appointing Ho’s law firm as his “legal adviser,” the three of
them slipped out via the mall exit. Tibbo and Man planned to move
Snowden to the apartments of refugees who were their clients.
Snowden’s credit card had been frozen, so it is not clear who
paid his sizable hotel bill. According to hotel records, it was paid
by another credit card. Poitras, who had taken a room at the hotel,
might have used her own credit card, or Snowden might have had
another benefactor in Hong Kong. In any case, the lawyers escorted
Snowden to a prearranged residence.
“I am in a safe house for now,” Snowden wrote to Greenwald on
June 11. The situation might not have been totally under his control,
because he added, “But I have no idea how safe it is.”
Epst_9780451494566_2p_all_r1.z.indd 95
9/29/16 5:51 PM
96 | how america lost its secrets
Greenwald flew back to Brazil that day. Soon afterward, he would
resign from The Guardian. In February 2014, he became the cofounding
editor of The Intercept, an online publication dedicated to
investigative journalism, which was backed by the Internet billionaire
Pierre Omidyar.
Poitras remained in Hong Kong, where she moved, along with the
Guardian reporter MacAskill, to the five- star Sheraton Hong Kong
Hotel & Towers, which, like the Mira hotel, was on Nathan Road in
Kowloon. The Guardian paid the bill. Her next task was to set up
what turned out to be Snowden’s final interview in Hong Kong. It
was scheduled for June 12.
The journalist chosen was Lana Lam, a young Australian reporter
working for the South China Morning Post. Tibbo had suggested
Lam to Snowden. She had served as Tibbo’s outlet on previous news
stories, and, as he told me, he found her to be a totally reliable journalist.
He brought her to Poitras’s suite at the Sheraton in Kowloon.
First, Lam had to agree to the conditions of the interview, which
included submitting the story to Poitras for Snowden’s approval.
Next, as Lam put it, Poitras “confiscated” her cell phone. Finally,
after a ten- minute wait, Poitras took her to another room and sat
her before a black laptop. The laptop, which had a Tor sticker on it,
had on its screen an online chat room where she was connected by
Poitras to Snowden.
“Hi Lana, thanks for coming for this,” Snowden said from his safe
house. He told her that the NSA had intercepted data from at least
sixty- one thousand different computers in Hong Kong, China, and
elsewhere. To expose what he called America’s “hypocrisy” in accusing
China of cyber espionage, he supplied her with relevant NSA
documents. “Last week the American government happily operated
in the shadows with no respect for the consent of the governed, but
no longer,” he said. “The United States government has committed a
tremendous number of crimes against Hong Kong [and] the People’s
Republic of China as well.” Under Poitras’s close supervision, Lam
was allowed to ask Snowden more questions about the NSA’s interception
of communications in Hong Kong and China. He told her, “I
have had many opportunities to flee Hong Kong, but I would rather
Epst_9780451494566_2p_all_r1.z.indd 96
9/29/16 5:51 PM
Whistle- blower | 97
stay and fight the United States government in the courts.” That bit
of braggadocio would not be proven out.
Greenwald, Poitras, and MacAskill in their reporting did not
concern themselves with any of the mechanics of the largest theft
of top secret documents in the history of the United States. In the
entire filmed interview at the Mira hotel, for example, they did not
ask their source how he managed to get access to the documents.
Lam, however, asked him about how he widened his access. When
she asked him why he had switched jobs from Dell to Booz Allen
Hamilton in March 2013, his answer provided her with a real scoop:
“My position with Booz Allen Hamilton granted me access to lists
of machines all over the world the NSA hacked.” Snowden told her
that he deliberately went to Booz Allen Hamilton to get access to
the “lists” revealing the NSA’s sources in foreign countries. This
admission could further complicate his legal situation in Hong Kong
because it suggested that he meant to steal documents even before
he had known their content. In fact, to protect himself, he restricted
Lam from publishing this part of the interview until after he had
departed Hong Kong. (It was not published until June 24, a day after
he arrived in Russia.) This condition indicated to Lam that as early
as June 12, if not before, he was planning on leaving Hong Kong.
His interview with Lam didn’t reveal how he had learned about
these “lists” before taking the job. Nor did he reveal to her what he
planned to do with these lists. He made it clear to her, however, that
he had not disposed of all his secret documents. “If I have time to go
through this information,” he said, “I would like to make it available
to journalists in each country to make their own assessment,
independent of my bias, as to whether or not the knowledge of US
network operations against their people should be published.” So as
late as June 12, Snowden was still reading and assessing the files he
had stolen from the NSA four weeks earlier.
Poitras vetted the Lam interview. Soon afterward, she suspected
that she was being followed. That was likely, because by June 14 all
the intelligence services in Hong Kong knew that she was in contact
with Snowden.
“I was being tailed,” Poitras recalled in an interview with a Vogue
Epst_9780451494566_2p_all_r1.z.indd 97
9/29/16 5:51 PM
98 | how america lost its secrets
reporter in Berlin in 2014. “The risks became very great,” she said in
describing her situation in Hong Kong. So, on June 15, she left Hong
Kong and flew back to Berlin, where she began editing her footage
of the Snowden interview.
Meanwhile, Snowden, organizing his own exit from Hong Kong,
placed a call to Julian Assange.
Epst_9780451494566_2p_all_r1.z.indd 98
9/29/16 5:51 PM
c h a p t e r 11
Enter Assange
Thanks to Russia (and thanks to WikiLeaks), Snowden remains
free.
— julian assange, Newsweek, 2015
Julian assange had made a brilliant career of trafficking in
state, military, and corporate secrets. Born on July 3, 1971, in
Queensland, Australia, Assange began his hacking career while still
a teenager. Using the alias Mendax (“the untruthful one”), he had
hacked into the computers of the Pentagon, the U.S. Navy, NASA,
Citibank, Lockheed Martin, and Australia’s Overseas Telecommunications
Commission before he was twenty. At the age of twenty- five,
he pleaded guilty to twenty- five charges of hacking in Australia but
was released on a good behavior bond. In 2006, with the spread of
Tor software, he co- founded WikiLeaks, a website in which secret
documents could be anonymously sent and posted. The site received
little public attention until Bradley Manning sent it several hundred
thousand lowly classified U.S. military and State Department
documents in April 2010. With these stolen documents, WikiLeaks
became a media sensation, and Assange, the runner- up for Time’s
Man of the Year for 2010, became a leading figure, along with Appelbaum,
in the global hacktivist underground.
Epst_9780451494566_2p_all_r1.z.indd 99
9/29/16 5:51 PM
100 | how america lost its secrets
In November 2010, however, he ran into a legal problem in
Sweden. A judge in Stockholm ordered his detention on suspicion
of rape, sexual molestation, and unlawful coercion. He denied the
charges but was arrested in London on a European arrest warrant. In
December, he was released on a $312,700 bail deposit (supplied by
his supporters) and confined to Ellingham Hall in Norfolk, England.
While awaiting the outcome of the extradition proceedings, he lived
there with Sarah Harrison, his twenty- eight- year- old deputy at
WikiLeaks. A graduate of the elite Sevenoaks School in Kent, Harrison
served as Assange’s liaison with the outside world. Although she
was officially given the title “investigative editor” of WikiLeaks, she
worked so closely with Assange during this period that the British
press carried stories saying she was his paramour. Harrison worked
on a WikiLeaks documentary titled Mediastan, which concerned
WikiLeaks’s exposure of U.S. secret operations in Russia and other
parts of the former Soviet Union. It was a project that took her to
Russia and provided her with a multi- entry Russian visa.
In June 2012, after the extradition order was upheld, Assange
jumped bail and fled to the Ecuador embassy in London. For the next
year, his only visible means of income was a weekly program from
the embassy. It was sponsored in 2012 by RT television, a Moscowbased,
English- language news channel funded by the Russian government,
which would also finance and release Mediastan. This
sponsorship suggests that the Russian government saw potential
value in the document- gathering activities of WikiLeaks.
Snowden telephoned Assange at his refuge at the Ecuador
embassy on June 10, 2013. According to Assange, Snowden needed
help for his exit plan. He wanted Assange to use WikiLeaks’s
“resources” to get him out of Hong Kong. Assange considered it a
surprising request, because Snowden had not given any of the stolen
documents to WikiLeaks. In their discussion, according to Assange,
Snowden claimed that one reason he decided to take the secret NSA
documents was the brutal treatment of Bradley Manning after he
was arrested in 2010 by the U.S. government. “Snowden told me
they had abused Manning in a way that contributed to his decision
to become a whistle- blower,” Assange said in an interview in 2015.
If Manning’s mistreatment was Snowden’s motive, it was a sharp
Epst_9780451494566_2p_all_r1.z.indd 100
9/29/16 5:51 PM
Enter Assange | 101
departure from the position Snowden had taken in his postings on
the Ars Technica site in January 2009. He complained in a post there
about the detrimental consequences to U.S. intelligence of leakers’
revealing “classified shit” to The New York Times, and he suggested
as punishment “those people should be shot in the balls.” Either he
had a change of heart, or he was telling Assange what he believed he
wanted to hear.
Assange counseled Snowden to go directly to Russia. “My advice
was that he should take asylum in Russia despite the negative PR
consequences,” he told the London Times in 2015. He said, “Snowden
was well aware of the spin that would be put on it if he took asylum
in Russia.” So a story would be released presumably by WikiLeaks,
coinciding with his departure, asserting that Snowden was “bound
for the republic of Ecuador via a safe route.” When Snowden asked
how he would carry out the plan, Assange told him that he would
immediately dispatch one of his senior staff members to help him
engineer his escape to Russia. That senior staff member was Sarah
Harrison.
After speaking to Snowden, Assange called Harrison, who was in
Melbourne. She had gone there a month earlier to help organize
Assange’s somewhat quixotic election campaign for president of
Australia. Assange told her to forget the campaign and go to Hong
Kong. She was to use WikiLeaks’s resources to save Snowden from “a
lifetime in prison.” Presumably, Assange told her that he had advised
Snowden to proceed to Russia. Harrison later said that she didn’t
even bother to pack her clothing after hearing from Assange. She
caught the next plane to Hong Kong and arrived there on June 11—
the same day that Snowden texted Greenwald he was in a safe house
and before Snowden’s explosive interview with Lam. Harrison had
her own connections in Hong Kong. Her two younger sisters, Kate
and Alexandra, lived there and were part of the expatriate community.
She also had an older brother, Simon, who headed Avra, a ship
brokerage and commodity trading company, headquartered in Singapore,
but he frequently traveled to Hong Kong on business.
