SHARE
TWEET

Permanent Record Edward Snowden Part Two

a guest Sep 18th, 2019 25,872 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. PART TWO
  2.  
  3.  
  4.  
  5. In sum, during my time in the field, the field was rapidly changing. The agency was increasingly adamant that COs
  6.  
  7. enter the new millennium, and technical field officers like myself were tasked with helping them do that in addition
  8.  
  9. to all of our other duties. We put them online, and they put up with us.
  10.  
  11. Geneva was regarded as ground zero for this transition because it contained the world’s richest environment of
  12.  
  13. sophisticated targets, from the global headquarters of the United Nations to the home offices of numerous specialized
  14.  
  15. UN agencies and international nongovernmental organizations. There was the International Atomic Energy Agency, which
  16.  
  17. promotes nuclear technology and safety standards worldwide, including those that relate to nuclear weaponry; the
  18.  
  19. International Telecommunication Union, which— through its influence over technical standards for everything from the
  20.  
  21. radio spectrum to satellite orbits—determines what can be communicated and how; and the World Trade Organization,
  22.  
  23. which—through its regulation of the trade of goods, services, and intellectual property among participating nations—
  24.  
  25. determines what can be sold and how. Finally, there was Geneva’s role as the capital of private finance, which
  26.  
  27. allowed great fortunes to be stashed and spent without much public scrutiny regardless of whether those fortunes were
  28.  
  29. ill-gotten or well earned.
  30.  
  31. The notoriously slow and meticulous methods of traditional spycraft certainly had their successes in manipulating
  32.  
  33. these systems for America’s benefit, but ultimately too few to satisfy the ever-increasing appetite of the American
  34.  
  35. policy makers who read the IC’s reports, especially as the Swiss banking sector—along with the rest of the world—went
  36.  
  37. digital. With the world’s deepest secrets now stored on computers, which were more often than not connected to the
  38.  
  39. open Internet, it was only logical that America’s intelligence agencies would want to use those very same connections
  40.  
  41. to steal them.
  42.  
  43. Before the advent of the Internet, if an agency wanted to gain access to a target’s computer it had to recruit an
  44.  
  45. asset who had physical access to it. This was obviously a dangerous proposition: the asset might be caught in the act
  46.  
  47. of downloading the  secrets, or  of  implanting the  exploitative hardware and
  48. software that would radio the secrets to their handlers. The global spread of digital technology simplified this
  49.  
  50. process enormously. This new world of “digital network intelligence” or “computer network operations” meant that
  51.  
  52. physical access was almost never required, which reduced the level of human risk and permanently realigned the
  53.  
  54. HUMINT/SIGINT balance. An agent now could just send the target a message, such as an email, with attachments or links
  55.  
  56. that unleashed malware that would allow the agency to surveil not just the target’s computer but its entire network.
  57.  
  58. Given this innovation, the CIA’s HUMINT would be dedicated to the identification of targets of interest, and SIGINT
  59.  
  60. would take care of the rest. Instead of a CO cultivating a target into an asset—through cash-on-the-barrel bribery,
  61.  
  62. or coercion and blackmail if the bribery failed—a few clever computer hacks would provide a similar benefit. What’s
  63.  
  64. more, with this method the target would remain unwitting, in what would inevitably be a cleaner process.
  65.  
  66. That,  at  least,  was  the  hope. But  as  intelligence increasingly became “cyberintelligence” (a term used to
  67.  
  68. distinguish it from the old phone-and-fax forms of off-line SIGINT), old concerns also had to be updated to the new
  69.  
  70. medium  of  the  Internet.  For  example:  how  to  research  a  target  while remaining anonymous online.
  71.  
  72. This issue would typically emerge when a CO would search the name of a person from a country like Iran or China in
  73.  
  74. the agency’s databases and come up empty-handed. For casual searches of prospective targets like these, No Results
  75.  
  76. was actually a fairly common outcome: the CIA’s databases were mostly filled with people already of interest to the
  77.  
  78. agency, or citizens of friendly countries whose records were more easily available. When faced with No Results, a CO
  79.  
  80. would have to do the same thing you do when you want to look someone up: they’d turn to the public Internet. This was
  81.  
  82. risky.
  83.  
  84. Normally when you go online, your request for any website travels from your computer more or less directly to the
  85.  
  86. server that hosts your final destination—the website you’re trying to visit. At every stop along the way, however,
  87.  
  88. your request cheerfully announces exactly where on the Internet it came from, and exactly where on the Internet it’s
  89.  
  90. going, thanks to identifiers called source and destination headers, which you can think of as the address information
  91.  
  92. on a postcard. Because of these headers, your Internet browsing can easily be identified as yours by, among others,
  93.  
  94. webmasters, network administrators, and foreign intelligence services.
  95.  
  96. It may be hard to believe, but the agency at the time had no good answer for  what  a  case  officer  should  do  in  
  97.  
  98. this  situation,  beyond  weakly
  99. recommending that they ask CIA headquarters to take over the search on their behalf. Formally, the way this
  100.  
  101. ridiculous procedure was supposed to work was that someone back in McLean would go online from a specific computer
  102.  
  103. terminal and use what was called a “nonattributable research system.” This was set up to proxy—that is, fake the
  104.  
  105. origin of—a query before sending it to Google. If anyone tried to look into who had run that particular search, all
  106.  
  107. they would find would be an anodyne business located somewhere in America—one of the myriad fake executive-headhunter
  108.  
  109. or personnel-services companies the CIA used as cover.
  110.  
  111. I can’t say that anyone ever definitively explained to me why the agency liked to use “job search” businesses as a
  112.  
  113. front; presumably they were the only companies that might plausibly look up a nuclear engineer in Pakistan one day
  114.  
  115. and a retired Polish general the next. I can say with absolute certainty, however, that the process was ineffective,
  116.  
  117. onerous, and expensive. To create just one of these covers, the agency had to invent the purpose and name of a
  118.  
  119. company, secure a credible physical address somewhere in America, register a credible URL, put up a credible website,
  120.  
  121. and then rent servers in the company’s name. Furthermore, the agency had to create an encrypted connection from those
  122.  
  123. servers that allowed it to communicate with the CIA network without anyone noticing the connection. Here’s the
  124.  
  125. kicker: After all of that effort and money was expended just to let us anonymously Google a name, whatever front
  126.  
  127. business was being used as a proxy would immediately be burned—by which I mean its connection to the CIA would be
  128.  
  129. revealed to our adversaries—the moment some analyst decided to take a break from their research to log in to their
  130.  
  131. personal Facebook account on that same computer. Since few of the people at headquarters were undercover, that
  132.  
  133. Facebook account would often openly declare, “I work at the CIA,” or just as tellingly, “I work at the State
  134.  
  135. Department, but in McLean.”
  136.  
  137. Go ahead and laugh. Back then, it happened all the time.
  138.  
  139. During my stint in Geneva, whenever a CO would ask me if there was a safer, faster, and all-around more efficient way
  140.  
  141. to do this, I introduced them to Tor.
  142.  
  143. The Tor Project was a creation of the state that ended up becoming one of the few effective shields against the
  144.  
  145. state’s surveillance. Tor is free and open- source software that, if used carefully, allows its users to browse
  146.  
  147. online with the closest thing to perfect anonymity that can be practically achieved at scale. Its protocols were
  148.  
  149. developed by the US Naval Research Laboratory throughout the mid-1990s, and in 2003 it was released to the public—to
  150.  
  151. the
  152. worldwide civilian population on whom its functionality depends. This is because Tor operates on a cooperative
  153.  
  154. community model, relying on tech- savvy volunteers all over the globe who run their own Tor servers out of their
  155.  
  156. basements, attics, and garages. By routing its users’ Internet traffic through these servers, Tor does the same job
  157.  
  158. of protecting the origin of that traffic as the CIA’s “non-attributable research” system, with the primary difference
  159.  
  160. being that  Tor  does it  better, or  at  least more efficiently. I  was  already convinced  of  this,  but  
  161.  
  162. convincing  the  gruff  COs  was  another  matter altogether.
  163.  
  164. With the Tor protocol, your traffic is distributed and bounced around through randomly generated pathways from Tor
  165.  
  166. server to Tor server, with the purpose being to replace your identity as the source of a communication with that of
  167.  
  168. the last Tor server in the constantly shifting chain. Virtually none of the Tor servers, which are called “layers,”
  169.  
  170. know the identity of,  or  any identifying information about, the origin of the traffic. And in a true stroke of
  171.  
  172. genius, the one Tor server that does know the origin—the very first server in the chain—does not know where that
  173.  
  174. traffic is headed. Put more simply: the first Tor server that connects you to the Tor network, called a gateway,
  175.  
  176. knows you’re the one sending a request, but because it isn’t allowed to read that request, it has no idea whether
  177.  
  178. you’re looking for pet memes or information about a protest, and the final Tor server that your request passes
  179.  
  180. through, called an exit, knows exactly what’s being asked for, but has no idea who’s asking for it.
  181.  
  182. This layering method is called onion routing, which gives Tor its name: it’s The Onion Router. The classified joke
  183.  
  184. was that trying to surveil the Tor network makes spies want to cry. Therein lies the project’s irony: here was a US
  185.  
  186. military–developed technology that made cyberintelligence simultaneously harder and easier, applying hacker know-how
  187.  
  188. to protect the anonymity of IC officers, but only at the price of granting that same anonymity to adversaries and to
  189.  
  190. average users across the globe. In this sense, Tor was even more neutral than Switzerland. For me personally, Tor was
  191.  
  192. a life changer, bringing me back to the Internet of my childhood by giving me just the slightest taste of freedom
  193.  
  194. from being observed.
  195.  
  196.  
  197.  
  198. NONE OF THIS account of the CIA’s pivot to cyberintelligence, or SIGINT on the  Internet, is  meant  to  imply  that  
  199.  
  200. the  agency  wasn’t  still  doing  some significant HUMINT, in the same manner in which it had always done so, at
  201.  
  202. least since the advent of the modern IC in the aftermath of World War II.
  203. Even I got involved, though my most memorable operation was a failure. Geneva was the first and only time in my
  204.  
  205. intelligence career in which I made the personal acquaintance of a target—the first and only time that I looked
  206.  
  207. directly into the eyes of a human being rather than just recording their life from afar. I have to say, I found the
  208.  
  209. whole experience unforgettably visceral and sad.
  210.  
  211. Sitting around discussing how to hack a faceless UN complex was psychologically easier by a wide margin. Direct
  212.  
  213. engagement, which can be harsh and emotionally draining, simply doesn’t happen that much on the technical side of
  214.  
  215. intelligence, and almost never in computing. There is a depersonalization of experience fostered by the distance of a
  216.  
  217. screen. Peering at life through a window can ultimately abstract us from our actions and limit any meaningful
  218.  
  219. confrontation with their consequences.
  220.  
  221. I met the man at an embassy function, a party. The embassy had lots of those, and the COs always went, drawn as much
  222.  
  223. by the opportunities to spot and assess potential candidates for recruitment as by the open bars and cigar salons.
  224.  
  225. Sometimes the COs would bring me along. I’d lectured them on my specialty long enough, I guess, that now they were
  226.  
  227. all too happy to lecture me on  theirs,  cross-training  me  to  help  them  play  “spot  the  sap”  in  an
  228.  
  229. environment where there were always more people to meet than they could possibly handle on their own. My native
  230.  
  231. geekiness meant I could get the young researchers from CERN (Conseil Européen pour la Recherche Nucléaire: European
  232.  
  233. Council for Nuclear Research) talking about their work with a voluble excitement that the MBAs and political science
  234.  
  235. majors who comprised the ranks of our COs had trouble provoking on their own.
  236.  
  237. As a technologist, I found it incredibly easy to defend my cover. The moment some bespoke-suited cosmopolite asked me
  238.  
  239. what I did, and I responded with the four words “I work in IT” (or, in my improving French, je travaille dans
  240.  
  241. l’informatique), their interest in me was over. Not that this ever stopped the conversation. When you’re a fresh-
  242.  
  243. faced professional in a conversation outside your field, it’s never that surprising when you ask a lot of questions,
  244.  
  245. and in my experience most people will jump at the chance to explain exactly how much more they know than you do about
  246.  
  247. something they care about deeply.
  248.  
  249. The party I’m recalling took place on a warm night on the outside terrace of an upscale café on one of the side
  250.  
  251. streets alongside Lake Geneva. Some of the COs wouldn’t hesitate to abandon me at such a gathering if they had to in
  252. order to sit as close as possible to whatever woman happened to match their critical intelligence-value indicators of
  253.  
  254. being highly attractive and no older than a student, but I wasn’t about to complain. For me, spotting targets was a
  255.  
  256. hobby that came with a free dinner.
  257.  
  258. I took my plate and sat down at a table next to a well-dressed Middle Eastern man in a cuff-linked, demonstratively
  259.  
  260. Swiss pink shirt. He seemed lonely, and totally exasperated that no one seemed interested in him, so I asked him
  261.  
  262. about himself. That’s the usual technique: just be curious and let them talk. In this case, the man did so much
  263.  
  264. talking that it was like I wasn’t even there. He was Saudi, and told me about how much he loved Geneva, the relative
  265.  
  266. beauties of the French and Arabic languages, and the absolute beauty of this one Swiss girl with whom he—yes—had a
  267.  
  268. regular date playing laser tag. With a touch of a conspiratorial tone, he said that he worked in private wealth
  269.  
  270. management. Within moments I was getting a full-on polished presentation about what, exactly, makes a private bank
  271.  
  272. private, and the challenge of investing without moving markets when your clients are the size of sovereign wealth
  273.  
  274. funds.
  275.  
  276. “Your clients?” I asked.
  277.  
  278. That’s when he said, “Most of my work is on Saudi accounts.”
  279.  
  280. After a few minutes, I excused myself to go to the bathroom, and on the way there I leaned over to tell the CO who
  281.  
  282. worked finance targets what I’d learned. After a necessarily too-long interval “fixing my hair,” or texting Lindsay
  283.  
  284. in front of the bathroom mirror, I returned to find the CO sitting in my chair. I waved to my new Saudi friend before
  285.  
  286. sitting down beside the CO’s discarded, smoky-eyed date. Rather than feeling bad, I felt like I’d really earned the
  287.  
  288. Pavés de Genève that were passed around for dessert. My job was done.
  289.  
  290. The next day, the CO, whom I’ll call Cal, heaped me with praise and thanked me effusively. COs are promoted or passed
  291.  
  292. over based primarily on how effective they are at recruiting assets with access to information on matters substantial
  293.  
  294. enough to be formally reported back to headquarters, and given Saudi Arabia’s suspected involvement in financing
  295.  
  296. terror, Cal felt under tremendous pressure to cultivate a qualifying source. I was sure that in no time at all our
  297.  
  298. fellow party guest would be getting a second paycheck from the agency.
  299.  
  300. That was not quite how it worked out, however. Despite Cal’s regular forays with the banker to strip clubs and bars,
  301.  
  302. the banker wasn’t warming up
  303. to him—at least not to the point where a pitch could be made—and Cal was getting impatient.
  304.  
  305. After a month of failures, Cal was so frustrated that he took the banker out drinking and got him absolutely
  306.  
  307. plastered. Then he pressured the guy to drive home drunk instead of taking a cab. Before the guy had even left the
  308.  
  309. last bar of the night, Cal was calling the make and plate number of his car to the Geneva police, who not fifteen
  310.  
  311. minutes later arrested him for driving under the influence. The banker faced an enormous fine, since in Switzerland
  312.  
  313. fines aren’t flat sums but based on a percentage of income, and his driver’s license was suspended for three months—a
  314.  
  315. stretch of time that Cal would spend, as a truly wonderful friend with a fake-guilty conscience, driving the guy back
  316.  
  317. and forth between his home and work, daily, so that the guy could “keep his office from finding out.” When the fine
  318.  
  319. was levied, causing his friend cash-flow problems, Cal was ready with a loan. The banker had become dependent, the
  320.  
  321. dream of every CO.
  322.  
  323. There was only one hitch: when Cal finally made the pitch, the banker turned him down. He was furious, having figured
  324.  
  325. out the planned crime and the engineered arrest, and felt betrayed that Cal’s generosity hadn’t been genuine. He cut
  326.  
  327. off all contact. Cal made a halfhearted attempt to follow up and do damage control, but it was too late. The banker
  328.  
  329. who’d loved Switzerland had lost his job and was returning—or being returned—to Saudi Arabia. Cal himself was rotated
  330.  
  331. back to the States.
  332.  
  333. Too much had been hazarded, too little had been gained. It was a waste, which I myself had put in motion and then was
  334.  
  335. powerless to stop. After that experience, the prioritizing of SIGINT over HUMINT made all the more sense to me.
  336.  
  337. In the summer of 2008, the city celebrated its annual Fêtes de Genève, a giant carnival that culminates in fireworks.
  338.  
  339. I remember sitting on the left bank of Lake Geneva with the local personnel of the SCS, or Special Collection
  340.  
  341. Service, a joint CIA-NSA program responsible for installing and operating the special surveillance equipment that
  342.  
  343. allows US embassies to spy on foreign signals. These guys worked down the hall from my vault at the embassy, but they
  344.  
  345. were older than I was, and their work was not just way above my pay grade but way beyond my abilities—they had access
  346.  
  347. to NSA tools that I didn’t even know existed. Still, we were friendly: I looked up to them, and they looked out for
  348.  
  349. me.
  350.  
  351. As the fireworks exploded overhead, I was talking about the banker’s case, lamenting the disaster it had been, when
  352.  
  353. one of the guys turned to me
  354. and said, “Next time you meet someone, Ed, don’t bother with the COs—just give us his email address and we’ll take
  355.  
  356. care of it.” I remember nodding somberly to this, though at the time I barely had a clue of the full implications of
  357.  
  358. what that comment meant.
  359.  
  360. I steered clear of parties for the rest of the year and mostly just hung around the cafés and parks of Saint-Jean
  361.  
  362. Falaises with Lindsay, taking occasional vacations with her to Italy, France, and Spain. Still, something had soured
  363.  
  364. my mood, and it wasn’t just the banker debacle. Come to think of it, maybe it was banking in general. Geneva is an
  365.  
  366. expensive city and unabashedly posh, but as 2008 drew to a close its elegance seemed to tip over into extravagance,
  367.  
  368. with a massive influx of the superrich—most of them from the Gulf states, many of them Saudi—enjoying the profits of
  369.  
  370. peak oil prices on the cusp of the global financial crisis. These royal types were booking whole floors of five-star
  371.  
  372. grand hotels and buying out the entire inventories of the luxury stores just across the bridge. They were putting on
  373.  
  374. lavish banquets at the Michelin-starred restaurants and speeding their chrome-plated Lamborghinis down the cobbled
  375.  
  376. streets. It would be hard at any time to miss Geneva’s display of conspicuous consumption, but the profligacy now on
  377.  
  378. display was particularly galling—coming as it did during the worst economic disaster, as the American media kept
  379.  
  380. telling us, since the Great Depression, and as the European media kept telling us, since the interwar period and
  381.  
  382. Versailles.
  383.  
  384. It wasn’t that Lindsay and I were hurting: after all, our rent was being paid by Uncle Sam. Rather, it’s that every
  385.  
  386. time she or I would talk to our folks back home, the situation seemed grimmer. Both of our families knew people who’d
  387.  
  388. worked their entire lives, some of them for the US government, only to have their homes taken away by banks after an
  389.  
  390. unexpected illness made a few mortgage payments impossible.
  391.  
  392. To live in Geneva was to live in an alternative, even opposite, reality. As the  rest  of  the  world  became  more  
  393.  
  394. and  more  impoverished,  Geneva flourished, and while the Swiss banks didn’t engage in many of the types of risky
  395.  
  396. trades that caused the crash, they gladly hid the money of those who’d profited from the pain and were never held
  397.  
  398. accountable. The 2008 crisis, which laid so much of the foundation for the crises of populism that a decade later
  399.  
  400. would sweep across Europe and America, helped me realize that something that is devastating for the public can be,
  401.  
  402. and often is, beneficial to the elites. This was a lesson that the US government would confirm for me in other
  403.  
  404. contexts, time and again, in the years ahead.
  405. 16
  406.  
  407. Tokyo
  408.  
  409. The Internet is fundamentally American, but I had to leave America to fully understand what that meant. The World
  410.  
  411. Wide Web might have been invented in Geneva, at the CERN research laboratory in 1989, but the ways by which the Web
  412.  
  413. is accessed are as American as baseball, which gives the American Intelligence Community the home field advantage.
  414.  
  415. The cables and satellites, the servers and towers—so much of the infrastructure of the Internet is under US control
  416.  
  417. that over 90 percent of the world’s Internet traffic passes through technologies developed, owned, and/or operated by
  418.  
  419. the American government and American businesses, most of which are physically located on American territory.
  420.  
  421. Countries that traditionally worry about such advantages, like China and Russia, have attempted to make alternative
  422.  
  423. systems, such as the Great Firewall, or the state-sponsored censored search engines, or the nationalized satellite
  424.  
  425. constellations that provide selective GPS—but America remains the hegemon, the keeper of the master switches that can
  426.  
  427. turn almost anyone on and off at will.
  428.  
  429. It’s not just the Internet’s infrastructure that I’m defining as fundamentally American—it’s the computer software
  430.  
  431. (Microsoft, Google, Oracle) and hardware (HP, Apple, Dell), too. It’s everything from the chips (Intel, Qualcomm), to
  432.  
  433. the routers and modems (Cisco, Juniper), to the Web services and platforms that provide email and social networking
  434.  
  435. and cloud storage (Google, Facebook, and the most structurally important but invisible Amazon, which provides cloud
  436.  
  437. services to the US government along with half the Internet). Though some of these companies might manufacture their
  438.  
  439. devices in, say, China, the companies themselves are American and are subject to American law. The problem is,
  440.  
  441. they’re also subject to classified American policies that pervert law and permit the US government to surveil
  442.  
  443. virtually every man, woman, and child who has ever touched a computer or picked up a phone.
  444.  
  445. Given the American nature of the planet’s communications infrastructure, it should have been obvious that the US
  446.  
  447. government would engage in this type of mass surveillance. It should have been especially obvious to me. Yet it
  448.  
  449. wasn’t—mostly because the government kept insisting that it did nothing of the sort, and generally disclaimed the
  450.  
  451. practice in courts and in the media in a manner so adamant that the few remaining skeptics who accused it of lying
  452.  
  453. were  treated  like  wild-haired  conspiracy  junkies.  Their  suspicions  about secret  NSA  programs  seemed  
  454.  
  455. hardly  different  from  paranoid  delusions
  456. involving alien messages being beamed to the radios in our teeth. We—me, you, all of us—were too trusting. But what
  457.  
  458. makes this all the more personally painful for me was that the last time I’d made this mistake, I’d supported the
  459.  
  460. invasion of Iraq and joined the army. When I arrived in the IC, I felt sure that I’d never be fooled again,
  461.  
  462. especially given my top secret clearance. Surely that had to count for some degree of transparency. After all, why
  463.  
  464. would the government keep secrets from its secret keepers? This is all to say that the obvious didn’t even become the
  465.  
  466. thinkable for me until some time after I moved to Japan in 2009 to work for the NSA, America’s premier signals
  467.  
  468. intelligence agency.
  469.  
  470. It was a dream job, not only because it was with the most advanced intelligence agency on the planet, but also
  471.  
  472. because it was based in Japan, a place that had always fascinated Lindsay and me. It felt like a country from the
  473.  
  474. future. Though mine was officially a contractor position, its responsibilities and, especially, its location were
  475.  
  476. more than enough to lure me. It’s ironic that only by going private again was I put in a position to understand what
  477.  
  478. my government was doing.
  479.  
  480. On paper, I was an employee of Perot Systems, a company founded by that diminutive hyperactive Texan who founded the
  481.  
  482. Reform Party and twice ran for the presidency. But almost immediately after my arrival in Japan, Perot Systems was
  483.  
  484. acquired by Dell, so on paper I became an employee of Dell. As in the CIA, this contractor status was all just
  485.  
  486. formality and cover, and I only ever worked in an NSA facility.
  487.  
  488. The NSA’s Pacific Technical Center (PTC) occupied one-half of a building inside the enormous Yokota Air Base. As the
  489.  
  490. headquarters of US Forces Japan, the  base  was  surrounded by  high  walls, steel  gates, and  guarded checkpoints.
  491.  
  492. Yokota and the PTC were just a short bike ride from where Lindsay and I got an apartment in Fussa, a city at the
  493.  
  494. western edge of Tokyo’s vast metropolitan spread.
  495.  
  496. The PTC handled the NSA’s infrastructure for the entire Pacific, and provided support for the agency’s spoke sites in
  497.  
  498. nearby countries. Most of these were focused on managing the secret relationships that let the NSA cover the Pacific
  499.  
  500. Rim with spy gear, as long as the agency promised to share some of the intelligence it gleaned with regional
  501.  
  502. governments—and so long as their citizens didn’t find out what the agency was doing. Communications interception was
  503.  
  504. the major part of the mission. The PTC would amass “cuts” from captured signals and push them back across the ocean
  505.  
  506. to Hawaii, and Hawaii, in turn, would push them back to the continental United States.
  507. My official job title was systems analyst, with responsibility for maintaining the local NSA systems, though much of
  508.  
  509. my initial work was that of a systems administrator, helping to connect the NSA’s systems architecture with the
  510.  
  511. CIA’s. Because I was the only one in the region who knew the CIA’s architecture, I’d also travel out to US embassies,
  512.  
  513. like the one I’d left in Geneva, establishing and maintaining the links that enabled the agencies to share
  514.  
  515. intelligence in ways that hadn’t previously been possible. This was the first time in my life that I truly realized
  516.  
  517. the power of being the only one in a room with a sense not just of how one system functioned internally, but of how
  518.  
  519. it functioned together with multiple systems—or didn’t. Later, as the chiefs of the PTC came to recognize that I had
  520.  
  521. a knack for hacking together solutions to their problems, I was given enough of a leash to propose projects of my
  522.  
  523. own.
  524.  
  525. Two things about the NSA stunned me right off the bat: how technologically sophisticated it was compared with the
  526.  
  527. CIA, and how much less vigilant it was about security in its every iteration, from the compartmentalization of
  528.  
  529. information to data encryption. In Geneva, we’d had to haul the hard drives out of the computer every night and lock
  530.  
  531. them up in a safe—and what’s more, those drives were encrypted. The NSA, by contrast, hardly bothered to encrypt
  532.  
  533. anything.
  534.  
  535. In fact, it was rather disconcerting to find out that the NSA was so far ahead of the game in terms of
  536.  
  537. cyberintelligence yet so far behind it in terms of cybersecurity, including the most basic: disaster recovery, or
  538.  
  539. backup. Each of the NSA’s spoke sites collected its own intel, stored the intel on its own local servers, and,
  540.  
  541. because of bandwidth restrictions—limitations on the amount of data that could be transmitted at speed—often didn’t
  542.  
  543. send copies back to the main servers at NSA headquarters. This meant that if any data were destroyed at a particular
  544.  
  545. site, the intelligence that the agency had worked hard to collect could be lost.
  546.  
  547. My chiefs at the PTC understood the risks the agency was taking by not keeping copies of many of its files, so they
  548.  
  549. tasked me with engineering a solution and pitching it to the decision makers at headquarters. The result was a backup
  550.  
  551. and storage system that would act as a shadow NSA: a complete, automated,  and  constantly  updating  copy  of  all  
  552.  
  553. of  the  agency’s  most important material, which would allow the agency to reboot and be up and running again, with
  554.  
  555. all its archives intact, even if Fort Meade were reduced to smoldering rubble.
  556.  
  557. The major problem with creating a global disaster-recovery system—or
  558. really with creating any type of backup system that involves a truly staggering number of computers—is dealing with
  559.  
  560. duplicated data. In plain terms, you have to handle situations in which, say, one thousand computers all have copies
  561.  
  562. of the same single file: you have to make sure you’re not backing up that same file one thousand times, because that
  563.  
  564. would require one thousand times the amount of bandwidth and storage space. It was this wasteful duplication, in
  565.  
  566. particular, that was preventing the agency’s spoke sites from transmitting daily backups of their records to Fort
  567.  
  568. Meade: the connection would be clogged with a thousand copies of the same file containing the same intercepted phone
  569.  
  570. call, 999 of which the agency did not need.
  571.  
  572. The way to avoid this was “deduplication”: a method to evaluate the uniqueness of data. The system that I designed
  573.  
  574. would constantly scan the files at every facility at which the NSA stored records, testing each “block” of data down
  575.  
  576. to the slightest fragment of a file to find out whether or not it was unique. Only if the agency lacked a copy of it
  577.  
  578. back home would the data be automatically queued for transmission—reducing the volume that flowed over the agency’s
  579.  
  580. transpacific fiber-optic connection from a waterfall to a trickle.
  581.  
  582. The combination of deduplication and constant improvements in storage technology allowed the agency to store
  583.  
  584. intelligence data for progressively longer periods of time. Just over the course of my career, the agency’s goal went
  585.  
  586. from being able to store intelligence for days, to weeks, to months, to five years or more after its collection. By
  587.  
  588. the time of this book’s publication, the agency might already be able to store it for decades. The NSA’s conventional
  589.  
  590. wisdom was that there was no point in collecting anything unless they could store it until it was useful, and there
  591.  
  592. was no way to predict when exactly that would be. This rationalization was fuel for the agency’s ultimate dream,
  593.  
  594. which is permanency—to store all of the files it has ever collected or produced for perpetuity, and so create a
  595.  
  596. perfect memory. The permanent record.
  597.  
  598. The NSA has a whole protocol you’re supposed to follow when you give a program a code name. It’s basically an I
  599.  
  600. Ching–like stochastic procedure that randomly picks words from two columns. An internal website throws imaginary dice
  601.  
  602. to pick one name from column A, and throws again to pick one name from column B. This is how you end up with names
  603.  
  604. that don’t mean anything, like FOXACID and EGOTISTICALGIRAFFE. The point of a code name is that it’s not supposed to
  605.  
  606. refer to what the program does. (As has been reported, FOXACID was the code name for NSA servers that host malware
  607.  
  608. versions of  familiar websites; EGOTISTICALGIRAFFE was  an NSA program intended to exploit a vulnerability in certain
  609.  
  610. Web browsers
  611. running Tor, since they couldn’t break Tor itself.) But agents at the NSA were so confident of their power and the
  612.  
  613. agency’s absolute invulnerability that they rarely complied with the regulations. In short, they’d cheat and redo
  614.  
  615. their dice throws until they got the name combination they wanted, whatever they thought was cool: TRAFFICTHIEF, the
  616.  
  617. VPN Attack Orchestrator.
  618.  
  619. I swear I never did that when I went about finding a name for my backup system. I swear that I just rolled the bones
  620.  
  621. and came up with EPICSHELTER.
  622.  
  623. Later, once the agency adopted the system, they renamed it something like the Storage Modernization Plan or Storage
  624.  
  625. Modernization Program. Within two   years   of   the   invention  of   EPICSHELTER,  a   variant  had   been
  626.  
  627. implemented and was in standard use under yet another name.
  628.  
  629.  
  630.  
  631. THE MATERIAL THAT I disseminated to journalists in 2013 documented such an array  of  abuses  by  the  NSA,  
  632.  
  633. accomplished through  such  a  diversity  of technological capabilities, that no one agent in the daily discharge of
  634.  
  635. their responsibilities was ever in the position to know about all of them—not even a systems administrator. To find
  636.  
  637. out about even a fraction of the malfeasance,
  638. you had to go searching. And to go searching, you had to know that it existed.
  639.  
  640. It was something as banal as a conference that first clued me in to that existence, sparking my initial suspicion
  641.  
  642. about the full scope of what the NSA was perpetrating.
  643.  
  644. In the midst of my EPICSHELTER work, the PTC hosted a conference on China sponsored by the Joint Counterintelligence
  645.  
  646. Training Academy (JCITA) for  the  Defense Intelligence Agency (DIA), an  agency connected to  the Department of
  647.  
  648. Defense that specializes in spying on foreign militaries and foreign military–related matters. This conference
  649.  
  650. featured briefings given by experts from all the intelligence components, the NSA, CIA, FBI, and military, about how
  651.  
  652. the Chinese intelligence services were targeting the IC and what the IC could do to cause them trouble. Though China
  653.  
  654. certainly interested me, this wasn’t the kind of work I would ordinarily have been involved in, so I didn’t pay the
  655.  
  656. conference much mind until it was announced that the only technology briefer was unable to attend at the last minute.
  657.  
  658. I’m not sure what the reason was for that absence—maybe flu, maybe kismet— but the course chair for the conference
  659.  
  660. asked if there was anyone at the PTC who might be able to step in as a replacement, since it was too late to
  661.  
  662. reschedule. One of the chiefs mentioned my name, and when I was asked if I wanted to give it a shot, I said yes. I
  663.  
  664. liked my boss, and wanted to help him
  665. out. Also, I was curious, and relished the opportunity to do something that wasn’t about data deduplication for a
  666.  
  667. change.
  668.  
  669. My boss was thrilled. Then he told me the catch: the briefing was the next day.
  670.  
  671. I called Lindsay and told her I wouldn’t be home. I was going to be up all night preparing the presentation, whose
  672.  
  673. nominal topic was the intersection between a very old discipline, counterintelligence, and a very new discipline,
  674.  
  675. cyberintelligence, coming together to try to exploit and thwart the adversary’s attempts to use the Internet to
  676.  
  677. gather surveillance. I started pulling everything off the NSA network (and off the CIA network, to which I still had
  678.  
  679. access), trying to read every top secret report I could find about what the Chinese were doing online. Specifically,
  680.  
  681. I read up on so-called intrusion sets, which are bundles  of  data  about  particular  types  of  attacks,  tools,  
  682.  
  683. and  targets.  IC analysts used these intrusion sets to identify specific Chinese military cyberintelligence or
  684.  
  685. hacking groups, in the same way that detectives might try to identify a suspect responsible for a string of
  686.  
  687. burglaries by a common set of characteristics or modus operandi.
  688.  
  689. The point of my researching this widely dispersed material was to do more than merely report on how China was hacking
  690.  
  691. us, however. My primary task was  to  provide a  summary of  the  IC’s  assessment of  China’s ability  to
  692.  
  693. electronically track American officers and assets operating in the region.
  694.  
  695. Everyone knows (or thinks they know) about the draconian Internet measures of the Chinese government, and some people
  696.  
  697. know (or think they know) the gravamen of the disclosures I gave to journalists in 2013 about my own government’s
  698.  
  699. capabilities. But listen: It’s one thing to casually say, in a science-fiction dystopic type of way, that a
  700.  
  701. government can theoretically see and hear everything that all of its citizens are doing. It’s a very different thing
  702.  
  703. for a government to actually try to implement such a system. What a science- fiction writer can describe in a
  704.  
  705. sentence might take the concerted work of thousands of technologists and millions of dollars of equipment. To read
  706.  
  707. the technical details of China’s surveillance of private communications—to read a complete and accurate accounting of
  708.  
  709. the mechanisms and machinery required for  the  constant collection, storage, and  analysis of  the  billions of  
  710.  
  711. daily telephone and Internet communications of over a billion people—was utterly mind-boggling. At first I was so
  712.  
  713. impressed by the system’s sheer achievement and audacity that I almost forgot to be appalled by its totalitarian
  714.  
  715. controls.
  716.  
  717. After all, China’s government was an explicitly antidemocratic single- party state. NSA agents, even more than most
  718.  
  719. Americans, just took it for
  720. granted that the place was an authoritarian hellhole. Chinese civil liberties weren’t my department. There wasn’t
  721.  
  722. anything I could do about them. I worked, I was sure of it, for the good guys, and that made me a good guy, too.
  723.  
  724. But there were certain aspects of what I was reading that disturbed me. I was  reminded  of  what  is  perhaps  the  
  725.  
  726. fundamental rule  of  technological progress: if something can be done, it probably will be done, and possibly
  727.  
  728. already has been. There was simply no way for America to have so much information about what the Chinese were doing
  729.  
  730. without having done some of the very same things itself, and I had the sneaking sense while I was looking through all
  731.  
  732. this China material that I was looking at a mirror and seeing a reflection of America. What China was doing publicly
  733.  
  734. to its own citizens, America might be—could be—doing secretly to the world.
  735.  
  736. And although you should hate me for it, I have to say that at the time I tamped down my unease. Indeed, I did my best
  737.  
  738. to ignore it. The distinctions were still fairly clear to me. China’s Great Firewall was domestically censorious and
  739.  
  740. repressive, intended to keep its citizens in and America out in the most chilling and demonstrative way, while the
  741.  
  742. American systems were invisible and purely defensive. As I then understood US surveillance, anyone in the world could
  743.  
  744. come in through America’s Internet infrastructure and access whatever content they pleased, unblocked and unfiltered
  745.  
  746. —or at least only blocked and filtered by their home countries and American businesses, which are, presumptively, not
  747.  
  748. under US government control. It was only those who’d been expressly targeted for visiting, for example, jihadist
  749.  
  750. bombing sites or malware marketplaces who would find themselves tracked and scrutinized.
  751.  
  752. Understood this way, the US surveillance model was perfectly okay with me. It was more than okay, actually—I fully
  753.  
  754. supported defensive and targeted surveillance, a “firewall” that didn’t keep anybody out, but just burned the guilty.
  755.  
  756. But in the sleepless days after that sleepless night, some dim suspicion still stirred in my mind. Long after I gave
  757.  
  758. my China briefing, I couldn’t help but keep digging around.
  759.  
  760.  
  761.  
  762. AT THE START of my employment with the NSA, in 2009, I was only slightly more knowledgeable about its practices than
  763.  
  764. the rest of the world. From journalists’  reports,  I  was  aware  of  the  agency’s  myriad  surveillance
  765.  
  766. initiatives  authorized  by  President  George  W.  Bush  in  the  immediate
  767. aftermath of 9/11. In particular, I knew about its most publicly contested initiative, the warrantless wiretapping
  768.  
  769. component of the President’s Surveillance Program (PSP), which had been disclosed by the New York Times in 2005
  770.  
  771. thanks to the courage of a few NSA and Department of Justice whistleblowers.
  772.  
  773. Officially speaking, the PSP was an “executive order,” essentially a set of instructions set down by the American
  774.  
  775. president that the government has to consider the equal of public law—even if they’re just scribbled secretly on a
  776.  
  777. napkin.  The  PSP  empowered the  NSA  to  collect  telephone  and  Internet communications between the United States
  778.  
  779. and abroad. Notably, the PSP allowed the NSA to do this without having to obtain a special warrant from a Foreign
  780.  
  781. Intelligence Surveillance Court, a secret federal court established in
  782. 1978 to oversee IC requests for surveillance warrants after the agencies were caught domestically spying on the
  783.  
  784. anti–Vietnam War and civil rights movements.
  785.  
  786. Following the outcry that attended the Times revelations, and American Civil Liberties Union challenges to the
  787.  
  788. constitutionality of the PSP in non- secret, regular courts, the Bush administration claimed to have let the program
  789.  
  790. expire in 2007. But the expiration turned out to be a farce. Congress spent the last two years of the Bush
  791.  
  792. administration passing legislation that retroactively legalized the PSP. It also retroactively immunized from
  793.  
  794. prosecution the telecoms and Internet service providers that had participated in it. This legislation—the Protect
  795.  
  796. America Act of 2007 and the FISA Amendments Act of 2008—employed intentionally misleading language to reassure US
  797.  
  798. citizens that  their  communications were  not  being  explicitly  targeted,  even  as  it effectively extended the
  799.  
  800. PSP’s remit. In addition to collecting inbound communications coming from foreign countries, the NSA now also had
  801.  
  802. policy approval for the warrantless collection of outbound telephone and Internet communications originating within
  803.  
  804. American borders.
  805.  
  806. That, at least, was the picture I got after reading the government’s own summary of the situation, which was issued
  807.  
  808. to the public in an unclassified version in July 2009, the very same summer that I spent delving into Chinese cyber-
  809.  
  810. capabilities. This summary, which bore the nondescript title Unclassified Report on the President’s Surveillance
  811.  
  812. Program, was compiled by the Offices of the Inspector Generals of five agencies (Department of Defense, Department of
  813.  
  814. Justice, CIA, NSA, and the Office of the Director of National Intelligence) and was offered to the public in lieu of
  815.  
  816. a full congressional investigation of Bush-era NSA overreach. The fact that President Obama, once in office, refused
  817.  
  818. to call for a full congressional
  819. investigation was the first sign, to me at least, that the new president—for whom Lindsay had enthusiastically
  820.  
  821. campaigned—intended to move forward without a proper reckoning with the past. As his administration rebranded and
  822.  
  823. recertified PSP-related programs, Lindsay’s hope in him, as well as my own, would prove more and more misplaced.
  824.  
  825. While the unclassified report was mostly just old news, I found it informative in a few respects. I remember being
  826.  
  827. immediately struck by its curious, they-do-protest-too-much tone, along with more than a few twists of logic  and  
  828.  
  829. language that  didn’t  compute. As  the  report  laid  out  its  legal arguments in support of various agency
  830.  
  831. programs—rarely named, and almost never described—I couldn’t help but notice the fact that hardly any of the
  832.  
  833. executive branch officials who had actually authorized these programs had agreed to be interviewed by the inspector
  834.  
  835. generals. From Vice President Dick Cheney and his counsel David Addington to Attorney General John Ashcroft and  DOJ  
  836.  
  837. lawyer  John  Yoo,  nearly  every  major  player  had  refused  to cooperate with the very offices responsible for
  838.  
  839. holding the IC accountable, and the IGs couldn’t compel them to cooperate, because this wasn’t a formal investigation
  840.  
  841.  involving  testimony.  It  was  hard  for  me  to  interpret  their absence from the record as anything other than
  842.  
  843. an admission of malfeasance.
  844.  
  845. Another aspect of the report that threw me was its repeated, obscure references to “Other Intelligence Activities”
  846.  
  847. (the capitalization is the report’s) for which no “viable legal rationale” or no “legal basis” could be found beyond
  848.  
  849. President Bush’s claim of executive powers during wartime—a wartime that had no end in sight. Of course, these
  850.  
  851. references gave no description whatsoever of what these Activities might actually be, but the process of deduction
  852.  
  853. pointed to warrantless domestic surveillance, as it was pretty much the only intelligence activity not provided for
  854.  
  855. under the various legal frameworks that appeared subsequent to the PSP.
  856.  
  857. As I read on, I wasn’t sure that anything disclosed in the report completely justified the legal machinations
  858.  
  859. involved, let alone the threats by then deputy attorney general James Comey and then FBI director Robert Mueller to
  860.  
  861. resign if certain aspects of the PSP were reauthorized. Nor did I notice anything that fully explained the risks
  862.  
  863. taken by so many fellow agency members—agents much  senior  to  me,  with  decades of  experience—and DOJ  personnel
  864.  
  865. to contact the press and express their misgivings about how aspects of the PSP were being abused. If they were
  866.  
  867. putting their careers, their families, and their lives on the line, it had to be over something graver than the
  868.  
  869. warrantless wiretapping that had already made headlines.
  870. That suspicion sent me searching for the classified version of the report, and it was not in the least dispelled by
  871.  
  872. the fact that such a version appeared not to exist. I didn’t understand. If the classified version was merely a
  873.  
  874. record of the sins of the past, it should have been easily accessible. But it was nowhere to be found. I wondered
  875.  
  876. whether I was looking in the wrong places. After a while of ranging fairly widely and still finding nothing, though,
  877.  
  878. I decided to drop the issue. Life took over and I had work to do. When you get asked to give recommendations on how
  879.  
  880. to keep IC agents and assets from being uncovered and executed by the Chinese Ministry of State Security, it’s hard
  881.  
