Each XKEYSCORE plugin (e.g., the one that decodes Skype traffic) contains its own parsing code. Historically, NSA plugins have had remote code execution (RCE) bugs. Leaked source code would turn those bugs into zero-day exploits against the NSA’s own infrastructure.
Here’s a draft for a blog post that dives into the intrigue, implications, and technical curiosity surrounding the — without veering into illegal or dangerous territory. xkeyscore source code
Until then, the source code remains exactly where the NSA wants it: in the dark, on secure servers, guarded by armed federal agents and strict classification. But shadows have a way of receding. And history suggests that no secret—not even XKEYSCORE’s source—stays hidden forever. Each XKEYSCORE plugin (e