Previous parts:

On January 19, 2018, The Intercept published an article showing how the NSA and GCHQ have secretly used speaker recognition technology to identify people by their voices. Along with the article, The Intercept published 22 documents from the Snowden archive. However, the "Documents published with this article" section at the end of the article lists only 21 of them. The missing document is linked only from within the article text and doesn't have its own document page on The Intercept's website, which makes it hard to find (this is also why it is missing from many existing archives).

The missing document titled "Pages From VFUG minutes Sept 2008" is the September 2008 minutes of an internal GCHQ Voice/Fax User Group (VFUG), which met roughly every couple of months ("since the last VFUG in July").

Here is what the PDF looks like when you open it in a PDF viewer:

But the PDF was not properly redacted, because it only relies on the CropBox mechanism. Instead of actually removing the content from the PDF, The Intercept applied a soft crop, which can be trivially undone with common PDF tools. Removing the crop reveals the whole page, including a number of GCHQ/NSA personnel names. Here is the PDF with the crop removed (redactions added by us):

Undoing the crop, the page 3 of 7 is revealed in full.

The cropped-out material adds more context how GCHQ's voice-processing teams worked. It describes how systems were tested and delivered in phases. It describes an internal briefing called "LISTEN 08" where linguists were asked to flag "Pick Your Own Number" (PYON) cases, where a person can be using for example UK-code number but is actually based abroad. These PYON cases were marked as "techref PYON" into a surveillance database called B3M, which is GCHQ's database of voice call content. The "4. B14 / MCS update" section is the progress report from the people who built the systems. Other published VFUG documents show that B14 is the GCHQ team that developed and deployed voice analytics, the counterpart of NSA's speech research teams. MCS is the operational service within it that ran the models, managed the tasking and handled diarisation inside B3M.

The cropped-out material reveals a previously unpublished GCHQ tool name called Diariser. It's described as a tool for splitting a call into segments by speaker (doing diarisation), and version 5.0 was deployed over the summer of 2008. Its main change was a rewritten "modem arbiter" that could better recognise dial-up and fax modem signals on intercepted phone lines, and then those signals were passed to a separate decoding team (OPC~CAP) to recover the data or fax pages the signals carried. So the voice pipeline also handled machine traffic, consistent with a user group that was working on both fax and voice services.

The hidden Language ID section shows B14 describing a quiet period with no new deployments in September 2008. They say that GCHQ was supplementing its language-ID models with "non-sigint language data" drawn from its speech-to-text collections, addressing the shortage of training data, described in the January 2008 minutes, showing that NSA was legally prohibited from sharing raw datasets with GCHQ, and that GCHQ instead provided NSA with its own Afghan language corpus. They also acknowledge a technical limitation that when the system attempts to identify a target language among multiple others, some of which remain unidentified, it tends to misclassify the unidentified languages as the target.

The next document might not be a redaction failure, but it reveals material that was redacted in the primary published document.

In January 2015 Der Spiegel published a July 2012 SIDtoday document, titled "Interview with a SID "Hacker" -- Part 1: How Does TAO Do Its Work?".

Der Spiegel's published PDF is perfectly fine on its own and doesn't contain any redaction failures.

In July 2015, German journalists Svea Eckert from NDR and Marcel Rosenbach and Holger Stark from Der Spiegel spoke at a Netzwerk Recherche conference. At the conference, Eckert showed the "Interview with a SID Hacker" document during her presentation. This version had different redactions from the one Der Spiegel had published six months earlier.

In Der Spiegel's version, one part of the document is fully redacted:

But in Eckert's presentation, that part is not redacted:

(TS//SI//REL) Besides hacking a target's computer, we can also turn their Wi-Fi cards into beacons, so that
NSA can do "geo ops" and find out with good accuracy where the computer or device is physically
located. This has resulted in many terrorists being "rolled up" [captured].

It shows how NSA can turn the device's Wi-Fi card into a beacon, letting NSA carry out "geo ops" to pin down its physical location with good accuracy. The interviewee credits this with leading to many terrorists being "rolled up". This fits U.S. military Find, Fix, Finish targeting doctrine, where signals intelligence is used to identify and locate a target by tracking their electronic devices. In this case the beacon technique offers a hacking-based method for locating targets who use computers which have Wi-Fi cards in them. This technique might've been used in the SHENANIGANS pod and the VICTORYDANCE mission, which mapped Wi-Fi signals across Yemen during the same year.

As mentioned, it's not entirely clear whether this counts as a redaction failure. Different outlets and journalists may have different views on what is "supposed" to be redacted, so the document Eckert showed may have been perfectly fine from her perspective.

Notes

The conference video was found by browsing through Electrospaces old posts.