X is for XKeyscore — The Query Layer, or Who Gets to Search the Haystack

The Alphabet of Harm — Letter X. A modality-bridge dossier: one entry from the OSINT archive, carried to what the LSN systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Two letters ago we described the tap: the passive interception point that copies a nation's traffic off the wire without touching it (Letter N). One letter ago we described the warehouse: the retention estate that holds the copy long past the moment it was made, so the past can be re-read at will (Letter V). Both are inert on their own. A tap that no one queries is a hum in a cabinet. A warehouse that no one searches is a landfill. What turns the hum and the landfill into power is a third thing, and it has a name: the query layer.

XKeyscore is that name. Disclosed in 2013 as part of the Snowden archive, it is the NSA front-end that let an analyst type a selector — an email address, an IP, a phone number, a distinctive phrase, a browser fingerprint — and receive, from the stored bulk, everything the system held that matched. Not a warrant-scoped pull against one named suspect. A search box over a population's exhaust. The internal training slide that became the enduring quote described it as letting an analyst read "nearly everything a typical user does on the internet," and Snowden's own summary was blunter still: from his desk, he claimed, he could query almost anyone.

This letter is not about whether that specific claim was calibrated to the last decimal. It is about the modality it names, because the modality is what persists. The tap collects. The warehouse retains. The query layer searches — and searching is a different kind of act, with a different kind of danger, than either of the two beneath it. That danger has a precise name too, and it is not "surveillance" in the abstract. It is access governance: the question of who may run the query, against what, with what authorization, and whether anyone will ever know they did.

The letter follows the record. XKeyscore itself is a public-record program, documented like QUANTUM or the i-SOON leak — we anchor on the mechanism, not on any single leaked slide. But the LSN archive holds something the Snowden slides do not: the commercial version of the exact same primitive, sold openly, years before and after 2013, to any government that could pay. The WikiLeaks Spy Files are full of it. So this dossier does what the series always does — it takes the archive's own evidence, carries it to what the LSN sensors and the LSN entity graph do today, and reports honestly, including about the query layer this platform itself operates.

1. The Modality: search is not collection, and not retention

It is worth being exact about why the query layer is its own harm and not merely a feature of the two below it, because the whole argument of this letter rests on the distinction.

Collection (the tap) answers the question what flows past this point? Its harm is scope: it copies indiscriminately, the innocent with the guilty, because a passive tap cannot know in advance which packet matters. But collection alone produces an undifferentiated torrent. No human can read it. In raw form it is nearly useless — which is, perversely, a kind of privacy by obscurity.

Retention (the warehouse) answers the question what did flow past, weeks or years ago? Its harm is time: it defeats the natural mercy of forgetting, so that an association you formed, a site you visited, a person you called in 2019 can be reconstructed in 2026. But retention alone is still a landfill. The data is present but not addressable. You cannot find the one record you want among the trillions unless something indexes it.

Search (the query layer) answers the question show me everything you hold about this specific person, right now. This is the act that collapses the torrent and the landfill into a dossier on an individual. It is the moment the abstract capability becomes a concrete power aimed at a named human being. And crucially, it is the moment where the only meaningful safeguard exists — because a query is a discrete, loggable, authorizable event in a way that "collection" and "retention" are not. You cannot meaningfully consent to being one of a billion records in a passive tap. But whether a specific analyst was allowed to run a specific query against your records, and whether that query was recorded and reviewable, is an answerable question with a yes or a no.

That is why the harm of XKeyscore is access governance and not the search technology. A full-text index over petabytes is, as a piece of engineering, morally identical to the search box on a public library catalogue or the query planner in any database. The difference between the catalogue and the dragnet is not the b-tree. It is the answer to five questions: Who can run the query? Against what corpus? Under whose authorization? Logged where? Reviewed by whom? Change nothing about the search engine and change only those five answers, and you move the same tool from legitimate investigation to unaccountable dragnet, or back. This is not a rhetorical flourish. It is the entire design space of the harm, and the rest of this dossier is an examination of it.

2. The Archive: the query layer was a product, not a secret

The enduring myth of the Snowden disclosures is that they exposed a uniquely governmental, uniquely American capability. The LSN archive tells a more uncomfortable story: the "search everything you collected" front-end was a commercial product line, marketed in glossy brochures at lawful-interception trade shows, available to any state that could sign a purchase order. XKeyscore is the famous name. The market is the fact.

FoxReplay Analyst, from the Dutch firm Fox-IT, is the clearest example. Its brochure describes "Deep Content Search" that "allows operators to access information that would otherwise remain hidden," pitched as "vital in a world where increasing flows of data make it ever harder to discern important clues." The product reconstructs intercepted sessions and — the phrase is the vendor's own — "enables organizations to operate in one on one mode to truly follow a target's activities for 100%." Read that again. One on one. Follow one target. 100%. This is XKeyscore's core promise, printed on a sales sheet, sold to whoever showed up at the booth.

