NSA Nicknames and Codewords

(Updated: April 18, 2015)

Below is a listing of nicknames and codewords related to US Signals Intelligence (SIGINT) and Communications Security (COMSEC). Most of them are from the National Security Agency (NSA), some are from other government or military agencies.

NICKNAMES are generally unclassified. NSA uses single word nicknames, but at other agencies they usually consist of two separate words, with the first word selected from alphabetical blocks that are assigned to different agencies by the Joint Staff. Usually, nicknames are printed using all capital letters.

CODEWORDS are always classified and always consist of a single word. Active codewords, or their three-letter abbreviations, which identify a classification compartment always need to be shown in the classification or banner line. Normally, codewords are printed using all capital letters.

It's not always clear whether we see a nickname or a codeword, but terms mentioned in public sources like job descriptions can be considered unclassified nicknames.


Similar lists are available on this website for GCHQ, CSE and BND. See also the lists of abbreviations of SIGINT and COMSEC, and general telephony and internet terms.

Please keep in mind that a listing like this will always be work in progress!

(this list has been copied on some other websites and forums, but only this one is being updated frequently)


A B C D E F G H I J K L M N O P Q R S T U V W X Y Z


A
ABNER I - ASA-sponsored general-purpose analytic computer (1952)
ACIDWASH - Covert access point for a mobile phone network in Afghanistan, part of the MYSTIC program * *
ACORN - Compartment for Top Secret COMINT information (1950-1951) *
ACCORDIAN - Type 1 Cryptographic algorithm used in a number of crypto products
ACRIDMINI - TAO computer hacking project *
AETHER - ONI tool "to correlate seemingly disparate entities and relationships, to identify networks of interest, and to detect patterns" *
AGILITY - NSA internet information tool or database
AGILEVIEW - NSA internet information tool or database
AIRGAP - Database which deals with priority DoD missions
AIRHANDLER (AH) - Processing system for wireless data collected by a drone platform, like AST-221A *
AIRSTEED - Cell phone tracking program of the Global Access Operations (GAO) *
AIRWOLF - ?
ALAMITO - The mission of Mexico at the United Nations in New York *
ALBATROSS - Soviet cipher system of the 1940s and maybe 1950s
ALPHA - Retired SIGINT Exchange Designator for Great Britain
ALTEREDCARBON - An IRATEMONK implant for Seagate drives *
ALTEREGO - A type of Question-Focused Dataset based on E.164
AMBERJACK - SIGINT/EW collection and exploitation system
AMBLE - Retired SIGINT product codeword
AMBULANT (AMB) - SI-ECI compartment related to the BULLRUN program
ANCHORY - NSA software system which provides web access to textual intelligence documents
ANGRYNEIGHBOR - Family of radar retro-reflector tools used by NSA's TAO division *
APALATCHEE - The EU mission in New York
APERIODIC - SI-ECI compartment related to the BULLRUN program
APERTURESCIENCE - TAO computer hacking project *
APEX - See Abbreviations listing
APPLE1 - Upstream collection site
APPLESAUCE - Civilian(CIA)-run station on Cyprus (1950s)
APRIL STRAWBERY - Small-scale program that researched vulnerabilities in computer networks running critical infrastructure *
APSTARS - NSA tool that provides "semantic integration of data from multiple sources in support of intelligence processing" *
AQUADOR - Merchant ship tracking tool
ARGYLEALIEN - Method to cause a loss of data by exploiting zeroization of hard-drives *
ARKSTREAM - Implant used to reflash BIOS, installed by remote access or intercepted shipping
ARTIFICE - SSO corporate partner (foreign?) *
AUTOSOURCE - NSA tool or database
AQUACADE - A class of SIGINT spy satellites (formerly RHYOLITE)
ARCA - SIGINT Exchange Designator for ?
ARGON - Satellite mapping program
ARTIFICE - SSO corporate partner under the STORMBREW program
ASPHALT - Project to increase the volume of satellite intercepts at the Menwith Hill Station in the UK *
ASPHALT-PLUS - See above
ASSOCIATION - NSA analytical tool or database
ATALANTA - EU anti-piracy operation
ATLAS - CSEC database
ATLAS - Cryptanalytic computer using magnetic drum storage technology (delivered in 1950)
AUNTIE - SI-ECI compartment related to the BULLRUN program
AURORAGOLD (AG) - Repository of data about international GSM/UMTS networks *
AUTO ASSOCIATION - Second party database
AZUREPHOENIX - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program *

B
BACCHUS - ASA-provided electromechanical cipher equipment for South Korean forces (1953)
BALLOONKNOT - TAO computer hacking project *
BAMBOOSPRING - ?
BANANAGLEE - Software implant that allows remote Jetplow firmware installation
BANCROFT - KY-67 voice encryption system
BANISTER - The Columbian trade bureau in New York *
BANYAN - NSA tactical geospatial correlation database
BARNFIRE - TAO tool to erase the BIOS on a brand of servers that act as a backbone to many rival governments *
BASECOAT - Program targeting the mobile phone network on the Bahamas (sigad: US-3310A) *
BASTE - Retired SIGINT product codeword
BATON - Type 1 Block cipher algorithm, used with many crypto products
BEACHHEAD - Computer exploit delivered by the FERRETCANON system *
BEAMER - ?
BEGGAR SHADOW - Navy airborne SIGINT missions
BELLTOPPER - NSA database *
BELLVIEW - SIGINT reporting tool
BERSERKR - Persistent backdoor that is implanted into the BIOS and runs from System Management Mode * *
BIG LOOK - ELINT systems on Navy EC-121s to detect SAM radars (Vietnam War)
BIGOT - List of personnel cleared for access to highly sensitive information or operations
BIG RIB - airborne telemetry collection program using RB-57 aircraft based in Adana, Turkey (1965-?)
BINOCULAR - Former NSA intelligence dissemination tool
BIRCHWOOD - Upstream collection site
BITTERSWEET - first "advisory warning" (COMINT-provided alert) plan for airborne SIGINT missions (1952)
BLACKBOOK - ODNI tool for large-scale semantic data analysis *
BIRDWATCHER - Automated survey system *
BLACKFOOT - The French mission at the United Nations in New York *
BLACKHAWK - Program for surveillance of the Turkish mission at the UN in New York
BLACKHEART - Collection through FBI implants *
BLACKMAGIC - NSA database or tool
BLACKNIGHT - Filtering or selection tool *
BLACKPEARL - NSA database with SIGINT 5-tuple (TCP/IP), identified routers, routing protocols, and SIGINT access points, maybe also case notations * * *
BLACKWATCH - NSA reporting tool
BLARNEY - Program for intercepting phone and internet traffic at switches in the US (since 1978)*
BLEAKINQUIRY - Metadata database of potentially exploitable VPNs *
BLINDDATE - Connection for afloat computer network operations like aboard USS Annapolis *
BLUEANCHOR - Partner providing a network access point for the YACHTSHOP program
BLUEFISH (BLFH) - Compartment of the KLONDIKE control system
BLUESASH - Network used by NTOC operational analysts *
BLUE SKY - Airborne COMINT program in Far East (1952-?)
BLUEZEPHYR - Sub-program of OAKSTAR
BOOTY - Retired SIGINT product codeword
BORGERKING - Something related to Linux exploits *
BOTANICREALTY - Video demodulation tool (formerly: UNCANNY) *
BOUNDLESSINFORMANT - DNI and DNR metadata visualization tool
BOURBON - Joint NSA and GCHQ program for breaking Soviet encryption codes (1946-?)*
BOXINGRUMBLE - Network attack that was countered by QUANTUMDNS *
BRIDE - Second codename for what eventually became VENONA *
BROKENRECORD - NSA tool
BROKENTIGO - Tool for computer network operations
BROADSIDE - Covert listening post in the US embassy in Moscow
BROOMSTICK - ?
BRUNEAU - The Italian embassy in Washington DC *
BRUTUS - Tool or program related to MARINA *
BUFFALOGREEN - The name ORANGECRUSH was known to Polish partners *
BULLDOZER - PCI bus hardware implant on intercepted shipping
BULLRUN - An NSA COI for decryption of network communications
BULLSEYE - NSG High-Frequency Direction-Finding (HF-DF) network (now called CROSSHAIR)
BYEMAN (BYE) - Retired SCI control system for overhead collection systems (1961-2005)
BYZANTINE - First word of nicknames for programs involving defense against Chinese cyber-warfare and US offensive cyber-warfare *
BYZANTINE ANCHOR (BA) – A group of Chinese hackers which compromised multiple US government and defense contractor systems since 2003 *
BYZANTINE CANDOR (BC) – A group of Chinese hackers which compromised a US-based ISP and at least one US government agency * *
BYZANTINE FOOTHOLD (BF) – A group of Chinese hackers who attacked various international companies and internet services providers *
BYZANTINE HADES (BH) – A concerted effort against Chinese hackers who attacked the Pentagon and military contractors. Probably renamed to the LEGION-series *
BYZANTINE TRACE - "intrusion set" already indentified in 2007 *

