Room 641A and the Backbone Taps

How the NSA copies internet traffic at the source, with help from AT&T.

State of Surveillance Editorial Team

TL;DR: Room 641A is a windowless room inside AT&T's San Francisco switching facility where fiber-optic splitters copy all internet traffic and route it to NSA equipment. Revealed by technician Mark Klein in 2006, the setup let the NSA intercept emails, phone calls, and web traffic in bulk: not targeting specific suspects, but copying everything. Similar rooms exist in Seattle, San Jose, Los Angeles, San Diego, Atlanta, and more. The Snowden documents later confirmed this "upstream collection" accounts for about 9% of NSA's internet surveillance: the rest comes from collecting data directly from tech companies. Klein's evidence showed exactly how it worked. Congress responded by granting AT&T retroactive legal immunity.

The Room

Room 641A is located at 611 Folsom Street, San Francisco, an AT&T switching facility that handles massive amounts of internet traffic [1].

Physical specifications:

  • Approximately 24 by 48 feet (7.3 by 14.6 meters)
  • No door handle from the outside
  • Required NSA security clearance to enter
  • Internally referred to as the "SG3 Secure Room" (Study Group 3)
  • Operations commenced in 2003

Equipment inside:

  • Narus STA 6400: A device designed to intercept and analyze internet communications at speeds of 10 gigabits per second
  • Logic boards and servers: To process and store captured traffic
  • Fiber-optic connections from beam splitters installed on backbone cables

The room was purpose-built for mass surveillance, hidden in plain sight within AT&T's infrastructure.

How Backbone Tapping Works

The technical setup is straightforward but powerful [2]:

Step 1: Fiber-optic splitters

AT&T installed beam splitters on the fiber-optic cables carrying internet backbone traffic. These devices create an exact copy of all data passing through: every packet, every connection, everything.

Step 2: Routing to the secure room

The copied data stream is routed into Room 641A via dedicated fiber-optic lines. The original traffic continues to its destination unchanged: users have no way to detect the interception.

Step 3: Analysis equipment

Inside the room, Narus equipment processes the data at line speed. Narus (now part of Boeing) specializes in "semantic traffic analysis": identifying patterns, extracting content, and filtering communications based on selectors.

Step 4: Storage and transmission to NSA

Relevant data is stored and transmitted to NSA facilities for further analysis. What constitutes "relevant" is determined by targeting rules that remain classified.

The scale of what flows through:

  • International fiber-optic cables carry 99% of international phone and internet data
  • AT&T's backbone handles traffic for its own customers plus traffic it carries for other ISPs
  • A single tap point can capture communications from millions of users

The Whistleblower: Mark Klein

Mark Lee Klein (1945-2025) worked as an AT&T technician for over 25 years. In 2002-2003, he was assigned to the San Francisco facility and witnessed the construction of Room 641A [3].

What Klein saw:

  • NSA-cleared personnel installing equipment in a room only they could access
  • Fiber-optic splitters being installed on backbone cables
  • Engineering documents showing how traffic was routed to the secret room

What Klein did:

  • Kept copies of internal AT&T documents showing the splitter configuration
  • Gathered over 100 pages of authenticated schematic diagrams
  • Approached multiple journalists and eventually connected with the EFF
  • Testified before Congress and provided evidence for lawsuits

Klein later wrote: "When I saw the splitters, I realized the NSA was spying on all Internet traffic, not just foreign traffic as claimed." His technical expertise made him uniquely positioned to understand what the infrastructure meant.

Klein didn't just claim the surveillance was happening: he provided the engineering diagrams proving it. He died on March 8, 2025, remembered by the EFF as "a hero of our movement" [4].

Room 641A Wasn't Alone

San Francisco was just one location. Similar NSA-secure rooms were installed at AT&T facilities across the country [5]:

  • Seattle
  • San Jose
  • Los Angeles
  • San Diego
  • Atlanta
  • Multiple other undisclosed locations

Internal AT&T documents referenced by Klein indicated the program was systematic: not a one-off experiment but a comprehensive infrastructure for copying internet backbone traffic at major switching points nationwide.

The Snowden documents later confirmed over a dozen major U.S.-based internet switching stations where this filtering takes place.

Upstream Collection: The Official Name

The Snowden revelations gave names to what Klein had exposed. The NSA divides its internet surveillance into two main categories [6]:

Upstream collection:

  • Intercepting communications on fiber-optic cables as data flows through
  • Tapping the internet backbone at major switching points
  • Copying traffic regardless of whether targets are specifically identified
  • Programs include FAIRVIEW, STORMBREW, BLARNEY, and OAKSTAR
  • Accounts for approximately 9% of NSA's internet collection under Section 702

PRISM (downstream collection):

  • Collecting data directly from internet companies (Google, Apple, Facebook, Microsoft, etc.)
  • Requests made under Section 702 of the FISA Amendments Act
  • Companies provide access to specific accounts or data
  • Accounts for 91% of NSA's internet traffic acquired under Section 702
  • Described in NSA documents as "the number one source of raw intelligence"

Room 641A was an upstream collection facility. The infrastructure Klein documented was part of a program that, according to NSA's own figures, collected about 13.25 million internet communications in the first half of 2011 alone.