  882. to remember what you were Googling the week before.
  883.  
  884. It was only later, long after I’d forgotten about the missing IG report, that the classified version came skimming
  885.  
  886. across my desktop, as if in proof of that old maxim that the best way to find something is to stop looking for it.
  887.  
  888. Once the classified version turned up, I realized why I hadn’t had any luck finding it previously: it couldn’t be
  889.  
  890. seen, not even by the heads of agencies. It was filed  in  an  Exceptionally Controlled  Information  (ECI)  
  891.  
  892. compartment, an extremely rare classification used only to make sure that something would remain hidden even from
  893.  
  894. those holding top secret clearance. Because of my position, I was familiar with most of the ECIs at the NSA, but not
  895.  
  896. this one. The report’s full classification designation was TOP SECRET//STLW//HCS/COMINT//ORCON/NOFORN, which  
  897.  
  898. translates  to: pretty much only a few dozen people in the world are allowed to read this.
  899.  
  900. I was most definitely not one of them. The report came to my attention by mistake: someone in the NSA IG’s office had
  901.  
  902. left a draft copy on a system that I, as a sysadmin, had access to. Its caveat of STLW, which I didn’t recognize,
  903.  
  904. turned out to be what’s called a “dirty word” on my system: a label signifying a document that wasn’t supposed to be
  905.  
  906. stored on lower-security drives. These drives were being constantly checked for any newly appearing dirty words, and
  907.  
  908. the moment one was found I was alerted so that I could decide how best to scrub the document from the system. But
  909.  
  910. before I did, I’d have to examine the offending file myself, just to confirm that the dirty word search hadn’t
  911.  
  912. flagged anything accidentally. Usually I’d take just the briefest glance at the thing. But this time, as soon I
  913.  
  914. opened the document and read the title, I knew I’d be reading it all the way through.
  915.  
  916. Here was everything that was missing from the unclassified version. Here was everything that the journalism I’d read
  917.  
  918. had lacked, and that the court proceedings I’d followed had been denied: a complete accounting of the NSA’s  most  
  919.  
  920. secret  surveillance programs, and  the  agency  directives and Department of Justice policies that had been used to
  921.  
  922. subvert American law
  923. and contravene the US Constitution. After reading the thing, I could understand why no IC employee had ever leaked it
  924.  
  925. to journalists, and no judge would be able to force the government to produce it in open court. The document was so
  926.  
  927. deeply classified that anybody who had access to it who wasn’t a sysadmin would be immediately identifiable. And the
  928.  
  929. activities it outlined were so deeply criminal that no government would ever allow it to be released unredacted.
  930.  
  931. One issue jumped out at me immediately: it was clear that the unclassified version  I  was  already  familiar  with  
  932.  
  933. wasn’t  a  redaction  of  the  classified version, as would usually be the practice. Rather, it was a wholly
  934.  
  935. different document, which the classified version immediately exposed as an outright and carefully concocted lie. The
  936.  
  937. duplicity was stupefying, especially given that I’d just dedicated months of my time to deduplicating files. Most of
  938.  
  939. the time, when you’re dealing with two versions of the same document, the differences between them are trivial—a few
  940.  
  941. commas here, a few words there. But the only thing these two particular reports had in common was their title.
  942.  
  943. Whereas the unclassified version merely made reference to the NSA being ordered to intensify its intelligence-
  944.  
  945. gathering practices following 9/11, the classified version laid out the nature, and scale, of that intensification.
  946.  
  947. The NSA’s historic brief had been fundamentally altered from targeted collection of communications to “bulk
  948.  
  949. collection,” which is the agency’s euphemism for mass surveillance. And whereas the unclassified version obfuscated
  950.  
  951. this shift, advocating for expanded surveillance by scaring the public with the specter of terror,  the  classified
  952.  
  953. version  made  this  shift  explicit, justifying it  as  the legitimate corollary of expanded technological
  954.  
  955. capability.
  956.  
  957. The NSA IG’s portion of the classified report outlined what it called “a collection gap,” noting that existing
  958.  
  959. surveillance legislation (particularly the Foreign Intelligence Surveillance Act) dated from 1978, a time when most
  960.  
  961. communications signals traveled via radio or telephone lines, rather than fiber-optic cables and satellites. In
  962.  
  963. essence, the agency was arguing that the speed and volume of contemporary communication had outpaced, and outgrown,
  964.  
  965. American law—no court, not even a secret court, could issue enough individually targeted warrants fast enough to keep
  966.  
  967. up—and that a truly global world required a truly global intelligence agency. All of this pointed, in the NSA’s
  968.  
  969. logic, to the necessity of the bulk collection of Internet communications. The code name for this bulk collection
  970.  
  971. initiative was indicated in the very “dirty word” that got it flagged on my system: STLW, an abbreviation of
  972.  
  973. STELLARWIND. This turned out to be the single major component of the PSP that had continued, and even grown, in
  974.  
  975. secret after the
  976. rest of the program had been made public in the press.
  977.  
  978. STELLARWIND was the classified report’s deepest secret. It was, in fact, the NSA’s deepest secret, and the one that
  979.  
  980. the report’s sensitive status had been designed to protect. The program’s very existence was an indication that the
  981.  
  982. agency’s mission had been transformed, from using technology to defend America to  using technology to  control it  
  983.  
  984. by  redefining citizens’ private Internet communications as potential signals intelligence.
  985.  
  986. Such fraudulent redefinitions ran throughout the report, but perhaps the most  fundamental and  transparently
  987.  
  988. desperate  involved  the  government’s vocabulary. STELLARWIND had been collecting communications since the PSP’s
  989.  
  990. inception in 2001, but in 2004—when Justice Department officials balked  at  the  continuation  of  the  initiative—
  991.  
  992. the  Bush  administration attempted to legitimize it ex post facto by changing the meanings of basic English words,
  993.  
  994. such as “acquire” and “obtain.” According to the report, it was the government’s position that the NSA could collect
  995.  
  996. whatever communications  records  it  wanted  to,  without  having  to  get  a  warrant, because it could only be
  997.  
  998. said to have acquired or obtained them, in the legal sense, if and when the agency “searched for and retrieved” them
  999.  
  1000. from its database.
  1001.  
  1002. This lexical sophistry was particularly galling to me, as I was well aware that the agency’s goal was to be able to
  1003.  
  1004. retain as much data as it could for as long as it could—for perpetuity. If communications records would only be
  1005.  
  1006. considered definitively “obtained” once they were used, they could remain “unobtained” but collected in storage
  1007.  
  1008. forever, raw data awaiting its future manipulation. By redefining the terms “acquire” and “obtain”—from describing
  1009.  
  1010. the act of data being entered into a database, to describing the act of a person (or, more likely, an algorithm)
  1011.  
  1012. querying that database and getting a “hit” or “return” at any conceivable point in the future—the US government was
  1013.  
  1014. developing the capacity of an eternal law-enforcement agency. At any time, the government could dig through the past
  1015.  
  1016. communications of anyone it wanted to victimize in search of a crime (and everybody’s communications contain evidence
  1017.  
  1018. of something). At any point, for all perpetuity, any new administration—any future rogue head of the NSA—could just
  1019.  
  1020. show up to work and, as easily as flicking a switch, instantly track everybody with a phone or a computer, know who
  1021.  
  1022. they were, where they were, what they were doing with whom, and what they had ever done in the past.
  1023.  
  1024.  
  1025.  
  1026. THE TERM “MASS surveillance” is more clear to me, and I think to most people,
  1027. than the government’s preferred “bulk collection,” which to my mind threatens to give a falsely fuzzy impression of
  1028.  
  1029. the agency’s work. “Bulk collection” makes it sound like a particularly busy post office or sanitation department, as
  1030.  
  1031. opposed to a historic effort to achieve total access to—and clandestinely take possession of—the records of all
  1032.  
  1033. digital communications in existence.
  1034.  
  1035. But even once a common ground of terminology is established, misperceptions can still abound. Most people, even
  1036.  
  1037. today, tend to think of mass surveillance in terms of content—the actual words they use when they make a phone call
  1038.  
  1039. or write an email. When they find out that the government actually cares comparatively little about that content,
  1040.  
  1041. they tend to care comparatively little about government surveillance. This relief is understandable, to a degree, due
  1042.  
  1043. to what each of us must regard as the uniquely revealing and intimate nature of our communications: the sound of our
  1044.  
  1045. voice, almost as personal as a thumbprint; the inimitable facial expression we put on in a selfie sent by text. The
  1046.  
  1047. unfortunate truth, however, is that the content of our communications is rarely as revealing as its other elements—
  1048.  
  1049. the unwritten, unspoken information that can expose the broader context and patterns of behavior.
  1050.  
  1051. The NSA calls this “metadata.” The term’s prefix, “meta,” which traditionally is translated as “above” or “beyond,”
  1052.  
  1053. is here used in the sense of “about”: metadata is data about data. It is, more accurately, data that is made by data
  1054.  
  1055. —a cluster of tags and markers that allow data to be useful. The most direct way of thinking about metadata, however,
  1056.  
  1057. is as “activity data,” all the records of all the things you do on your devices and all the things your devices do on
  1058.  
  1059. their own. Take a phone call, for example: its metadata might include the date and time of the call, the call’s
  1060.  
  1061. duration, the number from which the call was made, the number being called, and their locations. An email’s metadata
  1062.  
  1063. might include information about what type of computer it was generated on, where, and when, who the computer belonged
  1064.  
  1065. to, who sent the email, who received it, where and when it was sent and received, and who if anyone besides the
  1066.  
  1067. sender and recipient accessed it, and where and when. Metadata can tell your surveillant the address you slept at
  1068.  
  1069. last night and what time you got up this morning. It reveals every place you visited during your day and how long you
  1070.  
  1071. spent there. It shows who you were in touch with and who was in touch with you.
  1072.  
  1073. It’s this fact that obliterates any government claim that metadata is somehow not a direct window into the substance
  1074.  
  1075. of a communication. With the dizzying volume of digital communications in the world, there is simply
  1076. no way that every phone call could be listened to or email could be read. Even if it were feasible, however, it still
  1077.  
  1078. wouldn’t be useful, and anyway, metadata makes this unnecessary by winnowing the field. This is why it’s best to
  1079.  
  1080. regard metadata not as some benign abstraction, but as the very essence of content: it is precisely the first line of
  1081.  
  1082. information that the party surveilling you requires.
  1083.  
  1084. There’s another thing, too: content is usually defined as something that you knowingly produce. You know what you’re
  1085.  
  1086. saying during a phone call, or what you’re writing in an email. But you have hardly any control over the metadata you
  1087.  
  1088.  produce, because it  is  generated automatically. Just  as  it’s collected,  stored,  and  analyzed  by  machine,  
  1089.  
  1090. it’s  made  by  machine,  too, without your participation or even consent. Your devices are constantly communicating
  1091.  
  1092. for you whether you want them to or not. And, unlike the humans you communicate with of your own volition, your
  1093.  
  1094. devices don’t withhold private information or use code words in an attempt to be discreet. They merely ping the
  1095.  
  1096. nearest cell phone towers with signals that never lie.
  1097.  
  1098. One major irony here is that law, which always lags behind technological innovation by at least a generation, gives
  1099.  
  1100. substantially more protections to a communication’s content than to its metadata—and yet intelligence agencies are
  1101.  
  1102. far more interested in the metadata—the activity records that allow them both the “big picture” ability to analyze
  1103.  
  1104. data at scale, and the “little picture” ability to make perfect maps, chronologies, and associative synopses of an
  1105.  
  1106. individual person’s life, from which they presume to extrapolate predictions of behavior. In sum, metadata can tell
  1107.  
  1108. your surveillant virtually everything they’d ever want or need to know about you, except what’s actually going on
  1109.  
  1110. inside your head.
  1111.  
  1112. After reading this classified report, I spent the next weeks, even months, in a daze. I was sad and low, trying to
  1113.  
  1114. deny everything I was thinking and feeling—that’s what was going on in my head, toward the end of my stint in Japan.
  1115.  
  1116. I felt far from home, but monitored. I felt more adult than ever, but also cursed with the knowledge that all of us
  1117.  
  1118. had been reduced to something like children, who’d be forced to live the rest of our lives under omniscient parental
  1119.  
  1120. supervision. I felt like a fraud, making excuses to Lindsay to explain my sullenness. I felt like a fool, as someone
  1121.  
  1122. of supposedly serious technical skills who’d somehow helped to build an essential component of this system without
  1123.  
  1124. realizing its purpose. I felt used, as an employee of the IC who only now was realizing that all along I’d been
  1125.  
  1126. protecting not my country but the state. I felt, above all, violated. Being in Japan only accentuated the sense of
  1127. betrayal.
  1128.  
  1129. I’ll explain.
  1130.  
  1131. The Japanese that I’d managed to pick up through community college and my interests in anime and manga was enough for
  1132.  
  1133. me to speak and get through basic conversations, but reading was a different matter. In Japanese, each word can be
  1134.  
  1135. represented by its own unique character, or a combination of characters, called kanji, so there were tens of
  1136.  
  1137. thousands of them—far too many for me to memorize. Often, I was only able to decode particular kanji if they were
  1138.  
  1139. written with their phonetic gloss, the furigana, which are most commonly meant for foreigners and young readers and
  1140.  
  1141. so are typically absent from public texts like street signs. The result of all this was that I walked around
  1142.  
  1143. functionally illiterate. I’d get confused and end up going right when I should have gone left, or left when I should
  1144.  
  1145. have gone right. I’d wander down the wrong streets and misorder from menus. I was a stranger, is what I’m saying, and
  1146.  
  1147. often lost, in more ways than one. There were times when I’d accompany Lindsay out on one of her photography trips
  1148.  
  1149. into the countryside and I’d suddenly stop and realize, in the midst of a village or in the middle of a forest, that
  1150.  
  1151. I knew nothing whatsoever about my surroundings.
  1152.  
  1153. And yet: everything was known about me. I now understood that I was totally transparent to my government. The phone
  1154.  
  1155. that gave me directions, and corrected me when I went the wrong way, and helped me translate the traffic signs, and
  1156.  
  1157. told me the times of the buses and trains, was also making sure that all of my doings were legible to my employers.
  1158.  
  1159. It was telling my bosses where I was and when, even if I never touched the thing and just left it in my pocket.
  1160.  
  1161. I remember forcing myself to laugh about this once when Lindsay and I got   lost   on   a   hike   and   Lindsay—to  
  1162.  
  1163. whom   I’d   told   nothing—just spontaneously said, “Why don’t you text Fort Meade and have them find us?” She kept
  1164.  
  1165. the joke going, and I tried to find it funny but couldn’t. “Hello,” she mimicked me, “can you help us with
  1166.  
  1167. directions?”
  1168.  
  1169. Later I would live in Hawaii, near Pearl Harbor, where America was attacked and dragged into what might have been its
  1170.  
  1171. last just war. Here, in Japan, I was closer to Hiroshima and Nagasaki, where that war ignominiously ended. Lindsay
  1172.  
  1173. and I had always hoped to visit those cities, but every time we planned to go we wound up having to cancel. On one of
  1174.  
  1175. my first days off, we were all set to head down Honshu to Hiroshima, but I was called in to work and told to go in
  1176.  
  1177. the opposite direction—to Misawa Air Base in the frozen north. On the day of our next scheduled attempt, Lindsay got
  1178.  
  1179. sick, and then I
  1180. got sick, too. Finally, the night before we intended to go to Nagasaki, Lindsay and I were woken by our first major
  1181.  
  1182. earthquake, jumped up from our futon, ran down seven flights of stairs, and spent the rest of the night out on the
  1183.  
  1184. street with our neighbors, shivering in our pajamas.
  1185.  
  1186. To my true regret, we never went. Those places are holy places, whose memorials honor the two hundred thousand
  1187.  
  1188. incinerated and the countless poisoned by fallout while reminding us of technology’s amorality.
  1189.  
  1190. I think often of what’s called the “atomic moment”—a phrase that in physics describes the moment when a nucleus
  1191.  
  1192. coheres the protons and neutrons spinning around it into an atom, but that’s popularly understood to mean the advent
  1193.  
  1194. of the nuclear age, whose isotopes enabled advances in energy production, agriculture, water potability, and the
  1195.  
  1196. diagnosis and treatment of deadly disease. It also created the atomic bomb.
  1197.  
  1198. Technology doesn’t have a Hippocratic oath. So many decisions that have been made by technologists in academia,
  1199.  
  1200. industry, the military, and government since at least the Industrial Revolution have been made on the basis of “can
  1201.  
  1202. we,” not “should we.” And the intention driving a technology’s invention rarely, if ever, limits its application and
  1203.  
  1204. use.
  1205.  
  1206. I do not mean, of course, to compare nuclear weapons with cybersurveillance in terms of human cost. But there is a
  1207.  
  1208. commonality when it comes to the concepts of proliferation and disarmament.
  1209.  
  1210. The only two countries I knew of that had previously practiced mass surveillance were those two other major
  1211.  
  1212. combatants of World War II—one America’s enemy, the other America’s ally. In both Nazi Germany and Soviet Russia,  
  1213.  
  1214. the   earliest   public   indications   of   that   surveillance   took   the superficially innocuous form of a
  1215.  
  1216. census, the official enumeration and statistical recording of a population. The First All-Union Census of the Soviet
  1217.  
  1218. Union, in 1926, had a secondary agenda beyond a simple count: it overtly queried Soviet citizens about their
  1219.  
  1220. nationality. Its findings convinced the ethnic Russians who comprised the Soviet elite that they were in the minority
  1221.  
  1222. when compared to the aggregated masses of citizens who claimed a Central Asian heritage, such as Uzbeks, Kazakhs,
  1223.  
  1224. Tajiks, Turkmen, Georgians, and Armenians. These findings significantly strengthened Stalin’s resolve to eradicate
  1225.  
  1226. these cultures, by “reeducating” their populations in the deracinating ideology of Marxism-Leninism.
  1227.  
  1228. The Nazi German census of 1939 took on a similar statistical project, but with the assistance of computer technology.
  1229.  
  1230. It set out to count the Reich’s
  1231. population in order to control it and to purge it—mainly of Jews and Roma— before exerting its murderous efforts on
  1232.  
  1233. populations beyond its borders. To effect this, the Reich partnered with Dehomag, a German subsidiary of the American
  1234.  
  1235. IBM, which owned the patent to the punch card tabulator, a sort of analog computer that counted holes punched into
  1236.  
  1237. cards. Each citizen was represented by a card, and certain holes on the cards represented certain markers of
  1238.  
  1239. identity. Column 22 addressed the religion rubric: hole 1 was Protestant, hole 2 Catholic, and hole 3 Jewish. Shortly
  1240.  
  1241. thereafter, this census information was used to identify and deport Europe’s Jewish population to the death camps.
  1242.  
  1243. A single current-model smartphone commands more computing power than all of the wartime machinery of the Reich and
  1244.  
  1245. the Soviet Union combined. Recalling this  is  the  surest  way  to  contextualize not  just  the modern American
  1246.  
  1247. IC’s technological dominance, but also the threat it poses to democratic governance. In the century or so since those
  1248.  
  1249. census efforts, technology has made astounding progress, but the same could not be said for the law or human scruples
  1250.  
  1251. that could restrain it.
  1252.  
  1253. The United States has a census, too, of course. The Constitution established the American census and enshrined it as
  1254.  
  1255. the official federal count of each state’s population in order to determine its proportional delegation to the House
  1256.  
  1257. of Representatives. That was something of a revisionist principle, in that authoritarian governments, including the
  1258.  
  1259. British monarchy that ruled the colonies, had traditionally used the census as a method of assessing taxes and
  1260.  
  1261. ascertaining the number of young men eligible for military conscription. It was the Constitution’s genius to
  1262.  
  1263. repurpose what had been a mechanism of oppression into one of democracy. The census, which is officially under the
  1264.  
  1265. jurisdiction of the Senate, was ordered to be performed every ten years, which was roughly the amount of time it took
  1266.  
  1267. to process the data of most American censuses following the first census of 1790. This decade-long lag was shortened
  1268.  
  1269. by the census of 1890, which was the world’s first census to make use of computers (the prototypes of the models that
  1270.  
  1271. IBM later sold to Nazi Germany). With computing technology, the processing time was cut in half.
  1272.  
  1273. Digital technology didn’t just further streamline such accounting—it is rendering it obsolete. Mass surveillance is
  1274.  
  1275. now a never-ending census, substantially more dangerous than any questionnaire sent through the mail. All our
  1276.  
  1277. devices, from our phones to our computers, are basically miniature census-takers we carry in our backpacks and in our
  1278.  
  1279. pockets—census-takers that remember everything and forgive nothing.
  1280. Japan was my atomic moment. It was then that I realized where these new technologies were headed, and that if my
  1281.  
  1282. generation didn’t intervene the escalation would only continue. It would be a tragedy if, by the time we’d finally
  1283.  
  1284. resolved to resist, such resistance were futile. The generations to come would have to get used to a world in which
  1285.  
  1286. surveillance wasn’t something occasional and directed in legally justified circumstances, but a constant and
  1287.  
  1288. indiscriminate presence: the ear that always hears, the eye that always sees, a memory that is sleepless and
  1289.  
  1290. permanent.
  1291.  
  1292. Once the ubiquity of collection was combined with the permanency of storage, all any government had to do was select
  1293.  
  1294. a person or a group to scapegoat and go searching—as I’d gone searching through the agency’s files
  1295. —for evidence of a suitable crime.
  1296. 17
  1297.  
  1298. Home on the Cloud
  1299.  
  1300. In 2011, I was back in the States, working for the same nominal employer, Dell, but now attached to my old agency,
  1301.  
  1302. the CIA. One mild spring day, I came home from my first day at the new job and was amused to notice: the house I’d
  1303.  
  1304. moved into had a mailbox. It was nothing fancy, just one of those subdivided rectangles common to town house
  1305.  
  1306. communities, but still, it made me smile. I hadn’t had a mailbox in years, and hadn’t ever checked this one. I might
  1307.  
  1308. not even have registered its existence had it not been overflowing— stuffed to bursting with heaps of junk mail
  1309.  
  1310. addressed to “Mr. Edward J. Snowden or Current Resident.” The envelopes contained coupons and ad circulars for
  1311.  
  1312. household products. Someone knew that I’d just moved in.
  1313.  
  1314. A memory surfaced from my childhood, a memory of checking the mail and finding a letter to my sister. Although I
  1315.  
  1316. wanted to open it, my mother wouldn’t let me.
  1317.  
  1318. I remember asking why. “Because,” she said, “it’s not addressed to you.” She explained that opening mail intended for
  1319.  
  1320. someone else, even if it was just a birthday card or a chain letter, wasn’t a very nice thing to do. In fact, it was
  1321.  
  1322. a crime.
  1323.  
  1324. I wanted to know what kind of crime. “A big one, buddy,” my mother said. “A federal crime.”
  1325.  
  1326. I stood in the parking lot, tore the envelopes in half, and carried them to the trash.
  1327.  
  1328. I had a new iPhone in the pocket of my new Ralph Lauren suit. I had new Burberry glasses. A new haircut. Keys to this
  1329.  
  1330. new town house in Columbia, Maryland, the largest place I’d ever lived in, and the first place that really felt like
  1331.  
  1332. mine. I was rich, or at least my friends thought so. I barely recognized myself.
  1333.  
  1334. I’d decided it was best to live in denial and just make some money, make life better for the people I loved—after
  1335.  
  1336. all, wasn’t that what everybody else did? But it was easier said than done. The denial, I mean. The money—that came
  1337.  
  1338. easy. So easy that I felt guilty.
  1339.  
  1340. Counting Geneva, and not counting periodic trips home, I’d been away for nearly four years. The America I returned to
  1341.  
  1342. felt like a changed country. I won’t go as far as to say that I felt like a foreigner, but I did find myself mired
  1343. in way too many conversations I didn’t understand. Every other word was the name of some TV show or movie I didn’t
  1344.  
  1345. know, or a celebrity scandal I didn’t care about, and I couldn’t respond—I had nothing to respond with.
  1346.  
  1347. Contradictory thoughts rained down like Tetris blocks, and I struggled to sort them out—to make them disappear. I
  1348.  
  1349. thought, pity these poor, sweet, innocent people—they’re victims, watched by the government, watched by the very
  1350.  
  1351. screens they worship. Then I thought: Shut up, stop being so dramatic—they’re happy, they don’t care, and you don’t
  1352.  
  1353. have to, either. Grow up, do your work, pay your bills. That’s life.
  1354.  
  1355. A normal life was what Lindsay and I were hoping for. We were ready for the next stage and had decided to settle
  1356.  
  1357. down. We had a nice backyard with a cherry tree that reminded me of a sweeter Japan, a spot on the Tama River where
  1358.  
  1359. Lindsay and I had laughed and rolled around atop the fragrant carpet of Tokyo blossoms as we watched the sakura fall.
  1360.  
  1361. Lindsay was getting certified as a yoga instructor. I, meanwhile, was getting used to my new position—in sales.
  1362.  
  1363. One of the external vendors I’d worked with on EPICSHELTER ended up working for Dell, and convinced me that I was
  1364.  
  1365. wasting my time with getting paid by the hour. I should get into the sales side of Dell’s business, he said, where I
  1366.  
  1367. could earn a fortune—for more ideas like EPICSHELTER. I’d be making an astronomical leap up the corporate ladder, and
  1368.  
  1369. he’d be getting a substantial referral bonus. I was ready to be convinced, especially since it meant distracting
  1370.  
  1371. myself from my growing sense of unease, which could only get me into trouble. The official job title was solutions
  1372.  
  1373. consultant. It meant, in essence, that I had to solve the problems created by my new partner, whom I’m going to call
  1374.  
  1375. Cliff, the account manager.
  1376.  
  1377. Cliff was supposed to be the face, and I was to be the brain. When we sat down with the CIA’s technical royalty and
  1378.  
  1379. purchasing agents, his job was to sell Dell’s equipment and expertise by any means necessary. This meant reaching
  1380.  
  1381. deep into the seat of his pants for unlimited slick promises as to how we’d do things for the agency, things that
  1382.  
  1383. were definitely, definitely not possible for our competitors (and, in reality, not possible for us, either). My job
  1384.  
  1385. was to lead a team of experts in building something that reduced the degree to which Cliff had lied by just enough
  1386.  
  1387. that, when the person who signed the check pressed the Power button, we wouldn’t all be sent to jail.
  1388.  
  1389. No pressure.
  1390.  
  1391. Our main project was to help the CIA catch up with the bleeding edge—or
  1392. just with the technical standards of the NSA—by building it the buzziest of new technologies, a  “private cloud.” The
  1393.  
  1394. aim was to  unite the  agency’s processing and storage while distributing the ways by which data could be accessed.
  1395.  
  1396. In plain American, we wanted to make it so that someone in a tent in Afghanistan could do exactly the same work in
  1397.  
  1398. exactly the same way as someone at CIA headquarters. The agency—and indeed the whole IC’s technical leadership—was
  1399.  
  1400. constantly complaining about “silos”: the problem of having a billion buckets of data spread all over the world that
  1401.  
  1402. they couldn’t keep track of or access. So I was leading a team of some of the smartest people at Dell to come up with
  1403.  
  1404. a way that anyone, anywhere, could reach anything.
  1405.  
  1406. During the proof of concept stage, the working name of our cloud became “Frankie.” Don’t blame me: on the tech side,
  1407.  
  1408. we just called it “The Private Cloud.” It was Cliff who named it, in the middle of a demo with the CIA, saying they
  1409.  
  1410. were going to love our little Frankenstein “because it’s a real monster.”
  1411.  
  1412. The more promises Cliff made, the busier I became, leaving Lindsay and me only the weekends to catch up with our
  1413.  
  1414. parents and old friends. We tried to furnish and equip our new home. The three-story place had come empty, so we had
  1415.  
  1416. to get everything, or everything that our parents hadn’t generously handed down to us. This felt very mature, but was
  1417.  
  1418. at the same time very telling about our priorities: we bought dishes, cutlery, a desk, and a chair, but we still
  1419.  
  1420. slept on a mattress on the floor. I’d become allergic to credit cards, with all their tracking, so we bought
  1421.  
  1422. everything outright, with hard currency. When we needed a car, I bought a ’98 Acura Integra from a classified ad for
  1423. $3,000 cash. Earning money was one thing, but neither Lindsay nor I liked to spend it, unless it was for computer
  1424.  
  1425. equipment—or a special occasion. For Valentine’s Day, I bought Lindsay the revolver she always wanted.
  1426.  
  1427. Our new condo was a twenty-minute drive from nearly a dozen malls, including the Columbia Mall, which has nearly 1.5
  1428.  
  1429. million square feet of shopping, occupied by some two hundred stores, a fourteen-screen AMC multiplex, a P.F.
  1430.  
  1431. Chang’s, and a Cheesecake Factory. As we drove the familiar roads in the beat-up Integra, I was impressed, but also
  1432.  
  1433. slightly taken aback, by all the development that had occurred in my absence. The post-9/11 government spending spree
  1434.  
  1435. had certainly put a lot of money into a lot of local pockets. It was an unsettling and even overwhelming experience
  1436.  
  1437. to come back to America after having been away for a while and to realize anew just how wealthy this part of the
  1438.  
  1439. country was, and how many consumer options it offered—how   many   big-box   retailers   and   high-end   interior  
  1440.  
  1441. design
  1442. showrooms. And all of them had sales. For Presidents’ Day, Memorial Day, Independence  Day,  Labor  Day,  Columbus  
  1443.  
  1444. Day,  Veterans’  Day.  Festive banners announced the latest discounts, just below all the flags.
  1445.  
  1446. Our mission was pretty much appliance-based on this one afternoon I’m recalling—we were at Best Buy. Having settled
  1447.  
  1448. on a new microwave, we were checking out, on Lindsay’s healthful insistence, a display of blenders. She had her phone
  1449.  
  1450. out and was in the midst of researching which of the ten or so devices had the best reviews, when I found myself
  1451.  
  1452. wandering over to the computer department at the far end of the store.
  1453.  
  1454. But along the way, I  stopped. There, at  the edge of  the kitchenware section, ensconced atop a brightly decorated
  1455.  
  1456. and lit elevated platform, was a shiny new refrigerator. Rather, it  was a  “Smartfridge,” which was being advertised
  1457.  
  1458. as “Internet-equipped.”
  1459.  
  1460. This, plain and simple, blew my mind.
  1461.  
  1462. A salesperson approached, interpreting my stupefaction as interest—“It’s amazing, isn’t it?”—and proceeded to
  1463.  
  1464. demonstrate a few of the features. A screen was embedded in the door of the fridge, and next to the screen was a
  1465.  
  1466. holder for a tiny stylus, which allowed you to scribble messages. If you didn’t want to scribble, you could record
  1467.  
  1468. audio and video memos. You could also use the screen as you would your regular computer, because the refrigerator had
  1469.  
  1470. Wi-Fi. You could check your email, or check your calendar. You could watch YouTube clips, or listen to MP3s. You
  1471.  
  1472. could even make phone calls. I had to restrain myself from keying in Lindsay’s number and saying, from across the
  1473.  
  1474. floor, “I’m calling from a fridge.”
  1475.  
  1476. Beyond that, the salesperson continued, the fridge’s computer kept track of internal temperature, and, through
  1477.  
  1478. scanning barcodes, the freshness of your food. It also provided nutritional information and suggested recipes. I
  1479.  
  1480. think the price was over $9,000. “Delivery included,” the salesperson said.
  1481.  
  1482. I remember driving home in a confused silence. This wasn’t quite the stunning moonshot tech-future we’d been
  1483.  
  1484. promised. I was convinced the only reason that thing was Internet-equipped was so that it could report back to its
  1485.  
  1486. manufacturer about its owner’s usage and about any other household data that was  obtainable. The  manufacturer, in  
  1487.  
  1488. turn,  would  monetize that  data  by selling it. And we were supposed to pay for the privilege.
  1489.  
  1490. I wondered what the point was of my getting so worked up over government surveillance if my friends, neighbors, and
  1491.  
  1492. fellow citizens were more than happy to invite corporate surveillance into their homes, allowing
  1493. themselves to be tracked while browsing in their pantries as efficiently as if they were browsing the Web. It would
  1494.  
  1495. still be another half decade before the domotics  revolution,  before  “virtual  assistants”  like  Amazon  Echo  and
  1496.  
  1497. Google  Home  were  welcomed into  the  bedroom and  placed  proudly  on nightstands to record and transmit all
  1498.  
  1499. activity within range, to log all habits and preferences (not to mention fetishes and kinks), which would then be
  1500.  
  1501. developed into advertising algorithms and converted into cash. The data we generate just by living—or just by letting
  1502.  
  1503. ourselves be surveilled while living
  1504. —would enrich private enterprise and impoverish our private existence in equal measure. If government surveillance
  1505.  
  1506. was having the effect of turning the citizen into a subject, at the mercy of state power, then corporate surveillance
  1507.  
  1508. was turning the consumer into a product, which corporations sold to other corporations, data brokers, and
  1509.  
  1510. advertisers.
  1511.  
  1512. Meanwhile, it felt as if every major tech company, including Dell, was rolling out new civilian versions of what I
  1513.  
  1514. was working on for the CIA: a cloud. (In fact, Dell had even tried four years previously to trademark the term “cloud
  1515.  
  1516. computing” but was denied.) I was amazed at how willingly people were signing up, so excited at the prospect of their
  1517.  
  1518. photos and videos and music and e-books being universally backed up and available that they never  gave  much  
  1519.  
  1520. thought  as  to  why  such  an  uber-sophisticated  and convenient storage solution was  being offered to  them  for  
  1521.  
  1522. “free” or  for “cheap” in the first place.
  1523.  
  1524. I don’t think I’d ever seen such a concept be so uniformly bought into, on every side. “The cloud” was as effective a
  1525.  
  1526. sales term for Dell to sell to the CIA as it was for Amazon and Apple and Google to sell to their users. I can still
  1527.  
  1528. close my eyes and hear Cliff schmoozing some CIA suit about how “with the cloud, you’ll be able to push security
  1529.  
  1530. updates across agency computers worldwide,” or “when the cloud’s up and running, the agency will be able to track who
  1531.  
  1532. has read what file worldwide.” The cloud was white and fluffy and peaceful, floating high above the fray. Though many
  1533.  
  1534. clouds make a stormy sky, a single cloud provided a benevolent bit of shade. It was protective. I think it made
  1535.  
  1536. everyone think of heaven.
  1537.  
  1538. Dell—along with the largest cloud-based private companies, Amazon, Apple,  and  Google—regarded  the  rise  of  the  
  1539.  
  1540. cloud  as  a  new  age  of computing. But in concept, at least, it was something of a regression to the old mainframe
  1541.  
  1542. architecture of computing’s earliest history, where many users all depended upon a single powerful central core that
  1543.  
  1544. could only be maintained by   an   elite   cadre   of   professionals.  The   world   had   abandoned   this
  1545.  
  1546. “impersonal” mainframe model only a generation before, once businesses like
  1547. Dell developed “personal” computers cheap enough, and simple enough, to appeal to mortals. The renaissance that
  1548.  
  1549. followed produced desktops, laptops, tablets, and smartphones—all devices that allowed people the freedom to make an
  1550.  
  1551. immense amount of creative work. The only issue was—how to store it?
  1552.  
  1553. This was the genesis of “cloud computing.” Now it didn’t really matter what kind of personal computer you had,
  1554.  
  1555. because the real computers that you relied upon were warehoused in the enormous data centers that the cloud companies
  1556.  
  1557. built  throughout the  world.  These  were,  in  a  sense,  the  new mainframes, row after row of racked, identical
  1558.  
  1559. servers linked together in such a way that each individual machine acted together within a collective computing
  1560.  
  1561. system. The loss of a single server or even of an entire data center no longer mattered, because they were mere
  1562.  
  1563. droplets in the larger, global cloud.
  1564.  
  1565. From the standpoint of a regular user, a cloud is just a storage mechanism that ensures that your data is being
  1566.  
  1567. processed or stored not on your personal device, but on a range of different servers, which can ultimately be owned
  1568.  
  1569. and operated by different companies. The result is that your data is no longer truly yours.  It’s  controlled  by  
  1570.  
  1571. companies,  which  can  use  it  for  virtually  any purpose.
  1572.  
  1573. Read your terms of service agreements for cloud storage, which get longer and longer by the year—current ones are
  1574.  
  1575. over six thousand words, twice the average length of one of these book chapters. When we choose to store our data
  1576.  
  1577. online, we’re often ceding our claim to it. Companies can decide what type of data they will hold for us, and can
  1578.  
  1579. willfully delete any data they object to. Unless we’ve kept a separate copy on our own machines or drives, this data
  1580.  
  1581. will be lost to us forever. If any of our data is found to be particularly objectionable or otherwise in violation of
  1582.  
  1583. the terms of service, the companies can unilaterally delete our accounts, deny us our own data, and yet retain a copy
  1584.  
  1585. for their own records, which they can turn over to the authorities without our knowledge or consent. Ultimately, the
  1586.  
  1587. privacy of our data depends on the ownership  of  our  data.  There  is  no  property  less  protected,  and  yet  no
  1588.  
  1589. property more private.
  1590.  
  1591.  
  1592.  
  1593. THE INTERNET I’D  grown  up  with,  the  Internet  that  had  raised  me,  was disappearing. And with it, so was my
  1594.  
  1595. youth. The very act of going online, which had once seemed like a marvelous adventure, now seemed like a fraught
  1596.  
  1597. ordeal. Self-expression now required such strong self-protection as to
  1598. obviate its liberties and nullify its pleasures. Every communication was a matter not of creativity but of safety.
  1599.  
  1600. Every transaction was a potential danger.
  1601.  
  1602. Meanwhile, the private sector was busy leveraging our reliance on technology into market consolidation. The majority
  1603.  
  1604. of American Internet users lived their entire digital lives on email, social media, and e-commerce platforms owned by
  1605.  
  1606. an imperial triumvirate of companies (Google, Facebook, and Amazon), and the American IC was seeking to take
  1607.  
  1608. advantage of that fact by obtaining access to their networks—both through direct orders that were kept secret from
  1609.  
  1610. the public, and clandestine subversion efforts that were kept secret from the companies themselves. Our user data was
  1611.  
  1612. turning vast profits for the companies, and the government pilfered it for free. I don’t think I’d ever felt so
  1613.  
  1614. powerless.
  1615.  
  1616. Then there was this other emotion that I felt, a curious sense of being adrift and yet, at the same time, of having
  1617.  
  1618. my privacy violated. It was as if I were dispersed—with parts of my life scattered across servers all over the globe
  1619.  
  1620. —and yet intruded or imposed upon. Every morning when I left our town house, I found myself nodding at the security
  1621.  
  1622. cameras dotted throughout our development. Previously I’d never paid them any attention, but now, when a light turned
  1623.  
  1624. red on my commute, I couldn’t help but think of its leering sensor, keeping tabs on me whether I blew through the
  1625.  
  1626. intersection or stopped. License-plate readers were recording my comings and goings, even if I maintained a speed of
  1627.  
  1628. 35 miles per hour.
  1629.  
  1630. America’s fundamental laws exist to make the job of law enforcement not easier but harder. This isn’t a bug, it’s a
  1631.  
  1632. core feature of democracy. In the American system, law enforcement is expected to protect citizens from one another.
  1633.  
  1634. In turn, the courts are expected to restrain that power when it’s abused, and to provide redress against the only
  1635.  
  1636. members of society with the domestic authority to detain, arrest, and use force—including lethal force. Among the
  1637.  
  1638. most important of these restraints are the prohibitions against law enforcement surveilling private citizens on their
  1639.  
  1640. property and taking possession of their private recordings without a warrant. There are few laws, however, that
  1641.  
  1642. restrain the surveillance of public property, which includes the vast majority of America’s streets and sidewalks.
  1643.  
  1644. Law enforcement’s use of surveillance cameras on public property was originally conceived of as a crime deterrent and
  1645.  
  1646. an aid to investigators after a crime had occurred. But as the cost of these devices continued to fall, they became
  1647.  
  1648. ubiquitous, and their role became preemptive—with law enforcement using  them  to  track  people  who  had  not  
  1649.  
  1650. committed,  or  were  not  even
  1651. suspected of, any crime. And the greatest danger still lies ahead, with the refinement of artificial intelligence
  1652.  
  1653. capabilities such as facial and pattern recognition. An AI-equipped surveillance camera would be no mere recording
  1654.  
  1655. device, but could be made into something closer to an automated police officer—a true robo-cop actively seeking out
  1656.  
  1657. “suspicious” activity, such as apparent drug deals (that is, people embracing or shaking hands) and apparent gang
  1658.  
  1659. affiliation (such as people wearing specific colors and brands of clothing). Even in 2011, it was clear to me that
  1660.  
  1661. this was where technology was leading us, without any substantive public debate.
  1662.  
  1663. Potential monitoring abuses piled up in my mind to cumulatively produce a vision of an appalling future. A world in
  1664.  
  1665. which all people were totally surveilled would logically become a world in which all laws were totally enforced,
  1666.  
  1667. automatically, by computers. After all, it’s difficult to imagine an AI device that’s capable of noticing a person
  1668.  
  1669. breaking the law not holding that person accountable. No policing algorithm would ever be programmed, even if it
  1670.  
  1671. could be, toward leniency or forgiveness.
  1672.  
  1673. I wondered whether this would be the final but grotesque fulfillment of the original American promise that all
  1674.  
  1675. citizens would be equal before the law: an equality of oppression through total automated law enforcement. I imagined
  1676.  
  1677. the future SmartFridge stationed in my kitchen, monitoring my conduct and habits, and using my tendency to drink
  1678.  
  1679. straight from the carton or not wash my hands to evaluate the probability of my being a felon.
  1680.  
  1681. Such a world of total automated law enforcement—of, say, all pet- ownership laws, or all zoning laws regulating home
  1682.  
  1683. businesses—would be intolerable. Extreme justice can turn out to be extreme injustice, not just in terms of the
  1684.  
  1685. severity of punishment for an infraction, but also in terms of how consistently and thoroughly the law is applied and
  1686.  
  1687. prosecuted. Nearly every large and long-lived society is full of unwritten laws that everyone is expected to follow,
  1688.  
  1689. along with vast libraries of written laws that no one is expected to follow, or even know about. According to
  1690.  
  1691. Maryland Criminal Law Section
  1692. 10-501, adultery is illegal and punishable by a $10 fine. In North Carolina, statute 14-309.8 makes it illegal for a
  1693.  
  1694. bingo game to last more than five hours. Both of these laws come from a more prudish past and yet, for one reason or
  1695.  
  1696. another, were never repealed. Most of our lives, even if we don’t realize it, occur not in black and white but in a
  1697.  
  1698. gray area, where we jaywalk, put trash in the  recycling  bin  and  recyclables  in  the  trash,  ride  our  bicycles
  1699.  
  1700.  in  the improper lane, and borrow a stranger’s Wi-Fi to download a book that we didn’t pay for. Put simply, a world
  1701.  
  1702. in which every law is always enforced would be a world in which everyone was a criminal.
  1703. I tried to talk to Lindsay about all this. But though she was generally sympathetic to my concerns, she wasn’t so
  1704.  
  1705. sympathetic that she was ready to go off the grid, or even off Facebook or Instagram. “If I did that,” she said, “I’d
  1706.  
  1707. be giving up my art and abandoning my friends. You used to like being in touch with other people.”
  1708.  
  1709. She was right. And she was right to be worried about me. She thought I was too tense, and under too much stress. I
  1710.  
  1711. was—not because of my work, but because of my desire to tell her a truth that I wasn’t allowed to. I couldn’t tell
  1712.  
  1713. her that my former coworkers at the NSA could target her for surveillance and read the love poems she texted me. I
  1714.  
