CHAPTER 10 Whistle-blower They elected me. The overseers ... The [American] system failed comprehensively, and each level of oversight, each level of re- sponsibility that should have addressed this, abdicated their re- sponsibility. —EDWARD SNOWDEN, Moscow, 2013 Wi SNOWDEN in Hong Kong was attempting to reel in the journalists, Lindsay Mills returned to Honolulu from her “island-hopping” trip to find their house partially flooded and Snowden nowhere to be found. In a brief note Snowden left her, he said he was away on a business trip and indicated that, at least tem- porarily, their eight-year relationship was on hold. “T feel alone, lost, overwhelmed, and desperate for a reprieve from the bipolar nature of my current situation,” she wrote in her journal on June 2 (which would be June 3 across the international timeline in Hong Kong). “I’ve nearly lost my mind, family, and house over the past few weeks.” She also noted in her online journal, “Oh and I physically lost my memory [SIM] card with nearly all my adven- ture photos,” as well as other personal data. The loss would make it difficult to reconstruct her past activities with Snowden. In Hong Kong, if Snowden were following Lindsay’s online jour- nal, he would have read that his girlfriend had returned home, lost her data, and needed a “reprieve” from the situation in which he had | | Epst_9780451494566_2p_all_r1.z.indd 89 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019577

go | HOW AMERICA LOST ITS SECRETS put her. But because they were exchanging private text messages by then, he would not have needed to consult her public journal. Snowden was certainly aware that he would soon be the object of a manhunt that could involve those with whom he was acquainted. He instructed Poitras to mask their e-mail communications in cyber- space “so we don’t have a clue or record of your true name in your file communication chain.” Such precautions were necessary, he explained to her, because “every trick in the book is likely to be used in looking into this.” The journalists arrived the evening of June 2. The Mira hotel can be entered by guests both through a ground- floor lobby with a restaurant and a smaller third-floor lobby that connects to the Mira shopping mall. The instructions that Snowden sent Poitras on her arrival were an exercise in control: “On timing, regarding meeting up in Hong Kong, the first rendezvous attempt will be at 10 a.m. local time. We will meet in the hallway outside of the restaurant in the Mira Hotel. I will be working on a Rubik’s cube so that you can identify me. Approach me and ask if I know the hours of the restaurant. I’ll respond by stating that I’m not sure and @ suggest you try the lounge instead. I’ll offer to show you where it is, @ and at that point we’re good. You simply need to follow naturally.” According to Greenwald’s account, Snowden changed the plan to the upper lobby. “We were to go to the third floor,” Greenwald writes. “We were to wait on a couch near a ‘giant alligator’ ” which Poitras said was a room decoration. (A hotel executive told me that the hotel knew of no plastic alligator on the third floor but possibly it had been temporarily parked there by a hotel guest.) They were then to give the recognition signal. Although these instructions provided the atmospherics of “an international spy thriller,” as Greenwald described them, Snowden hardly needed any spy tradecraft to recog- nize Greenwald and Poitras because there were many photographs of them on the Internet. In any case, they gave the recognition signal, twice, in the des- ignated place, and a young man walked over to them holding a Rubik’s Cube. Greenwald noted, “The first thing I saw was the unsolved Rubik’s Cube, twirling in the man’s left hand.” The man said, “Hello,” and introduced himself as “Ed Snowden.” Greenwald was particularly surprised by Snowden’s boyish looks. | | Epst_9780451494566_2p_all_r1.z.indd 90 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019578

Whistle-blower | 91 “The initial impression was one of extreme confusion,” Greenwald wrote in his book. “I was expecting to meet somebody in his six- ties or seventies, someone very senior in the agency, because I knew almost nothing about him prior to our arrival in Hong Kong.” His initial confusion was understandable. Snowden, it will be recalled, had falsely identified himself to them in an e-mail as a senior mem- ber of the intelligence community. Snowden led Greenwald and Poitras to the nearby elevator, and they went through various corridors of the hotel to his room on the tenth floor. It was mainly occupied by a king-sized bed, but it also featured a sleek writing desk in the corner, two chairs, and a modernistic lamp. The bathroom was behind a glass partition, which could be closed off by a black louver blind. There was also a small refrigerator in which Snowden asked them to stow their cell phones. Snowden, as we know, had already told Poitras that he wanted her to make a documentary of the meeting. She therefore wasted no time in mounting her camera on a tripod. “Minutes after meet- ing, I set up the camera,” she said. Snowden told her, “When you @ are involved in an action which is likely to get you indicted, you @ typically don’t have a camera rolling in the room.” Nevertheless, he allowed her to film his actions for the next eight days. One pos- sible reason is that he had no intention of standing trial. In any case, as Poitras found out, Snowden was anything but camera shy. Over the next week, she would shoot over twenty hours of Snowden’s activities in that small room. It was essentially a one-man show, a presentation of him, by himself, for the appreciation of a global pub- lic. Poitras knew virtually nothing about her subject until ten min- utes before she began filming him. She had not even googled him, because she was concerned that her Internet search might alert the NSA and law enforcement authorities. In an over-the-top waiver of his own privacy, he allowed her to film him washing in the bath- room, preening his hair in the mirror, napping on his bed, getting dressed, and packing his bag. He even permitted her to film a private computer exchange between him and Mills (who was in Honolulu). That day Mills informed Snowden that two government investiga- tors had come to their home in Hawaii, asking her about Snowden’s whereabouts. When he had failed to show up for work on June 3 it | | Epst_9780451494566_2p_all_r1.z.indd 91 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019579

92 | HOW AMERICA LOST ITS SECRETS evidently set off alarm bells at Booz Allen and the NSA. Snowden expressed anger to the journalists in the room at the NSA’s intru- sions on the privacy of his girlfriend. Snowden also performed his security procedures on camera, including stuffing bed pillows under the door to block any eaves- droppers and throwing a red blanket over his head, which he called jokingly his “magical cloak of power.” He explained to Greenwald that he donned his “cloak” when he turned on his laptop to prevent any hidden cameras in the room from spotting his password. He also checked the hotel phone for bugs. It was not without irony that he went through these security rituals to protect his data as he allowed Poitras to film NSA data on his computer screen. Because he planned to use these journalists as his outlets to go public in a few days, the security measures he performed while on camera would only serve a temporary purpose. The centerpiece of the planned video would take the form of an interview with Greenwald. Snowden himself provided the talking points. The filming would eventually provide Poitras with a feature- @ length documentary, Citizenfour, which would be commercially @ released in October 2014 and win an Academy Award for her. The next day, Ewen MacAskill, whom Poitras had not wanted Greenwald to bring to the initial meeting, joined Poitras and Green- wald in Snowden’s room. Snowden insisted that MacAskill also go through the ritual of stowing his cell phone in the minibar refrigera- tor. Not without irony, Snowden’s own phone can be seen on his bed recharging. Although MacAskill was sent by Gibson to the event to verify the source’s bona fides, he had apparently hardly been briefed. The questioning went as follows: MACASKILL: Sorry, I don’t know anything about you. snowpen: OK, I work for— MACASKILL: Sorry, I don’t know even your name. snowben: Oh, sorry, my name is Edward Snowden. I go by Ed. MacAskill went on to ask him to enumerate the various positions he held during his career in intelligence. Snowden was not entirely | | Epst_9780451494566_2p_all_r1.z.indd 92 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019580

Whistle-blower | 93 truthful in describing himself. He said that he had been a senior adviser to the CIA, when he had been just a telecommunications sup- port officer. He also said he had been a senior adviser at the Defense Intelligence Agency, even though, according to that intelligence service, he was never employed there. (He did speak at an inter- agency counterintelligence course the DIA had sponsored.) He said he had a $200,000-a-year salary from Booz Allen when, according to Booz Allen, it was $133,000. It is understandable that he wanted to impress these Guardian journalists in light of his young age and boyish appearance, even to the extent of meretriciously claiming in the video that he had been personally given the “authority” at the NSA to intercept President Obama’s private communications, which, according to an NSA spokeswoman, was not true. No NSA employee, and certainly no civilian contract worker, was given the authority to spy on the president of the United States, she insisted. Such career enhancements reinforced the fact that Snowden altered reality when it suited his purpose with journalists. Snowden had greatly exaggerated or misrepresented the posi- @ tions he held with the CIA and the DIA, but no effort was made by @ the team of journalists to verify the information. Instead, MacAskill wrote to Janine Gibson in New York, “The Guinness is good.” It was a prearranged code by which MacAskill certified Snowden’s cred- ibility for The Guardian. Gibson told Greenwald to proceed with the story. Snowden had already provided Poitras and Greenwald with thumb drives on which he had loaded the documents he wanted them to use. Greenwald wrote his first story about NSA transgressions based almost entirely on the FISA warrant involving Verizon’s coopera- tion that Snowden had copied from the administrative file. Before the story could be published, however, the Guardian policy required relevant American government officials be given the opportunity to respond. Gibson made the requisite call to the White House national security spokesperson, Caitlin Hayden, who arranged a conference call with the FBI’s deputy director, Sean Joyce, the NSA’s deputy director, Chris Inglis, and Robert Litt, the legal officer for the Office of the Director of National Intelligence. After duly taking into account | | Epst_9780451494566_2p_all_r1.z.indd 93 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019581

94 | HOW AMERICA LOST ITS SECRETS the response of these three officials, which included the admonition by Litt that “no serious news organization would publish this,” Gib- son gave the green light to publish the story. The story broke on June 6. “NSA Collecting Phone Records of Millions of Verizon Customers Daily,” proclaimed the Guardian headline. Under Greenwald’s byline, it said, “Exclusive: Top secret court order requiring Verizon to hand over all call data shows scale of domestic surveillance under Obama.” Along with it was the FISA order. The PRISM story broke hours later in The Washington Post. Written by Gellman and Poitras, it claimed that the NSA and the FBI were tapping directly into the central servers of nine leading U.S. Internet companies, which were knowingly participating in the operation. The latter allegation turned out to be not entirely true, because some of the Internet companies cited in the story denied that they had knowingly participated. The back-to-back publication of these two stories by The Guardian and the Post, however, provided the explosive “shock,” at least in the global media, that Snowden had predicted. @ Snowden’s identity had not been revealed in either the Guardian @ or the Post story on June 6. Snowden, however, insisted on outing himself. He explained to Greenwald that he needed to “define him- self” before the U.S. government “demonized” him as a spy. That self-definition would be accomplished by a twelve-minute video titled “Whistleblower.” Poitras extracted much of the material for the video from the twenty or so hours she had shot. In the filmed interview, Snowden voiced many of the same statements he had made in his manifesto, so he no longer needed to post that on the Internet. When he insisted on the immediate airing of the video, Greenwald told him that by going public in this way, he was saying “fuck you” to the American government. Snowden replied, “I want to identify myself as the person behind these disclosures.” On June 9, the video was posted on the Guardian website with the Freedom of the Press Foundation getting an on-screen credit. “My name is Ed Snowden,” the extraordinary disclosure began. He then described how the NSA was watching U.S. citizens. Even though the NSA press spokesperson subsequently disputed some of his more dramatic claims, such as his assertion that he had the authority at | | Epst_9780451494566_2p_all_r1.z.indd 94 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019582

Whistle-blower | 95 the NSA “to wiretap anyone, even the president,” the press largely accepted his claims as established facts. As for American surveillance, he declared, “I don’t want to live in a society that does those sorts of things.” The Guardian story accompanying the video carried the headline “Edward Snowden: The Whistleblower Behind the NSA Surveil- lance Revelations.” Overnight, Snowden became a global celebrity and, to much of the world, a hero. The next morning he packed his belongings into a backpack and moved, without notifying the front desk, to another room Poitras had rented at the Mira. Complicated schemes, especially when they involve transferring state secrets to unauthorized parties in a for- eign country, do not necessarily go as planned. That was true of Snowden’s escape plan. Snowden had no plan to stay put and face the music. On the morning of June 10, though, there was apparently a problem. Robert Tibbo and Jonathan Man, the lawyers who, along with Albert Ho, had been retained for Snowden by an unidentified party, received an emergency phone call early in the morning tell- @ ing them to help Snowden move to a safe location. Although Tibbo @ would not identify the person who had called, the message had been relayed to Man and him through Ho’s office. When Tibbo called Snowden offering to help him move, Snowden told him, “I can make myself unrecognizable.” Tibbo and Man immediately proceeded to the mall adjacent to the Mira hotel, where they met Snowden. After he signed a docu- ment appointing Ho’s law firm as his “legal adviser,” the three of them slipped out via the mall exit. Tibbo and Man planned to move Snowden to the apartments of refugees who were their clients. Snowden’s credit card had been frozen, so it is not clear who paid his sizable hotel bill. According to hotel records, it was paid by another credit card. Poitras, who had taken a room at the hotel, might have used her own credit card, or Snowden might have had another benefactor in Hong Kong. In any case, the lawyers escorted Snowden to a prearranged residence. “T am in a safe house for now,” Snowden wrote to Greenwald on June 11. The situation might not have been totally under his control, because he added, “But I have no idea how safe it is.” | | Epst_9780451494566_2p_all_r1.z.indd 95 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019583

96 | HOW AMERICA LOST ITS SECRETS Greenwald flew back to Brazil that day. Soon afterward, he would resign from The Guardian. In February 2014, he became the co- founding editor of The Intercept, an online publication dedicated to investigative journalism, which was backed by the Internet billion- aire Pierre Omidyar. Poitras remained in Hong Kong, where she moved, along with the Guardian reporter MacAskill, to the five-star Sheraton Hong Kong Hotel & Towers, which, like the Mira hotel, was on Nathan Road in Kowloon. The Guardian paid the bill. Her next task was to set up what turned out to be Snowden’s final interview in Hong Kong. It was scheduled for June 12. The journalist chosen was Lana Lam, a young Australian reporter working for the South China Morning Post. Tibbo had suggested Lam to Snowden. She had served as Tibbo’s outlet on previous news stories, and, as he told me, he found her to be a totally reliable jour- nalist. He brought her to Poitras’s suite at the Sheraton in Kowloon. First, Lam had to agree to the conditions of the interview, which included submitting the story to Poitras for Snowden’s approval. @ Next, as Lam put it, Poitras “confiscated” her cell phone. Finally, @ after a ten-minute wait, Poitras took her to another room and sat her before a black laptop. The laptop, which had a Tor sticker on it, had on its screen an online chat room where she was connected by Poitras to Snowden. “Hi Lana, thanks for coming for this,” Snowden said from his safe house. He told her that the NSA had intercepted data from at least sixty-one thousand different computers in Hong Kong, China, and elsewhere. To expose what he called America’s “hypocrisy” in accus- ing China of cyber espionage, he supplied her with relevant NSA documents. “Last week the American government happily operated in the shadows with no respect for the consent of the governed, but no longer,” he said. “The United States government has committed a tremendous number of crimes against Hong Kong [and] the People’s Republic of China as well.” Under Poitras’s close supervision, Lam was allowed to ask Snowden more questions about the NSA’s inter- ception of communications in Hong Kong and China. He told her, “I have had many opportunities to flee Hong Kong, but I would rather | | Epst_9780451494566_2p_all_r1.z.indd 96 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019584

Whistle-blower | 97 stay and fight the United States government in the courts.” That bit of braggadocio would not be proven out. Greenwald, Poitras, and MacAskill in their reporting did not concern themselves with any of the mechanics of the largest theft of top secret documents in the history of the United States. In the entire filmed interview at the Mira hotel, for example, they did not ask their source how he managed to get access to the documents. Lam, however, asked him about how he widened his access. When she asked him why he had switched jobs from Dell to Booz Allen Hamilton in March 2013, his answer provided her with a real scoop: “My position with Booz Allen Hamilton granted me access to lists of machines all over the world the NSA hacked.” Snowden told her that he deliberately went to Booz Allen Hamilton to get access to the “lists” revealing the NSA’s sources in foreign countries. This admission could further complicate his legal situation in Hong Kong because it suggested that he meant to steal documents even before he had known their content. In fact, to protect himself, he restricted Lam from publishing this part of the interview until after he had @ departed Hong Kong. (It was not published until June 24, a day after @ he arrived in Russia.) This condition indicated to Lam that as early as June 12, if not before, he was planning on leaving Hong Kong. His interview with Lam didn’t reveal how he had learned about these “lists” before taking the job. Nor did he reveal to her what he planned to do with these lists. He made it clear to her, however, that he had not disposed of all his secret documents. “If I have time to go through this information,” he said, “I would like to make it avail- able to journalists in each country to make their own assessment, independent of my bias, as to whether or not the knowledge of US network operations against their people should be published.” So as late as June 12, Snowden was still reading and assessing the files he had stolen from the NSA four weeks earlier. Poitras vetted the Lam interview. Soon afterward, she suspected that she was being followed. That was likely, because by June 14 all the intelligence services in Hong Kong knew that she was in contact with Snowden. “I was being tailed,” Poitras recalled in an interview with a Vogue | | Epst_9780451494566_2p_all_r1.z.indd 97 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019585

98 | HOW AMERICA LOST ITS SECRETS reporter in Berlin in 2014. “The risks became very great,” she said in describing her situation in Hong Kong. So, on June 15, she left Hong Kong and flew back to Berlin, where she began editing her footage of the Snowden interview. Meanwhile, Snowden, organizing his own exit from Hong Kong, placed a call to Julian Assange. | | Epst_9780451494566_2p_all_r1.z.indd 98 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019586

CHAPTER 11 Enter Assange Thanks to Russia (and thanks to WikiLeaks), Snowden remains free. —JULIAN ASSANGE, Newsweek, 2015 ULIAN ASSANGE had made a brilliant career of trafficking in state, military, and corporate secrets. Born on July 3, 1971, in Queensland, Australia, Assange began his hacking career while still a teenager. Using the alias Mendax (“the untruthful one”), he had hacked into the computers of the Pentagon, the U.S. Navy, NASA, Citibank, Lockheed Martin, and Australia’s Overseas Telecommuni- cations Commission before he was twenty. At the age of twenty-five, he pleaded guilty to twenty-five charges of hacking in Australia but was released on a good behavior bond. In 2006, with the spread of Tor software, he co-founded WikiLeaks, a website in which secret documents could be anonymously sent and posted. The site received little public attention until Bradley Manning sent it several hun- dred thousand lowly classified U.S. military and State Department documents in April 2010. With these stolen documents, WikiLeaks became a media sensation, and Assange, the runner-up for Time’s Man of the Year for 2010, became a leading figure, along with Appel- baum, in the global hacktivist underground. | | Epst_9780451494566_2p_all_r1.z.indd 99 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019587

100 | HOW AMERICA LOST ITS SECRETS In November 2010, however, he ran into a legal problem in Sweden. A judge in Stockholm ordered his detention on suspicion of rape, sexual molestation, and unlawful coercion. He denied the charges but was arrested in London on a European arrest warrant. In December, he was released on a $312,700 bail deposit (supplied by his supporters) and confined to Ellingham Hall in Norfolk, England. While awaiting the outcome of the extradition proceedings, he lived there with Sarah Harrison, his twenty-eight-year-old deputy at WikiLeaks. A graduate of the elite Sevenoaks School in Kent, Harri- son served as Assange’s liaison with the outside world. Although she was Officially given the title “investigative editor” of WikiLeaks, she worked so closely with Assange during this period that the British press carried stories saying she was his paramour. Harrison worked on a WikiLeaks documentary titled Mediastan, which concerned WikiLeaks’s exposure of U.S. secret operations in Russia and other parts of the former Soviet Union. It was a project that took her to Russia and provided her with a multi-entry Russian visa. In June 2012, after the extradition order was upheld, Assange @ jumped bail and fled to the Ecuador embassy in London. For the next @ year, his only visible means of income was a weekly program from the embassy. It was sponsored in 2012 by RT television, a Moscow- based, English-language news channel funded by the Russian gov- ernment, which would also finance and release Mediastan. This sponsorship suggests that the Russian government saw potential value in the document-gathering activities of WikiLeaks. Snowden telephoned Assange at his refuge at the Ecuador embassy on June 10, 2013. According to Assange, Snowden needed help for his exit plan. He wanted Assange to use WikiLeaks’s “resources” to get him out of Hong Kong. Assange considered it a surprising request, because Snowden had not given any of the stolen documents to WikiLeaks. In their discussion, according to Assange, Snowden claimed that one reason he decided to take the secret NSA documents was the brutal treatment of Bradley Manning after he was arrested in 2010 by the U.S. government. “Snowden told me they had abused Manning in a way that contributed to his decision to become a whistle-blower,” Assange said in an interview in 2015. If Manning’s mistreatment was Snowden’s motive, it was a sharp | | Epst_9780451494566_2p_all_r1.z.indd 100 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019588

Enter Assange | 101 departure from the position Snowden had taken in his postings on the Ars Technica site in January 2009. He complained in a post there about the detrimental consequences to U.S. intelligence of leakers’ revealing “classified shit” to The New York Times, and he suggested as punishment “those people should be shot in the balls.” Either he had a change of heart, or he was telling Assange what he believed he wanted to hear. Assange counseled Snowden to go directly to Russia. “My advice was that he should take asylum in Russia despite the negative PR consequences,” he told the London Times in 2015. He said, “Snowden was well aware of the spin that would be put on it if he took asylum in Russia.” So a story would be released presumably by WikiLeaks, coinciding with his departure, asserting that Snowden was “bound for the republic of Ecuador via a safe route.” When Snowden asked how he would carry out the plan, Assange told him that he would immediately dispatch one of his senior staff members to help him engineer his escape to Russia. That senior staff member was Sarah Harrison. @ After speaking to Snowden, Assange called Harrison, who was in @ Melbourne. She had gone there a month earlier to help organize Assange’s somewhat quixotic election campaign for president of Australia. Assange told her to forget the campaign and go to Hong Kong. She was to use WikiLeaks’s resources to save Snowden from “a lifetime in prison.” Presumably, Assange told her that he had advised Snowden to proceed to Russia. Harrison later said that she didn’t even bother to pack her clothing after hearing from Assange. She caught the next plane to Hong Kong and arrived there on June 11— the same day that Snowden texted Greenwald he was in a safe house and before Snowden’s explosive interview with Lam. Harrison had her own connections in Hong Kong. Her two younger sisters, Kate and Alexandra, lived there and were part of the expatriate commu- nity. She also had an older brother, Simon, who headed Avra, a ship brokerage and commodity trading company, headquartered in Sin- gapore, but he frequently traveled to Hong Kong on business. Like Poitras, Sarah Harrison took great care to shield her move- ments. She did not have a Twitter, Facebook, or any other social media account. She did not own a cell phone for fear of being tracked by an | | Epst_9780451494566_2p_all_r1.z.indd 101 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019589

