| | Epst_9780451494566_2p_all_rtzindd 1 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019477

ALSO BY EDWARD JAY EPSTEIN The Annals of Unsolved Crime Three Days in May: Sex, Surveillance, and DSK The Hollywood Economist: The Hidden Financial Reality Behind the Movies The Big Picture: The New Logic of Money and Power in Hollywood Dossier: The Secret History of Armand Hammer Deception: The Invisible War Between the KGB and the CIA The Rise and Fall of Diamonds: The Shattering of a Brilliant Ilusion Cartel Legend: The Secret World of Lee Harvey Oswald Agency of Fear: Opiates and Political Power in America Between Fact and Fiction: The Problem of Journalism News from Nowhere: Television and the News Counterplot Inquest: The Warren Commission and the Establishment of Truth | | Epst_9780451494566_2p_all_rt.zindd 2 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019478

HOW AMERICA LOST ITS SECRETS | | Epst_9780451494566_2p_all_rtzindd 1 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019479

| | Epst_9780451494566_2p_all_rt.zindd 2 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019480

HOW AMERICA LOST ITS SECRETS Edward Snowden, the Man and the Theft Edward Jay Epstein AR ALERED A. KNOPE NEW YORK | 2017 | | Epst_9780451494566_2p_all_rt.zindd 3 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019481

THIS IS A BORZOTI BOOK PUBLISHED BY ALFRED A. KNOPF Copyright @ 2017 by E.J. E. Publications, Ltd. All rights reserved. Published in the United States by Alfred A. Knopf, a division of Penguin Random House LLC, New York, and distributed in Canada by Random House of Canada, a division of Penguin Random House Canada Limited, Toronto. www.aaknopf.com Knopf, Borzoi Books, and the colophon are registered trademarks of Penguin Random House LLC. Library of Congress Cataloging-in-Publication Data [to come] Jacket photograph by TK Jacket design by TK Manufactured in the United States of America First Edition Epst_9780451494566_2p_all_rt.zindd 4 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019482

This book is dedicated to the memory of a wise teacher, James Q. Wilson (1931-2012) | | Epst_9780451494566_2p_all_rt.zindd 5 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019483

| | Epst_9780451494566_2p_all_rt.zindd 6 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019484

There are certain persons who ... have a perfect right to commit breaches of morality and crimes, and... the law is not for them. —FYODOR DOSTOYEVSRY, Crime and Punishment | | Epst_9780451494566_2p_all_rt.zindd 7 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019485

| | Epst_9780451494566_2p_all_rt.zindd 8 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019486

Contents Prologue Snowden’s Trail: Hong Kong, 2014 000 part onE SNOWDEN’S ARC CHAPTER 1 CHAPTER 2 CHAPTER 3 CHAPTER 4 CHAPTER 5 CHAPTER 6 CHAPTER 7 CHAPTER 8 CHAPTER 9 Tinker 15 Secret Agent 22 Contractor 28 Thief 38 Crossing the Rubicon 44 Hacktivist 49 String Puller 59 Raider of the Inner Sanctum 73 Escape Artist 80 CHAPTER 10 Whistle-blower 88 CHAPTER 11 Enter Assange 98 CHAPTER 12 Fugitive 104 part two THE INTELLIGENCE CRISIS CHAPTER 13 The Great Divide 113 cuapter 14 The Crime Scene Investigation 133 | | Epst_9780451494566_2p all_r1.z.indd 9 HOUSE_OVERSIGHT_019487 9/29/16 5:51PM | |

x | Contents CHAPTER 15 Did Snowden Act Alone? 146 carter 16 The Question of When 156 carter 17 The Keys to the Kingdom Are Missing 168 CHAPTER 18 The Unheeded Warning 185 part THREE |THE GAME OF NATIONS CHAPTER 19 The Rise of the NSA 195 carter 20 The NSA’s Back Door 207 cHapter 21 The Russians Are Coming 217 CHAPTER 22 The Chinese Puzzle 231 cuapter 23 A Single Point of Failure 238 part Four MOSCOW CALLING CHAPTER 24 Off to Moscow 247 cuarter 25 Through the Looking Glass 254 CHAPTER 26 The Handler 261 part Five CONCLUSIONS: WALKING THE CAT BACK CHAPTER 27 Snowden’s Choices 271 cuarter 28 The Espionage Source 281 cHapter 29 The “War on Terror” After Snowden 287 | | Epst_9780451494566_2p_all_r1.z.indd 10 Epilogue The Snowden Effect 295 Acknowledgments 301 Notes 303 Selected Bibliography 325 Index 329 @ 929/16 5:51 PM | | HOUSE_OVERSIGHT_019488

HOW AMERICA LOST ITS SECRETS | | Epst_9780451494566_2p_all_rtzindd 1 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019489

| | Epst_9780451494566_2p_all_rt.zindd 2 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019490

Prologue Snowden’s Trail: Hong Kong, 2014 T" NATIONAL SECURITY AGENCY, or, as it is now commonly called, the NSA, was created on October 24, 1952, in such a tight cocoon of secrecy that even the presidential order creating it was classified top secret. When journalists asked questions about this new agency, Washington officials jokingly told them that the initials NSA stood for “No Such Agency.” The reason for this extraordinary stealth is that the NSA is involved in a very sensitive enterprise. Its job is to intercept, decode, and analyze foreign electronic com- munications transmitted around the globe over copper wires, fiber- optic cable, satellite, microwave relays, cell phone towers, wireless transmissions, and the Internet for specified intelligence purposes. In intelligence jargon, its product is called COMINT, which stands for communications intelligence. Because this form of intelligence gath- ering is most effective when the NSA’s targets are unaware of the state-of-the-art tools the NSA uses to break into their computers and telecommunications channels to first intercept and then decrypt | | Epst_9780451494566_2p_all_rt.zindd 3 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019491

4 | HOW AMERICA LOST ITS SECRETS their secret messages, the NSA goes to extraordinary lengths to keep them secret. Draconian laws protect this secrecy. In the first week of June 2013, the NSA learned that there had been a massive breach. Thousands of secret files bearing on com- munications intelligence had been stolen from a heavily guarded regional base in Oahu, Hawaii. The suspect was Edward Snowden, a twenty-nine-year-old civil- ian analyst at that base, who had fled to Hong Kong before the breach was discovered. According to a three-count criminal com- plaint filed by federal prosecutors in the Eastern District of Vir- ginia, Snowden had stolen government property and violated the Espionage Act by the unauthorized and willful communication of national defense information to an unauthorized person. He also likely violated the Computer Fraud and Abuse Act by entering com- puter systems illicitly. This was not a whodunit mystery. On June 9, 2013, in an extraor- dinary twelve-minute video made in a cramped hotel room in Hong Kong, Snowden identified himself as the person who had taken the @ NSA documents. Watching the video, the world saw a shy, awk- @ ward, and sympathetic-looking man wearing a rumpled shirt, rim- less glasses, and a computer-geek haircut, passionately speaking out against what he termed the NSA’s violations of the law and, in a shaky voice, expressing his willingness to suffer the consequences for exposing them. Snowden had an innocent, idealistic, principled look about him, and the world was ready to congratulate him for revealing the NSA’s alleged illegal collection of data inside the United States, But in fact, Snowden had stolen a great deal more than documents relating to domestic surveillance. He had also stolen secret documents from the NSA, the CIA, the Department of Defense, and the British cipher service revealing the sources and methods they employed in their monitoring of adversaries, which was their job. By the time the theft had been discovered, in the first week of June 2013, it was impossible for the FBI, a grand jury, or any other U.S. agency to question him because he had fled the country. His first stop, Hong Kong, the economically autonomous city of 7.2 mil- lion, is a special administrative region of mainland China. Under the | | Epst_9780451494566_2p_all_rt.zindd 4 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019492

Prologue | 5 terms of the 1997 transfer of sovereignty from Great Britain, China is responsible for Hong Kong’s defense and foreign policy, includ- ing intelligence services. He then proceeded to Russia, which has no extradition treaty with the United States. Russia granted him asy- lum, making it unlikely that U.S. authorities would ever have the opportunity to question him. Snowden’s escape left in its wake an incredibly important unsolved mystery: How hada young analyst in training at the NSA succeeded in penetrating all the layers of NSA security to pull off the largest theft of secret documents in the history of American intelligence? Did he act alone? What happened to the documents? Was his arrival in Russia part of the plan? Because I had written several books on the vulnerability of intelli- gence services, this was a mystery—a “howdunit,” if you like—that immediately intrigued me. Even if Snowden had acted for the most salutary of reasons, the unauthorized transfer of state secrets from the United States to an adversary country is, by almost any defini- tion, a form of espionage. @ I decided to begin my investigation of this case in Hong Kong, @ because it was the place to which Snowden first fled after leav- ing Hawaii. Snowden had planned the trip for at least four weeks, according to the mandatory travel plan he had filed at the NSA. When I spoke to my sources in the intelligence community, they could not explain Snowden’s choice. It would not necessarily protect him from the reach of U.S. law, because Hong Kong had an active extradition treaty with the United States. Just a few months earlier, Hong Kong had made headlines by honoring America’s request to extradite Trent Martin, a fugitive wanted for insider trading. Nor was Hong Kong particularly convenient to Hawaii. There were no nonstop flights there from Honolulu in May 2013. Snowden flew eight hours to Narita International Airport in Japan, where he waited almost three hours. He then flew five hours to Hong Kong. Snowden could have flown to countries that do not have extradition treaties with America in far less time. Adding to this mystery, at the time he departed Honolulu, Snowden had not yet arranged for any journalists to meet him in Hong Kong, and as far as U.S. intelligence could determine, he had | | Epst_9780451494566_2p_all_rt.zindd 5 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019493

6 | HOW AMERICA LOST ITS SECRETS no known appointments there. Even so, Snowden carried to Hong Kong digital copies he had made of the top secret NSA documents. As General Michael Hayden, who served as the head of both the NSA and the CIA, told me, “It’s very mysterious why Snowden chose Hong Kong.” We can assume he had a compelling enough rea- son for him to take the risk that he would be arrested there by Hong Kong police after U.S. authorities invoked the detention provision of its extradition treaty. It was of course possible that Snowden had traveled there to see someone he believed could protect him. I arrived in Hong Kong on May 20, 2014—exactly one year after Snowden had arrived there aboard a Japan Airlines flight. I checked in to the Mira hotel in the Tsim Sha Tsui shopping district of Kow- loon, a ten-minute ferry ride away from Hong Kong Island, where most of the foreign consulates are located. I chose the Mira because it was the five-star hotel in which Snowden had stayed and where he had made the celebrated video @ admitting his role in taking the NSA documents. I asked at the front @ desk for room 1014, the same one that Snowden had occupied in 2013, because I wanted easy access to the hotel’s service and secu- rity personnel responsible for the room who might have had contact with Snowden a year earlier, Unfortunately, that room was occupied, but I was given a nearby room that served my purpose. Snowden had told Glenn Greenwald and Laura Poitras, the Guardian reporters he met in Hong Kong, that he had hidden out at the Mira hotel since his arrival in Hong Kong because he feared that the CIA might capture him. My first surprise was that Snowden had not arrived at the Mira until eleven days after he arrived in Hong Kong. As I learned from the hotel staff, Snowden had regis- tered there under his real name and used his own passport and credit card to secure the room, an odd choice if he was hiding out. He had checked in to the hotel not on May 20, as he had told the reporters, but on June 1, 2013. He checked out on June 10. Wherever Snowden stayed from May 20 to June 1, he apparently considered it a safe enough place from which to send Greenwald a “welcome package,” as he called it, of twenty top secret NSA docu- | | Epst_9780451494566_2p_all_rt.zindd 6 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019494

Prologue | 7 ments on May 25. He had now not only downloaded documents but also violated the oath he had signed when he took his job by provid- ing them to an unauthorized party. During this period, Snowden also contacted Barton Gellman, on behalf of The Washington Post, via e-mail. Indeed, while he was staying someplace other than the place he claimed to be staying, he made almost all the arrangements for his journalistic coming-out. He was in contact with at least one foreign mission during this period, according to what he wrote to Gellman on May 24. In that e-mail, concerning when and how his story was to be published by The Washington Post, Snowden asked Gellman to include some text that would help Snowden with his dealings with this mission. But which country was he approaching? In an effort to establish Snowden’s whereabouts during these “miss- ing” eleven days, which, among other things, could shed light on why he first came to Hong Kong, I called Keith Bradsher, a prizewin- ning journalist who had been the New York Times bureau chief in Hong Kong in 2013. He had written a well-researched report about Snowden’s arrival there. He proposed we meet at the Foreign Cor- @ respondents’ Club. @ Bradsher told me that he had known Albert Ho, who had been retained as Snowden’s lawyer, for more than a decade. He had inter- viewed him many times, because he was a leader of a political move- ment in Hong Kong. Bradsher said that a few days after Snowden had revealed himself on June 9, he met with Ho and questioned him about Snowden’s unknown whereabouts. Ho told Bradsher that all of Snowden’s logistics had been arranged for him by an intermediary, whom Ho called a “carer.” Ho said that Snowden had been in contact with the “carer” prior to his arrival in Hong Kong on May 20. According to Ho, it was this person who had arranged accommodations for Snowden on his arrival and afterward. If so, it seemed to me that this person might be able to shed light on whom, if anyone, Snowden saw in his first eleven days in Hong Kong. Even if this person might have been unaware of the reasons for Snowden’s trip to Hong Kong when he made the arrangements for him, he was still the best lead I had to learning why Snowden had come to Hong Kong. Bradsher told me that he pressed Ho for details about this mystery person over the course of several meet- | | Epst_9780451494566_2p_all_rt.zindd 7 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019495

8 | HOW AMERICA LOST ITS SECRETS ings but Ho would not identify him beyond saying that he was a “well-connected resident” of Hong Kong. I called Ho’s law office in Hong Kong. He politely declined to be interviewed by me, saying he had said all he was going to say about the Snowden case. I was able, though, to make an appointment with Robert Tibbo, a Canadian-born barrister specializing in civil liberties cases. Tibbo had worked closely with Ho on the Snowden case. I met Tibbo in the tearoom at the Mandarin Oriental hotel on Hong Kong Island. Tibbo, in his early fifties, was tall, with a round face and thinning hair. He talked freely about his remarkable career, After earning a degree in chemical engineering from McGill Univer- sity and working in Asia as an engineer for a decade, he went to law school in New Zealand and became a barrister in Hong Kong special- izing in cases involving the legal status of refugees. Over a leisurely tea, Tibbo made it clear that he had played a far more active role than Ho in the Snowden case. He had even per- sonally escorted Snowden from the Mira hotel to a safe house on June to. He did not dispute what Ho had told Bradsher. When I asked @ him if he could give me the name of the “carer,” he said that he was @ bound by a lawyer-client privilege that prevented him from provid- ing me with any details that might reveal the identity of the person who had made arrangements for Snowden. When I asked the date that he was officially retained by Snowden, he said that Snowden had signed an agreement hiring him and Ho’s law firm as his legal adviser on June 10, 2013 (which was a matter of public record). “T understand that,” I said, “but I am inquiring about something that had happened before you became his legal adviser.” He shook his head, as if getting rid of a pesky fly, and said that his oath pre- cluded him from saying anything at all that might do damage to the credibility of his client. “Not even where he was staying in May in Hong Kong?” I persisted. He leaned forward and, after a brief hesitation, said, jokingly I assumed, that he would not divulge that information, “even if you held a gun to my head.” We met two more times, but true to his word Tibbo would not say if he even knew the identity of the “carer.” Meanwhile, Joyce Xu, a very resourceful Chinese journalist who was assisting me in Hong Kong, had filed the equivalent of a Freedom | | Epst_9780451494566_2p_all_rt.zindd 8 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019496

Prologue | 9 of Information request with the Hong Kong Security Bureau ask- ing for information about Snowden’s movements in May. Thomas Ng, the secretary for security, turned down the request, adding that Hong Kong authorities do not keep records of hotel registrations. I had run into a dead end with the Hong Kong authorities on the issue of Snowden’s “carer” and Snowden’s whereabouts for those eleven crucial days. At this point, I got some much-needed help from an old friend on the Obama White House staff. Before I had left New York, I asked him if he could find someone at the consulate in Hong Kong who might brief me on the Snowden case. I didn’t hear from him until just a few days before I was due to return to New York. He put me in touch with a former employee of the Hong Kong consulate, who he said was “fully informed” about the efforts of the U.S. mission to locate Snowden in Hong Kong. This person was still living in Hong Kong, and he agreed to meet with me on condition that I did not mention either his name or his specific job in the U.S. mission in Hong Kong. The venue was the terrace lounge of the American Club @ in Exchange Square in central Hong Kong, a posh club mainly for @ expatriate Americans. It was on the forty-eighth floor, with a spec- tacular view of Victoria Harbor. Once there, I had no problem find- ing my source, identifying him by the description he had given me. He was sitting alone at a discreet table in the corner. After we ordered drinks, he told me ina soft voice about the Amer- ican reaction to Snowden’s revelations in Hong Kong. “All hell broke loose,” he said, describing the atmosphere at the U.S. mission after Snowden’s video was posted on The Guardian's website on June 9. Lasked about an assertion that Snowden had made concerning the U.S. consulate in that extraordinary video. Snowden had said that he could be seized at any moment by a CIA rendition team based at the U.S. consulate “just down the road” from the Mira hotel. “Was that true?” I asked. He rolled his eyes and said, “Snowden has a pretty wild imagina- tion. For one thing, the U.S. consulate is not down the road from the Mira in Kowloon; it is here on Hong Kong Island. And there was no CIA rendition team in Hong Kong.” My next question concerned a second period during which | | Epst_9780451494566_2p_all_rt.zindd 9 @ 929N6 5:51 Pa | | HOUSE_OVERSIGHT_019497

10 | HOW AMERICA LOST ITS SECRETS Snowden’s whereabouts are clouded—the period between the time he left the Mira hotel on June 10 and the day he left Hong Kong for Russia on June 23. When I asked my consulate source whether the U.S. mission took any action to track Snowden during these thirteen days, he explained that the FBI had long maintained a contingent of “legal attachés” based at the consulate to pursue many possible violations of U.S. law including video piracy. In addition, the CIA and the Defense Intelligence Agency (DIA) had retained a handful of “China watchers” under diplomatic cover in Hong Kong. This group constituted the “intelligence mission,” as he referred to it. It had developed informal relations with the Hong Kong police that, along with the NSA’s electronic capabilities abroad, allowed it to track Snowden’s movements after he had outed himself on the video. Because Snowden, his lawyers, and the journalists in his entourage frequently used their cell phones to text one another, it was fairly easy for the U.S. intelligence mission to follow Snowden’s trail after he left the Mira hotel. He said that the Hong Kong police also knew where he was during this period. My source further suggested that @ the massive Chinese intelligence contingent in Hong Kong also @ knew, because it had close relations with the Hong Kong police. “So everyone knew Snowden’s whereabouts as he moved every few days from apartment to apartment,” I interjected. He answered that it was no secret to anyone except the media and the public. “Of course we knew,” he said, adding that there were also photographs of Snowden entering the office building that housed the Russian consulate. I mentioned that there was a report in a Russian newspa- per that Snowden had visited the Russian consulate in late June in connection with the flight he later took to Moscow. “All we know is he entered the building,” he answered, with a shrug. That Russian consulate visit did not come as a complete surprise to U.S. intelligence. After Snowden left the Mira, his interactions with the Russian and Chinese intelligence services in Hong Kong had been closely monitored by “secret means,” a term that in that context likely indicated electronic surveillance. A former top intel- ligence executive in Washington, D.C., subsequently confirmed this monitoring to me. All of Snowden’s stealth in exiting from the Mira hotel, which included wearing a baseball cap and dark glasses, thus | | Epst_9780451494566_2p_all_r1.z.indd 10 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019498

