[DECEMBER DRAFT--- 287 pages] THE SNOWDEN AFFAIR A Spy Story in Six Parts By Edward Jay Epstein CONTENTS PROLOGUE On the Snowden Trail: Hong Kong 2014 PART ONE The Intelligence Crisis Chapter One The Great Divide Chapter Two The Crime Scene Investigation PART TWO Snowden’s Arc Chapter Three Tinker Chapter Four Secret Agent Chapter Five Contractor Chapter Six Thief Chapter Seven Crossing the Rubicon Chapter Eight Hacktavist Chapter Nine String-Puller Chapter Ten Raider of the Inner Sanctum Chapter Eleven Escape Artist Chapter Twelve Whistle Blower Chapter Thirteen Enter Assange Chapter Fourteen Fugitive PART THREE The Counterintelligence Conundrum Chapter Fifteen Did Snowden Act Alone Chapter Sixteen The Question of When Chapter Seventeen The Keys to the Kingdom Are Missing Chapter Eighteen The Unheeded Warning PART FOUR The Game of Nation Chapter Nineteen The Rise of the NSA Chapter Twenty Back Door In Chapter Twenty-One The Russians Are Coming Chapter Twenty-Two The Chinese Puzzle Chapter Twenty-Three The Pawn in the Game PART FIVE WALKING THE CAT BACK Chapter Twenty-Four Dinner with Oliver Stone Chapter Twenty-Five Vanishing Act Chapter Twenty-Six through the Looking Glass Chapter Twenty-Seven the Handler PART SIX CONCLUSIONS Chapter Twenty-Eight Snowden’s Choices Chapter Twenty-Nine The Whistle Blower Who Became an Espionage Source EPILOGUE THE SNOWDEN EFFECT Chapter Thirty The ‘War on Terrorism’ after Snowden Chapter Thirty-one America after Snowden: The Good, the Bad and the Ugly Appendix A the Spies in this Book [TK] End Notes Bibiography [TK] Chronology 1: Snowden Thriller: From Honolulu to Moscow in 82 Days. April 8, 2013, Honolulu. Edward Snowden begins working as an infrastructure-analyst in training at the National Threat Operations Center for outside contractor Booz Allen Hamilton. June 5, 2013, London The Guardian publishes a classified document revealing that the National Security Agency has secretly been gathering the telephone billing records of millions of American. The Washington Post then publishing other secret documents revealing that the NSA has been intercepting data from the Internet. June 9, 2013, Hong Kong. In a 12-minute long video posted on the website of the Guardian, Edward Snowden reveals himself as the source for the document published by the Guardian and the Washington Post June 11 Hong Kong. Sarah Harrison arrives in Hong Kong to work behind-the-scenes to assist Snowden. June 14, 2013, Washington D.C. Federal prosecutors in the Eastern District of Virginia, file a three-count criminal complaint against Snowden charging him with theft of government documents, unauthorized communication of national defense information and the willful communication of classified communications intelligence information to an unauthorized person. June 23, 2013, Moscow. Snowden arrived from Hong Kong at Sheremetyevo International Airport. PROLOGUE On The Snowden Trail: Hong Kong 2014 The National Security Agency, or, as it now commonly called, the NSA, was created on October 24, 1952, in such a tight cocoon of secrecy that even the Presidential order creating it was classified “Top Secret.” When journalists asked questions about this new agency, Washington officials jokingly told them that the initials NSA stood for “No Such Agency.” The reason for this extraordinary stealth is that the NSA is involved in a very sensitive enterprise. Its job is to intercept, decode and analyze foreign electronic communications transmitted around the globe over from copper wires, fiber optic cable, satellite, microwave relays, cell phone towers, wireless transmissions and the Internet for intelligence purposes. In intelligence jargon, its product is called COMINT. This form of intelligence-gathering is particularly effective when the NSA’s targets are unaware of the state-of-the-art tools the NSA uses to break into their computers and telecommunications and decipher their enciphered messages. In the first week of June in 2013, the NSA learned that a huge number of its most secret files had been stolen. The suspect was Edward Snowden, a 29 year old civilian analyst at the NSA’s regional base in Oahu, Hawaii, who had fled to Hong Kong. The stolen documents revealed, among other things, the secret tools and capabilities that the NSA employed to do its job. According to a three-count criminal complaint filed by Federal prosecutors in the Eastern District of Virginia, Snowden had stolen government documents and violated the Espionage Act by the unauthorized and willful communication of national defense information to an unauthorized person. This was not a who-dunn-it mystery. On June 9th, 2013, in an extraordinary 12-minute video made in a cramped hotel room in Hong Kong, Snowden identified himself as the person who had taken the NSA documents. Watching the video, the world saw a shy, awkward and sympathetic-looking, man wearing a rumpled shirt, rimless glasses and a computer geek-style haircut, passionately speaking out against the NSA’s violations of the law and, in a shaky voice, expressing his willingness to expose them. Snowden had an innocent, idealistic, principled look about him, and the world was ready to congratulate him for revealing the NSA's illegal collection of data inside the United States. But in fact, he stole a great deal more than documents relating to domestic surveillance. He had also stolen secret documents from the NSA revealing the sources and methods it employed in its monitoring of foreign adversaries. What made this theft even more extraordinary was that he got away with it. By the time it had been discovered in the first week of June 2013, it was not possible for the FBI, the Grand Jury or any other US agency to question him because he had fled the country. He went first to Hong Kong. Although it is economically autonomous, the city of 7.2 million is actually a special administrative zone of China, whose national security apparatus is ultimately controlled by Beijing. Making the possibility of questioning him even more remote, he next went to Russia, a country which has no extradition treaty with the United States. And Russia granted him asylum. His escape left in its wake an incredibly-important unsolved mystery: how did a young analyst at the NSA succeeded in penetrating all the layers of NSA security to pull off the largest theft of secret documents in the history of American intelligence? Did he act alone? What happened to documents? Was his arrival in Russia part of the plan? As I had written several books on the vulnerability of intelligence services, this was a mystery-- a "how-dunnit" if you like-- that immediately intrigued me. After all, even if the perpetrator had acted for the most salutary of reasons, the unauthorized transfer of state secrets to another country is, by any definition, a form of espionage. I decided to begin my investigation of this case in Hong Kong because it was the place to which Snowden first fled after leaving Hawaii. Snowden had planned the trip for at least 4 weeks, according to the travel plan he had filed at the NSA, I assumed he had a good reason for going first to Hong Kong. But when I spoke to my sources in the intelligence community, they could not explain Snowden’s choice of this semi-autonomous zone in China as his initial destination. It would not protect him from the reach of US law since Hong Kong had an active extradition treaty with the United States. Just a few months earlier, Hong Kong had made headlines by extraditing Trent Martin, a fugitive wanted in America for insider-trading, who was arrested in Hong Kong following an American request to detain him. Martin was then sent back to the United States to stand trial. Nor was Hong Kong particularly convenient to Hawaii. There were no non-stop flights to it from Honolulu. Snowden’s flight took 8 hours and ten minutes just to Narita airport, Japan, where he had to change planes. After a three hour wait at the airport, it took him five more hours to fly to Hong Kong. Moreover, at the time he departed Honolulu, Snowden had not yet arranged for any journalists to meet him in Hong Kong and, as far as US intelligence could determine, he had no known appointments there. Even so, Snowden carried the digital copies he had made of the top-secret NSA documents to Hong Kong. General Michael Hayden, who served both as the head of the NSA and the CIA, told me. “It’s very mysterious why Snowden chose Hong Kong.” Whatever reason he had for flying to Hong Kong, we can assume it was compelling enough for him to take the risk that he would be arrested there after US authorities discovered the theft and invoked the detention provision of its extradition treaty with Hong Kong. It was possible that Snowden travelled there to see someone other than a journalist. But who? Using my frequent travel miles, I bought a ticket on Japan Air Lines to Hong Kong. The route, like that of Snowden’s route the previous year, had a stop-over in Narita Airport in Japan (where, according to an intelligence source, Snowden was caught on the CCTV cameras waiting in the transit lounge for his connection to the four and one half flight to Hong Kong). I arrived in Hong Kong on May 20th 2014– the same day that Snowden had arrived there the previous year. I checked into the five-star Mira Hotel. It was in the Tsim Sha Tsui shopping district of Kowloon, a 10-minute ferry ride away from Hong Kong island, where most of the foreign consulates are located. I chose the Mira because it was the hotel in which Snowden stayed and made the celebrated video admitting his role in taking the NSA documents. I asked at the front desk for room 1014, the same one that Snowden had occupied in 2013. Snowden had told the journalists from the Guardian that that he had been at Mira Hotel since he first arrived in Hong Kong on May 20th until he left on June 10th. My motive in taking the room during that period was not journalistic nostalgia; I wanted access to the hotel’s service and security personnel who may have had contact with Snowden a year earlier. Unfortunately, that room was occupied. Even so, I was given a nearby room that served my purpose. The rate was $330 a day with taxes, although I received a journalist’s discount of 30 percent. My first surprise was that Snowden had not arrived at the Mira until 11 days after he arrived in Hong Kong. He told the Guardian reporters that he hid out at the Mira hotel since his arrival because he feared that he might be captured by the CIA. But, as I learned from the hotel staff, Snowden had actually registered there under his real name and used his own passport and credit card to secure the room. Even more surprising was the date he checked into the Mira Hotel. It was not May 20th but June 1, 2013. Since he checked out on June 10, 2013, he was there for only nine days. The question that could not be answered by the registry of the Mira Hotel was: where was Snowden staying for the eleven days between from May 20th to June 1? Wherever he was, he apparently considered himself safe enough to take another irrevocable step in his defection. He sent journalist Glenn Greenwald of the Guardian a “welcome package,” as he called it, of 20 top-secret NSA documents on May 25, 2013. He had now not only downloaded documents but, in a violation of his oath, he provided them to an unauthorized party. He also in Hong Kong, for the first time, directly contacted via email Barton Gellman of the Washington Post. Indeed, it was during these first 11 days during which he was staying someplace other than the place he claimed to be staying that he made almost all the arrangements for his journalistic event. He was also apparently in contact with at least one foreign mission during this period, according to what he written to Gellman on May 25th. In that email concerning when and how his story was to be published by the Washington Post, Snowden even asked Gellman to include in it some text that would help him with this mission. But which country was he approaching? Clearly his whereabouts during these missing 11 days was a