New documents show XKEYSCORE, NSA's Google-like tool, collects more data than previously reported including web searches and router configuration information
XKEYSCORE: NSA's Google for the World's Private Communications — Illustrations by Blue Delliquanti and David Axe for The Intercept
Context & Ripple Effects
The Intercept pairs this disclosure with its own technical walkthrough of how XKEYSCORE actually works, turning the tool's 'Google for private communications' framing into specifics: analyst queries against web searches and router configuration data that were not part of the previously reported picture.
The story also fits a longer arc the corpus documents: seven years later, reporting on multiple US military branches buying access to Team Cymru's Augury monitoring tool showed the same appetite expressed through purchased commercial telemetry rather than built systems.
First-order effects
- NSA analysts gain direct search access to two new data classes — web searches and router configuration information — meaning ordinary internet users' queries and network equipment metadata are now queryable targets, not just intercepted content.
- Router owners and network operators face a concrete security exposure: configuration data that was assumed to be local becomes collectable intelligence at scale.
Second-order effects
- Network-equipment vendors and ISPs are pushed toward treating router configuration hygiene as a counterintelligence issue, since misconfigured devices effectively hand reconnaissance material to XKEYSCORE-style collection.
- Commercial surveillance vendors get a proven market template: once agency demand for broad traffic visibility is documented, products like Team Cymru's Augury can sell coverage claims (90%+ of internet traffic) directly to military buyers.
Third-order effects
- If the pattern holds, state internet collection splits into two structures — agencies building query platforms over their own taps, and agencies licensing commercial visibility products — with the boundary between 'public data' and 'collected communications' increasingly defined by whoever runs the index.
- Each expansion of what these tools demonstrably collect adds pressure toward end-to-end encryption and hardened default configurations, shifting the cost of mass collection back onto the collectors.
The trend: Intelligence collection is converging on searchable, Google-like indexes over global traffic — first built in-house as with XKEYSCORE, then increasingly bought as commercial telemetry products like Augury.