[DECEMBER DRAFT--- 287 pages] THE SNOWDEN AFFAIR A Spy Story in Six Parts By Edward Jay Epstein HOUSE_OVERSIGHT_020153

Chapter One Chapter Two Chapter Three Chapter Four Chapter Five Chapter Six Chapter Seven Chapter Eight Chapter Nine CONTENTS PROLOGUE On the Snowden Trail: Hong Kong 2014 PART ONE The Intelligence Crisis The Great Divide The Crime Scene Investigation PART TWO Snowden’s Arc Tinker Secret Agent Contractor Thief Crossing the Rubicon Hacktavist String-Puller HOUSE_OVERSIGHT_020154

Chapter Ten Raider of the Inner Sanctum Chapter Eleven Escape Artist Chapter Twelve Whistle Blower Chapter Thirteen Enter Assange Chapter Fourteen Fugitive PART THREE The Counterintelligence Conundrum Chapter Fifteen Did Snowden Act Alone Chapter Sixteen The Question of When Chapter Seventeen The Keys to the Kingdom Are Missing Chapter Eighteen The Unheeded Warning PART FOUR The Game of Nation Chapter Nineteen The Rise of the NSA Chapter Twenty Back Door In Chapter Twenty-One The Russians Are Coming Chapter Twenty-Two The Chinese Puzzle Chapter Twenty-Three The Pawn in the Game PART FIVE WALKING THE CAT BACK HOUSE_OVERSIGHT_020155

Chapter Twenty-Four Dinner with Oliver Stone Chapter Twenty-Five Vanishing Act Chapter Twenty-Six through the Looking Glass Chapter Twenty-Seven the Handler PART SIX CONCLUSIONS Chapter Twenty-Eight Snowden’s Choices Chapter Twenty-Nine = The Whistle Blower Who Became an Espionage Source EPILOGUE THE SNOWDEN EFFECT Chapter Thirty The ‘War on Terrorism’ after Snowden Chapter Thirty-one America after Snowden: The Good, the Bad and the Ugly Appendix A the Spies in this Book [TK] End Notes Bibiography [TK] HOUSE_OVERSIGHT_020156

HOUSE_OVERSIGHT_020157

Chronology 1: Snowden Thriller: From Honolulu to Moscow in 82 Days. April 8, 2013, Honolulu. Edward Snowden begins working as an infrastructure-analyst in training at the National Threat Operations Center for outside contractor Booz Allen Hamilton. June 5, 2013, London The Guardian publishes a classified document revealing that the National Security Agency has secretly been gathering the telephone billing records of millions of American. The Washington Post then publishing other secret documents revealing that the NSA has been intercepting data from the Internet. June 9, 2013, Hong Kong. —In a 12-minute long video posted on the website of the Guardian, Edward Snowden reveals himself as the source for the document published by the Guardian and the Washington Post June 11 Hong Kong. Sarah Harrison arrives in Hong Kong to work behind-the-scenes to assist Snowden. June 14, 2013, Washington D.C. Federal prosecutors in the Eastern District of Virginia, file a three- count criminal complaint against Snowden charging him with theft of government documents, unauthorized communication of national defense information and the willful communication of classified communications intelligence information to an unauthorized person. June 23, 2013, Moscow. Snowden arrived from Hong Kong at Sheremetyevo International Airport. HOUSE_OVERSIGHT_020158

PROLOGUE On The Snowden Trail: Hong Kong 2014 The National Security Agency, or, as it now commonly called, the NSA, was created on October 24, 1952, in such a tight cocoon of secrecy that even the Presidential order creating it was classified “Top Secret.” When journalists asked questions about this new agency, Washington officials jokingly told them that the initials NSA stood for “No Such Agency.” The reason for this extraordinary stealth is that the NSA is involved in a very sensitive enterprise. Its job is to intercept, decode and analyze foreign electronic communications transmitted around the globe over from copper wires, fiber optic cable, satellite, microwave relays, cell phone towers, wireless transmissions and the Internet for intelligence purposes. In intelligence jargon, its product is called COMINT. This form of intelligence-gathering is particularly effective when the NSA’s targets are unaware of the state-of-the-art tools the NSA uses to break into their computers and telecommunications and decipher their enciphered messages. In the first week of June in 2013, the NSA learned that a huge number of its most secret files had been stolen. The suspect was Edward Snowden, a 29 year old civilian analyst at the NSA’s regional base in Oahu, Hawaii, who had fled to Hong Kong. The stolen documents revealed, among other things, the secret tools and capabilities that the NSA employed to do its job. According to a three-count criminal complaint filed by Federal prosecutors in the Eastern District of Virginia, Snowden had stolen government documents and violated the Espionage Act by the unauthorized and willful communication of national defense information to an unauthorized person. This was not a who-dunn-it mystery. On June 9", 2013, in an extraordinary 12-minute video made in a cramped hotel room in Hong Kong, Snowden identified himself as the person who had taken the NSA documents. Watching the video, the world saw a shy, awkward and sympathetic- looking, man wearing a rumpled shirt, rimless glasses and a computer geek-style haircut, passionately speaking out against the NSA’s violations of the law and, in a shaky voice, expressing his willingness to expose them. Snowden had an innocent, idealistic, principled look about him, and the world was ready to congratulate him for revealing the NSA's illegal collection of data inside the United States. But in fact, he stole a great deal more than documents relating to domestic surveillance. He had also stolen secret documents from the NSA revealing the sources and methods it employed in its monitoring of foreign adversaries. What made this theft even more extraordinary was that he got away with it. By the time it had been discovered in the first week of June 2013, it was not possible for the FBI, the Grand Jury or any other US agency to question him because he had fled the country. He went first to Hong Kong. Although it is economically autonomous, the city of 7.2 million is actually a special HOUSE_OVERSIGHT_020159

administrative zone of China, whose national security apparatus is ultimately controlled by Beying. Making the possibility of questioning him even more remote, he next went to Russia, a country which has no extradition treaty with the United States. And Russia granted him asylum. His escape left in its wake an incredibly-important unsolved mystery: how did a young analyst at the NSA succeeded in penetrating all the layers of NSA security to pull off the largest theft of secret documents in the history of American intelligence? Did he act alone? What happened to documents? Was his arrival in Russia part of the plan? As I had written several books on the vulnerability of intelligence services, this was a mystery-- a "how-dunnit" if you like-- that immediately intrigued me. After all, even if the perpetrator had acted for the most salutary of reasons, the unauthorized transfer of state secrets to another country is, by any definition, a form of espionage. I decided to begin my investigation of this case in Hong Kong because it was the place to which Snowden first fled after leaving Hawaii. Snowden had planned the trip for at least 4 weeks, according to the travel plan he had filed at the NSA, I assumed he had a good reason for going first to Hong Kong. But when I spoke to my sources in the intelligence community, they could not explain Snowden’s choice of this semi-autonomous zone in China as his initial destination. It would not protect him from the reach of US law since Hong Kong had an active extradition treaty with the United States. Just a few months earlier, Hong Kong had made headlines by extraditing Trent Martin, a fugitive wanted in America for insider-trading, who was arrested in Hong Kong following an American request to detain him. Martin was then sent back to the United States to stand trial. Nor was Hong Kong particularly convenient to Hawaii. There were no non-stop flights to it from Honolulu. Snowden’s flight took 8 hours and ten minutes just to Narita airport, Japan, where he had to change planes. After a three hour wait at the airport, it took him five more hours to fly to Hong Kong. Moreover, at the time he departed Honolulu, Snowden had not yet arranged for any journalists to meet him in Hong Kong and, as far as US intelligence could determine, he had no known appointments there. Even so, Snowden carried the digital copies he had made of the top-secret NSA documents to Hong Kong. General Michael Hayden, who served both as the head of the NSA and the CIA, told me. “It’s very mysterious why Snowden chose Hong Kong.” Whatever reason he had for flying to Hong Kong, we can assume it was compelling enough for him to take the risk that he would be arrested there after US authorities discovered the theft and invoked the detention provision of its extradition treaty with Hong Kong. It was possible that Snowden travelled there to see someone other than a journalist. But who? Using my frequent travel miles, I bought a ticket on Japan Air Lines to Hong Kong. The route, like that of Snowden’s route the previous year, had a stop-over in Narita Airport in Japan (where, according to an intelligence source, Snowden was caught on the CCTV cameras waiting in the transit lounge for his connection to the four and one half flight to Hong Kong). HOUSE_OVERSIGHT_020160

I arrived in Hong Kong on May 20" 2014— the same day that Snowden had arrived there the previous year. I checked into the five-star Mira Hotel. It was in the Tsim Sha Tsui shopping district of Kowloon, a 10-minute ferry ride away from Hong Kong island, where most of the foreign consulates are located. I chose the Mira because it was the hotel in which Snowden stayed and made the celebrated video admitting his role in taking the NSA documents. I asked at the front desk for room 1014, the same one that Snowden had occupied in 2013. Snowden had told the journalists from the Guardian that that he had been at Mira Hotel since he first arrived in Hong Kong on May 20th until he left on June 10". My motive in taking the room during that period was not journalistic nostalgia; I wanted access to the hotel’s service and security personnel who may have had contact with Snowden a year earlier. Unfortunately, that room was occupied. Even so, I was given a nearby room that served my purpose. The rate was $330 a day with taxes, although I received a journalist’s discount of 30 percent. My first surprise was that Snowden had not arrived at the Mira until 11 days after he arrived in Hong Kong. He told the Guardian reporters that he hid out at the Mira hotel since his arrival because he feared that he might be captured by the CIA. But, as I learned from the hotel staff, Snowden had actually registered there under his real name and used his own passport and credit card to secure the room. Even more surprising was the date he checked into the Mira Hotel. It was not May 20" but June 1, 2013. Since he checked out on June 10, 2013, he was there for only nine days. The question that could not be answered by the registry of the Mira Hotel was: where was Snowden staying for the eleven days between from May 20" to June 1? Wherever he was, he apparently considered himself safe enough to take another irrevocable step in his defection. He sent journalist Glenn Greenwald of the Guardian a “welcome package,” as he called it, of 20 top-secret NSA documents on May 25, 2013. He had now not only downloaded documents but, in a violation of his oath, he provided them to an unauthorized party. He also in Hong Kong, for the first time, directly contacted via email Barton Gellman of the Washington Post. Indeed, it was during these first 11 days during which he was staying someplace other than the place he claimed to be staying that he made almost all the arrangements for his journalistic event. He was also apparently in contact with at least one foreign mission during this period, according to what he written to Gellman on May 25". In that email concerning when and how his story was to be published by the Washington Post, Snowden even asked Gellman to include in it some text that would help him with this mission. But which country was he approaching? Clearly his whereabouts during these missing 11 days was a gap that needed to be filled in. It could shed light on why he came to Hong Kong. I next called Keith Bradsher, a prize-winning journalist who had been the New York Times bureau chief in Hong Kong in 2013, who had written a well-researched report about Snowden’s HOUSE_OVERSIGHT_020161

10 arrival in Hong Kong in 2013.. He proposed we meet at the Foreign Correspondent’s Club on top of Ice House Street in central Hong Kong, a venue, I recalled, reminiscent of where John LeCarre had set the opening chapter of his spy novel The Honourable Schoolboy. When we spoke later, Bradsher told me that he knew Albert Ho, who had been retained as Snowden’s lawyer, for more than a decade, and interviewed him many times as he was a leader of a political movement in Hong Kong. Bradsher said that a few days after Snowden had revealed himself on June 9", 2013, he met with Ho and questioned him on the very question that intrigued me about Snowden’s unknown whereabouts. Ho told Bradsher that all of Snowden’s logistics had been arranged for him by an intermediary, who Ho called a “carer.” Ho further said that Snowden had been in contact with the “carer” prior to his arrival in Hong Kong on May 20th. According to Ho, it was this person who had arranged accommodations for Snowden on his arrival—and afterwards. If so, It seemed plausible to me that this person might be able to shed light on whom, if anyone, Snowden saw in his first ii days in Hong Kong. Of course, this person may have been unaware of the reasons for Snowden’s escape to Hong Kong when he made the arrangements for him but he was the best lead I had to learning why Snowden had come to Hong Kong. But who was the “carer?” Bradsher told me that he pressed Ho for details about this mystery person over the course of several meeting but Ho would not identify him beyond saying, that he was a “well- connected “resident” of Hong Kong. I next called Ho’s law office in Hong Kong. But Ho politely declined to be interviewed by me, saying he had said all he was going to say about the Snowden case. I next made an appointment with Robert Tibbo, a Canadian-born barrister, specializing in civil liberties cases, who had worked closely with Ho on the Snowden case. He immediately agreed to see me. I met Tibbo in the tea room at the Mandarin Oriental hotel on Hong Kong Island, where I moved to from the Mira hotel. The Mandarin was also convenient to Tibbo’s office at the court. Tibbo was a tall, round-faced man, with thinning hair, in his early fifties. He talked freely about his remarkable career. After earning a degree in chemical engineering from McGill University, and working in Asia as an engineer for a decade, he went to law school in New Zealand, and then became a barrister in Hong Kong specializing in cases involving the legal status of refugees. Over a leisurely tea, Tibbo made it clear to me that he had played a far more active role than Ho in the Snowden case, even personally escorting Snowden from the Mira Hotel on June 10" to a safe house. He did not dispute what Ho had told Bradsher, but said that he was himself bound by lawyer-client privilege which prevented him from providing me with any details that might reveal the identity of the person who had made arrangements for Snowden. When I asked the date that he was officially retained by Snowden, he said that Snowden had signed an agreement hiring Ho’s law firm as his legal adviser on June 10, 2013 (which was a matter of public record.) “I understand that,” I said, “but I am inquiring about something that had happened before you became his legal adviser.” He shook his head, as if getting rid of a pesky fly, and said that his oath precluded him saying anything at all that might do damage to the credibility HOUSE_OVERSIGHT_020162

11 of his client. “Not even where he was staying in May in Hong Kong,” I persisted. He leaned forward and, after a brief hesitation, said, jokingly I assumed that he would not divulge that information “even if you held a gun to my head.” We met two more times but, true to his word, Tibbo would not say if he even knew the identity of the “carer.” Meanwhile, Joyce Xu, a very resourceful Chinese journalist who was assisting me in Hong Kong, had filed the equivalent of a Freedom of Information request with the Hong Kong Security Bureau asking for information about Snowden’s movements in May. Thomas Ng, the Secretary for Security, turned down the request, adding that Hong Kong authorities do not keep records of hotel registrations. So I ran into a dead end on the issue of Snowden's “carer” and his whereabouts for those eleven crucial days with the Hong Kong authorities. At this point, I had some much-needed help from an old friend on the White House staff. Before I had left New York, I asked him if he could find someone at the consulate in Hong Kong who might brief me on the Snowden case. I didn’t hear from him until just a few days before I was due to return to New York. He had managed to put me in touch with a former employee of the consulate, who he said was “fully informed” about the efforts of the US mission to locate Snowden in Hong Kong. This person was still living in Hong Kong and he agreed to meet with me on condition that I did not mention either his name or his position in the US mission in Hong Kong. The venue was the terrace lounge of the American Club in Exchange Square in central Hong Kong, a posh club mainly for expatriate Americans. It was on the 48" floor with a spectacular view of Victoria Harbor. Once there, I had no problem finding my source. He was, as he had described himself, a large man with short-cropped brown hair wearing a brightly-striped tie. He was sitting alone at a discreet table in the corner. I introduced myself and gave him a copy of my latest book, The Annals of Unsolved Crime. After ordering drinks, he told me in a soft voice about the American reaction to Snowden’s revelations in Hong Kong. “All hell broke loose,” he said, describing the atmosphere at the US mission after Snowden’s video was posted on the Guardian’s website on June 9", 2013. To break the ice, I went over some of the assertions Snowden had made concerning the US consulate in that extraordinary video. For example, Snowden had said that he could be seized at any moment by a CIA rendition team based at the US consulate “just down the road” from the Mira Hotel. “Was that true,’ I asked? He rolled his eyes, and said, “Snowden has a pretty wild imagination. For one thing, the US consulate is not down the road from the Mira in Kowloon, it is here on Hong Kong Island. And there was no CIA rendition team in Hong Kong.” My next question concerned a second period during which Snowden's whereabouts are unknown—the period between the time he left the Mira Hotel on June 10, 2013 and the day he left Hong Kong for Russia on June 23, 2013. When I asked my consulate source whether the US mission took any action to track Snowden during these 13 days, he explained that the FBI had a contingent of “legal attaches” based at the consulate to pursue, among other things, video pirates. In addition, the CIA and the Defense Intelligence Agency had a handful of “China-watchers” in HOUSE_OVERSIGHT_020163

[2 Hong Kong. This group constituted the intelligence “mission,” as he referred to it. After Snowden outed himself on the Internet, the mission began tracking Snowden’s movements. Since Snowden, his lawyers and the journalists in his entourage frequently used their cell phones to text one another, it was fairly easy for the mission to follow Snowden’s trail after he left the Mira hotel. Presumably, the Hong Kong Police also knew where he was during this period. My source further suspected that the massive Chinese intelligence contingent in Hong Kong also knew, since it had close relations with the Hong Kong police. If so, Snowden’s whereabouts as he moved every few days from apartment to apartment was no secret anyone but the public from June 10" to June 23™ “Of course we knew,” he said, adding that there were also photographs of Snowden entering the office building that housed the Russian consulate. I mentioned that there was a report in a Russian newspaper that Snowden had visited the Russian consulate in late June in connection with the flight he later took to Moscow. “All we know is he entered the building,” he answered, with a shrug. That visit did not come as a complete surprise to US intelligence. After Snowden left the Mira, his interactions with the Russian and Chinese intelligence services in Hong Kong also had been closely monitored by the “secret means,” as was subsequently confirmed to me a former top intelligence executive in Washington DC. All of Snowden’s stealth in exiting from the Mira hotel, which included wearing a baseball cap and dark glasses, was ineffective in hiding him from US intelligence and presumably other intelligence services seeking the treasure trove of documents he had taken from the NSA. Among other things, the Hong Kong lawyers moving him to a safe house were carrying easily traceable cell phones. The mystery that most concerned me was, however, not where Snowden was housed in the interim between when he went public and when he went to Moscow. It was where, and in whose care, Snowden had been before, he had checked into the Mira hotel on June 1*. When I asked him about this period, he said that as far as he knew neither the FBI nor the Hong Kong police could find a trace of him during the period between May 20", when he passed through Hong Kong customs, and June 1“, when he used his credit card and passport to check into the Mira hotel. They could not find any credit card charges, ATM withdrawals, telephone calls, hotel registrations, subway pass purchases or other clues to Snowden’s activities. As far as a paper trail was concerned, Snowden was a ghost during this period. Could an American just vanish in Hong Kong for eleven days, I asked”? “Apparently he did just that,” my source replied. Snowden’s whereabouts during these 11 days was not a mystery I was going to solve on this first trip to Hong Kong. I needed to know more about Snowden’s activities before he flew to Hong Kong. After all, Snowden was not, as he himself pointed out from Moscow, an “angel descending from the heavens.” He had a past working for the US government that extended back seven years. During that period, he had been part of America’s secret intelligence regime, and held a clearance for Sensitive Compartmented Information, or SCI. Such SCI material is considered so sensitive that it must be handled within formal access control systems established by the Director of National Intelligence. HOUSE_OVERSIGHT_020164

13 Nor did Snowden’s breach begin with him handing over classified documents to the Guardian reporters in Hong Kong in June 2013 or, for that matter, in the eleven days prior to his meeting with journalists in 2013. He had, as the NSA quickly determined begun illicitly copying documents in the late summer of 2012. Such an enterprise does not emerge from thin air. Even if he had managed to elude American intelligence from late May to early June 2013, he could not hide all the history that led to his decision to come to Hong Kong. There had to be an envelope of reality surrounding it, including Snowden’s motivation, associates, movements, finances, and his activities prior to his fleeing to Hong Kong. What was missing was not just Snowden’s first 11 days in Hong Kong but the entire context of the alleged crime. I now needed to fill in that envelope of reality in America. I left Hong Kong for New York on June 2, 2014 two days after my meeting with the former official of the consulate. HOUSE_OVERSIGHT_020165

HOUSE_OVERSIGHT_020166

HOUSE_OVERSIGHT_020167

16 PART ONE THE INTELLIGENCE CRISIS HOUSE_OVERSIGHT_020168

HOUSE_OVERSIGHT_020169

18 CHAPTER ONE The Great Divide “What you’ve seen so far is just the tip of the iceberg.” -- retired Admiral Michael McConnell, vice chairman of Booz Allen Hamilton On June 9, 2013, the Guardian, the British newspaper known for the quality and gravity of its reporting posted Snowden’s 12-minute video on its website. In it, Snowden identified himself as an infrastructure analyst at a regional base of National Security Agency that was located in Oahu, Hawaii. He revealed in a calm, unemotional voice that he had been the source for the stories in both the Guardian and the Washington Post. He said that he had supplied the secret, classified documents that the two newspapers had used in their scoops about domestic surveillance being conducted by the NSA, America’s enormous electronic surveillance agency. These sensational revelations had been, literally, the talk of the world, and now, in another major news event, the boyish-looking Snowden revealed his responsibility for what would turn out to be the largest theft of top-secret documents in the history of U.S. intelligence. In the video, Snowden was questioned by Glenn Greenwald, an American journalist living in Brazil who had broken the NSA story in the Guardian. What was his motive? Greenwald asked. Why did he do it? Snowden replied that he had become horrified by the NSA’s secret operations which, to him, represented a kind of distillation of the excesses of the American national security state, and he therefore made it his mission to blow the whistle. He believed that the public needed to be informed of the existence of a vast, secret surveillance operation directed against tens of millions of Americans that flagrantly violated US laws and was a grave threat to their privacy and their freedoms. Within hours of the release of that video on the Guardian website, Snowden was one of the most famous people in the world, celebrated by his supporters as a courageous whistle-blower. The Snowden interview in the video subsequently was expanded by the documentary filmmaker Laura Poitras into the two-hour movie CitizenFour, which won the 2015 academy-award for the best documentary. Poitras said in accepting her Oscar in the Academy Awards Theater in Hollywood on February 22" 2015, that Snowden acted as a whistle-blower not only to “expose a threat to our privacy but to our democracy itself.” She received a standing ovation. The film convincingly depicts Snowden as an altruistic young man who is willing to risk his own personal freedom and face years of imprisonment for the sake of others. Adding to the drama, almost all the footage of Snowden in the film is from interviews with him in the confines of Snowden’s small HOUSE_OVERSIGHT_020170

19 room at the Mira hotel from June 3 to June 9", 2013, as the event was actually unfolding. Snowden, speaking for the camera, describes himself as a civilian contractor for the National Security Agency. He took full responsibility for the theft of classified documents, saying that he had acted alone. He said that he had been forced to take these documents to expose a crime that threatened the freedom of Americans: the US government’s illegal surveillance of US citizens. He said that he had a duty to bring this secret activity to the attention of the American people. “Sitting on his unmade bed—white sheets and covers, white headboard, white bathrobe, white skin—Snowden seems like a figure in some obscure ritual, being readied for sacrifice,” George Packer wrote about the film in a widely-read article in The New Yorker. He said repeatedly he was willing to make the ultimate sacrifice, by allowing himself to go to prison, so that Americans could live in freedom. A large part of the public, who viewed this powerful film, including many of my colleagues in journalism whose writing I greatly respect, came to accept Snowden’s whistle- blowing narrative. This powerful narrative, as lucidly articulated by Poitras, Greenwald and other Snowden supporters, described the NSA activities exposed by Snowden as part of a vast criminal conspiracy involving, among others, President Obama, James Clapper, the Director of National Intelligence and both Democrat and Republican members of the Congressional oversight committees. It further derided claims that there was evidence that Snowden’s theft of NSA secrets went beyond exposing government misdeeds as part of an orchestrated effort to demonize Snowden. The purpose of this demonization was to divert away from the government’s crimes. For example, this narrative asserted as if it was established fact, that US government officials had deliberately “trapped” Snowden in Russia. According to Snowden, the purpose of this government ploy was to “demonize” him. To be sure, it is not unprecedented for the government to release defamatory information about individuals who have embarrassed US intelligence by defecting. When two NSA analysts, William Martin and Bernon Mitchell, defected to Russia in the 1960s and accused the NSA of violating international law after arriving in Moscow, U.S. government officials responded by putting out the story that they were homosexual lovers, which was both untrue and irrelevant to the intelligence secrets that they compromised. So it is certainly possible that the government put out information to intentionally defame Snowden. Secretary of State John Kerry, after all, characterized him as a coward who should “man up” by returning to the United States. While one can discount such characterizations against him by government officials as demonization, as I do, one cannot as easily dismiss the independent evidence that undermines Snowden assertion that his sole motive was blowing the whistle on illicit surveillance in the United States. For example, by the Lawfare Institute in cooperation with The Brookings Institution in 2014 did an independent analysis of all the published documents that Snowden provided to the media. It concluded that, with some notable exceptions, such as the two documents initially published by the Guardian and Washington Post, the now famous FISA HOUSE_OVERSIGHT_020171

20 warrant and the PRISM slides, few of the other documents that Snowden had given Poitras and Greenwald for publication had little to do with either domestic surveillance or the infringements on the privacy of Americans. By the Lawfare Institute’s count, 32 of Snowden’s leaks to these journalists concerned the NSA’s overseas sources and method, nine identified overseas locations of the NSA’s intelligence bases, 25 of them revealed the identities of foreign officials of interest to US intelligence agencies, 14 of them disclosed information about Internet companies legally cooperating with the NSA, and 19 of them concerned technology products that the NSA had been using or researching. In addition, a considerable number of the published documents did not even belong to the NSA but were copies of reports sent to the NSA by its allies, including the British, Australian, Canadian, French, Norwegian and Israeli intelligence services. For example, he provided journalists with secret documents from the British cyber service GCHQ describing its own plans to obtain a legal warrant to penetrate the Russian computer security firm Kaspersky to expand its “computer network exploitation capability." All the GCHQ was revealing in this document was its own capabilities to monitor a Russian target of interest to it. While the release of these foreign documents may have embarrassed foreign allies of the United States, they exposed no violations of US law by the NSA. It was a legitimate part of the NSA’s job to share information with its allies. This raises the question: what constitutes whistle-blowing? To the general public no doubt, a whistle-blower is simply a person who exposes government misdeeds from inside that government. But in the eyes of the law someone who discloses classified information to an unauthorized person, even as an act of personal conscience, is not exempt from punitive consequences of his act. Indeed, if a person deliberately reveals secret US operations, especially ones that compromise the sources and methods of US intelligence services, he or she may run afoul of American espionage laws. In the past when government employees have disclosed classified information to journalist to redress perceived government misconduct, they almost always received prison sentences, Just during Obama’s presidency, there were six government employees who, as a matter of personal conscience, shared classified information they obtained from the FBI, CIA, State Department and US Army with journalists. They were Shamai Leibowitz in 2010, Chelsea Manning in 2013, John Kiriakou in 2013, Donald Sachtleben in 2013, Stephen Kim in 2014 and Jeffrey Sterling in 2014. Like Snowden, they claimed to be whistle-blowers informing the public of abuses of the government. But since they disclosed classified documents, they were dealt with as law-breakers. All six men were indicted, tried, convicted and received prison sentences. Sterling, a CIA officer who allegedly turned over a document to James Risen, a Pulitzer Prize winning reporter for the New York Times, was sentenced to 42 months, for example. The most severe sentence was meted out to Private Bradley/Chelsea Manning, who an Army court sentenced to 35 years in a military stockade. The prison time that others received did not go unnoticed by Snowden. He had been following the Manning case since 2012. In fact, he posted about it shortly before he began stealing far more HOUSE_OVERSIGHT_020172

