# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### ExpressLane

# ExpressLane v3.0 -- User Guide

- 1
- 2
- 3
…
- 5
- 6

SECRET
ExpressLane 3.0 User’s Guide
OTS/I2C has an established effort to provide liaison services with a system that collects
biometric information. ExpressLane 3.0, and supporting tools, was developed to support
OTS/I2C in their efforts to verify that this data is also being shared with the Agency and
to provide an ability to disable this software if liaison doesn’t provide us with continued
access.
ExpressLane 3.0 will be installed as part of a normal upgrade to this system by OTS
officers who maintain it, if the liaison service already has this system. If it is a new
system for liaison then it will be installed at Headquarters before the liaison service
receives the system. ExpressLane 3.0 will overtly appear to be just another part of this
system. It’s called: MOBSLangSvc.exe and is stored in \Windows\System32. Covertly
it will collect the data files of interest from the liaison system and store them compressed
and encrypted in the covert partition on a specially watermarked thumb drive when it is
inserted into the system. Additionally, it manages a “kill date” to disable the software by
corrupting the license files associated with the software. When ExpressLane 3.0
(MOBSLangSvc) is first installed it sets the kill date to 6 months (183 days) in the future
as a default value. This value is changed by inserting a watermarked thumb drive. Part
of the watermark is a new “kill date”. This “kill date” is set by the CreatePartition utility.
The envisioned scenario is:
• The software is initially set up (6 month default).
• A watermarked thumb drive is inserted into the system will a specified “kill date”.
• Agency officers return to service the liaison system before the specified “kill
date”, whereupon they again insert a watermarked thumb drive with a new “kill
date”.
• If Agency officers don’t return (or aren’t allowed to) in the specified time the
software licenses “expire” and liaison can either call us back to “fix” it or just not
be able to use the software anymore.
If necessary, to uninstall ExpressLane 3.0 (MOBSLangSvc.exe) open a command
prompt, navigate to \Windows\System32 and type: “MOBSLangSvc –u”. Two other
supporting utilities are also provided, CreatePartition 3.0 and ExitRamp 3.0.
CreatePartition 3.0
Create Partition.lnk
This utility is used to create a covert partition with the appropriate watermark on any
commercially purchased thumb drive. It is a GUI program and is to be used at
Headquarter or the Station to initialize the thumb drive to be used operationally. The
GUI looks like this:
SECRET

- 1
- 2
- 3
…
- 5
- 6