The records released by the National Security Agency provide an important distinction.

The NSA’s PROMIS, or Product Management Information System, was an intelligence-product management database developed during the 1970s. According to records released to The Black Vault under the Freedom of Information Act (FOIA), the system was designed to organize information associated with intelligence reports and give senior signals intelligence managers a way to search, analyze and manage information about those products.

It should not simply be equated with the better-known Prosecutor’s Management Information System, also called PROMIS, associated with INSLAW, Inc. and the Department of Justice.

That distinction became a central issue when the Justice Department investigated allegations surrounding INSLAW and its software in the 1990s. DOJ ultimately concluded in 1994 that there was no credible evidence that INSLAW’s PROMIS had been improperly distributed elsewhere in the federal government or to foreign governments. A subsequent Court of Federal Claims proceeding also rejected INSLAW’s claims.

Yet NSA did, in fact, have something called PROMIS.

The records obtained by The Black Vault document what it was, and then a FOIA request filed in 2013 to uncover those records produced one final surprise nearly 13 years later.

Two Systems Called PROMIS

The Black Vault’s pursuit began with a passage contained in Justice Department records concerning the INSLAW controversy.

On November 14, 2013, The Black Vault filed a FOIA request with NSA seeking:

“a copy of all records pertaining to the NSA’s use of the computer program PROMIS.”

The request specifically cited a Justice Department account stating that investigators had contacted NSA to determine whether the agency “used or developed any program called PROMIS.” According to that account, NSA explained that it had developed a database in the 1970s using the M204 database system and called it PROMIS, an acronym for Product Related On-line Management Information System.

The NSA records subsequently released provide considerably more detail.

A draft Justice Department report sent to NSA for review in May 1994 recounts interviews with NSA personnel about the issue. The document states:

“the NSA maintains a database known as Product Management Information System, or ‘PROMIS.'”

It explains that “Product” was an NSA term for intelligence reports and that the database contained “abstracts of intelligence reports generated by various parts of the NSA.”

Most importantly, the DOJ account records an explicit distinction between NSA’s database and the software at the center of the INSLAW controversy:

“the NSA ‘PROMIS’ is not a software program, but rather is an application of the M204 database management system.”

One NSA employee interviewed by DOJ said she had participated in the original development of the database during the 1970s. According to the document, it was developed “primarily to allow the accumulation of management information regarding the productivity of various NSA divisions.”

That distinction is important because the Justice Department’s own PROMIS was the Prosecutor’s Management Information System, a case-management system used by U.S. Attorneys’ Offices. DOJ records describe that system as a tool for maintaining and tracking information involving defendants, crimes, charges, court events and witnesses.

The common acronym helped produce decades of confusion, but the NSA records released through this FOIA case document an independently developed intelligence-product management database.

Building PROMIS Inside NSA

The released records trace the NSA system to early 1974.

A January 15, 1974, memorandum titled “SIGINT Management Data Bases” described the underlying management problem. The Deputy Director for Operations wrote that existing management statistics were prepared separately by different production groups and therefore were not available in a form that fully met his needs.

The memorandum called for:

“a system which will cut across Group lines”

and provide management data while allowing officials to respond to Intelligence Community questions.

Another memorandum, dated January 21, 1974, described plans to implement:

“an on-line computer system to provide product-related data needed at the DDO level and outside the agency.”

The document also made clear that security was built into the design requirements. Because some of the information was sensitive, the system would need controls governing both security and access. The memorandum stated that access to data, “either in part or in whole,” would be restricted to those who actually needed it.

A February 12, 1974, memorandum described the existing process the proposed database was intended to improve. The older Offline Coversheet Processing system was characterized as costly and inadequate, with manual data conversion alone consuming approximately 500 man-hours each quarter. Output could lag by roughly two weeks, while the memorandum estimated an error rate of seven to eight percent.

By May 1974, the name PROMIS was explicitly appearing in the records.

A May 8 memorandum titled “PROMIS Content and Timeliness Requirements” discussed a study of the database and asked what SIGINT products should be included initially, what products should eventually be covered and how current the information needed to be.

The memorandum stated:

“We expect to conclude the study and to recommend a system for PROMIS in the very near future.”

The surviving documents therefore portray PROMIS not as a mysterious stand-alone surveillance package, but as a management and retrieval system built around NSA intelligence “products,” with requirements involving searchable information, access controls, timeliness and the handling of sensitive SIGINT data.