21 damaging documents than had Manning. He therefore would have been aware that by revealing state secrets that he had sworn to protect, he would be risking imprisonment unless, unlike Manning, he fled the country. His motives, no matter how noble they might be, would not spare him, anymore than it spared the other six, from determined federal prosecution. To be sure, the view of those on the Snowden side of the divide is not grounded in legal definitions, but in a broader notion of morality. Snowden‘s supporters do not accept that the law should be applied in this fashion to Snowden. They argue that Snowden had a moral imperative to act, even if it meant breaking the law. They fully accepted his view that he had a higher duty to protect citizens of all countries in the world from, as he put it, “secret pervasive surveillance.” That higher duty transcended him any narrower legal definitions of law-breaking. For example, Ben Wizner, a lawyer from the American Civil Liberties Union who represented Snowden since November 2013, argues that Snowden’s taking of classified documents was as “act of conscience” that overrode any legal constraints because it “revitalized democratic oversight in the U.S.” And, without question, Snowden’s theft caused a much needed debate on govern surveillance. In this ends- justify-the-means view, any person with access to government secrets can authorize himself or herself to reveal those secrets to the world if it serves the public good and because doing so would be an “act of conscience,” he or she should be immune from legal prosecution. So for Snowden’s supporters, his “act of conscience” justifies his claim to being a whistle- blower even though the preponderance of the secrets disclosed by Snowden had to do with the NSA’s authorized activity of using its multi-billion dollar global arrays of sensors to intercept data in foreign countries and share it with some 30 allied intelligence services, as it did in 2013. Snowden, for example, took the NSA to task for its sharing information with Israel. In an interview in Moscow with James Bamford for Wired Magazine in August 2014, Snowden describes supplying intelligence to Israel as “One of the biggest abuses we’ve seen.” He was referring to the NSA providing the Israeli Cyber Service, known as Unit 8200, with data concerning Arab communications in Gaza, the West Bank, and Lebanon. But providing Israel with such data, as well as providing it with lethal weaponry, was not some rogue operation. It was part of a policy that had been approved by every American President—and every Congress—since 1948. Snowden had every right to disagree with this established US policy of aiding Israel with intelligence, but it is another matter to release secret documents to support his view. If the concept of whistle blowing is expanded to cover intelligence workers who steal secrets because they disagree with their government’s foreign policy of their government, it would also have to include many notorious spies, such as Kim Philby. Snowden’s concept of whistle-blowing also applied to NSA’s spying on adversary nations. “We’ve crossed lines.” Snowden said in regard to China, “We’re hacking universities and hospitals and wholly civilian infrastructure.” The NSA’s operations against China were such “a HOUSE_OVERSIGHT_020173

Ze real concern” for Snowden that he targeted lists of the NSA’s penetrations in China. This expansion of the whistle-blowing concept to adversaries was echoed by Russian President Vladimir Putin. He complimented Snowden for having “uncovered illegal acts by the United States around the globe,” Putin’s view implies a convenient global concept of whistle-blowing that justified breaking US laws. Even so, this whistle-blower interpretation of Snowden’s act has had immense international resonance in the media. The Washington Post and Britain's Guardian, the newspapers that initially published the purloined documents, won the 2014 Pulitzer Prize. The journalists, who assisted Snowden in this enterprise, including Greenwald and Poitras, were awarded the 2014 Polk Award for national-security reporting. Former Congressman Ron Paul organized a clemency petition in February for Snowden, stating: "Thanks to one man's courageous actions, Americans know about the truly egregious ways their government is spying on them," and his son, Senator Rand Paul, who was a candidate for the Republican Presidential nomination in 2016, calling for a Presidential pardon for Snowden. Senator Paul’s concern fitted with the growing public apprehension over increasing intrusion on its privacy. Snowden was correct, in my opinion, in describing the threat of a surveillance state and the loss of privacy is certainly a legitimate public concern. “We actually buy cell phones that are the equivalent of a network microphone that we carry around in our pockets voluntarily,” he pointed out from Moscow. Snowden is correct that the technology involved in the electronic equipment we all use in the 21* century has made mass surveillance part of our daily life. There can be little doubt that our privacy has been largely eroded, if not entirely negated, by the widespread use of cell phones, credit cards, social media and the search engines of the Internet. When we use smart phones, as most Americans do today, our location is relayed to our telephone service provider every three seconds. The phone companies collect and archive our phone usage “metadata,” which includes whom we called and how long we spoke. When we use Google to search for anyone or anything on the Internet, that activity is captured by Google, a company whose profits mainly come from making available to advertisers the results of its surveillance and collection of its users’ searches. When we use Gmail, the Google’s email service used by nearly one-billion senders and recipients, we agree to allow Google to read the actual contents of our correspondence to find keywords in them of interest to advertisers. When we use a credit card, the credit card company also retains data about what we buy and where we go. When we travel in automobiles equipped with GPS, every turn and stop is tracked and recorded. And when we are in public places with CCTV cameras, our image is recorded and archived. When we use Facebook, Twitter, and other so- called social media, as over two billion people do today, we allow these companies to collect, retain and exploit its surveillance of our movements, associations with other people, and stated preferences. When we use Amazon and other on-line stores, we allow them to track and archive a great deal of our commercial activity. For Internet companies, such as Facebook, Twitter, HOUSE_OVERSIGHT_020174

23 Yahoo and Google, collecting private data on hundreds of millions of their members provide them with vast searchable data bases that they can sell to advertisers and other search parties. The exploitation of these data bases is a fundamental aspect of their business plans. Without such surveillance of their users, social media companies would not be able to turn a profit. Indeed, they may be more aptly called surveillance media rather than social media. For those of us who use them to post pictures and communicate, any notion of personal privacy is largely illusionary. To be sure, there is a distinction to made between the surveillance of our activities to which we voluntarily agree in exchange for the benefits and conveniences that we gain from social media, search engines, and other Internet companies, and the surveillance done by government to which we do not voluntarily invite-- or want. We willingly waive our privacy for corporations but not for governments. What the public might not fully realize, however, is that all the personal information in data bases of private companies can be accessed by the government if it obtains a court order or search warrant. As Snowden himself pointed out, “If Facebook is going to hand over all of your messages, all of your wall posts, all of your private photos, all of your private details from their server, the government has no need to intercept all of the communications that constitute those private records." These Internet companies, even if they are only interested in exploiting the data for its own profit, cannot refuse to share this information with the NSA, FBI and other agencies of the government if they have a court-ordered search warrant, Consequently, all the information these private corporations collect about us is legally available to any municipal, state and federal authority that obtains a warrant from a court. And such search warrants are routinely issued. That reality became evident to me in my investigation of the rape charges brought (and subsequently dropped) against Dominique Strauss- Kahn, the managing director of the International Monetary Fund, in 2011. Immediately after his arrest, Cyrus Vance Jr, the district attorney of New York county, obtained a warrant for Strauss-Kahn’s cell phone records, credit card records, hotel room electronic key records, emails, room service bills, and the CCTV videos of his activities (some of which I published in my article about the case in the New York Review of Books). If anyone doubts the pervasiveness of government data collection, consider a little known government agency called the “Consumer Financial Protection Bureau.” Created in 2010 by Congress, it mines data on a monthly basis from some 600 million personal credit card accounts, targeting about 95 percent of the credit cards users in the United States. In additions, through 11 other data mining programs, it gathers data on everything from private home mortgages and student loans to credit scores and overdrafts in personal banks accounts. This ubiquitous surveillance of virtually every non-cash transaction came about because of advances in computer technology which made it economically feasible to mine data. Nor is the concern raised by Snowden about NSA domestic surveillance misplaced. Ever since the 9-11 attack the NSA has increasingly played a role in this surveillance state not by own choice but because Congress mandated it. In 2001, it empowered the NSA to obtain and archive data on American citizens. Accordingly, the NSA obtained the billing records of customers from phone and Internet companies and archived these records. The operation was intended to build a searchable data base for the government that could be used to trace the history of the telephone and Internet activities in the United States of FBI-designated foreign terrorists and spies. The government also kept secret these anti-terrorist programs from the public because it did not want the foreign suspects to realize their communications in America were being monitored. The HOUSE_OVERSIGHT_020175

24 public only learned that the phone company was turning over its billing records on June 5, 2013, when Snowden disclosed it to the Guardian and Washington Post. The documents he provided the journalists showed that the NSA had been obtaining phone records every three months that had been collected by Verizon. While this revelation may have shocked the American public, the NSA had not acted on its own. It had obtained a warrant issued by a secret court established by Congress in 1978 as part of the Foreign Intelligence Surveillance Act (FISA) for each request for records. Congress empowered the FISA court to hear cases and authorize search warrants in secret in cases involving national security. As its name implies, the FISA court was meant to deal with matters bearing on foreign intelligence activities in the United States. That restriction changed after the devastating terrorist attacks of September 11, 2001. A month after the attack, Congress expanded the purview of the FISA court by passing the USA Patriot Act (an acronym which stands for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism”). Part of the Act, Section 215, euphemistically referred to as the "library records" provision, permitted the FISA court to issue warrants authorizing searches of records by the NSA and other federal agencies to investigate international terrorism or clandestine intelligence activities Through these FISA authorizations, the NSA could obtain "tangible things" such as "books, records, papers, documents, and other items." Under the interpretation of this section of the law by both the Bush and Obama administrations, the FISA court was enabled by Congress to issue warrants to telephone companies demanding that they turn over to the NSA the bulk billing records of all calls made in America.. The FISA court need only deem these records to be “relevant: to the FBI’s investigations of terrorists and spies. Essentially, this controversial interpretation of the word “relevant” in Section 215 by the FISA court was used by the NSA to create a searchable database of telephone billing records. Sucha “haystack,” as the NSA called the national collection of billing records, could allow the FBI to instantly find missing “needles,” even if the connections were made years earlier. For example, if the FBI had a lead on a foreign suspect, it could search the data base for any telephone calls made by the foreign suspect to telephone numbers in America, and then who those people called. The FBI always had this power, if it obtained a warrant, but it did not have the records previously in a single data base. General Alexander believed such a “Haystack” database made sense. His approach was, ‘Let’s collect the whole haystack,’” according to one former senior U.S. intelligence official quoted by the Washington Post. According to its critics, including the ACLU, the results provided by this vast database did not justify its immense potential for abuse. In early May 2015, just three weeks before this part of the Patriot Act was set to expire, a three- judge panel of the Second U.S. Circuit Court of Appeals in New York, agreed with the ACLU position, overturning a lower court decision that it was legal. The panel found that the word “relevant” in the Act was not intended by Congress to justify the acquisition and storing of the bulk records of telephone companies. It declared that the government’s interpretation of Section 215 of The Patriot Act was incorrect. Soon afterwards Congress replaced the Patriot Act with the USA Freedom Act, which effectively transferred bulk storage of billing records from the NSA to the phone companies themselves. Despite the change in venue, the records of individuals were still not completely private. The databases held by phone companies could still be searched under the new law via a FISA warrant by the FBI. The core of Snowden’s charge in the media was that the FISA court overreached its authority by issuing sweeping warrants that allowed the NSA to obtain data collected by private phone and Internet companies. It the initial story published in the Guardian on June 5, 2013, Snowden HOUSE_OVERSIGHT_020176

Zo disclosed one such FISA warrant to support his charge. It was issued by Judge Roger Vinson of the FISA court on April 25, 2013 and ordered Verizon to turn over to the FBI all its billing records of landline customers for the next 90 days. The FBI presented this FISA authorization to the NSA, which acts as a service organization for the FBI and CIA in collecting communications data. The NSA, with the FISA warrant in hand, then obtained the Verizon billing records. Snowden also provided the Washington Post and Guardian with another secret document, which was actually a power point presentation on 20 slides by the NSA to other intelligence agencies. It described a program it was using for monitoring the Internet. Its code name was PRISM. It was authorized under Section 702 of the Foreign Intelligence Surveillance Act and was designed to collect messages sent over the Internet from foreigners. Since most of the Internet pipes that carried these messages ran through the United States, the NSA intercepted a large part of the data from Internet companies based in America. This program was not entirely secret from the Internet companies. Such information was in fact obtained with FISA court approval and with the knowledge of the service providers. It also requires a written directive from both the Attorney General and the Director of National Intelligence, and a review by the Department of Justice every three months of each case. After obtaining this data, the NSA ran programs to filter out all domestic Internet communications. In theory at least, PRISM targeted foreign communications, but, as Snowden pointed out, domestic information was also accidently picked up. Whenever the Justice Department actually opened an investigation against Americans in contact with foreign suspects, as it did in 170 cases in 2013, it could obtain warrants from the FISA court to search these Americans’ Internet activities. So though PRISM supposedly was a tool for foreign surveillance, it could be extended to Americans in contact with foreign suspects. These two documents raised legitimate questions for many Americans, including members of Congress, about the proper role of the FISA court, including should it conduct its business in secret? If Snowden had released only these two documents that related to unwarranted domestic surveillance, and other possible violations of the law by the NSA, it would be difficult for any reasonable person not to see his actions as a valuable and even necessary public service. After all, as the three-judge panel of the Second U.S. Circuit Court of Appeals would later find, Congress had not intended Section 215 of the Patriot Act to be used to justify the bulk collection of American records. So if he had limited his illegal downloading to the few documents about bulk collection, it would be more difficult to argue that he was not a whistle-blower in spirit if not in the letter of the law and even a hero of the struggle to preserve our civil liberties. But, in fact, he took a great many other secret documents that did not bear on civil liberties issues. As a result, the Snowden case produced a great divide in the American appreciation of him. On one hand, he has been almost universally lauded and lionized by what might be seen as the mainstream media, by numerous academics, and even, as we have seen, by members of Congress. The journalists who assisted him, such as like Greenwald, Poitras and/ Gellman also have been celebrated for the roles they played in bringing Snowden’s revelations to the public. In other circles, the appreciation had been of him has been very different. American and British intelligence HOUSE_OVERSIGHT_020177

26 officials, senior members of the Obama Administration, and members of the oversight committees of Congress do not view Snowden as a hero or even an authentic whistle-blower. Instead they see him as a betrayer of secrets who, acting willfully brought damage to the United States and benefits to its adversaries. The holders of this darker view of Snowden base it on classified reports of the full extent of the theft of classified data. Those officials reckon that only handful of the tens of thousands of documents he stole involved domestic surveillance, and these few documents served as a cover for a much larger theft. Admiral Michael Rogers, who replaced General Alexander as head of the NSA in January 2014, said that March at a public forum at Princeton University. “Edward Snowden is not the "whistleblower" some have labeled him to be.” He further explained to Congress: “Snowden stole from the United States government a large amount of classified information, a small portion of which is germane to his apparent central argument regarding NSA and privacy issues.” Gen. Martin Dempsey, the chairman of the Joint Chiefs of Staff, went even further. He testified to the House Armed Services Committee on March 6, 2014, after estimating that the Snowden breach could cost the military “billions” to repair, added that "The vast majority of the electronic documents that Snowden exfiltrated from our highest levels of security had nothing to do with exposing government oversight of domestic activities." He based this assessment on then still-secret Defense Intelligence Agency’s report on the breach. Although he did not reveal the full extent of the damage even in his classified testimony to Congress in 2013, the classified DIA report showed that Snowden took "over 900,000" military files from the Department of Defense (DoD) in addition to the NSA files he had taken.. The Defense Department loss in terms of the number of files stolen actually exceeded the loss, in sheer numbers, of NSA documents. Lieutenant General Mike Flynn, the DIA director, who directed the DIA secret study, testified to the Senate Select Committee on Intelligence that the breach “has caused grave damage to our national security.” To be sure, this was not the first time that the cryptological branches of the military had been compromised. The spy ring of John Walker had provided thousands of the Navy’s reports on breaking Russian ciphers to the KGB during the Cold War era, for example. But the Snowden breach exposing military sources was an order of magnitude greater than any past breach. The CIA’s assessment was no less grim. Michael J. Morell, the deputy director of the CIA in 2013, who, after Snowden’s breach, was appointed by President Obama to the task force to review the NSA’s intelligence breach and its consequences for national security, wrote that Snowden’s action went beyond taking the handful of documents, such as the FISA order, “that addressed the privacy issue.” Instead, as Morell put it, “he backed up a virtual tractor trailer and emptied a warehouse full of documents—the vast majority of which he could not possibly have read and few of which he would likely understand—T[and] and he delivered the documents to a variety of news organizations and God knows who else.” _—_As a result, Morell concluded “Snowden’s disclosures will go down in history as the greatest compromise of classified information ever.” General Keith Alexander, the head of the NSA at the time, came to a very similar assessment, asserting that Snowden did “the greatest damage to our combined nations’ intelligence systems that we have ever suffered.” To be sure, it is to be expected that military intelligence officers HOUSE_OVERSIGHT_020178

Zul would not be on Snowden’s side of the divide (and the Snowden breach ended the career of many of them, including General Alexander.) But political leaders in both parties could also be found on the anti-Snowden side of the divide. “T don’t look at this as being a whistle-blower.” Senator Dianne Feinstein (D. - Calif.), the head of the Senate Intelligence Committee, said after she was briefed on Snowden's theft of documents. "I think it’s an act of treason." Rep. Mike Rogers, (R.-Mich.), her counterpart on the House Intelligence Committee, said on the NBC program, “Meet the Press,” that Snowden might be working for a foreign intelligence service. And a former prominent member of President Obama's cabinet went even further, suggesting to me off the record in March this year that there are only three possible explanations for the Snowden heist: 1) It was a Russian espionage operation; 2) It was a Chinese espionage operation, or 3) It was a joint Sino-Russian operation. These severe accusations generated much heat but little light. They were not accompanied by any evidence from these Congressional leaders showing that Snowden had acted in concert with any foreign power in stealing the files or, for that matter, that he was not acting out of his own personal convictions, not matter how misguided they may have been. On this side of the divide, Snowden's critics regard the whistle blowing narrative as at best incomplete, and at worst fodder for the naive. They point out that the FISA document that gave him credentials as a whistle-blower was only issued in the last week of April 2013, which was three months after he first contacted Greenwald and almost 9 months after he began illegally copying secret documents. They further believe that the evidence contradicts Snowden’s claims that he stole only documents that exposed NSA transgression into domestic surveillance, that he turned over all the stolen documents to journalists, and that he was forced to remain in Moscow by the actions of the US government. They believe that all three of these claims, which are at the conceptual basis of the whistle blowing story, are false. They also find that the unprecedented size and complexity of the penetration of NSA files, compromising hundreds of thousands of secret documents pertaining to US operations against adversary nations, according to the NSA’s and Pentagon estimates, does not afford an innocent explanation for the volume of files he took. The deep split in how Snowden is perceived brings to mind the famous drawing of a duck -rabbit cartoon first published in 1900 in the book Fact and Fable in Psychology. The figure is perceived either as a duck or as a rabbit but it cannot be seen as both simultaneously. Whether a person sees a rabbit or duck in this test may depend on the information available to that person. For example, if the person has never seen an image of a rabbit before, he will see almost certainly see a duck; and vice versa. Similarly, what may account for the sharp divide between the Snowden and anti-Snowden camps is a disparity in the available information. The pro-Snowden camp's view is largely informed by Snowden himself. It prefers to believe his words over his actions. In the anti-Snowden camp are administration officials and the members of the House and Senate intelligence oversight committees who have been at least partially briefed on the continuing investigations of the Snowden affair. The members of the Senate Intelligence Committee, for example, were briefed by David Leatherwood, the director of operations of the Defense HOUSE_OVERSIGHT_020179

28 Intelligence Agency that the military files compromised by Snowden included documents bearing on military plans and weapons systems; foreign government’s intelligence activities (including special activities), intelligence sources, or methods or cryptology; Scientific and technological matters relating to national security;; vulnerabilities systems, installations, infrastructures, projects, plans, or protection services relations to national security and the development, production, or use of weapons of mass destruction. The members of the House and Senate Intelligence Committees, but not the public, also have been privy to an NSA investigation that established the chronology of his actions, including changing jobs, copying more than one million classified documents at the Signals Intelligence Center in Hawaii and flying to Russia. Nor does additional information necessarily change the minds of people who already have a firm view. In the field of social psychology, the testing of “confirmation theory” consistently shows that people tend to more readily reject new information that contradicts their pre-existing beliefs. For example, when Lee Harvey Oswald was arrested in the Texas Theater on November 22, 1963, he said famously, “I haven’t shot anybody.” Ten months later, the Warren Commission presented evidence, including ballistic tests that it claamed showed that Oswald had shot three people, including President John F. Kennedy, less than an hour before making his statement. Yet, many of those who believed Oswald’s public proclamation his innocence chose to believe that the government had falsified all the incriminating evidence to tarnish Oswald (who had been killed on November 24, 1963) rather than accept that they had been wrong in believing Oswald. The charges, countercharges and defamatory name-calling in the Snowden case therefore only deepened the great divide. Those who saw Snowden as a democratic hero exposing the abuses of power of an out-of-control national security state tended to dismiss anything that depicts Snowden in a negative light as a fabrication while those who saw Snowden as a “traitor” tended to dismiss anything that depicted him in a more positive light. When it comes to the murky universe of spy agencies, the problem in deciding where the truth lies is further heightened by the possibility of deliberate deception. Spy masters are, after all, in the business of concealing their most sensitive operations. It is often considered essential that important secrets be protected by what Winston Churchill famously termed “a bodyguard of lies.” Top intelligence officials are not exempt from this practice. Consider, for example, the response to a question concerning the NSA’s operations made by James D. Clapper, the Director of National Intelligence to the Senate Intelligence Committee on March 12, 2013. Senator Ron Wyden (D-Oregon) of the Committee asked the spy master if the NSA collected data on Americans. Clapper answered that the NSA did not knowingly “collect any type of data” on millions of Americans. Clapper’s answer was clearly untrue. However, it did not mislead Senator Wyden or any other members of the Senate Intelligence Committee because Clapper had truthfully testified that the NSA did collect American’s telephone records in a classified session of the Committee earlier that week. Who was being misled was the American public. Yet, none of the Senators on the Committee, including Senator Wyden, corrected this obviously false answer. When Clapper realized he had misspoken, he could not publically correct the record of the public HOUSE_OVERSIGHT_020180

PA session because, to do so, would be revealing classified information he had swore to protect. No doubt other intelligence officers find themselves in a similar bind in discussing secret matters. This suggests that there is a risk in accepting statements made by the intelligence chiefs at face value. But Snowden also has a credibility problem. He has told numerous untruths including ones calculated to help him insinuate himself into the key position from which he stole secrets and to cover up the nature of his theft. For example, Snowden got access in the spring of 2013 to the super-secret NSA’s computers storing these electronic files by working at Booz Allen Hamilton, a hedge-fund owned consulting firm, that helped manage computer systems at its Kunia base in Hawaii. On his application to Booz Allen in March 2013, Snowden claimed to be in the process of completing a master’s degree at the University of Liverpool in computer security sciences, which he expected to get that year. Although he had registered two years earlier at the online division of University of Liverpool, he had not completed a single course there and, according to the registrar, he was not in line to receive a master’s (or any) degree. To be sure, Snowden did not lie gratuitously. He told untruths to get access to classified documents and to get safely away with them. He also was not entirely truthful with journalists whose trust he sought when it suited his purpose in protecting himself. For example, in contacting Laura Poitras under the alias Citizen Four in January 2013, he gave her his word that he was currently a “government employee,” although in fact he was working for a private contractor at the time. Snowden had little concern about misleading journalists when it suited his purpose. For example, he told Alan Rusbridger of the Guardian, Brian Williams of NBC News, James Bamford of Wired Magazine, Katrina vanden Heuvel of the Nation, Barton Gellman of the Washington Post and Jane Mayer of Zhe New Yorker that the U.S, government intentionally acted to “trap” him in Moscow by revoking his passport while he was already on a plane to Moscow on the afternoon of June 23, 2013. Although he had first made this charge on July 1, 2013, none of these journalists asked Snowden what was the basis for his oft-repeated allegation. He did admit, however, during the Q&A following his July 12, 2013 press conference in Moscow that he had no independent source, sating t he had “read it” in the news reports. In fact, news stories prior to his statement reported that his passport had been revoked before he had left Hong Kong on June 22™ 2013. ABC News, for example reported that the U.S. "Consul General-Hong Kong confirmed Hong Kong authorities were notified that Mr. Snowden's passport was revoked June 22.” By the date to June 23", Snowden effectively provided to unsuspecting journalists an alibi for his presence in Russia. The credibility problem with Snowden assumed a more sinister dimension once Snowden put himself and his fate in the hands of the Russian authorities in Moscow. Even though the Obama Administration decided against revealing the extent of Russian intelligence service's participation in Snowden’s move from Hong Kong to Moscow, or what intelligence services call an “exfiltration,” I was told by a Presidential National Security staff adviser that the government acted to protect the intelligence sources used by the CIA, NSA and FBI to track Snowden’s HOUSE_OVERSIGHT_020181