102 | HOW AMERICA LOST ITS SECRETS intelligence service. When she traveled, she bought “burner” phones locally and disposed of them before any calls could be traced back to her. Upon arriving in Hong Kong, she avoided meeting Snowden face-to-face out of concern about the surveillance of American intel- ligence there. Instead, for thirteen days in Hong Kong she worked through intermediaries. Her task was not only to arrange Snowden’s escape route but also to create diversions to camouflage his real des- tination. Under Assange’s tutelage, she had made deceptive ploys an integral part of her tradecraft. “We were working very hard to lay as many false trails as possible,” she later told an interviewer in Berlin. According to Assange, she booked decoy flights for Snowden to Beijing and New Delhi. She also used Snowden’s credit card number to pay for the flight to India; because the card was blocked, she knew there was a high probability that it would come to the attention of USS. intelligence. According to Harrison, she booked no fewer than a dozen such decoy tickets to confuse Snowden’s possible pursuers in U.S. intelligence. The only actual ticket she bought for Snowden, according to an Aeroflot official, was one to Moscow at the last min- @ ute. She bought a ticket for herself on the same flight, leaving on @ June 23. The source of the money for the Assange-Harrison operation is unclear. Subsequently, Harrison said she was setting up secret bank accounts to help organize such transborder escapes. Assange said she was using “WikiLeaks’s resources.” Harrison said the “WikiLeaks team” helped fund Snowden’s flight to Russia from Hong Kong, as well as her own flight there. But WikiLeaks was not an organization with spare cash in June 2013. Assange had forfeited his own bail by fleeing to the embassy of Ecuador, offending many of his financial supporters in Britain. He had also all but exhausted his bank account. Aside from money that dribbled in from Poitras’s six-month-old Freedom of the Press Foundation, the only steady source of funds for WikiLeaks in 2013 was the previously mentioned payments Assange received from the Russian government's RT television. Mounting pressure was brought on the Hong Kong government to take action against Snowden. On June 16, the U.S. government informed the Hong Kong authorities that it had filed a criminal complaint against Snowden and would be seeking his extradition. | | Epst_9780451494566_2p_all_r1.z.indd 102 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019590

Enter Assange | 103 Because Hong Kong had a vigorously enforced extradition agree- ment with the United States, as mentioned above, it was expected that Snowden would be taken into custody. But China had the final say in any extradition decision. In fact, China had explicitly been given the right of vetoing any extraditions for any reason in the formal 1999 agreement between Hong Kong and the United States. Because the Chinese president, Xi Jinping, had just met with Presi- dent Obama in California, China also had an interest in avoiding embarrassing public demonstrations on behalf of Snowden. Accord- ing to a well-placed official in Hong Kong, China’s liaison office in Hong Kong told the Hong Kong Authority in no uncertain terms that Snowden had to be out of Hong Kong by June 23. On June 19, Snowden had a meeting with Tibbo, the barrister who would handle any eventual court case, and Man and Ho, the Hong Kong solicitors who had been retained for him. It took place in a small apartment where, according to Ho, they ate pizza while they discussed Snowden’s options. Tibbo wanted Snowden to remain in Hong Kong, allow himself @ to be arrested, seek bail, and fight extradition in court. Tibbo said @ he planned to mount a powerful legal defense against extradition by using a provision in Hong Kong’s extradition treaty with the United States that protects fugitives from persecution on political grounds. After he told Snowden that it would entail a long court battle, Snowden asked him if he could avoid even being arrested. Tibbo explained that Hong Kong courts, which closely follow British law, would certainly issue an arrest warrant for him imme- diately after the United States formally filed charges against him. Those charges could come within hours, he reckoned. Soon after- ward, Snowden would be temporarily jailed, and his computers, electronic gear, and thumb drives would be seized and placed in the custody of the court. Tibbo would immediately seek his release on bail but could not guarantee an outcome because Snowden, who had fled U.S. jurisdiction, might be considered a flight risk. If so, Snowden could remain incarcerated during the long court battle. During the litigation, Snowden would have a platform to make his case against U.S. surveillance. Indeed, Tibbo’s strategy involved building massive public support for Snowden’s cause. Once the U.S. | | Epst_9780451494566_2p_all_r1.z.indd 103 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019591

104 | HOW AMERICA LOST ITS SECRETS government filed charges, though, Snowden could further expect it would invalidate his passport to go anywhere except for his return to the United States, and Interpol would issue a red alert to all its mem- bers. Because his case involved national security secrets, he had also to consider that the Hong Kong court could deny him any use of the Internet until his extradition case was settled. If Snowden wanted to leave Hong Kong, he had to act swiftly. Tibbo, although evasive on the point when I interviewed him, might not have known about the escape Harrison was planning. He did not know that Snowden’s other alternatives were not good. He had no money, and his credit card had been blocked. He had no visas to go to any other country, and Interpol would issue its own border alert as soon as the United States filed its charges. At that point, Hong Kong airport authorities would be officially notified and could prevent him from leaving the city. Even if he somehow got out, he would be an international fugitive. Tibbo counseled Snowden to seek redress in the Hong Kong courts. Snowden, though, had no intention of allowing himself to be @ arrested, Despite what he had told Lana Lam only one week earlier, @ at least for publication, about his determination to seek justice in the Hong Kong courts, he had not planned to use Hong Kong as anything more than a temporary stopover on his escape route. Two months later and safely in Moscow, he made this point clear in a lengthy interview with Alan Rusbridger, the editor of The Guard- ian. He told him that it had never been part of his plan to use Hong Kong to escape the legal consequences of his act. “The purpose of my mission [to Hong Kong] was to get the information to journalists.” If so, he had merely been using Tibbo, Man, and Ho to provide him with temporary cover while, following the instructions of Assange, Harrison laid down the smoke screen for his escape to Moscow. | | Epst_9780451494566_2p_all_r1.z.indd 104 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019592

CHAPTER 12 Fugitive If I end up in chains in Guantaénamo, I can live with that. —EDWARD SNOWDEN, Hong Kong, 2013 URING HIS INTERVIEWS with Poitras and Greenwald in June, Snowden said stoically, “If I am arrested, I am arrested.” His fatalistic words notwithstanding, Snowden had made plans to seek a haven from American justice well before his meeting them. As early as May 24, 2013, he had suggested to Barton Gellman that he was making arrangements with a foreign government. To that end, he asked Gellman to insert an encrypted key in the Internet version of the NSA exposé that Snowden proposed he write for The Washington Post. He told him the purpose of the encrypted key was to assist him with a foreign government. Snowden did not iden- tify any foreign government to Gellman, but Gellman said he knew that Snowden wanted to “seek asylum” overseas. He decided against assisting him. “I can’t help him evade U.S. jurisdiction—I don’t want to, and I can’t,” he later explained. “It’s not my job. It’s not the rela- tionship. I am a journalist.” Although Gellman suspected that Iceland might be the foreign government in question, Snowden, as it turned out, had never con- | | Epst_9780451494566_2p_all_r1.z.indd 105 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019593

106 | HOW AMERICA LOST ITS SECRETS tacted the consulate of Iceland while he was in Hong Kong. “We had heard nothing from Snowden,” an Iceland government official told Vanity Fatr. Snowden also did not contact the government of Ecuador while in Hong Kong. In mid-June, while Harrison was laying down false tracks for Snowden in Hong Kong, Assange in London asked Fidel Narvaez, who was a friend of his and the legal attaché in the Lon- don embassy of Ecuador, to issue a document that Snowden could use. But this document was not delivered to Snowden in Hong Kong (and it was later invalidated by Ecuador). There are no direct flights to Ecuador from Hong Kong. If Snowden had really planned to go to Ecuador without stopping in a country allied with the United States, he would have had to fly to Cuba. He would need a Cuban travel document to do that, which he could have obtained from the Cuban consulate anytime during his month in Hong Kong. But he did not obtain it. Nor did he acquire a visa to go to any other country in Latin America or elsewhere while in Hong Kong. So where was he headed? @ Whatever foreign government with which Snowden was deal- @ ing earlier presumably did not have an extradition treaty with the United States. Almost all other countries that did not have active extradition treaties with the United States could not be directly reached by air. With three notable exceptions, the flights to most of these countries had stopovers in a country that was an ally of the United States, where officials could seize Snowden. The three excep- tions were China, North Korea (via China), and Russia. The only one of these three countries that Snowden is known to have had contact with directly during his thirty-three-day stay in Hong Kong was Russia. The Russian president, Vladimir Putin, revealed these contacts in a televised press briefing in September 2013. Putin did not provide the date of these contacts, but he pro- vided an intriguing clue. Snowden was identified to him, according to Putin, not by name but merely as an “agent of special services.” If his name was not given to Putin, it might have been because Snowden’s first meeting with the Russians had taken place before Snowden became a household name on June 9, 2013. For his part, Snowden was evasive when discussing his con- | | Epst_9780451494566_2p_all_r1.z.indd 106 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019594

Fugitive | 107 tacts with Russia while still in Hong Kong. When Lana Lam asked Snowden on June 12, 2013, whether he had already requested asy- lum from the Russian government, he deferred, saying, “My only comment is that I am glad there are governments that refuse to be intimidated by great power.” The Russian government was clearly not intimidated by the threats of reprisals by the United States, as the Obama administration would learn after Snowden’s arrival in Russia on June 23. Snowden could only have known that with cer- tainty on June 12 if he had been in contact with Russian officials prior to his interview with Lam. If Putin’s own description of Snowden’s interactions with the Russians in Hong Kong is to be believed, the decision to facilitate Snowden’s escape to Russia had been kicked all the way up the Rus- sian chain of command to Putin. Presumably, this decision-making process began earlier than June 21, when Snowden was said to have gone to the consulate. But how much earlier? Because Snowden had arrived in Hong Kong on May 20, his contacts with Russian offi- cials could have occurred in May. Such a contact with the Russians @ would fit with Snowden’s telling Gellman on May 24 that he needed @ his help in dealing with the diplomatic mission of a country that Snowden did not identify. In any case, Putin said an American “agent of the special services” had contacted Russian diplomats because he wanted assistance. The agent, Snowden, of course, needed assistance to escape from Hong Kong. The decision to accept him in Russia, given the international ramifications, would have to be made at a much higher level than the Russian mission in Hong Kong. Nine days before Snowden boarded Aeroflot Flight SU213 to Moscow on June 23, the United States had filed a criminal complaint against him. It had also officially alerted Interpol when it unsealed the complaint on June 21. It had invalidated his U.S. passport except to return to America (although he still had it in his possession at the Hong Kong airport). Because by this time he was the most famous visitor in Hong Kong, his passage through passport control on June 23 might have reflected the acquiescence of the Hong Kong authorities to the reported request of China to be rid of Snowden by that date. | | Epst_9780451494566_2p_all_r1.z.indd 107 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019595

108 | HOW AMERICA LOST ITS SECRETS According to one Aeroflot official, ordinarily all international pas- sengers are required to have a valid passport as well as a visa to the country of final destination. Snowden had neither a valid passport nor a visa. Still Snowden was able to board the flight to Moscow. Aeroflot, a state-controlled airline, presumably responds to the Rus- sian government on matters where Putin has given his approval. Snowden first met Harrison in person on June 23. She was wait- ing for him in the car that Jonathan Man had arranged to take him to the airport that morning. Snowden was dressed in a gray shirt and khaki slacks. Harrison was dressed in jeans and flip-flops. She said she had chosen this dress style so that they would blend in at the airport with vacationing tourists. She had financed the trip, and she was apparently now calling the shots. Harrison’s concern was that they might be arrested at the airport, so Man accompanied them through passport control. He was able to do this because he bought a ticket on the cheapest available international flight. Harrison had given Man a phone number to call if they got arrested. When she and Snowden boarded the flight at 12:45 p.m., Harrison effectively @ became Snowden’s second “carer”—a job that would require her @ presence in Moscow for the next four months. Snowden had pretty much remained silent until the plane took off. The first full proper sentence she heard from him as they headed for Moscow, as she recalled, was “I didn’t expect that WikiLeaks was going to send a ninja to get me out.” Meanwhile, Assange continued creating “distractions,” as he put it. On June 24, a booking was made for Snowden on an Aeroflot flight to Cuba, and this information was relayed to the foreign press organization in Moscow, resulting in over a dozen reporters flying to Havana on the flight. Snowden, of course, never showed up for it. “In some of our communications, we deliberately spoke about that [flight] on open lines to lawyers in the United States,” Assange said. One subsequent piece of his misinformation was that Snowden was flying to Bolivia on the private plane of the Bolivian president, Evo Morales (who was then in Moscow for a meeting). That misinfor- mation had the desired effect. U.S. allies in Europe, including France, Spain, and Portugal, refused to allow that plane to fly through its airspace, forcing the plane to land in Austria. This misinformation | | Epst_9780451494566_2p_all_r1.z.indd 108 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019596

Fugitive | 109 resulted in an international incident but did not change the fact that Snowden was still in the custody of Russian authorities. Snowden came to realize that those assisting him, including Assange and Harrison, were taking serious risks. “Anyone ina three- mile radius [of me] is going to get hammered,” he later said in 2015 to a reporter from Vogue. (After finally leaving Snowden in Moscow on November 3, 2013, Harrison moved to Berlin, where she set up an organization to provide, as she termed it, “an underground rail- road” for other fugitives who had made available documents expos- ing government secrets.) Snowden was sequestered in the transit zone of the Moscow air- port for thirty-seven days. A Russian intermediary provided him with a Russian classic to read while awaiting asylum. It was Fyodor Dostoyevsky’s Crime and Punishment, whose protagonist, Rodion Romanovich Raskolnikov, is a dissenter who believes breaking the law is morally justified by the unfair abuses of the political system. Snowden received official sanctuary in Russia on August 1, 2013. His public statements in Hong Kong that he was willing to go to @ prison so that others could live freely in a democratic society were, @ as it turned out, mere rhetoric. Instead of risking prison, he had suc- cessfully escaped to a country in which he would be treated as a hero for defying the U.S. government. He had not sacrificed himself; he had transformed himself. He had risen from being a lowly techni- cian in Hawaii whose talents went largely unrecognized to the status of an international media star in Moscow. In his new role, he could make Internet appearances via Skype to prestigious gatherings, such as the TED conference, where he would be roundly applauded as an Internet hero, as well as be paid a $20,000 fee for just his electronic participation. He would be beamed into dozens of ACLU meetings where he was celebrated as a defender of American liberty. He would describe to sympathetic audiences in Germany, Norway, and France the unfairness of the American legal system, asserting that it was denying him a “fair trial.” He would now make front-page news by granting interviews to The New York Times, The Washington Post, The Nation, and other publications. He would join Poitras and Greenwald on the board of directors of the Freedom of the Press Foundation. He would be the subject of an Oscar-winning documen- | | Epst_9780451494566_2p_all_r1.z.indd 109 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019597

110 | HOW AMERICA LOST ITS SECRETS tary, the hero of the 2016 Hollywood movie Snowden (directed by Oliver Stone), and a consultant to the 2015 season of the televi- sion series Homeland. He would be nominated for the Nobel Peace Prize in 2014. He would attract over one million followers to his tweets in 2015. “For me, in terms of personal satisfaction, the mis- sion’s already accomplished. I already won,” he informed the Post in his first live interview in Moscow in December 2013. It was a mission that involved a very high-stakes enterprise: taking not only domestic surveillance documents but America’s military and foreign intelligence secrets abroad. Whistle-blowers do not ordinarily steal military secrets. Nor do they flee to the territory of America’s principal adversaries. A fugi- tive, especially one lacking a Russian visa, does not wind up in Mos- cow by pure accident. It’s hard to imagine that a Russian president with the KGB background of Putin would give his personal sanction for a high-profile exfiltration from Hong Kong without weighing the gain that might proceed from it. Whatever else may be said of Putin, his actions show him to be a calculating opportunist. Part of @ his calculus would be that the defector from American intelligence @ had taken possession of a great number of potentially valuable docu- ments from the inner sanctum of the NSA and, aside from these documents, claimed to hold secrets of great importance in his head. To be sure, the practical value of this stolen archive would require a lengthy evaluation by Russia’s other intelligence services. But it is hard to believe that a defector who put himself in the hands of the FSB, the successor to the KGB, and other Russian intelligence services wouldn't be expected to cooperate with them. Even if such a defector did not carry these files with him to Moscow, intelligence services have the means to recover digital files, even after they are erased from a computer or if they are sent to the cloud. Moreover, once secret documents are taken, they are compromised. Yet for much of the American public, Snowden remained a hero. | | Epst_9780451494566_2p_all_r1.z.indd 110 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019598

PART TWO THE INTELLIGENCE CRISIS What you've seen so far [in the Snowden theft of documents] is just the tip of the iceberg. —RETIRED ADMIRAL MICHAEL MCCONNELL, vice-chairman, Booz Allen Hamilton, 2013 | | Epst_9780451494566_2p_all_r1.z.indd 111 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019599

| | Epst_9780451494566_2p_all_r1.z.indd 112 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019600

CHAPTER 13 The Great Divide That moral decision to tell the public about spying that affects all of us has been costly, but it was the right thing to do and I have no regrets. —EDWARD SNOWDEN, Moscow, 2013 N THE TWELVE-MINUTE VIDEO on The Guardian's website, Snowden correctly identified himself as an infrastructure analyst at a regional base of the National Security Agency in Oahu, Hawaii. He also revealed in a calm, unemotional voice that he had been the source for the stories in both The Guardian and The Washington Post. He said that he had supplied the secret, classified documents that the two newspapers had used in their scoops about domestic surveillance being conducted by the NSA, America’s enormous elec- tronic surveillance agency. These sensational revelations had been, literally, the talk of the world, and now, in another major news event, the boyish-looking Snowden took responsibility for what would turn out to be the largest theft of top secret documents in the his- tory of U.S. intelligence. In the video, it will be recalled, Glenn Greenwald, who had bro- ken the NSA story in The Guardian, questioned Snowden. What was his motive? Greenwald asked. Why did he do it? Snowden replied that he had become horrified by the NSA’s secret operations, | | Epst_9780451494566_2p_all_r1.z.indd 113 @ HOUSE_OVERSIGHT_019601 9/29/16 5:51PM | |

114 | HOW AMERICA LOST ITS SECRETS which, to him, represented a kind of distillation of the excesses of the American national security state, and he had therefore made it his mission to blow the whistle. He believed that the public needed to be informed of the existence of a vast, secret surveillance opera- tion directed against tens of millions of Americans that flagrantly violated U.S. laws and was a grave threat to their privacy and their freedoms. Within hours of the release of that video on the Guardian website, Snowden was known throughout the world as a courageous whistle-blower. In Laura Poitras’s remarks in accepting her Academy Award for Citizenfour on February 22, 2015, she said that Snowden acted as a whistle-blower not only to “expose a threat to our privacy but to our democracy itself.” She received a standing ovation. A large part of the public who viewed this powerful film, includ- ing many of my colleagues in journalism whose writing I greatly respect, came to accept Snowden’s whistle-blowing narrative. The film so convincingly depicted Snowden as an altruistic young man willing to risk his own personal freedom and face years of imprison- @ ment for the sake of others that editorial writers asked that he be @ given clemency from prosecution. “Sitting on his unmade bed—white sheets and covers, white head- board, white bathrobe, white skin—Snowden seems like a figure in some obscure ritual, being readied for sacrifice,” George Packer wrote about the film in a widely read article in The New Yorker. This powerful narrative, as lucidly articulated by Poitras, Green- wald, and other Snowden supporters, described the NSA activities exposed by Snowden as part of a vast criminal conspiracy involv- ing, among others, President Obama, James Clapper, the director of national intelligence, and both Democratic and Republican members of the congressional oversight committees. It further derided any claims that there was evidence that Snowden’s theft of NSA secrets went beyond simply exposing government misdeeds. For example, this narrative asserted, as if it were established fact, that U.S. gov- ernment officials had deliberately “trapped” Snowden in Russia. According to Snowden, the purpose of this government ploy was to “demonize” him. “There was no question that I was going to be subject to a demonization campaign,” Snowden said in an interview | | Epst_9780451494566_2p_all_r1.z.indd 114 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019602

The Great Divide | 115 from Moscow, “They [Greenwald and Poitras] actually recorded me on camera saying this before I revealed my identity.” The purpose of this demonization was to divert attention from the government's own crimes. To be sure, it is not unprecedented for the government to release defamatory information about individuals who have embarrassed USS. intelligence by defecting. When two NSA analysts, William Martin and Bernon Mitchell, defected to Russia in the 1960s and accused the NSA of violating international law after arriving in Moscow, U.S. government officials responded by putting out the story that they were homosexual lovers, which was both untrue and irrelevant to the intelligence secrets that they had compromised. It is certainly possible that the government put out information to intentionally defame Snowden. Secretary of State John Kerry char- acterized him as a coward who should “man up” by returning to the United States. While one can discount such characterizations against Snowden by government officials as demonization, as I do, one cannot as eas- @ ily dismiss the independent evidence that undermines Snowden’s @ assertion that his sole motive was blowing the whistle on illicit sur- veillance in the United States. For example, in 2014, the Lawfare Institute, a nonprofit organization that publishes a blog on national security concerns, in cooperation with the Brookings Institution, did an independent analysis of all the published documents that Snowden provided to the media. It concluded that with some notable exceptions, such as the two documents initially published by The Guardian and the Post, the now-famous FISA Verizon warrant and the PRISM slides, few of the other documents that Snowden had given Poitras and Greenwald for publication had anything to do with either domestic surveillance or infringements on the privacy of Americans. By the Lawfare Institute’s count, 32 of Snowden’s leaks to these journalists concerned the NSA’s overseas sources and meth- ods, 9 identified overseas locations of the NSA’s intelligence bases, 25 revealed the identities of foreign officials of interest to U.S. intel- ligence agencies, 14 disclosed information about Internet companies legally cooperating with the NSA, and 19 concerned technology products that the NSA had been using or researching. | | Epst_9780451494566_2p_all_r1.z.indd 115 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019603