Prologue | 11 proved ineffective in hiding him from U.S. intelligence and presum- ably other intelligence services seeking the treasure trove of docu- ments he had taken from the NSA. As for his next destination, I could find no evidence that Snowden had made any arrangements during his monthlong stay in Hong Kong to go to any Latin American country. Before he went public on June 9, he could have easily gotten a visa in Hong Kong with his still-valid passport to go to almost any country in the world, includ- ing Cuba (for which a U.S. passport was not necessary), Bolivia, and Ecuador. Yet he did not apply for visas during this time period. Even as late as June 8, after meetings with Greenwald and Poitras, his name had still not been revealed, no criminal complaint had been issued against him, and there was no Interpol red alert for his deten- tion. He could have walked out of the Mira hotel, caught a taxi to the Hong Kong airport, and gone on Swiss International Air Lines via Zurich to any country in South America or to Iceland. But, as in the oft-cited Sherlock Holmes clue of the dog that did not bark, Snowden’s inaction in not obtaining visas during this thirty-day @ period suggests that he had no plans to go anyplace but where he @ went: Moscow. However, the mystery that most concerned me was not where Snowden was housed in the interim between when he went pub- lic and when he went to Moscow. It was where, and in whose care, Snowden had been before he checked into the Mira on June 1. When I asked my source about this period, he said that as far as he knew, neither the FBI nor the Hong Kong police could find a trace of him during the period between May 20, when he passed through Hong Kong customs, and June 1, when he first used his credit card and passport to check into the Mira hotel. Other than those transac- tions, they could not find any credit card charges, ATM withdrawals, telephone calls, hotel registrations, subway pass purchases, or other clues to Snowden’s activities. As far as a paper trail was concerned, Snowden was a ghost during this period. “Could an American just vanish in Hong Kong for eleven days?” Lasked. “Apparently, he did just that,” my source replied. Snowden’s whereabouts during these eleven days was not a mys- | | Epst_9780451494566_2p_all_r1.z.indd 11 @ 9/29/16 5:51PM | HOUSE_OVERSIGHT_019499

L2 | HOW AMERICA LOST ITS SECRETS tery I was going to solve on this first trip to Hong Kong. I needed to know more about his activities before he got there. After all, Snowden was not, as he himself pointed out from Moscow, an “angel descend- ing from the heavens.” He had been working for the U.S. govern- ment for the previous seven years. During that period, he had been part of America’s secret intelligence regime and held a clearance for sensitive compartmented information, or SCI. Such SCI material is considered so sensitive that it must be handled within formal access control systems established by the director of national intelligence. Nor did Snowden’s breach begin with his handing over classified documents to the Guardian reporters in Hong Kong in June 2013 or, for that matter, in the eleven days prior to his meeting with journal- ists. He had, as the NSA quickly determined, begun illicitly copying documents in the summer of 2012. Such a dangerous enterprise is not born of a sudden impulse. It was, as his actions suggested, nur- tured over many months. Even if he had managed to elude American intelligence from late May to early June 2013, he could not hide all the history that led to his decision to come to Hong Kong. There @ had to be an envelope of circumstances surrounding it, including @ Snowden’s motivation, associates, movements, finances, and activi- ties prior to his fleeing to Hong Kong. What was missing was not just Snowden’s first eleven days in Hong Kong but the context of the alleged crime. I first needed to find out who Edward Snowden was. | | Epst_9780451494566_2p_all_r1.z.indd 12 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019500

PART ONE SNOWDEN’S ARC I woke this morning with a new name. I had had a vision. A dream vision. A vision righteous and true. Before me I saw Gamers, Gamers shrouded in the glory of their true names. Step forth, and assume your name in the pantheon. It’s always been there, your avatar’s true name. It slips through @ your subconscious, reveals itself under your posts, and flashed visibly in that moment of unrestrained spite; in the indulgent teabag. You've felt it, known it, recognized it. Now realize it. I woke this morning with a new name. That name is Wolfking. Wolfking Awesomefox. —EDWARD SNOWDEN, Geneva, June 12, 2008 | | I | | | Epst_9780451494566_2p _all_ri.zindd 13 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019501

| | Epst_9780451494566_2p_all_r1.z.indd 14 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019502

CHAPTER 1 Tinker It’s like the boiling frog. You get exposed to a little bit of evil, a little bit of rule-breaking, a little bit of dishonesty ... you can come to justify it. —EDWARD SNOWDEN, Moscow, 2014 DWARD JOSEPH SNOWDEN was born on June 21, 1983, in Eliza- beth City, North Carolina. His parents were Lon Snowden and Elizabeth “Wendy” Barrett. According to their marriage records, they wed when they were both eighteen in 1979. The following year they had a daughter, Jessica. Lon Snowden, like his father before him, served in the U.S. Coast Guard. He was stationed at its main aviation base, where his father- in-law, Edward Joseph Barrett, was an officer and rising star of the Coast Guard. While Edward Snowden was still a child, his maternal grandfather would become not only an admiral but also head of the Coast Guard’s entire aviation service. When Lon was transferred to a Coast Guard base near Baltimore in 1992, he bought a two-story house in Crofton, Maryland, a resi- dential community very close to the NSA’s headquarters building at Fort Meade. Edward, who was nine, and Jessica, who was twelve, were enrolled in local public schools in Crofton. Jessica was a top student. After she obtained her degree at the | | Epst_9780451494566_2p_all_r1.z.indd 15 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019503

16 | HOW AMERICA LOST ITS SECRETS University of Maryland, she went on to law school, graduating with honors. Unlike his sister, Edward Snowden experienced a string of failures in his education. In 1998, after only one year of classes, he dropped out of Arundel High School; according to school records, he stopped attending classes at the age of fifteen. He later attributed his absence from school to a medical problem, mononucleosis, but according to Robert Mosier, a spokesman for Anne Arundel County public schools, there is no record of any illness. Brad Gunson, who knew Snowden before he dropped out of high school, recalled in an interview with The Washington Post only that he had a high-pitched voice, liked magic cards, and played fantasy video games. Instead of completing a formal education, Snowden went his own way. Still in his teens, he became the product of a broken home. His parents were entangled in messy divorce proceedings until he was seventeen. By this time, Jessica had her own apartment. When his parents separated, Snowden’s mother bought a two-bedroom condo- minium in Ellicott City, Maryland. She moved Edward, along with his two cats, into the condominium, while she remained in the fam- @ ily house awaiting its sale. According to a condominium neighbor, @ Joyce Kinsey, Snowden stayed home alone almost all the time. From what she could observe, he spent long hours in front of a computer screen. At the age of eighteen, while other teens his age went to college, Snowden was still living by himself, now devoting a large part of his time to playing fantasy games on the Internet. Posting under the alias TheTrueHooHa on a website called Ars Technica, he showed himself to be a passionate gamer. He was especially drawn to anime, a graphically violent style of Japanese animation. These anime games had by 2002 achieved a fanatic following in both Japan and the United States. He claimed special skills at Tekken, a martial arts fighting game. He even went to anime conventions in the Washing- ton, D.C., area. When he became a webmaster for Ryuhana Press, a website running these anime-based games, he described himself somewhat fancifully as a thirty-seven-year-old father of two chil- dren. The only truth in his description was that he was born on “the longest day of the year” (June 21). He wrote Internet posts under his TrueHooHa alias about how he | | Epst_9780451494566_2p_all_r1.z.indd 16 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019504

Tinker | 17 used weight lifting and intensive training to precision shape his body. He bragged to his online followers that he had reduced his “body fat percentage to between 9.5% and 10.5%” (which was less than half of the average for his age). He wrote that he wore “cool” purple sun- glasses, practiced martial arts, and was a fan of Japanese cuisine. He described himself at one point, as if advertising his virtues, as having a “head of vibrant, shimmering blond hair (with volume).” He appeared somewhat restless with his solitary life in his almost daily postings. He expressed a longing to go to Japan. “I’ve always dreamed of being able to ‘make it’ in Japan. I’ve taken Japanese for a year and a half,” he wrote in 2002. Despite his claim of learning Japanese, there is no record of his taking any courses in Japanese. But it was perhaps part of his yearning. In pursuit of an employ- ment opportunity in Japan, he posted, “I’d love a cushy gov job over there.” Eventually, he gave up on the idea of relocating himself to Japan because, as he explained in a post, he would have to put his cats in quarantine for six months. Snowden’s father meanwhile moved to Pennsylvania with his @ new wife-to-be. This left Snowden with only one male family mem- @ ber in the area, his maternal grandfather, Admiral Barrett, who was now in the top echelon of U.S. intelligence working at the Pentagon. Barrett was there when a plane piloted by terrorists crashed into it on 9/11. He emerged unscathed. Snowden sought to join the Special Forces through the 18X pro- gram, a U.S. Army Reserve program created in 2003 that allowed individuals who had not served in the military or completed their education to train to be a Special Forces recruit. He listed his religion on the application as Buddhist because, as he explained in a sardonic post on Ars Technica, “agnostic is strangely absent” from the form. He enlisted in the army reserves on May 7, 2004, according to U.S. Army records. He reported for a ten-week basic training at Fort Benning, Georgia, which was standard for all enlistees in the infan- try. In August, he began a three-week course in parachute jumping but did not complete that training. As Snowden put it in his Inter- net postings, he “washed out.” He was discharged on September 29, 2004, ending his nineteen-week military career. Snowden would later claim on the Internet that he returned to civilian life because | | Epst_9780451494566_2p_all_r1.z.indd 17 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019505

18 | HOW AMERICA LOST ITS SECRETS he had broken both legs. An army spokesman could not confirm that Snowden injured his legs or that he was in fact dropped from the program for medical reasons. Under his TrueHooHa alias, Snowden wrote that “they [the army] held on to me until the doctors cleared me to be discharged, and then after being cleared they held onto me for another month just for shits and giggles.” He attributed this treatment in the army, as he would later attribute his problems in the CIA and the NSA, to the inferior intelligence of his superiors. He wrote in his post, “Psych problems = dishonorable discharge depending on how much they hate you. Lots of alleged homos were in the hold unit, too, but they only got a general discharge at best.” If he had broken his legs, it was not evident to Joyce Kinsey, his next-door neighbor, who told me that she never saw Snowden on crutches when he returned to his mother’s condominium in Sep- tember 2004. Army records show that he did not receive a medical discharge. He received an “administrative discharge.” Unlike a medi- cal discharge, which is given because a soldier has sustained injuries @ that prevent him from performing his duties, an administrative dis- @ charge is a “morally neutral” form of separation given to a soldier when he or she is deemed for nonmedical reasons inappropriate for military service. Snowden preferred to cite a medical explanation for his severance, just as he had claimed a medical reason for dropping out of high school (and would later claim he needed medical treat- ment for epilepsy at the NSA). When he returned home from Fort Benning, Georgia, he was twenty-one. He remained unemployed for several months before taking a job as a security guard at the University of Maryland’s Cen- ter for Advanced Study of Language, where he was given his first security clearance. Snowden had to take a polygraph exam to get the job. According to his Ars Technica postings, he worked the night shift from six in the evening to six in the morning. He had higher ambitions than being a campus security guard. He wanted to become a male model. He did not seem overly con- cerned about his privacy, posting pictures of himself on the Internet “mooning” for the camera. He also posted provocative modeling pic- tures of himself on the Ars Technica website. He commented on his | | Epst_9780451494566_2p_all_r1.z.indd 18 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019506

Tinker | 19 own beefcake-style pictures, “So sexxxy it hurts” and “I like my girl- ish figure that attracts girls.” He approached a model agency called Model Mayhem, which recommended a photographer. He had some concern about that photographer because he, as Snowden wrote in a post, “shoots mostly guys.” Snowden said he was “a little worried he might, you know, try to pull my pants off and choke me to death with them, but he turned out to be legit and is a pretty damn good model photographer.” He posted the photographs on the Internet. The lack of any paid job offers dashed Snowden’s hopes for a model- ing career. Around this time, he began dating Lindsay Mills, an extremely attractive nineteen-year-old art student at the Maryland Institute College of Art. Jonathan Mills, Lindsay’s father, was an applications developer at the Oracle Corporation. According to him, Snowden met his daughter on an Internet dating site. Snowden and Mills had much in common. They both had divorced parents who gave them a great deal of latitude in conducting their personal lives. Both of them were keenly interested in perfecting their bodies through exercise @ and diet regimes. Mills’s only paid employment over the next eight @ years would be as a fitness and yoga instructor in Maryland. When they first met, they both had ambitions to be models, and neither of them had inhibitions about posing provocatively for photographers. They both also had a desire to travel to exotic places, including cities in Asia. Mills had spent four month in Guilin, China, before meeting Snowden. As bleak as his prospects as a high-school dropout might have seemed, Snowden had an unexpected stroke of good fortune in the spring of 2006. The CIA offered him a $66,o00-a-year job as a CIA communications officer. “I don’t have a degree of ANY type. In fact, I don’t even have a high school diploma,” Snowden boasted in May 2006 on the website Ars Technica under his alias. He added, with only a slight exaggeration, “I make 70K.” How did Snowden get the job? The CIA’s minimum requirements in 2006 for a job in its clandestine division included a bachelor’s or master’s degree and a strong academic record, with a preferred GPA of 3.0 or better. The CIA needed technical workers in 2006. But even if Snowden | | Epst_9780451494566_2p_all_r1.z.indd 19 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019507

20 | HOW AMERICA LOST ITS SECRETS applied only in this capacity, which entailed a five-year employment agreement, the minimum requirement for an intelligence technol- ogy job was an associate’s degree awarded by a two-year community college in electronics and communications, engineering technology, computer network systems, or electronics engineering technology. Candidates had to have had a final GPA of at least 3.0 on a 4.0 scale from a fully accredited technical school or university. Snowden, as we've seen, did not meet these standards. If a candidate lacks these qualifications, the CIA can make an exception only if he or she has at least two years’ civilian or military work experience in the tele- communications and/or automated information systems field that is comparable to one of the requisite degree fields. Snowden in no way qualified in this way either. Under extraordinary circumstances, even the minimum require- ments might be waived if the applicant had a distinguished mili- tary career and an honorable discharge. Snowden, however, did not complete his military training at Fort Benning and received only an administrative discharge. @ The CIA, to be sure, had needed computer-savvy recruits to ser- @ vice its expanding array of computer systems since 1990. By 2006, however, there was no shortage of fully qualified applicants for IT jobs who met the CIA’s minimum standards. Most of them had uni- versity course records, work experience at IT companies, computer science training certificates from technical schools, and other such credentials. The CIA, like the NSA, also obtained technicians with special skills for IT jobs from outside contractors. So it had no need for employing a twenty-two-year-old dropout who did not meet its requisites. According to Tyler Drumheller, a former CIA station chief in Europe, the only plausible way that Snowden, with no qualifica- tions, was allowed to jump the queue was that “he had some pull.” In 2006, Snowden’s grandfather, who had attained the rank of rear admiral, was certainly well connected in the intelligence world. After twenty years’ service in the Coast Guard, Barrett had joined an interagency task force in 1998, which included top executives from the CIA, the FBI, and the Drug Enforcement Administration. It had been set up to monitor any gaps in the U.S. embargo on Cuba, and Barrett, as one of its leaders, was in constant liaison with the | | Epst_9780451494566_2p_all_r1.z.indd 20 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019508

Tinker | 21 CIA. By 2004, he had joined the FBI as the section head of its avia- tion and special operations. In this capacity, he supervised the joint CIA-FBI interrogation of the prisoners in the Guanténamo base in Cuba, which involved him in the rendition program for terrorists. Barrett could certainly have played a role in furthering his only grandson’s employment. The CIA, however, has not disclosed any information about who, if anyone, recommended Snowden. All that is known is that in 2006 the CIA waived its minimum requirements for him. Later Snowden pointed out from Moscow that in 2006 the fed- eral government employed his entire family. His father was serving in the Coast Guard; his mother was an administrative clerk for the federal court in Maryland; his sister was a research director at the Federal Judicial Center; and Admiral Barrett was still a top executive at the FBI. In a sense, Snowden had entered the family business. | | Epst_9780451494566_2p_all_r1.z.indd 21 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019509

CHAPTER 2 Secret Agent Sure, a whistleblower could use these [NSA computer vulner- abilities], but so could a spy. —EDWARD SNOWDEN, Moscow, 2014 TT" SUDDEN TRANSFORMATION of Snowden in 2006 from a night watchman on a university campus to an employee for the CIA provided him with a powerful new identity and one much closer to the avatars he adopted for his fantasy games. It was bur- nished so deeply in his self-image that he cited it eight years later, in exaggerated fashion, in Moscow. When Brian Williams, then an NBC anchorman, began an hour-long television interview with Snowden in 2014 by saying, “It seems to me spies probably look a lot more like Ed Snowden and a lot less like James Bond these days,” Snowden approvingly smiled and told him, “I was trained as a spy in sort of the traditional sense of the word.” Snowden further con- firmed his interviewer’s point, stating, “I lived and worked under- cover overseas—pretending to work in a job that I’m not [in]—and even being assigned a name that was not mine.” In reality, Snowden’s employment at the CIA was far more pro- saic. When he joined the CIA, he did not have the required experi- ence in maintaining secret communication systems, so the CIA sent | | Epst_9780451494566_2p_all_r1.z.indd 22 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019510

Secret Agent | 23 him to its information technology school for six months to train as a communications officer, not a spy. After completing his training, he was dispatched to the CIA station in Geneva. He worked there for the next two years as one of dozens of information technologists servicing the CIA’s communication channels in Switzerland. He was stationed there, according to Swiss registry records, under his own name from March 2007 to February 2009. He was identified as a U.S. State Department employee in Geneva because Switzerland does not allow any intelligence officers to operate in its country. Offi- cially, he was attached to the permanent U.S. mission to the United Nations, which employed hundreds of U.S. government functionar- ies in Switzerland. It was a thin cover; the Swiss government was aware that the CIA maintained its base in Geneva and posted its employees at the U.S. mission. Although Snowden would claim in a video he made in Hong Kong that he had served as a “senior adviser for the Central Intelli- gence Agency,” he was merely a telecommunications support officer, or TSO in CIA parlance, which was a junior-level job at the CIA. @ He worked as part of a team of information technologists under the @ supervision of senior CIA officers, according to a former CIA officer in Geneva. The job of these TSOs was to protect the security of the CIA’s computer systems through which the CIA station in Geneva sent and received its secret communications. As far as is known, Snowden made very few friends at the eight- hundred-person mission. The only person to have publicly reported knowing him in Geneva during this period is Mavanee Anderson, a young and attractive summer intern at the U.S. mission from May to August 2007. She described befriending Snowden, who, according to her, said that he was in the CIA and also demonstrated to her his martial arts skills. She later recalled in interviews that he was “a bit” prone to brooding and voiced growing dissatisfaction with the CIA. The job in Geneva did have its benefits, however. It provided him with a generous housing and travel allowance. In many ways, it was the “cushy government job” he had said he was seeking in his Inter- net posts. He rented a four-room apartment and had his girlfriend, Lindsay Mills, now twenty-one, join him there. According to his posts on the Ars Technica website, he took full | | Epst_9780451494566_2p_all_r1.z.indd 23 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019511