gap that needed to be filled in. It could shed light on why he came to Hong Kong. I next called Keith Bradsher, a prize-winning journalist who had been the New York Times bureau chief in Hong Kong in 2013, who had written a well-researched report about Snowden’s arrival in Hong Kong in 2013.. He proposed we meet at the Foreign Correspondent’s Club on top of Ice House Street in central Hong Kong, a venue, I recalled, reminiscent of where John LeCarre had set the opening chapter of his spy novel The Honourable Schoolboy. When we spoke later, Bradsher told me that he knew Albert Ho, who had been retained as Snowden’s lawyer, for more than a decade, and interviewed him many times as he was a leader of a political movement in Hong Kong. Bradsher said that a few days after Snowden had revealed himself on June 9th, 2013, he met with Ho and questioned him on the very question that intrigued me about Snowden’s unknown whereabouts. Ho told Bradsher that all of Snowden’s logistics had been arranged for him by an intermediary, who Ho called a “carer.” Ho further said that Snowden had been in contact with the “carer” prior to his arrival in Hong Kong on May 20th. According to Ho, it was this person who had arranged accommodations for Snowden on his arrival—and afterwards. If so, it seemed plausible to me that this person might be able to shed light on whom, if anyone, Snowden saw in his first ii days in Hong Kong. Of course, this person may have been unaware of the reasons for Snowden’s escape to Hong Kong when he made the arrangements for him but he was the best lead I had to learning why Snowden had come to Hong Kong. But who was the “carer?” Bradsher told me that he pressed Ho for details about this mystery person over the course of several meeting but Ho would not identify him beyond saying, that he was a “well-connected “resident” of Hong Kong. I next called Ho’s law office in Hong Kong. But Ho politely declined to be interviewed by me, saying he had said all he was going to say about the Snowden case. I next made an appointment with Robert Tibbo, a Canadian-born barrister, specializing in civil liberties cases, who had worked closely with Ho on the Snowden case. He immediately agreed to see me. I met Tibbo in the tea room at the Mandarin Oriental hotel on Hong Kong Island, where I moved to from the Mira hotel. The Mandarin was also convenient to Tibbo’s office at the court. Tibbo was a tall, round-faced man, with thinning hair, in his early fifties. He talked freely about his remarkable career. After earning a degree in chemical engineering from McGill University, and working in Asia as an engineer for a decade, he went to law school in New Zealand, and then became a barrister in Hong Kong specializing in cases involving the legal status of refugees. Over a leisurely tea, Tibbo made it clear to me that he had played a far more active role than Ho in the Snowden case, even personally escorting Snowden from the Mira Hotel on June 10th to a safe house. He did not dispute what Ho had told Bradsher, but said that he was himself bound by lawyer-client privilege which prevented him from providing me with any details that might reveal the identity of the person who had made arrangements for Snowden. When I asked the date that he was officially retained by Snowden, he said that Snowden had signed an agreement hiring Ho’s law firm as his legal adviser on June 10, 2013 (which was a matter of public record.) “I understand that,” I said, “but I am inquiring about something that had happened before you became his legal adviser.” He shook his head, as if getting rid of a pesky fly, and said that his oath precluded him saying anything at all that might do damage to the credibility of his client. “Not even where he was staying in May in Hong Kong,” I persisted. He leaned forward and, after a brief hesitation, said, jokingly I assumed that he would not divulge that information “even if you held a gun to my head.” We met two more times but, true to his word, Tibbo would not say if he even knew the identity of the “carer.” Meanwhile, Joyce Xu, a very resourceful Chinese journalist who was assisting me in Hong Kong, had filed the equivalent of a Freedom of Information request with the Hong Kong Security Bureau asking for information about Snowden’s movements in May. Thomas Ng, the Secretary for Security, turned down the request, adding that Hong Kong authorities do not keep records of hotel registrations. So I ran into a dead end on the issue of Snowden's “carer” and his whereabouts for those eleven crucial days with the Hong Kong authorities. At this point, I had some much-needed help from an old friend on the White House staff. Before I had left New York, I asked him if he could find someone at the consulate in Hong Kong who might brief me on the Snowden case. I didn’t hear from him until just a few days before I was due to return to New York. He had managed to put me in touch with a former employee of the consulate, who he said was “fully informed” about the efforts of the US mission to locate Snowden in Hong Kong. This person was still living in Hong Kong and he agreed to meet with me on condition that I did not mention either his name or his position in the US mission in Hong Kong. The venue was the terrace lounge of the American Club in Exchange Square in central Hong Kong, a posh club mainly for expatriate Americans. It was on the 48th floor with a spectacular view of Victoria Harbor. Once there, I had no problem finding my source. He was, as he had described himself, a large man with short-cropped brown hair wearing a brightly-striped tie. He was sitting alone at a discreet table in the corner. I introduced myself and gave him a copy of my latest book, The Annals of Unsolved Crime. After ordering drinks, he told me in a soft voice about the American reaction to Snowden’s revelations in Hong Kong. “All hell broke loose,” he said, describing the atmosphere at the US mission after Snowden’s video was posted on the Guardian’s website on June 9th, 2013. To break the ice, I went over some of the assertions Snowden had made concerning the US consulate in that extraordinary video. For example, Snowden had said that he could be seized at any moment by a CIA rendition team based at the US consulate “just down the road” from the Mira Hotel. “Was that true,” I asked? He rolled his eyes, and said, “Snowden has a pretty wild imagination. For one thing, the US consulate is not down the road from the Mira in Kowloon, it is here on Hong Kong Island. And there was no CIA rendition team in Hong Kong.” My next question concerned a second period during which Snowden's whereabouts are unknown—the period between the time he left the Mira Hotel on June 10, 2013 and the day he left Hong Kong for Russia on June 23, 2013. When I asked my consulate source whether the US mission took any action to track Snowden during these 13 days, he explained that the FBI had a contingent of “legal attaches” based at the consulate to pursue, among other things, video pirates. In addition, the CIA and the Defense Intelligence Agency had a handful of “China-watchers” in Hong Kong. This group constituted the intelligence “mission,” as he referred to it. After Snowden outed himself on the Internet, the mission began tracking Snowden’s movements. Since Snowden, his lawyers and the journalists in his entourage frequently used their cell phones to text one another, it was fairly easy for the mission to follow Snowden’s trail after he left the Mira hotel. Presumably, the Hong Kong Police also knew where he was during this period. My source further suspected that the massive Chinese intelligence contingent in Hong Kong also knew, since it had close relations with the Hong Kong police. If so, Snowden’s whereabouts as he moved every few days from apartment to apartment was no secret anyone but the public from June 10th to June 23rd. “Of course we knew,” he said, adding that there were also photographs of Snowden entering the office building that housed the Russian consulate. I mentioned that there was a report in a Russian newspaper that Snowden had visited the Russian consulate in late June in connection with the flight he later took to Moscow. “All we know is he entered the building,” he answered, with a shrug. That visit did not come as a complete surprise to US intelligence. After Snowden left the Mira, his interactions with the Russian and Chinese intelligence services in Hong Kong also had been closely monitored by the “secret means,” as was subsequently confirmed to me a former top intelligence executive in Washington DC. All of Snowden’s stealth in exiting from the Mira hotel, which included wearing a baseball cap and dark glasses, was ineffective in hiding him from US intelligence and presumably other intelligence services seeking the treasure trove of documents he had taken from the NSA. Among other things, the Hong Kong lawyers moving him to a safe house were carrying easily traceable cell phones. The mystery that most concerned me was, however, not where Snowden was housed in the interim between when he went public and when he went to Moscow. It was where, and in whose care, Snowden had been before, he had checked into the Mira hotel on June 1st. When I asked him about this period, he said that as far as he knew neither the FBI nor the Hong Kong police could find a trace of him during the period between May 20th, when he passed through Hong Kong customs, and June 1st, when he used his credit card and passport to check into the Mira hotel. They could not find any credit card charges, ATM withdrawals, telephone calls, hotel registrations, subway pass purchases or other clues to Snowden’s activities. As far as a paper trail was concerned, Snowden was a ghost during this period. Could an American just vanish in Hong Kong for eleven days, I asked”? “Apparently he did just that,” my source replied. Snowden’s whereabouts during these 11 days was not a mystery I was going to solve on this first trip to Hong Kong. I needed to know more about Snowden’s activities before he flew to Hong Kong. After all, Snowden was not, as he himself pointed out from Moscow, an “angel descending from the heavens.” He had a past working for the US government that extended back seven years. During that period, he had been part of America’s secret intelligence regime, and held a clearance for Sensitive Compartmented Information, or SCI. Such SCI material is considered so sensitive that it must be handled within formal access control systems established by the Director of National Intelligence. Nor did Snowden’s breach begin with him handing over classified documents to the Guardian reporters in Hong Kong in June 2013 or, for that matter, in the eleven days prior to his meeting with journalists in 2013. He had, as the NSA quickly determined begun illicitly copying documents in the late summer of 2012. Such an enterprise does not emerge from thin air. Even if he had managed to elude American intelligence from late May to early June 2013, he could not hide all the history that led to his decision to come to Hong Kong. There had to be an envelope of reality surrounding it, including Snowden’s motivation, associates, movements, finances, and his activities prior to his fleeing to Hong Kong. What was missing was not just Snowden’s first 11 days in Hong Kong but the entire context of the alleged crime. I now needed to fill in that envelope of reality in America. I left Hong Kong for New York on June 2, 2014 two days after my meeting with the former official of the consulate. PART ONE THE INTELLIGENCE CRISIS CHAPTER ONE The Great Divide “What you’ve seen so far is just the tip of the iceberg.” -- retired Admiral Michael McConnell, vice chairman of Booz Allen Hamilton On June 9, 2013, the Guardian, the British newspaper known for the quality and gravity of its reporting posted Snowden’s 12-minute video on its website. In it, Snowden identified himself as an infrastructure analyst at a regional base of National Security Agency that was located in Oahu, Hawaii. He revealed in a calm, unemotional