in counterintelligence that a spy, fearing arrest, flees to
a country that has some reason to offer him protection. When the
British spies Guy Burgess, Donald Maclean, and Kim Philby fled to
Moscow during the Cold War, the presumption was that they had a
prior intelligence connection with Russia. Philby confirmed that in
his 1968 memoir, My Silent War. So in the case of Snowden, counterintelligence
had to consider the possibility that his theft of state
secrets and his arrival in Moscow might not be totally coincidental.
Snowden blamed high officials in the U.S. government who purposely
“trapped him” in Russia. He told the editor of The Nation,
“I’m in exile. My government revoked my passport intentionally to
leave me exiled” and “chose to keep me in Russia.” He repeated that
assertion over a dozen times, but as we’ve seen, it had no basis in
fact. Whenever criminal charges are lodged against a U.S. citizen by
the Department of Justice, the State Department, in accordance with
the U.S. code of justice, marks in the electronic passport validation
advisory system that that person’s passport is valid only for return
to the United States. After criminal charges were publicly filed
against Snowden on June 21, it advised foreign governments that
because Snowden was wanted on felony charges, he “should not be
allowed to proceed in any further international travel, other than is
necessary to return him to the United States.” Rather than “exiling”
Snowden, the government acted to facilitate his return home. With
his passport, he could have flown home from either Hong Kong or
Moscow, where he, like any other person accused of a felony, would
face the charges against him. Snowden’s unfounded claims suggested
to investigators that he had something to hide about his arrival in
Russia.
The counterintelligence investigation had access to State Department
records showing that its representatives in Hong Kong had
informed authorities there on June 16 that there were criminal
charges against Snowden. Only a typographical error in spelling out
Snowden’s middle name— James instead of Joseph— in the criminal
Epst_9780451494566_2p_all_r1.z.indd 142
9/29/16 5:51 PM
The Crime Scene Investigation | 143
charges prevented the Hong Kong police from immediately ordering
his detention. His Hong Kong lawyers were certainly advised of
these pending charges no later than June 21, when they were published
on the front page of the South China Morning Post in Hong
Kong. Presumably, Snowden knew that actions by the U.S. government
were already in progress and that one of these actions would
include restricting his passport. One of his lawyers, Jonathan Man,
even accompanied Snowden to the airport out of his concern that he
would not be allowed by Hong Kong authorities to go through passport
control. Ordinarily, Hong Kong passport control scans passports
when tourists exit but does not check them against a computerized
database.
In any case, when Snowden arrived in Russia on June 23, any
future international travel decisions for him would be up to the government
of Russia, not that of the United States. It could have sent
him back to Hong Kong, as is normally done when someone arrives
without a proper visa, or to the United States. The only government
with the actual means to “trap” him in Russia was the Russian
government.
Senior intelligence officials also knew that the U.S. government,
rather than conspiring to keep Snowden in Moscow, had met nearly
every day while he was in Hong Kong with Lisa Monaco, President
Obama’s homeland security adviser, in the White House Situation
Room to find a way to prevent Snowden and his cache of secrets
from falling into Russian hands. Robert S. Mueller III, then the FBI
director, reportedly even directly appealed to the FSB head, Alexander
Bortnikov, to return Snowden to the United States.
U.S. intelligence also knew that it was no accident that Snowden
wound up in the hands of Russia. He had been in contact with Russian
officials in Hong Kong. It will be recalled that Putin admitted to
this liaison on September 3, in a press briefing on state- owned Channel
One television; he also divulged that he had advance knowledge
of Snowden’s plan.
“I will tell you something I have never said before,” Putin said.
Snowden “first went to Hong Kong and got in touch with our diplomatic
representatives.” Putin was told then that an American “agent
of special services” was seeking to come to Russia. Putin added that
Epst_9780451494566_2p_all_r1.z.indd 143
9/29/16 5:51 PM
144 | how america lost its secrets
he declared that this agent would be “welcome, provided, however,
that he stops any kind of activity that could damage Russian- US
relations.”
Even before that public confirmation of the Russian role in Hong
Kong, the White House was well aware of it. On June 23, the Democratic
senator Charles Schumer of New York correctly said, based
on a White House briefing, that “Vladimir Putin had personally
approved Snowden’s flight” to Moscow. The NSA had the means to
monitor Russian communication between Moscow and Hong Kong.
The NSA also reportedly intercepted contacts between these Russian
officials and Russian representatives of Aeroflot, the Russian stateowned
airline that had flights between Hong Kong and Moscow.
Aeroflot (like most other international carriers) ordinarily requires
international passengers to have both a valid passport and, if necessary,
a visa to the country of their destination. Those rules had to
be waived for Snowden’s exfiltration from Hong Kong. Snowden’s
defection to Moscow was not a haphazard result of unexpected circumstances.
Russia obviously knew he was coming. This raised new
questions for the investigation. What led Snowden to defect to Russia?
Was his arrival in Moscow planned by Russian intelligence in
advance of his going public in Hong Kong? Was any other party,
such as China, privy to the plan? Was there a quid pro quo?
Putin’s authorization could certainly account for Aeroflot’s waiving
its usual passport and visa check to allow Snowden to board its
plane, as well as the dispatch with which Russian officials whisked
Snowden off the plane after it landed at the Moscow airport. It could
also account for Snowden’s vanishing from public view for the next
three weeks and the promulgation of the cover story that Snowden
was unwillingly trapped at the airport by the U.S. government. The
reasons behind Putin’s move were less clear.
By September 2013, the investigation was looking into a veritable
abyss. Snowden’s culpability was no longer an issue. What was
lacking from Snowden’s video, or the two- hour film made by Laura
Poitras, was any specific information on how many documents he
had copied, how he had obtained the passwords to the computers
on which they were stored, the period of time involved in the theft,
or how he had breached all the security measures of the NSA in
Epst_9780451494566_2p_all_r1.z.indd 144
9/29/16 5:51 PM
The Crime Scene Investigation | 145
Hawaii. Nor would that data be forthcoming from Snowden, who
may be the only witness to the crime. By June 23, he was in a safe
haven in Moscow. Even though the grand jury case against Snowden
was cut and dry, it was also irrelevant because the United States does
not have an extradition treaty with Russia.
The purpose of the intelligence investigation went far beyond
determining Snowden’s guilt or innocence, however. Its job was to
find out how such a massive theft of documents could occur, how the
perpetrator escaped, and, perhaps most urgent, who had obtained the
unaccounted- for stolen documents from Snowden.
In his interviews with journalists in Moscow, Snowden studiously
avoided describing the means by which he breached the security
aperture of America’s most secret intelligence service. He only told
the journalists who came to Moscow to interview him, with a bit of
pseudo- modesty, that he was not “an angel” who descended from
heaven to carry out the theft. But the question of how Snowden
stole these documents may be the most important part of the story.
The NSA, after all, furnishes communications intelligence to the
president, his national security advisers, and the Department of
Defense, intelligence that is supposedly derived from secret sources
in adversary nations. If these adversary nations learn about the
NSA’s sources, then the information, if not worthless, cannot be
fully trusted. The most basic responsibility of the NSA is to protect
its sources. Yet Snowden walked away with long lists of them.
In doing so, he amply demonstrated that a single civilian employee
working for an outside contractor, even one not having the necessary
passwords and other access privileges, could steal documents
that betrayed these vital sources. He also demonstrated that such a
massive theft could go undetected for at least two weeks.
If Snowden managed this feat on his own, as he claims in his
Hong Kong video, it suggests that any other civilian employee with
a perceived grievance against NSA practices or American foreign
policy could also walk away with some of the most precious secrets
held by U.S. intelligence. Such vulnerability extends to tens of thousands
of civilian contract employees in positions similar to the one
held by Snowden. The lone disgruntled employee explanation is
therefore hardly reassuring. If true, it calls into question the entire
Epst_9780451494566_2p_all_r1.z.indd 145
9/29/16 5:51 PM
146 | how america lost its secrets
multibillion- dollar enterprise of outsourcing the management of the
NSA’s computer networks and other technical work to outside contractors.
It also casts doubts on the post- 9/11 decision by the intelligence
community to strip away much of the NSA’s “stovepiping”
that previously insulated its most sensitive computers. Without
such stovepiping, any rogue civilian employee could bring down the
entire edifice of shared intelligence.
A finding that Snowden had acted in concert with others in breaching
compartments at the NSA would hardly be any more reassuring.
Such collaboration among intelligence workers would reflect gravely
on the mind- set of the NSA. Snowden described an atmosphere in
which intelligence workers exchanged lewd photographs of foreign
suspects. Some NSA employees met to protest the NSA policies. Did
this violation of the NSA’s rules also involve abetting the theft of
documents? If so, the NSA would have to evaluate further vulnerabilities
that might arise when it entrusts its secrets to technicians
who do not share its values. A collaborative breach would signal an
immense failure of the present concept of the counterintelligence
regime in the NSA.
From what I gathered from government officials who were familiar
with the investigation, there was a concern that answering the
“how” question would rouse serious doubts about the very ability
of the NSA to carry out its core mission of protecting the government’s
intelligence secrets. However it was organized, it was clear
that Snowden had played a major role in what amounted to a brilliant
intelligence coup.
Epst_9780451494566_2p_all_r1.z.indd 146
9/29/16 5:51 PM
c h a p t e r 15
Did Snowden Act Alone?
When you look at the totality of Snowden’s actions certainly one
hypothesis that jumps out at you, that seems to explain his ability
to do all these things, is that he had help and had help from
somebody who was very competent in these matters.
— general michael hayden, former director, NSA and CIA
A
whistle- blower enters the enterprise of stealing state
secrets for reasons of conscience, but so do many spies. Such
conscience- driven spies are called, in CIA parlance, “ideological
agents.” For instance, the British diplomat Donald Maclean, one
of the most important Russian spies in the Cold War, was an ideological
recruit. He stole immensely valuable U.S. nuclear secrets
for the Russian intelligence service without receiving any monetary
compensation.
The acceptance of money is not necessarily a meaningful distinction
when it comes to espionage. To be sure, many spies get
paid, but some whistle- blowers also receive a rich bounty for their
work. Indeed, under federal laws, whistle- blowers can qualify for
multimillion- dollar bounties for exposing financial malfeasance. The
whistle- blower Bradley Birkenfeld, for example, after he himself
was paroled from prison in 2012, received an award of $104 million
for providing data that exposed illicit tax sheltering at the Swiss UBS
bank. Assange also offered political whistle- blowers six- figure cash
Epst_9780451494566_2p_all_r1.z.indd 147
9/29/16 5:51 PM
148 | how america lost its secrets
bounties from money raised on the Internet. In 2015, for instance,
WikiLeaks offered $100,000 bounties to any whistle- blowers who
provided the site with secret documents exposing details of the
Trans- Pacific Trade Agreement.