24 | HOW AMERICA LOST ITS SECRETS advantage of his compensation to live the high life. He gambled on financial developments by buying and selling options, which are contracts that allow speculators to bet on the directions of the mar- ket without buying the actual stocks, bonds, or commodities. He also bought a BMW sports car on which, he wrote, he disabled the speed control so he could exceed the legal limit. He described in his posts racing motorcycles in Italy and traveling around Germany with an Estonian rock star (whom he did not further identify). He also con- tinued his avatar life in Internet gaming; the alias he chose for that was Wolfking Awesomefox. He also indulged in a fantasy gun sport called Airsoft, a variation of paintball, in which participants used realistic-looking pistols to splatter each other with paint. Snowden’s good fortune came to an abrupt end in 2008. He suf- fered a massive loss in his options speculations. He wrote in a post that he had “lost $20,000 in October [2008] alone,” a sum that repre- sented almost a third of his annual salary. He blamed the U.S. finan- cial system, posting on Ars Technica that Ben Bernanke, the Federal Reserve chairman, was a “cockbag.” He also bet against any further @ rise in the stock market index, asking a user with whom he was chat- @ ting on the Internet in December 2008 to “pray” for a collapse of stock prices. When his correspondent asked him why he wanted him to pray for a decline, Snowden responded, “Because then I'll be filthy fucking rich.” But Snowden lost this bet. Snowden lashed out at others on the Internet over these setbacks. He termed those who questioned his financial judgment “fucking retards.” As with other setbacks, he blamed them on government offi- cials in Ars Technica posts. Because the CIA was engaged in 2008 in highly sensitive operations to gather banking data in Switzerland— one of which Snowden later disclosed to The Guardian—any Inter- net discussion by a CIA employee of financial losses could serve as a beacon to an adversary intelligence service on the prowl for a source. If any party was looking for disgruntled U.S. employees, Snowden’s Internet chatter about bad choices in gambling could have aroused its interest. That Snowden used his TrueHooHa alias for these Internet post- ings would not prevent a sophisticated espionage organization from | | Epst_9780451494566_2p_all_r1.z.indd 24 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019512

Secret Agent | 25 quickly uncovering his true identity. He was listed by his true name on the roster of the U.S. mission to the UN. By consulting personnel records, one would further discover that he did not actually work for the State Department. Because it was no secret that the U.S. mission in Geneva housed the CIA station for all of Switzerland, any out- sider would think it probable that this brittle gambler who played the options market worked for the CIA. Even though it cannot be precluded that Snowden was spotted in Geneva by another intelligence service, there is no evidence, at least that I know of, to suggest that he was approached by one. Nor is there reason to believe that if he had been contacted by a for- eign service in 2008, he would have responded positively. Despite his indiscreet posting about his outside activities, he apparently still respected the boundaries of secrecy that had been clearly defined in the oath he had taken at the CIA. For example, after The New York Times published an article revealing secret American intelligence activities in Iran on January 11, 2009, Snowden railed against the newspaper on the Internet under his TrueHooHa alias. He wrote, @ “This shit is classified for a reason.... It’s because this shit won't @ work if Iran knows what we are doing.” He clearly recognized that revealing intelligence sources was extremely damaging. As for the Times, he said, “Hopefully they’Il finally go bankrupt this year.” When another Internet user asked him if it was unethical to release national security secrets, he answered, “ YEEEEEEEEEES.” As with every CIA officer, Snowden had to undergo a two-year evaluation and take a routine polygraph test. It was then, in Decem- ber 2008, that his superior at the CIA placed a “derog” in his file, the CIA’s shorthand for a derogatory comment, in an unfavorable evalu- ation. The reason remains somewhat murky. According to a New York Times story by the veteran intelligence reporter Eric Schmitt, Snowden’s superior had suspected that Snowden “was trying to break into classified computer files to which he was not authorized to have access.” Schmitt evidently had well-placed sources in the CIA. He said that he interviewed two senior American officials who were familiar with the case. According to what they told Schmitt, the CIA superior had decided to “send Snowden home.” Officially, how- | | Epst_9780451494566_2p_all_r1.z.indd 25 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019513

26 | HOW AMERICA LOST ITS SECRETS ever, according to a reply by a CIA public affairs officer to the Times, Snowden had not been fired or accused of attempting to “break into classified computer files to which he did not have authorized access.” A former CIA officer who had also been at the U.S. mission in Geneva explained the discrepancy to me. He said that the spin the CIA put on the story was “necessary containment.” After the Snowden breach occurred in June 2013, the CIA had a problem that could, as he put it, “blow up in its face.” If Snowden had been fired but allowed to keep his security clearance in 2009, the CIA’s incom- petence could be partly blamed for the NSA’s subsequent employ- ment of him. If he had broken into a computer to which he was not authorized, he should have been fired if not arrested. What this spin glossed over, according to this former CIA officer, is the part about Snowden’s behavior that concerned his superior. Technically, Snowden, as a CIA communications officer, was autho- rized to use the computer system. The problem was that Snowden had deliberately misused it by adding code to it. This code could have compromised the security of the CIA's “live system.” So while what @ the CIA public affairs officer quoted in the Times story said was cor- @ rect, it clouded the issue. During his time in Geneva, Snowden had received no promotions or commendations for his work. He was threatened with a punitive investigation unless he agreed to quietly resign from the CIA. “It was not a stellar career” Drumheller, the former CIA station chief, told me in 2014. Snowden blamed his career-ending “derog” on an “e-mail spat” with a superior. From Moscow, he wrote to James Risen of the Times that his superior officer ordered him not “to rock the boat.” Further, he complained that the technical team at the CIA station in Geneva had “brushed him off,” even though he had a legitimate grievance. When he complained about a flaw in the computer system, he said that his superior took vengeance on him. He said he added the code to the system to prove he was right. He attributed the “derog” in his file to the incompetence, blindness, and errors of his superiors. According to Snowden, he was a victim. This would not be the last time he faulted superiors for their supposed incompetence. He would | | Epst_9780451494566_2p_all_r1.z.indd 26 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019514

Secret Agent | 27 later say that the NSA experts who examined the documents that he had stolen were “totally incapable.” In any case, in February 2009, Snowden not only had a career- damaging “derog” in his file but faced an internal investigation of his suspicious computer activities. According to Drumheller, such an internal investigation would not be undertaken lightly or because of an “e-mail spat.” He said that such an investigation was “a big deal” involving the CIA Office of Security in Washington and possibly the FBI. It would also result in the temporary suspension of Snowden’s security clearance. This left Snowden with little real choice. If he wanted to avoid that investigation, he had to resign from the CIA, which he did in February 2009. That was the end of the security investigation. He was clearly bitter, posting on Ars Technica on January 10, 2009, “Obama just appointed a fucking POLITICIAN to run the CIA!” (He was referring to Leon Panetta, President Clinton’s former chief of staff.) Snowden attributed the origins of his antipathy to US. intelligence to his 2007-9 experiences in the CIA. He later told @ Vanity Fair that the 2009 incident in the CIA convinced him that @ working “through the system would lead only to reprisals.” Snowden, if not yet a ticking time bomb, was certainly a disgrun- tled intelligence worker before he ever got to the NSA. | | Epst_9780451494566_2p_all_r1.z.indd 27 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019515

CHAPTER 3 Contractor Private contractors don’t clear employees. The government does. —ADMIRAL MICHAEL MCCONNELL, former vice-chairman, Booz Allen Hamilton GroNeeN aged twenty-five, returned from Europe and moved into his mother’s condo. Not only was he unemployed now, hav- ing resigned from the CIA, but his financial state had been hurt by the huge losses he had suffered playing the options market in Geneva and by the fact that he did not qualify for any CIA benefits. His vision of himself as a secret agent, the unstoppable Wolfking Awesomefox, might have also suffered. According to the narrative he later supplied to The Guardian, he had become deeply concerned about the immoral way in which the CIA conducted its intelligence operations in Switzerland. “Much of what I saw in Geneva really disillusioned me about how my government functions and what its impact is in the world. I real- ized that I was part of something that was doing far more harm than good,” Snowden told The Guardian. By way of example, he said he learned that the CIA had gotten a Swiss banker drunk enough to be arrested when he drove so the CIA could compromise him. Snowden, who did not drink himself, was appalled at this ploy. Despite his | | Epst_9780451494566_2p_all_r1.z.indd 28 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019516

Contractor | 29 growing antagonism toward the U.S. government, he had not given up on, if not becoming a secret agent, working in the netherworld of secret intelligence. There was still a back door through which he could reenter the spy world. Private corporations hired civilian technicians to work for spy agencies as independent contractors. By 2009, the CIA, the NSA, and other U.S. intelligence services had outsourced much of the job of maintaining and upgrading their computer systems to these private companies. They supplied the NSA with most of its system administrators and other information technology workers. This arrangement allowed the NSA to effectively bypass budget limits and other restrictions limiting how many NSA technicians it could recruit. Instead of being on the NSA’s own payroll, these people nominally worked for, and received their paychecks from, private employers. In fact, many of these outside contractors worked full-time for the NSA. Snowden applied in April 2009 to one of these private compa- nies, a subsidiary of the Dell computer company. To diversify out of @ manufacturing computers, Dell had recently gone into the business @ of managing government computer systems for the NSA and other intelligence services. As a leading specialist in the field of corporate cyber security, Dell had no problem obtaining sizable contracts from the NSA’s Technology Directorate. In 2008, the NSA had in effect outsourced to Dell the task of reorganizing the backup systems at its regional bases. Dell had to find thousands of independent contrac- tors to work at these bases. In 2009, it was seeking to fill positions at the NSA’s regional base in Japan, and Snowden applied. Relocat- ing would be no issue for him because he had a longtime interest in going to Japan. He had little problem obtaining the job. He had a single compel- ling qualification: like all other CIA officers, he had been given a top secret clearance. For an outside contractor such as Dell, such a security clearance was pure gold. If a potential recruit lacked it, Dell needed to wait for a time-consuming background check that would have to be conducted before it could deploy him or her at the NSA. Ifa recruit already had the clearance, as Snowden did, he could begin working immediately. | | Epst_9780451494566_2p_all_r1.z.indd 29 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019517

30 | HOW AMERICA LOST ITS SECRETS Snowden still had his security clearance, despite his highly prob- lematic exit from the CIA, because the agency had instituted a policy a few years earlier that allowed voluntarily retiring CIA officers to keep their clearance for two years after they left. This “free pass,” as one former CIA officer called the two-year grace period, had been intended to make it easier for retiring officers to find jobs in parts of the defense industry. This accommodation, in turn, made it easier for the CIA to downsize to meet its budget. Not only did Snowden retain his clearance, but unlike when he had applied for his job at the CIA in 2006, he could now list on his résumé two years of experience in information technology and cyber security at the CIA. Dell could check only a single fact: that Snowden was employed at the CIA between 2006 and 2009. His CIA file, which contained the “derog,” was not available to Dell or any other private company because of government privacy regulations. Even though the CIA had “security concerns” about Snowden, it could not convey them to either Dell or the NSA without violating the privacy rules. “So the guy with whom the CIA had concerns left @ the Agency and joined the ranks of the many contractors working @ in the intelligence community [IC] before CIA could inform the rest of the IC about its worries,” Michael Morell, then CIA deputy direc- tor, explained. “He even got a pay raise.” Obviously, this was a glitch in the security system. As a result of it, though, Snowden entered the secret world of the NSA only five months after being forced out of the CIA. For the next forty-five months, Dell assigned him various IT tasks at the NSA. In June 2009, he was sent to Japan to work in the NSA complex at the U.S. Yokota Air Base, which is about two hours by car from downtown Tokyo. He moved into a small one-bedroom apart- ment in Fussa, just outside the sprawling base. His initial job for Dell was teaching cyber security to army and air force personnel. In this capacity, he instructed U.S. military officers stationed at the base in how to shield their computers from hack- ers. Such security training had been required for military person- nel dealing with classified material after several successful break-ins to U.S. military networks by China, Russia, and other adversary nations. It was not a challenging or interesting job. | | Epst_9780451494566_2p_all_r1.z.indd 30 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019518

Contractor | 31 But Snowden found diversions in Japan. In July 2009, Lindsay Mills joined him there. She had become an amateur photographer, specializing in arty self-portraits. She also saw herself as a global tourist, writing in her blog after arriving in Japan that she had trav- eled to seventeen countries. Like Snowden, she also deemed herself, tongue in cheek, a “super hero.” In this sense, her Internet avatar was a match for Snowden’s Wolfking Awesomefox. In Japan, Mills and Snowden spent time with another Ameri- can couple, Jennie and Joseph Chamberlin, who also worked at the Yokota base. Jennie, a sergeant in the public affairs section of the U.S. Air Force, had been at art college with Mills and called herself in her blog the Little Red Ninja. Joseph Chamberlin was a decorated U.S. Navy pilot who now flew highly sensitive intelligence-gathering missions from the Yokota base. Jennie described Lindsay in her blog as her “super-model friend.” The two couples also went on expedi- tions in Japan together. As far as is known, the Chamberlins were the only Americans at the base with whom Snowden socialized. On August 17, 2009, the foursome attempted to walk up Mount Fuji, @ but they got lost en route and wound up in the Mount Fuji gift @ shop. Jennie described the misadventure in her blog: “Our adven- ture started off a little rocky with our attempts to find the interstate. Alas, our iconic mountain was obscured by cloud. A short stop at the Mt. Fuji combination soba noodle stand/gift shop was enough to whet our appetite for the further exploration that is to come.” Pho- tographs taken that day show Snowden wearing Hawaiian shorts and a black tank top emblazoned with an eagle and the letters USA. They also show Mills wearing safari shorts, a brown sweater, and what appears to be an engagement ring. “Ed was looking rather red- necky,” Lindsay commented on one photograph. Snowden described her, in turn, as “nerdy.” They never made it to the top of Mount Fuji. Snowden also sought to advance himself by getting credit toward a college certificate by enrolling in a summer online course at the University of Maryland’s Asia program, which had a regional cam- pus on the Yokota base. Known as UMUC, it had a contract with the government to provide military personnel with such educa- tional opportunities. Snowden would later claim that he was tak- ing courses for a graduate degree in computer sciences, but William | | Epst_9780451494566_2p_all_r1.z.indd 31 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019519

32 | HOW AMERICA LOST ITS SECRETS Stevens, the assistant registrar of UMUC, who I spoke to at the base in 2016, told me that the program in 2009 did not provide gradu- ate courses in computer sciences. According to the program’s record, while Snowden had enrolled as a student in the summer of 2009, he received neither any credits nor a certificate. In October 2009, Dell assigned Snowden a job in which he had direct access to the NSA’s computers. He was now a system adminis- trator, which is essentially a tech-savvy repairman. Dell was working on a backup system code-named EPICSHELTER. For this contract, Dell was transferring large chunks of data from the NSA’s main computers in Maryland to backup drives in Japan so that the system could be quickly restored if there was a communications interrup- tion, Because most of the classified data was in its encrypted form, it had little value to any outside party. Snowden’s job was to maintain the proper functioning of computers, but as a system administrator he also had privileges to call up unencrypted files. He sat in front of a computer screen all day looking for any problems in the transferring of files to backup servers. @ The work was highly repetitive and exceedingly dull. Snowden @ found time to search for anomalies in the system, and he claimed to have spotted a major flaw in the security system in late 2009. He discovered that a rogue system administrator in Japan could steal secret data without anyone else’s realizing that it had been stolen. Snowden brought that to the attention of his superiors, as he later said, The emergence of a rogue system administrator was not that far- fetched in 2009. Hacktivists such as Julian Assange had adopted the battle cry “Sysadmins of the world, unite.” Instead of asking them to “throw off their chains,” as Marx did, he asked them to send clas- sified documents about secret government activity to the WikiLeaks site. Snowden, as a “sys admin,” was aware he had the power to do so. He recalled in Moscow in 2014, “I actually recommended they [the NSA] move to two-man control for administrative access back in 2009.” To make his point even clearer, he added, “A whistleblower could use these things, but so could a spy.” Not without irony, Snowden became that rogue system administrator some three years | | Epst_9780451494566_2p_all_r1.z.indd 32 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019520

Contractor | 33 later. In fact, he later used the very vulnerability he pointed out to steal NSA documents at Dell. In September 2009, still on the Dell payroll, Snowden made a ten- day trip to India. He later said he was on an official visit “working at the US embassy.” Hotel records show that he arrived at the Hyatt Regency in New Delhi on September 2 from Japan and at 3:30 p.m. on September 3 checked into the Koenig Inn, an annex to Koenig Solutions, a school that gave crash courses on programming and computer hacking. According to Rohit Aggarwal, head of the school, Snowden stayed there until September 10 while taking classes with a private instructor. It cost $2,000 in tuition and fees, which Snowden prepaid from Japan with his personal credit card. Even though Snowden later said he only took courses in “programming,” the school’s records show that during that week he took intensive courses in sophisticated hacking techniques. The course was titled “Ethical Hacking,” but that was a euphemism for teaching the tech- niques of illicit hacking. The course provided tutoring on hackers’ tools such as SpyEye and Zeus, which are used to circumvent secu- @ rity procedures. It also demonstrated how these hacking tools could @ be customized by criminals and spies to break into files, plant sur- veillance programs, impersonate system administrators, assume the privileges of system administrators in a network, and capture the passwords of others. On September 11, Snowden, according to hotel records, left India for Japan. While the stated purpose of the hacking training was to allow security consultants to detect intruders, it also prepared Snowden to be, if he chose to be, an intruder in the NSA system. One problem with working as a contractor is that the standard two-year contracts are not necessarily renewed. Nor is there much possibility for advancement for IT workers. As one contractor told me, “It is a dead-end job with great pay.” In the fall of 2010, Snowden’s contract in Japan with Dell was nearing an end. Dell offered Snowden, and he accepted, a new position in the United States. He rented a modest suburban house shaded by a sakura cherry tree in a suburb of Annapolis, Maryland. Lindsay Mills meanwhile was attending a two-week fitness training course at | | Epst_9780451494566_2p_all_r1.z.indd 33 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019521

34 | HOW AMERICA LOST ITS SECRETS a retreat that qualified her to be a yoga instructor. She had been liv- ing on and off with Snowden during the previous two years abroad, including while he worked at the CIA in Switzerland and the NSA in Japan, and now she moved in with Snowden again. The twenty-five- year-old Mills posted on Instagram, “Finally in our first US place together.” She also put pictures online of him in bed with her, affec- tionately referring to him in her posts as a “computer crusader.” He worked on problem solving for corporate clients at Dell head- quarters in Annapolis. In preparation for his new corporate role, Snowden shaved off his facial hair and, with Lindsay’s help, bought a Ralph Lauren suit. His corporate clients were assisting the NSA, the CIA, and the DIA. Consequently, Snowden dealt with a wide range of intelligence officers and gave presentations on the vulnerabilities in computer security at the DIA-sponsored Joint Counterintelligence seminar. In February 2011, he attended a black tie Valentine’s Day gala sponsored by corporate members of the Armed Forces Commu- nication and Electronics Association. The guest speaker was Michael Hayden, who had headed the CIA when Snowden was abruptly @ forced out two years earlier. Nevertheless, Snowden joined the cue @ to have his photo taken with the former director, a perk of the char- ity event. These dealings in no way mitigated his resentment of the intel- ligence establishment. What began at the CIA in 2009 as objections to what he saw as the incompetence of his superiors grew into well- articulated disapproval of the way the U.S. government conducted its intelligence. He found NSA surveillance particularly worrisome, later telling The Guardian, “They [the NSA] are intent on making every conversation and every form of behavior in the world known to them.” He claimed after defecting to Moscow that he had voiced his concerns about what he considered illicit surveillance to ten NSA officials, “none of whom took any action to address them.” The NSA can find no record of these complaints, but if Snowden had indeed complained to these officials while working for Dell, his superiors at Dell either didn’t notice or didn’t care that they had a very dis- gruntled employee on their hands. Snowden also made no secret on the Internet of his anger at the U.S. government and the corporations that served it. He railed on | | Epst_9780451494566_2p_all_r1.z.indd 34 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019522