30 movements in the latter part of June in Hong Kong. CIA Deputy Director Morell would go no further than to state that during that period he had no doubt the intelligence services of Russia and China “had an enormous interest in him and the information he [Snowden] had stolen.” Presumably, the last thing these adversary services would want would be to make this “interest” transparent to the United States. The role of concealment must be taken into account when assessing information bearing on the work of espionage services. I learned when I was interviewing James Jesus Angleton, the CIA’s legendary ex-counterintelligence chief of the CIA in the 1970s for my book on deception that intelligence services play by a different set of rules than historians when it comes to their espionage successes. Angleton, a famously baroque thinker himself, impressed on me the complexity of espionage. He said “It’s not enough just to steal a secret. It must be done in a way that the theft remains undetected.” From his perspective, there were two requisites that had to be fulfilled to assure the success of any intelligence theft. The first task is the obvious one: acquiring by espionage an adversary’s state secrets. The second task is concealment of that success. Deception is employed to obscure the nature and the extent of the espionage theft. This deception is necessary to extend the usefulness of theft. One of the most famous examples of this principle was the deceptions used by British intelligence in the Second World War to conceal its success in breaking the German ciphers generated by the Enigma machines. If German naval intelligence discovered Britain was able to read the ciphers it used to communicate with its U-boats, it would have stopped using them. So British intelligence hid its coup by supplying false information to known German spies to account for the sinking of U-boats, including the canard that British aerial cameras could detect one ingredient in the paint used to camouflage the U-boats. That same hoary principle of deception applies to modern-day communications intelligence. If the Russian, Chinese or any other adversary intelligence service got its hands on the documents stolen by Snowden from the NSA’s repositories in Hawaii in 2013, it would likely employ deception, including well-crafted lies, to create as much ambiguity as possible as to the ultimate disposition of the missing documents. From this counterintelligence perspective, the intelligence issue that spawned the great divide cannot be resolved by accepting the uncorroborated statements made by a source, such as Snowden, who may be in the hands of the Russian security services in Moscow. By the same token, the calculations made by NSA officials about the extent of the theft are also suspect. After all, the NSA is an intelligence service that often engages in secret machinations. We know that its top officials reported to the House and Senate Intelligence Committees, as well as the President’s National Security Adviser, that over one million documents were compromised by Snowden. But if this was disinformation, it is difficult to see its purpose. Inflating the extent of the damage of the Snowden breach to the President, Congress and the Secretary of Defense obviously reflected poorly on their own management of the NSA, and their own careers. Yet such a possibility cannot be precluded in the arcane world of intelligence. HOUSE_OVERSIGHT_020182

31 As in any case involving the loss of state secrets, uncontested facts remain in extremely short- supply. The opinion-laden appellatives such as “patriot” and “traitor” that have tended to fill the gap in the great divide do little to address the important mystery of how many thousands of state secrets were taken from the United States. How did Snowden breach the supposedly formidable defenses of the NSA? Did he have any assistance? How did he escape to Moscow? And what was the final destination of the stolen documents? The purpose is to find answers to these questions. For this endeavor, it is necessary to return to the crime scene: the NSA’s base in Hawaii. HOUSE_OVERSIGHT_020183

32 CHAPTER TWO The Crime Scene Investigation “Any private contractor, not even an employee of the government, could walk into the NSA building, take whatever they wanted, and walk out with it and they would never know.” Edward Snowden, Moscow 2014 About 15 miles northwest of Honolulu on the island of Oahu in Hawaii, adjacent to the sprawling Wheeler Air Force Base, is a 250,000 square foot man-made mound of earth and reinforced concrete surrounded by an electrified fence. Inside the mound is a three story structure originally built by the Air Force in the Second World War as a bomb-proof aircraft repair facility. In the Cold War, it was modernized to withstand an enemy chemical, biological, radiological or Electrical Magnetic Pulse attacks, and used by the Navy’s operation center for its Pacific fleet. After the Cold War ended, the huge edifice was turned over to the NSA, which had been created as an intelligence service to intercept the communications and signals of foreign countries after World War II, a mission which included vacuuming into its giant computer arrays telephone messages, missile telemetry, submarine signals and virtually everything on the electro-magnetic spectrum of interest to the US defense department and US intelligence agencies. Because it provided a valuable window on the activities of adversary nations in the Pacific region, it was able to monitor the ballistic missile tests and submarine activities of China, North Korea and Russia. As the NSA developed it, this Hawatian base became one of its primary regional bases for gathering Asian communications intelligence. By 2013, the Kunia base, also called “the tunnel” by its NSA workers, had a vast array of state-of-the-art technology, including 90 Cray supercomputers arranged in a horseshoe configuration, used to decipher and make sense of the intercepted signals from China, Russia and North Korea. At the heart of the Hawaiian complex was a unit with both military and civilian employees. A large share of the civilians who ran the computers worked under two-year contract to the NSA’s leading civilian contractor, Booz Allen Hamilton. Keith Alexander, the four-star general who headed the NSA from 2005 to 2014, first learned about the impending story in the Guardian on June 4, 2013 while he was in Germany meeting with its top intelligence officials. Janine Gibson, the Guardian’s American website editor had notified the NSA it intended to break a story based on NSA the next day. It took NSA counterintelligence less than 48 hours to determine that a civilian employee at the base from which documents were stolen had not reported back to work on June 3rd, 2013. It also determined he had lied on his application of a two-week medical leave and had flown to Hong Kong. The missing man was Edward Joseph Snowden, a 29-year civilian employee of Booz Allen Hamilton. At the time of the theft in May 2013, he was still being trained as an analyst at the Threat Operations Center. Personnel records further showed that he had worked there for less HOUSE_OVERSIGHT_020184

33 than six weeks. He had taken the medical leave on May 18, 2013 left the country by plane. By June 7 he had become the NSA’s main suspect. Snowden had been hired to work there as an outside contractor by Booz Allen Hamilton, a private company owned by a hedge fund, which managed much of the information technology at the Center. General Alexander, returning to Washington DC after assigning the sensitive job of investigating the breach to Richard “Rick” Ledgett, the Director of the NSA’s Threat Operations Center at NSA’s headquarters in Fort Meade, Maryland. It was a key position since the top- secret unit was responsible for discovering and countering the threats posed by Chinese, Russian and other adversary nations. Ledgett was also the logical choice to head the damage assessment investigation since the Center’s regional branch in Hawaii was from where highly-sensitive documents were stolen and where the main suspect, Snowden, last worked. Ledgett immediately boarded a military jet bound for Hawaii. His first task was to reconstruct the chronology all of Snowden’s moves at the Center, or, as the tactic is called in counterintelligence parlance, “walking the cat back.” The NSA meanwhile notified the FBI of Snowden’s possible involvement in the theft of state secrets. It is in charge of criminal investigations of civilian US intelligence workers, even if they occur on a NSA base, The FBI immediately dispatched a top task force of agents to investigate a potential espionage case in Hawaii. When questioned, Lindsay Mills, who shared Snowden’s rental home with him and had been his girl friend for 8 years, said Snowden was away on a business trip. After determining from airline and hotel data that he was in Hong Kong, the FBI realized Snowden was a possible intelligence defector. It froze his credit and bank cards. It also notified the passport office in the State Department the legal attaches at the Hong Kong consulate. The legal attaches, who were actually FBI field agents posted in Hong Kong, located Snowden at the Mira Hotel on June 8". Such international detective work proved unnecessary since on the evening of June 10" Snowden ended all doubts about the identity of the perpetrator by revealing in a 12-minute video posted on the Guardian website that he was the source of the stolen NSA documents for which the FBI was searching. The problem was that since Hong Kong was in China, US law enforcement did not have the means to recover them. At that point, determining the magnitude of the theft of documents became a critical concern of the investigation. Aside from the few dozen documents published by the Guardian and Washington Post, what else had Snowden stolen? Within the next few days, a small army of forensic investigators from the FBI, the Defense Department and the “Q” counterintelligence division of the NSA swarmed onto the NSA base in Hawaii. The proximate crime scene for their investigation was the National Threat Operations Center. They examined the cubicle where Snowden had last worked at NSA, and then began HOUSE_OVERSIGHT_020185

34 retracing all his activities at the NSA over the past four years. To begin with, they needed to find out how many documents from the Center had been copied and taken by Snowden. The Defense Intelligence Agency (DIA), the Pentagon’s own intelligence service, meanwhile was kept partially in the dark. It did not learn from the NSA that Snowden had stolen military documents, concerning the joint Cyber Command until July 10, 2013. In terms of sheer quantity, the number of stolen military documents was staggering. The DIA found that Snowden had copied “over 900,000” military files. Many of these files came from this joint command, which had been set up in 2011 by the NSA and Army, Navy, Marine and Air Force cryptological services to combat the threat of warfare in cyberspace. The loss was considered of such importance that between 200 and 2500 military intelligence officers worked day and night for the next four months, according to the DIA’s classified report, to "triage, analyze, and assess Department of Defense impacts related to the Snowden compromise." The job of this unit, called the Joint Staff Mitigation Oversight Task Force, was to attempt to contain the damage caused by the Snowden breach. In many cases, containment meant shutting down NSA operations in China, Russia, North Korea and Iran so they could not be used to confuse and distract the U.S. military. The NSA and Defense Department were not the only government agencies concerned with determining the extent of the breach. There was also the CIA. The NSA acted as a service organization for it, handling most, if not all, of its requests for communication intelligence to support its international espionage operations. Although the CIA and NSA were both part of the so-called “Intelligence Community,” the NSA did not immediately share with the CIA details of the Snowden breach. Despite the immense potential damage of the theft, it was not until a week later that CIA Director John Owen Brennan and Deputy Director Michael Morell were briefed by the NSA. When Morell realize how much data had been taken by Snowden, he was astounded “You might have thought of all the government entities on the planet, the one least vulnerable to such grand theft would have been the NSA,” he wrote “but it turned out that the NSA had left itself vulnerable.” According to Morell, he bluntly told the NSA briefer that it was urgent for the CIA to be brought in on the case. After all, only four years earlier Snowden had been employed by the CIA. Specifically, Morell said the CIA needed to find out three things. Has CIA documents had been part of Snowden’s haul? How long had Snowden been stealing documents? Had Snowden been working “with any foreign intelligence service, either wittingly or not?” According to Morell, the effort to get a direct answer from NSA officials to these three key questions “proved maddeningly difficult.” He found that in mid June NSA officials with whom he dealt were so “distraught at the massive security breach” that initially they even refused to allow CIA officers to participate in the on-going security review. A former NSA executive told me there was “near panic” at the NSA. Finally, Morell called Chris Inglis, a former professor of computer science who had risen to be the NSA’s Deputy Director at the time of the breach. Inglis, who headed operations for the NSA, told him “the news was not good.” Among the data copied by Snowden were a large number of CIA secrets. By the time, the CIA learned that its secrets had been compromised, Snowden was headed to Russia. The investigation of a crime involving potential espionage is no easy task. In this case, it required attempting to solve a jigsaw puzzle in which not only were key pieces missing but, since it involved adversary intelligence services, some of the found pieces might have been twisted to deliberately to mislead the US investigators. HOUSE_OVERSIGHT_020186

35 By late July, NSA investigators made their initial assessment. They determined that most of the material had been taken from sealed-off areas, known in intelligence-speak as “compartments,” which in this case were files stored on computers that were isolated from any network. Each compartment electronically tracked all the activities that occur in them on their logs, including the password identity of any person who has gained entry to any compartment. From a forensic examination of these logs, NSA investigators were quickly able to reconstruct the timeline of the theft. The logs showed that an unauthorized party had begun copying files in mid-April, which was just days after Snowden began his job at the Center. The breach illicit activity ended just before Snowden’s last day of work there. So this piece fit in with Snowden’s guilt. The size of the theft was another matter. Ledgett was certainly in a position to know. Not only had he been in charge of the National Threat Center at the time of the Snowden breach, but he personally supervised the NSA’s damage assessment team. And, in the shake-up that followed that followed, he would replace Inglis as Deputy Director of the NSA. According to Ledgett, the perpetrator, moving from compartment to compartment, had “touched” 1.7 million documents. Of these “touched” documents, according to the analysis of the logs, more than one million of them were moved in mid-May by the unauthorized party to an auxiliary computer intended to be used for temporary storage by authorized service personnel. Finally, the data was transferred from this auxiliary computer to thumb drives. This download occurred just days before Snowden’ left the NSA on May 17, 2013, having told the agency that he needed a leave of absence to undergo medical treatment in Japan. The FBI further established from airport records that Snowden flew to Hong Kong the next day presumably with thumb drives containing, by the government’s calculation, over one million documents. To be sure, the quantity of stolen documents does not necessarily reveal the damage, and can itself be misleading. Many documents that do not reveal current or known sources or methods and others may have little value to an enemy. And a large portion of the 1.7 million documents may have been duplications. But the quality of some of these documents is another matter. Just one document that exposed a source or method of which enemies are unaware can be of immense value. For example, one of the missing documents taken by Snowden provided what Ledgett called “a roadmap” to the NSA’s current secret operations. That single document would reveal to an adversary such as Russia, China or Iran, according to Ledgett, “what we know, what we don’t know, and, implicitly, a way to protect themselves.” And there were many documents in the Snowden breach that met these criteria, according to a National Security official at the Obama White House. The breach had happened on the watch of General Alexander, who headed both the NSA and the US Cyber Command, in 2013. A short, compact man with military bearing, Alexander closely followed the investigation as it developed over the summer of 2013. By then, of course, the whole world knew that Snowden had stolen a vast trove of NSA documents. But General Alexander saw major inconsistencies developing between Snowden own account of the theft and what had HOUSE_OVERSIGHT_020187

36 actually happened. To him, Snowden’s timeline, as established by the government’s investigators, did not match up to Snowden’s story line. “Something is not right,” Alexander said in an interview. What was wrong with Snowden's account proceeded from unresolved inconsistencies in both the timing and nature of the theft. For one thing, Snowden had made the claim to journalists, four months after he was in Russia, that he had turned over all the documents he took from the NSA’s compartments to journalists Laura Poitras and Glenn Greenwald in Hong Kong. However, on August 18, 2013, the investigators had the opportunity to examine the files that Snowden had actually given Poitras and Greenwald in Hong Kong. This discovery came when David Miranda, Greenwald’s romantic partner, was detained at Heathrow Airport by British Authorities under Schedule Seven of Britain’s Terrorism Act. At the time, as British intelligence presumably knew, Miranda was acting as a courier for Greenwald and Poitras. According to Greenwald’s account, Snowden had given both him and Poitras identical copies of the NSA documents in Hong Kong. When Greenwald returned home to Rio de Janeiro, he found his copy was corrupted. But Poitras still had her digital copy of whatever stolen documents that Snowden had distributed to them. So Greenwald dispatched Miranda from Rio to Berlin to get a copy of Poitras’ thumb dive. On the return trip, Miranda’s plane stopped at Heathrow and British authorities temporarily detained him and temporarily took the thumb drive from him. Poitras had written out the password for Greenwald, and Miranda kept it with the thumb drive. The British quietly copied the contents and shared them with the NSA. As a result, the NSA discovered that Snowden had only given Poitras and Snowden some 58,000 documents. By any measure, it was only a tiny fraction of Snowden’s total haul. The damage assessment team under Ledgett determined that some of these documents had been edited out of much larger documents that the NSA logs showed that he had copied. Snowden had evidently selected for the journalist’s only parts of the lengthy documents. For example, only scattered fragments of the 36,000 page “road map” file were among the material on the thumb drive. By the count of both the NSA team and the Defense Department team almost one million documents were unaccounted for. If Snowden had not given these missing files to Poitras and Greenwald, the issue of what had happened to them became a critical missing piece in the puzzle. Adding another layer to the mystery of the missing documents, the NSA investigation found that the chronology of the theft of documents did not support Snowden’s claim to journalists that he had only been seeking whistle-blowing documents. Most of the documents he first took did not concern the domestic activities of the NSA. It was only towards the end of the theft that he copied documents that would qualify as whistle-blowing. In fact, the now-famous FISA court order to Verizon that was the basis of the initial Guardian expose was only issued by the FISA court on April 27, 2013. The other main whistle-blowing document he revealed, the PowerPoint presentation about PRISM, a joint NSA-FBI-CIA Internet surveillance program, that was the basis of the Washington Post expose, was also only issued in April 2013. Yet Snowden had been HOUSE_OVERSIGHT_020188

37 down-loading documents for some 10 months before he copied these documents. When I discussed the chronology of the copied documents with a former government official briefed on the investigation, he suggested that Snowden’s purpose may have changed between 2012 and 2013. When I asked him what might have induced the change, he replied “That is one of the unanswered questions.” That Snowden only took these two whistle-blowing documents at the tail-end of his 9-month operation, and after he had contacted Poitras and Greenwald, suggests he may have had another motive prior to contacting journalists. In light of this chronology, the investigation had to consider the possibility that his whistle-blowing was, partly if not wholly, a cover for another enterprise. The investigation soon ran into another serious issue: his access. Snowden had described to journalists a situation in which he had access to“ millions of records that [he] could walk out the door with at any time with no accountability, no oversight, no auditing, the government didn’t even know they were gone,” but, as it turned out, he was not among the limited number of individuals at the Center who had access to these documents, The NSA’s and Booz Allen’s employment records showed that Snowden had not yet completed his requisite on-the- job training at the National Threat Operations Center in Hawaii when he carried out the theft. Consequently, he had not yet been provided with the passwords he needed to get the documents. A former NSA official bluntly told me that Snowden, at least during the period of the thefts in April and May 2013, had no more legitimate access to the compartments than the cleaning personnel at the Center. Somehow he converted his proximity to access. This lack of access could not be ignored in any law-enforcement investigation. Consider if a hundred top-quality D-flawless diamonds were stolen from locked vaults at Tiffany’s by a recently- hired trainee who, it turned out, did not have either the combination to open these vaults. One possibility that the police would be expected to consider was that the trainee might have had help from a current or former insider at the company who knew the combinations. Snowden had accomplished a similar inexplicable feat as the hypothetical jewel thief. In Snowden’s case, the FBI had to consider two very different possibilities that could explain how he could have acquired the password. He said in his video confession that he was solely responsible but there was another possibility. He had help, unwitting or witting, from others and he was trying to protect away from them. The FBI faced a dilemma. It could either assume that the NSA’s security regime was so badly flawed that Snowden could trick his fellow workers into providing him with access or that there was another individual at the Center who might have assisted or directed Snowden. If it pursued the former hypothesis, it could close the case as far as the sitting Grand Jury was concerned. After all, Snowden had admitted he was the perpetrator and, if further evidence was needed, he could be seen showing stolen documents to Greenwald on the video. And Greenwald later used these documents. For the Grand Jury, it was, as one former federal prosecutor put it, “a slam dunk.” Not even Snowden denied the charge that he gave secret documents to individuals that HOUSE_OVERSIGHT_020189

38 were not authorized to receive them, the same charge for which Manning was convicted. Even if it went no further, the FBI would satisfy its superiors in the Department of Justice that it had done its law-enforcement job. But if it pursued the latter hypothesis, it would need to engage in a mole hunt for a quarry that might not exist. By doing so, it could open a Pandora’s Box of suspicions that it, or the NSA, might not ever be able to close. When the investigation came to this fork in the road in the summer of 2013, according to a source on the House Intelligence Committee, it chose the former route. Finally, there was the question of whether Snowden had gone to Russia by design or accident. Whenever an intelligence worker steals sensitive compartmentalized information of interest to a foreign adversary and then defect to it, it raises at least the specter of state-sponsored espionage. It is acommonly accepted presumption in counterintelligence that a spy, fearing arrest, flees to a country that has some reason to offer him protection. When the British spies Guy Burgess, Donald Maclean and Kim Philby, for example, fled to Moscow in the Cold War the presumption was that they had a prior intelligence connection with Russia. And Philby confirmed it in his 1968 memoir “My Silent War.” So in the case of Snowden, counterintelligence had to consider the possibility that his theft of state secrets and his arrival in Moscow might not be totally coincidental. For his part, Snowden said that he did not leave Hong Kong with the intention of staying in Russia, but that the U.S. government “trapped him” at Moscow’s Airport by revoking his passport. He told editor of The Nation magazine: “I’m in exile. My government revoked my passport intentionally to leave me exiled.” He added that the U.S. government “chose to keep me in Russia.” Although he repeated that assertion over a dozen times, it was untrue. The US government had not invalidated his passport for travel back to the United States. When criminal charges are lodged against a U.S, citizen by the Department of Justice, the State Department, in accordance with the U.S. code of justice, marks in the electronic passport validation advisory system that that person’s passport is electronically marked valid only for return to the U.S. After criminal charges were filed against Snowden, including the theft of classified government documents, it advised foreign governments that Snowden was wanted on felony charges, and “should not be allowed to proceed in any further international travel, other than is necessary to return him to the United States." It was simply requiring that his passport, which is a State Department document, be used for him to return to the United States. Rather than preventing Snowden from returning to the United States, or “exiling” him, the government facilitated his return home. With his passport, he could have flown home from either Hong Kong or Moscow, where he, like any other person accused of a felony, would face the charges against him. Nor was it plausible that President Obama and Secretary Of State Clinton would conspire to trap a perpetrator carrying incredibly valuable national security secrets in Russia. The counterintelligence investigation had little difficulty establishing that Snowden’s trapped” version in the media was not consistent with the actual chronology of the events. Snowden claimed that the U.S. State Department had acted while the plane was flying to Moscow on June HOUSE_OVERSIGHT_020190

49 23” but in actuality it had acted on June 22, 2013, which was the day before the plane (or Snowden) departed from Hong Kong. The Hong Kong authorities had been advised as early as June 19, 2013 that there were criminal charges against Snowden and only a typographical error in spelling out Snowden’s middle name—James instead of John-- in the criminal charges prevented the Hong Kong police from immediately ordering his detention. His Hong Kong lawyers were advised of the pending charges, which were unsealed on June 21, 2013 and published on front page of the South China Morning Post in Hong Kong. So presumably Snowden knew that action by the U.S. government was imminent. One of his lawyers, Jonathan Mann, even accompanied Snowden to the airport out of his concern that he would not even be allowed by Hong Kong authorities to go through passport control. Although Snowden still had a US passport in his possession, the computerized database would show on June 23rd, it was no longer valid for travel to anywhere but the U.S. This electronic notification advised foreign government that his passport was only approved for his return to the U.S. Even so, when he arrived in Russia any future international travel decisions for him would be up to Russia, not the U.S. So the only government with the means to “trap” him in Russia was the Russian government. The U.S. government also knew that his it was no accident that Snowden wound up in the hands of Russia. He had been in contact with Russian officials in Hong Kong. Even before Putin admitted this liaison on September 3, 2013, the CIA knew about it. In fact, on June 23™, t, Senator Charles Schumer (D-N.Y.), correctly said based on a White House briefing that “Vladimir Putin had personally approved Snowden’s flight” to Moscow. As mentioned earlier, the NSA still had the capability to monitor Russian communication in June 2013. The messages, as well as the traffic, it intercepted from its sources reportedly revealed the Russian intelligence activity in Hong Kong. The NSA also reportedly intercepted contacts between these Russian officials and Russian representatives of Aeroflot, the Russian state-owned airline flying between Hong Kong and Moscow. Aeroflot, like most other international carriers, ordinarily requires international passengers to have both a valid passport and visa to the country of his destination. That those rules were waived for Snowden implicated Aeroflot in Snowden’s exfiltration from Hong Kong. All of which meant to investigators that Snowden’s defection to Moscow was not a haphazard result of unexpected circumstances. This raised new questions for the investigation. What led Snowden to defect to Russia? Was his arrival in Moscow planned by Russia intelligence in advance? Was any other party, such as China, privy to the plan? Was there a quid pro quo? US intelligence had some clues suggesting that Snowden’s path to Russia had been prepared for him in advance. On September 3, 2013, Russia’s President Putin gave a lengthy interview on state-owned Channel | television in which he divulged that he personally had had advance knowledge of Snowden’s plan. “I will tell you something I have never said before,” Putin said. Snowden "first went to Hong Kong and got in touch with our diplomatic representatives” and that he was told then that an American "agent of special services" was seeking to come to Russia. HOUSE_OVERSIGHT_020191

40 Putin then decided that this agent would be “welcome, provided, however, that he stops any kind of activity that could damage Russian-US relations.” Putin’s disclosure came as no surprise to the NSA investigation since the Russian pro-government newspaper Kommersant had reported that Snowden visited the Russian consulate in Hong Kong. Putin’s authorization could certainly account for Aeroflot waiving its usual passport and visa check to allow Snowden to board its plane. It also might explain the dispatch with which Russian officials whisked Snowden off the plane after it landed and into a waiting car at the Moscow airport. It could even account for Snowden’s vanishing from public view for the next three weeks and the promulgation of the cover story that Snowden was unwillingly trapped at the airport by the U.S. government. The reasons behind Putin’s move were less clear. By September 2013, the investigation was looking into a veritable abyss. Snowden’s culpability was no longer an issue. What was lacking from the video, or the 2-hour film made from it by Laura Poitras, was any specific information on how many documents he had copied, how he had obtained the passwords to the computers on which they were stored, the period of time involved in the theft, or how he had breached all the security measures of the NSA in Hawaii. Nor would that data be forthcoming from Snowden, who may be the only witness to the crime, By June 23, 2013, he was in a safe haven in Moscow. Even though the Grand Jury case against Snowden was cut and dry, it was also irrelevant because the US does not have an extradition treaty with Russia. The purpose of the intelligence investigation went far beyond determining Snowden’s guilt or innocence, however. Its job was to find out how such a massive theft of documents could occur how the perpetrator escaped, and, perhaps most urgent, who had obtained the stolen documents from Snowden. 2 When Snowden first met Greenwald and Poitras in Hong Kong on June 3™ 2013, he displayed in his hand, as a recognition signal. It was an unsolved Rubik’s Cube. It may also be an appropriate metaphor for the unsolved elements in the Snowden enigma. Even in his later interviews with journalists in Moscow, Snowden studiously avoided describing the means by which he breached the entire security regime of America’s most secret intelligence service. He only told the journalists who came to Moscow to interview him, with a bit of pseudo-modesty, that he was not “an angel” who descended from heaven to carry out the theft. But the question of how Snowden stole these documents may be the most important part of the story. The NSA, after all, furnishes communications intelligence to the President, his National Security advisers, and the Department of Defense that is supposedly derived from secret sources in adversary nations. If these adversary nations learn about the NSA’s sources, the information, if not worthless, cannot be fully trusted. The most basic mission of the NSA is to protect its sources. Yet, despite all its efforts, Snowden walked away with long lists of its sources. In doing so, he amply demonstrated that a single civilian employee working for an outside contractor, even HOUSE_OVERSIGHT_020192