C
CADENCE - NSA database with tasking dictionaries
CAJABLOSSOM - Automated system for analysing and profiling internet browsing histories
CAKEBREAD - Codename for Osama bin Laden
CALIX - System used at the Waihopai satellite intercept station *
CALYPSO - Remote SATCOM collection facility
CANDYGRAM - Laptop mimicking GSM cell tower, sends out SMS whenever registered target enters its area, for tracking and ID of targets
CANYON - Class of COMINT spy satellites (1968-1977)
CANOE - Compartment for Top Secret COMINT information (1952-1953) *
CANNON LIGHT - Counterintelligence database of the US Army
CAPRICORN - (former?) database for voice data *
CAPTIVATEDAUDIENCE - Computer implant plug-in to take over a targeted computer’s microphone and record conversations taking place near the device
CARBOY - Second Party satellite intercept station at Bude, England
CARBOY II - Units of ECHELON which break down satellite links into telephone and telegraph channels
CARILLON - Complex of five IBM-370 (or 360, later four IBM 3033s) high performance computers strapped together at Fort Meade, for a mostly traffic analytic process (1973)
CARPAT - NSA contact chaining algorithm *
CASport - NSA user authorization service
CASTLECRASHER - Primary technique for executing DNT payloads for Windows computers *
CATALYST - Computer system capable of automatically analyzing the massive quantities of data gathered across the entire intelligence community *
CENTER ICE - Data center for the exchange of intelligence regarding Afghanistan among the members of the 14-Eyes/SSEUR *
CENTERMASS - NSA tool or database
CENTRICDUD - Tool that can read and write bytes in the CMOS of a targeted Windows computer *
CERF CALL MOSES1 - Contact Event Record Format - for certain telephony metadata *
CERNET - Open Source information used for the TREASUREMAP tool *
CHALET - First codename for CHALET/VORTEX class SIGINT satellites (the codename was changed after 1979 leak)
CHALKFUN - Analytic tool, used to search the FASCIA database *
CHAOS - CIA domestic spying operation (1967-1973)
CHAOSOVERLORD - TAO computer hacking project *
CHARGER HORSE - Communication net for afloat direct SIGINT support detachments (Vietnam War, 1969-?)
CHASEFALCON - Major program of the Global Access Operations (GAO) *
CHATTERII - Communications tool (connecting to 3rd Party agencies?)
CHEER - Retired SIGINT product codeword
CHENEY - Soviet cipher system, probably of the 1950s
CHESS - Compartment of TALENT KEYHOLE for the U-2 spy plane
CHEWSTICK - NSA tool or database
CHIMNEYPOOL - Framework or specification of GENIE-compliance for hardware/software implants
CHIPPEWA - Some communications network, involving Israel *
CHOCOLATESHIP - TAO computer hacking project *
CHUTE - Retired SIGINT product codeword
CIMBRI - Probably a metadata database *
CINEPLEX - NSA tool or database
CIRCUIT RAPTOR - System for processing data from circuit switched telephone networks *
CLARIFYMIND - Pilot program for secure wireless communications *
CLASSIC - ?
CLASSIC BULLSEYE - Worldwide ocean SIGINT surveillance or direction finding system (1960's-?)
CLASSIC TROLL - System that increases the probability of SIGINT intercept by 500%, supporting tactical and national requirements
CLASSIC WIZARD - Satellite ocean surveillance system for ELINT
CLEVERDEVICE - Upstream collection site
CLOUD - NSA database
CLOUD - DSP program implementing graph algorithms in a cloud computing environment *
CLOUDSHIELD - System that terminates a client-side connection to a malicious server and blocks the server's response *
COASTLINE - NSA tool or database
COBALTFALCON - Sub-program of OAKSTAR
COBRA FOCUS - NSA-G operations center for producing intelligence from Iraq *
COGNOS - NSA tool or database
COLERIDGE - Soviet cipher system of the 1940s
COMFY LEVI - C-130s with roll-on SIGINT suites (1968-?)
CORDOBA - Type 2 Cryptographic algorithm used in a number of crypto chips
COMBAT SENT - Reconaissance operation
COMMONDEER - Computer exploit for looking whether a computer has security software
COMMONGROUND - System used at the Waihopai satellite intercept station *
COMMONVIEW - Internal NSA monitoring tool *
CONFIRM - NSA database for personell access
CONJECTURE - Network compatible with HOWLERMONKEY
CONTRAOCTAVE - NSA telephony tasking database * Used to determine 'foreigness' *
CONVEYANCE - Voice content ingest processor *
COPILOT - System that automatically scans digital data for things like language, phone and creditcard numbers and attachments *
COPSE - Compartment for Top Secret COMINT information (1949-1950) *
CORALINE - NSA satellite intercept station at Sabena Seca at Puerto Rico (closed)
CORALREEF - Database for VPN crypto attack data *
CORONA - A series of photographic surveillance satellites (1959-1972)
CO-TRAVELER - Set of tools for finding unknown associates of intelligence targets by tracking movements based upon cell phone locations *
COTTONMOUTH (CM) - Computer implant devices used by NSA's TAO division
COTTONMOUTH-I (CM-I) - USB hardware implant providing wireless bridge into target network and loading of exploit software onto target PCs, formerly DEWSWEEPER
COTTONMOUTH-II (CM-II) - USB hardware host tap provides covert link over USP into target's network co-located with long haul relay; dual-stacked USB connector, consists of CM-I digital hardware plus long haul relay concealed in chassis; hub with switches is concealed in a dual stacked USB connector and hard-wired to provide intra-chassis link.
COTTONMOUTH-III (CM-III) - Radio Frequency link for commands to software implants and data infiltration/exfiltration, short range inter-chassis link within RJ45 Dual Stacked USB connector
COURIERSKILL - Filtering or selection tool *
COWBOY - The DICTIONARY computer used at the Yakima station of ECHELON *
CRANKSHAFT - Codename for Osama bin Laden
CREAM - Compartment for Top Secret COMINT information (1946-1947) *
CREDIBLE - Transport of intelligence materials to partner agencies
CREST - Database that automatically translates foreign language intercepts in English *
CRISSCROSS - Database of telecommunications selectors, operated by the CIA and also used by DOJ, DOD and NSA
CROSSBEAM - GSM module mating commercial Motorola cell with WagonBed controller board for collecting voice data content via GPRS (web), circuit-switched data, data over voice, and DTMF to secure facility, implanted cell tower switch
CROSSBONES - Analytic tool
CROSSEYEDSLOTH - TAO computer hacking project *
CROSSHAIR - NSG High-Frequency Direction-Finding (HF-DF) network (formerly BULLSEYE)
CRUMPET - Covert network with printer, server and desktop nodes
CULTWEAVE - Smaller size SIGINT database *
CYBERTRANS - A common interface to a number of underlying machine translation systems *
CYCLONE Hx9 - Base station router, network in a box using Typhon interface
CYR - Intelligence exchange agreement between DIA and the Israeli military intelligence directorate (1968) *

D
DAFF - Codeword for products of satellite imagery
DAMEON - Remote SATCOM collection facility
DANCER - Project initiated in 1965 to employ South Vietnamese as linguists in US SIGINT operations
DANCINGOASIS (DGO) - SSO program collecting data from fiber optic cables between Europe and the Far East (since 2011) *
DANDERSPRITZ - Software tool that spoofs IP and MAC addresses, intermediate redirector node
DANGERMOUSE - Tactical SIGINT collecting system for like cell phone calls
DARDANUS - Remote SATCOM collection facility
DAREDEVIL - Shooter/implant as part of the QUANTUM system *
DARKFIRE - TAO computer hacking project *
DARKTHUNDER - TAO computer hacking project *
DARKQUEST (DQ) - Automated FORNSAT survey system * that can for example identify the presence of a VPN *; part of SHAREDQUEST *
DAUNT - Compartment for Top Secret COMINT information (1959-1960) *
DAYSEND - Program at NSA's communications complex receiving intercepts files (1973)
DECKPIN - NSA crisis cell activated during emergencies
DEEPDIVE - An XKEYSCORE related method *
DEFIANTWARRIOR - Program under which a host computer that is infected with an exploitable bot can hijacked through a QUANTUMBOT attack and redirected to the NSA *
DEITYBOUNCE - Provides implanted software persistence on Dell PowerEdge RAID servers via motherboard BIOS using Intel's System Management Mode for periodic execution, installed via ArkStream to reflash the BIOS
DELTA - Former SCI control system for intercepts from Soviet military operations
DENIM - Retired SIGINT product codeword
DESERTWINTER - Codeword found in the source code used by the Equation hacking group *
DESPERADO - NSA software tool to prepare reports
DEWSWEEPER - Technique to tap USB hardware hosts *
DIANA - ASA-provided one-time-pad system for South Korean forces (1953)
DIKTER - SIGINT Exchange Designator for Norway
DINAR - Compartment for Top Secret COMINT information (1961-1965) *
DIONYSUS - Remote SATCOM collection facility
DIRESCALLOP - Method to circumvent commercial products that prevent malicious software from making changes to a computer system
DISCOROUTE - NAC/GCHQ repository for router configuration files from CNE and passive SIGINT, like for example telnet sessions * *
DISHFIRE - NSA database for text messages (SMS)
DISTANTFOCUS - A pod for tactical SIGINT and precision geolocation (since 2005) *
DISTILLERY - Tactical collection system(?) *
DISTILLERY - Stream-based platform for executing hacking identification applications *
DIVERSITY - SIGINT Exchange Designator for ?
DOBIE - The South African consulate and mission at the UN in New York *
DOCKETDICTATE - Something related to NSA's TAO division
DOGCOLLAR - A type of Question-Focussed Dataset based on the Facebook display name cookie
DOGHUT - Upstream collection site
DOUBLEARROW - One of NSA's voice processing databases? *
DRAGGABLEKITTEN - An XKEYSCORE Map/Reduce analytic *
DRAWSTRING - Project to "remote" more intercept facilities because of budget cuts (1973-?)
DREADNOUGHT - NSA operation focused on Ayatollah Khamenei *
DRINKPARSLEY - Codeword found in the source code used by the Equation hacking group *
DROPMIRE - Passive collection of emanations (e.g. from printers or faxes) by using a radio frequency antenna
DROPOUTJEEP - STRAITBIZARRE-based software implant for iPhone, initially close access but later remotely
DRTBOX - System for processing data from mobile communication networks
DRUG - Third codename for what eventually became VENONA *
DRUID - SIGINT Exchange Designator for third party countries
DRYAD - A US military numeral cipher/authentication system
DRYTORTUGAS - Analytic tool
DUALTIRE - System used at the Waihopai satellite intercept station *
DUSKPALLET - SSO interception program for GSM networks in Kenya (US-3270), part of the MYSTIC program *
DYNAMO - SIGINT Exchange Designator for Denmark
DYNO - Classifed codename for the Galactic Radiation And Background (GRAB) Low-Earth Orbit ELINT satellite (1960-1962 launches)

E
EAGLE - Upstream collection site
EASYKRAKEN - An IRATEMONK implantation for ARM-based Samsung drives *
ECHELON - A SIGINT collection network run by Australia, Canada, New Zealand, the United Kingdom, and the United States
ECHO - SIGINT Exchange Designator for Australia
ECRU (EU) - Compartment of the ENDSEAL control system
EDEN - Upstream collection site
EGOTISTICALGIRAFFE (EGGI) - NSA program for exploiting the TOR network *
EGOTISTICALGOAT (EGGO) - NSA tool for exploiting the TOR network *
EIDER - Compartment for Top Secret COMINT information (1955-1959) *
EIKANOL (or: EIKONAL) - Joint NSA-BND operation to tap a fiber-optic cable of Deutsche Telekom in Frankfurt, part of the RAMPART-A program
EINSTEIN - Cell phone network intercepting equipment used by SCS units
EINSTEIN - Intrusion detection system for US government network gateways (deployed in 2004)
EINSTEIN 2 - Second version of the EINSTEIN program for detecting malicious network activity
EINSTEIN 3 - Third version of the EINSTEIN program that will monitor government computer traffic on private sector sites too *
ELEGANTCHAOS - Large scale FORNSAT data analysis system *
EMBRACEFLINT - Tool for computer network operations
EMERALD - Alternate codename for operation WHARPDRIVE(?) *
ENDSEAL (EL) - SCI control system
ENDUE - A COI for sensitive decrypts of the BULLRUN program
ENTOURAGE - Directional finder for line of bearing for GSM, UMTS, CDMA, FRS signals, works with NEBULA active interrogator within GALAXY program
EPICSHELTER - Sophisticated data backup system designed by Edward Snowden *
EQUATION (Group) - Nickname given by Kaspersky to a highly advanced computer hacking group, suspected of being tied to NSA *
ERRONEOUSINGENUITY (ERIN) - NSA tool for exploiting the TOR network *
ETCHINGSPIN - SSO mobile telephone interception program, part of the MYSTIC program *
EVENINGEASEL - Program for surveillance of phone and text communications from Mexico's cell phone network (sigad: US-3411), part of the MYSTIC program *
EVILOLIVE - Iinternet geolocation tool
EVOLVED MUTANT BROTH - Second party database
EXPLORER I / II / III - Intercept operations using unmaned equipment on hilltops during the Vietnam War (1970-1972)
EYESPY - System that scans data for logos of companies, political parties and other organizations, as well for pictures with faces for facial recognition *

