XKEYSCORE appears to do a bad job of this. To compensate for this, developers often rely on multiple layers of security if attackers can get through one layer, they may still be thwarted by other layers. As hard as software developers may try, it's nearly impossible to write bug-free source code. There might be security issues with the XKEYSCORE system itself as well.

The Intercept's analysis focuses on the system's ability to 'fingerprint' communications based on a set of criteria - for example, 'Emails that are PGP encrypted' or 'IMs written in Arabic,' and that can be correlated with cookies set by common Internet services like Google. Anyone with those credentials can alter the logs of the system, including evidence or their own actions - and any audit trail left behind by such shenanigans will lead only to the entire pool of senior admins, not to a single person. All administrators shared a single account (login: 'oper') with a single password. One of the most glaring flaws in XKS is its administrative logging, which is key to oversight of the system to track abuse and defection from its senior staff. Their operations team must be extremely unhappy.' There are many open source offerings that would function far better than this design with very little work. Data ingest, day-to-day operations, and searching is all poorly designed. John Adams, an engineer who was a senior opps manager at Twitter, looked at the details, and pronounced them terrible: 'they were able to achieve so much success with such a poorly designed system. XKS is/was a GNU/Linux app that runs on Red Hat servers, using Apache to search Mysql stores. However, to its credit, it did not (and may still not) support Internet Explorer. The snapshots we have of XKEYSCORE date to 2013, so the chances are that the system has matured since then, but as of the day Edward Snowden scraped and exfiltrated its specs, it was something of a shambles. Following up on its in-depth look at which communications the secret XKEYSCORE tool lets the NSA search, The Intercept makes some observations about how the technology actually works.

Xkeyscore search data