Like Poitras, Sarah Harrison took great care to shield her movements.
She did not have a Twitter, Facebook, or any other social media
account. She did not own a cell phone for fear of being tracked by an
Epst_9780451494566_2p_all_r1.z.indd 101
9/29/16 5:51 PM
102 | how america lost its secrets
intelligence service. When she traveled, she bought “burner” phones
locally and disposed of them before any calls could be traced back to
her. Upon arriving in Hong Kong, she avoided meeting Snowden
face- to- face out of concern about the surveillance of American intelligence
there. Instead, for thirteen days in Hong Kong she worked
through intermediaries. Her task was not only to arrange Snowden’s
escape route but also to create diversions to camouflage his real destination.
Under Assange’s tutelage, she had made deceptive ploys an
integral part of her tradecraft. “We were working very hard to lay as
many false trails as possible,” she later told an interviewer in Berlin.
According to Assange, she booked decoy flights for Snowden to
Beijing and New Delhi. She also used Snowden’s credit card number
to pay for the flight to India; because the card was blocked, she knew
there was a high probability that it would come to the attention of
U.S. intelligence. According to Harrison, she booked no fewer than
a dozen such decoy tickets to confuse Snowden’s possible pursuers
in U.S. intelligence. The only actual ticket she bought for Snowden,
according to an Aeroflot official, was one to Moscow at the last minute.
She bought a ticket for herself on the same flight, leaving on
June 23.
The source of the money for the Assange- Harrison operation is
unclear. Subsequently, Harrison said she was setting up secret bank
accounts to help organize such transborder escapes. Assange said she
was using “WikiLeaks’s resources.” Harrison said the “WikiLeaks
team” helped fund Snowden’s flight to Russia from Hong Kong, as
well as her own flight there. But WikiLeaks was not an organization
with spare cash in June 2013. Assange had forfeited his own bail by
fleeing to the embassy of Ecuador, offending many of his financial
supporters in Britain. He had also all but exhausted his bank account.
Aside from money that dribbled in from Poitras’s six- month- old
Freedom of the Press Foundation, the only steady source of funds
for WikiLeaks in 2013 was the previously mentioned payments
Assange received from the Russian government’s RT television.
Mounting pressure was brought on the Hong Kong government
to take action against Snowden. On June 16, the U.S. government
informed the Hong Kong authorities that it had filed a criminal
complaint against Snowden and would be seeking his extradition.
Epst_9780451494566_2p_all_r1.z.indd 102
9/29/16 5:51 PM
Enter Assange | 103
Because Hong Kong had a vigorously enforced extradition agreement
with the United States, as mentioned above, it was expected
that Snowden would be taken into custody. But China had the final
say in any extradition decision. In fact, China had explicitly been
given the right of vetoing any extraditions for any reason in the
formal 1999 agreement between Hong Kong and the United States.
Because the Chinese president, Xi Jinping, had just met with President
Obama in California, China also had an interest in avoiding
embarrassing public demonstrations on behalf of Snowden. According
to a well- placed official in Hong Kong, China’s liaison office in
Hong Kong told the Hong Kong Authority in no uncertain terms
that Snowden had to be out of Hong Kong by June 23.
On June 19, Snowden had a meeting with Tibbo, the barrister who
would handle any eventual court case, and Man and Ho, the Hong
Kong solicitors who had been retained for him. It took place in a
small apartment where, according to Ho, they ate pizza while they
discussed Snowden’s options.
Tibbo wanted Snowden to remain in Hong Kong, allow himself
to be arrested, seek bail, and fight extradition in court. Tibbo said
he planned to mount a powerful legal defense against extradition
by using a provision in Hong Kong’s extradition treaty with the
United States that protects fugitives from persecution on political
grounds. After he told Snowden that it would entail a long court
battle, Snowden asked him if he could avoid even being arrested.
Tibbo explained that Hong Kong courts, which closely follow
British law, would certainly issue an arrest warrant for him immediately
after the United States formally filed charges against him.
Those charges could come within hours, he reckoned. Soon afterward,
Snowden would be temporarily jailed, and his computers,
electronic gear, and thumb drives would be seized and placed in the
custody of the court. Tibbo would immediately seek his release on
bail but could not guarantee an outcome because Snowden, who
had fled U.S. jurisdiction, might be considered a flight risk. If so,
Snowden could remain incarcerated during the long court battle.
During the litigation, Snowden would have a platform to make
his case against U.S. surveillance. Indeed, Tibbo’s strategy involved
building massive public support for Snowden’s cause. Once the U.S.
Epst_9780451494566_2p_all_r1.z.indd 103
9/29/16 5:51 PM
104 | how america lost its secrets
government filed charges, though, Snowden could further expect it
would invalidate his passport to go anywhere except for his return to
the United States, and Interpol would issue a red alert to all its members.
Because his case involved national security secrets, he had also
to consider that the Hong Kong court could deny him any use of the
Internet until his extradition case was settled. If Snowden wanted to
leave Hong Kong, he had to act swiftly.
Tibbo, although evasive on the point when I interviewed him,
might not have known about the escape Harrison was planning. He
did not know that Snowden’s other alternatives were not good. He
had no money, and his credit card had been blocked. He had no visas
to go to any other country, and Interpol would issue its own border
alert as soon as the United States filed its charges. At that point,
Hong Kong airport authorities would be officially notified and could
prevent him from leaving the city. Even if he somehow got out, he
would be an international fugitive. Tibbo counseled Snowden to seek
redress in the Hong Kong courts.
Snowden, though, had no intention of allowing himself to be
arrested. Despite what he had told Lana Lam only one week earlier,
at least for publication, about his determination to seek justice in
the Hong Kong courts, he had not planned to use Hong Kong as
anything more than a temporary stopover on his escape route. Two
months later and safely in Moscow, he made this point clear in a
lengthy interview with Alan Rusbridger, the editor of The Guardian.
He told him that it had never been part of his plan to use Hong
Kong to escape the legal consequences of his act. “The purpose of my
mission [to Hong Kong] was to get the information to journalists.”
If so, he had merely been using Tibbo, Man, and Ho to provide him
with temporary cover while, following the instructions of Assange,
Harrison laid down the smoke screen for his escape to Moscow.
Epst_9780451494566_2p_all_r1.z.indd 104
9/29/16 5:51 PM
c h a p t e r 12
Fugitive
If I end up in chains in Guantánamo, I can live with that.
— edward snowden, Hong Kong, 2013
During his interviews with Poitras and Greenwald in June,
Snowden said stoically, “If I am arrested, I am arrested.” His
fatalistic words notwithstanding, Snowden had made plans to seek
a haven from American justice well before his meeting them. As
early as May 24, 2013, he had suggested to Barton Gellman that
he was making arrangements with a foreign government. To that
end, he asked Gellman to insert an encrypted key in the Internet
version of the NSA exposé that Snowden proposed he write for The
Washington Post. He told him the purpose of the encrypted key was
to assist him with a foreign government. Snowden did not identify
any foreign government to Gellman, but Gellman said he knew
that Snowden wanted to “seek asylum” overseas. He decided against
assisting him. “I can’t help him evade U.S. jurisdiction— I don’t want
to, and I can’t,” he later explained. “It’s not my job. It’s not the relationship.
I am a journalist.”
Although Gellman suspected that Iceland might be the foreign
government in question, Snowden, as it turned out, had never con-
Epst_9780451494566_2p_all_r1.z.indd 105
9/29/16 5:51 PM
106 | how america lost its secrets
tacted the consulate of Iceland while he was in Hong Kong. “We had
heard nothing from Snowden,” an Iceland government official told
Vanity Fair.
Snowden also did not contact the government of Ecuador while
in Hong Kong. In mid- June, while Harrison was laying down false
tracks for Snowden in Hong Kong, Assange in London asked Fidel
Narváez, who was a friend of his and the legal attaché in the London
embassy of Ecuador, to issue a document that Snowden could
use. But this document was not delivered to Snowden in Hong Kong
(and it was later invalidated by Ecuador). There are no direct flights
to Ecuador from Hong Kong. If Snowden had really planned to go to
Ecuador without stopping in a country allied with the United States,
he would have had to fly to Cuba. He would need a Cuban travel
document to do that, which he could have obtained from the Cuban
consulate anytime during his month in Hong Kong. But he did not
obtain it. Nor did he acquire a visa to go to any other country in
Latin America or elsewhere while in Hong Kong. So where was he
headed?
Whatever foreign government with which Snowden was dealing
earlier presumably did not have an extradition treaty with the
United States. Almost all other countries that did not have active
extradition treaties with the United States could not be directly
reached by air. With three notable exceptions, the flights to most of
these countries had stopovers in a country that was an ally of the
United States, where officials could seize Snowden. The three exceptions
were China, North Korea (via China), and Russia.
The only one of these three countries that Snowden is known
to have had contact with directly during his thirty- three- day stay
in Hong Kong was Russia. The Russian president, Vladimir Putin,
revealed these contacts in a televised press briefing in September
2013. Putin did not provide the date of these contacts, but he provided
an intriguing clue. Snowden was identified to him, according
to Putin, not by name but merely as an “agent of special services.”
If his name was not given to Putin, it might have been because
Snowden’s first meeting with the Russians had taken place before
Snowden became a household name on June 9, 2013.
For his part, Snowden was evasive when discussing his con-
Epst_9780451494566_2p_all_r1.z.indd 106
9/29/16 5:51 PM
Fugitive | 107
tacts with Russia while still in Hong Kong. When Lana Lam asked
Snowden on June 12, 2013, whether he had already requested asylum
from the Russian government, he deferred, saying, “My only
comment is that I am glad there are governments that refuse to be
intimidated by great power.” The Russian government was clearly
not intimidated by the threats of reprisals by the United States, as
the Obama administration would learn after Snowden’s arrival in
Russia on June 23. Snowden could only have known that with certainty
on June 12 if he had been in contact with Russian officials
prior to his interview with Lam.
If Putin’s own description of Snowden’s interactions with the
Russians in Hong Kong is to be believed, the decision to facilitate
Snowden’s escape to Russia had been kicked all the way up the Russian
chain of command to Putin. Presumably, this decision- making
process began earlier than June 21, when Snowden was said to have
gone to the consulate. But how much earlier? Because Snowden had
arrived in Hong Kong on May 20, his contacts with Russian officials
could have occurred in May. Such a contact with the Russians
would fit with Snowden’s telling Gellman on May 24 that he needed
his help in dealing with the diplomatic mission of a country that
Snowden did not identify.
