mimicking GSM cell tower, sends out SMS whenever registered target enters its area, for tracking and ID of targets
CANYON - Class of COMINT spy satellites (1968-1977)
CANOE - Compartment for Top Secret COMINT information (1952-1953) *
CANNON LIGHT - Counterintelligence database of the US Army
CANYONDUST - Ground based Inmarsat mobile terminal geolocation that computes geo-locations on many kinds of Inmarsat terminals within its coverage region * *
CAPRICORN - (former?) database for voice data *
CAPRI OS - Post-processing system that receives SRI files for decryption, decompression and unrar-ing of SSL/TLS and SSH network traffic *
CAPTAINCRUNCH - FBI owned and monitored network servers to attrack foreign hackers *
CARBOY - Second Party satellite intercept station at Bude, England
CARBOY II - Units of ECHELON which break down satellite links into telephone and telegraph channels
CARDAMON - Probably an XKEYSCORE site of the Australian DSD *
CARDIGAN - Some kind of SIGINT system, related to the TERMITE system, 1980s *
CARILLON - Complex of five IBM-370 (or 360, later four IBM 3033s) high performance computers strapped together at Fort Meade, for a mostly traffic analytic process (1973)
CARPAT - NSA contact chaining algorithm *
CASPORT - NSA's Corporate Authorization Service which provides authorization attributes and access controls services to NSA Enterprise programs and projects *
CASSIEOPIA - System or source providing GSM metadata from Afghanistan, processed via JUGGERNAUT *
CATALYST - Computer system capable of automatically analyzing the massive quantities of data gathered across the entire intelligence community *
CELLFINDER - Application to geolocate the locations of Base Transceiver Stations (BTS) *
CENTER ICE - Secure communications system providing TS/SI-level tipping and threat information as well as direct support to operations for tactical units of the SIGINT Seniors Europe or 14-Eyes * * *
CENTERMASS - NSA computer system
CENTRICDUD - Tool that can read and write bytes in the CMOS of a targeted Windows computer *
CERF CALL MOSES1 - Contact Event Record Format - for certain telephony metadata *
CERNET - Open Source information used for the TREASUREMAP tool *
CHALET - First codename for CHALET/VORTEX class SIGINT satellites (the codename was changed after 1979 leak)
CHALKFUN - Analytic tool, used to search the FASCIA database *
CHARGER HORSE - Communication net for afloat direct SIGINT support detachments (Vietnam War, 1969-?)
CHASEFALCON - Major program of the Global Access Operations (GAO) *
CHATTERII - Communications tool (connecting to 3rd Party agencies?)
CHEEKYMONKEY - Tool to calculate gaps in activity based upon the event from a target's selector *
CHEER - Retired SIGINT product codeword
CHENEY - Soviet cipher system, probably of the 1950s
CHEROKEE - (former) handling instruction: limited to senior officials
CHESS - Compartment of TALENT KEYHOLE for the U-2 spy plane
CHEWSTICK - NSA tool or database
CHIMNEYPOOL - Framework or specification of GENIE-compliance for hardware/software implants
CHIPPEWA - Some communications network, involving Israel *
CHUTE - Retired SIGINT product codeword
CIMBRI - Probably a metadata database *
CINEPLEX - Analytical tool *
CIRCUIT RAPTOR - System for processing data from circuit switched telephone networks *
CLARIFYMIND - Pilot program for secure wireless communications *
CLASSIC - ? (a so-called access detail)*
CLASSIC BULLSEYE - Worldwide ocean SIGINT surveillance or direction finding system (1960's-?)
CLASSIC TROLL - System that increases the probability of SIGINT intercept by 500%, supporting tactical and national requirements
CLASSIC WIZARD - Satellite ocean surveillance system for ELINT
CLEARSIGHT - Processing system related to COURIERSKILL *
CLEVERDEVICE - Upstream collection site
CLIFFSIDE (CS) - Trans-Pacific cable access site under the FAIRVIEW program * *
CLOISTER - NSA language center in College Park staffed with contractor native speakers of Russian and Eastern European languages (1960s and 70s) *
CLOUD - NSA database
CLOUD - DSP program implementing graph algorithms in a cloud computing environment *
CLOUDRUNNER - Successor for MARINA? (March 2013) *
CLOUDSHIELD - Firewall that terminates a client-side connection to a malicious server and blocks the server's response *
COASTLINE - NSA messaging system
COBALTFALCON - Sub-program of OAKSTAR
COBRA BALL - RC-135 reconaissance aircraft with a primary FISINT mission *
COBRA FOCUS - Counter-terrorism SIGINT fusion center at NSA-G, first for operations in Iraq, later expanded to other regions * *
CODHOOK - Space collection site of the Norwegian intelligence service near Fauske, Norway *
COGNOS - NSA tool or database
COLERIDGE - Soviet cipher system of the 1940s
COMFY LEVI - C-130s with roll-on SIGINT suites (1968-?)
CONTROLAND - Digital video processing system (for satellite collection?), related to NEXTGEN *
COPES - Some kind of SIGINT program, 1980s *
CORDOBA - Type 2 Cryptographic algorithm used in a number of crypto chips
COMBAT SENT - RC-135 reconaissance aircraft with a primary technical ELINT mission *
COMMONGROUND - System used at the Waihopai satellite intercept station *
COMMONVIEW - Internal NSA monitoring tool *
CONCERTO - NSA's internal personnel system, with most personnel information in HR CONCERTO and name, SSN and clearances in SECURITY CONCERTO *
CONFIRM - NSA database for personnel access
CONTRAOCTAVE - Reference database that contains phone numbers that should not be tasked in OCTAVE or UTT.* * Used to determine 'foreigness' *
CONVERSION QUEST - Part of SHAREDQUEST relating to antenna command and control *
CONVEYANCE - Voice content ingest processor *
COOKIEDOUGH - ? *
COPILOT - System that automatically scans digital data for things like language, phone and creditcard numbers and attachments *
COPPER DUNE - Operation against Al Qaida on the Arabian Peninsula (AQAP) in Yemen
COPSE - Compartment for Top Secret COMINT information (1949-1950) *
COPTINE - nATO codeword for classified (top secret) material about Western Stay-Behind Organisations (SBO) that were active during the Cold War, until approx. 1992.
CORALINE - NSA satellite intercept station at Sabena Seca at Puerto Rico (closed)
CORALREEF - Tepository of all the retrieved PSK (Pre-Shared Key) files from VPNs which can be used to decrypt the VPN traffic * *
CORONA - A series of photographic surveillance satellites (1959-1972) as well as a classification compartment of the defunct BYEMAN Control System (BCS).
CORRALCLOUD - Center of excellence for challenging SATCOM exploitation efforts headed by Yakima Research Station *
CO-TRAVELER - Set of tools for finding unknown associates of intelligence targets by tracking movements based upon cell phone locations * *
COURIERSKILL - High performance content Filtering and Selection (F&S) system for internet traffic, as well as for the WEALTHYCLUSTER 2.0 system. Designed to replace the legacy BLACKNIGHT system. COURIERSKILL is a project under the THEORYMASTER program.*
COWBOY - The DICTIONARY computer used at the Yakima station of ECHELON *
COWBOY - FISA authorized collection under the FAIRVIEW program (sigad: US-984T) *
CRAFTY SHACK - Analytics documentation *
CRANKSHAFT - Codename for Osama bin Laden
CREAM - Compartment for Top Secret COMINT information (1946-1947) *
CREDIBLE - Transport of intelligence materials to partner agencies
CREST - Database that automatically translates foreign language intercepts in English *
CRISSCROSS - Database of telecommunications selectors, operated by the CIA and also used by DOJ, DOD and NSA
CROSSBEAM - GSM module mating commercial Motorola cell with WagonBed controller board for collecting voice data content via GPRS (web), circuit-switched data, data over voice, and DTMF to secure facility, implanted cell tower switch
CROSSEYEDBEAR - FAIRVIEW support to TAO shaping operations under EO 12333 *
CROSSHAIR - Multinational High-Frequency Direction-Finding (HF-DF) network (formerly BULLSEYE)
CROWNROYAL - ? *
CRUMPET - Covert network with printer, server and desktop nodes
CRUSHED ICE - Secure network for sharing data and information among the members of the SIGINT Seniors Pacific (SSPAC) *
CULTWEAVE - Smaller size SIGINT database *
CULTWEAVE II - Database for VOICESAIL metadata *
CYBERCLOUD - Cloud platform that produces analytic results from all incoming data sources *
CYBERCOP - Cyber attack visualisation tool
CYBERQUEST (CQ) - Cyber threat discovery mission? (since 2008)*
CYBERTRANS - A common interface to a number of underlying machine translation systems *
CYCLONE Hx9 - Base station router, network in a box using Typhon interface
CYR - Intelligence exchange agreement between DIA and the Israeli military intelligence directorate (1968) *

D
DAFF - Codeword for products of satellite imagery
DAMEON - Remote SATCOM collection facility
DANCEHALL - Internal database for job vacancies * or, officially, the Signals Intelligence Directorate's Mission Readiness Database *
DANCER - Project initiated in 1965 to employ South Vietnamese as linguists in US SIGINT operations
DANCINGOASIS (DGO) - SSO program collecting data from fiber optic cables between Europe and the Far East (since 2011) *
DANDERSPRITZ - Software tool that spoofs IP and MAC addresses, intermediate redirector node
DANGERMOUSE - Tactical SIGINT collecting system for like cell phone calls
DARDANUS - Remote SATCOM collection facility
DARKQUEST (DQ) - Automated FORNSAT survey system * that can for example identify the presence of a VPN *; part of SHAREDQUEST *
DARKTHUNDER - FAIRVIEW support to TAO shaping operations under EO 12333 *
DATAWAVE - Ingest and query framework for large scale computer clusters
DAUNT - Compartment for Top Secret COMINT information (1959-1960) *
DAYSEND - Program at NSA's communications complex receiving intercepts files (1973)
DEADSEA - 4th party computer network exploitation effort *
DECKPIN - NSA crisis cell activated during emergencies
DECODEORDAIN - Query tool for e-mail messages contained in PINWALE *
DEEPDIVE - XKEYSCORE version that can process internet traffic at data rates of 10 gigabit per second *
DEEPSKY - Overhead Collection processing system *
DELLA - Special-purpose cryptanalytic computer machine from the early 1950s *
DELTA - Former SCI control system for intercepts from Soviet military operations
DEMONSPIT - Dataflow for bulk telephony metadata acquired from major Pakistani telecom providers *
DENIM - Retired SIGINT product codeword
DEPUTYDAWG - ? *
DESOTO - Processing system related to FAIRVIEW Transit collection under FAA 704 & 705b *
DESPERADO - NSA software tool to prepare reports
DEVILFISH - ECI compartment *
DEVILHOUND - ? *
DEWSWEEPER - Technique to tap USB hardware hosts *
DIANA - ASA-provided one-time-pad system for South Korean forces (1953)
DIKTER - SIGINT Exchange Designator for Norway
DINAR - Compartment for Top Secret COMINT information (1961-1965) *
DIONYSUS - Remote SATCOM collection facility
DIRESCALLOP - Method to circumvent commercial products that prevent malicious software from making changes to a computer system
DIRTSHED - 4th party collection program *
DISCOROUTE - NAC/GCHQ repository for router configuration files from CNE and passive SIGINT, like for example telnet sessions * *
DISHFIRE - Storage and retrieval system for text messages (SMS), offering retrieval, viewing, and some manipulation of SMS messages passed through various worldwide networks (still mentioned early 2020).*
DISPATCHER - A system that provides operators a means to report hardware problems to maintenance, 1980s *
DISTANTFOCUS - A pod for tactical SIGINT and precision geolocation (since 2005) *
DISTILLERY - Tactical collection system(?) *
DISTILLERY - Stream-based platform for executing hacking identification applications *
DIVERSITY - SIGINT Exchange Designator for ?
DOBIE - The South African consulate and mission at the UN in New York *
DOGCOLLAR - A type of Question-Focussed Dataset based on the Facebook display name cookie
DOGHUT - Upstream collection site
DORIAN - Classified designation for the reconnaissance mission (1966) and equipment of the experimental Manned Orbiting Laboratory (MOL), part of the defunct BYEMAN Control System (BCS).
DOUBLEARROW - One of NSA's voice processing databases? *
DOUBLE PLUS - A probably defunct classification compartment or dissemination marking (used by the White House in the 1970s)
DOUBLETALK - A PCMA technology used by SATCOM carriers such as AST and ViaSat *
DRAGGABLEKITTEN - An XKEYSCORE Map/Reduce analytic *
Dragon TAMERS - Operational test bed for RT-RG tools *
DRAWSTRING - Project to "remote" more intercept facilities because of budget cuts (1973-?)
DREADNOUGHT - NSA operation focused on Ayatollah Khamenei *
DROPOUT - Phase I Collection/Processing System (AN/FRR-102), 1980s *
DRTBOX - System for processing data from mobile communication networks
DRUG - Third codename for what eventually became VENONA *
DRUID - SIGINT Exchange Designator for third party countries
DRYAD - A US military numeral cipher/authentication system
DRYTORTUGAS - Analytic tool
DUALTIRE - System used at the Waihopai satellite intercept station *
DUSKPALLET - SSO interception program for GSM networks in Kenya (US-3270), part of the MYSTIC program *
DYNAMO - SIGINT Exchange Designator for Denmark
DYNO - Classifed codename for the Galactic Radiation And Background (GRAB) Low-Earth Orbit ELINT satellite (1960-1962 launches)