Nor is acting alone necessarily a line that divides whistle- blowers
from spies. In many cases, whistle- blowers have accomplices who
help them carry out their mission. For example, in 1969, the celebrated
whistle- blower Daniel Ellsberg, a military analyst at the
Rand Corporation, had an accomplice, Anthony Russo, who had also
worked at Rand. (Both were indicted by the government.) Acting in
concert, they copied secret documents that became known famously
as the Pentagon Papers.
Whistle- blowers can also, like conventional spies, enter into elaborate
conspiracies to carry out an operation. On the night of March 8,
1971, eight whistle- blowers working together with burglary tools
broke into the FBI office in Media, Pennsylvania, and stole almost all
the FBI files there. The conspirators escaped and kept their identities
secret for over forty- two years.
Self- definitions also do not necessarily produce a distinction
between whistle- blowers and conventional spies. Consider Philip
Agee, who left the CIA in 1969 for what he described as “reasons
of conscience.” Specifically, he said he objected to the CIA’s covert
support of Latin American dictators. After contacting the Soviet
embassy in Mexico City, he defected to Cuba, where he leaked information
that exposed CIA operations. Although Agee insisted he was
a whistle- blower, and he adamantly denied offering any secrets to the
Soviet Union, the KGB viewed him as a conventional spy. According
to Oleg Kalugin, the top Soviet counterintelligence officer in the
KGB in Moscow, who defected to the United States, Agee offered
CIA secrets first to the KGB residency in Mexico City in 1973 and
then to the Cuban intelligence service. Agee provided the KGB with
a “treasure trove” of U.S. secrets, Kalugin revealed. “I then sat in
my office in Moscow reading the growing list of revelations coming
from Agee.” Despite this disparity, Agee still defined himself to the
public as a whistle- blower because he also had exposed CIA operations
to the public.
The Snowden case blurs the demarcation line even further. Unlike
Epst_9780451494566_2p_all_r1.z.indd 148
9/29/16 5:51 PM
Did Snowden Act Alone? | 149
other whistle- blowers who uncovered what they considered government
malfeasance by virtue of their jobs, Snowden, by his own
admission, took a new job in 2013 specifically to get access to the SCI
files concerning NSA sources that he stole from the Threat Operations
Center. Switching jobs in order to widen one’s access to state
secrets is an activity usually associated with penetration agents, not
whistle- blowers. While the technical distinction between a whistleblower
and a spy may still serve the media in the case of Snowden,
it does not help in solving the counterintelligence conundrum. A
complex theft of state secrets had been successfully carried out in
a supposedly secure site. The only known witness, Snowden, had
escaped to Russia, where he could be of no help in reconstructing the
crime for American intelligence agencies. The stolen data was kept
in the equivalent of sealed “vaults”— actually computer drives that
were not connected to the NSA network. If ever there was a lockedroom
mystery, this was it.
According to the FBI investigation, Snowden pierced these barriers
by using passwords that belonged to other people and using credentials
that allowed him to masquerade as a system administrator.
It was a feat that must have required meticulous planning.
To address such a mystery, a counterintelligence investigation
starts with a tabula rasa, stripping away all the previous assumptions,
including that Snowden was the lone perpetrator. It builds
alternative scenarios to test against the known facts. To be sure, scenario
building differs from that of a conventional forensic investigation
aimed at finding pieces of evidence that can be used to persuade
a jury in a courtroom. Unlike a judicial investigation concerned with
guilt and innocence, scenario building looks to develop a story that
is, concurrently, intrinsically consistent and humanly plausible, and
in the process it also identifies and explores the possible holes in the
case.
“Scenarios deal with two worlds: the world of facts and the world
of perceptions. They explore for facts but they aim at perceptions
inside the heads of decision makers. Their purpose is to gather and
transform information of strategic significance into fresh perceptions,”
wrote Pierre Wack in the Harvard Business Review in 1985.
Such scenarios must aim at constituting a limited set of mutually
Epst_9780451494566_2p_all_r1.z.indd 149
9/29/16 5:51 PM
150 | how america lost its secrets
exclusive alternatives. The point is to assure that any alternative that
fits the relevant facts, no matter how implausible it may initially
seem to be, is not neglected.
One of the most vexing problems that had to be explained by these
scenarios is how Snowden got the passwords to up to twenty- four of
these vaults. He could not have obtained these passwords during his
previous employment at Dell, because Dell technicians did not have
access to the Level 3 documents stored in these compartments. Nor,
as noted earlier, was he given access to them when he transferred to
Booz Allen, because he had not completed the requisite training.
Snowden had also, it will be recalled, relinquished his privileges as
a system administrator when he transferred to Booz Allen, so he did
not have the privilege to override password protection. In short, his
new position as an infrastructure analyst did not give him the ability
to enter compartments that he had not yet been read into.
As I’ve said, there are two possible ways he could have gotten
these passwords: either he had assistance from a party who had
access to them, or he found flaws in the NSA’s security procedures
that left the supposedly closed vaults effectively unlocked.
The Unwitting Accomplice Possibility
It is possible that if Snowden received assistance, it was entirely
unwitting. He might have obtained some passwords through deception,
such as tricking co- workers into typing their passwords into
a device that captured them. As the NSA informed Congress in
2014, three of his fellow workers told the FBI that Snowden might
have deceived them to gain access to their passwords. He could have
simply asked other analysts at the center who had been read into
compartments for their passwords. Such an approach would be
extremely risky for the analyst, who could lose his job and security
clearance by cooperating. It could also be risky for Snowden because
any analyst he approached was supposed to report any request for
a password to a security officer. Making such requests even more
suspicious, Snowden had been working at the Threat Operations
Center for just a few weeks as a trainee and was not well known to
Epst_9780451494566_2p_all_r1.z.indd 150
9/29/16 5:51 PM
Did Snowden Act Alone? | 151
other analysts there. “It is inconceivable to me that his co- workers
would divulge their passwords to him,” a former Booz Allen executive,
who had also worked at the Defense Intelligence Agency, told
me. “If he was a system administrator, he might trick a threat analyst
into entering his password into his computer under the pretext
that he needed it to deal with an urgent hardware issue.” But,
it will be recalled, Snowden was not a system administrator at the
center. Snowden therefore “had no plausible reason for requesting
passwords to compartments he had not been read into,” the former
executive said. He said that NSA executives might have been read
into all twenty- four of the compartments, but he deemed it inconceivable
they would illicitly share their passwords with Snowden. I
asked him what the chance was of his voluntarily obtaining some
twenty- four passwords from co- workers in five weeks. “In my opinion,
near zero,” he said.
It is possible of course that Snowden could have simply observed
others typing in their passwords, one by one, but that would take
time and possibly attract attention. I asked the former Booz Allen
contractor whether it was possible that Snowden could have used a
device for intercepting another computer’s electronic signals, called
by hackers a “key logger.” Such a device, which is obtainable over
the Internet, could be used to steal the passwords of the analysts
who had been read into the compartments. My source said that
while it was possible that Snowden smuggled in a key logger in his
backpack, it could not be operated unless it was hardwired to a computer
inside the center, because, like those at all other NSA facilities,
the computers had been insulated to block any form of wireless
transmission. This precaution was taken to guard against an EMP, or
electromagnetic pulse, attack by an enemy. The only way Snowden
could intercept keystrokes was to attach a cable from his key logger
to each of his fellow workers’ computers. In this scenario, he would
have had to surreptitiously build his own wired network connecting
his hidden key logger to twenty- four separate computers. Moreover,
he would have to do this wiring in an open- plan office where
he could not count on these additional wires, even if rigged one by
one, not being noticed by either other analysts in the room or the
“geek squad” of system administrators who regularly checked con-
Epst_9780451494566_2p_all_r1.z.indd 151
9/29/16 5:51 PM
152 | how america lost its secrets
nections. Making the task even more risky, according to my Booz
Allen source, there were closed- circuit cameras. The only way he
could mitigate the risk of detection was by having someone help
him build this network.
Even if Snowden had managed to obtain all the necessary passwords
from colleagues, he would have had to transfer the files to an
external storage device. This was not a matter of simply attaching
a thumb drive or other external device to a port, because, unlike in
movies such as Mission: Impossible, the ports on the computers at
the NSA were ordinarily sealed shut. This measure was taken specifically
to prevent any unauthorized downloading by NSA workers.
The only people at the center who had the authorization, and the
means, to open these ports and transfer data were system administrators,
according to the former Booz Allen executive. System
administrators needed to have this privilege to deal with glitches
in the computers. Snowden was no longer a system administrator
and had no such privileges. So again, he would have needed help.
He would have needed to either borrow a system administrator’s
credential or forge his own.
The credential he would need is called a public key infrastructure,
or PKI, card with its authentication code embedded in a magnetic
strip. When I asked the former Booz Allen executive if Snowden
possessed the skill set to forge such a card, he said that he strongly
doubted any NSA employee would be capable of such a forgery
without special equipment. Just asking such a favor could “set off
alarms,” my source said.
The unwitting accomplice scenario had another stumbling block:
time. We know from Poitras that Snowden told her in early April
2013 that he planned to deliver documents to her in six to eight
weeks (which he in fact did). But he had not yet started working for
Booz Allen at the center until that same month. It does not seem
plausible that in making such a commitment he was merely counting
on his ingenuity in the face of strangers to fulfill it. The only way
he could have known for certain that he would be able to borrow a
PKI card and obtain the passwords, whether by trickery, by observation,
or by a key router, before he had begun working at the center
was that he already knew someone there who would help him.
Epst_9780451494566_2p_all_r1.z.indd 152
9/29/16 5:51 PM
The Witting Accomplice Possibility
Did Snowden Act Alone? | 153
The witting accomplice scenario better fits with the principle in logic
called Occam’s razor, which suggests that when one is choosing
between alternative explanations, the one that requires the fewest
assumptions should be given priority. It would be relatively easy
to gain access to passwords if Snowden had the cooperation of an
insider at the center who had been read into the compartments or,
even better, if he had the cooperation of a system administrator with
the necessary PKI cards and shell keys to bypass the password protection.
