Investigation of leaked source code reveals NSA tracks users of Tor website, calls visitors to Tails and Linux Journal sites “extremists”
NSA targets the privacy-conscious — The investigation discloses the following: Two servers in Germany - in Berlin and Nuremberg - are under surveillance by the NSA.
Context & Ripple Effects
This lands on top of a year of incremental Snowden-era disclosures about anonymity tools: Businessweek reported in January on the standoff between Tor and the NSA, and The Intercept documented in February that GCHQ had spied on [[a:1202609|WikiLeaks visitors while the NSA discussed going after WikiLeaks, Pirate Bay, and Anonymous]]. What is new here is the granularity — leaked NSA source code examined by Panorama shows the agency fingerprinting individual Tor users and explicitly classifying visitors to the Tails and Linux Journal websites as "extremists", plus two servers in Berlin and Nuremberg placed under watch.
The story traveled unusually wide for a technical leak: Bruce Schneier covered it directly, and syndication ran through Ars Technica, The Verge, Boing Boing, The Hill, RT, SecurityCurrent, and Linux Journal itself, with Schneier and other experts cited as believing the code leaks come from an NSA leaker other than Snowden — a claim of attribution, not settled fact.
First-order effects
- Linux Journal and the Tails project are now publicly branded as extremist-linked by the world's largest signals-intelligence agency, putting both organizations' funding, hosting, and community relationships under immediate reputational pressure.
- German authorities face confirmed evidence of NSA monitoring of servers on their own soil in Berlin and Nuremberg, compounding already-rumored German concerns about US interception of sensitive communications.
Second-order effects
- Operators of privacy infrastructure — relay hosts, mirror sites, small publishers — must now weigh that running or visiting such services places them in an intelligence classification, raising hosting costs and chilling participation in exactly the ecosystems Tor and Tails depend on.
- The "extremist" label gives European governments concrete material for diplomatic pushback against US surveillance programs, at a moment when German officials were already voicing suspicion about eavesdropping channels.
Third-order effects
- If merely browsing a privacy website constitutes extremist indicators, the de facto doctrine is guilt-by-association profiling rather than suspicion based on conduct — a structural shift in how signals agencies define targets that privacy advocates will press regulators and courts to confront.
- The disclosure pattern — leaks surfacing through journalists and independent cryptographers rather than official oversight — points toward a longer-term legitimacy problem for classified surveillance programs and the trust model around anonymity software like Tor.
The trend: Signals intelligence is moving from targeted collection against named suspects toward behavioral profiling of anyone who touches anonymity tools, with each Snowden-era leak narrowing the gap between surveillance of adversaries and surveillance of ordinary users.