E
EAGLE - Upstream collection site under the FAIRVIEW program *
EAGLEVIEW - Data processing tool for GSM cellular networks, successor of PILOTHOUSE *
EARPOP - Former NSA/NRO compartment that apparently protected information related to satellite "overhead" collection systems in the 1960s and 1970s * *
EASYCHAIR (EC) - CIA research project for developing resonant cavity covert listening devices (bugs)
ECHELON - Sub-program of FROSTING directed against INTELSAT satellites * *
ECHIDNA - System or source providing GSM metadata from Afghanistan, processed via JUGGERNAUT *
ECHO - SIGINT Exchange Designator for Australia
ECHOBASE - SIGINT analytics architecture that includes GHOSTMACHINE and Identifier Scoreboard *
ECRU (EU) - Compartment of the ENDSEAL control system
EDEN - Upstream collection site under the FAIRVIEW program, maybe in New York City *
EIDER - Compartment for Top Secret COMINT information (1955-1959) *
EIKANOL (or: EIKONAL) - Joint NSA-BND operation to tap a fiber-optic cable of Deutsche Telekom in Frankfurt, part of the RAMPART-A program
EINSTEIN - Cell phone network intercepting equipment used by SCS units
EINSTEIN - Intrusion detection system for US government network gateways (deployed in 2004)
EINSTEIN 2 - Second version of the EINSTEIN program for detecting malicious network activity
EINSTEIN 3 - Third version of the EINSTEIN program that will monitor government computer traffic on private sector sites too *
ELEGANTCHAOS - Large scale FORNSAT data analysis system *
ELIXIR - An automated morse processing system, 1980s *
EMERALD - Alternate codename for operation WHARPDRIVE(?) *
ENDSEAL (EL) - SCI control system
ENDUE - A COI for sensitive decrypts of the BULLRUN program
ENTOURAGE - Directional finder for line of bearing for GSM, UMTS, CDMA, FRS signals, works with NEBULA active interrogator within GALAXY program
EPICFAIL - *
EPICSHELTER - Data backup system to recover information from particular NSA sites, designed by Edward Snowden * *
EQUATION (Group) - Nickname given by Kaspersky to a highly advanced computer hacking group, suspected of being tied to NSA *
ETCHINGSPIN - SSO mobile telephone interception program, part of the MYSTIC program *
EVENINGEASEL - Program for surveillance of phone and text communications from Mexico's cell phone network (sigad: US-3411), part of the MYSTIC program *
EVILOLIVE - Iinternet geolocation tool
EVOLVED MUTANT BROTH - Second party database
EXPLETIVEDELETED - Cover name for al Qaeda's favorite encryption software *
EXPLORER I/II/III - Intercept operations using unmaned equipment on hilltops during the Vietnam War (1970-1972)
EXUBERANTCORPSE - Cover name for al Qaeda's favorite encryption software *
EYESPY - System that scans data for logos of companies, political parties and other organizations, as well for pictures with faces for facial recognition *

F
FACELIFT - Codeword related to NSA's Special Source Operations division *
FACTOR - NSA program targeting North Vietnamese maritime infiltration (1970-?)
FAIRVIEW - Domestic cable tapping program in cooperation with AT&T (since 1985 - Dataflow diagrams) * *
FAIRVIEWCOTS - System for processing telephony metadata collected under the FAIRVIEW program *
FALLENORACLE - NSA tool or database
FALLOUT - DNI metadata ingest processor/database *
FALLOWHAUNT (FH) - FORNSAT architecture for intercepting mobile satellite services (VSAT) used at Misawa, Waihopai and other stations, part of SHAREDQUEST * * *
FARLEY - (SIGINT exchange designator?)
FARMER - Projected general-purpose computer for both cryptanalysis and traffic analysis (1950s)
FARNDALE - ? *
FASCIA - DNR (telephony) metadata ingest processor/database * *
FASCIA II - Primary source of telephone metadata for target development. The FASCIA II data warehouse contains PSTN, PCS, Media Over IP (MOIP), High Powered Cordless Phone (HPCP) Call Detail Records, ISAT, and VSAT contact events. FASCIA data are accessed by BANYAN, ASSOCIATION, MAINWAY, HOMEBASE and SEDB. It formerly contained internet metadata which are now in MARINA.* *
FASCINATOR - Series of Type 1 encryption modules for Motorola digital-capable voice radios
FASTBAT - Telephony related database?
FASTFOLLOWER - Tool to identify foreign agents who might tail American case officers overseas by correlating cellphone signals
FASTSCOPE (FS) - NSA database for flight lists and manifests, including passenger names * (still mentioned early 2020)
FIFTYEXCLAIM - Cover term representing NSA's contract with Computer Sciences Corporation (CSC) for mission support in Bad Aibling, Germany *
FENESTRA - System that processes (decompression) circuit-switched communications (from satellite collection?) *
FIRE ANT - Open Source visualisation tool
FIREBIRD - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program *
FIREFLY - NSA key generation scheme, used for exchanging EKMS public keys
FIRETRUCK - SIGINT tool or database
FIRSTFRUITS - Counterintelligence database to track unauthorized disclosures to the press, set up in 2001 * * *
FISHBOWL - NSA program for securing commercial smartphones
FISHWAY - Data batching & distribution system used for FAIRVIEW and BLARNEY collection * *
FISHWORK - A SIGINT project installed at an undisclosed location, 1980s *
FLAMINGO - Antenna installation (2004) *
FLARE - Retired SIGINT product codeword
FLATLIQUID - TAO operation against the office of the Mexican president *
FLEMING - The embassy of Slovakia in Washington DC *
FLINTLOCK - The DICTIONARY computer used at the Waihopai station of ECHELON *
FLOWBEE - Project of NSA's Research Directorate for reducing the volumes of metadata collected from high-speed links (2008) *
FLOWERGARDEN - Front-end collection system for satellite interception by the Norwegian intelligence service, part of VICTORYGARDEN *
FLUTE - System used at the Waihopai satellite intercept station *
FLYLEAF - ECI compartment *
FOGYNULL - DNT exfiltration protocol *
FOREJUDGE - General PROFORMA information/descriptions *
FOREMAN - Tactical SIGINT database? Used to determine 'foreigness' *
FOURSCORE - (former?) database for fax and internet data *
FOURSCORE - Repository for tasked, full-take, PPTP VPN network traffic collection *
FOXAMI - (SIGINT exchange designator?)
FOXTRAIL - NSA tool or database *
FREEFLOW-compliant - Supported by TURBULENCE architecture
FREEWAY - A major west coast IP backbone access *
FRESNELEFFECT - System used at the Waihopai satellite intercept station *
FRETTING YETI - Mobile gateway identification analytic *
FRIAR - Cable station of AT&T at the East coast under the FAIRVIEW program * *
FRIARTUCK - VPN Events tool or database (CSEC?)
FRONTO - Retired SIGINT Exchange Designator for ?
FROSTBITE - GCSB codename for operation BASILHAYDEN
FROSTBURG - Connection Machine 5 (CM-5) supercomputer, used by NSA from 1991-1997
FROSTING - Umbrella program for collecting and processing emanations from communication satellites (est. 1966)*
FROTH - Compartment for Top Secret COMINT information (1953-1954) *
FUNNELAPS - DNT exfiltration data format *
FURIOUS CHAINSAW - Graph analysis tool which enables contact chaining and other analytics *

G
GALACTICHALO - Remote SATCOM collection facility
GALAXY - Find/fix/finish program of locating signal-emitting devices of targets
GALLANT PHOENIX - Joint operation of 22 countries, led by JSOC from Jordan, for gathering intelligence about ISIS fighters in Syria and Iraq *
GALLOWAY - System related to the Predator drone *
GAMBIT - The KH-7 reconaissance satellite (1963-1967) as well as a classification compartment of the defunct BYEMAN Control System (BCS).
GAMBIT - Prototype web portal for the AMOD (Analytical Modernization) QFD (Question Focused Dataset) strategy (2011)
GAMBIT - Internal version of Stackoverflow *
GAMIRA - Overhead Collection processing system *
GAMMA (G) - Compartment for highly sensitive communication intercepts
GAMUT - NSA collection tasking tool or database
GANDER - Target development or reporting tool (mentioned early 2020)
GARLICK - The NSA satellite intercept station at Bad Aibling (Germany)
GATEKEEP - Processing system for internet cable tapping *
GATEKEEPER - User account management system to apply for and maintain access to many NSA Databases *
GAVEL - Retired SIGINT product codeword
GEMINI - Remote SATCOM collection facility
GEMINI - DIA intelligence portal for access to GEOINT database(s)
GENESIS - Filtering tool for internet communications, related to XKEYSCORE
GENESIS - Modified GSM handset for covert network surveys, recording of RF spectrum use, and handset geolocation based on software defined radio
GENIE - Overall close-access program, collection by Sigads US-3136 and US-3137 * *
GEO-T - An RT-RG tool that allows the analyst to watch targets of interest in near real time and visually dispalys tem in a geospatial environment *
GHOSTHUNTER (GH) - System to geolocate targets when they log onto the internet, for example through VSAT or internet cafes (since 2006) *
GHOSTMACHINE (GM) - NSA's cloud analytics platform
GHOSTWOLF - Project to capture or eliminate key nodes in terrorist networks through actionable geolocation intelligence * also related to CT10 *
GIGGLELOOP - Internal file sharing tool on NSANet *
GINPENNANT - SSG cloud framework *
GILGAMESH (GMESH) - Predator-based NSA geolocation system used by JSOC *
GISTQUEUE (GQ) - NSA tipping and reporting database
GJALLER - NSA tool or database
GLAIVE - (Satellite) interception common architecture *
GLINT - Compartment for Top Secret COMINT information (1947-1949) *
GLOBALBROKER - NSA tool or database
GLOBALREACH - Tool for federated querying metadata records shared by NSA and its Five Eyes partners *
GLOBALTIPPER (GT) - System for internal requests of information *
GLOBALVISION - Single sign-on federated query tool (since 2005) *
GLOBALWATCH - Software suite within the Real Time Regional Gateway (RT-RG)
GLOMAR - "neither confirm nor deny" a response to a FOIA request
GLOWING SYMPHONY - US Cyber Command operation to disrupt and deny ISIL internet usage (2016)
gmALAMO - GHOSTMACHINE cloud computing system at NSA Texas
gmAPPLE - GHOSTMACHINE cloud computing system in Yakima
gmBALTIC - GHOSTMACHINE cloud computing system at NSA headquarters
gmCALM - GHOSTMACHINE cloud computing system at Camp Humphreys in South Korea
gmCARBON - GHOSTMACHINE cloud computing system at NSA headquarters
gmCAVE - GHOSTMACHINE cloud computing system in Utah
gmDEN - GHOSTMACHINE cloud computing system at NSA Colorado (ADF-C)
gmGEIST - GHOSTMACHINE cloud computing system in Germany
gmGULF - GHOSTMACHINE cloud computing system at NIOC-Bahrein (planned in 2011)
gmHALO - GHOSTMACHINE cloud computing system at NSA headquarters *
gmIDEA - GHOSTMACHINE cloud computing system at Camp Victory in Iraq
GMLEARN - Cloud-related tool (mentioned early 2020)
gmLIGHT - GHOSTMACHINE cloud computing system at NSA headquarters
gmMATE - GHOSTMACHINE cloud computing system in Alice Springs, Australia
gmMOUNT - GHOSTMACHINE cloud computing system in ?
gmPAC - GHOSTMACHINE cloud computing system at Misawa AFB in Japan
gmPARK - GHOSTMACHINE cloud computing system at NSA headquarters
gmPEACH - GHOSTMACHINE cloud computing system in Utah
gmPEN - GHOSTMACHINE cloud computing system in South Korea
gmPLACE - GHOSTMACHINE cloud computing system at NSA headquarters *
gmREGAL - GHOSTMACHINE cloud computing system at Menwith Hill in the UK
gmROYAL - GHOSTMACHINE cloud computing system at Menwith Hill in the UK
gmSEMINOLE - GHOSTMACHINE cloud computing system at NSA Georgia (planned in 2011)
gmTOTE - GHOSTMACHINE cloud computing system in Bagram, Afghanistan
gmZILLA - GHOSTMACHINE cloud computing system in Kabul, Afghanistan (planned in 2011)
GNOMEVISION - De-obfuscation of malicious packages, upgrade of the TUTELAGE system *
GODLIKELESION - Modernization program for NSA's European Technical Center (ETC) in Wiesbaden in 2011 *
GODSURGE - Runs on FLUXBABBITT circuit board to provide software persistence by exploiting JTAG debugging interface of server processors, requires interdiction and removal of motherboard of JTAG scan chain reconnection
GoGadget - Displays analytic results from CYBERCLOUD and detailed metadata for analysts
GOLDBERG - First magnetic drum storage technology (1947)
GOLDENCARRIAGE - NSA corporate servers, used by the AURORAGOLD application *
GOLDENRETRIEVER - Storage and/or distribution system *
GOLDMINER - Dimensional database for DNI, DNR and other data, part of the RT10 and RT-RG architecture **
GOLDPOINT 2 - Database to update and maintain the NSA/CSS master list of SIGADs and PDDGs (since 2005) *
GOLLUM - Computer implant created by a partner agency *
GOPHERRAGE - Pilot project that seeks to develop a hypervisor implant to provide implant capabilites and a back door *
GOSSAMER - SIGINT/EW collection and exploitation system
GOTHAM - Processor for external monitor recreating target monitor from red video
GOURMETTROUGH - Configurable implant for Juniper NetScreen firewalls including SSG type, minimal beaconing
GOUT - Subcompartment of GAMMA for intercepts of South Vietnamese government communications
GOVPORT - US government user authentication service
GRAB - Galactic Radiation and Background, cover name for a series of ELINT satellites as well as a classification compartment of the defunct BYEMAN Control System (BCS).
GRANDMASTER - Processing system for internet traffic, has been replaced by WEALTHYCLUSTER and TURMOIL *
GRAPEVINE - NSA tool (mentioned early 2020)
Graph-In-Memory - Database holding maps of contacts in support of contact-chaining *
GREENGARDEN - FLOWERGARDEN collection processing, part of VICTORYGARDEN *
GREENWAY - Program under which non-mission IT infrastructure is outsourced to private sector companies (since 2015), successor of the GROUNDBREAKER program *
GREY FOX - The 2003 covername of the Mission Support Activity (MSA) of JSOC
GREY GHOST - SIGINT Seniors Europe (SSEUR) conference in June 2013 *
GRIMPLATE - Tool for identifying adversarial use of BitTorrent *
GRIZZLY STEPPE - Russian malicious cyber activities related to the 2016 US presidential elections
GROUNDBREAKER - Program to outsource the NSA's non-mission IT infrastructure to private sector companies (2001-2014); succeeded by the GREENWAY program * * *
GROUPDIVE - Network used by NTOC operational analysts *
GUARDRAIL I / II / IV / V - Series of Army airborne SIGINT collection systems on RC-12 aircraft
GUNMAN - NSA 1984 OPSEC project to remove 11 tons of electronic devices from the US Embassy of Moscow for thorough inspection in the US. GUNMAN eventually found KGB bugs planted into electric typewriters.
GUPY - Subcompartment of GAMMA for intercepts from Soviet leadership car phones (1960's-70's)

