Edward Snowden is a whistleblower who revealed the existence of STELLARWIND, the US government’s mass surveillance program.
Edward, who’s referred to as “Ed” throughout the book, was born in 1983, the same year as the public Internet. Growing up, Ed was fascinated by technology. He first encountered video games when he was six and his family got a home computer when he was nine. By age 12, his goal was to spend as much time on the Internet as possible.
The Internet of Ed’s childhood was a different entity than it is today. The early Internet was mainly used by people (rather than governments or businesses), it wasn’t monetized, and it was anonymous. Ed—and everyone—had tremendous freedom online.
In Ed’s teenage years, he began to question authority and got into hacking. His most notable achievement was discovering a security hole on the website of the Los Alamos National Laboratory, a US nuclear facility.
In freshman year of high school, Ed’s parents divorced, and in sophomore year, he came down with mononucleosis. He became too ill to even use the computer and missed so much school he was told he’d have to repeat the year. Ed absolutely did not want to do this, so he “hacked” the school system—he discovered he didn’t actually need a high school diploma to attend college, so he applied to Anne Arundel Community College and was accepted.
Ed enjoyed his college classes more than he’d enjoyed his high school ones. He made friends with a group of people in his Japanese class and one of them, Mae, owned a web design business. She hired Ed to work for her.
Ed was infatuated with Mae, even though she was older and married, and enjoyed working with her even though the actual work was sometimes repetitive. If he wanted to keep working in tech, he knew he’d have to acquire a professional certification, so he tested for his Microsoft Certified Systems Engineer (MCSE).
September 11, 2001, changed everything for Ed (and for the US). Ed had never felt more patriotic or American and decided to serve. He didn’t have enough qualifications to be a hacker for an intelligence agency, and computers were easy for him and he wanted to do something harder. Therefore, he joined the army.
Ed injured his legs during basic training and had to leave the army. The army taught him that the military didn’t want its soldiers to think and that he’d have a better chance at defending democracy from behind a computer.
Ed’s first job as a technologist was for a company called COMSO that contracted services to the CIA. (Intelligence agencies rely so heavily on contracting that it’s easier to work for them as a contractor than as an employee.) Ed spent the next few years working at a variety of positions for the CIA and NSA in the US, Geneva, and Tokyo. Because Ed worked with computer systems, he had top secret security clearance and access to more documents than most individuals would, even those higher up in the agency.
When Ed was in Tokyo, three important things happened:
Ed eventually found the classified version of the PSP report. This version revealed the US had been conducting mass surveillance on its citizens past the expiry of the PSP. It had details about the program, STELLARWIND, and explained how the NSA had gotten around legislation and the Constitution. A secret court had given the NSA a blanket warrant to collect everyone’s data, which was questionable because warrants are by nature meant to be specific.
Because most of the Internet is based in the US or owned by American companies, STELLARWIND affected nearly everyone in the world.
Initially, Ed decided not to do anything about what he’d discovered. He and his girlfriend moved back to the US from Japan and Ed began a stressful job as a solutions consultant with Dell.
Around the same time, clouds and smart home devices were becoming popular. People were happy—and sometimes even willing to pay—to share their data with companies. Ed wondered if anyone would even care about government mass surveillance if they were so willingly sharing their data with corporations.
Ed had his first epileptic seizure and had to take a leave of absence from work. While he was recovering, he spent much of his time watching news coverage. He wondered if mass surveillance was a legitimate problem, given the scale of some of the conflict and violence taking place around the world. However, he couldn’t help but notice that while people’s causes and governments differed, the main thing everyone wanted was to be free from oppression and censorship.
In the hopes of better managing his epilepsy, Ed took a new job with the NSA in Hawaii, which his doctors had recommended for its relaxed lifestyle. While there, he decided to learn more about the mass surveillance program. He knew he wouldn’t be able to decide what to do about it until he understood it fully.
Ed created a program called Heartbeat. Heartbeat searched the intelligence agencies “readboards” (news blogs) and pulled documents. It then created a feed tailored to an agent’s office, clearance, and projects. Ed had access to everyone’s documents and used Heartbeat to learn more about the mass surveillance program without arousing suspicion.
After reviewing the Constitution in 2012, Ed decided he had to act. STELLARWIND violated the Fourth Amendment. He decided to get in touch with journalists and share the top secret documents that proved the existence of the US’s mass surveillance program.
If Ed was caught, he’d be arrested, and the NSA had plenty of security. However, Ed had spent his entire career learning to anonymize himself on the Internet and he’d built a lot of the systems the NSA used, so he knew how to exploit them. Additionally, as a systems administrator, Ed also had access to reports about people who’d been caught selling secrets, so he had some idea of how to avoid detection.
Ed had already found the documents he needed to leak through Heartbeat, but the NSA logs everything that’s done on their network-connected computers, so Ed couldn’t organize or make copies of the files without attracting attention. He switched to the night shift and invented a compatibility-testing project that gave him a legitimate reason to transfer Heartbeat files onto older computers that weren’t connected to the NSA’s main networks. On these old computers, Ed compressed and encrypted the documents and transferred them onto small SD cards. Then he smuggled the SD cards out of the NSA in his cheek, in his socks, or behind the panels of a Rubik’s Cube.
Connecting with journalists was also a challenge. Ed decided to start with Laura Poitras and Glenn Greenwald, two journalists who were on the intelligence agencies’ to-watch list. To get in touch with them anonymously, Ed drove around the island of Hawaii and connected to strangers’ wifi connections. He used encrypted email and a computer that deleted everything he did on it every time it was shut down.
Ed wanted to see how mass surveillance technology works in practice, so he took a job at the NSA’s National Threat Operations Center. There, he used XKEYSCORE, a program that allowed him to view almost everything anyone had ever done on the Internet. He learned about what porn people watched and saw pictures of their families. He found it incredibly invasive.
Ed continued talking to the journalists. He had trouble setting up a meeting in advance because he couldn’t give them a date or place. He had to find a country that had free internet but also wouldn't be so intimidated by the US that it would immediately give Ed up when the story broke.
Ed met with journalists in Hong Kong in spring 2013 and the mass surveillance program was revealed to the public. Ed decided to reveal his own identity as the whistleblower so he could do so on his own terms. (If the government revealed him first, they’d try to discredit him and shift the focus from their illegal activities to Ed’s.) Ed’s family and girlfriend back in the US were harassed by the government—his girlfriend went through long interrogations and was followed by the FBI 24/7.
The US government charged Ed under the Espionage Act for divulging top secret documents and called for his extradition. The government of Hong Kong wouldn’t protect him and he tried to get to Ecuador with the help of WikiLeaks, an organization that publishes leaks and classified information. Ed couldn’t fly direct and ended up stranded in Russia when the US canceled his passport.
Ed was stuck in a Russian airport for forty days before the Russian government granted him temporary asylum. His girlfriend moved to Russia to join him and they were married. Ed still lives in Russia as of 2019, where he works for the Freedom of the Press Foundation.
Ed’s disclosures resulted in:
In 2013, Edward Snowden leaked top secret documents to the media. The documents revealed that the US government was conducting mass surveillance on its citizens and nearly everyone in the world.
Permanent Record is Ed’s memoir. It was originally written in three parts and 29 chapters. This summary has reorganized the part and chapter divisions for concision and clarity.
In this summary, Ed’s story is organized as follows:
Part 1 covers the early years of Edward’s life, from childhood until college. Each chapter starts with a section about the context in which Ed was growing up, followed by a section about Ed’s life.
Context: The Internet
When we talk about the Internet, we tend to treat it like a single entity. In fact, “Internet” most broadly refers to the network of networks that connect computers all over the world. The computers connect via “languages” called protocols. There are many kinds of protocols. For example, the Hypertext Transfer Protocol (http) allows computers to communicate about websites. There are so many different types of protocols that there are few things that can’t be digitized. Food, water, clothes, and homes are some of the only things that can’t go online.