116 | HOW AMERICA LOST ITS SECRETS Some secret methods that Snowden made public compromised the NSA’s state-of-the-art technology of which adversaries had been unaware. For example, the NSA had devised an ingenious tech- nology in 2008 for tapping into computers abroad that had been “air-gapped,” or intentionally isolated from any network to protect highly sensitive information, such as missile telemetry, nuclear bomb development, and cyber-warfare capabilities. The secret method that the NSA used involved surreptitiously implanting speck-sized cir- cuit boards into air-gapped computers. These devices then covertly transmitted the data back in bursts of radio waves. Once Snowden exposed this technology, and the radio frequency transmission it used, America lost this intelligence capability. In addition, a considerable number of the published documents did not even belong to the NSA but were copies of reports sent to the NSA by its allies, including the British, Australian, Canadian, French, Norwegian, and Israeli intelligence services. Snowden pro- vided journalists with secret documents from the British cyber service GCHQ, describing its plans to obtain a legal warrant to pen- @ etrate the Russian computer security firm Kaspersky to expand its @ “computer network exploitation capability.” What the GCHQ was revealing in this secret document was its own capabilities to monitor a Russian target of interest to British intelligence. While the release of these foreign documents might have embarrassed allies of the United States, they exposed no violations of U.S. law by the NSA. It was a legitimate part of the NSA’s job to share information with its allies. This raises the question: What constitutes whistle-blowing? To the general public no doubt, a whistle-blower is simply a per- son who exposes government misdeeds from inside that govern- ment. But in the eyes of the law, someone who discloses classified information to an unauthorized person, even as an act of personal conscience, is not exempt from the punitive consequences of this act. Indeed, if a person deliberately reveals secret U.S. operations, espe- cially ones that compromise the sources and methods of U.S. intelli- gence services, he or she may run afoul of American espionage laws. In the past, when government employees have disclosed highly classified information to journalists to redress perceived govern- ment misconduct, they were almost always prosecuted. During | | Epst_9780451494566_2p_all_r1.z.indd 116 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019604

The Great Divide | 117 Barack Obama’s presidency, there were six government employees who, as a matter of personal conscience, shared classified informa- tion they obtained from the FBI, the CIA, the State Department, and the U.S. Army with journalists. They were all convicted: Sha- mai Leibowitz in 2010, Chelsea Manning in 2013, John Kiriakou in 2013, Donald Sachtleben in 2013, Stephen Kim in 2014, and Jeffrey Sterling in 2014. Like Snowden, they claimed to be whistle-blowers informing the public of government abuses. But because they dis- closed classified documents, they were dealt with as lawbreakers. All six were indicted, tried, convicted, and sentenced to prison. Sterling, a CIA officer who allegedly turned over a document to James Risen, a Pulitzer Prize-winning reporter for the Times, was sentenced to forty-two months. The most severe sentence was meted out to Pri- vate Manning, whom an army court sentenced to thirty-five years in a military stockade, as noted earlier. The prison time that others received did not go unnoticed by Snowden. He had been following the Manning case since 2012. In fact, he posted about it shortly before he began stealing far more @ damaging documents than Manning had. He would therefore likely @ have been aware that by revealing state secrets he had sworn to pro- tect, he would be risking imprisonment unless, unlike Manning, he fled the country. His motives, no matter how noble they might be, would not spare him—any more than they spared the other six— from determined federal prosecution. The view of those on the Snowden side of the divide is grounded not in legal definitions but in a broader notion of morality. Snowden’s supporters do not accept that the law should be applied to Snowden in this fashion. A writer for The New Yorker termed it “an act of civil disobedience.” His supporters argue that Snowden had a moral imperative to act, even if it meant breaking the law. They fully accept his view that he had a higher duty to protect citizens of all coun- tries in the world from, as he put it, “secret pervasive surveillance.” That higher duty transcended any narrower legal definitions of law- breaking. Ben Wizner, a lawyer from the American Civil Liberties Union who has represented Snowden since October 2013, argues that Snowden’s taking of classified documents was an “act of con- science” that overrode any legal constraints because it “revitalized | | Epst_9780451494566_2p_all_r1.z.indd 117 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019605

118 | HOW AMERICA LOST ITS SECRETS democratic oversight in the U.S.” and, without question, caused a much-needed debate on government surveillance. In this ends-justify-the-means view, any person with access to government secrets can authorize him- or herself to reveal those secrets to the world if she or he believes it serves the public good. Further, because doing so would be an “act of conscience,” he or she should be immune from legal prosecution. For Snowden’s supporters, his “act of conscience” justifies his claim to being a whistle-blower, even though the preponderance of the secrets he disclosed had to do with the NSA’s authorized activ- ity of using its multibillion-dollar global arrays of sensors to inter- cept data in foreign countries. For example, one of the thirty allied intelligence services that the NSA cooperated with in 2013 was the cyber service of Israel. Because Snowden deemed this cooperation to infringe on privacy rights, he revealed documents bearing on the NSA’s data exchange with Israel. He subsequently told James Bamford, in an interview in Wired magazine in August 2014, that supplying such intelligence to Israel was “one of the biggest abuses @ we've seen.” Snowden therefore believed he was justified in reveal- @ ing information concerning Arab communications in Gaza, the West Bank, and Lebanon that the NSA had provided the Israeli cyber ser- vice, known as Unit 8200. In doing so, he compromised an Israeli source. But how could this act qualify as whistle-blowing? Providing Israel with such data was not some NSA rogue operation. It was part of a policy that had been approved by every American president— and every Congress—since 1948. Snowden had every right to per- sonally disagree with this established U.S. policy of aiding Israel with intelligence, but it is another matter to release secret documents to support his view. If the concept of whistle-blowing were expanded to cover intelligence workers who steal secrets because they disagree with their government's foreign policy, it would also have to include many notorious spies, such as Kim Philby. Snowden’s concept of whistle-blowing also applied to the NSA’s spying on adversary nations. “We've crossed lines,” Snowden said in regard to China. “We're hacking universities and hospitals and wholly civilian infrastructure.” The NSA’s operations against China were stich “a real concern” for Snowden that he targeted lists of | | Epst_9780451494566_2p_all_r1.z.indd 118 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019606

The Great Divide | 119 the NSA’s penetrations in China. Putin echoed this expansion of the whistle-blowing concept to adversaries. He complimented Snowden for having “uncovered illegal acts by the United States around the globe.” Putin’s defense of Snowden not only implied a global concept of whistle-blowing that justifies breaking U.S. laws but also pointed to America’s double standard in publicly complaining about Russian and Chinese cyber espionage. Snowden’s whistle-blower interpretation gained immense public resonance. Even after President Obama and leaders of both houses of Congress roundly denounced Snowden for betraying American secrets, the majority of the public, according to a Quinnipiac poll taken in July 2013, still considered “Snowden a whistleblower who did a service revealing government domestic spying programs.” Moreover, Snowden’s revelations helped stoke a growing distrust of the American government itself. According to polls conducted by the Pew Research Center after Snowden came forward, just 19 per- cent of the public said that “they can trust the government always or most of the time.” The support for Snowden was not limited to @ America. On October 29, 2015, a majority of the European Parlia- @ ment voted to award Snowden the official status of a “human rights defender.” The former congressman Ron Paul went even further. He orga- nized a clemency petition in February 2014 for Snowden, stating, “Thanks to one man’s courageous actions, Americans know about the truly egregious ways their government is spying on them,” and his son Senator Rand Paul, who was a candidate for the Republican presidential nomination in 2016, called for a pardon for Snowden. Senator Paul’s concern fitted with the growing public apprehen- sion over increasing intrusion on privacy. Snowden was correct, in my opinion, in describing the threat of a surveillance state and the loss of privacy as a legitimate public concern. “We actually buy cell phones that are the equivalent of a network microphone that we carry around in our pockets voluntarily,” he pointed out from Moscow. The very technology involved in the electronic equipment we all use in the twenty-first century has made mass surveillance part of our daily life. There can be little doubt that our privacy has been | | Epst_9780451494566_2p_all_r1.z.indd 119 @ 9/29/16 5:51PM | | HOUSE_OVERSIGHT_019607

120 | HOW AMERICA LOST ITS SECRETS largely eroded, if not entirely negated, by the widespread use of cell phones, credit cards, social media, and the search engines of the Internet. When we use smart phones, our location is relayed to our telephone service provider every three seconds. The phone compa- nies collect and archive our phone usage “metadata,” which includes whom we called and how long we spoke. When we use Google to search for anyone or anything on the Internet, that activity is captured by Google, a company whose profits mainly come from making available to advertisers the results of its surveillance and collection of its users’ searches, When we use Gmail, Google’s e-mail service, used by nearly one billion senders and recipients, we agree to allow Google to read the actual contents of our correspondence to find keywords of interest to advertisers. When we use a credit card, the credit card company also retains data about what we buy and where we go. When we travel in auto- mobiles equipped with GPS, every turn and stop is tracked and recorded. And when we are in public places with CCTV (closed- circuit television) cameras, our image is recorded and archived. @ When we use Facebook, Twitter, and other so-called social media, as @ over two billion people do today, we allow these companies to collect, retain, and exploit their surveillance of our movements, associations with other people, and stated preferences. When we use Amazon and other online stores, we allow them to track and archive a great deal of our commercial activity. For Internet companies such as Facebook, Twitter, and Yahoo!, like Google, collecting private data on hundreds of millions of their members provides them with vast searchable databases that are easily marketable. The exploitation of these data- bases is a fundamental aspect of their business plans. Without such surveillance of their users, social media companies would not be able to turn a profit. Indeed, they may be more aptly called surveillance media than social media. For those of us who use them to post pic- tures and communicate, any notion of personal privacy is largely illusory. To be sure, there is a distinction to be made between the surveil- lance of our activities to which we voluntarily agree in exchange for the benefits and conveniences that we gain from social media, search engines, and other Internet companies and the surveillance | | Epst_9780451494566_2p_all_r1.z.indd 120 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019608

The Great Divide | 121 done by the government, which we do not voluntarily invite—or want. We willingly waive our privacy for corporations but not for governments. What the public might not fully realize, however, is that the gov- ernment can access all the personal information in the databases of private companies if it issues a subpoena or search warrant, which it does often. As Snowden himself pointed out, “If Facebook is going to hand over all of your messages, all of your wall posts, all of your private photos, all of your private details from their server, the gov- ernment has no need to intercept all of the communications that con- stitute those private records.” These Internet companies, even if they are only interested in exploiting the data for their own profit, cannot refuse to share this information with the NSA, the FBI, and other government agencies if they have a subpoena or search warrant. That reality became evident to me in my investigation of the rape charges brought (and subsequently dropped) against Dominique Strauss-Kahn, the managing director of the International Monetary Fund, in 2011. Immediately after his arrest, Cyrus Vance Jr, the dis- @ trict attorney of New York County, issued a subpoena for Strauss- @ Kahn’s cell phone records, credit card records, hotel room electronic key records, e-mails, room service bills, and the CCTV videos of his activities (some of which I published in my article about the case in The New York Review of Books). Nor is this access uncommon. According to Vance in 2016, his office issues thousands of such sub- poenas every year. Even though Apple made headlines by refusing to comply with a court order to help the FBI unlock the iPhone of a dead mass murderer in 2016, it had complied with many previous subpoenas. In fact, in 2015 alone, it quietly provided the backed-up data of some seventy-one hundred iPhone customers to government authorities. If anyone doubts the pervasiveness of government data collection, consider a little-known government agency called the Consumer Financial Protection Bureau. Created in 2010 by Congress, it mines data on a monthly basis from some 600 million personal credit card accounts, targeting about 95 percent of the credit card users in the United States. In addition, through eleven other data-mining pro- grams, it gathers data on everything from private home mortgages | | Epst_9780451494566_2p_all_r1.z.indd 121 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019609

122 | HOW AMERICA LOST ITS SECRETS and student loans to credit scores and overdrafts in personal bank accounts. This ubiquitous surveillance of virtually every non-cash transaction came about because of advances in computer technology that made it economically feasible to mine such data. Snowden’s concern about NSA domestic surveillance is certainly not misplaced. Ever since the 9/11 attacks, the NSA has increasingly played a role in this surveillance state, not by its own choice, but because Congress mandated it. In 2001, it empowered the NSA to obtain and archive data on American citizens. Accordingly, the NSA obtained the billing records of customers from phone and Internet companies and archived these records. The bulk collection of these billing records was intended to build a searchable database for the government that could be used to trace the history of the telephone and Internet activities in the United States of FBI-designated foreign terrorists and spies abroad. The government’s rationale for keeping these anti-terrorist programs secret from the public was that it did not want the foreign suspects to realize their communications in America were being monitored. @ The public only learned that the phone company was routinely @ turning over its billing records on June 6, 2013, when Snowden dis- closed it to The Guardian and The Washington Post. The documents he provided the journalists showed that the NSA had been obtain- ing phone records collected by Verizon every three months. While this revelation might have shocked the American public, the NSA had not acted on its own. It had acted under a warrant issued by a secret court established by Congress in 1978 as part of the Foreign Intelligence Surveillance Act for each request for records. Congress empowered the FISA court, whose judges are appointed by the pres- ident, to hear cases and authorize search warrants in secret in cases involving national security. As its name implies, the FISA court was meant to deal with matters bearing on foreign intelligence activities in the United States. That restriction changed after the terrorist attacks of September 11, 2001. A month after the attacks, Congress expanded the purview of the FISA court by passing the USA Patriot Act (an acronym that stands for Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism). Part of the | | Epst_9780451494566_2p_all_r1.z.indd 122 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019610

The Great Divide | 123 act, Section 215, euphemistically referred to as the “library records” provision, permitted the FISA court to issue warrants authorizing searches of records by the NSA and other federal agencies to inves- tigate international terrorism or clandestine intelligence activities. Through these FISA authorizations, the NSA could obtain “tangible things” such as “books, records, papers, documents, and other items.” Under the interpretation of this section of the law by both the Bush and the Obama administrations, the FISA court was enabled by Congress to issue warrants to telephone companies demanding that they turn over to the NSA the bulk billing records of all calls made in America. The FISA court need only deem these records to be “rel- evant” to the FBI’s investigations of terrorists and spies. Essentially, the NSA, to create a searchable database of telephone billing records, used the FISA court’s controversial interpretation of the word “relevant” in Section 215. Such a “haystack,” as the NSA called the national collection of billing records, could allow the FBI to instantly find missing “needles,” as this tracking was supposed to work, even if the connections were made years earlier. For example, @ if the FBI had a lead on a foreign suspect, it could search the data- @ base for any telephone calls made by the foreign suspect to tele- phone numbers in America and then who those people called. The FBI always had this power, if it obtained a warrant, but it did not previously have the “haystack” of records in a single database. Gen- eral Keith Alexander, who headed the NSA between 2005 and 2014, believed that maintaining such a haystack database made sense. “His approach was, ‘Let’s collect the whole haystack,’” according to one former senior U.S. intelligence official quoted by The Washington Post. According to critics of NSA domestic surveillance, including the ACLU, the results provided by this vast database did not justify its immense potential for abuse. In early May 2015, just three weeks before this part of the Patriot Act was set to expire, a three-judge panel of the Second U.S. Circuit Court of Appeals in New York agreed with the ACLU position, overturning a lower court deci- sion that said it was legal. The panel found that the word “relevant” in the act was not intended by Congress to justify the acquisition and storing of the bulk records of telephone companies for possible | | Epst_9780451494566_2p_all_r1.z.indd 123 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019611

124 | HOW AMERICA LOST ITS SECRETS future use. Soon afterward, Congress replaced the Patriot Act with the USA Freedom Act, which effectively transferred bulk storage of billing records from the NSA to the phone companies themselves. Despite the change in venue, the records of individuals were still not completely private. Under the new law, the FBI via a FISA warrant could still search the phone company’s databases. The core of Snowden’s charge in the media was that the FISA court overreached its authority by issuing sweeping warrants that allowed the NSA to obtain data collected by private phone and Inter- net companies. In the initial story published in The Guardian on June 6, Snowden disclosed one such FISA warrant to support his charge. It was issued by Judge Roger Vinson of the FISA court on April 25, 2013, and ordered Verizon to turn over to the FBI all its billing records of landline customers for the next ninety days. The FBI presented this FISA authorization to the NSA, which acts as a service organization for the FBI and the CIA in collecting com- munications data. The NSA, with the FISA warrant in hand, then obtained the Verizon billing records. @ Snowden also provided the Post and The Guardian with another @ secret document: a PowerPoint presentation on twenty slides, sent by the NSA to other intelligence agencies. It described a program it was using for monitoring the Internet. Its code name was the aforementioned PRISM. It was authorized under Section 702 of the Foreign Intelligence Surveillance Act and was designed to collect messages sent over the Internet from foreigners. Such information was in fact obtained with the knowledge of the service providers. It also required a written directive from both the attorney general and the director of national intelligence and a review by the Department of Justice every three months for each and every case. After obtain- ing this data, the NSA ran programs, as required by law, to filter out all domestic Internet communications, but, as Snowden pointed out, domestic information was also accidently picked up. Whenever the Justice Department actually opened an investigation against Ameri- cans in contact with foreign suspects, as it did in 170 cases in 2013, it could obtain warrants from the FISA court to search these Ameri- cans’ Internet activities. These two documents raised legitimate questions for many | | Epst_9780451494566_2p_all_r1.z.indd 124 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019612

The Great Divide | 125 Americans, including members of Congress, about the proper role of the FISA court, including whether it should conduct its business in secret. If Snowden had released only these two documents that related to unwarranted domestic surveillance and other possible vio- lations of the law by the NSA, it would be difficult for any reasonable person not to see his actions as a potentially valuable public service. Indeed, additional safeguards were necessary in an age in which new technologies enabled mass surveillance of the public. As the three- judge panel of the Second U.S. Circuit Court of Appeals would later find, Congress had not intended Section 215 of the Patriot Act to be used to justify the bulk collection of American records. If he had limited his illegal downloading to the few documents about bulk col- lection, it would be more difficult to argue that he was not a whistle- blower in the spirit if not the letter of the law, and even a hero in the struggle to preserve our civil liberties. But in fact, Snowden took a great many other secret documents that did not bear on the civil liberties of Americans. He claimed he was acting on behalf of citizens in foreign countries by exposing the NSA‘s and the CIA's spying @ operations abroad, but that same claim could also be made by any @ espionage agent stealing U.S. secrets to benefit the people of another country. As a result, the Snowden case produced a great divide in the American appreciation of him. On one hand, he has been almost universally lauded and lionized by what might be seen as the main- stream media, by numerous academics, and even, as we have seen, by members of Congress. The journalists who assisted him, Green- wald, Poitras, and Gellman, have been celebrated for the roles they played in bringing Snowden’s revelations to the public and received the 2014 Polk Award for national security reporting. The Post and The Guardian, the newspapers that initially published the purloined documents, won the 2014 Pulitzer Prize for public service. In other circles, the reaction has been very different. American and British intelligence officials, senior members of the Obama administration, and members of the oversight committees of Con- gress do not view Snowden as a hero or even an authentic whistle- blower. Instead, they see him as a betrayer of secrets who willfully brought damage to the United States and benefits to its adversar- | | Epst_9780451494566_2p_all_r1.z.indd 125 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019613

126 | HOW AMERICA LOST ITS SECRETS ies. The holders of this darker view of Snowden base it on classified reports of the full extent of the theft of classified data. Those officials believe that only a handful of the tens of thousands of documents he stole involved domestic surveillance and that those few documents served as a cover for a much larger theft. Admiral Michael Rogers, who replaced General Alexander as head of the NSA in March 2014, said at a public forum at Princeton University, “Edward Snowden is not the ‘whistleblower’ some have labeled him to be.” He further explained to Congress, “Snowden stole from the United States government a large amount of classi- fied information, a small portion of which is germane to his apparent central argument regarding NSA and privacy issues.” General Martin Dempsey, the chairman of the Joint Chiefs of Staff, went even further. In testifying before the House Armed Services Committee on March 6, 2014, after estimating that the Snowden breach could cost the military “billions” to repair, he added, “The vast majority of the electronic documents that Snowden exfiltrated from our highest levels of security had nothing to do with exposing @ government oversight of domestic activities.” Dempsey based this @ assessment on a then still-secret Defense Intelligence Agency report on the breach. The classified DIA report showed that Snowden took “over 900,000” military files from the Department of Defense in addition to the NSA files he had taken. The Defense Department loss in terms of the number of files stolen actually exceeded the loss—in sheer numbers—of NSA documents. Lieutenant General Mike Flynn, the DIA director who directed the study, testified to the Senate Select Committee on Intelligence that the breach “has caused grave damage to our national security.” To be sure, this was not the first time that the cryptological branches of the military had been compromised. The spy ring of John Walker had provided thousands of the navy’s reports on breaking Russian ciphers to the KGB during the Cold War. But the Snowden breach exposing military sources was an order of magnitude greater than any past breach. The CIA’s assessment was no less grim. Morell, the deputy director of the CIA in 2013, wrote that Snowden’s action went beyond taking the handful of documents, such as the FISA order, “that addressed | | Epst_9780451494566_2p_all_r1.z.indd 126 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019614

The Great Divide | 127 the privacy issue.” Instead, as Morell put it, “he backed up a virtual tractor trailer and emptied a warehouse full of documents—the vast majority of which he could not possibly have read and few of which he would likely understand—[and] he delivered the documents to a variety of news organizations and God knows who else.” As a result, Morell concluded, “Snowden’s disclosures will go down in history as the greatest compromise of classified information ever.” General Alexander, the head of the NSA at the time of the theft, asserted that Snowden did “the greatest damage to our combined nations’ intel- ligence systems that we have ever suffered.” Obviously, military intelligence officers would not be on Snowden’s side of the divide (and the Snowden breach ended the careers of many of them, includ- ing Alexander). But political leaders in both parties could also be found on the anti-Snowden side of the divide. “I don’t look at this as being a whistle-blower,” the Democratic senator Dianne Feinstein of California, the head of the Senate Intelligence Committee, said after she was briefed on Snowden’s theft. “I think it’s an act of treason.” The Republican representative Mike Rogers of Michigan, her coun- @ terpart on the House Intelligence Committee, said on the NBC pro- @ gram Meet the Press that Snowden might be working for a foreign intelligence service. And a former prominent member of President Obama’s cabinet went even further, suggesting to me off the record in March 2016 that there are only three possible explanations for the Snowden heist: (1) it was a Russian espionage operation; (2) it was a Chinese espionage operation; (3) it was a joint Sino-Russian opera- tion, These severe accusations generated much heat but little light. They were not accompanied by any evidence showing that Snowden had acted in concert with any foreign power in stealing the files or, for that matter, that he was not acting out of his own personal con- victions, no matter how misguided they might have been. On this side of the divide, Snowden’s critics regard the whistle- blowing narrative as at best incomplete and at worst fodder for the naive. They point out that the FISA document that gave him cre- dentials as a whistle-blower was only issued in the last week of April 2013, which was four months after he first contacted Greenwald and almost nine months after he began illegally copying secret docu- ments. They further believe that the evidence contradicts Snowden’s | | Epst_9780451494566_2p_all_r1.z.indd 127 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019615