voice that he had been the source for the stories in both the Guardian and the Washington Post. He said that he had supplied the secret, classified documents that the two newspapers had used in their scoops about domestic surveillance being conducted by the NSA, America’s enormous electronic surveillance agency. These sensational revelations had been, literally, the talk of the world, and now, in another major news event, the boyish-looking Snowden revealed his responsibility for what would turn out to be the largest theft of top-secret documents in the history of U.S. intelligence. In the video, Snowden was questioned by Glenn Greenwald, an American journalist living in Brazil who had broken the NSA story in the Guardian. What was his motive? Greenwald asked. Why did he do it? Snowden replied that he had become horrified by the NSA’s secret operations which, to him, represented a kind of distillation of the excesses of the American national security state, and he therefore made it his mission to blow the whistle. He believed that the public needed to be informed of the existence of a vast, secret surveillance operation directed against tens of millions of Americans that flagrantly violated US laws and was a grave threat to their privacy and their freedoms. Within hours of the release of that video on the Guardian website, Snowden was one of the most famous people in the world, celebrated by his supporters as a courageous whistle-blower. The Snowden interview in the video subsequently was expanded by the documentary filmmaker Laura Poitras into the two-hour movie CitizenFour, which won the 2015 academy-award for the best documentary. Poitras said in accepting her Oscar in the Academy Awards Theater in Hollywood on February 22nd 2015, that Snowden acted as a whistle-blower not only to “expose a threat to our privacy but to our democracy itself.” She received a standing ovation. The film convincingly depicts Snowden as an altruistic young man who is willing to risk his own personal freedom and face years of imprisonment for the sake of others. Adding to the drama, almost all the footage of Snowden in the film is from interviews with him in the confines of Snowden’s small room at the Mira hotel from June 3 to June 9th, 2013, as the event was actually unfolding. Snowden, speaking for the camera, describes himself as a civilian contractor for the National Security Agency. He took full responsibility for the theft of classified documents, saying that he had acted alone. He said that he had been forced to take these documents to expose a crime that threatened the freedom of Americans: the US government’s illegal surveillance of US citizens. He said that he had a duty to bring this secret activity to the attention of the American people. “Sitting on his unmade bed—white sheets and covers, white headboard, white bathrobe, white skin—Snowden seems like a figure in some obscure ritual, being readied for sacrifice,” George Packer wrote about the film in a widely-read article in The New Yorker. He said repeatedly he was willing to make the ultimate sacrifice, by allowing himself to go to prison, so that Americans could live in freedom. A large part of the public, who viewed this powerful film, including many of my colleagues in journalism whose writing I greatly respect, came to accept Snowden’s whistle-blowing narrative. This powerful narrative, as lucidly articulated by Poitras, Greenwald and other Snowden supporters, described the NSA activities exposed by Snowden as part of a vast criminal conspiracy involving, among others, President Obama, James Clapper, the Director of National Intelligence and both Democrat and Republican members of the Congressional oversight committees. It further derided claims that there was evidence that Snowden’s theft of NSA secrets went beyond exposing government misdeeds as part of an orchestrated effort to demonize Snowden. The purpose of this demonization was to divert away from the government’s crimes. For example, this narrative asserted as if it was established fact, that US government officials had deliberately “trapped” Snowden in Russia. According to Snowden, the purpose of this government ploy was to “demonize” him. To be sure, it is not unprecedented for the government to release defamatory information about individuals who have embarrassed US intelligence by defecting. When two NSA analysts, William Martin and Bernon Mitchell, defected to Russia in the 1960s and accused the NSA of violating international law after arriving in Moscow, U.S. government officials responded by putting out the story that they were homosexual lovers, which was both untrue and irrelevant to the intelligence secrets that they compromised. So it is certainly possible that the government put out information to intentionally defame Snowden. Secretary of State John Kerry, after all, characterized him as a coward who should “man up” by returning to the United States. While one can discount such characterizations against him by government officials as demonization, as I do, one cannot as easily dismiss the independent evidence that undermines Snowden assertion that his sole motive was blowing the whistle on illicit surveillance in the United States. For example, by the Lawfare Institute in cooperation with The Brookings Institution in 2014 did an independent analysis of all the published documents that Snowden provided to the media. It concluded that, with some notable exceptions, such as the two documents initially published by the Guardian and Washington Post, the now famous FISA warrant and the PRISM slides, few of the other documents that Snowden had given Poitras and Greenwald for publication had little to do with either domestic surveillance or the infringements on the privacy of Americans. By the Lawfare Institute’s count, 32 of Snowden’s leaks to these journalists concerned the NSA’s overseas sources and method, nine identified overseas locations of the NSA’s intelligence bases, 25 of them revealed the identities of foreign officials of interest to US intelligence agencies, 14 of them disclosed information about Internet companies legally cooperating with the NSA, and 19 of them concerned technology products that the NSA had been using or researching. In addition, a considerable number of the published documents did not even belong to the NSA but were copies of reports sent to the NSA by its allies, including the British, Australian, Canadian, French, Norwegian and Israeli intelligence services. For example, he provided journalists with secret documents from the British cyber service GCHQ describing its own plans to obtain a legal warrant to penetrate the Russian computer security firm Kaspersky to expand its “computer network exploitation capability." All the GCHQ was revealing in this document was its own capabilities to monitor a Russian target of interest to it. While the release of these foreign documents may have embarrassed foreign allies of the United States, they exposed no violations of US law by the NSA. It was a legitimate part of the NSA’s job to share information with its allies. This raises the question: what constitutes whistle-blowing? To the general public no doubt, a whistle-blower is simply a person who exposes government misdeeds from inside that government. But in the eyes of the law someone who discloses classified information to an unauthorized person, even as an act of personal conscience, is not exempt from punitive consequences of his act. Indeed, if a person deliberately reveals secret US operations, especially ones that compromise the sources and methods of US intelligence services, he or she may run afoul of American espionage laws. In the past when government employees have disclosed classified information to journalist to redress perceived government misconduct, they almost always received prison sentences, Just during Obama’s presidency, there were six government employees who, as a matter of personal conscience, shared classified information they obtained from the FBI, CIA, State Department and US Army with journalists. They were Shamai Leibowitz in 2010, Chelsea Manning in 2013, John Kiriakou in 2013, Donald Sachtleben in 2013, Stephen Kim in 2014 and Jeffrey Sterling in 2014. Like Snowden, they claimed to be whistle-blowers informing the public of abuses of the government. But since they disclosed classified documents, they were dealt with as law-breakers. All six men were indicted, tried, convicted and received prison sentences. Sterling, a CIA officer who allegedly turned over a document to James Risen, a Pulitzer Prize winning reporter for the New York Times, was sentenced to 42 months, for example. The most severe sentence was meted out to Private Bradley/Chelsea Manning, who an Army court sentenced to 35 years in a military stockade. The prison time that others received did not go unnoticed by Snowden. He had been following the Manning case since 2012. In fact, he posted about it shortly before he began stealing far more damaging documents than had Manning. He therefore would have been aware that by revealing state secrets that he had sworn to protect, he would be risking imprisonment unless, unlike Manning, he fled the country. His motives, no matter how noble they might be, would not spare him, anymore than it spared the other six, from determined federal prosecution. To be sure, the view of those on the Snowden side of the divide is not grounded in legal definitions, but in a broader notion of morality. Snowden‘s supporters do not accept that the law should be applied in this fashion to Snowden. They argue that Snowden had a moral imperative to act, even if it meant breaking the law. They fully accepted his view that he had a higher duty to protect citizens of all countries in the world from, as he put it, “secret pervasive surveillance.” That higher duty transcended him any narrower legal definitions of law-breaking. For example, Ben Wizner, a lawyer from the American Civil Liberties Union who represented Snowden since November 2013, argues that Snowden’s taking of classified documents was as “act of conscience” that overrode any legal constraints because it “revitalized democratic oversight in the U.S.” And, without question, Snowden’s theft caused a much needed debate on govern surveillance. In this ends- justify-the-means view, any person with access to government secrets can authorize himself or herself to reveal those secrets to the world if it serves the public good and because doing so would be an “act of conscience,” he or she should be immune from legal prosecution. So for Snowden’s supporters, his “act of conscience” justifies his claim to being a whistle-blower even though the preponderance of the secrets disclosed by Snowden had to do with the NSA’s authorized activity of using its multi-billion dollar global arrays of sensors to intercept data in foreign countries and share it with some 30 allied intelligence services, as it did in 2013. Snowden, for example, took the NSA to task for its sharing information with Israel. In an interview in Moscow with James Bamford for Wired Magazine in August 2014, Snowden describes supplying intelligence to Israel as “One of the biggest abuses we’ve seen.” He was referring to the NSA providing the Israeli Cyber Service, known as Unit 8200, with data concerning Arab communications in Gaza, the West Bank, and Lebanon. But providing Israel with such data, as well as providing it with lethal weaponry, was not some rogue operation. It was part of a policy that had been approved by every American President—and every Congress—since 1948. Snowden had every right to disagree with this established US policy of aiding Israel with intelligence, but it is another matter to release secret documents to support his view. If the concept of whistle blowing is expanded to cover intelligence workers who steal secrets because they disagree with their government’s foreign policy of their government, it would also have to include many notorious spies, such as Kim Philby. Snowden’s concept of whistle-blowing