H
HAIRBALL - Project of NSA's Research Directorate (2008) *
HAMMOCK - Direct SIGINT support process for US Air Force missions over North Vietnam (1965-?)
HANDLESS - Collection program for internet data *
HAPPYFOOT - Program that intercepts traffic generated by mobile apps that send a smartphone’s location to advertising networks
HARBORVIEW - (a so-called access detail)*
HARD ASSOCIATION - Second party database
HARMONY - DoD national database for DOCEX information, run by the NGIC
HARVAN - A probably defunct classification compartment or dissemination marking (used by the White House in the 1970s)
HARVEST - A supercomputer, built by IBM for nearly 10 million US dollar and used by NSA from 1962-1976 *
HAVASU - International call detail records collection under FAIRVIEW *
HAVE BLUE - Development program of the F-117A Stealth fighter-bomber
HAVE QUICK (HQ) - Frequency-hopping system protecting military UHF radio traffic
HAWKEYE - AFSS project for an airborne direction-finding system; never operational (1963)
HAYMAKER - Operation against Al Qaida in Afghistan *
HEADRESS NU - Very high priority project targeting a Pakistan government/military secure network *
Heartbeat - Apparently a data handler system, built by Edward Snowden* and/or successor of EPICSHELTER, or an index of surveillance systems * *
HEMISPHERE - Program under which AT&T provides telephone records to the DEA
HEMLOCK - The Italian embassy in Washington DC *
HERETIC - NSA tool or database
HERESYITCH - UC collateral tool, collaborative program between NSA units T1222 and SSG *
HERMOS - Joint venture between the German BND and another country with access for NSA (2012)*
HERON - Retired SIGINT product codeword
HEXAGON - The KH-9 ("Big Bird") photographic reconaissance satellites (1971-1986) as well as a classification compartment of the defunct BYEMAN Control System (BCS).
HIDDENSALAMANDER (HS) - Subsystem of TURMOIL to identify events associated with botnet activities *
HIGHCASTLE - Tactical database?
HIGHDECIBEL - Local Area Network (LAN) for the FAIRVIEW and BLARNEY programs *
HIGHLANDS - Technique for close access collection from computer implants *
HIGH PRIDE - ? *
HIGHTIDE - NSA tool or database
HOBGOBLIN - NSA tool or database
HOLLOWPOINT - Software defined radio plaform
HOMEBASE - Database which allows analysts to coordinate tasking with DNI mission priorities, and/or reporting on targets, since 2005 accessible through GLOBALVISION *
HOMEMAKER - Upstream collection site
HOMING PIGEON - Tool for correlating GSM handsets from airplane passengers to subscribers * *
HOTZONE - Voice collection system, equivalent of GCHQ's ROSECROSS system *
HUB - Part of the internal Tradecraft ECOsystem *
HYPERWIDE - A frequency hopper, component of the SNOWFLAKE system *
HYSON - Retired SIGINT product codeword
HYSSOP - ECI compartment *

I
ICEBERG - Major NSA backbone project *
ICE CASTLE - Intelligence exchange agreement between DIA and the Israeli military intelligence directorate (1988) *
ICREACH - Tool for sharing communications metadata among the US Intelligence Community (since 2007)*
IDITAROD (IDIT) - Compartment of the KLONDIKE control system
IGLOO WHITE - Program for detecting movement of vehicles through unattended ground sensors, tested in Laos from 1968-1973
INCENSER - Joint NSA-GCHQ program for tapping an internet cable between Europe and Asia with the help of Cable & Wireless; part of the WINDSTOP program
INDEX - Team at Menwith Hill Station (MHS) *
INDIA - SIGINT Exchange Designator for New Zealand (retired)
INDRA - Satellite intercept station near Khon Khaen, Thailand (1979-ca. 2000)
INTERQUAKE (IQ) - A terrestrial signals knowledge base and interface *
INTOLERANT - Data set stolen by hackers, discovered and exploited by CSEC and Menwith Hill Station since 2010 *
INTREPID SPEAR - The 2009 covername of the Mission Support Activity (MSA) of JSOC
INTRUDER - Series of ELINT and COMINT spy satellites (since 2009)
IRISHBEAUTY - the Unified Targeting Tool (UTT) *
IRON HORSE - NSA equipment to display intercepted morse grid-positions on a radar scope (1967-?)
IRONSAND (IS) - Second Party satellite intercept station at Waihopai, New Zealand
IRONSHORE - Project including the Joint Regional Security Stacks (JRSS) and a Big Data Platform on AWS GovCloud (2016)
IRRITANT HORN - Five Eyes pilot project for hacking target's phone connections to app stores in order to implant spyware *
ISHTAR - SIGINT Exchange Designator for Japan (retired)
ISLANDTRANSPORT (IT) - Internal data distribution system, also used for QUANTUM * *
IVORY - Retired SIGINT product codeword
IVY BELLS - NSA, CIA and Navy operation to place wire taps on Soviet underwater communication cables

J
JACKHAMMER - System used at the Waihopai satellite intercept station *
JACKKNIFE - The NSA satellite intercept station at Yakima (US)
JACKPOT - Internal NSA process improvement program (early 1990s - early 2000s) *
JADE - First codename for what eventually became VENONA *
JAEGER - Former SIGINT Exchange Designator for Austria
JEMA - (see Abbreviations listing)
JEWETT II - SIGINT collection system with a remote collection facility and an operations facility with a computer controlled collection console, 1980s *
JOSEKI-1 - Classified Suite A algorithm
JOURNEYMAN - Umbrella program for transforming the way SIGINT analysts can write and disseminate their reports *
JUBILEECORONA - NSA unit *
JUGGERNAUT (JUG) - Ingest system that processes intercepted calls from mobile phone networks * *
JUGGLER - Collection program for internet data *
JUKEBOX - Status reports, 1980s *
JUMPDOLLAR - Tool to support various file systems *
JUMPSEAT - Class of SIGINT reconnaissance satellites (1971-1983)
JUNE - FBI classification marking for information related to unwarranted electronic surveillance and surreptitious entries * JUNIORMINT - Implant digital core, either mini printed circuit board or ultra-mini Flip Chip Module, contains ARM9 micro-controller, FPGA Flash SDRAM and DDR2 memories
JUPITER GARRET - Operation against Al Qaida in East Africa (EA) in Somalia



NSA codenames used under the SPINALTAP program for
combining data from active hacking operations
and passive signals intelligence collection.

K
KAMPUS - SIGINT Exchange Designator for South Korea (retired) *
KANDIK (KAND) - Compartment of the KLONDIKE control system
KARMA POLICE - Second party database
KARUS - System or source providing GSM metadata from Afghanistan, processed via JUGGERNAUT *
KATEEL - The Brazilian embassy in Washington *
KEA - Asymmetric-key Type 2 algorithm used in products like Fortezza, Fortezza Plus
KEELSON - Internet metadata processing system *
KESSELRUN - ECI compartment *
KEYCARD - Premier target-based Filtering and Selection database; integral part of the TURMOIL collection system and a member of the TURBULENCE suite of tools. Interfaces are the UTT, OCTAVE and the KEYCARD GUI.* (still mentioned early 2020)
KEYRUT - Retired SIGINT Exchange Designator for ?
KEYSTONE - Collection program for internet data *
KEYSTONE II - Status reports, 1980s *
KILOMISER - System used at the Waihopai satellite intercept station *
KILTING - ELINT database
KIMBO - Retired SIGINT product codeword (used in 1964)
KIRKBOMB - Windows kernel examination to detect loaded drivers and processes *
KITTYBINGE - Processing system for intercepting foreign Lawful Intercept systems *
KLIEGLIGHT (KL) - Reporting vehicle used to forward time-sensitive SIGINT technical information to NSOC, SIGINT producers and Cryptologic Support Groups *
KLONDIKE (KDK) - Control system for sensitive geospatial intelligence
KLONDIKE - The embassy of Greece in Washington DC *
KNIGHTHAWK - Probably a military SIGINT tool
KNOBSTICK - An antenna designed to receive LVHF signals in various parts of the world, 1980s *
KOBAYASHIMARU - NSA contract with General Dynamics to help break into another country's surveillance equipment *
KODA - Method for summarizing very large textual data sets
KOZYKOVE (KK) - A FAIRVIEW site *
KRAUSS - System used at the Waihopai satellite intercept station *
KRONE - Retired SIGINT product codeword

L
LACEBARK - NSA project to upgrade South Vietnamese SIGINT communications security
LACONIC (LAC) - Retired NSA dissemination control marking
LADYLOVE - The NSA satellite intercept station at Misawa, Japan (since 1982)
LAMPSHADE - Some kind of INMARSAT data *
LANYARD - The KH-6 reconaissance satellites (1963) as well as a classification compartment of the defunct BYEMAN Control System (BCS).
LARUM - Retired SIGINT product codeword
LATEN(T)TH(R)EAT - System that breaks intercepted satellite signals down into individual communications *
LAUNDROMAT - Accesses to yet unknown sources, similar to DUSKPALLET *
LAYERCAKE - Tool to find geospatial overlap of a set of targets *
LEAKYFAUCET - Flow repository of 802.11 WiFi IP addresses and clients via STUN data *
LEAVE BEHIND - VHF radio signal collection platform *
LEGALEAGLE - NSA's corporate query review system * *
LEGALREPTILE - System that collects text message and call metadata, showing who is contacting whom and when *
LEMONWOOD - NSA satellite intercept station in Thailand
LEXHOUND - CCE Extraction Architecture * and/or Front-end tool that performs Google-like searching across repositories *
LIBERTY - First word of nicknames for collection and analysis programs used by JSOC and other sensitive DOD activities *
LIBERTY BLUE - Modified RC-12 Guardrail surveillance airplane used by JSOC's Mission Support Activity (MSA)
LIGHTNING - Research project into a "1,000 megahertz" computer. Didn't produce a functional computer but pioneered many technology "bricks" (1950s)
LIGHTNINGTHIEF - ECI compartment *
LIGHTSHIP - SIGINT site, 1980s *
LILDIPPER - Billing records data flow within BR FISA collection under FAIRVIEW *
LIONHEART - Traditional search tool for the PINWALE database, searching both content and metadata *
LIONHEART Fusion - Search engine for the PINWALE database, which searches the most recent 13 months *
LIONROAR - Search engine for the PINWALE database, which searches between 13 months and 5 years back *
LIONSHARE - Internal NSA process improvement program (2003-2008) *
LITHIUM - Covername for a corporate partner for domestic long-distance cable access under the BLARNEY program (presumably AT&T) * **
LITTLE CLOUD - Airborne collection program using RB-57 aircraft based in Pakistan (1963-1965?)
LOCATOR - Some kind of NSA database *
LODESTAR - Cryptanalytic computer subcomplex at NSA headquarters (1978)
LODESTONE - NSA's CRAY-1 supercomputer
LOGGERHEAD - Device to collect contents of analog cell phone calls (made by Harris Corp.) *
LOLLYGAG - SSO mobile telephone interception program, part of the MYSTIC program *
LOMA - SCI control system for Foreign Instrumentation and Signature Intelligence* *
LONGFELLOW - Soviet cipher system of the 1940s
LOPERS - Dialed Number Recognition (DNR) system providing filtering, selection, and metadata extraction for intercepted telephony traffic from the Public Switched Telephone Network (PSTN), GSM, CDMA, and UMTS Core networks, or in between the PSTN and a Core network.* * Also used by 2nd and 3rd party partners.* (still mentioned early 2020)
LUMBERYARD - FAIRVIEW (satisfying POC with NTOC for anomaly detection/situational awareness) *
LUNCHBOX - Unclassified nickname for a Navy system to process 40 worldwide PROFORMA signals, which also contains electronic media documentation pertaining to many of those signals; used in 2001 aboard the EP-3E surveillance aircraft *
LUSTRE - Memorandum of Understanding regarding the exchange of data between the NSA and the French foreign intelligence service DSGE (2011/12) *
LYCANTHROPE - Collection system providing data feeds to the RT-RG architecture *