128 | HOW AMERICA LOST ITS SECRETS claims that he stole only documents that exposed NSA transgres- sions into domestic surveillance, that he turned over all the stolen documents to journalists, and that he was forced to remain in Mos- cow by the actions of the U.S. government. They also find that the unprecedented size and complexity of the penetration of NSA files, compromising hundreds of thousands of secret documents pertain- ing to U.S. operations against adversary nations, according to the NSA’s and the Pentagon’s estimates, is not easily explained given Snowden’s avowed purpose for his theft. The deep split in how Snowden is perceived brings to mind the famous drawing of a duck-rabbit cartoon first published in 1900 in the book Fact and Fable in Psychology. The figure is perceived either as a duck or as a rabbit, but it cannot be seen as both simultaneously. Whether a person sees a rabbit or a duck in this test may depend on the information available to that person. Similarly, what may account for the sharp divide between the pro-Snowden and the anti- Snowden camps is a disparity in their available information. The pro-Snowden camp’s view is largely informed by Snowden @ himself. Snowden supporters prefer to believe his words rather than @ his actions. In the anti-Snowden camp are administration officials and the members of the House and Senate intelligence oversight committees who have been at least partially briefed on the con- tinuing investigations of the Snowden affair. The members of the Senate Intelligence Committee, for example, were told by David Leatherwood, the director of operations for the Defense Intelligence Agency, that the military files compromised by Snowden included documents bearing on military plans and weapons systems; foreign governments’ intelligence activities (including special activities), intelligence sources, or methods of cryptology; scientific and techno- logical matters relating to national security; and vulnerable systems, installations, infrastructures, projects, plans, and protection services related to national security and the development, production, or use of weapons of mass destruction. The members of the House and Senate Intelligence Committees, but not the public, have also been privy to an NSA investigation that established the chronology of Snowden’s actions, including changing jobs, copying more than one | | Epst_9780451494566_2p_all_r1.z.indd 128 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019616

The Great Divide | 129 million classified documents at the Signals Intelligence Center in Hawaii, and flying to Russia. Additional information does not necessarily change the minds of people who already have a firm view. In the field of social psychol- ogy, the testing of “confirmation theory” consistently shows that people tend to more readily reject new information that contradicts their pre-existing beliefs. For example, when Lee Harvey Oswald was arrested in the Texas Theater on November 22, 1963, he said famously, “I haven’t shot anybody.” Ten months later, the Warren Commission presented evidence, including ballistic tests, that it claimed showed that Oswald had shot three people, including Presi- dent John F. Kennedy, less than an hour before making his statement. Yet many of those who believed Oswald’s public proclamation of his innocence chose to believe that the government had falsified all the incriminating evidence to tarnish Oswald (who had been killed on November 24, 1963) rather than accept that they had been wrong in believing Oswald. The charges, countercharges, and defamatory name-calling in the @ Snowden case therefore only deepened the great divide. Those who @ saw Snowden as a democratic hero exposing the abuses of power of an out-of-control national security state tended to dismiss anything that depicted Snowden in a negative light as a fabrication, while those who saw Snowden as a “traitor” tended to dismiss anything that depicted him in a more positive light. When it comes to the murky universe of spy agencies, the prob- lem in deciding where the truth lies is further heightened by the possibility of deliberate deception. Spy masters are, after all, in the business of concealing their most sensitive operations. It is often considered essential that important secrets be protected by what Winston Churchill famously termed “a bodyguard of lies.” Top intelligence officials are not exempt from this practice. Consider, for example, the response to a question concerning the NSA‘s opera- tions made by James Clapper, the director of national intelligence, to the Senate Intelligence Committee on March 12, 2013. The Demo- cratic senator Ron Wyden of Oregon, who was on the committee, asked the spymaster if the NSA collected data on Americans. Clap- | | Epst_9780451494566_2p_all_r1.z.indd 129 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019617

130 | HOW AMERICA LOST ITS SECRETS per answered that the NSA did not knowingly “collect any type of data” on millions of Americans. Clapper’s answer was clearly untrue, but it did not mislead Senator Wyden or any other members of the Senate Intelligence Committee; Clapper had truthfully testified in a classified session of the committee earlier that week that the NSA did collect Americans’ telephone records. It was the American people who were being misled. Yet none of the senators on the committee corrected this obviously false answer. When Clapper realized he had misspoken, he could not publicly correct the record of the public ses- sion, because to do so would be revealing classified information he had sworn to protect. No doubt other intelligence officers find them- selves in a similar bind in discussing secret matters. This suggests that there is a risk in accepting statements made by the intelligence chiefs at face value. But Snowden also has a credibility problem. He has told numerous untruths, including some calculated to help him insinuate himself into the key positions from which he stole secrets and some calcu- lated to cover up the nature of his theft. For example, Snowden got @ access in the spring of 2013 to the NSA’s super-secret computers that @ stored these electronic files by working at Booz Allen Hamilton. On his application to Booz Allen in March 2013, as we’ve seen, Snowden claimed to be in the process of completing a master’s degree at the University of Liverpool in computer security sciences. Snowden had not completed a single course there and purposely lied to get access to classified documents and then to get safely away with them. He was also not entirely truthful with the journalists whose trust he sought when it suited his purpose of protecting himself. For example, as we have seen, in contacting Laura Poitras under the alias Citizen Four in January 2013, he told her that he was currently a “government employee,” although in fact he was working for a private contractor at the time. Snowden had little concern about misleading journalists when it suited his purpose. For example, he told Alan Rusbridger of The Guardian, Brian Williams of NBC News, James Bamford of Wired, Katrina vanden Heuvel of The Nation, Barton Gellman, and Jane Mayer of The New Yorker that the U.S. government intentionally | | Epst_9780451494566_2p_all_r1.z.indd 130 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019618

The Great Divide | 131 acted to “trap” him in Moscow by revoking his passport while he was already on a plane to Moscow on the afternoon of June 23. None of these journalists asked Snowden what the basis for his oft- repeated allegation was. If they had, they would have discovered that he had no independent basis for his assertion. When asked about it during the Q&A following his July 12 press conference in Moscow, he indeed said that the only knowledge he had about the suspen- sion of his passport was what he had “read” in the news reports. But all the news stories prior to his statement reported that his pass- port had been revoked on June 22, while he was still in Hong Kong. ABC News, for example, reported that the U.S. “Consul General— Hong Kong confirmed Hong Kong authorities were notified that Mr. Snowden’s passport was revoked June 22.” By advancing that date to when his plane was in “midair” on June 23, Snowden provided to unsuspecting journalists an untrue alibi for his presence in Russia. The credibility problem with Snowden assumed a more sinister dimension once he put himself and his fate in the hands of the Rus- sian authorities in Moscow. Even though the Obama administration @ decided against revealing the extent of the Russian intelligence ser- @ vice’s participation in Snowden’s move from Hong Kong to Mos- cow, or what intelligence services call an “exfiltration,” I was told by a presidential national security staff adviser that the government acted to protect the intelligence sources used by the CIA, the NSA, and the FBI to track Snowden’s movements in the latter part of June in Hong Kong. The CIA’s deputy director, Morell, would go no fur- ther than to state that during that period he had no doubt that the intelligence services of Russia and China “had an enormous interest in him and the information he [Snowden] had stolen.” Presumably, the last thing these adversary services would want would be to make this “interest” transparent to the United States. The role of concealment must be taken into account when assess- ing information bearing on the work of espionage services. When I was interviewing James Jesus Angleton—the CIA’s legendary ex- counterintelligence chief, active in the 1970s—for a book on decep- tion, I learned that intelligence services play by a different set of rules from historians when it comes to their espionage successes. | | Epst_9780451494566_2p_all_r1.z.indd 131 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019619

13.2 | HOW AMERICA LOST ITS SECRETS Angleton, a famously baroque thinker himself, impressed on me the complexity of espionage. He said, “It’s not enough just to steal a secret. It must be done in a way that the theft remains undetected.” Deception is employed to obscure the nature and the extent of the espionage theft. One of the most famous examples of this prin- ciple was the deception used by British intelligence in World War II to conceal its success in breaking the German ciphers generated by the Enigma machines. If German naval intelligence had discovered Britain was able to read the ciphers it used to communicate with its U-boats, it would have stopped using them. So British intelligence hid its coup by supplying false information to known German spies to account for the sinking of U-boats, including the canard that Brit- ish aerial cameras could detect one ingredient in the paint used to camouflage the U-boats. That same hoary principle of deception applies to modern-day communications intelligence. If the Russian, Chinese, or any other adversary intelligence service got its hands on the documents stolen by Snowden from the NSA’s repositories in Hawaii in 2013, it would @ likely employ deception, including well-crafted lies, to create as @ much ambiguity as possible as to the missing documents. From this counterintelligence perspective, the intelligence issue that spawned the great divide cannot be resolved by accepting the uncorroborated statements made by a source, such as Snowden, who may be in the hands of the Russian security services in Moscow. By the same token, the calculations made by NSA officials about the extent of the theft are also suspect. After all, the NSA is an intel- ligence service that often engages in secret machinations. We know that its top officials reported to the House and Senate Intelligence Committees, as well as the president’s national security adviser, that Snowden compromised over one million documents. But if this was disinformation, it is difficult to see its purpose. Inflating the extent of the damage of the Snowden breach to the president, Congress, and the secretary of defense obviously reflected poorly on their own management of the NSA, and their own careers. Yet such a possibil- ity cannot be precluded in the arcane world of intelligence. As in any case involving the loss of state secrets, uncontested facts remain in extremely short supply. The opinion-laden appellatives | | Epst_9780451494566_2p_all_r1.z.indd 132 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019620

The Great Divide | 133 such as “patriot” and “traitor” that have tended to fill the gap in the great divide do little to address the important mystery of how many thousands of state secrets were taken from the United States. How did Snowden breach the supposedly formidable defenses of the NSA? Did he have any assistance? How did he escape to Moscow? And what was the final destination of the stolen documents? How Snowden succeeded in this coup cannot simply be pieced together from his own statements and interviews. The story also requires a visit into the wilderness of mirrors of a counterintelligence investi- gation. For this endeavor, it is necessary to return to the crime scene: the NSA’s base in Hawaii. | | Epst_9780451494566_2p_all_r1.z.indd 133 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019621

CHAPTER 14 The Crime Scene Investigation Any private contractor, not even an employee of the government, could walk into the NSA building, take whatever they wanted, and walk out with it and they would never know. —EDWARD SNOWDEN, Moscow, 2014 | aaa MILES NORTHWEST of Honolulu on the island of Oahu, adjacent to the sprawling Wheeler Air Force Base, is a 250,000- square-foot, man-made mound of earth and reinforced concrete sur- rounded by an electrified fence. Inside the mound is a three-story structure originally built by the air force in World War II as a bomb- proof aircraft repair facility. In the Cold War, it was modernized to withstand enemy chemical, biological, radiological, or electromag- netic pulse attacks and was used by the navy’s operation center for its Pacific fleet. After the Cold War, the huge edifice was turned over to the NSA, which, as stated earlier, had been created as an intelli- gence service to intercept the communications and signals of foreign countries after World War II, a mission that included vacuuming into its giant computer arrays telephone messages, missile telem- etry, submarine signals, and virtually everything on the electro- magnetic spectrum of interest to the U.S. Defense Department and USS. intelligence agencies. As the NSA developed it, this Hawaiian base became one of its primary regional bases for gathering Asian | | Epst_9780451494566_2p_all_r1.z.indd 134 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019622

The Crime Scene Investigation | 135 communications intelligence. It provided a valuable window on the activities of adversary nations in the Pacific region and was able to monitor the ballistic missile tests and submarine activities of China, North Korea, and Russia. By 2013, the Kunia base had a vast array of state-of-the-art technology, including ninety Cray supercom- puters arranged in a horseshoe configuration, used to decipher and make sense of the intercepted signals from China, Russia, and North Korea. At the heart of the Hawaiian complex was a unit with both military and civilian employees. A large share of the civilians who ran the computers worked under two-year contracts with the NSA’s leading civilian contractor, Booz Allen Hamilton. General Alexander, who, as I said, headed the NSA in 2013, first learned about an impending story in The Guardian on June 4, while he was in Germany meeting with its top intelligence officials, from Janine Gibson, The Guardian’s American website editor. She had notified the NSA it intended to break a story focusing on the organi- zation. It took NSA counterintelligence less than forty-eight hours to determine that a civilian employee at the base from which docu- @ ments were stolen had not reported back to work on May 22. His @ civilian supervisor had delayed reporting the absence to the NSA until May 28. It also determined that the missing civilian employee, Snowden, had lied on his application for a medical leave and had flown to Hong Kong. Personal records showed he was being trained as an analyst at the Threat Operations Center and had worked there for less than six weeks. He had taken the medical leave on May 18 and left the country by plane. By June 6, he had become the NSA’s main suspect. Alexander flew to Washington, D.C., after assigning the sensi- tive job of investigating the breach to a team headed by Richard “Rick” Ledgett, who was then director of the NSA’s Threat Opera- tions Center at the NSA’s headquarters in Fort Meade, Maryland. Ledgett was the logical choice to head the damage assessment inves- tigation because the center’s regional branch in Hawaii was under his command. Ledgett flew to Hawaii, where his first task was to reconstruct the chronology of Snowden’s moves, or, as the tactic is called in counterintelligence parlance, “walking the cat back.” The NSA had also notified the FBI of Snowden’s possible involve- | | Epst_9780451494566_2p_all_r1.z.indd 135 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019623

136 | HOW AMERICA LOST ITS SECRETS ment in the theft of state secrets in the first week of June. The FBI is in charge of criminal investigations of civilian U.S. intelligence workers, even if the alleged crime occurs on an NSA base. The FBI immediately dispatched a task force of agents to investigate a poten- tial espionage case in Hawaii. When questioned, Lindsay Mills said Snowden was away on a business trip. After determining from airline and hotel data that he was in Hong Kong, the FBI realized Snowden was a possible intelligence defector. It froze his credit and bank cards. It also notified the passport office in the State Depart- ment and the legal attachés at the Hong Kong consulate. The legal attachés, who were actually FBI field agents posted in Hong Kong, located Snowden at the Mira hotel on June 8. On the evening of June 9, Snowden revealed in his twelve-minute video posted on the Guardian website that he was the source of the stolen NSA docu- ments. Because Hong Kong is part of China, U.S. law enforcement did not have the means to recover them. At that point, determining the magnitude of the theft of docu- ments became a critical concern of the investigation. Aside from the @ few dozen documents published by The Guardian and The Washing- @ ton Post, what else had Snowden stolen? Within the next few days, a small army of forensic investigators from the FBI, the Defense Department, and the “Q” counterintel- ligence division of the NSA swarmed onto the NSA base in Hawaii. The proximate crime scene for their investigation was the National Threat Operations Center. They examined the cubicle where Snowden had last worked and then began retracing all his activi- ties at the NSA from 2009 to 2013. To begin with, they needed to find out how many documents from the center had been copied and taken by Snowden. Meanwhile, the Defense Intelligence Agency (the Pentagon’s own intelligence service) was kept partially in the dark. Although the NSA is officially part of the Department of Defense, it operated with a high degree of autonomy with its own inspector general, inves- tigative staff, and reporting channels. The DIA did not learn from the NSA that Snowden had stolen military documents concerning the joint Cyber Command until July 10. The number of stolen mili- tary documents from the Department of Defense was staggering. | | Epst_9780451494566_2p_all_r1.z.indd 136 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019624

The Crime Scene Investigation | 137 The DIA found from its forensic examination that Snowden had copied “over 900,000” military files. Many of these non-NSA files came from the Cyber Command, which had been set up in 2011 by the NSA and the army, navy, marine, and air force cryptologi- cal services to combat the threat of warfare in cyberspace. The loss was considered of such importance that between 200 and 250 mil- itary intelligence officers worked day and night for the next four months, according to the DIA’s classified report, to “triage, analyze, and assess Department of Defense impacts related to the Snowden compromise.” The job of this unit, called the Joint Staff Mitigation Oversight Task Force, was to attempt to contain the damage caused by the Snowden breach. In many cases, containment meant shutting down NSA operations in China, Russia, North Korea, and Iran so they could not be used to confuse and distract the U.S. military. The NSA and the Defense Department were not the only gov- ernment agencies concerned with determining the extent of the breach. The NSA acted as a service organization for the CIA through handling most if not all of its requests for communications intel- @ ligence to support both its international espionage and its analytic @ operations. Although the CIA and the NSA were both part of the so- called intelligence community, the NSA did not immediately share with the CIA details of the Snowden breach. Despite the immense potential damage of the theft, it was not until June 10 that the CIA’s director, John Owen Brennan, and his deputy, Michael Morell, were briefed by the NSA. When Morell realized how much data Snowden had taken, he was astounded. “You might have thought of all the government entities on the planet, the one least vulnerable to such grand theft would have been the NSA,” he wrote. “But it turned out that the NSA had left itself vulnerable.” According to Morell, he bluntly told the NSA briefer that it was urgent for the CIA to be brought in on the case. After all, the CIA had employed Snowden only four years earlier. Specifically, Morell said, the CIA needed to find out three things: Had CIA docu- ments been part of Snowden’s haul? How long had Snowden been stealing documents? Had Snowden been working “with any foreign intelligence service, either wittingly or not”? According to Morell, the effort to get a direct answer from NSA | | Epst_9780451494566_2p_all_r1.z.indd 137 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019625

138 | HOW AMERICA LOST ITS SECRETS officials to these three key questions “proved maddeningly diffi- cult.” He found that in mid-June NSA officials with whom he dealt were so “distraught at the massive security breach” that initially they refused to allow even CIA officers to participate in the ongoing security review. A former NSA executive told me there was “near panic” at the NSA. Finally, Morell called Chris Inglis, a former pro- fessor of computer science who had risen to be the NSA’s deputy director at the time of the breach. Inglis, who headed operations for the NSA, told him “the news was not good.” Among the data copied by Snowden were a large number of CIA secrets. By the time the CIA learned that its secrets had been compromised, Snowden was headed to Russia. The investigation of a crime involving potential espionage is no easy task. In this case, it required attempting to solve a jigsaw puz- zle in which not only were key pieces missing but also, because it involved adversary intelligence services, some of the found pieces might deliberately have been twisted to mislead the U.S. investigators. By late July, NSA investigators had made their initial assessment. @ They determined that most of the material had been taken from @ sealed-off areas known in intelligence speak as “compartments,” which in this case were files stored on computers that were isolated from any network. Each compartment electronically tracks all the activities that occur in it on its logs, including the password identity of any person who has gained entry to any compartment. From a forensic examination of these logs, NSA investigators were quickly able to reconstruct the timeline of the theft. The logs showed that an unauthorized party without proper passwords had begun copying files in mid-April, which was just days after Snowden began his job at the center. The illicit activity ended just before Snowden’s last day of work there. So this piece fit in with Snowden’s guilt. The size of the theft was another matter. Ledgett was certainly in a position to know (in the shake-up that followed, he would replace Inglis as deputy director of the NSA). According to Ledgett, the per- petrator had “touched” 1.7 million documents, moving from com- partment to compartment. Of these “touched” documents, according to the analysis of the logs, more than one million of them had been moved by the unauthorized party in mid-May to an auxiliary com- | | Epst_9780451494566_2p_all_r1.z.indd 138 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019626

The Crime Scene Investigation | 139 puter intended to be used for temporary storage by authorized ser- vice personnel. Finally, the data was transferred off this auxiliary computer presumably to thumb drives or other external storage devices. This download occurred just days before Snowden left the NSA on May 17, 2013, having told the agency that he needed a med- ical leave of absence. The quantity of stolen documents, 1.7 million, does not necessar- ily reveal the damage and can itself be misleading. Many documents do not reveal current or known sources or methods, and others may have little value to an enemy. And a large portion of the documents might have been duplications. The quality of some of these docu- ments is another matter. Just one document that exposed a source or method of which enemies are unaware can be of immense value. One such document taken by Snowden provided what Ledgett called “a roadmap” to the NSA’s current secret operations, revealing to an adversary such as Russia, China, or Iran “what we know, what we don’t know, and, implicitly, a way to protect themselves.” There were many documents in the Snowden breach that met these criteria, @ according to a national security official at the Obama White House. @ General Alexander closely followed the investigation as it devel- oped over the summer of 2013. By then, of course, the whole world knew that Snowden had stolen a vast trove of NSA documents. Alexander saw major inconsistencies developing between Snowden’s personal account of the theft and what had actually happened. The timeline established by the government’s investigators did not match Snowden’s story line. “Something is not right,” Alexander said in an interview. For one thing, Snowden had made the claim to journalists, four months after he was in Russia, that he had turned over all the documents he took from the NSA’s compartments to Poitras and Greenwald in Hong Kong. On August 18, the investigators had the opportunity to examine the files that Snowden had given to Poitras and Greenwald. This discovery came when British authorities, under Schedule 7 of Britain’s Terrorism Act, detained David Miranda, Greenwald’s romantic partner, at Heathrow Airport. Miranda was suspected of acting as a courier for Greenwald and Poitras. Accord- ing to Greenwald’s account, Snowden had given both him and Poi- | | Epst_9780451494566_2p_all_r1.z.indd 139 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019627