Contractor | 35 the Ars Technica site against the complicity of private corporations, such as Dell, that assisted the NSA. In his online posts in 2010, Snowden expressed loathing for the assistance that corporate Amer- ica was providing the intelligence community. “It really concerns me how little this sort of corporate behavior bothers those outside of technology circles,” he wrote under his TrueHooHa alias. He said he feared that America was already on “a slippery slope,” and he sug- gested, perhaps adumbrating his own later actions, that this corpo- rate assistance to U.S. intelligence “was entirely within our control to stop.” What the “computer crusader” expressed in these angry Internet postings was an almost obsessive concern over individuals’ freely submitting to government authority. “Society really seems to have developed an unquestioning obedience towards spooky types,” he wrote on Ars Technica without mentioning that he himself worked for a corporation that assisted spy agencies. He asked rhetorically on this public forum whether the sinister slide toward a surveil- lance state “sneaked in undetected because of pervasive government @ secrecy.” @ The outright contempt he expressed toward this “government secrecy” did not prevent him from seeking even more secret work at Dell for the intelligence services. In February 2011, after his CIA security clearance ran out, he applied to renew it. The new clearance now required a new background check and filling out the govern- ment’s 127-page Standard Form 86. Since 1996, background investigations for the NSA, like much of the computer work at the NSA, had been outsourced to a private company. It had proceeded from the effort of the Clinton adminis- tration to cut the size of government by privatizing tasks that could be more efficiently done by for-profit companies. U.S. Investiga- tions Services, or USIS, as it is now called, which won the contract for background checks, was initially owned by the private equity fund Carlyle Group, which later sold it to another financial group, Providence Equity Partners. For the private equity and hedge funds, profits were the measure of success. To increase its profits from the contract with the NSA, USIS had to move more quickly in conclud- ing background checks because it did not get paid more for extensive | | Epst_9780451494566_2p_all_r1.z.indd 35 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019523

36 | HOW AMERICA LOST ITS SECRETS investigation. In 2006, the government learned these background checks were often prematurely ended. In Snowden’s case, because the CIA did not share its files with a private concern, USIS did not have access to Snowden’s CIA files, and it therefore did not learn about the threatened security investigation. Nor did it learn from the Internet, where he always employed an alias, that he was a dis- gruntled employee. So Snowden’s new clearance was approved in the summer of 2011, allowing him to continue working for Dell on secret intelligence projects. Meanwhile, in August 2011, Mills began her own blog titled L’s Journey. In it, she described herself as “a world-traveling pole- dancing super hero.” Many of her posted pictures were provocative poses of herself in her underwear and various states of undress. She wrote, “I’ve always wanted to be splashed on the cover of magazines, with my best air-brushed look.” Her wish would be gratified two years later in a way she likely did not anticipate. For his part, Snowden seemed happy to encourage her fantasy about being a superhero. He even gave her a Star Trek—inspired head @ visor. Despite all the concerns he voiced about privacy, he did not @ seem to mind her provocative posts. On the contrary, he took pho- tographs of her, telling her at one point that her photographs were not “sexy” enough. Snowden was soon offered a new position by Dell at the NSA’s Kunia regional base in Hawaii. Dell, which was in the process of expanding its government consulting business, wanted him to be a system administrator on the NSA’s backup system. The NSA needed this system before it could upgrade new security protocols that would audit suspicious activity in real time. In Hawaii, as in Japan, system administrators still worked alone. Snowden knew from his experience in Japan that this solo work in an unaudited workplace provided an opportunity for a system administrator to steal docu- ments. So he might also have realized that as a solo system admin- istrator in Hawaii, he would have this opportunity. Whether this was on his mind or not, on March 15, 2012, he accepted this offer. Dell agreed to pay all his relocation expenses and provide him with a housing allowance. He found a 1,559-square-foot house in Oahu, located at 94-1044 | | Epst_9780451494566_2p_all_r1.z.indd 36 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019524

Contractor | 37 Eleu Street in the middle-class suburb of Waipahu. It was part of the Royal Kunia development, which contained three hundred similar-looking homes. According to Albi Matco, the manager of the community association for the development, many of the residents worked at military facilities in the area. The corner house Snowden rented was comfortable enough, with three bedrooms, a walk-in closet, a living room with a high ceiling, and a single-car garage, but in no way lavish. It did not even have a backyard. He moved in on April 2, 2012, which entailed a brief separation from his girlfriend, Mills, who had committed herself to attending a girlfriend’s wedding the following month. After he left for his new assignment, she wrote on Instagram, “Sex toy party and then saying goodbye to my man— well not goodbye so much as see you in two months.” | | Epst_9780451494566_2p_all_r1.z.indd 37 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019525

CHAPTER 4 Thief We begin by coveting what we see every day. —HANNIBAL LECTER, The Silence of the Lambs N HAWAII IN 2012, Snowden was living a very comfortable life. He was earning just over $120,000 a year from Dell. His hous- ing allowance covered the rent and the lease on his car. He worked five days a week at the NSA base. The commute, as I timed it, took only ten minutes. Driving past a sign marked “Restricted Area: Keep Out,” and the security booth where NSA guards checked his cre- dentials, he left his car in the outdoor lot for the Kunia Regional Security Operations Center. (When I drove into the base in 2016, I was detained nearly two hours at the security booth before being turned back.) Snowden worked in a three-story reinforced concrete building called “the tunnel,” even though it was above the ground. It had been built during World War II to serve as an aircraft assembly plant. During the war, it was entirely covered with earth and shrub- bery to proof it against Japanese bomber attacks. In 1980, the NSA converted it to its regional base in Hawaii for its intelligence gather- | | Epst_9780451494566_2p_all_r1.z.indd 38 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019526

Thief | 39 ing. Its lack of windows and the dirt covering gave it the appearance, when I viewed it in 2016, of an oblong-shaped anthill. Workers, both military and civilian, entered through an exterior staircase in the center of the mound. Even though it is above the ground, it is known as the tunnel. Snowden said in describing the atmosphere, “ You're in a vaulted space. Everybody has sort of similar clearances, everybody knows everybody. It’s a small world.” He said that to relieve the tediousness of the work, every two months or so his fellow work- ers would circulate a picture of a naked person that showed up on their screens as part of the NSA’s surveillance of foreign suspects. He explained, “You've got young enlisted guys, 18 to 22 years old [who have] suddenly been thrust into a position of extraordinary respon- sibility where they now have access to all of your private records. In the course of their daily work they stumble across ...an intimate nude photo of someone in a sexually compromising position.” He knew that copying any files, including photographs, was a vio- lation of NSA rules. But he did not report this illicit activity to the NSA, even though he later claimed that it occurred regularly. He @ joked in his Moscow interview with The Guardian that some of the @ nudes were “extremely attractive” and that viewing them was, as he put it, “the fringe benefits of surveillance positions.” Snowden identified with the Libertarian Party, and at the NSA he made no effort to conceal his political support of its causes. He became an active partisan of Congressman Ron Paul, the leading fig- ure in the party in 2012. “He’s so dreamy,” Snowden posted on the Ars Technica site in March 2009 (just after he registered to vote in North Carolina, though he no longer lived there). Paul was running in the 2012 Republican presidential primaries, and Snowden made a contribution of $500 to his election committee. Snowden’s attrac- tion to Paul’s libertarian ideology was not that surprising. At the core of Paul’s worldview was a deep hostility to the intrusion of the government into private lives. Snowden shared this hostility, as was clear from his Internet postings. Like other Libertarians, Snowden believed that citizens should not be “shackled” by federal law. He later addressed from Moscow via an Internet hookup a libertarian gathering at which Ron Paul also spoke. “Law is a lot like medi- | | Epst_9780451494566_2p_all_r1.z.indd 39 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019527

40 | HOW AMERICA LOST ITS SECRETS cine,” he said. “When you have too much it can be fatal.” Like Paul, Snowden ardently opposed any form of gun control, as did Lindsay Mills in her online postings. Like other Libertarians, Snowden, a contractor for the government, saw the government as an adversary. “The [American] government,” he later said, “assumed upon itself, in secret, new executive powers without any public awareness or any public consent and used them against the citizenry of its own country to increase its own power, to increase its own awareness.” Most relevant to his future activities at the NSA, Snowden wholeheartedly agreed with Paul’s position on the dangers inherent in government surveillance of U.S. citizens. Paul described the CIA, the organization that had forced Snowden out, as nothing short of a “secret government” and said that “in a true Republic, there is no place for an organization like the CIA.” He also railed against NSA surveillance. As is clear from Snowden’s Internet postings, he, like Ron Paul, had doubts about the competence of the intelligence agencies of the U.S. government. Snowden’s own disillusionment about the govern- @ ment might have begun with his rejection and perceived mistreat- @ ment by the Special Forces of the U.S. Army. It was almost certainly reinforced by his ouster from the CIA. He later told The Guardian that he was disillusioned as early as 2007 when he learned about the CIA’s methods in compromising Swiss citizens. His critical view of the U.S. government only hardened during the years he worked at the NSA. He described his NSA superiors as “grossly incompetent,” as he later explained to a journalist from Wired magazine in Mos- cow. At the NSA, he said employees were kept in line by “fear and a false image of patriotism.” He said that he saw his fellow workers cowed into “obedience to authority” and his superiors induced to break the law. He became particularly concerned with what he called the “secret powers” of the NSA. He saw them as “tremendously dangerous.” By this time, Snowden was fully aware that the NSA conducted domestic surveillance because he had used his privileges as a system administrator in 2012 to read the NSA inspector gen- eral’s report on a 2009 surveillance program. Nevertheless, Snowden continued to work at the NSA, where he was, as he put it, “making a ton of money.” Mills joined him in his | | Epst_9780451494566_2p_all_r1.z.indd 40 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019528

Thief | 41 “paradise” in June 2012, shortly before his twenty-ninth birthday. Just before leaving Annapolis for Hawaii, Mills posted a seminude picture of herself on her blog, L’s Journey. In it, her face was cov- ered with a blanket. The caption under it read, “Trying to avoid the changes coming my way.” In Honolulu, she found “E.,” as she called Snowden in her blog, “elusive.” She found that he preferred to stay at home and avoided meeting other people to the point that her friends “were not quite sure that E. existed.” Lindsay’s fellow per- formers in the Waikiki Acrobatic Troupe told me in 2016 that they rarely, if ever, saw Snowden at the practice sessions. Andrew Towl, a juggler with the group, did briefly meet Snowden once. It was on a hike with Lindsay in Oahu. Towl said he asked Snowden what he was doing in Hawaii and Snowden answered tersely, “I work with computers,” and continued walking. Even though Mills had dated Snowden for eight years, most of her other friends, except for Jennie and Joe Chamberlin in Japan, had not met him. Next door neigh- bors I spoke to caught brief glimpses of him entering or leaving his house but did not engage him in a conversation as Snowden tended @ to avoid eye contact. If he had other social interactions in Hawaii, no @ one he met came forward and spoke of meeting him, even after he became world famous. Two days after his twenty-ninth birthday dinner on June 21, Mills described him playfully as a “goof.” She wrote in her blog, “The universe is telling me something and I’m pretty sure it’s saying get out, Fuck you Hawaii.” In early July, she summed up her shaky situ- ation with Snowden in another blog, writing, “I moved to Hawaii to continue my relationship with E. [but] it has been an emotional roller coaster since I stepped off the plane.” She diverted herself by organizing a pole-dancing studio in the four-hundred-square-foot garage of the house. She also found her own friends in physical fit- ness and dance groups. She joined a New Age yoga studio called Physical Phatness, as well as a local acrobatic performance group, and, on Friday nights, pole danced at the Mercury lounge in down- town Honolulu. Unlike Snowden, she enjoyed socializing, writing in her blog, “We lovingly crammed a large group into a small corner of a delicious Japanese restaurant and filled our bellies with sushi, tempura, and good conversation.” | | Epst_9780451494566_2p_all_r1.z.indd 41 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019529

42 | HOW AMERICA LOST ITS SECRETS That same July, Snowden had other things on his mind, includ- ing an attempt to advance himself. Although his position at Dell as a system administrator was a well-compensated one, especially for a twenty-nine-year-old with no formal education, it carried little prestige. He sat from 9:00 a.m. to 5:00 p.m. in a windowless room watching a bank of monitors in the so-called tunnel. Many of those who worked with him were, as he described them, “eighteen year old soldiers.” Presumably, they had little interest in discussing with him the weightier issues of the world. Working as an outside contractor was also a dead-end job that hardly matched the vision he had of himself in his Internet postings. In real life, in a cubicle in the NSA, he was decidedly not the Wolfking Awesomefox heroic image he had of himself in his dream vision. Snowden now decided to apply for a position in the NSA itself. He apparently believed that if he scored high enough on its entrance exam, the NSA would invite him to join it as a Senior Executive Service officer, or SES, which was the civilian equivalent in rank and pay to a flag officer in the U.S. armed forces. “I’m still amazed that @ a twenty-eight-year-old thought he could get an SES position,” a @ civilian contractor working for the NSA during the same period told me, “Snowden had a very overinflated view of his self-worth.” To enhance his chances of getting the SES job, Snowden in the summer of 2022 illicitly hacked into the NSA’s administrative files and stole the answers to the NSA exam. As the NSA’s subsequent postmortem would determine, it was the first known document that Snowden took without authorization at the NSA. It was not the first time, however, that he had used his hacking skills to attempt to advance himself. At the CIA in 2009, as he later said in Moscow, he had added text to his annual CIA evaluation in what he termed “a non-malicious way” to prove a point. His CIA superior took a much darker view of that incident when the hack was detected, calling for an investigation. It was the threat of that investigation that, it will be recalled, in effect ended Snowden’s CIA career. At the NSA, his intrusion was not detected for almost a year. “He stole the [NSA] test with the answers, and he took the test and he aced it,” the former NSA director Michael McConnell recounted | | Epst_9780451494566_2p_all_r1.z.indd 42 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019530

Thief | 43 in a 2013 interview. “He then walked into the NSA and said you should hire me because I am this good on the test.” The reason why he attempted to gain entry into the upper ranks of the NSA in the late summer of 2012 is less clear. If his Internet posting and libertarian riffs are an indication of his state of mind then, he was hostile to the surveillance activities of the NSA. If so, it made little sense that he would seek a permanent career there. If this is considered in light of the career move he made six months later (in March 2013), which, as he himself admits, was for the express purpose of getting at tightly held documents stored on computers that were not available to him in his job at Dell, then he might have been seeking wider access in 2012 for a more nefarious purpose than an NSA job. In any case, despite the near-perfect scores, the NSA did not offer him a Senior Executive Service job. “It was totally unrealistic for Snowden to expect to get an SES position,” a former senior NSA officer told me. Snowden’s ambitions might have been disappointed in this instance, but it did not prevent him from later claiming that @ he had been a senior adviser to the CIA and also a senior adviser to @ the Defense Intelligence Agency. Instead of an SES position, the NSA offered him a lowly G-13 job as an information technology worker, which was not an improve- ment on his job at Dell. He took this slight as evidence of the NSA’s incompetence, subsequently joking to a reporter in Moscow that his ability to steal the test answers should have been seen as a qualifica- tion for the NSA job. In September 2012, he turned down the NSA offer. If he was to advance himself now, he had to find a new way. | | Epst_9780451494566_2p_all_r1.z.indd 43 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019531

CHAPTER 5 Crossing the Rubicon What I came to feel is that a regime that is described as a national security agency has stopped representing the public interest and has instead begun to protect and promote state security interests. —EDWARD SNOWDEN, Moscow, 2014 S OON AFTER Snowden failed to get an SES job at the NSA in Sep- tember 2012, he intensified his rogue activities. As we've seen, part of Snowden’s job as a system administrator under contract to Dell was transferring files held at Fort Meade to backup computers in Hawaii. He “was moving copies of that data there for them,” said Deputy Director Ledgett, “which was perfect cover for stealing the [NSA] data” through the fall and winter of 2012. The security mea- sures at the Hawaii base presented no obstacles to him because, as a system administrator, he had privileges that allowed him to copy documents that had not been encrypted. Indeed, it was part of the process of building the backup system. The flaw he had pointed to in Japan, in which system administrators working solo could safely steal files, also existed in Hawaii, as we know. This time, however, instead of bringing it to the attention of the NSA, he used it to steal files. Snowden could be confident that his thefts of documents would go undetected. Real-time auditing of the movement of documents, | | Epst_9780451494566_2p_all_r1.z.indd 44 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019532

Crossing the Rubicon | 45 which was done at NSA headquarters in Fort Meade and most of the NSA’s regional facilities, had not yet been installed at the Hawaii base, because a lack of bandwidth prevented the safe upgrading of the software. This auditing software was scheduled to be installed after the backup system was completed in 2013. The Kunia base was one of the last NSA bases that did not monitor suspicious transfers of files on a real-time basis. Snowden was aware of this deficiency; he later pointed out in his interview in Wired that the NSA base where he worked did not have an “audit” mechanism. This security gap allowed Snowden, using his system administrator’s credentials, to copy classified data to a thumb drive without anyone's being able to trace the copied data back to him. According to the NSA’s subse- quent damage assessment, he stole many thousands of pages while working for Dell in 2012 before he contacted journalists. Ledgett subsequently reported that the NSA analysis of the fifty-eight thou- sand documents that were given by Snowden to journalists in June 2013 showed that most of them were taken while he was still work- ing at Dell. @ This theft was made even more serious by the interconnection @ of NSA computers with those of other intelligence agencies. Prior to the 9/11 attacks in 2001, “stovepiping” had protected NSA data on its computers from networks used by other intelligence services. After the 9/11 Commission concluded that part of the reason U.S. intelligence agencies were unable to “connect the dots” in advance of the attack was related to this practice, the NSA stripped away a large part of its stovepiping. As a result, the NSANet, which Snowden had access to at Dell in 2012, became a shared network with “com- mon access points,” as the former NSA director Michael Hayden described them to me, which made them the equivalent of “reading rooms” in a library. They served as a means for NSA workers to exchange ideas about the problems they were encountering on vari- ous projects for the intelligence community. In maintaining them, system administrators, or “system admins,” like Snowden, acted as the “librarians.” If a system administrator copied data from this net- work, no one knew. For Snowden, the NSANet, which included CIA and Defense Department documents, provided a rich hunting ground in the fall | | Epst_9780451494566_2p_all_r1.z.indd 45 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019533