Technical Deep Dive: The Narus Equipment

The Narus STA 6400 installed in Room 641A was cutting-edge surveillance technology [8]:

Capabilities:

  • Speed: Real-time analysis of 10 Gbps network traffic
  • Deep packet inspection: Reads content of communications, not just metadata
  • Protocol analysis: Handles email, web browsing, VoIP, streaming, and other protocols
  • Pattern matching: Identifies communications matching specified selectors
  • Session reconstruction: Reassembles complete communications from packet fragments

What it could capture:

  • Email content and attachments
  • Web browsing activity and search queries
  • VoIP phone conversations
  • Chat and instant messaging
  • File transfers
  • Essentially any unencrypted internet traffic

Narus was founded in 1997 and specialized in "semantic traffic analysis." The company was later acquired by Boeing in 2010. Narus equipment was also sold to authoritarian governments for surveillance purposes.

The encryption problem (for NSA):

At the time Room 641A was built (2003), most internet traffic was unencrypted. Today, widespread adoption of HTTPS, encrypted messaging, and VPNs means much traffic is encrypted, though the NSA has worked to defeat encryption through various means, including collecting encrypted traffic for later decryption if keys become available.

What Changed After Snowden

Klein's 2006 revelations generated controversy but limited reform. The 2013 Snowden documents provided confirmation and additional detail [9]:

Confirmed:

  • Backbone tapping was systematic and ongoing
  • Upstream collection was one of multiple NSA internet surveillance programs
  • PRISM collection from tech companies was far larger
  • Surveillance extended far beyond what officials had publicly acknowledged

Reform efforts:

  • USA FREEDOM Act (2015): Ended bulk phone records collection under Section 215 but didn't address upstream collection
  • Tech company encryption: Companies accelerated encryption adoption partly in response to surveillance revelations
  • FISA Court reforms: Minor procedural changes but fundamental structure unchanged

What didn't change:

  • Section 702 authority continues with ongoing renewals
  • Upstream collection infrastructure remains in place
  • Telecom immunity remains in effect
  • No accountability for past surveillance

See: Section 702 FISA Renewal: The 2025 Privacy Fight

What Room 641A Teaches Us

Surveillance requires corporate cooperation: The NSA couldn't tap backbone traffic without AT&T's active participation. Private companies are essential partners in government surveillance, and can be compelled or incentivized to cooperate.

Technical evidence matters: Klein's engineering diagrams proved what officials denied. Without documentation, claims of surveillance can be dismissed as conspiracy theory. With it, denial becomes impossible.

Legal protections can be removed retroactively: When evidence threatened accountability, Congress changed the law to protect the surveilling companies. Legal rights that existed when Klein came forward were eliminated after he did.

Bulk collection is the architecture: Room 641A copied all traffic, not specific suspects' communications. Bulk collection first, targeting later: this remains the fundamental approach to modern surveillance.

Whistleblowers face asymmetric risk: Klein risked his career to expose illegal surveillance. The result: immunity for the companies, no consequences for officials, and no meaningful reform of the practices he exposed.

The Infrastructure Today

Twenty years after Room 641A began operations, the surveillance infrastructure has expanded [10]:

  • Section 702 authority has been renewed repeatedly
  • Upstream collection continues under legal authorization
  • Additional collection points have likely been added as internet traffic patterns changed
  • Cloud computing concentration means fewer chokepoints to tap
  • Mobile data and 5G create new collection opportunities

The specific equipment has certainly been upgraded, but the principle remains: copy traffic at the backbone level, analyze it for intelligence value, store what's useful.

When Frank Church warned in 1975 that surveillance technology could enable tyranny, he was talking about telephone wiretaps. Room 641A represented the upgrade: surveillance at internet scale, capturing not just phone calls but the entirety of digital life flowing through the network.

Mark Klein saw it being built. He documented how it worked. He told the public. The infrastructure remains.

References

  1. Wikipedia: Room 641A
  2. EFF: Upstream vs. PRISM
  3. Wikipedia: Mark Klein
  4. EFF, In Memoriam: Mark Klein
  5. TechCrunch: AT&T Technician Mark Klein Dies
  6. Electrospaces: Slides About NSA's Upstream Collection
  7. PBS: Whistleblower Mark Klein Dies at 79
  8. Covert Access Team: What Is Inside Room 641A
  9. ProPublica: What We Still Don't Know About NSA Internet Surveillance
  10. Data Center Dynamics: How Did the NSA Wiretap the Backbones?