M

MALLARD - Joint NSA-DFS foreign satellite intercept station at Tachiarai in Japan for traditional SIGINT collection and SIGINT-enabled cyber collection * *
MAROON ARCHER - Some kind of military program started in 1979 *
MACHINESHOP - ? *
MADCAPOCELOT - Sub-program of STORMBREW for collection of internet metadata about Russia and European terrorism
MAESTRO-II - Mini digital core implant, standard TAO implant architecture
MAGIC - Codeword for decrypted high-level diplomatic Nazi messages
MAGIC LANTERN - A keystroke logging software developed by the FBI
MAGNES - Remote SATCOM collection facility
MAGNUM - Series of SIGINT spy satellites (since 1985)
MAGNUMOPUS - TAO computer hacking project *
MAGOTHY - The embassy of the European Union in Washington DC *
MAILORDER - FTP-based file transport system used to move data between various collection, processing and selection management systems. Originally developed in 1990, ultimately to be replaced by JDTS * *
MAIN CORE - Federal database of personal and financial data of suspicious US citizens
MAINWAY (MW) - NSA's main contact chaining system for foreign and domestic telephone and internet metadata from multiple sources; performs data quality, preparation and sorting functions, summarizes contacts and stores the resulting one-hop contact chains * *
MALLARD - Japanese foreign satellite interception station in Tachiarai, operated jointly by NSA and the Japanese Directorate for SIGINT (DFS) *
MANASSAS - Former NSA counter-encryption program, succeeded by BULLRUN
MARINA - NSA database for internet metadata; maybe succeeded by CLOUDRUNNER in 2013 * *
MARKHAM - General PROFORMA information/descriptions *
MARTES - Unclassified nickname for a collection of software tools for collecting, analyzing and processing signals, used in 2001 aboard the EP-3E surveillance aircraft *
MASTERLINK - SID program for sensing and warning about threats to defense networks *
MASTERSHAKE - Tool or database with FORNSAT and WiFi data collection *
MASTERWORKS - SIGINT collection technology (equivalent at BLUESASH sites is called Cynecs)*
MATRIX - Some kind of data processing system *
MATTERHORN - Collection system providing data feeds to the RT-RG architecture *
MAXFLI - System related to the Predator drone *
MAYTAG - Upstream collection site
MEDLEY - Classified Suite A algorithm
MELVIN - Classification compartment for a program under the defunct BYEMAN Control System (BCS).
MENTOR - Class of SIGINT spy satellites? (since 1995?)
MERCED - The Bulgarian embassy in Washington DC *
MERCURY - Soviet cipher machine partially exploited by NSA in the 1960's
MERCURY (MC) - ELINT/SIGINT satellites launched from 1994 to 1998 (publicly known as ("Advanced Vortex") and operated from Menwith Hill, UK.
MERCURY - Remote SATCOM collection facility
MERLIN - FAIRVIEW's effort to build-out the mobility network access, including SMS messages, Mobile Application Part (MAP), packet data and voice.*
MESA - Cable access under the FAIRVIEW program *
MESSIAH - NSA automated message handling system
META LION - Search tool for the PINWALE database, queries metadata only (since 2005) *
METAWAVE - Warehouse of unselected internet metadata *
METRICS - NSA database probably used for call network analysis, or manage and rationalize SIGINT assets
METROTUBE - Analytic tool for VPN data *
METTLESOME - NSA Collection mission system
MIDAS - Satellite program
MIDFIELD - Processing system related to FAIRVIEW Transit collection under FAA 704 & 705b *
MIDNIGHTRIDER - An internal NSA monitoring system - acccording to Edward Snowden on page 256 of his book Permanent Record.
MILKBONE - Question-Focused Dataset used for text message collection *
MINARET - A sister project to Project SHAMROCK (1967-1973)
MINSTREL - Tapeless transcription support system for linguists, succeeded SEMESTER around 1989 *
MINUTEMAN - Deployable SIGINT unit of about 200 people.
MINUTEMAN - Cordless and cell phone intercept programs in Afghanistan.
MIRANDA - System for managing intelligence requirements of GCHQ customers *
MIRROR - Automated survey system that can for example identify the presence of a VPN; interface to the ROADBED system *
MISS MONEYPENNY - Support unit providing cover identities for undercover CNE operations abroad *
MISTRALWIND - Calling card and private network access under the STORMBREW program *
MJOLNIR - Tool to break the anonymity of the Tor network * *
MONKEYROCKET - Sub-program of OAKSTAR for collecting internet metadata and content through a foreign access point being a non-western anonymous internet browsing product (since 2012) * *
MONSTERMIND - Program that can automatically react to cyber attacks against the US
MOONLIGHTPATH (EGL?) - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program * *
MOONPENNY - The NSA satellite intercept station at Harrogate (Great Britain)
MOONSCAPE - System used at the Waihopai satellite intercept station *
MORAY - Compartment for the least sensitive (Category I) COMINT material, retired in 1999 *
MORECOWBELL (MCB) - Covert HTTP/DNS monitoring system for operations support *
MORGAN - (a so-called access detail)*
MORPHEON - Rules, shared queries, shared filters and tabs to organize and search collected voice cuts *
MORPHEUS - Program of the Global Access Operations (GAO) *
MOTHMONSTER - NSA tool for exploiting the TOR network
MOUNTAIN - NSA tool or system (mentioned early 2020)
MOUSETRAP - Sandia implant for EFI *
MOVEONYX - Tool related to CASPORT
MULBERRY - The mission of Japan at the United Nations in New York *
MUSCULAR (JPM?) - Joint NSA-GCHQ operation to tap the cables linking Google and Yahoo data clouds to the internet * * Part of WINDSTOP
MUSKET - Retired SIGINT Exchange Designator for ?
MUSKETEER - Special Signal Collection unit (military/1990s/still active in 2013*)
MYSTIC - SSO unilateral wireless/mobile interception program (since 2009)*
MYSTIC STAR - Presidential Global Communications System

N
NASHUA - The mission of India at the United Nations in New York *
NATIVEFLORA - FAIRVIEW support to TAO shaping operations under EO 12333 *
NAVAJO - The mission of Vietnam at the United Nations in New York *
NAVARRO - The embassy of Georgia in Washington DC *
NEBULA - Base station router similar to CYCLONE Hx9
NEBULA - Airborne SIGINT system carried by MC-12W aircraft
NECTAR - SIGINT Exchange Designator for ? (retired)
NELEUS - High Frequency Direction Finding (HFDF) system * or remote SATCOM collection facility
NEMESIS - SIGINT satellite
NEPTUNE SPEAR - Operation to kill or capture Osama bin Laden (2011)
NEPTUNETHUNDER - Connection for afloat computer network operations like aboard USS Annapolis *
NESTOR - Family of digital secure voice equipment: KY-8, KY-28, and KY-38
NETBOTZ - Remote monitoring tool
NETEZZA - Commercially developed data warehouse appliance
NETFLOW - Sensor deployed at FAIRVIEW collection sites * *
NETWORKPUMP - Distribution system *
NEWSDEALER - NSA’s internal intelligence news network
NEXUS - Interface that allows to conduct queries through the User Interface Services (UIS) *
NEXUS 7 - Successor program of the Real Time-Regional Gateway (RT-RG) * *
NIAGARAFILES - Data transfer tool * * (SFTP-based?)
NICKELBACK - The Joint Chiefs of Staff (JCS) unclassified nickname assigned to COMINT advisory support *
NIGHTGLOW - System related to the Predator drone *
NIGHTWATCH - Portable computer in shielded case for recreating target monitor from progressive-scan non-interlaced VAGRANT signals
NINJANIC - Something related to TURMOIL *
NITESURF - NSA tool or database
NITRO - Remote SATCOM collection facility
NOCON - NSA dissemination marking or COI
NODDY-3 - Coverage of current and forecasted NRTM circuits under the FAIRVIEW program * *
NOMAD - Projected Navy-sponsored and Raytheon-made computer for mass data handling (1951-1954)
NONBOOK (NK) - Compartment of the ENDSEAL control system
NORMALRUN - NSA tool or database
NOVELETTE - General PROFORMA information/descriptions *
NUCLEARWINTER - Signal Intelligence Directorate team that uses anti-tamper solutions *
NUCLEON - Database for contents of phone calls
NYMROD - Automated name-matching and recognition system (since 2008)*
NUTHATCH - FAIRVIEW's covername for the transport upgrade between FRIAR and PINECONE to accommodate growth in the cable system *

O
OAKSTAR - Umbrella program for 9 accesses at 7 corporate partners (since 2004)* * *
OBELISK - Codename for Al Qaeda’s network of websites and servers *
OBELISK - GSM collection system *
OCEAN - Optical collection system for raster-based computer screens *
OCEANARIUM - Database for SIGINT from NSA and intelligence sharing partners around the world *
OCEANFRONT - Part of the communications network for ECHELON
OCEAN SHIELD - NATO anti-piracy operation
OCEANSURF - Engineering hub of the Global Access Operations (GAO) *
OCELOT - Actual name: MADCAPOCELOT
OCOT II - Some kind of highly secret SIGINT system, 1980s *
OCTAVE - Principal system for tasking of telephone numbers (and other telephone identification data such as IMSIs, IMEIs, and INMARSAT FTINs and RTINs) to the various DNR collection systems used by NSA and its 2nd Party partners. It also enables the management of those numbers. Replaced by the UTT in 2011.*
OCTSKYWARD - Repository for SIGINT and collateral information related to location data on GSM networks,* including from flying aircraft
OILSTOCK - A system for analyzing air warning and surveillance data
OILSTOCK - High-resolution interactive geographic-based software system used to store, track and display near real-time and historical SIGINT-related data over a map background *
OILYRAG - SSO mobile telephone interception program, part of the MYSTIC program *
OLYMPIA - CSEC tool for discovering and identifying telephone and computer connections
OMNIGAT - Field network component
ONEROOF - Main tactical SIGINT database, with raw and unfiltered intercepts; or an analytic tool * (still mentioned early 2020)
ONYX - Newer units of the LACROSSE reconaissance satellites
ORANGEBLOSSOM - Sub-program of OAKSTAR for collection from an international transit switch (sigad: US-3251)*
ORANGECRUSH - Sub-program of OAKSTAR for collecting metadata, voice, fax, phone and internet content through a foreign access point
ORION - SIGINT satellite
ORLANDOCARD - NSA operation thtat attracted visits from 77,413 foreign computers and planted spyware on more than 1,000 by using a 'honeypot' computer *
OSAGE - The embassy of India in Washington DC *
OSCAR - SIGINT Exchange Designator for the USA
OSWAYO - The embassy annex of India in Washington DC
OUTBOARD - US Navy shipboard direction finding system, providing electronic warfare signals acquisition and direction finding systems (AN/SRS-1)*
OUTPARKS - NSA's unclassified environment for access to the public internet, operational as of 2004, replaced BRAZEN, AIRGAP, OSIS and NIPRNet *
OVERHILL - FAIRVIEW collection site *
OWL - Some kind of file system? * *
OXCART - The Lockheed A-12 program (better known as SR-71)
OZONE - Some kind of application framework *