4l one not having the necessary passwords and other access privileges, could steal documents that betrayed these vital sources. He also demonstrated that such a theft, which the NSA calculates exceeded one million documents, can go undetected for at least two weeks. If Snowden managed this feat on his own, as he claims in his Hong Kong video, it suggests that any other civilian employee with a perceived grievance against NSA practices or American foreign policy could also walk away with some of the most precious secrets held by US intelligence. Such vulnerability extends to tens of thousands of civilian contract employees in positions similar to the one held by Snowden. The lone disgruntled employee explanation is therefore hardly reassuring. If true, calls into question the entire multi-billion dollar enterprise of outsourcing the management of the NSA’s computer networks and other technical work to outside contractors. It also casts doubts on the post-9/11 decision by the intelligence community to strip away much of the NSA’s “stove- piping” that previously insulated the NSA’s most sensitive computers. Without such “stove- piping,” any rogue civilian employee could bring down entire edifice of shared intelligence. Nor would a finding by the investigation that Snowden had acted in concert with others in breaching compartments at the NSA be any more reassuring. Such collaboration among intelligence workers would reflect gravely on the mindset of the NSA. Snowden described an atmosphere in which intelligence workers exchanged lewd photographs of foreign suspects. Did this violation of the NSA’s rules also involve abetting the theft of documents? If so, the NSA would have to evaluate further vulnerabilities that might arise when it entrusts its secrets to technicians who do not share is values. A collaborative breach would signal an immense failure of the present concept of the counterintelligence regime in the NSA. From what I gathered from government officials who were familiar with the investigation, there was a concern that answering the “how” question could open up a Pandora Box of other issues concerning the very ability of the NSA to carry out its core mission of protecting the government’s intelligence secrets. However it was organized, it was that clear that Snowden had played a major role in what amounted to a brilliant intelligence coup. HOUSE_OVERSIGHT_020193

42 HOUSE_OVERSIGHT_020194

43 PART TWO SNOWDEN’S ARC “T woke this morning with a new name. I had had a vision. A dream vision. A vision righteous and true. Before me I saw Gamers shrouded in the glory of their true names...Step forth, and assume your name in the pantheon. It's always been there, your avatar's true name. It slips through your subconscious, reveals itself under your posts, and flashed visibly in that moment of unrestrained spite; in the indulgent teabag. You've felt it, known it, and recognized it. Now realize it. I woke this morning with a new name. That name is ... Wolfking Awesomefox” --Edward Snowden in Geneva, June 12, 2008. HOUSE_OVERSIGHT_020195

44 CHAPTER THREE Tinker “Tt’s like the boiling frog. You get exposed to a little bit of evil, a little bit of rule-breaking, a little bit of dishonesty... you can come to justify it.” —Snowden in Moscow, 2014 Edward John Snowden was born on June 21, 1983 in Elizabeth City, North Carolina. His parents, Lon Snowden and Elizabeth “Wendy” Barrett, according to their marriage records, wed when they were both 18 in 1979. The following year they had a daughter, Jessica. Lon Snowden, like his father before him, served in the U.S. Coast Guard. He was stationed at its main aviation base, where his father-in-law Edward John Barrett, was an officer and rising star of the Coast Guard. While Edward Snowden was still a child, his grandfather would become not only an admiral but the head of the Coast Guard’s entire aviation service. Admiral Barrett would be the only grandfather, Edward Snowden would ever know. His paternal grandfather died before he was born in a fatal car crash. He had had a drinking problem and killed a woman in a prior car crash.) When Lon was transferred to a Coast Guard base near Baltimore in 1992, the family moved to Maryland. Lon bought a two-story house in Croften, Maryland, a residential community very close to the NSA’s headquarters building at Fort Meade. The two children, Edward, who was nine, and Jessica, who was 12, were enrolled in local public schools in Croften. Jessica was a top student. She graduated high school, completed both her courses at University of Maryland and went on to law school, where she graduated with honors. Unlike his sister, Snowden experienced a string of failures in his education. In 1998, after only one year of classes, he dropped out of Arundel High School. According to school records, he stopped attending classes at the age of fifteen. He later attributed his absence from school to a medical problem, mononucleosis, but according to Robert Mosier, a spokesman for Anne Arundel County public schools, there is no record of any medical illness. Brad Gunson, who knew him before he dropped out of high school, recalled in an interview with the Washington Post only that he had a high- pitched voice, liked magic cards, and played fantasy video games. Nor did Snowden receive home schooling or ever get a high school diploma. Instead, Snowden became the product of a broken home. His parents were entangled in a messy divorce fight until he was seventeen. By this time Jessica had her own apartment. When his HOUSE_OVERSIGHT_020196

45 parents separated, Snowden’s mother, Wendy, bought a two-bedroom condominium in Elliott City, Maryland. She moved Snowden, along with his two cats, into the condominium. She remained in the family house while awaiting its sale. According to his neighbor Joyce Kinsey, Snowden, alone, stayed home almost all the time. From what she could observe, he spent long hours in front of a computer screen. At the age of 18, Snowden was still living by himself, while other teens his age went to college, Snowden now devoted a large part of his time playing fantasy games on the Internet. Posting under the alias “The TrueHooHa” on a web site called Ars Technica, he showed himself to be a passionate gamer. He was especially drawn to Anime, a graphically violent style of Japanese animation. These Anime games had by 2002 achieved a fanatic following in both Japan and the United States. He claimed special skills at Takken, a martial arts fighting game. He even went to Anime conventions in the Washington DC area. When he became a webmaster for Ryuhana Press, a website running these anime-based games, he described himself somewhat fancifully as a 37-year old father of two children, The only clearly true part of his description was that he was born on “the longest day of the year” (June 21). He also apparently valued changing his body. He wrote Internet posts under his TrueHooHa alias about how he used weightlifting and intensive training to precision-shape his body. He bragged to his online followers that he had reduced his “body fat percentage to between 9.5% and 10.5%” (which was less than half of the average for his age.) He appeared somewhat restless with his solitary life in a Maryland suburb in his almost daily postings. He expressed a longing to go to Japan. “I’ve always dreamed of being able to "make it" in Japan. I've taken Japanese for a year and a half,” he posted in 2002. Despite his claim of learning Japanese, there is no record of him taking any courses in Japanese. But it perhaps part of his yearning. He also wrote that he wore “cool” purple sunglasses, practiced martial arts and was a fan of Japanese cuisine. He described himself at one point, as if advertising his virtues, as having a “head of vibrant, shimmering blond hair (with volume).” In pursuit of an employment opportunity in Japan, he posted “I’d love a cushy gov job over there.” Eventually, he gave up on the idea of relocating himself to Japan because, as he explained in a post, he would have to put his cats in quarantine for six months. Snowden’s father meanwhile moved to Pennsylvania with his new wife-to-be. This left Snowden with only one male family member in the area, his maternal grandfather, Admiral Edward J. Barrett. Unlike Snowden’s virtual career on the Internet, where at one point Snowden invented for himself two fantasy children, Admiral Barrett became a real actor in the top echelon of US intelligence. After the Coast Guard, he moved to the Pentagon. He was actually in the Pentagon when a plane piloted by terrorists crashed into it on 9-11. He emerged unscathed and, by 2004, was a top official in the intelligence regime that operated the interrogation center at Guantanamo. HOUSE_OVERSIGHT_020197

46 Instead of seeking a job in Japan, Snowden sought to join the Special Forces through the 18X program. It was an Army Reserve program created in 2003 that allowed individuals who had not served in the military or completed their education, to train to be a Special Forces recruit. He listed his religion on the application as “Buddhist” because, as he explained in a sardonic post on Ars Technica, “Agnostic is strangely absent” from the form.” He enlisted in the army reserves on May 7, 2004, according to U.S. Army records. He reported for a 10 week basic training at Fort Benning, Georgia. That was standard course for all enlistees in the infantry. In August, he began a three-week course in of parachute jumping but did not complete that training. US Army records show he did not complete the training requirements and received no commendations. As Snowden put it in his Internet postings, he “washed out.” He was discharged on September 29, 2004, ending his 19 week military career. Snowden would later claim on the Internet that he returned to civilian life because he had injured himself by breaking both legs. An Army spokesman said, however, that he could not confirm that Snowden injured his legs or that he was in fact dropped from the program for medical reasons. Under his alias TheTrueHooHa he wrote that “they [the Army] held on to me until the doctors cleared me to be discharged, and then after being cleared they held onto me for another month just for shits and giggles.” He attributed this treatment in the Army, as he would later attribute his problems in the CIA and NSA, to the inferior intelligence of his superiors, He wrote in his post “Psych problems = dishonorable discharge depending on how much they hate you. Lots of alleged homos were in the hold unit, too, but they only got a general discharge at best.” It is not entirely clear whether or not Snowden actually injured himself. If he had broken his legs, it was not evident to Joyce Kinsey, his next door neighbor, who told me that she never saw Snowden on crutches when he returned to his mother’s condominium in September 2004. Whether or not he broke his legs, Army records show that he did not receive a medical discharge. He received an “administrative discharge.” Unlike a medical discharge which is given because a soldier has sustained injuries that prevent him from performing his duties, an administrative discharge is a “morally-neutral” form of separation given to a soldier when her or she is deemed for non-medical reasons inappropriate for military service. Snowden himself preferred to voice a medical explanation for his severance, just as he had claimed a medical reason for dropping out of high school (and would later claim he needed medical treatment for epilepsy at the NSA.) When he returned home from Fort Benning, Georgia on September 28, 2004, he was 21. Having failed in his attempt to join the Special Forces, he returned to his mother’s condominium in Elliott City, where he remained unemployed for several months. He took a job as a security guard at the University of Maryland’s Center for Advanced Study of Language. According to his Ars Technica postings, he worked the night shift from six in the evening to six in the morning. Because intelligence officers took its language courses, Snowden had to take a polygraph exam to get the job. After he passed it, he was hired and given his first security clearance But he had higher ambitions than being a campus security guard, It was only a temporary stop gap for him. HOUSE_OVERSIGHT_020198

47 He had ambitions of becoming a male model. He did not seem overly concerned about his privacy, posting pictures of himself “mooning” for the camera. He also posted provocative modeling pictures of himself on the Ars Technica website. He commented on his own beefcake- style pictures “So sexxxy it hurts” and “I like my girlish figure that attracts girls.” He approached a model agency called Model Mania. He had some concern about the photographer who “shoots mostly guys.” Snowden said in a post he was “a little worried he might, you know, try to pull my pants off and choke me to death with them, but he turned out to be legit and is a pretty damn good model photographer.” He posted the photographs on the Internet, commenting: “ I think I look pretty good in the shots, so it's kind of hard to get used to thinking of yourself in terms of being an element in a picture as opposed to just a picture of X." Despite his enthusiasm, the lack of any paid job offers dashed any hopes he had of a modeling career. He also began dating Lindsay Mills around this time. She was an extremely attractive 19-year old art student at the Maryland Institute College of Art. Jonathan Mills, Lindsay’s father, was an applications developer at the Oracle Corporation. According to him, she met Snowden on an Internet dating site. However they met, Snowden and Mills had much in common. They both had divorced parents who gave them a great deal of latitude in conducting their personal lives. Both of them were keenly interested in perfecting their bodies through exercise and diet regimes, Mills’ only paid employment over the next 8 years would be as a fitness and Yoga instructor in Maryland. They both also had ambitions to be models and neither of them had inhibitions about posing provocatively for photographers. They both also had a desire to travel to exotic places, including cities in Asia. Mills had spent four month in Guilin, China before meeting Snowden. As bleak as his prospects as a high school dropout may have seemed, he had an unexpected stroke of good fortune in the spring of 2006. The CIA, out-of-the-blue, offered Snowden a $66,000 a year job as a CIA communications officer. “I don’t have a degree of ANY type. In fact, I don’t even have a high school diploma,” Snowden boasted in May 2006 on the website Ars Technica under his alias The TrueHooHa. He added, with only a slight exaggeration, “I make 70K.” But how did Snowden get the job? The CIA’s minimum requirements in 2006 for a job in its clandestine division included a bachelor's or master's degree and a strong academic record, with a preferred GPA of 3.0 or better. Snowden had only completed one year of high school. He had never attended college. He said himself that he had “no degree.” So he had none of the requisite degrees for the job he got. CIA deputy director Ledgett said the CIA needed technical workers in 2006. But even if Snowden only applied in this capacity, which entailed a 5-year contract-term employment agreement, the minimum requirements for an intelligence technology job were a minimum of an Associates’ Degree awarded by a two-year Community college in Electronics and Communications Engineering Technology Computer Network Systems, or Electronics Engineering Technology. Candidates further must have a final GPA of at least 3.0 on a 4.0 scale HOUSE_OVERSIGHT_020199

48 from a fully accredited technical school or university. Snowden did not meet these standards. Lacking these qualifications, the CIA can make an exception only if a candidate had at least two years civilian or military work experience in the telecommunications and/or automated information systems field that are comparable to one of the requisite degree fields. , Even here, Snowden in no way qualified. He did not have the education qualifications or two-year work experience anywhere. In fact, his only paid work was as a security guard at a language school at the University of Maryland, and that job lasted less than one year. Under extraordinary circumstances, even the minimum requirements might be waived if the applicant had a distinguished military career and an honorable discharge. Snowden, however, did not complete his military training at Fort Benning, Georgia and received only an administrative discharge. The CIA, to be sure, had needed computer savvy recruits to service its expanding array of computer systems since 1990. By 2006, however, there was no shortage of fully-qualified applicants for IT jobs who met the CIA’s minimum standards. Most of them had university course records, work experience at IT companies, computer science training certificates from technical schools, and other such credentials they could provide the personnel office. The CIA, like the NSA, also obtained technicians with special skills for IT jobs from outside contractors. So it had no need for employing a 22-year old drop-out who did not meet its requisites. According to the former CIA station chief, the only plausible way that Snowden, with no qualifications, was allowed to jump the queue was that “he had some pull.” In 2006, Snowden was not without family connections. His grandfather, it will be recalled was Rear Admiral Barrett, who certainly was well-connected in the intelligence world. After 20 years service in the Coast Guard, Admiral Barrett joined an interagency task force in 1998, which included top executives from the CIA, FBI, and DEA. It had been set up to monitor any gaps in the US embargo on Cuba and, as one of its leaders, Barrett was in constant liaison with the CIA. Following the attack on the World Trade Center in NY in 2001, he joined the FBI as the section head of its aviation and special operations. In this capacity, he supervised the joint CIA/FBI interrogation of the prisoners in the Guantanamo base in Cuba which involved him in the rendition program for terrorist. As atop FBI executive in a liaison role with the CIA, he certainly had could have played a role in furthering his only grandson’s employment. The CIA, however, has not disclosed any information about whom, if anyone, recommended Snowden. All that is known is that in 2006 the CIA waived its minimum requirements for Snowden. However Snowden got his job at the CIA, it meant, as he pointed out from Moscow, that in 2006 his entire family was employed by the Federal government. His father Lon in 2006 was serving in the Coastguard; his mother Wendy was the administrative clerk for the Federal Court in Maryland; his sister Jessica was a research director at the Federal Judicial Center; and his namesake grandfather, Admiral Barrett, was still a top executive at the FBI. In a sense, Snowden had now entered the family business. HOUSE_OVERSIGHT_020200

49 Chronology2: The Snowden Thriller The Intelligence World, 2006-2014 June2006-Feb 2007 CIA Trainee, Langley, Virginia March 2007- Feb 2009 CIA Communications officer. Geneva, Switzerland June 2009-Sept 2010 DELL/ NSA Security instructor, Yokoda. Japan October 2010- March-2012 DELL/ NSA Computer platforms, Maryland—designing computer platforms April 2012- March 2012 DELL/ NSA System administrator, Oahu, Hawaii M arch 2012— May 2013 BOOZ ALLEN HAMILTON/ NSA Infrastructure analyst, Oahu, Hawaii October 2013— Present Unidentified Cyber Security Firm Unknown position, Moscow, Russia HOUSE_OVERSIGHT_020201

50 HOUSE_OVERSIGHT_020202

51 CHAPTER FOUR Secret Agent “Sure, a whistleblower could use these [computer vulnerabilities], but so could a spy.” --Edward Snowden in Moscow The sudden transformation of Snowden in 2006 from a night watchman on a university campus to secret agent for the CIA provided him with a powerful new identity and one much closer to the avatars he adopted for his fantasy games. It was burnished so deeply in his self- image that he cited it eight years in Moscow. When Brian Williams, then a NBC anchorman, began an hour-long NBC television interview with Snowden in 2014 by saying, “It seems to me spies probably look a lot more like Ed Snowden and a lot less like James Bond these days," Snowden approvingly smiled and told him, “I was trained as a spy in sort of the traditional sense of the word.” Snowden further confirmed his interviewer’s point, sating “I lived and worked undercover overseas, pretending to work in a job that I'm not, and even being assigned a name that was not mine." In reality, Snowden’s employment at the CIA was more prosaic. When he joined the CIA in 2006, he did not have the required experience in maintaining secret communication systems. So the CIA sent him to its information technology school for six months to train as a communications officer, not aspy. After completing his training, he was dispatched to the CIA station in Geneva, Switzerland. He worked there for the next two years as one of dozens of Information Technologists servicing the CIA’s communication channels in Switzerland. He was stationed there, according to Swiss registry records, under his own name from March 2007 to February 2009. He was identified as a US State Department employee in Geneva because Switzerland does not allow any intelligence officers to operate in that country. So officially he was attached to the permanent U.S. mission to the United Nations which employed hundreds of US government functionaries in Switzerland. It was a thin cover, since the Swiss government was aware that the CIA maintained its base in Geneva and posted it employees at the US mission, Although he would later claim in the video he made in Hong Kong that he had served as a “senior adviser for the Central Intelligence Agency,” he was merely a telecommunications support officer, or TSO in CIA parlance, which was a junior level job at the CIA. He worked as part of a 12 man team of information technologists under the supervision of senior CIA officers, according to a former CIA officer in Geneva. The job of these TSOs was to protect the security of the CIA’s computer systems through which the CIA station in Geneva sent and received its secret communications. As far as is known, Snowden made very few friends at the 800-person mission. The only person there to have publicly reported knowing him in Geneva during this HOUSE_OVERSIGHT_020203

AZ period is Mavanee Anderson, a young and attractive summer intern at the US Mission from May to August 2007. She described befriending Snowden, who, according to her, said that he was in the CIA and also demonstrated to her his martial arts skills. She later recalled in interviews that he was “a bit” prone to brooding and voiced growing dissatisfaction with the CIA. During his time in Geneva, he received no promotions or commendations for his work. In December 2008, he received an unfavorable evaluation from his superior and a “derog,” the CIA’s shorthand for a derogatory comment. He was also threatened with a punitive investigation unless he agreed to quietly resign from the CIA. “It was not a stellar career,” Tyler Drumheller, former CIA station chief told me in 2014. The job in Geneva did have its benefits, however. It provided him a generous housing and travel allowance. In many ways, it was the “cushy government job” he had said he was seeking in his Internet posts. He rented a four room apartment and had his girlfriend Lindsay Mills, now 21, join him there. According to his posts on the Ars Technica web site, he took full advantage of his compensation to live the high life. He gambled on financial developments in the option markets, losing and making substantial sums of money. He also bought a BMW sports car. While these BMW had a speed control to keep the car within the speed limit, he wrote that he illicitly disabled it so he could exceed this legal limit. He described in his posts other pursuits, including racing motorcycles it Italy and traveling around Germany with an Estonian rock star (who he did not further identify.) He also continued his fantasy life in Internet gaming. The gaming alias he chose was “Wolfking Awesomefox.” He even indulged in a fantasy gun sport called Airsoft, a variation of paint ball, in which participants used realistic looking pistols to splatter each other with paint. His good fortune came to an abrupt end in 2008. He suffered a massive loss in his options speculations. He wrote in a post that he had "lost $20,000 in October [2008] alone;” a sum which represented a substantial part of the $66,000 a year CIA salary. He blamed the US financial system, posting on Ars Technica that Ben Bernanke, the Federal Reserve chairman, was a “cockbag.” He also bet against any further rise in the stock market index, asking a user with whom he was chatting on the Ars Technica site in December 2008 to “pray” for a collapse of stock prices. When his correspondent asked him why he wanted him to pray for a decline, Snowden responded “because then I’Il be filthy fucking rich.” The stock market, however, continued to rise, and Snowden also lost this bet. Snowden lashed out at others on the Internet over these setbacks. He termed those who questioned his financial judgment as “fucking retards.” As with other setbacks, he blamed them on government officials. He even advertised them in Ars Technica, a closely-watched Internet forum, while serving in the CIA. Since the CIA was engaged in 2008 in highly sensitive operations to gather banking data in Switzerland-- one of which Snowden later disclosed to the Guardian—any Internet discussion by a CIA employee of financial losses could serve as a beacon HOUSE_OVERSIGHT_020204

53 to an adversary intelligence services on the prowl for a source. If any party was looking for a disgruntled US employees, Snowden’s Internet chatter about bad choices in gambling could arouse its interest. That Snowden used his TheTrueHooHa alias for these Internet posting would not prevent a sophisticated espionage organization, such as the Russian Intelligence service, from quickly uncovering that his true identity was Edward Snowden. Nor would it be difficult to place him at the CIA since, it will be recalled, he was listed by his true name on the roster of the US Mission to the UN. By consulting personnel records it would further emerge that he did not actually work for the State Department. Since it was no secret, at least to the Russian Intelligence services, that the US mission in Geneva housed the CIA station for all of Switzerland, it was probable that this brittle gambler who played the options market worked for the CIA. Even though it cannot be precluded that Snowden was spotted in Geneva by another intelligence service, there is no evidence, at least that I know of, to suggest that he was approached by one. Nor is there reason to believe that if he had been contacted by a foreign service in 2008, he would have responded positively. Despite his indiscreet posting about his outside activities, he apparently still respected the boundaries of secrecy that had been clearly defined in the oath he had taken in the CIA. For example, after the New York Times published an article revealing secret American intelligence activities in Iran on January 11, 2009, Snowden railed against the newspaper on the Internet under his True HOOHA alias, He wrote “This shit is classified for a reason... It’s because this shit won’t work if Iran knows what we are doing.” He clearly recognized that revealing intelligence sources was extremely damaging. As for the New York Times, he said “Hopefully they’ll finally go bankrupt this year.” When another Internet user asked him if it was unethical to release national security secrets, he answered,” YEEEEEEEEEES.” Nevertheless, he had his career-ending problem at the CIA. As with every CIA officer, he had to undergo a two year evaluation and take a routine polygraph test. It was then, in December 2008, that his superior at the CIA placed the “derog” in his file. The reason remains somewhat murky. According to a New York Times story by veteran intelligence reporter Eric Schmitt, Snowden’s superior had suspected that Snowden “was trying to break into classified computer files to which he was not authorized to have access.” Schmitt evidently had well-placed sources in the CIA. He said that he interviewed two senior American officials who were familiar with the case. According to what they told Schmitt, the CIA superior had decided to “send Snowden home.” Officially, however, according to a CIA reply to the New York Times report, Snowden had not been fired or accused of attempting to “break into classified computer files to which he did not have authorized access.” The discrepancy was explained to me by a former CIA officer who had also been at the US Mission in Geneva. He said that the spin the CIA put on the story was “necessary containment.” After the Snowden breach occurred in June 2013, the CIA had a problem which could, as he put it, “blow up in its face.” If Snowden had been fired but allowed to keep his secrecy clearance in 2009, the CIA’s incompetency could be partly blamed for the NSA’s subsequent employment of him. If he had broken into a computer he was not authorized, he should have been fired, if not arrested. What this spin glossed over, according to this former CIA officer, is the part of Snowden’s behavior that concerned his superior. Technically, HOUSE_OVERSIGHT_020205

54 Snowden, as a CIA communications officer, was authorized to use the computer system. The problem was that Snowden had deliberately misused it by adding code to it. This code could have compromised the security of the CIA’s “live system.” So while what the CIA public affairs officer said was correct, it clouded the issue. For his part, Snowden blamed his career-ending “derog” on an “e-mail spat” with a superior. From Moscow, he wrote James Risen of the New York Times that his superior officer ordered him not “to rock the boat.” Further, he complained that the technical team at the CIA station in Geneva had “brushed him off’ even though he had a legitimate complaint. When he complained about a flaw in the computer system, he said that his superior took vengeance on him. He said he added the code to the system prove he was right. He attributed the “derog” in his file to the incompetence, blindness and errors of his superiors. According to Snowden, he was a victim. This would not be the last time he faulted superiors for their incompetency. He would later say that the NSA experts who examined the documents that he had stolen as “totally incapable.” In any case, in February 2009, Snowden not only had a career-damaging “derog” in his file but he faced an internal investigation of his suspicious computer activities. According to Tyler Drumheller, the former CIA chief for Europe, such an internal investigation was not undertaken lightly or because of an “email spat.” He said that such an investigation was “a big deal” involving the CIA Office of Security in Washington and possibly the FBI. It would also result in the temporary suspension of his secrecy clearance. This left Snowden with little choice. If he wanted avoid the investigation, he had to resign from the CIA, which he did. That was the end of the security investigation. He was clearly bitter about the CIA, posting on Ars Technica on January 10, 2009, “Obama just appointed a fucking POLITICIAN to run the CIA!” (He was referring to Leon Panetta, President Clinton’s former chief of staff.) Snowden attributed the origins of his antipathy to US intelligence to his 2007-2009 experiences in the CIA. Snowden later told Vanity Fair that the 2009 incident in the CIA convinced him that working “through the system would lead only to reprisals.” "Much of what I saw in Geneva really disillusioned me about how my government functions and what its impact is in the world," he told the Guardian in June 2013. "I realized that I was part of something that was doing far more harm than good." Snowden, if not yet a ticking time bomb, was certainly a disgruntled intelligence worker before he ever got to the NSA HOUSE_OVERSIGHT_020206

35 CHAPTER FIVE Contractor “Private contractors don’t clear employees. The government does.”-- Admiral Michael McConnell, Vice Chairman of Booz Allen Hamilton Snowden, age 26, returned from Europe and moved into his mother’s condo. He was not only unemployed now, having resigned the CIA without qualifying for any benefits, but his financial state had been hurt by the huge losses he had suffered playing the options market in Geneva. His vision of himself as a secret agent, the unstoppable “Wolfking Awesomefox” may have also suffered. According to the narrative he later supplied to the Guardian, he had become deeply concerned about the immoral way in which the CIA conducted its intelligence operations in Switzerland. "Much of what I saw in Geneva really disillusioned me about how my government functions and what its impact is in the world. I realized that I was part of something that was doing far more harm than good," Snowden told the Guardian. By way of example, he said he learned that the CIA had gotten a Swiss banker drunk enough arrested to be arrested when he drove, so the CIA could compromise him. Snowden, who did not drink himself, was appalled at this ploy. Despite his growing antagonism towards the US government, he had not given up on, if not becoming a secret agent, working in the netherworld of secret intelligence. Although Snowden’s career had abruptly ended at the CIA, there still was a backdoor through which he could re-enter the spy world. It was private corporations that hired civilian technicians to work for spy agencies as independent contractors. By 2009, The CIA, NSA and other US intelligence services had outsourced much of the job of maintaining and upgrading their computer systems to these private companies. They supplied the NSA with most of its system administrators and other information technology workers. This arrangement allowed the NSA to effectively bypass budget limits and other restrictions limiting how many NSA technicians it could recruit. Instead, of putting these workers on its own payroll, they nominally worked for, and received their paychecks from, private employers. In fact, many of these outside contractors worked full-time for the NSA. Snowden applied in April 2009 to one of these private companies, Dell SecureWorks. It was a subsidiary of the Dell computer company. To diverse out of manufacturing computers, Dell had recently gone into the business of managing government computer systems for the NSA and other intelligence services. As a leading specialist in the field of corporate cyber security, Dell had no problem obtaining sizable contracts for from the NSA’s Technology Directorate. In 2008, the NSA had in effect outsourced to Dell the task of re-organizing its back-up systems at its regional bases. Now Dell had to find thousands of independent contractors to work at these bases In 2009, when Snowden applied, Dell was seeking to fill positions at the NSA’s regional base in HOUSE_OVERSIGHT_020207