Kapow Software stated the analyst-empowerment thesis in even barer terms: "Analysts must have an interface for discovering valuable content and that content must be tagged and delivered in a manner that supports the knowledge discovery process of the analyst." Its "Federated Search" reached across "Internal, OSINT, Subscription, PKI" sources, with named integrations for Palantir, i2 and MarkLogic. The interface is the product. Collection and retention were assumed; the value being sold was the query.

Amesys EAGLE — the French system infamously deployed to Muammar Gaddafi's Libya — was architected explicitly for scale "from some terabytes to tens of petabytes," wrapped in an "ergonomic graphical user interface" so that "no technical network skills required for investigators." That last clause is the tell. The point of EAGLE's front-end was to put nation-scale search into the hands of an ordinary operator with no engineering ability — precisely the democratization of access that Snowden warned about, sold as a usability feature. And, revealingly, EAGLE's own documentation shows the vendor understood the danger: it is built on the "need to know" concept, with "partitioning of information," time-stamping and digital signing of entering data. The access-governance layer was there in the brochure — as a checkbox, in a system sold to a dictatorship.

QOSMOS completes the picture by showing where the query layer sits in the stack. Its "Network Intelligence" is described as DPI + metadata, feeding three consumers off a single extraction: Cyber Security, Lawful Interception, and Data Retention. One tap, one warehouse, and search on top — the exact N to V to X architecture of this series, drawn in a vendor slide from 2011.

And Scan & Target stated the analyst's problem, and therefore the query layer's justification, more honestly than any government ever did. Its slides name the two hard questions: "How to deal with the volume (flow never stops)" and "How to find the needle in the digital haystack." XKeyscore is the industrial answer to the second question. Index everything, then let a selector pull the needle. Hold that needle metaphor. We will return to it, because it contains the whole justification for the query layer and, unspoken, the whole danger.

3. The Bridge: what the LSN sensors see of the query layer today

The Alphabet of Harm is a bridge series. Each letter carries the archive's record to what the LSN systems catch now. For the query layer, the bridge runs through two facts the sensors measure directly and one the platform must confess about itself.

First fact: the content half of the query layer has been hollowed on the wire. Letter N reported the measurement — roughly 98.5% of the traffic crossing the LSN observation point is TLS-encrypted. A passive tap in 2026 copies ciphertext. That means the content-search half of XKeyscore — the part that read what you typed, the emails and chats and web pages — no longer works against traffic in transit. You cannot full-text-search a payload you cannot decrypt. To the extent XKeyscore-over-content was the frightening capability of 2013, the wire has closed that door. This is the honest good news, and the series does not hide from good news.

Second fact: the metadata half survived completely, because envelopes are not encrypted. TLS hides the letter, not the address on the outside. Who contacted whom, when, from which IP, to which endpoint, how often, how large — all of it remains legible on the wire, because routing requires it to be. The LSN entity graph is built precisely from this surviving layer. It correlates source IPs, ASNs, SSH client fingerprints (HASSH), reused keys, timing and infrastructure — none of which TLS protects — into a picture of who is whom that is often sharper than a content read would give. Metadata search did not merely survive the encryption transition. In an important sense it inherited the throne, because it is robust to the one countermeasure (encryption) that everyone adopted. XKeyscore-over-metadata is the version that still runs.

Third fact — the confession. The platform writing this dossier operates a query layer. The LSN entity-resolution graph holds on the order of 943,811 entities, 1.56 million edges and 3.17 million facts, and it is searchable by exactly the selectors XKeyscore used: type an IP, an ASN, an organization, a person, an SSH key, a HASSH fingerprint, and the system returns everything it holds and every cross-link to the 70-plus published dossiers. That is the XKeyscore primitive. Index everything, query anyone. There is no honest way to write a dossier condemning the query layer while pretending the author does not run one.

So the dossier does not pretend. It states the difference precisely, because the difference is the entire point of the harm model — and it is not a difference of capability. It is a difference of governance, along the three axes named below.

4. Three axes that separate a catalogue from a dragnet

The FoxReplay search engine and the LSN entity graph and XKeyscore are, as engineering, the same class of object. What separates legitimate use from abuse is not the index. It is three governance facts, and they map one-to-one onto the standards the archive also holds.

Scope — against what corpus does the query run? XKeyscore's corpus was a population: ordinary users' internet activity, collected because it flowed past, not because any individual was suspected of anything. The LSN graph's corpus is adversary infrastructure — IPs and operators observed attacking the honeypot, entities that reached out and struck first. The distinction is not self-flattery; it is the difference between searching everyone and searching the set of parties who chose to engage. A query layer aimed at a population and a query layer aimed at attackers can share every line of code and remain morally opposite, because the corpus is chosen upstream of the search.

