Dark Mirror

by Barton Gellman

  offered publicly to put me in a field: The story he disliked was Barton Gellman, “U.S. Bombs Missed 70% of Time,” Washington Post, March 16, 1991, available on the Stanford University website at http://stanford.io/1KSNLdM.

  “So it is decided!”: Verax to Poitras and author, email, May 2013, on file with author. Verax used cover names, even in encrypted correspondence, to add one more layer of security.

  did not invoke any official grievance procedure: In a statement sent by email to reporters, the NSA public affairs office wrote, “There are numerous avenues that Mr. Snowden could have used to raise . . . concerns or whistleblower allegations. We have searched for . . . indications of outreach from him in those areas and to date have not discovered any engagements related to his claims.” NSA statement, May 29, 2014.

  a recent presidential directive: President Obama’s directive extended whistleblower protections for the first time to intelligence community employees. It made no mention of contractors. In any case, its procedures did not come into effect until July 2013, a month after the first Snowden disclosure. See “Presidential Policy Directive 19,” October 10, 2012, http://fas.org/irp/offdocs/ppd/ppd-19.pdf. Also see Glenn Kessler, “Edward Snowden’s Claim That He Had ‘No Proper Channels’ for Protection as a Whistleblower,” Washington Post, March 12, 2014, http://wapo.st/1RMjylz.

  The Intelligence Community Whistleblower Protection Act of 1998, Public Law 105-272, at https://perma.cc/JJ64-WC43, provides a secure means for employees—including contractors—to report to Congress or an agency’s inspector general on matters of “urgent concern” regarding classified information. According to the Defense Department, however, it offers no protection “from reprisal for whistleblowing.” The statute’s definition of “urgent concern” specifically excludes “differences of opinions concerning public policy matters.” See “About the ICWPA,” Department of Defense Office of the Inspector General, www.dodig.mil/programs/whistleblower/icwpa.html [inactive]; and Daniel D’Isidoro, “Protecting Whistleblowers and Secrets in the Intelligence Community,” Harvard Law School National Security Journal, September 29, 2014, http://harvardnsj.org/2014/09/protecting-whistleblowers-and-secrets-in-the-intelligence-community/.

  Three digital vaults: The Pandora and Verax vaults were in TrueCrypt format, with Verax inside Pandora. The innermost vault, Journodrop, which was inside Verax, was an encrypted, compressed archive in a format called 7z, an alternative to the more familiar zip format.

  one gigabyte could hold: The forensic security firm Setec has published a reference sheet, “How Many Pages per Gigabyte and Megabyte?,” www.setecinvestigations.com/resources/techhints/Pages_per_Gigabyte.pdf.

  My master’s thesis: “Secrecy, Security and the ‘Right to Know’: Some Grounds and Limits of Open Government” (M.Litt. thesis in Politics, University of Oxford, 1988).

  twice taught a Princeton course: The course, WWS 384, was called “Secrecy, Accountability, and the National Security State.” See https://registrar.princeton.edu/course-offerings/course_details.xml?courseid=011833&term=1132.

  cover names, handling caveats, and access controls: The authoritative source is “Intelligence Community Authorized Classification and Control Markings,” Controlled Access Program Coordination Office, Office of the Director of National Intelligence, March 30, 2012, https://perma.cc/M9W2-SY3Z. For a slightly more user-friendly guide, see “Marking Classified National Security Information,” Information Security Oversight Office, Revision 4, January 2018, https://perma.cc/6N2K-2SZB.

  surveillance program created by Dick Cheney: See Gellman, Angler, chapters 11 and 12.

  “Wish I knew the underlying details”: Author to Poitras, August 7, 2012.

  Years later he told me: Edward Snowden, interview with author, July 1, 2015, Moscow.

  one final breach of NSA defenses: I tell this story in the final chapter of this book.

  “Edward Joseph Snowden, SSN”: The redaction of his Social Security number is mine, not Snowden’s. He provided it to us in full.

  “Former Senior Advisor”: I take up later in this book whether Snowden exaggerated the nature or seniority of his positions. The titles he used here were imprecise.

  CHAPTER TWO: HEARTBEAT

  steered his new Integra: For Snowden’s daily commute from his home at 94-1044 Eleu Street in Waipahu to the Kunia Regional Security Operations Center, see Google Maps, https://goo.gl/4vwT8w.