In any case, Putin said an American “agent of the special services”
had contacted Russian diplomats because he wanted assistance. The
agent, Snowden, of course, needed assistance to escape from Hong
Kong. The decision to accept him in Russia, given the international
ramifications, would have to be made at a much higher level than the
Russian mission in Hong Kong.
Nine days before Snowden boarded Aeroflot Flight SU213 to
Moscow on June 23, the United States had filed a criminal complaint
against him. It had also officially alerted Interpol when it unsealed
the complaint on June 21. It had invalidated his U.S. passport except
to return to America (although he still had it in his possession at
the Hong Kong airport). Because by this time he was the most
famous visitor in Hong Kong, his passage through passport control
on June 23 might have reflected the acquiescence of the Hong Kong
authorities to the reported request of China to be rid of Snowden by
that date.
Epst_9780451494566_2p_all_r1.z.indd 107
9/29/16 5:51 PM
108 | how america lost its secrets
According to one Aeroflot official, ordinarily all international passengers
are required to have a valid passport as well as a visa to the
country of final destination. Snowden had neither a valid passport
nor a visa. Still Snowden was able to board the flight to Moscow.
Aeroflot, a state- controlled airline, presumably responds to the Russian
government on matters where Putin has given his approval.
Snowden first met Harrison in person on June 23. She was waiting
for him in the car that Jonathan Man had arranged to take him
to the airport that morning. Snowden was dressed in a gray shirt
and khaki slacks. Harrison was dressed in jeans and flip- flops. She
said she had chosen this dress style so that they would blend in at
the airport with vacationing tourists. She had financed the trip, and
she was apparently now calling the shots. Harrison’s concern was
that they might be arrested at the airport, so Man accompanied them
through passport control. He was able to do this because he bought
a ticket on the cheapest available international flight. Harrison had
given Man a phone number to call if they got arrested. When she
and Snowden boarded the flight at 12:45 p.m., Harrison effectively
became Snowden’s second “carer”— a job that would require her
presence in Moscow for the next four months.
Snowden had pretty much remained silent until the plane took
off. The first full proper sentence she heard from him as they headed
for Moscow, as she recalled, was “I didn’t expect that WikiLeaks was
going to send a ninja to get me out.”
Meanwhile, Assange continued creating “distractions,” as he put
it. On June 24, a booking was made for Snowden on an Aeroflot
flight to Cuba, and this information was relayed to the foreign press
organization in Moscow, resulting in over a dozen reporters flying
to Havana on the flight. Snowden, of course, never showed up for it.
“In some of our communications, we deliberately spoke about that
[flight] on open lines to lawyers in the United States,” Assange said.
One subsequent piece of his misinformation was that Snowden was
flying to Bolivia on the private plane of the Bolivian president, Evo
Morales (who was then in Moscow for a meeting). That misinformation
had the desired effect. U.S. allies in Europe, including France,
Spain, and Portugal, refused to allow that plane to fly through its
airspace, forcing the plane to land in Austria. This misinformation
Epst_9780451494566_2p_all_r1.z.indd 108
9/29/16 5:51 PM
Fugitive | 109
resulted in an international incident but did not change the fact that
Snowden was still in the custody of Russian authorities.
Snowden came to realize that those assisting him, including
Assange and Harrison, were taking serious risks. “Anyone in a threemile
radius [of me] is going to get hammered,” he later said in 2015
to a reporter from Vogue. (After finally leaving Snowden in Moscow
on November 3, 2013, Harrison moved to Berlin, where she set up
an organization to provide, as she termed it, “an underground railroad”
for other fugitives who had made available documents exposing
government secrets.)
Snowden was sequestered in the transit zone of the Moscow airport
for thirty- seven days. A Russian intermediary provided him
with a Russian classic to read while awaiting asylum. It was Fyodor
Dostoyevsky’s Crime and Punishment, whose protagonist, Rodion
Romanovich Raskolnikov, is a dissenter who believes breaking the
law is morally justified by the unfair abuses of the political system.
Snowden received official sanctuary in Russia on August 1, 2013.
His public statements in Hong Kong that he was willing to go to
prison so that others could live freely in a democratic society were,
as it turned out, mere rhetoric. Instead of risking prison, he had successfully
escaped to a country in which he would be treated as a hero
for defying the U.S. government. He had not sacrificed himself; he
had transformed himself. He had risen from being a lowly technician
in Hawaii whose talents went largely unrecognized to the status
of an international media star in Moscow. In his new role, he could
make Internet appearances via Skype to prestigious gatherings, such
as the TED conference, where he would be roundly applauded as an
Internet hero, as well as be paid a $20,000 fee for just his electronic
participation. He would be beamed into dozens of ACLU meetings
where he was celebrated as a defender of American liberty. He would
describe to sympathetic audiences in Germany, Norway, and France
the unfairness of the American legal system, asserting that it was
denying him a “fair trial.” He would now make front- page news
by granting interviews to The New York Times, The Washington
Post, The Nation, and other publications. He would join Poitras and
Greenwald on the board of directors of the Freedom of the Press
Foundation. He would be the subject of an Oscar- winning documen-
Epst_9780451494566_2p_all_r1.z.indd 109
9/29/16 5:51 PM
110 | how america lost its secrets
tary, the hero of the 2016 Hollywood movie Snowden (directed by
Oliver Stone), and a consultant to the 2015 season of the television
series Homeland. He would be nominated for the Nobel Peace
Prize in 2014. He would attract over one million followers to his
tweets in 2015. “For me, in terms of personal satisfaction, the mission’s
already accomplished. I already won,” he informed the Post
in his first live interview in Moscow in December 2013. It was a
mission that involved a very high- stakes enterprise: taking not only
domestic surveillance documents but America’s military and foreign
intelligence secrets abroad.
Whistle- blowers do not ordinarily steal military secrets. Nor do
they flee to the territory of America’s principal adversaries. A fugitive,
especially one lacking a Russian visa, does not wind up in Moscow
by pure accident. It’s hard to imagine that a Russian president
with the KGB background of Putin would give his personal sanction
for a high- profile exfiltration from Hong Kong without weighing
the gain that might proceed from it. Whatever else may be said of
Putin, his actions show him to be a calculating opportunist. Part of
his calculus would be that the defector from American intelligence
had taken possession of a great number of potentially valuable documents
from the inner sanctum of the NSA and, aside from these
documents, claimed to hold secrets of great importance in his head.
To be sure, the practical value of this stolen archive would require
a lengthy evaluation by Russia’s other intelligence services. But it
is hard to believe that a defector who put himself in the hands of
the FSB, the successor to the KGB, and other Russian intelligence
services wouldn’t be expected to cooperate with them. Even if such
a defector did not carry these files with him to Moscow, intelligence
services have the means to recover digital files, even after they are
erased from a computer or if they are sent to the cloud. Moreover,
once secret documents are taken, they are compromised. Yet for
much of the American public, Snowden remained a hero.
Epst_9780451494566_2p_all_r1.z.indd 110
9/29/16 5:51 PM
part two
THE INTELLIGENCE CRISIS
What you’ve seen so far [in the Snowden theft of documents]
is just the tip of the iceberg.
—retired admiral michael mcconnell,
vice- chairman, Booz Allen Hamilton, 2013
Epst_9780451494566_2p_all_r1.z.indd 111
9/29/16 5:51 PM
Epst_9780451494566_2p_all_r1.z.indd 112
9/29/16 5:51 PM
c h a p t e r 13
The Great Divide
That moral decision to tell the public about spying that affects all
of us has been costly, but it was the right thing to do and I have
no regrets.
— edward snowden, Moscow, 2013
In the twelve- minute video on The Guardian’s website,
Snowden correctly identified himself as an infrastructure analyst
at a regional base of the National Security Agency in Oahu, Hawaii.
He also revealed in a calm, unemotional voice that he had been the
source for the stories in both The Guardian and The Washington
Post. He said that he had supplied the secret, classified documents
that the two newspapers had used in their scoops about domestic
surveillance being conducted by the NSA, America’s enormous electronic
surveillance agency. These sensational revelations had been,
literally, the talk of the world, and now, in another major news event,
the boyish- looking Snowden took responsibility for what would
turn out to be the largest theft of top secret documents in the history
of U.S. intelligence.
In the video, it will be recalled, Glenn Greenwald, who had broken
the NSA story in The Guardian, questioned Snowden. What
was his motive? Greenwald asked. Why did he do it? Snowden
replied that he had become horrified by the NSA’s secret operations,
Epst_9780451494566_2p_all_r1.z.indd 113
9/29/16 5:51 PM
114 | how america lost its secrets
which, to him, represented a kind of distillation of the excesses of
the American national security state, and he had therefore made it
his mission to blow the whistle. He believed that the public needed
to be informed of the existence of a vast, secret surveillance operation
directed against tens of millions of Americans that flagrantly
violated U.S. laws and was a grave threat to their privacy and their
freedoms. Within hours of the release of that video on the Guardian
website, Snowden was known throughout the world as a courageous
whistle- blower.
In Laura Poitras’s remarks in accepting her Academy Award for
Citizenfour on February 22, 2015, she said that Snowden acted as a
whistle- blower not only to “expose a threat to our privacy but to our
democracy itself.” She received a standing ovation.
A large part of the public who viewed this powerful film, including
many of my colleagues in journalism whose writing I greatly
respect, came to accept Snowden’s whistle- blowing narrative. The
film so convincingly depicted Snowden as an altruistic young man
willing to risk his own personal freedom and face years of imprisonment
for the sake of others that editorial writers asked that he be
given clemency from prosecution.
“Sitting on his unmade bed— white sheets and covers, white headboard,
white bathrobe, white skin— Snowden seems like a figure
in some obscure ritual, being readied for sacrifice,” George Packer
wrote about the film in a widely read article in The New Yorker.
This powerful narrative, as lucidly articulated by Poitras, Greenwald,
and other Snowden supporters, described the NSA activities
exposed by Snowden as part of a vast criminal conspiracy involving,
among others, President Obama, James Clapper, the director of
national intelligence, and both Democratic and Republican members
of the congressional oversight committees. It further derided any
claims that there was evidence that Snowden’s theft of NSA secrets
went beyond simply exposing government misdeeds. For example,
this narrative asserted, as if it were established fact, that U.S. government
officials had deliberately “trapped” Snowden in Russia.