also applied to NSA’s spying on adversary nations. “We’ve crossed lines.” Snowden said in regard to China, “We’re hacking universities and hospitals and wholly civilian infrastructure.” The NSA’s operations against China were such “a real concern” for Snowden that he targeted lists of the NSA’s penetrations in China. This expansion of the whistle-blowing concept to adversaries was echoed by Russian President Vladimir Putin. He complimented Snowden for having “uncovered illegal acts by the United States around the globe,” Putin’s view implies a convenient global concept of whistle-blowing that justified breaking US laws. Even so, this whistle-blower interpretation of Snowden’s act has had immense international resonance in the media. The Washington Post and Britain's Guardian, the newspapers that initially published the purloined documents, won the 2014 Pulitzer Prize. The journalists, who assisted Snowden in this enterprise, including Greenwald and Poitras, were awarded the 2014 Polk Award for national-security reporting. Former Congressman Ron Paul organized a clemency petition in February for Snowden, stating: "Thanks to one man's courageous actions, Americans know about the truly egregious ways their government is spying on them," and his son, Senator Rand Paul, who was a candidate for the Republican Presidential nomination in 2016, calling for a Presidential pardon for Snowden. Senator Paul’s concern fitted with the growing public apprehension over increasing intrusion on its privacy. Snowden was correct, in my opinion, in describing the threat of a surveillance state and the loss of privacy is certainly a legitimate public concern. “We actually buy cell phones that are the equivalent of a network microphone that we carry around in our pockets voluntarily,” he pointed out from Moscow. Snowden is correct that the technology involved in the electronic equipment we all use in the 21st century has made mass surveillance part of our daily life. There can be little doubt that our privacy has been largely eroded, if not entirely negated, by the widespread use of cell phones, credit cards, social media and the search engines of the Internet. When we use smart phones, as most Americans do today, our location is relayed to our telephone service provider every three seconds. The phone companies collect and archive our phone usage “metadata,” which includes whom we called and how long we spoke. When we use Google to search for anyone or anything on the Internet, that activity is captured by Google, a company whose profits mainly come from making available to advertisers the results of its surveillance and collection of its users’ searches. When we use Gmail, the Google’s email service used by nearly one-billion senders and recipients, we agree to allow Google to read the actual contents of our correspondence to find keywords in them of interest to advertisers. When we use a credit card, the credit card company also retains data about what we buy and where we go. When we travel in automobiles equipped with GPS, every turn and stop is tracked and recorded. And when we are in public places with CCTV cameras, our image is recorded and archived. When we use Facebook, Twitter, and other so-called social media, as over two billion people do today, we allow these companies to collect, retain and exploit its surveillance of our movements, associations with other people, and stated preferences. When we use Amazon and other on-line stores, we allow them to track and archive a great deal of our commercial activity. For Internet companies, such as Facebook, Twitter, Yahoo and Google, collecting private data on hundreds of millions of their members provide them with vast searchable data bases that they can sell to advertisers and other search parties. The exploitation of these data bases is a fundamental aspect of their business plans. Without such surveillance of their users, social media companies would not be able to turn a profit. Indeed, they may be more aptly called surveillance media rather than social media. For those of us who use them to post pictures and communicate, any notion of personal privacy is largely illusionary. To be sure, there is a distinction to made between the surveillance of our activities to which we voluntarily agree in exchange for the benefits and conveniences that we gain from social media, search engines, and other Internet companies, and the surveillance done by government to which we do not voluntarily invite-- or want. We willingly waive our privacy for corporations but not for governments. What the public might not fully realize, however, is that all the personal information in data bases of private companies can be accessed by the government if it obtains a court order or search warrant. As Snowden himself pointed out, “If Facebook is going to hand over all of your messages, all of your wall posts, all of your private photos, all of your private details from their server, the government has no need to intercept all of the communications that constitute those private records." These Internet companies, even if they are only interested in exploiting the data for its own profit, cannot refuse to share this information with the NSA, FBI and other agencies of the government if they have a court-ordered search warrant, Consequently, all the information these private corporations collect about us is legally available to any municipal, state and federal authority that obtains a warrant from a court. And such search warrants are routinely issued. That reality became evident to me in my investigation of the rape charges brought (and subsequently dropped) against Dominique Strauss- Kahn, the managing director of the International Monetary Fund, in 2011. Immediately after his arrest, Cyrus Vance Jr, the district attorney of New York county, obtained a warrant for Strauss-Kahn’s cell phone records, credit card records, hotel room electronic key records, emails, room service bills, and the CCTV videos of his activities (some of which I published in my article about the case in the New York Review of Books). If anyone doubts the pervasiveness of government data collection, consider a little known government agency called the “Consumer Financial Protection Bureau.” Created in 2010 by Congress, it mines data on a monthly basis from some 600 million personal credit card accounts, targeting about 95 percent of the credit cards users in the United States. In additions, through 11 other data mining programs, it gathers data on everything from private home mortgages and student loans to credit scores and overdrafts in personal banks accounts. This ubiquitous surveillance of virtually every non-cash transaction came about because of advances in computer technology which made it economically feasible to mine data. Nor is the concern raised by Snowden about NSA domestic surveillance misplaced. Ever since the 9-11 attack the NSA has increasingly played a role in this surveillance state not by own choice but because Congress mandated it. In 2001, it empowered the NSA to obtain and archive data on American citizens. Accordingly, the NSA obtained the billing records of customers from phone and Internet companies and archived these records. The operation was intended to build a searchable data base for the government that could be used to trace the history of the telephone and Internet activities in the United States of FBI-designated foreign terrorists and spies. The government also kept secret these anti-terrorist programs from the public because it did not want the foreign suspects to realize their communications in America were being monitored. The public only learned that the phone company was turning over its billing records on June 5, 2013, when Snowden disclosed it to the Guardian and Washington Post. The documents he provided the journalists showed that the NSA had been obtaining phone records every three months that had been collected by Verizon. While this revelation may have shocked the American public, the NSA had not acted on its own. It had obtained a warrant issued by a secret court established by Congress in 1978 as part of the Foreign Intelligence Surveillance Act (FISA) for each request for records. Congress empowered the FISA court to hear cases and authorize search warrants in secret in cases involving national security. As its name implies, the FISA court was meant to deal with matters bearing on foreign intelligence activities in the United States. That restriction changed after the devastating terrorist attacks of September 11, 2001. A month after the attack, Congress expanded the purview of the FISA court by passing the USA Patriot Act (an acronym which stands for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism”). Part of the Act, Section 215, euphemistically referred to as the "library records" provision, permitted the FISA court to issue warrants authorizing searches of records by the NSA and other federal agencies to investigate international terrorism or clandestine intelligence activities Through these FISA authorizations, the NSA could obtain "tangible things" such as "books, records, papers, documents, and other items." Under the interpretation of this section of the law by both the Bush and Obama administrations, the FISA court was enabled by Congress to issue warrants to telephone companies demanding that they turn over to the NSA the bulk billing records of all calls made in America.. The FISA court need only deem these records to be “relevant: to the FBI’s investigations of terrorists and spies. Essentially, this controversial interpretation of the word “relevant” in Section 215 by the FISA court was used by the NSA to create a searchable database of telephone billing records. Such a “haystack,” as the NSA called the national collection of billing records, could allow the FBI to instantly find missing “needles,” even if the connections were made years earlier. For example, if the FBI had a lead on a foreign suspect, it could search the data base for any telephone calls made by the foreign suspect to telephone numbers in America, and then who those people called. The FBI always had this power, if it obtained a warrant, but it did not have the records previously in a single data base. General Alexander believed such a “Haystack” database made sense. His approach was, ‘Let’s collect the whole haystack,’ ” according to one former senior U.S. intelligence official quoted by the Washington Post. According to its critics, including the ACLU, the results provided by this vast database did not justify its immense potential for abuse. In early May 2015, just three weeks before this part of the Patriot Act was set to expire, a three-judge panel of the Second U.S. Circuit Court of Appeals in New York, agreed with the ACLU position, overturning a lower court decision that it was legal. The panel found that the word “relevant” in the Act was not intended by Congress to justify the acquisition and storing of the bulk records of telephone companies. It declared that the government’s interpretation of Section 215 of The Patriot Act was incorrect. Soon afterwards Congress replaced the Patriot Act with the USA Freedom Act, which effectively transferred bulk storage of billing records from the NSA to the phone companies themselves. Despite the change in venue, the records of individuals were still not completely private. The databases held by phone companies could still be searched under the new law via a FISA warrant by the FBI. The core of Snowden’s charge in the media was that the FISA court overreached its authority by issuing sweeping warrants that allowed the NSA to obtain data collected by private phone and Internet companies. It the initial story published in the Guardian on June 5, 2013, Snowden disclosed one such FISA warrant to support his charge. It was issued by Judge Roger Vinson of the FISA court on April 25, 2013 and ordered Verizon to turn over to the FBI all its billing records of landline customers for the next 90 days. The FBI presented this FISA authorization to