Such an accomplice could also help explain how Snowden
was able to get the job at the center in the first place, how he knew
in advance that he could find there the “lists” of the NSA sources in
foreign countries, and how he knew that there were security traps at
the center. Such a witting accomplice might even have prepared in
advance the “spiders” that Snowden used to index the files.
The witting accomplice scenario of course requires an unsettling
expansion of the plot. It means Snowden collaborated with one or
more insiders at the center to steal secret documents. It is not difficult
to imagine, in light of the lax background checks for outside
contractors servicing the NSA, that there were others in the “geek
squad” who shared Snowden’s antipathy to NSA surveillance. Certainly,
we know that Snowden found other NSA workers who were
willing to attend his anti- surveillance CryptoParty in December
2012. Some might be willing to offer Snowden help if he was willing
to go public. Indeed, if the geek culture produced one Snowden, why
wouldn’t it produce others? If such an accomplice lacked Snowden’s
willingness to flee to another country, he might have limited his participation
to supplying technical assistance. For his part, Snowden
might have agreed to divert suspicion from his accomplice by taking
sole responsibility for the crime when he went public.
All of this is theoretically possible, but no witting accomplice was
ever identified. The FBI, which was in charge of the domestic part of
the investigation of the Snowden case, questioned all of Snowden’s
co- workers at the center over the course of six months and failed
to find anyone who knowingly helped Snowden. If the accomplice
was an idealistic amateur, it is likely the FBI would have found him.
Epst_9780451494566_2p_all_r1.z.indd 153
9/29/16 5:51 PM
154 | how america lost its secrets
Three co- workers did admit to the FBI, as noted earlier, that they
might have inadvertently given Snowden their passwords, but these
three slips would not account for Snowden’s breach of all the other
compartments. Of course, there might have also been less forthcoming
co- workers who hid their slips in divulging their passwords to
Snowden.
This raises the more sinister possibility that the accomplice
was not an amateur co- worker but a spy who was already in place
when Snowden arrived. Such a penetration agent could have been
recruited by an adversary intelligence service before Snowden came
on the scene. After Snowden expressed a desire to expose the NSA’s
domestic surveillance, it could then have used him as an “umbrella”
to hide its own activities. Finding such a means to protect a source
while exploiting his or her information is not uncommon in espionage
operations, and because Snowden was willing to flee America
and go public, he could serve as a near- perfect umbrella. “Snowden
may have carried out of the NSA many more documents than he
knew about,” Tyler Drumheller, the former CIA station chief, said. It
could also account for the disparity between the claims of Snowden
and the NSA damage assessment as to the number of documents
that were compromised.
As far- fetched as this scenario may seem, less than three years
before the Snowden breach the NSA had received a warning from
a CIA mole (to be discussed in greater detail later) that the Russian
intelligence service might have recruited a KGB mole at the Fort
Meade headquarters of the NSA. No mole was found in 2010, and
if one existed, it could not have been Snowden, who was working
for the NSA in Japan in 2010. Such a putative mole could conceivably
have acquired enough information to later facilitate Snowden’s
operation.
As Snowden acknowledges, he was not a happy worker at the
NSA. He complained in his posts over the Internet between 2010
and 2013 about superiors and what he considered NSA abuses to
co- workers. If someone assumed the guise of a reluctant whistleblower,
he would have little difficulty in approaching Snowden.
Snowden might not even know his true affiliation beyond that he
Epst_9780451494566_2p_all_r1.z.indd 154
9/29/16 5:51 PM
Did Snowden Act Alone? | 155
shared Snowden’s anti- surveillance views. If Snowden then voiced
an interest in exposing the NSA’s secrets, this person could supply
him with the necessary guidance, steering a still- unsuspecting
Snowden first to the Booz Allen position and afterward to his associates
in Hong Kong. By taking sole credit for the coup in the video
that he made with Poitras and Greenwald in Hong Kong, he acted, as
he told Greenwald, to divert suspicion from anyone else. This move
could also give any collaborator he might have had in Hawaii time
to cover his or her tracks.
The astronomer Carl Sagan famously said in regard to searching
the universe for signals from other civilizations that the “absence
of evidence is not evidence of absence.” That injunction also applies
to the spooky universe of espionage. The fact that a mole hunt fails
to find a hidden collaborator at the NSA does not necessarily mean
such a mole does not exist. Historically, we have many notable cases
in which Russian moles eluded long, intensive investigations. Robert
Hanssen penetrated the FBI for over twenty years for the KGB
without being caught. Similarly, Aldrich Ames acted as a KGB mole
in the CIA for more than ten years and passed all the CIA’s sophisticated
lie detector tests. Both Hanssen and Ames eluded intensive FBI
and CIA investigations that lasted over a decade. According to Victor
Cherkashin, their KGB case officer, whom I interviewed in Moscow
in 2015, the KGB was able to hide their existence from investigators
for such a long period partly because of the widespread belief in U.S.
intelligence that moles were fictional creatures that sprang from the
“paranoid mind” of James Jesus Angleton. When I then cited the
signature line from the movie The Usual Suspects, “The greatest
trick the devil ever pulled was convincing the world he didn’t exist,”
Cherkashin thinly smiled and said, “CIA denial [of moles] certainly
helped.”
In view of such past successes of the Russian intelligence services,
it cannot be precluded that there was another person in the NSA
working with the enthusiastic Snowden as cover to prevent any light
from falling on his own surreptitious spying. While it may seem
extremely unlikely that Snowden had such assistance, the alternative
scenario, that Snowden broke into the sealed compartments and
Epst_9780451494566_2p_all_r1.z.indd 155
9/29/16 5:51 PM
156 | how america lost its secrets
made off with the documents without any assistance, seems equally
unlikely.
Even if Snowden had been, as he claims, a pure idealist seeking
to right a perceived wrong, it does not exclude the possibility
of his becoming entangled in the plots of others. Intelligence services
make it their business to bring about such witting or unwitting
entanglements.
Epst_9780451494566_2p_all_r1.z.indd 156
9/29/16 5:51 PM
c h a p t e r 16
The Question of When
The NSA was actually concerned back in the time of the cryptowars
with improving American security. Nowadays, we see that
their priority is weakening our security.
— edward snowden, Moscow, 2015
In his 1974 novel, Tinker, Tailor, Soldier, Spy, John Le Carré
helped establish the concept in the public imagination of a mole
burrowing into a rival intelligence service. Le Carré’s now-classic
mole, code- named Gerald by the KGB, managed in the novel to gain
access to the inner sanctum of the British intelligence service MI6.
Aided and guided by his controllers in Moscow, he systematically
stole British intelligence secrets. As Le Carré wove the plot, the brilliantly
orchestrated operation involved spotting, compromising, and
recruiting others to gradually advance Gerald the mole to a position
of power. Such well- organized penetrations are not limited to fiction.
The career of the KGB mole Heinz Felfe, who was advanced through
the ranks of West German intelligence by an elaborate series of sacrifices
by his controllers in Moscow until he actually headed West
German counterintelligence in 1961, could have served as the nonfiction
inspiration for Le Carré’s 1963 novel, The Spy Who Came
in from the Cold. As U.S. intelligence only found out after the Cold
War ended, the KGB also had the ability to sustain moles for decades.
Epst_9780451494566_2p_all_r1.z.indd 157
9/29/16 5:51 PM
158 | how america lost its secrets
The CIA also had its share of long- term successes, such as Alexander
Poteyev, who fed the CIA secrets for over ten years while
burrowing into Russian intelligence. In the choreography of these
operations, as in Le Carré’s fiction, rival intelligence services ensnared
and sacrificed recruits, as if playing a chess game, to advance their
moles. Despite notable successes such as Felfe and Poteyev, a great
number of these elaborate conspiracies fail to insinuate a mole into
their adversaries’ confidence. Intelligence services therefore also
take advantage of a more prosaic source: the self- generated spy, or,
as they are called in the trade, a “walk- in.”
Although they are largely unsung in novels, these walk- ins are an
important part of espionage. A counterespionage review done for the
Presidential Foreign Intelligence Advisory Board (PFIAB) in 1990
found that most U.S. spies in the Cold War had taken documents on
their own volition and only afterward offered them to an adversary
service. Self- generated spies have diverse motives. Some intelligence
workers steal secrets for financial gain. Others take them to further
an ideological interest. As opportunistic enterprises, intelligence services
do not turn walk- ins away if they have valuable intelligence.
Indeed, some of the most successful moles were not recruited, or even
controlled, by spy agencies. They were self- generated penetrations,
or “espionage sources,” as the KGB preferred to call them, who first
stole secrets and later voluntarily delivered them to an adversary.
Hanssen, who successfully penetrated the FBI for the Russian
intelligence services from 1979 to 2001, according to the assessment
of a 2002 presidential commission, had caused “the worst intelligence
disaster in US history.” Eleven years later, George Ellard, a
former NSA inspector general who had been a member of that commission,
compared Hanssen with Snowden “in that they both used
very well- honed IT abilities to steal and disclose classified information
vital to our national security.”
It is also possible to exploit a walk- in even after he has left his
service. For example, the KGB major Anatoliy Golitsyn was an ideological
self- generated spy who walked into the U.S. embassy in Helsinki
on December 15, 1961. He asked to see the CIA officer on duty
and announced to him that he had collected a trove of KGB secrets,
including information that could identify its key spies in the West.
Epst_9780451494566_2p_all_r1.z.indd 158
9/29/16 5:51 PM
The Question of When | 159
He offered to defect to the United States. The CIA accepted his offer,
and through this archive of secrets he had previously compiled, he
became one of the CIA’s most productive sources in the Cold War.
The job of an intelligence service is to take advantage of whatever
opportunities come its way in the form of self- generated spies. If
a Russian walk- in had not yet burned his bridges to his own service,
U.S. intelligence officers were under instructions to attempt to
persuade the walk- in to return to his post in Russia and serve as a
“defector- in- place,” or mole. “While defectors can and do provide
critical information,” a CIA memorandum on walk- ins during the
Cold War noted, “there are very few cases in which the same individual
may not have been of greater value if he had returned to his
post.” Of course, if a walk- in believed he was already compromised,
as Golitsyn did, a decision would have to be made whether the value
of his intelligence merited exfiltrating him to the United States.
This required evaluating the bona fides of the walk- in. Not all
walk- ins are accepted as defectors. Some walk- ins are deemed “dangles,”
or agents dispatched by the KGB to test and confuse the CIA.