According to Snowden, the purpose of this government ploy was
to “demonize” him. “There was no question that I was going to be
subject to a demonization campaign,” Snowden said in an interview
Epst_9780451494566_2p_all_r1.z.indd 114
9/29/16 5:51 PM
The Great Divide | 115
from Moscow, “They [Greenwald and Poitras] actually recorded me
on camera saying this before I revealed my identity.” The purpose
of this demonization was to divert attention from the government’s
own crimes.
To be sure, it is not unprecedented for the government to release
defamatory information about individuals who have embarrassed
U.S. intelligence by defecting. When two NSA analysts, William
Martin and Bernon Mitchell, defected to Russia in the 1960s and
accused the NSA of violating international law after arriving in
Moscow, U.S. government officials responded by putting out the
story that they were homosexual lovers, which was both untrue and
irrelevant to the intelligence secrets that they had compromised. It
is certainly possible that the government put out information to
intentionally defame Snowden. Secretary of State John Kerry characterized
him as a coward who should “man up” by returning to the
United States.
While one can discount such characterizations against Snowden
by government officials as demonization, as I do, one cannot as easily
dismiss the independent evidence that undermines Snowden’s
assertion that his sole motive was blowing the whistle on illicit surveillance
in the United States. For example, in 2014, the Lawfare
Institute, a nonprofit organization that publishes a blog on national
security concerns, in cooperation with the Brookings Institution,
did an independent analysis of all the published documents that
Snowden provided to the media. It concluded that with some notable
exceptions, such as the two documents initially published by The
Guardian and the Post, the now- famous FISA Verizon warrant and
the PRISM slides, few of the other documents that Snowden had
given Poitras and Greenwald for publication had anything to do
with either domestic surveillance or infringements on the privacy of
Americans. By the Lawfare Institute’s count, 32 of Snowden’s leaks
to these journalists concerned the NSA’s overseas sources and methods,
9 identified overseas locations of the NSA’s intelligence bases,
25 revealed the identities of foreign officials of interest to U.S. intelligence
agencies, 14 disclosed information about Internet companies
legally cooperating with the NSA, and 19 concerned technology
products that the NSA had been using or researching.
Epst_9780451494566_2p_all_r1.z.indd 115
9/29/16 5:51 PM
116 | how america lost its secrets
Some secret methods that Snowden made public compromised
the NSA’s state- of- the- art technology of which adversaries had
been unaware. For example, the NSA had devised an ingenious technology
in 2008 for tapping into computers abroad that had been
“air- gapped,” or intentionally isolated from any network to protect
highly sensitive information, such as missile telemetry, nuclear bomb
development, and cyber- warfare capabilities. The secret method that
the NSA used involved surreptitiously implanting speck- sized circuit
boards into air- gapped computers. These devices then covertly
transmitted the data back in bursts of radio waves. Once Snowden
exposed this technology, and the radio frequency transmission it
used, America lost this intelligence capability.
In addition, a considerable number of the published documents
did not even belong to the NSA but were copies of reports sent to
the NSA by its allies, including the British, Australian, Canadian,
French, Norwegian, and Israeli intelligence services. Snowden provided
journalists with secret documents from the British cyber
service GCHQ, describing its plans to obtain a legal warrant to penetrate
the Russian computer security firm Kaspersky to expand its
“computer network exploitation capability.” What the GCHQ was
revealing in this secret document was its own capabilities to monitor
a Russian target of interest to British intelligence. While the release
of these foreign documents might have embarrassed allies of the
United States, they exposed no violations of U.S. law by the NSA. It
was a legitimate part of the NSA’s job to share information with its
allies. This raises the question: What constitutes whistle- blowing?
To the general public no doubt, a whistle- blower is simply a person
who exposes government misdeeds from inside that government.
But in the eyes of the law, someone who discloses classified
information to an unauthorized person, even as an act of personal
conscience, is not exempt from the punitive consequences of this act.
Indeed, if a person deliberately reveals secret U.S. operations, especially
ones that compromise the sources and methods of U.S. intelligence
services, he or she may run afoul of American espionage laws.
In the past, when government employees have disclosed highly
classified information to journalists to redress perceived government
misconduct, they were almost always prosecuted. During
Epst_9780451494566_2p_all_r1.z.indd 116
9/29/16 5:51 PM
The Great Divide | 117
Barack Obama’s presidency, there were six government employees
who, as a matter of personal conscience, shared classified information
they obtained from the FBI, the CIA, the State Department,
and the U.S. Army with journalists. They were all convicted: Shamai
Leibowitz in 2010, Chelsea Manning in 2013, John Kiriakou in
2013, Donald Sachtleben in 2013, Stephen Kim in 2014, and Jeffrey
Sterling in 2014. Like Snowden, they claimed to be whistle- blowers
informing the public of government abuses. But because they disclosed
classified documents, they were dealt with as lawbreakers. All
six were indicted, tried, convicted, and sentenced to prison. Sterling,
a CIA officer who allegedly turned over a document to James Risen,
a Pulitzer Prize– winning reporter for the Times, was sentenced to
forty- two months. The most severe sentence was meted out to Private
Manning, whom an army court sentenced to thirty- five years
in a military stockade, as noted earlier.
The prison time that others received did not go unnoticed by
Snowden. He had been following the Manning case since 2012. In
fact, he posted about it shortly before he began stealing far more
damaging documents than Manning had. He would therefore likely
have been aware that by revealing state secrets he had sworn to protect,
he would be risking imprisonment unless, unlike Manning, he
fled the country. His motives, no matter how noble they might be,
would not spare him— any more than they spared the other six—
from determined federal prosecution.
The view of those on the Snowden side of the divide is grounded
not in legal definitions but in a broader notion of morality. Snowden’s
supporters do not accept that the law should be applied to Snowden
in this fashion. A writer for The New Yorker termed it “an act of
civil disobedience.” His supporters argue that Snowden had a moral
imperative to act, even if it meant breaking the law. They fully accept
his view that he had a higher duty to protect citizens of all countries
in the world from, as he put it, “secret pervasive surveillance.”
That higher duty transcended any narrower legal definitions of lawbreaking.
Ben Wizner, a lawyer from the American Civil Liberties
Union who has represented Snowden since October 2013, argues
that Snowden’s taking of classified documents was an “act of conscience”
that overrode any legal constraints because it “revitalized
Epst_9780451494566_2p_all_r1.z.indd 117
9/29/16 5:51 PM
118 | how america lost its secrets
democratic oversight in the U.S.” and, without question, caused a
much- needed debate on government surveillance.
In this ends- justify- the- means view, any person with access to
government secrets can authorize him- or herself to reveal those
secrets to the world if she or he believes it serves the public good.
Further, because doing so would be an “act of conscience,” he or she
should be immune from legal prosecution.
For Snowden’s supporters, his “act of conscience” justifies his
claim to being a whistle- blower, even though the preponderance of
the secrets he disclosed had to do with the NSA’s authorized activity
of using its multibillion- dollar global arrays of sensors to intercept
data in foreign countries. For example, one of the thirty allied
intelligence services that the NSA cooperated with in 2013 was the
cyber service of Israel. Because Snowden deemed this cooperation
to infringe on privacy rights, he revealed documents bearing on
the NSA’s data exchange with Israel. He subsequently told James
Bamford, in an interview in Wired magazine in August 2014, that
supplying such intelligence to Israel was “one of the biggest abuses
we’ve seen.” Snowden therefore believed he was justified in revealing
information concerning Arab communications in Gaza, the West
Bank, and Lebanon that the NSA had provided the Israeli cyber service,
known as Unit 8200. In doing so, he compromised an Israeli
source. But how could this act qualify as whistle- blowing? Providing
Israel with such data was not some NSA rogue operation. It was part
of a policy that had been approved by every American president—
and every Congress— since 1948. Snowden had every right to personally
disagree with this established U.S. policy of aiding Israel with
intelligence, but it is another matter to release secret documents to
support his view. If the concept of whistle- blowing were expanded
to cover intelligence workers who steal secrets because they disagree
with their government’s foreign policy, it would also have to include
many notorious spies, such as Kim Philby.
Snowden’s concept of whistle- blowing also applied to the NSA’s
spying on adversary nations. “We’ve crossed lines,” Snowden said
in regard to China. “We’re hacking universities and hospitals and
wholly civilian infrastructure.” The NSA’s operations against China
were such “a real concern” for Snowden that he targeted lists of
Epst_9780451494566_2p_all_r1.z.indd 118
9/29/16 5:51 PM
The Great Divide | 119
the NSA’s penetrations in China. Putin echoed this expansion of the
whistle- blowing concept to adversaries. He complimented Snowden
for having “uncovered illegal acts by the United States around the
globe.” Putin’s defense of Snowden not only implied a global concept
of whistle- blowing that justifies breaking U.S. laws but also pointed
to America’s double standard in publicly complaining about Russian
and Chinese cyber espionage.
Snowden’s whistle- blower interpretation gained immense public
resonance. Even after President Obama and leaders of both houses
of Congress roundly denounced Snowden for betraying American
secrets, the majority of the public, according to a Quinnipiac poll
taken in July 2013, still considered “Snowden a whistleblower who
did a service revealing government domestic spying programs.”
Moreover, Snowden’s revelations helped stoke a growing distrust of
the American government itself. According to polls conducted by
the Pew Research Center after Snowden came forward, just 19 percent
of the public said that “they can trust the government always
or most of the time.” The support for Snowden was not limited to
America. On October 29, 2015, a majority of the European Parliament
voted to award Snowden the official status of a “human rights
defender.”
The former congressman Ron Paul went even further. He organized
a clemency petition in February 2014 for Snowden, stating,
“Thanks to one man’s courageous actions, Americans know about
the truly egregious ways their government is spying on them,” and
his son Senator Rand Paul, who was a candidate for the Republican
presidential nomination in 2016, called for a pardon for Snowden.
Senator Paul’s concern fitted with the growing public apprehension
over increasing intrusion on privacy. Snowden was correct,
in my opinion, in describing the threat of a surveillance state and
the loss of privacy as a legitimate public concern. “We actually buy
cell phones that are the equivalent of a network microphone that
we carry around in our pockets voluntarily,” he pointed out from
Moscow.