The public Internet was created in 1983 by the US Department of Defense. The Department of Defense had a group of interconnected computers that they split in half. They kept half for their own use and named the network MILNET. The other half became the Internet.
At the time of the book’s publication (2019), around three billion people—42% of the world’s population—used the Internet regularly.
Edward Snowden was born on June 21, 1983, in Elizabeth City, North Carolina. He came from a long line of heroes and patriots. His grandfather and father both worked for the Coast Guard and his mother was directly descended from the barrelmaker on the Mayflower.
Ed was part of the last generation whose childhood wasn’t digitized. His baby photos are in photo albums instead of on Facebook, and his home videos are on VHS tapes instead of YouTube. Unlike online digital records, these analog formats won’t last forever.
Context: The World Wide Web
The World Wide Web is the collection of web pages accessed via the Internet. It was invented in 1989 in Geneva by the Conseil Européen pour la Recherche Nucléaire/European Organization for Nuclear Research (CERN).
As a child, Ed liked spying. In his parents’ house, there was a window between his room and the den and he would spy on his family members as they watched TV, did chores, or in the case of his father Lonnie, played with technology.
In his work as an engineer with the Coast Guard, Lonnie often had access to new technology and sometimes he brought it home. One day, Lonnie brought home a Commodore 64, one of the first home computers. Ed spied on his father while he played Choplifter!
Ed got caught, but his father wasn’t mad. Instead, Lonnie let Ed sit on his lap as he played Choplifter! He even gave Ed an unplugged joystick so he could pretend to play along.
Lonnie was often away for work, so Ed’s mother Wendy was a large part of his childhood. She taught Ed and his sister, Jessica, how to read by labeling their dresser drawers (socks, underwear) and taking them to the library. Ed’s favorite books were about machines, but he also liked King Arthur and Greco-Roman myths, especially the story of Hephaestus/Vulcan. He liked the idea of a group of goddesses and gods who fought among themselves and interfered with and spied on humanity.
Wendy also taught Ed math. She would buy him things only if he could correctly add up the prices. At first, he only had to round to the nearest dollar, then get the actual amount, then calculate tax.
In 1989, when Ed was six, his family got a Nintendo (8-bit NES). He loved it so much his mother made a rule that he had to finish a book every time he wanted to rent a new game. He was faster at beating games than reading, so he beat the system by taking out short books with lots of pictures so he could get through them more quickly.
Context: Fix-It Culture
In the author’s parents’ generation, when something broke, you fixed it, or got it fixed. By the time the author’s generation came along, however, when something broke, it was easier, cheaper, and faster to just get a new one. Getting something fixed was often more expensive than buying a new version, and buying the parts and fixing it yourself was even more expensive.
As a result, no one really knows how a lot of technology works anymore. When it breaks, we’re at its mercy.
When Ed was seven, the Nintendo stopped working. Ed tried the only fix he knew—blowing into the slots where the game and console connected to clear out the dust. It didn’t work, so he took the Nintendo apart, which was what he’d seen Lonnie do with electronics that weren’t working. Ed didn’t know how to repair it and ended up making the problem worse.
When Lonnie got home, he explained that to fix things, you can’t just look for a broken part, you also have to consider how and why something had gone wrong. He showed Ed what every part of the Nintendo did on its own and how it worked together with the other parts. According to Lonnie, fixing things wasn’t just about fixing the existing design. If something is set up in the most efficient way and just malfunctioning, then all you have to do is fix it. But if there’s something off with the design, you have to improve it.
To fix the Nintendo, Lonnie wanted to use some special equipment at the Coast Guard base, so he brought Ed to work. The base had advanced (for the time) computers. Up until this point, Ed had only used video game consoles. While Lonnie fixed the Nintendo, he gave Ed some simple instructions to type into the computer. Ed found typing much more natural than writing (he was left-handed but forced to become a rightie) and loved that he had the power to tell a machine to do something. He realized gaming systems had nothing on computers—you could interact with them and play through levels, but you couldn’t change the game. With a computer, you could do anything, and anyone could reproduce it.
Context: Employment at Fort Meade
Fort Meade
Fort Meade is the second-largest US army base and the headquarters of the National Security Agency (NSA). In the 90s, every fourth person in the surrounding Anne Arundel County worked for Fort Meade and the area had a civil servant monoculture. The base was part of the community and had a pool, grocery store, and post office.
Job Compartmentalization
In the 90s, people in the government didn’t talk much about their jobs, either to their kids or to each other. This was partly because of confidentiality, but also because people’s jobs were so specialized and technical no one else was interested in the details.
Even today, the government values compartmentalization, and it’s normal for employees not to understand how their job fits into the larger picture.
When Ed was nine, his family moved to Crofton, Maryland. Lonnie continued to work for the Coast Guard. Wendy took a new job at the NSA, the National Security Agency, making retirement arrangements for spies.
Ed had been popular enough and had good grades back in North Carolina, but he didn’t fit in at his new school. He didn’t like sports, he wore glasses, and his classmates mocked his Southern accent. He was so insecure about his accent that he taught himself to speak differently and didn’t talk at school until he’d ironed it out. Not talking affected his grades enough that his teachers thought he might have a learning disability. They got him to take an IQ test, which he scored very high on. This resulted in “enrichment assignments.”
Shortly after moving to Crofton Ed’s family got a Compaq Presario 425, their first home computer. At the time it seemed state of the art—it had a 25MHz CPU, 200MG hard disk, and a 256-color monitor.
Ed adored the computer. He spent all his time on it and hated sharing it with his other family members. He particularly liked a video game called Loom. Video games had advanced since Choplifter!—now they had plots instead of simply premises—and Loom was about a magical loom that can control events. A boy learns about the loom and what it can do and is sent into exile. The parallel between the magical loom and a computer wasn’t lost on Ed—a magical loom connected to the world via threads while a computer connected to the Internet via cables, and both could influence the world.
Computers and the Internet would have a huge effect on Ed during his formative years.
Ed would spend even more time with computers in his teen years.
Context: Complete Separation of Online and Real Life
In the 90s, unlike today, your online persona was completely separate from your real self. This anonymity meant you were free to be as creative and open as you liked. You never had to worry about your reputation, or looking like a hypocrite, or if people would make fun of your tacky GeoCities site. People posted about whatever they liked, hoping to sway others to their opinion. Because the Internet was anonymous, you could easily change your mind and reinvent yourself anytime.
The Internet also encouraged creating new, separate identities via role-playing games, especially MMORPGs (massively multiplayer online role-playing games). To play these games, you had to create an avatar, or “alt.” You could be any of a group of stock medieval characters including a thief, wizard, or warrior. You could also have more than one “alt” and switch between them whenever you liked.
Everything would change in the 2000s when the government and businesses started to link online personas to people’s real-life identities.
When Ed was approximately 12, he decided to spend as much time as he possibly could online. The Internet became an obsession. He became paler, sedentary, and slept at school instead of at night. His grades fell again. He didn’t mind because he was getting an education online and his parents were happy enough with this reasoning—for a while.
Ed especially liked learning about technical subjects and playing games, but he learned about all sorts of subjects. He sometimes felt like he wanted to consume the entire Internet. Every moment he wasn’t online new things were going up and he was missing them. When his family members kicked him off the computer, he’d print things to read, or he’d sneak online at night when everyone else was asleep.
There were a few ways to chat with people online, and Ed liked online bulletin-board systems (BBSes). Ed mostly used them to ask questions about building computers and received plenty of personal, generous responses. Reflecting back on this as an adult, Ed thinks most people on the Internet were civil because there was a high bar for entry. It wasn’t easy or convenient to use the Internet—you had to plug your computer into a phone jack and it could take whole minutes to establish the dial-up connection. If you were willing to go to the trouble to get online, you were worth talking to.