56 Japan. It first had to find technicians willing to go to Japan. Since Snowden had a long-time interest in going to Japan, he was more than willing to relocate to Japan. He had little problem obtaining the job. Aside from his family connections, he had a single compelling qualification for the job—a top secret clearance. For an outside contractor such as Dell, such a security clearance was pure gold. If a potential recruit lacked a top secret clearance, before Dell could deploy him or her at the NSA, it needed a wait for the completion of a time- consuming background check. Ifa recruit already had one, as Snowden did, he could begin working immediately. The reason that Snowden still had his secrecy clearance, despite his highly-problematic exit from the CIA, was that the CIA had instituted a policy a few years earlier that allowed voluntarily- retiring CIA officers to keep their secrecy clearance for two years after they left. This “free pass,” as one former CIA officer called the two year grace period, had been intended to make it easier for retiring officers to find jobs in parts of the defense industry that required secrecy clearance. This accommodation, in turn, made it easier for the CIA to downsize to meet its budget. Not only did Snowden retain his security clearance, but unlike when he had applied for his job at the CIA in 2006, he now could list on his resume two years experience in information technology and cyber security at the CIA. All Dell could check was a single fact: Snowden was indeed employed at the CIA between 2006 and 2009. His CIA file, which contained the “derog,” was not available to Dell or any other private company. Even though the CIA had “security concerns” about Snowden, as CIA Deputy Director Morell noted, it could not convey them to either Dell or the NSA. “So the guy with whom the CIA had concerns left the Agency and joined the ranks of the many contractors working in the intelligence community before CIA could inform the rest of the IC about its worries,” Morell explained. “He even got a pay raise.” Obviously, this was a glitch in the security system but, as a result of it, Snowden entered the NSA by the back door only five months after being forced out of the CIA. For the next 45 months Dell assigned him various IT tasks at the NSA. In June 2009, he was sent to Japan to work in the NSA complex at the Yokota air base outside Tokyo. He moved into a small one bedroom apartment in the nearby town of Fussia. His initial job for Dell was teaching cyber security to Army and Air Force personnel. In this capacity, he instructed US military officers stationed at the base in how to shield their computers from hackers. Such security training had been required for military personnel dealing with classified material after several successful break-ins to US military networks by China, Russia, and other adversary nations. Although it finally brought him to Japan, it was not a challenging or interesting job. But Snowden found diversions in Japan. In July 2009, he was joined in Japan by Lindsay Mills. She had become an amateur photographer, specializing in arty self portraits. She also saw herself as a global tourist, writing in her blog after arriving in Japan that had she travelled to 17 HOUSE_OVERSIGHT_020208

oF countries. Like Snowden, she also deemed herself, tongue and cheek, a “super hero.” In this sense, her Internet avatar, was a match for Snowden’s “Wolfking Awesomefox,” In Japan, Mills and Snowden spent time with another American couple, Jennie and Joseph Chamberlin, who also worked at the Yokota base. Jennie, a sergeant in the public affairs section of the US Air force, had been at Art College with Mills, and called herself in her blog the “Little Red Ninja.” Her husband, Joseph Chamberlin was a decorated US Navy pilot who now flew highly-sensitive intelligence-gathering missions from the Yokota base. When Lindsay Mills arrived she made contact with Jennie, who in the next few weeks showed her many of the sights of Tokyo. Jennie described Lindsay in her blog as her “super-model friend.” The two couples also went on expeditions in Japan together. Joseph Chamberlin had a car and, as far as is known, he and his wife were the only Americans at the base with whom Snowden socialized. On August 17, 2009, the foursome attempted to walk up Mount Fuji, but they got lost en route to the tourist site. Giving up on Mount Fuji, they wound up in the Mount Fuji gift shop. Jennie described the misadventure in her Little Red Ninja blog: “Our adventure started off a little rocky with our attempts to find the interstate. Alas, our iconic mountain was obscured by cloud. A short stop at the Mt. Fuji combination soba noodle stand/gift shop was enough to whet our appetite for the further exploration that is to come.” The photographs that day show Snowden wearing Hawaiian shorts, and a black tank top emblazoned with an eagle and the letters USA. They also show Mills wearing safari shorts, a brown sweater and what appears to be an engagement ring (possibly to allay suspicions about her living with Snowden.) “Ed was looking rather rednecky,” Lindsay commented on one the photograph. Snowden described her, in turn, as “nerdy.” Finally, after posing for photographs, they found the Suyama-guchi path. But they never made it to the top. Back in Tokyo, Snowden was still seeking to advance himself. He attempted to get a college certificate by enrolling in a summer on-line course at the University of Maryland’s Asia program. But, according to the program’s record, he did not succeed in receiving any credit or a certificate from the on-line University. Finally, in October 2009, Dell assigned Snowden a job in which he had direct access to the NSA’s computers. His new position was a system administrator, which is essentially a tech-savvy repairman. Dell was working on backup system code-named EPIC SHELTER. For this contract, Dell was transferring large chunks of data from the NSA’s main computers in Maryland to back- up drives in Japan so if there was a communications interruption the system could be quickly restored. Since most of the classified data was in its encrypted form, it had little value to any outside party. Snowden’s job was to maintain the proper functioning of computers but, as a system administrator, he also had privileges to call up unencrypted files. He sat in front of a computer screen all day looking for any problems in the transferring files to back-up servers. The work was highly-repetitive and exceedingly dull. Snowden found time to search for anomalies in the system and he claimed to have spotted a major flaw in the security system in late 2009. The flaw was that a system administrator in Japan worked as a singleton and could steal secret data HOUSE_OVERSIGHT_020209

58 without anyone else realizing that it had been stolen. It intrigued him enough for him to bring it to the attention of his superiors, as he later said. Snowden saw that a rogue system administrator like himself could use his computer privileges to download and steal documents in ways that would go unnoticed. The emergence of a rogue system administrator was not that farfetched in 2009. Hacktavists such as Julian Assange had adopted the battle cry: system administrators, or “syst admins of the world unite.” Instead of asking them to “throw off their chains,” as Marx did, he asked them to send classified documents about secret government activity to the Wikileaks site. Snowden recalled in Moscow in 2014: “I actually recommended they [the NSA] move to two- man control for administrative access back in 2009.” To make his point even clearer, he added: “A whistleblower could use these things, but so could a spy.” Not without irony, Snowden himself became that rogue system administrator some three years later at Dell. In fact, he later used the vulnerability he pointed out to steal NSA documents at Dell (before moving to Booz Allen.). In September 2009, Snowden made a ten day trip to India. He later said he was on an official visit “working at the US embassy.” He was still on the Dell payroll. Hotel records show that he arrived at the Hyatt Regency hotel in New Delhi on September 2™ from Japan, and at 3:30 pm on September 3", checked into the Koenig Inn, a facility that was an annex to Koenig Solutions, a school that gave crash courses on programming and computer hacking. According to Rohit Aggarwal, the head of the school, Snowden stayed there until September 10" while taking classes with a private instructor. It cost $2,000 in tuition and fees, which Snowden prepaid from Japan with his own personal credit card. Even though Snowden later said he only took courses in “programming,” the school’s records show that during that week he took intensive courses in sophisticated hacking techniques. Although the course was entitled “ethical hacking” that was also a euphemism for teaching the techniques of illicit hacking. The course provided tutoring on hacker’s tools, such as “Spyeye” and “ZeuS,” that are used to circumvent security procedures. It also demonstrated how these hacking tools could be customized by criminals and spies to break into files, plant surveillance programs, impersonate system administrators, assume the privileges of system administrators in a network, and capture the passwords of others. On September 11", Snowden, according to hotel records, left India for Japan. While the stated purpose of the hacking training was to allow security consultants to detect intruders, it also prepared Snowden to be, if he chooses to be, an intruder in the NSA system. One problem with working as a contractor is that the standard two-year contracts are not necessarily renewed, making a contractor’s job essentially temporary employment. Nor is there much possibility for advancement for IT workers. As one contractor told me “It is a dead end job with great pay.” In the fall of 2010, Snowden’s contract in Japan with Dell SecureWorks came to anend. Dell then offered Snowden a new position in the United States. He now was assigned to work at Dell headquarters in Annapolis, Maryland. He rented a modest suburban house shaded by a Sakura cherry tree in suburb of Annapolis, Maryland. Mills HOUSE_OVERSIGHT_020210

ag meanwhile was attending a two-week fitness training course at a Yoga camp that qualified her to be a yoga instructor. She then moved in with Snowden. Even though she had been living on and off with Snowden during the past two years abroad, including while he worked at the CIA in Switzerland and the NSA in Japan, they had not shared a home in America up until now. The now 25-year old Mills posted on Instagram “Finally in our first US place together.” She also put on line pictures of him in bed with her, who she now affectionately referred to in her posts as a “computer crusader.” Dell meanwhile had him to work on problem- solving for its corporate clients. In preparation for his corporate role, he shaved off this facial hair and, with Lindsay’s help, bought a Ralph Lauren suit. These corporate clients were assisting the NSA, the CIA, and the Defense Intelligence Agency (DIA). Consequently, Snowden dealt with a wide range of intelligence officers, and gave presentations on the vulnerabilities at computer security at the DIA-sponsored Joint Counter Intelligence seminar. His dealings with these US intelligence officers in no way mitigated his resentment of the intelligence establishment. What began at the CIA in 2009 as objections to what he saw as the incompetence of his superiors grew into well-articulated disapproval of the way that the US government conducted its intelligence. He found NSA surveillance particularly worrisome, later telling the Guardian: "They [the NSA] are intent on making every conversation and every form of behavior in the world known to them." He claimed after defecting to Moscow that he had voiced his concerns about what he considered illicit surveillance to ten NSA officials, “none of whom took any action to address them.” The NSA can find no record of these complaints but if Snowden had indeed complained to these officials while working for Dell, his superiors at Dell either didn’t notice or care that they had a very disgruntled employee on their hand. He also made no secret of anger at the US government and the corporations that served it on the Internet. He railed on the Ars Technica site against the complicity of private corporations, such as Dell, that assisted the NSA. In his on-line posts in 2010, Snowden expressed loathing for the assistance that corporate America was providing the intelligence community. “It really concerns me how little this sort of corporate behavior bothers those outside of technology circles,” he wrote under his True Hoo-ha alias. He said he feared that America was already on “a slippery slope,” and suggested, perhaps adumbrating his own later actions, that this corporate assistance to US intelligence “was entirely within our control to stop.” What the “computer crusader,” as Mills had playfully called him in her Internet postings, expressed in these angry Internet postings was an almost obsessive concern over individuals freely submitting to government authority. “Society really seems to have developed an unquestioning obedience towards spooky types,” he wrote on Ars Technica without mentioning that he himself worked for a corporation, Dell that assisted spy agencies. He asked rhetorically on this public forum whether the sinister slide towards a surveillance state “sneaked in undetected because of pervasive government secrecy?” The outright contempt he expressed towards this “government secrecy” in no way prevented him from seeking even more secret work at Dell for the intelligence services. In February 2011, HOUSE_OVERSIGHT_020211

60 after his CIA security clearance ran out, he applied to renew it. A new clearance required a new background check and filling out (again) the government’s 127-page standard form 86. Since 1996, background investigations for the NSA, like much of the computer work at the NSA, had been outsourced to a private company. It had proceeded from the effort of the Clinton Administration to cut the size of the government by privatizing tasks that could be more efficiently done by for profit companies. US Investigations Services, or USIS as it is now called, which won the contract for background checks, was initially owned by the hedge fund Carlyle Group who later sold it to another hedge fund, Providence Equity Partners. For the hedge funds, profits were the measure of success. To increase its profits from the contract with the NSA, USIS had to move more quickly in concluding background checks since it did not get paid more extensive investigation. In 2006, the government learned USIS’s background checks were often prematurely ended. In Snowden’s case, as USIS did not have access to Snowden’s CIA personnel files, it did not learn about the pending security investigation of him. Nor did it learn from the Internet that he was a disgruntled employee. So Snowden’s new clearance was approved in the summer of 2011, allowing him to continue working for Dell on secret intelligence projects. Meanwhile, in August 2011, Mills began her own blog entitled “L’s Journey.” In it, she described herself as “a world-traveling pole-dancing super hero.” By now, she was an accomplished photographer, specializing in taking self-portraits. Many of her posted pictures were provocative poses of herself in her underwear and various states of undress. She wrote: “T’ve always wanted to be splashed on the cover of magazines, with my best air-brushed look.” Her wish would be gratified two years later in way she did not anticipate. For his part, Snowden seemed happy to encourage her fantasy about being a super hero. He even gave her a Star-Trek-inspired head visor. Despite all the concerns he voiced about privacy, he did not seem to mind her provocative posts. On the contrary, he took photographs of her, telling her, at one point, that her photographs were not “sexy” enough. Snowden meanwhile got offered by Dell a new position at an NSA Kunia regional base in Hawaii. Dell, which was in the process of expanding its government consulting business, wanted him to be a system administrator on the NSA’s back-up system. The NSA needed this system before it could upgrade new security protocols that would audit suspicious activity in real time. In Hawaii, as in Japan, system administrators still worked as singletons. As Snowden had seen when working in Japan this solo work in an unaudited workplace provided an opportunity for a system administrator like himself to steal documents. So he may have also realized that as a solo system administrator in Hawaii, he would have this opportunity. In any case, on March 15, 2012, he accepted the offer. Dell agreed to pay all his relocation expenses and provide him with a housing allowance. He found a 3-bedroom house in Hawaii on-line, and arranged to move there on April 2, 2012. 1t was located at 94-1044 Eleu Street in the upper-middle class suburb of Waipahu, only a few HOUSE_OVERSIGHT_020212

61 blocks from the Royal Kunia country club. It had a master bedroom with a walk-in closet, a patio deck in back shielded from public view by a clump of palm trees and a large garage with an automatic door. The move to Hawaii entailed a brief separation from his girlfriend since Mills had committed her to attending her girlfriend’s wedding in May. After he left for his new assignment, she wrote on Instagram, “Sex toy party and then saying goodbye to my man -- well not goodbye so much as see you in two month/s.” HOUSE_OVERSIGHT_020213

62 CHAPTER SIX Thief “We begin by coveting what we see every day” —Hannibal Lecter, The Silence of the Lambs In Hawaii in 2012, Snowden was living a very comfortable life. He was earning from Dell just over $120,000 a year. His housing allowance from Dell paid the rent on his 1,559 square- foot house. He had also leased a sporty car. Looking back at this period of life from Moscow, he said he had been “living in paradise.” He went to work five times a week, a 15 minute trip drive through a lush landscape with sugar plantations. After passing through security, he parked his car in a sprawling parking lot, and entered the underground part of the NSA base known as “the tunnel.” He said in describing the atmosphere, “You’re in a vaulted space. Everybody has sort of similar clearances, everybody knows everybody. It’s a small world.” He said that to relieve the tediousness of the work, every two months or so his fellow workers would pass around a naked picture that showed up on their screens. He explained: “You've got young enlisted guys, 18 to 22 years old [who] suddenly been thrust into a position of extraordinary responsibility where they now have access to all of your private records. In the course of their daily work they stumble across ... an intimate nude photo of someone in a sexually compromising position.” Snowden, as will be recalled, was no stranger to posting lewd photographs. Before he joined the CIA, he had posted pictures of himself mooning on the Internet. He also knew that copying any files, including photographs, was a violation of NSA rules. But he did not report this illicit activity at the NSA even though he later claimed that it occurred regularly. He joked in his Moscow interview with the Guardian that some of the nudes were “extremely attractive” and that viewing them was, as he put it, “a sort of the fringe benefits of surveillance positions.” Snowden also had an interest in American politics. He identified with the Libertarian Party, and at the NSA he made no effort to conceal his political support of its causes. He became an active partisan of Congressman Ron Paul, the leading figure in the Libertarian Party in 2012. “He's so dreamy,” Snowden posted on the Ars Technica site in March 2009 (just after he registered to vote in North Carolina.) Since Paul was running as a Presidential candidate in the 2012 Republican primaries, Snowden sent the Paul election committee a contribution of $500. Snowden’s attraction to the Libertarian ideology of Ron Paul was not that surprising. At the core of Paul’s libertarianism was a deep hostility to the intrusion of the government into private lives. Snowden shared this same hostility towards government authority, as was clear from his Internet postings. Like other libertarians, Snowden believed that citizens should not be shackled by HOUSE_OVERSIGHT_020214

63 Federal law. He later told a Libertarian gathering, at which Ron Paul also spoke, “Law is a lot like medicine. When you have too much it can be fatal." Paul also ardently opposed any form of gun control. Not only did Snowden support this position in his Internet postings, but so did his girlfriend Lindsay Mills in her own on-line postings. Most relevant to his future activities at the NSA, Snowden whole-heartedly agreed with the position of Paul on the dangers inherent in government’s surveillance of US citizens. Paul described the CIA, the organization which had forced Snowden out, as nothing short of a “secret government” and that "In a true Republic, there is no place for an organization like the CIA." He also railed against NSA surveillance. As is clear from Snowden’s Internet postings, he, like Ron Paul, expressed doubts about the competency of the intelligence agencies of the U.S. government. Snowden’s own disillusionment about the government may have begun with his rejection, and perceived mistreatment, by the Special Forces of the US Army. It was almost certainly reinforced by his ouster from the CIA. He later told the Guardian that he was disillusioned as early as 2007 when he learned about the CIA’s methods in compromising Swiss citizens. He also told the New York Times after he arrived in Moscow that he came to realize while working in the CIA that any attempt redress these wrongs against him by working through the system would only lead to further punishment for him. His critical view of the US government only hardened during the years he worked at the NSA. He described his NSA superiors as “grossly incompetent,” as he later explained to a journalist from Wired magazine in Moscow. At the NSA, he said employees were kept in line by “fear and a false image of patriotism.” He said that he saw his fellow workers cowed into “obedience to authority” and his superiors induced to break the law. He became particularly concerned with what he called the “secret powers” of the NSA. He saw them as “tremendously dangerous.” By this time, Snowden was fully aware that that the NSA conducted domestic surveillance because he had used his privileges as a system administrator in 2012 to obtain the NSA’s inspector general’s report on a 2009 surveillance program. Nevertheless, Snowden continued to work at the NSA, where he was, as he put it, “making a ton of money.” Mills joined him in his “paradise” in June 2012, shortly before his 29" birthday. Just before leaving Annapolis, Maryland for Hawaii, Mills posted a semi-nude picture of herself on her blog, “L’s Journey.” In it, her face was covered with a blanket. The caption under it read: “Trying to avoid the changes coming my way.” In Honolulu, she found “E,” as she called Snowden in her blog, “elusive.” She found that he preferred to stay at home and avoided meeting other people to the point that her friends “were not quite sure that E. existed.” At best, one of Lindsay’s friends in an acrobatic class caught a glimpse of Snowden picking her up one afternoon. Even though Mill’s dated Snowden for eight years, most of her friends, with the exception of Jennie and Joe Chamberlin in Japan, had never met Snowden. If he had other social interactions in Hawaii, no one he met came forward and spoke of meeting him even after he became world famous. HOUSE_OVERSIGHT_020215

64 Two days after his 29" birthday dinner on June 21st, she described him playfully as a “goof.” She wrote in her blog:”The universe is telling me something and I'm pretty sure it's saying get out, Fuck you Hawaii.” In early July, she summed up her shaky situation with Snowden, in another blog, writing: “I moved to Hawaii to continue my relationship with E. [but] it has been an emotional roller coaster since I stepped off the plane.” She also found it odd that Snowden would work on his computer at home hooded under a blanket, as she would later tell the FBI. She diverted herself by organizing a pole dancing studio in the 400 foot garage of the house. She also joined a New Age yoga studio called “Physical Phatness,” a local acrobatic performance group, and, on Friday nights, pole-danced at the Mercury lounge in downtown Honolulu. That same July, Snowden had other things on his mind, including an attempt to advance himself. Although his position at Dell as a system administrator was a well-compensated one, especially for a 29 year old with no formal education, it carried little prestige. He sat from 9 AM to 5 PM in a windowless room watching a bank of monitors in the so-called “tunnel” at the NSA. Many of those who worked him were, as he described them, “eighteen year old soldiers. Presumably, they had little interest in discussing with him the weightier issues of the world. Working as an outside contractor was also a dead-end job that hardly matched the vision he had of himself in his Internet postings. In real life in a cubicle in the NSA, he decidedly was not the “Wolfking Awesomefox” heroic image he had of himself in his dream vision. Whatever his motive, he decided to apply for a position in the NSA itself. He apparently believed that if he scored high enough in its entrance exam, the NSA would invite him to join it as a Senior Executive Service officer, or SES, which was the civilian equivalent in rank and pay to a flag officer in the US armed forces. To achieve this SES job, Snowden used his privileges as a system administrator at Dell to hack into the NSA’s administrative files and steal the answers to the NSA exam. As the NSA’s subsequent post mortem would find out, it was the first known document that Snowden took at the NSA. But it was not the first time he had used his hacking skills to attempt to advance himself. At the CIA in 2009, as he late said in Moscow, he had added text to his annual evaluation in what he termed “a non-malicious way” to prove a point. His CIA superior took a much darker view of that incident when the hack was detected, calling for an investigation that, it will be recalled, ended Snowden’s CIA career. At the NSA his intrusion, however, was not detected for almost a year. “He stole the [NSA] test with the answers, and he took the test and he aced it,” former NSA Director Michael McConnell recounted in a 2013 interview, “He then walked into to the NSA and said you should hire me because I am this good on the test.” The issue of why he attempted to gain entry into the upper ranks of the NSA in the late summer of 2012 is less clear. If his Internet posting and Libertarian riffs are an indication of his state of mind in 2012, he was hostile to the surveillance activities of the NSA. If so, it made little sense he would seek a permanent career in the NSA. If this attempted career is considered in light of the career move he made six months later in March 2013 which, as he himself admits, was for the express purpose of getting at tightly-held documents stored on computers that were not HOUSE_OVERSIGHT_020216

65 available to him in his job at Dell, he may have been seeking wider access in 2012 for a more nefarious purpose than a NSA job. In any case, despite the near-perfect high grades he scored, the NSA did not offer him a position in the senior executive service job. While Snowden may have believed such results would elevate him, the NSA’s offer did not meet his expectations. “It was totally unrealistic for Snowden to expect to get a SES position,” a former senior NSA officer told me. Snowden ambitions may have been disappointed in this instance, but it did not prevent him from later claiming that he had been a senior adviser to the CIA and also a senior adviser to the Defense Intelligence Agency. Instead of an SES position, the NSA offered a lowly G-13 job as an information technology worker, which was not an improvement on his job at Dell. He took this slight as evidence of the NSA’s incompetence, subsequently joking to a reporter in Moscow that his ability to steal the test answers should have been seen as a qualification for the NSA job. In September 2012, he turned down the NSA offer. If he was to advance himself now, he had to find a new way. HOUSE_OVERSIGHT_020217

66 CHAPTER SEVEN Crossing the Rubicon “What I came to feel is that a regime that is described as a national security agency has stopped representing the public interest and has instead begun to protect and promote state security interests. “ --Edward Snowden, interviewed in Moscow 2014 Soon after Snowden failed to get a SES job at the NSA, he intensified his rogue activities. At that time, Dell was tasked with building an enhanced backup system for the NSA in Hawaii. Deputy Director Ledgett explained that part of Snowden’s job as a system administrator under contract to Dell was transferring files held at Fort Meade to back-up computers in Hawaii. He “was moving copies of that data there for them, which was perfect cover for stealing the [NSA] data.” Snowden took advantage of this cover. Snowden expanded his own rogue operation, as Ledgett reconstructed the breach, through the fall and winter of 2012. There was little risk of him getting caught. The security measures at the Hawaii base presented no obstacles to him since, as a system administrator, he had privileges that allowed him to copy documents that had not been encrypted. Indeed, it was part of the process of building the backup system. The flaw he had pointed to in Japan in which system administrators working solo could safely steal files also existed in Hawaii. This time, however, instead of bringing it to the attention of the NSA, he used it to himself steal files. He could be confident that his 2012 thefts of documents would go undetected because the NSA’s base had not yet installed an auditing system. Such real-time auditing of the movement of documents, which was done at NSA headquarters in Fort Meade and most of the NSA’s regional facilities, had not yet been installed at the Hawaii base because a lack of bandwidth prevented the safe upgrading of the software. This auditing software was scheduled to be installed after the backup system was completed in 2013. The Kunia base was one of the last NSA bases which did not monitor suspicious transfers of files on a real-time basis. Snowden certainly was certainly aware of this deficiency. He later pointed out in his interview in Wired magazine in Moscow that the NSA base where he worked did not have an “audit” mechanism. This security gap allowed Snowden, using his system administrator’s credentials, to copy classified data to a thumb drive without anyone being able to trace the copied data back to him. And, according to the NSA’s subsequent damage assessment, he stole many thousands of pages while working for Dell in 2012 before he contacted journalists. Deputy Director Ledgett subsequently reported that the NSA analysis the 58,000 documents that were given by Snowden to journalists in June 2013 showed that most of them were taken by Snowden while he was still working at Dell. HOUSE_OVERSIGHT_020218