F
FACELIFT - Codeword related to NSA's Special Source Operations division *
FACTOR - NSA program targeting North Vietnamese maritime infiltration (1970-?)
FAIRVIEW - NSA corporate partner with access to international cables, routers, and switches (since 1985)*
FAIRVIEWCOTS - System for processing telephony metadata collected under the FAIRVIEW program *
FAKEDOUBT - An IRATEMONK implantation for ARM-based Hitachi drives *
FALLENORACLE - NSA tool or database
FALLOUT - DNI metadata ingest processor/database
FALLOWHAUNT (FH) - System used at the Waihopai satellite station, New Zealand, part of SHAREDQUEST *
FARMER - Projected general-purpose computer for both cryptanalysis and traffic analysis (1950s)
FASCIA - DNR metadata ingest processor/database *
FASCIA II - Ibidem with a dedicated HCS partition *
FASCINATOR - Series of Type 1 encryption modules for Motorola digital-capable voice radios
FASHIONCLEFT (FC) - Protocol for hiding packets of VPN and VoIP communications within other packets that are allowed to leave the targeted network *
FASTBAT - Telephony related database?
FASTFOLLOWER - Tool to identify foreign agents who might tail American case officers overseas by correlating cellphone signals
FASTSCOPE - NSA database
FEEDTROUGH - Software implant for unauthorized access to Juniper firewall models N5XT, NS25, NS50, NS200, NS500, ISG1000
FERRETCANON - Subsystem of the FOXACID system *
FIFTYEXCLAIM - Cover term representing NSA's contract with Computer Sciences Corporation (CSC) for mission support in Bad Aibling, Germany *
FINKDIFFERENT (FIDI) - Tool used for exploiting TOR networks
FIRE ANT - Open Source visualisation tool
FIREBIRD - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program *
FIREFLY - NSA key generation scheme, used for exchanging EKMS public keys
FIRETRUCK - SIGINT tool or database
FIREWALK -Bidirectional network implant, passive gigabit ethernet traffic collector and active ethernet packet injector within RJ45 Dual Stacked USB connector, digital core used with HOWLERMONKEY, formerly RADON
FISHBOWL - NSA program for securing commercial smartphones
FLARE - Retired SIGINT product codeword
FLATLIQUID - TAO operation against the office of the Mexican president *
FLEMING - The embassy of Slovakia in Washington DC *
FLINTLOCK - The DICTIONARY computer used at the Waihopai station of ECHELON *
FLOWBEE - Project of NSA's Research Directorate for reducing the volumes of metadata collected from high-speed links (2008) *
FLUTE - System used at the Waihopai satellite intercept station *
FLUXBABBITT - Hardware implant for Dell PowerEdge RAID servers using Xeon processors
FOGGYBOTTOM - Computer implant plug-in that records logs of internet browsing histories and collects login details and passwords used to access websites and email accounts
FOREMAN - Tactical SIGINT database? Used to determine 'foreigness' *
FOURSCORE - (former?) database for fax and internet data *
FOXACID (FA?) - System of secret internet servers used to attack target computers * or TAO tool that allows to continually add functions to small malware programs even after they have been installed in target computers *
FOXSEARCH - Tool for monitoring a QUANTUM target which involves FOXACID servers
FOXTRAIL - NSA tool or database *
FRIARTUCK - VPN Events tool or database (CSEC?)
FREEFLOW-compliant - Supported by TURBULENCE architecture
FREEZEPOST - Something related to NSA's TAO division
FRESNELEFFECT - System used at the Waihopai satellite intercept station *
FRONTO - Retired SIGINT Exchange Designator for ?
FROSTBURG - Connection Machine 5 (CM-5) supercomputer, used by NSA from 1991-1997
FROTH - Compartment for Top Secret COMINT information (1953-1954) *
FRUGALSHOT - FOXACID servers for receiving callbacks from computers infected with NSA spying software

G
GADGET HISS - Computer network "intrusion set" already identified in 2007 *
GALACTICHALO - Remote SATCOM collection facility
GALAXY - Find/fix/finish program of locating signal-emitting devices of targets
GAMMA (G) - Compartment for highly sensitive communication intercepts
GAMUT - NSA collection tasking tool or database
GARLICK - The NSA satellite intercept station at Bad Aibling (Germany)
GATEKEEPER - NSA user account management system
GAVEL - Retired SIGINT product codeword
GECKO II - System consisting of hardware implant MR RF or GSM, UNITEDRAKE software implant, IRONCHEF persistence back door
GEMINI - Remote SATCOM collection facility
GENESIS - Filtering tool for internet communications, related to XKEYSCORE
GENESIS - Modified GSM handset for covert network surveys, recording of RF spectrum use, and handset geolocation based on software defined radio
GENIE - Overall close-access program, collection by Sigads US-3136 and US-3137 * *
GHOSTMACHINE - NSA's Special Source Operations cloud analytics platform
GHOSTWolf - Something related to CT10 *
GINSU - Provides software persistence for the CNE implant KONGUR having PCI bus hardware implant BULLDOZER on MS desktop PCs
GILGAMESH (GMESH) - Predator-based NSA geolocation system used by JSOC *
GISTQEUE (GQ) - NSA software or database
GJALLER - NSA tool or database
GLINT - Compartment for Top Secret COMINT information (1947-1949) *
GLOBALBROKER - NSA tool or database
GLOBALREACH - Tool for federated querying metadata records shared by NSA and its Five Eyes partners *
GLOBALTIPPER (GT) - System for internal requests of information *
GLOBALWATCH - Software suite within the Real Time Regional Gateway (RT-RG)
GM-PLACE - Database for the BOUNDLESSINFORMANT tool *
GODLIKELESION - Modernization program for NSA's European Technical Center (ETC) in Wiesbaden in 2011 *
GODSURGE - Runs on FLUXBABBITT circuit board to provide software persistence by exploiting JTAG debugging interface of server processors, requires interdiction and removal of motherboard of JTAG scan chain reconnection
GOLD - Joint SIS-CIA operation to wiretap Soviet army landlines through a tunnel under Berlin (1953-1956; British codename: STOPWATCH)
GOLDBERG - First magnetic drum storage technology (1947)
GOLDENCARRIAGE - NSA corporate servers, used by the AURORAGOLD application *
GOLDENRETRIEVER - Storage and/or distribution system *
GOLLUM - Computer implant created by a partner agency *
GOPHERRAGE - Pilot project that seeks to develop a hypervisor implant to provide implant capabilites and a back door *
GOPHERSET - Software implant on GMS SIM phase 2+ Toolkit cards that exfiltrates contact list, SMS and call log from handset via SMS to user-defined phone; malware loaded using USB smartcard reader or over-the-air.
GOSSAMER - SIGINT/EW collection and exploitation system
GOTHAM - Processor for external monitor recreating target monitor from red video
GOURMETTROUGH - Configurable implant for Juniper NetScreen firewalls including SSG type, minimal beaconing
GOUT - Subcompartment of GAMMA for intercepts of South Vietnamese government communications
GOVPORT - US government user authentication service
GRAB - SIGINT satellite program
GRANDMASTER - Processing system for internet traffic, has been replaced by WEALTHYCLUSTER and TURMOIL *
GREY FOX - The 2003 covername of the Mission Support Activity (MSA) of JSOC
GREYSTONE (GST) - CIA's highly secret rendition and interrogation programs *
GROK - Computer implant plug-in used to log keystrokes
GROUPDIVE - Network used by NTOC operational analysts *
GUARDRAIL I / II / IV / V - Series of Army airborne SIGINT collection systems on RC-12 aircraft
GUMFISH - Computer implant plug-in to take over a computer’s webcam and snap photographs
GUNMAN - NSA 1984 OPSEC project to remove 11 tons of electronic devices from the US Embassy of Moscow for thorough inspection in the US. GUNMAN eventually found KGB bugs planted into electric typewriters.
GUPY - Subcompartment of GAMMA for intercepts from Soviet leadership car phones (1960's-70's)

H
HAIRBALL - Project of NSA's Research Directorate (2008) *
HALLUXWATER - Software implant as boot ROM upgrade for Huawei Eudemon firewalls, finds patch points in inbound packet processing, used in O2, Vodafone and Deutsche Telekom
HAMMERCHANT - Implant for network routers to intercept and perform exploitation attacks against data sent through a Virtual Private Network (VPN) and/or phone calls via Skype and other VoIP software *
HAMMERMILL - Insertion Tool controls HEADWATER boot ROM backdoor
HAMMERSTEIN - Implant for network routers to intercept and perform exploitation attacks against data sent through a Virtual Private Network (VPN) and/or phone calls via Skype and other VoIP software
HAMMOCK - Direct SIGINT support process for US Air Force missions over North Vietnam (1965-?)
HAPPYFOOT - Program that intercepts traffic generated by mobile apps that send a smartphone’s location to advertising networks
HAPPYHOUR - Connection for afloat computer network operations like aboard USS Annapolis *
HARD ASSOCIATION - Second party database
HARVEST - An IBM supercomputer used by NSA from 1962-1976
HAVE BLUE - Development program of the F-117A Stealth fighter-bomber
HAVE QUICK (HQ) - Frequency-hopping system protecting military UHF radio traffic
HAWKEYE - AFSS project for an airborne direction-finding system; never operational (1963)
HEADMOVIES - TAO computer hacking project *
HEADWATER - Permanent backdoor in boot ROM for Huawei routers stable to firmware updates, installed over internet, capture and examination of all IP packets passing through host router, controlled by Hammermill Insertion Tool
HEMISPHERE - Program under which AT&T provides telephone records to the DEA
HEMLOCK - The Italian embassy in Washington DC *
HERCULES - CIA terrorism database
HERETIC - NSA tool or database
HERESYITCH - UC collateral tool, collaborative program between NSA units T1222 and SSG *
HERMOS - Joint venture between the German BND and another country with access for NSA (2012)*
HERON - Retired SIGINT product codeword
HIGHCASTLE - Tactical database?
HIGHLANDS - Technique for close access collection from computer implants *
HIGH PRIDE - ? *
HIGHTIDE - NSA tool or database
HOBGOBLIN - NSA tool or database
HOLLOWPOINT - Software defined radio platform
HOMEBASE - Database which allows analysts to coordinate tasking with DNI mission priorities
HOMEMAKER - Upstream collection site
HOMINGPIGEON - Program to intercept communications from airplane passengers *
HOTZONE - ?
HOWLERMONKEY (HM) - Generic radio frequency (RF) transceiver tool used for various applications *
HUFF - System like FOXACID? *
HYDRA - CIA program to secretly access databases maintained by foreign countries and extract data to add to US watchlists *
HYDROCASTLE - Tool or database with 802.11 configuration data extracted from CNE activity in specific locations *
HYSON - Retired SIGINT product codeword