Others are rejected as political liabilities, as happened to Wang Lijun,
a well- connected police chief in China. In February 2012, Wang
walked into the U.S. consulate in Chengdu asking for asylum. The
State Department decided against it. After Wang left U.S. protection,
he was arrested for corruption and received a fifteen- year prison
sentence. Such decisions about walk- ins are not made without due
consideration, often at the highest level of a government, because
exfiltrating a defector can result in diplomatic ruptures and political
embarrassments.
Conversely, it raises espionage concerns when an adversary government
authorizes the exfiltration of a rogue employee of an intelligence
service. At minimum, it suggests that a rival government
placed value on what the defector could provide it. The Snowden
case is no exception. Whatever Snowden’s prior relations might have
been with Russia, it can be assumed that after he fled to Moscow,
in light of the intelligence value of the stolen documents, he would
wind up in the hands of the Russian security services. That assumption
was reinforced by subsequent countermeasures that were
implemented by adversaries moved to block secret sources of NSA
Epst_9780451494566_2p_all_r1.z.indd 159
9/29/16 5:51 PM
160 | how america lost its secrets
surveillance, as the CIA deputy director later revealed. Such moves
could indicate that at least part of the U.S. communications intelligence
that Snowden had stolen was in enemy hands. The CIA and
NSA’s monitoring of these countermeasures was itself extremely
delicate, because revealing what they learned about Russian and
Chinese countermeasures risked compromising even more U.S.
communications sources than had Snowden.
General Alexander said in his interview with The Australian
Financial Review, “We absolutely need to know what Russia’s
involvement is with Snowden.” He further said, “I think Snowden
is now being manipulated by Russian intelligence. I just don’t know
when that exactly started.” At what point did Snowden first come in
contact with the Russians? The counterintelligence issue was not if
this U.S. intelligence defector in Moscow was under Russian control
but when he came under it.
There were three possible time periods when Snowden might
have been brought under control by the Russian intelligence service:
while he was still working for the NSA; after he arrived in Hong
Kong on May 20, 2013; or after he arrived in Russia on June 23,
2013.
The NSA Scenario
The first scenario could stretch as far back as when Snowden was
forced out of the CIA in 2009. It will be recalled that the CIA had
planned to launch a security investigation of Snowden, but it was
aborted when he resigned. He had also incurred large losses speculating
in the financial markets in Geneva, which is the kind of activity
that had in the past attracted the interest of foreign intelligence
services. So it has to be considered in this scenario that Snowden had
been recruited by the Russians after he left the CIA and directed to
take jobs at civilian contractors servicing the NSA.
Such “career management,” as it is called by the CIA, could
explain why Snowden had switched jobs in March 2013 to Booz
Allen Hamilton, which, unlike his previous employer, Dell, allowed
Epst_9780451494566_2p_all_r1.z.indd 160
9/29/16 5:51 PM
The Question of When | 161
him to gain proximity to the super-secret lists of the telecommunications
systems that the NSA had penetrated in Russia and China.
This could account for how he managed to acquire the necessary
passwords to accrue privileged information. It could also account for
why the documents he copied that pertained to NSA operations in
Russia were not among those he gave to Poitras, Greenwald, and
other journalists. Because Russia has had an active intelligencesharing
treaty with China since 1996, it could further explain why
his first stop was Hong Kong, a part of China. It was a safe venue for
debriefing Snowden, as well as establishing his credentials among
journalists as a whistle- blower, before a decision was made to allow
him to proceed to Russia.
The nearly fatal problem with this early recruitment scenario is
Snowden’s contacts with journalists. Snowden, it will be recalled,
had contacted Greenwald in December 2012. Greenwald was a highprofile
blogger in Brazil who did not use encryption or any security
safeguards. Next, he contacted Poitras in January 2013 in Berlin;
she was a magnet for NSA dissidents. Both of these contacts put
Snowden’s clandestine downloading at grave risk. As known opponents
of U.S. intelligence agencies, these journalists might be, as they
themselves suspected they were, under surveillance by American,
British, Brazilian, or German intelligence services. Greenwald and
Poitras might also tell others who were either under surveillance or
informers. So no matter what precautions Snowden took, his secret
enterprise, or just the fact he was in contact with anti- government
activists, might be detected. At minimum, he could lose his access to
secrets and be of no further use as a source at the NSA. He could also
be interrogated and reveal the way he was brought under control. If
Snowden had actually been under the control of the Russian intelligence
service, the last thing it would allow was for him to take such
a risk— or even to contact a single journalist. After all, the purpose
of an espionage operation is to steal secrets without alerting anyone
to the theft.
A former CIA officer told me that while anything could “go haywire”
in an intelligence operation, it would be “unthinkable” that
the Russian intelligence service would permit an undercover source
Epst_9780451494566_2p_all_r1.z.indd 161
9/29/16 5:51 PM
162 | how america lost its secrets
it controlled in the NSA to expose himself by contacting journalists.
Snowden’s continued interactions with Poitras and Greenwald make
it implausible that he was under Russian control before he went to
Hong Kong.
The Hong Kong Scenario
The most compelling support for the scenario that Snowden was
brought under Russian control while he was in Hong Kong comes, it
will be recalled, from Vladimir Putin. His disclosure about the case
leaves little doubt that Russian officials had engaged Snowden in
Hong Kong, that Putin had authorized his trip to Moscow, and that
the Russian government allowed him to fly to Moscow without a
Russian visa. We know that Putin’s version is supported by U.S. surveillance
of Snowden’s activities in Hong Kong. We also know that
the Russians went to some lengths not only to facilitate his trip to
Moscow but to arrange to keep him in Russia. This supports the
possibility that the Russian intelligence service managed to bring
Snowden under its sway during his thirty- four days in Hong Kong.
The Russian intelligence service might even have been aware
of Snowden and his anti- NSA activities before his arrival on May
20. Snowden was anything but discreet in his contacts with strangers
in the anti- surveillance movement, including such well- known
activists as Runa Sandvik (to whom he revealed his true name and
address via e- mail), Micah Lee, Jacob Appelbaum, Parker Higgins,
and Laura Poitras. “It is not statistically improbable that members of
this circle were being watched by a hostile service,” a former NSA
counterintelligence officer told me in 2015. When I told him that
Poitras and others in her circle had used PGP encryption, aliases,
and Tor software in their exchanges with Snowden, he said, arching
his eyebrows, “That might work against amateurs, but it wouldn’t
stop the Russians if they thought they might have a defector in the
NSA.” He explained that both the NSA and hostile services have the
“means” to bypass such safeguards.
I asked what the Russian intelligence service would have done if
it had indeed spotted Snowden in late 2012 or early 2013. “Maybe
Epst_9780451494566_2p_all_r1.z.indd 162
9/29/16 5:51 PM
The Question of When | 163
just research him,” he replied. As we know now, he pointed out, Russia
and China probably had access to the 127- page standard form in
his personnel file that he updated in 2011. They also had the capability
to track his air travel to Hong Kong. “Could someone have
steered him to Hong Kong?” I asked. He answered, with a shrug,
“That depends on whether Snowden had a confidante who could
have influenced him.”
Whenever adversaries became aware of Snowden in this scenario,
it was not until after he copied the NSA secrets and took them with
him to Hong Kong that Russian intelligence officers offered him a
deal. So from the Russian point of view, Snowden had already burned
his bridges. Because he had used other people’s passwords and access
privileges to get into computers that he was not authorized to use,
illegally moved documents, and given a false reason for his medical
leave, it was only a matter of time, as he told Greenwald in his
interview in Hong Kong, before NSA investigators would identify
him as a possible spy. He could be of no further use at the NSA to an
adversary. His intelligence value now lay in the documents he had
taken with him or stored in the cloud as well as his ability to help
clarify them in debriefing sessions. He could also inflict damage on
the morale and public standing of the NSA by denouncing its spying
in the media.
Once Snowden was in Hong Kong, the Russians would have no
reason to restrain him from holding a press event or releasing a
video. In fact, the KGB had organized press conferences for all the
previous NSA defectors to Moscow. Hong Kong was a perfect venue
for a well- staged media event because all the major newspapers in
the world had bureaus there. Snowden’s disclosures about NSA spying
could serve to weaken the NSA’s relations with its allies.
It is also possible that Russian or Chinese intelligence did not
become aware of Snowden until after he went public in June by
having The Guardian release his video. The video would have convinced
the Russians or the Chinese of how dissatisfied Snowden was
with the NSA. Because dissatisfaction is one of the classic means of
recruitment in the intelligence business, he would certainly become
a prime target for recruitment after he went public.
The CIA also considered the possibility that Snowden might
Epst_9780451494566_2p_all_r1.z.indd 163
9/29/16 5:51 PM
164 | how america lost its secrets
have been reeled in unwittingly. Morell suggested in his book that
Snowden might not himself have fully realized “when and how he
would be used.”
It can be safely assumed that the decision made by Putin’s intelligence
service to allow Snowden to travel to Russia proceeded from
something other than softhearted sentiment about his welfare. After
Putin learned that there was an American in Hong Kong from the
“special services” seeking to come to Russia, he also learned from
Snowden’s own disclosure on the video released that Snowden had
taken a large number of NSA documents to Hong Kong: indeed,
some were shown on the video. After that self- outing by Snowden,
Putin had plenty of time to calculate the advantages and disadvantages
of allowing him to come to Moscow.
Putin could offer him not only freedom from arrest but also a
platform to express his views. The exploitation of an intelligence
defector, even after he yields his secrets, can be the final stage of
a successful intelligence operation. The CIA considered one of its
greatest coups of the Cold War its release of the espionage- acquired
secret speech of Nikita Khrushchev to the Communist Party of the
Soviet Union in 1956 exposing the transgressions of the previous
regime of Joseph Stalin. Making public these deeds was meant by
the CIA to sow discord both inside the Soviet Union and to disrupt
its relations with its allies. General Alexander suggested that Putin
might similarly be “looking to capitalize on the fact that [Snowden’s]
actions are enormously disruptive and damaging to US interests.”
This potential gain, if Alexander’s assessment is correct, provided
Putin with an additional reason to have his representatives in Hong
Kong offer Snowden exfiltration.
Snowden was in no position to refuse. After the release of the
video, there was no going back to America without his facing a
determined criminal prosecution. He would have known that in
almost every prior case intelligence workers who had intentionally
released even a single classified document had gone to prison. As his
Internet postings show, he had closely followed the ordeal of Bradley
Manning, whose trial was coming to its conclusion while Snowden
was in Hong Kong. Manning had been kept in solitary confinement
Epst_9780451494566_2p_all_r1.z.indd 164
9/29/16 5:51 PM
The Question of When | 165
under horrific conditions for over a year while awaiting his trial and
was facing a long prison sentence. There was no reason for Snowden
to expect a better outcome for himself if he returned to the United
States or was arrested anywhere else that had an extradition treaty
with the United States. As the Russian officials in Hong Kong would
have informed him, Russia had no extradition treaty with the United
States. It was also one of the few places in the world that he could
reach from Hong Kong without flying through airspace in which he
might be intercepted by a U.S. ally. Snowden was told he could take
the direct Aeroflot flight to Moscow without a valid passport or visa.