P
PACKAGEDGOODS (PG) - Globally disperced and clandestine placed traceroute and DNS processors that map internet connections for the TREASUREMAP tool * *
PACKET RAPTOR - System for processing internet packet data *
PACKETSCOPE - Internet cable tapping system
PACKETSWING - NSA tool or database
PADSTONE - Type 1 Cryptographic algorithm used in several crypto products
PAINTBALL - Analysis tool (for social network analysis?) *
PAINTEDEAGLE - SI-ECI compartment related to the BULLRUN program
PALANTERRA - A family of spatially and analytically enabled Web-based interfaces used by the NGA
PALMCARTE - System that feeds FISA data to the Network Analysis Center (NAC)? *
PANDORASMAYHEM - Database related to network defense, fed by data from TURMOIL and provinding input to CLOUDSHIELD
PANGRAM (PM) - Alleged SCI control system *
PANOPLY - Populates INTERQUAKE with emitter information and reports *
PANOPTICON - Target management tool, included in the RT-RG architecture *
PANTHER - The embassy of Vietnam in Washington DC *
PANT_SPARTY - Injection of an NSA software tool into a backdoor in the target's defenses *
PARCAE - SIGINT satellite for ocean reconnaissance. Unclassified codename: WHITE CLOUD, a.k.a. Naval Ocean Surveillance System (NOSS); part of CLASSIC WIZARD
PARKHILL - Some kind of Comsec equipment in the 1980s *
PARTNERMALL PROGRAM (PMP) - A single collaboration environment, to be succeeded by the Global Collaboration Environment (GCE) *
PARTSHOP - ?
PARTSTREAMER - Codeword related to data exchange at NSA's European Cryptologic Center (ECC) *
Passport - A "behind-the-scenes" user account system *
PATHFINDER - SIGINT analysis tool (developed by SAIC) *
PATHWAY - NSA's former main computer communications network
PATTERNTRACER - Call chaining analysis tool (developed by i2)
PAWLEYS - SI-ECI compartment related to the BULLRUN program
PEARL - Retired SIGINT product codeword
PEEVEY - A data processing output system, comprised of several commercial equipments linked together by a central computer and special purpose software, 1980s *
PENCUP - Project to upgrade DETs in Korea (2004) *
PENDLETON - SI-ECI compartment related to the BULLRUN program
PENNANT RACE - Airborne SIGINT-based geolocation system carried by MC-12W aircraft
PEPPERBOX - Tool or database for targeting Requests (CSEC?)
PERDIDO - The mission of the European Union at the United Nations in New York *
PERFECTMOON - An out-sites covering system
PERFECTSTORM - Limited FISA authorized collection under the STORMBREW program (sigad: US-984P) *
PERMANENTPRESS - SSO mobile telephone interception program, part of the MYSTIC program *
PHANTOMNOVA - Program in cooperation with Turkey *
PHYLLIS ANN - Air Force airborne radio direction-finding system on EC-47s (1966-?)
PHOSPHORESSENCE - XKEYSCORE steg/encryption plugin *
PHOTOANGLO - A continuous wave generator and receiver. The bugs on the other end are ANGRYNEIGHBOR class
PHOTONTORPEDO - An NSA tool that grabs IP addresses of MSN messenger users - according to Edward Snowden on page 256 of his book Permanent Record
PIEDMONT - SI-ECI compartment related to the BULLRUN program
PICARESQUE (PIQ) - SI-ECI compartment related to the BULLRUN program
PICASSO - Modified GSM handset that collects user data plus room audio
PILOTHOUSE - Front-end collection device, created in 2002 and succeeded by EAGLEVIEW * Tactical mapping tool *
PINECONE - Covername for the LITHIUM centralized processing facility in New Jersey for data collected under the FAIRVIEW program * *
PINUP - Retired SIGINT product codeword
PINWALE - Primary storage, search, and retrieval system for SIGINT text intercepts. Target data is filtered through a Packet Raptor at the collection site and is subsequently processed by a WC2, followed by an XKEYSCORE for selection at NSA headquarters.* *
PIONEER GROUNDBREAKER - Alleged NSA network operations center that should duplicate AT&T's operations center in Bedminster, New Jersey (2001)*
PISCES - Joint NSA, CIA and State Department program collecting biometric data on border crossings from a wide range of countries *
PITCHFORD - SI-ECI compartment related to the BULLRUN program
PIVOT - Retired SIGINT product codeword
PIXIE - Retired SIGINT product codeword
PLANK - Access expansion and collection (content and metadata) via the deployment of a global SIGINT sensor grid through FAIRVIEW's LITHIUM partner.*
PLANK-3A - The follow-on to FAIRVIEW's FY11 PLANK-3 access expansion effort.*
PLANTATION - Ggeneral processing computer project, later integrated into HARVEST (1950s)
PLATFORM - Computer system linking the ECHELON intercept sites * and/or internal NSA e-mail system
PLATFORM - Internal NSA network, via a gateway connected to the COINS network (mid-1980s)*
PLUCKHAGEN - An IRATEMONK implantation for ARM-based Fujitsu drives *
PLURIBUS IMP - Some system related to packet switched computer networks, 1980s *
PLUS - SID's product metrics database, which gives users feedback about SIG1NT production * in use in 1997 and still mentioned in the PRISM presentation from 2013.
POCOMOKE - The Brazilian Permanent Mission to the UN in New York *
POGODA - Soviet cipher system of the 1940s
POISONIVY - Remote-access trojan used by Chinese government spies *
POISON NUT - CES VPN attack orchestrator *
POLARBREEZE - NSA technique to tap into nearby computers *
POORWILL - FAIRVIEW's effort to continue cable modernization, specifically focus on providing increased DNR access capacity and processing across all existing cable sites.*
POPEYESEAR - Database and with an interface (including GraphViz) used at NSA's NTOC floor *
POPPY - Code name for a series of ELINT satellites (1962-1971) as well as a classification compartment of the defunct BYEMAN Control System (BCS) - (see also: REPTILE)
POPQUIZ - Real-time behavioral analytics, upgrade of the TUTELAGE system * *
POPROCKS - Some tool, probably related to Computer Network Exploitation (CNE)
POPTOP - Collection system for telephony data
POUNDSAND - Prototype Incubator for tracking botnets *
POWDER - Program for surveillance of the Turkish embassy in Washington DC
POWELL - The Greek mission at the United Nations in New York *
PREFACE - Processing system for Opscomm at NSA HQ, replacement of TIDE (1978-?)
PREFER - System for identifying and extracting text messages (SMS) from the DISHFIRE database *
PRESSUREPORT - Software interface related to PRESSUREWAVE
PRESSUREWAVE - NSA cloud database for VPN and VoIP content and metadata, among other things * * Couples corporate object storage capabilities with a flexible policy language for customization of access control, retention, and storage of data within the same system *
PRIMECANE - American high-tech company cooperating in providing a network access point for the ORANGECRUSH program
PRISM - Collection of internet data from specific foreign targets at major US internet companies (since 2007) *
PROFORMA - Digital command and control data communications signals that relay information and instructions to and from radar systems, weapon systems (e.g. surface-to-air missiles, anti-aircraft artillery, fighter aircraft), and control centers.* Or just machine-to-machine transmissions.*
PROLOG - Something related to Artificial Intelligence, 1980s *
PROPHET - Mobile tactical SIGINT collection system
PROTEIN - SIGINT Exchange Designator for ?
PROTON - Storage and analysis system for the CRISSCROSS database of (telephony?) metadata of (counterintelligence) targets; operated by CIA and used by DOJ, DOD and NSA *
PROTOSS - Local computer handling radio frequency signals from implants
PULSE - NSA tool (mentioned early 2020)
PURPLE - Codename for a Japanese diplomatic cryptosystem during WWII
PURPLE DRAGON - US military OPSEC program (since 1966)
PUTTY - NSA tool or database
PUZZLECUBE - TAO division tasking tool
PYLON - SIGINT Exchange Designator for ?

Q
QLIX - Target development or reporting tool (mentioned early 2020)
QUADRANT - A crypto implementation code
QUADRESPECTRE PRIME - ?
QUANTUM - Secret servers placed by NSA at key places on the internet backbone; part of the TURMOIL program * *
QUANTUM[...] - See TAO codewords listing
QUANTUM LEAP - CIA tool to "find non-obvious linkages, new connections, and new information" from within a dataset *
QUARTERPOUNDER - Upstream collection site
QUASAR - Relay satellite for reconaissance satellites
QUEEN BEE CHARLIE/DELTA - Airborne SIGINT missions using C-130s in South-East Asia (1964-1965?)
QUEENSLAND - Upstream collection site
QUICKPOINT - Distribution system *
QUIDDITCH - Exploit used by the Special Collection Service (SCS) *
QUILL - Code name for an experimental radar-imaging spacecraft (1964) as well as a classification compartment of the defunct BYEMAN Control System (BCS).

R
RADIOSPRING - ?
RADIANT - First word for two dozen Navy tactical-national data sharing systems, including satellites and stealth drones *
RADIANT GEMSTONE - System from the RADIANT family, installed at the USS Annapolis around 2005 *
RADIUS - Systems that logs ISP dial up customer records, which can create a "natural link" between DNR and DNI datasets *
RADON - Host tap that can inject Ethernet packets *
RAGTIME (RGT) - ECI compartment for call and e-mail content collected under FISA authority * Encompasses both NSA and FBI FISA data since 2002 * *
RAILHEAD - NCTC database project
RAINFALL - (NSA unit for decrypting) Russian secure, encrypted voice communications (around 1979)*
RAINFALL - Unclassified codename for RHYOLITE/AQUACADE SIGINT satellites (see below)
RAINFALL - The joint CIA/NSA/DSD satellite ground station Pine Gap, Australia (F78) *
RAISIN - NSA database or tool
RAMPART-A (RAM-A) - Program for collecting information about Russia, the Middle East and North-Africa, in cooperation with at least five 3rd Party partner agencies (since 1992)*
RAMPART-I (RAM-I) - Program for collecting communications from Iraq
RAMPART-M (RAM-M) - Program for collecting data from undersea fiber-optic cables about terrorists, arms traders and Iraq (since 1986)*
RAMPART-T (RAM-T) - Program providing access to land-based cables, in cooperation with the CIA, to collect communications from state leaders and their entourage (since 1991)*
RAMPART-X (RAM-X) - Program for collecting information from Afghanistan *
RAMROD - Unclassified codename for a SIGINT satellite, possibly the 1994-96 ORION launches
RANCIDRINSE - SSO mobile telephone interception program, part of the MYSTIC program *
RANGER - Unclassified codename for a SIGINT satellite (post-2000 launches)
RATTAN - Codename for overall US effort against Soviet codes (1945-1946, later BOURBON)*
RAVEN - SIGINT satellite
REACTOR - Tool or program related to MARINA? *
REBA - Major NSA backbone project *
REBATE - Unclassified cover term for the MULTIGROUP/STRAWMAN series of ELINT satellites (terminated in 1973) *
RECOVERY - ? *
RED DISK - DIA cloud system (to be integrated into the DCGS-A) to distribute information, images and video to soldiers and other military intelligence users *
REDHARVEST (RDV) - ECI compartment that protects names, locations and techniques of RAMPART-A cable tapping facilities *
REDHAWK - NSA tool
REDRACE - Airborne SIGINT system used for Direction Finding/geolocation and to collect VHF communications
REDRIDGE - Antenna system? * *
REDROOF - NSA tool
REEDWORK - SIGINT site, 1980s *
REGAL - Compartment for Top Secret COMINT information derivated from the Berlin Tunnel operation (1955-?)
RELOAD - Joint NSA/SCE effort to restore the SIGINT technical health in the field, 1980s *
RELOOK - A SIGINT reporting project, 1980s *
REMATION - Joint NSA-GCHQ counter-TOR workshop *
REMEDY - Internal NSA ticket system *
RENOIR - NSA telephone network visualization tool
REPTILE - Unclassified cover term for the POPPY series of ELINT satellite system (terminated in 1971) *
REQUETTE - A Taiwanese TECO in New York *
RESERVE (RSV) - Control system for the National Reconnaissance Office (NRO)
RESERVEVISION - Remote monitoring tool
RESOLUTETITAN - Internet cable access program?
RETRO - see RETROSPECTIVE
RETROSPECTIVE - 30-day retrospective retrieval tool for SCALAWAG *
RETURNSPRING - Collection system providing data feeds to the RT-RG architecture *
RHINEHART - Tool for both real-time and retrospective keyword-searching of vast amounts of voice content (introduced in 2004, replaced by VoiceRT)*
RHYOLITE - Class of SIGINT spy satellites (in 1975 changed to AQUACADE)
RICHTER - SIGINT Exchange Designator for Germany
RIMROCK - Access to 4ESS circuit switches under the FAIRVIEW program *
RINGBILL - Some kind of communications traffic, including Internet data *
RINGNESS - Operational signals processing system based upon a PDP 11/70 computer, located in T154 spaces, 1980s *
RIPCORD - ?
RIVET GYM - Codename for the four SIGINT positions aboard EC-121 COLLEGE EYE aircraft (Vietnam War)
RIVET JOINT - RC-135 reconaissance aircraft with a primary SIGINT mission *
ROADBED - Database for satellite communications data *
ROCKGARDEN - Survey system for a satellite interception system for the Norwegian intelligence service, deployed in November 2004, part of VICTORYGARDEN *
ROCKSALT - Corporate partner for domestic long-distance cable access under the BLARNEY program *
ROCKYKNOB - Optional DSP when using Data Over Voice transmission in CROSSBEAM
RODEHOUSE - Offsite language processing center for Arabic, Amharic, Pasto/Dari and Tagalog (since 9/11) *
RODEO STAR - FAIRVIEW Site *
ROGUE - Cryptanalytic computer from the early 1950s, the first using remote terminals connected to a central processor *
ROLLERCOASTER - Tool or system that provides access to phone metadata, analyst queries and results of SKYNET Analytics *
RONIN - NSA tool for detecting TOR-node and/or mobile IP-addresses * *
RORIPA - SIGINT Exchange Designator for Japan *
ROSTER - Unclassified codename for MAGNUM/ORION SIGINT satellites *
ROUNDTABLE - Internal version of SharePoint on NSANet *
ROUTEMASTER - Server/router for VoIP and audio traffic *
ROUTEVIEWS - Open source inforamtion used for the TREASUREMAP tool *
ROYALNET - Internet mapping tool to determine access points for target’s communications *
RUFF - Compartment of TALENT KEYHOLE for satellite imagery *
RUFFER - Unclassified codename for JUMPSEAT/TRUMPET SIGINT satellites
RUMBUCKET - Analytic tool to access FORNSAT data residing on GINPENNANT *
RUNWAY - Unclassified codename for CANYON/CHALET/VORTEX SIGINT satellites; or a processing system at Menwith Hill *
RUSTICBAGGAGE - Data source for the TREASUREMAP tool *
RUTLEY - Command and control transmissions, for example collected by the MERCURY SIGINT satellites *
RYE - NSA-developed software for Univac 490 computers (introduced 1963) or a system through which 200 remote terminals could access 4 main machines (since 1972)*
RYE - Computer complex supporting CSOC/NSOC, internetting Opscomm circuits, running several softwares including TIDE (late 1960s-?)
RYE/TIPS - A batch retrieval system that had been in operation since the late 1960s, part of the COINS network *