The very technology involved in the electronic equipment we all
use in the twenty- first century has made mass surveillance part of
our daily life. There can be little doubt that our privacy has been
Epst_9780451494566_2p_all_r1.z.indd 119
9/29/16 5:51 PM
120 | how america lost its secrets
largely eroded, if not entirely negated, by the widespread use of
cell phones, credit cards, social media, and the search engines of the
Internet. When we use smart phones, our location is relayed to our
telephone service provider every three seconds. The phone companies
collect and archive our phone usage “metadata,” which includes
whom we called and how long we spoke. When we use Google
to search for anyone or anything on the Internet, that activity is
captured by Google, a company whose profits mainly come from
making available to advertisers the results of its surveillance and
collection of its users’ searches. When we use Gmail, Google’s e- mail
service, used by nearly one billion senders and recipients, we agree
to allow Google to read the actual contents of our correspondence to
find keywords of interest to advertisers.
When we use a credit card, the credit card company also retains
data about what we buy and where we go. When we travel in automobiles
equipped with GPS, every turn and stop is tracked and
recorded. And when we are in public places with CCTV (closedcircuit
television) cameras, our image is recorded and archived.
When we use Facebook, Twitter, and other so- called social media, as
over two billion people do today, we allow these companies to collect,
retain, and exploit their surveillance of our movements, associations
with other people, and stated preferences. When we use Amazon and
other online stores, we allow them to track and archive a great deal
of our commercial activity. For Internet companies such as Facebook,
Twitter, and Yahoo!, like Google, collecting private data on hundreds
of millions of their members provides them with vast searchable
databases that are easily marketable. The exploitation of these databases
is a fundamental aspect of their business plans. Without such
surveillance of their users, social media companies would not be able
to turn a profit. Indeed, they may be more aptly called surveillance
media than social media. For those of us who use them to post pictures
and communicate, any notion of personal privacy is largely
illusory.
To be sure, there is a distinction to be made between the surveillance
of our activities to which we voluntarily agree in exchange
for the benefits and conveniences that we gain from social media,
search engines, and other Internet companies and the surveillance
Epst_9780451494566_2p_all_r1.z.indd 120
9/29/16 5:51 PM
The Great Divide | 121
done by the government, which we do not voluntarily invite— or
want. We willingly waive our privacy for corporations but not for
governments.
What the public might not fully realize, however, is that the government
can access all the personal information in the databases of
private companies if it issues a subpoena or search warrant, which it
does often. As Snowden himself pointed out, “If Facebook is going
to hand over all of your messages, all of your wall posts, all of your
private photos, all of your private details from their server, the government
has no need to intercept all of the communications that constitute
those private records.” These Internet companies, even if they
are only interested in exploiting the data for their own profit, cannot
refuse to share this information with the NSA, the FBI, and other
government agencies if they have a subpoena or search warrant.
That reality became evident to me in my investigation of the rape
charges brought (and subsequently dropped) against Dominique
Strauss- Kahn, the managing director of the International Monetary
Fund, in 2011. Immediately after his arrest, Cyrus Vance Jr., the district
attorney of New York County, issued a subpoena for Strauss-
Kahn’s cell phone records, credit card records, hotel room electronic
key records, e- mails, room service bills, and the CCTV videos of his
activities (some of which I published in my article about the case
in The New York Review of Books). Nor is this access uncommon.
According to Vance in 2016, his office issues thousands of such subpoenas
every year. Even though Apple made headlines by refusing
to comply with a court order to help the FBI unlock the iPhone of
a dead mass murderer in 2016, it had complied with many previous
subpoenas. In fact, in 2015 alone, it quietly provided the backed- up
data of some seventy- one hundred iPhone customers to government
authorities.
If anyone doubts the pervasiveness of government data collection,
consider a little- known government agency called the Consumer
Financial Protection Bureau. Created in 2010 by Congress, it mines
data on a monthly basis from some 600 million personal credit card
accounts, targeting about 95 percent of the credit card users in the
United States. In addition, through eleven other data- mining programs,
it gathers data on everything from private home mortgages
Epst_9780451494566_2p_all_r1.z.indd 121
9/29/16 5:51 PM
122 | how america lost its secrets
and student loans to credit scores and overdrafts in personal bank
accounts. This ubiquitous surveillance of virtually every non-cash
transaction came about because of advances in computer technology
that made it economically feasible to mine such data.
Snowden’s concern about NSA domestic surveillance is certainly
not misplaced. Ever since the 9/11 attacks, the NSA has increasingly
played a role in this surveillance state, not by its own choice, but
because Congress mandated it. In 2001, it empowered the NSA to
obtain and archive data on American citizens. Accordingly, the NSA
obtained the billing records of customers from phone and Internet
companies and archived these records. The bulk collection of these
billing records was intended to build a searchable database for the
government that could be used to trace the history of the telephone
and Internet activities in the United States of FBI- designated foreign
terrorists and spies abroad. The government’s rationale for keeping
these anti-terrorist programs secret from the public was that it did
not want the foreign suspects to realize their communications in
America were being monitored.
The public only learned that the phone company was routinely
turning over its billing records on June 6, 2013, when Snowden disclosed
it to The Guardian and The Washington Post. The documents
he provided the journalists showed that the NSA had been obtaining
phone records collected by Verizon every three months. While
this revelation might have shocked the American public, the NSA
had not acted on its own. It had acted under a warrant issued by a
secret court established by Congress in 1978 as part of the Foreign
Intelligence Surveillance Act for each request for records. Congress
empowered the FISA court, whose judges are appointed by the president,
to hear cases and authorize search warrants in secret in cases
involving national security.
As its name implies, the FISA court was meant to deal with matters
bearing on foreign intelligence activities in the United States. That
restriction changed after the terrorist attacks of September 11, 2001.
A month after the attacks, Congress expanded the purview of the
FISA court by passing the USA Patriot Act (an acronym that stands
for Uniting and Strengthening America by Providing Appropriate
Tools Required to Intercept and Obstruct Terrorism). Part of the
Epst_9780451494566_2p_all_r1.z.indd 122
9/29/16 5:51 PM
The Great Divide | 123
act, Section 215, euphemistically referred to as the “library records”
provision, permitted the FISA court to issue warrants authorizing
searches of records by the NSA and other federal agencies to investigate
international terrorism or clandestine intelligence activities.
Through these FISA authorizations, the NSA could obtain “tangible
things” such as “books, records, papers, documents, and other items.”
Under the interpretation of this section of the law by both the Bush
and the Obama administrations, the FISA court was enabled by
Congress to issue warrants to telephone companies demanding that
they turn over to the NSA the bulk billing records of all calls made
in America. The FISA court need only deem these records to be “relevant”
to the FBI’s investigations of terrorists and spies.
Essentially, the NSA, to create a searchable database of telephone
billing records, used the FISA court’s controversial interpretation of
the word “relevant” in Section 215. Such a “haystack,” as the NSA
called the national collection of billing records, could allow the FBI
to instantly find missing “needles,” as this tracking was supposed to
work, even if the connections were made years earlier. For example,
if the FBI had a lead on a foreign suspect, it could search the database
for any telephone calls made by the foreign suspect to telephone
numbers in America and then who those people called. The
FBI always had this power, if it obtained a warrant, but it did not
previously have the “haystack” of records in a single database. General
Keith Alexander, who headed the NSA between 2005 and 2014,
believed that maintaining such a haystack database made sense. “His
approach was, ‘Let’s collect the whole haystack,’ ” according to one
former senior U.S. intelligence official quoted by The Washington
Post.
According to critics of NSA domestic surveillance, including the
ACLU, the results provided by this vast database did not justify its
immense potential for abuse. In early May 2015, just three weeks
before this part of the Patriot Act was set to expire, a three- judge
panel of the Second U.S. Circuit Court of Appeals in New York
agreed with the ACLU position, overturning a lower court decision
that said it was legal. The panel found that the word “relevant”
in the act was not intended by Congress to justify the acquisition
and storing of the bulk records of telephone companies for possible
Epst_9780451494566_2p_all_r1.z.indd 123
9/29/16 5:51 PM
124 | how america lost its secrets
future use. Soon afterward, Congress replaced the Patriot Act with
the USA Freedom Act, which effectively transferred bulk storage of
billing records from the NSA to the phone companies themselves.
Despite the change in venue, the records of individuals were still not
completely private. Under the new law, the FBI via a FISA warrant
could still search the phone company’s databases.
The core of Snowden’s charge in the media was that the FISA
court overreached its authority by issuing sweeping warrants that
allowed the NSA to obtain data collected by private phone and Internet
companies. In the initial story published in The Guardian on
June 6, Snowden disclosed one such FISA warrant to support his
charge. It was issued by Judge Roger Vinson of the FISA court on
April 25, 2013, and ordered Verizon to turn over to the FBI all its
billing records of landline customers for the next ninety days. The
FBI presented this FISA authorization to the NSA, which acts as
a service organization for the FBI and the CIA in collecting communications
data. The NSA, with the FISA warrant in hand, then
obtained the Verizon billing records.
Snowden also provided the Post and The Guardian with another
secret document: a PowerPoint presentation on twenty slides, sent
by the NSA to other intelligence agencies. It described a program
it was using for monitoring the Internet. Its code name was the
aforementioned PRISM. It was authorized under Section 702 of the
Foreign Intelligence Surveillance Act and was designed to collect
messages sent over the Internet from foreigners. Such information
was in fact obtained with the knowledge of the service providers. It
also required a written directive from both the attorney general and
the director of national intelligence and a review by the Department
of Justice every three months for each and every case. After obtaining
this data, the NSA ran programs, as required by law, to filter out
all domestic Internet communications, but, as Snowden pointed out,
domestic information was also accidently picked up. Whenever the
Justice Department actually opened an investigation against Americans
in contact with foreign suspects, as it did in 170 cases in 2013,
it could obtain warrants from the FISA court to search these Americans’
Internet activities.
These two documents raised legitimate questions for many
Epst_9780451494566_2p_all_r1.z.indd 124
9/29/16 5:51 PM
The Great Divide | 125
Americans, including members of Congress, about the proper role
of the FISA court, including whether it should conduct its business
in secret. If Snowden had released only these two documents that
related to unwarranted domestic surveillance and other possible violations
of the law by the NSA, it would be difficult for any reasonable
person not to see his actions as a potentially valuable public service.
Indeed, additional safeguards were necessary in an age in which new
technologies enabled mass surveillance of the public. As the threejudge
panel of the Second U.S. Circuit Court of Appeals would later
find, Congress had not intended Section 215 of the Patriot Act to
be used to justify the bulk collection of American records. If he had
limited his illegal downloading to the few documents about bulk collection,
it would be more difficult to argue that he was not a whistleblower
in the spirit if not the letter of the law, and even a hero in
the struggle to preserve our civil liberties. But in fact, Snowden took
a great many other secret documents that did not bear on the civil
liberties of Americans. He claimed he was acting on behalf of citizens
in foreign countries by exposing the NSA’s and the CIA’s spying
operations abroad, but that same claim could also be made by any
espionage agent stealing U.S. secrets to benefit the people of another
country.