That Snowden’s alternative to going to Russia was going to prison
gave the Russians considerable leverage in Hong Kong. The Russian
“diplomats” could have used this leverage to extract a quid pro
quo. The price of admission might have meant putting himself in the
hands of Russian intelligence and telling it all he knew.
The Moscow Scenario
The final possibility is that Snowden did not come under Russian
control until after he arrived in Moscow. After assessing the negative
attitude that Snowden expressed toward government authority
on the video that was released by The Guardian, the Russian “diplomats”
in Hong Kong might have concluded that Snowden could bolt
if too much pressure was exerted on him there. The Russians could
afford to be patient. They knew that Interpol and the United States
would be pursuing Snowden throughout the world and that he had
no valid travel documents and that his credit cards had been frozen.
They would likely know that Sarah Harrison had arranged his flight
to Moscow on June 23. So they had no urgent need to apply pressure
on him before his plane landed in Russia.
After the Russians took him in a “special operation” from the
plane at the airport, he was informed by Russian authorities that
he would not be allowed to go to Cuba, Venezuela, Iceland, Ecuador,
or any other country without the permission of Russian officials,
which would not be immediately forthcoming. He was now at the
Epst_9780451494566_2p_all_r1.z.indd 165
9/29/16 5:51 PM
166 | how america lost its secrets
mercy of the Russian authorities. There was good reason for keeping
him in a virtual prison in Russia. “He can compromise thousands
of intelligence and military officials,” Sergei Alexandrovich Markov,
the co- chairman of the National Strategic Council of Russia and an
adviser to Putin, pointed out. “We can’t send him back just because
America demands it.”
So Snowden was consigned to the transit zone of the airport,
which is a twilight zone neither inside nor outside Russia, a netherworld
that extends beyond the confines of the airport to include safe
houses and other facilities maintained by the FSB for the purposes
of interrogation and security. Stranded at the Moscow airport, no
matter what he had believed earlier in Hong Kong, Snowden would
quickly realize that he had only one viable option: seeking protection
in Russia.
Even though the FSB is known by U.S. intelligence to strictly
control the movements and contacts of former members of foreign
intelligence services in Russia, Snowden might not have realized the
full extent of the FSB’s interest in him. He naively told The Washington
Post in December 2013, in Moscow, “I am still working for
the NSA right now. They are the only ones who don’t realize it.”
Whatever he might have been thinking, a former U.S. communications
intelligence worker who stole American state secrets, such as
Snowden, would be under the FSB’s scrutiny.
Andrei Soldatov, the co- author of the 2010 book The New Nobility:
The Restoration of Russia’s Security State and the Enduring
Legacy of the KGB, who was personally knowledgeable about
FSB procedures, explained the FSB would monitor “every facet of
Snowden’s communications, and his life.” General Oleg Kalugin,
who, as previously mentioned, defected from the KGB to the United
States in 1995, added that the FSB (following the standard operating
procedures of the KGB) would be “his hosts and they are taking care
of him.” Kalugin further said in 2014, “Whatever he had access to in
his former days at NSA, I believe he shared all of it with the Russians,
and they are very grateful.” This assessment was backed by Frants
Klintsevich. As the first deputy chairman of the Kremlin’s defense
and security committee at the time of Snowden’s defection, he was
Epst_9780451494566_2p_all_r1.z.indd 166
9/29/16 5:51 PM
The Question of When | 167
in a position to know Snowden’s contribution. “Let’s be frank,” he
said in a taped interview with NPR (in Russian), “Snowden did share
intelligence. This is what security services do. If there’s a possibility
to get information, they will get it.”
Even without Klintsevich’s comments, top American intelligence
officers had little doubt that the Russian security services would do
their job. Michael Hayden, for example, who in succession headed
three American intelligence services, was certainly in a position to
appreciate the capabilities of the Russian and Chinese intelligence
services. He told me in 2014 that he saw no other possibility than
that Snowden would be induced to cooperate in this situation, saying,
“I would lose all respect for the Russian and Chinese security
services if they haven’t fully exploited everything Snowden had to
give.” They certainly had that opportunity when Snowden spent
almost six weeks at Sheremetyevo International Airport. The FSB
controlled his access to food, lodgings, the Internet, and whatever
else he needed to survive there. If he did not cooperate, the FSB
could also return him to the United States, where in the eyes of the
Department of Justice he had betrayed the United States by stealing
secrets and taking them abroad. What recourse did Snowden have?
In a word, the FSB held all the cards but one— Snowden’s help with
the stolen documents. Even if Snowden disliked the tactics of the
Russian security services, he now had a powerful inducement not to
decline the requests of the Russian authorities.
Two weeks after his arrival, the Russian authorities provided him
with a convenient path to full cooperation with Russia. He was put
in contact with Anatoly Grigorievich Kucherena, a silver- haired,
fifty- two- year- old lawyer who is known to be a personal friend of
Putin’s. Kucherena did tasks for Putin’s party in the Russian parliament,
or Duma. He had excellent connections in the Russian security
apparatus because he served on the oversight committee of the
FSB. Kucherena offered to serve as Snowden’s pro bono lawyer. On
July 12, Snowden officially retained him as his legal representative in
Moscow. In explaining the relationship, Kucherena said, “Officially,
he is my client, but at the same time, I provide a number of other
services to him.” According to Kucherena, Snowden turned down
Epst_9780451494566_2p_all_r1.z.indd 167
9/29/16 5:51 PM
168 | how america lost its secrets
all requests to meet with any representative of the U.S. embassy in
Moscow. From that point on, he would act as Snowden’s go- between
with the FSB and other Russian agencies.
At the outset, Kucherena made it clear to Snowden that he would
have to play by Moscow’s rules before the Kremlin would grant him
permission to stay in Russia. To begin with, Snowden had to withdraw
any applications he had made elsewhere for asylum. He had to
put his fate entirely in the hands of Putin’s Russia. He would also
have to be fully candid with the Russian authorities on what was of
great value to Putin: the secret documents he had acquired.
Eighteen days later, Snowden received Russian identification
papers that allowed him to resettle in Moscow. He was provided
with a residence and allowed to set up a broadcasting studio in it
that he could use for Internet appearances at well- attended events
around the world, such as South by Southwest and TED. Snowden
was, according to Kucherena, also furnished with bodyguards. To
help earn his keep, he was said by Kucherena to be employed at an
unidentified Moscow cyber- security firm. To complete his resettlement,
Lindsay Mills, whom he had left behind in Hawaii, was given
a three- month visa and was allowed to temporarily live with him in
Moscow. This afforded him a lifestyle that Snowden described in an
interview as “great.”
It would strain credibility that such privileges would be awarded to
an intelligence defector who had refused to cooperate with Russian
authorities. In Snowden’s case, he was even allowed to participate in
Putin’s telethon on state- controlled television. On it, he was called
on to ask Putin if the Russian government violated the privacy of
Russian citizens in the same way that the American government
violated the rights of its citizens. Putin, smiling at Snowden’s presumably
vetted question, answered in a single word: “No.”
In the Moscow scenario, the Russians acted to advance their interests.
They gave Snowden sanctuary, support, perks, and high- level
treatment because he agreed to cooperate with them. If Snowden
had not paid this basic price of admission, either in Russia or before
his arrival, he would not have been accorded this privileged status.
Epst_9780451494566_2p_all_r1.z.indd 168
9/29/16 5:51 PM
c h a p t e r 17
The Keys to the Kingdom
Are Missing
There’s a zero percent chance the Russians or Chinese have
received any documents.
— edward snowden, Moscow, 2013
A
critical missing piece in the Snowden enigma is the whereabouts
of the NSA documents. Greenwald told the Associated
Press that the documents that Snowden had taken from the NSA
constituted “the instruction manual for how the NSA is built” and
that they “would allow somebody who read them to know exactly
how the NSA does what it does, which would in turn allow them to
evade that surveillance or replicate it.” Snowden, for his part, said on
camera in his Hong Kong interview in June 2013 that NSA investigators
would have “a heart attack” when they discovered the extent
of the breach.
Ledgett, the NSA official who had conducted the damage assessment,
while not having a heart attack, confirmed that Snowden had
taken a massive number of documents and among them was what
he deemed the NSA’s “keys to the kingdom.” These keys could presumably
open up the mechanism through which the United States
learns about the secret activities of other nations and, by doing so,
bring down the American signals intelligence system that had for
Epst_9780451494566_2p_all_r1.z.indd 169
9/29/16 5:51 PM
170 | how america lost its secrets
sixty years monitored government communications. It had also kept
track of adversaries’ missile telemetry, submarine movements, and
nuclear proliferation.
The Snowden breach was not without precedent at the NSA.
There had been two Russian spies at the NSA during the Cold
War, Jack Dunlap and David Sheldon Boone, who took a limited
number of documents, but no one since the end of the Cold War
is known to have taken a single NSA classified document. Now an
insider had removed a vast number of the NSA’s documents. Many
of these documents were classified TS/SCI— “Top Secret, Sensitive
Compartmented Information”— which, as NSA secrets went, were
deemed the gold standard of espionage because they revealed the
sources used in communications intelligence. Whatever the assessment
of Snowden’s motivation, the single question that needed to be
answered was, what happened to these stolen files?
Recall the huge disparity between the number of documents that
the NSA calculated that Snowden compromised and the number of
documents he is known to have handed over to journalists in Hong
Kong on a thumb drive. When the House and Senate Intelligence
Committees asked the NSA how many documents Snowden took,
the NSA could not come up with a definitive number despite having
employed a world- class team of experts to reconstruct the crime. The
NSA could say that 1.7 million documents had been selected in two
dozen NSA computers during Snowden’s brief tenure at Booz Allen
in 2013, including documents from the Department of Defense, the
NSA, and the CIA. Of these “touched” documents, some 1.3 million
had been copied and moved to another computer.