  It was March 2012: Snowden, interview with author, July 1, 2015, Moscow.

  half an hour’s drive from the Baskin-Robbins: Peter Serafin, “Punahou Grad Stirs Up Illinois Politics,” Honolulu Star-Bulletin, March 21, 2004, http://archives.starbulletin.com/2004/03/21/news/story4.html. For the drive time, see Google Maps, https://goo.gl/SY1673.

  shabby with age: The physical description of Kunia’s underground facility is based on interviews with former members of the workforce there. Its origins, design, and successive tenants are described in “History of NIOC Hawaii,” Navy Information Operations Command, www.public.navy.mil/fltfor/niochi/Pages/AboutUs.aspx; and Donna Miles, “Beneath the Pineapple Fields,” Soldiers, January 1995, 26–27, https://fas.org/irp/news/1995/soldiers_jan95_p26.htm.

  did not break ground: See Michael A. Lantron, “NSA/CSS Hawaii Breaks Ground for New Operations Security Center,” U.S. Navy news release, September 7, 2007, www.navy.mil/submit/display.asp?story_id=31660.

  was still “Charlie Foxtrot”: The NSA announced completion of the new Captain Joseph J. Rochefort Building just before Snowden arrived. Sources with firsthand knowledge told me that much confusion accompanied the move, with the usual complaints and growing pains. Years later, the Kunia Tunnel remained in use, with many offices still divided between the two facilities. See NSA press release, “NSA/CSS Unveils New Hawaii Center Designed to Boost Intelligence Integration, Collaboration,” January 6, 2012, at https://perma.cc/JV6V-75WZ.

  scanned his green contractor’s badge: NSA badges are color-coded for quick identification: blue for employees, green for contractors, red (with a big “V”) for visitors, black for photographers, and so on. Snowden, interview with author, December 6, 2013, Moscow; agency sources who wish to remain unnamed, interviews with author.

  miles of fluorescent bulbs: “History of NIOC Hawaii” reports that there are roughly five thousand bulbs, each forty inches long. End to end, they would stretch for more than three miles.

  “It’s like a Bond villain’s lair”: Snowden, encrypted live chat with author, February 14, 2014.

  other noms de code: At various stages of interaction with Laura Poitras, Glenn Greenwald, and me, Snowden used alter egos including Cincinnatus, anon108, and Citizen Four.

  “I was starting to operationalize”: Snowden, interview with author, July 1, 2015, Moscow.

  he blamed “tabloid values”: Snowden, interview with author, December 6, 2013, Moscow.

  serious epileptic seizure: Snowden described a “really big epilepsy scare” and “a pretty serious event” that prevented him from driving again under Maryland law. He declined to provide further details. Snowden, chat with author, February 14, 2014.

  Dell Advanced Solutions Group: Snowden’s business card, examined by author, said only Dell. The division he worked for was also known as Dell Services Federal Government.

  intended to pedal to work: In his memoir, Snowden implies but does not quite say that he actually commuted by bicycle. He told me, in a lengthy exchange of emails, that he had planned to bike but changed his mind and drove despite the small risk of an epileptic seizure. See Edward Snowden, Permanent Record (New York: Henry Holt, 2019), 215.

  six seizure-free months before driving: Hawaii’s law was actually stricter than Maryland’s, which forbade driving by anyone who had had a seizure in the three previous months. See Epilepsy Foundation, “Driver Information by State,” www.epilepsy.com/driving-laws/2008696, and HAW. REV. STAT. § 286-4.1 (2011).

 
NSA’s National Threat Operations Center: Formally, it is the NSA/CSS Threat Operations Center, the CSS being Central Security Service. See National Cyber Incident Response Plan, September 2010, www.federalnewsradio.com/wp-content/uploads/pdfs/NCIRP_Interim_Version_September_2010.pdf. For an advertised position similar to Snowden’s, see National Security Agency, “Computer Network Defense (CND) Analyst,” NTOC, Hawaii, archived at https://archive.is/ioxyb.

  CACI International: CACI International was one of four prime contractors at the time under an NSA umbrella program called AXISS (Agency Extended Information System Services), for information technology and security services. See Brian Friel, “Spy Agency Multiple-Award Contracts Bring 80 Companies $20 Billion,” Bloomberg Government, November 20, 2012, reposted at http://iissonline.net/spy-agency-multiple-award-contracts-bring-80-companies-20-billion/. A sampling of current AXISS contract jobs at the company may be found at http://careers.caci.com/key/Axiss-NSA.html [inactive].

  “a half hour a day”: Snowden, live chat with author, February 13, 2014.

  One baffled colleague: Correspondence released by the NSA in FOIA case 78137E, on file with author. See Jason Leopold, Marcy Wheeler, and Ky Henderson, “Exclusive: Snowden Tried to Tell NSA About Surveillance Concerns, Documents Reveal,” Vice News, June 4, 2016, https://news.vice.com/article/edward-snowden-leaks-tried-to-tell-nsa-about-surveillance-concerns-exclusive. The full correspondence is at www.documentcloud.org/documents/2852366-Leopold-FOIA-NSA-Emails-About-Snowden-Concerns.html.