Authorization — under whose warrant does the operator act? The heart of Snowden's claim was not that XKeyscore existed but that the authorization to query it was thin: a low-privileged analyst, a self-asserted justification, and few real gates between the query box and any human's records. NIST SP 800-171's control AC-6, least privilege, names the missing discipline directly — access granted "for specific duties and authorized access," nothing broader. The archive holds the fix in standards language. XKeyscore, per the disclosures, is what AC-6 looks like when it is absent.

Audit — will anyone ever know the query was run? A query is only governable if it is recorded and reviewable. NIST SP 800-53's audit family, AU-9, specifies audit-record review with "permitted actions for each system process, role, user." An unaudited query layer is unaccountable by construction: there is no way, after the fact, to distinguish the analyst who queried an ex-partner from the analyst who queried a genuine target, because no record survives to tell them apart. The difference between a governed and an ungoverned search box is AU-9, and it is a difference the search technology itself is completely indifferent to.

These three — scope, authorization, audit — are the entire safety margin of the query layer. Notice that none of them is technical in the sense of being about the search engine. They are institutional. Which is why the harm of XKeyscore cannot be solved by better cryptography or a cleverer index, and why it recurs everywhere the primitive is rebuilt: the technology is easy, and the governance is the hard, permanently-unfinished part.

5. The needle and the source: why the justification is also the danger

Return to Scan & Target's phrase: "find the needle in the digital haystack." It is the universal justification for the query layer, and it is genuinely a real problem — the flow never stops, no human can read it all, and a selector-driven search is the only way to make the haystack answerable. Every vendor uses the metaphor. Every agency uses it. It is not a lie.

But it conceals its own corollary, and the corollary is the danger stated exactly. The same selector-driven search that finds the needle finds whatever matches the selector — and the interface does not know, and cannot know, whether the match is a terrorist, a journalist's source, a dissident, a lawyer, an ex-partner, or a political rival. The query returns records, not moral categories. "Find the needle" and "find the source" are the identical operation. There is no version of the search box that answers the first request and refuses the second, because to the index they are the same request.

This is why every serious safeguard against the query layer is procedural rather than technical, and why the harm is so durable. You cannot build a search engine that declines to find journalists. You can only build an institution that (scope) never pointed the corpus at journalists in the first place, (authorization) requires a real, specific, reviewed warrant before any query touches a person's records, and (audit) logs every query so that the analyst who searched the source can be identified and held to account afterward. Remove any one of the three and the needle-finder becomes a source-finder with no friction and no trace. The tool did not change. Only the governance did.

6. The mutation: where the query layer went after 2013

The Snowden disclosures triggered the encryption wave that Letter N measured. It is fair to ask whether that wave ended the query layer. It did not. It moved it, and in moving it made it in several respects more powerful. Three migrations matter.

To the endpoint. If content is ciphertext on the wire, it is plaintext where it is typed and where it is read — on the phone, the laptop, the server. The query layer followed. Endpoint agents, lawful-hacking implants, and the commercial spyware market (a modality this series treats elsewhere) reconstruct at the device what the tap can no longer read in transit. The search box did not lose its content; it relocated to the two ends of the encrypted tunnel, where the tunnel offers no protection at all.

To the cloud provider. The largest lakes of plaintext content in 2026 are not on the wire but at rest inside the hyperscalers: the mailbox, the message history, the photo library, the document store. Legal process — or compromise — against a provider yields exactly the content-search XKeyscore promised, at a scale the 2013 program could not match, because the provider has already done the collection, retention and indexing as its ordinary business. The query layer, in its most consequential form, is now a subpoena or a warrant served on a company that runs the search box for you.

To the model. The most significant mutation is the newest. The 2013 query layer matched selectors — an address, a string, a fingerprint. The 2026 query layer reasons over the corpus. Machine learning turns "show me everyone who contacted this number" into "show me everyone whose pattern of life resembles this profile," and "find this phrase" into "find this idea, however phrased, in any language." The needle-finder became a pattern-finder, and a pattern is a far broader and far less accountable selector than a string. The LSN entity graph itself is a small, benign instance of this: it does not merely store facts, it infers identity across 1.56 million edges, concluding that seventeen IPs are one operator from a reused key that no single record states outright. The same inference, at population scale and pointed at a citizenry, is the query layer's future, and it is more powerful than anything in the Snowden archive.

So the content-search-on-the-wire that frightened 2013 is genuinely gone, killed by TLS. But the capability it named — search everything you hold, about anyone — migrated to the endpoint, to the cloud, and to the model, and each migration widened it. That is not an ending. It is a mutation, and a growth.