  1715. couldn’t tell her that they could access all the photos she took—not just her public photos, but the intimate ones. I
  1716.  
  1717. couldn’t tell her that her information was being collected, that everyone’s information was being collected, which
  1718.  
  1719. was tantamount to a government threat: If you ever get out of line, we’ll use your private life against you.
  1720.  
  1721. I tried to explain it to her, obliquely, through an analogy. I told her to imagine opening up her laptop one day and
  1722.  
  1723. finding a spreadsheet on her desktop.
  1724.  
  1725. “Why?” she said. “I don’t like spreadsheets.”
  1726.  
  1727. I wasn’t prepared for this response, so I just said the first thing that came to mind. “Nobody does, but this one’s
  1728.  
  1729. called The End.”
  1730.  
  1731. “Ooh, mysterious.”
  1732.  
  1733. “You don’t remember having created this spreadsheet, but once you open it up, you recognize its contents. Because
  1734.  
  1735. inside it is everything, absolutely everything, that could ruin you. Every speck of information that could destroy
  1736.  
  1737. your life.”
  1738.  
  1739. Lindsay smiled. “Can I see the one for you?”
  1740.  
  1741. She was joking, but I wasn’t. A spreadsheet containing every scrap of data about you would pose a mortal hazard.
  1742.  
  1743. Imagine it: all the secrets big and small that could end your marriage, end your career, poison even your closest
  1744.  
  1745. relationships, and  leave  you  broke, friendless, and  in  prison. Maybe the spreadsheet would include the joint you
  1746.  
  1747. smoked last weekend at a friend’s house, or the one line of cocaine you snorted off the screen of your phone in a bar
  1748.  
  1749. in college. Or the drunken one-night stand you had with your friend’s girlfriend, who’s now your friend’s wife, which
  1750.  
  1751. you both regret and have agreed never to mention to anyone. Or an abortion you got when you were a teenager, which
  1752.  
  1753. you kept hidden from your parents and that you’d like to keep hidden from your spouse. Or maybe it’s just information
  1754.  
  1755. about a petition you
  1756. signed, or a protest you attended. Everyone has something, some compromising information buried among their bytes—if
  1757.  
  1758. not in their files then in their email, if not in their email then in their browsing history. And now this
  1759.  
  1760. information was being stored by the US government.
  1761.  
  1762. Some time after our exchange, Lindsay came up to me and said, “I figured out what would be on my Spreadsheet of Total
  1763.  
  1764. Destruction—the secret that would ruin me.”
  1765.  
  1766. “What?”
  1767.  
  1768. “I’m not going to tell you.”
  1769.  
  1770. I tried to chill, but I kept having strange physical symptoms. I’d become weirdly clumsy, falling off ladders—more
  1771.  
  1772. than once—or bumping into door frames. Sometimes I’d trip, or drop spoons I was holding, or fail to gauge distances
  1773.  
  1774. accurately and miss what I was reaching for. I’d spill water over myself, or choke on it. Lindsay and I would be in
  1775.  
  1776. the middle of a conversation when I’d miss what she’d said, and she’d ask where I’d gone to—it was like I’d been
  1777.  
  1778. frozen in another world.
  1779.  
  1780. One day when I went to meet Lindsay after her pole-fitness class, I started feeling dizzy. This was the most
  1781.  
  1782. disturbing of the symptoms I’d had thus far. It scared me, and scared Lindsay, too, especially when it led to a
  1783.  
  1784. gradual diminishing of my senses. I had too many explanations for these incidents: poor diet, lack of exercise, lack
  1785.  
  1786. of sleep. I had too many rationalizations: the plate was too close to the edge of the counter, the stairs were
  1787.  
  1788. slippery. I couldn’t make up my mind whether it was worse if what I was experiencing was psychosomatic or genuine. I
  1789.  
  1790. decided to go to the doctor, but the only appointment wasn’t for weeks.
  1791.  
  1792. A day or so later, I was home around noon, trying my best to keep up with work remotely. I was on the phone with a
  1793.  
  1794. security officer at Dell when the dizziness hit me hard. I immediately excused myself from the call, slurring my
  1795.  
  1796. words, and as I struggled to hang up the phone, I was sure: I was going to die.
  1797.  
  1798. For those who’ve experienced it, this sense of impending doom needs no description, and for those who haven’t, there
  1799.  
  1800. is no explanation. It strikes so suddenly and primally that it wipes out all other feeling, all thought besides
  1801.  
  1802. helpless resignation. My life was over. I slumped in my chair, a big black padded Aeron that tilted underneath me as
  1803.  
  1804. I fell into a void and lost consciousness.
  1805.  
  1806. I came to still seated, with the clock on my desk reading just shy of 1:00
  1807. p.m. I’d been out less than an hour, but I was exhausted. It was as if I’d been awake since the beginning of time.
  1808.  
  1809. I reached for the phone in a panic, but my hand kept missing it and grabbing the air. Once I managed to grab ahold of
  1810.  
  1811. it and get a dial tone, I found I couldn’t remember Lindsay’s number, or could only remember the digits but not their
  1812.  
  1813. order.
  1814.  
  1815. Somehow I managed to get myself downstairs, taking each step deliberately, palm against the wall. I got some juice
  1816.  
  1817. out of the fridge and chugged it, keeping both hands on the carton and dribbling a fair amount on my chin. Then I lay
  1818.  
  1819. down on the floor, pressed my cheek to the cool linoleum, and fell asleep, which was how Lindsay found me.
  1820.  
  1821. I’d just had an epileptic seizure.
  1822.  
  1823. My mother had epilepsy, and for a time at least was prone to grand mal seizures: the foaming at the mouth, her limbs
  1824.  
  1825. thrashing, her body rolling around until it stilled into a horrible unconscious rigidity. I couldn’t believe I hadn’t
  1826.  
  1827. previously associated my symptoms with hers, though that was the very same denial she herself had been in for
  1828.  
  1829. decades, attributing her frequent falls to “clumsiness” and “lack of coordination.” She hadn’t been diagnosed until
  1830.  
  1831. her first grand mal in her late thirties, and, after a brief spell on medication, her seizures stopped. She’d always
  1832.  
  1833. told me and my sister that epilepsy wasn’t hereditary and to this day I’m still not sure if that’s what her doctor
  1834.  
  1835. had told her or if she was just trying to reassure us that her fate wouldn’t be ours.
  1836.  
  1837. There is no diagnostic test for epilepsy. The clinical diagnosis is just two or more unexplained seizures—that’s it.
  1838.  
  1839. Very little is known about the condition.  Medicine  tends  to  treat  epilepsy  phenomenologically. Doctors don’t
  1840.  
  1841. talk about “epilepsy,” they talk about “seizures.” They tend to divide seizures into two types: localized and
  1842.  
  1843. generalized, the former being an electrical misfire in a certain section of your brain that doesn’t spread, the
  1844.  
  1845. latter being an electrical misfire that creates a chain reaction. Basically, a wave of misfiring synapses rolls
  1846.  
  1847. across your brain, causing you to lose motor function and, ultimately, consciousness.
  1848.  
  1849. Epilepsy is such a strange syndrome. Its sufferers feel different things, depending on  which part  of  their  brain  
  1850.  
  1851. has  the  initial electrical cascade failure. Those who have this failure in their auditory center famously hear
  1852.  
  1853. bells. Those who have it in their visual center either have their vision go dark or see sparkles. If the failure
  1854.  
  1855. happens in the deeper core areas of the brain—
  1856. which was where mine occurred—it can cause severe vertigo. In time, I came to know the warning signs, so I could
  1857.  
  1858. prepare for an oncoming seizure. These signs  are  called  “auras,” in  the  popular language of  epilepsy, though in
  1859.  
  1860. scientific fact these auras are the seizure itself. They are the proprioceptive experience of the misfire.
  1861.  
  1862. I consulted with as many epilepsy specialists as I could find—the best part of working for Dell was the insurance: I
  1863.  
  1864. had CAT scans, MRIs, the works. Meanwhile, Lindsay, who was my stalwart angel throughout all this, driving me back
  1865.  
  1866. and forth from appointments, went about researching all the information that was available about the syndrome. She
  1867.  
  1868. Googled both allopathic and  homeopathic treatments so  intensely that  basically all  her Gmail ads were for
  1869.  
  1870. epilepsy pharmaceuticals.
  1871.  
  1872. I felt defeated. The two great institutions of my life had been betrayed and were betraying me: my country and the
  1873.  
  1874. Internet. And now my body was following suit.
  1875.  
  1876. My brain had, quite literally, short-circuited.
  1877. 18
  1878.  
  1879. On the Couch
  1880.  
  1881. It was late at night on May 1, 2011, when I noticed the news alert on my phone: Osama bin Laden had been tracked down
  1882.  
  1883. to Abbottabad, Pakistan, and killed by a team of Navy SEALs.
  1884.  
  1885. So  there  it  was.  The  man  who’d  masterminded the  attacks  that  had propelled me into the army, and from there
  1886.  
  1887. into the Intelligence Community, was now dead, a dialysis patient shot point-blank in the embrace of his multiple
  1888.  
  1889. wives in their lavish compound just down the road from Pakistan’s major military academy. Site after site showed maps
  1890.  
  1891. indicating where the hell Abbottabad was, alternating with street scenes from cities throughout America, where people
  1892.  
  1893. were fist-pumping, chest-bumping, yelling, getting wasted. Even New York was celebrating, which almost never happens.
  1894.  
  1895. I turned off the phone. I just didn’t have it in me to join in. Don’t get me wrong: I was glad the motherfucker was
  1896.  
  1897. dead. I was just having a pensive moment and felt a circle closing.
  1898.  
  1899. Ten years. That’s how long it had been since those two planes flew into the Twin Towers, and what did we have to show
  1900.  
  1901. for it? What had the last decade actually accomplished? I sat on the couch I’d inherited from my mother’s condo and
  1902.  
  1903. gazed through the window into the street beyond as a neighbor honked the horn of his parked car. I couldn’t shake the
  1904.  
  1905. idea that I’d wasted the last decade of my life.
  1906.  
  1907. The previous ten years had been a cavalcade of American-made tragedy: the forever war in Afghanistan, catastrophic
  1908.  
  1909. regime change in Iraq, indefinite detentions  at  Guantánamo Bay,  extraordinary renditions,  torture,  targeted
  1910.  
  1911. killings of civilians—even of American civilians—via drone strikes. Domestically, there was the Homeland
  1912.  
  1913. Securitization of everything, which assigned a threat rating to every waking day (Red–Severe, Orange–High, Yellow–
  1914.  
  1915. Elevated), and, from the Patriot Act on, the steady erosion of civil liberties, the very liberties we were allegedly
  1916.  
  1917. fighting to protect. The cumulative damage—the malfeasance in aggregate—was staggering to contemplate and felt
  1918.  
  1919. entirely irreversible, and yet we were still honking our horns and flashing our lights in jubilation.
  1920.  
  1921. The biggest terrorist attack on American soil happened concurrently with the development of digital technology, which
  1922.  
  1923. made much of the earth American soil—whether we liked it or not. Terrorism, of course, was the
  1924. stated reason why most of my country’s surveillance programs were implemented, at a time of great fear and
  1925.  
  1926. opportunism. But it turned out that fear was the true terrorism, perpetrated by a political system that was
  1927.  
  1928. increasingly willing to use practically any justification to authorize the use of force. American politicians weren’t
  1929.  
  1930. as afraid of terror as they were of seeming weak, or of being disloyal to their party, or of being disloyal to their
  1931.  
  1932. campaign donors, who had ample appetites for government contracts and petroleum products from the Middle East. The
  1933.  
  1934. politics of terror became more powerful than the terror itself, resulting in “counterterror”: the panicked actions of
  1935.  
  1936. a country unmatched in capability, unrestrained by policy, and blatantly unconcerned about upholding the rule of law.
  1937.  
  1938. After 9/11, the IC’s orders had been “never again,” a mission that could never be accomplished. A decade later, it
  1939.  
  1940. had become clear, to me at least, that the repeated evocations of terror by the political class were not a response
  1941.  
  1942. to any specific threat or concern but a cynical attempt to turn terror into a permanent danger that required
  1943.  
  1944. permanent vigilance enforced by unquestionable authority.
  1945.  
  1946. After a decade of mass surveillance, the technology had proved itself to be a potent weapon less against terror and
  1947.  
  1948. more against liberty itself. By continuing these programs, by continuing these lies, America was protecting little,
  1949.  
  1950. winning nothing, and losing much—until there would be few distinctions left between those post-9/11 polarities of
  1951.  
  1952. “Us” and “Them.”
  1953.  
  1954.  
  1955.  
  1956. THE LATTER HALF of 2011 passed in a succession of seizures, and in countless doctors’ offices and hospitals. I was
  1957.  
  1958. imaged, tested, and prescribed medications that stabilized my body but clouded my mind, turning me depressed,
  1959.  
  1960. lethargic, and unable to focus.
  1961.  
  1962. I wasn’t sure how I was going to live with what Lindsay was now calling my “condition” without losing my job. Being
  1963.  
  1964. the top technologist for Dell’s CIA account meant I had tremendous flexibility: my office was my phone, and I could
  1965.  
  1966. work from home. But meetings were an issue. They were always in Virginia, and I lived in Maryland, a state whose laws
  1967.  
  1968. prevented people diagnosed with epilepsy from driving. If I were caught behind the wheel, I could lose my driver’s
  1969.  
  1970. license, and with it my ability to attend the meetings that were the single nonnegotiable requirement of my position.
  1971.  
  1972. I finally gave in to the inevitable, took a short-term disability leave from Dell, and decamped to my mother’s
  1973.  
  1974. secondhand couch. It was as blue as my mood, but comfortable. For weeks and weeks it was the center of my existence—
  1975.  
  1976. the place where I slept and ate and read and slept some more, the
  1977. place where I just generally wallowed bleakly as time mocked me.
  1978.  
  1979. I don’t remember what books I tried to read, but I do remember never managing much more than a page before closing my
  1980.  
  1981. eyes and sinking back again into the cushions. I couldn’t concentrate on anything except my own weakness, the  
  1982.  
  1983. uncooperative lump that used to  be  me  spread across the upholstery, motionless but for a lone finger atop the
  1984.  
  1985. screen of the phone that was the only light in the room.
  1986.  
  1987. I’d scroll through the news, then nap, then scroll again, then nap—while protesters in Tunisia, Libya, Egypt, Yemen,
  1988.  
  1989. Algeria, Morocco, Iraq, Lebanon, and Syria were being imprisoned and tortured or just shot in the streets by the
  1990.  
  1991. secret state agents of thuggish regimes, many of which America had helped keep in power. The suffering of that season
  1992.  
  1993. was immense, spiraling out of the regular news cycle. What I was witnessing was desperation, compared with which my
  1994.  
  1995. own struggles seemed cheap. They seemed small—morally and ethically small—and privileged.
  1996.  
  1997. Throughout the Middle East, innocent civilians were living under the constant threat of violence, with work and
  1998.  
  1999. school suspended, no electricity, no sewage. In many regions, they didn’t have access to even the most rudimentary
  2000.  
  2001. medical care. But if at any moment I doubted that my anxieties about surveillance and privacy were relevant, or even
  2002.  
  2003. appropriate, in the face of such immediate danger and privation, I only had to pay a bit more attention to the crowds
  2004.  
  2005. on the street and the proclamations they were making—in Cairo and Sanaa, in Beirut and Damascus, in Ahvaz, Khuzestan,
  2006.  
  2007. and in every other city of the Arab Spring and Iranian Green Movement. The crowds were calling for an end to
  2008.  
  2009. oppression, censorship, and precarity. They were declaring that in a truly just society the people were not
  2010.  
  2011. answerable to the government, the government was answerable to the people. Although each crowd in  each city, even on
  2012.  
  2013.  each day, seemed to  have its  own specific motivation and its own specific goals, they all had one thing in common:
  2014.  
  2015. a rejection of authoritarianism, a recommitment to the humanitarian principle that an individual’s rights are inborn
  2016.  
  2017. and inalienable.
  2018.  
  2019. In an authoritarian state, rights derive from the state and are granted to the people. In a free state, rights derive
  2020.  
  2021. from the people and are granted to the state. In the former, people are subjects, who are only allowed to own
  2022.  
  2023. property, pursue an education, work, pray, and speak because their government permits them to. In the latter, people
  2024.  
  2025. are citizens, who agree to be governed in a covenant of consent that must be periodically renewed and is
  2026.  
  2027. constitutionally revocable. It’s this clash, between the authoritarian and the
  2028. liberal democratic, that I believe to be the major ideological conflict of my time—not some concocted, prejudiced
  2029.  
  2030. notion of an East-West divide, or of a resurrected crusade against Christendom or Islam.
  2031.  
  2032. Authoritarian states are typically not governments of laws, but governments of leaders, who demand loyalty from their
  2033.  
  2034. subjects and are hostile to dissent. Liberal-democratic states, by contrast, make no or few such demands, but depend
  2035.  
  2036. almost solely on each citizen voluntarily assuming the responsibility of  protecting  the  freedoms  of  everyone  
  2037.  
  2038. else  around  them, regardless of their race, ethnicity, creed, ability, sexuality, or gender. Any collective
  2039.  
  2040. guarantee, predicated not on blood but on assent, will wind up favoring egalitarianism—and though democracy has often
  2041.  
  2042. fallen far short of its ideal, I still believe it to be the one form of governance that most fully enables people of
  2043.  
  2044. different backgrounds to live together, equal before the law.
  2045.  
  2046. This equality consists not only of rights but also of freedoms. In fact, many of the rights most cherished by
  2047.  
  2048. citizens of democracies aren’t even provided for in law except by implication. They exist in that open-ended empty
  2049.  
  2050. space created through the restriction of government power. For example, Americans only have a “right” to free speech
  2051.  
  2052. because the government is forbidden from making any law restricting that freedom, and a “right” to a free press
  2053.  
  2054. because the government is forbidden from making any law to abridge it. They only have a “right” to worship freely
  2055.  
  2056. because the government is forbidden from making any law respecting an establishment of religion, and a “right” to
  2057.  
  2058. peaceably assemble and protest because the government is forbidden from making any law that says they can’t.
  2059.  
  2060. In contemporary life, we have a single concept that encompasses all this negative or potential space that’s off-
  2061.  
  2062. limits to the government. That concept is “privacy.” It is an empty zone that lies beyond the reach of the state, a
  2063.  
  2064. void into which the law is only permitted to venture with a warrant—and not a warrant “for everybody,” such as the
  2065.  
  2066. one the US government has arrogated to itself in pursuit of mass surveillance, but a warrant for a specific person or
  2067.  
  2068. purpose supported by a specific probable cause.
  2069.  
  2070. The word “privacy” itself is somewhat empty, because it is essentially indefinable, or over-definable. Each of us has
  2071.  
  2072. our own idea of what it is. “Privacy” means something to everyone. There is no one to whom it means nothing.
  2073.  
  2074. It’s because of this lack of common definition that citizens of pluralistic, technologically sophisticated
  2075.  
  2076. democracies feel that they have to justify their desire for privacy and frame it as a right. But citizens of
  2077.  
  2078. democracies don’t
  2079. have to justify that desire—the state, instead, must justify its violation. To refuse to claim your privacy is
  2080.  
  2081. actually to cede it, either to a state trespassing its constitutional restraints or to a “private” business.
  2082.  
  2083. There is, simply, no way to ignore privacy. Because a citizenry’s freedoms are  interdependent, to  surrender your  
  2084.  
  2085. own  privacy is  really  to  surrender everyone’s. You might choose to give it up out of convenience, or under the
  2086.  
  2087. popular pretext that privacy is only required by those who have something to hide. But saying that you don’t need or
  2088.  
  2089. want privacy because you have nothing to hide is to assume that no one should have, or could have, to hide anything—
  2090.  
  2091. including   their   immigration   status,   unemployment   history, financial history, and health records. You’re
  2092.  
  2093. assuming that no one, including yourself, might object to revealing to anyone information about their religious
  2094.  
  2095. beliefs, political affiliations, and sexual activities, as casually as some choose to reveal their movie and music
  2096.  
  2097. tastes and reading preferences.
  2098.  
  2099. Ultimately, saying that you don’t care about privacy because you have nothing to hide is no different from saying you
  2100.  
  2101. don’t care about freedom of speech because you have nothing to say. Or that you don’t care about freedom of the press
  2102.  
  2103. because you don’t like to read. Or that you don’t care about freedom of religion because you don’t believe in God. Or
  2104.  
  2105. that you don’t care about the freedom to peaceably assemble because you’re a lazy, antisocial agoraphobe. Just
  2106.  
  2107. because this or that freedom might not have meaning to you today doesn’t mean that it doesn’t or won’t have meaning
  2108.  
  2109. tomorrow, to you, or to your neighbor—or to the crowds of principled dissidents I was following on my phone who were
  2110.  
  2111. protesting halfway across the planet, hoping to gain just a fraction of the freedoms that my country was busily
  2112.  
  2113. dismantling.
  2114.  
  2115. I  wanted to  help, but  I  didn’t know how. I’d  had  enough of  feeling helpless, of being just an asshole in
  2116.  
  2117. flannel lying around on a shabby couch eating Cool Ranch Doritos and drinking Diet Coke while the world went up in
  2118.  
  2119. flames.
  2120.  
  2121. The young people of the Middle East were agitating for higher wages, lower prices, and better pensions, but I
  2122.  
  2123. couldn’t give them any of that, and no one could give them a better shot at self-governance than the one they were
  2124.  
  2125. taking themselves. They were, however, also agitating for a freer Internet. They were decrying Iran’s Ayatollah
  2126.  
  2127. Khamenei, who had been increasingly censoring and blocking threatening Web content, tracking and hacking traffic to
  2128.  
  2129. offending platforms and services, and shutting down certain foreign ISPs entirely. They were protesting Egypt’s
  2130.  
  2131. president, Hosni Mubarak, who’d cut off Internet access for his whole country—which had merely succeeded in
  2132. making every young person in the country even more furious and bored, luring them out into the streets.
  2133.  
  2134. Ever since I’d been introduced to the Tor Project in Geneva, I’d used its browser and run my own Tor server, wanting
  2135.  
  2136. to do my professional work from home and my personal Web browsing unmonitored. Now, I shook off my despair, propelled
  2137.  
  2138. myself off the couch, and staggered over to my home office to set up a bridge relay that would bypass the Iranian
  2139.  
  2140. Internet blockades. I then distributed its encrypted configuration identity to the Tor core developers.
  2141.  
  2142. This was the least I could do. If there was just the slightest chance that even one young kid from Iran who hadn’t
  2143.  
  2144. been able to get online could now bypass the imposed filters and restrictions and connect to me—connect through me—
  2145.  
  2146. protected by the Tor system and my server’s anonymity, then it was certainly worth my minimal effort.
  2147.  
  2148. I imagined this person reading their email, or checking their social media accounts to make sure that their friends
  2149.  
  2150. and family had not been arrested. I had no way of knowing whether this was what they did, or whether anyone at all
  2151.  
  2152. linked to my server from Iran. And that was the point: the aid I offered was private.
  2153.  
  2154. The guy who started the Arab Spring was almost exactly my age. He was a produce peddler in Tunisia, selling fruits
  2155.  
  2156. and vegetables out of a cart. In protest against repeated harassment and extortion by the authorities, he stood in
  2157.  
  2158. the square and set fire to his life, dying a martyr. If burning himself to death was the last free act he could
  2159.  
  2160. manage in defiance of an illegitimate regime, I could certainly get up off the couch and press a few buttons.
  2161. PART THREE
  2162. 19
  2163.  
  2164. The Tunnel
  2165.  
  2166. Imagine you’re entering a tunnel. Imagine the perspective: as you look down the length that stretches ahead of you,
  2167.  
  2168. notice how the walls seem to narrow to the tiny dot of light at the other end. The light at the end of the tunnel is
  2169.  
  2170. a symbol of hope, and it’s also what people say they see in near-death experiences. They have to go to it, they say.
  2171.  
  2172. They’re drawn to it. But then where else is there to go in a tunnel, except through it? Hasn’t everything led up to
  2173.  
  2174. this point?
  2175.  
  2176. My tunnel was the Tunnel: an enormous Pearl Harbor–era airplane factory turned NSA facility located under a pineapple
  2177.  
  2178. field in Kunia, on the island of Oahu,  Hawaii.  The  facility  was  built  out  of  reinforced  concrete,  its
  2179.  
  2180. eponymous tunnel a kilometer-long tube in the side of a hill opening up into three cavernous floors of server vaults
  2181.  
  2182. and offices. At the time the Tunnel was built, the hill was covered over with huge amounts of sand, soil, desiccated
  2183.  
  2184. pineapple plant leaves, and patches of sun-parched grass to camouflage it from Japanese bombers. Sixty years later it
  2185.  
  2186. resembled the vast burial mound of a lost civilization, or some gigantic arid pile that a weird god had heaped up in
  2187.  
  2188. the middle of a god-size sandbox. Its official name was the Kunia Regional Security Operations Center.
  2189.  
  2190. I went to work there, still on a Dell contract, but now for the NSA again, early in 2012. One day that summer—
  2191.  
  2192. actually, it was my birthday—as I passed through the security checks and proceeded down the tunnel, it struck me:
  2193.  
  2194. this, in front of me, was my future.
  2195.  
  2196. I’m not saying that I made any decisions at that instant. The most important decisions in life are never made that
  2197.  
  2198. way. They’re made subconsciously and only express themselves consciously once fully formed— once you’re finally
  2199.  
  2200. strong enough to admit to yourself that this is what your conscience has already chosen for you, this is the course
  2201.  
  2202. that your beliefs have decreed. That was my twenty-ninth birthday present to myself: the awareness that I had entered
  2203.  
  2204. a tunnel that would narrow my life down toward a single, still-indistinct act.
  2205.  
  2206. Just as Hawaii has always been an important waystation—historically, the US military treated the island chain as
  2207.  
  2208. little more than a mid-Pacific refueling depot for boats and planes—it had also become an important switchpoint for
  2209.  
  2210. American communications. These include the intelligence that flowed between   the   contiguous   forty-eight   states
  2211.  
  2212.   and   my   former   place   of
  2213. employment, Japan, as well as other sites in Asia.
  2214.  
  2215. The job I’d taken was a significant step down the career ladder, with duties I could at this point perform in my
  2216.  
  2217. sleep. It was supposed to mean less stress, a lighter burden. I was the sole employee of the aptly named Office of
  2218.  
  2219. Information Sharing, where I worked as a SharePoint systems administrator. SharePoint is a Microsoft product, a dopey
  2220.  
  2221. poky program, or rather a grab- bag of programs, focused on internal document management: who can read what, who can
  2222.  
  2223. edit what, who can send and receive what, and so on. By making me Hawaii’s SharePoint systems administrator, the NSA
  2224.  
  2225. had made me the manager of document management. I was, in effect, the reader in chief at one of the agency’s most
  2226.  
  2227. significant facilities. As was my typical practice in any new technical position, I spent the earliest days
  2228.  
  2229. automating my tasks— meaning writing scripts to do my work for me—so as to free up my time for something more
  2230.  
  2231. interesting.
  2232.  
  2233. Before I go any further, I want to emphasize this: my active searching out of NSA abuses began not with the copying
  2234.  
  2235. of documents, but with the reading of them. My initial intention was just to confirm the suspicions that I’d first
  2236.  
  2237. had back in 2009 in Tokyo. Three years later, I was determined to find out if an  American system  of  mass  
  2238.  
  2239. surveillance existed  and,  if  it  did,  how  it functioned. Though I was uncertain about how to conduct this
  2240.  
  2241. investigation, I was at least sure of this: I had to understand exactly how the system worked before I could decide
  2242.  
  2243. what, if anything, to do about it.
  2244.  
  2245.  
  2246.  
  2247. THIS, OF COURSE, was not why Lindsay and I had come to Hawaii. We hadn’t hauled all the way out to paradise just so I
  2248.  
  2249. could throw our lives away for a principle.
  2250.  
  2251. We’d come to start over. To start over yet again.
  2252.  
  2253. My doctors told me that the climate and more relaxed lifestyle in Hawaii might be beneficial for my epilepsy, since
  2254.  
  2255. lack of sleep was thought to be the leading  trigger  of  the  seizures.  Also,  the  move  eliminated  the  driving
  2256.  
  2257. problem: the Tunnel was within bicycling distance of a number of communities in Kunia, the quiet heart of the
  2258.  
  2259. island’s dry, red interior. It was a pleasant, twenty-minute ride to work, through sugarcane fields in brilliant
  2260.  
  2261. sunshine. With the mountains rising calm and high in the clear blue distance, the gloomy mood of the last few months
  2262.  
  2263. lifted like the morning fog.
  2264.  
  2265. Lindsay and I found a decent-size bungalow-type house on Eleu Street in
  2266. Waipahu’s Royal Kunia, which we furnished with our stuff from Columbia,
  2267. Maryland, since Dell paid relocation expenses. The furniture didn’t get much use, though, since the sun and heat
  2268.  
  2269. would often cause us to walk in the door, strip off our clothes, and lie naked on the carpet beneath the overworked
  2270.  
  2271. air conditioner. Eventually, Lindsay turned the garage into a fitness studio, filling it with yoga mats and the
  2272.  
  2273. spinning pole she’d brought from Columbia. I set up a new Tor server. Soon, traffic from around the world was
  2274.  
  2275. reaching the Internet via the laptop sitting in our entertainment center, which had the ancillary benefit of hiding
  2276.  
  2277. my own Internet activity in the noise.
  2278.  
  2279. One night during the summer I turned twenty-nine, Lindsay finally prevailed on me to go out with her to a luau. She’d
  2280.  
  2281. been after me to go for a while, because a few of her pole-fitness friends had been involved in some hula-girl
  2282.  
  2283. capacity, but I’d been resistant. It had seemed like such a cheesy touristy thing to do, and had felt, somehow,
  2284.  
  2285. disrespectful. Hawaiian culture is ancient, although its traditions are very much alive; the last thing I wanted was
  2286.  
  2287. to disturb someone’s sacred ritual.
  2288.  
  2289. Finally, however, I capitulated. I’m very glad I did. What impressed me the most was not the luau itself—though it
  2290.  
  2291. was very much a fire-twirling spectacle—but the old man who was holding court nearby in a little amphitheater down by
  2292.  
  2293. the sea. He was a native Hawaiian, an erudite man with that soft but nasal island voice, who was telling a group of
  2294.  
  2295. people gathered around a fire the creation stories of the islands’ indigenous peoples.
  2296.  
  2297. The one story that stuck with me concerned the twelve sacred islands of the gods. Apparently, there had existed a
  2298.  
  2299. dozen islands in the Pacific that were so beautiful and pure and blessed with freshwater that they had to be kept  
  2300.  
  2301. secret  from  humanity, who  would  spoil  them.  Three  of  them  were especially revered: Kane-huna-moku, Kahiki,
  2302.  
  2303. and Pali-uli. The lucky gods who inhabited these islands decided to keep them hidden, because they believed that a
  2304.  
  2305. glimpse of their bounty would drive people mad. After considering numerous ingenious schemes by which these islands
  2306.  
  2307. might be concealed, including dyeing them the color of the sea, or sinking them to the bottom of the ocean, they
  2308.  
  2309. finally decided to make them float in the air.
  2310.  
  2311. Once the islands were airborne, they were blown from place to place, staying constantly in motion. At sunrise and
  2312.  
  2313. sunset, especially, you might think that you’d noticed one, hovering far at the horizon. But the moment you pointed
  2314.  
  2315. it out to anyone, it would suddenly drift away or assume another form entirely, such as a pumice raft, a hunk of rock
  2316.  
  2317. ejected by a volcanic eruption
  2318. —or a cloud.
  2319.  
  2320. I thought about that legend a lot while I went about my search. The
  2321. revelations I was pursuing were exactly like those islands: exotic preserves that a pantheon of self-important,
  2322.  
  2323. self-appointed rulers were convinced had to be kept secret and hidden from humanity. I wanted to know what the NSA’s
  2324.  
  2325. surveillance  capabilities  were  exactly;  whether  and  how  they  extended beyond the agency’s actual surveillance
  2326.  
  2327. activities; who approved them; who knew about them; and, last but surely not least, how these systems—both technical
  2328.  
  2329. and institutional—really operated.
  2330.  
  2331. The moment I’d think that I spotted one of these “islands”—some capitalized code name I didn’t understand, some
  2332.  
  2333. program referenced in a note buried at the end of a report—I’d go chasing after further mentions of it in other
  2334.  
  2335. documents, but find none. It was as if the program I was searching for had floated away from me and was lost. Then,
  2336.  
  2337. days later, or weeks later, it might surface again under a different designation, in a document from a different
  2338.  
  2339. department.
  2340.  
  2341. Sometimes I’d find a program with a recognizable name, but without an explanation of what it did. Other times I’d
  2342.  
  2343. just find a nameless explanation, with no indication as to whether the capability it described was an active program
  2344.  
  2345. or an aspirational desire. I was running up against compartments within compartments, caveats within caveats, suites
  2346.  
  2347. within suites, programs within programs. This was the nature of the NSA—by design, the left hand rarely knew what the
  2348.  
  2349. right hand was doing.
  2350.  
  2351. In a way, what I was doing reminded me of a documentary I once watched about map-making—specifically, about the  way
  2352.  
  2353. that nautical charts were created in the days before imaging and GPS. Ship captains would keep logs and note their
  2354.  
  2355. coordinates, which landbound mapmakers would then try to interpret. It was through the gradual accretion of this
  2356.  
  2357. data, over hundreds of years, that the full extent of the Pacific became known, and all its islands identified.
  2358.  
  2359. But I didn’t have hundreds of years or hundreds of ships. I was alone, one man hunched over a blank blue ocean,
  2360.  
  2361. trying to find where this one speck of dry land, this one data point, belonged in relation to all the others.
  2362. 20
  2363.  
  2364. Heartbeat
  2365.  
  2366. Back in 2009 in Japan, when I went to that fateful China conference as a substitute briefer, I  guess I’d  made some
  2367.  
  2368. friends, especially at  the  Joint Counterintelligence Training Academy (JCITA) and its parent agency, the Defense
  2369.  
  2370. Intelligence Agency (DIA). In the three years since, JCITA had invited me a half-dozen or so times to give seminars
  2371.  
  2372. and lectures at DIA facilities. Essentially, I was teaching classes in how the American Intelligence Community could
  2373.  
  2374. protect itself from Chinese hackers and exploit the information gained from analyzing their hacks to hack them in
  2375.  
  2376. return.
  2377.  
  2378. I always enjoyed teaching—certainly more than I ever enjoyed being a student—and in the early days of my
  2379.  
  2380. disillusionment, toward the end of Japan and through my time at Dell, I had the sense that were I to stay in
  2381.  
  2382. intelligence work for the rest of my career, the positions in which my principles would be least compromised, and my
  2383.  
  2384. mind most challenged, would almost certainly be academic. Teaching with JCITA was a way of keeping that door open. It
  2385.  
  2386. was also a way of keeping up to date—when you’re teaching, you can’t let your students get ahead of you, especially
  2387.  
  2388. in technology.
  2389.  
  2390. This put me in the regular habit of perusing what the NSA called “readboards.” These are digital bulletin boards that
  2391.  
  2392. function something like news blogs, only the “news” here is the product of classified intelligence activities. Each  
  2393.  
  2394. major  NSA  site  maintains its  own,  which  its  local  staff updates daily with what they regard as the day’s most
  2395.  
  2396. important and interesting documents—everything an employee has to read to keep current.
  2397.  
  2398. As  a  holdover from my JCITA lecture preparation, and also, frankly, because I was bored in Hawaii, I got into the
  2399.  
  2400. habit of checking a number of these boards every day: my own site’s readboard in Hawaii, the readboard of my former
  2401.  
  2402. posting in Tokyo, and various readboards from Fort Meade. This new low-pressure position gave me as much time to read
  2403.  
  2404. as I wanted. The scope of my curiosity might have raised a few questions at a prior stage of my career, but now I was
  2405.  
  2406. the only employee of the Office of Information Sharing
  2407. —I was the Office of Information Sharing—so my very job was to know what sharable information was out there.
  2408.  
  2409. Meanwhile, most of my colleagues at the Tunnel spent their breaks streaming Fox News.
  2410.  
  2411. In the hopes of organizing all the documents I wanted to read from these various readboards, I put together a
  2412.  
  2413. personal best-of-the-readboards queue. The files quickly began to pile up, until the nice lady who managed the
  2414.  
  2415. digital
  2416. storage quotas complained to me about the folder size. I realized that my personal readboard had become less a daily
  2417.  
  2418. digest than an archive of sensitive information with relevance far beyond the day’s immediacy. Not wanting to erase
  2419.  
  2420. it or stop adding to it, which would’ve been a waste, I decided instead to share it with others. This was the best
  2421.  
  2422. justification for what I was doing that I could think of, especially because it allowed me to more or less
  2423.  
  2424. legitimately collect material from a wider range of sources. So, with my boss’s approval, I set about creating an
  2425.  
  2426. automated readboard—one that didn’t rely on anybody posting things to it, but edited itself.
  2427.  
  2428. Like EPICSHELTER, my automated readboard platform was designed to perpetually scan for new and unique documents. It
  2429.  
  2430. did so in a far more comprehensive manner, however, peering beyond NSAnet, the NSA’s network, into the networks of
  2431.  
  2432. the CIA and the FBI as well as into the Joint Worldwide Intelligence Communications System (JWICS), the Department of
  2433.  
  2434. Defense’s top-secret intranet. The idea was that its findings would be made available to every NSA officer by
  2435.  
  2436. comparing their digital identity badges— called PKI certificates—to the classification of the documents, generating a
  2437.  
  2438. personal readboard customized to their clearances, interests, and office affiliations. Essentially, it would be a
  2439.  
  2440. readboard of readboards, an individually tailored newsfeed aggregator, bringing each officer all the newest
  2441.  
  2442. information pertinent to their work, all the documents they had to read to stay current. It would be run from a
  2443.  
  2444. server that I alone managed, located just down the hall from me. That server would also store a copy of every
  2445.  
  2446. document it sourced, making it easy for me to perform the kind of deep interagency searches that the heads of most
  2447.  
  2448. agencies could only dream of.
  2449.  
  2450. I called this system Heartbeat, because it took the pulse of the NSA and of the wider IC. The volume of information
  2451.  
  2452. that crashed through its veins was simply enormous, as it pulled documents from internal sites dedicated to every
  2453.  
  2454. specialty from updates on the latest cryptographic research projects to minutes of the meetings of the National
  2455.  
  2456. Security Council. I’d carefully configured it to ingest materials at a slow, constant pace, so as not to monopolize
  2457.  
  2458. the undersea fiber-optic cable tying Hawaii to Fort Meade, but it still pulled so many more documents than any human
  2459.  
  2460. ever could that it immediately became the NSAnet’s most comprehensive readboard.
  2461.  
  2462. Early on in its operation I got an email that almost stopped Heartbeat forever. A faraway administrator—apparently
  2463.  
  2464. the only one in the entire IC who actually bothered to look at his access logs—wanted to know why a system in Hawaii
  2465.  
  2466. was copying, one by one, every record in his database. He had immediately blocked me as a precaution, which
  2467.  
  2468. effectively locked me
  2469. out, and was demanding an explanation. I told him what I was doing and showed him how to use the internal website
  2470.  
  2471. that would let him read Heartbeat for himself. His response reminded me of an unusual characteristic of the
  2472.  
  2473. technologists’ side of the security state: once I gave him access, his wariness instantly turned into curiosity. He
  2474.  
  2475. might have doubted a person, but he’d never doubt a machine. He could now see that Heartbeat was just doing what it’d
  2476.  
  2477. been meant to do, and was doing it perfectly. He was fascinated. He unblocked me from his repository of records, and
  2478.  
  2479. even offered to help me by circulating information about Heartbeat to his colleagues.
  2480.  
  2481. Nearly all of the documents that I later disclosed to journalists came to me through Heartbeat. It showed me not just
  2482.  
  2483. the aims but the abilities of the IC’s mass surveillance system. This is something I want to emphasize: in mid-
  2484. 2012, I was just trying to get a handle on how mass surveillance actually worked. Almost every journalist who later
  2485.  
  2486. reported on the disclosures was primarily concerned with the targets of surveillance—the efforts to spy on American
  2487.  
  2488. citizens, for instance, or on the leaders of America’s allies. That is to say, they were more interested in the
  2489.  
  2490. topics of the surveillance reports than in the system that produced them. I respect that interest, of course, having
  2491.  
  2492. shared it myself, but my own primary curiosity was still technical in nature. It’s all well and good to read a
  2493.  
  2494. document or to click through the slides of a PowerPoint presentation to find out what a program is intended to do,
  2495.  
  2496. but the better you can understand a program’s mechanics, the better you can understand its potential for abuse.
  2497.  
  2498. This meant that I wasn’t much interested in the briefing materials—like, for example, what has become perhaps the
  2499.  
  2500. best-known file I disclosed, a slide deck from a 2011 PowerPoint presentation that delineated the NSA’s new
  2501.  
  2502. surveillance posture as a matter of six protocols: “Sniff It All, Know It All, Collect It All, Process It All,
  2503.  
  2504. Exploit It All, Partner It All.” This was just PR speak, marketing jargon. It was intended to impress America’s
  2505.  
  2506. allies: Australia, Canada, New Zealand, and the UK, the primary countries with which the United States shares
  2507.  
  2508. intelligence. (Together with the United States, these countries are known as the Five Eyes.) “Sniff It All” meant
  2509.  
  2510. finding a data source; “Know It All” meant finding out what that data was; “Collect It All” meant capturing that
  2511.  
  2512. data; “Process It All” meant analyzing that data for usable intelligence; “Exploit It All” meant using that
  2513.  
  2514. intelligence to further the agency’s aims; and “Partner It All” meant sharing the new data source with allies. While
  2515.  
  2516. this six-pronged taxonomy was easy to remember, easy to sell, and an accurate measure of the scale of the agency’s
  2517.  
  2518. ambition and the degree of its collusion with foreign governments, it gave me no insight into
  2519. how exactly that ambition was realized in technological terms.
  2520.  
  2521. Much more revealing was an order I found from the FISA Court, a legal demand for a private company to turn over its
  2522.  
  2523. customers’ private information to the federal government. Orders such as these were notionally issued on the
  2524.  
  2525. authority of public legislation; however, their contents, even their existence, were classified Top Secret. According
  2526.  
  2527. to Section 215 of the Patriot Act, aka the “business records” provision, the government was authorized to obtain
  2528.  
  2529. orders from the FISA Court that compelled third parties to produce “any tangible thing” that was “relevant” to
  2530.  
  2531. foreign intelligence or terrorism investigations. But  as  the  court order I  found made clear, the  NSA had
  2532.  
  2533. secretly  interpreted  this  authorization  as  a  license  to  collect  all  of  the “business records,” or
  2534.  
  2535. metadata, of telephone communications coming through American telecoms, such as Verizon and AT&T, on “an ongoing
  2536.  
  2537. daily basis.” This included, of course, records of telephone communications between American citizens, the practice
  2538.  
  2539. of which was unconstitutional.
  2540.  
  2541. Additionally, Section 702 of the FISA Amendments Act allows the IC to target any foreigner outside the United States
  2542.  
  2543. deemed likely to communicate “foreign intelligence information”—a broad category of potential targets that includes
  2544.  
  2545. journalists, corporate employees, academics, aid workers, and countless others innocent of any wrongdoing whatsoever.
  2546.  
  2547. This legislation was being used by the NSA to justify its two most prominent Internet surveillance methods: the PRISM
  2548.  
  2549. program and upstream collection.
  2550.  
