SurveillanceNSA planted sleeper malware in 50,000 computer networks

Published 11 December 2013

The NSA has planted 50,000 sleeper malware packages – in effect, digital sleeper agents – in more than 50,000 computer networks around the world. The agents, controlled by the NSA’s Tailored Access Operations (TAO) unit, can be activated on command to harvest information of cause disruption. To plant the digital agents, the NSA employed methods typically used by Internet scammers and fraudsters.

The National Security Agency (NSA) is reported to have installed computer malware in 50,000 computer networks around the globe. Reports in the Washington Post, based on documents provided by Edward Snowden, revealed that by the end of 2008 the NSA had 20,000 computers infected, and the number has increased to about 50,000 infiltrated computer networks today.

The infections, considered, “Digital Sleeper Agents,” remain inactive within network systems until they are activated to harvest sensitive information or cause disruption. The tactic is considered basic spy work from an agency tasked with spying.

Techcrunch reports that new details of the Computer Networks Exploitation (CNE) program, a term given to the secret infiltration of computer systems accomplished by installing malware, indicate that the digital sleeper agents can be watched and controlled remotely “with a single push of a button.” A New York Times report says that the NSA has been working to advance its surveillance capabilities to infiltrate newer digital technology and online communications. The strategy, described in a February 2012 paper, shows that agency officials set an objective to “aggressively pursue legal authorities and a policy framework mapped more fully to the information age.”

While news of the program may be unsurprising by many who follow the recent revelations by Edward Snowden, the NSA’s methods of infiltrating network systems have caught most by surprise. Phishing scams with false e-mail requests typically used by Internet scammers and fraudsters were employed by the NSA, according to TechCrunch. The Dutch newspaper NRC reported that the NSA’s British counterpart, Government Communications Headquarters (GCHQ), used false LinkedIn pages to attract and infect computer networks belonging to employees of Belgacom.

NRC also reports that the NSA’s CNE program is operated by a special department called TAO, (Tailored Access Operations). The department employs more than a thousand hackers.