There was evidence that Snowden had used preprogrammed spiders
to find and index the documents. He had said that he took the
job at Booz Allen to get access to data that he copied. So as far as the
NSA was concerned, of course, the 1.3 million documents he copied
and moved were considered compromised. On top of this haul,
Snowden had copied files while working at Dell in 2012. As a system
administrator there, he could download data without leaving a
digital trail. As previously mentioned, more than half the documents
actually published in newspapers had been taken during Snowden’s
time at Dell.
Epst_9780451494566_2p_all_r1.z.indd 170
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 171
Snowden’s supporters do not accept that he stole such a large number
of documents. According to Greenwald, the NSA vastly exaggerated
the magnitude of the theft in order to “demonize” Snowden.
Snowden also disputed the magnitude of the 1.7 million number. He
told James Bamford of Wired in early 2014 that he took far fewer
than the 1.7 million documents that the NSA reported were compromised.
He offered, however, no more specific details on the magnitude
of his theft. Nor did he offer Bamford any way to verify his
assertion other than to say that he had purposely left behind “a trail
of digital bread crumbs” at the NSA base in Hawaii so that the NSA
could determine which documents he “touched” but did not download.
A government official familiar with the investigation said no
such “bread crumbs” were found by the NSA.
It is possible that the NSA Damage Assessment team under Ledgett
falsified its findings or otherwise inflated the number of documents
that Snowden stole. NSA executives might have also lied
to Congress to exaggerate the loss. But why would these officials
engage in an orchestrated deception that made them look bad? Exaggerating
the magnitude of the theft would only magnify Ledgett and
the NSA’s failure in its mission to protect U.S. secrets.
Officials had no reason to demonize Snowden for legal reasons.
He already had been. Greenwald and Poitras had already revealed
that Snowden had given them a vast number of NSA classified documents
on a thumb drive that revealed, as Greenwald put it, the “blueprints”
of the NSA. This drive contained, it will be recalled, no fewer
than 58,000 highly classified documents. In the eyes of the law, that
constituted an unprecedented breach of the laws passed to protect
communications intelligence. In any case, in Russia Snowden was
not in any jeopardy, no matter how many documents he was said to
have stolen. Interestingly, the thirty- five- page Defense Intelligence
Agency’s damage assessment reports that 900,000 Pentagon documents
compromised by Snowden were not made public. That was
only disclosed via a Vice magazine Freedom of Information request
in June 2015.
Many of the putative 1.3 million documents that the NSA says
were copied and moved were duplicate copies. Others were outdated
or otherwise useless routing data. So the quantity does not tell the
Epst_9780451494566_2p_all_r1.z.indd 171
9/29/16 5:51 PM
172 | how america lost its secrets
whole story. Of far more importance is the quality of some of the
data that Snowden had copied. Just a single one of these documents
could cripple not just the NSA but America’s entire multibilliondollar
apparatus for intercepting foreign intelligence. The previously
cited road map, which was thirty- one thousand pages long, listed
critical gaps in U.S. coverage of China, Russia, and other adversaries,
including those cited by President Obama’s national security team.
It was not found among the files on the thumb drive given to Poitras
and Greenwald. Nor were most of the missing Level 3 lists concerning
NSA activities in Russia and China found on the thumb drive,
even though Snowden said he had taken his final job at Booz Allen
to get access to these lists. If Snowden had not given these documents
to Poitras, Greenwald, or other journalists, where were they?
The compartment logs showed that Snowden copied and transferred
these Level 3 documents in his final week at the NSA. He
presumably had them in his possession in Hong Kong when he
arrived on May 20. On June 3, according to Greenwald, Snowden
was still sorting through the documents to determine which ones
were appropriate to give to journalists. On June 12, he told the
reporter Lana Lam in Hong Kong that he was going through the
documents, country by country, to determine which additional ones
he should pass on to journalists. Eleven days later, he departed Hong
Kong for Moscow carrying at least one laptop computer. After arriving
in Moscow, he suggested he still had NSA secrets in his possession.
“No intelligence service— not even our own— has the capacity
to compromise the secrets I continue to protect,” he wrote to the
former senator Gordon Humphrey. “I cannot be coerced into revealing
that information, even under torture.” Much of the material he
copied while working at Booz Allen remained, as far as the NSA
could determine, missing. Had he brought these files under his “protection”
to Russia?
An answer soon came from Snowden’s Moscow lawyer. On September
23, Anatoly Kucherena was extensively interviewed on the
RT channel in Russia. The interviewer, Sophie Shevardnadze, who
had a show called SophieCo, was a well- admired journalist. She is
the granddaughter of Eduard Shevardnadze, a former foreign minis-
Epst_9780451494566_2p_all_r1.z.indd 172
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 173
ter and Politburo member of the Soviet Union and, after the Soviet
Union broke up, the first president of Georgia. Even though she had
interviewed many top political figures in Russia, obtaining an hourlong
interview with Kucherena was a coup because, until then, he
had not discussed Snowden in a television interview.
About halfway through the interview, Shevardnadze brought
up the highly sensitive subject of the disposition of the NSA documents.
If anyone was in a position to know about these documents,
it was Kucherena. He had acted as an intermediary for Snowden
in his negotiations with Russian authorities, including the FSB. As
such, he would be privy to the status of the secret material that was
of interest to the Russian intelligence services. When I interviewed
Kucherena in Moscow in 2015, he told me that “all the reports” concerning
Snowden had been turned over to him by “Russian authorities”
in July 2013. “I had all of Snowden’s statements,” he said. If so,
he presumably knew what Snowden had told the Russian security
services.
Had Snowden come to Russia with empty hands or bearing gifts?
Shevardnadze directly asked Kucherena if Snowden had given all
the documents he had taken from the NSA to journalists in Hong
Kong. Kucherena answered her question without any evasion, saying
that Snowden had only given “some” of the NSA’s documents in
his possession to journalists in Hong Kong. He had kept the remaining
documents in his possession. That confirmed what Snowden had
told Greenwald, Poitras, and Lam in Hong Kong. Snowden told them
that he had divided the stolen NSA documents into two separate sets
of documents. One set he gave to Poitras and Greenwald on thumb
drives. The other set, which he told them he considered too sensitive
for these journalists, he retained for himself. U.S. investigators
at the NSA, the CIA, and the Department of Defense would like to
know what Snowden did with the set of documents he had retained
for himself and had not shared with the journalists in Hong Kong.
Shevardnadze, who makes it a point to drill her interviewees,
pressed Kucherena as to whether Snowden still had these NSA files,
or “material,” in Russia. The dialogue went as follows (from the
transcript supplied to me by Shevardnadze).
Epst_9780451494566_2p_all_r1.z.indd 173
9/29/16 5:51 PM
174 | how america lost its secrets
shevardnadze: So he [Snowden] does have some materials that
haven’t been made public yet?
kucherena: Certainly.
Shevardnadze asked the next logical question: “Why did Russia
get involved in this whole thing if it got nothing out of it?”
“Snowden spent quite a few years working for the CIA. We haven’t
fully realized yet the importance of his revelations.” Kucherena was
on the FSB’s public oversight board. He was clearly in the picture.
Kucherena’s answer was completely consistent with the statement
Snowden made three weeks after arriving in Russia in his previously
mentioned e- mail to Senator Humphrey.
It is certainly possible that Snowden transferred the NSA files
from his own computers and thumb drives to storage on a remote
server in the cloud before coming to Russia. The “cloud” is actually
not in the sky but a term used for remote storage servers, such as
those provided by Dropbox, Microsoft, Google, Amazon, and other
Internet companies. Anyone who is connected to the Internet can
store and retrieve files by entering a user name and a password.
For Kucherena to be certain Snowden had access to the so- farunrevealed
data, Snowden must have demonstrated his access either
to him or to the authorities. The Russians obviously knew Snowden
had the means to retrieve this data one way or the other. Because the
data concerned electronic espionage against Russia, the FSB would
have been keen to obtain the documents, and the FSB is not known
to take no for an answer in issues involving espionage.
Even if Snowden refused to furnish his key encryption, according
to a former National Security Council staffer, the Russian cyber
service in 2013 had the means, the time, and the incentive to break
the encryption. It is unlikely it would have had to go through the
trouble. It doesn’t take a great stretch of the imagination to conclude
that, willingly or under duress, Snowden shared his access to his
treasure trove of documents with the agencies that were literally in
control of his life in Russia.
Kucherena’s answer on the television program may also help to
explain Putin’s decision to allow Snowden to come to Moscow. It
was not a minor sacrifice for Putin. His foreign minister, Sergei Lav-
Epst_9780451494566_2p_all_r1.z.indd 174
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 175
rov, had spent almost six months negotiating with Hillary Clinton’s
State Department a one- on- one summit between President Obama
and President Putin. Not only would this summit be a diplomatic
coup for Russia, but also it would add to Putin’s personal credibility
in advance of the Olympic Games in Russia. In mid- June, after
U.S. intelligence reported to Obama’s national security adviser that
Snowden was in contact with Russian officials in Hong Kong, the
State Department explicitly told Lavrov that allowing Snowden
to defect to Russia would be viewed by President Obama as a blatantly
unfriendly act. As such, it could (and did) lead to the cancellation
of the planned summit. Putin knew the downside of admitting
Snowden.
But if Snowden had a large archive of files containing the sources
of the NSA’s electronic interceptions, as Snowden claimed he had in
Hong Kong, there was an enormous potential intelligence upside.
Putin had to choose between the loss of an Obama summit and
an intelligence coup. Would Putin have made the choice he did if
Snowden had destroyed, or refused to share, the stolen data?
“No country, not even the United States, would grant sanctuary
to an intelligence defector who refused to be cooperative,” answered
a former CIA officer who had spent a decade dealing with Russian
intelligence defectors. “That’s not how it works.” If so, it seems plausible
to believe that, as Kucherena said, the documents Snowden
brought to Russia explain why Russia exfiltrated him from Hong
Kong and provided him with a safe haven.
The Quickly Changing Narrative
Three weeks after Kucherena’s appearance on Shevardnadze’s show,
on October 17, Snowden had his first interview exchange with a
journalist since his arrival in Russia. It was over the Internet with
James Risen of The New York Times, as noted earlier. Snowden now
asserted a very different narrative. The subsequent front- page story,
which carried the headline “Snowden Says He Took No Secret Files
to Russia,” reported that Snowden claimed he gave all his documents
to journalists in Hong Kong and brought none of them to Russia. He
Epst_9780451494566_2p_all_r1.z.indd 175
9/29/16 5:51 PM
176 | how america lost its secrets
also said that he was “100 percent” certain that no foreign intelligence
service had had access to them at any point during his journey
from Honolulu to Moscow. When I later asked Kucherena in Moscow
why Snowden changed his story in direct contradiction of what
Kucherena had stated, he said, “Wizner.”
