UK spy agency using Splunk for Facebook, YouTube data haul

Britain’s spy agencies are using Splunk big data software to monitor real-time data from the biggest social media sites, according to documents leaked by whistleblower Edward Snowden.

A 2012 presentation by the British Government Communications Headquarters (GCHQ) — obtained and published by NBC News — shows the agency demonstrating a pilot data collection and monitoring program, dubbed “Squeaky Dolphin”, to its US counterparts, the National Security Agency.

It outlines how the GCHQ uses the Splunk dashboard to extract, monitor and display unencrypted data from the likes of Facebook, YouTube and Twitter, in order to analyse trends on the sites.

At the time, Twitter data and Facebook “like” data was unencrypted. Both companies have since encrypted their data, but Google’s YouTube data remains unencrypted, reported NBC.

The presentation did not reveal how the agency accessed the data, but according to earlier Snowden documents leaked to The Guardian, the GCHQ has existing arrangements with private sector companies operating the cables under its “Tempora” operation.

The operation reportedly allows the GCHQ to attach intercept probes to transatlantic fibre optic cables which carry data to parts of Europe from North America, and to store the data for up to 30 days.

The use of Splunk appears not to have provided the spy agency with detail on specific users, but rather outlined trends of popular content in geographical regions.

The “Psychology A New Kind of SIGDEV" (Signals Development) presentation uses the example of trend data-gathering from YouTube and Facebook in mid February 2012 ahead of anti-government demonstrations in Bahrain.