Executive Summary

Full report

On this page

Modern communications surveillance relies on a mix of sophisticated network taps, deep-packet inspection (DPI), metadata analysis, and cooperation with service providers. Key systems include commercial wiretapping solutions (e.g. Boeing’s NarusInsight, Verint’s Vantage, Utimaco LIMS), national intercept frameworks (e.g. Russia’s SORM, India’s Central Monitoring System), and intelligence agency platforms (e.g. NSA’s PRISM and XKeyscore). These tools operate at ISP backbones, endpoints, and cloud services. They filter on keywords or patterns using DPI, pattern matching or AI. Leaked documents show keyword lists spanning terrorism (“MAGA,” “Trump,” jihadist terms), violent or hate speech (“kill,” “white power,” “Antifa”), illicit commerce (“guns,” drug slang, sporting goods merchants), encryption references (“Tor,” “VPN”), and even innocuous items (purchases of religious texts)【31†L512-L520】【76†L230-L239】. Legal regimes vary: some require secret court orders (Russia’s SORM【45†L268-L277】), others use broader intelligence warrants (NSA). Oversight is limited or opaque, and public leaks (Snowden PRISM/XKeyscore, WikiLeaks SpyFiles, Congressional reports) have been the main source of detail. Trends include bulk collection (e.g. mass fiber taps, cloud APIs) and AI/ML-assisted filtering (e.g. social media/DarkWeb mining), plus expanded roles for cloud providers scanning user data and sharing flagged content with law enforcement【82†L227-L236】【88†L105-L113】.

Systems and Tools

We categorize modern keyword-surveillance systems by deployment and vendor:

• NSA/Government SIGINT systems: The NSA’s XKeyscore and PRISM collect vast Internet data streams (via cable taps or provider interfaces) and allow analysts to query by IP, email, keyword, etc【76†L230-L239】. Section 702/FISA authorities back this; oversight is classified. Similarly, corporate cloud platforms cooperate under law (e.g. the US Cloud Act) or voluntarily. Leaks reveal XKeyscore’s ability to find “suspicious” content in any captured traffic without pre-approval【76†L230-L239】.

• Law-Enforcement Wiretaps: Traditional LE systems (FBI, local police) use commercial intercept gear. For example, Boeing’s NarusInsight (used by many countries) provides DPI appliances that inspect traffic at ISP routers to filter by application, content, or keywords【8†L15283-L15291】. Verint (US/Israel) acquired ECtel’s tech to enable “mass collection and analysis of voice and data”【58†L1763-L1766】. Germany’s Utimaco LIMS hooks into telecom networks for lawful intercept of calls, SMS, email, VoIP, etc.【62†L209-L217】. India’s Central Monitoring System (contracted to Verint) taps undersea cables and ISPs. Many vendors (e.g. Qosmos, IPS, Cy4Gate, Vehere) sell DPI/sniffer products for network-level interception【60†L1039-L1046】【60†L1050-L1054】. These operate at ISP or carrier gateways and do not inherently require prior authorization at packet capture time; instead, filtered content (based on target lists or keywords) is forwarded to analysts.

• Endpoint/Network Forensics (Open Source): Open-source tools like Zeek (Bro), Snort/Suricata and nDPI can be configured for content filtering by keyword. While not specifically “for surveillance,” these are used by security teams and could be repurposed by authorities. Network-recording platforms like Arkime/Moloch can capture whole traffic streams for later search. The WikiLeaks SpyFiles reveal customized IDS probes (ClearTrail’s xTrail) that passively monitor networks and “filter based on a ‘pure keyword’” or user ID【83†L438-L446】. Custom hardware (e.g. ClearTrail’s QuickTrail) can also quickly intercept Wi-Fi/LAN traffic.

