The newest alarming revelation to hit the headlines courtesy of Edward Snowden is that the NSA has been infecting computers with malware via faked Facebook login pages - performing essentially a worldwide “industrial-scale exploitation” of computer networks.

Facebook has denied any knowledge of the NSA's malware infection program, and said its site is now protected against such attacks. But the company suggested that, if the allegations are true, other social networks could also have been compromised.

According to First Look, the covert infrastructure that supports the hacking efforts which were developed to infect potentially millions of computers worldwide with malware “implants,” operates from the agency’s headquarters in Fort Meade, Maryland, and from eavesdropping bases in the United Kingdom and Japan. GCHQ, the British intelligence agency, appears to have played an integral role in helping to develop the implants tactic.



In some cases the NSA has masqueraded as a fake Facebook server, using the social media site as a launching pad to infect a target’s computer and exfiltrate files from a hard drive. In others, it has sent out spam emails laced with the malware, which can be tailored to covertly record audio from a computer’s microphone and take snapshots with its webcam. The hacking systems have also enabled the NSA to launch cyberattacks by corrupting and disrupting file downloads or denying access to websites.

The implants being deployed were once reserved for a few hundred hard-to-reach targets, whose communications could not be monitored through traditional wiretaps. But the documents analyzed by The Intercept show how the NSA has aggressively accelerated its hacking initiatives in the past decade by computerizing some processes previously handled by humans. The automated system – codenamed TURBINE – is designed to “allow the current implant network to scale to large size (millions of implants) by creating a system that does automated control implants by groups instead of individually.”

In a top-secret presentation, dated August 2009, the NSA describes a pre-programmed part of the covert infrastructure called the “Expert System,” which is designed to operate “like the brain.” The system manages the applications and functions of the implants and “decides” what tools they need to best extract data from infected machines.

The NSA provided a statement regarding the leak, which simply read: "Signals intelligence shall be collected exclusively where there is a foreign intelligence or counterintelligence purpose."