Ed loved the freedom anonymity gave him. He didn’t have to be a 12-year-old boy, he could be anyone, and he created a variety of personas for himself. Whenever he had what he considered a stupid or amateur question, he’d ask it on an amateur board under a new name. Or, if he posted something inflammatory and people hated the post (they couldn’t hate him because they didn’t know who he was), he’d drop the name and pick up a new one. Sometimes, he’d even use the new name to join the mob complaining about what he’d previously posted himself. He felt this was a relief. Thinking back to this time as an adult, Ed thinks it was important that he could do or say stupid things on the Internet and not be held accountable. When he made mistakes, no one knew it was him who’d made a mistake, and it was easy to recover.
Ed finally had to reveal his age after one of his BBSes tried to set up in-person meetings. People wanted him to go and he finally had to explain why he couldn’t. No one minded that he was young though; in fact, his correspondents became more encouraging.
When Ed played MMORPGs, he enjoyed trying to figure out which alts belonged to the same person. Based on how their alts spoke or acted, he could see patterns between characters that suggested they were voiced by the same person. He also liked trying to make his alts as distinct as possible so that no one would figure out they were played by the same user.
Ed’s obsession with the computer was inconvenient for his family, especially his sister. The Internet was dial-up, so the phone and Internet couldn’t be used at the same time, and Ed would use the Internet so frequently Jessica would miss calls from her friends. As revenge, sometimes she’d pick up the phone when Ed was in the middle of something online to break the connection. You can’t save or pause MMORPGs because they’re live—other people are playing it at the same time—so when you get interrupted, your character dies.
Ed’s parents handled this by installing another phone line and switching the Internet plan to unlimited.
Context: Hacking
Hacking doesn’t only happen in the tech world. Hacking is simply finding a way to exploit the weakness of a system. When people build systems, they rely on assumptions they haven’t necessarily thought through and sometimes don’t even test their systems. They only consider how their system is supposed to work. A hacker discovers how it actually works, or how they could make it work differently.
Hacker culture is based in playfulness and cleverness, and it generally comes with antiauthoritarian politics. Many hackers believe more things should be free and publicly accessible.
As Ed entered his teenage years, he encountered the same struggle all teenagers have to deal with—feeling like they’re adults but being treated like children. This was where he really started questioning the rules—if there wasn’t a good justification for a rule to be followed, it was just a power trip. At this time in his life, Ed thought in terms of black and white—binary is only 0 or 1, false or true. He hadn’t developed nuance.
Ed’s teenage rebellion consisted of hacking, which he considers to be the most educational, healthiest, and sanest way to establish independence. Hacking is a great way to put yourself on equal footing with an adult because all you have to do is reason, which doesn’t have anything to do with your age.
On Ed’s first day of school when he was 13, his teachers gave out their grading policies and syllabi. For the first time, Ed knew how grades were calculated. And once he knew how the system worked, he could see how to hack it.
Homework, papers, class participation, tests, and quizzes were all worth a percentage of his history grade. Homework took Ed a long time, he didn’t need to do it to do well on quizzes and tests, and it was only 10 percent of his grade. If he stopped doing it and just forfeited the 10 percent, he’d still easily pass the class. Other classes had similar percentage breakdowns, and he stopped doing homework.
This gave him a lot of free time—until he explained his calculations to his math teacher when asked why he never did homework. His teacher smiled, but the next day, he gave out a new syllabus that stated anyone who missed more than six homework assignments would automatically fail.
Ed also did some computer hacking. He didn’t steal anyone’s identity—even if that had occurred to him and he’d wanted to, the Internet wasn’t yet monetized and the only theft he’d heard of was “phreaking,” getting free phone calls. Instead, he hacked games to give himself extra lives or special abilities.
Ed also hacked the website of the US’s nuclear research facility, Los Alamos National Laboratory. Ed was worried about nuclear war and found himself researching the US nuclear program. He ended up on the Los Alamos National Laboratory website and quickly discovered a security problem.
The lab used an open directory structure on their website. This means that the website’s URL showed where and how the site’s files were organized. For example, a URL in an open directory structure might look like this: site.com/sitefiles/docs/publicfile.doc. Publicfile.doc is the document the website intended to show you, but you can access all of the documents in the file tree by typing site.com/sitefiles.
Using this knowledge, Ed was able to access some documents that only employees with security clearances should have been able to. It was personal info rather than blueprints of the plant, but it still scared him. He emailed the lab’s webmaster, who never responded. Next, Ed tried calling the lab. He left a voicemail for the IT department and waited, checking the site regularly to see if the structure was fixed. Weeks later, the lab called to tell him they’d fixed it and thanked him. They realized he was a teenager and told him to get in touch when he was 18.
Ed’s parents got a divorce. Lonnie moved out, and Wendy sold the house and moved to a condo in Ellicott City with Jessica and Ed. Jessica got into the University of North Carolina at Wilmington and also moved out.
Ed blamed himself for his parents’ divorce—if he’d been a better child, it wouldn’t have happened. He tried to be more grown-up and got a cell phone that he wore attached to his belt like an adult. He became closer to mentors rather than his parents. After the divorce, everyone in the family started keeping secrets.
In sophomore year, Ed came down with mononucleosis. He was so tired he couldn’t go to school or even stay awake long enough to do more than play games on the computer. He eventually became too sick to even play on the computer and it was a dark time emotionally. He missed four months of school and then got a letter that told him he’d have to repeat the year. He absolutely did not want to do this and it kicked him out of his slump. He looked for a hack.
Ed discovered you don’t actually need a high school diploma to get into college and got himself accepted at Anne Arundel Community College. He went to class two days a week, which was all he could handle as he was still recovering. It wasn’t a very social experience—the college didn’t have much of a campus life, but Ed didn’t mind. He was younger than anyone else, too sick to do much socializing anyway, and was fine with the anonymity. He liked his college classes better than his high school classes. (He did eventually get his GED.)
Context: The Tech Industry
Professional Certification
In the early 2000s, professional industry certifications were becoming a requirement for jobs in the tech industry. Job postings were starting to require official accreditation from companies like IBM and Cisco if the job was working with their products.
Microsoft Certified Professional series certifications were the most prestigious. There were a few options and the highest certification was Microsoft Certified Systems Engineer (MCSE), with which you’d get a starting salary of $40,000. It wasn’t an easy certification to get, but it also didn’t require you to be a genius.
There were more general certifications as well, that didn’t have to do with specific companies’ products. You could get “A+ Certification” for serving and repairing computers and “Net+ Certification” for networking.
Though these certifications were becoming an industry standard, they weren’t necessarily an indicator of skill, and they changed as the industry invented new ones.
Freelance Industry
During the dot-com boom, when a large company wanted a stronger Internet presence and a website, they’d hire a PR firm or ad agency. The PR firm or ad agencies didn’t know much about the Internet, only enough to write a job description for a web designer. They’d post this on a freelance work portal and mom-and-pop companies would put in bids for the job.
The mom-and-pop companies were so competitive that they priced their services very low. Additionally, the companies had to pay a cut to the work portal, so it was hard to make any money. Companies also didn’t get any credit—the PR firm or ad agency would claim they’d done the project. It was easy for clients to take advantage of mom-and-pop companies.
When Ed was attending college, he met Mae in Japanese class. Mae was a published artist who also owned a web-design business. Ed was infatuated with her and started working as a web designer for her company.
Mae was good at the business side of things, especially once Ed took over some of the web design work, and she’d try to get jobs directly rather than going through the work portals. She was an illustrator so she could also offer logo design and branding services.
Ed enjoyed the job—even though it was sometimes repetitive, he got to spend time with Mae—but realized he needed to certify to go farther in the field. He got his MCSE certification from Johns Hopkins University.
Context: 9/11
9/11 changed many things in the US. The government gave itself, and its intelligence agencies, larger budgets and more power, the extent of which wouldn’t be discovered for years. The threat of terror was used to justify everything, including the secrecy around all the changes.