S
SABERTOOTH - SIGINT training program for South Vietnam government (launched in 1961)
SABRE - Retired SIGINT product codeword
SAGUARO (or SAGURA?) - Access to AT&T internet backbone cables, including OC-192 and 10GE peering circuits, under the FAIRVIEW program * *
SAGURA (or SAGUARO?) - Access to AT&T internet backbone cables, including OC-192 and 10GE peering circuits, under the FAIRVIEW program * *
SALEM - ?
SALTYDOGS - Tool to find frequency and carrier rates and discover signal characteristics of satellite links *
SAM HEARTBURN - General PROFORMA information/descriptions *
SAMOS - Reconnaissance satellite program
SANDGOAT - Method for locating large numbers of INMARSAT terminals (2008) *
SANDKEY - Joint NSA/DEA program that intercepts and exploits unencrypted VHF voice communications of narco-traffickers at sea *
SANDLOT - A24 and T333 user interface layer, 1980s *
SAPPY - Retired SIGINT product codeword
SARACEN - Intercept operation using unmaned equipment on a hilltop (Vietnam War, 1972)
SARATOGA - SSO access facility (since 2011) * *
SARDINE - SIGINT Exchange Designator for Sweden
SAVILLE - Narrow band voice encryption for radio and telephone communication
SAVIN - Retired SIGINT product codeword
SCALAWAG - Collection facility under the MYSTIC program *
SCALLION - Upstream collection site
SCAMPI - Secure voice and data network for C4I communications between the commander and the components of the US Special Operations Command, operational sites and other government agencies *
SCAPEL - Second Party satellite intercept station in Nairobi, Kenia
SCARAB - Commercial name for a ruggedized computer used for the LUNCHBOX PROFORMA processor; carried onboard the EP-3E surveillance aircraft *
SCATTERED CASTLES - US Intelligence Community database of security clearance holders (since 2008) *
SCHOOLMONTANA - Software implant for Juniper J-series routers used to direct traffic between server, desktop computers, corporate network and internet
SCIMITAR - A tool to create contact graphs? *
SCISSORS - Data scanning, formatting and distribution system * or processing system that slices up data for sorting *
SCORCHERSIX - FAIRVIEW support to TAO shaping operations under EO 12333 *
SCORECARD - NSA tool (early 2020 mentioned as ID SCORECARD)
SCORPIOFORE - SIGINT reporting tool *
SCQAWK - The "SID Mailbag" in the newsletter of NSA's Signals Intelligence Directorate
SEABOOT - SIGINT Exchange Designator for South Korea *
SEADIVER - System that collects, processes and forwards voice, fax and data traffic transmitted over the Inmarsat-III satellite system from FornSat and SCS/TRYST collection facilities *
SEAGULL - Secure Allied Communications ISO BMD at COMUSSIXTHFLT *
SEARCHLIGHT - NSA's internal corporate directory service for personnel information *
SEARCHLITE - Tactical SIGINT collecting system for like cell phone calls
SEA SENTRY - Program for collecting radar signatures from shipping traffic in the Dardanelles *
SEA SENTRY II - Choke point collection program in cooperation with Turkey *
SEASIDEFERRY - Commercially purchased data source for the TREASUREMAP tool *
SECUREINSIGHT - A software framework to support high-volume analytics
SEDENA - XKEYSCORE steg/encryption plugin *
SEEDSPHERE - Chinese "intrusion set" against US computer networks, identified in 2007 * *
SEEKER - 4th party collection tool? * (still mentioned early 2020)
SEENFLARE(?) - Codeword related to data exchange at NSA's European Cryptologic Center (ECC) *
SEMESTER - Transcription support system for linguists, using tapes, succeeded by MINSTREL around 1989 *
SEMITONE - System that monitors fax and voice messages *
SENIOR SCOUT - Transportable suite of ISR equipment (since 1991)
SENIOR SPAN - Radome on top of the U2 to relay SIGINT data to ground stations
SEAGULL - BR-FISA metadata, LITHIUM's billing records * collected under the FAIRVIEW program *
SEALION - FAIRVIEW site *
SEMITONE - Probably a fax communications processing system *
SENSOR PACER - Nickname assigned to the secure, digital, air-ground-air communications system used for SIGINT reporting and advisory support *
SENTINEL - NSA database security filter, part of project PLUS *
SENTRY EAGLE (SEE) - Overarching umbrella program for ECI compartments and SAP programs of the National Initiative to protect US cyberspace
SENTRY HAWK - ECI compartment of SENTRY EAGLE that protects information about Computer Network Exploitation *
SENTRY FALCON - ECI compartment of SENTRY EAGLE that protects information about Computer Network Defense *
SENTRY OSPREY - ECI compartment of SENTRY EAGLE that protects information about HUMINT enabled SIGINT *
SENTRY RAVEN - ECI compartment of SENTRY EAGLE that protects information about exploitation of encipherment *
SENTRY CONDOR - ECI compartment of SENTRY EAGLE that protects information about general Computer Network Operations *
SENTRY OWL - ECI compartment of SENTRY EAGLE that protects information about relationships with industry *
SERENADE - Covername for a corporate partner for domestic long-distance cable access under the BLARNEY program * *
SERRATEDEDGE - Conflict number access under the STORMBREW program *
SERUM - Bank of servers within ROC managing approvals and ticket system
SETTEE - Former SIGINT Exchange Designator for South Korea *
SHADOWCAT - Some system to be used at the Waihopai satellite station, New Zealand *
SHAMROCK - Operation for intercepting telegraphic data going in or out the US (1945-1975)
SHAREDQUEST (SQ) - Contains the DARKQUEST program *
SHAREDQUEST - 5-Eyes modernization program for the satellite interception architecture (follow-up of SHAREDVISION) *
SHAREDVISION (SV) - 5-Eyes modernization program for the satellite interception architecture (until 2010, followed by SHAREDQUEST) *
SHARKFIN - Sweeps up all-source communications intelligence at high speed and volumes *
SHARKFINN - Selector enrichment tool, included in the RT-RG architecture *
SHARKFURY - Tool for unstructured data exploitation, includes SharkQuery and SharkDocs *
SHARKSEER - Program to identify and mitigate Advanced Persistent Threats (APTs) and Zero Day malware at DoD Information Network (DoDIN) Internet Access Points (IAPs) *
SHARPFOCUS-2 - GSM geolocation tool, providing starting points for hunts against handsets operating within certain Iraqi networks * part of the RT10 architecture *
SHELLGREY - DNT exfiltration metadata format *
SHELLOCK - XKEYSCORE steg/encryption plugin *
SHELLTRUMPET - NSA metadata processing program (since December 2007)*
SHENANIGANS - Aircraft-based NSA geolocation system used by CIA *
SHERMAN - Cryptanalytic computer subcomplex at NSA HQ (1978)
SHIFTINGSHADOW - Sub-program of OAKSTAR for collecting telephone metadata and voice content from Afghanistan through a foreign access point
SHILLELAGH - Classified Suite A algorithm
SHORTHAND - Project initiated in 1966 to employ South Vietnamese as linguists in US LLVI operations
SHOTGIANT - NSA operation for hacking and monitoring the Huawei network (since 2009)
SIDELIGHT - Codeword related to data exchange at NSA's European Cryptologic Center (ECC) *
SIERRAMIST - Tool to support various file systems *
SIGABA - American high-level cipher machine used from World War II until the 1950s, also known as ECM Mark II
SIGCOM - (National) Signals Intelligence Committee *
SIGINT NAVIGATOR - NSA analytic tool used in combination with MAINWAY
SIGSALY - The first secure voice system, used during World War II, also known as Green Hornet
SILKWORTH - A software program used for the ECHELON system
SILLYBUNNY - Some kind of webbrowser tag which can be used as selector *
SILO - Research project in high-speed computer memory, later integrated into HARVEST (1950s)
SILVER - Soviet cipher machine, 1950s-1960s, partially exploited by NSA in the 1960's
SILVER COLLAM (SC) - The only FAIRVIEW collection site outside continental USA, but considered US territory, most likely operated by AT&T *
SILVERCOMET - SIGINT satellites? *
SILVER PEAK - WAN optimization project at Waihopai satellite station, New Zealand *
SILVERZEPHYR (SZ) - Sub-program of OAKSTAR for collecting phone and internet metadata and content from Latin and South America through an international transit switch
SIRE - A software program used for the ECHELON system(?)
SKIDROWE - System for processing low speed internet traffic, replaces WEALTHYCLUSTER2 and interoperates with XKEYSCORE *
SKIPJACK - Type 2 Block cipher algorithms used in various crypto products
SKOPE - SIGINT analytical toolkit
SKYNET - Collaborative cloud research program to identify patterns of suspect activity from bulk telephony data *
SKYSCRAPER - Interface to the ROADBED system
SKYWRITER - NSA tool to prepare (internet) intelligence reports
SLINGSHOT - End Product Reports (CSEC?)
SLIPSTICK - Azimuth and range tool, used in 2001 aboard the EP-3E surveillance aircraft *
SLIVER - Proof-of-Concept for cross-mission use of passive IP sensors *
SMARTTRACKER - Analytic tool for detecting geolocational patterns in cell phone usage *
SMOKEYSINK (SMK) - Cable tapping facility operated in cooperation with a 3rd Party agency, part of the RAMPART-A program (cosed in June 2011)*
SNICK - GCHQ satellite intercept station in Oman
SNOWFLAKE (SN) - An airborne COMINT collection system, installed on a Finnish Fokker F-27 SIGINT aircraft *
SNOWHAZE - NSA tool or database *
SOAPOPERA - (former?) database for voice, end product and SRI information *
SOARING EAGLE - Some US military/intelligence network protection program *
SOCIALSTAMP - Commercially purchased data source for the TREASUREMAP tool *
SOCIOPATH - Storage and/or distribution system *
SODAPRESSED - Linux application presistence *
SOLO - NSA-developed general-purpose cryptanalytic ccomputer, the world's first entirely using transistors, later marketed by Philco as Transac S-1000 (mid-1950s) *
SOMALGET - Umbrella program for collecting content from mobile phone networks of two entire countries, part of MYSTIC (sigad: US-3310**)
SORA-2 - IP expansion effort for the FAIRVIEW program to exploit the access side of the Common Backbone (CBB) network *
SORTINGHAT - RT10 application * or Traffic control system for information exchanged with GCHQ *
SORTINGLEAD - Tool which characterizes GSM behaviour based on location, time-of-day, etc. and correlates DNI persona to GSM handset * *
SOUNDER - Second Party satellite intercept station at Cyprus
SOURSMACK2 - PINWALE partition for DNI foreign government and counter-proliferation traffic collected through SSO corporate partners under FAA authority *
SOUTHWINDS - Collection program for Inmarsat satellite communications, first for its EMEA region, later global coverage *
SPARKLEPONY - Tool or program related to MARINA *
SPEARGUN - Cable access program of New Zealand's GCSB *
SPECTRE - SCI control system for intelligence on terrorist activities *
SPECULATION - Protocol for over-the-air communication between COTTONMOUTH computer implant devices, compatible with HOWLERMONKEY
SPEEDBUMP - NSA database, since 2005 accessible through GLOBALVISION *
SPHINX - Counterintelligence database of the Defense Intelligence Agency
SPINALTAP - NSA program for combining data from active hacking operations and passive signals intelligence collection *
SPINNERET (SPN) - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program * *
SPIRITFIRE - Robust voice processing system based on speech-to-text keyword search and paired dialogue transcription (succeeded VoiceRT in 2013) * *
SPIT - Typewriter designed for copying morse code; project named for SPecial Intercept Typewriter (1957)
SPITEFULANGEL - Hacking tool or method in or for the Python programming language *
SPLITGLASS - NSA analytical database *
SPLUNK - Tool used for SIGINT Development
SPOKE - Compartment for less sensitive (Category II) COMINT material, retired in 1999 * but apparently still in use as unpublished SCI control system
STONEVAULT - Electronic record management system (since 2013) *
SPOTBEAM - NSA database, since 2005 accessible through GLOBALVISION *
SPORTCOAST - Upstream collection site
SPRIG - Retired SIGINT product codeword
SPRINGRAY - Some kind of internal notification system *
SPRINKLER - Menwith Hill Station COMSEC monitoring team *
SPYDER - Analytic tool for selected content of text messages from the DISHFIRE database *
SQUAWK - Target development or reporting tool (mentioned early 2020)
STAKECLAIM - Replacement of the mission system for NSA's collection facility on Okinawa *
STARBURST - Temporary cover term for what would become the STELLARWIND compartment (October 2001) *
STARFIRE - NSA contact chaining algorithm (developed in 1999) *
STARGATE (SG) - FAIRVIEW site *
STARLIGHT - Analyst tool
STARPROC - User lead that can be used as a selector *
STARPROC - Processing system for intercepting foreign Lawful Intercept systems *
STARSEARCH - Target Knowledge tool or database (CSEC?)
STATEROOM - Covert SIGINT collection sites based in US diplomatic facilities *
STEALTHFIGTHER - Codeword found in the source code used by the Equation hacking group *
STEELFLAUTA - FAIRVIEW support to TAO shaping operations under EO 12333 *
STEELKNIGHT - (foreign?) partner providing a network access point for the SILVERZEPHYR program *
STEELWINTER - A supercomputer acquired by the Norwegian military intelligence agency *, a derivative of the WINDSORBLUE supercomputer *
STEEPLEBUSH - Program to expand satellite interception capabilities at Menwith Hill ca. 1980 *
STELLAR - Second Party satellite intercept station at Geraldton, Australia
STELLARWIND (STLW) - Cover term for the President's Surveillance Program, which encompassed bulk collection of domestic metadata and targeted interception at backbone facilities inside the US in order to track down foreign terrorists and their previously unknown conspirators (2001-2007) *
STEPHANIE - Covert listening post in the Canadian embassy in Moscow (est. 1972)
STINGRAY - Device for tracking the location of cell phones (made by Harris Corp.) * STONEGATE - Automated and scalable dial-up data modem and FAX modem demodulation system, used to collect, recognize, demodulate, format, forward, database, archive, and reporting on dial-up data modem, FAX modem, speech, and unknown signals.* For example used at the Waihopai satellite intercept station *
STONEGHOST - DIA network for information exchange with UK, Canada, Australia and New Zealand (TS/SCI)
STONEHOUSE - Site built in the 1960s at Asmara, Ethiopia, for collection against the Soviet space program. Featured two 150-feet diameter dishes (closed in 1975).
STONE RUBY - Intelligence exchange agreement between DIA and the Israeli military intelligence directorate (1996) *
STORMBREW - Domestic cable tapping program in cooperation with Verizon (since 2001) *
STORMFORCE - Hardware modem for processing satellite signals *
STOUTHEART - Collection program for internet data *
STRATOS - Tool or databse for GPRS Events (CSEC?)
STRAWHAT - NSA datalinks between field sites and processing centers (1969-?)*
STRAWHORSE - Modification to Apple's software installer Xcode to insert a remote-controlled backdoor into each app it compiled *
STREAMLINER - NSA-developed automatic switch for communications centers (early 1970s)
STRETCH - IBM high-performance computer project, later integrated into HARVEST (1950s)
S-TRICKLER - Tool or database with IP address fingerprints and potential vulnarabilities from the FORNSAT collection *
STROMTIME - Something related to BIOS attacks *
STRONGMITE - Computer at remote operations center used for long range communications
STRUM - (see abbreviations)
STYGIAN FLOW - FBI nickname for network intrusions for which assistance of the NSA was asked *
STYLISHCHAMP - Tool that can create a HPA on a hard drive and then provide raw reads and writes to this area *
SUBSTRATUM - Upstream collection site
SUEDE - Compartment for Top Secret COMINT information (1951-1952) *
SUGAR-HALFLEX - Collection program for internet data *
SULPHUR - The mission of South Korea at the United Nations in New York *
SUNSCREEN - Tool or database
SURFBOARD - System for processing data from (satellite?) telephone networks *
SURPLUSHANGAR (SH) - High to low diode, part of the QUANTUM system *
SURREY - Main NSA requirements database, where tasking instructions are stored and validated, used by the FORNSAT, SSO and TAO divisions *
SWEEPFORWARD - Repository for manually processed target data (2009) *
SWEETSMACK2 - PINWALE partition for DNI counterterrorism traffic collected through SSO corporate partners under FAA authority *
SYNAPSE - NSA tool for analyzing target connections *

