TURBINE was described as an NSA system for automatically managing and controlling malware implants placed on selected computers or deployed in bulk. The architecture reduced human oversight by grouping implants for automated control; The Intercept, as quoted in the source, reported that its goal was to scale the network to “millions of implants.” The source identifies the NSA as responsible and says the agency shared implant-related files with its Five Eyes partners: the United Kingdom, Canada, New Zealand, and Australia.
TURBINE depended on TURMOIL sensors positioned at NSA facilities and overseas listening sites, including Fort Meade, Misawa Air Base in Japan, and RAF Menwith Hill in England. Those sensors monitored Internet traffic, used selectors such as email addresses, IP addresses, cookies, encryption-key fingerprints, and computer identifiers to identify targets, and could send automated alerts that initiated malware operations. The supplied source does not provide a specific launch date, financial figure, named whistleblower, or court or regulatory resolution; its documented lasting consequence is the exposure of a mass-surveillance architecture linking automated hacking, global traffic interception, and intelligence sharing among Five Eyes agencies.