As a result, the Snowden case produced a great divide in the
American appreciation of him. On one hand, he has been almost
universally lauded and lionized by what might be seen as the mainstream
media, by numerous academics, and even, as we have seen,
by members of Congress. The journalists who assisted him, Greenwald,
Poitras, and Gellman, have been celebrated for the roles they
played in bringing Snowden’s revelations to the public and received
the 2014 Polk Award for national security reporting. The Post and
The Guardian, the newspapers that initially published the purloined
documents, won the 2014 Pulitzer Prize for public service.
In other circles, the reaction has been very different. American
and British intelligence officials, senior members of the Obama
administration, and members of the oversight committees of Congress
do not view Snowden as a hero or even an authentic whistleblower.
Instead, they see him as a betrayer of secrets who willfully
brought damage to the United States and benefits to its adversar-
Epst_9780451494566_2p_all_r1.z.indd 125
9/29/16 5:51 PM
126 | how america lost its secrets
ies. The holders of this darker view of Snowden base it on classified
reports of the full extent of the theft of classified data. Those officials
believe that only a handful of the tens of thousands of documents he
stole involved domestic surveillance and that those few documents
served as a cover for a much larger theft.
Admiral Michael Rogers, who replaced General Alexander as
head of the NSA in March 2014, said at a public forum at Princeton
University, “Edward Snowden is not the ‘whistleblower’ some have
labeled him to be.” He further explained to Congress, “Snowden
stole from the United States government a large amount of classified
information, a small portion of which is germane to his apparent
central argument regarding NSA and privacy issues.”
General Martin Dempsey, the chairman of the Joint Chiefs of Staff,
went even further. In testifying before the House Armed Services
Committee on March 6, 2014, after estimating that the Snowden
breach could cost the military “billions” to repair, he added, “The
vast majority of the electronic documents that Snowden exfiltrated
from our highest levels of security had nothing to do with exposing
government oversight of domestic activities.” Dempsey based this
assessment on a then still- secret Defense Intelligence Agency report
on the breach. The classified DIA report showed that Snowden took
“over 900,000” military files from the Department of Defense in
addition to the NSA files he had taken. The Defense Department
loss in terms of the number of files stolen actually exceeded the
loss— in sheer numbers— of NSA documents. Lieutenant General
Mike Flynn, the DIA director who directed the study, testified to the
Senate Select Committee on Intelligence that the breach “has caused
grave damage to our national security.”
To be sure, this was not the first time that the cryptological
branches of the military had been compromised. The spy ring of John
Walker had provided thousands of the navy’s reports on breaking
Russian ciphers to the KGB during the Cold War. But the Snowden
breach exposing military sources was an order of magnitude greater
than any past breach.
The CIA’s assessment was no less grim. Morell, the deputy director
of the CIA in 2013, wrote that Snowden’s action went beyond taking
the handful of documents, such as the FISA order, “that addressed
Epst_9780451494566_2p_all_r1.z.indd 126
9/29/16 5:51 PM
The Great Divide | 127
the privacy issue.” Instead, as Morell put it, “he backed up a virtual
tractor trailer and emptied a warehouse full of documents— the vast
majority of which he could not possibly have read and few of which
he would likely understand— [and] he delivered the documents to a
variety of news organizations and God knows who else.” As a result,
Morell concluded, “Snowden’s disclosures will go down in history
as the greatest compromise of classified information ever.” General
Alexander, the head of the NSA at the time of the theft, asserted that
Snowden did “the greatest damage to our combined nations’ intelligence
systems that we have ever suffered.” Obviously, military
intelligence officers would not be on Snowden’s side of the divide
(and the Snowden breach ended the careers of many of them, including
Alexander). But political leaders in both parties could also be
found on the anti- Snowden side of the divide. “I don’t look at this as
being a whistle- blower,” the Democratic senator Dianne Feinstein of
California, the head of the Senate Intelligence Committee, said after
she was briefed on Snowden’s theft. “I think it’s an act of treason.”
The Republican representative Mike Rogers of Michigan, her counterpart
on the House Intelligence Committee, said on the NBC program
Meet the Press that Snowden might be working for a foreign
intelligence service. And a former prominent member of President
Obama’s cabinet went even further, suggesting to me off the record
in March 2016 that there are only three possible explanations for the
Snowden heist: (1) it was a Russian espionage operation; (2) it was a
Chinese espionage operation; (3) it was a joint Sino- Russian operation.
These severe accusations generated much heat but little light.
They were not accompanied by any evidence showing that Snowden
had acted in concert with any foreign power in stealing the files or,
for that matter, that he was not acting out of his own personal convictions,
no matter how misguided they might have been.
On this side of the divide, Snowden’s critics regard the whistleblowing
narrative as at best incomplete and at worst fodder for the
naive. They point out that the FISA document that gave him credentials
as a whistle- blower was only issued in the last week of April
2013, which was four months after he first contacted Greenwald and
almost nine months after he began illegally copying secret documents.
They further believe that the evidence contradicts Snowden’s
Epst_9780451494566_2p_all_r1.z.indd 127
9/29/16 5:51 PM
128 | how america lost its secrets
claims that he stole only documents that exposed NSA transgressions
into domestic surveillance, that he turned over all the stolen
documents to journalists, and that he was forced to remain in Moscow
by the actions of the U.S. government. They also find that the
unprecedented size and complexity of the penetration of NSA files,
compromising hundreds of thousands of secret documents pertaining
to U.S. operations against adversary nations, according to the
NSA’s and the Pentagon’s estimates, is not easily explained given
Snowden’s avowed purpose for his theft.
The deep split in how Snowden is perceived brings to mind the
famous drawing of a duck- rabbit cartoon first published in 1900 in
the book Fact and Fable in Psychology. The figure is perceived either
as a duck or as a rabbit, but it cannot be seen as both simultaneously.
Whether a person sees a rabbit or a duck in this test may depend
on the information available to that person. Similarly, what may
account for the sharp divide between the pro- Snowden and the anti-
Snowden camps is a disparity in their available information.
The pro- Snowden camp’s view is largely informed by Snowden
himself. Snowden supporters prefer to believe his words rather than
his actions. In the anti- Snowden camp are administration officials
and the members of the House and Senate intelligence oversight
committees who have been at least partially briefed on the continuing
investigations of the Snowden affair. The members of the
Senate Intelligence Committee, for example, were told by David
Leatherwood, the director of operations for the Defense Intelligence
Agency, that the military files compromised by Snowden included
documents bearing on military plans and weapons systems; foreign
governments’ intelligence activities (including special activities),
intelligence sources, or methods of cryptology; scientific and technological
matters relating to national security; and vulnerable systems,
installations, infrastructures, projects, plans, and protection services
related to national security and the development, production, or use
of weapons of mass destruction. The members of the House and
Senate Intelligence Committees, but not the public, have also been
privy to an NSA investigation that established the chronology of
Snowden’s actions, including changing jobs, copying more than one
Epst_9780451494566_2p_all_r1.z.indd 128
9/29/16 5:51 PM
The Great Divide | 129
million classified documents at the Signals Intelligence Center in
Hawaii, and flying to Russia.
Additional information does not necessarily change the minds of
people who already have a firm view. In the field of social psychology,
the testing of “confirmation theory” consistently shows that
people tend to more readily reject new information that contradicts
their pre-existing beliefs. For example, when Lee Harvey Oswald
was arrested in the Texas Theater on November 22, 1963, he said
famously, “I haven’t shot anybody.” Ten months later, the Warren
Commission presented evidence, including ballistic tests, that it
claimed showed that Oswald had shot three people, including President
John F. Kennedy, less than an hour before making his statement.
Yet many of those who believed Oswald’s public proclamation of
his innocence chose to believe that the government had falsified
all the incriminating evidence to tarnish Oswald (who had been
killed on November 24, 1963) rather than accept that they had
been wrong in believing Oswald.
The charges, countercharges, and defamatory name- calling in the
Snowden case therefore only deepened the great divide. Those who
saw Snowden as a democratic hero exposing the abuses of power of
an out- of- control national security state tended to dismiss anything
that depicted Snowden in a negative light as a fabrication, while
those who saw Snowden as a “traitor” tended to dismiss anything
that depicted him in a more positive light.
When it comes to the murky universe of spy agencies, the problem
in deciding where the truth lies is further heightened by the
possibility of deliberate deception. Spy masters are, after all, in the
business of concealing their most sensitive operations. It is often
considered essential that important secrets be protected by what
Winston Churchill famously termed “a bodyguard of lies.” Top
intelligence officials are not exempt from this practice. Consider, for
example, the response to a question concerning the NSA’s operations
made by James Clapper, the director of national intelligence, to
the Senate Intelligence Committee on March 12, 2013. The Democratic
senator Ron Wyden of Oregon, who was on the committee,
asked the spymaster if the NSA collected data on Americans. Clap-
Epst_9780451494566_2p_all_r1.z.indd 129
9/29/16 5:51 PM
130 | how america lost its secrets
per answered that the NSA did not knowingly “collect any type of
data” on millions of Americans. Clapper’s answer was clearly untrue,
but it did not mislead Senator Wyden or any other members of the
Senate Intelligence Committee; Clapper had truthfully testified in a
classified session of the committee earlier that week that the NSA
did collect Americans’ telephone records. It was the American people
who were being misled. Yet none of the senators on the committee
corrected this obviously false answer. When Clapper realized he had
misspoken, he could not publicly correct the record of the public session,
because to do so would be revealing classified information he
had sworn to protect. No doubt other intelligence officers find themselves
in a similar bind in discussing secret matters. This suggests
that there is a risk in accepting statements made by the intelligence
chiefs at face value.
But Snowden also has a credibility problem. He has told numerous
untruths, including some calculated to help him insinuate himself
into the key positions from which he stole secrets and some calculated
to cover up the nature of his theft. For example, Snowden got
access in the spring of 2013 to the NSA’s super-secret computers that
stored these electronic files by working at Booz Allen Hamilton. On
his application to Booz Allen in March 2013, as we’ve seen, Snowden
claimed to be in the process of completing a master’s degree at the
University of Liverpool in computer security sciences. Snowden had
not completed a single course there and purposely lied to get access
to classified documents and then to get safely away with them.