There was a shift in the population too. The world narrowed into two groups, America and its supporters, and everyone else. There was a huge surge in patriotism and fear. Shooting ranges put Arab men on targets. People bought guns and cell phones.
On September 11, 2001, Ed arrived at Mae’s house for work. Mae lived on base and her husband worked at Fort Meade, so Ed and Mae heard about the attack on the Twin Towers quickly. The base evacuated because Fort Meade could have been the next target.
As Ed left Mae’s, he was able to get in touch with his mother, who was safe, but it took him some time to find out about the rest of his family. Ed was particularly worried about his grandfather, who now worked for the FBI and regularly visited federal buildings. Fortunately, he was fine.
Later in life, Ed would develop more nuanced feelings about the government’s response to 9/11. At the time, though, he fully supported the war. Mae didn’t, and they grew apart. Ed distanced himself from the anti-institutional views of hacker culture and his parents’ apolitical patriotism. He’d never wanted to serve before, but he did now.
Ed thought he’d be most useful behind a computer, but a normal IT job didn’t seem like enough of an outlet for his newfound patriotic fervor. Hacking for the NSA or CIA would have been ideal, but they required a college degree, and Ed only had community college credits and his MCSE certification. (However, intelligence agencies would sometimes waive their requirement for a degree if you were a military veteran.)
Ed enlisted. He chose the army, which his family didn’t approve of because the Coast Guard considers the army leadership crazy.
Part 1 covered Ed’s childhood. Part 2 covers his brief stint in the army in 2004.
Context: Army Backgrounder
18 X-Ray
After 9/11, many US programs were changing. A new program called “18 X-Ray” screened incoming army applicants for Special Forces’ qualification courses at sign-up. Previously, to get into Special Forces courses, you had to already be in the army.
Injuries
The army has a stigma about injuries for a few reasons:
The goal is to make soldiers feel invincible.
The army doesn’t want to be liable for mistraining.
This results in injured recruits being seen as whiners or fakers, and it encourages people to hide injuries. For example, one recruit hurt his hip but ignored it. By the time he got it looked at a week later, he had to go straight into surgery—his hip was broken and the break was sharp enough to slice nerves.
Ed qualified for the X-Ray program based on his performance in his entrance exams. Before he could take any special training, however, he had to go through basic training, which for him was held at Fort Benning, Georgia. Ed spent most of the journey there next to a giant man nicknamed Daisy who became one of his regular training partners. The buddy carries were tough for Ed because Daisy massively outweighed him. However, the army also used a lot of bodyweight training, which Ed had an advantage in because he was slight.
Ed’s main impression of training was that the point was to make the recruits so exhausted that they couldn’t rebel or question orders.
During a land navigation movement drill—map and compass navigation—Ed fell and injured himself. He was diagnosed with bilateral tibial fractures. The only way to heal was to keep weight off his legs, so he was benched for a few days before he would be reassessed. Ed was worried—if you miss more than three or four days of training, you’re in danger of having to restart basic training or being sent home. He’d lose his spot in the 18 X-Ray program if he didn’t complete basic training on time.
While Ed was injured, he was put on fireguard. His partner decided to go AWOL, which is a crime. Ed asked why the man had even told him—Ed was injured and the man would have had plenty of time to run away while Ed was at the latrine. He explained that Ed was the only one who listened. Ed believed him, went to the latrine, and didn’t tell anyone that the man was leaving.
Ed was reassessed and the doctor said he couldn’t continue with basic training. Ed could try again later, outside of the X-Ray program, or, he could leave the army on “administrative separation.” The doctor explained to Ed that this was a quick, low-paperwork way to leave the army that didn’t involve either an honorable or dishonorable discharge. Ed liked the idea and agreed. Then he saw the paperwork.
Ed had to sign a statement that said he was completely healed. It was a hack. The government was trying to get out of liability and paying him disability benefits. But Ed couldn’t get free without signing, so he did.
Part 3 covers Ed’s career as a technologist, from approximately 2005 to 2009.
Context: Careers in Technology
Career Options
Technologists have a few career options if they want to specialize:
Software developers/programmers. These people write computer code.
Network/hardware specialists. These people physically set up wires and servers.
Systems technologists. These people work with the big picture of computing. They work with software, hardware, and networks. More specifically, the job titles are:
Systems administrators/sysadmins. These people are responsible for maintaining an entire system. When it breaks, they fix it, and they slowly make it better as a whole over time.
Systems engineers. These people solve a problem by inventing a new system to address it, or by massaging existing solutions into something custom.
Security Clearances
The federal government is the only entity that can grant a security clearance and they only clear people who are sponsored—people who have an offer for a job that requires clearance. Most private companies don’t want to hire uncleared people and pay them while they’re waiting for clearance to come through. Therefore, most people get their clearance by taking a government job. Once they have it, they can leave the government and take their clearance with them.
There are three levels of security clearance: confidential is lowest, then secret, then top secret. Top secret also has an additional qualifier, Sensitive Compartmented Information (TS/SCI). The highest-level intelligence positions require TS/SCI and it can take over a year to get this clearance.
To get TS/SCI, a candidate undergoes a Single Scope Background Investigation. This investigation is primarily to find out if a candidate has anything that could be used against them. They care less if your record is perfect and more that you’re honest. If you have a secret, an enemy could use it against you to get access to sensitive parts of your job.
After some time, Ed’s legs healed and he thought about what he would do with the rest of his life. He may not have made the cut for the army, but he was young and smart and had plenty of other options. Part of why he’d gone to the army was because he wanted to succeed at something that was hard for him. Computers had always been easy.
Now, however, Ed realized that he would best be able to serve via a computer. He also realized that computers would have a better chance than guns at implementing and maintaining democracy. Ed wasn’t really a veteran, but having gotten into the army could be some help if he applied to work at an intelligence agency. If he was going to get into intelligence, however, he would also need a security clearance
Ed aimed for TS/SCI. He got a government job with the University of Maryland that would sponsor his clearance application. Ed was a good candidate: he didn’t have a criminal record or drug habit, plenty of his family members had served and so had he, and his only debt was student loans. However, he was still nervous because the check would look into every element of his life. The National Background Investigations Bureau talked to everyone Ed knew, including, he suspects, a man he worked with once at a snow cone stand.
The background check made Ed reflect on his childhood online activities. He was less worried about embarrassing searches for porn—everyone does that—and more concerned about his posts on forums. They weren’t necessarily going to cause a problem for his clearance, but he felt they were stupid. They reflected opinions he’d changed, things he’d said just to be inflammatory (a large part of early Internet culture), or things he’d never meant at all and had said just to get attention. He disagreed with what a lot of his childhood self had written.
Ed could have deleted his posts if he’d wanted to. This wasn’t illegal, nor would it have affected his clearance. However, he decided to leave everything up. If he took things down, he’d perpetuate the idea that you can’t make a mistake—you have to be perfect, and if you’re not, you’ll pay for it forever. Ed decided he’d figure out how to live with what he’d posted, and that in that spirit, he’d keep posting so that his self another ten years from now would get to go through the same thing as his current self was.
Interestingly, his dating profiles never embarrassed him. Reflecting back on this as an adult, he thinks this is because they were supposed to attract real-life attention, so he’d been thoughtful about the content.
The final stage of Ed’s clearance was a polygraph interview. All the questions were yes or no answers and he had to answer them all three times. He passed all three times and came out with the TS/SCI as well as the “full scope polygraph.”
Ed met Lindsay Mills, the woman who would become his wife, on HotOrNot.com. Ed was worried their connection would break when they met in person, but it didn’t. On their first meeting, Lindsay picked him up in her car. Ed had spent so much time worrying about meeting her that he hadn’t actually thought about what they’d do. They ended up driving around talking and then parking and talking.
