XKeyscore: Global NSA Query Interface (Revealed July 2013)

Introduction

In July 2013, the Guardian published NSA training documents provided by Edward Snowden describing a system called XKeyscore. The documents described XKeyscore as the NSA's ''widest-reaching'' signals intelligence analytic tool — a query interface that allowed NSA analysts to search across enormous repositories of collected internet content and metadata by specifying a selector such as an email address, phone number, IP address, or keyword.

XKeyscore was not itself a collection programme; it was a query and analysis layer sitting atop data collected by the NSA's various upstream and downstream collection capabilities, including taps on international fibre-optic cables and collection from internet exchange points.

What XKeyscore Does

XKeyscore operates as a distributed database and query system. Analysts enter a selector — an identifier associated with a target — and XKeyscore searches across indexed repositories of intercepted data to return matching content and metadata. The repositories hold data for rolling time windows: full content of internet sessions for up to a few days, and metadata for longer periods.

The scope of what XKeyscore indexes is extensive. NSA training slides published by the Guardian included descriptions of the system covering email content and headers, web browsing history, search queries, social media activity, online chat logs, metadata showing communication patterns, and file transfers. Analysts could use XKeyscore to track a target across multiple communications channels, reconstruct browsing activity, and identify previously unknown associates through pattern analysis.

The ''No Warrant Required'' Problem

A significant aspect of the XKeyscore disclosure was the training documents' description of the query process. Analysts could run searches on their own authority for the purpose of intelligence collection on foreign targets. While NSA policy required analysts to document their basis for queries and oversight systems were described as monitoring for abuse, the system allowed real-time access to collected content without requiring the analyst to obtain a court order for each individual search.

This was the feature Glenn Greenwald emphasised in the original Guardian reporting and that Snowden referenced in interviews: an analyst could, in his description, ''sit at a terminal and listen to anyone.'' The NSA disputed characterisations of XKeyscore as permitting unconstrained domestic surveillance, arguing that legal authorities and technical controls limited collection to foreign targets. Subsequent reporting and legal analysis suggested the technical controls were imperfect and that US person communications were captured incidentally.

Global Reach

Training documents indicated that XKeyscore drew on collection from over 150 field sites worldwide. The system was described as covering ''nearly everything a typical user does on the internet.'' Partner intelligence agencies in the Five Eyes alliance — Australia, Canada, New Zealand, and the UK — had access to XKeyscore under bilateral intelligence-sharing arrangements.

Confirmation and Official Response

The NSA confirmed XKeyscore's existence in a statement responding to the Guardian's story, describing it as a tool used for ''valid foreign intelligence purposes'' subject to ''extensive oversight.'' The Office of the Director of National Intelligence subsequently declassified additional information about the programme in 2013 and 2014 in response to public and congressional pressure following the Snowden disclosures.

Multiple independent security researchers and legal analysts have analysed the published XKeyscore slides and assessed them as credible and consistent with known NSA technical architecture.

Verdict

Confirmed. XKeyscore's existence is confirmed by NSA training documents published by the Guardian in July 2013, the NSA's own public acknowledgement, and subsequent government declassifications. The system gives NSA analysts query access to billions of intercepted records across global collection sites, covering email, web browsing, search queries, and chat, with analyst-initiated searches not requiring individual court orders.

Beyond the NSA: Who Else Had a Login

The 2013 disclosures described XKeyscore as an NSA system, but later reporting on the same Snowden document set showed the tool's reach extended well past the NSA itself. Under Five Eyes intelligence-sharing arrangements, New Zealand's Government Communications Security Bureau (GCSB) operated its own XKeyscore access, and 2016 reporting drawing on documents reviewed by Der Spiegel found that Germany's foreign intelligence service (the BND) and its domestic counterpart (the BfV) had used XKeyscore since 2007 — years before the Guardian's story made the tool's name public. NSA material described the German services as "key partners" in the relationship. None of this changes what XKeyscore is; it does mean that assessing the programme purely as a question of US domestic law misses that several allied governments had their own terminals into comparable data.

Scope Creep: Not Every Query Was About Terrorism

XKeyscore's official justification, in both the original NSA training slides and the agency's public statements, is counterterrorism and foreign-intelligence collection. Reporting in 2015 by The Intercept and New Zealand's Herald newspapers, based on separate leaked GCSB documents, showed the tool used for purposes that sit uneasily with that framing. One document showed the GCSB building XKeyscore "fingerprints" — targeted keyword combinations — to intercept communications about rival candidates during the 2013 race to become director-general of the World Trade Organization, a contest in which New Zealand's own trade minister, Tim Groser, was a candidate. One fingerprint specifically flagged Indonesia's candidate, Mari Elka Pangestu, as a "particular concern." A second document, dated January 2013, showed XKeyscore configured to intercept messages naming several Solomon Islands government officials and Benjamin Afuga, an anti-corruption campaigner who ran a group publishing government leaks — none of them associated with terrorism in the reporting. The GCSB's acting director, asked about the Solomon Islands surveillance, said "everything we do is explicitly authorised and subject to independent oversight," which may be true as a matter of New Zealand law while still illustrating how a tool sold publicly as a counterterrorism system in practice supported ordinary diplomatic and political intelligence work by a partner agency.

