German public broadcaster ARD said in a report on Thursday that the NSA is using its XKEYSCORE data collection program to secretly track internet users who search for details about software to stay hidden online.
The report provides details of specific rules written for XKEYSCORE, which collects the internet protocol (IP) addresses of users of privacy programs such as Tor network.
Tor has been popular for online rights activists attempting to hide their activities and escape persecution from their governments as well as among hackers trying to keep their illegal work secret and other people trying to hide their behavior online.
In its report, the German broadcaster did not mention that whether it acquired the XKEYSCORE code from NSA surveillance whistleblower Edward Snowden.
Experts have speculated that this shows that there could be a second leaker at the NSA who is providing information to media outlets.
A national security expert said that he believed that this leak may come from a second source as the code was not in the trove of Snowden documents that he had seen.
Another expert, Bruce Schneier, who had also reviewed Snowden’s documents, agreed, saying, “I do not believe that this came from the Snowden documents…I think there’s a second leaker out there.”
Snowden began leaking classified intelligence documents in June 2013, revealing the extent of the NSA’s spying activities.
He revealed that the spy agency has been collecting the phone records of millions of Americans and foreign nationals as well as political leaders around the world.
Snowden fled his country to avoid espionage charges. In August, Russia granted him asylum for one year.
Many regard Snowden as a whistleblower and a national hero for blowing the lid off the US government’s global surveillance operations.
Some analysts say that the existence of a potential second source means that Snowden may have inspired some of his former colleagues to reveal crucial information about the agency’s inimicable activities.