  2551. PRISM enabled the NSA to routinely collect data from Microsoft, Yahoo!, Google, Facebook, Paltalk, YouTube, Skype,
  2552.  
  2553. AOL, and Apple, including email, photos, video and audio chats, Web-browsing content, search engine queries, and all
  2554.  
  2555. other data stored on their clouds, transforming the companies into witting coconspirators. Upstream collection,
  2556.  
  2557. meanwhile, was arguably even more invasive. It enabled the routine capturing of data directly from private-sector
  2558.  
  2559. Internet  infrastructure—the switches  and  routers  that  shunt Internet traffic worldwide, via the satellites in
  2560.  
  2561. orbit and the high-capacity fiber-optic cables that run under the ocean. This collection was managed by the NSA’s
  2562.  
  2563. Special Sources Operations unit, which built secret wiretapping equipment and embedded it inside the corporate
  2564.  
  2565. facilities of obliging Internet service providers around the world. Together, PRISM (collection from the servers of
  2566.  
  2567. service providers) and upstream collection (direct collection from Internet infrastructure) ensured that the world’s
  2568.  
  2569. information, both stored and in transit, was surveillable.
  2570.  
  2571. The next stage of my investigation was to figure out how this collection
  2572. was actually accomplished—that is to say, to examine the documents that explained which tools supported this program
  2573.  
  2574. and how they selected from among the vast mass of dragneted communications those that were thought worthy of closer
  2575.  
  2576. inspection. The difficulty was that this information did not exist in any presentation, no matter the level of
  2577.  
  2578. classification, but only in engineering diagrams and raw schematics. These were the most important materials for me
  2579.  
  2580. to find. Unlike the Five Eyes’ pitch-deck cant, they would be concrete proof that the capacities I was reading about
  2581.  
  2582. weren’t merely the fantasies of an overcaffeinated project manager. As a systems guy who was always being prodded to
  2583.  
  2584. build faster and deliver more, I was all too aware that the agencies would sometimes announce technologies before
  2585.  
  2586. they even existed—sometimes because a Cliff-type salesperson had made one too many promises, and sometimes just out
  2587.  
  2588. of unalloyed ambition.
  2589.  
  2590. In this case, the technologies behind upstream collection did exist. As I came to realize, these tools are the most
  2591.  
  2592. invasive elements of the NSA’s mass surveillance system, if only because they’re the closest to the user—that is, the
  2593.  
  2594. closest to the person being surveilled. Imagine yourself sitting at a computer, about to visit a website. You open a
  2595.  
  2596. Web browser, type in a URL, and hit Enter. The URL is, in effect, a request, and this request goes out in search of
  2597.  
  2598. its destination server. Somewhere in the midst of its travels, however, before your request gets to that server, it
  2599.  
  2600. will have to pass through TURBULENCE, one of the NSA’s most powerful weapons.
  2601.  
  2602. Specifically, your request passes through a few black servers stacked on top of one another, together about the size
  2603.  
  2604. of a four-shelf bookcase. These are installed in  special  rooms  at  major  private  telecommunications buildings
  2605.  
  2606. throughout allied countries, as well as in US embassies and on US military bases, and contain two critical tools. The
  2607.  
  2608. first, TURMOIL, handles “passive collection,” making a copy of the data coming through. The second, TURBINE, is in
  2609.  
  2610. charge of “active collection”—that is, actively tampering with the users.
  2611.  
  2612. You can think of TURMOIL as a guard positioned at an invisible firewall through which Internet traffic must pass.
  2613.  
  2614. Seeing your request, it checks its metadata for selectors, or criteria, that mark it as deserving of more scrutiny.
  2615.  
  2616. Those selectors can be whatever the NSA chooses, whatever the NSA finds suspicious: a particular email address,
  2617.  
  2618. credit card, or phone number; the geographic origin or  destination of  your  Internet activity; or  just  certain
  2619.  
  2620. keywords such as “anonymous Internet proxy” or “protest.”
  2621.  
  2622. If TURMOIL flags your traffic as suspicious, it tips it over to TURBINE,
  2623. which diverts your request to the NSA’s servers. There, algorithms decide which of the agency’s exploits—malware
  2624.  
  2625. programs—to use against you. This choice is based on the type of website you’re trying to visit as much as on your
  2626.  
  2627. computer’s software and Internet connection. These chosen exploits are sent back to TURBINE (by programs of the
  2628.  
  2629. QUANTUM suite, if you’re wondering), which injects them into the traffic channel and delivers them to you along with
  2630.  
  2631. whatever website you requested. The end result: you get all the content you want, along with all the surveillance you
  2632.  
  2633. don’t, and it all happens in less than 686 milliseconds. Completely unbeknownst to you.
  2634.  
  2635. Once the exploits are on your computer, the NSA can access not just your metadata, but your data as well. Your entire
  2636.  
  2637. digital life now belongs to them.
  2638. 21
  2639.  
  2640. Whistleblowing
  2641.  
  2642. If any NSA employee who didn’t work with the SharePoint software I managed knew anything at all about SharePoint,
  2643.  
  2644. they knew the calendars. These  were  pretty  much  the  same  as  any  normal  nongovernment group calendars, just
  2645.  
  2646. way more expensive, providing the basic when-and-where-do- I-have-to-be-at-a-meeting scheduling interface for NSA
  2647.  
  2648. personnel in Hawaii. This was about as exciting for me to manage as you might imagine. That’s why I tried to spice it
  2649.  
  2650. up by making sure the calendar always had reminders of all the holidays, and I mean all of them: not just the federal
  2651.  
  2652. holidays, but Rosh Hashanah, Eid al-Fitr, Eid al-Adha, Diwali.
  2653.  
  2654. Then there was my favorite, the seventeenth of September. Constitution Day and Citizenship Day, which is the
  2655.  
  2656. holiday’s formal name, commemorates the moment in 1787 when the delegates to the Constitutional Convention officially
  2657.  
  2658. ratified, or signed, the document. Technically, Constitution Day is not a federal holiday, just a federal observance,
  2659.  
  2660. meaning that Congress didn’t think our country’s founding document and the oldest national constitution still in use
  2661.  
  2662. in the world were important enough to justify giving people a paid day off.
  2663.  
  2664. The   Intelligence   Community   had   always   had   an   uncomfortable relationship  with  Constitution  Day,  
  2665.  
  2666. which  meant  its  involvement  was typically limited to circulating a bland email drafted by its agencies’ press
  2667.  
  2668. shops and signed by Director So-and-So, and setting up a sad little table in a forgotten corner of the cafeteria. On
  2669.  
  2670. the table would be some free copies of the Constitution printed, bound, and donated to the government by the kind and
  2671.  
  2672. generous rabble-rousers at places like the Cato Institute or the Heritage Foundation, since the IC was rarely
  2673.  
  2674. interested in spending some of its own billions on promoting civil liberties through stapled paper.
  2675.  
  2676. I suppose the staff got the message, or didn’t: over the seven Constitution Days I spent in the IC, I don’t think I’d
  2677.  
  2678. ever known anyone but myself to actually take a copy off the table. Because I love irony almost as much as I love
  2679.  
  2680. freebies, I’d always take a few—one for myself, and the others to salt across my friends’ workstations. I kept my
  2681.  
  2682. copy propped against the Rubik’s Cube on my desk, and for a time made a habit of reading it over lunch, trying not to
  2683.  
  2684. drip grease on “We the People” from one of the cafeteria’s grim slices of elementary-school pizza.
  2685.  
  2686. I  liked  reading  the  Constitution partially  because  its  ideas  are  great,
  2687. partially because its prose is good, but really because it freaked out my coworkers. In an office where everything
  2688.  
  2689. you printed had to be thrown into a shredder after you were done with it, someone would always be intrigued by the
  2690.  
  2691. presence of hard-copy pages lying on a desk. They’d amble over to ask, “What have you got there?”
  2692.  
  2693. “The Constitution.”
  2694.  
  2695. Then they’d make a face and back away slowly.
  2696.  
  2697. On Constitution Day 2012, I picked up the document in earnest. I hadn’t really read the whole thing in quite a few
  2698.  
  2699. years, though I was glad to note that I still knew the preamble by heart. Now, however, I read through it in its
  2700.  
  2701. entirety, from the Articles to the Amendments. I was surprised to be reminded that fully 50 percent of the Bill of
  2702.  
  2703. Rights, the document’s first ten amendments, were intended to make the job of law enforcement harder. The Fourth,
  2704.  
  2705. Fifth, Sixth, Seventh, and Eighth Amendments were all deliberately, carefully  designed  to  create  inefficiencies  
  2706.  
  2707. and  hamper  the  government’s ability to exercise its power and conduct surveillance.
  2708.  
  2709. This is especially true of the Fourth, which protects people and their property from government scrutiny: The right
  2710.  
  2711. of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures,
  2712.  
  2713. shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and
  2714.  
  2715. particularly describing the place to be searched, and the persons or things to be seized.
  2716.  
  2717. Translation: If officers of the law want to go rooting through your life, they first have to go before a judge and
  2718.  
  2719. show probable cause under oath. This means they have to explain to a judge why they have reason to believe that you
  2720.  
  2721. might have committed a specific crime or that specific evidence of a specific crime might be found on or in a
  2722.  
  2723. specific part of your property. Then they have to swear that this reason has been given honestly and in good faith.
  2724.  
  2725. Only if the judge approves a warrant will they be allowed to go searching— and even then, only for a limited time.
  2726.  
  2727. The Constitution was written in the eighteenth century, back when the only computers were abacuses, gear calculators,
  2728.  
  2729. and looms, and it could take weeks or months for a communication to cross the ocean by ship. It stands to reason that
  2730.  
  2731. computer files, whatever their contents, are our version of the Constitution’s “papers.” We certainly use them like
  2732.  
  2733. “papers,” particularly our word-processing documents and spreadsheets, our messages and histories of inquiry. Data,
  2734.  
  2735. meanwhile, is our version of “effects,” a catchall term for all
  2736. the stuff that we own, produce, sell, and buy online. That includes, by default, metadata, which is the record of all
  2737.  
  2738. the stuff that we own, produce, sell, and buy online—a perfect ledger of our private lives.
  2739.  
  2740. In the centuries since the original Constitution Day, our clouds, computers, and phones have become our homes, just
  2741.  
  2742. as personal and intimate as our actual houses nowadays. If you don’t agree, then answer me this: Would you rather let
  2743.  
  2744. your coworkers hang out at your home alone for an hour, or let them spend even just ten minutes alone with your
  2745.  
  2746. unlocked phone?
  2747.  
  2748. The NSA’s surveillance programs, its domestic surveillance programs in particular, flouted the Fourth Amendment
  2749.  
  2750. completely. The agency was essentially making a claim that the amendment’s protections didn’t apply to modern-day
  2751.  
  2752. lives. The agency’s internal policies neither regarded your data as your legally protected personal property, nor
  2753.  
  2754. regarded their collection of that data as a “search” or “seizure.” Instead, the NSA maintained that because you had  
  2755.  
  2756. already  “shared”  your  phone  records  with  a  “third  party”—your telephone service provider—you had forfeited
  2757.  
  2758. any constitutional privacy interest you may once have had. And it insisted that “search” and “seizure” occurred only
  2759.  
  2760. when its analysts, not its algorithms, actively queried what had already been automatically collected.
  2761.  
  2762. Had constitutional oversight mechanisms been functioning properly, this extremist interpretation of the Fourth
  2763.  
  2764. Amendment—effectively holding that the very act of using modern technologies is tantamount to a surrender of your
  2765.  
  2766. privacy rights—would have been rejected by Congress and the courts. America’s Founders were skilled engineers of
  2767.  
  2768. political power, particularly attuned to the perils posed by legal subterfuge and the temptations of the presidency
  2769.  
  2770. toward exercising monarchical authority. To forestall such eventualities, they designed a system, laid out in the
  2771.  
  2772. Constitution’s first three articles, that established the US government in three coequal branches, each supposed to
  2773.  
  2774. provide checks and balances to the others. But when it came to protecting the privacy of American citizens in the
  2775.  
  2776. digital age, each of these branches failed in its own way, causing the entire system to halt and catch fire.
  2777.  
  2778. The legislative branch, the two houses of Congress, willingly abandoned its supervisory role: even as the number of
  2779.  
  2780. IC government employees and private contractors was exploding, the number of congresspeople who were kept informed
  2781.  
  2782. about the IC’s capabilities and activities kept dwindling, until only a few special committee members were apprised
  2783.  
  2784. in closed-door hearings. Even then they were only informed of some, but not all, of the IC’s activities.
  2785. When rare public hearings on the IC were held, the NSA’s position was made strikingly clear: The agency would not
  2786.  
  2787. cooperate, it would not be honest, and, what was worse, through classification and claims of secrecy it would force
  2788.  
  2789. America’s federal legislatures to collaborate in its deception. In early 2013, for  instance,  James  Clapper,  then  
  2790.  
  2791. the  director  of  National  Intelligence, testified under oath to the US Senate Select Committee on Intelligence
  2792.  
  2793. that the  NSA  did  not  engage  in  bulk  collection  of  the  communications  of American citizens. To the
  2794.  
  2795. question, “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?” Clapper
  2796.  
  2797. replied, “No, sir,” and then added, “There are cases where they could inadvertently perhaps collect, but not
  2798.  
  2799. wittingly.” That was a witting, bald-faced lie, of course, not just to Congress but to the American people. More than
  2800.  
  2801. a few of the congresspeople to whom Clapper was testifying knew very well that what he was saying was untrue, yet
  2802.  
  2803. they refused, or felt legally powerless, to call him out on it.
  2804.  
  2805. The failure of the judiciary was, if anything, even more disappointing. The Foreign Intelligence Surveillance Court
  2806.  
  2807. (FISC), which oversees intelligence surveillance within the United States, is a specialized body that meets in secret
  2808.  
  2809.  and  hears  only  from  the  government.  It  was  designed  to  grant individual warrants for foreign intelligence
  2810.  
  2811. collection, and has always been especially accommodating to the NSA, approving well over 99 percent of the agency’s
  2812.  
  2813. requests—a rate more suggestive of a ministerial rubber stamp than a deliberative judicial process. After 9/11, the
  2814.  
  2815. court expanded its role from authorizing the surveillance of specific individuals to ruling on the legality and
  2816.  
  2817. constitutionality of broad programmatic surveillance, without any adversarial scrutiny. A body that previously had
  2818.  
  2819. been tasked with approving the surveillance of Foreign Terrorist #1 or Foreign Spy #2 was now being used to
  2820.  
  2821. legitimize the whole combined infrastructure of PRISM and upstream collection. Judicial review of that infrastructure
  2822.  
  2823. was reduced, in the words of the ACLU to a secret court upholding secret programs by secretly reinterpreting federal
  2824.  
  2825. law.
  2826.  
  2827. When civil society groups like the ACLU tried to challenge the NSA’s activities in ordinary, open federal courts, a
  2828.  
  2829. curious thing happened. The government didn’t defend itself on the ground that the surveillance activities were legal
  2830.  
  2831. or constitutional. It declared, instead, that the ACLU and its clients had no right to be in court at all, because
  2832.  
  2833. the ACLU could not prove that its clients had in fact been surveilled. Moreover, the ACLU could not use the
  2834.  
  2835. litigation to seek evidence of surveillance, because the existence (or nonexistence) of that evidence was “a state
  2836.  
  2837. secret,” and leaks to journalists
  2838. didn’t count. In other words, the court couldn’t recognize the information that was publicly known from having been
  2839.  
  2840. published in the media; it could only recognize the information that the government officially confirmed as being
  2841.  
  2842. publicly known. This invocation of classification meant that neither the ACLU, nor anyone else, could ever establish
  2843.  
  2844. standing to raise a legal challenge in open court. To my disgust, in February 2013 the US Supreme Court decided 5 to
  2845.  
  2846. 4 to accept the government’s reasoning and dismissed an ACLU and Amnesty International lawsuit challenging mass
  2847.  
  2848. surveillance without even considering the legality of the NSA’s activities.
  2849.  
  2850. Finally, there was the executive branch, the primary cause of this constitutional breach. The president’s office,
  2851.  
  2852. through the Justice Department, had committed the original sin of secretly issuing directives that authorized mass  
  2853.  
  2854. surveillance  in  the  wake  of  9/11.  Executive  overreach  has  only continued in the decades since, with
  2855.  
  2856. administrations of both parties seeking to act unilaterally and establish policy directives that circumvent law—
  2857.  
  2858. policy directives that cannot be challenged, since their classification keeps them from being publicly known.
  2859.  
  2860. The constitutional system only functions as a whole if and when each of its three branches works as intended. When
  2861.  
  2862. all three don’t just fail, but fail deliberately and  with  coordination, the  result is  a  culture of  impunity. I
  2863.  
  2864. realized that I was crazy to have imagined that the Supreme Court, or Congress, or President Obama, seeking to
  2865.  
  2866. distance his administration from President George W. Bush’s, would ever hold the IC legally responsible—for anything.
  2867.  
  2868. It was time to face the fact that the IC believed themselves above the law, and given how broken the process was,
  2869.  
  2870. they were right. The IC had come to understand the rules of our system better than the people who had created it, and
  2871.  
  2872. they used that knowledge to their advantage.
  2873.  
  2874. They’d hacked the Constitution.
  2875.  
  2876.  
  2877.  
  2878. AMERICA WAS BORN from an act of treason. The Declaration of Independence was  an  outrageous violation of  the  laws  
  2879.  
  2880. of  England and  yet  the  fullest expression of what the Founders called the “Laws of Nature,” among which was the
  2881.  
  2882. right to defy the powers of the day and rebel on point of principle, according to the dictates of one’s conscience.
  2883.  
  2884. The first Americans to exercise
  2885. this right, the first “whistleblowers” in American history, appeared one year
  2886. later—in 1777.
  2887.  
  2888. These men, like so many of the men in my family, were sailors, officers of
  2889. the Continental Navy who, in defense of their new land, had taken to the sea. During the Revolution, they served on
  2890.  
  2891. the USS Warren, a thirty-two-gun frigate under the command of Commodore Esek Hopkins, the commander in chief of the
  2892.  
  2893. Continental Navy. Hopkins was a lazy and intractable leader who refused to bring his vessel into combat. His officers
  2894.  
  2895. also claimed to have witnessed him  beating and  starving British prisoners of  war.  Ten  of  the Warren’s officers
  2896.  
  2897. —after consulting their consciences, and with barely a thought for their careers—reported all of this up the chain of
  2898.  
  2899. command, writing to the Marine Committee:
  2900.  
  2901. Much Respected Gentlemen,
  2902.  
  2903. We who present this petition are engaged on board the ship Warren with an earnest desire and fixed expectation of
  2904.  
  2905. doing our country some service. We are still anxious for the Weal of America & wish nothing more earnestly than to
  2906.  
  2907. see her in peace & prosperity. We are ready to hazard every thing that is dear & if necessary sacrifice our lives for
  2908.  
  2909. the welfare of our country. We are desirous of being active in the defence  of our constitutional  liberties  and
  2910.  
  2911. privileges against the unjust cruel claims of tyranny & oppression; but as things are now circumstanced on board this
  2912.  
  2913. frigate, there seems to be no prospect of our being serviceable in our present station. We  have  been  in  this  
  2914.  
  2915. situation  for  a  considerable  space  of  time.  We  are  personally  well acquainted with the real character &
  2916.  
  2917. conduct of our commander, Commodore Hopkins, & we take this method not having a more convenient opportunity of
  2918.  
  2919. sincerely & humbly petitioning the honorable Marine Committee that they would inquire into his character & conduct,
  2920.  
  2921. for we suppose that his character is such & that he has been guilty of such crimes as render him quite unfit  for  
  2922.  
  2923. the  public  department  he  now  occupies,  which  crimes,  we  the  subscribers  can sufficiently attest.
  2924.  
  2925. After receiving this letter, the Marine Committee investigated Commodore Hopkins. He reacted by dismissing his
  2926.  
  2927. officers and crew, and in a fit of rage filed a criminal libel suit against Midshipman Samuel Shaw and Third
  2928.  
  2929. Lieutenant Richard Marven, the two officers who admitted to having authored the petition. The suit was filed in the
  2930.  
  2931. courts of Rhode Island, whose last colonial governor had been Stephen Hopkins, a signatory to the Declaration of
  2932.  
  2933. Independence and the commodore’s brother.
  2934.  
  2935. The case was assigned to a judge appointed by Governor Hopkins, but before the trial commenced Shaw and Marven were
  2936.  
  2937. saved by a fellow naval officer, John Grannis, who broke ranks and presented their case directly to the Continental
  2938.  
  2939. Congress. The  Continental Congress was  so  alarmed  by  the precedent being set by allowing military complaints
  2940.  
  2941. regarding dereliction of duty to be subject to the criminal charge of libel that it intervened. On July 30,
  2942. 1778, it terminated the command of Commodore Hopkins, ordered the Treasury Office to pay Shaw and Marven’s legal
  2943.  
  2944. fees, and by unanimous consent enacted America’s first whistleblower protection law. This law declared it “the duty
  2945.  
  2946. of all persons in the service of the United States, as well as all other inhabitants thereof, to give the earliest
  2947.  
  2948. information to Congress or
  2949. any other proper authority of any misconduct, frauds, or misdemeanors committed by any officers or persons in the
  2950.  
  2951. service of these states, which may come to their knowledge.”
  2952.  
  2953. The law gave me hope—and it still does. Even at the darkest hour of the Revolution, with the very existence of the
  2954.  
  2955. country at stake, Congress didn’t just welcome an act of principled dissent, it enshrined such acts as duties. By the
  2956.  
  2957. latter half of 2012, I was resolved to perform this duty myself, though I knew I’d be making my disclosures at a very
  2958.  
  2959. different time—a time both more comfortable and more cynical. Few if any of my IC superiors would have sacrificed
  2960.  
  2961. their careers for the same American principles for which military personnel regularly sacrifice their lives. And in
  2962.  
  2963. my case, going up “the chain of command,” which the IC prefers to call “the proper channels,” wasn’t an option as it
  2964.  
  2965. was for the ten men who crewed on the Warren. My superiors were not only aware of what the agency was doing, they
  2966.  
  2967. were actively directing it—they were complicit.
  2968.  
  2969. In organizations like the NSA—in which malfeasance has become so structural as to be a matter not of any particular
  2970.  
  2971. initiative, but of an ideology
  2972. —proper channels can only become a trap, to catch the heretics and disfavorables. I’d already experienced the failure
  2973.  
  2974. of command back in Warrenton, and then again in Geneva, where in the regular course of my duties I had discovered a
  2975.  
  2976. security vulnerability in a critical program. I’d reported the vulnerability, and when nothing was done about it I
  2977.  
  2978. reported that, too. My supervisors weren’t happy that I’d done so, because their supervisors weren’t happy, either.
  2979.  
  2980. The chain of command is truly a chain that binds, and the lower links can only be lifted by the higher.
  2981.  
  2982. Coming from a Coast Guard family, I’ve always been fascinated by how much of the English language vocabulary of
  2983.  
  2984. disclosure has a nautical undercurrent. Even before the days of the USS Warren, organizations, like ships, sprang
  2985.  
  2986. leaks. When steam replaced wind for propulsion, whistles were blown at sea to signal intentions and emergencies: one
  2987.  
  2988. whistle to pass by port, two whistles to pass by starboard, five for a warning.
  2989.  
  2990. The same terms in European languages, meanwhile, often have fraught political valences conditioned by historical
  2991.  
  2992. context. French used dénonciateur throughout much of the twentieth century, until the word’s WWII-era association
  2993.  
  2994. with being a “denouncer” or “informant” for the Germans led to a preference for lanceur d’alerte (“one who launches a
  2995.  
  2996. warning”). German, a language that has struggled with its culture’s Nazi and Stasi past, evolved beyond its own
  2997.  
  2998. Denunziant and Informant to settle on the unsatisfactory
  2999. Hinweisgeber (a “hint- or tip-giver”), Enthueller (“revealer”), Skandalaufdecker  (“scandal-uncoverer”), and  even  
  3000.  
  3001. the  pointedly  political ethische Dissidenten (“ethical dissident”). German uses few of these words online, however;
  3002.  
  3003. with respect to today’s Internet-based disclosures, it has simply borrowed the noun Whistleblower and the verb
  3004.  
  3005. leaken. The languages of regimes like Russia and China, for their part, employ terms that bear the pejorative sense
  3006.  
  3007. of “snitch” and “traitor.” It would take the existence of a strong free press in those societies to imbue those words
  3008.  
  3009. with a more positive coloration, or to coin new ones that would frame disclosure not as a betrayal but as an
  3010.  
  3011. honorable duty.
  3012.  
  3013. Ultimately, every language, including English, demonstrates its culture’s relationship to power by how it chooses to
  3014.  
  3015. define the act of disclosure. Even the nautically derived English words that seem neutral and benign frame the act
  3016.  
  3017. from the perspective of the institution that perceives itself wronged, not of the public that the institution has
  3018.  
  3019. failed. When an institution decries “a leak,” it is implying that the “leaker” damaged or sabotaged something.
  3020.  
  3021. Today, “leaking” and “whistleblowing” are often treated as interchangeable. But to my mind, the term “leaking” should
  3022.  
  3023. be used differently  than  it  commonly  is.  It  should  be  used  to  describe  acts  of disclosure done not out of
  3024.  
  3025. public interest but out of self-interest, or in pursuit of institutional or political aims. To be more precise, I
  3026.  
  3027. understand a leak as something closer to a “plant,” or an incidence of “propaganda-seeding”: the selective release of
  3028.  
  3029. protected information in order to sway popular opinion or affect the course of decision making. It is rare for even a
  3030.  
  3031. day to go by in which some “unnamed” or “anonymous” senior government official does not leak, by way of a hint or tip
  3032.  
  3033. to a journalist, some classified item that advances their own agenda or the efforts of their agency or party.
  3034.  
  3035. This dynamic is perhaps most brazenly exemplified by a 2013 incident in which IC officials, likely seeking to inflate
  3036.  
  3037. the threat of terrorism and deflect criticism of mass surveillance, leaked to a few news websites extraordinarily
  3038.  
  3039. detailed accounts of a conference call between al-Qaeda leader Ayman al- Zawahiri and his global affiliates. In this
  3040.  
  3041. so-called conference call of doom, al-Zawahiri purportedly discussed organizational cooperation with Nasser al-
  3042.  
  3043. Wuhayshi,  the  leader  of  al-Qaeda  in  Yemen,  and  representatives of  the Taliban  and  Boko  Haram.  By  
  3044.  
  3045. disclosing  the  ability  to  intercept  this conference call—that is, if we’re to believe this leak, which consisted
  3046.  
  3047. of a description of the call, not a recording—the IC irrevocably burned an extraordinary means of apprising itself of
  3048.  
  3049. the plans and intentions of the highest ranks of terrorist leadership, purely for the sake of a momentary
  3050. political advantage in the news cycle. Not a single person was prosecuted as a result of this stunt, though it was
  3051.  
  3052. most certainly illegal, and cost America the ability to keep wiretapping the alleged al-Qaeda hotline.
  3053.  
  3054. Time and again, America’s political class has proven itself willing to tolerate, even generate leaks that serve its
  3055.  
  3056. own ends. The IC often announces its “successes,” regardless of their classification and regardless of the
  3057.  
  3058. consequences. Nowhere in recent memory has that been more apparent than in the leaks relating to the extrajudicial
  3059.  
  3060. killing of the American-born extremist cleric Anwar al-Aulaqi in Yemen. By breathlessly publicizing its drone attack
  3061.  
  3062. on al-Aulaqi to the Washington Post and the New York Times, the Obama administration was tacitly admitting the
  3063.  
  3064. existence of the CIA’s drone program and its “disposition matrix,” or kill list, both of which are officially top
  3065.  
  3066. secret. Additionally, the government was implicitly confirming that it engaged not just in targeted assassinations,
  3067.  
  3068. but in targeted assassinations of American citizens. These leaks, accomplished in the coordinated fashion of a media
  3069.  
  3070. campaign, were shocking demonstrations of the state’s situational approach to secrecy: a  seal  that  must  be  
  3071.  
  3072. maintained for  the  government to  act  with impunity, but that can be broken whenever the government seeks to claim
  3073.  
  3074. credit.
  3075.  
  3076. It’s only in this context that the US government’s latitudinal relationship to leaking can be fully understood. It
  3077.  
  3078. has forgiven “unauthorized” leaks when they’ve resulted in  unexpected benefits, and  forgotten “authorized” leaks
  3079.  
  3080. when they’ve caused harm. But if a leak’s harmfulness and lack of authorization, not to mention its essential
  3081.  
  3082. illegality, make scant difference to the government’s reaction, what does? What makes one disclosure permissible, and
  3083.  
  3084. another not?
  3085.  
  3086. The answer is power. The answer is control. A disclosure is deemed acceptable only if it doesn’t challenge the
  3087.  
  3088. fundamental prerogatives of an institution. If all the disparate components of an organization, from its mailroom to
  3089.  
  3090. its executive suite, can be assumed to have the same power to discuss   internal   matters,   then   its   executives
  3091.  
  3092.   have   surrendered   their information control, and the organization’s continued functioning is put in jeopardy.
  3093.  
  3094. Seizing this equality of voice, independent of an organization’s managerial or decision-making hierarchy, is what is
  3095.  
  3096. properly meant by the term “whistleblowing”—an act that’s particularly threatening to the IC, which operates  by  
  3097.  
  3098. strict  compartmentalization under  a  legally  codified  veil  of secrecy.
  3099.  
  3100. A  “whistleblower,”  in  my  definition,  is  a  person  who  through  hard
  3101. experience has concluded that their life inside an institution has become incompatible with the principles developed
  3102.  
  3103. in—and the loyalty owed to—the greater society outside it, to which that institution should be accountable. This
  3104.  
  3105. person knows that they can’t remain inside the institution, and knows that the institution can’t or won’t be
  3106.  
  3107. dismantled. Reforming the institution might be possible, however, so they blow the whistle and disclose the
  3108.  
  3109. information to bring public pressure to bear.
  3110.  
  3111. This is an adequate description of my situation, with one crucial addition: all the information I intended to
  3112.  
  3113. disclose was classified top secret. To blow the whistle on secret programs, I’d also have to blow the whistle on the
  3114.  
  3115. larger system of secrecy, to expose it not as the absolute prerogative of state that the IC claimed it was but rather
  3116.  
  3117. as an occasional privilege that the IC abused to subvert democratic oversight. Without bringing to light the full
  3118.  
  3119. scope of this systemic secrecy, there would be no hope of restoring a balance of power between citizens and their
  3120.  
  3121. governance. This motive of restoration I take to be essential to whistleblowing: it marks the disclosure not as a
  3122.  
  3123. radical act of dissent or resistance, but a conventional act of return—signaling the ship to return back to port,
  3124.  
  3125. where it’ll be stripped, refitted, and patched of its leaks before being given the chance to start over.
  3126.  
  3127. A total exposure of the total apparatus of mass surveillance—not by me, but by the media, the de facto fourth branch
  3128.  
  3129. of the US government, protected by the Bill of Rights: that was the only response appropriate to the scale of the
  3130.  
  3131. crime. It wouldn’t be enough, after all, to merely reveal a particular abuse or set of abuses, which the agency could
  3132.  
  3133. stop (or pretend to stop) while preserving the rest of the shadowy apparatus intact. Instead, I was resolved to bring
  3134.  
  3135.  to  light  a  single,  all-encompassing fact:  that  my  government  had developed and deployed a global system of
  3136.  
  3137. mass surveillance without the knowledge or consent of its citizenry.
  3138.  
  3139. Whistleblowers can be elected by circumstance at any working level of an institution. But digital technology has
  3140.  
  3141. brought us to an age in which, for the first time in  recorded history, the most effective will come up  from the
  3142.  
  3143. bottom, from the ranks traditionally least incentivized to maintain the status quo. In the IC, as in virtually every
  3144.  
  3145. other outsize decentralized institution that relies on computers, these lower ranks are rife with technologists like
  3146.  
  3147. myself, whose legitimate access to vital infrastructure is grossly out of proportion to their formal authority to
  3148.  
  3149. influence institutional decisions. In other words, there is usually an imbalance that obtains between what people
  3150.  
  3151. like me are intended to know and what we are able to know, and between the slight power we have to change the
  3152.  
  3153. institutional culture and the vast power we have to
  3154. address  our  concerns to  the  culture  at  large.  Though  such  technological privileges can certainly be abused—
  3155.  
  3156. after all, most systems-level technologists have access to everything—the highest exercise of that privilege is in
  3157.  
  3158. cases involving the technology itself. Specialist abilities incur weightier responsibilities. Technologists seeking
  3159.  
  3160. to report on the systemic misuse of technology must do more than just bring their findings to the public, if the
  3161.  
  3162. significance of  those findings is  to  be  understood. They have a  duty  to contextualize and explain—to demystify.
  3163.  
  3164. A few dozen or so of the people best positioned to do this in the whole entire world were here—they were sitting all
  3165.  
  3166. around me in the Tunnel. My fellow technologists came in every day and sat at their terminals and furthered the  work
  3167.  
  3168.  of  the  state.  They  weren’t merely  oblivious to  its  abuses, but incurious about them, and that lack of
  3169.  
  3170. curiosity made them not evil but tragic. It didn’t matter whether they’d come to the IC out of patriotism or
  3171.  
  3172. opportunism: once they’d gotten inside the machine, they became machines themselves.
  3173. 22
  3174.  
  3175. Fourth Estate
  3176.  
  3177. Nothing is harder than living with a secret that can’t be spoken. Lying to strangers about a cover identity or
  3178.  
  3179. concealing the fact that your office is under the world’s most top-secret pineapple field might sound like it
  3180.  
  3181. qualifies, but at least you’re part of a team: though your work may be secret, it’s a shared secret, and therefore a
  3182.  
  3183. shared burden. There is misery but also laughter.
  3184.  
  3185. When you have a real secret, though, that you can’t share with anyone, even the laughter is a lie. I could talk about
  3186.  
  3187. my concerns, but never about where they were leading me. To the day I die I’ll remember explaining to my colleagues
  3188.  
  3189. how our work was being applied to violate the oaths we had sworn to uphold and their verbal shrug in response: “What
  3190.  
  3191. can you do about it?” I hated that question, its sense of resignation, its sense of defeat, but it still felt valid
  3192.  
  3193. enough that I had to ask myself, “Well, what?”
  3194.  
  3195. When the answer presented itself, I decided to become a whistleblower. Yet to breathe to Lindsay, the love of my
  3196.  
  3197. life, even a word about that decision would have put our relationship to an even crueler test than saying nothing.
  3198.  
  3199. Not wishing to cause her any more harm than I was already resigned to causing, I kept silent, and in my silence I was
  3200.  
  3201. alone.
  3202.  
  3203. I thought that solitude and isolation would be easy for me, or at least easier than it had been for my predecessors
  3204.  
  3205. in the whistleblowing world. Hadn’t each step of my life served as a kind of preparation? Hadn’t I gotten used to
  3206.  
  3207. being alone, after all those years spent hushed and spellbound in front of a screen? I’d been the solo hacker, the
  3208.  
  3209. night-shift harbormaster, the keeper of the keys in an empty office. But I  was human, too, and the lack of
  3210.  
  3211. companionship was hard. Each day was haunted by struggle, as I tried and failed to reconcile the moral and the legal,
  3212.  
  3213. my duties and my desires. I had everything I’d ever wanted—love, family, and success far beyond what I ever deserved
  3214.  
  3215. —and I lived in Eden amid plentiful trees, only one of which was forbidden to me. The easiest thing should have been
  3216.  
  3217. to follow the rules.
  3218.  
  3219. And even if I was already reconciled to the dangers of my decision, I wasn’t yet adjusted to the role. After all, who
  3220.  
  3221. was I to put this information in front of the American public? Who’d elected me the president of secrets?
  3222.  
  3223. The information I intended to disclose about my country’s secret regime of mass surveillance was so explosive, and
  3224.  
  3225. yet so technical, that I was as scared of being doubted as I was of being misunderstood. That was why my first
  3226. decision, after resolving to go public, was to go public with documentation. The way to reveal a secret program might
  3227.  
  3228. have been merely to describe its existence, but the way to reveal programmatic secrecy was to describe its workings.
  3229.  
  3230. This required documents, the agency’s actual files—as many as necessary to expose the scope of the abuse though I
  3231.  
  3232. knew that disclosing even one PDF would be enough to earn me prison.
  3233.  
  3234. The threat of government retribution against any entity or platform to which I made the disclosure led me to briefly
  3235.  
  3236. consider self-publishing. That would’ve been the most convenient and safest method: just collecting the documents
  3237.  
  3238. that best communicated my concerns and posting them online, as they were, then circulating a link. Ultimately, one of
  3239.  
  3240. my reasons for not pursuing this course had to do with authentication. Scores of people post “classified secrets” to
  3241.  
  3242. the Internet every day—many of them about time-travel technologies and aliens. I didn’t want my own revelations,
  3243.  
  3244. which were fairly incredible already, to get lumped in with the outlandish and lost among the crazy.
  3245.  
  3246. It was clear to me then, from the earliest stage of the process, that I required, and that the public deserved, some
  3247.  
  3248. person or institution to vouch for the veracity of the documents. I also wanted a partner to vet the potential
  3249.  
  3250. hazards posed by the revelation of classified information, and to help explain that information by putting it in
  3251.  
  3252. technological and legal context. I trusted myself to present the problems with surveillance, and even to analyze
  3253.  
  3254. them, but  I’d  have  to  trust  others  to  solve  them.  Regardless of  how  wary  of institutions I might have
  3255.  
  3256. been by this point, I was far warier of trying to act like one myself. Cooperating with some type of media
  3257.  
  3258. organization would defend me against the worst accusations of rogue activity, and correct for whatever biases I had,
  3259.  
  3260. whether they were conscious or unconscious, personal or professional. I  didn’t want any political opinion of mine to
  3261.  
  3262. prejudice anything with regard to the presentation, or reception, of the disclosures. After all, in a country in
  3263.  
  3264. which everyone was being surveilled, no issue was less partisan than surveillance.
  3265.  
  3266. In retrospect, I have to credit at least some of my desire to find ideological filters to Lindsay’s improving
  3267.  
  3268. influence. Lindsay had spent years patiently instilling in me the lesson that my interests and concerns weren’t
  3269.  
  3270. always hers, and certainly weren’t always the world’s, and that just because I shared my knowledge didn’t mean that
  3271.  
  3272. anyone had to share my opinion. Not everybody who was opposed to invasions of privacy might be ready to adopt 256-bit
  3273.  
  3274. encryption standards or drop off the Internet entirely. An illegal act that disturbed one person as a violation of
  3275.  
  3276. the Constitution might upset another
  3277. person as a violation of their privacy, or of that of their spouse or children. Lindsay was my key to unlocking this
  3278.  
  3279. truth—that diverse motives and approaches can only improve the chances of achieving common goals. She, without even
  3280.  
  3281. knowing it, gave me the confidence to conquer my qualms and reach out to other people.
  3282.  
  3283. But  which  people? Who?  It  might  be  hard  to  remember, or  even  to imagine, but at the time when I first
  3284.  
  3285. considered coming forward, the whistleblower’s forum of choice was WikiLeaks. Back then, it operated in many respects
  3286.  
  3287. like a traditional publisher, albeit one that was radically skeptical of state power. WikiLeaks regularly joined up
  3288.  
  3289. with leading international  publications  like  the  Guardian,  the  New  York  Times,  Der Spiegel, Le Monde, and El
  3290.  
  3291. País to publish the documents provided by its sources. The work that these partner news organizations accomplished
  3292.  
  3293. over the course of 2010 and 2011 suggested to me that WikiLeaks was most valuable as a go-between that connected
  3294.  
  3295. sources with journalists, and as a firewall that preserved sources’ anonymity.
  3296.  
  3297. WikiLeaks’ practices changed following its publication of disclosures by US Army private Chelsea Manning—huge caches
  3298.  
  3299. of US military field logs pertaining to the Iraq and Afghan wars, information about detainees at Guantanamo Bay,
  3300.  
  3301. along with US diplomatic cables. Due to the governmental backlash and media controversy surrounding the site’s
  3302.  
  3303. redaction of the Manning materials, WikiLeaks decided to change course and publish future leaks as they received
  3304.  
  3305. them: pristine and unredacted. This switch to a policy of total transparency meant that publishing with WikiLeaks
  3306.  
  3307. would not meet my needs. Effectually, it would have been the same for me as self-publishing, a route I’d already
  3308.  
  3309. rejected as insufficient. I knew that the story the NSA documents told about a global system of mass surveillance
  3310.  
  3311. deployed in the deepest secrecy was a difficult one to understand—a story so tangled and technical that I was
  3312.  
  3313. increasingly convinced it could not be presented all at once in a “document dump,” but only by the patient and
  3314.  
  3315. careful work of journalists, undertaken, in the best scenario I could conceive of, with the support of multiple
  3316.  
  3317. independent press institutions.
  3318.  
  3319. Though I felt some relief once I’d resolved to disclose directly to journalists, I still had some lingering
  3320.  
  3321. reservations. Most of them involved my country’s most prestigious publications—particularly America’s newspaper of
  3322.  
  3323. record, the New York Times. Whenever I thought about contacting the Times, I found myself hesitating. While the paper
  3324.  
  3325. had shown some willingness to displease the US government with its WikiLeaks reporting, I couldn’t stop reminding
  3326.  
  3327. myself of its earlier conduct involving an important article on the
  3328. government’s warrantless wiretapping program by Eric Lichtblau and James
  3329. Risen.
  3330.  
  3331. Those two journalists, by combining information from Justice Department whistleblowers with their own reporting, had
  3332.  
  3333. managed to uncover one aspect of STELLARWIND—the NSA’s original-recipe post-9/11 surveillance initiative—and had
  3334.  
  3335. produced a fully written, edited, and fact-checked article about it, ready to go to press by mid-2004. It was at this
  3336.  
  3337. point that the paper’s editor in chief, Bill Keller, ran the article past the government, as part of a courtesy
  3338.  
  3339. process whose typical purpose is for a publication’s editorial staff to have a chance to assess the government’s
  3340.  
  3341. arguments as to why the publication of certain information might endanger national security. In this case, as in most
  3342.  
  3343. cases, the government refused to provide a specific reason, but implied that one existed and that it was classified,
  3344.  
  3345. too. The Bush administration told Keller and the paper’s publisher, Arthur Sulzberger, without providing any
  3346.  
  3347. evidence, that the Times would be emboldening America’s enemies and enabling terror if it went public with the
  3348.  
  3349. information that the government was wiretapping American citizens without a warrant. Unfortunately, the paper allowed
  3350.  
  3351. itself to be convinced and spiked the article. Lichtblau and Risen’s reporting finally ran, but over a year later, in
  3352.  
  3353. December 2005, and only after Risen pressured the paper by announcing that the material was included in a book of his
  3354.  
  3355. that was about to be released. Had that article run when it was originally written, it might well have changed the
  3356.  
  3357. course of the 2004 election.
  3358.  
  3359. If the Times, or any paper, did something similar to me—if it took my revelations, reported on them, submitted the
  3360.  
  3361. reporting for review, and then suppressed its publication—I’d be sunk. Given the likelihood of my identification as
  3362.  
  3363. the source, it would be tantamount to turning me in before any revelations were brought to the public.
  3364.  
  3365. If I couldn’t trust a legacy newspaper, could I trust any institution? Why even bother? I hadn’t signed up for any of
  3366.  
  3367. this. I had just wanted to screw around with computers and maybe do some good for my country along the way. I had a
  3368.  
  3369. lease and a lover and my health was improved. Every STOP sign on my commute I took as advice to stop this voluntary
  3370.  
