Sometimes, the spooks do get caught. German magazine Der Spiegel yesterday revealed a new slide (PDF) from the Edward Snowden document cache that offers a tantalizing glimpse of what it looks like when someone stumbles on an intelligence agency cable tap.

The NSA's Special Source Operations (SSO) branch isn't in the business of computer hacking but of cable tapping; its logo shows an eagle flying above the globe and clutching a string of wires in its talons. These taps, each obscured with a codename, are often made deep within the network of telecom providers and often with the cooperation of key executives. But sometimes non-cleared people start raising questions about just what might be going on, as was the case with AT&T whistleblower Mark Klein, who revealed an NSA "secret room" in San Francisco.

On March 14, 2013, an SSO weekly briefing included a note regarding such a discovery. The unit had been informed two days earlier that "the access point for WHARPDRIVE was discovered by commercial consortium personnel. Witting partner personnel have removed the evidence and a plausible cover story was provided. All collection has ceased."

According to Der Spiegel, Wharpdrive was a fiber-optic cable tap (underseas fiber is often laid by consortia of companies, so it's possible this took place at an onshore landing point for such a cable). Employees from one of the companies involved—though not the company that had a relationship with NSA and the German intelligence agency BND—apparently noticed some unusual gear and commented on it. In response, the company involved with the NSA ("witting partner personnel") removed the tap and made up a story to explain what the gear in question had been doing.

Though the NSA lost access to Wharpdrive, it wasn't for long. Der Spiegel cites additional documents in its possession and says that "a team was quietly put together to reinstall the program."