• Social Media and Open-Source Intelligence (OSINT) Tools: Private and public entities deploy AI-driven monitors of social/dark web data. For example, Cy4Gate’s D-SINT platform (sold to Gulf states) uses AI to scan social media and dark-web chatter for topics of interest【64†L133-L141】. Police use commercial social-media monitoring software (often proprietary) to flag extremist or criminal discussions. Facebook, Google and others have in-house scanning (e.g. content moderation AI) and cooperate with LE to report threats.

• Financial/Metadata Scanners: Though not “communications” per se, law enforcement uses metadata filters akin to keywords. A 2024 House report revealed FinCEN’s use of payment and banking data: banks ran searches for terms like “MAGA,” “Trump,” “Biden,” “Kamala,” “Schumer,” “Pelosi,” and even merchant codes (e.g. sporting goods stores) or purchase of books (including religious texts) as “extremism indicators”【31†L512-L520】【31†L543-L552】. No court warrant was used to flag ordinary Americans on these terms. These practices illustrate keyword monitoring of transaction metadata and merchant records.

Keyword/Target Lists and Criteria

Public disclosures show the kinds of words/phrases that trigger surveillance filters. Categories include:

• Terrorism/Extremism: Terms related to terrorist groups, ideologies or planned violence. For example, leaked NSA rules targeted words like “Al Qaida,” “Jihad,” “Taliban,” “bomb,” “attack,” etc.【76†L230-L239】. In domestic contexts, FinCEN flagged extremist slogans (“MAGA,” “Trump,” “Biden,” etc.), militia and hate symbols (“Proud Boys,” “boogaloo,” “white power,” “Camp Auschwitz”), and violent language (“kill,” “shoot,” “civil war”)【31†L543-L552】. Intelligence agencies also watch for drug slang and gang codes in this category when relevant.

• Child Sexual Exploitation: Lists of known abbreviations and slang used by abusers. The UK Internet Watch Foundation (IWF) maintains a CSAM Keywords List of code words, brand names, and euphemisms (e.g. specific acronyms or innocent-sounding words) used to hide child-abuse imagery【88†L105-L113】. Law enforcement and platforms use these lists to filter chat messages, search logs and forum content. (Example terms are typically withheld publicly, but include codenames and age-references used by predators.)

• Drug Trafficking/Illicit Trade: Detected words include drug names and paraphernalia (e.g. “weed,” “cocaine,” “heroin,” “fentanyl,” “Xanax,” etc.), slang (e.g. “molly,” “doja”), and related terms (“pill press,” “MDMA,” etc.). Financial monitoring may flag payments to dispensaries or overseas pharmaceutical codes. While no single leaked list is public, law enforcement task forces monitor known drug-related keywords in communications as “suspicious.”

• Criminal Fraud and Cybercrime: Keywords like “hack,” “credit card,” “Malware,” “bitcoin,” “Mule,” or phrases indicating money-laundering or cybercriminal tools (e.g. Tor, VPN, PGP, “DDOS”) are routinely flagged in networks and IT systems. Authorities have disclosed targeting “dark web” terminology and anonymization tools【76†L230-L239】 (e.g. finding users “speaking a language out of place,” hinting at encrypted darknet chatter).

• Political Dissent and Public Disorder: Surveillance filters often include political protest language, insurgency or opposition rhetoric. For instance, U.S. agencies monitored “antifa,” “resistance,” or civil disturbance keywords in 2020-21 (Congressional hearings noted searches on “Antifa” and “civil war”)【31†L543-L552】. In authoritarian states, regimes explicitly ban words criticizing the government, and their taps filter posts containing activists’ names, protest slogans or human-rights topics.

• Other Categories: Also flagged are encryption/discussion of anonymity (“Tor,” “anonymous proxy,” “encryption”); violent or hate terms (slurs, gang names); and even innocuous terms used in coded ways (e.g. generic words that map to illicit activities). Financial proxies like MCC codes for guns or explosives are treated akin to keywords【31†L543-L552】.