The Black Vault’s FOIA Pursuit

Obtaining those records became its own unusually long story.

The Black Vault filed the request on November 14, 2013.

By March 2016, NSA had located a substantial volume of potentially responsive material but sought $440 in fees to continue processing the request. The Black Vault did not pay the requested amount, and there was no expectation that a release would follow.

Then, unexpectedly, one did.

On October 4, 2018, nearly five years after the original request, NSA sent The Black Vault a partial release. The agency wrote:

“Your request has been processed under the FOIA and some of the documents you requested are enclosed.”

NSA withheld portions under FOIA Exemptions 1, 3 and 6, citing classified national-security information, statutory protections applicable to NSA activities and personal privacy.

Significantly, the October 4 letter also stated:

“Additional documents will be provided when their processing is complete.”

The first release included internal NSA memoranda from the 1970s describing the creation and requirements of the system, along with Justice Department correspondence concerning its later INSLAW investigation.

A second, much larger release followed on October 22, 2018. That production contained 85 pages, including a PROMIS user’s manual and additional memoranda. NSA characterized that production as the final release in the case. The Black Vault subsequently archived the material on this page.

And for years, that appeared to be the end of FOIA case 75611.

It wasn’t.

An Unexpected Letter — Nearly Eight Years Later

On April 29, 2026, The Black Vault received another response from NSA.

There had been no indication to The Black Vault that the 2013 request remained open, and nearly eight years had passed since NSA’s October 2018 releases.

Nevertheless, NSA’s new letter identified the same underlying November 14, 2013 request and described the 2026 correspondence as:

“a final response to your Freedom of Information Act (FOIA) request”

The agency then provided an explanation for why a case that had seemingly ended years earlier had suddenly produced another record:

“During a review of our files, we located one document that was not provided to you with our final response to your request.”

NSA said it had reviewed the newly located document under FOIA and released it with redactions. Portions were withheld under the statutory protection applicable to NSA, while NSA also stated that the CIA had requested protection of CIA information under FOIA Exemptions 6 and 3.

The newly released record was dated February 8, 1978.

Its subject was:

“Regular PROMIS Listings for CIA”

That document added a significant piece to the historical record.

Addressed to the DDO from NSA’s Chief, V, the memorandum states that an individual identified as being with CIA/COMP had asked NSA to provide “regular quarterly PROMIS listings” for certain sites. Portions identifying the sites remain redacted.

The memorandum indicates that NSA had previously provided the information on a “one-time basis” the preceding August. The author then questioned whether NSA should establish recurring distribution:

“I don’t see any grounds for standing fast on one-time lists, since we are providing monthly listings for [redacted]”

and noted that another party was “obviously aware of this agreement.”

The identities and portions of the operational context remain withheld, preventing a complete reconstruction of what information was being supplied and to whom. The document does, however, establish that by 1978 NSA officials were discussing providing CIA personnel with recurring PROMIS-generated listings and that at least one earlier PROMIS listing had already been supplied.

What the Records Establish — and What They Do Not

The documents now accumulated through this FOIA case establish that NSA developed a system called PROMIS during the 1970s; that the name referred to a product-management database associated with intelligence reporting; that the system grew out of an effort to replace or supplement cumbersome offline management processes; and that its design contemplated searchable product information with controls over sensitive SIGINT data.

They also show that PROMIS information crossed organizational boundaries. The January 1974 planning records contemplated information needed “outside the agency,” while the newly released 1978 memorandum documents discussions about recurring PROMIS listings for CIA.

What these records do not establish is equally important.

They do not demonstrate that NSA’s PROMIS was INSLAW’s Prosecutor’s Management Information System. In fact, the Justice Department material contained within NSA’s own release specifically records NSA personnel distinguishing the agency’s PROMIS database from a separate software program. Nor do the released records, standing alone, substantiate broader claims that have circulated for decades connecting PROMIS to later NSA surveillance systems.

The documentary record supports a narrower conclusion: NSA developed and operated a PROMIS database for managing intelligence-product information beginning in the 1970s, and surviving records show the system being discussed internally and in connection with information provided to the CIA.

The history of the FOIA request has now lasted almost as long as some modern government information systems themselves. A request submitted in November 2013 produced records in 2018, appeared finished, and then resurfaced without warning in April 2026 when NSA discovered that a responsive 1978 document had been left out of its earlier final production.

Whether additional responsive records remain undiscovered is unknown. NSA’s April 29, 2026, letter again labels its response “final.”