140 | HOW AMERICA LOST ITS SECRETS tras identical copies of the NSA documents in Hong Kong. When Greenwald returned home to Rio de Janeiro, he found his copy was corrupted. But Poitras still had her digital copy of whatever stolen documents Snowden had distributed to them. So Greenwald dis- patched Miranda from Rio to Berlin to get a copy of Poitras’s thumb drive. On the return trip, Miranda’s plane stopped at Heathrow, where British authorities detained him and temporarily took the thumb drive from him. Poitras had written out the password for Greenwald, and Miranda kept it with the thumb drive. The Brit- ish copied the contents and shared them with the NSA. As a result, the NSA discovered that Snowden had only given Poitras fifty-eight thousand documents. The damage assessment team under Ledgett determined that some of these documents had been edited out of much larger documents that the NSA logs showed Snowden had copied. By the count of both the NSA and the Defense Department teams, almost one million documents were unaccounted for What happened to the missing documents? The NSA investigation found that the chronology of the theft @ of documents did not support Snowden’s claim to journalists that @ he had only been seeking whistle-blowing documents. Most of the documents he took first did not concern the domestic activities of the NSA. Only toward the end of the theft did he copy documents that would qualify as whistle-blowing. The court order to Verizon that was the basis of the initial Guardian exposé was only issued by the FISA court on April 27, 2013. The other main whistle-blowing docu- ment he revealed, the PowerPoint presentation about PRISM, was only issued in April 2013. Yet Snowden had been downloading docu- ments for at least nine months before he copied these documents. When I discussed the chronology of the copied documents with a former government official briefed on the investigation, he sug- gested that Snowden’s purpose might have changed between 2012 and 2013. When I asked him what might have induced the change, he replied, “That is one of the unanswered questions.” That Snowden only took these two whistle-blowing documents at the tail end of his nine-month operation, and after he had contacted Poitras and Greenwald, suggests he might have had another motive prior to contacting journalists. In light of this chronology, the investigation | | Epst_9780451494566_2p_all_r1.z.indd 140 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019628

The Crime Scene Investigation | 141 had to consider the possibility that his whistle-blowing was, partly if not wholly, a cover for another enterprise. Snowden told journalists he had access to “millions of records that [he] could walk out the door with at any time with no account- ability, no oversight, no auditing, the government didn’t even know they were gone.” However, he was not among the limited number of individuals at the center who had access to these documents. Both the NSA’s and Booz Allen’s employment records showed that Snowden had not yet completed his requisite on-the-job training when he carried out the theft. Consequently, he had not yet been provided with the passwords he needed to get the documents. Even if he had remained at the NSA long enough to finish his training, he would only have been provided with the password to the particu- lar compartment relevant to his work, not to all compartments. The tight control over these passwords was, according to a former top NSA official, a critical part of the NSA’s security framework. He told me that Snowden, at least during the period of the thefts in April and May 2013, had no more legitimate access to the compartments @ than the cleaning personnel. Somehow, though, Snowden converted @ his proximity to access. Ifa hundred top-quality diamonds were stolen from locked vaults at Tiffany by a recently hired trainee who, it turned out, did not have the combination to open these vaults, the police would be expected to consider that the trainee might have had help from a current or for- mer insider at the company who knew the combinations. Snowden, who had accomplished a similarly inexplicable feat, said in his video confession that he was solely responsible. However, it is perfectly logical to assume, given the circumstances, that he might have had help, unwitting or witting. The FBI could assume either that the NSA’s security regime was so badly flawed that Snowden could trick his fellow workers into providing him with access or that there was another individual at the center who might have assisted or directed Snowden. When the investigation came to this fork in the road in the summer of 2013, according to a source on the House Intelligence Comittee, it chose the former route. Finally, there was the question of whether Snowden had gone to | | Epst_9780451494566_2p_all_r1.z.indd 141 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019629

142 | HOW AMERICA LOST ITS SECRETS Russia by design or by accident. Whenever an intelligence worker steals sensitive compartmented information of interest to a foreign adversary and then defects to that adversary, it raises at least the specter of state-sponsored espionage. It is a commonly accepted pre- sumption in counterintelligence that a spy, fearing arrest, flees to a country that has some reason to offer him protection. When the British spies Guy Burgess, Donald Maclean, and Kim Philby fled to Moscow during the Cold War, the presumption was that they had a prior intelligence connection with Russia. Philby confirmed that in his 1968 memoir, My Silent War. So in the case of Snowden, coun- terintelligence had to consider the possibility that his theft of state secrets and his arrival in Moscow might not be totally coincidental. Snowden blamed high officials in the U.S. government who pur- posely “trapped him” in Russia. He told the editor of The Nation, “I’m in exile. My government revoked my passport intentionally to leave me exiled” and “chose to keep me in Russia.” He repeated that assertion over a dozen times, but as we’ve seen, it had no basis in fact. Whenever criminal charges are lodged against a U.S. citizen by @ the Department of Justice, the State Department, in accordance with @ the U.S. code of justice, marks in the electronic passport validation advisory system that that person’s passport is valid only for return to the United States. After criminal charges were publicly filed against Snowden on June 21, it advised foreign governments that because Snowden was wanted on felony charges, he “should not be allowed to proceed in any further international travel, other than is necessary to return him to the United States.” Rather than “exiling” Snowden, the government acted to facilitate his return home. With his passport, he could have flown home from either Hong Kong or Moscow, where he, like any other person accused of a felony, would face the charges against him. Snowden’s unfounded claims suggested to investigators that he had something to hide about his arrival in Russia. The counterintelligence investigation had access to State Depart- ment records showing that its representatives in Hong Kong had informed authorities there on June 16 that there were criminal charges against Snowden. Only a typographical error in spelling out Snowden’s middle name—James instead of Joseph—in the criminal | | Epst_9780451494566_2p_all_r1.z.indd 142 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019630

The Crime Scene Investigation | 143 charges prevented the Hong Kong police from immediately order- ing his detention. His Hong Kong lawyers were certainly advised of these pending charges no later than June 21, when they were pub- lished on the front page of the South China Morning Post in Hong Kong. Presumably, Snowden knew that actions by the U.S. govern- ment were already in progress and that one of these actions would include restricting his passport. One of his lawyers, Jonathan Man, even accompanied Snowden to the airport out of his concern that he would not be allowed by Hong Kong authorities to go through pass- port control. Ordinarily, Hong Kong passport control scans passports when tourists exit but does not check them against a computerized database. In any case, when Snowden arrived in Russia on June 23, any future international travel decisions for him would be up to the gov- ernment of Russia, not that of the United States. It could have sent him back to Hong Kong, as is normally done when someone arrives without a proper visa, or to the United States. The only govern- ment with the actual means to “trap” him in Russia was the Russian @ government. @ Senior intelligence officials also knew that the U.S. government, rather than conspiring to keep Snowden in Moscow, had met nearly every day while he was in Hong Kong with Lisa Monaco, President Obama’s homeland security adviser, in the White House Situation Room to find a way to prevent Snowden and his cache of secrets from falling into Russian hands. Robert S. Mueller III, then the FBI director, reportedly even directly appealed to the FSB head, Alexan- der Bortnikov, to return Snowden to the United States. USS. intelligence also knew that it was no accident that Snowden wound up in the hands of Russia. He had been in contact with Rus- sian officials in Hong Kong. It will be recalled that Putin admitted to this liaison on September 3, ina press briefing on state-owned Chan- nel One television; he also divulged that he had advance knowledge of Snowden’s plan. “T will tell you something I have never said before,” Putin said. Snowden “first went to Hong Kong and got in touch with our diplo- matic representatives.” Putin was told then that an American “agent of special services” was seeking to come to Russia. Putin added that | | Epst_9780451494566_2p_all_r1.z.indd 143 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019631

144 | HOW AMERICA LOST ITS SECRETS he declared that this agent would be “welcome, provided, however, that he stops any kind of activity that could damage Russian-US relations.” Even before that public confirmation of the Russian role in Hong Kong, the White House was well aware of it. On June 23, the Demo- cratic senator Charles Schumer of New York correctly said, based on a White House briefing, that “Vladimir Putin had personally approved Snowden’s flight” to Moscow. The NSA had the means to monitor Russian communication between Moscow and Hong Kong. The NSA also reportedly intercepted contacts between these Russian officials and Russian representatives of Aeroflot, the Russian state- owned airline that had flights between Hong Kong and Moscow. Aeroflot (like most other international carriers) ordinarily requires international passengers to have both a valid passport and, if neces- sary, a visa to the country of their destination. Those rules had to be waived for Snowden’s exfiltration from Hong Kong. Snowden’s defection to Moscow was not a haphazard result of unexpected cir- cumstances. Russia obviously knew he was coming. This raised new @ questions for the investigation. What led Snowden to defect to Rus- @ sia? Was his arrival in Moscow planned by Russian intelligence in advance of his going public in Hong Kong? Was any other party, such as China, privy to the plan? Was there a quid pro quo? Putin’s authorization could certainly account for Aeroflot’s waiv- ing its usual passport and visa check to allow Snowden to board its plane, as well as the dispatch with which Russian officials whisked Snowden off the plane after it landed at the Moscow airport. It could also account for Snowden’s vanishing from public view for the next three weeks and the promulgation of the cover story that Snowden was unwillingly trapped at the airport by the U.S. government. The reasons behind Putin’s move were less clear. By September 2013, the investigation was looking into a veri- table abyss. Snowden’s culpability was no longer an issue. What was lacking from Snowden’s video, or the two-hour film made by Laura Poitras, was any specific information on how many documents he had copied, how he had obtained the passwords to the computers on which they were stored, the period of time involved in the theft, or how he had breached all the security measures of the NSA in | | Epst_9780451494566_2p_all_r1.z.indd 144 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019632

The Crime Scene Investigation | 145 Hawaii. Nor would that data be forthcoming from Snowden, who may be the only witness to the crime. By June 23, he was in a safe haven in Moscow. Even though the grand jury case against Snowden was cut and dry, it was also irrelevant because the United States does not have an extradition treaty with Russia. The purpose of the intelligence investigation went far beyond determining Snowden’s guilt or innocence, however. Its job was to find out how such a massive theft of documents could occur, how the perpetrator escaped, and, perhaps most urgent, who had obtained the unaccounted-for stolen documents from Snowden. In his interviews with journalists in Moscow, Snowden studiously avoided describing the means by which he breached the security aperture of America’s most secret intelligence service. He only told the journalists who came to Moscow to interview him, with a bit of pseudo-modesty, that he was not “an angel” who descended from heaven to carry out the theft. But the question of how Snowden stole these documents may be the most important part of the story. The NSA, after all, furnishes communications intelligence to the @ president, his national security advisers, and the Department of @ Defense, intelligence that is supposedly derived from secret sources in adversary nations. If these adversary nations learn about the NSA’s sources, then the information, if not worthless, cannot be fully trusted. The most basic responsibility of the NSA is to pro- tect its sources. Yet Snowden walked away with long lists of them. In doing so, he amply demonstrated that a single civilian employee working for an outside contractor, even one not having the neces- sary passwords and other access privileges, could steal documents that betrayed these vital sources. He also demonstrated that such a massive theft could go undetected for at least two weeks. If Snowden managed this feat on his own, as he claims in his Hong Kong video, it suggests that any other civilian employee with a perceived grievance against NSA practices or American foreign policy could also walk away with some of the most precious secrets held by U.S. intelligence. Such vulnerability extends to tens of thou- sands of civilian contract employees in positions similar to the one held by Snowden. The lone disgruntled employee explanation is therefore hardly reassuring. If true, it calls into question the entire | | Epst_9780451494566_2p_all_r1.z.indd 145 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019633

146 | HOW AMERICA LOST ITS SECRETS multibillion-dollar enterprise of outsourcing the management of the NSA’s computer networks and other technical work to outside con- tractors. It also casts doubts on the post-9/11 decision by the intel- ligence community to strip away much of the NSA’s “stovepiping” that previously insulated its most sensitive computers. Without such stovepiping, any rogue civilian employee could bring down the entire edifice of shared intelligence. A finding that Snowden had acted in concert with others in breach- ing compartments at the NSA would hardly be any more reassuring. Such collaboration among intelligence workers would reflect gravely on the mind-set of the NSA. Snowden described an atmosphere in which intelligence workers exchanged lewd photographs of foreign suspects. Some NSA employees met to protest the NSA policies. Did this violation of the NSA‘s rules also involve abetting the theft of documents? If so, the NSA would have to evaluate further vulner- abilities that might arise when it entrusts its secrets to technicians who do not share its values. A collaborative breach would signal an immense failure of the present concept of the counterintelligence @ regime in the NSA. @ From what I gathered from government officials who were famil- iar with the investigation, there was a concern that answering the “how” question would rouse serious doubts about the very ability of the NSA to carry out its core mission of protecting the govern- ment’s intelligence secrets. However it was organized, it was clear that Snowden had played a major role in what amounted to a bril- liant intelligence coup. | | Epst_9780451494566_2p_all_r1.z.indd 146 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019634

CHAPTER 15 Did Snowden Act Alone? When you look at the totality of Snowden’s actions certainly one hypothesis that jamps out at you, that seems to explain his abil- ity to do all these things, is that he had help and had help from somebody who was very competent in these matters. —GENERAL MICHAEL HAYDEN, former director, NSA and CIA WHISTLE-BLOWER enters the enterprise of stealing state secrets for reasons of conscience, but so do many spies. Such conscience-driven spies are called, in CIA parlance, “ideological agents.” For instance, the British diplomat Donald Maclean, one of the most important Russian spies in the Cold War, was an ide- ological recruit. He stole immensely valuable U.S. nuclear secrets for the Russian intelligence service without receiving any monetary compensation. The acceptance of money is not necessarily a meaningful dis- tinction when it comes to espionage. To be sure, many spies get paid, but some whistle-blowers also receive a rich bounty for their work. Indeed, under federal laws, whistle-blowers can qualify for multimillion-dollar bounties for exposing financial malfeasance. The whistle-blower Bradley Birkenfeld, for example, after he himself was paroled from prison in 2012, received an award of $104 million for providing data that exposed illicit tax sheltering at the Swiss UBS bank. Assange also offered political whistle-blowers six-figure cash | | Epst_9780451494566_2p_all_r1.z.indd 147 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019635

148 | HOW AMERICA LOST ITS SECRETS bounties from money raised on the Internet. In 2015, for instance, WikiLeaks offered $100,000 bounties to any whistle-blowers who provided the site with secret documents exposing details of the Trans-Pacific Trade Agreement. Nor is acting alone necessarily a line that divides whistle-blowers from spies. In many cases, whistle-blowers have accomplices who help them carry out their mission. For example, in 1969, the cel- ebrated whistle-blower Daniel Ellsberg, a military analyst at the Rand Corporation, had an accomplice, Anthony Russo, who had also worked at Rand. (Both were indicted by the government.) Acting in concert, they copied secret documents that became known famously as the Pentagon Papers. Whistle-blowers can also, like conventional spies, enter into elabo- rate conspiracies to carry out an operation. On the night of March 8, 1971, eight whistle-blowers working together with burglary tools broke into the FBI office in Media, Pennsylvania, and stole almost all the FBI files there. The conspirators escaped and kept their identities secret for over forty-two years. @ Self-definitions also do not necessarily produce a distinction @ between whistle-blowers and conventional spies. Consider Philip Agee, who left the CIA in 1969 for what he described as “reasons of conscience.” Specifically, he said he objected to the CIA’s covert support of Latin American dictators. After contacting the Soviet embassy in Mexico City, he defected to Cuba, where he leaked infor- mation that exposed CIA operations. Although Agee insisted he was a whistle-blower, and he adamantly denied offering any secrets to the Soviet Union, the KGB viewed him as a conventional spy. Accord- ing to Oleg Kalugin, the top Soviet counterintelligence officer in the KGB in Moscow, who defected to the United States, Agee offered CIA secrets first to the KGB residency in Mexico City in 1973 and then to the Cuban intelligence service. Agee provided the KGB with a “treasure trove” of U.S. secrets, Kalugin revealed. “I then sat in my office in Moscow reading the growing list of revelations coming from Agee.” Despite this disparity, Agee still defined himself to the public as a whistle-blower because he also had exposed CIA opera- tions to the public. The Snowden case blurs the demarcation line even further. Unlike | | Epst_9780451494566_2p_all_r1.z.indd 148 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019636

Did Snowden Act Alone? | 149 other whistle-blowers who uncovered what they considered gov- ernment malfeasance by virtue of their jobs, Snowden, by his own admission, took a new job in 2013 specifically to get access to the SCI files concerning NSA sources that he stole from the Threat Opera- tions Center. Switching jobs in order to widen one’s access to state secrets is an activity usually associated with penetration agents, not whistle-blowers. While the technical distinction between a whistle- blower and a spy may still serve the media in the case of Snowden, it does not help in solving the counterintelligence conundrum. A complex theft of state secrets had been successfully carried out in a supposedly secure site. The only known witness, Snowden, had escaped to Russia, where he could be of no help in reconstructing the crime for American intelligence agencies. The stolen data was kept in the equivalent of sealed “vaults”—actually computer drives that were not connected to the NSA network. If ever there was a locked- room mystery, this was it. According to the FBI investigation, Snowden pierced these barri- ers by using passwords that belonged to other people and using cre- @ dentials that allowed him to masquerade as a system administrator. @ It was a feat that must have required meticulous planning. To address such a mystery, a counterintelligence investigation starts with a tabula rasa, stripping away all the previous assump- tions, including that Snowden was the lone perpetrator. It builds alternative scenarios to test against the known facts. To be sure, sce- nario building differs from that of a conventional forensic investiga- tion aimed at finding pieces of evidence that can be used to persuade a jury in a courtroom. Unlike a judicial investigation concerned with guilt and innocence, scenario building looks to develop a story that is, concurrently, intrinsically consistent and humanly plausible, and in the process it also identifies and explores the possible holes in the case. “Scenarios deal with two worlds: the world of facts and the world of perceptions. They explore for facts but they aim at perceptions inside the heads of decision makers. Their purpose is to gather and transform information of strategic significance into fresh percep- tions,” wrote Pierre Wack in the Harvard Business Review in 1985. Such scenarios must aim at constituting a limited set of mutually | | Epst_9780451494566_2p_all_r1.z.indd 149 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019637

150 | HOW AMERICA LOST ITS SECRETS exclusive alternatives. The point is to assure that any alternative that fits the relevant facts, no matter how implausible it may initially seem to be, is not neglected. One of the most vexing problems that had to be explained by these scenarios is how Snowden got the passwords to up to twenty-four of these vaults. He could not have obtained these passwords during his previous employment at Dell, because Dell technicians did not have access to the Level 3 documents stored in these compartments. Nor, as noted earlier, was he given access to them when he transferred to Booz Allen, because he had not completed the requisite training. Snowden had also, it will be recalled, relinquished his privileges as a system administrator when he transferred to Booz Allen, so he did not have the privilege to override password protection. In short, his new position as an infrastructure analyst did not give him the ability to enter compartments that he had not yet been read into. As I've said, there are two possible ways he could have gotten these passwords: either he had assistance from a party who had access to them, or he found flaws in the NSA’s security procedures @ that left the supposedly closed vaults effectively unlocked. @ The Unwitting Accomplice Possibility It is possible that if Snowden received assistance, it was entirely unwitting. He might have obtained some passwords through decep- tion, such as tricking co-workers into typing their passwords into a device that captured them. As the NSA informed Congress in 2014, three of his fellow workers told the FBI that Snowden might have deceived them to gain access to their passwords. He could have simply asked other analysts at the center who had been read into compartments for their passwords. Such an approach would be extremely risky for the analyst, who could lose his job and security clearance by cooperating. It could also be risky for Snowden because any analyst he approached was supposed to report any request for a password to a security officer. Making such requests even more suspicious, Snowden had been working at the Threat Operations Center for just a few weeks as a trainee and was not well known to | | Epst_9780451494566_2p_all_r1.z.indd 150 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019638

Did Snowden Act Alone? | 151 other analysts there. “It is inconceivable to me that his co-workers would divulge their passwords to him,” a former Booz Allen execu- tive, who had also worked at the Defense Intelligence Agency, told me. “If he was a system administrator, he might trick a threat ana- lyst into entering his password into his computer under the pre- text that he needed it to deal with an urgent hardware issue.” But, it will be recalled, Snowden was not a system administrator at the center. Snowden therefore “had no plausible reason for requesting passwords to compartments he had not been read into,” the former executive said. He said that NSA executives might have been read into all twenty-four of the compartments, but he deemed it incon- ceivable they would illicitly share their passwords with Snowden. I asked him what the chance was of his voluntarily obtaining some twenty-four passwords from co-workers in five weeks. “In my opin- ion, near zero,” he said. It is possible of course that Snowden could have simply observed others typing in their passwords, one by one, but that would take time and possibly attract attention. I asked the former Booz Allen @ contractor whether it was possible that Snowden could have used a @ device for intercepting another computer’s electronic signals, called by hackers a “key logger.” Such a device, which is obtainable over the Internet, could be used to steal the passwords of the analysts who had been read into the compartments. My source said that while it was possible that Snowden smuggled in a key logger in his backpack, it could not be operated unless it was hardwired to a com- puter inside the center, because, like those at all other NSA facili- ties, the computers had been insulated to block any form of wireless transmission. This precaution was taken to guard against an EMP, or electromagnetic pulse, attack by an enemy. The only way Snowden could intercept keystrokes was to attach a cable from his key logger to each of his fellow workers’ computers. In this scenario, he would have had to surreptitiously build his own wired network connect- ing his hidden key logger to twenty-four separate computers. More- over, he would have to do this wiring in an open-plan office where he could not count on these additional wires, even if rigged one by one, not being noticed by either other analysts in the room or the “geek squad” of system administrators who regularly checked con- | | Epst_9780451494566_2p_all_r1.z.indd 151 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019639