67 This 2012 theft was made even more serious by the interconnection of NSA computers with those of other intelligence agencies. It will be recalled that prior to the 9/11 attack in 2001, NSA data had been protected by “stove-piping” that separated NSA’ computers from networks used by other intelligence services. After the 9/11 Commission concluded that part of the reason why US intelligence agencies were unable to “connect the dots” in advance of the attack was because this “stove-piping, the NSA stripped away a large part of its “stove-piping.” One result was that the NSANet, which Snowden had access to at Dell in 2012, became a shared network. It had common access points. General Hayden described them to me as the equivalent of “reading rooms” in a library. They served as a means for NSA workers to exchange ideas about the problems they were encountering on various projects for the intelligence community. In maintaining them, system administrators, or “system admins,” like Snowden acted as the “librarians.” If a stem administrator copied data from this network, no one knew. For Snowden, the NSANet, which included CIA and Defense Department documents, provided a rich hunting ground for Snowden in the fall and winter of 2012. Many of the documents he took off the NSANet revealed not only operations of the NSA but also those of the CIA and Pentagon. By taking them he had come to a Rubicon from which there would be no return. He later explained in an email to Vanity Fair from Moscow, “I crossed that line.” As far as is known, he was not sharing them with any other party prior to May 2013. He was not even yet in contact with Poitras, Greenwald or any other journalists. Presumably, Snowden was collecting them drives, despite the risks that possessing such a collection of secrets might entail, for some future use. But why would Snowden jeopardize his career and, if caught, his freedom, by undertaking this illicit enterprise? He may have had by now strong ideological objections the NSA’s global surveillance. As he said later in Moscow, “we’re subverting our security standards for the sake of surveillance.” But ordinarily even ideologically-opposed employees don’t steal state secrets and risk imprisonment. If they are disgruntled, they seek employment elsewhere. Certainly, Snowden, with his three years experience working for Dell, would have little problem finding a job as an IT worker in the booming civilian sector of computer technology. Instead of resigning, he sought to widen his access to NSA documents. This behavior suggests to me that he had another agenda. One possible clue to it is the first document he took; the NSA exam. The secret in that document, the answers to the questions, were a form of power to him: power to burrow deeper into the executive structure of the NSA. It would unlock the door to door to even the more powerful documents containing the NSA’s sources stored in Level 3 compartments. His later actions demonstrated that he equated the possession of such secrets with personal power. For example, after he arrived in Moscow in 2013, he bragged to James Risen of the New York Times that he had access to secrets that gave him great leverage over the NSA. He told him specifically his access to “full lists” of NSA’s agents and operation in adversary countries could, if revealed, closed down the NSA’s capabilities to gather information in them. HOUSE_OVERSIGHT_020219

68 Such a fascination with the power of government-held secrets has always been a core concern of radical libertarians. In his 1956 book The Torment of Secrecy: The Background and Consequences of American Security Policies, the sociologist Edward Shils brilliantly dissects the fascination with secrecy among individuals on all ends of the political spectrum who fear that government agencies will use covert machinations against them. In Shils’ concept, this anti- government counter-culture is “tormented” by the government’s possession of knowledge unavailable to them. Those who subscribe to this culture tend to believe that the agencies that hold these secrets, such as the FBI, CIA and NSA, can control their lives. The other side of this torment over others holding secrets is the belief that by obtaining such secrets will give individuals power over government. Snowden himself was concerned with a coming “dark future,” which he later described as follows: “[The elites] know everything about us and we know nothing about them — because they are secret, they are privileged, and they are a separate class... the elite class, the political class, the resource class — we don’t know where they live, we don’t know what they do, we don’t know who their friends are. They have the ability to know all that about us. This is the direction of the future but I think there are changing possibilities in this.” To change the “dark future,” someone would have to know the secrets of the “elites.” Snowden saw himself as one of the few individuals in a position to seize state secrets from those elites. He had both a SCI, or Sensitive Compartmental Information, clearance, a pass into a NSA regional base and the privileges of a system administrator. This position allowed him to steal state secrets—and whatever power that went with them. And if he moved to a position that gave him greater access, he would, in this view, amass even greater power. Whatever his actual agenda in 2012, we know that he tested possible reactions to a leak exposing NSA surveillance in the United States. He asked fellow workers at the NSA base in 2012, according to his own account: “What do you think the public would do if this [secret data] was on the front page?” He asked this question at a time when a large number of State Department and US Army classified documents had been posted on Julian Assange’s Wikileaks website. While these Wikileaks revelations of secrets were making front-page headlines, the NSA documents that Snowden had taken were far more explosive since they contained NSA intelligence secrets. And no NSA document had ever been published in the press in 2012. One reason why NSA documents remained secrets, as all intelligence workers at Dell were told when they signed their oath, was that the unauthorized release of communications intelligence documents could violate US espionage laws. Even so, there was no shortage of activists overseas, such as Assange, who would be willing to publish NSA documents revealing its global surveillance activities. And in answer to his rhetorical question, he no doubt knew that they would cause an immense reaction on the front page. Cyber punks, as these activists called themselves, tended to be hostile to the NSA since they believed (correctly) that it monitored their activities on the Internet. This anti- NSA view was well HOUSE_OVERSIGHT_020220

69 represented at the Computer Chaos Club convention in Berlin. In addressing these cyber punks Assange and his followers at Wikileaks declared that the main enemy in cyber space was the NSA. In the late fall of 2012, Snowden further tested his newly found powers. Using an alias, he reached out to some of the leading hacktavists. It opened a door for him to the darker side of cyber space. HOUSE_OVERSIGHT_020221

70 CHAPTER EIGHT Hacktavist . “When you gaze long into an abyss the abyss gazes into you”. ~ Friedrich Nietzsche By 2012, the alienated hacktavist battling to unlock the secrets of evil corporations and governments had become a stock hero of popular culture. For example, in the prize-winning Gir/ with the Dragon Tattoo trilogy by Stieg Larsson, which sold 90 million copies, the heroine, a self- educated hacker in her twenties named Lisbeth Salander steals incriminating documents from computers that provides journalist Mikael Blomkvist with scoops that save the progressive magazine he edits from bankruptcy. Her sociopathic behavior, which includes embezzling millions of dollars, extortion, maiming and murder, is accepted by the journalists at the magazine because her hacking exposes crimes and abuses of power. In the realm of non-fiction universe, hacktavists also use their skills to attempt to redress perceived abuses of power, For example in December 2010, the group “Anonymous,” whose members called “Anon” often wear Guy Fawkes masks resembling those worn in the 2006 movie V Js For Vendetta, launched a successful denial of service attack called “Operation Avenge Assange,” It was aimed at paralyzing companies, including PayPal and MasterCard that refused to process donations for Wikileaks because these “anons” believed that these companies were stifling the freedom of the Internet by hindering the money flow to Wikileaks. Since hacktavists often use illicit means to redress their grievances, such denial of service attacks, theft of passwords and hacking into computers, they must conceal their true identities to avoid the retribution of the FBI and other law enforcement agencies. This requires them to operate on the dark side of cyber space which has become known as the dark net. | Fortunately for hacktavists, the dark net is accessible to anyone. It is a place frequented by those that want to avoid laws, regulations and government surveillance. Its denizens include cyber saboteurs, industrial spies, purveyors of illegal contraband, spammers, pranksters, identity thieves, video pirates, bullies, slanderers, drug dealers, child pornographers, money launderers, contract killers, inside traders, anarchists, terrorists, and the intelligence services of many countries. Sue Halpern writing about it in the New York Review of books noted: “My own forays to the dark Net include visits to sites offering counterfeit drivers’ licenses, methamphetamine, a template for a US twenty-dollar bill, files to make a 3D-printed gun, and books describing how to receive illegal goods in the mail without getting caught. There were, too, links to rape and child abuse videos “ To operate effectively on the dark net, a mask of anonymity is often necessary. But it is not easy to completely hide enes tracks in cyber space. The way that the Internet ordinarily works is that whenever an individual sends emails, instant messages, or visits a websites, his or her identity can be referenced by the IP address assigned to him or her by their internet service provider. The problem is that if dark side users’ IP address is discoverable, they obviously cannot remain HOUSE_OVERSIGHT_020222

71 anonymous. So, to evade this built-in transparency in the Internet, dark side users have come to rely on ingenious software to hide their IP address. The most commonly used software for this purpose is TOR. It was first called The Onion Router, since it moves IP addresses through multiple layers, but it quickly became known simply by its acronym, TOR. TOR software hides the IP address by routing messages through a network of TOR-enabled relay stations, called “nodes.” Each node further obscure the user’s IP, even from the next node in the network. This scrambling allows messages to exit the chain of TOR nodes without an easily discoverable IP. By doing so, it “anomizes” each user of the dark side. Because of the anonymity it provides, TOR became the software of choice for individuals and organization who wanted to hide their identity. For example, TOR software made possible Silk Road, which acted as an exchange for drug dealers, assassins, safe crackers, and prostitutes until it was closed down by the FBI in 2011. It was created by Ross Ulbricht, a libertarian who wore a Ron Paul t-shirt, “to create a website where people could buy anything anonymously, with no trail whatsoever that led back to them.” (Ulbricht received a life prison sentence for running this criminal enterprise in May 2015.) To eradicate the Internet trail, Silk Road employed TOR software. TOR was also employed to steal and transfer classified secrets by Private Bradley Manning (now called Chelsea Manning.) He used TOR software to transfer some 50,000 diplomatic cables and military reports from his laptop to Julian Assange’s Wikileaks website. Eventually Manning was identified by a fellow hacker, convicted by a military court for violations of the Espionage Act, and sentenced to 35 years in prison. TOR enabled Wikileaks to publish other secret data, such as the theft of Sony’s files allegedly by the North Korean intelligence service in 2015. It was the means for guaranteeing anonymity to the IT workers who responded to his by now famous clarion call “System admins of the world unite.” It allowed system administrators who opposed the “surveillance state,” as well as other disgruntled employees of government agencies or corporation, to send documents they copied to the Wikileaks website without revealing their IP addresses. Since Wikileaks did not know the identity of their sources, they could not be legally compelled to reveal them. "Tor's importance to WikiLeaks cannot be overstated," Assange said in an interview with Ro/ling Stone in 2010. Indeed without the anonymity provided by its TOR software, Wikileaks could not have easily entered into a document-sharing arrangement major newspapers, including the Guardian, New York Times, Der Spiegel, Le Monde and El Pais. Through the magic of TOR, these newspapers simply attribute their sources to Wikileaks which, in turn, made Assange a major force in international journalism/. Ironically, TOR originally was a creation of US intelligence. In the early 2000s, the US Naval Research Laboratory and the Defense Advance Research Project Agency (DARPA) developed it to allow US intelligence operatives to cloak their movements on the Internet. They could anonymously manipulate web sites operated by Islamic radicals, for example, and create their own Trojan Horse sites to lures would-be terrorists and spies. As it turned out, that use of TOR HOUSE_OVERSIGHT_020223

ae software had a conceptual flaw. If US intelligence services used it, the targets could figure out that anyone visiting a site without an IP address was using TOR software to hide it. If TOR was exclusive used by US intelligence services, the targets could further deduce that all the anonymous visitors were avatars for American intelligence. It would be analogous to undercover police using pink-color cars that civilians did not use. To remedy this flaw, the US government in 2008 made TOR software open-source and freely available to everyone in the world. It even provided funding for its promulgation with the State Department, the National Science Foundation, and the Broadcasting Board of Governors financing TOR’s core developer. The public rationale for this generosity was that TOR could serve as a tool for, as the State Department called it, “democracy advocates in authoritarian states." The result was TOR software became a tool of both intelligence services and their adversaries. As TOR software became widely used by adversaries (as well as common criminals), the NSA sought to find vulnerabilities in it. “It should hardly be surprising that our intelligence agencies seek ways to counteract targets’ that use TOR software to hide their communications, explained a NSA spokesperson. The NSA’s adversaries also took an interest in identifying TOR users. TOR software also took on a cult-like importance to hacktavists concerned with the US government tracking their activities. An illuminating insight into the mind-set of the TOR hacktavists is provided by Catherine A. Fitzpatrick in her 2013 book Privacy For Me Not For Thee. She describes these hacktavists as largely “radical anarchists,” who believe “the state is all- powerful, that law-enforcement is so strong that it will prevail anyway, and that they are a persecuted minority.” As a refuge against the surveillance of the state, and in particular the NSA, they not only hide attempt to their own identity nut use encryption to obscure their messages. Their goal is free their movements from “of any interference from law-enforcement.” In this mind- set, according to Fitzpatrick, “They believe government intelligence agencies will stop at nothing to stop them from absolute encryption.” TOR software was a means to defeat the NSA, but to be successfully there needed to be such a proliferation of TOR servers that the NSA could not piece together IP addresses. The problem was that in 2012 the TOR project, as they called it, was still a very tiny operation in 2012. It employed less than 100 core developers who were located mainly in Germany, Iceland, Japan, Estonia, and the United States. Its staff worked mainly out of a single room in Cambridge, Massachusetts. The guiding spirit behind the TOR movement was Jacob Appelbaum, a charismatic 28-year old who had grown up in northern California. Like Snowden, he had dropped out of high school. Appelbaum identified himself to his followers on the Internet as a “hacktivist” battling state surveillance. For him, as with many in the hacktavist culture, the main enemy was the NSA. After all, the NSA had a vast army of computer scientists working to unravel TOR software. HOUSE_OVERSIGHT_020224

73 Appelbaum was also well connected in this culture. He was the North American representative for Wikileaks before he moved to Berlin in 2013. He also managed Wikileaks’ cyber security when it released classified documents in Iceland in 2010. He was so well-regarded among hacktavists that Assange chose him as his keynote speaker replacement at the “Hackers of the Planet Earth” (HOPE) convention in New York City. Assange also sung his praises, telling Rolling Stone “Jake [Appelbaum] has been a tireless promoter behind the scenes of our cause.” For its part, Ro//ing Stone entitled its profile of Appelbaum, “Meet the most dangerous man on the Internet.” The reason that Assange needed a replacement for this particular event was that he feared he would be arrested if he came to New York because he had released the Manning files on Wikileaks. In Berlin, Appelbaum went to extreme lengths to protect himself from American surveillance. For example, when George Packer interviewed him for the New Yorker, in 2014, he insisted on meeting with Packer naked in a sauna so he could be sure Packer did not have a recording device (other than his notebook.) Appelbaum stated repeatedly in other interviews that he was being spied upon by America. While his claims may have sounded paranoid to his interviewers, as a character in Joseph Heller’s Catch 22 famously said, “Just because you are paranoid doesn’t mean that you are not being followed.” In any event, Appelbaum acted to defeat the perceived surveillance. Runa Sandvik was another principal core developers in the TOR project in 2012. A Norwegian national in her mid-twenties, she wrote in 2012 a well-followed blog for Forbes on Internet privacy in which she identified herself as a privacy and security researcher working at the intersection of technology, law and policy. As a close associate of Appelbaum’s, she worked tirelessly to extend TOR’s cloak of anonymity against the surveillance of the NSA and other would-be intruders of privacy. Appelbaum and Sandvik shared another distinction. They both came in contact with Snowden before he went public and while he was still working for the NSA in Hawaii. Snowden was in 2012 a major advocate of TOR software. He made no secret of his concerns about it electronic interceptions. He even wore to work a jacket with a parody of the NSA insignia, which, instead of merely depicting the NSA eagle, show the eagle clutching AT&T phone lines. He had also become a member of the Electronic Freedom Foundation, the digital rights organization that was helping finance TOR. His efforts on behalf of TOR were not limited to symbolic gestures. Through his work as a system administrator for Dell, he had found documents revealing NSA efforts to defeat TOR’s ability to camouflage its user’s identity on the Internet. Though not yet successful, he found that the NSA was attempting to build back-door entry ways into TOR software. He also knew that the NSA was becoming increasingly hostile to the spread of TOR software. One of the NSA documents that he illicitly downloaded was entitled “TOR Stinks.” It described the NSA’s enormous but not fully successful efforts to penetrate TOR servers. In addition, he downloaded NSA documents describing programs begun in 2012 that aimed at searching the Internet for the cyber-signatures of foreign parties suspected of hacking into US government systems. So he knew that the NSA considered the TOR movement an enemy. HOUSE_OVERSIGHT_020225

74 Nevertheless, Snowden worked to assist the TOR movement. He created TOR’s main exit node in Hawaii in 2012. This activity required a two gigabyte server called “The Signal,” which he described as the largest TOR relay station in Honolulu. Sandvik first heard directly from Snowden in November 2012. At the time, he wrote her under the alias “Cincinnatus,” but also supplied his real name and address in Hawaii so that she could supply him with TOR stickers. So she knew his identity seven months before he went public. He would later tell Sandvik from Moscow that he had been “moonlighting” on behalf of the TOR cause at the NSA. By “moonlighting” he meant that in 2012 he had two jobs: Officially he was working as an NSA system administrator; unofficially he was working to advance the TOR Project. He added, with some understatement, that his moonlighting was “something the NSA might not have been too happy about.” By November 2012, while still working for Dell at the NSA, his dual role led him to organize a “crypto party” aimed at finding new recruits for TOR. The “crypto party” movement itself had been started in 2011 in Australia by Asher Wolf, a radical hacktavist and anarchist living in Melbourne. She promoted them not unlike the tupper-ware parties of the 1950s. They worked as follows. The party organizer, usually with a representative of the TOR project, advertised the party on the Internet. Attendees were encouraged to bring their own laptops so they could install TOR as well encryption software in them. The attendees then would be instructed on how to use it. Finally, those converted to TOR software would be told to proselytize about its virtues by holding their own “crypto party.” Wolf’s idea was to use these gatherings to expand the realm of TOR. On November 18, 2012, Snowden launched his initial crypto party. It was called the “Oahu Crypto party” and had its own web page. He told Asher Wolf that it would be the first Crypto party in Honolulu. She wrote him back, advising him to “keep it simple.”(Wolf later said she did not know he was working at the NSA.) Snowden apparently had no inhibitions in staging a party which the NSA might consider subversive of its battle against TOR. He even invited his fellow NSA workers in Hawaii as well as Others in the local computer culture. He asked Sandvik, who was living in Washington DC at the time, to participate, proposing that she co-host it with him in Honolulu. He scheduled it for December 11, 2012. He suggested that TOR stickers that could be used as “swag” to lure an audience. According to her account, Snowden informed he that he “had been talking to some of the more technical guys at work into setting up some additional fast servers” for TOR. His “work” place at the time was the NSA. If so, he had already attempted to find co-workers at the NSA who might be interested in attending an anti-NSA surveillance presentation. Sandvik not only agreed a to be Snowden’s co-presenter but she made the Oahu Crypto party a TOR-sponsored event. Sandvik flew to Honolulu on December 6, 2012. It was a fourteen hour flight and a relatively expensive one. She later told Wired magazine that the invitation from Snowden coincided with her plan to take a “vacation in Hawaii.” Whatever her reason, it brought HOUSE_OVERSIGHT_020226

75 her in direct contact with a TOR supporter with access to the computers of its main enemy, the NSA. On December 11, 2012, following Snowden’s instructions, Sandvik arrived shortly before 6 PM at the Fishcake furniture store in downtown Honolulu. She proceed to the back of the store where there was a public space called the Box Jelly. It was used mainly for counterculture events. Folding chairs and work tables had already been set up, Snowden was there waiting for her with Lindsay Mills, who he introduced to Sandvik as his girlfriend. He told her that she was there to film the event. Mills did not mention this Crypto party in her blog. But that Snowden brought her and introduced her to Sandvik suggests that he did not keep secret from her his activities to further TOR. The event started at six PM sharp. By Sandvik’s count, about twenty people gradually filled the room. Some of them were from the local “Hi-Cap” computer club and other attendees were from Snowden’s NSA base. Snowden began the presentation by giving reasons why Internet users needed to defend their privacy by using both encryption and TOR software. According to one attendee who asked not to be identified by name, Snowden, while not revealing that he worked for the NSA, spoke with such precise knowledge about government surveillance capabilities that he suspected Snowden worked for the government. Snowden next introduced Sandvik, who took the podium and discussed the work of the TOR project, stressing the importance of expanding the TOR network. Following their presentations, Snowden and Sandvik took questions from the audience. The Oahu crypto party, according to Sandvik, ended about 10 PM. No one objected to Mills making a video of the meeting even though it was dedicated to the idea of protecting privacy. The video was not posted on the Internet so presumably Snowden wanted it for his own purposes. Afterwards, Sandvik went to a local diner called Zippy’s for a late dinner. She left Hawaii two days later. Even though a number of the prominent hacktavists he invited were unable to attend, Snowden declared the Crypto party a huge success in his after-hours report. One of the people Snowden invited under the alias Cincinnatus was Parker Higgins, who was a prime mover in the previously-mentioned Electronic Freedom Foundation. He now lived in California where he had founded the San Francisco Crypto Party. (Higgins would make headlines in 2013 by flying a chartered blimp over the NSA’s secret facility in Utah and photographing it from the air). Despite Snowden’s efforts, Higgins wrote him that he was unable to attend the December Crypto Party because of the high price of the airfare that month between San Francisco and Honolulu. (Higgins was hardly poor: his family home in Oahu had been rented to President Obama for two of his vacations in Hawaii.) As a consolation, Higgins told Snowden that he would try to attend Snowden’s next Crypto Party, which was scheduled for February 23, 2013. HOUSE_OVERSIGHT_020227

76 Even while he used his position as a system administrator at Dell for the NSA to download secret documents, Snowden remained in touch with some of the leading figures in the TOR project under his various aliases. He also continued to invite activists to his crypto parties and he openly advertised the Oahu Crypto Parties on the Internet until 2013. It certainly was not the “loose lips sink ships” mind set of the NSA’s Cold War days. It better reflected on what CIA Deputy Director Morell, who reviewed the situation in 2014 as a member of President Obama’s NSA Review Committee, described as the NSA’s new “culture of transparency.” Even though the NSA’s activities were largely walled off to the outside world, he found that the NSA in the post- Cold War age had encouraged its technical workers to freely discuss challenges that arose in its computer operations. ‘The idea was to spread knowledge and learn from the successes of others,” Morell wrote, “but it created an enormous security vulnerability, given the always-existent risk of an insider committed to stealing secrets.” According to a former intelligence executive, this new “open culture,” exemplified by largely unrestricted entry to the NSANet by civilian contractors,” fit the culture of the young civilians on the “geek squads” who now ran the NSA’s computer networks. It was remarkable that even in such “open culture “Snowden’s crypto party, TOR station, and other anti-NSA activities could go unnoticed. After all, ten or so NSA workers attended the first party it is not unlikely that many of them recognized him as their co-worker. If so, they knew (as did Sandvik and Mills) that the TOR advocate “Cincinnatus” was Snowden. He had also not been shy in contacting via email notable enemies of the NSA, such as Jacob Appelbaum, Parker Higgins and Asher Wolf on behalf of the “Oahu Crypto Party.” If anyone, including the security staff of the NSA, had been on the lookout for dissident intelligence workers, this well-advertised gathering, and its organizer, might have been of interest. In 2014, I asked a former top NSA executive whether such activities on behalf of TOR by a NSA employee would arouse the attention of the NSA’s own “Q” counterespionage unit. He answered, “Snowden was not a NSA employee.” As a contract employee of Dell residing in the United States, the NSA could not legally monitor his private activities or intercept his communication. To do so, would require a FBI request approved by the FISA court. So Snowden/Cincinnatus was free to operate openly in recruiting NSA workers, hacktavists and computer buffs for his events. Ironically, adversary intelligence services searching for disgruntled intelligence workers had no such constraints. HOUSE_OVERSIGHT_020228

77 CHAPTER NINE The String-Puller “It wasn’t that they put it on me as an individual — that I’m uniquely qualified [or] an angel descending from the heavens — as that they put it on someone, somewhere.” --Edward Snowden in Moscow, 2013 Downloading NSA documents was not Snowden’s only rogue activity while working at the NSA for Dell in 2012. Three weeks after the Crypto party, Snowden began anonymously contacting a high-profile journalist, He used the same alias “Cincinnatus” that he used with Sandvik, and to advertise the Oahu Crypto Party. The journalist to whom he wrote On December 1, 2012, was Glenn Greenwald, the previously-mentioned Rio-based columnist for the Guardian. Greenwald had not always been an activist journalist. Up until 2004, Greenwald was a litigation lawyer at the elite New York firm of Wachtell, Lipton, and Rosen & Katz. He was also an entrepreneur owning part of Master Notions, a company which, among other things, had a fifty percent financial interest in the pornographic website HJ (an acronym which originally stood for “Hairy Jock.”) All did not go well with this enterprise. In 2004, Greenwald became involved in an acrimonious law suit with his other associates in HJ. As a result, he had a number of open legal judgments filed against him, including an $85,000 lien by the IRS. After resigning from his law firm in 2005, he moved to Rio de Janeiro and began a new career as a blogger for the Internet magazine Sa/on. He wrote fierce, and often brilliant, polemics against US government surveillance and other perceived intrusions on personal privacy The extent of his bitter antagonism to the activities of the “surveillance state,” as he called it, was reflected in the title of his 2007 book, How Would a Patriot Act? Defending American Values from a President Run Amok. His position on surveillance was unrelenting, even when it came to the president. “By ordering illegal eavesdropping, the president had committed crimes and should be held accountable for them,” Greenwald wrote. | When Barack Obama became President in 2009, Greenwald also attacked him for breaking the law by “ordering illegal eavesdropping.” Because of his opposition to President Obama, he contributed money to the libertarian campaign of Ron Paul, the same candidate to whom Snowden gave money. In August 2012, he had transferred his provocative blog, which had amassed a following of nearly one million readers (including Snowden), from Sa/on to the Guardian. The British newspaper also had a powerful anti-surveillance position, having first published the Wikileaks documents that had been illicitly leaked by Private Bradley Manning and published by Assange in 2010. HOUSE_OVERSIGHT_020229