I
ICEBERG - Major NSA backbone project *
ICE CASTLE - Intelligence exchange agreement between DIA and the Israeli military intelligence directorate (1988) *
ICREACH - Tool for sharing communications metadata among the US Intelligence Community (since 2007)*
IDITAROD (IDIT) - Compartment of the KLONDIKE control system
IGLOO WHITE - Program for detecting movement of vehicles through unattended ground sensors, tested in Laos from 1968-1973
INCENSER - Joint NSA-GCHQ program for tapping an internet cable between Europe and Asia with the help of Cable & Wireless; part of the WINDSTOP program
INDEX - Team at Menwith Hill Station (MHS) *
INDIA - SIGINT Exchange Designator for New Zealand (retired)
INDRA - Satellite intercept station near Khon Khaen, Thailand (1979-ca. 2000)
INTERQUAKE (IQ) - A terrestrial signals knowledge base and interface *
INTOLERANT - Data set stolen by hackers, discovered and exploited by CSEC and Menwith Hill Station since 2010 *
INTREPID SPEAR - The 2009 covername of the Mission Support Activity (MSA) of JSOC
INTRUDER - Series of ELINT and COMINT spy satellites (since 2009)
IRATEMONK - Hard drive firmware providing software persistence for desktops and laptops via Master Boot Record substitution, for Seagate Maxtor Samsung file systems FAR NRFS EXT3 UFS, payload is implant installer, shown at internet cafe *
IRONAVENGER - NSA hacking operation against an ally and an adversary (2010) *
IRONCHEF - Provides access persistence back door exploiting BIOS and SMM to communicate with a 2-way RF hardware implant
IRON HORSE - NSA equipment to display intercepted morse grid-positions on a radar scope (1967-?)
IRONSAND (IS) - Second Party satellite intercept station at Waihopai, New Zealand
ISHTAR - SIGINT Exchange Designator for Japan (retired)
ISLANDTRANSPORT (IT) - Internal messaging service, as part of the QUANTUM system * or data distribution system *
IVORY - Retired SIGINT product codeword
IVY BELLS - NSA, CIA and Navy operation to place wire taps on Soviet underwater communication cables

J
JACKHAMMER - System used at the Waihopai satellite intercept station *
JACKKNIFE - The NSA satellite intercept station at Yakima (US)
JACKPOT - Internal NSA process improvement program (early 1990s - early 2000s) *
JADE - First codename for what eventually became VENONA *
JAEGER - Former SIGINT Exchange Designator for Austria
JEEPFLEA - TAO computer hacking project *
JETPLOW - Persistent firmware back door for Cisco PIX and ASA firewall and routers, modifies OS at boot time
JOLLYROGER - Tool that provides metadata that describe the networking environment of TAO-implanted Windows PCs *
JOSEKI-1 - Classified Suite A algorithm
JOURNEYMAN - Retrieval tool or system *
JUBILEECORONA - NSA unit *
JUGGERNAUT - Ingest system that processes intercepted calls from mobile phone networks * *
JUMPDOLLAR - Tool to support various file systems *
JUMPSEAT - Class of SIGINT reconnaissance satellites (1971-1983)
JUNE - FBI classification marking for information related to unwarranted electronic surveillance and surreptitious entries * JUNIORMINT - Implant digital core, either mini printed circuit board or ultra-mini Flip Chip Module, contains ARM9 micro-controller, FPGA Flash SDRAM and DDR2 memories




K
KAMPUS - SIGINT Exchange Designator for ? (retired)
KANDIK (KAND) - Compartment of the KLONDIKE control system
KARMA POLICE - Second party database
KATEEL - The Brazilian embassy in Washington *
KEA - Asymmetric-key Type 2 algorithm used in products like Fortezza, Fortezza Plus
KEELSON - Internet metadata processing system *
KEYCARD - Database for VPN key exchange IP packet addresses * or filtering/selection tool *
KEYRUT - Retired SIGINT Exchange Designator for ?
KILOMISER - System used at the Waihopai satellite intercept station *
KILTING - ELINT database
KIMBO - Retired SIGINT product codeword
KIRKBOMB - Windows kernel examination to detect loaded drivers and processes *
KLIEGLIGHT (KL) - Tactical SIGINT reports
KLONDIKE (KDK) - Control system for sensitive geospatial intelligence
KLONDIKE - The embassy of Greece in Washington DC *
KNIGHTHAWK - Probably a military SIGINT tool
KOALAPUNCH - TAO computer hacking project *
KODA - Method for summarizing very large textual data sets
KONGUR - Software implant restorable by GINSU after OS upgrade or reinstall
KRAUSS - System used at the Waihopai satellite intercept station *
KRONE - Retired SIGINT product codeword

L
LACEBARK - NSA project to upgrade South Vietnamese SIGINT communications security
LACONIC (LAC) - Retired NSA dissemination control marking
LADYLOVE - The NSA satellite intercept station at Misawa, Japan (since 1982)
LANYARD - Reconaissance satellite program
LARUM - Retired SIGINT product codeword
LATEN(T)TH(R)EAT - System that breaks intercepted satellite signals down into individual communications *
LAUNDROMAT - Accesses to yet unknown sources, similar to DUSKPALLET *
LEAKYFAUCET - Flow repository of 802.11 WiFi IP addresses and clients via STUN data *
LEGALREPTILE - System that collects text message and call metadata, showing who is contacting whom and when *
LEGION AMBER - Chinese hacking operation against a major US software company *
LEGION JADE - A group of Chinese hackers *
LEGION RUBY - A group of Chinese hackers *
LEGION YANKEE - Chinese hacking operation against the Pentagon and defense contractors (2011)*
LEMONWOOD - NSA satellite intercept station in Thailand
LEXHOUND - CCE Extraction Architecture * and/or Front-end tool that performs Google-like searching across repositories *
LIBERTY - First word of nicknames for collection and analysis programs used by JSOC and other sensitive DOD activities *
LIBERTY BLUE - Modified RC-12 Guardrail surveillance airplane used by JSOC's Mission Support Activity (MSA)
LIFESAVER - Technique which images the hard drive of computers *
LIGHTNING - Research project into a "1,000 megahertz" computer. Didn't produce a functional computer but pioneered many technology "bricks" (1950s)
LIONSHARE - Internal NSA process improvement program (2003-2008) *
LITHIUM - Facility to filter and gather data at a major (foreign?) telecommunications company under the BLARNEY program *
LITTLE CLOUD - Airborne collection program using RB-57 aircraft based in Pakistan (1963-1965?)
LOCATOR - Some kind of NSA database *
LODESTAR - Cryptanalytic computer subcomplex at NSA headquarters (1978)
LODESTONE - NSA's CRAY-1 supercomputer
LOGGERHEAD - Device to collect contents of analog cell phone calls (made by Harris Corp.) *
LOLLYGAG - SSO mobile telephone interception program, part of the MYSTIC program *
LOMA - SCI control system for Foreign Instrumentation and Signature Intelligence* *
LONGFELLOW - Soviet cipher system of the 1940s
LOPERS - System for processing data collected from Public Switched Telephone Networks (PSTN) * *
LOUDAUTO - An ANGRYNEIGHBOR radar retro-reflector, microphone captures room audio by pulse position modulation of square wave
LUSTRE - Memorandum of Understanding regarding the exchange of data between the NSA and the French foreign intelligence service DSGE (2011/12) *
LUTEUSICARUS - TAO computer hacking project *
LUTEUSOBSTOS - Codeword found in the source code used by the Equation hacking group *

M
MACHINESHOP - ? *
MADBISHOP - Hard drive implant *
MADCAPOCELOT - Sub-program of STORMBREW for collection of internet metadata about Russia and European terrorism
MAESTRO-II - Mini digital core implant, standard TAO implant architecture
MAGIC - Codeword for decrypted high-level diplomatic Nazi messages
MAGIC LANTERN - A keystroke logging software developed by the FBI
MAGNES - Remote SATCOM collection facility
MAGNETIC - Technique of sensor collection of magnetic emanations *
MAGNUM - Series of SIGINT spy satellites (since 1985)
MAGNUMOPUS - TAO computer hacking project *
MAGOTHY - The embassy of the European Union in Washington DC *
MAILORDER - Tool for transferring data between NSA, GCHQ, ASD and CSEC * (SFTP-based?)
MAIN CORE - Federal database of personal and financial data of suspicious US citizens
MAINWAY (MW) - NSA database of bulk phone metadata
MAKERS MARK - Computer network "intrusion set" already identified in 2007 *
MANASSAS - Former NSA counter-encryption program, succeeded by BULLRUN
MARINA - NSA database of bulk internet metadata
MARKHAM - NSA data system?
MARTES - NSA software tool to prepare reports
MASTERLINK - NSA tasking source
MASTERSHAKE - Tool or database with FORNSAT and WiFi data collection *
MATCHCRIMP - Network or connection at the Remote Operations Center of NSA's TAO division *
MATRIX - Some kind of data processing system *
MAYTAG - Upstream collection site
MEDLEY - Classified Suite A algorithm
MENTOR - Class of SIGINT spy satellites? (since 1995?)
MERCED - The Bulgarian embassy in Washington DC *
MERCURY - Soviet cipher machine partially exploited by NSA in the 1960's
MERCURY - Remote SATCOM collection facility
MESSIAH - NSA automated message handling system
METAWAVE - Warehouse of unselected internet metadata *
METROTUBE - Analytic tool for VPN data *
METTLESOME - NSA Collection mission system
MIDAS - Satellite program
MIDDLEMAN - TAO covert network
MILKBONE - Question-Focused Dataset used for text message collection *
MINARET - A sister project to Project SHAMROCK (1967-1973)
MINERALIZE - Technique for close access collection through LAN implants *
MIRANDA - System for managing intelligence requirements of GCHQ customers *
MIRROR - Automated survey system that can for example identify the presence of a VPN; interface to the ROADBED system *
MOCCASIN - A hardware implant, permanently connected to a USB keyboard *
MONKEYCALENDAR - Software implant on GMS SIM cards that exfiltrates user geolocation data
MONKEYROCKET - Sub-program of OAKSTAR for collecting internet metadata and content through a foreign access point
MONSTERMIND - Program that can automatically react to cyber attacks against the US
MOONLIGHTPATH (EGL?) - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program * *
MOONPENNY - The NSA satellite intercept station at Harrogate (Great Britain)
MOONSCAPE - System used at the Waihopai satellite intercept station *
MORAY - Compartment for the least sensitive (Category I) COMINT material, retired in 1999 *
MORECOWBELL (MCB) - Covert HTTP/DNS monitoring system for operations support *
MORPHEUS - Program of the Global Access Operations (GAO) *
MOTHMONSTER - NSA tool for exploiting the TOR network
MOUSETRAP - Sandia implant for EFI *
MOVEONYX - Tool related to CASPORT
MULBERRY - The mission of Japan at the United Nations in New York *
MURPHYSLAW - TAO computer hacking project *
MUSCULAR (JPM?) - Joint NSA-GCHQ operation to tap the cables linking Google and Yahoo data clouds to the internet * Part of WINDSTOP
MUSKET - Retired SIGINT Exchange Designator for ?
MUSKETEER - NSA's Special Signal Collection unit (military/1990s?)
MYSTIC - SSO unilateral wireless/mobile interception program (since 2009)*
MYSTIC STAR - Presidential Global Communications System

N
NASHUA - The mission of India at the United Nations in New York *
NAVAJO - The mission of Vietnam at the United Nations in New York *
NAVARRO - The embassy of Georgia in Washington DC *
NEBULA - Base station router similar to CYCLONE Hx9
NECTAR - SIGINT Exchange Designator for ? (retired)
NELEUS - Remote SATCOM collection facility
NEMESIS - SIGINT satellite
NEPTUNE SPEAR - Operation to kill or capture Osama bin Laden (2011)
NEPTUNETHUNDER - Connection for afloat computer network operations like aboard USS Annapolis *
NESTOR - Family of digital secure voice equipment: KY-8, KY-28, and KY-38
NETBOTZ - Remote monitoring tool
NETWORKPUMP - Distribution system *
NEWSDEALER - NSA’s internal intelligence news network
NIAGARAFILES - Data transfer tool * * (SFTP-based?)
NIGHTSTAND - 802.11 wireless packet injection tool that runs on standalone x86 laptop running Linux Fedora Core 3 and exploits windows platforms running Internet Explorer, from 8 miles away
NIGHTWATCH - Portable computer in shielded case for recreating target monitor from progressive-scan non-interlaced VAGRANT signals
NINJANIC - Something related to TURMOIL *
NITESTAND - Connection for afloat computer network operations like aboard USS Annapolis *
NITESURF - NSA tool or database
NITRO - Remote SATCOM collection facility
NOCON - NSA dissemination marking or COI
NOMAD - Projected Navy-sponsored and Raytheon-made computer for mass data handling (1951-1954)
NONBOOK (NK) - Compartment of the ENDSEAL control system
NORMALRUN - NSA tool or database
NUCLEARWINTER - Signal Intelligence Directorate team that uses anti-tamper solutions *
NUCLEON - Database for contents of phone calls
NYMROD - Automated name-matching and recognition system (since 2008)*

