NSA techs perform an unauthorized field upgrade to Cisco hardware in these 2010 photos from an NSA document.

A document included in the trove of National Security Agency files released with Glenn Greenwalds book No Place to Hide details how the agencys Tailored Access Operations (TAO) unit and other NSA employees intercept servers, routers, and other network gear being shipped to organizations targeted for surveillance and install covert implant firmware onto them before theyre delivered. These Trojan horse systems were described by an NSA manager as being some of the most productive operations in TAO because they pre-position access points into hard target networks around the world.

The document, a June 2010 internal newsletter article by the chief of the NSAs Access and Target Development department (S3261) includesphotos (above) of NSA employees opening the shipping box for a Cisco router and installing beacon firmware with a load station designed specifically for the task.

The NSA manager described the process:

Heres how it works: shipments of computer network devices (servers, routers, etc,) being delivered to our targets throughout the world are intercepted. Next, they are redirected to a secret location where Tailored Access Operations/Access Operations (AO-S326) employees, with the support of the Remote Operations Center (S321), enable the installation of beacon implants directly into our targets electronic devices. These devices are then re-packaged and placed back into transit to the original destination. All of this happens with the support of Intelligence Community partners and the technical wizards in TAO.

Sean Gallagher / Sean is Ars Technica's IT Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland.

View post:

Photos of an NSA upgrade factory show Cisco router getting implant