  3371. madness. My head and
  3372. heart were in conflict, with the only constant being the desperate hope that
  3373. somebody else, somewhere else, would figure it out on their own. After all, wasn’t journalism about following the
  3374.  
  3375. bread crumbs and connecting the dots? What else did reporters do all day, besides tweet?
  3376.  
  3377. I knew at least two things about the denizens of the Fourth Estate: they competed for scoops, and they knew very
  3378.  
  3379. little about technology. It was this
  3380. lack of expertise or even interest in tech that largely caused journalists to miss two events that stunned me during
  3381.  
  3382. the course of my fact-gathering about mass surveillance.
  3383.  
  3384. The first was the NSA’s announcement of the construction of a vast new data facility in Bluffdale, Utah. The agency
  3385.  
  3386. called it the Massive Data Repository, until somebody with a knack for PR realized the name might be tough to explain
  3387.  
  3388. if it ever got out, so it was renamed the Mission Data Repository—because as long as you don’t change the acronym,
  3389.  
  3390. you don’t have to change all the briefing slides. The MDR was projected to contain a total of four twenty-five-
  3391.  
  3392. thousand-square-foot halls, filled with servers. It could hold an immense amount of data, basically a rolling history
  3393.  
  3394. of the entire planet’s pattern of life, insofar as life can be understood through the connection of payments to
  3395.  
  3396. people, people to phones, phones to calls, calls to networks, and the synoptic array of Internet activity moving
  3397.  
  3398. along those networks’ lines.
  3399.  
  3400. The only prominent journalist who seemed to notice the announcement was James Bamford, who wrote about it for Wired
  3401.  
  3402. in March 2012. There were a few follow-ups in the nontech press, but none of them furthered the reporting. No one
  3403.  
  3404. asked what, to me at least, were the most basic questions: Why does any government agency, let alone an intelligence
  3405.  
  3406. agency, need that much space? What data, and how much of it, do they really intend to store there, and for how long?
  3407.  
  3408. Because there was simply no reason to build something to those specs unless you were planning on storing absolutely
  3409.  
  3410. everything, forever. Here was, to my mind, the corpus delicti—the plain-as- day corroboration of a crime, in a
  3411.  
  3412. gigantic concrete bunker surrounded by barbed wire and guard towers, sucking up a city’s worth of electricity from
  3413.  
  3414. its own power grid in the middle of the Utah desert. And no one was paying attention.
  3415.  
  3416. The second event happened one year later, in March 2013—one week after Clapper lied to Congress and Congress gave him
  3417.  
  3418. a pass. A few periodicals had covered that testimony, though they merely regurgitated Clapper’s denial that the NSA
  3419.  
  3420. collected bulk data on Americans. But no so- called mainstream publication at all covered a rare public appearance by
  3421.  
  3422. Ira “Gus” Hunt, the chief technology officer of the CIA.
  3423.  
  3424. I’d known Gus slightly from my Dell stint with the CIA. He was one of our top customers, and every vendor loved his
  3425.  
  3426. apparent inability to be discreet: he’d always tell you more than he was supposed to. For sales guys, he was like a
  3427.  
  3428. bag of money with a mouth. Now he was appearing as a special
  3429. guest  speaker at  a  civilian tech  event  in  New  York  called  the  GigaOM Structure: Data conference. Anyone
  3430.  
  3431. with $40 could go to it. The major talks, such as Gus’s, were streamed for free live online.
  3432.  
  3433. The reason I’d made sure to catch his talk was that I’d just read, through internal NSA channels, that the CIA had
  3434.  
  3435. finally decided on the disposition of its cloud contract. It had refused my old team at Dell, and turned down HP,
  3436.  
  3437. too, instead signing a ten-year, $600 million cloud development and management deal with Amazon. I  had no  negative
  3438.  
  3439. feelings about this— actually, at this juncture, I was pleased that my work wasn’t going to be used by the agency. I
  3440.  
  3441. was just curious, from a professional standpoint, whether Gus might obliquely address this announcement and offer any
  3442.  
  3443. insight into why Amazon had been chosen, since rumors were going around that the proposal process had been rigged in
  3444.  
  3445. Amazon’s favor.
  3446.  
  3447. I got insight, certainly, but of an unexpected kind. I had the opportunity of witnessing the highest-ranking
  3448.  
  3449. technical officer at the CIA stand onstage in a rumpled suit and brief a crowd of uncleared normies—and, via the
  3450.  
  3451. Internet, the uncleared world—about the agency’s ambitions and capacities. As his presentation unfolded, and he
  3452.  
  3453. alternated bad jokes with an even worse command of PowerPoint, I grew more and more incredulous.
  3454.  
  3455. “At the CIA,” he said, “we fundamentally try to collect everything and hang on to it forever.” As if that wasn’t
  3456.  
  3457. clear enough, he went on: “It is nearly within  our  grasp  to  compute  on  all  human  generated  information.” The
  3458.  
  3459. underline was Gus’s own. He was reading from his slide deck, ugly words in an ugly font illustrated with the
  3460.  
  3461. government’s signature four-color clip art.
  3462.  
  3463. There were a few journalists in the crowd, apparently, though it seemed as if almost all of them were from specialty
  3464.  
  3465. tech-government publications like Federal Computer Week. It was telling that Gus stuck around for a Q & A toward the
  3466.  
  3467. conclusion of his presentation. Rather, it wasn’t quite a Q & A, but more like an auxiliary presentation, offered
  3468.  
  3469. directly to the journalists. He must have been trying to get something off his chest, and it wasn’t just his clown
  3470.  
  3471. tie.
  3472.  
  3473. Gus told the journalists that the agency could track their smartphones, even when they were turned off—that the
  3474.  
  3475. agency could surveil every single one  of  their  communications. Remember: this  was  a  crowd  of  domestic
  3476.  
  3477. journalists. American journalists. And the way that Gus said “could” came off as “has,” “does,” and “will.” He
  3478.  
  3479. perorated in a distinctly disturbed, and disturbing, manner, at least for a CIA high priest: “Technology is moving
  3480.  
  3481. faster than government or law can keep up. It’s moving faster … than you can
  3482. keep up: you should be asking the question of what are your rights and who owns your data.” I was floored—anybody
  3483.  
  3484. more junior than Gus who had given a presentation like this would’ve been wearing orange by the end of the day.
  3485.  
  3486. Coverage of Gus’s confession ran only in the Huffington Post. But the performance itself lived on at YouTube, where
  3487.  
  3488. it still remains, at least at the time of this writing six years later. The last time I checked, it had 313 views— a
  3489.  
  3490. dozen of them mine.
  3491.  
  3492. The lesson I took from this was that for my disclosures to be effective, I had to do more than just hand some
  3493.  
  3494. journalists some documents—more, even, than help them interpret the documents. I had to become their partner, to
  3495.  
  3496. provide the technological training and tools to help them do their reporting accurately and safely. Taking this
  3497.  
  3498. course of action would mean giving myself over totally to one of the capital crimes of intelligence work: whereas
  3499.  
  3500. other spies have committed espionage, sedition, and treason, I would be aiding and abetting an act of journalism. The
  3501.  
  3502. perverse fact is that legally, those crimes are virtually synonymous. American law makes no distinction between
  3503.  
  3504. providing classified information to the press in the public interest and providing it, even selling it, to the enemy.
  3505.  
  3506. The only opinion I’ve ever found to contradict this came from my first indoctrination into the IC: there, I was told
  3507.  
  3508. that it was in fact slightly better to offer secrets for sale to the enemy than to offer them for free to a domestic
  3509.  
  3510. reporter. A reporter will tell the public, whereas an enemy is unlikely to share its prize even with its allies.
  3511.  
  3512. Given the risks I was taking, I needed to identify people I could trust who were also trusted by the public. I needed
  3513.  
  3514. reporters who were diligent yet discreet, independent yet reliable. They would need to be strong enough to challenge
  3515.  
  3516. me on the distinctions between what I suspected and what the evidence proved, and to challenge the government when it
  3517.  
  3518. falsely accused their work of endangering lives. Above all, I had to be sure that whoever I picked wouldn’t
  3519.  
  3520. ultimately cave to power when put under pressure that was certain to be like nothing they, or I, had ever experienced
  3521.  
  3522. before.
  3523.  
  3524. I cast my net not so widely as to imperil the mission, but widely enough to avoid a single point of failure—the New
  3525.  
  3526. York Times problem. One journalist, one publication, even one country of publication wouldn’t be enough, because the
  3527.  
  3528. US government had already demonstrated its willingness to stifle such reporting. Ideally, I’d give each journalist
  3529.  
  3530. their own set of documents simultaneously, leaving me with none. This would shift the focus of scrutiny to them, and
  3531.  
  3532. ensure that even if I were arrested the truth would still get out.
  3533. As I narrowed down my list of potential partners, I realized I’d been going about this all wrong, or just wastefully.
  3534.  
  3535. Instead of trying to select the journalists on my own, I should have been letting the system that I was trying to  
  3536.  
  3537. expose  select  them  for  me.  My  best  partners,  I  decided,  would  be journalists whom the national security
  3538.  
  3539. state had already targeted.
  3540.  
  3541. Laura Poitras I knew as a documentarian, primarily concerned with America’s post-9/11 foreign policy. Her film My
  3542.  
  3543. Country, My Country depicted the 2005 Iraqi national elections that were conducted under (and frustrated by) the US
  3544.  
  3545. occupation. She had also made The Program, about the NSA cryptanalyst William Binney—who had raised objections
  3546.  
  3547. through proper channels about TRAILBLAZER, the predecessor of STELLARWIND, only to be accused of leaking classified
  3548.  
  3549. information, subjected to repeated harassment, and arrested at gunpoint in his home, though never charged. Laura
  3550.  
  3551. herself had been frequently harassed by the government because of her work, repeatedly detained and interrogated by
  3552.  
  3553. border agents whenever she traveled in or out of the country.
  3554.  
  3555. Glenn Greenwald I knew as a civil liberties lawyer turned columnist, initially for  Salon—where he  was  one  of  the
  3556.  
  3557.  few  who  wrote  about  the unclassified version of the NSA IG’s Report back in 2009—and later for the US edition of
  3558.  
  3559. the Guardian. I liked him because he was skeptical and argumentative, the kind of man who’d fight with the devil, and
  3560.  
  3561. when the devil wasn’t around fight with himself. Though Ewen MacAskill, of the British edition of the Guardian, and
  3562.  
  3563. Bart Gellman of the Washington Post would later prove stalwart partners (and patient guides to the journalistic
  3564.  
  3565. wilderness), I found  my  earliest  affinity  with  Laura  and  Glenn,  perhaps  because  they weren’t merely
  3566.  
  3567. interested in reporting on the IC but had personal stakes in understanding the institution.
  3568.  
  3569. The only hitch was getting in touch.
  3570.  
  3571. Unable to reveal my true name, I contacted the journalists under a variety of identities, disposable masks worn for a
  3572.  
  3573. time and then discarded. The first of these was “Cincinnatus,” after the legendary farmer who became a Roman consul
  3574.  
  3575. and then voluntarily relinquished his power. That was followed by “Citizenfour,” a handle that some journalists took
  3576.  
  3577. to mean that I considered myself the fourth dissident-employee in the NSA’s recent history, after Binney and his
  3578.  
  3579. fellow TRAILBLAZER whistleblowers J. Kirk Wiebe and Ed Loomis
  3580. —though the triumvirate I actually had in mind consisted of Thomas Drake, who disclosed the existence of TRAILBLAZER
  3581.  
  3582. to journalists, and Daniel Ellsberg and  Anthony Russo, whose disclosure of  The  Pentagon Papers
  3583. helped expose the deceptions of the Vietnam War and bring it to an end. The final name I chose for my correspondence
  3584.  
  3585. was “Verax,” Latin for “speaker of truth,” in the hopes of proposing an alternative to the model of a hacker called
  3586.  
  3587. “Mendax” (“speaker of lies”)—the pseudonym of the young man who’d grow up to become WikiLeaks’ Julian Assange.
  3588.  
  3589. You can’t really appreciate how hard it is to stay anonymous online until you’ve tried to operate as if your life
  3590.  
  3591. depended on it. Most of the communications systems set up in the IC have a single basic aim: the observer of  a  
  3592.  
  3593. communication must  not  be  able  to  discern  the  identities of  those involved, or in any way attribute them to
  3594.  
  3595. an agency. This is why the IC calls these exchanges “non-attributable.” The pre-Internet spycraft of anonymity is
  3596.  
  3597. famous, mostly from TV and the movies: a safe-house address coded in bathroom-stall graffiti, for instance, or
  3598.  
  3599. scrambled into the abbreviations of a classified ad. Or think of the Cold War’s “dead drops,” the chalk marks on
  3600.  
  3601. mailboxes signaling that a secret package was waiting inside a particular hollowed-out tree in a public park. The
  3602.  
  3603. modern version might be fake profiles trading fake chats on a dating site, or, more commonly, just a superficially
  3604.  
  3605. innocuous app that leaves superficially innocuous messages on a superficially innocuous Amazon server secretly
  3606.  
  3607. controlled by the CIA. What I wanted, however, was something even better than that—something that required none of
  3608.  
  3609. that exposure, and none of that budget.
  3610.  
  3611. I decided to use somebody else’s Internet connection. I wish that were simply a matter of going to a McDonald’s or
  3612.  
  3613. Starbucks and signing on to their Wi-Fi. But those places have CCTV, and receipts, and other people— memories with
  3614.  
  3615. legs. Moreover, every wireless device, from a phone to a laptop, has a globally unique identifier called a MAC
  3616.  
  3617. (Machine Address Code), which it leaves on record with every access point it connects to—a forensic marker of its
  3618.  
  3619. user’s movements.
  3620.  
  3621. So I didn’t go to McDonald’s or Starbucks—I went driving. Specifically, I went war-driving, which is when you convert
  3622.  
  3623. your car into a roving Wi-Fi sensor. For this you need a laptop, a high-powered antenna, and a magnetic GPS sensor,
  3624.  
  3625. which can be slapped atop the roof. Power is provided by the car or by a portable battery, or else by the laptop
  3626.  
  3627. itself. Everything you need can fit into a backpack.
  3628.  
  3629. I  took along a  cheap laptop running TAILS, which is  a  Linux-based “amnesiac” operating system—meaning it forgets
  3630.  
  3631. everything when you turn it off, and starts fresh when you boot it up again, with no logs or memory traces of
  3632.  
  3633. anything ever done on it. TAILS allowed me to easily “spoof,” or disguise,
  3634. the laptop’s MAC: whenever it connected to a network it left behind the record of some other machine, in no way
  3635.  
  3636. associable with mine. Usefully enough, TAILS also had built-in support for connecting to the anonymizing Tor network.
  3637.  
  3638. At nights and on weekends, I drove around what seemed like the entire island of Oahu, letting my antenna pick up the
  3639.  
  3640. pulses of each Wi-Fi network. My GPS sensor tagged each access point with the location at which it was noticed,
  3641.  
  3642. thanks to a mapping program I used called Kismet. What resulted was a map of the invisible networks we pass by every
  3643.  
  3644. day without even noticing, a scandalously high percentage of which had either no security at all or security I could
  3645.  
  3646. trivially bypass. Some of the networks required more sophisticated hacking. I’d briefly jam a network, causing its
  3647.  
  3648. legitimate users to be booted off-line; in their attempt to reconnect, they’d automatically rebroadcast their
  3649.  
  3650. “authentication packets,” which I could intercept and effectively decipher into passwords that would let me log on
  3651.  
  3652. just like any other “authorized” user.
  3653.  
  3654. With this network map in hand, I’d drive around Oahu like a madman, trying to check my email to see which of the
  3655.  
  3656. journalists had replied to me. Having made contact with Laura Poitras, I’d spend much of the evening writing to her—
  3657.  
  3658. sitting behind the wheel of my car at the beach, filching the Wi-Fi from a nearby resort. Some of the journalists I’d
  3659.  
  3660. chosen needed convincing to use encrypted email, which back in 2012 was a pain. In some cases, I had to show them
  3661.  
  3662. how, so I’d upload tutorials—sitting in my idling car in a parking lot, availing myself of the network of a library.
  3663.  
  3664. Or of a school. Or of a gas station. Or of a bank—which had horrifyingly poor protections. The point was to not
  3665.  
  3666. create any patterns.
  3667.  
  3668. Atop the parking garage of a mall, secure in the knowledge that the moment I closed the lid of my laptop, my secret
  3669.  
  3670. was safe, I’d draft manifestos explaining why I’d gone public, but then delete them. And then I’d try writing emails
  3671.  
  3672. to Lindsay, only to delete them, too. I just couldn’t find the words.
  3673. 23
  3674.  
  3675. Read, Write, Execute
  3676.  
  3677. Read, Write, Execute: in computing, these are called permissions. Functionally speaking, they determine the extent of
  3678.  
  3679. your authority within a computer or computer network, defining what exactly you can and cannot do. The right to read
  3680.  
  3681. a file allows you to access its contents, while the right to write a file allows you to modify it. Execution,
  3682.  
  3683. meanwhile, means that you have the ability to run a file or program, to carry out the actions it was designed to do.
  3684.  
  3685. Read, Write, Execute: this was my simple three-step plan. I wanted to burrow into the heart of the world’s most
  3686.  
  3687. secure network to find the truth, make a copy of it, and get it out into the world. And I had to do all this without
  3688.  
  3689. getting caught—without being read, written, and executed myself.
  3690.  
  3691. Almost everything you do on a computer, on any device, leaves a record. Nowhere is this more true than at the NSA.
  3692.  
  3693. Each log-in and log-out creates a log entry. Each permission I used left its own forensic trace. Every time I opened
  3694.  
  3695. a file, every time I copied a file, that action was recorded. Every time I downloaded, moved, or deleted a file, that
  3696.  
  3697. was recorded, too, and security logs were updated to reflect the event. There were network flow records, public key
  3698.  
  3699. infrastructure records—people even joked about cameras hidden in the bathrooms, in the bathroom stalls. The agency
  3700.  
  3701. had a not inconsiderable number of  counterintelligence programs spying  on  the  people  who  were spying on people,
  3702.  
  3703. and if even one caught me doing something I wasn’t supposed to be doing, it wouldn’t be a file that was getting
  3704.  
  3705. deleted.
  3706.  
  3707. Luckily, the  strength of  these  systems was  also  their  weakness: their complexity meant that not even the people
  3708.  
  3709. running them necessarily knew how they worked. Nobody actually understood where they overlapped and where their gaps
  3710.  
  3711. were. Nobody, that is, except the systems administrators. After all, those sophisticated monitoring systems you’re
  3712.  
  3713. imagining, the ones with scary names like MIDNIGHTRIDER—somebody’s got to install them in the first place. The NSA
  3714.  
  3715. may have paid for the network, but sysadmins like myself were the ones who really owned it.
  3716.  
  3717. The  Read  phase  would  involve  dancing  through  the  digital  grid  of tripwires laid across the routes
  3718.  
  3719. connecting the NSA to every other intelligence agency, domestic and foreign. (Among these was the NSA’s UK partner,
  3720.  
  3721. the Government Communications Headquarters, or GCHQ, which was setting up dragnets like OPTICNERVE, a program that
  3722.  
  3723. saved a snapshot every five
  3724. minutes from the cameras of people video-chatting on platforms like Yahoo Messenger, and PHOTONTORPEDO, which grabbed
  3725.  
  3726. the IP addresses of MSN Messenger users.) By using Heartbeat to bring in the documents I wanted, I could turn “bulk
  3727.  
  3728. collection” against those who’d turned it against the public, effectively Frankensteining the IC. The agency’s
  3729.  
  3730. security tools kept track of who read what, but it didn’t matter: anyone who bothered to check their logs was used to
  3731.  
  3732. seeing Heartbeat by now. It would sound no alarms. It was the perfect cover.
  3733.  
  3734. But while Heartbeat would work as a way of collecting the files—far too many files—it only brought them to the server
  3735.  
  3736. in Hawaii, a server that kept logs even I couldn’t get around. I needed a way to work with the files, search them,  
  3737.  
  3738. and  discard  the  irrelevant  and  uninteresting,  along  with  those containing legitimate secrets that I wouldn’t
  3739.  
  3740. be giving to journalists. At this point, still in my Read phase, the hazards were manifold, due mainly to the fact
  3741.  
  3742. that the protocols I was up against were no longer geared to monitoring but to prevention. If I ran my searches on
  3743.  
  3744. the Heartbeat server, it would light a massive electronic sign blinking ARREST ME.
  3745.  
  3746. I thought about this for a while. I couldn’t just copy the files directly from the Heartbeat server onto a personal
  3747.  
  3748. storage device and waltz out of the Tunnel without being caught. What I could do, though, was bring the files closer,
  3749.  
  3750. directing them to an intermediate way station.
  3751.  
  3752. I couldn’t send them to one of our regular computers, because by 2012 all of  the  Tunnel  had  been  upgraded  to  
  3753.  
  3754. new  “thin  client”  machines:  small helpless computers with crippled drives and CPUs that couldn’t store or process
  3755.  
  3756. data on their own, but did all of their storage and processing on the cloud. In a forgotten corner of the office,
  3757.  
  3758. however, there was a pyramid of disused desktop computers—old, moldering legacy machines the agency had wiped clean
  3759.  
  3760. and  discarded. When I  say  old  here, I  mean young by  the standards of anyone who doesn’t live on a budget the
  3761.  
  3762. size of the NSA’s. They were Dell PCs from as recently as 2009 or 2010, large gray rectangles of comforting weight,
  3763.  
  3764. which could store and process data on their own without being connected to the cloud. What I liked about them was
  3765.  
  3766. that though they were still in the NSA system, they couldn’t really be closely tracked as long as I kept them off the
  3767.  
  3768. central networks.
  3769.  
  3770. I  could  easily  justify  needing  to  use  these  stolid,  reliable  boxes  by claiming  that  I  was  trying  to  
  3771.  
  3772. make  sure  Heartbeat  worked  with  older operating systems. After all, not everybody at every NSA site had one of
  3773.  
  3774. the new “thin clients” just yet. And what if Dell wanted to implement a civilian
  3775. version of Heartbeat? Or what if the CIA, or FBI, or some similarly backward organization wanted to use it? Under the
  3776.  
  3777. guise of compatibility testing, I could transfer the files to these old computers, where I could search, filter, and
  3778.  
  3779. organize them as much as I wanted, as long as I was careful. I was carrying one of the big old hulks back to my desk
  3780.  
  3781. when I passed one of the IT directors, who stopped me and asked me what I needed it for—he’d been a major proponent
  3782.  
  3783. of getting rid of them. “Stealing secrets,” I answered, and we laughed.
  3784.  
  3785. The Read phase ended with the files I wanted all neatly organized into folders. But they were still on a computer
  3786.  
  3787. that wasn’t mine, which was still in the Tunnel underground. Enter, then, the Write phase, which for my purposes
  3788.  
  3789. meant  the  agonizingly  slow,  boring-but-also-cripplingly-scary process  of copying the files from the legacy Dells
  3790.  
  3791. something that I could spirit out of the building.
  3792.  
  3793. The easiest and safest way to copy a file off any IC workstation is also the oldest: a camera. Smartphones, of
  3794.  
  3795. course, are banned in NSA buildings, but workers accidentally bring them in all the time without anyone noticing.
  3796.  
  3797. They leave them in their gym bags or in the pockets of their windbreakers. If they’re caught with one in a random
  3798.  
  3799. search and they act goofily abashed instead of screaming panicked Mandarin into their wristwatch, they’re often
  3800.  
  3801. merely warned, especially if it’s their first offense. But getting a smartphone loaded with NSA secrets out of the
  3802.  
  3803. Tunnel is a riskier gambit. Odds are that nobody would’ve noticed—or cared—if I walked out with a smartphone, and it
  3804.  
  3805. might have been an adequate tool for a staffer trying to copy a single torture report, but I wasn’t wild about the
  3806.  
  3807. idea of taking thousands of pictures of my computer screen in the middle of a top secret facility. Also, the phone
  3808.  
  3809. would have had to be configured in such a way that even the world’s foremost forensic experts could seize and search
  3810.  
  3811. it without finding anything on it that they shouldn’t.
  3812.  
  3813. I’m going to refrain from publishing how exactly I went about my own writing—my own copying and encryption—so that
  3814.  
  3815. the NSA will still be standing tomorrow. I will mention, however, what storage technology I used for the copied
  3816.  
  3817. files. Forget thumbdrives; they’re too bulky for the relatively small amount they store. I went, instead, for SD
  3818.  
  3819. cards—the acronym stands for Secure Digital. Actually, I went for the mini- and micro-SD cards.
  3820.  
  3821. You’ll recognize SD cards if you’ve ever used a digital camera or video camera, or  needed more storage on  a  
  3822.  
  3823. tablet. They’re tiny little buggers, miracles of nonvolatile flash storage, and—at 20 x 21.5 mm for the mini, 15 x
  3824. 11 mm for the micro, basically the size of your pinkie fingernail—eminently concealable. You can fit one inside the
  3825.  
  3826. pried-off square of a Rubik’s Cube, then stick the square back on, and nobody will notice. In other attempts I
  3827.  
  3828. carried a card in my sock, or, at my most paranoid, in my cheek, so I could swallow it if I had to. Eventually, as I
  3829.  
  3830. gained confidence, and certainty in my methods of encryption, I’d just keep a card at the bottom of my pocket. They
  3831.  
  3832. hardly ever triggered metal detectors, and who wouldn’t believe I’d simply forgotten something so small?
  3833.  
  3834. The size of SD cards, however, has one downside: they’re extremely slow to write. Copying times for massive volumes
  3835.  
  3836. of data are always long—at least always longer than you want—but the duration tends to stretch even more when you’re
  3837.  
  3838. copying not to a speedy hard drive but to a minuscule silicon wafer embedded in plastic. Also, I wasn’t just copying.
  3839.  
  3840. I was deduplicating, compressing, encrypting, none of which processes could be accomplished simultaneously with any
  3841.  
  3842. other. I was using all the skills I’d ever acquired in my storage work, because that’s what I was doing, essentially.
  3843.  
  3844. I was storing the NSA’s storage, making an off-site backup of evidence of the IC’s abuses.
  3845.  
  3846. It could take eight hours or more—entire shifts—to fill a card. And though I switched to working nights again, those
  3847.  
  3848. hours were terrifying. There was the old computer chugging, monitor off, with all but one fluorescent ceiling panel
  3849.  
  3850. dimmed to  save energy in  the after-hours. And there I  was, turning the monitor back on every once in a while to
  3851.  
  3852. check the rate of progress and cringing. You know the feeling—the sheer hell of following the completion bar as it
  3853.  
  3854. indicates 84 percent completed, 85 percent completed … 1:58:53 left … As it filled toward the sweet relief of 100
  3855.  
  3856. percent, all files copied, I’d be sweating, seeing shadows and hearing footsteps around every corner.
  3857.  
  3858.  
  3859.  
  3860. EXECUTE: THAT  WAS  the final step. As each card filled, I had to run my getaway routine. I had to get that vital
  3861.  
  3862. archive out of the building, past the bosses and military uniforms, down the stairs and out the empty hall, past the
  3863.  
  3864. badge scans and  armed guards and  mantraps—those two-doored security zones in which the next door doesn’t open until
  3865.  
  3866. the previous door shuts and
  3867. your badge scan is approved, and if it isn’t, or if anything else goes awry, the
  3868. guards draw their weapons and the doors lock you in and you say, “Well, isn’t this embarrassing?” This—per all the
  3869.  
  3870. reports I’d been studying, and all the nightmares I’d been having—was where they’d catch me, I was sure of it. Each
  3871.  
  3872. time I left, I was petrified. I’d have to force myself not to think about the SD card. When you think about it, you
  3873.  
  3874. act differently, suspiciously.
  3875. One unexpected upshot of gaining a better understanding of NSA surveillance was that I’d also gained a better
  3876.  
  3877. understanding of the dangers I faced. In other words, learning about the agency’s systems had taught me how not to
  3878.  
  3879. get caught by them. My guides in this regard were the indictments that the  government had  brought against former
  3880.  
  3881. agents—mostly real  bastards who, in IC jargon, had “exfiltrated” classified information for profit. I compiled, and
  3882.  
  3883. studied, as many of these indictments as I could. The FBI—the agency that investigates all crime within the IC—took
  3884.  
  3885. great pride in explaining exactly how they caught their suspects, and believe me, I didn’t mind benefiting from their
  3886.  
  3887. experience. It seemed that in almost every case, the FBI would wait to make its arrest until the suspect had finished
  3888.  
  3889. their work and was about to go home. Sometimes they would let the suspect take the material out of a SCIF—a Sensitive
  3890.  
  3891. Compartmented Information Facility, which is a type of building or room shielded against surveillance—and out into
  3892.  
  3893. the public, where its very presence was a federal crime. I kept imagining a team of FBI agents lying in wait for me—
  3894.  
  3895. there, out in the public light, just at the far end of the Tunnel.
  3896.  
  3897. I’d usually try to banter with the guards, and this was where my Rubik’s Cube came in most handy. I was known to the
  3898.  
  3899. guards and to everybody else at the Tunnel as the Rubik’s Cube guy, because I was always working the cube as I walked
  3900.  
  3901. down the halls. I got so adept I could even solve it one-handed. It became my totem, my spirit toy, and a distraction
  3902.  
  3903. device as much for myself as for my coworkers. Most of them thought it was an affectation, or a nerdy conversation
  3904.  
  3905. starter. And it  was, but primarily it  relieved my anxiety. It calmed me.
  3906.  
  3907. I bought a few cubes and handed them out. Anyone who took to it, I’d give them pointers. The more that people got
  3908.  
  3909. used to them, the less they’d ever want a closer look at mine.
  3910.  
  3911. I got along with the guards, or I told myself I did, mostly because I knew where their minds were: elsewhere. I’d
  3912.  
  3913. done something like their job before, back at CASL. I knew how mind-numbing it was to spend all night standing,
  3914.  
  3915. feigning vigilance. Your feet hurt. After a while, all the rest of you hurts. And you can get so lonely that you’ll
  3916.  
  3917. talk to a wall.
  3918.  
  3919. I aimed to be more entertaining than the wall, developing my own patter for each human obstacle. There was the one
  3920.  
  3921. guard I talked to about insomnia and  the  difficulties of  day-sleeping (remember, I  was  on  nights,  so  this
  3922.  
  3923. would’ve been around two in the morning). Another guy, we discussed politics. He called Democrats “Demon Rats,” so
  3924.  
  3925. I’d read Breitbart News in
  3926. preparation for the conversation. What they all had in common was a reaction to my cube: it made them smile. Over the
  3927.  
  3928. course of my employment at the Tunnel, pretty much all the guards said some variation of, “Oh man, I used to play
  3929.  
  3930. with that when I was a kid,” and then, invariably, “I tried to take the stickers off to solve it.” Me too, buddy. Me
  3931.  
  3932. too.
  3933.  
  3934. It was only once I got home that I was able to relax, even just slightly. I was still worried about the house being
  3935.  
  3936. wired—that was another one of those charming methods the FBI used against those it suspected of inadequate loyalty.
  3937.  
  3938. I’d rebuff Lindsay’s concerns about my insomniac ways until she hated me and I hated myself. She’d go to bed and I’d
  3939.  
  3940. go to the couch, hiding with my laptop under a blanket like a child because cotton beats cameras. With the threat of
  3941.  
  3942. immediate arrest out of the way, I could focus on transferring the files to a larger external storage device via my
  3943.  
  3944. laptop—only somebody who didn’t understand technology very well would think I’d keep them on the laptop forever—and
  3945.  
  3946. locking them down under multiple layers of encryption algorithms using differing implementations, so that even if one
  3947.  
  3948. failed the others would keep them safe.
  3949.  
  3950. I’d been careful not to leave any traces at my work, and I took care that my encryption left no traces of the
  3951.  
  3952. documents at home. Still, I knew the documents could lead back to me once I’d sent them to the journalists and they’d
  3953.  
  3954. been decrypted. Any investigator looking at which agency employees had accessed, or could access, all these materials
  3955.  
  3956. would come up with a list with probably only a single name on it: mine. I could provide the journalists with fewer
  3957.  
  3958. materials, of course, but then they wouldn’t be able to most effectively do their work. Ultimately, I had to contend
  3959.  
  3960. with the fact that even one briefing slide or PDF left me vulnerable, because all digital files contain metadata,
  3961.  
  3962. invisible tags that can be used to identify their origins.
  3963.  
  3964. I struggled with how to handle this metadata situation. I worried that if I didn’t strip the identifying information
  3965.  
  3966. from the documents, they might incriminate me the moment the journalists decrypted and opened them. But I also
  3967.  
  3968. worried that by thoroughly stripping the metadata, I risked altering the files—if they were changed in any way, that
  3969.  
  3970. could cast doubt on their authenticity. Which was more important: personal safety, or the public good? It might sound
  3971.  
  3972. like an easy choice, but it took me quite a while to bite the bullet. I owned the risk, and left the metadata intact.
  3973.  
  3974. Part of what convinced me was my fear that even if I had stripped away the metadata I knew about, there could be
  3975.  
  3976. other digital watermarks I wasn’t aware of and couldn’t scan for. Another part had to do with the difficulty of
  3977. scrubbing single-user documents. A  single-user document is  a  document marked with a user-specific code, so that if
  3978.  
  3979. any publication’s editorial staff decided to run it by the government, the government would know its source.
  3980.  
  3981. Sometimes the  unique  identifier was  hidden  in  the  date  and  time-stamp coding, sometimes it involved the
  3982.  
  3983. pattern of microdots in a graphic or logo. But it might also be embedded in something, in some way, I hadn’t even
  3984.  
  3985. thought of. This phenomenon should have discouraged me, but instead it emboldened me. The technological difficulty
  3986.  
  3987. forced me, for the first time, to confront the prospect of discarding my lifetime practice of anonymity and coming
  3988.  
  3989. forward to identify myself as the source. I would embrace my principles by signing my name to them and let myself be
  3990.  
  3991. condemned.
  3992.  
  3993. Altogether, the documents I selected fit on a single drive, which I left out in the open on my desk at home. I knew
  3994.  
  3995. that the materials were just as secure now as they had ever been at the office. Actually, they were more secure,
  3996.  
  3997. thanks to multiple levels and methods of encryption. That’s the incomparable beauty of the cryptological art. A
  3998.  
  3999. little bit of math can accomplish what all the guns and barbed wire can’t: a little bit of math can keep a secret.
  4000. 24
  4001.  
  4002. Encrypt
  4003.  
  4004. Most people who use computers, and that includes members of the Fourth Estate,  think  there’s  a  fourth  basic  
  4005.  
  4006. permission besides  Read,  Write,  and Execute, called “Delete.”
  4007.  
  4008. Delete is everywhere on the user side of computing. It’s in the hardware as a key on the keyboard, and it’s in the
  4009.  
  4010. software as an option that can be chosen from a drop-down menu. There’s a certain finality that comes with choosing
  4011.  
  4012. Delete, and a certain sense of responsibility. Sometimes a box even pops up to double-check: “Are you sure?” If the
  4013.  
  4014. computer is second-guessing you by requiring confirmation—click “Yes”—it makes sense that Delete would be a
  4015.  
  4016. consequential, perhaps even the ultimate decision.
  4017.  
  4018. Undoubtedly, that’s true in the world outside of computing, where the powers of deletion have historically been vast.
  4019.  
  4020. Even so, as countless despots have been reminded, to truly get rid of a document you can’t just destroy every copy of
  4021.  
  4022. it. You also have to destroy every memory of it, which is to say you have to destroy all the people who remember it,
  4023.  
  4024. along with every copy of all the other documents that mention it and all the people who remember all those other
  4025.  
  4026. documents. And then, maybe, just maybe, it’s gone.
  4027.  
  4028. Delete functions appeared from the very start of digital computing. Engineers understood that in a world of
  4029.  
  4030. effectively unlimited options, some choices would inevitably turn out to be mistakes. Users, regardless of whether or
  4031.  
  4032. not they were really in control at the technical level, had to feel in control, especially with regard to anything
  4033.  
  4034. that they themselves had created. If they made a file, they should be able to unmake it at will. The ability to
  4035.  
  4036. destroy what they created and start over afresh was a primary function that imparted a sense of agency to the user,
  4037.  
  4038. despite the fact that they might be dependent on proprietary hardware they couldn’t repair and software they couldn’t
  4039.  
  4040. modify, and bound by the rules of third-party platforms.
  4041.  
  4042. Think about the reasons that you yourself press Delete. On your personal computer, you might want to get rid of some
  4043.  
  4044. document you screwed up, or some file you downloaded but no longer need—or some file you don’t want anyone to know
  4045.  
  4046. you ever needed. On your email, you might delete an email from a former lover that you don’t want to remember or
  4047.  
  4048. don’t want your spouse to find, or an RSVP for that protest you went to. On your phone, you might delete the history
  4049.  
  4050. of everywhere that phone has traveled, or some of the pictures, videos, and private records it automatically uploaded
  4051.  
  4052. to the cloud. In
  4053. every instance, you delete, and the thing—the file—appears to be gone.
  4054.  
  4055. The truth, though, is that deletion has never existed technologically in the way that we conceive of it. Deletion is
  4056.  
  4057. just a ruse, a figment, a public fiction, a not-quite-noble lie that computing tells you to reassure you and give you
  4058.  
  4059. comfort. Although the deleted file disappears from view, it is rarely gone. In technical terms, deletion is really
  4060.  
  4061. just a form of the middle permission, a kind of Write. Normally, when you press Delete for one of your files, its
  4062.  
  4063. data— which has been stashed deep down on a disk somewhere—is not actually touched. Efficient modern operating
  4064.  
  4065. systems are not designed to go all the way into the bowels of a disk purely for the purposes of erasure. Instead,
  4066.  
  4067. only the computer’s map of where each file is stored—a map called the “file table”—is rewritten to say “I’m no longer
  4068.  
  4069. using this space for anything important.” What this means is that, like a neglected book in a vast library, the
  4070.  
  4071. supposedly erased file can still be read by anyone who looks hard enough for it. If you only erase the reference to
  4072.  
  4073. it, the book itself still remains.
  4074.  
  4075. This can be confirmed through experience, actually. Next time you copy a file, ask yourself why it takes so long when
  4076.  
  4077. compared with the instantaneous act of deletion. The answer is that deletion doesn’t really do anything to a file
  4078.  
  4079. besides conceal it. Put simply, computers were not designed to correct mistakes, but to hide them—and to hide them
  4080.  
  4081. only from those parties who don’t know where to look.
  4082.  
  4083.  
  4084.  
  4085. THE  WANING  DAYS  of  2012  brought  grim  news:  the  few  remaining legal protections that prohibited mass
  4086.  
  4087. surveillance by some of the most prominent members of the Five Eyes network were being dismantled. The governments of
  4088.  
  4089. both Australia and the UK were proposing legislation for the mandatory recording of telephony and Internet metadata.
  4090.  
  4091. This was the first time that
  4092. notionally democratic governments publicly avowed the ambition to establish
  4093. a sort of surveillance time machine, which would enable them to technologically rewind the events of any person’s
  4094.  
  4095. life for a period going back months and even years. These attempts definitively marked, to my mind at least,  the  
  4096.  
  4097. so-called  Western  world’s  transformation from  the  creator  and defender  of  the  free  Internet  to  its  
  4098.  
  4099. opponent  and  prospective  destroyer. Though these laws were justified as public safety measures, they represented
  4100.  
  4101. such a breathtaking intrusion into the daily lives of the innocent that they terrified—quite rightly—even the
  4102.  
  4103. citizens of other countries who didn’t think themselves affected (perhaps because their own governments chose to
  4104.  
  4105. surveil them in secret).
  4106. These public initiatives of mass surveillance proved, once and for all, that there could be no natural alliance
  4107.  
  4108. between technology and government. The rift between my two strangely interrelated communities, the American IC and
  4109.  
  4110. the global online tribe of technologists, became pretty much definitive. In my earliest years in the IC, I could
  4111.  
  4112. still reconcile the two cultures, transitioning smoothly between my spy work and my relationships with civilian
  4113.  
  4114. Internet privacy folks—everyone from the anarchist hackers to the more sober academic Tor  types  who  kept  me  
  4115.  
  4116. current about  computing research and inspired me politically. For years, I was able to fool myself that we were all,
  4117.  
  4118. ultimately, on the same side of history: we were all trying to protect the Internet, to keep it free for speech and
  4119.  
  4120. free of fear. But my ability to sustain that delusion was gone. Now the government, my employer, was definitively the
  4121.  
  4122. adversary. What my technologist peers had always suspected, I’d only recently confirmed, and I couldn’t tell them. Or
  4123.  
  4124. I couldn’t tell them yet.
  4125.  
  4126. What I could do, however, was help them out, so long as that didn’t imperil my plans. This was how I found myself in
  4127.  
  4128. Honolulu, a beautiful city in which I’d never had much interest, as one of the hosts and teachers of a CryptoParty.
  4129.  
  4130. This was a new type of gathering invented by an international grassroots cryptological movement, at which
  4131.  
  4132. technologists volunteered their time to teach free classes to the public on the topic of digital self-defense—
  4133.  
  4134. essentially, showing anyone who was interested how to protect the security of their communications. In many ways,
  4135.  
  4136. this was the same topic I taught for JCITA, so I jumped at the chance to participate.
  4137.  
  4138. Though this might strike you as a dangerous thing for me to have done, given the other activities I was involved with
  4139.  
  4140. at the time, it should instead just reaffirm how much faith I had in the encryption methods I taught—the very methods
  4141.  
  4142. that protected that drive full of IC abuses sitting back at my house, with locks that couldn’t be cracked even by the
  4143.  
  4144. NSA. I knew that no number of documents, and no amount of journalism, would ever be enough to address the threat the
  4145.  
  4146. world was facing. People needed tools to protect themselves, and they needed to know how to use them. Given that I
  4147.  
  4148. was also trying to provide these tools to journalists, I was worried that my approach had become too technical. After
  4149.  
  4150. so many sessions spent lecturing colleagues, this opportunity to simplify my treatment of the subject for a general
  4151.  
  4152. audience would benefit me as much as anyone. Also, I honestly missed teaching: it had been a year since I’d stood at
  4153.  
  4154. the front of a class, and the moment I was back in that position I realized I’d been teaching the right things to the
  4155.  
  4156. wrong people all along.
  4157.  
  4158. When I say class, I don’t mean anything like the IC’s schools or briefing
  4159. rooms. The CryptoParty was held in a one-room art gallery behind a furniture store and coworking space. While I was
  4160.  
  4161. setting up the projector so I could share slides showing how easy it was to run a Tor server to help, for example,
  4162.  
  4163. the citizens of Iran—but also the citizens of Australia, the UK, and the States
  4164. —my students drifted in, a diverse crew of strangers and a few new friends I’d only met online. All in all, I’d say
  4165.  
  4166. about twenty people showed up that December night to learn from me and my co-lecturer, Runa Sandvik, a bright young
  4167.  
  4168. Norwegian woman from the Tor Project. (Runa would go on to work as the senior director of information security for
  4169.  
  4170. the New York Times, which would sponsor her later CryptoParties.) What united our audience wasn’t an interest in Tor,
  4171.  
  4172. or even a fear of being spied on as much as a desire to re- establish a sense of control over the private spaces in
  4173.  
  4174. their lives. There were some grandparent types who’d wandered in off the street, a local journalist covering the  
  4175.  
  4176. Hawaiian “Occupy!” movement, and  a  woman who’d been victimized by revenge porn. I’d also invited some of my NSA
  4177.  
  4178. colleagues, hoping to interest them in the movement and wanting to show that I wasn’t concealing my involvement from
  4179.  
  4180. the agency. Only one of them showed up, though, and sat in the back, legs spread, arms crossed, smirking throughout.
  4181.  