O
OAKSTAR - Umbrella program to filter and gather information at major telecommunications companies (since 2004)*
OBELISK - Codename for Al Qaeda’s network of websites and servers *
OCEAN - Optical collection system for raster-based computer screens *
OCEANARIUM - Database for SIGINT from NSA and intelligence sharing partners around the world *
OCEANFRONT - Part of the communications network for ECHELON
OCEAN SHIELD - NATO anti-piracy operation
OCEANSURF - Engineering hub of the Global Access Operations (GAO) *
OCELOT - Actual name: MADCAPOCELOT
OCTAVE - NSA tool for telephony tasking (succeeded by the UTT in 2011)
OCTSKYWARD - Collection of GSM data from flying aircraft
OILSTOCK - A system for analyzing air warning and surveillance data
OILYRAG - SSO mobile telephone interception program, part of the MYSTIC program *
OLYMPIA - CSEC tool for discovering and identifying telephone and computer connections
OLYMPIC - First word of nicknames for programs involving defense against Chinese cyber-warfare and US offensive cyber-warfare *
OLYMPIC GAMES - Joint US and Israel operation against the Iranian nuclear program (aka Stuxnet)*
OLYMPUS - Software component of VALIDATOR/SOMBERKNAVE used to communicate via wireless LAN 802.11 hardware
OMNIGAT - Field network component
ONEROOF - Main tactical SIGINT database, with raw and unfiltered intercepts; or an analytic tool *
ONYX - Newer units of the LACROSSE reconaissance satellites
ORANGEBLOSSOM - Sub-program of OAKSTAR for collection from an international transit switch (sigad: US-3251)*
ORANGECRUSH - Sub-program of OAKSTAR for collecting metadata, voice, fax, phone and internet content through a foreign access point
ORION - SIGINT satellite
ORLANDOCARD - NSA operation thtat attracted visits from 77,413 foreign computers and planted spyware on more than 1,000 by using a 'honeypot' computer *
OSAGE - The embassy of India in Washington DC *
OSCAR - SIGINT Exchange Designator for the USA
OSWAYO - The embassy annex of India in Washington DC
OXCART - The Lockheed A-12 program (better known as SR-71)
OZONE - Some kind of application framework *

P
PACKAGEDGOODS (PG) - Globally disperced and clandestine placed traceroute and DNS processors that map internet connections for the TREASUREMAP tool * *
PACKET RAPTOR - System for processing internet packet data *
PACKETSCOPE - Internet cable tapping system
PACKETSWING - NSA tool or database
PACKETWRENCH - Computer exploit delivered by the FERRETCANON system *
PADSTONE - Type 1 Cryptographic algorithm used in several crypto products
PAINTBALL - Analysis tool (for social network analysis?) *
PAINTEDEAGLE - SI-ECI compartment related to the BULLRUN program
PALANTERRA - A family of spatially and analytically enabled Web-based interfaces used by the NGA
PALMCARTE - System that feeds FISA data to the Network Analysis Center (NAC)? *
PANGRAM (PM) - Alleged SCI control system *
PANOPLY - Populates INTERQUAKE with emitter information and reports *
PANTHER - The embassy of Vietnam in Washington DC *
PARCAE - SIGINT satellite for ocean reconnaissance. Unclassified codename: WHITE CLOUD, a.k.a. Naval Ocean Surveillance System (NOSS); part of CLASSIC WIZARD
PARCHDUSK (PD) - Productions Operation of NSA's TAO division *
PARTNERMALL PROGRAM (PMP) - A single collaboration environment, to be succeeded by the Global Collaboration Environment (GCE) *
PARTSHOP - ?
PASSIONATEPOLKA - TAO tool for remotely bricking network cards *
PATHFINDER - SIGINT analysis tool (developed by SAIC) *
PATHWAY - NSA's former main computer communications network
PATTERNTRACER - Call chaining analysis tool (developed by i2)
PAWLEYS - SI-ECI compartment related to the BULLRUN program
PEARL - Retired SIGINT product codeword
PEDDLECHEAP - Computer exploit delivered by the FERRETCANON system *
PENDLETON - SI-ECI compartment related to the BULLRUN program
PEPPERBOX - Tool or database for targeting Requests (CSEC?)
PERDIDO - The mission of the European Union at the United Nations in New York *
PERFECT CITIZEN - Research and engineering program to counter cyberattacks, in cooperation with Raytheon *
PERFECTMOON - An out-sites covering system
PERMANENTPRESS - SSO mobile telephone interception program, part of the MYSTIC program *
PHANTOMNOVA - Program in cooperation with Turkey *
PHYLLIS ANN - Air Force airborne radio direction-finding system on EC-47s (1966-?)
PHOTOANGLO - A continuous wave generator and receiver. The bugs on the other end are ANGRYNEIGHBOR class
PIEDMONT - SI-ECI compartment related to the BULLRUN program
PICARESQUE (PIQ) - SI-ECI compartment related to the BULLRUN program
PICASSO - Modified GSM handset that collects user data plus room audio
PINUP - Retired SIGINT product codeword
PINWALE - Database for recorded signals intercepts/internet content
PISCES - Joint NSA, CIA and State Department program collecting biometric data on border crossings from a wide range of countries *
PITCHFORD - SI-ECI compartment related to the BULLRUN program
PIVOT - Retired SIGINT product codeword
PIXIE - Retired SIGINT product codeword
PLANTATION - Ggeneral processing computer project, later integrated into HARVEST (1950s)
PLATFORM - Computer system linking the ECHELON intercept sites *
PLUCKHAGEN - An IRATEMONK implantation for ARM-based Fujitsu drives *
PLUS - NSA SIGINT production feedback program *
POCOMOKE - The Brazilian Permanent Mission to the UN in New York *
POGODA - Soviet cipher system of the 1940s
POISON NUT - CES VPN attack orchestrator *
POLARBREEZE - NSA technique to tap into nearby computers *
POLITERAIN - CNA team or operation from the ATO unit of TAO *
POPEYESEAR - Database and with an interface (including GraphViz) used at NSA's NTOC floor *
POPPY - SIGINT satellite program
POPROCKS - Some tool, probably related to Computer Network Exploitation (CNE)
POPTOP - Collection system for telephony data
POPQUIZ - Project of NSA's Research Directorate to collect network metadata on high-bandwidth protocols such as HTTP, SMTP and DNS (2008) *
POTBED - TAO computer hacking project *
POWDER - Program for surveillance of the Turkish embassy in Washington DC
POWELL - The Greek mission at the United Nations in New York *
PREFACE - Processing system for Opscomm at NSA HQ, replacement of TIDE (1978-?)
PREFER - System for identifying and extracting text messages (SMS) from the DISHFIRE database *
PRESSUREPORT - Software interface related to PRESSUREWAVE
PRESSUREWAVE - NSA cloud database for VPN and VoIP content and metadata * *
PRIMECANE - American high-tech company cooperating in providing a network access point for the ORANGECRUSH program
PRISM - Program for collecting foreign internet data from US internet companies
PROFORMA - Intelligence derived from computer-based data
PROPHET - Mobile tactical SIGINT collection system
PROTEIN - SIGINT Exchange Designator for ?
PROTON - Storage and analysis system for the CRISSCROSS database of (telephony?) metadata of (counterintelligence) targets; operated by CIA and used by DOJ, DOD and NSA *
PROTOSS - Local computer handling radio frequency signals from implants
PURPLE - Codename for a Japanese diplomatic cryptosystem during WWII
PURPLE DRAGON - US military OPSEC program (since 1966)
PUTTY - NSA tool or database
PUZZLECUBE - NSA tool or database
PYLON - SIGINT Exchange Designator for ?

Q
QUADRANT - A crypto implementation code
QUADRESPECTRE PRIME - ?
QFIRE - A consolidated QUANTUMTHEORY platform to reduce latencies by co-locating passive sensors with local decisioning and traffic injection (under development in 2011)
QUANTUM - Secret servers placed by NSA at key places on the internet backbone; part of the TURMOIL program *
QUANTUMBISCUIT - Enhancement of QUANTUMINSERT for targets which are behind large proxies *
QUANTUMBOT - Method for taking control of idle IRC bots and botnets) *
QUANTUMBOT2 - Combination of Q-BOT and Q-BISCUIT for webbased botnets *
QUANTUMCOOKIE - Method to force cookies onto target computers
QUANTUMCOPPER - Method for corrupting file uploads and downloads *
QUANTUMDIRK - Replacement for the QUANTUMINSERT hacking toolset that injects malicious content into chat services provided by websites such as Facebook and Yahoo *
QUANTUMDNS - DNS injection/redirection based off of A record queries *
QUANTUMHAND - Man-on-the-side technique using a fake Facebook server *
QUANTUMINSERT (QI) - Man-on-the-side technique that redirects target internet traffic to a FOXACID server for exploitation *
QUANTUMMUSH - Targeted spam exploitation method *
QUANTUMNATION - Umbrella for COMMONDEER and VALIDATOR computer exploits
QUANTUMPHANTOM - Hijacks any IP address to use as covert infrastructure *
QUANTUMSKY - Malware used to block targets from accessing certain websites through RST packet spoofing *
QUANTUMSMACKDOWN - Method for using packet injection to block attacks against DoD computers *
QUANTUMSPIN - Exploitation method for instant messaging *
QUANTUMSQUEEL - Method for injecting MySQL persistant database connections *
QUANTUMSQUIRREL - Using any IP address as a covert infrastructure *
QUANTUMTHEORY (QT) - Computer hacking toolbox used by NSA's TAO division, which dynamically injects packets into target's network session *
QUANTUM LEAP - CIA tool to "find non-obvious linkages, new connections, and new information" from within a dataset *
QUARTERPOUNDER - Upstream collection site
QUASAR - Relay satellite for reconaissance satellites
QUEEN BEE CHARLIE/DELTA - Airborne SIGINT missions using C-130s in South-East Asia (1964-1965?)
QUEENSLAND - Upstream collection site
QUERTY - TAO keylogger tool, maybe as a module of the WARRIORPRIDE program *
QUICKPOINT - Distribution system *