He was referring to Ben Wizner, Snowden’s ACLU lawyer in
Washington, D.C. Wizner had joined the ACLU in August 2001
after graduating from NYU Law School and clerking for a federal
judge. At the ACLU, he became an effective foe of NSA surveillance.
“I had spent ten years before this [Snowden leak] trying to bring
lawsuits against the intelligence community,” he explained in an
interview with Forbes in 2014. Prior to the Snowden leak, he had
frequently been consulted by Poitras on government surveillance
issues (and appeared in Poitras’s 2010 documentary, The Oath). He
had also been engaged in a lawsuit aimed at exposing the NSA’s subpoenas
for Verizon records.
He had first learned about Snowden from Poitras in January
2013 while Snowden was still working for Dell at the NSA base in
Hawaii. At that time, Poitras did not know Snowden’s real name, but
she informed Wizner that she was in touch with a person identifying
himself as a senior officer in U.S. intelligence. (Poitras did not
know at that time that her source, Snowden, was lying to her about
his position.) Wizner also was shown e-mails by Poitras in which
Snowden said he had information about the government’s secret
domestic surveillance program. Wizner, according to Poitras, advised
her to stay in touch with this source.
On July 13, 2013, after Snowden asked for asylum in Russia,
Kucherena arranged an encrypted chat between Snowden and Wizner.
According to Wizner, Snowden asked him at the outset, “Do you
have standing now?” It was a question that suggested that Snowden
was aware that the ACLU needed to gain standing in federal court to
challenge the government’s alleged domestic surveillance. Up until
now, it was unsuccessful because it had no way to show it was a victim
of surveillance. The FISA order to Verizon, which Snowden had
taken had provided that standing to Wizner and the ACLU.
Aside from the opportunity Snowden offered the ACLU, Wizner
no doubt believed in the salutary benefit of Snowden’s revela-
Epst_9780451494566_2p_all_r1.z.indd 176
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 177
tions. When they discussed Snowden’s legal situation in America,
Snowden expressed an interest in obtaining some form of amnesty
from prosecution. Wizner was willing to attempt to explore making
a possible deal with the Department of Justice, but it would not be an
easy task, especially if Snowden had turned over NSA documents to
a foreign power.
Even to argue that Snowden was merely an NSA whistle- blower
presented a serious challenge for Wizner. The ACLU had been
involved with previous NSA whistle- blowers, but Snowden’s case
differed from those cases in important ways. Those whistle- blowers
had not intentionally taken any NSA documents. Snowden, on the
other hand, had not only taken a large number of NSA documents
but also released tens of thousands of these top secret files to journalists
based in Germany and Brazil, as well as to other unauthorized
recipients. In addition, the Whistleblower Protection Act, passed
by Congress in 1989, does not exempt an insider, such as Snowden,
who signs a secrecy oath from the legal consequences of disclosing
classified documents to journalists or other unauthorized people.
Consequently, getting some form of amnesty for Snowden required
bolstering his image as a person taking personal risks to fight for
America. But if Snowden had taken even a single top secret document
to Russia, it would strengthen the case in the court of public
opinion that he had stolen communications intelligence secrets with
the intent to damage the United States, which under the provisions
of federal law could be considered espionage. In this regard, Kucherena’s
disclosure was extremely damaging to Snowden’s position, and
Snowden had, after all, already found refuge in Russia. Snowden
had two options, according to Wizner, the “first is to be where he is
in Russia. And the second is to be in a maximum security prison cell,
cut off from the world.” These, of course, would be the options of
any espionage defector who fled to Russia.
One way to mitigate the damage was for Snowden to substitute
a new narrative. Wizner took it upon himself to screen potential
journalists and other outlets for Snowden. He told a reporter for
The New York Times that, except for Oliver Stone, all individuals
who have “met with Snowden have just gone through me, and
we’ve hooked it up.” Nor did he limit his extraordinary control to
Epst_9780451494566_2p_all_r1.z.indd 177
9/30/16 11:09 AM
178 | how america lost its secrets
interviews. In the case of Stone’s movie Snowden, Wizner asked for
the right to veto any shots featuring Snowden in the film. In it, he
would tell handpicked journalists that he had given all his documents
to Poitras and Greenwald in Hong Kong and took none of
them to Russia. Wizner could then argue that documents such as the
FISA court order were improperly classified secret and that disclosing
them served the public good. The government might not be able
to contest his claim without further revealing NSA sources. Under
these circumstances, it might be induced to agree to a plea bargain
for Snowden. Changing the narrative would also help enhance his
public image as a whistle- blower.
Snowden’s new narrative that he had destroyed all the documents
he had in his possession before coming to Moscow and had no access
to any NSA documents, not even those that he had distributed to
journalists, was reinforced in a series of interviews that Wizner
helped arrange. “I went the first six months without giving an interview,”
Snowden later said. “It wasn’t until December 2013 that I
gave my first interview to Barton Gellman.” (Snowden did not count
his Internet exchange with Risen in October as an “interview”.)
In late December 2013, Snowden met with Barton Gellman. It was
his first face- to- face meeting with a journalist since he had arrived in
Russia in June. Snowden turned his laptop toward Gellman and, as
if proving his point, said to him, “There’s nothing on it. . . . My hard
drive is completely blank.” That his computer had no files stored on
it at that moment of course meant very little. Just six weeks earlier,
Snowden had met with the former CIA officer Ray McGovern, who
had been invited to meet him in Moscow along with three other
American whistle- blowers. At that meeting, he told McGovern that
he had stored all the NSA data he had taken on external hard drives.
Gellman asked about the precise whereabouts of the files, but, as he
reported, Snowden declined to answer that question. He would only
say that he was “confident he did not expose them to Chinese intelligence
in Hong Kong.” That answer did not nail down the issue,
so Wizner arranged for Vanity Fair, which was preparing an article
on Snowden, to submit questions. In his reply to them, Snowden
wrote that he destroyed all his files in Hong Kong because he didn’t
Epst_9780451494566_2p_all_r1.z.indd 178
9/30/16 11:09 AM
The Keys to the Kingdom Are Missing | 179
want to risk bringing them to Russia. He expanded on this claim in
three more interviews. These interviews were all with three journalists
who had opposed NSA surveillance: James Bamford, writing
for Wired magazine; Alan Rusbridger, the editor of The Guardian;
and Katrina vanden Heuvel, the editor of The Nation. He also gave
a televised interview to Brian Williams of NBC News in which he
explained that because he had no access to the NSA documents in
Russia, he could not provide access to the Russians even if they
“break my fingers.”
Snowden did not specify where, when, or how the putative
destruction of the files occurred and offered neither witnesses nor
evidence, other than the meaningless blank laptop screen, to corroborate
it. Still his new self- serving narrative was widely accepted
by the media. The fact remains, though, that Snowden went to considerable
risk to select, copy, and steal Level 3 documents before
leaving Hawaii for Hong Kong. These secrets were his last potential
bargaining chips. Why would he have destroyed them in June in
Hong Kong?
It is also difficult for me to accept that Snowden would destroy
these documents because he feared the Russians might get them.
If he was so concerned about the possibility, he could have stayed
in Hong Kong and fought extradition instead of flying to Russia.
Surely he must have realized that even without the files on his computer,
the Russian intelligence service could still obtain the NSA
secrets he held in his head. Indeed, as he told the Times, the secrets
he held in his head would have devastating consequences for NSA
operations.
In light of Kucherena’s statement that in Russia Snowden had
access to NSA documents, it would require a serious suspension of
disbelief to accept Snowden’s new narrative. Even if one were willing
to accept his new claim, it still would not mean that the NSA
documents had not fallen into the hands of adversaries. If he had
destroyed all of the electronic copies of the NSA’s data before boarding
his flight to Moscow, he still couldn’t be “100 percent” certain, as
he claimed, that the data had not been accessed by others prior to his
departure from Hong Kong. His files could have been copied with-
Epst_9780451494566_2p_all_r1.z.indd 179
9/29/16 5:51 PM
180 | how america lost its secrets
out his knowledge, just as he had copied them without the NSA’s
knowledge. As former U.S. intelligence officers pointed out to me,
adversary services could not be expected to shirk from employing
their full capabilities once they learned that an American “agent of
special services,” as Putin called him, had brought stolen NSA documents
to Hong Kong.
The Times reported from Hong Kong that two sources, both of
whom worked for major government intelligence agencies, “said
they believed that the Chinese government had managed to drain
the contents” of the laptop that Snowden brought to Hong Kong.
That China had the capability to obtain Snowden’s data was also
the view of the former CIA deputy director Morell. He said, “Both
the Chinese and the Russians would have used everything in their
tool kit— from human approaches to technical attacks— to get at
Snowden’s stolen data.”
Snowden would not have been a particularly difficult target for
them, especially after he started disclosing secrets to journalists at
the Mira hotel. Not only could the Chinese service approach the
security staff at the Mira, but they could track him after he left the
hotel and moved, along with his computers, in and out of several
residences arranged by his carer. Snowden, after all, had put himself
in the hands of people whom he had never met before, including
three Hong Kong lawyers, a carer, and three Guardian journalists.
It is likely that the efforts of these adversary intelligence services to
find him, and the NSA data, would further intensify after Snowden
revealed to the South China Morning Post on June 12 that he had
access to NSA lists of computers in China and elsewhere that the
NSA had penetrated.
It wouldn’t be only the Chinese service on his trail. The Russian
intelligence service would also likely be tasked to acquire these
NSA documents after Snowden’s meeting with Russian officials in
Hong Kong. And while he could get away with giving coy and elusive
answers to journalists who asked him about the whereabouts of
the NSA data, the Russian and Chinese officials in Hong Kong who
could offer him an escape route from prison would likely demand
more specific answers about the whereabouts of data they had not
already obtained by technical means.
Epst_9780451494566_2p_all_r1.z.indd 180
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 181
The Post– Hong Kong Documents
The NSA concern about who had access to its missing files deepened
further when NSA documents continued to surface in the press after
Snowden went to Moscow. If U.S. intelligence needed any further
evidence that someone had access to the documents, these additional
revelations provided it.