78 Greenwald was an activist as well as a journalist. Like Poitras, he joined the board of directors of the Freedom of the Press Foundation. The foundation, which eventually Runa Sandvik and Micah Lee would join, had been set up expressly to funnel money to both Assange’s Wikileaks site and the defense fund for Bradley Manning after he was arrested. Such a money laundry was necessary because, as will be recalled, American credit card companies were blocking money transfers to these two causes. This “blockade” was taking its toll on Wikileaks. According to Assange, “WikiLeaks had been cut off from more than 90 percent of its finances.” So the Freedom of the Press Foundation came to its rescue. John Perry Barlow, one of the song writers for the Grateful Dead band, was one of its chief financial backers. “The first serious info war is now engaged, Barlow declared. “The field of battle is WikiLeaks.” He served with Greenwald and Poitras on its Board in December 2012. Snowden was an avid reader of Greenwald’s screeds against the government. If he was to assume the role of a modern-day Prometheus, delivering forbidden secrets of the NSA to the public, Greenwald would be a logical candidate to break the story. Snowden could safely assume that Greenwald would be sympathetic to exposing NSA surveillance from his many blogs, tweets and YouTube comments on the subject. For example, on November 13 2012, just 18 days before Snowden contacted him, Greenwald had written a blog in Guardian asserting that the United States was “a surveillance state run amok.” In it, echoing very closely what Snowden said at his Crypto party, Greenwald wrote that “any remnants of internet anonymity have been all but obliterated by the union between the state and technology companies.” Citing a story in the Washington Post, he continued: “Every day, collection systems at the National Security Agency intercept and store 1.7 billion e-mails, phone calls and other types of communications." Asa result, Greenwald called for action in his blog on November 13, 2012, writing: “The US operates a sprawling, unaccountable Surveillance State that, in violent breach of the core guarantees of the Fourth Amendment, monitors and records virtually everything even the most law-abiding citizens do.” That same week Snowden invited Runa Sandvik to co-host his crypto party. One problem for Snowden was reaching out to Greenwald was Greenwald's lack of any encryption for his e-mails. Communicating with a journalist like Greenwald who famously attacked the very organization for which he worked was itself a risky undertaking, especially if he wanted to pass classified NSA documents to him. If his emails were intercepted by the NSA in Brazil (where Greenwald lived) and where the NSA was not restricted by US law, he could lose his job or even be arrested. Under his alias Cincinnatus, he told Greenwald that he needed to immediately encrypt his computer. To make his point, he cited Greenwald’s own November 12, 2012 blog. In it, Greenwald noted that General David Petraeus, then the CIA director, had been caught in a minor sex scandal because his personal emails had been intercepted, Snowden wrote Greenwald that Petraeus would not have been exposed if he had used encryption. Snowden also sent Greenwald instruction on how to install the necessary encryption software and a link to a 12- HOUSE_OVERSIGHT_020230

ao minute video on encryption (which might have been the same video he used at his Crypto party a few weeks earlier.) Greenwald did not manage to encrypt his computer, however. Snowden, unwilling to deal with Greenwald through an unencrypted channel, broke off contact with him in January 2013. Even so, he did not give up his plan of using Greenwald in his enterprise. He sought an intermediary who used encryption. The alternative route to Greenwald that Snowden chose was Laura Poitras. He knew she had am association with him. They both were founding board members of the Freedom of the Press Foundation. Greenwald had also written about her extensively. For example, he wrote an entire blog about her confrontation with the US government and her plans to make a documentary about the “U.S. Government’s increasing powers of domestic surveillance [through] its expanding covert domestic NSA activities” Since 2011, Poitras had been filming the construction of a massive NSA repository for data in Bluffdale, Utah. In the anti-surveillance culture, the structure had become symbolic of the powers of the NSA. In fact, was the same NSA site that Parker Higgins photographed from a blimp in the fall of 2013 and post on the Internet. Just six months earlier in August 2012, Poitras had released her documentary about the NSA’s use of the Bluffdale repository for domestic spying, Aside from her connections with Greenwald, Poitras had other impressive credentials. Born in 1964 in Boston, She came from a wealthy family that donated large sums of money to philanthropic causes, including $20 million for research on bipolar disorders. After graduating from the New School for Public Engagement in 1996, she pursued a career as an activist film- maker. Her focus quickly became exposing NSA’s surveillance. One of her short documentaries about the NSA’s domestic surveillance program was featured on the New York Times website and attracted enormous attention in 2012. As a dedicated opponent of the surveillance state, she participated in public events with William Binney, the now famous ex-NSA whistle-blower, and Jacob Appelbaum. In April 2012, for example, she made a presentation at the Whitney Museum in New York with Binney and Appelbaum. She became such a leading activist against the NSA by December 2012 that Appelbaum, after lauding her work, interspersed clips from her short film in his keynote address at the Computer Chaos Club convention of hacktavists in Berlin in December 2012. Snowden also closely followed her rise in this world. By simply googling Poitras’ name in January 2013, he would have learned about her connections with Greenwald, Appelbaum, Binney, Assange and other leading figures in the anti-surveillance camp. When asked later Snowden why he had chosen her to help him, He replied “I didn’t. You chose yourself.” The problem for Snowden was anonymously drawing her in to his enterprise. Poitras was living in Berlin in January 2013, which made her vulnerable to NSA surveillance. To get to her through an encrypted channel, Snowden chose a circuitous approach. On January 11, 2013, he wrote to Micah Lee in Berkeley, California. Unlike Greenwald and Poitras, Lee HOUSE_OVERSIGHT_020231

80 resided in America. This U.S. residence meant, as Snowden knew, the NSA would be legally barred from monitoring his communications. He used Lee, who was the chief technology officer at the Freedom of the Press Foundation, as the encrypted gateway to Poitras who, it will be recalled was a founding Board member of that small foundation. Lee also was well-connected to others with whom Snowden had contacted for his crypto party. Lee had been an associate of Runa Sandvik’s at TOR and was a prominent member of Noisebridge, an eclectic anti- government hackers’ commune based in Northern California, of which Appelbaum was also a member. To contact Lee, Snowden chose the alias Anon108. Anon was an alias frequently used by members of the Anonymous commune of hacktavists. “I’m a friend.” Snowden wrote Lee. “I need to get information securely to Laura Poitras and her alone, but I can’t find an email/gpg key for her.” The “gpg” encryption key he asked for, more commonly called a PGP key, was the so- called public key for an encryption system called Pretty Good Privacy, or, for short, PGP. This encryption system required both a public and private key. Snowden asked Lee to provide the former one, since Poitras had the latter one. Lee wrote Poitras about “anon108.” The next day, with the approval of Poitras, Lee supplied Poitras’ public key to Snowden, or, as he knew him, Anonl08. With it, Snowden now contacted Poitras directly. He asked her as a first step to open an anonymous email account using TOR software. He was now in contact with three members of the Freedom of the Press Foundation—Greenwald, Lee, and Poitras. (Sandvik would join the foundation in 2013.) Poitras later wrote about this initial contact: “I was at that point filming with several people who were all being targeted by the [US] government.” The people she was filming included Appelbaum, Assange, and two former NSA employees, William Binney and Thomas Drake. It was in the midst of this project when she received the email from Anon108 aka Edward Snowden. He next asked Poitras her take out a new enciphering key to use exclusively for her liaison with him. It provided them both with an extra layer of protection from any surveillance by law enforcement. Presumably, she accommodated his requests because she anticipated that the anonymous person would use this encrypted channel to send her highly-sensitive material. On January 23, 2013 Snowden wrote Poitras under yet another alias. This time he called himself “Citizen Four.” He wrote: “At this stage I can offer nothing more than my word.” He then said falsely, “I am a senior government employee in the intelligence community.” She had no way of knowing at this “stage” that, despite giving her his “word,” he was not who he claimed to be. He was not a “government employee, “ he was not a “senior” official and he was a member of the “intelligence community” (which is composed of the intelligence services of the U.S. government .) He would later also claim to her that he had been “a senior adviser to the CIA” and “a senior adviser to the DIA.” In fact, he had never held such position at either HOUSE_OVERSIGHT_020232

81 intelligence service. In January 2013, he was merely a contract employee of Dell working as a computer technician at the NSA base in Hawaii. Snowden told her in his initial email that he was well-acquainted with her career as an anti- surveillance activist. He said that he had read Greenwald’s account in Sa/on that past April, a blog in which Greenwald detailed the 40 times in which Poitras was searched by US authorities. The story also said that Poitras believed that she was on a special watch-list and under constant US government surveillance. She had come under such scrutiny by US authorities, it turned out, because of her documentary about American military abuses of civilians in Iraq in 2005 entitled “The Oath”. While filming it she was at a place close to an insurgent ambush of US troops in Iraq. Her presence at the ambush site led Army intelligence officers to suspect (without any evidence) that she might have been tipped off by the insurgents. She firmly denied the charge and the government never substantiated it. Even so, because of this incident, she was kept on a list that caused authorities to search her at airports. As a result, she took elaborate counter-measures to evade any possible surveillance of her communications. Snowden knew about this incident because Greenwald described them in a great detail in a blog that Snowden read (as he later told Greenwald.) “Poitras is now forced to take extreme steps — ones that hamper her ability to do her work, “Greenwald wrote: “She now avoids traveling with any electronic devices. She uses alternative methods to deliver the most sensitive parts of her work — raw film and interview notes — to secure locations. She spends substantial time and resources protecting her computers with encryption and password defenses. Especially when she is in the U.S., she avoids talking on the phone about her work, particularly to sources. And she simply will not edit her films at her home out of fear — obviously well-grounded — that government agents will attempt to search and seize the raw footage.” She claimed, as she told journalists, she was the victim of “Kafkaesque government harassment.” Snowden was duly impressed with her concerns about government surveillance. She fully subscribed to his view that that government surveillance was ubiquitous. Indeed, he later described her as “more paranoid when it comes to electronic security than I can be.” He meant it asacompliment. Such functional paranoia or, “operational security,” as Greenwald would call the precautions that she took, dove-tailed with Snowden’s growing conviction that universal encryption was necessary to defeat the surveillance state. It also made her the perfect channel for Snowden to safely pass some of the classified documents he stole to Greenwald and other journalists. It was not difficult to get her to cooperate in his plot. He played on her well-known concern about government surveillance. He wrote, for example, “The surveillance you’ve experienced means you have been ‘selected’—a term which will mean more to you as you learn how the modern SIGINT system works.” Just as she had been “chosen” by her work to act as his conduit, according to Snowden, she had been chosen by the NSA as a target because of her work. The idea of her being “selected” by an invisible signal intelligence agency, the NSA, could only excite HOUSE_OVERSIGHT_020233

82 her long-time concerns about being watched by the government. “Your victimization by the NSA system means that you are well aware of the threat that [the NSA’s] unrestricted, secret abilities pose for democracies,” he continued. “I hope you understand that contacting you is extremely high risk and if you are willing to agree to the following precautions before I share more, this will not be a waste of your time.” Further heightening her concern that she was under surveillance, he asked her to confirm to him “that no one has ever had a copy of your private key and that it uses a strong passphrase.” Such precautions were necessary because “your adversary is capable of one trillion guesses per second.” That “adversary” was, as she knew from her previous film, the NSA. At this point, she knew she was entering into a dangerous liaison with an unknown party in pursuit of NSA secrets. To elude this “adversary,” Snowden stressed to her that she would have to adopt a conspiratorial set of mind. “If the device you store the private key and enter your passphrase on has been hacked, it is trivial to decrypt our communications,” he explained. “If you publish the source material, I will likely be immediately implicated.” If her correspondent could be “immediately implicated,” it meant that he was a person authorized to handle these secrets. So Poitras knew, as early as January 2013 that she was creating an encrypted channel for someone with access to NSA secrets and who would be incriminated by providing them to her. The key source for Poitras’ previously-referred to short video was William Binney. Like her new source, he had been authorized to handle NSA secrets. Binney had been a NSA technical director until he had retired in 2001. The NSA’s domestic surveillance program that Binney told the press about years before being interviewed in Poitras’ film was called “Stellar Wind.” It indeed led to a major expose of domestic spying by the New York Times in December 2005. After President Bush’s own Justice Department then held that such surveillance was illegal, Congress passed a revision of the Patriot Act in 2007 that effectively legalize the “Stellar Wind” surveillance program on condition that the NSA obtain a FISA warrant for it that would be periodically reviewed by the Department of Justice. Binney had never provided Poitras with any NSA documents to back up the charges he made about Stellar Wind. He could not have done so without violating his sworn oath and, for that matter, US anti-espionage statutes. Binney made it clear to her and other journalists that he was not alaw breaker. But her new source, Snowden, was willing to do what Binney (and other insiders) had refused to do. He was offering in these emails to provide her with secret government documents even though it would implicate him as an outlaw. To further whet her appetite, he told her that these up-to-date NSA documents would fully substantiate the allegations that Binney made in her film. Even more important, he said Binney’s 2001 disclosures were still relevant to her cause. “What you know as Stellar Wind has grown” he wrote her. In fact, as Snowden knew from the draft Inspector-General report he stole in 2012 that Stellar Wind been terminated in 2011 by the NSA for budgetary reasons. He continued: “The expanded special source operations that took over Stellar Wind’s share of the pie have spread all over the world to HOUSE_OVERSIGHT_020234

83 practically include comprehensive coverage of the United States.” As a result, he wrote. “The amount of US communications ingested by the NSA is still increasing.” He further offered to substantiate her worst fears about the growth of NSA surveillance’ “TI know the location of most domestic interception points, and that the largest telecommunication companies in the US are betraying the trust of their customers, which I can prove.” He even proffered, evidence implicating President Barak Obama in illegal surveillance. “There is a detailed policy framework, a kind of martial law for cyber operations, created by the White House. It’s called presidential policy 20,” he wrote her. It was an 18-page directive that Obama had signed four months earlier in October 2012. Snowden was offering to reveal to her the up-to-date evidence of a surveillance state in America presided over by the President himself. It was what she had been searching for three years. How could she, as an activist film-maker, resist such a sensational offer? He further explained to her that he had placed great trust in his discretion. “No one, not even my most trusted confidante, is aware of my intentions, and it would not be fair for them to fall under suspicion for my actions,” he said. Poitras must have found it flattering that a total stranger was willing to disclose to her in emails what he would not tell even his “most trusted confidante” about his intentions to commit an illicit breach of U.S. national security. It was an extraordinary risk he was taking. After all, “Citizen 4” had no way of knowing who she else she told about him. She had long been concerned, with good reason that the U.S. government was out to get her. An unknown person offering to supply her with secret documents could be attempting to entrap her. So he could not preclude she would not consult with others about the offer he was making her. Since her current documentary project included interviews with Assange, Appelbaum and three ex-NSA executives, intelligence services with sophisticated surveillance capabilities might also have taken a professional interest in her communications, as Poitras herself had suspected. Even if Snowden was somehow able to use his position as a system administrator at Dell to ascertain that the NSA did not have Poitras under surveillance, he could not be sure that other agencies, such as the Russian and Chinese intelligence services, were not be monitoring his communications with Poitras. It was, however, a chance Snowden evidently was willing to take. Snowden, in any case, did not intend to conceal his identity for more than a few months. He told Poitras he had a specific purpose in allowing her to name him in her film. Indeed, he said it was essential in his plan to prevent others, including presumably his “most trusted confidante,” from being suspected by law enforcement of helping him in his enterprise. He prevailed on her to accommodate his plan, saying: “You may be the only one who can prevent that, and that is by immediately nailing me to the cross rather than trying to protect me as a source.” His choice of the imagery of crucifixion suggested that, like Jesus Christ, he was willing to sacrifice himself for the sake of others. In keeping with their operational security regime, he said that he would first send her an encrypted file of documents that she would not be able to read. Only after his conditions were HOUSE_OVERSIGHT_020235

84 met and “everything else is done,” he said “The key will follow.” He was now pulling the strings. To get that key, she had to follow his instructions. One of his conditions was that she helps him recruit Greenwald and other outlets for his disclosures. “The material provided and the investigative effort required will be too much for any one person,” he wrote Poitras. He next directed her to contact Greenwald. “I recommend that at the very minimum you involve Greenwald. I believe you know him.” (Snowden apparently did not tell her that he had unsuccessfully attempted to reach out to Greenwald before he had contacted her.) His continued interest in Greenwald was understandable. Aside from Greenwald’s opposition to what he called the “Surveillance State,” he was a gateway to the Guardian. The Guardian had become an important player in the business of disclosing government by publishing a large part of the US documents supplied to Wikileaks. By breaking whistle-blowing stories about US intelligence, it had also greatly increased the circulation of its website. As an establishment newspaper, it also gave these Wikileaks stories credibility with the media. So despite Greenwald’s inability to create an encrypted channel, Snowden still needed him. He had no reason to believe that Greenwald would turn down the opportunity for a whistle-blowing scoop for the Guardian. After all, the classified documents Snowden would provide him would also give credence to both Greenwald’s book and his many blogs denouncing of US government surveillance. Aside from Greenwald and Poitras, Snowden sought an outlet inside the American establishment. So he had Poitras write Barton Gellman, the Pulitzer Prize winning reporter for the Washington Post. Born in 1960, Gellman graduated from Princeton in 1981, and became an award-winning investigative reporter from the Miami Herald, Washington Post and Time magazine. He was also the author of the 2008 book Angler: the Cheney Vice-Presidency, which been made into an HBO mini-series. If Gellman could be drawn into the enterprise, he could provide Snowden with a gateway to the Washington Post, the prestigious American paper credited with bringing down President Richard Nixon in the Watergate scandal. Poitras, as the go-between for Snowden, immediately contacted Gellman. She already knew him from meetings they both attended at NYU’s Center on Law and Security. After telling him she was involved in a story about NSA surveillance, she suggested that they meet in New York City. For their rendezvous, Poitras took a number of precautions to evade anyone attempting to follow her. She had Gellman first meet her in one coffee shop in lower Manhattan. When he arrived, she had him follow her on foot to another coffee shop following her anti-surveillance tradecraft. Once assured no one was watching them, she ordered coffee for herself and Gellman. Over coffee, she told Gellman about Snowden, who she described as her anonymous source. She said that he was willing to supply Gellman with documents that would expose domestic HOUSE_OVERSIGHT_020236

85 surveillance, if Gellman agreed to write a story on it for the Washington Post. Even though Gellman had left the staff of the Washington Post in 2010, he had previously written several stories on that subject for the newspaper. He was also highly-regarded by the editors there. He was therefore interested in Poitras’ offer (although he would consult a friend at the Justice Department about the legality of publishing NSA documents. Snowden now had laid the groundwork for at least two possible outlets; one an establishment newspaper in Washington DC, the Washington Post; and a well-respected international newspaper, the Guardian. Poitras, however, was having some difficulty in bringing Greenwald in on the plan. Like Snowden, she did not trust writing him in unencrypted emails and, since Greenwald lived in Brazil, she still had not found an opportunity for a face-to-face meeting with him. That opportunity arose in mid-April 2013. Greenwald had flown to New York to give the lead speech at an event in Yonkers, N.Y. sponsored by the Council on American-Islamic Relations, or CAIR, a pro-Moslem civil rights and anti-Zionist organization. He had delivered the keynote speech at its previous meeting in San Jose, California on November 22, 2012, where his impassioned depiction of the American “Surveillance State” in America received a rousing ovation from the attendees. He was invited to speak at this award dinner for its east coast chapter. Poitras flew from Berlin to New York to see him. On April 19, 2013, she arranged to meet Greenwald at noon in the restaurant of the Marriott hotel where Greenwald was staying. When Greenwald arrived at the restaurant carrying a cell phone, she explained to him that the NSA could surreptitiously turn his cell phone into a microphone and use it to eavesdrop on their conversation. She told him to go back to his room to get rid of the phone. When he returned, phoneless, she took further precautions by having them change tables several times. Greenwald accepted these tactics because, as Greenwald later said, she was in charge of their “operational security.” After they finally found a secure table in the nearly empty restaurant, she showed Greenwald emails she had received from Snowden under the alias Citizen 4. Greenwald, as he recounted, made “no connection to the “long-forgotten emails” he had received from Snowden under the alias Cincinnatus. Reading the emails to Poitras, he was impressed with the “sincerity” of the anonymous correspondent. When Poitras showed Greenwald Citizen 4’s mission statement in which he said his motive was to end the US “surveillance state.” Greenwald was further impressed with the source. After all, the surveillance state Snowden described closely dovetailed with the surveillance state that Greenwald had described himself in his speech at the Council on American-Islamic Relations dinner in 2012. Of course, the close proximity of the phrasing may not have been entirely coincidental. Greenwald’s 2012 speech had been put on YouTube and widely circulated on the Internet just a few days before Snowden first wrote Greenwald on December 1, 2012. Snowden HOUSE_OVERSIGHT_020237

86 the emails identified himself as a privacy advocate, which was also how Greenwald often identified himself in his speeches. He also echoed other concerns Greenwald had publicly expressed including defending American privacy from government intrusions. Snowden promised the leaks he would supply would provide dramatic results. He asserted in his email that the “shock” of the documents he would give Greenwald would result in the public’s learning about the secret “mechanisms through which our privacy is violated.” According to Snowden’s assessment, following that initial uproar, they could achieve another objective in their common cause. “We can guarantee for all people equal protection against unreasonable search,” he wrote. In light of this convergence of views, it is not surprising that Greenwald was fully convinced of Citizen 4’s bona fides. He said to Poitras, “He’s real,” and he agreed to help break the story in the Guardian. After he said he was onboard the project, Poitras revealed to Greenwald that Citizen 4 would deliver an entire trove of secret documents to them in six to eight weeks. According to this timetable, the Greenwald’s scoop, and the “shock” Citizen 4 promised, would come in early to mid June 2013. At this point in late April, Snowden was in full control. Although his day job at Dell involved endlessly monitoring largely-meaningless encrypted numbers in the NSA tunnel, he had been able to get three major journalists to react favorably to his proposal. None of them knew his name, position, age, location or where he precisely where he worked. Nor did they know the means by which he planned to obtain the secrets that he dangled before them. They also did not know where, or even if, they would meet their source. Their total knowledge about him was the description he gave of himself: a “senior government employee in the intelligence community” (which, as they only later would find out, was untrue.) For his part, Greenwald speculated that he was a disgruntled CIA station chief. Yet by his anonymous emails, and by tugging at their strings, he had lined up three journalists to break his story. Despite the fact they were operating largely in the dark, these three journalists acted like almost any other ambitious reporter would act if they were offered a major scoop about illegal acts of the government. In addition, the information was in line with what they had previously investigated or written about. None of these journalists had any reason to doubt at this point that their anonymous source was anything but the sincere whistle-blower that he claimed to be. They could not have known from his anonymous emails that, aside from the whistle-blowing documents he promised them, he was in the process of stealing a large number of documents from the NSA’s National Threat Operations Center that concerned the NSA’s sources and methods in foreign countries. These documents, to which Snowden never referred in his correspondence with them, had little, if anything at all, to do with domestic spying on American citizens. HOUSE_OVERSIGHT_020238

87 CHAPTER TEN Raider of the Inner Sanctum “They think there’s a smoking gun in there that would be the death of them all politically.” —Edward Snowden in Moscow The nightmare of the NSA is a penetration. As the CIA, FBI and NSA found out in the 1990s, No intelligence service is invulnerable to it. Any employee of a large intelligence organization can turn, or be turned, against it. Among the more than 10,000 intelligence workers employed by the NSA, it is a near certainty that over time one or more of them will become dissatisfied with their work. He or she may have a personal grievance about their pay, lack of promotion or their treatment by their superiors. Disenchantment with the NSA may also proceed from idealistic objections. After all, the NSA is in the business of secretly intercepting messages, and an insider could find its spying activities at odds with his or her own beliefs about the violation of privacy. For any of these reasons, a disgruntled insider could go rogue. He or she then might attempt to right a perceived wrong by disclosing the NSA secrets to another party. That party might then induce or blackmail the rogue employee into disclosing further secrets. To guard against it, the NSA has developed a well-organized system for stratifying its data so that obtaining critical secrets would require a rogue employee to burrow into its heavily protected inner sanctum. As part of this system, the NSA divides its data into different tiers depending on the importance of the secrets to its operations. The first tier, Level 1, is mainly administrative material. This data would include FISA court orders and other directives it employees might need to check on to carry out their tasks. Level 2 contains data from which the secret sources have been removed. This tier, available to other intelligence services and policy-makers, includes reports and analysis that can be shared. The third tier, Levels 3, contains documents that cannot be shared outside of a small group of authorized individuals because they disclose the secret sources through which the NSA surreptitiously obtained the information. This third tier includes, for example, compiled list of the sources in China, Russia, Iran and other adversary countries. It also disclosed the exotic methods the NSA uses to get some of this data. Level 3 documents also include reports on HOUSE_OVERSIGHT_020239

88 specific NSA, CIA and Pentagon operations unknown to adversaries. These Level 3 documents are described by NSA executives as “the Keys to the Kingdom” because they could invalidate America’s entire intelligence enterprise if they fell into the hands of an adversary. And, as far as is known, prior to 2013, there had been no successful theft of any Level 3 documents. Because of their extreme sensitivity, Level 3 documents were not handled by most of the private firms providing independent contractors. At Dell, Snowden had access mainly to Level 1 and Level 2 data (which he could, and did, download from shared sites on the NSA Net.) These lower level documents had whistle-blowing potential since they concerned NSA operations in the US. They did not reveal, however, sources that the NSA used in intercepting the military and civilian activities of foreign adversaries. Consequently, at Dell, while Snowden could find documents of great interest to journalists, he did not have the opportunity to steal far more valuable data, such as the Level 3 lists of the NSA’s sources abroad. Snowden quit his job at Dell as a system administrator on March 15, 2013 to take another job working the NSA in Hawaii at Booz Allen Hamilton. Unlike other outside contractors that serviced the NSA, the firm he choose, Booz Allen specialized in handling the NSA’s Level 3 data. When Snowden applied to Booz Allen earlier in March 2013, the company had no opening for a system administrator at the National Threat Operations Center, an NSA unit in which it dealt with Level 3 data. It did have an opening for an infrastructure analyst, a lower-paying job involving maintaining the computer technology necessary to monitor threats. Despite the cut in pay, Snowden took that job. Snowden made no secret of one of his reason for this move. He subsequently told the South China Morning Post, as will be recalled, that he took it to “get access to lists of machines all over the world the NSA had hacked.” If so, he was after the keys to the NSA’s kingdom of global surveillance. And Booz Allen held those keys. "He targeted my company because we enjoy more access than other companies," Booz Allen Vice Chairman Michael McConnell said with the benefit of hindsight. As a result of the theft, he appraised “an entire generation of intelligence was lost.” McConnell, a former NSA director before taking the job at Booz Allen, was in a position to know. Snowden’s sudden career change had both advantages and disadvantages for the enterprise he was planning. The main advantage was that the job, he would have proximity to the computers in which the “lists” he sought of NSA global sources were kept. The main disadvantage, aside from a cut in salary, was that he would no longer be a system administrator. This change meant he would not have a system administrator’s privileges to bypass password restrictions or temporarily transfer data. Instead, as an infrastructure analyst, he would not have password access, at least during the two-month long training period, to the computers that he had not been specifically “read into,” which did not include those computers that stored the Level 3 lists. Access to these tightly-controlled compartments was limited to only a handful of analysts at the center who had a need-to-know. HOUSE_OVERSIGHT_020240

