MUSCULAR: NSA Tapping Google/Yahoo Inter-DC Links (Revealed 2013)
Introduction
In October 2013, the Washington Post published a story by reporters Barton Gellman and Ashkan Soltani revealing that the National Security Agency, together with Britain's GCHQ, had secretly tapped the private fibre-optic links connecting Google's and Yahoo's data centres to one another. The programme was codenamed MUSCULAR. The disclosure was among the most significant revelations in the Snowden archive because it exposed an intelligence operation targeting the internal infrastructure of two of the world's largest internet companies — infrastructure those companies believed to be private and secure.
What MUSCULAR Was
Google and Yahoo operate global networks of data centres connected by high-capacity fibre-optic cables. Data flowing between these centres — including user emails, search queries, and cloud storage — was, at the time of the MUSCULAR revelations, transmitted unencrypted within the companies' private networks. The companies considered this traffic protected by the private nature of their backbone infrastructure.
MUSCULAR exploited this assumption. The NSA and GCHQ, operating through a covert programme, accessed these inter-data-centre links at points where the cables passed through or near facilities accessible to British intelligence. The data was then forwarded to NSA repositories. Because the interception occurred on the backbone rather than at endpoints, it bypassed the legal framework governing requests to companies — such as the Foreign Intelligence Surveillance Court orders used under PRISM — and occurred entirely without the companies' knowledge or consent.
The Washington Post published NSA slides, including a diagram drawn by an NSA analyst showing data flowing between Google front-end servers with a handwritten annotation, ''SSL added and removed here'' followed by a smiley face. The annotation captured the intelligence significance: Google used SSL (encrypted connections) between users and its servers, but did not at that time encrypt traffic between its own data centres. MUSCULAR collected that unencrypted internal traffic.
Scale of Collection
According to NSA documents published by the Post, MUSCULAR collected millions of records per day. A 30-day period in January 2013 produced approximately 181 million records from the Google and Yahoo networks. The records included metadata and content.
Corporate Response
Google and Yahoo denied knowledge of the programme. Both companies publicly expressed outrage. Within months of the disclosure, both companies accelerated plans to encrypt traffic between their data centres — a direct response to MUSCULAR. Google's engineering blog described the encryption rollout explicitly in the context of NSA surveillance. The episode was a significant driver of industry-wide movement toward end-to-end and in-transit encryption of data centre traffic.
MUSCULAR vs. PRISM
MUSCULAR and PRISM are frequently conflated but are legally and technically distinct. PRISM operated under Section 702 of the FISA Amendments Act, using court-approved orders compelling US communications companies to provide specified data. The companies were legally obligated to comply and legally barred from disclosing it. MUSCULAR involved no legal process directed at the companies and no company knowledge or cooperation — it was a covert infrastructure tap.
The distinction matters because PRISM had a statutory basis (contested but present), while MUSCULAR operated under the NSA's foreign intelligence authority applied to what it characterised as foreign-located infrastructure, exploiting the fact that the cable taps occurred at points outside US jurisdiction.
Confirmation
MUSCULAR is confirmed by NSA and GCHQ slides published by the Washington Post, subsequent reporting by multiple outlets drawing on the Snowden archive, and independent technical analysis corroborating the described interception method. The US government did not deny the programme's existence; it argued that the collection was conducted lawfully under foreign intelligence authorities.
Verdict
Confirmed. NSA and GCHQ slides published by the Washington Post in October 2013 confirm MUSCULAR's existence, scope, and method. The programme tapped unencrypted backbone traffic between Google and Yahoo data centres without the companies' knowledge, collecting millions of records daily. The disclosure directly prompted industry-wide encryption of internal data-centre links.
Evidence Filters12
NSA/GCHQ slides published by Washington Post confirm programme
SupportingStrongThe Washington Post published NSA and GCHQ slides including diagrams of the Google backbone interception architecture and an analyst annotation ('SSL added and removed here :)') confirming that the programme exploited unencrypted inter-data-centre traffic.
181 million records collected in 30 days — January 2013
SupportingStrongNSA documents cited in the Washington Post reporting specified that MUSCULAR collected approximately 181 million records from Google and Yahoo networks during a single 30-day period in January 2013, confirming the scale of the operation.