Deployment Context and Methods

Surveillance filters are deployed in various network environments:

• ISP/Network Backbone: Many systems tap fiber or carrier infrastructure. DPI appliances (from Narus, Utimaco, etc.) sit at major routers or cable landing stations. They perform real-time filtering on all passing traffic, sending suspect packets or transcripts to analysts【8†L15283-L15291】【62†L209-L217】. For example, India’s ISP gateways run Verint gear to scan email/VoIP for targets.

• End-user/Local Networks: Some monitoring happens on corporate or campus LANs. Devices like QuickTrail can be plugged into a local Ethernet or Wi-Fi network to capture a specific target’s traffic and decrypt it (it can even perform “man-in-the-middle” attacks to break encryption)【83†L474-L483】. At endpoints, certain spyware or host-based tools can watch communications and keywords (though this falls more under intrusion than passive “sniffing”).

• Cloud Services: Increasingly, providers like Google, Microsoft and Facebook perform content scans in the cloud. For example, Google’s internal security team (CIG) parsed Gmail and YouTube content, flagging violent extremist messages and passing user account details to U.S. police【82†L227-L236】. WhatsApp attempted on-device CSAM scanning (later suspended due to backlash). Cloud APIs and lawful-intercept interfaces (CALEA APIs) also allow agencies to query provider-held metadata/content for specific terms.

• Metadata Systems: Financial surveillance often involves centralized databases (like FinCEN’s). Here, the “network” is essentially inter-bank data; keyword filters run on transaction descriptions and merchant data rather than raw packets. Mobile and telephony metadata might be searched in telecom billing or call-detail databases.

• Machine Learning Pipelines: Some modern systems ingest bulk data (e.g. social feeds) and apply ML models to flag emergent patterns or narratives. These are typically not “keyword” in the classical sense but can be directed by seed terms or topics. E.g. Cy4Gate’s D-SINT uses AI on open web sources to extract trending keywords and networks【64†L133-L141】. This blurs into predictive surveillance.

Legal Authorities and Oversight

Legal requirements vary by system and jurisdiction:

• In many countries, intercepts require a judicial or executive warrant. For example, Russia’s SORM demands a court order for each target, although the order is secret and providers cannot refuse【45†L268-L277】【45†L281-L284】. Even so, the law obliges all data be available to authorities at will.

• The U.S. government often operates under FISA Section 702 (authorizing collection “about” foreigners, but capturing incidental data on U.S. persons) or traditional warrants (e.g. wiretap orders). NSA’s XKeyscore, for instance, falls under FAA/702 with minimal transparency. Reports indicate NSA analysts needed no individual authorization to run keyword searches on collected data【76†L230-L239】.

• Commercial intercept equipment used by law enforcement (Narus, Utimaco, etc.) is deployed under domestic wiretap laws (e.g. CALEA, RIPA, etc.), though the criteria for selecting “target” communications are internal and largely unreported.

• Metadata surveillance (like bank data searches) often exploits broad regulatory reporting regimes (e.g. SARs or AML statutes) rather than individual warrants. The FinCEN case shows agencies using financial rules to search Americans’ transactions with just “suspicious” keywords【31†L512-L520】【31†L543-L552】. There was no Fourth Amendment warrant for those searches – they piggybacked on anti-money-laundering law.

• Transparency and Accountability: All of these programs suffer from secrecy. Very few lists of monitored keywords are public (aside from NGO compilations like IWF’s CSAM list【88†L105-L113】). Oversight usually happens through classified briefings or ad hoc inquiries. Leaks and investigative journalism have been the main source of public information (e.g. Snowden’s documents on NSA; WikiLeaks SpyFiles on global vendors; U.S. Congressional reports on financial surveillance).

Geographic Scope and Cross-Border Issues

Surveillance often transcends borders: fiber-optic cables and cloud services carry global traffic. NSA’s Prism and Upstream intercept programs tap US-internet backbones, inadvertently capturing foreign-to-foreign comms【76†L230-L239】. The U.S. Cloud Act compels American companies to provide data on global users to U.S. law enforcement, affecting EU and international citizens. Conversely, foreign surveillance regimes (China’s Great Firewall, Russia’s SORM【45†L268-L277】) focus domestically but can capture cross-border communications that traverse their networks.