For now, the documents below represent the record released by the government, including the document NSA itself found nearly eight years after its previous final response.

Document Archive

Department of Justice (DOJ)

 Report of Special Counsel Nicholas J. Bua to the Attorney General of the United States Regarding the Allegations of INSLAW, Inc., March 1993, and the 1994 DOJ Report on INSLAW/PROMIS matter, released by the Department of Justice (DOJ) Office of Information Policy (OIP) [465 Pages, 11MB] – Special thanks to GovernmentAttic.org for this record.

National Security Agency (NSA)

 NSA Documents Regarding PROMIS, Released 4 October 2018 [17 Pages, 2.7MB] – In March of 2016, see below, the NSA required a $440 payment in order to continue to process my request on PROMIS. Although I did not respond, I was surprised to receive this in October of 2018. It appears that this is only part of what the NSA has on PROMIS, and additional records are still being processed. I will add them when they are released to me.

 NSA Documents Regarding PROMIS, Released 22 October 2018 [85 Pages, 8MB] – This release includes the user’s manual of the PROMIS system, various memorandums and more. One document was withheld entirely and this, according to the NSA, is now the final release of information.

 NSA Documents Regarding PROMIS, Released 22 October 2018 [3 Pages, 1MB]

 Payment Estimate Letter (Read Above) Letter regarding the NSA use of the PROMIS System [4 Pages, 1.1MB] – The NSA did find a considerable amount of documents, however, they are requiring a payment of $440 for the release of the material.

The post NSA’s PROMIS: What the Declassified Records Actually Show first appeared on The Black Vault.

In the late 1990s and early 2000s, the FBI’s Carnivore system drew considerable attention and debate. Unveiled during this period, Carnivore was a sophisticated email wiretapping system designed to intercept and analyze digital communications. The system’s capabilities and the implications for privacy and civil liberties were subjects of intense scrutiny and concern among privacy advocates, Internet service providers (ISPs), and the public at large.

Carnivore, officially known as DCS1000, was a network diagnostic tool utilized by the FBI to monitor and intercept email and other online communications. The system was installed at an ISP’s premises and was capable of scanning vast amounts of digital data passing through the ISP’s network. Carnivore specifically targeted communications of suspects under investigation, allowing the FBI to capture emails, chat sessions, and other forms of online interactions.

The Carnivore system operated by tapping into the ISP’s network and filtering the data packets that flowed through it. According to an internal FBI document, the system was designed to “ensure that only the exact communications authorized by the court to be intercepted are what is intercepted”​​. This meant that Carnivore could be configured to capture only the communications of a specific target while excluding all other traffic.

The deployment of Carnivore was subject to strict legal guidelines and required a court order based on probable cause. The FBI had to demonstrate that the interception of communications was necessary for an ongoing investigation and that it would yield evidence of criminal activity. The court order specified the scope of the surveillance, including the types of communications to be intercepted and the duration of the surveillance.

Despite these legal safeguards, privacy advocates raised significant concerns about the potential for abuse and the broader implications for digital privacy. A key issue was the transparency and accountability of the Carnivore system. ISPs and privacy groups worried that the system could be used for more extensive monitoring than intended, potentially capturing the communications of individuals not under investigation.

In a letter to Congress, John E. Collingwood, Assistant Director of the FBI’s Office of Public and Congressional Affairs, emphasized that Carnivore was used “only when Internet Service Providers are unable on their own to restrict interceptions within the narrow confines of the controlling court order”​​. However, ISPs expressed doubts about their ability to verify that the FBI adhered strictly to these limitations once Carnivore was installed on their networks.

The reaction from the Internet industry was mixed. Some ISPs resisted the installation of Carnivore on their networks, citing concerns about the system’s impact on network performance and the privacy of their customers. In one notable case, EarthLink, a major ISP, refused to install Carnivore, arguing that it could cause disruptions to their service and compromise customer privacy​​.

EarthLink’s concerns were not isolated. The American Civil Liberties Union (ACLU) and other privacy organizations filed Freedom of Information Act (FOIA) requests to uncover more details about Carnivore’s technical capabilities and its use in investigations. The ACLU’s efforts aimed to obtain the source code of Carnivore, which would reveal the inner workings of the system and potentially confirm whether it could be used for broader surveillance than officially stated​​.