the NSA, which acts as a service organization for the FBI and CIA in collecting communications data. The NSA, with the FISA warrant in hand, then obtained the Verizon billing records. Snowden also provided the Washington Post and Guardian with another secret document, which was actually a power point presentation on 20 slides by the NSA to other intelligence agencies. It described a program it was using for monitoring the Internet. Its code name was PRISM. It was authorized under Section 702 of the Foreign Intelligence Surveillance Act and was designed to collect messages sent over the Internet from foreigners. Since most of the Internet pipes that carried these messages ran through the United States, the NSA intercepted a large part of the data from Internet companies based in America. This program was not entirely secret from the Internet companies. Such information was in fact obtained with FISA court approval and with the knowledge of the service providers. It also requires a written directive from both the Attorney General and the Director of National Intelligence, and a review by the Department of Justice every three months of each case. After obtaining this data, the NSA ran programs to filter out all domestic Internet communications. In theory at least, PRISM targeted foreign communications, but, as Snowden pointed out, domestic information was also accidently picked up. Whenever the Justice Department actually opened an investigation against Americans in contact with foreign suspects, as it did in 170 cases in 2013, it could obtain warrants from the FISA court to search these Americans’ Internet activities. So though PRISM supposedly was a tool for foreign surveillance, it could be extended to Americans in contact with foreign suspects. These two documents raised legitimate questions for many Americans, including members of Congress, about the proper role of the FISA court, including should it conduct its business in secret? If Snowden had released only these two documents that related to unwarranted domestic surveillance, and other possible violations of the law by the NSA, it would be difficult for any reasonable person not to see his actions as a valuable and even necessary public service. After all, as the three-judge panel of the Second U.S. Circuit Court of Appeals would later find, Congress had not intended Section 215 of the Patriot Act to be used to justify the bulk collection of American records. So if he had limited his illegal downloading to the few documents about bulk collection, it would be more difficult to argue that he was not a whistle-blower in spirit if not in the letter of the law and even a hero of the struggle to preserve our civil liberties. But, in fact, he took a great many other secret documents that did not bear on civil liberties issues. As a result, the Snowden case produced a great divide in the American appreciation of him. On one hand, he has been almost universally lauded and lionized by what might be seen as the mainstream media, by numerous academics, and even, as we have seen, by members of Congress. The journalists who assisted him, such as like Greenwald, Poitras and/ Gellman also have been celebrated for the roles they played in bringing Snowden’s revelations to the public. In other circles, the appreciation had been of him has been very different. American and British intelligence officials, senior members of the Obama Administration, and members of the oversight committees of Congress do not view Snowden as a hero or even an authentic whistle-blower. Instead they see him as a betrayer of secrets who, acting willfully brought damage to the United States and benefits to its adversaries. The holders of this darker view of Snowden base it on classified reports of the full extent of the theft of classified data. Those officials reckon that only handful of the tens of thousands of documents he stole involved domestic surveillance, and these few documents served as a cover for a much larger theft. Admiral Michael Rogers, who replaced General Alexander as head of the NSA in January 2014, said that March at a public forum at Princeton University. “Edward Snowden is not the "whistleblower" some have labeled him to be.” He further explained to Congress: “Snowden stole from the United States government a large amount of classified information, a small portion of which is germane to his apparent central argument regarding NSA and privacy issues.” Gen. Martin Dempsey, the chairman of the Joint Chiefs of Staff, went even further. He testified to the House Armed Services Committee on March 6, 2014, after estimating that the Snowden breach could cost the military “billions” to repair, added that "The vast majority of the electronic documents that Snowden exfiltrated from our highest levels of security had nothing to do with exposing government oversight of domestic activities." He based this assessment on then still-secret Defense Intelligence Agency’s report on the breach. Although he did not reveal the full extent of the damage even in his classified testimony to Congress in 2013, the classified DIA report showed that Snowden took "over 900,000" military files from the Department of Defense (DoD) in addition to the NSA files he had taken.. The Defense Department loss in terms of the number of files stolen actually exceeded the loss, in sheer numbers, of NSA documents. Lieutenant General Mike Flynn, the DIA director, who directed the DIA secret study, testified to the Senate Select Committee on Intelligence that the breach “has caused grave damage to our national security.” To be sure, this was not the first time that the cryptological branches of the military had been compromised. The spy ring of John Walker had provided thousands of the Navy’s reports on breaking Russian ciphers to the KGB during the Cold War era, for example. But the Snowden breach exposing military sources was an order of magnitude greater than any past breach. The CIA’s assessment was no less grim. Michael J. Morell, the deputy director of the CIA in 2013, who, after Snowden’s breach, was appointed by President Obama to the task force to review the NSA’s intelligence breach and its consequences for national security, wrote that Snowden’s action went beyond taking the handful of documents, such as the FISA order, “that addressed the privacy issue.” Instead, as Morell put it, “he backed up a virtual tractor trailer and emptied a warehouse full of documents—the vast majority of which he could not possibly have read and few of which he would likely understand—[and] and he delivered the documents to a variety of news organizations and God knows who else.” As a result, Morell concluded “Snowden’s disclosures will go down in history as the greatest compromise of classified information ever.” General Keith Alexander, the head of the NSA at the time, came to a very similar assessment, asserting that Snowden did “the greatest damage to our combined nations’ intelligence systems that we have ever suffered.” To be sure, it is to be expected that military intelligence officers would not be on Snowden’s side of the divide (and the Snowden breach ended the career of many of them, including General Alexander.) But political leaders in both parties could also be found on the anti-Snowden side of the divide. “I don’t look at this as being a whistle-blower.” Senator Dianne Feinstein (D. - Calif.), the head of the Senate Intelligence Committee, said after she was briefed on Snowden's theft of documents. "I think it’s an act of treason." Rep. Mike Rogers, (R.-Mich.), her counterpart on the House Intelligence Committee, said on the NBC program, “Meet the Press,” that Snowden might be working for a foreign intelligence service. And a former prominent member of President Obama's cabinet went even further, suggesting to me off the record in March this year that there are only three possible explanations for the Snowden heist: 1) It was a Russian espionage operation; 2) It was a Chinese espionage operation, or 3) It was a joint Sino-Russian operation. These severe accusations generated much heat but little light. They were not accompanied by any evidence from these Congressional leaders showing that Snowden had acted in concert with any foreign power in stealing the files or, for that matter, that he was not acting out of his own personal convictions, not matter how misguided they may have been. On this side of the divide, Snowden's critics regard the whistle blowing narrative as at best incomplete, and at worst fodder for the naive. They point out that the FISA document that gave him credentials as a whistle-blower was only issued in the last week of April 2013, which was three months after he first contacted Greenwald and almost 9 months after he began illegally copying secret documents. They further believe that the evidence contradicts Snowden’s claims that he stole only documents that exposed NSA transgression into domestic surveillance, that he turned over all the stolen documents to journalists, and that he was forced to remain in Moscow by the actions of the US government. They believe that all three of these claims, which are at the conceptual basis of the whistle blowing story, are false. They also find that the unprecedented size and complexity of the penetration of NSA files, compromising hundreds of thousands of secret documents pertaining to US operations against adversary nations, according to the NSA’s and Pentagon estimates, does not afford an innocent explanation for the volume of files he took. The deep split in how Snowden is perceived brings to mind the famous drawing of a duck -rabbit cartoon first published in 1900 in the book Fact and Fable in Psychology. The figure is perceived either as a duck or as a rabbit but it cannot be seen as both simultaneously. Whether a person sees a rabbit or duck in this test may depend on the information available to that person. For example, if the person has never seen an image of a rabbit before, he will see almost certainly see a duck; and vice versa. Similarly, what may account for the sharp divide between the Snowden and anti-Snowden camps is a disparity in the available information. The pro-Snowden camp's view is largely informed by Snowden himself. It prefers to believe his words over his actions. In the anti-Snowden camp are administration officials and the members of the House and Senate intelligence oversight committees who have been at least partially briefed on the continuing investigations of the Snowden affair. The members of the Senate Intelligence Committee, for example, were briefed by David Leatherwood, the director of operations of the Defense Intelligence Agency that the military files compromised by Snowden included documents bearing on military plans and weapons systems; foreign government’s intelligence activities (including special activities), intelligence sources, or methods or cryptology; Scientific and technological matters relating to national security;; vulnerabilities systems, installations, infrastructures, projects, plans, or protection services relations to national security and the development, production, or use of weapons of mass destruction. The members of the House and Senate Intelligence Committees, but not the public, also have been privy to an NSA investigation that established the chronology of his actions, including changing jobs, copying more than one million classified documents at the Signals Intelligence Center in Hawaii and flying to Russia. Nor does additional information necessarily change the minds of people who already have a firm view. In the field of social psychology, the testing of “confirmation theory” consistently shows that people tend to more readily reject new information that contradicts their pre-existing beliefs. For example, when Lee Harvey Oswald was arrested in the Texas Theater on November 22, 1963, he said famously, “I haven’t shot anybody.” Ten months later, the Warren Commission presented evidence, including ballistic tests that it claimed showed that Oswald had shot three