R
RADIOSPRING - ?
RADIANT - First word for two dozen Navy tactical-national data sharing systems, including satellites and stealth drones *
RADIANT GEMSTONE - System from the RADIANT family, installed at the USS Annapolis around 2005 *
RADIUS - Systems that logs ISP dial up customer records, which can create a "natural link" between DNR and DNI datasets *
RADON - Host tap that can inject Ethernet packets *
RAGEMASTER - Part of ANGRYNEIGHBOR radar retro-reflectors, for red video graphics array cable in ferrite bead RFI chokers between video card and monitor, target for RF flooding and collection of VAGRANT video signal
RAGTIME (RGT) - ECI compartment for call and e-mail content collected under FISA authority *
RAILHEAD - NCTC database project
RAINFALL - (NSA unit for decrypting) Russian secure, encrypted voice communications (around 1979)*
RAINFALL - Unclassified codename for RHYOLITE/AQUACADE SIGINT satellites
RAINFALL - Probably the joint CIA/NSA/DSD satellite ground station in Pine Gap, Australia *
RAISIN - NSA database or tool
RAMPART-A (RAM-A) - Program for collecting information about Russia, the Middle East and North-Africa, in cooperation with at least five 3rd Party partner agencies (since 1992)*
RAMPART-I (RAM-I) - Program for collecting communications from Iraq
RAMPART-M (RAM-M) - Program for collecting data from undersea fiber-optic cables about terrorists, arms traders and Iraq (since 1986)*
RAMPART-T (RAM-T) - Program providing access to land-based cables, in cooperation with the CIA, to collect communications from state leaders and their entourage (since 1991)*
RAMPART-X (RAM-X) - Program for collecting information from Afghanistan *
RAMROD - Unclassified codename for a SIGINT satellite, possibly the 1994-96 ORION launches
RANCIDRINSE - SSO mobile telephone interception program, part of the MYSTIC program *
RANGER - Unclassified codename for a SIGINT satellite (post-2000 launches)
RATTAN - Codename for overall US effort against Soviet codes (1945-1946, later BOURBON)*
RAVEN - SIGINT satellite
REACTOR - Tool or program related to MARINA? *
REBA - Major NSA backbone project *
RED DISK - DIA cloud system to distribute information, images and video to soldiers and other military intelligence users.
REDHARVEST (RDV) - ECI compartment that protects names, locations and techniques of RAMPART-A cable tapping facilities *
REDHAWK - NSA tool
REDROOF - NSA tool
REGAL - Compartment for Top Secret COMINT information derivated from the Berlin Tunnel operation (1955-?)
REGIN - Highly sophisticated spyware found in computers systems worldwide, supposedly used by NSA and GCHQ (discovered in 2013, codename by Microsoft) *
REMATION - Joint NSA-GCHQ counter-TOR workshop *
RENOIR - NSA telephone network visualization tool
REQUETTE - A Taiwanese TECO in New York *
RESERVE (RSV) - Control system for the National Reconnaissance Office (NRO)
RESERVEVISION - Remote monitoring tool
RESOLUTETITAN - Internet cable access program?
RETRO - see RETROSPECTIVE
RETROSPECTIVE - 30-day retrospective retrieval tool for SCALAWAG *
RETURNSPRING - High-side server shown in UNITEDRAKE internet cafe monitoring graphic
RHINEHEART - NSA tool or database
RHYOLITE - Class of SIGINT spy satellites (in 1975 changed to AQUACADE)
RICHTER - SIGINT Exchange Designator for Germany
RIPCORD - ?
RIVET GYM - Codename for the four SIGINT positions aboard EC-121 COLLEGE EYE aircraft (Vietnam War)
RIVET JOINT - Reconaissance operation
ROADBED - Probably a military SIGINT database
ROCKYKNOB - Optional DSP when using Data Over Voice transmission in CROSSBEAM
ROGUESAMURAI - Test framework of TAO's persistence division for testing computer exploits *
RONIN - NSA tool for detecting TOR-node and/or mobile IP-addresses * *
RORIPA - SIGINT Exchange Designator for ?
ROSTER - Unclassified codename for MAGNUM/ORION SIGINT satellites *
ROUTEMASTER - Server/router for VoIP and audio traffic *
ROUTEVIEWS - Open source inforamtion used for the TREASUREMAP tool *
ROYALNET - Internet mapping tool to determine access points for target’s communications *
RUFF - Compartment of TALENT KEYHOLE for satellite imagery *
RUFFER - Unclassified codename for JUMPSEAT/TRUMPET SIGINT satellites
RUMBUCKET - Analytic tool
RUNWAY - Unclassified codename for CANYON/CHALET/VORTEX SIGINT satellites; or a processing system at Menwith Hill *
RUSTICBAGGAGE - Data source for the TREASUREMAP tool *
RUTLEY - Unclassified codename for the MERCURY SIGINT satellites (launched 1995-2003); or a processing system at Menwith Hill *
RYE - NSA-developed software for Univac 490 computers (introduced 1963)
RYE - Computer complex supporting CSOC/NSOC, internetting Opscomm circuits, running several softwares including TIDE (late 1960s-?)

S
SABERTOOTH - SIGINT training program for South Vietnam government (launched in 1961)
SABRE - Retired SIGINT product codeword
SADDLEBACK - Hacking tool that performs a firmware modification? *
SALEM - ?
SALTYDOGS - Tool to find frequency and carrier rates and discover signal characteristics of satellite links *
SALVAGERABBIT - Computer implant plug-in that exfiltrates data from removable flash drives that connect to an infected computer
SAMOS - Reconnaissance satellite program
SANDKEY - Joint NSA/DEA program that intercepts and exploits unencrypted VHF voice communications of narco-traffickers at sea *
SAPPY - Retired SIGINT product codeword
SARACEN - Intercept operation using unmaned equipment on a hilltop (Vietnam War, 1972)
SARATOGA - SSO access facility (since 2011) * *
SARDINE - SIGINT Exchange Designator for Sweden
SAVILLE - Narrow band voice encryption for radio and telephone communication
SAVIN - Retired SIGINT product codeword
SCALAWAG - Collection facility under the MYSTIC program *
SCALLION - Upstream collection site
SCAPEL - Second Party satellite intercept station in Nairobi, Kenia
SCHOOLMONTANA - Software implant for Juniper J-series routers used to direct traffic between server, desktop computers, corporate network and internet
SCIMITAR - A tool to create contact graphs? *
SCISSORS - System used for separating different types of data and protocols
SCORECARD - NSA tool or database
SCORPIOFORE - SIGINT reporting tool *
SCREAMINGHARPY - TAO computer hacking project *
SEABOOT - SIGINT Exchange Designator for ?
SEADIVER - Collection system for telephony data
SEAGULL - Secure Allied Communications ISO BMD at COMUSSIXTHFLT *
SEAGULLFARO - High-side server shown in UNITEDRAKE internet cafe monitoring graphic
SEARCHLITE - Tactical SIGINT collecting system for like cell phone calls
SEA SENTRY - Program for collecting radar signatures from shipping traffic in the Dardanelles *
SEA SENTRY II - Choke point collection program in cooperation with Turkey *
SEASIDEFERRY - Commercially purchased data source for the TREASUREMAP tool *
SEASONEDMOTH (SMOTH) - Stage0 computer implant which dies after 30 days, deployed by the QUANTUMNATION method
SECONDDATE - Method to influence real-time communications between client and server in order to redirect web-browsers to FOXACID malware servers *
SECUREINSIGHT - A software framework to support high-volume analytics
SEED SPHERE - Computer network "intrusion set" already identified in 2007 *
SEMESTER - NSA SIGINT reporting tool
SEMITONE - System that monitors fax and voice messages *
SENIOR SCOUT - Transportable suite of ISR equipment (since 1991)
SENIOR SPAN - Radome on top of the U2 to relay SIGINT data to ground stations
SENTINEL - NSA database security filter*
SENTRY EAGLE (SEE) - Overarching umbrella program for ECI compartments and SAP programs of the National Initiative to protect US cyberspace
SENTRY HAWK - ECI compartment of SENTRY EAGLE that protects information about Computer Network Exploitation *
SENTRY FALCON - ECI compartment of SENTRY EAGLE that protects information about Computer Network Defense *
SENTRY OSPREY - ECI compartment of SENTRY EAGLE that protects information about HUMINT enabled SIGINT *
SENTRY RAVEN - ECI compartment of SENTRY EAGLE that protects information about exploitation of encipherment *
SENTRY CONDOR - ECI compartment of SENTRY EAGLE that protects information about general Computer Network Operations *
SENTRY OWL - ECI compartment of SENTRY EAGLE that protects information about relationships with industry *
SERENADE - SSO corporate partner (foreign?) *
SERUM - Bank of servers within ROC managing approvals and ticket system
SETTEE - Former SIGINT Exchange Designator for South Korea
SHADOWCAT - Some system to be used at the Waihopai satellite station, New Zealand *
SHAMROCK - Operation for intercepting telegraphic data going in or out the US (1945-1975)
SHAREDQUEST (SQ) - Contains the DARKQUEST program *
SHAREDTAFFY - TAO computer hacking project *
SHAREDVISION - Mission program at Menwith Hill satellite station *
SHARKFIN - Sweeps up all-source communications intelligence at high speed and volumes *
SHARPFOCUS (SF2) - Productions Operation of NSA's TAO division *
SHARPSHADOW - TAO computer hacking project *
SHELLTRUMPET - NSA metadata processing program (since December 2007)*
SHENANIGANS - Aircraft-based NSA geolocation system used by CIA *
SHERMAN - Cryptanalytic computer subcomplex at NSA HQ (1978)
SHIFTINGSHADOW - Sub-program of OAKSTAR for collecting telephone metadata and voice content from Afghanistan through a foreign access point
SHILLELAGH - Classified Suite A algorithm
SHORTHAND -Pproject initiated in 1966 to employ South Vietnamese as linguists in US LLVI operations
SHORTSHEET - NSA tool for Computer Network Exploitation *
SHOTGIANT - NSA operation for hacking and monitoring the Huawei network (since 2009)
SIERRAMIST - Tool to support various file systems *
SIERRAMONTANA - Software implant for Juniper M-series routers used by enterprises and service providers
SIGINT NAVIGATOR - NSA database
SIGSALY - The first secure voice system from World War II
SILKWORTH - A software program used for the ECHELON system
SILLYBUNNY - Some kind of webbrowser tag which can be used as selector *
SILO - Research project in high-speed computer memory, later integrated into HARVEST (1950s)
SILVER - Soviet cipher machine, 1950s-1960s, partially exploited by NSA in the 1960's
SILVERCOMET - SIGINT satellites? *
SILVER PEAK - WAN optimization project at Waihopai satellite station, New Zealand *
SILVERZEPHYR (SZ) - Sub-program of OAKSTAR for collecting phone and internet metadata and content from Latin and South America through an international transit switch
SIRE - A software program used for the ECHELON system(?)
SKIPJACK - Type 2 Block cipher algorithms used in various crypto products
SKOPE - SIGINT analytical toolkit
SKYHOOKCHOW - Codeword found in the source code used by the Equation hacking group *
SKYSCRAPER - Interface to the ROADBED system
SKYWRITER - NSA tool to prepare (internet) intelligence reports
SLICKERVICAR - Used with UNITEDRAKE or STRAITBIZARRE to upload hard drive firmware to implant IRATEMONK
SLINGSHOT - End Product Reports (CSEC?)
SMOKEYSINK (SMK) - Cable tapping facility operated in cooperation with a 3rd Party agency, part of the RAMPART-A program (cosed in June 2011)*
SNICK - GCHQ satellite intercept station in Oman
SNORT - Repository of computer network attack techniques/coding
SNOWGLOBE - Hacking operations against the US that may have originated in France *
SOAPOPERA - (former?) database for voice, end product and SRI information *
SOCIALSTAMP - Commercially purchased data source for the TREASUREMAP tool *
SOCIOPATH - Storage and/or distribution system *
SODAPRESSED - Linux application presistence *
SOLO - NSA-developped computer, the world's first computer to be entirely transistorized, later marketed by Philco as Transac S-1000 (mid-1950s)
SOMALGET - Umbrella program for collecting content from mobile phone networks of two entire countries, part of MYSTIC (sigad: US-3310**)
SOMBERKNAVE - Windows XP wireless software implant providing covert internet connectivity, routing TCP traffic via an unused 802.11 network device allowing OLYMPUS or VALIDATOR to call home from air-gapped computer
SORTINGHAT - ?
SORTINGLEAD - NSA tool or database
SOUFFLETROUGH - Software implant in BIOS Juniper SSG300 and SSG500 devices, permanent backdoor, modifies ScreenOS at boot, utilizes Intel's System Management Mode
SOUNDER - Second Party satellite intercept station at Cyprus
SPARKLEPONY - Tool or program related to MARINA *
SPARROW II - Airborne wireless network detector running BLINDDATE tools via 802.11
SPEARGUN - Cable access program of New Zealand's GCSB *
SPECTRE - SCI control system for intelligence on terrorist activities *
SPECULATION - Protocol for over-the-air communication between COTTONMOUTH computer implant devices, compatible with HOWLERMONKEY
SPHINX - Counterintelligence database of the Defense Intelligence Agency
SPINNERET (SPN) - Cable tapping facility operated in cooperation with a trusted 3rd Party agency, part of the RAMPART-A program * *
SPIT - Typewriter designed for copying morse code; project named for SPecial Intercept Typewriter (1957)
SPITEFULANGEL - Hacking tool or method in or for the Python programming language *
SPLITGLASS - NSA analytical database *
SPLUNK - Tool used for SIGINT Development
SPOKE - Compartment for less sensitive (Category II) COMINT material, retired in 1999 * but apparently still in use as unpublished SCI control system
SPOTBEAM - ?
SPORTCOAST - Upstream collection site
SPRIG - Retired SIGINT product codeword
SPRINGRAY - Some kind of internal notification system *
SPYDER - Analytic tool for selected content of text messages from the DISHFIRE database *
STARBURST - The initial code word for the STELLARWIND compartment
STARFIRE - NSA contact chaining algorithm (developed in 1999) *
STARLIGHT - Analyst tool
STARPROC - User lead that can be uses as a selector *
STARSEARCH - Target Knowledge tool or database (CSEC?)
STATEROOM - Covert SIGINT collection sites based in US diplomatic facilities *
STEALTHFIGTHER - Codeword found in the source code used by the Equation hacking group *
STEELFLAUTA - SSO Corporate/TAO Shaping program
STEELKNIGHT - (foreign?) partner providing a network access point for the SILVERZEPHYR program *
STEELWINTER - A supercomputer acquired by the Norwegian military intelligence agency *
STELLAR - Second Party satellite intercept station at Geraldton, Australia
STELLARWIND (STLW) - SCI compartment for the President's Surveillance Program information
STEPHANIE - Covert listening post in the Canadian embassy in Moscow (est. 1972)
STINGRAY - Device for tracking the location of cell phones (made by Harris Corp.) * STONEGATE - System used at the Waihopai satellite intercept station *
STONEGHOST - DIA network for information exchange with UK, Canada, Australia and New Zealand (TS/SCI)
STONEHOUSE - Site built in the 1960s at Asmara, Ethiopia, for collection against the Soviet space program. Featured two 150-feet diameter dishes (closed in 1975).
STONE RUBY - Intelligence exchange agreement between DIA and the Israeli military intelligence directorate (1996) *
STORMBREW - Program for collection from an international transit switches and cables (since 2001)
STRAITACID - Codeword found in the source code used by the Equation hacking group *
STRAI(GH)TBIZARRE (SBZ) - TAO software implant used to communicate through covert channels * or spyware that can turn computers into disposable and non-attributable "shooter" nodes *
STRAITSHOOTER - Codeword found in the source code used by the Equation hacking group *
STRATOS - Tool or databse for GPRS Events (CSEC?)
STRAWHAT - NSA datalinks between field sites and processing centers (1969-?)*
STREAMLINER - NSA-developed automatic switch for communications centers (early 1970s)
STRETCH - IBM high-performance computer project, later integrated into HARVEST (1950s)
S-TRICKLER - Tool or database with IP address fingerprints and potential vulnarabilities from the FORNSAT collection *
STRIKEZONE - Device running HOWLERMONKEY personality
STRONGMITE - Computer at remote operations center used for long range communications
STRUM - (see abbreviations)
STUCCOMONTANA - Software implant for Juniper T-Series routers used in large fixed-line, mobile, video, and cloud networks, otherwise just like SCHOOLMONTANA
STUMPCURSOR - Foreign computer accessing program of the NSA's Tailored Access Operations
STUXNET - A computer worm that was used to destroy Iran's nuclear centrifuges (discovered in 2010)
STYLISHCHAMP - Tool that can create a HPA on a hard drive and then provide raw reads and writes to this area *
SUBSTRATUM - Upstream collection site
SUEDE - Compartment for Top Secret COMINT information (1951-1952) *
SULPHUR - The mission of South Korea at the United Nations in New York *
SUNSCREEN - Tool or database
SURFBOARD - System for processing data from (satellite?) telephone networks *
SURLEYSPAWN - Data RF retro-reflector, gathers keystrokes FSK frequency shift keyed radar retro-reflector, USB or IBM keyboards
SURPLUSHANGAR (SH) - High to low diode, part of the QUANTUM system *
SURREY - Main NSA requirements database, where tasking instructions are stored and validated, used by the FORNSAT, SSO and TAO divisions *
SUTURESAILOR - Printed circuit board digital core used with HOWLERMONKEY
SWAMP - NSA data system?
SWAP - Implanted software persistence by exploiting motherboard BIOS and hard drive Host Protected Area for execution before OS loads, operative on windows linux, freeBSD Solaris
SYNAPSE - NSA tool for analyzing target connections *

