One line in analyst_api.c is particularly chilling:
analyzed fragments of the XKeyscore source code, identifying several specific behaviors that trigger surveillance: Privacy Software Interest : Users searching for privacy tools like are automatically flagged. Tor Network Use xkeyscore source code exclusive
: The code identified users who visited the Tor Project website or searched for Tor-related terms. One specific rule targeted users from "non-Five Eyes" countries (nations outside the US, UK, Canada, Australia, and New Zealand) who accessed the Tor directory servers. One line in analyst_api
Unlike other databases that centralize data immediately, XKeyscore stores the full unselected "raw" traffic locally at each site for 3 to 5 days before it is overwritten. The "Federated" Query: xkeyscore source code exclusive