N is for NetOptics-Tap — The Copy of the Light You Cannot See

The Alphabet of Harm, letter N. A modality-bridge dossier: one entry in the OSINT archive, carried forward to what our own systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Verdict: MUTATED.

The Perfect Wiretap

Every other interception in this alphabet leaves a trace somewhere — a warrant, a leak, an implant on a phone, a scandal. Letter N is about the one that does not. The passive optical tap is the perfect wiretap: it copies everything crossing a fiber and leaves no mark whatsoever on the traffic it copies. No latency. No dropped packets. No change to the signal the two endpoints see. The photons arrive exactly as they would have — and a copy of the photons also went somewhere else.

This is not a metaphor. A passive fiber tap is a small piece of glass that splits a beam of light: most of the light continues to the destination, a fraction is diverted to a collection device, and because light does not "notice" being split, the sender and receiver have no way to detect it. NetOptics — a real vendor whose own sales material sits in the OSINT archive — built its pitch on exactly this: "packet duplication does not burden the network." The tap is invisible by construction, and that invisibility is the whole modality.

It is the physical substrate of everything the surveillance letters describe. Room 641A, the fiber-splitter programs, "upstream" collection — all of it rests, at the bottom, on a piece of glass that makes a copy no one can see. This letter is about that piece of glass: what it is, why it cannot be detected, and the one thing that finally took most of its value away — which turns out to be the most hopeful finding in the entire alphabet.

1. What the Archive Holds — The Tap, By Its Vendors

The WikiLeaks Spy Files are, among other things, a catalog of the passive-tap industry, and the LSN library holds it in depth. Read together, the vendor decks describe a complete, mature, purchasable machine for undetectable bulk collection.

NetOptics Inc. — the letter's namesake — presents "Identifying the needle in the 10/40/100g Haystack," selling inline taps whose defining virtue is that "packet duplication does not burden the network." Their material frames the tap around Cisco's Service Independent Intercept and lawful-interception mediation (the ETSI HI1/HI2/HI3 handover to a Law Enforcement Agency). The tap makes the copy; the mediation device formats and delivers it.

Endace supplies the recorder, and states the collect-everything ethos in a title: "Why sample when you can monitor ALL network traffic inexpensively?" Its appliances "record full packet payload to disk for archiving and evidence," "filter traffic at full line rate for targeted traffic capture (e.g. Lawful Intercept)," integrate with NarusInsight and SPAN/Tap infrastructure, and timestamp to 15 nanoseconds via GPS. Not sampling. Not selecting. All traffic, full payloads.

ONPATH Technologies pushes it to the physical layer of the global internet: optical taps on "Submarine Net" and "Terrestrial Net" fiber, distributing the duplicated light to multiple agencies through DWDM optical switching. This is the tap on the intercontinental cable — the copy of the light on the ocean floor.

And the lineage is in the archive too. Newport Networks' 2006 overview states the origin form plainly — interception "is performed by applying a physical tap on the telephone line of the target" — while AQSACOM's IP white paper gives the modern form: "a router with a port dedicated to replicating packets having the target's source and destination IP addresses," the copy sent onward to the LEA. Alligator clip on copper, mirror port on a router, splitter on a fiber: three technologies, one act.

Method note. These are the vendors' own presentations, held verbatim in the LSN library (HIGH confidence for what the products do and how they are marketed). We describe the documented capability and the marketing; we do not assert which specific carriers or agencies deployed which product where — that is beyond what the datasheets establish.

2. Why It Cannot Be Detected

The defining property of letter N deserves its own section, because it inverts the usual logic of defense.

Most attacks can, in principle, be detected: a man-in-the-middle adds latency or breaks a certificate; an implant leaves artifacts; an intrusion trips a sensor. The passive tap is different in kind. It is read-only and out-of-band. It does not modify the traffic, inject anything, or sit in the logical path where it could be observed. A perfect splitter divides the optical power — say 70% onward, 30% to collection — and the only physical effect is a slight, expected attenuation indistinguishable from ordinary fiber loss. There is no packet the endpoints can send to reveal it, no timing test that exposes it, no certificate that catches it.