T
TABLON - Experiment of mass data storage technology, overtaken by disk storage technology (1960s)
TACOSUAVE - ?
TALENT KEYHOLE (TK) - Control system for space-based collection platforms
TALK QUICK - An interim secure voice system created to satisfy urgent requirements imposed by conditions to Southeast Asia. Function was absorbed by AUTOSEVOCOM
TAPERLAY - Covername for the Global Numbering Data Base (GNDB) containing telephony and provider information *
TARMAC - Program to intercept satellite communications at Menwith Hill Station *
TAROTCARD - NSA tool or database
TAWDRYYARD - Beacon radio frequency radar retro-reflector used to positionally locate deployed RAGEMASTER units
TEABALL - Direct SIGINT support to fighter escorts of operation Linebacker (1972)
TELLURIAN - Internet packet processing system, maybe also used to forward data from the collection site to NSA headquarters.
TEMPEST - Spying on information systems through leaking emanations, including unintentional radio or electrical signals, sounds, and vibrations (codename originally from a COMSEC point of view, not an attacker's one)
TENNIS - Network to remote-operate intercept facilities through satellite links (1967-?)
THESPIS - SIGINT Exchange Designator for ?
THINTREAD - Prototype program for wiretapping and sophisticated analysis of the resulting data (dismissed in 2002 in favor of TRAILBLAZER)
THUMB - Retired SIGINT product codeword
THUNDERCLOUD - Data enrichment tool, collaborative program between NSA units T1222 and SSG *
TIAMAT - Joint venture between the German BND and another country with access for NSA *
TICKETWINDOW - System that makes Special Source collection available to 2nd Party partners *
TIDALSURGE - Router Configurations tool (CSEC?)
TIDE - Software managing the KLIEGLIGHT database
TIDEWAY - Part of the communications network for ECHELON
TIMBERLINE - The NSA satellite intercept station at Sugar Grove (US)
TINMAN - Database related to air warning and surveillance
TITAN POINTE - Upstream collection site
TITAN RAIN - Presumably Chinese attacks on American computer systems (since 2003)
TITLEHOLDER - NSA tool
TOPAZ - Satellite program
TORNSTEAK - Exploit solution for two firewall devices from a particular vendor *
TORUS - Satellite antenna that allows multiple satellites to be viewed simultaneously *
TOTECHASER - Software implant in flash ROM windows CE for Thuraya 2520 satellite/GSM/web/email/MMS/GPS
TOTEGHOSTLY - Modular implant for windows mobile OS based on SB using CP framework, Freeflow-compliant so supported by TURBULENCE architecture
TOWERPOWER - NSA tool or database
TOXICARE - NSA tool
TOYGRIPPE - NSA repository of VPN endpoints and metadata * *
TRACFIN - NSA database for financial data like credit card purchases *
TRACTOR - IBM-developed tape drives loading system, used for HARVEST (1960s)
TRAFFICTHIEF - Part of the TURBULENCE umbrella program
TRAILBLAZER - NSA Program to analyze data carried on communications networks (2002-2006, replaced by TURBULENCE)
TRAILMAPPER - NSA tool or database
TRANSX - NSA database
TREACLEBETA - TAO hacking against the Pakistani terrorist group Lashkar-e-Taiba *
TREASUREMAP (TM) - Mapping, exploration and analysing tool that provides a near-real time, interactive map of the global internet *
TREASURETROVE - Analytic tool
TRIBUTARY - NSA provided voice threat warning network
TRIGGERFISH - Device to collect the content of digital cell phone calls (made by Harris Corp.) *
TRINE - Compartment for Top Secret COMINT information, predecessor of UMBRA (1965-1968) *
TRINITY - Implant digital core concealed in COTTONMOUTH-I, providing ARM9 microcontroller, FPGA Flash and SDRAM memories *
TRIREME - System for processing internet packet data *
TRITON - Tool or database for TOR Nodes (CSEC?)
TROJAN SPIRIT - Tactical network for sharing intelligence information with customers in the field
TROPICPUMA - Fax processing capability *
TRUMPET - Series of ELINT reconnaissance satellites (1994-2008)
TUBE - Database for selected internet content? *
TUMULT - Part of the TURBULENCE program
TUNDRA - DSP Research of new statistics for codebook analysis *
TUNDRAFREEZE - NSA's main in-house facial recognition program *
TUNINGFORK - Sustained collection linked to SEAGULLFARO, previously NSA database or tool for protocol exploitation
TURBINE - Active SIGINT: centralized automated command/control system for managing a large network of active computer implants for intelligence gathering (since 2010) *
TURBOPANDA - The Turbopanda Insertion Tool allows read/write to memory, execute an address or packet; joint NSA/CIA project on Huawei network equipment
TURBULENCE (TU) - Integrate NSA architecture with several layers and sub-programs to detect threats in cyberspace (since 2005)
TURMOIL (TML) - Passive SIGINT sensors: high speed collection and processing (with selection at the packet level) of internet traffic from foreign satellite, microwave and cable links, part of the TURBULENCE program * * Maybe also for selecting common internet encryption technologies to exploit.*
TURTLEPOWER - NSA tool
TUSKATTIRE - Ingest system for cleaning and processing DNR (telephony) data
TUTELAGE - Active defense system with detection sensors that monitor network traffic at for example the NIPRNet in order to detect malicious code and network attacks, part of the TURBULENCE program *
TWEED - Retired SIGINT product codeword
TWISTEDKILT - Writes to Host Protected area on hard drive to implant Swap and its implant installer payload, which can be used with the STYLISHCHAMP tool *
TWISTEDPATH - NSA tool or database
TYPHON HX - GSM base station router network in box for tactical Sigint geolocating and capturing user