T
TABLON - Experiment of mass data storage technology, overtaken by disk storage technology (1960s)
TACOSUAVE - ?
TALENT KEYHOLE (TK) - Control system for space-based collection platforms
TALIS - Collection system providing data feeds to the RT-RG architecture *
TALISMAN - Replaced the Consolidated Authoring Tool (CAT) in 2003 *

TALK QUICK - An interim secure voice system created to satisfy urgent requirements imposed by conditions to Southeast Asia. Function was absorbed by AUTOSEVOCOM
TAPERLAY - Covername for the Global Numbering Data Base (GNDB) containing telephony and provider information *
TAPIOCA - Multifunctional collaboration tool on NSANet *
TARMAC - Program to intercept satellite communications at Menwith Hill Station *
TAROTCARD - NSA tool or database
TATTERAN - Remote Collection Facilities (RCFs) for VHF radio signals in Afghanistan *
TATTOO - Server used for vPCS shaping operations under the STEELFLAUTA program *
TAWDRYYARD - Beacon radio frequency radar retro-reflector used to positionally locate deployed RAGEMASTER units
TEABALL - Direct SIGINT support to fighter escorts of operation Linebacker (1972)
TELLURIAN - Internet packet processing system, maybe also used to forward data from the collection site to NSA headquarters.
TEMPEST - Spying on information systems through leaking emanations, including unintentional radio or electrical signals, sounds, and vibrations (codename originally from a COMSEC point of view, not an attacker's one)
TENNIS - Network to remote-operate intercept facilities through satellite links (1967-?)
TERMITE - Some kind of SIGINT system, related to the CARDIGAN system, 1980s *
TETLEY - front-end collection device *
THAWFACTOR - Codeword related to data exchange at NSA's European Cryptologic Center (ECC) *
THEORYMASTER - Program that, among others, includes the COURIERSKILL project.*
THERAPYCHEATER - A tool for identifying suspicious patterns in the access to draft folders of webmail accounts *
THESPIS - SIGINT Exchange Designator for ?
THINTREAD - Prototype program for wiretapping and sophisticated analysis of the resulting data (dismissed in 2002 in favor of TRAILBLAZER)
THIEVING MAGPIE (TM) - Program for collecting metadata of mobile phones from airplane passengers; data source for HOMING PIGEON *
THINGSGOLD - (a so-called access detail)*
THORNYHOSTILE - Digital map and foundation geodata repository *
THUMB - Retired SIGINT product codeword
THUNDERCLOUD - Data enrichment tool, collaborative program between NSA units T1222 and SSG *
THUNDERISLAND - NCSC covername for the US partner company for the MONKEYROCKET subprogram of OAKSTAR * *
TIAMAT - Joint venture between the German BND and another country with access for NSA *
TICKETWINDOW - System for sharing Special Source collection among the Five Eyes partners *
TIDALSURGE - Router Configurations tool (CSEC?)
TIDE - Software managing the KLIEGLIGHT database
TIDEWAY - Part of the communications network for ECHELON
TIKICUBE - Unit of NSA's Security and Counterintelligence division (2014)
TIMBERLINE - The NSA satellite intercept station at Sugar Grove (US) *
TIMBERWOLF - Project adressing the complex need for online language working aids, ca. 1989 *
TINMAN - Database related to air warning and surveillance
TINSEL - Processing system related to FAIRVIEW and BLARNEY collection *
TITANPOINTE (TP) - Centralized processing facility for FISA data collected under the BLARNEY and FAIRVIEW programs, located in the AT&T switch at 33 Thomas Street in New York City * *
TITLEHOLDER - NSA tool
TOPAZ - Satellite program
TOPIARYGARDEN - Various mission management, analysis and reporting tools, including OCTAVE, RENOIR and the UIS toolset, part of VICTORYGARDEN *
TOPROCK - Facility for access to 4ESS circuit switches under the FAIRVIEW program *
TORUS - Satellite antenna that allows multiple satellites to be viewed simultaneously *
TOUCHWOLE - Something related to BIOS attacks *
TOWER - SIGINT Emitter Database (SEDB) Query-Focussed Dataset (QFD) fed by telephony metadata from the GMHalo cloud *
TOWERPOWER - NSA tool or database
TOXICARE - NSA tool
TOYGRIPPE - NSA repository of VPN endpoints and metadata * *
TRACFIN - NSA database for financial data like credit card purchases *
TRACTOR - IBM-developed tape drives loading system, used for HARVEST (1960s)
TRAFFICTHIEF (TT) - Alerting and tipping system which alerts analysts and collection systems across the NSA of real-time target communications to support the NSA's counterterrorism mission,* * part of the TURBULENCE umbrella program
TRAILBLAZER - NSA Program to analyze data carried on communications networks (2002-2006, replaced by TURBULENCE)
TRAILMAPPER - NSA tool or database
TRANSIENT - Sub-program of FROSTING directed against Soviet satellites *
TRANSPORTORO - Something related to the OAKSTAR program * *
TRANSX - Translation, transcription and transliteration system * (still mentioned early 2020)
TREASUREMAP (TM) - Mapping, exploration and analysing tool that provides a near-real time, interactive map of the global internet *
TREASURETROVE - Analytic tool
TREBLECLEF - System for data received from hacking operations? *
TRIBUTARY - Voice threat warning network to push time-critical information from a collection source to friendly assets most at risk *
TRIBUTARY - Some kind of Comsec system in the 1980s *
TRIGGERFISH - Device to collect the content of digital cell phone calls (made by Harris Corp.) *
TRINE - Compartment for Top Secret COMINT information, predecessor of UMBRA (1965-1968) *
TRIREME - System for processing internet packet data *
TRITON - Tool or database for TOR Nodes (CSEC?)
TROJAN SPIRIT - Tactical network for sharing intelligence information with customers in the field
TROPICPUMA - Fax processing capability *
TRUMPET - Series of ELINT reconnaissance satellites (1994-2008)
TROPICTHUNDER - FAIRVIEW support to TAO shaping operations under EO 12333 *
TRYST - GCHQ covert operations from inside British embassies * (a so-called NSA access detail)*
TUBE - Back-end of the TURBULENCE architecture; it receives objects in SOTF format from TURMOIL, determine what forwarding actions should occur, and perform any requisite pre-forwarding preparation processing so as to create objects which can be ingested by the appropriate destination repositories. This includes 2nd and 3rd party legacy databases.* *
TUMULT - Part of the TURBULENCE program
TUNDRA - DSP Research of new statistics for codebook analysis *
TUNDRAFREEZE - NSA's main in-house facial recognition program *
TUNINGFORK - NSA database or tool for protocol exploitation
TURBINE - Centralized and automated command & control system for managing a large network of active computer implants for intelligence gathering (since 2010) * *
TURBULENCE (TU) - Umbrella cover term for a next generation mission environment that created a unified system* as part of NSA/CSS Transformation. TURBULENCE unifies MidPoint and Endpoint SIGINT, and dynamic defense, and enables network attack in a manner that creates cooperative, interoperable, real-time exploitation/defense/attack-enabling capabilities between geographically distributed nodes in a peer-to-peer (P2P) manner (since 2005).*
TURMEROL - ? *
TURMOIL (TML) - Passive SIGINT sensors: filtering and selection (at the packet level) of internet traffic on high-speed satellite, microwave and cable links, part of the TURBULENCE program * * * Maybe also for selecting common internet encryption technologies to exploit.*
TURNSTILE - SAGUARO VoIP access processing system *
TURNSTYLE - Collar for certain antennas (2004) *
TURNWEALTHY - Component for signal acquisition within the SKIDROW system, replacement for WEALTHYCLUSTER *
TURTLEPOWER - System to process VoIP communications data * and/or automated decryption of enciphered data *
TUSKATTIRE - Ingest system for cleaning/processing/normalizing DNR (telephony) data *
TUTELAGE - Active defense system with sensors at defense department networks in order to detect incoming cyberattacks and allowing NSA to block the threat or manipulate the attack code,* * part of the TURBULENCE program
TWEED - Retired SIGINT product codeword
TWISTEDPATH - Accessed by 6 cable accesses under the FAIRVIEW program *
TYPHON - Airborne SIGINT system carried by MC-12W aircraft
TYPHON HX - GSM base station router network in box for tactical Sigint geolocating and capturing user

U
UDEAUS - High Frequency Direction Finding (HFDF) system *
ULTRA - Compartment for Top Secret COMINT information, like decrypted high-level military Nazi messages (until 1946)
UMBRA - Compartment for the most sensitive (Category III) COMINT material (1968-1999) * but apparently still in use as unpublished SCI control system
UMSTEAD - TSEC/CI-II, COSS secure satellite communications system *
UNICORNSANDWICH - FAIRVIEW support to TAO shaping operations under EO 12333 *
UNIFORM - SIGINT Exchange Designator for Canada
UNITY - System for processing data collected from telephony networks * through a SAGUARO access under the FAIRVIEW program *
UPWARD - Classification compartment for a program under the defunct BYEMAN Control System (BCS).
USHER - Retired SIGINT product codeword

V
VANGUARD - Sensor deployed at FAIRVIEW collection sites * *
VENATOR - Access to a Philippine mobile network provider, part of the MYSTIC program *
VENONA - Joint US-UK project for decrypting historical intercepts of one-time pad messages from the KGB; previously codenamed JADE, BRIDE and DRUG subsequently
VENUSAFFECT - System used at the Waihopai satellite intercept station *
VERDANT (VER) - Alleged SCI control system *
VESUVIUS - Prototype quantum computer, situated in NSA's Utah Data Center
VICTORYDANCE - Joint NSA-CIA operation to map WiFi fingerprints of nearly every major town in Yemen *
VICTORY GARDEN - Norwegian satellite interception site and processing capability, comparable to an NSA FORNSAT site, operational since 2005 *
VICTORYUNIFORM - Special Source collection *
VIEWPLATE - Processor for external monitor recreating target monitor from red video
VINEYARD - System used at the Waihopai satellite intercept station *
VINSON - KY-57/58 family of voice encryption systems
VINTAGE - System used at the Waihopai satellite intercept station *
VINTAGE HARVEST - Probably a military SIGINT tool
VISIONQUEST (VQ) - System used at the TITANPOINTE access point under the BLARNEY program
VIVIDDREAM - Query tool that tells whether a VPN session is likely exploitable, without revaling any close-hold information *
VIXEN - ? *
VoiceRT - Voice in Real Time, indexes, tags and searches intercepted voice to enable analysts to find relevant cuts and sort through much larger amounts of traffic based on content *
VOICESAIL - Intelligence database?
VORTEX - Class of SIGINT spy satellites (1978-1989)
VOTEDOOR - NSA managed server for the InfoWorkSpace (IWS) collaboration tool (2003) *
VOXGLO - Multiple award contract providing cyber security and enterprise computing, software development, and systems integration support *
VOYEUR - Compartment shared with GCHQ for spying on another country's spies as they spy on someone else (4th party collection) * *
VULCANDEATHGRIP - Repository for tasked, full-take, IPSec VPN network traffic collection *
VULCANMINDMELD - Repository for tasked, full-take SSL/TLS VPN network traffic collection *

