Editing National Security Agency (section)

==== Implanting hardware equipment ====
{{Multiple image|image1 = NSA implanting station.jpg|image2 = NSA interception.jpg|caption1 = Intercepted packages are opened carefully by NSA employees|caption2 = A "load station" implanting a beacon}}

A document included in the NSA files released with [[Glenn Greenwald]]'s book ''[[No Place to Hide (Greenwald book)|No Place to Hide]]'' details how the agency's [[Tailored Access Operations]] (TAO) and other NSA units gained access to hardware equipment. They intercepted [[Router (computing)|routers]], [[Server (computing)|servers]], and other [[network hardware]] equipment being shipped to organizations targeted for surveillance and installing covert implant firmware onto them before they are delivered. This was described by an NSA manager as "some of the most productive operations in TAO because they preposition access points into hard target networks around the world."<ref>{{cite web|url=https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant|title=Photos of an NSA "upgrade" factory show Cisco router getting implant|last=Gallagher|first=Sean|date=May 14, 2014|website=Ars Technica|access-date=June 7, 2024|archive-date=June 4, 2024|archive-url=https://web.archive.org/web/20240604094912/https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/|url-status=live}}</ref> 

Computers that were seized by the NSA due to [[interdiction]] are often modified with a physical device known as Cottonmouth.<ref>{{cite web|last=Whitwam|first=Ryan|url=http://www.extremetech.com/computing/173721-the-nsa-regularly-intercepts-laptop-shipments-to-implant-malware-report-says/|title=The NSA regularly intercepts laptop shipments to implant malware report says|work=extremetech.com|date=December 30, 2013|access-date=June 7, 2024|archive-date=December 5, 2022|archive-url=https://web.archive.org/web/20221205081243/https://www.extremetech.com/computing/173721-the-nsa-regularly-intercepts-laptop-shipments-to-implant-malware-report-says|url-status=live}}</ref> It is a device that can be inserted at the USB port of a computer to establish remote access to the targeted machine. According to the NSA's Tailored Access Operations (TAO) group implant catalog, after implanting Cottonmouth, the NSA can establish a [[network bridge]] "that allows the NSA to load exploit software onto modified computers as well as allowing the NSA to relay commands and data between hardware and software implants."<ref>{{Cite web |url=http://www.spiegel.de/static/happ/netzwelt/2014/na/v1/pub/img/USB/S3223_COTTONMOUTH-I.jpg |title=Archived copy |access-date=2015-03-10 |archive-date=2015-03-10 |archive-url=https://web.archive.org/web/20150310094750/http://www.spiegel.de/static/happ/netzwelt/2014/na/v1/pub/img/USB/S3223_COTTONMOUTH-I.jpg |url-status=dead }}</ref>