The NSA‘s own documents say that QUANTUMHAND „exploits the computer of a target that uses Facebook.“ The man-on-the-side attack impersonates a server, not the site itself. The NSA denies impersonating sites, but that‘s not what The Intercept said or what its own documents state.