46 | HOW AMERICA LOST ITS SECRETS and winter of 2012. Many of the documents he took off the NSANet revealed operations not only of the NSA but also of the CIA and the Pentagon. By taking them, he had come to a Rubicon from which there would be no return. He later explained in an e-mail to Vanity Fair from Moscow, “I crossed that line.” As far as is known, Snowden was not sharing documents with any other party prior to May 2013. He was not even yet in contact with Poitras, Greenwald, or any other journalists. Presumably, Snowden was collecting them on drives—despite the risks that possessing such a collection of secrets might entail—for some future use. Why would Snowden jeopardize his career and, if caught, his free- dom by undertaking this illicit enterprise? He might by now have had strong ideological objections to the NSA’s global surveillance. As he said later in Moscow, “We're subverting our security standards for the sake of surveillance.” Ordinarily, though, even ideologically opposed employees don’t steal state secrets and risk imprisonment. If they are disgruntled, they seek employment elsewhere. Certainly, Snowden, with his three years’ experience working for Dell, would @ have little problem finding a job as an IT worker in the booming @ civilian sector of computer technology. Instead, he sought to widen his access to NSA documents. This behavior suggests that he might have had another agenda. One possible clue to it is the first docu- ment he took: the NSA exam. The answers to the questions in it represented to him a form of tactical power. Those answers could empower him to obtain a more important job in the NSA itself that would allow him to burrow deeper into the executive structure of the agency. Holding such a job would unlock the door to documents containing the NSA’s sources stored in areas not available to Dell contractors like himself. His later actions demonstrated that he equated the possession of such secrets with personal power. For example, after he arrived in Moscow in 2013, he bragged to James Risen of the Times that he had access to secrets that gave him great leverage over the NSA. He told him specifically his access to “full lists” of the NSA’s agents and operations in adversary countries could, if revealed, close down the NSA’s capabilities to gather information in them. Such a fascination with the power of government-held secrets | | Epst_9780451494566_2p_all_r1.z.indd 46 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019534

Crossing the Rubicon | 47 has always been a core concern of radical Libertarians. In his 1956 book, The Torment of Secrecy: The Background and Consequences of American Security Policies, the sociologist Edward Shils brilliantly dissects the fascination with secrecy among individuals who fear that government agencies will use covert machinations against them. In Shils’s concept, this counterculture is “tormented” by the govern- ment’s possession of knowledge unavailable to them. Members of this culture tend to believe that the agencies that hold these secrets, such as the FBI, the CIA, and the NSA, can control their lives; they also believe that obtaining such secrets will give individuals power over government. Snowden himself was concerned with a coming “dark future,” which he later described as follows: “[The elites] know everything about us and we know nothing about them—because they are secret, they are privileged, and they are a separate class . .. the elite class, the political class, the resource class—we don’t know where they live, we don’t know what they do, we don’t know who their friends are, They have the ability to know all that about us. This is the direc- @ tion of the future but I think there are changing possibilities in this.” @ To change the “dark future,” someone would have to know the secrets of the “elites.” Snowden saw himself as one of the few indi- viduals in a position to seize state secrets from those elites. He had a SCI (sensitive compartmented information) clearance, a pass into an NSA regional base, and the privileges of a system administrator. This position allowed him to steal state secrets and whatever power that went with them. And if he moved to a position that gave him greater access, he would, in this view, amass even greater power. Whatever his actual agenda in 2012, we know that he tested pos- sible reactions to a leak exposing NSA surveillance in the United States. He asked fellow workers at the NSA base in 2012, according to his own account, “What do you think the public would do if this [secret data] was on the front page?” He asked this question at a time when a large number of State Department and U.S. Army classified documents had been posted on Julian Assange’s WikiLeaks website. These WikiLeaks revelations made, as Snowden knew they would, front-page headlines. His “question” was only rhetorical. No covert NSA document had ever been published in the press as of 2012. One | | Epst_9780451494566_2p_all_r1.z.indd 47 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019535

48 | HOW AMERICA LOST ITS SECRETS reason why NSA documents remained secrets, as all intelligence workers at Dell were told when they signed their oath to protect NSA secrets, was that the unauthorized release of communications intelligence documents would violate U.S. espionage laws. Even so, there was no shortage of activists overseas, such as Assange, who would be willing to publish NSA documents revealing its global sur- veillance activities. Cyberpunks, as these activists called themselves, tended to be hostile to the NSA because they believed (correctly) that it monitored their activities on the Internet. This anti-NSA view was well represented at the Chaos Computer Club convention in Berlin in 2012. In addressing these cyberpunks, Assange and his followers at WikiLeaks declared that the main enemy in cyberspace was the NSA. The NSA documents Snowden had taken were far more explosive than anything Assange had posted to date because they contained NSA intelligence source material. In the late fall of 2012, Snowden further tested his newly found powers. Using an alias, he reached out to some of the leading hack- tivists. It opened a door for him to the darker side of cyberspace. | | Epst_9780451494566_2p_all_r1.z.indd 48 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019536

CHAPTER 6 Hacktivist When you gaze long into an abyss, the abyss gazes into you. —FRIEDRICH NIETZSCHE B: THE TIME that Snowden had begun hacking into NSA files in 2012, the alienated hacktivist battling to unlock the secrets of evil corporations and governments had become a stock hero of popular culture. For example, in the international best-selling Girl with the Dragon Tattoo Trilogy by Stieg Larsson, the heroine, a self-educated hacker in her twenties named Lisbeth Salander, steals incriminating documents from computers that provide the journal- ist Mikael Blomkvist with scoops that save from bankruptcy the pro- gressive magazine he edits. The journalists at the magazine accept her sociopathic behavior, which includes embezzling millions of dol- lars, extortion, maiming, and murder, because her hacking exposes crimes and abuses of power. In the real-world universe, hacktivists also use their skills to attempt to redress perceived abuses of power. For example, in December 2010, the group Anonymous, whose members, called Anons, often wear Guy Fawkes masks resembling those worn in the 2006 movie V for Vendetta, launched a success- ful denial-of-service attack called Operation Avenge Assange. It was | | Epst_9780451494566_2p_all_r1.z.indd 49 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019537

50 | HOW AMERICA LOST ITS SECRETS aimed at paralyzing companies, including PayPal and MasterCard, that refused to process donations for WikiLeaks, which these Anons believed were stifling the freedom of the Internet. Because hacktiv- ists often use illicit means to redress their grievances, such as denial- of-service attacks, theft of passwords, and hacking into computers, they must conceal their true identities to avoid the retribution of the FBI and other law enforcement agencies. This requires them to operate on the dark side of cyberspace, which has become known as the dark net. Fortunately for hacktivists, the dark net is accessible to anyone. It is a place frequented by those who want to avoid laws, regula- tions, and government surveillance. Its denizens include cyber sabo- teurs, industrial spies, purveyors of illegal contraband, spammers, pranksters, identity thieves, video pirates, bullies, slanderers, drug dealers, child pornographers, money launderers, contract killers, inside traders, anarchists, terrorists, and the intelligence services of many countries. Sue Halpern, writing about it in The New York Review of Books, @ noted, “My own forays to the dark Net include visits to sites offer- @ ing counterfeit drivers’ licenses, methamphetamine, a template for a US twenty-dollar bill, files to make a 3D-printed gun, and books describing how to receive illegal goods in the mail without getting caught. There were, too, links to rape and child abuse videos.” To operate effectively on the dark net, one often needs a mask of anonymity. But it is not easy to completely hide one’s tracks in cyberspace. The way that the Internet ordinarily works is that whenever an individual sends e-mails or instant messages or visits a website, his or her identity can be referenced by the IP address assigned to him or her by the Internet service provider. If dark net users’ IP addresses are discoverable, they obviously cannot remain anonymous. So, to evade this built-in Internet transparency, dark side users have come to rely on ingenious software to hide their IP addresses. The most commonly used software for this purpose is Tor, which was first called the Onion Router, because it moves IP addresses through multiple layers. Tor software hides the IP address by routing messages through a network of Tor-enabled relay sta- tions, called nodes. Each node further obscures the user’s IP, even | | Epst_9780451494566_2p_all_r1.z.indd 50 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019538

Hacktivist | 51 from the next node in the network. This scrambling allows messages to exit the chain of Tor nodes without an easily discoverable IP. By doing so, it “anomizes” each user of the dark side. Because of the anonymity it provides, Tor became the software of choice for individuals and organizations who wanted to hide their identities. For example, Tor software made possible Silk Road, which acted as an exchange for drug dealers, assassins, safecrackers, and prostitutes until it was closed down by the FBI in 2013. It was cre- ated by Ross Ulbricht, a Libertarian who wore a Ron Paul T-shirt, as a website where “people could buy anything anonymously, with no trail whatsoever that led back to them.” (Ulbricht received a life sentence for running this criminal enterprise in May 2015.) Tor software was also employed by Private Bradley Manning (now Chelsea Manning) to transfer some fifty thousand diplomatic cables and military reports from his laptop to Assange’s WikiLeaks website. Eventually, Manning was identified by a fellow hacker, con- victed by a military court for violations of the Espionage Act, and sentenced to thirty-five years in prison. Tor enabled WikiLeaks to @ publish other secret data, such as material acquired in the theft of @ Sony’s files, allegedly by the North Korean intelligence service, in 2015. It was the means for guaranteeing anonymity to the IT work- ers who responded to Assange’s by now famous clarion call to unite. It allowed system administrators who opposed the “surveillance state,” as well as other disgruntled employees of government agen- cies or corporations, to send documents they copied to the WikiLeaks website without revealing their IP addresses. Because WikiLeaks did not know the identity of its sources, it could not be legally compelled to reveal them. “Tor’s importance to WikiLeaks cannot be overstated,” Assange said in an interview with Rolling Stone in 2012. Indeed, without the anonymity provided by its Tor software, WikiLeaks could not have easily entered into a document-sharing arrangement with major newspapers, including The Guardian, The New York Times, Der Spiegel, Le Monde, and El Pats. Through the magic of Tor, these newspapers simply attribute their sources to WikiLeaks, which, in turn, made Assange a major force in international journalism. Ironically, Tor was a creation of U.S. intelligence. In the early years | | Epst_9780451494566_2p_all_r1.z.indd 51 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019539

52 | HOW AMERICA LOST ITS SECRETS of the twenty-first century, the U.S. Naval Research Laboratory and the Defense Advanced Research Projects Agency developed it to allow American intelligence operatives to cloak their movements on the Internet. They could anonymously manipulate websites oper- ated by Islamic radicals, for example, and create their own Trojan horse sites to lure would-be terrorists and spies. As it turned out, that use of Tor software had a conceptual flaw. If U.S. intelligence services used it, the targets could figure out that anyone visiting a site without an IP address was using Tor software to hide it. If Tor was exclusively used by U.S. intelligence services, the targets could further deduce that all the anonymous visitors were avatars for American intelligence. It would be analogous to undercover police using pink-colored cars that civilians did not use. To remedy this flaw, the U.S. government made Tor software open source in 2008 and freely available to everyone in the world. It even provided funding for its promulgation, with the State Department, the National Science Foundation, and the Broadcasting Board of Governors financing Tor’s core developer. The public rationale for @ this generosity was that Tor could serve as a tool for, as the State @ Department called it, “democracy advocates in authoritarian states.” While Tor software remained a useful tool in covert operations by the CIA, the DIA, and the FBI, it was anathema to the NSA because it made it more difficult for it to track potential targets. As Tor software became widely used by adversaries (as well as common criminals), the NSA sought to find vulnerabilities in it. “It should hardly be surprising that our intelligence agencies seek ways to counteract targets that use Tor software to hide their communica- tions,” explained an NSA spokesperson. The NSA’s adversaries also took an interest in identifying Tor users because they might include political dissidents and potential spies. Tor software also took on a cultlike importance to hacktivists con- cerned with the U.S. government’s tracking their activities. Catherine A. Fitzpatrick provides an illuminating insight into the mind-set of these hacktivists in her 2014 book, Privacy for Me and Not for Thee. She describes them as largely “radical anarchists” who believe “the state is all-powerful, that law-enforcement is so strong that it will prevail anyway, and that they are a persecuted minority.” As a refuge | | Epst_9780451494566_2p_all_r1.z.indd 52 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019540

Hacktivist | 53 against the surveillance of the state, and in particular the NSA, they not only attempt to hide their own identities but also use encryption to obscure their messages. Their goal is to free their movements “of any interference from law-enforcement.” In this mind-set, accord- ing to Fitzpatrick, “they believe government intelligence agencies will stop at nothing to stop them from absolute encryption.” Tor software was a means to defeat the NSA, but for it to be suc- cessful, there needed to be such a proliferation of Tor servers that the NSA could not piece together IP addresses. The problem was that the Tor Project, as they called it, was still a very tiny operation in 2012. It employed fewer than a hundred core developers, who were located mainly in Germany, Iceland, Japan, Estonia, and the United States. Its staff worked mainly out of a single room in Cambridge, Massachusetts. The guiding spirit behind the Tor movement in the private sector was Jacob Appelbaum, a charismatic twenty-eight-year-old who had grown up in Northern California. Like Snowden, he had dropped out of high school. Appelbaum identified himself to his followers on @ the Internet as a “hacktivist” battling state surveillance. For him, as @ for many in the hacktivist culture, the main enemy was the NSA. After all, the NSA had a vast army of computer scientists working to defeat Tor software. Appelbaum was well connected in this cul- ture, having been the North American representative for WikiLeaks before he moved to Berlin in 2013. He also managed WikiLeaks’s cyber security when it released the classified documents it obtained from Manning in 2010. He was so well regarded among hacktiv- ists that Assange chose him as his keynote speaker replacement at the Hackers on Planet Earth (HOPE) convention in New York City. Assange told Rolling Stone, “Jake [Appelbaum] has been a tireless promoter behind the scenes of our cause.” For its part, Rolling Stone titled its profile of Appelbaum “Meet the Most Dangerous Man in Cyberspace.” (Assange needed a replacement for this particular event because he feared if he came to New York, he would be arrested for releasing the Manning files on WikiLeaks.) In Berlin, Appelbaum went to extreme lengths to protect him- self from American surveillance. For example, when George Packer interviewed him for The New Yorker in 2014, he insisted on meet- | | Epst_9780451494566_2p_all_r1.z.indd 53 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019541

54 | HOW AMERICA LOST ITS SECRETS ing with Packer naked in a sauna so he could be sure Packer did not have a recording device (other than his notebook). Appelbaum stated repeatedly in interviews that he was being spied upon by America. While his claims might have sounded paranoid to his interview- ers, as a character in Joseph Heller’s Catch-22 famously said, “Just because you’re paranoid doesn’t mean they aren’t after you.” Runa Sandvik, a close associate of Appelbaum’s, also worked tirelessly to extend Tor’s cloak of anonymity in the private sector against the surveillance of the NSA and other would-be intruders of privacy. A Norwegian national in her mid-twenties, she wrote a well-followed blog on Internet privacy for Forbes in 2012, in which she identified herself as a privacy and security researcher working at the intersection of technology, law, and policy. Appelbaum and Sandvik both came in contact with Snowden before he went public and while he was still working for the NSA in Hawaii. In 2012, Snowden become involved in the effort to encourage the use of Tor software to protect privacy. He made no secret of his concerns about electronic interceptions. According to an anony- @ mous co-worker, he even wore a jacket to work with a parody of the @ NSA insignia, which, instead of merely depicting the NSA eagle, showed the eagle clutching AT&T phone lines. He had also become a member of the Electronic Frontier Foundation, the digital rights organization that was helping finance Tor. He saw Tor software as a remedy. “Without Tor,” he later wrote, “when you walk the streets of the Internet, you're always watched.” His efforts on behalf of Tor were not limited to symbolic gestures. In 2012, he set up a two- gigabyte server called “The Signal,” which he described as the larg- est Tor relay station exit node in Honolulu. He apparently paid for it himself. Through his work as a system administrator for Dell, he found documents revealing NSA efforts, not yet successful, to defeat Tor’s ability to camouflage a user’s identity on the Internet. He found that the NSA was attempting to build backdoor entry ways into Tor soft- ware. One of the NSA documents that he illicitly downloaded, titled “Tor Stinks,” described the agency’s continuing efforts to penetrate Tor servers. In addition, he downloaded NSA documents describing programs begun in 2012 that aimed at searching the Internet for the | | Epst_9780451494566_2p_all_r1.z.indd 54 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019542

Hacktivist | 55 cyber signatures of foreign parties suspected of hacking into U.S. government systems. He also made efforts to directly contact Sandvik. She recalls first hearing from Snowden in November 2012. He first wrote to her under the alias Cincinnatus but later supplied his real name and mailing address in Hawaii because he wanted her to mail him authentic computer stickers from the Tor Project that he could use as “swag,” as he wrote her, to attract further interest in Tor software in Hawaii. As a result, she knew his identity seven months before he went public in Hong Kong. He would later tell Sandvik from Mos- cow that he had been “moonlighting” by working to advance the Tor Project. He added, with some understatement, that his moonlighting was “something the NSA might not have been too happy about.” On November 18, 2012, while still working for Dell at the NSA, his dual role led him to begin organizing a “CryptoParty” aimed at finding new recruits for Tor. The CryptoParty movement had been started in 2012 by Asher Wolf, a radical hacktivist and anarchist liv- ing in Melbourne, Australia. She promoted the get-togethers not @ unlike the Tupperware parties of the 1950s. The party organizer, @ usually with a representative of the Tor Project, advertised the party on the Internet. Attendees were encouraged to bring their own lap- tops so they could install Tor as well as encryption software in them. The attendees would then be instructed on how to use it. Finally, those converted to Tor software would be told to proselytize about its virtues by holding their own CryptoParty. Wolf's idea was to use these gatherings to expand the realm of Tor. Snowden called his fete the Oahu CryptoParty. It had its own web page. He told Wolf that it would be the first CryptoParty in Hono- lulu. She wrote back advising him to “keep it simple.” (Wolf later said she did not know he was working at the NSA.) Snowden apparently had no inhibitions in staging a party that the leadership of the NSA might consider subversive of its battle against Tor. He even invited fellow NSA workers in Hawaii, as well as others in the local computer culture. He asked Sandvik, who was living in Washington, D.C., at the time, to participate, proposing that she co- host the party with him. He scheduled it for December 11, 2012, in Honolulu. According to Sandvik’s account, Snowden informed her | | Epst_9780451494566_2p_all_r1.z.indd 55 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019543