Ed didn’t have his own set of political values at age 22, he had a mish-mash of principles he’d learned from his parents and online. His parents were federal civil servants who worked for the government, not a particular leader. They were loyal to their country, not a party or specific person who ran the country.
From the Internet and video games, Ed learned that there was a clear line between bad and good. The early Internet also had a lot in common with American values—online, everyone was equal, free, and allowed to pursue whatever they wanted. Ed believed that if you were brave and smart enough, you could succeed.
Context: Government Contracting
In the 2000s, much of the government’s work was done by contractors, including intelligence work. Contractors had a different attitude towards the government than the civil servants of yore—the government was simply a client that paid well, not something to feel patriotic about.
Many people believe that the government uses contractors for nefarious ends—contractors do the dirty work and the government never needs to learn the details. However, it’s more likely that the intelligence community employs contractors because it allows them to get around caps on hiring. Contractors aren’t included in hiring caps, so agencies can hire as many as they want and can afford.
The contractor model has some advantages: the government doesn’t have to pay contractors benefits or pensions, and the government can often get a better deal on the work costs because contractors compete with each other.
However, there are also some disadvantages:
Conflicts of interest. For example, a director might campaign for money to hire a particular contractor, and then later get a job with the same contractor.
Additional costs to taxpayers. “Cost-plus” contractors, middlemen between contracted employees and the government, bill the government for employees’ salaries and then an extra 3-5% of the salaries, as a fee. As a result, contractors try to pay their employees a lot, because they get paid more too.
Ed’s first job was working for the state of Maryland at the University of Maryland, which was helping the NSA open the Center for Advanced Study of Language (CASL). The CASL was supposed to help the NSA figure out how to use computers to understand foreign languages, however, when Ed started, it wasn’t open yet. Ed’s job was to patrol the under-construction building at night. He was basically a security guard.
Ed spent some of his shift looking for a better job. As he was searching, he learned that it was hard to directly serve the government. It would be much easier to get a job with a company that contracted services to the government. Ed found it a bit frightening that the government was hiring outsiders for national security work, because to do anything systems-level, contractors would need access to all sorts of sensitive information. Contracted technologists would also work at secure facilities such as NSA headquarters.
Context: CIA Backgrounder
Headquarters
Contrary to what you see in movies, CIA headquarters isn’t in the building in Langley, Virginia with the agency seal on the floor. That’s the Old Headquarters Building. The New Headquarters Building is in McLean, Virginia, and that’s where most CIA employees work.
Reorganization
9/11 was a massive intelligence failure and as a result, Congress and the executive branch reorganized the CIA and adjusted its powers. Previously, the director of the CIA was in charge of the whole American intelligence community. Congress reduced the director’s power to control of only the CIA, and forced out the existing director, George Tenet. They replaced him with Porter Goss, who was a former CIA officer but also a politician, a Florida Republican congressman.
The CIA was reorganized into five directorates, the Directorates of:
Operations. The DO did the actual spying.
Intelligence. The DI analyzed and synthesized the information gained from the DO spying.
Science and Technology. The DST was like the Q character in James Bond films—they supplied, built, and taught spies how to use weapons, communication devices, and computers.
Administration. The DA liaised with the government and included departments like HR and law.
Support. The DS was the largest and included everyone who supported the agency, including tech workers, doctors, cafeteria workers, and so on. The DS’s main function was to work with the CIA’s global communications infrastructure—basically, ensuring that the other directorates could communicate with each other and agencies, but only as much as allowed. DS maintained security and controlled digital access to CIA servers.
Morale
After 9/11, morale at the CIA was at an all-time low. CIA employees viewed the reorganization and other political maneuverings as betrayal. They felt blamed for some of the Bush administration’s mistakes and they didn’t like Goss as a director because he was a politician. They felt that having a partisan director was an attempt to weaponize the agency. Additionally, Goss was unpopular because he forced retirements, laid people off, and fired people. The CIA, now understaffed, used even more contractors than before.
The CIA was also unpopular with the public because information about black site prisons and other activities was leaked around the same time.
Indoctrination
On their first day, contract technologist employees go to a session called Indoc, short for indoctrination. The session has a few goals:
Convince the attendees that they’re special, elite, and would have access to information even Congress wouldn’t. The author says computer geniuses don’t need much convincing—they already have a healthy sense of their own importance. They’ve always been able to do and learn things with computers that others haven’t. They’re used to making decisions on behalf of others, acting independently, and controlling machines.
Emphasize security practices, such as not telling anyone where you work or what you do, being careful with documents, and not bringing your insecure cell into the workplace.
Present the bad guys. The Indoc leaders show a Powerpoint presentation of former contractors and employees who betrayed the CIA, accompanied by warnings about ruin and imprisonment.
Entering the intelligence community affects a person psychologically. She suddenly has access to a bunch of insider information, she’s supposed to play a part—an ordinary person—and the indoctrination creates a group mentality that the group is loyal to the intelligence community, not the law.
How to Be Ordinary
The intelligence community tries to get all its employees to be “ordinary.” As an employee, you try to be just like everyone else, act the same, talk the same, drive the same boring car, live in an ordinary house, wear mainstream clothing, and so on. Your thrills come from successfully convincing others that you’re just like them. This self-denial can have a profound effect on your psychology. As you learn more about others, so you can copy it, you forget bits of yourself, including things like politics.
CIA Technology
The CIA has its own intranet and versions of Facebook, Wikipedia, and Google. The CIA intranet contains far more detail than the media about current events and the government.
Whenever someone uses a computer at the CIA, she has to consent to her activities being monitored by checking a box. The author suspects this is the reason people working in intelligence aren’t very concerned about online tracking. They don’t give mass surveillance a pass because they think it protects the country; they’re just so used to not having any privacy that they don’t empathize with the public’s desire for it.
Times of Change
When the author entered the CIA, it was during a time of change. The older generation of CIA employees (not contractors), hadn’t or didn’t want to keep up with technology, and were working at tech jobs such as the help desk. The young, incoming contractors were doing the work that required high security clearances. The younger generation generally had low opinions of the career civil servants.
Ed’s first contracting job was with COMSO. He was part of the CIA’s Directorate of Support and his job was to manage CIA server architecture. He would have access to all the systems that stored and accessed intelligence. He also had access to COMSEC (communications security), which involves the codes that are used to protect all CIA information. These codes are considered some of the most secret of the CIA’s secrets. At the time, it didn’t occur to Ed that the breadth of his access might be indicative of a problem.
Ed worked the night shift with a man named Frank. Ed didn’t find the job too difficult and wrote scripts to do his work for him. This gave Ed most of his shift to do whatever he wanted, which was usually looking things up in the CIA intranet. This put him back in touch with his childhood curiosity with the Internet and his desire to know everything. The media might report a quote from an anonymous senior official, but in the CIA database, Ed could find the person’s real name and access their entire personal and employment history. He also searched for conspiracy theories like aliens and chemtrails.
Frank didn’t do much work and Ed eventually learned that the most important part of Frank’s job was doing a storage backup on a miniature tape format that was so old Ed didn’t recognize it. Tape backups are more reliable than digital technology, and Frank was one of the only people both old enough to know how to use them and willing to work a night shift.
The CIA’s Virginia headquarters was a long commute from Ellicott City in Maryland. Lindsay couldn’t move to join Ed because she was still finishing school, but they met up on weekends.
Context: Basic Telecommunications Training Program
The Hill
The Hill is a training facility in Warrenton, Virginia, that teaches, among other things, the Basic Telecommunications Training Program. The Hill is central to the field communications network of the CIA, has two data centers, and is more important than CIA headquarters.
Technical Information Security Officers (TISOs)
In foreign countries, the CIA doesn’t want any outsiders working inside government facilities, so they hire TISOs to work at missions, embassies, or consulates. TISOs deal with all technical infrastructure ranging from computers to solar panels to security—anything that gets plugged in or has something plugged into it is their domain. Additionally, TISOs have to know how to both build and destroy a lot of these systems. If a location is under siege, the TISO is responsible for destroying all the data before getting out themselves and/or sending just-learned information home.