W
WABASH - The embassy of France in Washington DC *
WAGONBED - Hardware GSM controller board implant on CrossBeam or HP Proliant G5 server that communicates over I2C interface
WALBURN - High-speed link encryption, used in various encryption products
WALLABY - Project to combine the processing of multilingual data with advanced Database and Knowledge Base systems, 1980s *
WATERFRONT - Processing system for data collected from vPCS shaping under the STEELFLAUTA program *
WATERWITCH - Hand-held tool for geolocating targeted handsets to last mile
WAVELEGAL - Authorization service that logs data queries
WAYLAND - Processing system related to FAIRVIEW Transit collection under FAA 704 & 705b *
WEALTHYCLUSTER (WC) - Processing system for low data rate internet traffic (packet-switched and C2C), that sessionizes all the data on the link before sending it to XKEYSCORE (since 2002, will be replaced by TURMOIL) * *
WEALTHYCLUSTER2 (WC2) - Protocol processing & session reassembly *
WEASEL - Type 1 Cryptographic algorithm used in SafeXcel-3340
WEBCANDID - NSA tool or database
WEE LOOK - ELINT systems on Navy EA-3Bs detecting SAM radars (Vietnam War)
WELLGROUNDED - Proposed, but not implemented internal NSA oversight program (early 1990s)
WELLSPRING - Tool that strips out facial images from e-mails and other communications, and displays those that might contain passport images *
WESTERNSTAR - Contact-chaining program *
WESTPORT - The mission of Venezuela at the United Nations in New York *
WHARPDRIVE - Joint venture between the German BND and another country with access for NSA (2013)* * *
WHIPGENIE (WPG) - ECI compartment for details about the STELLARWIND program * *
WHITEBIRCH - ASA project to set up an HF-DF network in South East Asia (initiated 1961)
WHITEBOX - Program for intercepting the public switched telephone network? *
WHITE WOLF - Joint Chiefs of Staff "advisory warning" program for all peripheral airborne reconnaissance missions (1963-?)
WHITE CLOUD - Unclassified codename for the PARCAE SIGINT satellite for ocean reconnaissance
WHITELIST - NSA tool
WHITESQUALL - International gateway switch access under the STORMBREW program *
WHITETAMALE - Operation for collecting e-mails from Mexico's Public Security Secretariat *
WHIZBANG - Training program (?)*
WILDANDSTORMY (WANDS) - Procurement for an "integrated, interoperable, and secure cloud ecosystem" for NSA's TS/SCI level* in 2022 re-awarded to Amazon Web Services (AWS) * *
WILLOW - Combination of a JUMPSEAT satellite and Low-Earth Orbit Program-989 ELINT sub-satellites (since 1982)
WILLY - AFSS COMINT support program during the Korea War (1950-?)
WINDCHASER - Tool or program related to MARINA *
WINDSORBLUE - Supercomputer developed by IBM * succeeded by WINDSORGREEN *
WINDSORGREEN - Supercomputer developed by IBM, successor of WINDSORBLUE * WINDSTOP - Umbrella program for 2nd Party high-volume cable tapping programs *
WINTERGARDEN - Inmarsat collection system of the Norwegian intelligence service, including two 13-meter antennas, part of VICTORYGARDEN *
WISPYKNIT - Special Source collection *
WIRESHARK - Database with malicious network signatures
WISPYKNIT - Special Source collection *
WISTFULTOLL - Premiere target survey tool for Windows that runs on almost all targets automatically. It brings back informatio about the target system's machine and operating system *
WITCH - Retired SIGINT product codeword
WITCHHUNT - ?
WOLFPOINT - SSO corporate partner under the STORMBREW program *
WORDGOPHER - Software system to demodulate low-rate satellite signals (2009) *
Wordscape - Vocabulary tool used at NSA
WRANGLER - Database or system which focuses on Electronic Intelligence

X
XBIT - Signals analysis software (bit manipulation) on the SCARAB computer, used in 2001 aboard the EP-3E aircraft *
XCONCORD - Program for finding key words in foreign language documents
XKEYSCORE (XKS) - Computer system that combines high-speed filtering of data traffic from different sources with techniques for discovering targets who use the internet anonymously. XKEYSCORE is deployed at US and Five Eyes interception sites around the world.* *

Y
YACHTSHOP - Sub-program of OAKSTAR for collecting internet metadata, or NSA database, since 2005 accessible through GLOBALVISION * or a TAO division tasking tool *
YANKEE - Part of the PINWALE database (NOFORN partition?) * *
YELLOWSTONE - Analytical database * apparently containing metrics that can be used to evaluate data collection * *
YIELD - Combination of a JUMPSEAT satellite and low-Earth orbit Program-989 ELINT sub-satellites (since 1982)
YOKE - AFSS tactical voice intercept support program during the Korea War (1951-?)
YUKON - The embassy of Venezuela in Washington DC *

Z
ZAKI - A collection and forwarding position, 1980s *
ZAP - (former?) database for texts *
ZARF - Compartment of TALENT KEYHOLE for ELINT satellites, retired in 1999 *
ZODIACARRAY - System that targets Broadband Global Area Network (BGAN) transmitted over het Inmarsat-IV satellite systems *
ZOMBIEARMY - ? *
ZOOM - Target development or reporting tool (mentioned early 2020)


(Some contributions were also made by Zone d'Intérêt)


- See also this list of NSA codewords from 2002



Links and Sources
- NSA Observer: Things the NSA doesn't want you to know
- List of NSA Code Names Revealed
- About What the NSA’s Massive Org Chart (Probably) Looks Like
- About Code Names for U.S. Military Projects and Operations
- National Reconnaissance Office: Review and Redaction Guide (pdf)
- About How Codes Names Are Assigned
- Wikipedia article about the Secret Service codename
- List of crypto machine designators
- Wikipedia article about the CIA cryptonym
- Article about Security Clearances and Classifications
- Listing in German: Marjorie-Wiki: SIGDEV
- Another list in German: Geheimdienstliche Akronyme und Codenamen
- William M. Arkin, Code Names, Deciphering U.S. Military Plans, Programs, and Operations in the 9/11 World, Steerforth Press, 2005.

24 comments:

Anonymous said...

the latest bombshells form the washington post are particularly rich sources. The reports, not the article.

Also you're missing Silverzephyr and Steelknight from O Globo (ther is an infographic. and a picture on the wikipedia 2013 mass surveillance disclosures article, which now looks halfway decent.

also, go the the nsa's website, and look at the United States v Thomas drake. you will see a document mentioning Turbulance, turmoil tutelege and trafficthief, and note that that trafficthief does interact with xkeyscore.

Lithium, blarney, oakstar, fairfiew are mentinoed on a press release. that release describes them as aliases for corporations. Which means that they are all part of SSO. So is Silverzephyr. But check the washinton post's article. It will help you clear up a lot.

P/K said...

Thank you for the update and the information! I'll check it out and add the new info to the listing.

Anonymous said...

There is now a stub article on wikipedia for the Unified targeting tool, UTT.

Has a few screen images pulled from the releases.

Trafficthief is in all probability a database and/or DB query tool. See the pyramid shaped prism slide. Which mentions two.

Anonymous said...

there is a screencap of OCTAVE in the "what to tell our overseers" release.

Anonymous said...

DRTBox is by Digital Receiver Technology Inc(http://www.drti.com/), now a wholly-owned subsidiary of Boeing Corp. DRT's are used to intercept and breakout(decrypt)Cell phones for the Oneroof tactical SIGINT audio collection system.

Anonymous said...

Re: "PHOTOANGLO - Portable radar retro-reflector replacement for CTX4000, joint NSA/GCHQ project, homodyne receiver connected to NIGHTWATCH or VIEWPLATE for processing "

The PHOTOANGLO is not a retro-reflector. It's a continuous wave generator and receiver. The bugs on the other end are ANGRYNEIGHBOR class. retro-reflectors

Also, you seem to be missing an entry for the CTX4000.

P/K said...

Thank you, I'll correct it!

CTX4000 seems to be an abbreviation instead of a codeword, so doesn't belong in this list.

Anonymous said...

Please correct: WAGNOBED => WAGONBED

Anonymous said...

what about Electronic Tracking? How do i find it and how can i destroy it without hurting my body or killing myself?

Rob said...

I've had a look into Richelson's book "The US Intelligence Community", I sum up the codenames related to SIGINT satellites here :

GRAB is in fact acronym for "Galactic radiation and background", the cover of the program. DYNO was the classifed codename for GRAB. GRAB/DYNO was a low-Earth orbit ELINT satellite (1960-1962 launches).

CHALET - first codename for CHALET / VORTEX class (the codename was changed after 1979 leak).

PARCAE - SIGINT satellite for ocean reconnaissance. Unclassified codename WHITE CLOUD, aka Naval Ocean Surveillance System (NOSS), aka or part of CLASSIC WIZARD.

RAINFALL - unclassified codename for RHYOLITE/AQUACADE

RAMROD - unclassified codename for a SIGINT satellite, possibly the 1994-96 ORION launches

RANGER - unclassified codename for a SIGINT satellite, post-2000 launches

ROSTER - unclassified codename for MAGNUM/ORION

RUFFER - unclassified codename for JUMPSEAT/TRUMPET

RUNWAY - unclassified codename for CANYON/CHALET/VORTEX SIGINT satellites

RUTLEY - unclassified codename for the MERCURY follow-on (1995-2003 launches).

YIELD / WILLOW (from 1982 onwards) - codename for combination of a JUMPSEAT satellite and low-Earth orbit Program-989 ELINT sub-satellites "piggy-backed" as payload of a rocket launch

"MENTOR" : I have never found a reliable source about the MENTOR codename. Snowden's spy budget shows that ORION is still used today, so I think that "MENTOR" is spurious.

I could find some crypto codenames (such as SILVER) and many early computers of NSA (HARVEST) if you want too.

Anonymous said...

SKIDROWE systems interoperate with the NSA X-Keyscore program.

Anonymous said...

PITIEDFOOL - A suite of CNA tools for use against file systems. Overwrites data to the point it is irrecoverable.

Unknown said...

STEEPLEBUSH - Program to expand satellite interception capabilities at Menwith Hill ca. 1980 (source: http://www.c4i.org/erehwon/nsa-f83.html)

P/K said...

Thanks for the additions - they have been added!

Unknown said...

NASSAU SHORE - Cable access station located in Tuckerton, New Jersey; available maps indicate the tap targets the TAT-14 cable under the FAIRVIEW program.

PINECONE is located in New Jersey.

(https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH2047.dir/doc.pdf) pg. 23
(https://cryptome.org/2015/08/nsa-fairview-nassau-shore-clusters.htm)

ExSp00k said...

Stumbled upon your blog. Interesting...

Having worked in COMINT, SIGINT, ELINT, HUMINT, ECM, ECCM and others, I find it interesting how much of the posted information is either incorrect or missing details about earlier codeword meanings.

Also, many of the names I searched (offline... no need to leave extra intel in your server logs ;) )weren't actually codewords but project names.

Example:
GLOBALREACH was used more than once. The first instance was related to over-the-horizon radar for monitoring purposes. This one was a bit unique in that installations in Greenland and Alaska and another could monitor airborne vehicular activity in China and the USSR.

There were quite a few others that had been used more than once - or the current leaked info was intentional to redirect further investigation (common tactic).

All in all, I appreciate your efforts to gather the info.

Thanks,

P/K said...

Thank you for your comment. You are right that many of these names have been used earlier or are used by other agencies for denoting other kinds of projects, systems, etc.

The primary purpose of this list is to index and get some grip on the numerous codewords etc. that have been published through the Snowden-revelations. Only these ones I try to list systematically. Old codenames are only added when I stumble upon them or when they are well known, important or otherwise interesting. Listings like these will of course never be complete.

Officially, there are different types, like for example nicknames, codewords and coverterms, each with a different meaning (see the page "NSA Glossary"). This list is called "Nicknames and Codewords", but actually includes names from all these different types, includig project names and such. This because we often don't know what type a certain term is. Sometimes this only becomes clear after we learn more about what the term actually stands for.

Anonymous said...

Another two;
SNOWFLAKE - Reportedly an airborne COMINT collection system, installed on a Finnish Fokker F-27 SIGINT aircraft.
HYPERWIDE - A component of the SNOWFLAKE system, HYPERWIDE is a frequency hopper.

Source: https://theintercept.com/snowden-sidtoday/4389657-comint-collection-system-installed-on-finnish/

P/K said...

Thank you, I added them to the list!

Unknown said...

Anything on bruce or the little guy or caveman or gift card?

Anonymous said...

Dawn Star- ACOUSTINT related to nuclear explosions

Anonymous said...

Wonder if you've ever noticed, there is a bonanza of never-seen-before NSA/GCHQ codewords in Trevor Paglen's art installation "Code Names of the Surveillance State" (2014).

Paglen was granted access to Snowden archive of Laura Poitras, from which he somehow compiled his art installation of over 4000 code names. According to Ars Techinca (https://arstechnica.com/gaming/2015/09/trevor-paglen-the-artist-visualizing-the-surveillance-state/), "The original list compiled by Paglen stretched to over 15,000."

Full installation can't be found online AFAIK, but even snapshots from it reveal familiar codewords from this page and from your TAO & GCHQ codeword pages along with plethora of totally new ones. See pictures and video here:
https://www.contemporaryartlibrary.org/project/trevor-paglen-at-metro-pictures-new-york-8738

Some interesting things about the scope of the Snowden archive could be inferred from the installation, assuming it accurately reflects the archive. It could also be very valuable for the damage assessement of Snowden leaks on programmes that were compromised by the leak, and no doubt counterintelligence people have already studied it carefully.

The installation also reveals reporting gaps about the Snowden archive material. For example, it can be inferred that from China hacking themed BYZANTINE codewords, the archive contains also someting about codewords BYZANTINE BISHOP, BYZANTINE GRANITE that has never been reveled; Or that the archive contains something about codewords SPRING CHICKEN, SPRING CLOUD, SPRING COBRA as well as the SPRING BISHOP that has already been reported. Or given the number of TURBO themed names shown on the video's list, there is perhaps some interesting and sensitive NSA program too sensitive to be reported about...

P/K said...

@Anonymous: That's really interesting! I will look whether it may be doable to copy those codewords here

Lawrence Surtees said...

BIG BEAR - Classified ELINT spectrum analysis program

BIG CROW - NKC-135A/E tail no. '55-3132' Airborne Electronic Warfare Laboratory for ECM testing, 1973+

BIG GREEN - SIGINT sensor system flown on US Army CENTCOM SATURN ARCH Dash-8s

BIG SAFARI - US Air Force umbrella special ops program since 1952 based at Greenville, TX, for acquisition, modification, and logistics support for special purpose airborne intelligence (incl. SIGINT, COMINT, ELINT) collection manned and unmanned aircraft and weapons systems including RC-135 and EC-130 aircraft.

BIG TEAM - SAC USAFSS 6949th SS strategic reconnaissance RC-135C ELINT-oriented platform (succeeded by RIVET JOINT)

BILBOBADGER - NSA FORNSAT daily summary feeds

In Dutch: Meer over het wetsvoorstel voor de Tijdelijke wet cyberoperaties