people, including President John F. Kennedy, less than an hour before making his statement. Yet, many of those who believed Oswald’s public proclamation his innocence chose to believe that the government had falsified all the incriminating evidence to tarnish Oswald (who had been killed on November 24, 1963) rather than accept that they had been wrong in believing Oswald. The charges, countercharges and defamatory name-calling in the Snowden case therefore only deepened the great divide. Those who saw Snowden as a democratic hero exposing the abuses of power of an out-of-control national security state tended to dismiss anything that depicts Snowden in a negative light as a fabrication while those who saw Snowden as a “traitor” tended to dismiss anything that depicted him in a more positive light. When it comes to the murky universe of spy agencies, the problem in deciding where the truth lies is further heightened by the possibility of deliberate deception. Spy masters are, after all, in the business of concealing their most sensitive operations. It is often considered essential that important secrets be protected by what Winston Churchill famously termed “a bodyguard of lies.” Top intelligence officials are not exempt from this practice. Consider, for example, the response to a question concerning the NSA’s operations made by James D. Clapper, the Director of National Intelligence to the Senate Intelligence Committee on March 12, 2013. Senator Ron Wyden (D-Oregon) of the Committee asked the spy master if the NSA collected data on Americans. Clapper answered that the NSA did not knowingly “collect any type of data” on millions of Americans. Clapper’s answer was clearly untrue. However, it did not mislead Senator Wyden or any other members of the Senate Intelligence Committee because Clapper had truthfully testified that the NSA did collect American’s telephone records in a classified session of the Committee earlier that week. Who was being misled was the American public. Yet, none of the Senators on the Committee, including Senator Wyden, corrected this obviously false answer. When Clapper realized he had misspoken, he could not publically correct the record of the public session because, to do so, would be revealing classified information he had swore to protect. No doubt other intelligence officers find themselves in a similar bind in discussing secret matters. This suggests that there is a risk in accepting statements made by the intelligence chiefs at face value. But Snowden also has a credibility problem. He has told numerous untruths including ones calculated to help him insinuate himself into the key position from which he stole secrets and to cover up the nature of his theft. For example, Snowden got access in the spring of 2013 to the super-secret NSA’s computers storing these electronic files by working at Booz Allen Hamilton, a hedge-fund owned consulting firm, that helped manage computer systems at its Kunia base in Hawaii. On his application to Booz Allen in March 2013, Snowden claimed to be in the process of completing a master’s degree at the University of Liverpool in computer security sciences, which he expected to get that year. Although he had registered two years earlier at the online division of University of Liverpool, he had not completed a single course there and, according to the registrar, he was not in line to receive a master’s (or any) degree. To be sure, Snowden did not lie gratuitously. He told untruths to get access to classified documents and to get safely away with them. He also was not entirely truthful with journalists whose trust he sought when it suited his purpose in protecting himself. For example, in contacting Laura Poitras under the alias Citizen Four in January 2013, he gave her his word that he was currently a “government employee,” although in fact he was working for a private contractor at the time. Snowden had little concern about misleading journalists when it suited his purpose. For example, he told Alan Rusbridger of the Guardian, Brian Williams of NBC News, James Bamford of Wired Magazine, Katrina vanden Heuvel of the Nation, Barton Gellman of the Washington Post and Jane Mayer of The New Yorker that the U.S, government intentionally acted to “trap” him in Moscow by revoking his passport while he was already on a plane to Moscow on the afternoon of June 23, 2013. Although he had first made this charge on July 1, 2013, none of these journalists asked Snowden what was the basis for his oft-repeated allegation. He did admit, however, during the Q&A following his July 12, 2013 press conference in Moscow that he had no independent source, sating t he had “read it” in the news reports. In fact, news stories prior to his statement reported that his passport had been revoked before he had left Hong Kong on June 22nd, 2013. ABC News, for example reported that the U.S. "Consul General-Hong Kong confirmed Hong Kong authorities were notified that Mr. Snowden's passport was revoked June 22.” By the date to June 23rd, Snowden effectively provided to unsuspecting journalists an alibi for his presence in Russia. The credibility problem with Snowden assumed a more sinister dimension once Snowden put himself and his fate in the hands of the Russian authorities in Moscow. Even though the Obama Administration decided against revealing the extent of Russian intelligence service's participation in Snowden’s move from Hong Kong to Moscow, or what intelligence services call an “exfiltration,” I was told by a Presidential National Security staff adviser that the government acted to protect the intelligence sources used by the CIA, NSA and FBI to track Snowden’s movements in the latter part of June in Hong Kong. CIA Deputy Director Morell would go no further than to state that during that period he had no doubt the intelligence services of Russia and China “had an enormous interest in him and the information he [Snowden] had stolen.” Presumably, the last thing these adversary services would want would be to make this “interest” transparent to the United States. The role of concealment must be taken into account when assessing information bearing on the work of espionage services. I learned when I was interviewing James Jesus Angleton, the CIA’s legendary ex-counterintelligence chief of the CIA in the 1970s for my book on deception that intelligence services play by a different set of rules than historians when it comes to their espionage successes. Angleton, a famously baroque thinker himself, impressed on me the complexity of espionage. He said “It’s not enough just to steal a secret. It must be done in a way that the theft remains undetected.” From his perspective, there were two requisites that had to be fulfilled to assure the success of any intelligence theft. The first task is the obvious one: acquiring by espionage an adversary’s state secrets. The second task is concealment of that success. Deception is employed to obscure the nature and the extent of the espionage theft. This deception is necessary to extend the usefulness of theft. One of the most famous examples of this principle was the deceptions used by British intelligence in the Second World War to conceal its success in breaking the German ciphers generated by the Enigma machines. If German naval intelligence discovered Britain was able to read the ciphers it used to communicate with its U-boats, it would have stopped using them. So British intelligence hid its coup by supplying false information to known German spies to account for the sinking of U-boats, including the canard that British aerial cameras could detect one ingredient in the paint used to camouflage the U-boats. That same hoary principle of deception applies to modern-day communications intelligence. If the Russian, Chinese or any other adversary intelligence service got its hands on the documents stolen by Snowden from the NSA’s repositories in Hawaii in 2013, it would likely employ deception, including well-crafted lies, to create as much ambiguity as possible as to the ultimate disposition of the missing documents. From this counterintelligence perspective, the intelligence issue that spawned the great divide cannot be resolved by accepting the uncorroborated statements made by a source, such as Snowden, who may be in the hands of the Russian security services in Moscow. By the same token, the calculations made by NSA officials about the extent of the theft are also suspect. After all, the NSA is an intelligence service that often engages in secret machinations. We know that its top officials reported to the House and Senate Intelligence Committees, as well as the President’s National Security Adviser, that over one million documents were compromised by Snowden. But if this was disinformation, it is difficult to see its purpose. Inflating the extent of the damage of the Snowden breach to the President, Congress and the Secretary of Defense obviously reflected poorly on their own management of the NSA, and their own careers. Yet such a possibility cannot be precluded in the arcane world of intelligence. As in any case involving the loss of state secrets, uncontested facts remain in extremely short-supply. The opinion-laden appellatives such as “patriot” and “traitor” that have tended to fill the gap in the great divide do little to address the important mystery of how many thousands of state secrets were taken from the United States. How did Snowden breach the supposedly formidable defenses of the NSA? Did he have any assistance? How did he escape to Moscow? And what was the final destination of the stolen documents? The purpose is to find answers to these questions. For this endeavor, it is necessary to return to the crime scene: the NSA’s base in Hawaii. CHAPTER TWO The Crime Scene Investigation “Any private contractor, not even an employee of the government, could walk into the NSA building, take whatever they wanted, and walk out with it and they would never know.” Edward Snowden, Moscow 2014 About 15 miles northwest of Honolulu on the island of Oahu in Hawaii, adjacent to the sprawling Wheeler Air Force Base, is a 250,000 square foot man-made mound of earth and reinforced concrete surrounded by an electrified fence. Inside the mound is a three story structure originally built by the Air Force in the Second World War as a bomb-proof aircraft repair facility. In the Cold War, it was modernized to withstand an enemy chemical, biological, radiological or Electrical Magnetic Pulse attacks, and used by the Navy’s operation center for its Pacific fleet. After the Cold War ended, the huge edifice was turned over to the NSA, which had been created as an intelligence service to intercept the communications and signals of foreign countries after World War II, a mission which included vacuuming into its giant computer arrays telephone messages, missile telemetry, submarine signals and virtually everything on the electro-magnetic spectrum of interest to the US defense department and US intelligence agencies. Because it provided a valuable window on the activities of adversary nations in the Pacific region, it was able to monitor the ballistic missile tests and submarine activities of China, North Korea and Russia. As the NSA developed it, this Hawaiian base became one of its primary regional bases for gathering Asian communications intelligence. By 2013, the Kunia base, also called “the tunnel” by its NSA workers, had a vast array of state-of-the-art technology, including 90 Cray supercomputers arranged in a horseshoe configuration, used to decipher and make sense of the intercepted signals from China, Russia and North Korea. At the heart of the Hawaiian complex was a unit with both military and civilian employees. A large share of the civilians who ran the computers worked under two-year contract to the NSA’s leading civilian contractor, Booz Allen Hamilton. Keith Alexander, the four-star general who headed the NSA from 2005 to 2014, first learned about the impending story in the Guardian on June 4, 2013 while he was in Germany meeting with its