TISO is a CIA job instead of a State Department job, even though the State Department is the organization that actually owns the embassy buildings, because these days, embassies are primarily used for espionage. There’s no reason to have a physical presence in a foreign country now that airplanes and electronic communication exist. Embassies do some paperwork such as renewing passports or sending demarches, but they’re mainly used to legitimize intelligence gathering. TISOs are usually called “attachés.”
After exploring the CIA databases, Ed realized how international the CIA is and decided that he wanted to work abroad as a CIA employee rather than as a contractor. He applied for a CIA tech position and was accepted. Getting into the CIA required an Indoc session, just like for contractors, but as a government employee, Ed also had to swear an oath to the US Constitution.
Ed went to the Hill to train to be a TISO. Ed, like other students, lived in a dilapidated Comfort Inn hotel during the six-month training period.
Ed’s classes were about all things technology. For example, he once had to haul an eighty-pound suitcase of Cold War-era communications gear up the roof of a building. Then, using only a sheet of coordinates and a compass, he had to find CIA stealth satellites and send CIA headquarters a radio message. He also learned about Van Eck phreaking (mirroring someone else’s monitor), how to service cables (physical cables connecting agency sites underground and underwater), and terminals (computers). Ed’s was the last year that TISOs studied these older technologies.
One day, the stairs at the Comfort Inn collapsed. This was a turning point—many of Ed’s classmates had been concerned about how the school’s administration was violating federal labor laws by requiring unpaid overtime, refusing to honor family benefits, or denying leave. Ed wasn’t too bothered because he was used to this kind of exploitation in the industry, but some of his older classmates weren’t having it. Ed’s classmates approached him and asked him to talk to the school’s head about their concerns because he was well-liked.
Ed agreed, partly because he valued justice, partly because it sounded fun. He wrote an email to the school’s head, who told him that the class would have to just suck it up for the remaining 12 weeks of the program. At this point, his classmates gave up. They were used to broken management and didn’t have the time to keep making a fuss. Ed, however, was now fueled by justice, and wrote an email to the school head’s boss, and then his boss.
Ed’s emails improved conditions a lot; however, he’d violated the chain of command and caused his superiors to question his loyalty to the mission. Instead of posting him to the Special Requirements Division, where he’d hoped to work, they sent him to Geneva.
Context: Intelligence Backgrounder
Types of Intelligence
There are several different types of intelligence. Permanent Record refers to the following three types:
SIGINT is short for signals intelligence. This type of intelligence comes from intercepted communications such as phone, fax, and computers.
Cyber intelligence specifically refers to intelligence gathered from the Internet.
The NSA focuses on SIGINT.
HUMINT is short for human intelligence. This type of intelligence is collected by case officers (COs) who gather intelligence face-to-face, by talking to people.
COs tend to be a particular brand of people—good liars, cynics, smokers, and drinkers.
The CIA focuses on HUMINT.
LOVEINT is short for love intelligence. This is an inside joke rather than a real intelligence type. LOVEINT refers to using surveillance for personal use, such as spying on your ex-girlfriend.
Since the birth of the Internet, SIGINT has become more widely applicable than HUMINT. For example, before the Internet, if a spy wanted to get something off of someone’s computer, she had to find a way to physically access it. There was plenty of opportunity to get caught while downloading info or installing new hardware or software. After the Internet, if a spy wanted to access someone’s computer, all she had to do was send their target an email with malware. She didn’t have to try to bribe, turn, or coerce her target. Her target need never even know he was being spied on.
As a result, the roles of HUMINT and SIGINT changed. HUMINT would figure out who was worth hacking, and the SIGINT would take care of collecting the intelligence. SIGINT and HUMINT often work together. For example, the author once created an infected thumb drive that could hack UN delegates’ computers, and someone else had to do the actual plugging in of the thumb drive.
Anonymity on the Internet
The Internet made a lot of things both easier and harder at the same time. For example, if a CO couldn’t find information about a target on the CIA databases, the CO would probably be able to find the target on the public Internet. However, on the public Internet, any search was trackable.
Whenever you search something on the Internet, your request typically goes directly to the website you’re aiming for. Your request is tagged with source and destination headers, which tell anyone who’s looking where the request is going and where it came from.
The CIA didn’t have a good solution. Whenever a CO needed to search someone on the public Internet, they were supposed to contact the CIA and get them to do the search for them. The CIA would do so using a “nonattributable research system,” which involved setting up a front business that would have some legitimate reason to do the search. Setting up a front was a lot of work—it needed a physical address, URL, website, and servers—and if it wasn’t done properly, the business could be traced back to the CIA.
Tor
The best way to maintain anonymity on the Internet is to use the Tor Project. Tor works a little like the front business, but better.
When you request a website using Tor, your request doesn’t go directly to the website you’re aiming for. Instead, it goes through a chain of Tor servers. The servers are hosted by volunteers all over the world.
The first server—the gateway—knows what your request is, but not where it’s going. By the time your request eventually gets to the website you’re looking for, it’s source header is the last Tor server in the chain. As a result, the content of the request can never be connected to where it came from.
Ed worked as a TISO at the US embassy in Geneva for almost three years. Geneva was home to many important world organizations such as the EU, the World Trade Organization, and CERN. As a result, the Geneva embassy piloted the most up-and-coming programs and technology, and Ed began to learn more about how big-picture intelligence and surveillance worked.
Part of Ed’s job was to teach COs how to use SIGINT, for example, how to use Tor. Ed loved Tor. It was a bit of a return to the anonymous Internet of his childhood.
Once, a CO brought Ed to an embassy party and Ed happened to sit next to a banker who handled Saudi accounts. The US suspected Saudi Arabia was financing terror, so Ed acted curious and listened (the usual HUMINT technique). Then Ed found a CO, Cal, and pointed out the banker.
Cal worked on the banker but got nowhere, so Cal finally took the banker out drinking and convinced him to drive himself home. Cal called the cops and the banker was arrested for drinking and driving. Cal insinuated himself into the banker’s life—driving him places and helping him pay the fine—but when Cal finally talked to the banker about becoming an asset, the banker said no. The HUMINT operation had taken a month and gone nowhere. Ed understood why the intelligence community was moving from HUMINT to SIGINT.
While Ed was training, he rarely talked to Lindsay on the phone or went to visit her. Now that she’d finished school, she moved to Geneva to join him.
Parts 1-3 covered Ed’s life until approximately 2009. Part 4 covers Ed’s life from 2009 until 2012, during which he learned about the US government’s mass surveillance program, STELLARWIND.
Context: Mass Surveillance
Historical Mass Surveillance
The pre-Internet version of mass surveillance is a census. In Soviet Russia and Nazi Germany, the census was used to collect information about people’s ethnicity and religion. Post-census, when the government wanted to discriminate against a group, they knew exactly who belonged to it.
The US census, however, hasn’t historically been used as surveillance. It’s used to reinforce democracy. The goal of the US census is to count how many people live in each state so that it can be proportionally represented in the House of Representatives.
President’s Surveillance Program (PSP)
After 9/11, George Bush came up with the President’s Surveillance Program (PSP). A major part of this program was that the NSA could wiretap phone and Internet communication between the US and abroad without a warrant from the Foreign Intelligence Surveillance Court (FISC). The justification was the threat of terror.
This detail of the program was revealed to the public by whistleblowers in 2005. Public outcry ensued because the constitutionality of PSP was questionable. The program allegedly expired in 2007; however, the Protect America Act (2007) and FISA Amendments Act (2008) retroactively legalized the PSP and immunized the companies that had helped with it. The language of the two new acts was intentionally misleading—citizens thought their communications weren’t being monitored, but the acts actually gave the NSA more power.