Google and Yahoo denied knowledge — and encrypted their links in response
SupportingStrongBoth companies publicly denied any knowledge of or cooperation with MUSCULAR. The denial is consistent with the programme's covert character. Both companies accelerated encryption of their inter-data-centre links directly in response to the disclosure.
MUSCULAR bypassed the legal PRISM framework entirely
SupportingStrongPRISM used FISC orders to compel company disclosure under Section 702. MUSCULAR circumvented this framework by intercepting data on private backbone infrastructure at points outside US legal jurisdiction, with no legal process directed at the companies.
NSA characterised interception as lawful foreign intelligence collection
DebunkingThe US government argued that MUSCULAR was lawful because the interception occurred outside the US on infrastructure characterised as foreign, applying foreign intelligence authorities rather than domestic surveillance law. Critics argued this reasoning had no basis in FISA or the Fourth Amendment.
Rebuttal
The government's legal characterisation is disputed and does not affect confirmation of the programme's existence or its technical operation. The legal argument is a justification post-revelation, not a rebuttal of the underlying facts.
Programme operated without company knowledge or consent
SupportingStrongUnlike PRISM, which involved compelled company cooperation under legal orders, MUSCULAR operated covertly against private infrastructure without the target companies' awareness, raising distinct legal and ethical questions about the limits of intelligence collection on nominally private networks.
GCHQ participation confirmed by British intelligence slides
SupportingStrongThe published documents included GCHQ slides confirming British intelligence participation in MUSCULAR, consistent with the Five Eyes signals intelligence-sharing framework under which NSA and GCHQ routinely conduct joint operations.
Technical analysts verified the described interception method is feasible
SupportingIndependent cryptographers and network engineers who reviewed the published slides assessed the described interception method as technically credible and consistent with known capabilities for tapping fibre-optic backbone traffic at cable landing or peering points.
Google and Yahoo Deployed Inter-Data-Centre Encryption Within Months of Disclosure
NeutralFollowing the Washington Post's October 2013 MUSCULAR story, Google announced it had begun encrypting traffic between its data centres — a measure that would have defeated the programme's collection method. Yahoo implemented similar protections by Q1 2014. This rapid corporate response effectively ended MUSCULAR's operational utility against these targets. The disclosure therefore had a concrete remediation effect, distinguishing this case from surveillance programmes whose continuation was unaffected by exposure.
Google and Yahoo Deployed Inter-Datacenter Encryption by Early 2014, Ending the Program's Utility
DebunkingWithin months of the November 2013 Washington Post disclosures of MUSCULAR, Google announced it had already begun encrypting traffic between its data centers and accelerated deployment. Yahoo completed similar encryption in 2014. Since MUSCULAR exploited unencrypted fiber links between data centers, this technical response effectively ended the program's collection capability for those companies. The speed of corporate response suggests the companies were genuinely unaware and moved decisively when informed — undermining claims of knowing cooperation. This outcome illustrates that adversarial technical countermeasures, once publicly disclosed, can close specific surveillance vectors relatively quickly.
Show 2 more evidence points
MUSCULAR Was a UK GCHQ-Led Operation Targeting Non-US Traffic Abroad
DebunkingGCHQ's Blarney programme tapped Google and Yahoo fibre links between overseas data centres — traffic that, because it transited outside US territory, fell outside both FISA Court jurisdiction and Section 702 authorisations. NSA participated as a junior partner. This jurisdictional framing matters: the operation was designed to avoid US legal constraints by operating on non-US soil against non-US-person traffic, making it legally distinct (if ethically contested) from domestic surveillance programmes. Conflating MUSCULAR with domestic collection programmes mischaracterises its legal basis and target scope.
MUSCULAR Operated Under EO 12333, Targeting Non-US Persons Outside the US
NeutralMUSCULAR was operated jointly with UK GCHQ and justified under Executive Order 12333's foreign-intelligence collection authority, which applies outside US borders to non-US persons. The fiber links targeted were located outside the United States, placing collection outside FISA's geographic and person-based constraints. This does not make the program unproblematic — Americans' communications transiting foreign data centers were incidentally collected — but the legal architecture differs from domestic warrantless surveillance. Conflating MUSCULAR's legal basis with Stellar Wind's domestic warrantless collection, or with programs requiring FISA Court orders, obscures meaningfully different legal and operational frameworks governing each program.