He was also not entirely truthful with the journalists whose
trust he sought when it suited his purpose of protecting himself.
For example, as we have seen, in contacting Laura Poitras under the
alias Citizen Four in January 2013, he told her that he was currently
a “government employee,” although in fact he was working for a
private contractor at the time.
Snowden had little concern about misleading journalists when
it suited his purpose. For example, he told Alan Rusbridger of The
Guardian, Brian Williams of NBC News, James Bamford of Wired,
Katrina vanden Heuvel of The Nation, Barton Gellman, and Jane
Mayer of The New Yorker that the U.S. government intentionally
Epst_9780451494566_2p_all_r1.z.indd 130
9/29/16 5:51 PM
The Great Divide | 131
acted to “trap” him in Moscow by revoking his passport while he
was already on a plane to Moscow on the afternoon of June 23.
None of these journalists asked Snowden what the basis for his oftrepeated
allegation was. If they had, they would have discovered that
he had no independent basis for his assertion. When asked about it
during the Q&A following his July 12 press conference in Moscow,
he indeed said that the only knowledge he had about the suspension
of his passport was what he had “read” in the news reports. But
all the news stories prior to his statement reported that his passport
had been revoked on June 22, while he was still in Hong Kong.
ABC News, for example, reported that the U.S. “Consul General–
Hong Kong confirmed Hong Kong authorities were notified that Mr.
Snowden’s passport was revoked June 22.” By advancing that date
to when his plane was in “midair” on June 23, Snowden provided to
unsuspecting journalists an untrue alibi for his presence in Russia.
The credibility problem with Snowden assumed a more sinister
dimension once he put himself and his fate in the hands of the Russian
authorities in Moscow. Even though the Obama administration
decided against revealing the extent of the Russian intelligence service’s
participation in Snowden’s move from Hong Kong to Moscow,
or what intelligence services call an “exfiltration,” I was told
by a presidential national security staff adviser that the government
acted to protect the intelligence sources used by the CIA, the NSA,
and the FBI to track Snowden’s movements in the latter part of June
in Hong Kong. The CIA’s deputy director, Morell, would go no further
than to state that during that period he had no doubt that the
intelligence services of Russia and China “had an enormous interest
in him and the information he [Snowden] had stolen.” Presumably,
the last thing these adversary services would want would be to make
this “interest” transparent to the United States.
The role of concealment must be taken into account when assessing
information bearing on the work of espionage services. When
I was interviewing James Jesus Angleton— the CIA’s legendary excounterintelligence
chief, active in the 1970s— for a book on deception,
I learned that intelligence services play by a different set of
rules from historians when it comes to their espionage successes.
Epst_9780451494566_2p_all_r1.z.indd 131
9/29/16 5:51 PM
132 | how america lost its secrets
Angleton, a famously baroque thinker himself, impressed on me the
complexity of espionage. He said, “It’s not enough just to steal a
secret. It must be done in a way that the theft remains undetected.”
Deception is employed to obscure the nature and the extent of
the espionage theft. One of the most famous examples of this principle
was the deception used by British intelligence in World War II
to conceal its success in breaking the German ciphers generated by
the Enigma machines. If German naval intelligence had discovered
Britain was able to read the ciphers it used to communicate with its
U- boats, it would have stopped using them. So British intelligence
hid its coup by supplying false information to known German spies
to account for the sinking of U- boats, including the canard that British
aerial cameras could detect one ingredient in the paint used to
camouflage the U- boats.
That same hoary principle of deception applies to modern- day
communications intelligence. If the Russian, Chinese, or any other
adversary intelligence service got its hands on the documents stolen
by Snowden from the NSA’s repositories in Hawaii in 2013, it would
likely employ deception, including well- crafted lies, to create as
much ambiguity as possible as to the missing documents. From this
counterintelligence perspective, the intelligence issue that spawned
the great divide cannot be resolved by accepting the uncorroborated
statements made by a source, such as Snowden, who may be in the
hands of the Russian security services in Moscow.
By the same token, the calculations made by NSA officials about
the extent of the theft are also suspect. After all, the NSA is an intelligence
service that often engages in secret machinations. We know
that its top officials reported to the House and Senate Intelligence
Committees, as well as the president’s national security adviser, that
Snowden compromised over one million documents. But if this was
disinformation, it is difficult to see its purpose. Inflating the extent
of the damage of the Snowden breach to the president, Congress,
and the secretary of defense obviously reflected poorly on their own
management of the NSA, and their own careers. Yet such a possibility
cannot be precluded in the arcane world of intelligence.
As in any case involving the loss of state secrets, uncontested facts
remain in extremely short supply. The opinion- laden appellatives
Epst_9780451494566_2p_all_r1.z.indd 132
9/29/16 5:51 PM
The Great Divide | 133
such as “patriot” and “traitor” that have tended to fill the gap in
the great divide do little to address the important mystery of how
many thousands of state secrets were taken from the United States.
How did Snowden breach the supposedly formidable defenses of the
NSA? Did he have any assistance? How did he escape to Moscow?
And what was the final destination of the stolen documents? How
Snowden succeeded in this coup cannot simply be pieced together
from his own statements and interviews. The story also requires a
visit into the wilderness of mirrors of a counterintelligence investigation.
For this endeavor, it is necessary to return to the crime scene:
the NSA’s base in Hawaii.
Epst_9780451494566_2p_all_r1.z.indd 133
9/29/16 5:51 PM
c h a p t e r 14
The Crime Scene Investigation
Any private contractor, not even an employee of the government,
could walk into the NSA building, take whatever they wanted,
and walk out with it and they would never know.
— edward snowden, Moscow, 2014
Fifteen miles northwest of Honolulu on the island of Oahu,
adjacent to the sprawling Wheeler Air Force Base, is a 250,000-
square- foot, man- made mound of earth and reinforced concrete surrounded
by an electrified fence. Inside the mound is a three- story
structure originally built by the air force in World War II as a bombproof
aircraft repair facility. In the Cold War, it was modernized to
withstand enemy chemical, biological, radiological, or electromagnetic
pulse attacks and was used by the navy’s operation center for
its Pacific fleet. After the Cold War, the huge edifice was turned over
to the NSA, which, as stated earlier, had been created as an intelligence
service to intercept the communications and signals of foreign
countries after World War II, a mission that included vacuuming
into its giant computer arrays telephone messages, missile telemetry,
submarine signals, and virtually everything on the electromagnetic
spectrum of interest to the U.S. Defense Department and
U.S. intelligence agencies. As the NSA developed it, this Hawaiian
base became one of its primary regional bases for gathering Asian
Epst_9780451494566_2p_all_r1.z.indd 134
9/29/16 5:51 PM
The Crime Scene Investigation | 135
communications intelligence. It provided a valuable window on the
activities of adversary nations in the Pacific region and was able to
monitor the ballistic missile tests and submarine activities of China,
North Korea, and Russia. By 2013, the Kunia base had a vast array
of state- of- the- art technology, including ninety Cray supercomputers
arranged in a horseshoe configuration, used to decipher and
make sense of the intercepted signals from China, Russia, and North
Korea. At the heart of the Hawaiian complex was a unit with both
military and civilian employees. A large share of the civilians who
ran the computers worked under two- year contracts with the NSA’s
leading civilian contractor, Booz Allen Hamilton.
General Alexander, who, as I said, headed the NSA in 2013, first
learned about an impending story in The Guardian on June 4, while
he was in Germany meeting with its top intelligence officials, from
Janine Gibson, The Guardian’s American website editor. She had
notified the NSA it intended to break a story focusing on the organization.
It took NSA counterintelligence less than forty- eight hours
to determine that a civilian employee at the base from which documents
were stolen had not reported back to work on May 22. His
civilian supervisor had delayed reporting the absence to the NSA
until May 28. It also determined that the missing civilian employee,
Snowden, had lied on his application for a medical leave and had
flown to Hong Kong. Personal records showed he was being trained
as an analyst at the Threat Operations Center and had worked there
for less than six weeks. He had taken the medical leave on May 18
and left the country by plane. By June 6, he had become the NSA’s
main suspect.
Alexander flew to Washington, D.C., after assigning the sensitive
job of investigating the breach to a team headed by Richard
“Rick” Ledgett, who was then director of the NSA’s Threat Operations
Center at the NSA’s headquarters in Fort Meade, Maryland.
Ledgett was the logical choice to head the damage assessment investigation
because the center’s regional branch in Hawaii was under
his command. Ledgett flew to Hawaii, where his first task was to
reconstruct the chronology of Snowden’s moves, or, as the tactic is
called in counterintelligence parlance, “walking the cat back.”
The NSA had also notified the FBI of Snowden’s possible involve-
Epst_9780451494566_2p_all_r1.z.indd 135
9/29/16 5:51 PM
136 | how america lost its secrets
ment in the theft of state secrets in the first week of June. The FBI
is in charge of criminal investigations of civilian U.S. intelligence
workers, even if the alleged crime occurs on an NSA base. The FBI
immediately dispatched a task force of agents to investigate a potential
espionage case in Hawaii. When questioned, Lindsay Mills said
Snowden was away on a business trip. After determining from
airline and hotel data that he was in Hong Kong, the FBI realized
Snowden was a possible intelligence defector. It froze his credit and
bank cards. It also notified the passport office in the State Department
and the legal attachés at the Hong Kong consulate. The legal
attachés, who were actually FBI field agents posted in Hong Kong,
located Snowden at the Mira hotel on June 8. On the evening of
June 9, Snowden revealed in his twelve- minute video posted on the
Guardian website that he was the source of the stolen NSA documents.
Because Hong Kong is part of China, U.S. law enforcement
did not have the means to recover them.
At that point, determining the magnitude of the theft of documents
became a critical concern of the investigation. Aside from the
few dozen documents published by The Guardian and The Washington
Post, what else had Snowden stolen?
Within the next few days, a small army of forensic investigators
from the FBI, the Defense Department, and the “Q” counterintelligence
division of the NSA swarmed onto the NSA base in Hawaii.
The proximate crime scene for their investigation was the National
Threat Operations Center. They examined the cubicle where
Snowden had last worked and then began retracing all his activities
at the NSA from 2009 to 2013. To begin with, they needed to
find out how many documents from the center had been copied and
taken by Snowden.