Cooperative frameworks vary: Five Eyes agreements coordinate keyword-targeting priorities among allies, while at the same time cross-border privacy laws (like EU GDPR) impose limits on transferring European data to third countries. For instance, China’s DPI censorship apparatus (the “Golden Shield”) filters terms on all traffic entering/exiting China. Middle Eastern states have hired Western vendors (Narus, Verint) to tap regional Internet infrastructure【8†L15283-L15291】. All this raises conflicts: e.g. should a U.S. warrant allow intercept of EU citizens’ data? (Legal treaties like MLA or new frameworks attempt to manage this, but tension remains high.)

Common Target Categories

Across systems, common keyword themes emerge:

• Terrorism & Extremism: Words related to violent ideologies (e.g. “ISIS,” “Jihad,” “bomb”). Officially, many countries filter chat or email for known extremist content. Snowden’s leaks show NSA indexing all communications “about” foreign targets【76†L230-L239】; many analysts look for terrorism-related terms.

• Child Exploitation: As noted, specialized lists (IWF keywords) gather euphemisms (“doggie style,” numeric codes, etc.) used in CSAM circles【88†L105-L113】. Companies like Microsoft and Google also scan images and chats for CSAM hashes (though not typically by text keyword).

• Drug Trafficking: Key drug names and slang are monitored. Financially, regulators flag transactions at cannabis dispensaries or overseas MDMA vendors. Networks may flag chats on darknet markets or terms like “Xanax” when correlated with criminal profiles.

• Political Dissent: During protests or controversial events, governments have surveyed communications for protest slogans or leader names. The FinCEN example directly targeted activists’ slogans (e.g. “MAGA”)【31†L512-L520】. Authoritarian regimes scan for censorship-terms, and democratic ones sometimes use broad criteria (e.g. U.S. fusion centers looked at “ANTIFA” transactions post-2020)【31†L543-L552】.

• Encryption/Anonymity: Interestingly, discussions of encryption technologies (“Tor,” “VPN,” “crypto”) have themselves been flagged as suspicious. NSA’s systems could query for Tor usage or searches in rare languages as a proxy for clandestine activity【76†L230-L239】. Many agencies view the use of strong crypto as itself a surveillance trigger.

Transparency and Legal Safeguards

In general, oversight is limited. Few programs are publicly acknowledged. Laws vary from no-warrant regimes (often in counterterrorism intel) to stricter warrant standards (in many democracies for domestic taps). Accountability mechanisms (legislative reporting, courts, IG audits) are often classified or non-existent. For instance, Russia kept SORM’s details secret【45†L268-L277】. In the U.S., oversight bodies (PCLOB, FISC) have only partially addressed keyword intercept issues (XKeyscore was reviewed by PCLOB in 2014). Congress recently critiqued FinCEN’s practice as lacking judicial review.

Notable Disclosures and Leaks (Timeline)

• 1997–2005: Carnivore/DCS1000 (FBI’s legacy packet sniffer) and its commercial successor. Initially secret, discussed in 2001 Congressional hearings. (By 2005 FBI moved to CALEA-compliant products【47†L254-L262】.)
• 2011: WikiLeaks “SpyFiles” expose products like ClearTrail’s xTrail/QuickTrail (with keyword filters) and other surveillance vendors worldwide【83†L438-L446】【86†L201-L204】.
• 2013: Edward Snowden leaks reveal NSA programs PRISM (provider access) and XKeyscore (content search). The Guardian reports XKeyscore allows keyword searches on all collected data without prior approval【76†L230-L239】.
• 2020: BlueLeaks hack (U.S.) surfaces internal police data, including Google’s “Cybercrime Investigation Group” notes flagging extremist YouTube comments. Demonstrates Google scanning content and sharing it with law enforcement【82†L227-L236】.
• 2024: U.S. House Judiciary disclosures: Leaked memos show FinCEN and banks scanning all transactions for terms like “MAGA,” “Trump,” gun store MCCs, and book purchases【31†L512-L520】【31†L543-L552】. This confirms keyword-based metadata monitoring on ordinary citizens.
• 2020s (ongoing): Reports of social media monitoring (e.g. police “Babel” projects), proposed AI scanning (Apple’s paused CSAM scanning, Microsoft/O365 DragonWeb), and new data laws (EARN-IT, IP Act) indicate evolving oversight battles.

Comparative Table of Key Systems

(Table notes: “Keyword” targeting can be applied via DPI content filters or query searches on stored data. Legal oversight is often secret or based on broad statutes. Sources: leaked contracts, press reports, corporate filings【8†L15283-L15291】【31†L512-L520】【45†L268-L277】【76†L230-L239】.*)

Recent Trends and Observations

• AI/ML Integration: Surveillance tech increasingly employs machine learning. For example, Cy4Gate’s D-SINT analyzes social media/dark-web chatter using AI to extract relevant terms【64†L133-L141】. Platforms like Facebook and Google use AI to detect hate, terrorism or CSAM in user content (often sharing flags with police). However, AI can be opaque, raising new accountability concerns.

• Bulk vs. Targeted: There is a shift toward bulk data collection followed by keyword filtering. NSA’s dragnet (cable taps, Prism) and cloud APIs gather massive raw data, then analysts query keywords. By contrast, traditional wiretaps were narrowly authorized. Modern systems (like XKeyscore) blur that line: they collect broadly and let analysts search at will【76†L230-L239】.

• Role of Cloud Providers: Major tech firms have become de facto surveillance partners. As seen with Google’s CIG group, they sift through user content for threats and forward details to law enforcement【82†L227-L236】. Telecom/cloud companies also build intercept APIs (e.g. SS8’s cloud-wiretap solutions). Legislative trends (e.g. the US CLOUD Act, EU ePrivacy laws) are grappling with how providers must assist or resist data requests.

• Categories of Keywords: Across disclosures, targeted words cluster around terrorism (bomb, jihad), extremism (ethnic slurs, militia references), illicit goods (firearms, drug names), criminal trade (money laundering terms), child exploitation (CSAM slang) and political events (Capitol riot terms, protest slogans). Lists also include innocuous words used in coded ways (e.g. brand names or emojis listed by IWF for CSAM【88†L105-L113】).

• Cross-Border Issues: With global Internet routing, a keyword filter in one country can sweep up foreign data. For instance, China’s Great Firewall and Russia’s SORM catch some international traffic, raising conflicts (Europe objected when US NSA collected EU citizens’ emails without GDPR-style approval). Mutual legal assistance treaties lag behind technical capabilities.

• Public Scrutiny: Most keyword surveillance remains hidden. Notable exceptions include NGO work (e.g. IWF’s public keyword list for CSAM【88†L105-L113】) and transparency reports. In the U.S., judicial orders (like those occasionally declassified by FISC) or audits (FBI IG reports) provide limited windows. The FinCEN leak and Snowden are rare examples that brought these practices to light.

Sources: Our analysis draws on vendor documents and contracts (e.g. Narus/Verint filings【8†L15283-L15291】【58†L1763-L1766】), investigative journalism (e.g. The Guardian on Google【82†L227-L236】, IrpiMedia on Cy4Gate【64†L133-L141】), think-tank and NGO reports (CSIS on SORM【45†L268-L277】, CIS India on ClearTrail【83†L438-L446】), and official leaks/releases (House reports on FinCEN【31†L512-L520】, Snowden slides via ACLU【76†L230-L239】). These reveal both the technology and the scant oversight of modern keyword-based surveillance.