NSA's XKeyscore lets analysts search anyone's internet activity in real-time without authorization

When Edward Snowden walked into a Hong Kong hotel room in May 2013 with thousands of classified NSA documents, he carried with him proof of a surveillance capability so expansive that it would fundamentally reshape public understanding of what "privacy" meant in the digital age. Among those documents was evidence of a program called XKeyscore—a system that allowed NSA analysts to search the internet activities of virtually anyone on Earth using nothing more than a name, email address, phone number, or a keyword.

The claim itself seemed almost too broad to be credible. The idea that American intelligence analysts could access your emails, browsing history, social media messages, and chat conversations without a warrant or judicial approval struck many as technologically implausible, if not impossible. How could any system be that permissive? How could it operate without oversight?

Government officials and NSA representatives initially dismissed the revelations as overblown. They suggested that safeguards existed, that training and procedures prevented abuse, that the system was designed specifically to target foreign threats. The framing became one of technical capability versus responsible stewardship—yes, the tools might exist, but they were being used appropriately. This narrative persisted in official statements and congressional briefings.

But the documents Snowden provided to journalists at The Guardian told a different story. XKeyscore training materials explicitly described the system as the "widest-reaching" collection program for searching through internet data. The slides showed analysts how to query the system with minimal constraints. There was no requirement for a warrant. There was no judicial authorization process. An analyst needed only to identify a selector—a phone number, email address, or username—and the system would return vast amounts of data about that person's online activity.