7. The counter-narrative, steelmanned

The strongest case for the query layer deserves to be stated at full strength, because the series does not win arguments by weakening its opponents.

The haystack problem is real and it does not go away. In a world of billions of communications a second, an intelligence or law-enforcement service that cannot search its lawfully-held data cannot function — cannot connect a known terrorist's number to his unknown contacts, cannot reconstruct a plot after an attack, cannot find the one message that would have prevented one. The needle metaphor is not propaganda; it is a genuine operational necessity. A rule that says "collect nothing you cannot instantly justify" would blind a service to exactly the retrospective connections that matter most, because relevance is often only visible in hindsight. And a well-governed query layer — narrow corpus, real warrants, complete audit — is not a dragnet; it is the digital equivalent of a properly executed search warrant, which is a legitimate and ancient instrument of justice. On this account, XKeyscore's sin was never the search box. It was the missing governance, and the answer is to build the governance, not to break the tool.

This dossier accepts almost all of that. The needle problem is real. A governed query layer is legitimate. The search technology is neutral. Where the counter-narrative fails is in its optimism about the governance, and the failure is evidential, not rhetorical. The Snowden disclosures were, at their core, a demonstration that the governance was not built — that authorization was thin and audit was weak inside one of the most resourced services on earth. The Spy Files were a demonstration that the same capability was sold, with the governance reduced to a brochure checkbox, to states with no oversight regime at all. The pattern across both archives is not "the tool was abused despite strong controls." It is "the controls were the first thing to be skipped." The counter-narrative's own precondition — good governance — is precisely the thing the record shows chronically absent. You cannot rest a defense on the one component every deployment omits.

8. What the platform will and will not do — the reflexive standard

Because this platform runs a query layer, the honest close is not a condemnation of others but a statement of the standard it holds itself to, in the same three axes it judged XKeyscore by.

On scope: the LSN corpus is adversary telemetry — parties observed attacking the honeypot, infrastructure that struck first. It is not, and will not become, a corpus of a population, of civilians, of the platform's own users, or of any party who did not engage. The corpus is chosen upstream, deliberately and narrowly, and that choice is the first and most important control.

On authorization: the query layer has one disclosed operator and one disclosed purpose — TLP:WHITE public threat intelligence. There is no covert tasking, no third-party sale of query access, no selector run on behalf of an undisclosed client. When the graph is queried to build a dossier, the dossier is published, which is the strongest possible authorization gate: every query that produces output is exposed to the reader.

On audit: the output is the audit. The series' method — evidence first, sources named, confidence stated, counter-narrative steelmanned — means every conclusion drawn from a query can be traced back to the records that produced it and challenged by anyone. A query layer whose every consequential result is published under scrutiny is the opposite of an unaudited one.

None of that makes the LSN query layer safe by nature. It makes it governed, which is the only kind of safety a query layer can have, because — as this whole letter has argued — there is no such thing as a search engine that is safe by construction. There is only a search engine that is well-scoped, well-authorized, and well-audited, or one that is not. The vectors do not lie, and they do not judge. They are the same on both sides of the line. What decides which side you are on is the governance, and the reader — not the tool, and not its operator's assurances — is the right party to judge whether the governance holds.

9. Verdict — CONTINUES

The tap collects; encryption hollowed its content. The warehouse retains; the metadata survived. The query layer searches — and search is the act that turns the other two into power aimed at a named person.

XKeyscore-over-content-on-the-wire is genuinely gone, killed by the 98.5% TLS the LSN sensors measure. That door closed. But the capability it named did not end. Metadata search survived intact because envelopes are not encrypted. Content search migrated to the endpoint and to the cloud provider, where the encrypted tunnel offers no protection at its two ends. And the newest mutation — the model that reasons over the corpus rather than matching a string — made the query layer broader and less accountable than anything in the 2013 archive. The commercial market documented in the Spy Files never paused. And the harm was never the search engine anyway; it was the access governance, which is an institutional problem that no cryptographic advance can solve and that the historical record shows to be chronically, perhaps permanently, unfinished.

The query layer therefore does not end. It CONTINUES — relocated, amplified, and as governed or ungoverned as the institution that runs it chooses to make it. The needle-finder is also the source-finder; it always was; and the only thing that has ever stood between the two is who gets to search the haystack, under what authority, and whether anyone will ever know. That question is exactly as open in 2026 as it was in 2013.

The Alphabet of Harm continues. Verdict: CONTINUES. Confidence: HIGH — commercial query-layer capability directly documented in the WikiLeaks Spy Files archive; content-hollowing and metadata-survival measured on the LSN wire (~98.5% TLS); the access-governance thesis corroborated by NIST AC-6 / AU-9 and by the platform's own operation of the same primitive. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges.