> It's interesting to consider "how would you build it better" Creating these one-off websites was easy but also pretty easy to track once detected, since virt

> It's interesting to consider "how would you build it better" Creating these one-off websites was easy but also pretty easy to track once detected, since virtually no one visited the fake sites (and they re-used unique components). Since the NSA and their "Five Eyes" partners tap into the global internet at so many points for "full take" feeds, it seems like it should be possible to devise a passive approach that monitors seemingly normal interactions with legit high-traffic sites. Just combining commercial browser fingerprinting and broad geolocation with certain patterns of behavior, like visiting a few particular sites in sequence, should be enough to identify the asset trying to make contact. Then the asset's subsequent connection to a different unrelated (and equally legit) site could be taken over by a MITM-style interception. I'm assuming here the NSA can gain sufficient certificate access for some major sites either surreptitiously or by gaining certain corporate employee's cooperation. Once the NSA has stepped into the online transaction with the legit site, it serves up slightly modified pass-through data from the real site to the asset. While more work to set up, it seems something along those lines would be virtually impossible to detect via bulk monitoring, especially if, at the end of each communication session, the asset is given a different ID behavior sequence to use for the next contact. Thus, there's no repeating behavior pattern statistically different enough to stand out.