Back in November, 2009, Attrition.org staff (including me) finally got around to finalizing the name for our new mascot (archive.org), the angry squirrel firmly associated with Attrition and myself. In a cheeky letter from the mascot, it was signed ‘Lazlo’. Since that date, the mascot has seen a wide variety of iterations as Lazlo was modified for various images and purposes, including presentations and stickers.
For a long while, the National Security Agency (NSA) has had a group called Tailored Access Operations (TAO) that “is a cyber-warfare intelligence-gathering unit [that] identifies, monitors, infiltrates, and gathers intelligence on computer systems being used by entities hostile to the United States.” This comes from the first iteration of the TAO page on Wikipedia. You can see the current page as of this blog has more information about the group. One thing to note is the use of code names that refer to projects, exploits, or capabilities of the group e.g. FOXACID or OLYMPUSFIRE.
On July 17, 2014, the page was edited to include TAO’s QUANTUMSQUIRREL capability. The line added: “Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host. The NSA thus may appear to be anywhere and anyone on the public Internet when utilizing QUANTUMSQUIRREL capability.” Along with that update was the inclusion of a file named QUANTUMSQUIRREL.jpg. Readers should immediately recognize the squirrel used!
That information comes from the NSA ANT catalog, which was leaked and subsequently disclosed by Der Spiegel on December 30, 2013. Written in 2008 or so, and updated after, we know that at some point after November 2009 and before December 2013, the NSA misappropriated the Lazlo image, which is copyrighted work. On March 12, 2025, the image was removed from the TAO page, citing “remove QUANTUMSQUIRREL image, as the caption was wrong, as this image does not explain anything“. Unlike the “lolcat” image which serves a purpose, someone deemed Lazlo irrelevant… jerk! =)
The information in the NSA ANT catalog and subsequent leaks by a group known as the Shadow Brokers has basically proven that the information is legitimate. That means there is very high confidence that the slide deck, tools, and associated documents pertaining to TAO’s tactics, techniques, and procedures (TTP) are real. That commonly used acronym in threat intelligence circles really should be TTTP, including ‘tools’, which are at the core of some of the leaks as they included exploits used by the group. Many of said exploits had fun code names like ETERNALSYNERGY, ETERNALROMANCE, ETERNALBLUE, EXPLODINGCAN and EWOKFRENZY.
On September 21, 2014, after seeing the QUANTUMSQUIRREL image added to Wikipedia, I sent in a Freedom of Information Act (FOIA) request to the NSA asking for “any information related to, and copies of such uses, of a stylized squirrel (colored in black, brown, red, and white) in any presentation by the Office of Tailored Access Operations (TAO) regarding the QUANTUMSQUIRREL project, internal or external [..]”. Basically looking for confirmation that the NSA used Lazlo in a presentation.
The NSA replied on September 25, 2014, just four days later which was the fastest reply to a FOIA request I have ever received. In the letter they denied my request citing the “existence or non-existence” of said squirrel was classified “in accordance with Executive Order 13526“.
Honestly, I don’t care if the NSA used Lazlo. I think it is pretty hilarious that they took the Attrition mascot and gave it a fun NSA code name QUANTUMSQUIRREL. I could file again citing Wikipedia articles, news articles, and everything that supports why they used it, but given the denial reason, it would just result in the same reply. The one good that came out of this is that two more Lazlo stickers were made. One mocking the NSA gently, and the other a more appropriate “quantum squirrel” using Lazlo.
Amusingly, the original NSA image is still used on one Wikipedia page as of today.
Leave a Reply