Lb 2 | HOW AMERICA LOST ITS SECRETS nections. Making the task even more risky, according to my Booz Allen source, there were closed-circuit cameras. The only way he could mitigate the risk of detection was by having someone help him build this network. Even if Snowden had managed to obtain all the necessary pass- words from colleagues, he would have had to transfer the files to an external storage device. This was not a matter of simply attaching a thumb drive or other external device to a port, because, unlike in movies such as Mission: Impossible, the ports on the computers at the NSA were ordinarily sealed shut. This measure was taken spe- cifically to prevent any unauthorized downloading by NSA workers. The only people at the center who had the authorization, and the means, to open these ports and transfer data were system admin- istrators, according to the former Booz Allen executive. System administrators needed to have this privilege to deal with glitches in the computers. Snowden was no longer a system administrator and had no such privileges. So again, he would have needed help. He would have needed to either borrow a system administrator’s @ credential or forge his own. @ The credential he would need is called a public key infrastructure, or PKI, card with its authentication code embedded in a magnetic strip. When I asked the former Booz Allen executive if Snowden possessed the skill set to forge such a card, he said that he strongly doubted any NSA employee would be capable of such a forgery without special equipment. Just asking such a favor could “set off alarms,” my source said. The unwitting accomplice scenario had another stumbling block: time. We know from Poitras that Snowden told her in early April 2013 that he planned to deliver documents to her in six to eight weeks (which he in fact did). But he had not yet started working for Booz Allen at the center until that same month. It does not seem plausible that in making such a commitment he was merely count- ing on his ingenuity in the face of strangers to fulfill it. The only way he could have known for certain that he would be able to borrow a PKI card and obtain the passwords, whether by trickery, by observa- tion, or by a key router, before he had begun working at the center was that he already knew someone there who would help him. | | Epst_9780451494566_2p_all_r1.z.indd 152 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019640

Did Snowden Act Alone? | 153 The Witting Accomplice Possibility The witting accomplice scenario better fits with the principle in logic called Occam’s razor, which suggests that when one is choosing between alternative explanations, the one that requires the fewest assumptions should be given priority. It would be relatively easy to gain access to passwords if Snowden had the cooperation of an insider at the center who had been read into the compartments or, even better, if he had the cooperation of a system administrator with the necessary PKI cards and shell keys to bypass the password pro- tection. Such an accomplice could also help explain how Snowden was able to get the job at the center in the first place, how he knew in advance that he could find there the “lists” of the NSA sources in foreign countries, and how he knew that there were security traps at the center. Such a witting accomplice might even have prepared in advance the “spiders” that Snowden used to index the files. The witting accomplice scenario of course requires an unsettling expansion of the plot. It means Snowden collaborated with one or @ more insiders at the center to steal secret documents. It is not dif- @ ficult to imagine, in light of the lax background checks for outside contractors servicing the NSA, that there were others in the “geek squad” who shared Snowden’s antipathy to NSA surveillance. Cer- tainly, we know that Snowden found other NSA workers who were willing to attend his anti-surveillance CryptoParty in December 2012. Some might be willing to offer Snowden help if he was willing to go public. Indeed, if the geek culture produced one Snowden, why wouldn’t it produce others? If such an accomplice lacked Snowden’s willingness to flee to another country, he might have limited his par- ticipation to supplying technical assistance. For his part, Snowden might have agreed to divert suspicion from his accomplice by taking sole responsibility for the crime when he went public. All of this is theoretically possible, but no witting accomplice was ever identified. The FBI, which was in charge of the domestic part of the investigation of the Snowden case, questioned all of Snowden’s co-workers at the center over the course of six months and failed to find anyone who knowingly helped Snowden. If the accomplice was an idealistic amateur, it is likely the FBI would have found him. | | Epst_9780451494566_2p_all_r1.z.indd 153 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019641

154 | HOW AMERICA LOST ITS SECRETS Three co-workers did admit to the FBI, as noted earlier, that they might have inadvertently given Snowden their passwords, but these three slips would not account for Snowden’s breach of all the other compartments. Of course, there might have also been less forthcom- ing co-workers who hid their slips in divulging their passwords to Snowden. This raises the more sinister possibility that the accomplice was not an amateur co-worker but a spy who was already in place when Snowden arrived. Such a penetration agent could have been recruited by an adversary intelligence service before Snowden came on the scene. After Snowden expressed a desire to expose the NSA’s domestic surveillance, it could then have used him as an “umbrella” to hide its own activities. Finding such a means to protect a source while exploiting his or her information is not uncommon in espio- nage operations, and because Snowden was willing to flee America and go public, he could serve as a near-perfect umbrella. “Snowden may have carried out of the NSA many more documents than he knew about,” Tyler Drumheller, the former CIA station chief, said. It @ could also account for the disparity between the claims of Snowden @ and the NSA damage assessment as to the number of documents that were compromised. As far-fetched as this scenario may seem, less than three years before the Snowden breach the NSA had received a warning from a CIA mole (to be discussed in greater detail later) that the Russian intelligence service might have recruited a KGB mole at the Fort Meade headquarters of the NSA. No mole was found in 2010, and if one existed, it could not have been Snowden, who was working for the NSA in Japan in 2010. Such a putative mole could conceiv- ably have acquired enough information to later facilitate Snowden’s operation. As Snowden acknowledges, he was not a happy worker at the NSA. He complained in his posts over the Internet between 2010 and 2013 about superiors and what he considered NSA abuses to co-workers. If someone assumed the guise of a reluctant whistle- blower, he would have little difficulty in approaching Snowden. Snowden might not even know his true affiliation beyond that he | | Epst_9780451494566_2p_all_r1.z.indd 154 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019642

Did Snowden Act Alone? | 155 shared Snowden’s anti-surveillance views. If Snowden then voiced an interest in exposing the NSA’s secrets, this person could sup- ply him with the necessary guidance, steering a still-unsuspecting Snowden first to the Booz Allen position and afterward to his associ- ates in Hong Kong. By taking sole credit for the coup in the video that he made with Poitras and Greenwald in Hong Kong, he acted, as he told Greenwald, to divert suspicion from anyone else. This move could also give any collaborator he might have had in Hawaii time to cover his or her tracks. The astronomer Carl Sagan famously said in regard to searching the universe for signals from other civilizations that the “absence of evidence is not evidence of absence.” That injunction also applies to the spooky universe of espionage. The fact that a mole hunt fails to find a hidden collaborator at the NSA does not necessarily mean such a mole does not exist. Historically, we have many notable cases in which Russian moles eluded long, intensive investigations. Rob- ert Hanssen penetrated the FBI for over twenty years for the KGB without being caught. Similarly, Aldrich Ames acted as a KGB mole @ in the CIA for more than ten years and passed all the CIA’s sophisti- @ cated lie detector tests. Both Hanssen and Ames eluded intensive FBI and CIA investigations that lasted over a decade. According to Victor Cherkashin, their KGB case officer, whom I interviewed in Moscow in 2015, the KGB was able to hide their existence from investigators for such a long period partly because of the widespread belief in U.S. intelligence that moles were fictional creatures that sprang from the “paranoid mind” of James Jesus Angleton. When I then cited the signature line from the movie The Usual Suspects, “The greatest trick the devil ever pulled was convincing the world he didn’t exist,” Cherkashin thinly smiled and said, “CIA denial [of moles] certainly helped.” In view of such past successes of the Russian intelligence services, it cannot be precluded that there was another person in the NSA working with the enthusiastic Snowden as cover to prevent any light from falling on his own surreptitious spying. While it may seem extremely unlikely that Snowden had such assistance, the alterna- tive scenario, that Snowden broke into the sealed compartments and | | Epst_9780451494566_2p_all_r1.z.indd 155 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019643

156 | HOW AMERICA LOST ITS SECRETS made off with the documents without any assistance, seems equally unlikely. Even if Snowden had been, as he claims, a pure idealist seek- ing to right a perceived wrong, it does not exclude the possibility of his becoming entangled in the plots of others. Intelligence ser- vices make it their business to bring about such witting or unwitting entanglements. | | Epst_9780451494566_2p_all_r1.z.indd 156 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019644

CHAPTER 16 The Question of When The NSA was actually concerned back in the time of the crypto- wars with improving American security. Nowadays, we see that their priority is weakening our security. —EDWARD SNOWDEN, Moscow, 2015 N HIS 1974 NOVEL, Tinker, Tailor, Soldier, Spy, John Le Carré helped establish the concept in the public imagination of a mole burrowing into a rival intelligence service. Le Carré’s now-classic mole, code-named Gerald by the KGB, managed in the novel to gain access to the inner sanctum of the British intelligence service MI6. Aided and guided by his controllers in Moscow, he systematically stole British intelligence secrets. As Le Carré wove the plot, the bril- liantly orchestrated operation involved spotting, compromising, and recruiting others to gradually advance Gerald the mole to a position of power. Such well-organized penetrations are not limited to fiction. The career of the KGB mole Heinz Felfe, who was advanced through the ranks of West German intelligence by an elaborate series of sac- rifices by his controllers in Moscow until he actually headed West German counterintelligence in 1961, could have served as the non- fiction inspiration for Le Carré’s 1963 novel, The Spy Who Came in from the Cold. As U.S. intelligence only found out after the Cold War ended, the KGB also had the ability to sustain moles for decades. | | Epst_9780451494566_2p_all_r1.z.indd 157 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019645

158 | HOW AMERICA LOST ITS SECRETS The CIA also had its share of long-term successes, such as Alex- ander Poteyev, who fed the CIA secrets for over ten years while burrowing into Russian intelligence. In the choreography of these operations, as in Le Carré’s fiction, rival intelligence services ensnared and sacrificed recruits, as if playing a chess game, to advance their moles. Despite notable successes such as Felfe and Poteyev, a great number of these elaborate conspiracies fail to insinuate a mole into their adversaries’ confidence. Intelligence services therefore also take advantage of a more prosaic source: the self-generated spy, or, as they are called in the trade, a “walk-in.” Although they are largely unsung in novels, these walk-ins are an important part of espionage. A counterespionage review done for the Presidential Foreign Intelligence Advisory Board (PFIAB) in 1990 found that most U.S. spies in the Cold War had taken documents on their own volition and only afterward offered them to an adversary service. Self-generated spies have diverse motives. Some intelligence workers steal secrets for financial gain. Others take them to further an ideological interest. As opportunistic enterprises, intelligence ser- @ vices do not turn walk-ins away if they have valuable intelligence. @ Indeed, some of the most successful moles were not recruited, or even controlled, by spy agencies. They were self-generated penetrations, or “espionage sources,” as the KGB preferred to call them, who first stole secrets and later voluntarily delivered them to an adversary. Hanssen, who successfully penetrated the FBI for the Russian intelligence services from 1979 to 2001, according to the assessment of a 2002 presidential commission, had caused “the worst intelli- gence disaster in US history.” Eleven years later, George Ellard, a former NSA inspector general who had been a member of that com- mission, compared Hanssen with Snowden “in that they both used very well-honed IT abilities to steal and disclose classified informa- tion vital to our national security.” It is also possible to exploit a walk-in even after he has left his service. For example, the KGB major Anatoliy Golitsyn was an ideo- logical self-generated spy who walked into the U.S. embassy in Hel- sinki on December 15, 1961. He asked to see the CIA officer on duty and announced to him that he had collected a trove of KGB secrets, including information that could identify its key spies in the West. | | Epst_9780451494566_2p_all_r1.z.indd 158 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019646

The Question of When | 159 He offered to defect to the United States. The CIA accepted his offer, and through this archive of secrets he had previously compiled, he became one of the CIA’s most productive sources in the Cold War. The job of an intelligence service is to take advantage of whatever opportunities come its way in the form of self-generated spies. If a Russian walk-in had not yet burned his bridges to his own ser- vice, U.S. intelligence officers were under instructions to attempt to persuade the walk-in to return to his post in Russia and serve as a “defector-in-place,” or mole. “While defectors can and do provide critical information,” a CIA memorandum on walk-ins during the Cold War noted, “there are very few cases in which the same indi- vidual may not have been of greater value if he had returned to his post.” Of course, if a walk-in believed he was already compromised, as Golitsyn did, a decision would have to be made whether the value of his intelligence merited exfiltrating him to the United States. This required evaluating the bona fides of the walk-in. Not all walk-ins are accepted as defectors. Some walk-ins are deemed “dan- gles,” or agents dispatched by the KGB to test and confuse the CIA. @ Others are rejected as political liabilities, as happened to Wang Lijun, @ a well-connected police chief in China. In February 2012, Wang walked into the U.S. consulate in Chengdu asking for asylum. The State Department decided against it. After Wang left U.S. protection, he was arrested for corruption and received a fifteen-year prison sentence. Such decisions about walk-ins are not made without due consideration, often at the highest level of a government, because exfiltrating a defector can result in diplomatic ruptures and political embarrassments. Conversely, it raises espionage concerns when an adversary gov- ernment authorizes the exfiltration of a rogue employee of an intel- ligence service. At minimum, it suggests that a rival government placed value on what the defector could provide it. The Snowden case is no exception. Whatever Snowden’s prior relations might have been with Russia, it can be assumed that after he fled to Moscow, in light of the intelligence value of the stolen documents, he would wind up in the hands of the Russian security services. That assump- tion was reinforced by subsequent countermeasures that were implemented by adversaries moved to block secret sources of NSA | | Epst_9780451494566_2p_all_r1.z.indd 159 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019647

160 | HOW AMERICA LOST ITS SECRETS surveillance, as the CIA deputy director later revealed. Such moves could indicate that at least part of the U.S. communications intel- ligence that Snowden had stolen was in enemy hands. The CIA and NSA’s monitoring of these countermeasures was itself extremely delicate, because revealing what they learned about Russian and Chinese countermeasures risked compromising even more U.S. communications sources than had Snowden. General Alexander said in his interview with The Australian Financial Review, “We absolutely need to know what Russia’s involvement is with Snowden.” He further said, “I think Snowden is now being manipulated by Russian intelligence. I just don’t know when that exactly started.” At what point did Snowden first come in contact with the Russians? The counterintelligence issue was not if this U.S. intelligence defector in Moscow was under Russian control but when he came under it. There were three possible time periods when Snowden might have been brought under control by the Russian intelligence service: while he was still working for the NSA; after he arrived in Hong @ Kong on May 20, 2013; or after he arrived in Russia on June 23, @ 2013. The NSA Scenario The first scenario could stretch as far back as when Snowden was forced out of the CIA in 2009. It will be recalled that the CIA had planned to launch a security investigation of Snowden, but it was aborted when he resigned. He had also incurred large losses specu- lating in the financial markets in Geneva, which is the kind of activ- ity that had in the past attracted the interest of foreign intelligence services. So it has to be considered in this scenario that Snowden had been recruited by the Russians after he left the CIA and directed to take jobs at civilian contractors servicing the NSA. Such “career management,” as it is called by the CIA, could explain why Snowden had switched jobs in March 2013 to Booz Allen Hamilton, which, unlike his previous employer, Dell, allowed | | Epst_9780451494566_2p_all_r1.z.indd 160 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019648

The Question of When | 161 him to gain proximity to the super-secret lists of the telecommuni- cations systems that the NSA had penetrated in Russia and China. This could account for how he managed to acquire the necessary passwords to accrue privileged information. It could also account for why the documents he copied that pertained to NSA operations in Russia were not among those he gave to Poitras, Greenwald, and other journalists. Because Russia has had an active intelligence- sharing treaty with China since 1996, it could further explain why his first stop was Hong Kong, a part of China. It was a safe venue for debriefing Snowden, as well as establishing his credentials among journalists as a whistle-blower, before a decision was made to allow him to proceed to Russia. The nearly fatal problem with this early recruitment scenario is Snowden’s contacts with journalists. Snowden, it will be recalled, had contacted Greenwald in December 2012. Greenwald was a high- profile blogger in Brazil who did not use encryption or any security safeguards. Next, he contacted Poitras in January 2013 in Berlin; she was a magnet for NSA dissidents. Both of these contacts put @ Snowden’s clandestine downloading at grave risk. As known oppo- @ nents of U.S. intelligence agencies, these journalists might be, as they themselves suspected they were, under surveillance by American, British, Brazilian, or German intelligence services. Greenwald and Poitras might also tell others who were either under surveillance or informers. So no matter what precautions Snowden took, his secret enterprise, or just the fact he was in contact with anti-government activists, might be detected. At minimum, he could lose his access to secrets and be of no further use as a source at the NSA. He could also be interrogated and reveal the way he was brought under control. If Snowden had actually been under the control of the Russian intel- ligence service, the last thing it would allow was for him to take such a risk—or even to contact a single journalist. After all, the purpose of an espionage operation is to steal secrets without alerting anyone to the theft. A former CIA officer told me that while anything could “go hay- wire” in an intelligence operation, it would be “unthinkable” that the Russian intelligence service would permit an undercover source | | Epst_9780451494566_2p_all_r1.z.indd 161 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019649

162 | HOW AMERICA LOST ITS SECRETS it controlled in the NSA to expose himself by contacting journalists. Snowden’s continued interactions with Poitras and Greenwald make it implausible that he was under Russian control before he went to Hong Kong. The Hong Kong Scenario The most compelling support for the scenario that Snowden was brought under Russian control while he was in Hong Kong comes, it will be recalled, from Vladimir Putin. His disclosure about the case leaves little doubt that Russian officials had engaged Snowden in Hong Kong, that Putin had authorized his trip to Moscow, and that the Russian government allowed him to fly to Moscow without a Russian visa. We know that Putin’s version is supported by U.S. sur- veillance of Snowden’s activities in Hong Kong. We also know that the Russians went to some lengths not only to facilitate his trip to Moscow but to arrange to keep him in Russia. This supports the @ possibility that the Russian intelligence service managed to bring @ Snowden under its sway during his thirty-four days in Hong Kong. The Russian intelligence service might even have been aware of Snowden and his anti-NSA activities before his arrival on May 20. Snowden was anything but discreet in his contacts with strang- ers in the anti-surveillance movement, including such well-known activists as Runa Sandvik (to whom he revealed his true name and address via e-mail), Micah Lee, Jacob Appelbaum, Parker Higgins, and Laura Poitras. “It is not statistically improbable that members of this circle were being watched by a hostile service,” a former NSA counterintelligence officer told me in 2015. When I told him that Poitras and others in her circle had used PGP encryption, aliases, and Tor software in their exchanges with Snowden, he said, arching his eyebrows, “That might work against amateurs, but it wouldn't stop the Russians if they thought they might have a defector in the NSA.” He explained that both the NSA and hostile services have the “means” to bypass such safeguards. I asked what the Russian intelligence service would have done if it had indeed spotted Snowden in late 2012 or early 2013. “Maybe | | Epst_9780451494566_2p_all_r1.z.indd 162 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019650

The Question of When | 163 just research him,” he replied. As we know now, he pointed out, Rus- sia and China probably had access to the 127-page standard form in his personnel file that he updated in 2011. They also had the capa- bility to track his air travel to Hong Kong. “Could someone have steered him to Hong Kong?” I asked. He answered, with a shrug, “That depends on whether Snowden had a confidante who could have influenced him.” Whenever adversaries became aware of Snowden in this scenario, it was not until after he copied the NSA secrets and took them with him to Hong Kong that Russian intelligence officers offered him a deal. So from the Russian point of view, Snowden had already burned his bridges. Because he had used other people’s passwords and access privileges to get into computers that he was not authorized to use, illegally moved documents, and given a false reason for his medi- cal leave, it was only a matter of time, as he told Greenwald in his interview in Hong Kong, before NSA investigators would identify him as a possible spy. He could be of no further use at the NSA to an adversary. His intelligence value now lay in the documents he had @ taken with him or stored in the cloud as well as his ability to help @ clarify them in debriefing sessions. He could also inflict damage on the morale and public standing of the NSA by denouncing its spying in the media. Once Snowden was in Hong Kong, the Russians would have no reason to restrain him from holding a press event or releasing a video. In fact, the KGB had organized press conferences for all the previous NSA defectors to Moscow. Hong Kong was a perfect venue for a well-staged media event because all the major newspapers in the world had bureaus there. Snowden’s disclosures about NSA spy- ing could serve to weaken the NSA’s relations with its allies. It is also possible that Russian or Chinese intelligence did not become aware of Snowden until after he went public in June by having The Guardian release his video. The video would have con- vinced the Russians or the Chinese of how dissatisfied Snowden was with the NSA. Because dissatisfaction is one of the classic means of recruitment in the intelligence business, he would certainly become a prime target for recruitment after he went public. The CIA also considered the possibility that Snowden might | | Epst_9780451494566_2p_all_r1.z.indd 163 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019651

164 | HOW AMERICA LOST ITS SECRETS have been reeled in unwittingly. Morell suggested in his book that Snowden might not himself have fully realized “when and how he would be used.” It can be safely assumed that the decision made by Putin’s intel- ligence service to allow Snowden to travel to Russia proceeded from something other than softhearted sentiment about his welfare. After Putin learned that there was an American in Hong Kong from the “special services” seeking to come to Russia, he also learned from Snowden’s own disclosure on the video released that Snowden had taken a large number of NSA documents to Hong Kong: indeed, some were shown on the video. After that self-outing by Snowden, Putin had plenty of time to calculate the advantages and disadvan- tages of allowing him to come to Moscow. Putin could offer him not only freedom from arrest but also a platform to express his views. The exploitation of an intelligence defector, even after he yields his secrets, can be the final stage of a successful intelligence operation. The CIA considered one of its greatest coups of the Cold War its release of the espionage-acquired @ secret speech of Nikita Khrushchev to the Communist Party of the @ Soviet Union in 1956 exposing the transgressions of the previous regime of Joseph Stalin. Making public these deeds was meant by the CIA to sow discord both inside the Soviet Union and to disrupt its relations with its allies. General Alexander suggested that Putin might similarly be “looking to capitalize on the fact that [Snowden’s] actions are enormously disruptive and damaging to US interests.” This potential gain, if Alexander’s assessment is correct, provided Putin with an additional reason to have his representatives in Hong Kong offer Snowden exfiltration. Snowden was in no position to refuse. After the release of the video, there was no going back to America without his facing a determined criminal prosecution. He would have known that in almost every prior case intelligence workers who had intentionally released even a single classified document had gone to prison. As his Internet postings show, he had closely followed the ordeal of Bradley Manning, whose trial was coming to its conclusion while Snowden was in Hong Kong. Manning had been kept in solitary confinement | | Epst_9780451494566_2p_all_r1.z.indd 164 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019652

