MUSCULAR
| Company type | Government intelligence program |
|---|---|
| Industry | Signals intelligence, surveillance |
| Headquarters | United Kingdom |
Area served | United Kingdom, United States |
Key people | Government Communications Headquarters (GCHQ), National Security Agency (NSA) |
| Products | Intelligence and data interception from Yahoo! and Google data centers |
MUSCULAR (DS-200B), headquartered in the United Kingdom, is an intelligence-gathering initiative jointly conducted by Britain's Government Communications Headquarters (GCHQ) and the U.S. National Security Agency (NSA), as disclosed through documents leaked by Edward Snowden.[1] The program is predominantly overseen by GCHQ.[2] It intercepts communication links between the data centers of Yahoo! and Google.[3] Critical information about MUSCULAR became publicly available in late October 2013.
Overview
MUSCULAR is a collaborative effort managed by:
- – GCHQ
- – NSA
This program is part of at least four initiatives that depend on a trusted intermediary, collectively referred to as WINDSTOP. During the period from December 2012 to January 2013, MUSCULAR gathered 181 million records, which is considerably fewer than another WINDSTOP operation named INCENSER (DS-300), which collected over 14 billion records in the same timeframe.Cite error: The opening <ref> tag is malformed or has a bad name
Operational details
Leaked materials reveal that NSA's acquisitions division transfers millions of records each day from Yahoo! and Google’s internal networks to data repositories at NSA headquarters in Fort Meade, Maryland. The program functions through an access point called DS-200B, situated outside the United States, utilizing an undisclosed telecommunications provider to secretly facilitate NSA and GCHQ access.[3]
According to The Washington Post, MUSCULAR captures more than twice the number of data selectors compared to the more widely recognized PRISM.[1] Unlike PRISM, MUSCULAR operates without requiring any (FISA or other) warrant, although it likely adheres to legal frameworks such as the UK's RIPA.Cite error: The opening <ref> tag is malformed or has a bad name
The sheer volume of intercepted data poses operational challenges for NSA's Special Source Operations. For instance, when Yahoo! relocated numerous mailboxes between its data centers, NSA’s main analytical database, PINWALE, struggled to manage the influx of MUSCULAR-derived information.Cite error: The opening <ref> tag is malformed or has a bad name
Programs related to MUSCULAR include INCENSER and TURMOIL, with TURMOIL handling data processed from MUSCULAR collections.[2]
The surveillance depended on unencrypted transmissions within Google's private cloud infrastructure, where "Google Front End Servers" add SSL encryption for external traffic but remove it internally. After these revelations became public, Google began encrypting communications between its data centers.[1]
Reactions and countermeasures
In November 2013, Google declared it would encrypt data flows between its data centers, followed by Yahoo! announcing similar measures later that month. In December, Microsoft disclosed its own encryption plans and described the NSA as an "advanced persistent threat"—a characterization equating the agency with state-level cyber attackers—which garnered widespread media coverage.
Brandon Downey, an engineer at Google, voiced strong criticism of NSA surveillance activities, underscoring the company’s dedication to safeguarding user privacy despite these challenges.
See also
- 2013 mass surveillance disclosures
- DISHFIRE, a joint NSA–GCHQ project collecting SMS and similar messages worldwide
- List of government mass surveillance projects
- Mass surveillance
- Squeaky Dolphin, a program targeting platforms like Facebook, YouTube, and Blogger
- STELLARWIND
- Total Information Awareness