How Levitation works
A look at how Canada tracked one person who downloaded a suspicious document
Scour file-sharing sites
Canada and its spying partners have amassed a vast trove of metadata of files uploaded and downloaded around the world. Every day, the agency's analysts sift through information on 10 to 15 million uploads or download events. It could include videos, music, documents and other files hosted by so-called "free file upload" sites. The data comes from 102 file-sharing websites.
Watch a suspicious file
Security analysts focus on suspicious files. Every month, the agency identifies about 350 “interesting download events” related to extremism or terrorism, the document says, adding this is the "easy part." One target file is The Explosives Course, an English al-Qaeda bomb-making manual published in late 2010, found on Sendspace.com.
Trace the IP
At 7:46 a.m., someone downloads The Explosives Course. Analysts look at the IP address. It reveals the location of the computer network used as Kenya. It doesn't give them the exact location of the person.
Follow the cookies
They drill down further. The IP address is plugged into Mutant Broth, a database run by Britain's electronic spy agency, which stores billions of internet cookies (most commonly used for targeted advertising). With this data, they piece together the target's online activity for five hours before the file was downloaded and five hours after.
Digging deeper
But that's not the end. The agency can also plug that Facebook ID – every profile gets assigned a unique number – into the U.S. National Security Agency's powerful Marina database, which keeps online metadata of millions of people for up to a year. That can give CSE lots of information, including a person's email address.
Share findings
In the end, the spy agency not only paints a detailed picture of someone's online life, but can also identify that individual as a new potential suspect. In other cases, the exercise leads them to previously unknown suspicious documents. Ultimately, all these findings are handed over to CSE's Office of Counter Terrorism. Some information may end up in the hands of spying partners or law enforcement agencies.