The most sensational of them was a purported document attributed
to Snowden concerning the NSA hacking of the cell phone of
the German chancellor, Angela Merkel. The story was published
on October 23 on the Der Spiegel website. Appelbaum was the coauthor
of the story. Even though Snowden had by now been in Russia
for four months, he was cited in the story, along with unnamed
“others,” as the source for the NSA document. Snowden did not
deny it. Indeed, he took a measure of credit for the revelation, saying
on German TV, “What I can say is we know Angela Merkel was
monitored by the National Security Agency.” If Snowden had been
involved in the release of this document, it would be consistent with
Kucherena’s assertion that he had access to the archive.
Adding to the intrigue, Poitras was apparently caught by surprise
when the Merkel story broke in Der Spiegel. She urgently texted
Snowden on what she called “background” (which ordinarily means
that a journalist will not attribute information to a source). She asked
him in the text to explain the NSA’s actions. Snowden explained to
her that Merkel was listed by her true name (and not by a code name)
in the NSA document because the German chancellor was an NSA
“target not an asset.” Presumably, Poitras would have already known
that distinction if she had the document referred to in Der Spiegel.
If the Merkel document was not among the data given to Poitras in
Hong Kong, how did it get to the authors of the Der Spiegel article?
Appelbaum, of course, had been in contact with Snowden before he
went public. He had served as Poitras’s co- interrogator of Snowden
while he was still working at the NSA in May 2013. Appelbaum
was also one of the leading supporters of WikiLeaks. Because he
was famously an advocate of revealing government secrets, it seems
unlikely that he would have delayed releasing such a bombshell
about Merkel’s phone if Snowden had given him this document
Epst_9780451494566_2p_all_r1.z.indd 181
9/29/16 5:51 PM
182 | how america lost its secrets
before he left Hong Kong in June 2013. Why would Appelbaum keep
it secret for more than four months? The same pressure to publish
would also apply to the journalists Snowden had dealt with in Hong
Kong. If Snowden had given Poitras, Greenwald, Lam, or MacAskill
the Merkel document, or even told them about it in their interviews
with him in Hong Kong, The Guardian would have certainly rushed
out such a scoop.
According to a source with knowledge of the Snowden investigation,
there was no document referencing any spying on Merkel’s
phone among the fifty- eight thousand documents on the thumb
drive that Snowden had given to Poitras and Greenwald in Hong
Kong. That absence would explain why Poitras had to send a text to
Snowden in Moscow to ask for an explanation after the story broke.
Further confirmation of the absence of this document in the
material Snowden provided journalists in Hong Kong comes from
James Bamford, a well- respected expert on the NSA. In the course
of researching his 2014 article on Snowden for Wired, he was given
access to all the documents Snowden gave to Poitras, Greenwald, and
Gellman. Bamford used a sophisticated indexing program to search
through the database specifically for the Merkel material. He did not
find any. He reported that no document given to journalists in Hong
Kong even mentioned Merkel. It therefore appeared that the Merkel
document was provided to Der Spiegel after Snowden went to Moscow.
If so, some party had access to NSA documents after Snowden
arrived in Russia and provided the Der Spiegel authors with the
scoop. In that context, it might not have been a pure coincidence that
Kucherena disclosed that Snowden had access to documents that he
had not given to journalists in Hong Kong shortly before just such a
document was published in Germany.
Bamford explored the possibility that there might be another person
in the NSA who was stealing documents. He wrote to Poitras
and asked her whether the Merkel document could have come from
another person in the NSA. She declined, via a letter from her lawyer,
to answer that question. But because she had not been the author of
the Der Spiegel article, and had not been given the document, there
is no reason to believe that she would know its provenance.
Documents continued to emerge years after Snowden arrived in
Epst_9780451494566_2p_all_r1.z.indd 182
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 183
Moscow that were more embarrassing to America. In June 2015, the
WikiLeaks website released another putative Snowden document,
two years after he had supposedly wiped his computer clean in Hong
Kong. It revealed that the NSA had targeted the telephones of three
consecutive presidents of France— Jacques Chirac, Nicolas Sarkozy,
and François Hollande.
According to a former NSA official, this document, like the 2013
Merkel material, was not among the data on the thumb drive given
to journalists in Hong Kong, which Greenwald confirmed. Greenwald
suggested to The New York Times that it might have been stolen
by another penetration in the NSA, presumably one who had
access to the same secret compartments as Snowden in 2013. Since
Greenwald and Poitras had no way of knowing about the documents
that Snowden did not give them, it is equally possible that the Russian
intelligence services obtained this document from Snowden and
later gave it to WikiLeaks. The release on Assange’s WikiLeaks site
came in the midst of NATO war games held near the Russian border,
which Putin had vehemently denounced. The accompanying article
was co- authored by Assange, who now claimed to have access to
Snowden’s NSA material. Because Assange had been in telephonic
contact with Snowden in Hong Kong, and his deputy, Sarah Harrison,
had spent five months in Moscow with Snowden in 2013, it
is certainly possible Snowden was his source. But it seems difficult
to believe that Assange waited two years before publishing because
he has made it part of his modus operandi to publish documents
immediately. Because WikiLeaks receives documents anonymously
via its Tor software, any party with access to the Snowden files
could have sent it. Subsequently, in July 2016, Assange released via
WikiLeaks a cache of politically disruptive documents from the files
of the Democratic National Committee. U.S. intelligence strongly
suspected they been stolen by the Russian intelligence services and
sent to WikiLeaks. If so, Russia made use of Assange and WikiLeaks
to exploit selected fruits of its espionage activities
Greenwald and Poitras also released belated documents. On
July 15, 2015, their web publication, The Intercept, released a
Snowden document that cited an NSA intercept of an Israeli military
communication concerning an Israeli raid in Syria on August 1,
Epst_9780451494566_2p_all_r1.z.indd 183
9/29/16 5:51 PM
184 | how america lost its secrets
2008. It revealed that a group of Israeli commandos killed General
Muhammad Suleiman, a top aide to President Bashar al- Assad
who had been working with North Korea to build a nuclear facility
in Syria. Israel had destroyed that facility in Operation Orchard
nearly a year earlier. Whatever the purpose of this new release of an
NSA document (which had little if anything to do with any of the
NSA’s own operations), it was not among the data that Snowden had
given Poitras and Greenwald in Hong Kong in 2013, according to a
source with access to the investigation. Next, on January 28, 2016,
The Intercept published data taken from a GHCQ (the British cipher
service) file furnished by Snowden revealing military intelligence
activities abroad. Specifically, it disclosed that the United States and
Britain were intercepting data from Israel’s military drones in 2008.
British intelligence had determined in 2013 that the material sent
to Greenwald via a courier did not contain such GCHQ documents.
If that is the case, then Poitras and Greenwald, like Appelbaum and
Assange, were still receiving NSA documents that Snowden had
allegedly stolen a long time after he went to Russia and claimed he
had destroyed all his files.
The NSA reportedly determined that these belated documents,
most of which concerned American allies in Germany, France, and
Israel, had been among the material copied during the Snowden
breach. They provided further reason to believe that someone still
had access to the documents that were not distributed to journalists
in Hong Kong. Kucherena’s disclosure, just before the first post–
Hong Kong release, that Snowden still had access to the NSA files
made it appear plausible that Snowden sent these documents to Der
Spiegel, WikiLeaks, and The Intercept.
A former high- ranking KGB officer I interviewed had a very different
view. He told me that in his experience an intelligence defector
to Russia would not be allowed to distribute secret material to
journalists without explicit approval by the security service tending
him. He added that this injunction would be especially true in
the case of Snowden because Putin had publicly enjoined him from
releasing U.S. intelligence data. The more plausible alternative was
that this material was released at the behest of the Russian intelligence
service.
Epst_9780451494566_2p_all_r1.z.indd 184
9/29/16 5:51 PM
The Keys to the Kingdom Are Missing | 185
The mystery of the post– Hong Kong documents also intrigued
members of the U.S. intelligence community with whom I discussed
it. When I asked a former intelligence executive about the ultimate
source for the Merkel story, he responded, “If Snowden didn’t give
journalists this document in Hong Kong, we can assume an intermediary
fed it to Appelbaum to publish in Der Spiegel.” According
to him, the NSA investigation had determined that Snowden indeed
had copied an NSA list of the cell phone numbers of foreign leaders,
including the number of Merkel. This list became the basis of the
Der Spiegel story.
It was also clear that Snowden gave credence to the release in Moscow.
He made a major point about the hacking of Merkel’s phone
in an interview with Wired in 2014. Just about two weeks before
the leak, Kucherena said Snowden still had access to the documents.
Clearly, someone had access. But whoever was behind it, the release
of information about the alleged bugging of Merkel’s phone resulted
in badly fraying U.S. relations with Germany in the midst of developing
troubles in Ukraine. As it later turned out, according to the
investigation of the German federal prosecutor, which concluded in
2015, there was no evidence found in this document, or elsewhere,
that Merkel’s calls were ever actually intercepted. Although they
revealed little if anything that the intelligence services of Germany,
France, and Israel were not already aware of, they raised a public
outcry in allies against NSA surveillance, and the outcry became the
event itself.
While these post– Hong Kong documents had little if any intelligence
value, they provided further evidence that at least part of
the stolen NSA documents was in the hands of a party hostile to the
United States. If so, it wasn’t much of a leap to assume that this party
also had access to the far more valuable Level 3 documents revealing
the NSA’s sources and methods, such as the one that Ledgett had
described as a “roadmap” to U.S. electronic espionage against Russia
and China.
Within the intelligence community, this concern was heightened
by new countermeasures to this espionage employed by Russia and
China after Snowden reached Moscow. For example, there were
indications that the NSA had lost part of its capabilities to follow
Epst_9780451494566_2p_all_r1.z.indd 185
9/29/16 5:51 PM
186 | how america lost its secrets
Russian troop movements in the Crimea and eastern Ukraine. U.S.
intelligence officials even went so far as to suggest, according to a
report in The Wall Street Journal, that “Russian planners might
have gotten a jump on the West by evading U.S. eavesdropping.”
Britain also discovered that some of its secret operations had been
compromised after Snowden went to Moscow. According to a 2015
story in the Sunday Times of London, British intelligence had determined
that Britain’s intelligence- gathering sources had been exposed
to adversary services by documents that Snowden had stolen from
the NSA in 2013. These documents had been provided to the NSA
by the GCHQ. Unless such intelligence disasters were freak aberrations,
it appeared to confirm General Alexander’s warning in 2014
that the NSA was “losing some of its capabilities, because they’re
being disclosed to our adversaries.”
Snowden’s supporters disputed this view. If only as an act of faith
in Snowden’s personal integrity, they continued to believe his avowal
to Senator Humphrey that he had acted to protect U.S. secrets by