What the NSA Says in Its Own Defense

The NSA's formal response to the Guardian's 2013 story is itself part of the public record and deserves to be represented directly rather than paraphrased. The agency said: "XKeyscore is used as a part of NSA's lawful foreign signals intelligence collection system," and that "allegations of widespread, unchecked analyst access to NSA collection data are simply not true." It added that access is "limited to only those personnel who require access for their assigned tasks," that there are "multiple technical, manual and supervisory checks and balances within the system to prevent deliberate misuse," and that "every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law." This is the NSA's own characterization, not an independent finding, but it is the agency's considered position and the correct baseline against which to weigh the leaked material: the dispute is not over whether XKeyscore exists or what it can technically do — both sides agree on that — but over how tightly the described legal and technical controls actually constrain its use in practice.

That dispute has some genuine texture to it. The 2015 Intercept document release included NSA training material describing system administrators as sharing a single "oper" login and, according to the reporting, having a path to query the underlying databases directly in a way that would not necessarily appear in the query-level logs that record an individual analyst's searches. That detail complicates the "fully auditable" claim, though it addresses a different population (system administrators) than the one the NSA's statement was defending (analysts running searches), so the two claims are not flatly contradictory — they describe two different layers of the same system, one of which appears to have had a documented gap.

The Oversight Board Finally Weighs In

For years after 2013, no US oversight body had publicly examined XKeyscore in detail. That changed when the Privacy and Civil Liberties Oversight Board (PCLOB), an independent federal watchdog agency, disclosed that it had conducted a classified "deep dive" review of NSA's use of XKeyscore for counterterrorism purposes under Executive Order 12333, completing a classified report in December 2020. The PCLOB requested declassification in 2021, and after a lengthy intelligence-community redaction process, released a heavily redacted unclassified version in February 2024 as the Report on Certain NSA Uses of XKEYSCORE for Counterterrorism Purposes.

The report's seven Board-level recommendations are themselves informative about the state of internal oversight as of 2020. They included that NSA "conduct and periodically review and update a legal analysis of XKEYSCORE" — implying no such regularly updated analysis existed at the time — and that NSA "notify the Board of changes to XKEYSCORE that could materially affect the privacy or civil liberties of U.S. persons," a notification requirement that, again, had apparently not been in place. The Board also recommended that NSA periodically report the number and nature of XKeyscore queries resulting in significant compliance findings involving US persons, which implies such findings occur with enough regularity to be worth systematically tracking. Two Board members, Edward Felten and Travis LeBlanc, filed additional recommendations going further, including that XKeyscore analysts be required to tag or otherwise flag known or believed US-person data and that NSA "affirmatively deprioritize" such data within the system. LeBlanc separately and publicly argued, after the redacted report's release, that the redactions obscured the seriousness of what the review had actually found — a dispute among the Board's own members about how alarming the underlying (still-classified) material is.

What the report does not do, at least in its public form, is find that XKeyscore had been used unlawfully against domestic targets outside its authorized foreign-intelligence mission; its scope was a review of process and compliance around an authorized counterterrorism tool, not an investigation into whether the tool's basic legal authority was being exceeded. That is a real limit on how far the report can be read as vindicating the most expansive readings of the 2013 leak, even as its recommendations show that, years after NSA's public assurances, the Board found the internal legal-review and change-notification processes underlying those assurances to be incomplete.

The "Collect It All" Debate: What "Full-Take" Actually Means

A recurring point of dispute since 2013 is what "full-take" collection implies. Some coverage of the leak treated it as evidence that the NSA stores a permanent, searchable copy of everyone's internet activity. An open-source-intelligence analysis of the 2015 New Zealand documents pushed back on that reading, describing "full-take" as a rolling buffer: unfiltered content held for roughly three to five days and metadata for around thirty days before being overwritten, with a targeted "selector" or "fingerprint" required to extract anything meaningful from the buffer rather than the system functioning as an indiscriminate, permanently retained archive. One NSA training slide quoted in that analysis describes the tool's purpose as helping analysts narrow "gigantic shrimping nets" down to "tiny goldfish-sized nets" — the agency's own metaphor for query-based filtering rather than bulk retention. That nuance matters for evaluating the collection architecture, but it does not resolve the underlying concern raised elsewhere in the documents: the same training material describes a low-friction process for defining a selector, and flagged results can be moved into longer-retention NSA databases such as Pinwale for years — so the rolling-buffer point limits, rather than eliminates, the "collect it all" characterization.