56 | HOW AMERICA LOST ITS SECRETS that he “had been talking some of the more technical guys at work into setting up some additional fast servers” for Tor. His “work” place at the time was the NSA. So, if he was telling the truth, he had already attempted to find co-workers at the NSA who might be interested in attending an anti-NSA surveillance presentation. Sandvik not only agreed to be Snowden’s co-presenter but made the Oahu CryptoParty a Tor-sponsored event. Sandvik flew to Honolulu on December 6, 2012. It was a fourteen-hour flight and a relatively expensive one. She later told Wired magazine that the invitation from Snowden coincided with her plan to take a “vacation in Hawaii.” Whatever her reason, it brought her in direct contact with a Tor supporter with access to the computers of its main enemy, the NSA. On December 11, following Snowden’s instructions, Sandvik arrived shortly before 6:00 p.m. at the Fishcake gallery in downtown Honolulu. She proceeded through a maze of furniture display rooms to BoxJelly, a public space. She was then directed to a small back room in which there were folding chairs and worktables already set up for @ the event. Rechung Fujihira, the owner of BoxfJelly, told me that Hi @ Capacity, a “creative collective” of computer buffs, had arranged the logistics for the event. As he recalled, Snowden had requested their help for the CryptoParty. Sandvik found Snowden waiting for her with Lindsay Mills, whom he introduced to Sandvik as his girlfriend. He told Sandvik that Mills was there to make a video of the event. Mills did not men- tion the party in her blog. But that Snowden brought her and intro- duced her to Sandvik suggests that he did not keep secret from her his activities to further Tor. The event started at 6:00 p.m. sharp. By Sandvik’s count, about twenty people gradually filled the room. She reckoned that about half of the attendees were from Snowden’s workplace. Snowden began the presentation by giving reasons why Internet users needed to defend their privacy by using both encryption and Tor software. According to one attendee who asked not to be identified by name, Snowden, while not revealing that he worked for the NSA, spoke with such precise knowledge about government surveillance capa- bilities that the attendee suspected Snowden worked for the govern- | | Epst_9780451494566_2p_all_r1.z.indd 56 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019544

Hacktivist | 57 ment. Snowden next introduced Sandvik, who took the podium and discussed the work of the Tor Project, stressing the importance of expanding the Tor network. Following their presentations, Snowden and Sandvik took questions from the audience. The Oahu CryptoParty, according to Sandvik, ended about to:00 p.m. No one objected to Mills’s making a video of the meet- ing, even though it was dedicated to the idea of protecting personal privacy. The video was not posted on the Internet, so presumably Snowden wanted it for his own purposes. Afterward, Sandvik went to a local diner called Zippy’s for a late dinner. She left Hawaii two days later. Not all the hacktivists that Snowden invited were able to attend. Parker Higgins, for example, a prime mover in the Electronic Fron- tier Foundation and founder of the San Francisco CryptoParty, wrote back to him that he was unable to attend the December CryptoParty because of the high price of the airfare that month between San Fran- cisco and Honolulu. He added that he would try to attend Snowden’s next CryptoParty, which was scheduled for February 23, 2013. (Hig- @ gins would make headlines in 2013 by flying a chartered blimp over @ the NSA’s secret facility in Utah and photographing it from the air.) Snowden’s double duty continued: downloading secret docu- ments while remaining in touch with some of the leading figures in the Tor Project under his various aliases. He also continued to invite activists to his CryptoParties, and he openly advertised them on the Internet until 2013. The CIA’s former deputy director Morell, who reviewed the security situation at the NSA in 2014 as a mem- ber of President Obama’s NSA Review Committee, found that the NSA in the post-Cold War age had encouraged its technical workers to freely discuss challenges that arose in its computer operations. “The idea was to spread knowledge and learn from the successes of others,” Morell wrote, “but it created enormous security vulner- ability, given the always-existent risk of an insider committed to stealing secrets.” According to a former intelligence executive, this new “open culture,” exemplified by largely unrestricted entry to the NSANet by civilian contractors, fit the culture of the young civilians on the “geek squads” who now ran the NSA’s computer networks. It was remarkable that even in such an “open culture,” Snowden’s | | Epst_9780451494566_2p_all_r1.z.indd 57 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019545

58 | HOW AMERICA LOST ITS SECRETS CryptoParty, Tor station, and other anti-NSA activities could go unremarked upon. After all, ten or so NSA workers attended the first party, and it is not unlikely that many of them recognized him as their co-worker. If so, they knew (as did Sandvik and Mills) that the Tor advocate “Cincinnatus” was Snowden. He had also not been shy in contacting notable enemies of the NSA via e-mail, such as Jacob Appelbaum, Parker Higgins, and Asher Wolf. If anyone, including the security staff of the NSA, had been on the lookout for dissident intelligence workers, this well-advertised gathering and its organizer might have been of interest. In 2014, I asked a former top NSA executive whether such activi- ties on behalf of Tor by an NSA employee would arouse the atten- tion of the NSA’s own “Q” counterespionage unit. He answered, “Snowden was not an NSA employee.” Because Snowden was a contract employee of Dell’s residing in the United States, the NSA could not legally monitor his private activities or intercept his com- munication. To do so would require a court-approved FBI request. So Snowden/Cincinnatus was free to operate openly in recruiting NSA @ workers, hacktivists, and computer buffs for his events. Ironically, @ adversary intelligence services searching for disgruntled intelligence workers had no such constraints. | | Epst_9780451494566_2p_all_r1.z.indd 58 @ 9/29/16 5:51PM | HOUSE_OVERSIGHT_019546

CHAPTER 7 String Puller It wasn’t that they put it on me asan individual—that I’m uniquely qualified [or] an angel descending from the heavens—as that they put it on someone, somewhere. —EDWARD SNOWDEN, Moscow, 2013 D OWNLOADING NSA documents was not Snowden’s only rogue activity while working at the NSA for Dell in 2012. Three weeks after the CryptoParty, Snowden began anonymously contact- ing a high-profile journalist. He used the same alias, Cincinnatus, that he used with Sandvik and to advertise the Oahu CryptoParty. The journalist to whom he wrote on December 1, 2012, was Glenn Greenwald, the previously mentioned Rio-based columnist for The Guardian. Greenwald had not always been an activist journalist. He had been a litigation lawyer at the elite New York firm of Wachtell, Lip- ton, Rosen & Katz. He was also an entrepreneur, owning part of Master Notions, a company that, among other things, had a 50 per- cent financial interest in the pornographic website HJ (an acronym that originally stood for “Hairy Jock”). All did not go well with this enterprise. In 2004, Greenwald became involved in an acrimonious lawsuit with his other associates in HJ. As a result, he had a number | | Epst_9780451494566_2p_all_r1.z.indd 59 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019547

60 | HOW AMERICA LOST ITS SECRETS of open legal judgments filed against him, including an $85,000 lien by the IRS. After resigning from his law firm in 2005, he moved to Rio de Janeiro and began a new career as a blogger for the Internet maga- zine Salon. He wrote fierce, and often brilliant, polemics against U.S. government surveillance and other perceived intrusions on personal privacy. The extent of his bitter antagonism toward the activities of the “surveillance state,” as he called it, was reflected in the title of his 2006 book, How Would a Patriot Act? Defending American Val- ues from a President Run Amok. His position on surveillance was unrelenting, even when it came to the president. “By ordering illegal eavesdropping, the president had committed crimes and should be held accountable for them,” Greenwald wrote. When Barack Obama became president in 2009, Greenwald also attacked him for breaking the law by “ordering illegal eavesdropping.” Because of his opposi- tion to Obama, he contributed money to the libertarian campaign of Ron Paul, the same candidate to whom Snowden gave money. In August 2012, he had transferred his provocative blog, which @ had amassed a following of nearly one million readers (including @ Snowden), from Salon to The Guardian. The British newspaper shared his powerful anti-surveillance position, having first published the WikiLeaks documents that had been illicitly leaked by Manning and published by Assange in 2010. Greenwald was an activist as well as a journalist. He joined the board of directors of the Freedom of the Press Foundation (eventu- ally Runa Sandvik would join too). It had been set up expressly to funnel money to both Assange’s WikiLeaks site and the defense fund for Manning after he was arrested. Such a financial intermediary was necessary because American credit card companies were block- ing money transfers to these two causes in 2012. This “blockade” was taking its toll on WikiLeaks. According to Assange, “WikiLeaks had been cut off from more than go percent of its finances.” The Freedom of the Press Foundation came to its rescue. John Perry Bar- low, one of the songwriters for the Grateful Dead, was one of its chief financial backers. “The first serious info war is now engaged,” Barlow declared. “The field of battle is WikiLeaks.” He served with Greenwald and Poitras on its board. | | Epst_9780451494566_2p_all_r1.z.indd 60 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019548

String Puller | 61 Snowden was an avid reader of Greenwald’s screeds against the government. If he were to assume the role of a modern-day Pro- metheus, delivering forbidden NSA secrets to the public, Greenwald would be a logical candidate to break the story. Snowden could safely assume that Greenwald would be sympathetic to exposing NSA sur- veillance from his many blogs, tweets, and YouTube comments on the subject. For example, on November 13, 2012, just eighteen days before Snowden contacted him, Greenwald had written a blog for The Guardian asserting that the United States was “a surveillance state run amok.” In it, echoing very closely what Snowden said at his CryptoParty, Greenwald wrote, “Any remnants of internet anonym- ity have been all but obliterated between the state and technology companies.” Citing a story in The Washington Post, he continued, “Every day, collection systems at the National Security Agency intercept and store 1.7 billion e-mails, phone calls and other types of communications.” Asa result, Greenwald called for action in that blog posting, writ- ing, “The US operates a sprawling, unaccountable Surveillance State @ that, in violent breach of the core guarantees of the Fourth Amend- @ ment, monitors and records virtually everything even the most law-abiding citizens do.” That same week, Snowden invited Runa Sandvik to co-host his CryptoParty. One problem for Snowden in reaching out to Greenwald was Greenwald’s lack of any encryption for his e-mails. Communicating with a journalist like Greenwald who famously attacked the very organization for which Snowden worked was itself a risky under- taking, especially if he wanted to pass classified NSA documents to him. If his e-mails were intercepted by the NSA in Brazil (where Greenwald lived) and where the NSA was not restricted by U.S. law, he could lose his job or even be arrested. As Cincinnatus, he told Greenwald that he needed to immediately encrypt his computer. To make his point, he cited Greenwald’s November 12, 2012, blog. In it, Greenwald noted that General David Petraeus, then the CIA direc- tor, had been caught in a sex scandal because his personal e-mails had been intercepted. Snowden wrote to Greenwald that Petraeus would not have been exposed if he had used encryption. Snowden sent Greenwald instructions on how to install the necessary encryp- | | Epst_9780451494566_2p_all_r1.z.indd 61 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019549

62 | HOW AMERICA LOST ITS SECRETS tion software and a link to a twelve-minute video on encryption (which might have been the same video he used at his CryptoParty a few weeks earlier). Greenwald did not manage to encrypt his computer, however, and Snowden, unwilling to deal with Greenwald through an unen- crypted channel, broke off contact with him in January 2013. Even so, he did not give up his plan of using Greenwald in his enterprise. He merely sought an intermediary who used encryption. He chose Laura Poitras. He knew she and Greenwald were found- ing board members of the Freedom of the Press Foundation. Green- wald had written about her extensively. For example, he wrote an entire blog about her confrontation with the U.S. government and her plans to make a documentary about the “US Government’s increasing powers of domestic surveillance [through] its expanding covert domestic NSA activities.” Since 2011, Poitras had been diligently filming the construction of a massive NSA repository for data in Bluffdale, Utah. In the anti- surveillance culture, the structure had become symbolic of the pow- @ ers of the NSA. In fact, it was the same NSA site that Parker Higgins @ photographed from a blimp in the fall of 2013 and posted on the Internet after Poitras had released her documentary about the NSA‘s use of the Bluffdale repository for domestic spying. Aside from her connections with Greenwald, Poitras had other impressive credentials. Born in 1964 in Boston, she came from a wealthy family that donated large sums of money to philanthropic causes, including $20 million for research on bipolar disorders. After graduating from the New School for Public Engagement in 1996, she pursued a career as an activist filmmaker. Her focus quickly became exposing NSA surveillance. One of her short documentaries about the NSA’s domestic surveillance program was featured on the New York Times website and attracted enormous attention in 2012. As a dedicated opponent of the surveillance state, she participated in public events with William Binney, the ex-NSA whistle-blower, and Jacob Appelbaum. In April 2012, for example, she made a pre- sentation at the Whitney Museum in New York with Binney and Appelbaum. She had become such a leading activist against the NSA by December 2012 that Appelbaum, after lauding her work, inter- | | Epst_9780451494566_2p_all_r1.z.indd 62 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019550

String Puller | 63 spersed clips from her short film in his keynote address at the Chaos Computer Club convention of hacktivists in Berlin that month. Snowden also closely followed her rise in this world. By simply googling Poitras’s name in January 2013, he would have learned about her connections with Greenwald, Appelbaum, Binney, Assange, and other leading figures in the anti-surveillance camp. When asked later by Poitras why he had chosen her to help him, Snowden replied, “I didn’t. You chose yourself.” The problem for Snowden was anonymously drawing her into his enterprise. Poitras was living in Berlin in January 2013, which made her vul- nerable to NSA surveillance. To get to her through an encrypted channel, Snowden chose a circuitous approach. On January 11, he wrote to Micah Lee in Berkeley, California. Given Lee’s residence in the United States, as Snowden knew, the NSA would be legally barred from monitoring his communications without a warrant. He used Lee, who was the chief technology officer at the Freedom of the Press Foundation, as the encrypted gateway to Poitras. Lee was also well-connected to others whom Snowden had contacted @ for his CryptoParty. Lee had been an associate of Runa Sandvik’s at @ Tor and was a prominent member of Noisebridge, an eclectic anti- government hackers’ commune based in Northern California, of which Appelbaum was also a member. To contact Lee, Snowden chose the alias Anon1o8. Anon is an alias frequently used by members of the Anonymous commune of hacktivists. “I’m a friend,” Snowden wrote to Lee. “I need to get information securely to Laura Poitras and her alone, but I can’t find an email gpg key for her.” The “gpg” encryption key he asked for, more commonly called a PGP key, was the so-called public key for an encryption system called Pretty Good Privacy, or, for short, PGP. This encryption system required both a public and a private key. Snowden asked Lee to provide the former one, because Poitras had the latter one. Lee wrote to Poitras about Anon1o8. The next day, with the approval of Poitras, Lee supplied Poitras’s public key to Snowden, or, as he knew him, Anon108. With it, Snowden contacted Poitras directly. He asked her as a first step to open an anonymous e-mail account using Tor software. Poi- tras later wrote about this initial contact, “I was at that point film- | | Epst_9780451494566_2p_all_r1.z.indd 63 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019551

64 | HOW AMERICA LOST ITS SECRETS ing with several people who were all being targeted by the [U.S.] government.” Many of the people she was filming, including Appel- baum, Assange, Binney, and the former NSA employee Thomas Drake, could attract interest by U.S. or foreign intelligence services. Snowden asked Poitras to take out a new enciphering key to use exclusively for her liaison with him. It provided them both with an extra layer of protection from any surveillance by law enforcement. Presumably, she accommodated his requests because she anticipated that the anonymous person would use this encrypted channel to send her highly sensitive material. On January 23, Snowden wrote to Poitras under yet another alias. This time he called himself Citizen Four. He wrote, “At this stage I can offer nothing more than my word.” He then said falsely, “I am a senior government employee in the intelligence community.” She had no way of knowing at this “stage” that despite giving her his “word,” he was not who he claimed to be. He was not a “government employee,” he was not a “senior” official, and he was not a member of the “intelligence community” (which is composed of the intel- @ ligence services of the U.S. government). He would later also claim @ to her that he had been “a senior adviser to the CIA” and “a senior adviser to the DIA.” That was untrue, too. In January 2013, he was merely a contract employee of Dell’s working as a computer techni- cian at the NSA base in Hawaii. Snowden told her in his initial e-mail that he was well acquainted with her career as an anti-surveillance activist. He said that he had read Greenwald’s account in Salon that past April, a blog in which Greenwald detailed the forty times in which Poitras was searched by U.S. authorities. The story also said that Poitras believed she was on a special watch list and under constant U.S. government surveillance. She had come under such scrutiny by U.S. authorities, it turned out, because of her documentary about American military abuses of civil- ians in Iraq in 2006, titled My Country, My Country. While filming it, she was at a place close to an insurgent ambush of U.S. troops in Iraq. Her presence at the ambush site led army intelligence officers to suspect (without any evidence) that she might have been tipped off by the insurgents. She firmly denied the charge, and the govern- ment never substantiated it. Even so, because of this incident, since | | Epst_9780451494566_2p_all_r1.z.indd 64 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019552

String Puller | 65 2006 she had been kept on a list that caused authorities to search her at airports. As a result, she took elaborate countermeasures to evade any possible surveillance of her communications. Snowden knew about this incident because Greenwald described it in great detail in a blog that Snowden read (as he later told Green- wald). “Poitras is now forced to take extreme steps—ones that ham- per her ability to do her work,” Greenwald wrote. “She now avoids traveling with any electronic devices. She uses alternative methods to deliver the most sensitive parts of her work—raw film and inter- view notes—to secure locations. She spends substantial time and resources protecting her computers with encryption and password defenses. Especially when she is in the US, she avoids talking on the phone about her work, particularly to sources. And she sim- ply will not edit her films at her home out of fear—obviously well grounded—that government agents will attempt to search and seize the raw footage.” She claimed, as she told journalists, she was the victim of “Kafkaesque government harassment.” Snowden was duly impressed with her concerns about govern- @ ment surveillance, which he agreed was ubiquitous. Indeed, he later @ described her as “more paranoid when it comes to electronic security than I can be.” He meant it as a compliment. Such functional para- noia or “operational security,” as Greenwald would call the precau- tions that she took, dovetailed with Snowden’s growing conviction that universal encryption was necessary to defeat the surveillance state. It also made her the perfect channel for Snowden to safely pass some of the classified documents he stole to Greenwald and other journalists. It was not difficult to get her to cooperate in his plot. He wrote, for example, “The surveillance you've experienced means you have been ‘selected’—a term which will mean more to you as you learn how the modern SIGINT [signals intelligence] system works.” Just as she had been “chosen” by her work to act as his conduit, accord- ing to Snowden, she had been chosen by the NSA as a target because of her work. The idea of her being “selected” by an invisible signals intelligence agency, the NSA, could only excite her longtime con- cerns about being watched by the government. “Your victimization by the NSA system means that you are well | | Epst_9780451494566_2p_all_r1.z.indd 65 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019553

66 | HOW AMERICA LOST ITS SECRETS aware of the threat that [the NSA’s] unrestricted, secret abilities pose for democracies,” he continued. “I hope you understand that con- tacting you is extremely high risk and if you are willing to agree to the following precautions before I share more, this will not be a waste of your time.” Further playing on her concern, he asked her to confirm to him “that no one has ever had a copy of your private key and that it uses a strong pass phrase.” Such precautions were neces- sary because “your adversary is capable of one trillion guesses per second.” That “adversary” was, as she knew from her previous film, the NSA. At this point, she knew she was entering into a dangerous liaison with an unknown party in pursuit of NSA secrets. She won- dered if he might be part of a plan to entrap her or her contacts like Assange and Appelbaum, as she noted in her diary. “Is C4 a trap?” she asked herself, referring to her Citizen Four source. “Will he put me in prison?” To elude this “adversary,” Snowden stressed to Poitras that she would have to adopt a conspiratorial frame of mind. “If the device you store the private key and enter your pass phrase on has been @ hacked, it is trivial to decrypt our communications,” he explained. “If @ you publish the source material, I will likely be immediately impli- cated.” If her correspondent could be “immediately implicated,” it meant that he was a person authorized to handle these secrets. So Poitras knew, as early as January 2013, that she was creating an encrypted channel for someone with access to NSA secrets who would be incriminated by providing them to her. The key source for Poitras’s previously referred to short video was Binney. Like her new source, he had been authorized to handle NSA secrets. Binney had been an NSA technical director until he had retired in 2001. The NSA‘s domestic surveillance program that Binney told the press about years before being interviewed in Poi- tras’s film was called Stellarwind. It involved data mining domestic communications and financial transactions that had been authorized by President George W. Bush in 2001 after 9/11 as commander-in- chief under the war powers given to him following the attacks. It indeed led to a major exposé on domestic spying by The New York Times in December 2005. Binney had never provided Poitras with any NSA documents | | Epst_9780451494566_2p_all_r1.z.indd 66 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019554