The Question of When | 165 under horrific conditions for over a year while awaiting his trial and was facing a long prison sentence. There was no reason for Snowden to expect a better outcome for himself if he returned to the United States or was arrested anywhere else that had an extradition treaty with the United States. As the Russian officials in Hong Kong would have informed him, Russia had no extradition treaty with the United States. It was also one of the few places in the world that he could reach from Hong Kong without flying through airspace in which he might be intercepted by a U.S. ally. Snowden was told he could take the direct Aeroflot flight to Moscow without a valid passport or visa. That Snowden’s alternative to going to Russia was going to prison gave the Russians considerable leverage in Hong Kong. The Rus- sian “diplomats” could have used this leverage to extract a quid pro quo. The price of admission might have meant putting himself in the hands of Russian intelligence and telling it all he knew. The Moscow Scenario The final possibility is that Snowden did not come under Russian control until after he arrived in Moscow. After assessing the nega- tive attitude that Snowden expressed toward government authority on the video that was released by The Guardian, the Russian “diplo- mats” in Hong Kong might have concluded that Snowden could bolt if too much pressure was exerted on him there. The Russians could afford to be patient. They knew that Interpol and the United States would be pursuing Snowden throughout the world and that he had no valid travel documents and that his credit cards had been frozen. They would likely know that Sarah Harrison had arranged his flight to Moscow on June 23. So they had no urgent need to apply pressure on him before his plane landed in Russia. After the Russians took him in a “special operation” from the plane at the airport, he was informed by Russian authorities that he would not be allowed to go to Cuba, Venezuela, Iceland, Ecuador, or any other country without the permission of Russian officials, which would not be immediately forthcoming. He was now at the | | Epst_9780451494566_2p_all_r1.z.indd 165 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019653

166 | HOW AMERICA LOST ITS SECRETS mercy of the Russian authorities. There was good reason for keeping him in a virtual prison in Russia. “He can compromise thousands of intelligence and military officials,” Sergei Alexandrovich Markov, the co-chairman of the National Strategic Council of Russia and an adviser to Putin, pointed out. “We can’t send him back just because America demands it.” So Snowden was consigned to the transit zone of the airport, which is a twilight zone neither inside nor outside Russia, a nether- world that extends beyond the confines of the airport to include safe houses and other facilities maintained by the FSB for the purposes of interrogation and security. Stranded at the Moscow airport, no matter what he had believed earlier in Hong Kong, Snowden would quickly realize that he had only one viable option: seeking protec- tion in Russia. Even though the FSB is known by U.S. intelligence to strictly control the movements and contacts of former members of foreign intelligence services in Russia, Snowden might not have realized the full extent of the FSB’s interest in him. He naively told The Wash- @ ington Post in December 2013, in Moscow, “I am still working for @ the NSA right now. They are the only ones who don’t realize it.” Whatever he might have been thinking, a former U.S. communica- tions intelligence worker who stole American state secrets, such as Snowden, would be under the FSB’s scrutiny. Andrei Soldatov, the co-author of the 2010 book The New Nobil- ity: The Restoration of Russia’s Security State and the Endur- ing Legacy of the KGB, who was personally knowledgeable about FSB procedures, explained the FSB would monitor “every facet of Snowden’s communications, and his life.” General Oleg Kalugin, who, as previously mentioned, defected from the KGB to the United States in 1995, added that the FSB (following the standard operating procedures of the KGB) would be “his hosts and they are taking care of him.” Kalugin further said in 2014, “Whatever he had access to in his former days at NSA, I believe he shared all of it with the Russians, and they are very grateful.” This assessment was backed by Frants Klintsevich. As the first deputy chairman of the Kremlin’s defense and security committee at the time of Snowden’s defection, he was | | Epst_9780451494566_2p_all_r1.z.indd 166 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019654

The Question of When | 167 in a position to know Snowden’s contribution. “Let’s be frank,” he said in a taped interview with NPR (in Russian), “Snowden did share intelligence. This is what security services do. If there’s a possibility to get information, they will get it.” Even without Klintsevich’s comments, top American intelligence officers had little doubt that the Russian security services would do their job. Michael Hayden, for example, who in succession headed three American intelligence services, was certainly in a position to appreciate the capabilities of the Russian and Chinese intelligence services. He told me in 2014 that he saw no other possibility than that Snowden would be induced to cooperate in this situation, say- ing, “I would lose all respect for the Russian and Chinese security services if they haven’t fully exploited everything Snowden had to give.” They certainly had that opportunity when Snowden spent almost six weeks at Sheremetyevo International Airport. The FSB controlled his access to food, lodgings, the Internet, and whatever else he needed to survive there. If he did not cooperate, the FSB could also return him to the United States, where in the eyes of the @ Department of Justice he had betrayed the United States by stealing @ secrets and taking them abroad. What recourse did Snowden have? In a word, the FSB held all the cards but one—Snowden’s help with the stolen documents. Even if Snowden disliked the tactics of the Russian security services, he now had a powerful inducement not to decline the requests of the Russian authorities. Two weeks after his arrival, the Russian authorities provided him with a convenient path to full cooperation with Russia. He was put in contact with Anatoly Grigorievich Kucherena, a silver-haired, fifty-two-year-old lawyer who is known to be a personal friend of Putin’s. Kucherena did tasks for Putin’s party in the Russian parlia- ment, or Duma. He had excellent connections in the Russian secu- rity apparatus because he served on the oversight committee of the FSB. Kucherena offered to serve as Snowden’s pro bono lawyer. On July 12, Snowden officially retained him as his legal representative in Moscow. In explaining the relationship, Kucherena said, “Officially, he is my client, but at the same time, I provide a number of other services to him.” According to Kucherena, Snowden turned down | | Epst_9780451494566_2p_all_r1.z.indd 167 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019655

168 | HOW AMERICA LOST ITS SECRETS all requests to meet with any representative of the U.S. embassy in Moscow. From that point on, he would act as Snowden’s go-between with the FSB and other Russian agencies. At the outset, Kucherena made it clear to Snowden that he would have to play by Moscow’s rules before the Kremlin would grant him permission to stay in Russia. To begin with, Snowden had to with- draw any applications he had made elsewhere for asylum. He had to put his fate entirely in the hands of Putin’s Russia. He would also have to be fully candid with the Russian authorities on what was of great value to Putin: the secret documents he had acquired. Eighteen days later, Snowden received Russian identification papers that allowed him to resettle in Moscow. He was provided with a residence and allowed to set up a broadcasting studio in it that he could use for Internet appearances at well-attended events around the world, such as South by Southwest and TED. Snowden was, according to Kucherena, also furnished with bodyguards. To help earn his keep, he was said by Kucherena to be employed at an unidentified Moscow cyber-security firm. To complete his resettle- @ ment, Lindsay Mills, whom he had left behind in Hawaii, was given @ a three-month visa and was allowed to temporarily live with him in Moscow. This afforded him a lifestyle that Snowden described in an interview as “great.” It would strain credibility that such privileges would be awarded to an intelligence defector who had refused to cooperate with Russian authorities. In Snowden’s case, he was even allowed to participate in Putin’s telethon on state-controlled television. On it, he was called on to ask Putin if the Russian government violated the privacy of Russian citizens in the same way that the American government violated the rights of its citizens. Putin, smiling at Snowden’s pre- sumably vetted question, answered in a single word: “No.” In the Moscow scenario, the Russians acted to advance their inter- ests. They gave Snowden sanctuary, support, perks, and high-level treatment because he agreed to cooperate with them. If Snowden had not paid this basic price of admission, either in Russia or before his arrival, he would not have been accorded this privileged status. | | Epst_9780451494566_2p_all_r1.z.indd 168 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019656

CHAPTER 17 The Keys to the Kingdom Are Missing There’s a zero percent chance the Russians or Chinese have received any documents. —EDWARD SNOWDEN, Moscow, 2013 A CRITICAL MISSING PIECE in the Snowden enigma is the where- abouts of the NSA documents. Greenwald told the Associated Press that the documents that Snowden had taken from the NSA constituted “the instruction manual for how the NSA is built” and that they “would allow somebody who read them to know exactly how the NSA does what it does, which would in turn allow them to evade that surveillance or replicate it.” Snowden, for his part, said on camera in his Hong Kong interview in June 2013 that NSA investi- gators would have “a heart attack” when they discovered the extent of the breach. Ledgett, the NSA official who had conducted the damage assess- ment, while not having a heart attack, confirmed that Snowden had taken a massive number of documents and among them was what he deemed the NSA’s “keys to the kingdom.” These keys could pre- sumably open up the mechanism through which the United States learns about the secret activities of other nations and, by doing so, bring down the American signals intelligence system that had for | | Epst_9780451494566_2p_all_r1.z.indd 169 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019657

L£/0 | HOW AMERICA LOST ITS SECRETS sixty years monitored government communications. It had also kept track of adversaries’ missile telemetry, submarine movements, and nuclear proliferation. The Snowden breach was not without precedent at the NSA. There had been two Russian spies at the NSA during the Cold War, Jack Dunlap and David Sheldon Boone, who took a limited number of documents, but no one since the end of the Cold War is known to have taken a single NSA classified document. Now an insider had removed a vast number of the NSA’s documents. Many of these documents were classified TS/SCI—“Top Secret, Sensitive Compartmented Information”—which, as NSA secrets went, were deemed the gold standard of espionage because they revealed the sources used in communications intelligence. Whatever the assess- ment of Snowden’s motivation, the single question that needed to be answered was, what happened to these stolen files? Recall the huge disparity between the number of documents that the NSA calculated that Snowden compromised and the number of documents he is known to have handed over to journalists in Hong @ Kong on a thumb drive. When the House and Senate Intelligence @ Committees asked the NSA how many documents Snowden took, the NSA could not come up with a definitive number despite having employed a world-class team of experts to reconstruct the crime. The NSA could say that 1.7 million documents had been selected in two dozen NSA computers during Snowden’s brief tenure at Booz Allen in 2013, including documents from the Department of Defense, the NSA, and the CIA. Of these “touched” documents, some 1.3 million had been copied and moved to another computer. There was evidence that Snowden had used preprogrammed spi- ders to find and index the documents. He had said that he took the job at Booz Allen to get access to data that he copied. So as far as the NSA was concerned, of course, the 1.3 million documents he cop- ied and moved were considered compromised. On top of this haul, Snowden had copied files while working at Dell in 2012. As a sys- tem administrator there, he could download data without leaving a digital trail. As previously mentioned, more than half the documents actually published in newspapers had been taken during Snowden’s time at Dell. | | Epst_9780451494566_2p_all_r1.z.indd 170 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019658

The Keys to the Kingdom Are Missing | 171 Snowden’s supporters do not accept that he stole such a large num- ber of documents. According to Greenwald, the NSA vastly exagger- ated the magnitude of the theft in order to “demonize” Snowden. Snowden also disputed the magnitude of the 1.7 million number. He told James Bamford of Wired in early 2014 that he took far fewer than the 1.7 million documents that the NSA reported were com- promised. He offered, however, no more specific details on the mag- nitude of his theft. Nor did he offer Bamford any way to verify his assertion other than to say that he had purposely left behind “a trail of digital bread crumbs” at the NSA base in Hawaii so that the NSA could determine which documents he “touched” but did not down- load. A government official familiar with the investigation said no such “bread crumbs” were found by the NSA. It is possible that the NSA Damage Assessment team under Led- gett falsified its findings or otherwise inflated the number of doc- uments that Snowden stole. NSA executives might have also lied to Congress to exaggerate the loss. But why would these officials engage in an orchestrated deception that made them look bad? Exag- @ gerating the magnitude of the theft would only magnify Ledgett and @ the NSA’s failure in its mission to protect U.S. secrets. Officials had no reason to demonize Snowden for legal reasons. He already had been. Greenwald and Poitras had already revealed that Snowden had given them a vast number of NSA classified docu- ments ona thumb drive that revealed, as Greenwald put it, the “blue- prints” of the NSA. This drive contained, it will be recalled, no fewer than 58,000 highly classified documents. In the eyes of the law, that constituted an unprecedented breach of the laws passed to protect communications intelligence. In any case, in Russia Snowden was not in any jeopardy, no matter how many documents he was said to have stolen. Interestingly, the thirty-five-page Defense Intelligence Agency’s damage assessment reports that 900,000 Pentagon docu- ments compromised by Snowden were not made public. That was only disclosed via a Vice magazine Freedom of Information request in June 2015. Many of the putative 1.3 million documents that the NSA says were copied and moved were duplicate copies. Others were outdated or otherwise useless routing data. So the quantity does not tell the | | Epst_9780451494566_2p_all_r1.z.indd 171 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019659

Ld | HOW AMERICA LOST ITS SECRETS whole story. Of far more importance is the quality of some of the data that Snowden had copied. Just a single one of these documents could cripple not just the NSA but America’s entire multibillion- dollar apparatus for intercepting foreign intelligence. The previously cited road map, which was thirty-one thousand pages long, listed critical gaps in U.S. coverage of China, Russia, and other adversaries, including those cited by President Obama’s national security team. It was not found among the files on the thumb drive given to Poitras and Greenwald. Nor were most of the missing Level 3 lists concern- ing NSA activities in Russia and China found on the thumb drive, even though Snowden said he had taken his final job at Booz Allen to get access to these lists. If Snowden had not given these docu- ments to Poitras, Greenwald, or other journalists, where were they? The compartment logs showed that Snowden copied and trans- ferred these Level 3 documents in his final week at the NSA. He presumably had them in his possession in Hong Kong when he arrived on May 20. On June 3, according to Greenwald, Snowden was still sorting through the documents to determine which ones @ were appropriate to give to journalists. On June 12, he told the @ reporter Lana Lam in Hong Kong that he was going through the documents, country by country, to determine which additional ones he should pass on to journalists. Eleven days later, he departed Hong Kong for Moscow carrying at least one laptop computer. After arriv- ing in Moscow, he suggested he still had NSA secrets in his posses- sion. “No intelligence service—not even our own—has the capacity to compromise the secrets I continue to protect,” he wrote to the former senator Gordon Humphrey. “I cannot be coerced into reveal- ing that information, even under torture.” Much of the material he copied while working at Booz Allen remained, as far as the NSA could determine, missing. Had he brought these files under his “pro- tection” to Russia? An answer soon came from Snowden’s Moscow lawyer. On Sep- tember 23, Anatoly Kucherena was extensively interviewed on the RT channel in Russia. The interviewer, Sophie Shevardnadze, who had a show called SophieCo, was a well-admired journalist. She is the granddaughter of Eduard Shevardnadze, a former foreign minis- | | Epst_9780451494566_2p_all_r1.z.indd 172 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019660

The Keys to the Kingdom Are Missing | 173 ter and Politburo member of the Soviet Union and, after the Soviet Union broke up, the first president of Georgia. Even though she had interviewed many top political figures in Russia, obtaining an hour- long interview with Kucherena was a coup because, until then, he had not discussed Snowden in a television interview. About halfway through the interview, Shevardnadze brought up the highly sensitive subject of the disposition of the NSA docu- ments. If anyone was in a position to know about these documents, it was Kucherena. He had acted as an intermediary for Snowden in his negotiations with Russian authorities, including the FSB. As such, he would be privy to the status of the secret material that was of interest to the Russian intelligence services. When I interviewed Kucherena in Moscow in 2015, he told me that “all the reports” con- cerning Snowden had been turned over to him by “Russian authori- ties” in July 2013. “I had all of Snowden’s statements,” he said. If so, he presumably knew what Snowden had told the Russian security services. Had Snowden come to Russia with empty hands or bearing gifts? @ Shevardnadze directly asked Kucherena if Snowden had given all @ the documents he had taken from the NSA to journalists in Hong Kong. Kucherena answered her question without any evasion, say- ing that Snowden had only given “some” of the NSA’s documents in his possession to journalists in Hong Kong. He had kept the remain- ing documents in his possession. That confirmed what Snowden had told Greenwald, Poitras, and Lam in Hong Kong. Snowden told them that he had divided the stolen NSA documents into two separate sets of documents. One set he gave to Poitras and Greenwald on thumb drives. The other set, which he told them he considered too sensi- tive for these journalists, he retained for himself. U.S. investigators at the NSA, the CIA, and the Department of Defense would like to know what Snowden did with the set of documents he had retained for himself and had not shared with the journalists in Hong Kong. Shevardnadze, who makes it a point to drill her interviewees, pressed Kucherena as to whether Snowden still had these NSA files, or “material,” in Russia. The dialogue went as follows (from the transcript supplied to me by Shevardnadze). | | Epst_9780451494566_2p_all_r1.z.indd 173 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019661

174 | HOW AMERICA LOST ITS SECRETS SHEVARDNADZE: SO he [Snowden] does have some materials that haven’t been made public yet? KucHERENA: Certainly. Shevardnadze asked the next logical question: “Why did Russia get involved in this whole thing if it got nothing out of it?” “Snowden spent quite a few years working for the CIA. We haven’t fully realized yet the importance of his revelations.” Kucherena was on the FSB’s public oversight board. He was clearly in the picture. Kucherena’s answer was completely consistent with the statement Snowden made three weeks after arriving in Russia in his previ- ously mentioned e-mail to Senator Humphrey. It is certainly possible that Snowden transferred the NSA files from his own computers and thumb drives to storage on a remote server in the cloud before coming to Russia. The “cloud” is actually not in the sky but a term used for remote storage servers, such as those provided by Dropbox, Microsoft, Google, Amazon, and other Internet companies. Anyone who is connected to the Internet can @ store and retrieve files by entering a user name and a password. @ For Kucherena to be certain Snowden had access to the so-far- unrevealed data, Snowden must have demonstrated his access either to him or to the authorities. The Russians obviously knew Snowden had the means to retrieve this data one way or the other. Because the data concerned electronic espionage against Russia, the FSB would have been keen to obtain the documents, and the FSB is not known to take no for an answer in issues involving espionage. Even if Snowden refused to furnish his key encryption, accord- ing to a former National Security Council staffer, the Russian cyber service in 2013 had the means, the time, and the incentive to break the encryption. It is unlikely it would have had to go through the trouble. It doesn’t take a great stretch of the imagination to conclude that, willingly or under duress, Snowden shared his access to his treasure trove of documents with the agencies that were literally in control of his life in Russia. Kucherena’s answer on the television program may also help to explain Putin’s decision to allow Snowden to come to Moscow. It was not a minor sacrifice for Putin. His foreign minister, Sergei Lav- | | Epst_9780451494566_2p_all_r1.z.indd 174 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019662

The Keys to the Kingdom Are Missing | 175 rov, had spent almost six months negotiating with Hillary Clinton’s State Department a one-on-one summit between President Obama and President Putin. Not only would this summit be a diplomatic coup for Russia, but also it would add to Putin’s personal credibil- ity in advance of the Olympic Games in Russia. In mid-June, after USS. intelligence reported to Obama’s national security adviser that Snowden was in contact with Russian officials in Hong Kong, the State Department explicitly told Lavrov that allowing Snowden to defect to Russia would be viewed by President Obama as a bla- tantly unfriendly act. As such, it could (and did) lead to the cancella- tion of the planned summit. Putin knew the downside of admitting Snowden. But if Snowden had a large archive of files containing the sources of the NSA’s electronic interceptions, as Snowden claimed he had in Hong Kong, there was an enormous potential intelligence upside. Putin had to choose between the loss of an Obama summit and an intelligence coup. Would Putin have made the choice he did if Snowden had destroyed, or refused to share, the stolen data? @ “No country, not even the United States, would grant sanctuary @ to an intelligence defector who refused to be cooperative,” answered a former CIA officer who had spent a decade dealing with Russian intelligence defectors. “That’s not how it works.” If so, it seems plau- sible to believe that, as Kucherena said, the documents Snowden brought to Russia explain why Russia exfiltrated him from Hong Kong and provided him with a safe haven. The Quickly Changing Narrative Three weeks after Kucherena’s appearance on Shevardnadze’s show, on October 17, Snowden had his first interview exchange with a journalist since his arrival in Russia. It was over the Internet with James Risen of The New York Times, as noted earlier. Snowden now asserted a very different narrative. The subsequent front-page story, which carried the headline “Snowden Says He Took No Secret Files to Russia,” reported that Snowden claimed he gave all his documents to journalists in Hong Kong and brought none of them to Russia. He | | Epst_9780451494566_2p_all_r1.z.indd 175 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019663

176 | HOW AMERICA LOST ITS SECRETS also said that he was “100 percent” certain that no foreign intelli- gence service had had access to them at any point during his journey from Honolulu to Moscow. When I later asked Kucherena in Mos- cow why Snowden changed his story in direct contradiction of what Kucherena had stated, he said, “Wizner.” He was referring to Ben Wizner, Snowden’s ACLU lawyer in Washington, D.C. Wizner had joined the ACLU in August 2001 after graduating from NYU Law School and clerking for a federal judge. At the ACLU, he became an effective foe of NSA surveillance. “IT had spent ten years before this [Snowden leak] trying to bring lawsuits against the intelligence community,” he explained in an interview with Forbes in 2014. Prior to the Snowden leak, he had frequently been consulted by Poitras on government surveillance issues (and appeared in Poitras’s 2010 documentary, The Oath). He had also been engaged in a lawsuit aimed at exposing the NSA’s sub- poenas for Verizon records. He had first learned about Snowden from Poitras in January 2013 while Snowden was still working for Dell at the NSA base in @ Hawaii. At that time, Poitras did not know Snowden’s real name, but @ she informed Wizner that she was in touch with a person identify- ing himself as a senior officer in U.S. intelligence. (Poitras did not know at that time that her source, Snowden, was lying to her about his position.) Wizner also was shown e-mails by Poitras in which Snowden said he had information about the government’s secret domestic surveillance program. Wizner, according to Poitras, advised her to stay in touch with this source. On July 13, 2013, after Snowden asked for asylum in Russia, Kucherena arranged an encrypted chat between Snowden and Wiz- ner. According to Wizner, Snowden asked him at the outset, “Do you have standing now?” It was a question that suggested that Snowden was aware that the ACLU needed to gain standing in federal court to challenge the government's alleged domestic surveillance. Up until now, it was unsuccessful because it had no way to show it was a vic- tim of surveillance. The FISA order to Verizon, which Snowden had taken had provided that standing to Wizner and the ACLU. Aside from the opportunity Snowden offered the ACLU, Wiz- ner no doubt believed in the salutary benefit of Snowden’s revela- | | Epst_9780451494566_2p_all_r1.z.indd 176 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019664