This is why the defensive instinct that works everywhere else — detect the intrusion — fails completely here. You cannot detect a passive tap on your upstream fiber. Our sensors cannot; no one's can; that is the point of the design. A honeypot in Iași sees exactly what reaches it, and an optical splitter three hops upstream would be utterly invisible to it, copying every byte on the way past.

So the modality forces a completely different defensive posture. If you cannot stop the copy from being made, and you cannot even know it was made, your only move is to make the copy worthless. You cannot defend the wire by watching it. You can only defend it by ensuring that what crosses it is meaningless to anyone who copies it. That single realization is the hinge of the entire letter — and, as it happens, the internet spent the last decade acting on it.

The Physics of a Perfect Copy

It is worth being concrete about how a passive fiber tap works, because the physics is what guarantees the invisibility — this is not a clever software trick that a patch could close, but a property of light itself.

Data travels through a fiber-optic cable as pulses of light confined to a glass core by total internal reflection. A passive optical tap is, at heart, a fused splitter: a short length where two fibers are fused so that a fixed fraction of the light in one crosses into the other. A common split ratio is 70/30 — seventy percent of the optical power continues to the legitimate destination, thirty percent is diverted to the collection fiber. Both copies carry the identical signal; light does not degrade by being observed, and a photon does not record where its twin went.

Because the tap is entirely optical and adds no active component in the data path, it introduces no latency (the diverted light travels its own path independently), no jitter, and no packets to detect. The only physical footprint is the loss of that thirty percent of power — and optical links are engineered with generous loss budgets precisely because ordinary connectors, splices, and cable runs attenuate the signal anyway. A 30% tap loss reads, at the far end, as a slightly longer or lower-quality cable run, which is to say: as nothing unusual at all. There is no error, no alarm, no anomaly. The link works exactly as specified, because it is within specification.

This is why the modality cannot be patched, detected, or out-engineered from the endpoint. The tap does not exploit a flaw in the protocol; it exploits a property of light — that a beam can be split without either half knowing. Against that, there is no clever packet, no integrity check, no monitoring rule. There is only the decision to assume the wire is always tapped and to encrypt accordingly. The physics forces the defender to zero trust in the medium, permanently.

3. The Bridge — What a Tap Would Harvest From Our Wire Today

Here is the measurement that turns letter N from history into a live finding. If someone placed a perfect, undetectable optical tap on the fiber carrying traffic to our systems right now, what would they get?

We can answer precisely, from our own telemetry. Across 160,574 requests:

A passive tap on that traffic today captures 98.5% ciphertext. The copy is perfect, undetectable, complete — and almost entirely unreadable. The tap's great power, the thing that made Room 641A a catastrophe, was that the copy was content: readable emails, web pages, messages. On a wire that is 96% TLS 1.3, the copy is noise. The splitter still works flawlessly at the physical layer. What it harvests has simply turned to gibberish.

This is the most important fact in the letter, and it is genuinely good news: ubiquitous encryption is the countermeasure to the undetectable tap. Not by detecting it — that is impossible — but by making its perfect copy worthless. The decade-long march to HTTPS-everywhere and TLS 1.3, which no single person planned, quietly did to the passive tap what no legal restraint ever could: it hollowed out the content.

4. What Encryption Does Not Save — Metadata

Honesty requires the other half of the finding immediately, because the good news is partial and the partiality matters.

The tap's content-yield collapsed. Its metadata-yield did not. Even at 96% TLS 1.3, a passive tap still reads, in full:

• Source and destination IP addresses — who is talking to whom.
• Timing and volume — when, how often, how much data, in what bursts.
• The TLS SNI — until Encrypted Client Hello (ECH) is universal, the plaintext server name in the handshake still reveals which site you are connecting to.