Surprisingly, instead of a full congressional investigation into the PSP, the government only summarized the program. In 2009, the Unclassified Report on the President’s Surveillance Program was released. The report was vague, the tone was chastising, and hardly any authoritative sources had been interviewed.
Metadata
Metadata is information about how content is made. For example, if you make a phone call, the metadata is how long the call was, the time and date, the numbers on the call, and where the phones were at the time of the call.
Your devices are constantly and automatically creating and emitting metadata. If someone is surveilling you and has access to your metadata, they know your routines and where you are at all times. They can predict your behavior. (In theory. Using data to predict people’s behavior isn’t very accurate and is, in fact, more like manipulation. For example, the government might try to predict what you’ll do based on the pattern of what you’ve done, the same way a website might suggest a book you’d like because you’ve read a different book. This is less prediction and more like getting you to do an action you’re presented with.)
In terms of mass surveillance, metadata is more useful than exact transcripts of your phone calls because it helps the NSA narrow down whom to target. For example, if you send an email to an organization that the NSA is interested in, they might become interested in you. Ironically, the law protects content more than metadata.
American-ness of the Internet
America owns and controls most of the infrastructure of the Internet, such as the towers, servers, satellites, and cables. As a result, most of the world’s Internet traffic—over 90%—at some point encounter something that’s operated, owned, or developed by US businesses or the government.
Additionally, most of this US technology is physically housed in the US and owned by American companies who must follow American law. As a result, American laws about technology affect nearly everyone in the world who’s ever used a phone or computer.
Unsurprisingly, the American-ness of the Internet makes some people and countries nervous. For example, China came up with their own system, the Great Firewall, but it doesn’t match the scale or the global reach of the Internet.
After Geneva, Ed took a new job in Japan in 2009. He went back to being a contractor (for Perot Systems, which was acquired by Dell) and worked for the NSA. Initially, his job was to connect the CIA and NSA’s infrastructure so they could share data.
One of the problems the NSA faced in Japan was how to back up data. Ideally, local NSA facilities would send copies of their data back to headquarters at Fort Meade. However, sending data takes up a lot of bandwidth, so people weren’t doing it. As a result, if anything happened to the local server, the information was gone forever.
Ed was assigned to solving this problem. He was to build a storage and backup system that was automatic and constantly updated. The system was code-named EPICSHELTER.
The project was hard for several reasons, the main one being duplicated data. The NSA had tons of computers, many of which had the same files on them. Sending a hundred copies of the same file to NSA headquarters was a waste of bandwidth and storage space.
Ed built a deduplication system that compared files on all NSA computers. If, and only if, a file on a local computer didn’t already exist at headquarters, the system would send it to headquarters to be backed up. This cut down on the number of files that needed to be sent, saving bandwidth.
While Ed was working in Japan, he attended a conference on China. The technology briefer canceled at the last minute and one of the chiefs asked Ed to step in. The topic was how much China could monitor US agents working in China.
Ed researched the topic on the NSA and CIA networks and learned exactly how China surveilled its citizens—with what machines, on what scale, and so on. As Ed read about what China was doing, he came to the conclusion that the US must have done some of the same things to their own citizens. If mass surveillance was possible, and the US already had the information about how to do it, there was no way they wouldn’t have tried it themselves, he reasoned. However, while China was spying on its citizens publicly, if the US was doing it, it was in secret.
Ed tried not to dwell on his suspicions. He rationalized them by comparing US views on freedom to China’s. China has an authoritarian government and the Great Firewall keeps citizens in and everyone else out. In contrast, the US government is democratic and doesn’t control Internet content or who can access it. At the time, Ed thought the US government only interfered with the Internet for defensive, targeted purposes.
The Unclassified Report on the President’s Surveillance Program was released around the same time Ed was starting to suspect the US might be conducting some form of mass surveillance. Ed thought the report had holes in it, so he went looking through the CIA and NSA networks for the classified version. He couldn’t find it and eventually gave up.
However, the classified version found him. Because Ed was a sysadmin, whenever someone accidentally saved a draft copy of something they shouldn’t have, the system alerted him. The most confidential files had labels called “dirty words” that indicated that the file shouldn’t be stored outside of high-security drives. Whenever the system encountered a dirty word, it would notify the sysadmin—in this case, Ed—so he could get rid of it. He was expected to take a look at flagged files to make sure they weren’t flagged by accident.
Someone saved a draft of the classified report where they shouldn’t have (it normally lived in a compartment of Exceptionally Controlled Information). Ed read it and discovered that the US government was in fact conducting mass surveillance. The report said:
Ed struggled with everything he read in the report as he realized the implications. He had known the NSA’s goal was to keep intelligence forever and he’d even helped build a system that would help them store it.
Context: Privacy and Clouds
Why Privacy Is Important
You may not think you particularly care about privacy. Maybe you think you don’t have anything to hide, or you don’t mind giving up some information about yourself for convenience. For example, you might think giving Google your location is worth getting driving directions.
However, not caring about your personal privacy also has an impact on everyone else’s. If you don’t value your privacy, then you’re assuming that no one else should either. There are plenty of things such as medical history and religion that people have good reasons to want to keep to themselves.
Privacy is a right. People shouldn’t have to defend why they want it; the government should have to justify why it’s allowed to violate it.
Clouds
In 2011, clouds—servers that are accessed via the Internet—were becoming popular both with the intelligence community and the public. Public clouds were available through sites such as Amazon, Apple, and Google. Clouds solved the problem of limited storage on a personal computer—clouds had lots of free or inexpensive space. Clouds can also be used as a backup for information stored on a computer.
However, whenever you put something on the cloud, you’re saving it to someone else’s server. Whoever owns the server can dictate the terms of service, and some terms give the owner a lot of power over what they can do with files saved on their servers. They can often delete whatever they want, delete your accounts but keep your data, and sometimes take ownership of your data.
Ed decided not to do anything about the mass surveillance program he’d discovered, except that he stopped using credit cards and talked to Lindsay about getting off Facebook and Instagram. (She wasn’t willing to; she was an artist and needed both to promote her art.)
In 2011, they returned from Japan and bought a condo in Columbia, Maryland. While they were furnishing their new home, Ed encountered a fridge that had wifi. Knowing everything that he did about surveillance, he was sure the reason a fridge needed Internet access was to spy on people and collect data, then allow the manufacturer to sell the data. Ed wondered if it was even worth worrying about government surveillance if people were buying things like smart fridges. (Amazon Alexa and Google Home wouldn’t come out for a few years.)
Ed continued working for Dell and went back to being a contractor for the CIA. He was now working in sales—Dell’s account manager, Cliff, convinced him to be a solutions consultant. Cliff would sell yet-to-be-invented technology and Ed would build whatever he described. Cliff lied freely about what was possible, and Ed had to build something close enough that they wouldn’t be arrested.
Their main job was to advance the CIA’s technology systems to match those of the NSA. Ed and his team would work towards this goal by building the CIA a private cloud. The goal was to make all the CIA’s data available to agents all over the world. Currently, the data was stored in “silos,” which were storage facilities in different locations that couldn’t be easily accessed remotely.
Ed had his first epileptic seizure and struggled with his health for the last half of 2011. His job was flexible and he could work from home, but he had to attend meetings, and because of his epilepsy, he wasn’t allowed to drive. He ended up taking short-term disability leave. He spent weeks on the couch, not feeling well enough to do much more than read, eat, or sleep.
Ed was still struggling with what he’d learned in the classified report. He watched the news and wondered if mass surveillance was really even that much of a problem in comparison to what so much of the world was facing—violence, dictatorships, and so on. However, he noticed that whenever and wherever people were protesting, the exact causes were often different but the desired outcome was always the same: they wanted freedom from censorship, oppression, and instability. They wanted their governments to answer to them, not the other way around, and they wanted human rights.