The controversy surrounding Carnivore led to calls for greater oversight and transparency in the deployment of digital surveillance tools. Critics argued that without independent verification of the system’s operations, there was no way to ensure that the FBI’s use of Carnivore was consistent with legal requirements and respected individual privacy rights.

In response to these concerns, the FBI conducted briefings with industry specialists and members of Congress to explain how Carnivore worked and the measures in place to prevent abuse. However, skepticism remained, and the debate over digital surveillance and privacy continued to evolve.

By circa 2005, it was reported that Carnivore had been replaced by more commercially available software​​. This shift indicated an evolution in the FBI’s approach to digital surveillance, moving away from proprietary systems like Carnivore to leveraging advancements in commercial technology.

Carnivore represented a significant development in law enforcement’s ability to monitor digital communications. While it provided a powerful tool for investigating and preventing criminal activity, it also raised critical questions about the balance between security and privacy in the digital age. As technology continues to advance and digital communication becomes even more integral to daily life, the need for clear legal frameworks and robust oversight mechanisms remains essential to protect civil liberties while enabling effective law enforcement.

In June of 2018, The Black Vault requested all FBI documents about the system. In July of 2018, the first release of records was received. In June of 2024, a second batch of records were released.

Document Archive

 FBI Release #1 on CARNIVORE – [608 Pages, 377MB] – Released July 2018

 FBI Release #2 on CARNIVORE – [468 Pages, 220MB] – Released June 2024

 FBI Release #3 on CARNIVORE – [443 Pages, 265MB] – Released August 2024

The post CARNIVORE (DCS1000): FBI Files on Their Email and Electronic Communication Monitoring Software first appeared on The Black Vault.

PRISM is a code name for a program under which the United States National Security Agency (NSA) collects internet communications from various U.S. internet companies. The program is also known by the SIGAD US-984XN. PRISM collects stored internet communications based on demands made to internet companies such as Google LLC under Section 702 of the FISA Amendments Act of 2008 to turn over any data that match court-approved search terms. Among other things, the NSA can use these PRISM requests to target communications that were encrypted when they traveled across the internet backbone, to focus on stored data that telecommunication filtering systems discarded earlier, and to get data that is easier to handle.

PRISM began in 2007 in the wake of the passage of the Protect America Act under the Bush Administration. The program is operated under the supervision of the U.S. Foreign Intelligence Surveillance Court (FISA Court, or FISC) pursuant to the Foreign Intelligence Surveillance Act (FISA). Its existence was leaked six years later by NSA contractor Edward Snowden, who warned that the extent of mass data collection was far greater than the public knew and included what he characterized as “dangerous” and “criminal” activities. The disclosures were published by The Guardian and The Washington Post on June 6, 2013. Subsequent documents have demonstrated a financial arrangement between the NSA’s Special Source Operations (SSO) division and PRISM partners in the millions of dollars.

Documents indicate that PRISM is “the number one source of raw intelligence used for NSA analytic reports”, and it accounts for 91% of the NSA’s internet traffic acquired under FISA section 702 authority.” The leaked information came after the revelation that the FISA Court had been ordering a subsidiary of telecommunications company Verizon Communications to turn over to the NSA logs tracking all of its customers’ telephone calls.

U.S. government officials have disputed criticisms of PRISM in the Guardian and Washington Post articles and have defended the program, asserting that it cannot be used on domestic targets without a warrant, that it has helped to prevent acts of terrorism, and that it receives independent oversight from the federal government’s executive, judicial and legislative branches. On June 19, 2013, U.S. President Barack Obama, during a visit to Germany, stated that the NSA’s data gathering practices constitute “a circumscribed, narrow system directed at us being able to protect our people.”

Document Archive

NSA Email: FOIAs for PRISM Information [21 Pages, 5.5MB] – This was an attempt to get previously released records further redacted. In May of 2019, an MDR request was filed to get these e-mails reviewed. Sadly, this time, nothing new was uncovered.

Loading...

Taking too long?

Reload document

| Open in new tab

Download [5.58 MB]

The post NSA Surveillance Program: PRISM first appeared on The Black Vault.

The following FBI was requested in May of 2014. In December of 2016, it was released.

It is believed this is the entire releasable portions of File #80-HQ-789 on “Tracing Telephone Calls.”

The approximate dates of the files within range from the 1950s through the 1970s.

Document Archive

 FBI File on Tracing Telephone Calls — File #80-HQ-789 [496 Pages, 302MB]

The post FBI File on Tracing Telephone Calls — File #80-HQ-789 first appeared on The Black Vault.