  4182. I began my presentation by discussing the illusory nature of deletion, whose objective of total erasure could never
  4183.  
  4184. be accomplished. The crowd understood this instantly. I went on to explain that, at best, the data they wanted no one
  4185.  
  4186. to see couldn’t be unwritten so much as overwritten: scribbled over, in a sense, with random or pseudo-random data
  4187.  
  4188. until the original was rendered unreadable. But, I cautioned, even this approach had its drawbacks. There was always
  4189.  
  4190. a chance that their operating system had silently hidden away a copy of the file they were hoping to delete in some
  4191.  
  4192. temporary storage nook they weren’t privy to.
  4193.  
  4194. That’s when I pivoted to encryption.
  4195.  
  4196. Deletion is a dream for the surveillant and a nightmare for the surveilled, but encryption is, or should be, a
  4197.  
  4198. reality for all. It is the only true protection against surveillance. If the whole of your storage drive is encrypted
  4199.  
  4200. to begin with, your adversaries can’t rummage through it for deleted files, or for anything else—unless they have the
  4201.  
  4202. encryption key. If all the emails in your inbox are encrypted, Google can’t read them to profile you—unless they have
  4203.  
  4204. the encryption key. If all your communications that pass through hostile Australian or British or American or Chinese
  4205.  
  4206. or Russian networks are encrypted, spies can’t read them—unless they have the encryption key. This is the ordering
  4207.  
  4208. principle of encryption: all power to the key holder.
  4209. Encryption works,  I  explained, by  way  of  algorithms. An  encryption algorithm sounds intimidating, and certainly
  4210.  
  4211. looks intimidating when written out, but its concept is quite elementary. It’s a mathematical method of reversibly
  4212.  
  4213. transforming information—such as your emails, phone calls, photos, videos, and files—in such a way that it becomes
  4214.  
  4215. incomprehensible to anyone who doesn’t have a copy of the encryption key. You can think of a modern encryption
  4216.  
  4217. algorithm as a magic wand that you can wave over a document to change each letter into a language that only you and
  4218.  
  4219. those you trust can read, and the encryption key as the unique magic words that complete the incantation and put the
  4220.  
  4221. wand to work. It doesn’t matter how many people know that you used the wand, so long as you can keep your personal
  4222.  
  4223. magic words from the people you don’t trust.
  4224.  
  4225. Encryption algorithms are basically just sets of math problems designed to be incredibly difficult even for computers
  4226.  
  4227. to solve. The encryption key is the one clue that allows a computer to solve the particular set of math problems
  4228.  
  4229. being used. You push your readable data, called plaintext, into one end of an encryption algorithm, and
  4230.  
  4231. incomprehensible gibberish, called ciphertext, comes out the other end. When somebody wants to read the ciphertext,
  4232.  
  4233. they feed it back into the algorithm along with—crucially—the correct key, and out comes the plaintext again. While
  4234.  
  4235. different algorithms provide different degrees of protection, the security of an encryption key is often based on its
  4236.  
  4237. length, which indicates the level of difficulty involved in solving a specific algorithm’s underlying math problem.
  4238.  
  4239. In algorithms that correlate longer keys with better security, the improvement is exponential. If we presume that an
  4240.  
  4241. attacker takes one day to crack a 64-bit key—which scrambles your data in one of 264 possible ways
  4242.  
  4243. (18,446,744,073,709,551,616 unique permutations)
  4244. —then it would take double that amount of time, two days, to break a 65-bit key, and four days to break a 66-bit key.
  4245.  
  4246. Breaking a 128-bit key would take
  4247. 264 times longer than a day, or fifty million billion years. By that time, I might even be pardoned.
  4248.  
  4249. In my communications with journalists, I used 4096- and 8192-bit keys. This  meant  that  absent major  innovations
  4250.  
  4251. in  computing technology or  a fundamental redefining of the principles by which numbers are factored, not even all
  4252.  
  4253. of the NSA’s cryptanalysts using all of the world’s computing power put together would be able to get into my drive.
  4254.  
  4255. For this reason, encryption is the single best hope for fighting surveillance of any kind. If all of our data,
  4256.  
  4257. including our communications, were enciphered in this fashion, from end to end (from the sender end to the recipient
  4258.  
  4259. end), then no government—no entity conceivable under our current knowledge of physics, for that matter—would
  4260. be able to understand them. A government could still intercept and collect the signals, but it would be intercepting
  4261.  
  4262. and collecting pure noise. Encrypting our communications would essentially delete them from the memories of every
  4263.  
  4264. entity we deal with. It would effectively withdraw permission from those to whom it was never granted to begin with.
  4265.  
  4266. Any government hoping to access encrypted communications has only two options: it can either go after the keymasters
  4267.  
  4268. or go after the keys. For the former,  they  can  pressure  device  manufacturers into  intentionally selling
  4269.  
  4270. products that perform faulty encryption, or mislead international standards organizations into accepting flawed
  4271.  
  4272. encryption algorithms that contain secret access points known as “back doors.” For the latter, they can launch
  4273.  
  4274. targeted attacks against the endpoints of the communications, the hardware and software that perform the process of
  4275.  
  4276. encryption. Often, that means exploiting a vulnerability that they weren’t responsible for creating but merely found,
  4277.  
  4278. and using it to hack you and steal your keys—a technique pioneered by criminals but today embraced by major state
  4279.  
  4280. powers, even though it means knowingly preserving devastating holes in the cybersecurity of critical international
  4281.  
  4282. infrastructure.
  4283.  
  4284. The best means we have for keeping our keys safe is called “zero knowledge,” a method that ensures that any data you
  4285.  
  4286. try to store externally— say, for instance, on a company’s cloud platform—is encrypted by an algorithm running on
  4287.  
  4288. your device before it is uploaded, and the key is never shared. In the zero knowledge scheme, the keys are in the
  4289.  
  4290. users’ hands—and only in the users’ hands. No company, no agency, no enemy can touch them.
  4291.  
  4292. My key to the NSA’s secrets went beyond zero knowledge: it was a zero- knowledge key consisting of multiple zero-
  4293.  
  4294. knowledge keys.
  4295.  
  4296. Imagine it like this: Let’s say that at the conclusion of my CryptoParty lecture, I stood by the exit as each of the
  4297.  
  4298. twenty audience members shuffled out. Now, imagine that as each of them passed through the door and into the Honolulu
  4299.  
  4300. night, I whispered a word into their ear—a single word that no one else could hear, and that they were only allowed
  4301.  
  4302. to repeat if they were all together, once again, in the same room. Only by bringing back all twenty of these folks
  4303.  
  4304. and having them repeat their words in the same order in which I’d originally distributed them could anyone reassemble
  4305.  
  4306. the complete twenty- word incantation. If just one person forgot their word, or if the order of recitation was in any
  4307.  
  4308. way different from the order of distribution, no spell would be cast, no magic would happen.
  4309.  
  4310. My   keys   to   the   drive   containing   the   disclosures   resembled   this
  4311. arrangement, with  a  twist: while I  distributed most of  the  pieces of  the incantation, I retained one for
  4312.  
  4313. myself. Pieces of my magic spell were hidden everywhere, but if I destroyed just the single lone piece that I kept on
  4314.  
  4315. my person, I would destroy all access to the NSA’s secrets forever.
  4316. 25
  4317.  
  4318. The Boy
  4319.  
  4320. It’s only in hindsight that I’m able to appreciate just how high my star had risen. I’d gone from being the student
  4321.  
  4322. who couldn’t speak in class to being the teacher of the language of a new age, from the child of modest, middle-class
  4323.  
  4324. Beltway parents to the man living the island life and making so much money that it had lost its meaning. In just the
  4325.  
  4326. seven short years of my career, I’d climbed from maintaining local servers to crafting and implementing globally
  4327.  
  4328. deployed systems—from graveyard-shift security guard to key master of the puzzle palace.
  4329.  
  4330. But there’s always a danger in letting even the most qualified person rise too far, too fast, before they’ve had
  4331.  
  4332. enough time to get cynical and abandon their idealism. I occupied one of the most unexpectedly omniscient positions
  4333.  
  4334. in the Intelligence Community—toward the bottom rung of the managerial ladder, but high atop heaven in terms of
  4335.  
  4336. access. And while this gave me the phenomenal, and frankly undeserved, ability to observe the IC in its grim
  4337.  
  4338. fullness, it also left me more curious than ever about the one fact I was still finding elusive: the absolute limit
  4339.  
  4340. of who the agency could turn its gaze against. It was a limit set less in policy or law than in the ruthless,
  4341.  
  4342. unyielding capabilities of what I now knew to be a world-spanning machine. Was there anyone this machine could not
  4343.  
  4344. surveil? Was there anywhere this machine could not go?
  4345.  
  4346. The only way to discover the answer was to descend, abandoning my panoptic perch for the narrow vision of an
  4347.  
  4348. operational role. The NSA employees with the freest access to the rawest forms of intelligence were those who sat in
  4349.  
  4350. the operator’s chair and typed into their computers the names of the individuals who’d fallen under suspicion,
  4351.  
  4352. foreigners and US citizens alike. For one reason or another, or for no reason at all, these individuals had become
  4353.  
  4354. targets of the agency’s closest scrutiny, with the NSA interested in finding out everything about them and their
  4355.  
  4356. communications. My ultimate destination, I knew, was the exact point of this interface—the exact point where the
  4357.  
  4358. state cast its eye on the human and the human remained unaware.
  4359.  
  4360. The program that enabled this access was called XKEYSCORE, which is perhaps best understood as a search engine that
  4361.  
  4362. lets an analyst search through all the records of your life. Imagine a kind of Google that instead of showing pages
  4363.  
  4364. from the public Internet returns results from your private email, your private chats, your private files, everything.
  4365.  
  4366. Though I’d read enough about the
  4367. program to understand how it worked, I hadn’t yet used it, and I realized I ought to know more about it. By pursuing
  4368.  
  4369. XKEYSCORE, I was looking for a personal confirmation of the depths of the NSA’s surveillance intrusions—the kind of
  4370.  
  4371. confirmation you don’t get from documents but only from direct experience.
  4372.  
  4373. One of the few offices in Hawaii with truly unfettered access to XKEYSCORE was the National Threat Operations Center.
  4374.  
  4375. NTOC worked out of the sparkling but soulless new open-plan office the NSA had formally named the Rochefort Building,
  4376.  
  4377. after Joseph Rochefort, a legendary World War II–era Naval cryptanalyst who broke Japanese codes. Most employees had
  4378.  
  4379. taken to calling it the Roach Fort, or simply “the Roach.” At the time I applied for a job there, parts of the Roach
  4380.  
  4381. were still under construction, and I was immediately reminded of my first cleared job, with CASL: it was my fate to
  4382.  
  4383. begin and end my IC career in unfinished buildings.
  4384.  
  4385. In addition to housing almost all of the agency’s Hawaii-based translators and analysts, the Roach also accommodated
  4386.  
  4387. the local branch of the Tailored Access Operations (TAO) division. This was the NSA unit responsible for remotely
  4388.  
  4389. hacking into the computers of people whom analysts had selected as targets—the agency’s equivalent of the old
  4390.  
  4391. burglary teams that once snuck into enemies’ homes to plant bugs and find compromising material. NTOC’s main job, by
  4392.  
  4393. contrast, was to monitor and frustrate the activity of the TAO’s foreign equivalents. As  luck  would  have  it,  
  4394.  
  4395. NTOC had  a  position open through a contractor job at Booz Allen Hamilton, a job they euphemistically described as
  4396.  
  4397. “infrastructure analyst.” The role involved using the complete spectrum of the NSA’s mass surveillance tools,
  4398.  
  4399. including XKEYSCORE, to monitor activity on the “infrastructure” of interest, the Internet.
  4400.  
  4401. Though I’d be making slightly more money at Booz, around $120,000 a year, I considered it a demotion—the first of
  4402.  
  4403. many as I began my final descent, jettisoning my accesses, my clearances, and my agency privileges. I was an engineer
  4404.  
  4405. who was becoming an analyst who would ultimately become an exile, a target of the very technologies I’d once
  4406.  
  4407. controlled. From that perspective, this particular fall in prestige seemed pretty minor. From that perspective,
  4408.  
  4409. everything seemed pretty minor, as the arc of my life bent back toward earth, accelerating toward the point of impact
  4410.  
  4411. that would end my career, my relationship, my freedom, and possibly my life.
  4412.  
  4413.  
  4414.  
  4415. I’D DECIDED  TO bring my archives out of the country and pass them to the journalists I’d contacted, but before I
  4416.  
  4417. could even begin to contemplate the
  4418. logistics of that act I had to go shake some hands. I had to fly east to DC and spend a few weeks meeting and
  4419.  
  4420. greeting my new bosses and colleagues, who had high hopes for how they might apply my keen understanding of online
  4421.  
  4422. anonymization to unmask their more clever targets. This was what brought me back home to the Beltway for the very
  4423.  
  4424. last time, and back to the site of my first encounter with an institution that had lost control: Fort Meade. This
  4425.  
  4426. time I was arriving as an insider.
  4427.  
  4428. The day that marked my coming of age, just over ten tumultuous years earlier, had profoundly changed not just the
  4429.  
  4430. people who worked at NSA headquarters but the place itself. I first noticed this fact when I got stopped in my rental
  4431.  
  4432. car trying to turn off Canine Road into one of the agency’s parking lots, which in my memory still howled with panic,
  4433.  
  4434. ringtones, car horns, and sirens. Since 9/11, all  the  roads that led  to  NSA headquarters had  been permanently
  4435.  
  4436. closed to  anyone who  didn’t possess one  of  the  special IC badges now hanging around my neck.
  4437.  
  4438. Whenever I wasn’t glad-handing NTOC leadership at headquarters, I spent my time learning everything I could—“hot-
  4439.  
  4440. desking” with analysts who worked different programs and different types of targets, so as to be able to teach my
  4441.  
  4442. fellow team members back in Hawaii the newest ways the agency’s tools  might  be  used.  That,  at  least,  was  the  
  4443.  
  4444. official  explanation  of  my curiosity, which as always exceeded the requirements and earned the gratitude of  the  
  4445.  
  4446. technologically inclined.  They,  in  turn,  were  as  eager  as  ever  to demonstrate   the   power   of   the  
  4447.  
  4448. machinery   they’d   developed,   without expressing a  single  qualm  about  how  that  power  was  applied. While  
  4449.  
  4450. at headquarters, I was also put through a series of tests on the proper use of the system, which were more like
  4451.  
  4452. regulatory compliance exercises or procedural shields than meaningful instruction. The other analysts told me that
  4453.  
  4454. since I could take these tests as many times as I had to, I shouldn’t bother learning the rules: “Just click the
  4455.  
  4456. boxes until you pass.”
  4457.  
  4458. The NSA described XKEYSCORE, in the documents I’d later pass on to journalists, as its “widest-ranging” tool, used to
  4459.  
  4460. search “nearly everything a user does on the Internet.” The technical specs I studied went into more detail as to how
  4461.  
  4462. exactly this was accomplished—by “packetizing” and “sessionizing,” or cutting up the data of a user’s online sessions
  4463.  
  4464. into manageable packets for analysis—but nothing could prepare me for seeing it in action.
  4465.  
  4466. It was, simply put, the closest thing to science fiction I’ve ever seen in science fact: an interface that allows you
  4467.  
  4468. to type in pretty much anyone’s
  4469. address, telephone number, or IP address, and then basically go through the recent history of their online activity.
  4470.  
  4471. In some cases you could even play back recordings of their online sessions, so that the screen you’d be looking at
  4472.  
  4473. was their screen, whatever was on their desktop. You could read their emails, their browser history, their search
  4474.  
  4475. history, their social media postings, everything. You could set up notifications that would pop up when some person
  4476.  
  4477. or some device you were interested in became active on the Internet for the day. And you could look through the
  4478.  
  4479. packets of Internet data to see a person’s search queries appear letter by letter, since so many sites transmitted
  4480.  
  4481. each character as it was typed. It was like watching an autocomplete, as letters and words flashed across the screen.
  4482.  
  4483. But the intelligence behind that typing wasn’t artificial but human: this was a humancomplete.
  4484.  
  4485. My weeks at Fort Meade, and the short stint I put in at Booz back in Hawaii,  were  the  only  times  I  saw,  
  4486.  
  4487. firsthand, the  abuses  actually  being committed that I’d previously read about in internal documentation. Seeing
  4488.  
  4489. them made me realize how insulated my position at the systems level had been from the ground zero of immediate
  4490.  
  4491. damage. I could only imagine the level of insulation of the agency’s directorship or, for that matter, of the US
  4492.  
  4493. president.
  4494.  
  4495. I didn’t type the names of the agency director or the president into XKEYSCORE, but after enough time with the system
  4496.  
  4497. I realized I could have. Everyone’s communications were in the system—everyone’s. I was initially fearful that if I
  4498.  
  4499. searched those in the uppermost echelons of state, I’d be caught and fired, or worse. But it was surpassingly simple
  4500.  
  4501. to disguise a query regarding even the most prominent figure by encoding my search terms in a machine format that
  4502.  
  4503. looked like gibberish to humans but would be perfectly understandable to XKEYSCORE. If any of the auditors who were
  4504.  
  4505. responsible for reviewing the searches ever bothered to look more closely, they would see only a snippet of
  4506.  
  4507. obfuscated code, while I would be able to scroll through the most personal activities of a Supreme Court justice or a
  4508.  
  4509. congressperson.
  4510.  
  4511. As far as I could tell, none of my new colleagues intended to abuse their powers so grandly, although if they had
  4512.  
  4513. it’s not like they’d ever mention it. Anyway, when analysts thought about abusing the system, they were far less
  4514.  
  4515. interested in what it could do for them professionally than in what it could do for them personally. This led to the
  4516.  
  4517. practice known as LOVEINT, a gross joke on HUMINT and SIGINT and a travesty of intelligence, in which analysts used
  4518.  
  4519. the agency’s programs to surveil their current and former lovers along with objects of more casual affection—reading
  4520.  
  4521. their emails, listening in on their phone calls, and stalking them online. NSA employees knew that only
  4522. the dumbest analysts were ever caught red-handed, and though the law stated that anyone engaging in any type of
  4523.  
  4524. surveillance for personal use could be locked up for at least a decade, no one in the agency’s history had been
  4525.  
  4526. sentenced to even a day in prison for the crime. Analysts understood that the government would never publicly
  4527.  
  4528. prosecute them, because you can’t exactly convict someone of abusing your secret system of mass surveillance if you
  4529.  
  4530. refuse to admit the existence of the system itself. The obvious costs of such a policy became apparent to me as I sat
  4531.  
  4532. along the back wall of vault V22 at NSA  headquarters with  two  of  the  more  talented  infrastructure analysts,
  4533.  
  4534. whose workspace was decorated with a seven-foot-tall picture of Star Wars’ famous wookie, Chewbacca. I realized, as
  4535.  
  4536. one of them was explaining to me the details of his targets’ security routines, that intercepted nudes were a kind of
  4537.  
  4538. informal office currency, because his buddy kept spinning in his chair to interrupt us with a smile, saying, “Check
  4539.  
  4540. her out,” to which my instructor would invariably reply “Bonus!” or “Nice!” The unspoken transactional rule seemed to
  4541.  
  4542. be that if you found a naked photo or video of an attractive target— or someone in communication with a target—you
  4543.  
  4544. had to show the rest of the boys, at least as long as there weren’t any women around. That was how you knew you could
  4545.  
  4546. trust each other: you had shared in one another’s crimes.
  4547.  
  4548. One thing you come to understand very quickly while using XKEYSCORE is that nearly everyone in the world who’s online
  4549.  
  4550. has at least two things in common: they have all watched porn at one time or another, and they all store photos and
  4551.  
  4552. videos of their family. This was true for virtually everyone of every gender, ethnicity, race, and age—from the
  4553.  
  4554. meanest terrorist to the nicest senior citizen, who might be the meanest terrorist’s grandparent, or parent, or
  4555.  
  4556. cousin.
  4557.  
  4558. It’s the family stuff that got to me the most. I remember this one child in particular, a little boy in Indonesia.
  4559.  
  4560. Technically, I shouldn’t have been interested in this little boy, but I was, because my employers were interested in
  4561.  
  4562. his father. I had been reading through the shared targeting folders of a “persona” analyst, meaning someone who
  4563.  
  4564. typically spent most of their day sifting through artifacts like  chat  logs  and  Gmail inboxes and  Facebook
  4565.  
  4566. messages, rather than the more obscure and difficult, typically hacker- generated traffic of the infrastructure
  4567.  
  4568. analysts.
  4569.  
  4570. The boy’s father, like my own father, was an engineer—but unlike my father, this  guy  wasn’t government- or  
  4571.  
  4572. military-affiliated. He  was  just  a regular academic who’d been caught up in a surveillance dragnet. I can’t even
  4573.  
  4574. remember how or why he’d come to the agency’s attention, beyond sending a job application to a research university in
  4575.  
  4576. Iran. The grounds for suspicion
  4577. were  often  poorly documented, if  they  were  documented at  all,  and  the connections could be incredibly
  4578.  
  4579. tenuous—“believed to be potentially associated with” and then the name of some international organization that could
  4580.  
  4581. be anything from a telecommunications standards body to UNICEF to something you might actually agree is menacing.
  4582.  
  4583. Selections from the man’s communications had been sieved out of the stream of Internet traffic and assembled into
  4584.  
  4585. folders—here was the fatal copy of the résumé sent to the suspect university; here were his texts; here was his Web
  4586.  
  4587. browser history; here was the last week or so of his correspondence both sent and received, tagged to IP addresses.
  4588.  
  4589. Here were the coordinates of a “geo-fence” the analyst had placed around him to track whether he strayed too far from
  4590.  
  4591. home, or perhaps traveled to the university for his interview.
  4592.  
  4593. Then there were his pictures, and a video. He was sitting in front of his computer, as I was sitting in front of
  4594.  
  4595. mine. Except that in his lap he had a toddler, a boy in a diaper.
  4596.  
  4597. The father was trying to read something, but the kid kept shifting around, smacking the keys and giggling. The
  4598.  
  4599. computer’s internal mic picked up his giggling and there I was, listening to it on my headphones. The father held the
  4600.  
  4601. boy tighter, and the boy straightened up, and, with his dark crescent eyes, looked directly into the computer’s
  4602.  
  4603. camera—I couldn’t escape the feeling that he was looking directly at me. Suddenly I realized that I’d been holding my
  4604.  
  4605. breath. I shut the session, got up from the computer, and left the office for the bathroom in the hall, head down,
  4606.  
  4607. headphones still on with the cord trailing.
  4608.  
  4609. Everything about that kid, everything about his father, reminded me of my own father, whom I met for dinner one
  4610.  
  4611. evening during my stint at Fort Meade. I hadn’t seen him in a while, but there in the midst of dinner, over bites of
  4612.  
  4613. Caesar salad and a pink lemonade, I had the thought: I’ll never see my family again. My eyes were dry—I was exerting
  4614.  
  4615. as much control as I could— but inside, I was devastated. I knew that if I told him what I was about to do, he
  4616.  
  4617. would’ve called the cops. Or else he would’ve called me crazy and had me committed to a mental hospital. He would’ve
  4618.  
  4619. done anything he thought he had to do to prevent me from making the gravest of mistakes.
  4620.  
  4621. I could only hope that his hurt would in time be healed by pride.
  4622.  
  4623. Back in Hawaii between March and May 2013, a sense of finality suffused nearly every experience for me, and though
  4624.  
  4625. the experiences themselves might seem trivial, they eased my path. It was far less painful to think that this was the
  4626.  
  4627. last time I’d ever stop at the curry place in Mililani or drop by the art-
  4628. gallery hacker space in Honolulu or just sit on the roof of my car and scan the nighttime sky for falling stars than
  4629.  
  4630. to think that I only had another month left with Lindsay, or another week left of sleeping next to her and waking up
  4631.  
  4632. next to her and yet trying to keep my distance from her, for fear of breaking down.
  4633.  
  4634. The preparations I was making were those of a man about to die. I emptied my bank accounts, putting cash into an old
  4635.  
  4636. steel ammo box for Lindsay to find so that the government couldn’t seize it. I went around the house doing oft-
  4637.  
  4638. procrastinated chores, like  fixing windows and  changing lightbulbs. I erased and encrypted my old computers,
  4639.  
  4640. reducing them to the silent husks of better times. In sum, I was putting my affairs in order to try to make
  4641.  
  4642. everything easier for Lindsay, or just for my conscience, which periodically would switch allegiance from a world
  4643.  
  4644. that hadn’t earned it to the woman who had and the family I loved.
  4645.  
  4646. Everything was imbued with this sense of an ending, and yet there were moments when it seemed that no end was in
  4647.  
  4648. sight and that the plan I’d developed was collapsing. It was difficult to get the journalists to commit to a meeting,
  4649.  
  4650. mostly because I couldn’t tell them who they were meeting with, or even, for a while at least, where and when it was
  4651.  
  4652. happening. I had to reckon with the prospect of them never showing up, or of them showing up but then dropping out.
  4653.  
  4654. Ultimately I decided that if either of those happened, I’d just abandon the plan and return to work and to Lindsay as
  4655.  
  4656. if everything was normal, to wait for my next chance.
  4657.  
  4658. In my wardrives back and forth from Kunia—a twenty-minute ride that could  become  a  two-hour  Wi-Fi  scavenger  
  4659.  
  4660. hunt—I’d  been  researching various  countries,  trying  to  find  a  location  for  my  meeting  with  the
  4661.  
  4662. journalists. It felt like I was picking out my prison, or rather my grave. All of the Five Eyes countries were
  4663.  
  4664. obviously off-limits. In fact, all of Europe was out, because its countries couldn’t be counted upon to uphold
  4665.  
  4666. international law against the extradition of those charged with political crimes in the face of  what was  sure  to  
  4667.  
  4668. be  significant American pressure. Africa and  Latin America were no-go zones too—the United States had a history of
  4669.  
  4670. acting there with impunity. Russia was out because it was Russia, and China was China: both were totally out of
  4671.  
  4672. bounds. The US government wouldn’t have to do anything to discredit me other than point at the map. The optics would
  4673.  
  4674. only  be  worse in  the  Middle East.  It  sometimes seemed as  if  the  most challenging hack of my life wasn’t
  4675.  
  4676. going to be plundering the NSA but rather trying to find a meeting venue independent enough to hold off the White
  4677.  
  4678. House and free enough not to interfere with my activities.
  4679. The process of elimination left me with Hong Kong. In geopolitical terms, it was the closest I could get to no-
  4680.  
  4681. man’s-land, but with a vibrant media and protest culture, not to mention largely unfiltered Internet. It was an
  4682.  
  4683. oddity, a reasonably liberal world city whose nominal autonomy would distance me from China and restrain Beijing’s
  4684.  
  4685. ability to take public action against me or the journalists—at least immediately—but whose de facto existence in
  4686.  
  4687. Beijing’s sphere of influence would reduce the possibility of unilateral US intervention. In a situation with no
  4688.  
  4689. promise of safety, it was enough to have the guarantee of time. Chances were that things weren’t going to end well
  4690.  
  4691. for me, anyway: the best I could hope for was getting the disclosures out before I was caught.
  4692.  
  4693. The last morning I woke up with Lindsay, she was leaving on a camping trip to Kauai—a brief getaway with friends that
  4694.  
  4695. I’d encouraged. We lay in bed and I held her too tightly, and when she asked with sleepy bewilderment why I was
  4696.  
  4697. suddenly being so affectionate, I apologized. I told her how sorry I was for how busy I’d been, and that I was going
  4698.  
  4699. to miss her—she was the best person I’d ever met in my life. She smiled, pecked me on the cheek, and then got up to
  4700.  
  4701. pack.
  4702.  
  4703. The moment she was out the door, I started crying, for the first time in years.  I  felt  guilty  about  everything
  4704.  
  4705. except  what  my  government would accuse me of, and especially guilty about my tears, because I knew that my pain
  4706.  
  4707. would be nothing compared to the pain I’d cause to the woman I loved, or to the hurt and confusion I’d cause my
  4708.  
  4709. family.
  4710.  
  4711. At least I had the benefit of knowing what was coming. Lindsay would return from her camping trip to find me gone,
  4712.  
  4713. ostensibly on a work assignment, and my mother basically waiting on our doorstep. I’d invited my mother to visit, in
  4714.  
  4715. a move so uncharacteristic that she must have expected another type of surprise—like an announcement that Lindsay and
  4716.  
  4717. I were engaged. I felt horrible about the false pretenses and winced at the thought of her disappointment, but I kept
  4718.  
  4719. telling myself I was justified. My mother would take care of Lindsay and Lindsay would take care of her. Each would
  4720.  
  4721. need the other’s strength to weather the coming storm.
  4722.  
  4723. The day after Lindsay left, I took an emergency medical leave of absence from work, citing epilepsy, and packed scant
  4724.  
  4725. luggage and four laptops: secure communications, normal communications, a decoy, and an “airgap” (a computer that had
  4726.  
  4727. never gone and would never go online). I left my smartphone on the kitchen counter alongside a notepad on which I
  4728.  
  4729. scribbled in pen: Got called away for work. I love you. I signed it with my call-letter
  4730. nickname, Echo. Then I went to the airport and bought a ticket in cash for the next flight to Tokyo. In Tokyo, I
  4731.  
  4732. bought another ticket in cash, and on May 20 arrived in Hong Kong, the city where the world first met me.
  4733. 26
  4734.  
  4735. Hong Kong
  4736.  
  4737. The deep psychological appeal of games, which are really just a series of increasingly difficult challenges, is the
  4738.  
  4739. belief that they can be won. Nowhere is this more clear to me than in the case of the Rubik’s Cube, which satisfies a
  4740.  
  4741. universal  fantasy:  that  if  you  just  work  hard  enough  and  twist  yourself through all of the possibilities,
  4742.  
  4743. everything in the world that appears scrambled and incoherent will finally click into position and become perfectly
  4744.  
  4745. aligned; that human ingenuity is enough to transform the most broken and chaotic system into something logical and
  4746.  
  4747. orderly where every face of three- dimensional space shines with perfect uniformity.
  4748.  
  4749. I’d had a plan—I’d had multiple plans—in which a single mistake would have meant getting caught, and yet I hadn’t
  4750.  
  4751. been: I’d made it out of the NSA, I’d made it out of the country. I had beaten the game. By every standard I could
  4752.  
  4753. imagine, the hard part was over. But my imagination hadn’t been good enough, because the journalists I’d asked to
  4754.  
  4755. come meet me weren’t showing up. They kept postponing, giving excuses, apologizing.
  4756.  
  4757. I knew that Laura Poitras—to whom I’d already sent a few documents and the promise of many more—was ready to fly
  4758.  
  4759. anywhere from New York City at a moment’s notice, but she wasn’t going to come alone. She was busy trying to get
  4760.  
  4761. Glenn Greenwald to commit, trying to get him to buy a new laptop that he wouldn’t put online. Trying to get him to
  4762.  
  4763. install encryption programs so we could better communicate. And there I was, in Hong Kong, watching the clock tick
  4764.  
  4765. away the hours, watching the calendar tick off the days, beseeching, begging: please come before the NSA realizes
  4766.  
  4767. I’ve been gone from work too long. It was tough to think about all the lengths I’d gone to only to face the prospect
  4768.  
  4769. of being left in Hong Kong high and dry. I tried to work up some sympathy for these journalists who seemed too busy
  4770.  
  4771. or too nervous to lock down their travel plans, but then I’d recall just how little of the material for which I was
  4772.  
  4773. risking everything would actually make it to the public if the police arrived first. I thought about my family and
  4774.  
  4775. Lindsay and how foolish it was to have put my life in the hands of people who didn’t even know my name.
  4776.  
  4777. I barricaded myself in my room at the Mira Hotel, which I chose because of its central location in a crowded shopping
  4778.  
  4779. and business district. I put the “Privacy Please—Do Not Disturb” sign on the door handle to keep housekeeping out.
  4780.  
  4781. For ten days, I didn’t leave the room for fear of giving a
  4782. foreign spy the chance to sneak in and bug the place. With the stakes so high, the only move I had was to wait. I
  4783.  
  4784. converted the room into a poor man’s operations center, the invisible heart of the network of encrypted Internet
  4785.  
  4786. tunnels from which I’d send increasingly shrill pleas to the absent emissaries of our free press. Then I’d stand at
  4787.  
  4788. the window hoping for a reply, looking out onto the beautiful park I’d never visit. By the time Laura and Glenn
  4789.  
  4790. finally arrived, I’d eaten every item on the room service menu.
  4791.  
  4792. That isn’t to say that I just sat around during that week and a half writing wheedling messages. I also tried to
  4793.  
  4794. organize the last briefing I’d ever give— going through the archive, figuring out how best to explain its contents to
  4795.  
  4796. the journalists in the surely limited time we’d have together. It was an interesting problem: how to most cogently
  4797.  
  4798. express to nontechnical people who were almost  certainly  inclined  to  be  skeptical  of  me  the  fact  that  the  
  4799.  
  4800. US government was surveilling the world and the methods by which it was doing so. I put together dictionaries of
  4801.  
  4802. terms of art like “metadata” and “communications bearer.” I put together glossaries of acronyms and abbreviations:
  4803.  
  4804. CCE, CSS, DNI, NOFORN. I made the decision to explain not through  technologies, or  systems,  but  through  
  4805.  
  4806. surveillance  programs—in essence, through stories—in an attempt to speak their language. But I couldn’t decide which
  4807.  
  4808. stories to give them first, and I kept shuffling them around, trying to put the worst crimes in the best order.
  4809.  
  4810. I had to find a way to help at least Laura and Glenn understand something in the span of a few days that it had taken
  4811.  
  4812. me years to puzzle out. Then there was another thing: I had to help them understand who I was and why I’d decided to
  4813.  
  4814. do this.
  4815.  
  4816.  
  4817.  
  4818. AT LONG LAST, Glenn and Laura showed up in Hong Kong on June 2. When they came to meet me at the Mira, I think I
  4819.  
  4820. disappointed them, at least initially. They even told me as much, or Glenn did: He’d been expecting someone older,
  4821.  
  4822. some chain-smoking, tipsy depressive with terminal cancer and a guilty conscience. He didn’t understand how a person
  4823.  
  4824. as young as I was
  4825. —he  kept  asking  me  my  age—not  only  had  access  to  such  sensitive
  4826. documents, but was also so willing to throw his life away. For my part, I didn’t know how they could have expected
  4827.  
  4828. some graybeard, given my instructions to them about how to meet: Go to a certain quiet alcove by the hotel
  4829.  
  4830. restaurant, furnished with an alligator-skin-looking pleather couch, and wait around for a guy holding a Rubik’s
  4831.  
  4832. Cube. The funny thing was that I’d originally been wary of using that bit of tradecraft, but the cube was the only
  4833. thing I’d brought with me that was likely to be unique and identifiable from a distance. It also helped me hide the
  4834.  
  4835. stress of waiting for what I feared might be the surprise of handcuffs.
  4836.  
  4837. That stress would reach its visible peak just ten or so minutes later, when I’d brought Laura and Glenn up to my
  4838.  
  4839. room—#1014, on the tenth floor. Glenn had barely had the chance to stow his smartphone in my minibar fridge at my
  4840.  
  4841. request when Laura started rearranging and adjusting the lights in the room. Then she unpacked her digital video
  4842.  
  4843. camera. Though we’d agreed, over encrypted email, that she could film our encounter, I wasn’t ready for the reality.
  4844.  
  4845. Nothing could have prepared me for the moment when she pointed her camera at me, sprawled out on my unmade bed in a
  4846.  
  4847. cramped, messy room that I hadn’t left for the past ten days. I think everybody has had this kind of experience: the
  4848.  
  4849. more conscious you are of being recorded, the more self- conscious you become. Merely the awareness that there is, or
  4850.  
  4851. might be, somebody pressing Record on their smartphone and pointing it at you can cause awkwardness, even if that
  4852.  
  4853. somebody is a friend. Though today nearly all of my interactions take place via camera, I’m still not sure which
  4854.  
  4855. experience I find more alienating: seeing myself on film or being filmed. I try to avoid the former, but avoiding the
  4856.  
  4857. latter is now difficult for everyone.
  4858.  
  4859. In a situation that was already high-intensity, I stiffened. The red light of Laura’s camera, like a sniper’s sight,
  4860.  
  4861. kept reminding me that at any moment the door might be smashed in and I’d be dragged off forever. And whenever I
  4862.  
  4863. wasn’t having that thought, I kept thinking about how this footage was going to look when it was played back in
  4864.  
  4865. court. I realized there were so many things I should have done, like putting on nicer clothes and shaving. Room-
  4866.  
  4867. service plates and trash had accumulated throughout the room. There were noodle containers and half-eaten burgers,
  4868.  
  4869. piles of dirty laundry and damp towels on the floor.
  4870.  
  4871. It was a surreal dynamic. Not only had I never met any filmmakers before being filmed by one, I had never met any
  4872.  
  4873. journalists before serving as their source.  The  first  time  I  ever  spoke  aloud  to  anyone  about  the  US
  4874.  
  4875. government’s system of mass surveillance, I was speaking to everyone in the world with an Internet connection. In the
  4876.  
  4877. end, though, regardless of how rumpled I looked and stilted I sounded, Laura’s filming was indispensable, because it
  4878.  
  4879. showed the world exactly what happened in that hotel room in a way that newsprint never could. The footage she shot
  4880.  
  4881. over the course of our days together in Hong Kong can’t be distorted. Its existence is a tribute not
  4882. just to her professionalism as a documentarian but to her foresight.
  4883.  
  4884. I spent the week between June 3 and June 9 cloistered in that room with Glenn and his colleague from the Guardian,
  4885.  
  4886. Ewen MacAskill, who joined us a bit later that first day. We talked and talked, going through the NSA’s programs,
  4887.  
  4888. while Laura hovered and filmed. In contrast to the frenetic days, the nights were empty and desolate. Glenn and Ewen
  4889.  
  4890. would retreat to their own hotel, the nearby W, to write up their findings into articles. Laura would disappear to
  4891.  
  4892. edit her footage and do her own reporting with Bart Gellman of the Washington Post, who never made it to Hong Kong
  4893.  
  4894. but worked remotely with the documents he received from her.
  4895.  
  4896. I’d sleep, or try to—or else I’d put on the TV, find an English-language channel like the BBC or CNN, and watch the
  4897.  
  4898. international reaction. On June
  4899. 5, the Guardian broke Glenn’s first story, the FISA court order that authorized the NSA to collect information from
  4900.  
  4901. the American telecom Verizon about every phone call it handled. On June 6, it ran Glenn’s PRISM story, pretty much
  4902.  
  4903. simultaneously with a similar account in the Washington Post by Laura and Bart. I knew, and I think we all knew, that
  4904.  
  4905. the more pieces came out the more likely it was that I’d be identified, particularly because my office had begun
  4906.  
  4907. emailing me asking for status updates and I wasn’t answering. But though  Glenn  and  Ewen  and  Laura  were  
  4908.  
  4909. unfailingly sympathetic to  my ticking time-bomb situation, they never let their desire to serve the truth be
  4910.  
  4911. tempered by that knowledge. And following their example, neither did I.
  4912.  
  4913. Journalism, like documentary film, can only reveal so much. It’s interesting  to  think  about  what  a  medium  is  
  4914.  
  4915. forced  to  omit,  both  by convention and technology. In Glenn’s prose, especially in the Guardian, you got a
  4916.  
  4917. laser-focused statement of fact, stripped of the dogged passion that defines his personality. Ewen’s prose more fully
  4918.  
  4919. reflected his character: sincere, gracious, patient, and fair. Meanwhile, Laura, who saw all but was rarely seen, had
  4920.  
  4921. an omniscient reserve and a sardonic wit—half master spy, half master artist.
  4922.  
  4923. As the revelations ran wall to wall on every TV channel and website, it became clear that the US government had
  4924.  
  4925. thrown the whole of its machinery into identifying the source. It was also clear that when they did, they would use
  4926.  
  4927. the face they found—my face—to evade accountability: instead of addressing the revelations, they’d impugn the
  4928.  
  4929. credibility and motives of “the leaker.” Given the stakes, I had to seize the initiative before it was too late. If I
  4930.  
  4931. didn’t explain my actions and intentions, the government would, in a way that would swing the focus away from its
  4932.  
  4933. misdeeds.
  4934. The only hope I had of fighting back was to come forward first and identify myself. I’d give the media just enough
  4935.  
  4936. personal detail to satisfy their mounting curiosity, with a clear statement that what mattered wasn’t me, but rather
  4937.  
  4938. the subversion of American democracy. Then I’d vanish just as quickly as I’d appeared. That, at least, was the plan.
  4939.  
  4940. Ewen and I decided that he’d write a story about my IC career and Laura suggested filming a video statement to appear
  4941.  
  4942. alongside it in the Guardian. In it, I’d claim direct and sole responsibility as the source behind the reporting on
  4943.  
  4944. global mass surveillance. But even though Laura had been filming all week (a lot of that footage would make it into
  4945.  
  4946. her feature documentary, Citizenfour), we just didn’t have the time for her to go through everything she’d shot in
  4947.  
  4948. search of snippets of me speaking coherently and making eye contact. What she proposed, instead, was my first
  4949.  
  4950. recorded statement, which she started filming right there and then—the one that begins, “Uh, my name is Ed Snowden.
  4951.  
  4952. I’m, ah, twenty-nine years old.”
  4953.  
  4954. Hello, world.
  4955.  
  4956.  
  4957.  
  4958. WHILE I’VE NEVER once regretted tugging aside the curtain and revealing my identity, I do wish I had done it with
  4959.  
  4960. better diction and a better plan in mind for what was next. In truth, I had no plan at all. I hadn’t given much
  4961.  
  4962. thought to answering the question of what to do once the game was over, mainly because a winning conclusion was
  4963.  
  4964. always so unlikely. All I’d cared about was
  4965. getting the facts out into the world: I figured that by putting the documents
  4966. into the public record, I was essentially putting myself at the public’s mercy. No exit strategy could be the only
  4967.  
  4968. exit strategy, because any next step I might have premeditated taking would have run the risk of undermining the
  4969.  
  4970. disclosures.
  4971.  
  4972. If I’d made preexisting arrangements to fly to a specific country and seek asylum, for example, I would’ve been
  4973.  
  4974. called a foreign agent of that country. Meanwhile, if I returned to my own country, the best I could hope for was to
  4975.  
  4976. be  arrested  upon  landing  and  charged  under  the  Espionage  Act.  That would’ve entitled me to a show trial
  4977.  
  4978. deprived of any meaningful defense, a sham in which all discussion of the most important facts would be forbidden.
  4979.  
  4980. The major impediment to justice was a major flaw in the law, a purposeful flaw created by the government. Someone in
  4981.  
  4982. my position would not even be allowed to argue in court that the disclosures I made to journalists were civically
  4983.  
  4984. beneficial. Even now, years after the fact, I would not be allowed to
  4985. argue that the reporting based on my disclosures had caused Congress to change certain laws regarding surveillance,
  4986.  
  4987. or convinced the courts to strike down  a  certain  mass  surveillance  program  as  illegal,  or  influenced  the
  4988.  
  4989. attorney general and the president of the United States to admit that the debate over mass surveillance was a crucial
  4990.  
  4991. one for the public to have, one that would ultimately strengthen the country. All these claims would be deemed not
  4992.  
  4993. just irrelevant but inadmissible in the kind of proceedings that I would face were I to head home. The only thing my
  4994.  
  4995. government would have to prove in court is that I disclosed classified information to journalists, a fact that is not
  4996.  
  4997. in dispute. This is why anyone who says I have to come back to the States for trial is essentially saying I have to
  4998.  