Evidence Cited by Believers7
NSA/GCHQ slides published by Washington Post confirm programme
SupportingStrongThe Washington Post published NSA and GCHQ slides including diagrams of the Google backbone interception architecture and an analyst annotation ('SSL added and removed here :)') confirming that the programme exploited unencrypted inter-data-centre traffic.
181 million records collected in 30 days — January 2013
SupportingStrongNSA documents cited in the Washington Post reporting specified that MUSCULAR collected approximately 181 million records from Google and Yahoo networks during a single 30-day period in January 2013, confirming the scale of the operation.
Google and Yahoo denied knowledge — and encrypted their links in response
SupportingStrongBoth companies publicly denied any knowledge of or cooperation with MUSCULAR. The denial is consistent with the programme's covert character. Both companies accelerated encryption of their inter-data-centre links directly in response to the disclosure.
MUSCULAR bypassed the legal PRISM framework entirely
SupportingStrongPRISM used FISC orders to compel company disclosure under Section 702. MUSCULAR circumvented this framework by intercepting data on private backbone infrastructure at points outside US legal jurisdiction, with no legal process directed at the companies.
Programme operated without company knowledge or consent
SupportingStrongUnlike PRISM, which involved compelled company cooperation under legal orders, MUSCULAR operated covertly against private infrastructure without the target companies' awareness, raising distinct legal and ethical questions about the limits of intelligence collection on nominally private networks.
GCHQ participation confirmed by British intelligence slides
SupportingStrongThe published documents included GCHQ slides confirming British intelligence participation in MUSCULAR, consistent with the Five Eyes signals intelligence-sharing framework under which NSA and GCHQ routinely conduct joint operations.
Technical analysts verified the described interception method is feasible
SupportingIndependent cryptographers and network engineers who reviewed the published slides assessed the described interception method as technically credible and consistent with known capabilities for tapping fibre-optic backbone traffic at cable landing or peering points.
Counter-Evidence3
NSA characterised interception as lawful foreign intelligence collection
DebunkingThe US government argued that MUSCULAR was lawful because the interception occurred outside the US on infrastructure characterised as foreign, applying foreign intelligence authorities rather than domestic surveillance law. Critics argued this reasoning had no basis in FISA or the Fourth Amendment.
Rebuttal
The government's legal characterisation is disputed and does not affect confirmation of the programme's existence or its technical operation. The legal argument is a justification post-revelation, not a rebuttal of the underlying facts.
Google and Yahoo Deployed Inter-Datacenter Encryption by Early 2014, Ending the Program's Utility
DebunkingWithin months of the November 2013 Washington Post disclosures of MUSCULAR, Google announced it had already begun encrypting traffic between its data centers and accelerated deployment. Yahoo completed similar encryption in 2014. Since MUSCULAR exploited unencrypted fiber links between data centers, this technical response effectively ended the program's collection capability for those companies. The speed of corporate response suggests the companies were genuinely unaware and moved decisively when informed — undermining claims of knowing cooperation. This outcome illustrates that adversarial technical countermeasures, once publicly disclosed, can close specific surveillance vectors relatively quickly.
MUSCULAR Was a UK GCHQ-Led Operation Targeting Non-US Traffic Abroad
DebunkingGCHQ's Blarney programme tapped Google and Yahoo fibre links between overseas data centres — traffic that, because it transited outside US territory, fell outside both FISA Court jurisdiction and Section 702 authorisations. NSA participated as a junior partner. This jurisdictional framing matters: the operation was designed to avoid US legal constraints by operating on non-US soil against non-US-person traffic, making it legally distinct (if ethically contested) from domestic surveillance programmes. Conflating MUSCULAR with domestic collection programmes mischaracterises its legal basis and target scope.