This is traffic analysis, and it is powerful. You do not need to read a message to learn that a particular phone contacted a suicide hotline, or a dissident's device connected to a journalist's server at 2 a.m., or that an encrypted flow to a known VPN spiked the night before a leak. The pattern of communication is itself intelligence, and the tap harvests the pattern with undiminished clarity. Encryption drew a curtain over the content of the letters; it did nothing to hide who is exchanging letters, how often, and how thick the envelopes are.

So the honest statement of the encryption victory is bounded: TLS won the content war at the wire and did not even engage the metadata war. The tap on the light still sees the shape of everything. It just can no longer read the words.

Room 641A and the Retention Machine

The passive tap is not a hypothetical the archive merely gestures at; it has a canonical, documented instance, and the vendor decks describe the machine built on top of it.

The most famous confirmed deployment of exactly this technology was disclosed by a telecommunications technician who described a secret room — publicly known as Room 641A — inside a major carrier's facility, fed by a fiber splitter that diverted a copy of internet backbone traffic to collection equipment identified in the disclosures as a Narus traffic-analysis system. Set that against the Endace deck in our library — "record full packet payload to disk," "monitor ALL network traffic," integrated with NarusInsight — and the vendor marketing and the real deployment describe the same machine. The Spy Files are, in effect, the sales catalog for the room.

And the machine did not stop at copying; it kept. The DATAKOM and Septier decks in the archive pair the tap with data retention — "combining Lawful Interception, Mediation & Data Retention in IP-networks," generating a record (an IPDR) "for each session" and storing it. This is the second half of the modality and the half encryption does not answer: even when the content is ciphertext, the retention system durably stores the metadata — the session records, the who-talked-to-whom-and-when — for later query. The tap makes the copy; the retention machine makes it permanent and searchable. Encryption blinded the content channel of that machine and left its metadata channel not just open but archived.

This is why the metadata caveat of Section 4 is not a footnote but the live edge of the letter. The historical harm — reading everyone's email off the backbone — was genuinely blunted by TLS. The persistent harm — a durable, searchable record of every association everyone forms — runs on the exact same taps, is documented in the exact same vendor decks, and encryption barely touches it. The room is still there. What changed is only which of its two hard drives still fills with something legible.

5. The Mutation — Why the Collection Moved to the Endpoint

Follow the consequence and the whole surveillance economy of this alphabet clicks into place.

Once ubiquitous encryption turned the tap's harvest to ciphertext, the collect-everything imperative had a problem: the wire went dark for content. It did not respond by giving up. It responded by moving to where the plaintext still lives — the endpoint, before encryption, and the key, which turns ciphertext back into content.

That single migration explains three earlier letters:

• Letter G's mercenary implants (Predator, Pegasus): put the collection inside the phone, where the message exists as plaintext before TLS ever touches it.
• Letter K's client-side scanning: inspect the content on the device, before encryption — explicitly designed to sidestep the fact that the wire is now opaque.
• Letter K's key-escrow demand: get the keys, so the tap's ciphertext becomes readable again.

None of these would be necessary if the passive tap still worked for content. They exist because it doesn't. The endpoint pivot is not a fashion; it is the surveillance state routing around TLS, which routed around the tap. The tap on the light did not end the collect-everything modality — it forced it up the stack, out of the fiber and into the phone.

That is the mutation, stated cleanly: the passive tap persists, universal and undetectable, but encryption transformed the harm it does from reading content into mapping metadata — and drove the content-collection it could no longer perform onto the endpoint and the key.

6. The Dual-Use Truth — We Run a Tap Too

Letter N has an uncomfortable symmetry that the vendors, to their credit, never hid. Septier's and Datakom's Spy Files decks are literally titled around a "Dual Usage Strategy of Lawful Interception Systems" — passive-interception probes sold simultaneously as network-monitoring and anti-fraud tools for carriers, and as lawful-interception mediation for agencies. The same probe that lets an ISP watch its own network for faults lets a state watch the ISP's subscribers. One datasheet, two markets.