top intelligence officials. Janine Gibson, the Guardian’s American website editor had notified the NSA it intended to break a story based on NSA the next day. It took NSA counterintelligence less than 48 hours to determine that a civilian employee at the base from which documents were stolen had not reported back to work on June 3rd, 2013. It also determined he had lied on his application of a two-week medical leave and had flown to Hong Kong. The missing man was Edward Joseph Snowden, a 29-year civilian employee of Booz Allen Hamilton. At the time of the theft in May 2013, he was still being trained as an analyst at the Threat Operations Center. Personnel records further showed that he had worked there for less than six weeks. He had taken the medical leave on May 18, 2013 left the country by plane. By June 7th, he had become the NSA’s main suspect. Snowden had been hired to work there as an outside contractor by Booz Allen Hamilton, a private company owned by a hedge fund, which managed much of the information technology at the Center. General Alexander, returning to Washington DC after assigning the sensitive job of investigating the breach to Richard “Rick” Ledgett, the Director of the NSA’s Threat Operations Center at NSA’s headquarters in Fort Meade, Maryland. It was a key position since the top-secret unit was responsible for discovering and countering the threats posed by Chinese, Russian and other adversary nations. Ledgett was also the logical choice to head the damage assessment investigation since the Center’s regional branch in Hawaii was from where highly-sensitive documents were stolen and where the main suspect, Snowden, last worked. Ledgett immediately boarded a military jet bound for Hawaii. His first task was to reconstruct the chronology all of Snowden’s moves at the Center, or, as the tactic is called in counterintelligence parlance, “walking the cat back.” The NSA meanwhile notified the FBI of Snowden’s possible involvement in the theft of state secrets. It is in charge of criminal investigations of civilian US intelligence workers, even if they occur on a NSA base, The FBI immediately dispatched a top task force of agents to investigate a potential espionage case in Hawaii. When questioned, Lindsay Mills, who shared Snowden’s rental home with him and had been his girl friend for 8 years, said Snowden was away on a business trip. After determining from airline and hotel data that he was in Hong Kong, the FBI realized Snowden was a possible intelligence defector. It froze his credit and bank cards. It also notified the passport office in the State Department the legal attaches at the Hong Kong consulate. The legal attaches, who were actually FBI field agents posted in Hong Kong, located Snowden at the Mira Hotel on June 8th. Such international detective work proved unnecessary since on the evening of June 10th, Snowden ended all doubts about the identity of the perpetrator by revealing in a 12-minute video posted on the Guardian website that he was the source of the stolen NSA documents for which the FBI was searching. The problem was that since Hong Kong was in China, US law enforcement did not have the means to recover them. At that point, determining the magnitude of the theft of documents became a critical concern of the investigation. Aside from the few dozen documents published by the Guardian and Washington Post, what else had Snowden stolen? Within the next few days, a small army of forensic investigators from the FBI, the Defense Department and the “Q” counterintelligence division of the NSA swarmed onto the NSA base in Hawaii. The proximate crime scene for their investigation was the National Threat Operations Center. They examined the cubicle where Snowden had last worked at NSA, and then began retracing all his activities at the NSA over the past four years. To begin with, they needed to find out how many documents from the Center had been copied and taken by Snowden. The Defense Intelligence Agency (DIA), the Pentagon’s own intelligence service, meanwhile was kept partially in the dark. It did not learn from the NSA that Snowden had stolen military documents, concerning the joint Cyber Command until July 10, 2013. In terms of sheer quantity, the number of stolen military documents was staggering. The DIA found that Snowden had copied “over 900,000” military files. Many of these files came from this joint command, which had been set up in 2011 by the NSA and Army, Navy, Marine and Air Force cryptological services to combat the threat of warfare in cyberspace. The loss was considered of such importance that between 200 and 2500 military intelligence officers worked day and night for the next four months, according to the DIA’s classified report, to "triage, analyze, and assess Department of Defense impacts related to the Snowden compromise." The job of this unit, called the Joint Staff Mitigation Oversight Task Force, was to attempt to contain the damage caused by the Snowden breach. In many cases, containment meant shutting down NSA operations in China, Russia, North Korea and Iran so they could not be used to confuse and distract the U.S. military. The NSA and Defense Department were not the only government agencies concerned with determining the extent of the breach. There was also the CIA. The NSA acted as a service organization for it, handling most, if not all, of its requests for communication intelligence to support its international espionage operations. Although the CIA and NSA were both part of the so-called “Intelligence Community,” the NSA did not immediately share with the CIA details of the Snowden breach. Despite the immense potential damage of the theft, it was not until a week later that CIA Director John Owen Brennan and Deputy Director Michael Morell were briefed by the NSA. When Morell realize how much data had been taken by Snowden, he was astounded “You might have thought of all the government entities on the planet, the one least vulnerable to such grand theft would have been the NSA,” he wrote “but it turned out that the NSA had left itself vulnerable.” According to Morell, he bluntly told the NSA briefer that it was urgent for the CIA to be brought in on the case. After all, only four years earlier Snowden had been employed by the CIA. Specifically, Morell said the CIA needed to find out three things. Has CIA documents had been part of Snowden’s haul? How long had Snowden been stealing documents? Had Snowden been working “with any foreign intelligence service, either wittingly or not?” According to Morell, the effort to get a direct answer from NSA officials to these three key questions “proved maddeningly difficult.” He found that in mid June NSA officials with whom he dealt were so “distraught at the massive security breach” that initially they even refused to allow CIA officers to participate in the on-going security review. A former NSA executive told me there was “near panic” at the NSA. Finally, Morell called Chris Inglis, a former professor of computer science who had risen to be the NSA’s Deputy Director at the time of the breach. Inglis, who headed operations for the NSA, told him “the news was not good.” Among the data copied by Snowden were a large number of CIA secrets. By the time, the CIA learned that its secrets had been compromised, Snowden was headed to Russia. The investigation of a crime involving potential espionage is no easy task. In this case, it required attempting to solve a jigsaw puzzle in which not only were key pieces missing but, since it involved adversary intelligence services, some of the found pieces might have been twisted to deliberately to mislead the US investigators. By late July, NSA investigators made their initial assessment. They determined that most of the material had been taken from sealed-off areas, known in intelligence-speak as “compartments,” which in this case were files stored on computers that were isolated from any network. Each compartment electronically tracked all the activities that occur in them on their logs, including the password identity of any person who has gained entry to any compartment. From a forensic examination of these logs, NSA investigators were quickly able to reconstruct the timeline of the theft. The logs showed that an unauthorized party had begun copying files in mid-April, which was just days after Snowden began his job at the Center. The breach illicit activity ended just before Snowden’s last day of work there. So this piece fit in with Snowden’s guilt. The size of the theft was another matter. Ledgett was certainly in a position to know. Not only had he been in charge of the National Threat Center at the time of the Snowden breach, but he personally supervised the NSA’s damage assessment team. And, in the shake-up that followed that followed, he would replace Inglis as Deputy Director of the NSA. According to Ledgett, the perpetrator, moving from compartment to compartment, had “touched” 1.7 million documents. Of these “touched” documents, according to the analysis of the logs, more than one million of them were moved in mid-May by the unauthorized party to an auxiliary computer intended to be used for temporary storage by authorized service personnel. Finally, the data was transferred from this auxiliary computer to thumb drives. This download occurred just days before Snowden’ left the NSA on May 17, 2013, having told the agency that he needed a leave of absence to undergo medical treatment in Japan. The FBI further established from airport records that Snowden flew to Hong Kong the next day presumably with thumb drives containing, by the government’s calculation, over one million documents. To be sure, the quantity of stolen documents does not necessarily reveal the damage, and can itself be misleading. Many documents that do not reveal current or known sources or methods and others may have little value to an enemy. And a large portion of the 1.7 million documents may have been duplications. But the quality of some of these documents is another matter. Just one document that exposed a source or method of which enemies are unaware can be of immense value. For example, one of the missing documents taken by Snowden provided what Ledgett called “a roadmap” to the NSA’s current secret operations. That single document would reveal to an adversary such as Russia, China or Iran, according to Ledgett, “what we know, what we don’t know, and, implicitly, a way to protect themselves.” And there were many documents in the Snowden breach that met these criteria, according to a National Security official at the Obama White House. The breach had happened on the watch of General Alexander, who headed both the NSA and the US Cyber Command, in 2013. A short, compact man with military bearing, Alexander closely followed the investigation as it developed over the summer of 2013. By then, of course, the whole world knew that Snowden had stolen a vast trove of NSA documents. But General Alexander saw major inconsistencies developing between Snowden own account of the theft and what had actually happened. To him, Snowden’s timeline, as established by the government’s investigators, did not match up to Snowden’s story line. “Something is not right,” Alexander said in an interview. What was wrong with Snowden's account proceeded from unresolved inconsistencies in both the timing and nature of the theft. For one thing, Snowden had made the claim to journalists, four months after he was in Russia, that he had turned over all the documents he took from the NSA’s compartments to journalists Laura Poitras and Glenn Greenwald in Hong Kong. However, on August 18, 2013, the investigators had the opportunity to examine the files that Snowden had actually given Poitras and Greenwald in Hong Kong. This discovery came when David Miranda, Greenwald’s romantic partner, was detained at Heathrow Airport by British Authorities under Schedule Seven of Britain’s Terrorism Act. At the time, as British intelligence presumably knew, Miranda was acting as a courier for Greenwald and Poitras. According