U
ULTRA - Compartment for Top Secret COMINT information, like decrypted high-level military Nazi messages (until 1946)
UMBRA - Compartment for the most sensitive (Category III) COMINT material (1968-1999) * but apparently still in use as unpublished SCI control system
UNCANNY - Video demodulation tool (now: BOTANICREALTY) *
UNIFORM - SIGINT Exchange Designator for Canada
UNITEDRAKE - Computer exploit delivered by the FERRETCANON system *
UNITY - System for processing data collected from telephony networks *
USHER - Retired SIGINT product codeword

V
VAGRANT - Radar retro-reflector technique on video cable to reproduce open computer screens *
VALIANTSURF - A "major system acquisition" that enables more efficient Computer Network Operations (CNO) by the TAO division; it will integrate into the TURBULENCE architecture *
VALIDATOR - Computer exploit delivered by the FERRETCANON system for looking whether a computer has security software, runs as user process on target OS, modified for SCHOOLMONTANA, initiates a call home, passes to SOMBERKNAVE, downloads OLYMPUS and communicates with remote operation center *
VENATOR - Access to a Philippine mobile network provider, part of the MYSTIC program *
VENONA - Joint US-UK project for decrypting intercepts of messages from the KGB; previously codenamed JADE, BRIDE and DRUG subsequently
VENUSAFFECT - System used at the Waihopai satellite intercept station *
VERDANT (VER) - Alleged SCI control system *
VESUVIUS - Prototype quantum computer, situated in NSA's Utah Data Center
VICTORYDANCE - Joint NSA-CIA operation to map WiFi fingerprints of nearly every major town in Yemen *
VIEWPLATE - Processor for external monitor recreating target monitor from red video
VINEYARD - System used at the Waihopai satellite intercept station *
VINSON - KY-57/58 family of voice encryption systems
VINTAGE - System used at the Waihopai satellite intercept station *
VINTAGE HARVEST - Probably a military SIGINT tool
VITALAIR - NSA tool
VITALAIR2 - Tool or database for automated scanned IP addresses for TAO known vulnerabilities *
VOICESAIL - Intelligence database
VORTEX - Class of SIGINT spy satellites (1978-1989)
VOXGLO - Multiple award contract providing cyber security and enterprise computing, software development, and systems integration support *
VOYEUR - US monitoring operation in which an Iranian hacking operation against the US was detected *

W
WABASH - The embassy of France in Washington DC *
WAGONBED - Hardware GSM controller board implant on CrossBeam or HP Proliant G5 server that communicates over I2C interface
WAITAUTO - Network or database at the Remote Operations Center of NSA's TAO division *
WALBURN - High-speed link encryption, used in various encryption products
WARPDRIVE - Joint venture between the German BND and another country with access for NSA (2013)* *
WARRIORPRIDE (WP) - Scalable, flexible and portable unified CNE platform used throughout the Five Eyes; equivalent at GCHQ is DAREDEVIL * It was for example used to break into iPhones *
WATERWITCH - Hand-held tool for geolocating targeted handsets to last mile
WAVELEGAL - Authorization service that logs data queries
WAXTITAN - TAO computer hacking project *
WEALTHYCLUSTER (WC) - Processing system for low data rate internet traffic, that sessionizes all the data on the link before sending it to XKEYSCORE (since 2002, will be replaced by TURMOIL) * *
WEASEL - Type 1 Cryptographic algorithm used in SafeXcel-3340
WEBCANDID - NSA tool or database
WEE LOOK - ELINT systems on Navy EA-3Bs detecting SAM radars (Vietnam War)
WELLSPRING - Tool that strips out facial images from e-mails and other communications, and displays those that might contain passport images *
WESTPORT - The mission of Venezuela at the United Nations in New York *
WICKEDVICAR - Hacking tool used to perform remote survey and installation *
WILDCHOCOBO - TAO computer hacking project *
WILDCOUGAR - TAO computer hacking project *
WILLOW - Combination of a JUMPSEAT satellite and Low-Earth Orbit Program-989 ELINT sub-satellites (since 1982)
WILLOWVIXEN - Method to deploy malware by sending out spam emails that trick targets into clicking a malicious link *
WISTFULTOLL - Plug-in for UNITEDRAKE and STRAITBIZARRE used to harvest target forensics via Windows Management Instrumentation and Registry extractions, can be done through USB thumb drive
WHIPGENIE (WPG) - ECI compartment for details about the STELLARWIND program *
WHITEBIRCH - ASA project to set up an HF-DF network in South East Asia (initiated 1961)
WHITEBOX - Program for intercepting the public switched telephone network? *
WHITE WOLF - Joint Chiefs of Staff "advisory warning" program for all peripheral airborne reconnaissance missions (1963-?)
WHISTLINGDUXIE - TAO computer hacking project *
WHITE CLOUD - Unclassified codename for the PARCAE SIGINT satellite for ocean reconnaissance
WHITELIST - NSA tool
WHITETAMALE - Operation for collecting e-mails from Mexico's Public Security Secretariat *
WHIZBANG - Training program (?)*
WILDCHOCOBO - TAO computer hacking project *
WILLY - AFSS COMINT support program during the Korea War (1950-?)
WINDCHASER - Tool or program related to MARINA *
WINDSORBLUE - Supercomputer program at IBM *
WINDSTOP - Umbrella program for 2nd Party high-volume cable tapping programs *
WINTERLIGHT - A QUANTUM computer hacking program in which Sweden takes part
WIRESHARK - Database with malicious network signatures
WITCH - Retired SIGINT product codeword
WITCHHUNT - ?
WOLFPOINT - SSO corporate partner under the STORMBREW program *
WORDGOPHER - Platform to enable demodulation of low-rate communication carriers
WRANGLER - Database or system which focuses on Electronic Intelligence

X
XCONCORD - Program for finding key words in foreign language documents
XKEYSCORE (XKS) - Computer system for indexing and searching internet communications

Y
YACHTSHOP - Sub-program of OAKSTAR for collecting internet metadata
YELLOWPIN - Printed circuit board digital core used with HOWLERMONKEY
YELLOWSTONE - NSA analytical database *
YIELD - Combination of a JUMPSEAT satellite and low-Earth orbit Program-989 ELINT sub-satellites (since 1982)
YOKE - AFSS tactical voice intercept support program during the Korea War (1951-?)
YUKON - The embassy of Venezuela in Washington DC *

Z
ZAP - (former?) database for texts *
ZARF - Compartment of TALENT KEYHOLE for ELINT satellites, retired in 1999 *
ZESTYLEAK - Software implant that allows remote JETPLOW firmware installation, used by NSA's CES unit


- See also this list of NSA codewords from 2002


Links and Sources
- NSA Observer: Things the NSA doesn't want you to know
- List of NSA Code Names Revealed
- About What the NSA’s Massive Org Chart (Probably) Looks Like
- About Code Names for U.S. Military Projects and Operations
- National Reconnaissance Office: Review and Redaction Guide (pdf)
- About How Codes Names Are Assigned
- Wikipedia article about the Secret Service codename
- List of crypto machine designators
- Wikipedia article about the CIA cryptonym
- Article about Security Clearances and Classifications
- Listing in German: Marjorie-Wiki: SIGDEV
- Another list in German: Geheimdienstliche Akronyme und Codenamen
- William M. Arkin, Code Names, Deciphering U.S. Military Plans, Programs, adn Operations in the 9/11 World, Steerforth Press, 2005.

10 comments:

Anonymous said...

the latest bombshells form the washington post are particularly rich sources. The reports, not the article.

Also you're missing Silverzephyr and Steelknight from O Globo (ther is an infographic. and a picture on the wikipedia 2013 mass surveillance disclosures article, which now looks halfway decent.

also, go the the nsa's website, and look at the United States v Thomas drake. you will see a document mentioning Turbulance, turmoil tutelege and trafficthief, and note that that trafficthief does interact with xkeyscore.

Lithium, blarney, oakstar, fairfiew are mentinoed on a press release. that release describes them as aliases for corporations. Which means that they are all part of SSO. So is Silverzephyr. But check the washinton post's article. It will help you clear up a lot.

P/K said...

Thank you for the update and the information! I'll check it out and add the new info to the listing.

Anonymous said...

There is now a stub article on wikipedia for the Unified targeting tool, UTT.

Has a few screen images pulled from the releases.

Trafficthief is in all probability a database and/or DB query tool. See the pyramid shaped prism slide. Which mentions two.

Anonymous said...

there is a screencap of OCTAVE in the "what to tell our overseers" release.

Anonymous said...

DRTBox is by Digital Receiver Technology Inc(http://www.drti.com/), now a wholly-owned subsidiary of Boeing Corp. DRT's are used to intercept and breakout(decrypt)Cell phones for the Oneroof tactical SIGINT audio collection system.

Anonymous said...

Re: "PHOTOANGLO - Portable radar retro-reflector replacement for CTX4000, joint NSA/GCHQ project, homodyne receiver connected to NIGHTWATCH or VIEWPLATE for processing "

The PHOTOANGLO is not a retro-reflector. It's a continuous wave generator and receiver. The bugs on the other end are ANGRYNEIGHBOR class. retro-reflectors

Also, you seem to be missing an entry for the CTX4000.

P/K said...

Thank you, I'll correct it!

CTX4000 seems to be an abbreviation instead of a codeword, so doesn't belong in this list.

Anonymous said...

Please correct: WAGNOBED => WAGONBED

Anonymous said...

what about Electronic Tracking? How do i find it and how can i destroy it without hurting my body or killing myself?

Rob said...

I've had a look into Richelson's book "The US Intelligence Community", I sum up the codenames related to SIGINT satellites here :

GRAB is in fact acronym for "Galactic radiation and background", the cover of the program. DYNO was the classifed codename for GRAB. GRAB/DYNO was a low-Earth orbit ELINT satellite (1960-1962 launches).

CHALET - first codename for CHALET / VORTEX class (the codename was changed after 1979 leak).

PARCAE - SIGINT satellite for ocean reconnaissance. Unclassified codename WHITE CLOUD, aka Naval Ocean Surveillance System (NOSS), aka or part of CLASSIC WIZARD.

RAINFALL - unclassified codename for RHYOLITE/AQUACADE

RAMROD - unclassified codename for a SIGINT satellite, possibly the 1994-96 ORION launches

RANGER - unclassified codename for a SIGINT satellite, post-2000 launches

ROSTER - unclassified codename for MAGNUM/ORION

RUFFER - unclassified codename for JUMPSEAT/TRUMPET

RUNWAY - unclassified codename for CANYON/CHALET/VORTEX SIGINT satellites

RUTLEY - unclassified codename for the MERCURY follow-on (1995-2003 launches).

YIELD / WILLOW (from 1982 onwards) - codename for combination of a JUMPSEAT satellite and low-Earth orbit Program-989 ELINT sub-satellites "piggy-backed" as payload of a rocket launch

"MENTOR" : I have never found a reliable source about the MENTOR codename. Snowden's spy budget shows that ORION is still used today, so I think that "MENTOR" is spurious.

I could find some crypto codenames (such as SILVER) and many early computers of NSA (HARVEST) if you want too.