  Off-the-books arrangements: Confidential sources, interviews with author, February 2014. A Dell spokesman declined to comment. For background, see U.S. Government Accountability Office, “Civilian Intelligence Community: Additional Actions Needed to Improve Reporting on and Planning for the Use of Contract Personnel,” January 2014.

  Microsoft-certified systems engineer: The MCSE, a frequently required credential in technology jobs, has since been renamed “Microsoft-certified solutions expert.” It signifies expertise in designing, building, and maintaining technology systems for large enterprises. See Microsoft, “Explore Microsoft Certifications,” www.microsoft.com/en-us/learning/mcse-certification.aspx.

  “three tiers of system administrators”: Ben Wittes and Robert McChesney, podcast with Lonny Anderson, Lawfare, December 18, 2013, www.lawfareblog.com/lawfare-podcast-episode-54-inside-nsa-part-iii-wherein-we-talk-lonny-anderson-chief-nsas-technology.

  “I was also helping out”: Snowden, interview with author, July 1, 2015, Moscow.

  “art of technology”: See “Welcome to Ars Technica,” Ars Technica, May 8, 1999, https://archive.is/PPRME.

  hosted online salons: See Kara Swisher, “Ars Technica’s Ken Fisher Speaks!,” All Things Digital, April 17, 2008, http://allthingsd.com/20080417/ars-technicas-ken-fisher-speaks/.

  the man behind that handle: See Kristina Cooke and John Shiffman, “Exclusive: Snowden as a Teen Online: Anime and Cheeky Humor,” Reuters, June 12, 2013, https://archive.is/SZbRn; and Joe Mullin, “NSA Leaker Ed Snowden’s Life on Ars Technica,” June 12, 2013, http://arstechnica.com/tech-policy/2013/06/nsa-leaker-ed-snowdens-life-on-ars-technica.

  free to speak anonymously: Snowden, interview with author, July 1, 2015, Moscow.

  In the Army slang: See U.S. Army, “Soldier-Speak: A Brief Guide to Modern Military Jargon,” March 8, 2015, at https://perma.cc/KC34-TS88.

  “belligerent, self-important”: See TheTrueHOOHA, “Building a Web Server?,” Ars Technica OpenForum, December 30, 2001, https://arstechnica.com/civis/viewtopic.php?p=16430380#p16430380.

  “It’s my first time”: See TheTrueHOOHA, “Building a Web Server?,” Ars Technica OpenForum, December 29, 2001, https://arstechnica.com/civis/viewtopic.php?p=16430380#p16430380.

  Shrike and Belgarion: Snowden, Permanent Record, 48.

  His father, Lonnie G. Snowden Jr.: Edward Snowden and a family confidant, interviews with author, 2015 and 2016. See also Bryan Burrough, Sarah Ellison, and Suzanna Andrews, “The Snowden Saga: A Shadowland of Secrets and Light,” Vanity Fair, May 2014, www.vanityfair.com/news/politics/2014/05/edward-snowden-politics-interview.

  Snowdens moved north: In 1993, the Snowdens bought a house on Knights Bridge Turn in Crofton, Maryland. See Julie Bykowicz and Greg Giroux, “NSA Leaker Was Shy, Computer-Bound Teenager in Maryland,” Bloomberg, June 11, 2013, http://bloom.bg/25eHvZn.

  with precocious chatter: Snowden, interview with author, July 1, 2015, Moscow; family confidant, interview with author, December 10, 2015.

  Teachers at the Crofton Woods: Greg Toppo, “Former Neighbor Remembers Snowden as ‘Nice Kid,’” USA Today, June 10, 2013, http://usat.ly/1VgZmfk.

  his IQ score: Snowden family confidants, interviews with author on condition of anonymity, 2014 and 2015. For a table of IQ score distributions, see iqcomparisonsite.com/iqtable.aspx. Also see James Bamford, “The Most Wanted Man in the World,” Wired, August 22, 2014, www.wired.com/2014/08/edward-snowden/.

  Snowden’s older sister: Federal Judicial Center, “Annual Report” (2015), https://archive.fo/yhlza.

  She skipped a grade: Family confidant, interview with author, July 22, 2014.

  He refused to bother: Family confidant, interview with author, October 12, 2015.

  His grades were erratic: Family confidant, interview with author, July 22, 2014.

  refused to return to school: Edward Snowden, interviews with author, 2015. See also Snowden, Permanent Record, 65.