Meanwhile, the Defense Intelligence Agency (the Pentagon’s own
intelligence service) was kept partially in the dark. Although the
NSA is officially part of the Department of Defense, it operated with
a high degree of autonomy with its own inspector general, investigative
staff, and reporting channels. The DIA did not learn from
the NSA that Snowden had stolen military documents concerning
the joint Cyber Command until July 10. The number of stolen military
documents from the Department of Defense was staggering.
Epst_9780451494566_2p_all_r1.z.indd 136
9/29/16 5:51 PM
The Crime Scene Investigation | 137
The DIA found from its forensic examination that Snowden had
copied “over 900,000” military files. Many of these non- NSA files
came from the Cyber Command, which had been set up in 2011
by the NSA and the army, navy, marine, and air force cryptological
services to combat the threat of warfare in cyberspace. The loss
was considered of such importance that between 200 and 250 military
intelligence officers worked day and night for the next four
months, according to the DIA’s classified report, to “triage, analyze,
and assess Department of Defense impacts related to the Snowden
compromise.” The job of this unit, called the Joint Staff Mitigation
Oversight Task Force, was to attempt to contain the damage caused
by the Snowden breach. In many cases, containment meant shutting
down NSA operations in China, Russia, North Korea, and Iran so
they could not be used to confuse and distract the U.S. military.
The NSA and the Defense Department were not the only government
agencies concerned with determining the extent of the
breach. The NSA acted as a service organization for the CIA through
handling most if not all of its requests for communications intelligence
to support both its international espionage and its analytic
operations. Although the CIA and the NSA were both part of the socalled
intelligence community, the NSA did not immediately share
with the CIA details of the Snowden breach. Despite the immense
potential damage of the theft, it was not until June 10 that the CIA’s
director, John Owen Brennan, and his deputy, Michael Morell, were
briefed by the NSA. When Morell realized how much data Snowden
had taken, he was astounded.
“You might have thought of all the government entities on the
planet, the one least vulnerable to such grand theft would have been
the NSA,” he wrote. “But it turned out that the NSA had left itself
vulnerable.” According to Morell, he bluntly told the NSA briefer
that it was urgent for the CIA to be brought in on the case. After all,
the CIA had employed Snowden only four years earlier. Specifically,
Morell said, the CIA needed to find out three things: Had CIA documents
been part of Snowden’s haul? How long had Snowden been
stealing documents? Had Snowden been working “with any foreign
intelligence service, either wittingly or not”?
According to Morell, the effort to get a direct answer from NSA
Epst_9780451494566_2p_all_r1.z.indd 137
9/29/16 5:51 PM
138 | how america lost its secrets
officials to these three key questions “proved maddeningly difficult.”
He found that in mid- June NSA officials with whom he dealt
were so “distraught at the massive security breach” that initially
they refused to allow even CIA officers to participate in the ongoing
security review. A former NSA executive told me there was “near
panic” at the NSA. Finally, Morell called Chris Inglis, a former professor
of computer science who had risen to be the NSA’s deputy
director at the time of the breach. Inglis, who headed operations for
the NSA, told him “the news was not good.” Among the data copied
by Snowden were a large number of CIA secrets. By the time the
CIA learned that its secrets had been compromised, Snowden was
headed to Russia.
The investigation of a crime involving potential espionage is no
easy task. In this case, it required attempting to solve a jigsaw puzzle
in which not only were key pieces missing but also, because it
involved adversary intelligence services, some of the found pieces
might deliberately have been twisted to mislead the U.S. investigators.
By late July, NSA investigators had made their initial assessment.
They determined that most of the material had been taken from
sealed- off areas known in intelligence speak as “compartments,”
which in this case were files stored on computers that were isolated
from any network. Each compartment electronically tracks all the
activities that occur in it on its logs, including the password identity
of any person who has gained entry to any compartment. From a
forensic examination of these logs, NSA investigators were quickly
able to reconstruct the timeline of the theft. The logs showed that an
unauthorized party without proper passwords had begun copying
files in mid- April, which was just days after Snowden began his job
at the center. The illicit activity ended just before Snowden’s last day
of work there. So this piece fit in with Snowden’s guilt.
The size of the theft was another matter. Ledgett was certainly in
a position to know (in the shake- up that followed, he would replace
Inglis as deputy director of the NSA). According to Ledgett, the perpetrator
had “touched” 1.7 million documents, moving from compartment
to compartment. Of these “touched” documents, according
to the analysis of the logs, more than one million of them had been
moved by the unauthorized party in mid- May to an auxiliary com-
Epst_9780451494566_2p_all_r1.z.indd 138
9/29/16 5:51 PM
The Crime Scene Investigation | 139
puter intended to be used for temporary storage by authorized service
personnel. Finally, the data was transferred off this auxiliary
computer presumably to thumb drives or other external storage
devices. This download occurred just days before Snowden left the
NSA on May 17, 2013, having told the agency that he needed a medical
leave of absence.
The quantity of stolen documents, 1.7 million, does not necessarily
reveal the damage and can itself be misleading. Many documents
do not reveal current or known sources or methods, and others may
have little value to an enemy. And a large portion of the documents
might have been duplications. The quality of some of these documents
is another matter. Just one document that exposed a source
or method of which enemies are unaware can be of immense value.
One such document taken by Snowden provided what Ledgett called
“a roadmap” to the NSA’s current secret operations, revealing to an
adversary such as Russia, China, or Iran “what we know, what we
don’t know, and, implicitly, a way to protect themselves.” There were
many documents in the Snowden breach that met these criteria,
according to a national security official at the Obama White House.
General Alexander closely followed the investigation as it developed
over the summer of 2013. By then, of course, the whole world
knew that Snowden had stolen a vast trove of NSA documents.
Alexander saw major inconsistencies developing between Snowden’s
personal account of the theft and what had actually happened. The
timeline established by the government’s investigators did not
match Snowden’s story line. “Something is not right,” Alexander
said in an interview.
For one thing, Snowden had made the claim to journalists, four
months after he was in Russia, that he had turned over all the
documents he took from the NSA’s compartments to Poitras and
Green wald in Hong Kong. On August 18, the investigators had the
opportunity to examine the files that Snowden had given to Poitras
and Greenwald. This discovery came when British authorities, under
Schedule 7 of Britain’s Terrorism Act, detained David Miranda,
Green wald’s romantic partner, at Heathrow Airport. Miranda was
suspected of acting as a courier for Greenwald and Poitras. According
to Greenwald’s account, Snowden had given both him and Poi-
Epst_9780451494566_2p_all_r1.z.indd 139
9/29/16 5:51 PM
140 | how america lost its secrets
tras identical copies of the NSA documents in Hong Kong. When
Green wald returned home to Rio de Janeiro, he found his copy was
corrupted. But Poitras still had her digital copy of whatever stolen
documents Snowden had distributed to them. So Greenwald dispatched
Miranda from Rio to Berlin to get a copy of Poitras’s thumb
drive. On the return trip, Miranda’s plane stopped at Heathrow,
where British authorities detained him and temporarily took the
thumb drive from him. Poitras had written out the password for
Greenwald, and Miranda kept it with the thumb drive. The British
copied the contents and shared them with the NSA. As a result,
the NSA discovered that Snowden had only given Poitras fifty- eight
thousand documents. The damage assessment team under Ledgett
determined that some of these documents had been edited out of
much larger documents that the NSA logs showed Snowden had
copied. By the count of both the NSA and the Defense Department
teams, almost one million documents were unaccounted for. What
happened to the missing documents?
The NSA investigation found that the chronology of the theft
of documents did not support Snowden’s claim to journalists that
he had only been seeking whistle- blowing documents. Most of the
documents he took first did not concern the domestic activities of the
NSA. Only toward the end of the theft did he copy documents that
would qualify as whistle- blowing. The court order to Verizon that
was the basis of the initial Guardian exposé was only issued by the
FISA court on April 27, 2013. The other main whistle- blowing document
he revealed, the PowerPoint presentation about PRISM, was
only issued in April 2013. Yet Snowden had been downloading documents
for at least nine months before he copied these documents.
When I discussed the chronology of the copied documents with
a former government official briefed on the investigation, he suggested
that Snowden’s purpose might have changed between 2012
and 2013. When I asked him what might have induced the change,
he replied, “That is one of the unanswered questions.” That Snowden
only took these two whistle- blowing documents at the tail end of
his nine- month operation, and after he had contacted Poitras and
Green wald, suggests he might have had another motive prior to
contacting journalists. In light of this chronology, the investigation
Epst_9780451494566_2p_all_r1.z.indd 140
9/30/16 11:09 AM
The Crime Scene Investigation | 141
had to consider the possibility that his whistle- blowing was, partly if
not wholly, a cover for another enterprise.
Snowden told journalists he had access to “millions of records
that [he] could walk out the door with at any time with no accountability,
no oversight, no auditing, the government didn’t even know
they were gone.” However, he was not among the limited number
of individuals at the center who had access to these documents.
Both the NSA’s and Booz Allen’s employment records showed that
Snowden had not yet completed his requisite on- the- job training
when he carried out the theft. Consequently, he had not yet been
provided with the passwords he needed to get the documents. Even
if he had remained at the NSA long enough to finish his training,
he would only have been provided with the password to the particular
compartment relevant to his work, not to all compartments. The
tight control over these passwords was, according to a former top
NSA official, a critical part of the NSA’s security framework. He told
me that Snowden, at least during the period of the thefts in April
and May 2013, had no more legitimate access to the compartments
than the cleaning personnel. Somehow, though, Snowden converted
his proximity to access.
If a hundred top- quality diamonds were stolen from locked vaults
at Tiffany by a recently hired trainee who, it turned out, did not have
the combination to open these vaults, the police would be expected to
consider that the trainee might have had help from a current or former
insider at the company who knew the combinations. Snowden,
who had accomplished a similarly inexplicable feat, said in his video
confession that he was solely responsible. However, it is perfectly
logical to assume, given the circumstances, that he might have had
help, unwitting or witting.
The FBI could assume either that the NSA’s security regime was
so badly flawed that Snowden could trick his fellow workers into
providing him with access or that there was another individual at
the center who might have assisted or directed Snowden. When the
investigation came to this fork in the road in the summer of 2013,
according to a source on the House Intelligence Committee, it chose
the former route.
Finally, there was the question of whether Snowden had gone to
Epst_9780451494566_2p_all_r1.z.indd 141
9/30/16 11:09 AM
142 | how america lost its secrets
Russia by design or by accident. Whenever an intelligence worker
steals sensitive compartmented information of interest to a foreign
adversary and then defects to that adversary, it raises at least the
specter of state- sponsored espionage. It is a commonly accepted presumption