to Greenwald’s account, Snowden had given both him and Poitras identical copies of the NSA documents in Hong Kong. When Greenwald returned home to Rio de Janeiro, he found his copy was corrupted. But Poitras still had her digital copy of whatever stolen documents that Snowden had distributed to them. So Greenwald dispatched Miranda from Rio to Berlin to get a copy of Poitras’ thumb dive. On the return trip, Miranda’s plane stopped at Heathrow and British authorities temporarily detained him and temporarily took the thumb drive from him. Poitras had written out the password for Greenwald, and Miranda kept it with the thumb drive. The British quietly copied the contents and shared them with the NSA. As a result, the NSA discovered that Snowden had only given Poitras and Snowden some 58,000 documents. By any measure, it was only a tiny fraction of Snowden’s total haul. The damage assessment team under Ledgett determined that some of these documents had been edited out of much larger documents that the NSA logs showed that he had copied. Snowden had evidently selected for the journalist’s only parts of the lengthy documents. For example, only scattered fragments of the 36,000 page “road map” file were among the material on the thumb drive. By the count of both the NSA team and the Defense Department team almost one million documents were unaccounted for. If Snowden had not given these missing files to Poitras and Greenwald, the issue of what had happened to them became a critical missing piece in the puzzle. Adding another layer to the mystery of the missing documents, the NSA investigation found that the chronology of the theft of documents did not support Snowden’s claim to journalists that he had only been seeking whistle-blowing documents. Most of the documents he first took did not concern the domestic activities of the NSA. It was only towards the end of the theft that he copied documents that would qualify as whistle-blowing. In fact, the now-famous FISA court order to Verizon that was the basis of the initial Guardian expose was only issued by the FISA court on April 27, 2013. The other main whistle-blowing document he revealed, the PowerPoint presentation about PRISM, a joint NSA-FBI-CIA Internet surveillance program, that was the basis of the Washington Post expose, was also only issued in April 2013. Yet Snowden had been down-loading documents for some 10 months before he copied these documents. When I discussed the chronology of the copied documents with a former government official briefed on the investigation, he suggested that Snowden’s purpose may have changed between 2012 and 2013. When I asked him what might have induced the change, he replied “That is one of the unanswered questions.” That Snowden only took these two whistle-blowing documents at the tail-end of his 9-month operation, and after he had contacted Poitras and Greenwald, suggests he may have had another motive prior to contacting journalists. In light of this chronology, the investigation had to consider the possibility that his whistle-blowing was, partly if not wholly, a cover for another enterprise. The investigation soon ran into another serious issue: his access. Snowden had described to journalists a situation in which he had access to“ millions of records that [he] could walk out the door with at any time with no accountability, no oversight, no auditing, the government didn’t even know they were gone,” but, as it turned out, he was not among the limited number of individuals at the Center who had access to these documents, The NSA’s and Booz Allen’s employment records showed that Snowden had not yet completed his requisite on-the- job training at the National Threat Operations Center in Hawaii when he carried out the theft. Consequently, he had not yet been provided with the passwords he needed to get the documents. A former NSA official bluntly told me that Snowden, at least during the period of the thefts in April and May 2013, had no more legitimate access to the compartments than the cleaning personnel at the Center. Somehow he converted his proximity to access. This lack of access could not be ignored in any law-enforcement investigation. Consider if a hundred top-quality D-flawless diamonds were stolen from locked vaults at Tiffany’s by a recently-hired trainee who, it turned out, did not have either the combination to open these vaults. One possibility that the police would be expected to consider was that the trainee might have had help from a current or former insider at the company who knew the combinations. Snowden had accomplished a similar inexplicable feat as the hypothetical jewel thief. In Snowden’s case, the FBI had to consider two very different possibilities that could explain how he could have acquired the password. He said in his video confession that he was solely responsible but there was another possibility. He had help, unwitting or witting, from others and he was trying to protect away from them. The FBI faced a dilemma. It could either assume that the NSA’s security regime was so badly flawed that Snowden could trick his fellow workers into providing him with access or that there was another individual at the Center who might have assisted or directed Snowden. If it pursued the former hypothesis, it could close the case as far as the sitting Grand Jury was concerned. After all, Snowden had admitted he was the perpetrator and, if further evidence was needed, he could be seen showing stolen documents to Greenwald on the video. And Greenwald later used these documents. For the Grand Jury, it was, as one former federal prosecutor put it, “a slam dunk.” Not even Snowden denied the charge that he gave secret documents to individuals that were not authorized to receive them, the same charge for which Manning was convicted. Even if it went no further, the FBI would satisfy its superiors in the Department of Justice that it had done its law-enforcement job. But if it pursued the latter hypothesis, it would need to engage in a mole hunt for a quarry that might not exist. By doing so, it could open a Pandora’s Box of suspicions that it, or the NSA, might not ever be able to close. When the investigation came to this fork in the road in the summer of 2013, according to a source on the House Intelligence Committee, it chose the former route. Finally, there was the question of whether Snowden had gone to Russia by design or accident. Whenever an intelligence worker steals sensitive compartmentalized information of interest to a foreign adversary and then defect to it, it raises at least the specter of state-sponsored espionage. It is a commonly accepted presumption in counterintelligence that a spy, fearing arrest, flees to a country that has some reason to offer him protection. When the British spies Guy Burgess, Donald Maclean and Kim Philby, for example, fled to Moscow in the Cold War the presumption was that they had a prior intelligence connection with Russia. And Philby confirmed it in his 1968 memoir “My Silent War.” So in the case of Snowden, counterintelligence had to consider the possibility that his theft of state secrets and his arrival in Moscow might not be totally coincidental. For his part, Snowden said that he did not leave Hong Kong with the intention of staying in Russia, but that the U.S. government “trapped him” at Moscow’s Airport by revoking his passport. He told editor of The Nation magazine: “I’m in exile. My government revoked my passport intentionally to leave me exiled.” He added that the U.S. government “chose to keep me in Russia.” Although he repeated that assertion over a dozen times, it was untrue. The US government had not invalidated his passport for travel back to the United States. When criminal charges are lodged against a U.S, citizen by the Department of Justice, the State Department, in accordance with the U.S. code of justice, marks in the electronic passport validation advisory system that that person’s passport is electronically marked valid only for return to the U.S. After criminal charges were filed against Snowden, including the theft of classified government documents, it advised foreign governments that Snowden was wanted on felony charges, and “should not be allowed to proceed in any further international travel, other than is necessary to return him to the United States." It was simply requiring that his passport, which is a State Department document, be used for him to return to the United States. Rather than preventing Snowden from returning to the United States, or “exiling” him, the government facilitated his return home. With his passport, he could have flown home from either Hong Kong or Moscow, where he, like any other person accused of a felony, would face the charges against him. Nor was it plausible that President Obama and Secretary Of State Clinton would conspire to trap a perpetrator carrying incredibly valuable national security secrets in Russia. The counterintelligence investigation had little difficulty establishing that Snowden’s trapped” version in the media was not consistent with the actual chronology of the events. Snowden claimed that the U.S. State Department had acted while the plane was flying to Moscow on June 23rd but in actuality it had acted on June 22, 2013, which was the day before the plane (or Snowden) departed from Hong Kong. The Hong Kong authorities had been advised as early as June 19, 2013 that there were criminal charges against Snowden and only a typographical error in spelling out Snowden’s middle name—James instead of John-- in the criminal charges prevented the Hong Kong police from immediately ordering his detention. His Hong Kong lawyers were advised of the pending charges, which were unsealed on June 21, 2013 and published on front page of the South China Morning Post in Hong Kong. So presumably Snowden knew that action by the U.S. government was imminent. One of his lawyers, Jonathan Mann, even accompanied Snowden to the airport out of his concern that he would not even be allowed by Hong Kong authorities to go through passport control. Although Snowden still had a US passport in his possession, the computerized database would show on June 23rd, it was no longer valid for travel to anywhere but the U.S. This electronic notification advised foreign government that his passport was only approved for his return to the U.S. Even so, when he arrived in Russia any future international travel decisions for him would be up to Russia, not the U.S. So the only government with the means to “trap” him in Russia was the Russian government. The U.S. government also knew that his it was no accident that Snowden wound up in the hands of Russia. He had been in contact with Russian officials in Hong Kong. Even before Putin admitted this liaison on September 3, 2013, the CIA knew about it. In fact, on June 23rd, t, Senator Charles Schumer (D-N.Y.), correctly said based on a White House briefing that “Vladimir Putin had personally approved Snowden’s flight” to Moscow. As mentioned earlier, the NSA still had the capability to monitor Russian communication in June 2013. The messages, as well as the traffic, it intercepted from its sources reportedly revealed the Russian intelligence activity in Hong Kong. The NSA also reportedly intercepted contacts between these Russian officials and Russian representatives of Aeroflot, the Russian state-owned airline flying between Hong Kong and Moscow. Aeroflot, like most other international carriers, ordinarily requires international passengers to have both a valid passport and visa to the country of his destination. That those rules were waived for Snowden implicated Aeroflot in Snowden’s exfiltration from Hong Kong. All of which meant to investigators that Snowden’s defection to Moscow was not a haphazard result of unexpected circumstances. This raised new questions for the investigation. What led Snowden to defect to Russia? Was his arrival in Moscow planned by Russia intelligence in advance? Was any other party, such as China, privy to the plan? Was there a quid pro quo?