  “The public education system”: The accent in “spikéd” and the confusion of “its” and “it’s” are from the original. See “Profile: Ed Snowden,” Ryuhana Press, Wayback Machine, April 27, 2002, http://web.archive.org/web/20031018021255/http://ryuhanapress.com/ed.html.

  “I’m from the Los Alamos National Laboratory”: Family confidant, interview with author, August 2016.

  asked if Snowden was looking for work: Snowden, Permanent Record, 60.

  seemed to be choosing almost at random: Snowden and a family confidant, interviews with author, 2014 and 2015. See also Jean Marbella, Shashank Bengali, and David S. Cloud, “Details About Edward Snowden’s Life in Maryland Emerge,” Baltimore Sun, June 10, 2010, www.baltimoresun.com/news/maryland/bs-md-snowden-profile-20130610-story.html.

  “I’m not paying for you”: Snowden family confidant, interview with author, December 10, 2015.

  The results and his diploma arrived: Test scores and diploma No. 269403 from the Maryland Department of Education are on file with author, courtesy of the Snowden family.

  course in Windows system engineering: Snowden, interview with author, July 1, 2015, Moscow; family confidant, interview with author, December 10, 2015. See also Matthew Mosk et al., “Timeline: Edward Snowden’s Life as We Know It,” ABC News, June 13, 2013, http://abcn.ws/21lizMS. Johns Hopkins University cut its ties with the for-profit entity seven years later, and the company was reported to be shut down. See South China Morning Post, June 22, 2013, www.scmp.com/news/world/article/1266209/booz-allen-hired-snowden-despite-discrepancies-his-resume; and an archived version of the CCI website in 2004, https://web.archive.org/web/20040611145138/http://www.jhutrain.com/about.aspx.

  syllabus spanning 4,416 pages: At that time the relevant corpus was the five-volume Microsoft Windows 2000 Core Requirements Training Kit (2nd ed., Microsoft Press, 2002). See also the subsequent Daniel Petri, “Windows 2000 MCSE Certification Requirements,” Petri IT Knowledgebase, January 8, 2009, www.petri.com/windows_2000_mcse_certification_requirements; and MCSE: Windows 2000 Exams in a Nutshell, Safari Books Online, www.safaribooksonline.com/library/view/mcse-windows-2000/0596000308/ch01s03.html.

  identification number 2661071: The author reviewed Snowden’s certificate, dated 2002, on June 14, 2016, courtesy of the Snowden family.

  “I’m not convinced I’m actually that intelligent”: Snowden, interview with author, July 1, 2015, Moscow.

  “Can you redeem your degree�
�: TheTrueHOOHA, Ars Technica OpenForum, May 12, 2003, https://arstechnica.com/civis/viewtopic.php?p=12895678#p12895678.

  ran a pair of businesses: They were not always successful. As a friend wrote on her blog in 2003, Snowden could be hard to keep on task: “Ed was easily distracted from work by shiny objects . . . like monitors with games on them.” See Katie Bair, “Counting Unhatched Chickens,” Katie Bair’s Art Emporium & Petting Zoo, April 16, 2003, https://web.archive.org/web/20030608093220/http://www.katiebair.com/news.html.

  a web design company: “Clockwork Chihuahua Studios,” Wayback Machine, July 8, 2002, https://web.archive.org/web/20030604101959/http://clockworkchihuahua.com/index.html. In his memoir, Snowden disguises the name as “Squirreling Industries.” See Snowden, Permanent Record, 70.

  online showcase for anime: “Ryuhana Press,” Wayback Machine, November 3, 2001, http://web.archive.org/web/20020408171636/http://ryuhanapress.com/home.html.

  brought a lot of money: Snowden, interview with author, July 1, 2015, Moscow.

  “Editor/Coffee-Boy”: Ed Snowden profile, Ryuhana Press, Wayback Machine, April 27, 2002, http://web.archive.org/web/20031018021255/http://ryuhanapress.com/ed.html.

  “Ed is positive”: “Ahhh . . . Birthdays Are a Blessed Time,” Ryuhana Press, Wayback Machine, June 21, 2002, http://web.archive.org/web/20031008215713/http://ryuhanapress.com/edbirthday.html.

  otaku for obsessive fans: Annalee Newitz, “Anime Otaku: Japanese Animation Fans Outside Japan,” Bad Subjects, April 1994, http://www.udel.edu/History-old/figal/Hist372/Materials/animeotaku.pdf.

  this time taking his friends: Katie Bair, “Yes Folks, She’s Still Standing!,” Katie Bair’s Art Emporium & Petting Zoo, August 13, 2002, https://web.archive.org/web/20030130163154/http://www.katiebair.com/news081302.html.