String Puller | 67 to back up the charges he made that Stellarwind was an unlawful domestic surveillance operation. He could not have done so without violating his sworn oath and, for that matter, U.S. anti-espionage statutes. Binney made it clear to her and other journalists that he was not a lawbreaker. But her new source, C4, was willing to do what Binney (and other insiders) had refused to do. He was offer- ing in these e-mails to provide her with secret government docu- ments, even though it would implicate him as an outlaw. To further whet her appetite, he told her that these up-to-date NSA documents would fully substantiate the allegations that Binney made in her film. Even more important, he said Binney’s 2001 disclosures were still relevant to her cause. “What you know as Stellarwind has grown,” he wrote to her. “The expanded special source operations that took over Stellarwind’s share of the pie have spread all over the world to practically include comprehensive coverage of the United States.” In fact, as Snowden knew from the Inspector General report he had read, the NSA had terminated Stellarwind almost a decade earlier. President Bush ended it after top officials of the Justice @ Department insisted that he did not have the legal authority for the @ domestic part of Stellarwind. Instead, he asked Congress to revise FISA to meet the objections of the Justice Department. The result was the FISA Amendment Act of 2006. Unlike the previous Stel- larwind program, it did not permit domestic surveillance. It speci- fied that the government could not target any person in the United States or anywhere else in the world under this authority. Nor could it target any foreign person, even one residing outside of the United States, to acquire information from a particular known person inside the United States. As the act recognized that information about U.S. citizens might mistakenly be intercepted by the NSA, it required that such data about Americans be expunged in a bimonthly review by a Justice Department task force. Although the NSA program in place in 2013 was not the comprehensive domestic surveillance that Snowden claimed it to be, Poitras had no way of knowing at this early state that her source was misleading her. He offered to substantiate her worst fears about the growth of NSA surveillance: “I know the location of most domestic intercep- tion points, and that the largest telecommunication companies in the | | Epst_9780451494566_2p_all_r1.z.indd 67 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019555

68 | HOW AMERICA LOST ITS SECRETS US are betraying the trust of their customers, which I can prove.” He even proffered evidence implicating President Barack Obama in illegal surveillance. “There is a detailed policy framework, a kind of martial law for cyber operations, created by the White House. It’s called presidential policy 20,” he wrote to her. It was an eighteen- page directive that Obama had signed four months earlier in Octo- ber 2012. Snowden was offering to reveal to her up-to-date evidence of a surveillance state in America presided over by the president himself. It was what she had been searching for over the past three years. How could she, as an activist filmmaker, resist such a sensa- tional offer? He further explained to her that he had placed great trust in her discretion. “No one, not even my most trusted confidante, is aware of my intentions, and it would not be fair for them to fall under sus- picion for my actions,” he said. Poitras must have found it flattering that a total stranger was willing to disclose to her in e-mails what he would not tell even his “most trusted confidante” about his intentions to commit an illicit @ breach of U.S. national security. It also put her under enormous @ stress. She noted in her journal that the pressure made her feel as if she were “underwater.” “I am battling with my nervous system. It doesn’t let me rest or sleep. Eye twitches, clenched throat, and now literally waiting to be raided.” Snowden was also taking an extraordinary risk. After all, he had no way of knowing who else she told about him. She had long been concerned, with good reason, that the U.S. government was out to get her. An unknown person offering to supply her with secret docu- ments could be attempting to entrap her. So Snowden could not pre- clude the possibility that she would consult with others about the offer he was making her. Because her current documentary project included interviews by her with Assange, Appelbaum, and three ex- NSA executives, intelligence services with sophisticated surveillance capabilities might also have taken a professional interest in her com- munications, as Poitras herself had suspected. Even if Snowden was somehow able to use his position as a system administrator at Dell to ascertain that the NSA did not have Poitras under surveillance, he could not be sure that other agencies, such as the Russian and Chi- | | Epst_9780451494566_2p_all_r1.z.indd 68 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019556

String Puller | 69 nese intelligence services, were not monitoring his communications with her. It was, however, a chance Snowden was willing to take. Snowden, in any case, did not intend to conceal his identity for more than a few months. He told Poitras he had a specific purpose in allowing her to name him in her ongoing film project. Indeed, he said it was essential in his plan to prevent others, including pre- sumably his “most trusted confidante,” from being suspected by law enforcement of helping him in his enterprise. He prevailed on her to accommodate his plan, saying, “You may be the only one who can prevent that, and that is by immediately nailing me to the cross rather than trying to protect me as a source.” His choice of the imag- ery of crucifixion suggested that like Jesus Christ he was willing to sacrifice himself for the sake of others. In keeping with their operational security arrangement, Snowden said that he would first send her an encrypted file of documents that she would not be able to read. Only after his conditions were met and “everything else is done,” he said, “the key will follow.” He was now pulling the strings. To get that key, she had to follow his instructions. @ One of his conditions was that she help him recruit Greenwald @ and other outlets for his disclosures. “The material provided and the investigative effort required will be too much for any one per- son,” he wrote to Poitras. He next directed her to contact Greenwald. “T recommend that at the very minimum you involve Greenwald. I believe you know him.” (Snowden apparently did not tell her that he had unsuccessfully attempted to reach out to Greenwald before he had contacted her.) His continued interest in Greenwald was understandable. Aside from Greenwald’s opposition to what he called the “Surveillance State,” he was a gateway to The Guardian. That publication had become an important player in the business of disclosing govern- ment documents by publishing a large part of the U.S. documents supplied to WikiLeaks, as we have seen. By breaking whistle- blowing stories about U.S. intelligence, it had also greatly increased the circulation of its website. As an establishment newspaper, it also gave these WikiLeaks stories credibility with the media. So despite Greenwald’s inability to create an encrypted channel, Snowden still needed him. He had no reason to believe that Greenwald would turn | | Epst_9780451494566_2p_all_r1.z.indd 69 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019557

7O | HOW AMERICA LOST ITS SECRETS down the opportunity for a whistle-blowing scoop for The Guard- ian. After all, the classified documents Snowden would provide him would also give credence to both Greenwald’s book and his many blogs denouncing U.S. government surveillance. Aside from Greenwald and Poitras, Snowden sought an outlet inside the American establishment. So he had Poitras write to Barton Gellman, the Pulitzer Prize-winning reporter for The Washington Post. Poitras had met Gellman in 2010, when they were both fellows at NYU’s Center on Law and Security. Poitras had requested help in encrypting her computer from Karen Greenberg, the executive director of the center, who took her “by the hand” to meet Gellman, Greenberg’s resident expert on encryption software. Born in 1960, Gellman graduated from Princeton in 1981 and became an award- winning investigative reporter for the Miami Herald, the Post, and Time magazine. He was also the author of Angler: The Cheney Vice Presidency. If Gellman could be drawn into the enterprise, he could provide Snowden with a gateway to the prestigious American paper credited with bringing down President Richard Nixon in the Water- @ gate scandal. @ Poitras, as the go-between for Snowden, immediately contacted Gellman. After telling him she was involved in a story about NSA surveillance, she suggested that they meet in New York City. For their rendezvous, Poitras took a number of precautions to evade anyone attempting to follow her. She had Gellman first meet her in one coffee shop in lower Manhattan. When he arrived, she had him follow her on foot to another coffee shop, following her anti- surveillance tradecraft. Once assured no one was watching them, she ordered coffee for herself and Gellman. Over coffee, she told Gell- man about Snowden, whom she described as her anonymous source. She said that he was willing to supply Gellman with documents that would expose domestic surveillance, if Gellman agreed to write a story on it for the Post. Even though Gellman had left the staff of the Post in 2010, he had previously written several stories on that subject for the newspaper, and he was also highly regarded by the editors there, Gellman was interested in Poitras’s offer (although he would consult a friend at the Justice Department about the legality of publishing NSA documents). | | Epst_9780451494566_2p_all_r1.z.indd 70 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019558

String Puller | 71 Snowden had now laid the groundwork for at least two possible outlets. Poitras, however, was having some difficulty in bringing Greenwald in on the plan. Like Snowden, she did not trust writing to him in unencrypted e-mails, and because Greenwald lived in Bra- zil, she still had not found an opportunity for a face-to-face meeting with him. That opportunity arose in mid-April 2013. Greenwald had flown to the United States to give the lead speech at an event in Yonkers, New York, sponsored by the Council on American-Islamic Rela- tions, a pro-Muslim civil rights organization. He had delivered the keynote speech at its previous meeting in San Jose, California, where his impassioned depiction of the American “Surveillance State” received a rousing ovation from the attendees. He was invited to speak at this award dinner for its East Coast chapter. Poitras flew from Berlin to New York to see him. On April 19, 2013, she arranged to meet Greenwald at noon in the restaurant of the Marriott hotel where Greenwald was staying. When Greenwald arrived at the restaurant carrying a cell phone, she explained to him @ that the NSA could surreptitiously turn his cell phone into a micro- @ phone and use it to eavesdrop on their conversation. She told him to go back to his room and leave his phone there. When he returned, phoneless, she took further precautions by having them change tables several times. Greenwald accepted these tactics because, as he later said, she was in charge of their “operational security.” When they finally settled at a table in the nearly empty restau- rant, she showed Greenwald e-mails she had received from Citizen Four. Greenwald, as he recounted, made “no connection” to the “long-forgotten emails” he had received from Snowden under the alias Cincinnatus. Reading the e-mails that Snowden had sent to Poitras, he was impressed with the “sincerity” of the anonymous correspondent. When Poitras showed Greenwald Citizen Four’s mission state- ment in which he said his motive was to end the U.S. “surveillance state,” Greenwald was further impressed with the source. The sur- veillance state Snowden described closely dovetailed with the sur- veillance state that Greenwald had described himself in his speech at the Council on American-Islamic Relations dinner in 2012. Of | | Epst_9780451494566_2p_all_r1.z.indd 71 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019559

72 | HOW AMERICA LOST ITS SECRETS course, the similarity of the phrasing might not have been entirely coincidental. Greenwald’s 2012 speech had been put on YouTube and widely circulated on the Internet just a few days before Snowden first wrote to him on December 1, 2012. Snowden identified himself as a privacy advocate, which was also how Greenwald often identi- fied himself in his speeches. He also echoed other concerns Green- wald had publicly expressed, including defending American privacy from government intrusions. Snowden promised the leaks he would supply would provide dra- matic results. He asserted in one of his e-mails to Poitras that the “shock” of the documents he would give Greenwald would result in the public’s learning about the secret “mechanisms through which our privacy is violated.” According to Snowden’s assessment, follow- ing that initial uproar, they could achieve another objective in their common cause. “We can guarantee for all people equal protection against unreasonable search,” he wrote. In light of this convergence of views, it is not surprising that Greenwald was fully convinced of Citizen Four’s bona fides. He said to Poitras, “He’s real,” and he @ agreed to help break the story in The Guardian. @ Poitras now revealed to Greenwald that Citizen Four would deliver an entire trove of secret documents to them in six to eight weeks. According to this timetable, the Greenwald scoop and the “shock” Citizen Four promised would come in early to mid-June 2013. At this point in April, Snowden was in full control. Although his job at Dell involved endlessly monitoring largely meaningless encrypted messages in the NSA tunnel, he had been able to get three major journalists to react favorably to his proposal. None of them knew his name, position, age, location, or where precisely he worked. Nor did they know the means by which he planned to obtain the secrets that he dangled before them. They also did not know where, or even if, they would meet their source. Their total knowledge about him was the description he improperly gave of himself: a “senior government employee in the intelligence community” (Greenwald speculated that he was a disgruntled CIA station chief). Even though they were operating largely in the dark, these three journalists acted as almost any other ambitious reporter would if he or she were offered a major scoop about illegal acts of the govern- | | Epst_9780451494566_2p_all_r1.z.indd 72 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019560

String Puller | 73 ment. In addition, the information was in line with what they had previously investigated or written about. None of these journalists had any reason to doubt at this point that their anonymous source was anything but the sincere whistle-blower he claimed to be. They could not have known from his anonymous e-mails that aside from the whistle-blowing documents he promised them, he was in the process of stealing a large number of other documents that con- cerned the NSA’s sources and methods in foreign countries. These documents, to which Snowden never referred in his correspondence with them, had little if anything at all to do with domestic spying on American citizens. | | Epst_9780451494566_2p_all_r1.z.indd 73 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019561

CHAPTER 8 Raider of the Inner Sanctum They think there’s a smoking gun in there that would be the death of them all politically. —EDWARD SNOWDEN, Moscow, 2014 HE NIGHTMARE OF THE NSA is a penetration. As the CIA, the FBI, and the NSA found out in the 1990s, no intelligence service is invulnerable to it. Any employee of a large intelligence organiza- tion can turn, or be turned, against it. Among the more than ten thousand intelligence workers employed by the NSA, it is a near certainty that over time more than one of them will become dis- satisfied with their work. A worker may have a personal grievance about salary, lack of promotion, or treatment by his or her superi- ors. Disenchantment with the NSA may also proceed from idealis- tic objections. The NSA is in the business of secretly intercepting messages, and an insider could come to find its spying activities at odds with his or her own beliefs about the violation of privacy. For any of these reasons, a disgruntled insider could go rogue. He or she then might attempt to right a perceived wrong by disclosing NSA secrets to another party. That party might then induce or blackmail the rogue employee into disclosing further secrets. | | Epst_9780451494566_2p_all_r1.z.indd 74 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019562

Raider of the Inner Sanctum | 75 To guard against this, the NSA has developed a well-organized system for stratifying its data so that obtaining critical secrets required a rogue employee to burrow into its heavily protected inner sanctum. As part of this system, the NSA divides its data into differ- ent tiers depending on the importance of the secrets to its operations. The first tier, Level 1, is mainly administrative material. This data would include FISA court orders and other directives its employees might need to check on to carry out their tasks. Level 2 contains data from which the secret sources have been removed. This tier, available to other intelligence services and policy makers, includes reports and analysis that can be shared. Level 3 contains documents that cannot be shared outside a small group of authorized individu- als, because they disclose the secret sources through which the NSA surreptitiously obtained the information. This third tier includes, for example, compiled lists of sources in China, Russia, Iran, and other adversary countries. It also discloses the exotic methods the NSA uses to get some of this data. Level 3 documents also include reports on specific NSA, CIA, and Pentagon operations unknown to @ adversaries. These Level 3 documents are described by NSA execu- @ tives as “the Keys to the Kingdom,” because they could invalidate America’s entire intelligence enterprise if they fell into the hands of an adversary. And, as far as is known, prior to 2013, there had been no successful theft of any Level 3 documents. Because of their extreme sensitivity, Level 3 documents were not handled by most of the private firms providing independent contrac- tors. At Dell, Snowden had access mainly to Level 1 and Level 2 data (which he could, and did, download from shared sites on NSANet). These lower-level documents had whistle-blowing potential because they concerned NSA operations in the United States. They did not reveal, however, sources that the NSA used in intercepting the mili- tary and civilian activities of foreign adversaries. Snowden quit his job at Dell as a system administrator on March 15, 2013, to take another job working for the NSA in Hawaii at Booz Allen Hamilton. Unlike other outside contractors that ser- viced the NSA, the firm he now chose specialized in handling the NSA’s Level 3 data. | | Epst_9780451494566_2p_all_r1.z.indd 75 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019563

76 | HOW AMERICA LOST ITS SECRETS When Snowden applied to Booz Allen earlier in March 2013, the company had no opening for a system administrator at the National Threat Operations Center, an NSA unit in which it dealt with Level 3 data. It did have an opening for an infrastructure analyst, a lower-paying job involving maintaining the computer technology necessary to monitor threats. Despite a cut in pay, Snowden took that job. “Snowden was an IT guy, not a SIGINT analyst,” a former NSA Signals Intelligence officer pointed out. “He was working as a contracted infrastructure analyst for NSA’s Information Assurance arm,...[which, ironically as it turned out] protects classified U.S. communications from potential intruders.” Steven Bay, the manager at Booz Allen who hired and supervised Snowden, recalled that the first “red flag” came up soon after Snowden began he training, when “Snowden began asking about a highly classified mass-surveillance program” to which Snowden did not have access (although Bay did). In retrospect, Bay realized that Snowden had applied for the job for a specific reason. “He targeted our [Booz Allen] contract directly,” Bay said. “Somehow he figured out that our contract, and what we did @ on that contract, were the types of gates he needed to get access to.” @ Snowden subsequently told the South China Morning Post that he took this job to “get access to lists of machines all over the world the NSA had hacked.” If so, he was after the keys to the NSA’s king- dom of global surveillance. Booz Allen held those keys. “He targeted my company because we enjoy more access than other companies,” Booz Allen’s vice-chairman Michael McConnell said with the bene- fit of hindsight. As a result of the theft, he appraised, “an entire gen- eration of intelligence was lost.” McConnell, a former NSA director, was in a position to know. Snowden’s sudden career change had both advantages and disad- vantages for the enterprise he was planning. The main advantage was that he would have proximity to the computers in which were kept the “lists” he sought of NSA global sources. The main disad- vantage, aside from a cut in salary, was that he would no longer be a system administrator. This change meant he would no longer have privileges to bypass password restrictions or temporarily transfer data. Instead, as an infrastructure analyst, he would not have pass- | | Epst_9780451494566_2p_all_r1.z.indd 76 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019564

Raider of the Inner Sanctum | 77 word access, at least during the two-month-long training period, to the computers that he had not been specifically “read into,” which did not include those computers that stored the Level 3 lists. Access to these tightly controlled compartments was limited to only a hand- ful of analysts at the center who had a need to know. Because the new job entailed handling higher-level secret docu- ments, Booz Allen had stricter requirements for applicants than Dell. To slip by them, Snowden had engaged in a minor subterfuge. He wrote on his application that he was expecting a master’s degree from the online division of Liverpool University in England. In fact, he had not completed a single course at Liverpool and would not be receiving any sort of a degree from it. Booz Allen did not verify this and had agreed to hire him as a trainee-analyst. It did not change that decision even after it found out about his subterfuge. According to Admiral McConnell, Snowden never actually worked in the Booz Allen offices, which are housed in a skyscraper in downtown Honolulu. Instead, he was immediately assigned to work at the NSA’s highly sensitive National Threat Operations Center at @ the Kunia base, the same location where he had worked for Dell. @ Before he could begin working there, however, he needed to fly to Maryland to take a mandatory orientation course at the NSA. The course was given in an eleven-story building, with a sheer wall of black glass, on the NSA’s 350-acre campus at Fort Meade. He arrived there from Hawaii on April 1, 2013. Like every other Booz Allen contractor who worked at the NSA’s center, Snowden was required to sign the “Sensitive Compartmented Information Nondisclosure Agreement.” In this document, Snowden acknowledged that he had been granted access to sensitive compartmented information, called SCI, as part of his work and that he understood that any disclosure of that information to an unauthorized person would violate fed- eral criminal law. He was also told, as were all new contract employ- ees at Booz Allen, that its disclosure could damage the interests of the United States and benefit its enemies. In signing the document, he swore an oath not to divulge any of this information without first receiving written approval from U.S. authorities. So less than two months before he downloaded sensitive compartmented infor- | | Epst_9780451494566_2p_all_r1.z.indd 77 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019565

