U.S. National Security Agency has been tracking Bitcoin transactions as early as 2013, online news outlet The Intercept reported, citing classified documents made available by whistle-blower Edward Snowden.
Citing an internal NSA report dating to March 2013, The Intercept reported that the watchdog had at least one source which helped it “harvest and analyze raw, global internet traffic while also exploiting an unnamed software program that purported to offer anonymity to users.”
While it was interested in tracking other competing cryptocurrencies, “Bitcoin is #1 priority,” the NSA said in a March 15, 2013 internal report.
The NSA’s Bitcoin tracking was through a secret Internet surveillance program code-named OAKSTAR, which is the Intercept report described as a “collection of covert corporate partnerships enabling the agency to monitor communications, including by harvesting internet data as it traveled along fiber optic cables that under-gird the internet.”
Bitcoin transactions were targeted through a sub-program of OAKSTAR called MONKEYROCKET, which tapped network equipment to gather data from the Middle East, Europe, South America, and Asia.
An NSA internal report dated March 8, 2013 said the agency’s analysts “found value in the MONKEYROCKET access to help track down senders and receivers of Bitcoins.”
The agency hoped to “use the access for their mission of looking at organized crime and cyber targets that utilize online e-currency services to move and launder money.”
Another NSA report dated March 29, 2013 said “MONKEYROCKET is offering a sole source for SIGDEV for the Bitcoin targets”. SIGDEV is the acronym for signals intelligence development.
Further, the classified documents also described MONKEYROCKET as “non-Western Internet anonymization service in support of counter-terrorism” with a “significant user base” in Iran and China that came online in July 2012.
MONKEYROCKET program is governed by the Executive Order 12333, which extends powers and responsibilities of U.S. intelligence agencies while investigating U.S. citizens.
The mysterious program was apparently promoted on the Internet disguised as a popular website or service with advertising focused in areas of interest to counter-terrorism.
An NSA entry in July 2012, said there were approximately 16,000 registered users and the site was generating about 2,000 events per day. The number of users was expected to grow significantly.
The website also had a “browsing product”, which could have been a virtual private network, to attract targets engaged in terrorism, including Al Qaida.
In effect, this software was used as privacy bait and switch drawing bitcoin users looking for anonymity online. But, the tool send user data directly to the NSA, the Intercept report said. Thus, the NSA harvested significant amount of Bitcoin user data.
Data harvested were “full-take”, meaning they were used entirely, and included billing information and internet protocol addresses of targets.
The agency was also tracking Liberty Reserve, a predecessor of Bitcoin, but with criminal ambitions. The Costa Rica headquartered website was charged with running a $6-billion “laundering scheme” and its Ukrainian founder was awarded a 20-year conviction, The Intercept reported, citing March 2013 NSA reports. The website was apparently NSA’s number two target after Bitcoin.
While there is no mention of the NSA program’s link to the 2013 crackdown on the notorious Silk Road, a darknet marketplace, the founder Ross Ulbricht was arrested roughly after six months after the Bitcoin surveillance began, the Intercept report said. He had alleged that authorities found out about his transactions illegally.
The news of NSA’s Bitcoin tracking is likely to raise privacy concerns in the cryptocurrency community.