~/ft-meade $ whois nsa.gov // ERROR: no such agency. (they know who asked, though.)
NSA
no such agency · every such packet
[01] THE AGENCY
Born from a secret Truman memo in 1952, denied for decades, now the largest eavesdropping operation in human history. The nickname was the mission statement.
No congressional debate created the NSA. A classified memorandum did, in October 1952, and the agency's existence stayed so officially unacknowledged that Washington's joke name for it stuck: No Such Agency. The charter is signals intelligence, intercepting and decrypting the world's communications, plus a second mission of protecting America's own. Keep both of those in mind. They will fight each other for the rest of this page.
The scale is municipal. Fort Meade has its own exit off the parkway, its own police force, and a campus where tens of thousands work behind a headcount that is itself classified. In Bluffdale, Utah, the agency built a roughly $1.5 billion data center whose storage capacity is classified too; outside estimates start at exabytes and argue upward from there. Director Keith Alexander's reported philosophy, the one his own colleagues quoted, was three words long: collect it all.
And it doesn't work alone. The take is pooled with Britain's GCHQ and the rest of the Five Eyes alliance, laundered through partners when domestic law gets awkward, and fed by compelled access to the companies you log into every day. The CIA does humans. The NSA does everything your humans say to each other.
// the file card
| founded | november 4, 1952, by classified truman memo. congress found out later |
| hq | fort meade, maryland. own exit ramp, own cops, mirrored glass |
| budget | classified. $10.8B in the 2013 black budget snowden leaked |
| headcount | classified. estimates run 30,000 to 40,000, plus contractors |
| storage | utah data center, bluffdale. capacity classified. unit: exabytes |
| missions | break their security. protect ours. one of these got the budget |
// the budget is classified. the headcount is classified. your call records were not.
[02] THE RECEIPTS
After 9/11, the agency wiretapped Americans' calls and emails with no court at all. The legal basis was so rotten that in 2004 the justice department's own leadership threatened mass resignation from a hospital bedside. The program kept running; the New York Times exposed it in 2005.
"Relevant to an investigation" was stretched to mean every American's phone records, every day, for years. In 2015 the second circuit ruled the program unlawful. The government's own privacy board had already checked the results: not one case where bulk collection made a concrete difference. All cost, no plot.
A roughly $250M-a-year program to weaken the crypto everyone relies on. Its trophy: the Dual_EC_DRBG random number generator, backdoored at the standards level until NIST had to formally retract it in 2014. Reuters reported RSA took $10M to make it a default. Your security was the line item.
Tailored Access Operations, the in-house hacking unit, with a 2013-leaked catalog of implants for routers, firewalls, hard drive firmware, and iPhones. Cisco gear got intercepted in shipping, opened, "upgraded," resealed, and delivered. There are photos. The boxes look great.
2016: someone posts the agency's own exploit stash for sale. 2017: the hoarded EternalBlue exploit escapes and powers WannaCry, which shut down hospitals, then NotPetya, the costliest cyberattack in history at roughly $10 billion. The stockpile kept "for our security" burned the world's.
In 2006 an AT&T technician named Mark Klein walked out with documents describing a secret room at the San Francisco switching hub: beam splitters copying the internet backbone into NSA deep-packet gear. Not a tap on a suspect. A tap on the country. They later named it "upstream" and kept it.
$ ./publish-standard --rng dual_ec_drbg --flaw deliberate > standard approved. nist signature attached. $ ./store --exploits eternal* --vault definitely-secure > vault contents now available on the open internet. — @shadowbrokers $ ./assess-damage --scope global > hospitals down, ports down, $10B gone. recommendation: bigger vault. // the agency that breaks security for a living lost its own toolbox. // the toolbox worked exactly as designed. on everyone.
[03] NOBODY BUT US
An agency told to break everyone's security and also protect America's will always feed the first mission. Offense gets headlines and budget. Defense gets the blame later.
The internal doctrine has a name: NOBUS, "nobody but us." A flaw is acceptable to keep secret, the theory goes, if only the NSA is capable of exploiting it. It's a bet about everyone else's competence, placed on your infrastructure, renewed every year against adversaries who also hire mathematicians. Dual_EC was supposed to be NOBUS until researchers flagged the backdoor shape in 2007. EternalBlue was NOBUS until the Shadow Brokers posted it. The bet keeps losing and the bettor never covers the stake; hospitals do.
The official safeguard is the Vulnerabilities Equities Process, a review that decides whether a discovered flaw gets disclosed to the vendor or hoarded for offense. The agency says the vast majority get disclosed. The flaw behind the worst cyberattack in history sat in the arsenal for around five years before it leaked, and the review process is run by the people who want to keep the bugs. Oversight that grades its own homework is a press release. So was "we don't collect on Americans," under oath, three months before the receipts published themselves.
// every backdoor is a NOBUS bet. the house keeps losing. the house is you.
[04] VERDICT
You can't out-lobby Fort Meade. You can out-math it. Encryption is the only oversight that doesn't need a hearing.
Every other check failed on schedule: the secret court approved nearly everything, the oversight committees learned the truth from a contractor with a thumb drive, and the reforms renamed the programs. What actually moved the needle was math. After 2013, encrypted traffic went from exception to default, and the agency's own complaints about "going dark" are the closest thing to a performance review you will ever get. So encrypt like it's policy, because it is, yours. The tools work today, the stack is documented, and the argument for why is the whole point of this site. The agency reads what the platforms hand over and shares it with four other governments; what it cannot read, it cannot share. The state won't restrain itself. Ciphertext will.
// no such agency. no such plaintext. fair trade.