  4999. come back to the States for sentencing, and the sentence would, now as then, surely be a cruel one. The penalty for  
  5000.  
  5001. disclosing top  secret documents, whether to  foreign spies  or domestic journalists, is up to ten years per
  5002.  
  5003. document.
  5004.  
  5005. From the moment that Laura’s video of me was posted on the Guardian website on June 9, I was marked. There was a
  5006.  
  5007. target on my back. I knew that the institutions I’d shamed would not relent until my head was bagged and my limbs
  5008.  
  5009. were shackled. And until then—and perhaps even after then—they would harass my loved ones and disparage my character,
  5010.  
  5011. prying into every aspect of my life and career, seeking information (or opportunities for disinformation) with which
  5012.  
  5013. to smear me. I was familiar enough with how this process went, both from having read classified examples of it within
  5014.  
  5015. the IC and from having studied the cases of other whistleblowers and leakers. I knew the stories of heroes like
  5016.  
  5017. Daniel Ellsberg and Anthony Russo, and more recent opponents of government secrecy like Thomas Tamm, an attorney with
  5018.  
  5019. the Justice Department’s Office of Intelligence Policy and Review who served as a source for much of the warrantless
  5020.  
  5021. wiretapping reporting of the mid-2000s. There  were  also  Drake,  Binney,  Wiebe,  and  Loomis,  the  digital-age
  5022.  
  5023. successors to Perry Fellwock, who back in 1971 had revealed the existence of the  then-unacknowledged NSA  in  the  
  5024.  
  5025. press,  which  caused  the  Senate’s Church Committee (the forerunner of today’s Senate Select Committee on
  5026.  
  5027. Intelligence) to  try  to  ensure  that  the  agency’s brief  was  limited  to  the gathering of foreign rather than
  5028.  
  5029. domestic signals intelligence. And then there was US Army Private Chelsea Manning, who for the crime of exposing
  5030.  
  5031. America’s war crimes was court-martialed and sentenced to thirty-five years in prison, of which she served seven, her
  5032.  
  5033. sentence commuted only after an international outcry arose over the treatment she received during solitary
  5034.  
  5035. confinement.
  5036.  
  5037. All of these people, whether they faced prison or not, encountered some
  5038. sort of backlash, most often severe and derived from the very abuse that I’d just helped expose: surveillance. If
  5039.  
  5040. ever they’d expressed anger in a private communication, they were “disgruntled.” If they’d ever visited a
  5041.  
  5042. psychiatrist or a psychologist, or just checked out books on related subjects from a library, they were “mentally
  5043.  
  5044. unsound.” If they’d been drunk even once, they were said to be alcoholics. If they’d had even one extramarital
  5045.  
  5046. affair, they were said to be sexual deviants. Not a few lost their homes and were bankrupted. It’s easier for an
  5047.  
  5048. institution to tarnish a reputation than to substantively engage with principled dissent—for the IC, it’s just a
  5049.  
  5050. matter of consulting the files, amplifying the available evidence, and, where no evidence exists, simply fabricating
  5051.  
  5052. it.
  5053.  
  5054. As sure as I was of my government’s indignation, I was just as sure of the support of my family, and of Lindsay, who
  5055.  
  5056. I was certain would understand— perhaps not forgive, but understand—the context of my recent behavior. I took comfort
  5057.  
  5058. from recalling their love: it helped me cope with the fact that there was nothing left for me to do, no further plans
  5059.  
  5060. in play. I could only extend the belief I had in my family and Lindsay into a perhaps idealistic belief in my fellow
  5061.  
  5062. citizens, a hope that once they’d been made aware of the full scope of American mass surveillance they’d mobilize and
  5063.  
  5064. call for justice. They’d be empowered to seek that justice for themselves, and, in the process, my own destiny would
  5065.  
  5066. be decided. This was the ultimate leap of faith, in a way: I could hardly trust anyone, so I had to trust everyone.
  5067.  
  5068.  
  5069.  
  5070. WITHIN HOURS AFTER my Guardian video ran, one of Glenn’s regular readers in Hong Kong contacted him and offered to
  5071.  
  5072. put me in touch with Robert Tibbo and Jonathan Man, two local attorneys who then volunteered to take on my case.
  5073.  
  5074. These were the men who helped get me out of the Mira when the press finally located me and besieged the hotel. As a
  5075.  
  5076. diversion, Glenn went
  5077. out the front lobby door, where he was immediately thronged by the cameras
  5078. and mics. Meanwhile, I was bundled out of one of the Mira’s myriad other exits, which connected via a skybridge to a
  5079.  
  5080. mall.
  5081.  
  5082. I like Robert—to have been his client is to be his friend for life. He’s an idealist and a crusader, a tireless
  5083.  
  5084. champion of lost causes. Even more impressive than his lawyering, however, was his creativity in finding safe houses.
  5085.  
  5086. While journalists were scouring every five-star hotel in Hong Kong, he took me to one of the poorest neighborhoods of
  5087.  
  5088. the city and introduced me to some of his other clients, a few of the nearly twelve thousand forgotten refugees in
  5089.  
  5090. Hong Kong—under Chinese pressure, the city has maintained a
  5091. dismal 1 percent approval rate for permanent residency status. I wouldn’t usually name them, but since they have
  5092.  
  5093. bravely identified themselves to the press, I will: Vanessa Mae Bondalian Rodel from the Philippines, and Ajith
  5094.  
  5095. Pushpakumara, Supun Thilina Kellapatha, and Nadeeka Dilrukshi Nonis, all from Sri Lanka.
  5096.  
  5097. These unfailingly kind and generous people came through with charitable grace. The solidarity they showed me was not
  5098.  
  5099. political. It was human, and I will be forever in their debt. They didn’t care who I was, or what dangers they might
  5100.  
  5101. face by helping me, only that there was a person in need. They knew all too well what it meant to be forced into a
  5102.  
  5103. mad escape from mortal threat, having survived ordeals far in excess of anything I’d dealt with and hopefully ever  
  5104.  
  5105. will:  torture  by  the  military,  rape,  and  sexual  abuse.  They  let  an exhausted stranger into their homes—and
  5106.  
  5107. when they saw my face on TV, they didn’t falter. Instead, they smiled, and took the opportunity to reassure me of
  5108.  
  5109. their hospitality.
  5110.  
  5111. Though their resources were limited—Supun, Nadeeka, Vanessa, and two little girls lived in a crumbling, cramped
  5112.  
  5113. apartment smaller than my room at the  Mira—they shared everything they  had  with  me,  and  they  shared it
  5114.  
  5115. unstintingly, refusing my offers to reimburse them for the cost of taking me in so vociferously that I had to hide
  5116.  
  5117. money in the room to get them to accept it. They fed me, they let me bathe, they let me sleep, and they protected me.
  5118.  
  5119. I will never be able to explain what it meant to be given so much by those with so little, to be accepted by them
  5120.  
  5121. without judgment as I perched in corners like a stray street cat, skimming the Wi-Fi of distant hotels with a special
  5122.  
  5123. antenna that delighted the children.
  5124.  
  5125. Their welcome and friendship was a gift, for the world to even have such people is a gift, and so it pains me that,
  5126.  
  5127. all these years later, the cases of Ajith, Supun, Nadeeka, and Nadeeka’s daughter are still pending. The admiration I
  5128.  
  5129. feel for these folks is matched only by the resentment I feel toward the bureaucrats in Hong Kong, who continue to
  5130.  
  5131. deny them the basic dignity of asylum. If folks as fundamentally decent and selfless as these aren’t deemed worthy of
  5132.  
  5133. the protection of the state, it’s because the state itself is unworthy. What gives me hope, however, is that just as
  5134.  
  5135. this book was going to press, Vanessa and her daughter received asylum in Canada. I look forward to the day when I
  5136.  
  5137. can visit all of my old Hong Kong friends in their new homes, wherever those may be, and we can make happier memories
  5138.  
  5139. together in freedom.
  5140.  
  5141. On June 14, the US government charged me under the Espionage Act in a
  5142. sealed complaint, and on June 21 they formally requested my extradition. I
  5143. knew it was time to go. It was also my thirtieth birthday.
  5144.  
  5145. Just as the US State Department sent its request, my lawyers received a reply  to  my  appeal  for  assistance  from  
  5146.  
  5147. the  UN  High  Commissioner on Refugees: there was nothing that could be done for me. The Hong Kong government,  
  5148.  
  5149. under  Chinese  pressure  or  not,  resisted  any  UN  effort  at affording me international protection on its
  5150.  
  5151. territory, and furthermore asserted that it would first have to consider the claims of my country of citizenship. In
  5152.  
  5153. other words, Hong Kong was telling me to go home and deal with the UN from prison. I wasn’t just on my own—I was
  5154.  
  5155. unwelcome. If I was going to leave freely, I had to leave now. I wiped my four laptops completely clean and destroyed
  5156.  
  5157. the cryptographic key, which meant that I could no longer access any of the documents even if compelled. Then I
  5158.  
  5159. packed the few clothes I had and headed out. There was no safety to be found in the “fragrant harbor.”
  5160. 27
  5161.  
  5162. Moscow
  5163.  
  5164. For a coastal country at the northwestern edge of South America, half a globe away from Hong Kong, Ecuador is in the
  5165.  
  5166. middle of everything: not for nothing does its name translate to “The Republic of the Equator.” Most of my fellow
  5167.  
  5168. North Americans would correctly say that it’s a small country, and some might even know enough to call it
  5169.  
  5170. historically oppressed. But they are ignorant if they think it’s a backwater. When Rafael Correa became president in
  5171.  
  5172. 2007, as part of a tide of so-called democratic socialist leaders who swept elections in the late 1990s and early
  5173.  
  5174. 2000s in Bolivia, Argentina, Brazil, Paraguay, and Venezuela, he initiated a spate of policies intended to oppose and
  5175.  
  5176. reverse the effects of US imperialism in the region. One of these measures, reflecting President Correa’s previous
  5177.  
  5178. career as an economist, was an announcement that Ecuador would consider its national debt illegitimate— technically,
  5179.  
  5180. it would be classified as “odious debt,” which is national debt incurred by a despotic regime or through despotic
  5181.  
  5182. imperialist trade policies. Repayment of odious debt is not enforceable. With this announcement, Correa freed his
  5183.  
  5184. people from decades of economic serfdom, though he made not a few enemies among the class of financiers who direct
  5185.  
  5186. much of US foreign policy.
  5187.  
  5188. Ecuador, at least in 2013, had a hard-earned belief in the institution of political asylum. Most famously, the
  5189.  
  5190. Ecuadorean embassy in London had become, under Correa, the  safe haven and  redoubt of  WikiLeaks’ Julian Assange. I
  5191.  
  5192. had no desire to live in an embassy, perhaps because I’d already worked in one. Still, my Hong Kong lawyers agreed
  5193.  
  5194. that, given the circumstances, Ecuador seemed to be the most likely country to defend my right to political asylum
  5195.  
  5196. and the least likely to be cowed by the ire of the hegemon that ruled its hemisphere. My growing but ad hoc team of
  5197.  
  5198. lawyers, journalists, technologists, and activists concurred. My hope was to make it to Ecuador proper.
  5199.  
  5200. With my government having decided to charge me under the Espionage Act, I stood accused of a political crime, meaning
  5201.  
  5202. a crime whose victim is the state itself rather than a person. Under international humanitarian law, those accused in
  5203.  
  5204. this way are generally exempt from extradition, because the charge of political criminality is more often than not an
  5205.  
  5206. authoritarian attempt at quashing legitimate dissent. In theory, this means that government whistleblowers should be
  5207.  
  5208. protected against extradition almost everywhere. In practice, of course, this is rarely the case, especially when the
  5209.  
  5210. government
  5211. that perceives itself wronged is America’s—which claims to foster democracy abroad yet secretly maintains fleets of
  5212.  
  5213. privately contracted aircraft dedicated to that form of unlawful extradition known as rendition, or, as everyone else
  5214.  
  5215. calls it, kidnapping.
  5216.  
  5217. The team supporting me had reached out to officials everywhere from Iceland to India, asking if they would respect
  5218.  
  5219. the prohibition against extradition of those accused of political crimes and commit to noninterference in my
  5220.  
  5221. potential travel. It soon became evident that even the most advanced democracies were afraid of incurring the wrath
  5222.  
  5223. of the US government. They were happy to privately express their sympathies, but reluctant to offer even unofficial
  5224.  
  5225. guarantees. The common denominator of the advice that filtered back to me was to land only in non-extradition
  5226.  
  5227. countries, and avoid any route that crossed the airspace of any countries with a record of cooperation with or
  5228.  
  5229. deference to the US military. One official, I think from France, suggested that the odds of my successful transit
  5230.  
  5231. might be significantly increased if I were issued a laissez-passer, a UN-recognized one-way travel document typically
  5232.  
  5233. issued to grant safe passage to refugees crossing borders—but obtaining one of those was easier said than done.
  5234.  
  5235. Enter Sarah Harrison, a journalist and an editor for WikiLeaks. The moment the news broke that an American had
  5236.  
  5237. unmasked a global system of mass surveillance, she had immediately flown to Hong Kong. Through her experience with
  5238.  
  5239. the website and particularly with the fate of Assange, she was poised to offer me the world’s best asylum advice. It
  5240.  
  5241. didn’t hurt that she also had family connections with the legal community in Hong Kong.
  5242.  
  5243. People have long ascribed selfish motives to Assange’s desire to give me aid, but I believe he was genuinely invested
  5244.  
  5245. in one thing above all—helping me evade capture. That doing so involved tweaking the US government was just a bonus
  5246.  
  5247. for him, an ancillary benefit, not the goal. It’s true that Assange can be self-interested and vain, moody, and even
  5248.  
  5249. bullying—after a sharp disagreement just a month after our first, text-based conversation, I never communicated with
  5250.  
  5251. him again—but he also sincerely conceives of himself as a fighter in a historic battle for the public’s right to
  5252.  
  5253. know, a battle he will do anything to win. It’s for this reason that I regard it as too reductive to interpret his
  5254.  
  5255. assistance as merely an instance of scheming or self-promotion. More important to him, I believe, was the opportunity
  5256.  
  5257. to establish a counterexample to  the  case of  the  organization’s most famous source, US  Army Private Chelsea
  5258.  
  5259. Manning, whose thirty-five-year prison sentence was  historically unprecedented and a monstrous deterrent to
  5260.  
  5261. whistleblowers everywhere. Though I never was, and never would be, a source for Assange, my situation
  5262. gave him a chance to right a wrong. There was nothing he could have done to save Manning, but he seemed, through
  5263.  
  5264. Sarah, determined to do everything he could to save me.
  5265.  
  5266. That said, I was initially wary of Sarah’s involvement. But Laura told me that she was serious, competent, and, most
  5267.  
  5268. important, independent: one of the few at WikiLeaks who dared to openly disagree with Assange. Despite my caution, I
  5269.  
  5270. was in a difficult position, and as Hemingway once wrote, the way to make people trustworthy is to trust them.
  5271.  
  5272. Laura informed me of Sarah’s presence in Hong Kong only a day or so before she communicated with me on an encrypted
  5273.  
  5274. channel, which itself was only a day or two before I actually met her in person—and if I’m somewhat loose on my dates
  5275.  
  5276. here, you’ll have to forgive me: one frenetic day bled into the next. Sarah had been a whirlwind, apparently, since
  5277.  
  5278. the moment of her landing in Hong Kong. Though she wasn’t a lawyer, she had deep expertise when it came to what I’ll
  5279.  
  5280. call the interpersonal or subofficial nuances of avoiding extradition. She met with local Hong Kong human rights
  5281.  
  5282. attorneys to seek independent opinions, and I was deeply impressed by both her pace and her circumspection. Her
  5283.  
  5284. connections through WikiLeaks and the extraordinary courage of the Ecuadorean consul in London, Fidel Narváez,
  5285.  
  5286. together produced a laissez-passer in my name. This laissez-passer, which was meant to  get me to  Ecuador, had been
  5287.  
  5288. issued by  the consul on  an emergency basis, since we didn’t have time for his home government to formally approve
  5289.  
  5290. it. The moment it was in hand, Sarah hired a van to take us to the airport.
  5291.  
  5292. That’s how I met her—in motion. I’d like to say that I started off our acquaintance by offering my thanks, but
  5293.  
  5294. instead the first thing I said was: “When was the last time you slept?” Sarah looked just as ragged and disheveled as
  5295.  
  5296. I did. She stared out the window, as if trying to recall the answer, but then just shook her head: “I don’t know.”
  5297.  
  5298. We were both developing colds and our careful conversation was punctuated by sneezes and coughs. By her own account,
  5299.  
  5300. she was motivated to support me out of loyalty to her conscience more than to the ideological demands of her
  5301.  
  5302. employer. Certainly her politics seemed shaped less by Assange’s feral opposition to central power than by her own
  5303.  
  5304. conviction that too much of what passed for contemporary journalism served government interests rather than
  5305.  
  5306. challenged them. As we hurtled to the airport, as we checked in, as we cleared passport control for the first of what
  5307.  
  5308. should have been three flights, I kept waiting for her to ask me for something—anything,
  5309. even just for me to make a statement on Assange’s, or the organization’s, behalf. But she never did, although she did
  5310.  
  5311. cheerfully share her opinion that I was a fool for trusting media conglomerates to fairly guard the gate between the
  5312.  
  5313. public and the truth. For that instance of straight talk, and for many others, I’ll always admire Sarah’s honesty.
  5314.  
  5315. We were traveling to Quito, Ecuador, via Moscow via Havana via Caracas for a simple reason: it was the only safe
  5316.  
  5317. route available. There were no direct flights to Quito from Hong Kong, and all of the other connecting flights
  5318.  
  5319. traveled through US airspace. While I  was concerned about the massive layover in Russia—we’d have almost twenty
  5320.  
  5321. hours before the Havana flight departed—my primary fear was actually the next leg of the journey, because traveling
  5322.  
  5323. from Russia to Cuba meant passing through NATO airspace. I didn’t particularly relish flying over a country like
  5324.  
  5325. Poland, which during my lifetime has done everything to please the US government, including hosting CIA black sites
  5326.  
  5327. where my former IC colleagues subjected prisoners to “enhanced interrogations,” another Bush-era euphemism for
  5328.  
  5329. “torture.”
  5330.  
  5331. I wore my hat down over my eyes to avoid being recognized, and Sarah did the seeing for me. She took my arm and led
  5332.  
  5333. me to the gate, where we waited until boarding. This was the last moment for her to back out, and I told her so. “You
  5334.  
  5335. don’t have to do this,” I said.
  5336.  
  5337. “Do what?”
  5338.  
  5339. “Protect me like this.”
  5340.  
  5341. Sarah stiffened. “Let’s get one thing clear,” she said as we boarded, “I’m not protecting you. No one can protect
  5342.  
  5343. you. What I’m here for is to make it harder for anyone to interfere. To make sure everyone’s on their best behavior.”
  5344.  
  5345. “So you’re my witness,” I said.
  5346.  
  5347. She gave a slight wry smile. “Someone has to be the last person to ever see you alive. It might as well be me.”
  5348.  
  5349. Though the three points where I’d thought we were most likely to get stopped were now behind us (check-in, passport
  5350.  
  5351. control, and the gate), I didn’t feel safe on the plane. I didn’t want to get complacent. I took the window seat and
  5352.  
  5353. Sarah sat next to me, to screen me from the other passengers across the row. After what felt like an eternity, the
  5354.  
  5355. cabin doors were shut, the skybridge pulled away, and finally, we were moving. But just before the plane rolled from
  5356.  
  5357. the tarmac onto the runway, it halted sharply. I was nervous. Pressing the brim of my hat up against the glass, I
  5358.  
  5359. strained to catch the sound
  5360. of sirens or the flashing of blue lights. It felt like I was playing the waiting game all over again—it was a wait
  5361.  
  5362. that wouldn’t end. Until, suddenly, the plane rolled into motion again and took a turn, and I realized that we were
  5363.  
  5364. just far back in the line for takeoff.
  5365.  
  5366. My spirits rose with the wheels, but it was hard to believe I was out of the fire. Once we were airborne, I loosened
  5367.  
  5368. my grip from my thighs and felt an urge to take my lucky Rubik’s Cube out of my bag. But I knew I couldn’t, because
  5369.  
  5370. nothing would make me more conspicuous. Instead, I sat back, pulled my hat down again, and kept my half-open eyes on
  5371.  
  5372. the map on the seatback screen  just  in  front  of  me,  tracking  the  pixelated  route  across  China, Mongolia,
  5373.  
  5374. and Russia—none of which would be especially amenable to doing any favors for the US State Department. However, there
  5375.  
  5376. was no predicting what the Russian government would do once we landed, beyond hauling us into an inspection so they
  5377.  
  5378. could search through my blank laptops and empty bag. What I hoped might spare us any more invasive treatment was that
  5379.  
  5380. the world was watching and my lawyers and WikiLeaks’ lawyers were aware of our itinerary.
  5381.  
  5382. It was only once we’d entered Chinese airspace that I realized I wouldn’t be able to get any rest until I asked Sarah
  5383.  
  5384. this question explicitly: “Why are you helping me?”
  5385.  
  5386. She flattened out her voice, as if trying to tamp down her passions, and told me that she wanted me to have a better
  5387.  
  5388. outcome. She never said better than what outcome or whose, and I could only take that answer as a sign of her
  5389.  
  5390. discretion and respect.
  5391.  
  5392. I was reassured, enough at least to finally get some sleep.
  5393.  
  5394.  
  5395.  
  5396. WE LANDED  AT Sheremetyevo on June 23 for what we assumed would be a twenty-hour layover. It has now dragged on for
  5397.  
  5398. over six years. Exile is an endless layover.
  5399.  
  5400. In the IC, and in the CIA in particular, you get a lot of training on how not to get into trouble at customs. You
  5401.  
  5402. have to think about how you dress, how you act. You have to think about the things in your bag and the things in your
  5403.  
  5404. pockets and the tales they tell about you. Your goal is to be the most boring person in line, with the most perfectly
  5405.  
  5406. forgettable face. But none of that really matters when the name on your passport is all over the news.
  5407.  
  5408. I handed my little blue book to the bearish guy in the passport control
  5409. booth, who scanned it and rifled through its pages. Sarah stood stalwart behind me. I’d made sure to take note of the
  5410.  
  5411. time it took for the people ahead of us in line to clear the booth, and our turn was taking too long. Then the guy
  5412.  
  5413. picked up his phone, grumbled some words in Russian, and almost immediately—far too  quickly—two security  officers  
  5414.  
  5415. in  suits  approached. They must have been waiting. The officer in front took my little blue book from the guy in the
  5416.  
  5417. booth and leaned in close to me. “There is problem with passport,” he said. “Please, come with.”
  5418.  
  5419. Sarah immediately stepped to my side and unleashed a fast flurry of English: “I’m his legal adviser. Wherever he
  5420.  
  5421. goes, I go. I’m coming with you. According to the—”
  5422.  
  5423. But before she could cite the relevant UN covenants and Genevan codicils, the officer held up his hand and glanced at
  5424.  
  5425. the line. He said, “Okay, sure, okay. You come.”
  5426.  
  5427. I don’t know whether the officer had even understood what she said. He just clearly didn’t want to make a scene.
  5428.  
  5429. The two security officers marched us briskly toward what I assumed was going to be a special room for secondary
  5430.  
  5431. inspection, but instead turned out to be one of Sheremetyevo’s plush business lounges—like a business-class or
  5432.  
  5433. first-class area, with just a few passengers basking obliviously in their luxury seats. Sarah and I were directed
  5434.  
  5435. past them and down a hall into a conference room of sorts, filled with men in gray sitting around a table. There were
  5436.  
  5437. a half-dozen of them or so, with military haircuts. One guy sat separately, holding a pen. He was a notetaker, a kind
  5438.  
  5439. of secretary, I guessed. He had a folder in front of him containing a pad of paper. On the cover of the folder was a
  5440.  
  5441. monocolor insignia that I didn’t need Russian in order to understand: it was a sword and shield, the symbol of
  5442.  
  5443. Russia’s foremost intelligence service, the Federal Security Service (FSB). Like the FBI in the United States, the
  5444.  
  5445. FSB exists not only to spy and investigate but also to make arrests.
  5446.  
  5447. At the center of the table sat an older man in a finer suit than the others, the white of his hair shining like a
  5448.  
  5449. halo of authority. He gestured for Sarah and me to sit opposite him, with an authoritative sweep of the hand and a
  5450.  
  5451. smile that marked him as a seasoned case officer, or whatever the term is for a CO’s Russian equivalent. Intelligence
  5452.  
  5453. services the world over are full of such figures—dedicated actors who will try on different emotions until they get
  5454.  
  5455. the response they want.
  5456.  
  5457. He cleared his throat and gave me, in decent English, what the CIA calls a
  5458. cold pitch, which is basically an offer by a foreign intelligence service that can be summarized as “come and work
  5459.  
  5460. for us.” In return for cooperation, the foreigners dangle favors, which can be anything from stacks of cash to a get-
  5461.  
  5462. out-of-jail-free card for pretty much anything from fraud to murder. The catch, of course, is that the foreigners
  5463.  
  5464. always expect something of equal or better value in exchange. That clear and unambiguous transaction, however, is
  5465.  
  5466. never how it starts. Come to think of it, it’s funny that it’s called a cold pitch, because the person making it
  5467.  
  5468. always starts warm, with grins, levity, and words of sympathy.
  5469.  
  5470. I knew I had to cut him off. If you don’t cut off a foreign intelligence officer right away, it might not matter
  5471.  
  5472. whether you ultimately reject their offer, because they can destroy your reputation simply by leaking a recording of
  5473.  
  5474. you considering it. So as the man apologized for inconveniencing us, I imagined the hidden devices recording us, and
  5475.  
  5476. tried to choose my words carefully.
  5477.  
  5478. “Listen, I understand who you are, and what this is,” I said. “Please let me be clear that I have no intention to
  5479.  
  5480. cooperate with you. I’m not going to cooperate with any intelligence service. I mean no disrespect, but this isn’t
  5481.  
  5482. going to be that kind of meeting. If you want to search my bag, it’s right here,” and I pointed to it under my chair.
  5483.  
  5484. “But I promise you, there’s nothing in it that can help you.”
  5485.  
  5486. As I was speaking, the man’s face changed. He started to act wounded. “No, we would never do that,” he said. “Please
  5487.  
  5488. believe me, we only want to help you.”
  5489.  
  5490. Sarah cleared her throat and jumped in. “That’s quite kind of you, but I
  5491. hope you can understand that all we’d like is to make our connecting flight.”
  5492.  
  5493. For the briefest instant, the man’s feigned sorrow became irritation. “You are his lawyer?”
  5494.  
  5495. “I’m his legal adviser,” Sarah answered.
  5496.  
  5497. The man asked me, “So you are not coming to Russia to be in Russia?” “No.”
  5498. “And so  may I  ask  where you are trying to  go?  What is  your final destination?”
  5499.  
  5500. I said, “Quito, Ecuador, via Caracas, via Havana,” even though I knew that he already knew the answer. He certainly
  5501.  
  5502. had a copy of our itinerary, since Sarah and I had traveled from Hong Kong on Aeroflot, the Russian flagship
  5503. airline.
  5504.  
  5505. Up until this point, he and I had been reading from the same intelligence script, but now the conversation swerved.
  5506.  
  5507. “You haven’t heard?” he said. He stood and looked at me like he was delivering the news of a death in the family. “I
  5508.  
  5509. am afraid to inform you that your passport is invalid.”
  5510. I was so surprised, I just stuttered. “I’m sorry, but I—I don’t believe that.” The man leaned over the table and
  5511.  
  5512. said, “No, it is true. Believe me. It is
  5513. the decision of your minister, John Kerry. Your passport has been canceled by
  5514. your government, and the air services have been instructed not to allow you to travel.”
  5515.  
  5516. I was sure it was a trick, but I wasn’t quite sure to what purpose. “Give us a minute,” I said, but even before I
  5517.  
  5518. could ask, Sarah had snatched her laptop out of her bag and was getting onto the airport Wi-Fi.
  5519.  
  5520. “Of course, you will check,” the man said, and he turned to his colleagues and chatted amiably to them in Russian, as
  5521.  
  5522. if he had all the time in the world.
  5523.  
  5524. It was reported on every site Sarah looked at. After the news had broken that I’d left Hong Kong, the US State
  5525.  
  5526. Department announced that it had canceled my passport. It had revoked my travel document while I was still in midair.
  5527.  
  5528. I was incredulous: my own government had trapped me in Russia. The State Department’s move might merely have been the
  5529.  
  5530. result of bureaucratic proceduralism—when you’re trying to catch a fugitive, putting out an Interpol alert and
  5531.  
  5532. canceling their passport is just standard operating procedure. But in the final accounting it was self-defeating, as
  5533.  
  5534. it handed Russia a massive propaganda victory.
  5535.  
  5536. “It’s true,” said Sarah, with a shake of her head.
  5537.  
  5538. “So what will you do?” the man asked, and he walked around to our side of the table.
  5539.  
  5540. Before I could take the Ecuadorean safe conduct pass out of my pocket, Sarah said, “I’m so sorry, but I’m going to
  5541.  
  5542. have to advise Mr. Snowden not to answer any more questions.”
  5543.  
  5544. The man pointed at me, and said, “You will come.”
  5545.  
  5546. He gestured me to follow him to the far end of the conference room, where there was a window. I went and stood next
  5547.  
  5548. to him and looked. About three or four floors below was street level and the largest media scrum I’ve
  5549. ever seen, scads of reporters wielding cameras and mics.
  5550.  
  5551. It was an impressive show, perhaps choreographed by the FSB, perhaps not, most likely half and half. Almost
  5552.  
  5553. everything in Russia is half and half. But at least now I knew why Sarah and I had been brought to this conference
  5554.  
  5555. room in this lounge.
  5556.  
  5557. I went back to my chair but didn’t sit down again.
  5558.  
  5559. The man turned from the window to face me and said, “Life for a person in your situation can be very difficult
  5560.  
  5561. without friends who can help.” He let the words linger.
  5562.  
  5563. Here it comes, I thought—the direct solicitation.
  5564.  
  5565. He said, “If there is some information, perhaps, some small thing you could share with us?”
  5566.  
  5567. “We’ll be okay on our own,” I said. Sarah stood up next to me.
  5568.  
  5569. The man sighed. He turned to mumble in Russian, and his comrades rose and filed out. “I hope you will not regret your
  5570.  
  5571. decision,” he said to me. Then he gave a slight bow and made his own exit, just as a pair of officials from the
  5572.  
  5573. airport administration entered.
  5574.  
  5575. I demanded to be allowed to go to the gate for the flight to Havana, but they ignored me. I finally reached into my
  5576.  
  5577. pocket and brandished the Ecuadorean safe conduct pass, but they ignored that, too.
  5578.  
  5579. All told, we were trapped in the airport for a biblical forty days and forty nights. Over the course of those days, I
  5580.  
  5581. applied to a total of twenty-seven countries for political asylum. Not a single one of them was willing to stand up
  5582.  
  5583. to American pressure, with some countries refusing outright, and others declaring that they were unable to even
  5584.  
  5585. consider my request until I arrived in their territory—a feat that was impossible. Ultimately, the only head of state
  5586.  
  5587. that proved sympathetic to my cause was Burger King, who never denied me a Whopper (hold the tomato and onion).
  5588.  
  5589. Soon, my presence in the airport became a global spectacle. Eventually the Russians found it a nuisance. On July 1,
  5590.  
  5591. the president of Bolivia, Evo Morales, left another airport in Moscow, Vnukovo, in his Bolivian state plane after
  5592.  
  5593. attending the annual GECF, or Gas Exporting Countries Forum. The US government, suspecting that I was onboard due to
  5594.  
  5595. President Morales’s expressions of solidarity, pressured the governments of Italy, France, Spain, and Portugal to
  5596.  
  5597. deny the plane access to their airspace, and succeeded in diverting it to Vienna, Austria. There it was grounded,
  5598.  
  5599. searched, and only
  5600. allowed to continue on its journey once no traces of me were found. This was a startling violation of sovereignty,
  5601.  
  5602. which occasioned UN censure. The incident was an affront to Russia, which couldn’t guarantee a visiting head of state
  5603.  
  5604. safe passage home. And it confirmed to Russia and to me that any flight that America suspected me of stowing away on
  5605.  
  5606. ran the same risk of being diverted and grounded.
  5607.  
  5608. The Russian government must have decided that it would be better off without me and the media swarm clogging up the
  5609.  
  5610. country’s major airport. On August 1 it granted me temporary asylum. Sarah and I were allowed to leave Sheremetyevo,
  5611.  
  5612. but eventually only one of us would be heading home. Our time together served to bind us as friends for life. I will
  5613.  
  5614. always be grateful for the weeks she spent by my side, for her integrity and her fortitude.
  5615. 28
  5616.  
  5617. From the Diaries of Lindsay Mills
  5618.  
  5619. As far away from home as I was, my thoughts were consumed with Lindsay. I’ve been wary of telling her story—the story
  5620.  
  5621. of what happened to her once I was gone: the FBI interrogations, the surveillance, the press attention, the online
  5622.  
  5623. harassment, the confusion and pain, the anger and sadness. Finally, I realized that only Lindsay herself should be
  5624.  
  5625. the person to recount that period. No one else has the experience, but more than that: no one else has the right.
  5626.  
  5627. Luckily, Lindsay has kept a diary since adolescence, using it to record her life and draft her art. She has
  5628.  
  5629. graciously agreed to let me include a few pages here. In the entries that follow, all names have been changed (except
  5630.  
  5631. those of family), some typos fixed, and a few redactions made. Otherwise, this is how it was, from the moment that I
  5632.  
  5633. left Hawaii.
  5634.  
  5635. 5.22.2013
  5636.  
  5637. Stopped in at K-Mart to get a lei. Trying to welcome Wendy with proper aloha spirit, but I’m pissed. Ed’s been
  5638.  
  5639. planning his mother’s visit for weeks. He’s the one who invited her. I was hoping he’d be there when I woke up this
  5640.  
  5641. morning. On the drive back to Waipahu from the airport Wendy was worried. She’s not used to him having to go away on
  5642.  
  5643. a moment’s notice. I tried to tell her this was usual. But it was usual when we lived overseas, not in Hawaii, and I
  5644.  
  5645. can’t remember any other time that Ed was away and wasn’t in touch. We went to a nice dinner to distract ourselves
  5646.  
  5647. and Wendy talked about how she thought Ed was on medical leave. It didn’t make any sense to her that he’d be called
  5648.  
  5649. away for work while on medical leave. The moment we got home Wendy went to bed. I checked my phone and found I had
  5650.  
  5651. three missed calls from an unknown number, and one missed call from a long foreign number, no voicemails. I Googled
  5652.  
  5653. the long foreign number. Ed must be in Hong Kong.
  5654.  
  5655. 5.24.2013
  5656.  
  5657. Wendy was home all day alone, thoughts just running circles in her brain. I feel bad for her and can only console
  5658.  
  5659. myself by thinking how Ed would handle  having  to  entertain  my  own  mother  by  himself.  Over  dinner, Wendy
  5660.  
  5661. kept asking me about Ed’s health, which I guess is understandable, given her own history of epilepsy. She said she’s
  5662.  
  5663. worried that he had another seizure, and then she started crying, and then I started crying. I’m just realizing that
  5664.  
  5665. I’m worried too. But instead of epilepsy, I’m thinking, What if he’s off having an affair? Who is she? Just try and
  5666.  
  5667. get through this
  5668. visit and have a good time. Take a puddle jumper to the Big Island. To
  5669. Kilauea, the volcano, as planned. Once Wendy goes back, reassess things.
  5670.  
  5671. 6.3.2013
  5672.  
  5673. Brought Wendy to the airport, to fly back to MD. She didn’t want to go back, but she has work. I took her as far as I
  5674.  
  5675. could go and hugged her. I didn’t want to let go of the hug. Then she got in line for security. Came home to find
  5676.  
  5677. Ed’s Skype status has changed to: “Sorry but it had to be done.” I don’t know when he changed it. Could’ve been
  5678.  
  5679. today, could’ve been last month. I just checked on Skype and happened to notice it, and I’m crazy enough to think
  5680.  
  5681. he’s sending me a message.
  5682.  
  5683. 6.7.2013
  5684.  
  5685. Woke up to a call from NSA Special Agent Megan Smith asking me to call her back about Ed. Still feeling sick with
  5686.  
  5687. fever. I had to drop off my car at the autobody shop and Tod gave me a ride back on his Ducati. When we pulled onto
  5688.  
  5689. the street I saw a white gov vehicle in the driveway and gov agents talking to our neighbors. I’ve never even met the
  5690.  
  5691. neighbors. I don’t know why but my first instinct was to tell Tod to keep driving. I ducked my head down to pretend
  5692.  
  5693. to look for something in my purse. We went to Starbucks, where Tod pointed out a newspaper, something about the NSA.
  5694.  
  5695. I tried to read the headlines but my paranoia just ran wild. Is that why the white SUV was in my driveway? Is that
  5696.  
  5697. the same SUV in the parking lot outside this Starbucks? Should I even be writing this stuff down? Went home again and
  5698.  
  5699. the SUV was gone. Took some meds and realized I hadn’t eaten. In the middle of lunch, cops showed up at the kitchen
  5700.  
  5701. window. Through the window, I could hear them radioing that someone was inside the residence. By someone they meant
  5702.  
  5703. me. I opened the front door to two agents and an HPD1 officer. They were frightening. The HPD officer searched
  5704.  
  5705. through the house as Agent Smith asked me about Ed, who’d been due back at work on May 31. The HPD officer said it
  5706.  
  5707. was suspicious when a workplace reported someone missing before the person’s spouse or girlfriend did. He was looking
  5708.  
  5709. at me like I killed Ed. He was looking around the house for his body. Agent Smith asked if she could see all the
  5710.  
  5711. computers in the house and that made me angry. I told her she could get a warrant. They left the house but camped out
  5712.  
  5713. on the corner.
  5714.  
  5715. San Diego, 6.8.2013
  5716.  
  5717. I got a little afraid that TSA wouldn’t let me leave the island. The TVs in the airport were all full of news about
  5718.  
  5719. the NSA. Once onboard the plane, I
  5720. emailed Agent Smith and the HPD Missing Persons’ detective that my grandma was having open heart surgery, requiring
  5721.  
  5722. me to be off-island for a few weeks. The surgery isn’t scheduled until the end of the month and it’s in Florida, not
  5723.  
  5724. San Diego, but this was the only excuse I could think of for getting to the mainland. It was a better excuse than
  5725.  
  5726. saying, I just need to be with my best friend Sandra and also it’s her bday. When the wheels left the ground I fell
  5727.  
  5728. into a momentary coma of relief. When I landed, I had a raging fever. Sandra picked me up. I hadn’t told her anything
  5729.  
  5730. because my paranoia was off the charts, but she could tell that something was up, that I wasn’t just visiting her for
  5731.  
  5732. her bday. She asked me if Ed and I had broken up. I answered maybe.
  5733.  
  5734. 6.9.2013
  5735.  
  5736. I got a phone call from Tiffany. She asked how I was doing and said she was worried about me. I didn’t understand.
  5737.  
  5738. She got quiet. Then she asked if I’d seen the news. She told me Ed had made a video and was on the homepage of the
  5739.  
  5740. Huffington Post. Sandra hooked up her laptop to the flatscreen. I calmly waited for the 12-minute YouTube video to
  5741.  
  5742. load. And then there he was. Real. Alive. I was shocked. He looked thin, but he sounded like his old self. The old
  5743.  
  5744. Ed, confident and strong. Like how he was before this last tough year. This was the man I loved, not the cold distant
  5745.  
  5746. ghost I’d recently been living with. Sandra hugged me and I didn’t know what to say. We stood in silence. We drove
  5747.  
  5748. out to Sandra’s bday bbq, at her cousins’ house on this pretty hill south of the city, right on the Mexican border.
  5749.  
  5750. Gorgeous place and I could barely see any of it. I was shutting down. Not knowing how to even begin to parse the
  5751.  
  5752. situation. We arrived to friendly faces that had no clue what I was going through on the inside. Ed, what have you
  5753.  
  5754. done? How can you come back from this? I was barely present for all the party small talk. My phone was blowing up
  5755.  
  5756. with calls and texts. Dad. Mom. Wendy. Driving back up to San Diego from the bbq I drove Sandra’s cousin’s Durango,
  5757.  
  5758. which Sandra needs this week to move. As we drove, a black gov SUV followed us and a police car pulled Sandra’s car
  5759.  
  5760. over, which was the car I’d come in. I just kept driving the Durango, hoping  I  knew  where  I  was  going  because
  5761.  
  5762. my  phone  was already dead from all the calls.
  5763.  
  5764. 6.10.2013
  5765.  
  5766. I knew Eileen2 was important in local politics, but I didn’t know she was also a fucking gangster. She’s been taking
  5767.  
  5768. care of everything. While we were waiting for her contacts to recommend a lawyer, I got a call from the
  5769. FBI. An agent named Chuck Landowski, who asked me what I was doing in San Diego. Eileen told me to hang up. The agent
  5770.  
  5771. called back and I picked up, even though Eileen said I shouldn’t. Agent Chuck said he didn’t want to show up at the
  5772.  
  5773. house unannounced, so he was just calling “out of courtesy” to tell us that agents were coming. This sent Eileen into
  5774.  
  5775. overdrive. She’s so goddamned tough, it’s amazing. She had me leave my phone at the house and we took her car and
  5776.  
  5777. drove around to think. Eileen got a text from a friend of hers recommending a lawyer, a guy named Jerry Farber, and
  5778.  
  5779. she handed me her phone and had me call him. A secretary picked up and I told her that my name was Lindsay Mills and
  5780.  
  5781. I was the girlfriend of Edward Snowden and needed representation. The secretary said, “Oh, let me put you right
  5782.  
  5783. through.” It was funny to hear the recognition in her voice.
  5784.  
  5785. Jerry picked up the phone and asked how he could help. I told him about the FBI calls and he asked for the agent’s
  5786.  
  5787. name, so he could talk to the feds. While we waited to hear back from Jerry, Eileen suggested we go get burner
  5788.  
  5789. phones, one to use with family and friends, one to use with Jerry. After the phones, Eileen asked which bank I kept
  5790.  
  5791. my money at. We drove to the nearest branch and she had me withdraw all of my money immediately in case the feds
  5792.  
  5793. froze my accounts. I went and took out all my life savings, split between cashier’s checks and cash. Eileen insisted
  5794.  
  5795. I split the money like that and I just followed her instructions. The bank manager asked me what I needed all that
  5796.  
  5797. cash for and I said, “Life.” I really wanted to say STFU, but I decided if I was polite I’d be forgettable. I was
  5798.  
  5799. concerned that people were going to recognize me since they were showing my face alongside Ed’s on the news. When we
  5800.  
  5801. got out of the bank I asked Eileen how she’d become such an expert at what to do when you’re in trouble. She told me,
  5802.  
  5803. very chill, “You get to know these things, as a woman. Like, you always take the money out of the bank, when you’re
  5804.  
  5805. getting a divorce.” We got some Vietnamese takeout and took it back to Eileen’s house and ate it on the floor in the
  5806.  
  5807. upstairs hallway. Eileen and Sandra plugged in their hairdryers and kept them blowing to make noise, as we whispered
  5808.  
  5809. to each other, just in case they were listening in on us.
  5810.  
  5811. Lawyer Jerry called and said we had to meet with the FBI today. Eileen drove us to his office, and on the way she
  5812.  
  5813. noticed we were being followed. It made no sense. We were going to a meeting to talk to the feds but also the feds
  5814.  
  5815. were behind us, two SUVs and a Honda Accord without plates. Eileen got the idea that maybe they weren’t the FBI. She
  5816.  