The Keys to the Kingdom Are Missing | 177 tions. When they discussed Snowden’s legal situation in America, Snowden expressed an interest in obtaining some form of amnesty from prosecution. Wizner was willing to attempt to explore making a possible deal with the Department of Justice, but it would not be an easy task, especially if Snowden had turned over NSA documents to a foreign power. Even to argue that Snowden was merely an NSA whistle-blower presented a serious challenge for Wizner. The ACLU had been involved with previous NSA whistle-blowers, but Snowden’s case differed from those cases in important ways. Those whistle-blowers had not intentionally taken any NSA documents. Snowden, on the other hand, had not only taken a large number of NSA documents but also released tens of thousands of these top secret files to jour- nalists based in Germany and Brazil, as well as to other unauthor- ized recipients. In addition, the Whistleblower Protection Act, passed by Congress in 1989, does not exempt an insider, such as Snowden, who signs a secrecy oath from the legal consequences of disclos- ing classified documents to journalists or other unauthorized people. @ Consequently, getting some form of amnesty for Snowden required @ bolstering his image as a person taking personal risks to fight for America. But if Snowden had taken even a single top secret docu- ment to Russia, it would strengthen the case in the court of public opinion that he had stolen communications intelligence secrets with the intent to damage the United States, which under the provisions of federal law could be considered espionage. In this regard, Kucher- ena’s disclosure was extremely damaging to Snowden’s position, and Snowden had, after all, already found refuge in Russia. Snowden had two options, according to Wizner, the “first is to be where he is in Russia. And the second is to be in a maximum security prison cell, cut off from the world.” These, of course, would be the options of any espionage defector who fled to Russia. One way to mitigate the damage was for Snowden to substitute a new narrative. Wizner took it upon himself to screen potential journalists and other outlets for Snowden. He told a reporter for The New York Times that, except for Oliver Stone, all individu- als who have “met with Snowden have just gone through me, and we've hooked it up.” Nor did he limit his extraordinary control to | | Epst_9780451494566_2p_all_r1.z.indd 177 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019665

178 | HOW AMERICA LOST ITS SECRETS interviews. In the case of Stone’s movie Snowden, Wizner asked for the right to veto any shots featuring Snowden in the film. In it, he would tell handpicked journalists that he had given all his docu- ments to Poitras and Greenwald in Hong Kong and took none of them to Russia. Wizner could then argue that documents such as the FISA court order were improperly classified secret and that disclos- ing them served the public good. The government might not be able to contest his claim without further revealing NSA sources. Under these circumstances, it might be induced to agree to a plea bargain for Snowden. Changing the narrative would also help enhance his public image as a whistle-blower. Snowden’s new narrative that he had destroyed all the documents he had in his possession before coming to Moscow and had no access to any NSA documents, not even those that he had distributed to journalists, was reinforced in a series of interviews that Wizner helped arrange. “I went the first six months without giving an inter- view,” Snowden later said. “It wasn’t until December 2013 that I gave my first interview to Barton Gellman.” (Snowden did not count @ his Internet exchange with Risen in October as an “interview”.) @ In late December 2013, Snowden met with Barton Gellman. It was his first face-to-face meeting with a journalist since he had arrived in Russia in June. Snowden turned his laptop toward Gellman and, as if proving his point, said to him, “There’s nothing on it.... My hard drive is completely blank.” That his computer had no files stored on it at that moment of course meant very little. Just six weeks earlier, Snowden had met with the former CIA officer Ray McGovern, who had been invited to meet him in Moscow along with three other American whistle-blowers. At that meeting, he told McGovern that he had stored all the NSA data he had taken on external hard drives. Gellman asked about the precise whereabouts of the files, but, as he reported, Snowden declined to answer that question. He would only say that he was “confident he did not expose them to Chinese intel- ligence in Hong Kong.” That answer did not nail down the issue, so Wizner arranged for Vanity Fair, which was preparing an article on Snowden, to submit questions. In his reply to them, Snowden wrote that he destroyed all his files in Hong Kong because he didn’t | | Epst_9780451494566_2p_all_r1.z.indd 178 @ 9/30/16 11:09 AM | | HOUSE_OVERSIGHT_019666

The Keys to the Kingdom Are Missing | 179 want to risk bringing them to Russia. He expanded on this claim in three more interviews. These interviews were all with three jour- nalists who had opposed NSA surveillance: James Bamford, writing for Wired magazine; Alan Rusbridger, the editor of The Guardian; and Katrina vanden Heuvel, the editor of The Nation. He also gave a televised interview to Brian Williams of NBC News in which he explained that because he had no access to the NSA documents in Russia, he could not provide access to the Russians even if they “break my fingers.” Snowden did not specify where, when, or how the putative destruction of the files occurred and offered neither witnesses nor evidence, other than the meaningless blank laptop screen, to cor- roborate it. Still his new self-serving narrative was widely accepted by the media. The fact remains, though, that Snowden went to con- siderable risk to select, copy, and steal Level 3 documents before leaving Hawaii for Hong Kong. These secrets were his last potential bargaining chips. Why would he have destroyed them in June in Hong Kong? @ It is also difficult for me to accept that Snowden would destroy @ these documents because he feared the Russians might get them. If he was so concerned about the possibility, he could have stayed in Hong Kong and fought extradition instead of flying to Russia. Surely he must have realized that even without the files on his com- puter, the Russian intelligence service could still obtain the NSA secrets he held in his head. Indeed, as he told the Times, the secrets he held in his head would have devastating consequences for NSA Operations. In light of Kucherena’s statement that in Russia Snowden had access to NSA documents, it would require a serious suspension of disbelief to accept Snowden’s new narrative. Even if one were will- ing to accept his new claim, it still would not mean that the NSA documents had not fallen into the hands of adversaries. If he had destroyed all of the electronic copies of the NSA’s data before board- ing his flight to Moscow, he still couldn’t be “100 percent” certain, as he claimed, that the data had not been accessed by others prior to his departure from Hong Kong. His files could have been copied with- | | Epst_9780451494566_2p_all_r1.z.indd 179 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019667

180 | HOW AMERICA LOST ITS SECRETS out his knowledge, just as he had copied them without the NSA’s knowledge. As former U.S. intelligence officers pointed out to me, adversary services could not be expected to shirk from employing their full capabilities once they learned that an American “agent of special services,” as Putin called him, had brought stolen NSA docu- ments to Hong Kong. The Times reported from Hong Kong that two sources, both of whom worked for major government intelligence agencies, “said they believed that the Chinese government had managed to drain the contents” of the laptop that Snowden brought to Hong Kong. That China had the capability to obtain Snowden’s data was also the view of the former CIA deputy director Morell. He said, “Both the Chinese and the Russians would have used everything in their tool kit—from human approaches to technical attacks—to get at Snowden’s stolen data.” Snowden would not have been a particularly difficult target for them, especially after he started disclosing secrets to journalists at the Mira hotel. Not only could the Chinese service approach the @ security staff at the Mira, but they could track him after he left the @ hotel and moved, along with his computers, in and out of several residences arranged by his carer. Snowden, after all, had put himself in the hands of people whom he had never met before, including three Hong Kong lawyers, a carer, and three Guardian journalists. It is likely that the efforts of these adversary intelligence services to find him, and the NSA data, would further intensify after Snowden revealed to the South China Morning Post on June 12 that he had access to NSA lists of computers in China and elsewhere that the NSA had penetrated. It wouldn’t be only the Chinese service on his trail. The Rus- sian intelligence service would also likely be tasked to acquire these NSA documents after Snowden’s meeting with Russian officials in Hong Kong. And while he could get away with giving coy and elu- sive answers to journalists who asked him about the whereabouts of the NSA data, the Russian and Chinese officials in Hong Kong who could offer him an escape route from prison would likely demand more specific answers about the whereabouts of data they had not already obtained by technical means. | | Epst_9780451494566_2p_all_r1.z.indd 180 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019668

The Keys to the Kingdom Are Missing | 181 The Post-Hong Kong Documents The NSA concern about who had access to its missing files deepened further when NSA documents continued to surface in the press after Snowden went to Moscow. If U.S. intelligence needed any further evidence that someone had access to the documents, these additional revelations provided it. The most sensational of them was a purported document attrib- uted to Snowden concerning the NSA hacking of the cell phone of the German chancellor, Angela Merkel. The story was published on October 23 on the Der Spiegel website. Appelbaum was the co- author of the story. Even though Snowden had by now been in Rus- sia for four months, he was cited in the story, along with unnamed “others,” as the source for the NSA document. Snowden did not deny it. Indeed, he took a measure of credit for the revelation, say- ing on German TV, “What I can say is we know Angela Merkel was monitored by the National Security Agency.” If Snowden had been involved in the release of this document, it would be consistent with @ Kucherena’s assertion that he had access to the archive. @ Adding to the intrigue, Poitras was apparently caught by surprise when the Merkel story broke in Der Spiegel. She urgently texted Snowden on what she called “background” (which ordinarily means that a journalist will not attribute information to a source), She asked him in the text to explain the NSA’s actions. Snowden explained to her that Merkel was listed by her true name (and not by a code name) in the NSA document because the German chancellor was an NSA “target not an asset.” Presumably, Poitras would have already known that distinction if she had the document referred to in Der Spiegel. If the Merkel document was not among the data given to Poitras in Hong Kong, how did it get to the authors of the Der Spiegel article? Appelbaum, of course, had been in contact with Snowden before he went public. He had served as Poitras’s co-interrogator of Snowden while he was still working at the NSA in May 2013. Appelbaum was also one of the leading supporters of WikiLeaks. Because he was famously an advocate of revealing government secrets, it seems unlikely that he would have delayed releasing such a bombshell about Merkel’s phone if Snowden had given him this document | | Epst_9780451494566_2p_all_r1.z.indd 181 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019669

182 | HOW AMERICA LOST ITS SECRETS before he left Hong Kong in June 2013. Why would Appelbaum keep it secret for more than four months? The same pressure to publish would also apply to the journalists Snowden had dealt with in Hong Kong. If Snowden had given Poitras, Greenwald, Lam, or MacAskill the Merkel document, or even told them about it in their interviews with him in Hong Kong, The Guardian would have certainly rushed out such a scoop. According to a source with knowledge of the Snowden investiga- tion, there was no document referencing any spying on Merkel’s phone among the fifty-eight thousand documents on the thumb drive that Snowden had given to Poitras and Greenwald in Hong Kong. That absence would explain why Poitras had to send a text to Snowden in Moscow to ask for an explanation after the story broke. Further confirmation of the absence of this document in the material Snowden provided journalists in Hong Kong comes from James Bamford, a well-respected expert on the NSA. In the course of researching his 2014 article on Snowden for Wired, he was given access to all the documents Snowden gave to Poitras, Greenwald, and @ Gellman. Bamford used a sophisticated indexing program to search @ through the database specifically for the Merkel material. He did not find any. He reported that no document given to journalists in Hong Kong even mentioned Merkel. It therefore appeared that the Merkel document was provided to Der Spiegel after Snowden went to Mos- cow. If so, some party had access to NSA documents after Snowden arrived in Russia and provided the Der Spiegel authors with the scoop. In that context, it might not have been a pure coincidence that Kucherena disclosed that Snowden had access to documents that he had not given to journalists in Hong Kong shortly before just such a document was published in Germany. Bamford explored the possibility that there might be another per- son in the NSA who was stealing documents. He wrote to Poitras and asked her whether the Merkel document could have come from another person in the NSA. She declined, via a letter from her lawyer, to answer that question. But because she had not been the author of the Der Spiegel article, and had not been given the document, there is no reason to believe that she would know its provenance. Documents continued to emerge years after Snowden arrived in | | Epst_9780451494566_2p_all_r1.z.indd 182 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019670

The Keys to the Kingdom Are Missing | 183 Moscow that were more embarrassing to America. In June 2015, the WikiLeaks website released another putative Snowden document, two years after he had supposedly wiped his computer clean in Hong Kong. It revealed that the NSA had targeted the telephones of three consecutive presidents of France—Jacques Chirac, Nicolas Sarkozy, and Francois Hollande. According to a former NSA official, this document, like the 2013 Merkel material, was not among the data on the thumb drive given to journalists in Hong Kong, which Greenwald confirmed. Green- wald suggested to The New York Times that it might have been sto- len by another penetration in the NSA, presumably one who had access to the same secret compartments as Snowden in 2013. Since Greenwald and Poitras had no way of knowing about the documents that Snowden did not give them, it is equally possible that the Rus- sian intelligence services obtained this document from Snowden and later gave it to WikiLeaks. The release on Assange’s WikiLeaks site came in the midst of NATO war games held near the Russian border, which Putin had vehemently denounced. The accompanying article @ was co-authored by Assange, who now claimed to have access to @ Snowden’s NSA material. Because Assange had been in telephonic contact with Snowden in Hong Kong, and his deputy, Sarah Har- rison, had spent five months in Moscow with Snowden in 2013, it is certainly possible Snowden was his source. But it seems difficult to believe that Assange waited two years before publishing because he has made it part of his modus operandi to publish documents immediately. Because WikiLeaks receives documents anonymously via its Tor software, any party with access to the Snowden files could have sent it. Subsequently, in July 2016, Assange released via WikiLeaks a cache of politically disruptive documents from the files of the Democratic National Committee. U.S. intelligence strongly suspected they been stolen by the Russian intelligence services and sent to WikiLeaks. If so, Russia made use of Assange and WikiLeaks to exploit selected fruits of its espionage activities Greenwald and Poitras also released belated documents. On July 15, 2015, their web publication, The Intercept, released a Snowden document that cited an NSA intercept of an Israeli mili- tary communication concerning an Israeli raid in Syria on August 1, | | Epst_9780451494566_2p_all_r1.z.indd 183 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019671

184 | HOW AMERICA LOST ITS SECRETS 2008. It revealed that a group of Israeli commandos killed General Muhammad Suleiman, a top aide to President Bashar al-Assad who had been working with North Korea to build a nuclear facil- ity in Syria. Israel had destroyed that facility in Operation Orchard nearly a year earlier. Whatever the purpose of this new release of an NSA document (which had little if anything to do with any of the NSA’s own operations), it was not among the data that Snowden had given Poitras and Greenwald in Hong Kong in 2013, according to a source with access to the investigation. Next, on January 28, 2016, The Intercept published data taken from a GHCQ (the British cipher service) file furnished by Snowden revealing military intelligence activities abroad. Specifically, it disclosed that the United States and Britain were intercepting data from Israel’s military drones in 2008. British intelligence had determined in 2013 that the material sent to Greenwald via a courier did not contain such GCHO documents. If that is the case, then Poitras and Greenwald, like Appelbaum and Assange, were still receiving NSA documents that Snowden had allegedly stolen a long time after he went to Russia and claimed he @ had destroyed all his files. @ The NSA reportedly determined that these belated documents, most of which concerned American allies in Germany, France, and Israel, had been among the material copied during the Snowden breach. They provided further reason to believe that someone still had access to the documents that were not distributed to journal- ists in Hong Kong. Kucherena’s disclosure, just before the first post— Hong Kong release, that Snowden still had access to the NSA files made it appear plausible that Snowden sent these documents to Der Spiegel, WikiLeaks, and The Intercept. A former high-ranking KGB officer I interviewed had a very dif- ferent view. He told me that in his experience an intelligence defec- tor to Russia would not be allowed to distribute secret material to journalists without explicit approval by the security service tend- ing him. He added that this injunction would be especially true in the case of Snowden because Putin had publicly enjoined him from releasing U.S. intelligence data. The more plausible alternative was that this material was released at the behest of the Russian intel- ligence service. | | Epst_9780451494566_2p_all_r1.z.indd 184 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019672

The Keys to the Kingdom Are Missing | 185 The mystery of the post-Hong Kong documents also intrigued members of the U.S. intelligence community with whom I discussed it. When I asked a former intelligence executive about the ultimate source for the Merkel story, he responded, “If Snowden didn’t give journalists this document in Hong Kong, we can assume an inter- mediary fed it to Appelbaum to publish in Der Spiegel.” According to him, the NSA investigation had determined that Snowden indeed had copied an NSA list of the cell phone numbers of foreign leaders, including the number of Merkel. This list became the basis of the Der Spiegel story. It was also clear that Snowden gave credence to the release in Mos- cow. He made a major point about the hacking of Merkel’s phone in an interview with Wired in 2014. Just about two weeks before the leak, Kucherena said Snowden still had access to the documents. Clearly, someone had access. But whoever was behind it, the release of information about the alleged bugging of Merkel’s phone resulted in badly fraying U.S. relations with Germany in the midst of devel- oping troubles in Ukraine. As it later turned out, according to the @ investigation of the German federal prosecutor, which concluded in @ 2015, there was no evidence found in this document, or elsewhere, that Merkel’s calls were ever actually intercepted. Although they revealed little if anything that the intelligence services of Germany, France, and Israel were not already aware of, they raised a public outcry in allies against NSA surveillance, and the outcry became the event itself. While these post-Hong Kong documents had little if any intel- ligence value, they provided further evidence that at least part of the stolen NSA documents was in the hands of a party hostile to the United States. If so, it wasn’t much of a leap to assume that this party also had access to the far more valuable Level 3 documents revealing the NSA’s sources and methods, such as the one that Ledgett had described as a “roadmap” to U.S. electronic espionage against Russia and China. Within the intelligence community, this concern was heightened by new countermeasures to this espionage employed by Russia and China after Snowden reached Moscow. For example, there were indications that the NSA had lost part of its capabilities to follow | | Epst_9780451494566_2p_all_r1.z.indd 185 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019673

186 | HOW AMERICA LOST ITS SECRETS Russian troop movements in the Crimea and eastern Ukraine. U.S. intelligence officials even went so far as to suggest, according to a report in The Wall Street Journal, that “Russian planners might have gotten a jump on the West by evading U.S. eavesdropping.” Britain also discovered that some of its secret operations had been compromised after Snowden went to Moscow. According to a 2015 story in the Sunday Times of London, British intelligence had deter- mined that Britain’s intelligence-gathering sources had been exposed to adversary services by documents that Snowden had stolen from the NSA in 2013. These documents had been provided to the NSA by the GCHQ. Unless such intelligence disasters were freak aberra- tions, it appeared to confirm General Alexander’s warning in 2014 that the NSA was “losing some of its capabilities, because they’re being disclosed to our adversaries.” Snowden’s supporters disputed this view. If only as an act of faith in Snowden’s personal integrity, they continued to believe his avowal to Senator Humphrey that he had acted to protect U.S. secrets by shielding them from adversary intelligence services after he took @ them abroad. They also continued to take him at his word when he @ said he had destroyed all the NSA documents before going to Rus- sia. Despite such protestations of patriotic loyalty, U.S. intelligence officials could not so easily dismiss the possibility that the missing documents still existed. After all, a U.S. intelligence worker who is dedicated to protecting America’s secrets from its adversaries does not ordinarily steal them. The NSA, the CIA, and the Department of Defense therefore had little choice but to assume the worst had happened: Russia and China had obtained access to the “keys to the kingdom.” Whatever the extent of the actual damage, it was up to Alexander’s replace- ment, Admiral Michael Rogers, both to restore morale and to rebuild the capabilities of America’s electronic intelligence in the wake of the massive breach. According to a national security staff member in the Obama White House, that job would take more than a decade. The NSA had failed to protect vital assets. This intelligence failure did not happen out of the blue. | | Epst_9780451494566_2p_all_r1.z.indd 186 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019674

CHAPTER 18 The Unheeded Warning The NSA—the world’s most capable signals intelligence organi- zation, an agency immensely skilled in stealing digital data—had had its pockets thoroughly picked. —CIA DEPUTY DIRECTOR MICHAEL MORELL, 2015 Is APRIL 2010, the CIA received a stark reminder of the ongoing nature of Russian espionage. It came in the form of a message from one of its best-placed moles in the Russian intelligence service. This surreptitious source was Alexander Poteyev, a fifty-four-year- old colonel in the SVR, which was the successor agency to the first chief directorate of the KGB. While the FSB took over the KGB’s domestic role in 1991, the SVR became Russia’s foreign intelligence service. Its operation center was in the Yasenevo district of Moscow. The CIA had recruited Poteyev as a mole in the 1990s when he had been stationed at the Russian embassy in Washington, D.C. That it could sustain a mole in Moscow for over a decade attested to its capa- bilities in the espionage business. After he returned to Moscow, still secretly on the CIA’s payroll, he became the deputy chief of the SVR’s “American” section. This unit of Russian intelligence had the pri- mary responsibility for establishing spies in the CIA, the FBI, the NSA, and other American intelligence agencies. The SVR’s last known (or caught) mole in US. intelligence was | | Epst_9780451494566_2p_all_r1.z.indd 187 @ HOUSE_OVERSIGHT_019675 9/29/16 5:51PM | |

188 | HOW AMERICA LOST ITS SECRETS the CIA officer Harold Nicholson, in 1996. Before it could expand its espionage capabilities, it needed to build a network of Russian agents in the United States. For this network, it needed to groom so-called illegals, or agents who were not connected to the Russian embassy. This so-called illegals network was necessary because presumably all Russian diplomats, including the so-called legal members of Rus- sian intelligence, were under constant surveillance by the FBI. Advances in surveillance technology in the twenty-first century made it increasingly difficult to communicate with recruits through its diplomatic missions. To evade it, the “American” division of the SVR was given the task of placing individuals in the United States disguised as ordinary Americans. Their “legend,” or operational cover, could be thin because they would not be applying for jobs in the government. Their job was simply to blend in with their com- munity until they were called upon by the “American” department in Moscow to service a mole who had been planted in U.S. intelli- gence or other parts of the U.S. government. Until they were acti- vated by such a call, they were classified as sleeper agents. Unlike the @ SVR’s “legal” officers, who were attached to Russian embassies as @ diplomats and were protected from arrest by the Treaty of Vienna, the SVR’s illegal agents lack diplomatic immunity. According to Pavel Sudoplatov, who defected from the KGB in the Cold War, the sole job of such sleeper agents was to “live under cover in the West awaiting assignments for the Center.” One assignment that justifies the expense of maintaining such agents is to service a penetration, after one is made, in the U.S. intelligence establishment. While wait- ing to be activated for such a job, sleeper agents were instructed to build every detail of their cover identity so as to perfectly blend in with Americans. To build this American network of sleeper agents took the better part of a decade. In 2005, the SVR’s “American” section in Mos- cow had begun methodically installing them in the United States. Almost all were Russian citizens who had assumed new identities to better blend into their communities. The CIA learned of this sleeper program through Poteyev soon after it began. The issue was how to exploit this knowledge. When I was writing my book on international deception, James Jesus Angle- | | Epst_9780451494566_2p_all_r1.z.indd 188 @ 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019676