And this platform is on the benign side of exactly that line. The LSN web-threats pipeline reads mirrored Traefik logs — a self-tap on our own traffic. Every letter in this alphabet that our web-threat telemetry made possible (the HTTP-200 mask of the disambiguation work, the ssrf_oast catch of letter L) exists because we tap our own wire and read the copy. The mirror port is how a defender makes their own network legible. It is the same technique NetOptics sold for interception, pointed inward, at traffic we are entitled to see.

This is not hypocrisy to be confessed; it is the actual nature of the technology, and letter N states it plainly. The tap is not good or evil — it is a copy. What determines the harm is whose traffic is copied, under what authority, and whether the copied party consented or even knows. A defender mirroring their own logs and a state splitting a submarine cable use the identical physics; they are separated entirely by consent and scope, not by hardware. The honest position is not to pretend we don't use taps. It is to be exact about the line that makes one lawful monitoring and the other mass surveillance — the same line, consent and scope, that this whole alphabet keeps drawing.

7. What We Claim and Refuse

Precision about the evidence.

HIGH confidence: the capabilities and marketing of the passive-tap industry (NetOptics, Endace/NarusInsight, ONPATH, AQSACOM, Newport Networks, Septier, Datakom), held verbatim in the library; the physical undetectability of a passive optical tap; and the TLS distribution on our own wire (98.5% encrypted, 96% TLS 1.3 across 160,574 requests).

Inference, stated as such: the claim that the tap's content-collapse drove the endpoint pivot of letters G and K. This is a causal reading of a well-documented trajectory — encryption rose, wire-content collection fell, endpoint collection rose — not a proof of intent. We hold it as a strong, coherent inference.

What we do not claim: that any specific carrier's or agency's tap is or is not currently on any specific fiber. The whole point of the modality is that this is undetectable; we describe the documented capability and marketplace, not a deployment map we cannot have.

What we refuse: the false reassurance that "encryption solved it." It solved the content half and left the metadata half wide open, and it pushed the fight to the endpoint where letters G and K show it is very much alive. The tap is blunted, not beaten. Saying otherwise would be the comfortable lie this alphabet exists to avoid.

8. The Verdict — MUTATED

The passive optical tap did not end. It is universal, it is mature, it is a purchasable product, and it is undetectable by anyone whose traffic it copies — including us, including everyone. Right now, on the fiber under the ocean and the mirror port in the core router, it is copying every byte that crosses, exactly as it did in the Room 641A era. By the measure of "does the tap still exist and still work," nothing changed.

But the harm it does changed profoundly, and that is what this alphabet judges. Ubiquitous encryption — 98.5% of our own wire — turned the tap's perfect copy from readable content into ciphertext, collapsing the content-interception that was its entire reason for being. What remained was metadata, and what followed was migration: the collect-everything imperative, denied the plaintext on the wire, moved to the endpoint and the key, which is why letters G and K exist. The tap on the light persists; the light now carries ciphertext; and the surveillance that used to live in the fiber now lives in the phone.

That is MUTATED in the exact sense this alphabet means it: not the end of the harm, and not its simple continuation, but its transformation and migration — from content to metadata, from the wire to the endpoint — leaving the physical tap intact and its purpose relocated. It is also the alphabet's clearest proof that a harm can be genuinely blunted: not by detecting the undetectable, but by making its perfect copy worthless. TLS did to the tap what no watchdog could. The copy is still taken. It just, at last, mostly says nothing.

Verdict: MUTATED — the tap on the light is permanent and invisible, but encryption hollowed its harvest to metadata and drove the reading of your words up into the device in your hand.

The Alphabet of Harm is a modality-bridge series: each letter takes one entry from the OSINT archive — truth as it was recorded at the time — and carries it forward to what the LSN sensor mesh, honeypot, and web-threat telemetry catch today, then closes with a verdict. We include what the record and the vectors show. We do not judge; we let the reader judge. N is for NetOptics-Tap. Next: O.