78 | HOW AMERICA LOST ITS SECRETS mation, he was fully aware of what the consequences of divulging this information would be. By this time, as we know, he had already agreed to deliver classified data to three journalists. Snowden believed that bringing complaints to NSA lawyers or supervisors was, as he put it, “playing with fire.” “When I was at NSA,” Snowden later said in Moscow, “everybody knew that for anything more serious than workplace harassment, going through the official process was a career-ender at best.” Nevertheless, on April 5, 2013, while still in the training facility in Maryland, he apparently sought to establish a paper trail for him- self. He wrote a letter to NSA’s Office of the General Counsel asking whether or not NSA directives take precedence over acts of Con- gress. A lawyer from the Office of the General Counsel responded three days later, addressing Snowden as “Dear Ed.” The lawyer said that acts of Congress take precedence over NSA directives. He also suggested that “Ed” phone him if he needed any further clarifica- tion. Presumably, Snowden had asked the question to elicit a reply he could later use to bolster his claim that the NSA had ignored or @ rejected policies regarding NSA directives. Instead, the “Dear Ed” @ response was of little use to Snowden, because it did not dispute his point that NSA directives must lawfully conform to the acts of Con- gress. The NSA lawyer never heard back from “Ed.” Snowden completed his orientation course at Fort Meade on Fri- day, April 12, 2013. While he was in Maryland, he took time off to pay visits to both of his divorced parents. It would be the last time he would see either of them in the United States. He returned on April 13 to Hawaii. One domestic task he had to attend to was helping Mills pack up their possessions, which they stored in boxes in the garage. The lease on their house was up on April 30, 2013, and they had to move. According to Mills, they found a temporary rental just a few blocks away. On Monday, April 15, Snowden began on-the-job training as an analyst at the National Threat Operations Center. He would not complete the course. The same week he began the training, he prepared his exit by writing to Booz Allen and saying he needed a brief medical leave in May to undergo treatment for epilepsy symp- toms. As far as is known, he did not suffer from epilepsy. Booz Allen | | Epst_9780451494566_2p_all_r1.z.indd 78 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019566

Raider of the Inner Sanctum | 79 required a minimum of one month’s notice for foreign travel. By making the request, he lessened the likelihood that it would arouse undue suspicion when he departed for Hong Kong with stolen docu- ments on May 18. This brief window left him some four weeks to take the lists that he coveted. Snowden carried out the heist with precision reminiscent of a Mission: Impossible movie caper. First, he needed to get passwords to up to twenty-four compartments at the National Threat Operations Center that he had not been read into. Even in the “open culture” of the NSA, this was not an easy challenge. He would be asking one or more intelligence professionals to break strict NSA rules that not only prohibited them from disclosing their passwords to an unauthorized party such as himself but required them to report any unauthorized person who asked to use their passwords. Remarkably, he accomplished this incredible feat. He gained access to twenty-four compartments containing the NSA’s most closely guarded secrets in a matter of a few weeks. Next, he had to find the lists he was seeking in a vast ocean of @ data. For this task, he used software applications called spiders to @ crawl through the data and find the files he was after. He deployed these robotic spiders, which presumably had been programmed in advance, soon after he began working at the center. According to the subsequent NSA damage assessment, Snowden’s spiders indexed well over one million documents. Many of those that he copied and moved were from Level 3 sensitive compartmented information, according to the NSA analysis. The spiders also made his penetra- tion relatively safe. As previously mentioned, the Hawaii base did not have a real-time auditing system. So alarm bells did not go off in the security office when he indexed documents. Finally, Snowden had to find a way to transfer this data to a com- puter with an opened USB port. This task was complicated by a secu- rity precaution. Most of the computers at the center had had their ports sealed shut to prevent unauthorized downloads. Making the transfer even more difficult, he was working as an analyst in train- ing in an open-plan office with closed-circuit security cameras. But it was not impossible. System administrators sometimes used service computers that had unsealed ports to back up data before they did | | Epst_9780451494566_2p_all_r1.z.indd 79 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019567

80 | HOW AMERICA LOST ITS SECRETS maintenance work. Even though Snowden was no longer a system administrator, he could still perhaps befriend a system administrator or even steal or borrow a service computer. Whatever the NSA’s and Booz Allen’s security measures, Snowden succeeded in getting the files. In a matter of a few weeks, he man- aged to download hundreds of thousands of Level 3 documents to an unsealed computer. He also took some less sensitive documents from the administrative file (which contained mainly Level 1 documents) at the end of April. These later acquisitions included an order from the FISA court issued on April 25, 2013. He had completed the operation by May 17, the last day he would ever enter the NSA facility. He transferred the data he had amassed on the service computer, including the lists of the computers in Rus- sia and China that the NSA had succeeded in penetrating, onto stor- age devices, which he later said were thumb drives. Then he coolly walked past the security guards at the exit, who only seldom per- formed random checks on NSA employees. He carried out the entire operation with such brilliant stealth that @ he left few if any clues behind as to how he obtained his colleagues’ @ passwords to multiple compartments, moved the data from many different supposedly sealed computers to an opened service machine, or downloaded these documents to multiple thumb drives without arousing suspicion. The NSA would not discover the theft for fifteen days. His departure from Hawaii was also well prepared. Lindsay Mills had departed that morning for a planned two-week visit to the outer islands. This trip allowed him to pack his belongings without saying anything to her that might be difficult for her to later explain. He simply left a note that she could show to authorities saying that he was away ona “business trip.” He informed Bay that he would have to go in for epilepsy tests on the following Monday and Tuesday. If the results weren’t good, he might have to be out even longer. | | Epst_9780451494566_2p_all_r1.z.indd 80 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019568

CHAPTER 9 Escape Artist I’m not self-destructive. I don’t want to self-immolate and erase myself from the pages of history. But if we don’t take chances, we can’t win. —EDWARD SNOWDEN, Moscow, 2014 TT" NEXT EVENING, May 18, Snowden drove to Honolulu Inter- national Airport. He left his leased car in the parking lot. He took with him only carry-on baggage, including a backpack and a laptop with a Tor sticker on it. “I took everything I had on my back,” he said, referring to the backpack. He also said that he took enough cash to pay for his fugitive life and he took the thumb drives con- taining the NSA’s keys to the kingdom. At this point, of course, Snowden was not wanted by the author- ities. He had provided his employer and the NSA with a medical excuse for his absence from work so he would not be immediately missed. He had a valid passport, a credit card, and ID. Snowden’s des- tination was Hong Kong. After crossing the international date line, Snowden waited about three hours in the transit zone of Narita. He then boarded a plane to Hong Kong. After the four-hour flight from Narita, he arrived in Hong Kong early in the morning on May 20. He had visited Hong Kong at least once before, with Lindsay Mills, when he was stationed in Japan. According to Albert Ho, his | | Epst_9780451494566_2p_all_r1.z.indd 81 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019569

82 | HOW AMERICA LOST ITS SECRETS Hong Kong lawyer, Snowden stayed at a residence arranged for him in advance by a party whom Snowden knew prior to his arrival. As noted earlier, for the next ten days, Snowden did not use his credit card or leave any paper trail to his location. Wherever he was, “his first priority,” as he later told Greenwald, was to find a place safe from U.S. countermeasures. He brought with him a large number of electronic copies of NSA documents marked TS/SCI/NOFORN, which stood for “Top Secret, Sensitive Compartmented Informa- tion, and No Foreign Distribution.” According to government rules, data carrying these labels could not be removed from a government- approved “SCI facility.” But Snowden, who brought them with him into this semiautonomous zone in China, broke these rules. Wherever Snowden was staying, apparently he believed he was relatively safe. “That whole period was very carefully planned and orchestrated,” Snowden later told The Guardian in Moscow. On May 22, he sent an e-mail to Bay (who did not know he had left Hawaii) saying that his epilepsy tests came back with “bad” results, and he needed further medical attention. Here Snowden commu- @ nicated directly first with Gellman and then with Greenwald. He @ e-mailed Gellman under the alias “Verax.” Already, via Poitras, he had provided Gellman with PowerPoint slides from an NSA presentation about a joint FBI-NSA-CIA operation code-named PRISM. He believed it qualified as whistle- blowing because it revealed that the NSA, in intercepting e-mails, tweets, postings, and other web interactions about foreign terrorists, incidentally also picked up data about Americans. According to the rules imposed on the NSA by a 2007 presidential directive, whatever information was accidently picked up about Americans was sup- posed to be filtered out, and hundreds of compliance officers were to recheck the data every ninety days to assure that directive was being carried out. Even so, it was likely some data was not expunged in this process. So PRISM could cause embarrassment for the NSA. Snowden had not yet made arrangements to meet journalists, but now he proposed that Gellman join him in Hong Kong. In attempting to convince him of the urgency of the trip, he wrote that he had rea- son to believe that “omniscient State powers” imperiled “our free- dom and way of life.” He noted, with a touch of modesty, “Perhaps | | Epst_9780451494566_2p_all_r1.z.indd 82 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019570

Escape Artist | 83 Iam naive.” He also added dramatically, “I have risked my life and family.” Even so, Gellman declined coming to Hong Kong. (Accord- ing to Greenwald, Gellman could not make the trip, because lawyers for The Washington Post were uneasy with having a reporter receive classified documents in a part of China.) On May 24, 2013, Snowden attempted to apply more pressure on Gellman by telling him that the story about the PRISM program had to be published by the Post within seventy-two hours. Gellman could not accede to such a condition, because the decision of when to publish a story was made not by him but by the editors of the news- paper. He told Snowden that the earliest the story could be published was June 6, 2013, which was well past Snowden’s deadline. Snowden next turned to Greenwald in Brazil. Both Poitras and Micah Lee had made great efforts to tutor Greenwald on encryption protocols, with Lee’s sending Greenwald a DVD by FedEx that would allow him to receive both encrypted messages and encrypted phone calls. Even then, Greenwald was unable to fully install it. As a result, Greenwald still had not met Snowden’s requisites on encrypting his @ computer. @ With Gellman uncertain, Greenwald was now essential to Snow- den’s plan. If he was to have any newspaper outlet, he needed to persuade Greenwald to come to Hong Kong. At this point, he took matters into his own hands. On May 25, Snowden somewhat aggres- sively e-mailed Greenwald, saying, “I’ve been working on a major project with a mutual friend of ours. You recently had to decline short-term travel to meet with me.” Although he did not specify the “short-term travel” to which he referred, he added pointedly, “You need to be involved in this story.” He suggested that they imme- diately speak on the phone via a website that encrypts conversa- tions. Snowden began the call by complaining, “I don’t like how this is developing.” He made it clear that he, not the journalist he had selected, was pulling the strings. If Greenwald wanted the scoop, he had to follow Snowden’s instructions, which included dividing the scoops between The Guardian and The Washington Post. According to his plan, Gellman would break the PRISM story in the Post, and Greenwald would break the “mass domestic spying” story in The Guardian. In addition, he insisted that The Guardian publish his per- | | Epst_9780451494566_2p_all_r1.z.indd 83 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019571

84 | HOW AMERICA LOST ITS SECRETS sonal manifesto alongside its story. As he envisioned it, the media event would also include a video component in which Greenwald would interview him. Greenwald agreed to this micromanaging, So Snowden said he would send him what he called a “welcome package” of documents to demonstrate his good faith. His plan also required a face-to-face meeting. Snowden told him, “The first order of business is to get you to Hong Kong.” The whole conversation lasted two hours, according to Greenwald. Snowden sent him twenty classified NSA documents labeled “Top Secret.” He also included in the package his personal manifesto, which asserted that the NSA was part of an international conspiracy of intelligence agencies that were working to “inflict upon the world a system of secret, pervasive surveillance from which there is no refuge.” Meanwhile, Snowden told Poitras he was sending her a number of NSA documents, including a FISA warrant that had been issued less than a month earlier. He wanted that FISA warrant to serve as the @ basis of Greenwald’s scoop. It was perfect whistle-blowing material @ for The Guardian because it ordered Verizon to turn over all its bill- ing records for ninety days to the NSA. It was as close to a smoking gun as anything he had copied at the NSA. It would also get atten- tion because James Clapper, the director of national intelligence, had stated before Congress just two months earlier that the NSA did not collect phone data in America. This warrant would allow The Guard- ian, in the best tradition of gotcha journalism, to catch Clapper in an apparent lie. Continuing his string pulling, Snowden instructed Poitras not to show the FISA warrant to Greenwald until they were safely aboard a plane to Hong Kong. That would prevent Greenwald from releas- ing the story previously. He also sent Poitras an entire encrypted file of NSA documents, saying it would “include my true name and details for the record, though it will be your decision as to whether or how to declare my involvement.” He did not send her the key to decipher the file, saying, “The key will follow when everything else is done.” He further told her that he preferred that her new film | | Epst_9780451494566_2p_all_r1.z.indd 84 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019572

Escape Artist | 85 focus on him as the sole perpetrator of the leak so that no one else at the NSA would be suspected. Poitras and Gellman were not the only journalists involved in the news event. Poitras also asked Appelbaum to help her interview Snowden about the NSA’s operations. She later said that she needed someone with technical expertise in government surveillance to test the bona fides of Citizen Four. She believed that Appelbaum, who had participated in her anti-NSA presentations in 2012, qualified for the position. Snowden previously had contact with Appelbaum. Appelbaum had communicated with Snowden under his Oahu CryptoParty alias about an obscure piece of software just a few weeks after Snowden had met with Runa Sandvik in Hawaii in December 2012. Appel- baum, in fact, had worked with Sandvik as a core developer of Tor software. Snowden allowed Appelbaum to put detailed questions to him concerning the secret operations of the NSA before he met with Poitras and Greenwald in Hong Kong. Indeed, Poitras joined him in asking Snowden via encrypted e-mails such questions as “What @ are some of the big surveillance programs that are active today @ and how do international partners aid the NSA?” “Does the NSA partner with other nations, like Israel?” and “Do private companies help the NSA?” Snowden answered all the questions to the satis- faction of Appelbaum and Poitras. (The interview was published on July 8, 2013, with Snowden’s approval on the website of Der Spie- gel, the German weekly, which had also published the WikiLeaks documents.) As the days ticked away while Snowden was waiting for Green- wald in Hong Kong, Greenwald was awaiting a green light to go there from Janine Gibson, the editor of the Guardian website, who was based in New York. Under Gibson’s leadership, The Guardian's website had effectively “gone into the business of publishing gov- ernment secrets,” as the Guardian columnist Michael Wolff pointed out. Most of the documents had been supplied by Bradley Man- ning via WikiLeaks. Few if any of these previous documents The Guardian published were highly classified, and none were SCI top secret documents. The NSA documents Greenwald had received | | Epst_9780451494566_2p_all_r1.z.indd 85 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019573

86 | HOW AMERICA LOST ITS SECRETS from Citizen Four were another matter. They contained the sort of SCI communications intelligence data that no major newspaper had ever published before. Their disclosure might result in journalists’ being imprisoned, because both British law and US. law criminal- ized the disclosure by anyone of communications intelligence. As a lawyer, Greenwald recognized this danger. On the other hand, the NSA documents were far more explosive than the WikiLeaks mate- rial and promised an even greater spike in circulation. So Greenwald assumed that Gibson would be willing to authorize their publication and provide the expenses for his trip to Hong Kong. He flew from Rio to New York on May 30 to meet in person with Gibson, who had concerns about publishing what were pur- ported to be top secret documents that came from an anonymous source. She was certainly not willing to go along with Citizen Four’s demand that The Guardian publish his personal manifesto alongside the documents. Aside from its shrill and alarming tone, it sounded, as she told Greenwald, “a bit Ted Kaczynski-ish,” referring to the mathematician known as the Unabomber who had maimed or killed @ twenty-six people with anonymous mail bombs between 1978 and @ 1995. Kaczynski had also demanded that newspapers publish his personal manifesto. Gibson explained to Greenwald, “It is going to sound crazy to some people.” Her concern was that it would detract from the credibility of the rest of the story. Snowden had also writ- ten to Greenwald to explain his position. “Even the Constitution is subverted when the appetites of power demand it,” Snowden said. Paraphrasing President Thomas Jefferson, he continued, “Let us speak no more of faith in man, but bind him down from mischief by the chains of cryptography.” Snowden, showing his cultlike faith in encryption, substituted “cryptography” for Jefferson’s word “con- stitution.” Gibson was unmoved. The stolen NSA documents were another matter. They were an enormous scoop that could have a greater impact than the WikiLeaks scoop. Gibson authorized Greenwald’s trip to Hong Kong on the con- dition that he take with him a Guardian staffer in whom she had confidence, the Scottish-born Ewen MacAskill, a sixty-one-year-old veteran journalist who had been the Washington bureau chief for The Guardian. His assignment was to evaluate the bona fides of the | | Epst_9780451494566_2p_all_r1.z.indd 86 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019574

Escape Artist | 87 anonymous source in Hong Kong for Gibson. Greenwald accepted her terms. Poitras, who would be accompanying them, would be paying her own way. In case The Guardian failed to publish the story, Snowden had a contingency plan in place. While Greenwald was negotiating with Gibson, Snowden arranged for Micah Lee, Poitras’s associate at the Freedom of the Press Foundation, to build a personal website for him. Writing to Lee from Hong Kong, first under his alias Anon108 and later under his real name, Snowden said that he planned to post his “anti-surveillance manifesto.” He would also use it to post “a global petition against surveillance.” Snowden had Lee name the site “SupportOnlineRights.com.” According to Lee, the website would be built with a “dead man’s switch,” which would automatically trigger the release of NSA documents if Snowden was arrested. It was not clear whether Lee was doing this work as a freelancer or in his capacity as the chief technology officer for the Freedom of the Press Foundation. The website Lee built for Snowden proved unnec- essary when Poitras e-mailed him on June 1 that The Guardian had @ approved the trip and she and Greenwald were booked on a Cathay @ Pacific flight to Hong Kong. They would arrive the next day. In his preparation to go public in Hong Kong, Snowden showed himself fully capable of orchestrating what would become a major news story. He not only picked the journalists who would break it but also instructed each of them as to the timing, sequence, and content of their initial disclosures. In the security of his unknown residence in Hong Kong, he also worked to carefully separate the purloined NSA documents into two very different caches. “I care- fully evaluated every single document I disclosed,” Snowden explained to the Guardian journalists in early June. The documents in this first cache were selected to serve what he termed the “pub- lic interest.” In the hands of journalists, these selected documents, and the story he fashioned to accompany them, would burnish his image in the public consciousness as a whistle-blower. He did not turn over the second cache, telling Greenwald, “There are all sorts of documents that would have made a big impact that I didn’t turn over.” By the time he received the message from Poitras, Snowden had | | Epst_9780451494566_2p_all_r1.z.indd 87 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019575

88 | HOW AMERICA LOST ITS SECRETS finished his preparations for the journalists. With selected docu- ments copied on a thumb drive, he moved from the residence where he had been staying for ten days to a venue for meeting the report- ers. The place he chose, as noted earlier, was the Mira hotel in the Kowloon district of Hong Kong, where he checked in under his own name. He e-mailed Poitras his name and the address of the hotel; there was no longer any reason to hide his true identity. | | Epst_9780451494566_2p_all_r1.z.indd 88 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019576