  5817. thought that
  5818. maybe they were some other agency or even a foreign government, trying to kidnap me. She started driving fast and
  5819.  
  5820. erratically, trying to lose them, but every traffic light was turning red just when we approached it. I told her that
  5821.  
  5822. she was being crazy, she had to slow down. There was a plainclothes agent by the door of Jerry’s building, he had gov
  5823.  
  5824. written all over his face. We went up in the elevator and when the door opened, three men were waiting: two of them
  5825.  
  5826. were agents, one of them was Jerry. He was the only man who shook hands with me. Jerry told Eileen that she couldn’t
  5827.  
  5828. come with us to the conference room. He’d call her when we were finished. Eileen insisted that she’d wait. She sat in
  5829.  
  5830. the lobby with an expression on her face like she was ready to wait for a million years. On the way to the conference
  5831.  
  5832. room Jerry took me aside and said he’d negotiated “limited immunity,” which I said was pretty meaningless, and he
  5833.  
  5834. didn’t disagree. He told me never to lie, and that when I didn’t know what to say, I should say IDK and let him talk.
  5835.  
  5836. Agent Mike had a grin that was a bit too kind, while Agent Leland kept looking at me like I was an experiment and he
  5837.  
  5838. was studying my reactions. Both of them creeped me out. They started with questions about me that were so basic, it
  5839.  
  5840. was like they were just trying to show me that they already knew everything about me. Of course they did. That was
  5841.  
  5842. Ed’s point. The gov always knows everything. They had me talk about the last two months, twice, and then when I was
  5843.  
  5844. finished with the “timeline,” Agent Mike asked me to start all over again from the beginning. I said, “The beginning
  5845.  
  5846. of what?” He said, “Tell me how you met.”
  5847.  
  5848. 6.11.2013
  5849.  
  5850. Coming out of the interrogation exhausted, late at night, with days of interrogations ahead of me. They wouldn’t tell
  5851.  
  5852. me how many exactly. Eileen drove us to meet Sandra for dinner at some diner, and as we left Downtown we noticed we
  5853.  
  5854. still had our tails. Eileen tried to lose them by speeding and making illegal U-turns again, and I begged her to
  5855.  
  5856. stop. I thought her driving like that just made me look worse. It made me look suspicious. But Eileen is a stubborn
  5857.  
  5858. mama bear. In the parking lot of the diner, Eileen banged on the windows of the surveillance vehicles and yelled that
  5859.  
  5860. I was cooperating, so there was no reason for them to be following. It was a little embarrassing, like when your
  5861.  
  5862. mother sticks up for you in school, but mostly I was just in awe. The nerve to go up to a vehicle with federal agents
  5863.  
  5864. and tell them off. Sandra was at a table in the back and we ordered and talked about “media exposure.” I was all over
  5865.  
  5866. the news.
  5867. Halfway through dinner, two men walked up to our table. One tall guy in a baseball hat, who had braces, and his
  5868.  
  5869. partner who was dressed like a guy going clubbing. The tall guy identified himself as Agent Chuck, the agent who’d
  5870.  
  5871. called me before. He asked to speak with me about “the driving behavior” once we’d finished eating. The moment he
  5872.  
  5873. said that we decided we were finished. The agents were out in front of the diner. Agent Chuck showed his badge and
  5874.  
  5875. told me that his main goal was my protection. He said there could be threats against my life. He tapped his jacket
  5876.  
  5877. and said if there was any danger he would take care of it, because he was on “the armed team.” It was all such macho
  5878.  
  5879. posturing or an attempt to get me to trust him, by putting me in a vulnerable position. He went on to say I was going
  5880.  
  5881. to be surveilled/followed by the FBI 24/7, for the foreseeable future, and the reckless driving Eileen was doing
  5882.  
  5883. would not be tolerated. He said agents are never supposed to talk to their assignments but he felt that, given the
  5884.  
  5885. circumstances, he had to “take the team in this direction for everyone’s safety.” He handed me a business card with
  5886.  
  5887. his contact info and said he’d be parked just outside Eileen’s house all night, and I should call him if I needed
  5888.  
  5889. him, or needed anything, for any reason. He told me I was free to go anywhere (you’re damn right, I thought), but
  5890.  
  5891. that whenever I planned to go anywhere, I should text him. He said, “Open communication will make everything easier.”
  5892.  
  5893. He said, “If you give us a heads-up, you’ll be that much safer, I promise.”
  5894.  
  5895. 6.16.2013–6.18.2013
  5896.  
  5897. Haven’t written for days. I’m so angry that I have to take a deep breath and figure out who and what exactly I’m
  5898.  
  5899. angry at, because it all just blurs together. Fucking Feds! Exhausting interrogations where they treat me like I’m
  5900.  
  5901. guilty and follow me everywhere, but what’s worse is that they’ve broken my routine. Usually I’d tear off into the
  5902.  
  5903. woods and shoot or write, but now I have a surveillance team audience wherever I go. It’s like by taking away my
  5904.  
  5905. energy and time and desire to write, they took away the last  little  bit  of  privacy I  had.  I  need  to  remember
  5906.  
  5907. everything that’s happened. First they had me bring in my laptop and copied the hard drive. They probably put a bunch
  5908.  
  5909. of bugs on it, too. Then they had copies of all my emails and chats printed out, and they were reading me things I
  5910.  
  5911. wrote to Ed and things Ed wrote to me and demanding I explain them. The FBI thinks that everything’s a code. And
  5912.  
  5913. sure, in a vacuum anyone’s messages look strange. But this is just how people who’ve been together for eight years
  5914.  
  5915. communicate! They act like they’ve never been in a relationship! They were asking questions to try to emotionally
  5916.  
  5917. exhaust me so that when
  5918. we returned to “the timeline,” my answers would change. They won’t accept I know nothing. But still, we keep
  5919.  
  5920. returning to “the timeline,” now with transcripts of all my emails and chats and my online calendar printed out in
  5921.  
  5922. front of us.
  5923.  
  5924. I would expect that gov guys would understand that Ed was always secretive about his work and I had to accept this
  5925.  
  5926. secrecy to be with him, but they don’t. They refuse to. After a while, I just broke down in tears, so the session
  5927.  
  5928. ended early. Agent Mike and Agent Leland offered to give me a ride back to Eileen’s, and before I left, Jerry took me
  5929.  
  5930. aside and said that the FBI seemed sympathetic. “They seem to have taken a liking to you, especially Mike.” He told
  5931.  
  5932. me to be careful, though, about being too casual on the ride home. “Don’t answer any of their questions.” The moment
  5933.  
  5934. we drove away Mike chimed in with, “I’m sure Jerry said not to answer any questions, but I only have a couple.” Once
  5935.  
  5936. Mike got talking, he told me that the FBI office in San Diego had a bet. Apparently, the agents had a pool going to
  5937.  
  5938. bet how long it would be before the media figured out my location. The winner would get a free martini. Later, Sandra
  5939.  
  5940. said she had her doubts. “Knowing men,” she said, “the bet’s about something else.”
  5941.  
  5942. 6.19.2013–6.20.2013
  5943.  
  5944. While the rest of the country is coming to grips with the fact that their privacy is being violated, mine’s being
  5945.  
  5946. stripped from me on a whole new level. Both things thanks to Ed. I hate sending Chuck “departure updates,” and then I
  5947.  
  5948. hate myself that I don’t have the nerve not to send them. The worst was this one night sending a “departure update”
  5949.  
  5950. that I’m leaving to meet Sandra and then getting lost on the way but not wanting to stop and ask the agents following
  5951.  
  5952. me for help, so I was just leading them around in circles. I got to thinking maybe they’d bugged Eileen’s car, so I
  5953.  
  5954. began talking aloud in the car, thinking maybe they could hear me. I wasn’t talking, I was cursing them out. I had to
  5955.  
  5956. pay Jerry, and after I did all I could think about was all the tax money being wasted on just following me to my
  5957.  
  5958. lawyer’s office and the gym. After the first two days of meetings I’d already run out of the only decent clothes I
  5959.  
  5960. had, so I went to Macy’s. Agents followed me around the women’s department. I wondered if they’d come into the
  5961.  
  5962. fitting room, too, and tell me that looks good, that doesn’t, green’s not your color. At the fitting room’s entrance
  5963.  
  5964. was a TV blaring the news and I froze when the announcer said “Edward Snowden’s girlfriend.” I fled the stall, and
  5965.  
  5966. stood in front of the screen. Watching as my photos flicked by. I whipped out my phone and made the mistake of
  5967.  
  5968. Googling myself. So many comments labeling me a stripper or whore. None of this
  5969. is me. Just like the feds, they had already decided who I was.
  5970.  
  5971. 6.22.2013–6.24.2013
  5972.  
  5973. Interrogations over, for now. But a tail still following. I left the house, happy to get back in the air at this
  5974.  
  5975. local aerial silks studio. Made it to the studio and couldn’t find street parking, but my tail did. He had to leave
  5976.  
  5977. his spot when I drove out of range, so I doubled back and stole his spot. Had a phone call with Wendy, where we both
  5978.  
  5979. said that however badly Ed hurt us, he did the right thing by trying to ensure that when he was gone, Wendy and I
  5980.  
  5981. were together. That’s why he’d invited her and been so insistent about her coming. He’d wanted us to be together in
  5982.  
  5983. Hawaii when he went public, so that we could keep each other company and give each other strength and comfort. It’s
  5984.  
  5985. so hard to be angry at someone you love. And even harder to be angry at someone you love and respect for doing the
  5986.  
  5987. right thing. Wendy and I were both in tears and then we both went quiet. I think we had the same thought, at the same
  5988.  
  5989. time. How can we talk like normal people when they’re eavesdropping on all our calls?
  5990.  
  5991. 6.25.2013
  5992.  
  5993. LAX  to  HNL.  Wore  the  copper-colored  wig  to  the  airport,  through security, and throughout the flight. Sandra
  5994.  
  5995. came with. We grabbed a gross preflight lunch in the food court. More TVs tuned to CNN, still showing Ed, and still
  5996.  
  5997. surreal, which is the new real for everyone, I think. Got a text from Agent Mike, telling me and Sandra to come see
  5998.  
  5999. him at Gate 73. Really? He came up to LA from San Diego? Gate 73 was roped off and empty. Mike was sitting waiting
  6000.  
  6001. for us on a row of chairs. He crossed his legs and showed us he was wearing an ankle pistol. More macho bullshit
  6002.  
  6003. intimidation. He had paperwork for me to sign in order for the FBI to release Ed’s car keys to me in Hawaii. He said
  6004.  
  6005. two agents would be waiting for us in Honolulu with the key. Other agents would be with us on the flight. He
  6006.  
  6007. apologized that he wasn’t coming personally. Ugh.
  6008.  
  6009. 6.29.2013
  6010.  
  6011. Been packing the house for days now with only minor interruptions from the FBI, coming by with more forms to sign.
  6012.  
  6013. It’s torture, going through everything. Finding all these little things that remind me of him. I’m like a crazy
  6014.  
  6015. woman, cleaning up, and then just gazing at his side of the bed. More  often,  though,  I  find  what’s  missing.  
  6016.  
  6017. What  the  FBI  took. Technology, yes, but also books. What they left behind were footprints, scuff marks on the
  6018.  
  6019. walls, and dust.
  6020. 6.30.2013
  6021.  
  6022. Waipahu yard sale. Three men responded to Sandra’s “take it all, best offer” Craigslisting. They showed up to rummage
  6023.  
  6024. through Ed’s life, his piano, guitar, and weight set. Anything I couldn’t bear to live with or afford to ship to the
  6025.  
  6026. mainland. The men filled their pickup with as much as they could, and then came back for a second load. To my
  6027.  
  6028. surprise, and I think to Sandra’s, too, I wasn’t too bothered by their scavenging. But the moment they were gone, the
  6029.  
  6030. second time, I lost it.
  6031.  
  6032. 7.2.2013
  6033.  
  6034. Everything got shipped today, except the futons and couch, which I’m just ditching. All that was left of Ed’s stuff
  6035.  
  6036. after the FBI raided the house fit into one small cardboard box. Some photos and his clothes, lots of mismatched
  6037.  
  6038. socks. Nothing that could be used as evidence in court, just evidence of our life together. Sandra brought some
  6039.  
  6040. lighter fluid and brought the metal trash can back around to the lanai. I dumped all of Ed’s stuff, the photos and
  6041.  
  6042. clothes, inside, and lit a book of matches on fire and tossed it in. Sandra and I sat around while it burned and the
  6043.  
  6044. smoke rose into the sky. The glow and the smoke reminded me of the trip I took with Wendy to Kilauea, the volcano on
  6045.  
  6046. the Big Island. That was just over a month ago, but it feels like years in the past. How could we have known that our
  6047.  
  6048. own lives were about to erupt? That Volcano Ed was going to destroy everything? But I remember the guide at Kilauea
  6049.  
  6050. saying that volcanoes are only destructive in the short term. In the long term, they move the world. They create
  6051.  
  6052. islands, cool the planet, and enrich the soil. Their lava flows uncontrolled and then cools and hardens. The ash they
  6053.  
  6054. shoot into the air sprinkles down as minerals, which fertilize the earth and make new life grow.
  6055. 29
  6056.  
  6057. Love and Exile
  6058.  
  6059. If at any point during your journey through this book you paused for a moment over a term you wanted to clarify or
  6060.  
  6061. investigate further and typed it into  a  search  engine—and  if  that  term  happened  to  be  in  some  way
  6062.  
  6063. suspicious, a term like XKEYSCORE, for example—then congrats: you’re in the system, a victim of your own curiosity.
  6064.  
  6065. But even if you didn’t search for anything online, it wouldn’t take much for an interested government to find out
  6066.  
  6067. that you’ve been reading this book. At the very least, it wouldn’t take much to find out that you have it, whether
  6068.  
  6069. you downloaded it illegally or bought a hard copy online or purchased it at a brick-and-mortar store with a credit
  6070.  
  6071. card.
  6072.  
  6073. All you wanted to do was to read—to take part in that most intensely intimate human act, the joining of minds through
  6074.  
  6075. language. But that was more than enough. Your natural desire to connect with the world was all the world needed to
  6076.  
  6077. connect your living, breathing self to a series of globally unique identifiers, such  as  your  email,  your  phone,
  6078.  
  6079. and  the  IP  address of  your computer. By creating a world-spanning system that tracked these identifiers across
  6080.  
  6081. every available channel of electronic communications, the American Intelligence Community gave itself the power to
  6082.  
  6083. record and store for perpetuity the data of your life.
  6084.  
  6085. And that was only the beginning. Because once America’s spy agencies had proven to themselves that it was possible to
  6086.  
  6087. passively collect all of your communications,  they  started  actively  tampering  with  them,  too.  By poisoning
  6088.  
  6089. the messages that were headed your way with snippets of attack code, or “exploits,” they developed the ability to
  6090.  
  6091. gain possession of more than just your words. Now they were capable of winning total control of your whole device,
  6092.  
  6093. including its camera and microphone. Which means that if you’re reading this now—this sentence—on any sort of modern
  6094.  
  6095. machine, like a smartphone or tablet, they can follow along and read you. They can tell how quickly or slowly you
  6096.  
  6097. turn the pages and whether you read the chapters consecutively or skip around. And they’ll gladly endure looking up
  6098.  
  6099. your nostrils and watching you move your lips as you read, so long as it gets them the data they want and lets them
  6100.  
  6101. positively identify you.
  6102.  
  6103. This is  the result of  two decades of  unchecked innovation—the final product of a political and professional class
  6104.  
  6105. that dreams itself your master. No matter the place, no matter the time, and no matter what you do, your life has
  6106. now become an open book.
  6107.  
  6108.  
  6109.  
  6110. IF MASS  SURVEILLANCE  was, by definition, a constant presence in daily life, then I wanted the dangers it posed, and
  6111.  
  6112. the damage it had already done, to be a constant presence too. Through my disclosures to the press, I wanted to make
  6113.  
  6114. this system known, its existence a fact that my country, and the world, could not ignore.In the years since 2013,
  6115.  
  6116. awareness has grown, both in scope
  6117. and  subtlety.  But  in  this  social  media  age,  we  have  always  to  remind
  6118. ourselves: awareness alone is not enough.
  6119.  
  6120. In America, the initial press reports on the disclosures started a “national conversation,” as President Obama
  6121.  
  6122. himself conceded. While I appreciated the sentiment, I remember wishing that he had noted that what made it
  6123.  
  6124. “national,” what made it a “conversation,” was that for the first time the American public was informed enough to
  6125.  
  6126. have a voice.
  6127.  
  6128. The revelations of  2013 particularly roused Congress, both houses of which launched multiple investigations into NSA
  6129.  
  6130. abuses. Those investigations concluded that the agency had repeatedly lied regarding the nature and efficacy of its
  6131.  
  6132. mass surveillance programs, even to the most highly cleared Intelligence Committee legislators.
  6133.  
  6134. In 2015, a federal court of appeals ruled in the matter of ACLU v. Clapper, a suit challenging the legality of the
  6135.  
  6136. NSA’s phone records collection program. The court ruled that the NSA’s program had violated even the loose standards
  6137.  
  6138. of the Patriot Act and, moreover, was most probably unconstitutional. The ruling focused on the NSA’s interpretation
  6139.  
  6140. of Section 215 of the Patriot Act, which allowed the government to demand from third parties “any tangible thing”
  6141.  
  6142. that it deemed “relevant” to foreign intelligence and terror investigations. In the court’s opinion, the government’s
  6143.  
  6144. definition of “relevant” was so expansive as to be virtually meaningless. To call some collected data “relevant”
  6145.  
  6146. merely because it might become relevant at some amorphous point in the future was “unprecedented and unwarranted.”
  6147.  
  6148. The court’s refusal to accept the government’s definition caused not a few legal scholars to interpret the ruling as
  6149.  
  6150. casting doubt on the legitimacy of all government bulk-collection programs predicated on this doctrine of future
  6151.  
  6152. relevance. In the wake of this opinion, Congress passed the USA Freedom Act, which amended Section 215 to explicitly
  6153.  
  6154. prohibit the bulk collection of Americans’ phone records. Going forward, those records would remain where they
  6155.  
  6156. originally had been, in the private control of the telecoms, and the government would have to formally request
  6157.  
  6158. specific ones with a FISC warrant
  6159. in hand if it wanted to access them.
  6160.  
  6161. ACLU v. Clapper was a notable victory, to be sure. A crucial precedent was set. The court declared that the American
  6162.  
  6163. public had standing: American citizens  had  the  right  to  stand  in  a  court  of  law  and  challenge  the
  6164.  
  6165. government’s officially secret system of mass surveillance. But as the numerous other cases that resulted from the
  6166.  
  6167. disclosures continue to wend their slow and deliberate ways through the courts, it becomes ever clearer to me that
  6168.  
  6169. the American legal resistance to mass surveillance was just the beta phase of what has to be an international
  6170.  
  6171. opposition movement, fully implemented across both governments and private sector.
  6172.  
  6173. The reaction of technocapitalists to the disclosures was immediate and forceful, proving once again that with extreme
  6174.  
  6175. hazards come unlikely allies. The documents revealed an NSA so determined to pursue any and all information it
  6176.  
  6177. perceived as being deliberately kept from it that it had undermined the basic encryption protocols of the Internet—
  6178.  
  6179. making citizens’ financial and  medical records, for  example, more  vulnerable, and  in  the process harming
  6180.  
  6181. businesses that relied on their customers entrusting them with such sensitive data. In response, Apple adopted strong
  6182.  
  6183. default encryption for its iPhones and iPads, and Google followed suit for its Android products and Chromebooks. But
  6184.  
  6185. perhaps the most important private-sector change occurred when businesses throughout the world set about switching
  6186.  
  6187. their website platforms, replacing http (Hypertext Transfer Protocol) with the encrypted https (the S signifies
  6188.  
  6189. security), which helps prevent third-party interception of Web traffic. The year 2016 was a landmark in tech history,
  6190.  
  6191. the first  year  since  the  invention of  the  Internet  that  more  Web  traffic  was encrypted than unencrypted.
  6192.  
  6193. The Internet is certainly more secure now than it was in 2013, especially given the sudden global recognition of the
  6194.  
  6195. need for encrypted tools and apps. I’ve been involved with the design and creation of a few of these myself, through
  6196.  
  6197. my work heading the Freedom of the Press Foundation, a nonprofit organization dedicated to protecting and empowering
  6198.  
  6199. public-interest journalism in the new millennium. A major part of the organization’s brief is to preserve and
  6200.  
  6201. strengthen First and Fourth Amendment rights through the development of encryption technologies. To that end, the FPF
  6202.  
  6203. financially supports Signal, an encrypted texting and calling platform created by Open Whisper Systems, and develops
  6204.  
  6205. SecureDrop (originally coded by the late Aaron Swartz), an open-source submission system that allows media
  6206.  
  6207. organizations to securely accept documents from anonymous whistleblowers and other sources. Today, SecureDrop is
  6208.  
  6209. available in ten languages and used
  6210. by more than seventy media organizations around the world, including the
  6211. New York Times, the Washington Post, the Guardian, and the New Yorker.
  6212.  
  6213. In a perfect world, which is to say in a world that doesn’t exist, just laws would make these tools obsolete. But in
  6214.  
  6215. the only world we have, they have never been more necessary. A change in the law is infinitely more difficult to
  6216.  
  6217. achieve than a  change in  a  technological standard, and as  long as  legal innovation lags behind technological
  6218.  
  6219. innovation institutions will seek to abuse that disparity in the furtherance of their interests. It falls to
  6220.  
  6221. independent, open- source hardware and software developers to close that gap by providing the vital civil liberties
  6222.  
  6223. protections that the law may be unable, or unwilling, to guarantee.
  6224.  
  6225. In my current situation, I’m constantly reminded of the fact that the law is country-specific, whereas technology is
  6226.  
  6227. not. Every nation has its own legal code but the same computer code. Technology crosses borders and carries almost  
  6228.  
  6229. every  passport.  As  the  years  go  by,  it  has  become  increasingly apparent to me that legislatively reforming
  6230.  
  6231. the surveillance regime of the country of my birth won’t necessarily help a journalist or dissident in the country of
  6232.  
  6233. my exile, but an encrypted smartphone might.
  6234.  
  6235.  
  6236.  
  6237. INTERNATIONALLY,  THE  DISCLOSURES helped to revive debates about surveillance in places with long histories of
  6238.  
  6239. abuses. The countries whose citizenries were most opposed to American mass surveillance were those whose governments
  6240.  
  6241. had most cooperated with it, from the Five Eyes nations (especially the UK, whose GCHQ remains the NSA’s primary
  6242.  
  6243. partner) to
  6244. nations of the European Union. Germany, which has done much to reckon
  6245. with its Nazi and Communist past, provides the primary example of this disjunction. Its citizens and legislators were
  6246.  
  6247. appalled to learn that the NSA was surveilling German communications and had even targeted Chancellor Angela Merkel’s
  6248.  
  6249. smartphone. At the same time, the BND, Germany’s premier intelligence agency, had collaborated with the NSA in
  6250.  
  6251. numerous operations, even carrying out certain proxy surveillance initiatives that the NSA was unable or unwilling to
  6252.  
  6253. undertake on its own.
  6254.  
  6255. Nearly every country in the world found itself in a similar bind: its citizens outraged, its government complicit.
  6256.  
  6257. Any elected government that relies on surveillance to maintain control of a citizenry that regards surveillance as
  6258.  
  6259. anathema to  democracy has  effectively ceased  to  be  a  democracy. Such cognitive dissonance on a geopolitical
  6260.  
  6261. scale has helped to bring individual privacy concerns back into the international dialogue within the context of
  6262. human rights.
  6263.  
  6264. For the first time since the end of World War II, liberal democratic governments throughout the world were discussing
  6265.  
  6266. privacy as the natural, inborn right of every man, woman, and child. In doing so they were harking back to the 1948
  6267.  
  6268. UN Universal Declaration of Human Rights, whose Article
  6269. 12 states: “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor
  6270.  
  6271. to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such
  6272.  
  6273. interference or attacks.” Like all  UN  declarations, this  aspirational document was  never enforceable, but it had
  6274.  
  6275. been intended to inculcate a new basis for transnational civil  liberties  in  a  world  that  had  just  survived  
  6276.  
  6277. nuclear  atrocities  and attempted genocides and was facing an unprecedented surfeit of refugees and the stateless.
  6278.  
  6279. The EU, still under the sway of this postwar universalist idealism, now became the  first  transnational body  to  
  6280.  
  6281. put  these  principles into  practice, establishing a new directive that seeks to standardize whistleblower
  6282.  
  6283. protections across its member states, along with a standardized legal framework for privacy protection. In 2016, the
  6284.  
  6285. EU Parliament passed the General Data Protection Regulation (GDPR), the most significant effort yet made to forestall
  6286.  
  6287. the incursions of technological hegemony—which the EU tends to regard, not unfairly, as an extension of American
  6288.  
  6289. hegemony.
  6290.  
  6291. The  GDPR treats the  citizens of  the  European Union, whom it  calls “natural persons,” as also being “data
  6292.  
  6293. subjects”—that is, people who generate personally  identifiable  data.  In  the  US,  data  is  usually  regarded  as
  6294.  
  6295.  the property of whoever collects it. But the EU posits data as the property of the person it represents, which
  6296.  
  6297. allows it to treat our data subjecthood as deserving of civil liberties protections.
  6298.  
  6299. The GDPR is undoubtedly a major legal advance, but even its transnationalism is too parochial: the Internet is
  6300.  
  6301. global. Our natural personhood will never be legally synonymous with our data subjecthood, not least because the
  6302.  
  6303. former lives in one place at a time while the latter lives in many places simultaneously.
  6304.  
  6305. Today, no matter who you are, or where you are, bodily, physically, you are also elsewhere, abroad—multiple selves
  6306.  
  6307. wandering along the signal paths, with no country to call your own, and yet beholden to the laws of every country
  6308.  
  6309. through which you pass. The records of a life lived in Geneva dwell in the Beltway. The photos of a wedding in Tokyo
  6310.  
  6311. are on a honeymoon in Sydney. The videos of a funeral in Varanasi are up on Apple’s iCloud, which
  6312. is partially located in my home state of North Carolina and partially scattered across the partner servers of Amazon,
  6313.  
  6314. Google, Microsoft, and Oracle, throughout the EU, UK, South Korea, Singapore, Taiwan, and China.
  6315.  
  6316. Our data wanders far and wide. Our data wanders endlessly.
  6317.  
  6318. We start generating this data before we are born, when technologies detect us in utero, and our data will continue to
  6319.  
  6320. proliferate even after we die. Of course, our consciously created memories, the records that we choose to keep,
  6321.  
  6322. comprise just a sliver of the information that has been wrung out of our lives
  6323. —most of it unconsciously, or without our consent—by business and government surveillance. We are the first people in
  6324.  
  6325. the history of the planet for whom this is true, the first people to be burdened with data immortality, the fact that
  6326.  
  6327. our collected records might have an eternal existence. This is why we have a special duty. We must ensure that these
  6328.  
  6329. records of our pasts can’t be turned against us, or turned against our children.
  6330.  
  6331. Today, the liberty that we call privacy is being championed by a new generation. Not yet born on 9/11, they have
  6332.  
  6333. spent their entire lives under the omnipresent  specter  of  this  surveillance.  These  young  people  who  have
  6334.  
  6335. known no other world have dedicated themselves to imagining one, and it’s their political creativity and
  6336.  
  6337. technological ingenuity that give me hope.
  6338.  
  6339. Still, if we don’t act to reclaim our data now, our children might not be able  to  do  so.  Then  they,  and  their  
  6340.  
  6341. children, will  be  trapped too—each successive generation forced to live under the data specter of the previous one,
  6342.  
  6343. subject to a mass aggregation of information whose potential for societal control and human manipulation exceeds not
  6344.  
  6345. just the restraints of the law but the limits of the imagination.
  6346.  
  6347. Who among us can predict the future? Who would dare to? The answer to the first question is no one, really, and the
  6348.  
  6349. answer to the second is everyone, especially every government and business on the planet. This is what that data of
  6350.  
  6351. ours is used for. Algorithms analyze it for patterns of established behavior in order to extrapolate behaviors to
  6352.  
  6353. come, a type of digital prophecy that’s only slightly more accurate than analog methods like palm reading. Once you
  6354.  
  6355. go digging into the actual technical mechanisms by which predictability is calculated, you come to understand that
  6356.  
  6357. its science is, in fact, anti-scientific, and fatally misnamed: predictability is actually manipulation. A website
  6358.  
  6359. that tells you that because you liked this book you might also like books by James Clapper or Michael Hayden isn’t
  6360.  
  6361. offering an educated guess as much as a mechanism of subtle coercion.
  6362. We can’t allow ourselves to be used in this way, to be used against the future. We can’t permit our data to be used
  6363.  
  6364. to sell us the very things that must not be sold, such as journalism. If we do, the journalism we get will be merely
  6365.  
  6366. the journalism we want, or the journalism that the powerful want us to have, not  the  honest  collective  
  6367.  
  6368. conversation that’s  necessary.  We  can’t  let  the godlike surveillance we’re under be used to “calculate” our
  6369.  
  6370. citizenship scores, or to “predict” our criminal activity; to tell us what kind of education we can have, or what
  6371.  
  6372. kind of job we can have, or whether we can have an education or a job at all; to discriminate against us based on our
  6373.  
  6374. financial, legal, and medical histories, not to mention our ethnicity or race, which are constructs that data often
  6375.  
  6376. assumes or imposes. And as for our most intimate data, our genetic information: if we allow it to be used to identify
  6377.  
  6378. us, then it will be used to victimize us, even to modify us—to remake the very essence of our humanity in the image
  6379.  
  6380. of the technology that seeks its control.
  6381.  
  6382. Of course, all of the above has already happened.
  6383.  
  6384.  
  6385.  
  6386. EXILE: NOT A day has passed since August 1, 2013, in which I don’t recall that “exile” was what my teenage self used
  6387.  
  6388. to call getting booted off-line. The Wi- Fi died? Exile. I’m out of signal range? Exile. The self who used to say
  6389.  
  6390. that now seems so young to me. He seems so distant.
  6391.  
  6392. When people ask me what my life is like now, I tend to answer that it’s a lot like theirs in that I spend a lot of
  6393.  
  6394. time in front of the computer—reading, writing, interacting. From what the press likes to describe as an “undisclosed
  6395.  
  6396. location”—which is really just whatever two-bedroom apartment in Moscow I happen to be renting—I beam myself onto
  6397.  
  6398. stages around the world, speaking about  the  protection of  civil  liberties  in  the  digital  age  to  audiences
  6399.  
  6400. of students, scholars, lawmakers, and technologists.
  6401.  
  6402. Some days I take virtual meetings with my fellow board members at the Freedom of the Press Foundation, or talk with
  6403.  
  6404. my European legal team, led by Wolfgang Kaleck, at  the European Center for Constitutional and Human Rights. Other
  6405.  
  6406. days, I just pick up some Burger King—I know where my loyalties lie—and play games I have to pirate because I can no
  6407.  
  6408. longer use credit cards. One fixture of my existence is my daily check-in with my American lawyer, confidant, and
  6409.  
  6410. all-around consigliere Ben Wizner at the ACLU, who has been my guide to the world as it is and puts up with my
  6411.  
  6412. musings about the world as it should be.
  6413.  
  6414. That’s my life. It got significantly brighter during the freezing winter of
  6415. 2014, when Lindsay came to visit—the first time I’d seen her since Hawaii. I tried not to expect too much, because I
  6416.  
  6417. knew I didn’t deserve the chance; the only thing I deserved was a slap in the face. But when I opened the door, she
  6418.  
  6419. placed her hand on my cheek and I told her I loved her.
  6420.  
  6421. “Hush,” she said, “I know.”
  6422.  
  6423. We held each other in silence, each breath like a pledge to make up for lost time.
  6424.  
  6425. From that moment, my world was hers. Previously, I’d been content to hang around indoors—indeed, that was my
  6426.  
  6427. preference before I was in Russia
  6428. —but Lindsay was insistent: she’d never been to Russia and now we were going to be tourists together.
  6429.  
  6430. My Russian lawyer, Anatoly Kucherena, who helped me get asylum in the country—he was the only lawyer who had the
  6431.  
  6432. foresight to show up at the airport with a translator—is a cultured and resourceful man, and he proved as adept at
  6433.  
  6434. obtaining last-minute tickets to the opera as he is at navigating my legal issues. He helped arrange two box seats at
  6435.  
  6436. the Bolshoi Theater, so Lindsay and I got dressed and went, though I have to admit I was wary. There were so many
  6437.  
  6438. people, all packed so tightly into a hall. Lindsay could sense my growing unease. As the lights dimmed and the
  6439.  
  6440. curtain rose, she leaned over, nudged me in the ribs, and whispered, “None of these people are here for you. They’re
  6441.  
  6442. here for this.”
  6443.  
  6444. Lindsay and I also spent time at some of Moscow’s museums. The Tretyakov Gallery contains one of the world’s richest
  6445.  
  6446. collection of Russian Orthodox icon paintings. The artists who made these paintings for the Church were essentially
  6447.  
  6448. contractors, I thought, and so were typically not allowed to sign  their  names  to  their  handiwork, or  preferred  
  6449.  
  6450. not  to.  The  time  and tradition that fostered these works was not given much to recognizing individual
  6451.  
  6452. achievement. As Lindsay and I stood in front of one of the icons, a young tourist, a teenage girl, suddenly stepped
  6453.  
  6454. between us. This wasn’t the first  time  I  was  recognized  in  public,  but  given  Lindsay’s  presence,  it
  6455.  
  6456. certainly threatened to  be  the  most headline-worthy. In  German-accented English, the girl asked whether she could
  6457.  
  6458. take a selfie with us. I’m not sure what explains my reaction—maybe it was this German girl’s shy and polite way of
  6459.  
  6460. asking, or maybe it was Lindsay’s always mood-improving, live-and- let-live presence—but without hesitation, for
  6461.  
  6462. once, I agreed. Lindsay smiled as the girl posed between us and took a photo. Then, after a few sweet words of
  6463.  
  6464. support, she departed.
  6465. I dragged Lindsay out of the museum a moment later. I was afraid that if the girl posted the photo to social media we
  6466.  
  6467. could be just minutes away from unwanted attention. I feel foolish now for thinking that. I kept nervously checking
  6468.  
  6469. online, but the photo didn’t appear. Not that day, and not the day after. As far as I can tell, it was never shared—
  6470.  
  6471. just kept as a private memory of a personal moment.
  6472.  
  6473.  
  6474.  
  6475. WHENEVER I GO outside, I try to change my appearance a bit. Maybe I get rid of my beard, maybe I wear different
  6476.  
  6477. glasses. I never liked the cold until I realized that a hat and scarf provide the world’s most convenient and
  6478.  
  6479. inconspicuous anonymity. I change the rhythm and pace of my walk, and, contrary to the sage advice of my mother, I
  6480.  
  6481. look away from traffic when
  6482. crossing the street, which is why I’ve never been caught on any of the car
  6483. dashcams that are ubiquitous here. Passing buildings equipped with CCTV I keep my head down, so that no one will see
  6484.  
  6485. me as I’m usually seen online— head-on. I used to worry about the bus and metro, but nowadays everybody’s too busy
  6486.  
  6487. staring at their phones to give me a second glance. If I take a cab, I’ll have it pick me up at a bus or metro stop a
  6488.  
  6489. few blocks away from where I live and drop me off at an address a few blocks away from where I’m going.
  6490.  
  6491. Today, I’m taking the long way around this vast strange city, trying to find some roses. Red roses, white roses, even
  6492.  
  6493. blue violets. Any flowers I can find. I don’t know the Russian names of any of them. I just grunt and point.
  6494.  
  6495. Lindsay’s Russian is better than mine. She also laughs more easily and is more patient and generous and kind.
  6496.  
  6497. Tonight, we’re celebrating our anniversary. Lindsay moved out here three years ago, and two years ago today, we
  6498.  
  6499. married.
  6500. NOTES
  6501.  
  6502. 1. Hawaii Police Department
  6503.  
  6504. 2. Sandra’s mother
  6505. ACKNOWLEDGMENTS
  6506.  
  6507. In May 2013, as I sat in that hotel room in Hong Kong wondering whether any journalists would show up to meet me, I’d
  6508.  
  6509. never felt more alone. Six years  later,  I  find  myself  in  quite  the  opposite  situation,  having  been
  6510.  
  6511. welcomed   into   an   extraordinary   and   ever-expanding   global   tribe   of journalists, lawyers,
  6512.  
  6513. technologists, and human rights advocates to whom I owe an incalculable debt. At the conclusion of a book, it’s
  6514.  
  6515. traditional for an author to thank the people who helped make the book possible, and I certainly intend to do that
  6516.  
  6517. here, but given the circumstances I’d be remiss if I didn’t also thank the people who have helped make my life
  6518.  
  6519. possible—by advocating for my freedom and, especially, by working ceaselessly and selflessly to protect our open
  6520.  
  6521. societies as well as the technologies that have brought us, and that bring everyone, together.
  6522.  
  6523. Over the last nine months, Joshua Cohen has taken me to writing school, helping to transform my rambling
  6524.  
  6525. reminiscences and capsule manifestos into a book that I hope he can be proud of.
  6526.  
  6527. Chris Parris-Lamb proved himself a shrewd and patient agent, while Sam Nicholson provided astute and clarifying edits
  6528.  
  6529. and support, as did the entire team at Metropolitan, from Gillian Blake to Sara Bershtel, Riva Hocherman, and Grigory
  6530.  
  6531. Tovbis.
  6532.  
  6533. The success of this team is a testament to its members’ talents, and to the talents of the man who assembled it—Ben
  6534.  
  6535. Wizner, my lawyer, and, I am honored to say, my friend.
  6536.  
  6537. In the same vein, I’d like to thank my international team of lawyers who have worked tirelessly to keep me free. I
  6538.  
  6539. would also like to thank Anthony Romero, the ACLU’s director, who embraced my cause at a time of considerable
  6540.  
  6541. political risk for the organization, along with the other ACLU staff who have helped me throughout the years,
  6542.  
  6543. including Bennett Stein, Nicola Morrow, Noa Yachot, and Daniel Kahn Gillmor.
  6544.  
  6545. Additionally, I’d like to acknowledge the work of Bob Walker, Jan Tavitian, and their team at the American Program
  6546.  
  6547. Bureau, who have allowed me to make a living by spreading my message to new audiences around the world.
  6548.  
  6549. Trevor Timm and my fellow board members at the Freedom of the Press Foundation have provided the space and resources
  6550.  
  6551. for me to return to my true passion, engineering for social good. I am especially grateful to our CTO
  6552. Micah Lee, former FPF operations manager Emmanuel Morales, and current FPF board member Daniel Ellsberg, who has
  6553.  
  6554. given the world the model of his rectitude, and given me the warmth and candor of his friendship.
  6555.  
  6556. This book was written using free and open-source software. I would like to  thank  the  Qubes  Project,  the  Tor  
  6557.  
  6558. Project,  and  the  Free  Software Foundation.
  6559.  
  6560. My earliest intimations of what it was like to write against deadline came from the masters, Glenn Greenwald, Laura
  6561.  
  6562. Poitras, Ewen Macaskill, and Bart Gellman, whose professionalism is informed by a passionate integrity. Having been
  6563.  
  6564. edited now myself, I have gained a new appreciation of their editors, who refused to be intimidated and took the
  6565.  
  6566. risks that gave meaning to their principles.
  6567.  
  6568. My deepest gratitude is reserved for Sarah Harrison.
  6569.  
  6570. And my heart belongs to my family, extended and immediate—to my father, Lon, to my mother, Wendy, and to my brilliant
  6571.  
  6572. sister, Jessica.
  6573.  
  6574. The only way I can end this book is the way I began it: with a dedication to Lindsay, whose love makes life out of
  6575.  
  6576. exile.
  6577. ABOUT THE AUTHOR
  6578.  
  6579.  
  6580. Edward Snowden was born in Elizabeth City, North Carolina, and grew up in the shadow of Fort Meade.  A systems  
  6581.  
  6582. engineer  by training,  he served  as an officer  of the Central Intelligence Agency and worked as a contractor for
  6583.  
  6584. the National Security Agency. He has received numerous awards for his public service, including the Right Livelihood
  6585.  
  6586. Award, the German Whistleblower Prize, the Ridenhour Prize for Truth-Telling, and the Carl von Ossietzky Medal from
  6587.  
  6588. the International League of Human Rights. Currently, he serves as president of the board of directors of the Freedom
  6589.  
  6590. of the Press Foundation.
  6591.  
  6592.    
  6593.  
  6594.  
  6595.  
  6596. Title Page Dedication Preface
  6597. PART ONE
  6598. CONTENTS
  6599.  
  6600. 1. Looking Through the Window
  6601.  
  6602. 2. The Invisible Wall
  6603.  
  6604. 3. Beltway Boy
  6605.  
  6606. 4. American Online
  6607.  
  6608. 5. Hacking
  6609.  
  6610. 6. Incomplete
  6611.  
  6612. 7. 9/11
  6613.  
  6614. 8. 9/12
  6615.  
  6616. 9. X-Rays
  6617.  
  6618. 10. Cleared and in Love
  6619.  
  6620. PART TWO
  6621.  
  6622. 11. The System
  6623.  
  6624. 12. Homo contractus
  6625.  
  6626. 13. Indoc
  6627.  
  6628. 14. The Count of the Hill
  6629.  
  6630. 15. Geneva
  6631.  
  6632. 16. Tokyo
  6633.  
  6634. 17. Home on the Cloud
  6635.  
  6636. 18. On the Couch
  6637.  
  6638. PART THREE
  6639.  
  6640. 19. The Tunnel
  6641.  
  6642. 20. Heartbeat
  6643. 21. Whistleblowing
  6644.  
  6645. 22. Fourth Estate
  6646.  
  6647. 23. Read, Write, Execute
  6648.  
  6649. 24. Encrypt
  6650.  
  6651. 25. The Boy
  6652.  
  6653. 26. Hong Kong
  6654.  
  6655. 27. Moscow
  6656.  
  6657. 28. From the Diaries of Lindsay Mills
  6658.  
  6659. 29. Love and Exile Notes Acknowledgments About the Author Copyright
  6660. First published 2019 by Metropolitan Books, Henry Holt and Company, LLC First published in the UK 2019 by Macmillan
  6661. This electronic edition first published in the UK 2019 by Macmillan an imprint of Pan Macmillan 20 New Wharf Road,
  6662.  
  6663. London N1 9RR Associated companies throughout the world www.panmacmillan.com
  6664. ISBN 978-1-5290-3567-4
  6665.  
  6666. Copyright © Edward Snowden 2019. Jacket design by Rodrigo Corral Jacket photograph © Platon
  6667. The right of Edward Snowden to be identified as the author of this work has been asserted by him in accordance with
  6668.  
  6669. the Copyright, Designs and Patents Act 1988.
  6670.  
  6671. You may not copy, store, distribute, transmit, reproduce or otherwise make available this publication (or any part of
  6672.  
  6673. it) in any form, or by any means (electronic, digital, optical, mechanical, photocopying, recording or otherwise),
  6674.  
  6675. without the prior written permission of the publisher. Any person who does any unauthorized act in relation to this
  6676.  
  6677. publication may be liable to criminal prosecution and civil claims for damage.
  6678.  
  6679. A CIP catalogue record for this book is available from the British Library.
  6680.  
  6681. Visit www.panmacmillan.com to read more about all our books and to buy them. You will also find features, author
  6682.  
  6683. interviews and news of any author events, and you can sign up for e-newsletters so that you’re always first to hear
  6684.  
  6685. about our new releases.
RAW Paste Data