Neutral / Ambiguous2
Google and Yahoo Deployed Inter-Data-Centre Encryption Within Months of Disclosure
NeutralFollowing the Washington Post's October 2013 MUSCULAR story, Google announced it had begun encrypting traffic between its data centres — a measure that would have defeated the programme's collection method. Yahoo implemented similar protections by Q1 2014. This rapid corporate response effectively ended MUSCULAR's operational utility against these targets. The disclosure therefore had a concrete remediation effect, distinguishing this case from surveillance programmes whose continuation was unaffected by exposure.
MUSCULAR Operated Under EO 12333, Targeting Non-US Persons Outside the US
NeutralMUSCULAR was operated jointly with UK GCHQ and justified under Executive Order 12333's foreign-intelligence collection authority, which applies outside US borders to non-US persons. The fiber links targeted were located outside the United States, placing collection outside FISA's geographic and person-based constraints. This does not make the program unproblematic — Americans' communications transiting foreign data centers were incidentally collected — but the legal architecture differs from domestic warrantless surveillance. Conflating MUSCULAR's legal basis with Stellar Wind's domestic warrantless collection, or with programs requiring FISA Court orders, obscures meaningfully different legal and operational frameworks governing each program.
Timeline
MUSCULAR collects 181 million records in 30 days
NSA documents later published by the Washington Post record that MUSCULAR collected approximately 181 million records from Google and Yahoo networks during a 30-day period in January 2013, illustrating the programme's operational scale at the time of the Snowden disclosures.
Washington Post publishes Gellman/Soltani MUSCULAR investigation
Barton Gellman and Ashkan Soltani publish the MUSCULAR story in the Washington Post, including NSA/GCHQ slides and the analyst annotation confirming that the programme intercepted unencrypted backbone traffic between Google and Yahoo data centres.
Source →Google announces encryption of inter-data-centre links
Within days of the MUSCULAR disclosure, Google's security engineering team announces an accelerated rollout of encryption for all traffic between its data centres worldwide, explicitly citing NSA surveillance as the motivation. Yahoo announces similar measures.
Industry-wide shift to backbone encryption accelerates post-MUSCULAR
The MUSCULAR revelations accelerate an industry-wide shift toward encrypting inter-data-centre and backbone traffic, with major cloud providers deploying end-to-end encryption for internal infrastructure that had previously been assumed to be protected by its private character alone.
Verdict
Confirmed by NSA and GCHQ slides published by the Washington Post in October 2013. MUSCULAR tapped unencrypted fibre-optic links between Google and Yahoo data centres without company knowledge, collecting approximately 181 million records in a single 30-day period. The programme operated outside FISC legal process. Both companies subsequently encrypted their internal backbone traffic in direct response.
Frequently Asked Questions
How is MUSCULAR different from PRISM?
PRISM operated under Section 702 of the FISA Amendments Act, using FISC-approved orders to compel US communications companies to provide specified data. The companies were legally required to comply and knew about the orders. MUSCULAR involved no legal process directed at Google or Yahoo, no company knowledge, and no cooperation — it was a covert tap of private backbone infrastructure at points outside US jurisdiction.
Did Google and Yahoo know about MUSCULAR?
No. Both companies publicly denied any knowledge of or participation in MUSCULAR. The companies expressed outrage at the disclosure. Within weeks, both companies accelerated plans to encrypt their inter-data-centre backbone traffic — a direct response to the discovery that the NSA had exploited the lack of such encryption.
How much data did MUSCULAR collect?
NSA documents cited in the Washington Post reporting specified approximately 181 million records from Google and Yahoo networks in a single 30-day period in January 2013. The records included both content (emails, documents) and metadata (communication patterns, user identifiers).
Was MUSCULAR legal?
The US government argued that MUSCULAR was conducted lawfully under foreign intelligence collection authorities because the interception occurred at points outside US jurisdiction on infrastructure characterised as foreign. Critics and legal scholars argued this reasoning had no basis in FISA or the Fourth Amendment. The programme was not reviewed by any court before the Snowden disclosures.
Sources
Show 3 more sources
Further Reading
- bookNo Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State — Glenn Greenwald (2014)
- articleNSA infiltrates links to Yahoo, Google data centers worldwide (WaPo) — Barton Gellman, Ashkan Soltani (2013)
- bookDark Mirror: Edward Snowden and the American Surveillance State — Barton Gellman (2020)