89 Nevertheless Snowden applied for the job. Since it handled higher level secret documents, Booz Allen had stricter requirements for applicants than Dell. To slip by them, Snowden engaged in a minor subterfuge. He wrote on his application that he was expecting a master’s degree from the online division of Liverpool University in England. In fact, he had not completed a single course at Liverpool, and would not be receiving any sort of a degree from it. Booz Allen, not fully taking into account the discrepancy in his application, agreed to hire him as a trainee-analyst (and it did not change that decision even after it found out about his subterfuge.). According to Admiral McConnell, Snowden never actually worked in the Booz Allen offices, which are housed in a skyscraper in downtown Honolulu. Instead, he was immediately assigned to work at the NSA’s highly-sensitive National Operations Threat Center in the tunnel at the Kunia base. Before he could begin working there, however, he needed to fly to Maryland to take a mandatory orientation course at the NSA. The course was given in an 11 story building, with a sheer wall of black glass, on the NSA’s 350 acre campus at Fort Meade in Maryland. He arrived there from Hawaii on April 1, 2013. Like every other Booz Allen contractors who work at the NSA’s Center, Snowden was required to sign the “Sensitive Compartmented Information Non- Disclosure Agreement.” In this document, Snowden acknowledged that he had been granted access to sensitive compartmented information, called SCI, as part of his work and that he understood that any disclosure of that information to an unauthorized person would violate federal criminal law. He was also told, as were all new contract employees a Booz Allen that its disclosure could damage the interest of the United States and benefit its enemies. In signing it, he swore an oath not to divulge any of this information without first receiving written approval from US authorities. So less than two months before he downloaded Sensitive Compartmented Information, he was fully aware of what would be the consequences of divulging this information. By this time, as discussed in the previous chapter, he had agreed to deliver classified data to three journalists. On April 5, 2013, while still in the training facility in Maryland, he apparently sought to establish a paper trail for himself. He wrote a letter to NSA’s General Counsel Office asking whether or not NSA directives take precedence over acts of Congress. A lawyer from the Office of General Counsel responded three days later, addressing Snowden as “Dear Ed.” The lawyer said, agreeing with Snowden, that acts of Congress take precedence over NSA directives. He also suggested that “Ed” phone him if he needed any further clarification. Presumably, Snowden had written the letter to elicit a response that he could later use to bolster his claim to be a whistle- blower. Instead, the “Dear Ed” response was of little use to Snowden, as it did not dispute his point that NSA directives must lawfully conform to the acts of Congress. The NSA lawyer did not ever hear back from “Ed.” Snowden completed his orientation course at Fort Meade on Friday April 12°2013. While he was in Maryland Snowden, he took time off to pay visits to both of his divorced parents. It would be the last time he would see either of them in the United States. HOUSE_OVERSIGHT_020241

90 He returned on April 13th to Hawaii, One domestic task he to attend to was helping Mills pack up their possessions, which they stored in boxes in the garage. The lease on their house was up on April 30, 2013, so he found a temporary rental for them just a few blocks away. On Monday April 15th, Snowden began on-the-job training as an analyst at the National Threat Operations Center—a training that he would not complete. The same week he began the training, he prepared his exit by writing Booz Allen that he needed a brief medical leave in May to undergo medical treatment for his putative epilepsy symptoms. Even though he had no planned any treatments, and, as far as is known did not suffer from epilepsy, Booz Allen required a minimum of one month’s notice for foreign travel. By making the request, he lessened the likelihood that it would arouse undue suspicion when he departed Hong Kong with stolen documents on May 18, 2013. This brief window left him some four weeks to take the lists that he coveted. Snowden carried out the heist with precision reminiscent of a “Mission Impossible” movie caper. First, he needed to get passwords to up to 24 compartments at the National Threat Operation Center that he had not been “read into.” Even in the “open culture” of the NSA this was not an easy challenge since he no longer had a plausible pretext for asking other experienced threat analysts had their passwords, as he did when he was a system administrator at Dell. He would now be asking them to break strict NSA rules that prohibited intelligence workers from disclosing their passwords to an unauthorized party. In addition, they were supposed to report anyone who asked to use their passwords. He may have obtained some passwords through deception, such as tricking them into typing in their passwords in a device that captured them. As the NSA informed Congress in 2014, three of his fellow workers told the FBI that Snowden may have deceived them to gain access their passwords. He may have also have used electronic means to have stolen the remaining passwords. In any case, however he accomplished this incredible feat, he gained access to 24 compartments containing the NSA’s most closely guarded secrets in a matter of a few weeks. Next, he had to find the lists he was seeking in a vast sea of data. He used for this task pre- programmed robotic devices, called “spiders” to crawl through the data and find the files he was after. Snowden deployed these spiders soon after he began working at the Center, raising the possibility that Snowden had prepared in advance the operation. According to the subsequent NSA damage assessment, Snowden’s spiders indexed well over one million documents. Many of those that he copied and moved were from Level 3 “Sensitive Compartmented Information” according to the NSA analysis. The spiders also made his penetration relatively safe. As previously mentioned, the Hawaii base did not have a real time auditing system. So alarm bells would go off in the security office when he indexed documents. Finally, Snowden had to find a way to transfer this data to a computer with an opened USB port. Most of the computers at the center had had their ports sealed shut to prevent unauthorized HOUSE_OVERSIGHT_020242

91 downloads. Making the transfer even more difficult, he was working as an analyst-in-training in an open-plan office with security CCTV camera. To be sure, there were also service computers with open ports used by the system administrators. They, after all, had to perform maintenance and back-up work. Even though Snowden was no longer a system administrator, he might still have been able to steal or borrow a service computer. Yet, despite all the NSA’s and Booz Allen’s security measures, he managed to download hundreds of thousands of level 3 documents to an unsealed computer. He also took some less-sensitive documents from the administrative file (which contained mainly Level 1 documents) at the end of April. These late acquisitions included the now famous warrant from the FISA court issued on April 25 2013. He completed the operation on Friday May 17, 2013, the last day he would ever enter the NSA facility. He transferred the data he had amassed on the service computer, including the lists of the computers in Russia and China that the NSA had succeeded in penetrating, onto thumb drives. Finally, he coolly walked past the security guards at the exit, who only seldom performed random checks on NSA employees. He had carried out the entire operation with such brilliant stealth he left few, if any clues behind to how obtained 24 of his colleagues’ passwords, moved the data from many different supposedly-sealed computers to an opened service machine or how he downloaded these documents to multiple thumb drives without arousing suspicion. In fact, the theft would not be discovered by the NSA for fifteen days. His escape was also well-prepared. Lindsay Mills had departed that morning for a planned two week visit to the outer islands. This trip allowed him to pack his belongings without saying anything to her that might be difficult to explain to the authorities. He simply left a note she would see on her return, and could show to authorities saying that he was away on a “business trip.” He also called to say good-bye to his mother and sister, who had been planning to visit him in Hawaii that month. HOUSE_OVERSIGHT_020243

92 CHAPTER ELEVEN The Escape Artist “T’m not self-destructive. I don’t want to self-immolate and erase myself from the pages of history. But if we don’t take chances, we can’t win.” --Snowden in Moscow The next evening Snowden drove to Honolulu International Airport. He left his leased car in the parking lot. He took with him only carry-on baggage, including a back-pack and a laptop with a TOR sticker on it. “I took everything I had on my back,” he said. Before leaving he also packed in his luggage the cash that would pay for his fugitive life. Along with the cash, he took the thumb drives containing the NSA’s keys to the kingdom. At this point, Snowden was still a free man. He was not wanted by the authorities. He had provided his employer and the NSA with a medical excuse for his absence from work so he would not be immediately missed. He also had a valid passport, a credit card, and ID. He had he yet made arrangements to meet the journalists. Snowden’s destination was Hong Kong. After crossing the International Date Line, Snowden waited three hours in the transit zone of Narita. Here he was reportedly captured by the airports CCTV cameras sitting alone. He then boarded a plane to Hong Kong. After the four-hour long flight from Narita, he arrived in Hong Kong early in the morning on May 20". He had visited Hong Kong at least once before with Lindsay Mills when he was stationed in Japan. He had also made some arrangements. According to Albert Ho, his Hong Kong Lawyer, Snowden stayed at a residence arranged for him in advance by a party whom Snowden knew prior to his arrival. This “carer,” Ho said, had assisted Snowden with his logistics. For the next ten days, Snowden did not use his credit card or leave any paper trail to his location. Wherever he was, “his first priority,” as he told Greenwald, was to find a place safe from US countermeasures. He brought with him a large number of electronic copies of NSA documents marked “TS/SCI/ NOFORN, which stood for Top Secret, Sensitive Compartmentalized Information and No Foreign Distribution. According to government rules, data carrying these labels could not be removed from a government-approved “SCI facility.” Yet Snowden, who brought them with him into this semi-autonomous zone in China, intended to break these rules. HOUSE_OVERSIGHT_020244

93 At this venue, Snowden apparently believed he was relatively safe. “That whole period was very carefully planned and orchestrated,” Snowden later told the Guardian in Moscow. Here, for the first time, Snowden communicated directly with first Gellman and then Greenwald. He emailed Gellman under the alias “Verax .’ Already, via Poitras, he had provided this Washington Post journalist with power point slides from a NSA presentation about a joint FBI-NSA-CIA operation codenamed PRISM. He believed it qualified as whistle-blowing because it revealed that the NSA, in intercepting emails, tweets, postings and other Web interactions about foreign terrorists, incidentally also picked up data about Americans. According to the rules imposed on the NSA by a 2007 presidential directive, whatever information accidently picked up about Americans was supposed to be filtered out, and hundreds of compliance officers rechecked the data ever 90 says to assure that directive was being carried. Even so, it was likely some data was not expunged in this process. So PRISM could cause embarrassment for the NSA. Snowden proposed that Gellman join him in Hong Kong. In attempting to persuade him of the urgency of the trip, he wrote him that he had reason to believe that “omniscient State powers” imperiled “our freedom and way of life.” He noted, with a touch of modesty, “Perhaps I am naive.” He added dramatically “I have risked my life and family.” Even so, Gellman declined coming to Hong Kong. (According to Greenwald, Gellman could not make the trip because lawyers for the Washington Post were uneasy with having a reporter receive classified documents in a part of China.) Next, on May 24, 2013, Snowden attempted to apply more pressure on Gellman by telling him that the story about the PRISM program had to be published by the Post within 72 hours. Gellman could not accede to such a condition because the decision of when to publish a story was made not by him but by the editors of the newspaper. He told Snowden that the earliest the story could be published was June 6, 2013, which was well past Snowden’s deadline. Snowden next turned to Greenwald. Both Poitras and Micah Lee had made great efforts to tutor Greenwald on encryption protocols, with Lee, who was in Berkeley, California, sending Greenwald by Fedex a DVD that would allow him to receive both encrypted messages and phone calls. Even then, Greenwald was unable to fully install it. As a result, Greenwald still had not met Snowden’s requisites on encrypting his computer. In addition, possibly because of a lost message, Snowden believed that Greenwald was reluctant to fly to the place that he designated for a meeting. With Gellman uncertain, Greenwald was now essential to his plan. If he was to have any newspaper outlet, he needed to persuade Greenwald to come to Hong Kong. At this point, he took matters in to his own hands. On May 25, 2013, Snowden somewhat aggressively emailed Greenwald “You recently had to decline HOUSE_OVERSIGHT_020245

94 short-term travel to meet with me.” He added pointedly “You need to be involved in this story." To further convince him, he suggested that they immediately speak on the phone via a website that encrypts conversations. The subsequent conversation lasted, according to Greenwald, two hours. Snowden began the encrypted call by complaining, “I don’t like how this is developing.” He made it clear that he, not the journalist he had selected, was pulling the strings. If Greenwald wanted the scoop, he had to follow Snowden’s instructions, which included dividing the scoops between the Guardian and the Washington Post. According to his plan, Gellman would break the PRISM story in the Washington Post and Greenwald would break the “mass domestic spying” story in the Guardian. In addition, he insisted that the Guardian publish his personal manifesto alongside its story. As he envisioned it, the media event would also include a video component in which Greenwald would interview him. Once Greenwald agreed to this micro-managing, Snowden would send him what he called a “welcome package” of documents to demonstrate his good faith. His plan also required a face-to- face meeting. When Greenwald said he was aboard the project, Snowden told him “the first order of business is to get you to Hong Kong.” Snowden next sent him 20 classified NSA documents labeled “TOP SECRET.” He also included in the package his personal manifesto, which asserted that the NSA was part of an international conspiracy of intelligence agencies that were working to “inflict upon the world a system of secret, pervasive surveillance from which there is no refuge.” Meanwhile, Snowden told Poitras, he was sending her a number of NSA documents including a recent FISA warrant. It had been issued less than a month earlier. He wanted that FISA warrant to serve as the basis of Greenwald’s scoop. It was perfect whistle-blowing material for the Guardian because it ordered Verizon to turn over all its billing records for 90 days to the NSA. It was as close to a smoking gun as anything he had copied at the NSA. It would also get attention since James Clapper, the Director of National Intelligence, had stated before Congress just two months earlier that the NSA did not collect phone data in America. This warrant would allow the Guardian, in the best tradition of “Gotcha” journalism, to catch Clapper in an apparent lie. Continuing his string-pulling, he instructed Poitras not to show the FISA warrant to Greenwald until they were safely aboard the plane. That measure would prevent Greenwald from releasing the story without coming to Hong Kong. He also sent Poitras an entire encrypted file of NSA documents, saying it would “include my true name and details for the record, though it will be your decision as to whether or how to declare my involvement.” He did not send her the key to decipher the file, saying “The key will follow when everything else is done.” He further told her that he preferred that her film focus on him as the sole perpetrator of the leak so that no one else at the NSA would be suspected. He instructed her “Your destination is Hong Kong.” HOUSE_OVERSIGHT_020246

95 Poitras and Gellman were not the only journalists involved in the news event. Poitras also asked the hacktavist Jacob Appelbaum to help her interview Snowden about the NSA’s operations. She later said that she needed someone with technical expertise in government surveillance to test the bona fides of Citizen 4. She believed that Appelbaum, who had participated in her anti-NSA presentations in 2012, qualified for the position. As it turns out, Appelbaum was already known to Snowden. Appelbaum had communicated with Snowden under his Oahu Crypto party alias about an obscure piece of software just a few after Snowden had met with Runa Sandvik in Hawaii in 2012. Appelbaum, after all, was Sandvik’s long-time ally in developing the use of TOR software. However he learned about him, Snowden allowed Appelbaum to put to him detailed questions to concerning the secret operations of the NSA before he met with Poitras and Greenwald in Hong Kong. Indeed, Poitras joined him in asking Snowden via encrypted emails, such questions as: “What are some of the big surveillance programs that are active today and how do international partners aid the NSA?” “Does the NSA partner with other nations, like Israel?” and “Do private companies help the NSA?” Snowden answered them all to the satisfaction of Appelbaum and Poitras. (The interview was published on June16, 2013 with Snowden’s approval on the website of Der Spiegel, the German weekly, which had also published the Wikileaks documents.) Even though the days were ticking away while Snowden was waiting for him in Hong Kong, Greenwald still had to overcome a final hurdle at the Guardian. He needed to get a green light to go to Hong Kong from Janine Gibson, the editor of the Guardian website, who was based in New York. Under Gibson’s leadership, the Guardian's website effectively “gone into the business of publishing government secrets,” as Guardian columnist Michael Wolff pointed out. Most of these secrets had been supplied by Manning via Wikileaks. Few, if any of these previous documents the Guardian published were highly-classified and none were SCI top secret documents. The NSA documents Greenwald had received from Citizen 4 were another matter. They contained the sort of SCI communications intelligence data that no major newspaper had ever published before. Their disclosure could even result in journalists being imprisoned since both U.S. and British law criminalized the disclosure by anyone of communications intelligence. As a lawyer, Greenwald recognized this danger. On the other hand, the NSA documents were far more explosive than the Wikileaks material, and promised an even greater spike in circulation. So Greenwald assumed that Gibson would be willing to authorize the publication of the documents—and provide the expenses for his trip to Hong Kong to meet the source. He flew from Rio to New York on May 30, 2013 to meet in person with Gibson, who had concerns about publishing what purported to be top secret documents that came from an anonymous source. For one thing, she was also not willing to go along with Citizen 4’s demand that the Guardian publish his personal manifesto alongside the documents. Aside from its shrill and alarming tone, it sounded, as she told Greenwald, “a bit Ted Kaczynski-ish.” She was referring to Ted Kaczinski, the deranged mathematician who had maimed or killed 23 people with anonymous mail bombs between 1978 and 1995. Like Citizen 4/Snowden, Kaczynski had HOUSE_OVERSIGHT_020247

96 demanded that newspapers publish his personal manifesto. She explained to Greenwald, “It is going to sound crazy to some people.” Her concern was that it would detract from the credibility of the rest of the story. Snowden had also written Greenwald a letter explain his position. “Even the Constitution is subverted when the appetites of power demand it,” Snowden asserted, and paraphrasing President Thomas Jefferson, he continued. “Let us speak no more of faith in man, but bind him down from mischief by the chains of cryptography.” Snowden, showing his cult- like faith in encryption, had “cryptography” for Jefferson’s word “constitution. Despite his Jeffersonian rhetoric, she decided against publishing it or the Manifesto. The stolen NSA documents were another matter. They were an enormous scoop that could have a greater impact than the Wikileaks scoop. .She was not about to miss publishing it. She authorized Greenwald’s trip to Hong Kong on the condition that he take with him a Guardian staffer in whom she had confidence. He was Scottish-born Ewen MacAskill, a 61-year old veteran journalist who had been the Washington bureau chief for the Guardian. His assignment was to evaluate the mystery source in Hong Kong for Gibson. Greenwald accepted her terms. Poitras, who would be accompanying them, would be paying her own way. Snowden, for his part, had a contingency plan in place in case the Guardian failed to publish the story. While Greenwald was negotiating with Gibson, he arranged for Micah Lee, Poitras’ associate at the Freedom of the Press Foundation, to build a personal website for him. Writing Lee from Hong Kong under both his alias Anon108 and his real name, Snowden said that he planned to post on it his “anti-surveillance manifesto.” He would also use it to post “a global petition against surveillance. (A year earlier his girlfriend Mills had also asked her followers on her “super hero” blog to sign a petition against government interference with the Internet.) Snowden had Lee name the site “Supportonlinerights.com.” According to Lee, the website would be build with a “dead man’s switch,” which would automatically trigger the release of NSA documents if he was arrested. It was not clear whether Lee was doing this work as a freelancer or in his capacity as the chief technology officer for the Freedom of the Press Foundation. After Lee built the website for Snowden It proved unnecessary to activate it since Poitras emailed Snowden that the Guardian had approved the trip, and she and Greenwald were booked on a Cathay Pacific flight to Hong Kong. They would arrive on June 2, 2013, In his preparation to go public in Hong Kong, Snowden showed himself fully capable of orchestrating what would become a major news story. He not only picked the journalists who would break it, but he instructed each of them as to the timing, sequence, and content of their initial disclosures. In the security of his residence in Hong Kong, he also worked to carefully separate the purloined NSA documents into two very different caches. "I carefully evaluated every single document I disclosed,” Snowden explained to the Guardian journalists in early June 2013. The documents in this first cache were selected to serve what he termed the “public interest.” In the hands of journalists, these selected documents, and the story he fashioned to accompany them, would burnish his image in the public consciousness as a whistle blower. He did HOUSE_OVERSIGHT_020248

a not turn over the second cache, telling Greenwald, “There are all sorts of documents that would have made a big impact that I didn't turn over.” By the time he received the message from Poitras on June 1*, Snowden had finished his preparations for the journalists. With selected documents copied on a thumb drive, he moved from the residence where he had been staying for ten days to a venue for meeting the reporters. The place he chose was the five-star, $330 a day, Mira hotel in the Kowloon district of Hong Kong. He checked into room 1014 under his own name and provided the front desk with his own credit card. He next emailed Poitras his name and the address of the Mira hotel. There was no longer any reason to hide his true identity because the rendezvous with journalists would make him famous in a matter of days. HOUSE_OVERSIGHT_020249

98 CHAPTER TWELVE Whistle-blower “They elected me. The overseers... The [American] system failed comprehensively, and each level of oversight, each level of responsibility that should have addressed this, abdicated their responsibility.” --Edward Snowden in Moscow While Snowden was attempting to reel in the journalists in Hong Kong, Lindsay Mills received a jarring surprise in Hawaii. When she returned to Honolulu from her “island-hopping” trip, she found Snowden was still away and the rented house partially flooded from a leak. The brief note Snowden left her indicated that her eight year relationship with Snowden had, at least temporarily, been put on hold by him. “TI feel alone, lost, overwhelmed, and desperate for a reprieve from the bipolar nature of my current situation,” she wrote in her journal on June 2" (which would be June 3™ across the international time line in Hong Kong.) “I've nearly lost my mind, family, and house over the past few weeks.” She also noted that she her SIM card containing her personal data was gone. She wrote in her on-line journal” “Oh and I physically lost my memory card with nearly all my adventure photos.” The loss would make it difficult to reconstruct her past activities with Snowden. In Hong Kong, if Snowden was following Lindsay’s online journal, he would have read that his girl friend had returned home, lost her data and needed a “reprieve” from the situation in which he had put her. But since they were exchanging private text messages by then, he would not have needed to consult her public journal. Snowden was certainly aware that he would soon be the object of a manhunt that could involve those with whom he was acquainted. He instructed Poitras to mask their email communications in cyber space “so we don’t have a clue or record of your true name in your file communication chain.” Such precautions were necessary, he explained to her because “every trick in the book is likely to be used in looking into this.” The journalists arrived late in the evening of June 2nd, 2013. Snowden’s message was waiting. Snowden’s instructions were themselves an exercise in control. Snowden had written them: “On timing, regarding meeting up in Hong Kong, the first rendezvous attempt will be at 10 A.M. local time. We will meet in the hallway outside of the restaurant in the Mira Hotel. I will be working on a Rubik’s cube so that you can identify me. Approach me and ask if I know the hours of the restaurant. Ill respond by stating that I’m not sure and suggest you try the lounge instead. I'll offer to show you where it is, and at that point we’re good. You simply need to follow naturally.” Even though such tradecraft was unnecessary since Snowden was registered at the hotel under his true name, he had provided the journalists with the atmospherics of “an international spy thriller,” as Greenwald subsequently described the instructions. HOUSE_OVERSIGHT_020250

| MacAskill had stayed at the W Hotel when Poitras and Greenwald Poitras went to the Mira Hotel. Poitras did not want to bring along an uninvited guest to the first meeting with Citizen Four. As instructed, at 10 AM on June 3™ she and Greenwald went to the Mira restaurant. They gave the recognition signal, twice. After a few minutes, a young man walked over to them, holding a Rubik cube. Greenwald noted: “The first thing I saw was the unsolved Rubik’s cube twirling in the man’s left hand.” The man said “Hello” and introduced himself as "Ed Snowden." Greenwald was particularly surprised by Snowden’s boyish looks. “The initial impression was one of extreme confusion,” Greenwald wrote in his book. “I was expecting to meet somebody in his sixties or seventies, someone very senior in the agency, because I knew almost nothing about him prior to our arrival in Hong Kong.” His initial confusion was understandable. Snowden, it will be recalled, had falsely identified himself to them in an email as a senior member of the intelligence community. Snowden led Greenwald and Poitras through various corridors of the hotel to his room, 1014. It was in a single room mainly occupied by a king-sized bed. Its other furniture included a sleek writing desk in the corner, a modernistic chair and a tall lamp. The bathroom was behind a glass partition, which could be closed off by a black louver blind. There was also a small refrigerator in the minibar in which Snowden asked them to stow their cell phones, Snowden had already told Poitras that he wanted her to make a documentary of the meeting. She therefore wasted no time in mounting her camera on a tripod. “Minutes after meeting, I set up the camera.” Snowden had told her, as she later recalled, “when you are involved in an action which is likely to get you indicted, you typically don’t have a camera rolling in the room.” Nevertheless, he allowed her to film his actions for the next eight days. One possible reason is that he had no intention of standing trial. In any case, as Poitras found out, Snowden was anything but camera shy. Over the next week, she would shoot over 20 hours of Snowden’s activities in that small room. It was essentially a one man show, a presentation of him, by himself, for the appreciation of a global public. Poitras knew virtually nothing about her subject until ten minutes before she began filming him. She had not even googled him, since she was concerned that her Internet search might alert the NSA and law enforcement authorities In an extraordinary waiver of his own privacy, he allowed her to film him washing in the bathroom, preening his hair in the mirror, napping on his bed, getting dressed, and packing his bag. He even permitted her to film a private computer exchange between him and Mills (who was in Honolulu.) Mills now informed Snowden that two government investigators had come to their home in Hawaii. Mills reported that they were asking her about Snowden’s whereabouts. Evidently when he had failed to show up for work on June 1%, it set off alarm bells at Booz Allen and the NSA. Snowden expressed anger to the journalists in the room at the NSA intrusion on the privacy of his girlfriend (although he had left her in the lurch by telling her in the note he was away on a brief business trip.) HOUSE_OVERSIGHT_020251

100 Snowden also performed his security procedures on camera, including stuffing bed pillows under the door to block any eaves-droppers, throwing a red blanket over his head, which he called jokingly his “magical cloak of power.” He explained to Greenwald that his donned his “cloak” when he turned on his laptop to prevent any hidden cameras in the room from spotting his password. He also checked the hotel phone for bugs. It was not without irony that he went through these security rituals to protect his data as he allowed Poitras to film NSA data on his computer screen. Since he planned to use these journalists as his outlets to go public in a few days, the security measures he did while on camera would only serve a temporary purpose. The centerpiece of the planned video would take the form of an interview with Greenwald. Snowden himself provided the talking points. The filming would eventually provide Poitras with a feature-length movie, CitizenFour, which would be commercially released in October 2014 and win an Academy Award for her. The next day, Wednesday June 4", Ewen MacAskill, the Guardian editor, joined Poitras and Greenwald in Snowden’s room. Snowden insisted that he also go through the ritual of stowing his cell phone in the mini-bar refrigerator. Not without irony, Snowden’s own phone can be seen on his bed recharging. Although MacAskill was sent by Gibson to the event to verify the source’s bona fides, he apparently had not been well briefed. The questioning went as follows: MacAskill: Sorry, I don’t know anything about you. Snowden: OK, I work for— MacAskill: Sorry, I don’t know even your name. Snowden: Oh, sorry, my name is Edward Snowden. I go by Ed MacAskill went on to ask him to enumerate the various positions he held during his career in intelligence. Snowden was not entirely truthful in describing himself. He said that he had been a senior adviser to the CIA, when he had been just a telecommunications support officer in the CIA. He also said he had been a senior adviser at the Defense Intelligence Agency (DIA) even though, according to that intelligence service, he was not actually ever employed there. (He merely spoke at an interagency counterintelligence course the DIA had sponsored.) He said he had a $200,000 a year salary from Booz Allen when, according to Booz Allen, it was $133,000. It is understandable that he wanted to impress these Guardian journalists in light of his young age and boyish appearance, even to the extent of meretriciously claiming in the video that he personally had been given the “authority” at the NSA to intercept President Obama’s private communications, which, according to a NSA spokeswoman, was not true. No NSA employee, and certainly not a civilian contract worker, was given the authority to soy on the President of the United States, she insisted. Such career enhancements suggest that Snowden altered factual reality when it suits his purpose with journalists. HOUSE_OVERSIGHT_020252