Ed still didn’t know what he was going to do about the report, but he did know how to help youth in the Middle East access the Internet. He set up a way to get past the Iranian blockades and then shared it with Tor developers, who would hopefully get it to Iranians who wanted to go online.
Context: Surveillance Legislation
The Patriot Act
2001’s Patriot Act has a section that allows the government to ask the FISA Court to force third parties to give them information on anything that could be considered “relevant” to terrorism or foreign intelligence.
The NSA interpreted this to mean they could collect telephone metadata from American telecoms every day forever on the grounds that one day, some of that information might be “relevant.”
FISA Amendments Act
The NSA also interpreted a section of the FISA Amendments Act aggressively. This section lets the intelligence community target any non-citizen outside the US who might communicate “foreign intelligence information.” People who fit this role according to the NSA include anyone from aid workers to journalists to academics.
Data Collection
The NSA collects data using two main methods:
The PRISM program collects data from service providers including photos, emails, web data, and files stored on cloud servers.
- For example, PRISM would collect data from Facebook, Paltalk, Skype, YouTube, AOL, Apple, Microsoft, Google, and Yahoo!
Upstream collection gathers data from Internet infrastructure. Whenever you go on the Internet and try to visit a URL, your request to visit the URL travels to the server where the URL is hosted. Before it gets to the destination server, however, it’ll pass through servers that the NSA has set up in telecommunications buildings as part of a program called TURBULENCE. TURBULENCE has two facets:
TURMOIL creates a copy of your request and evaluates it for “selectors.” Selectors are characteristics that the NSA has deemed suspicious, such as a request's originating location or its inclusion of specific keywords, phone numbers, or emails. If your request contains a selector, TURMOIL passes the request to TURBINE.
TURBINE detours your request to NSA servers. The NSA servers house malware programs—“exploits”— and when you’re redirected to your URL, you’re also sent an exploit. Exploits give the NSA access to all the data on your computer.
In early 2012, Ed made some changes to his life to accommodate his epilepsy. He took a new, less stressful job as Dell contractor for the NSA that involved managing documents and who was allowed to access, edit, and read them. The job was in Hawaii and the state’s climate and relaxed culture were supposed to be good for Ed’s epilepsy. Additionally, he didn’t have to drive in Hawaii because he could commute by bicycle.
As usual, Ed wrote scripts to do all his work for him so he could use his time to do whatever he liked, which was to learn more about mass surveillance programs. He wanted to confirm mass surveillance was happening and learn all the technical details on how it was achieved. Ed knew he wouldn’t be able to make a decision on what to do about STELLARWIND until he understood exactly how everything worked. He wanted to know if the NSA was doing all the surveillance it was capable of doing, and who knew about it and approved it.
It was difficult to find information about the mass surveillance program. Every time Ed would find something promising, he couldn’t find further information about it, and if he did eventually turn up something, it would be a place unrelated to where he’d originally discovered its existence (for example, he might find a file within a different department.) Sometimes he’d find program names but no information about what the program was, or he’d find an explanation without a name and then he couldn’t tell if the explanation was for a real program, or just something the NSA eventually wanted to do.
Ed’s research included “readboards”—NSA versions of news blogs. He wrote a program called Heartbeat that was similar to EPICSHELTER—it would pull new and unique readboard posts from intelligence databases of the NSA, FBI, CIA, and the Department of Defense’s Joint Worldwide Intelligence Communications System.
Heartbeat quickly pulled so much data that people complained about how much digital storage space it was taking up, so Ed decided to share the program. He set up Heartbeat to curate personal readboards for NSA officers based on their office, clearance, and interests. All the documents Heartbeat pulled Ed stored on a server that only he managed so that he could easily search all the available intelligence info.
The documents Ed pulled using Heartbeat proved that the US government was carrying out mass surveillance. He found schematics and engineering diagrams that showed upstream collection was possible.
Context: Whistleblowing and Legislation
The History of Whistleblowing
The first whistleblowers were sailors on the Warren in 1777. Their Warren was commanded by Commodore Esek Hopkins, who refused to fight in the Revolution, treated prisoners badly, and in general wasn’t fit for command. (He was also the Continental Navy’s commander in chief.) Ten sailors from the Warren wrote to the Marine Committee, the highest level in the chain of command, letting them know what Hopkins was doing. Hopkins took legal action—a criminal libel suit—against two of the officers who had written to the Marine Committee.
Before the trial started, another sailor brought the issue to the Continental Congress. The Continental Congress was horrified by the idea that someone could dismiss a serious complaint as libel and enacted a law to protect whistleblowers. If someone in the government was misbehaving, authorities wanted to know about it—speaking up was a duty.
The Fourth Amendment
The Fourth Amendment protects “the right of the people to be secure in their persons, houses, papers and effects.” Computers didn’t exist at the time of the writing, but the essence of the amendment is that if law enforcement wants to search you, your home, or your stuff, they need to prove there’s a good reason to do so. Additionally, the reason must be specific—law enforcement thinks you’ve committed a specific crime. The warrant will specify the scope of the search and how long anyone has permission to search.
The NSA had to carefully interpret the Fourth Amendment to justify mass surveillance. According to the NSA, modern technology couldn’t count as “papers” or “effects,” and data couldn’t be considered personal property. For example, since you made a phone call, you’d already “shared” data with your phone company, so you no longer had any right to privacy.
The founders who wrote the Constitution saw the potential for abuses of power. The founders tried to mitigate abuses by dividing power into three government branches with equal powers. However, all three branches failed when it came to privacy and mass surveillance:
The legislative branch is the two houses of Congress. Congress didn’t stay informed about the capabilities and actions of the intelligence community, or if they did know, couldn’t or wouldn’t do anything about it.
- For example, in 2013, the director of National Intelligence said under oath that the NSA didn’t mass surveil US citizens. Some of the congresspeople knew that wasn’t true but didn’t speak up.
The judicial branch in the case of intelligence is the Foreign Intelligence Surveillance Court. Its job is to grant warrants for collecting foreign intelligence. Before 9/11, the warrants were specific and individual; after, they were more general and could approve mass surveillance programs like upstream collection.
The executive branch is the president, and this is where all the problems started. Bush told the NSA to start mass surveillance after 9/11.
In 2012, the intelligence community celebrated Constitution Day and Citizenship Day by sending around an email and setting up a table with free hard copies of the Constitution. Ed always took a copy, and this year, with everything weighing on his mind, he read it closely. The Fourth Amendment in particular resonated with him, because it covered privacy.
Unlike the NSA, Ed considers that our computer files count as “papers” and our data, including metadata, falls under “effects.” Our phones, clouds, and computers are also our “homes”—are you any more comfortable giving a stranger your unlocked phone than you are letting them into your house?
Ed thinks leaking and whistleblowing are different. Leaking is releasing information for your own gain, while whistleblowing is releasing information for the good of the public. The intelligence community sometimes leaks their own information, which is often poorly thought out. For example, to announce the death of US citizen Anwar al-Aulaqi, the CIA had to admit their top secret drone program and kill list existed. The government tends to be okay with leaks when they benefit them. They ignore leaks that caused problems.
In the digital edge, the most effective whistleblowers come from lower down in the organization, the people who aren’t as inclined to maintain the status quo and who haven’t been with the intelligence community so long that they’re cynics.
Ed couldn’t blow the whistle by talking to someone higher up the chain of command because the highest authorities knew—and had authorized—mass surveillance.
He considered self-publishing (posting the docs online and sharing a link), but while it would have been the safest and easiest, he rejected it because it didn’t lend him enough authority. People on the Internet are always claiming to be leaking top secret information, and he didn’t want anyone to think he was just another conspiracy theorist. Additionally, no one would understand the documents without context.
Ed decided he needed an institution or a person to release the information to prove authenticity, mitigate his biases, and help explain the information. He considered WikiLeaks, but felt this would be too much like self-publishing—WikiLeaks would simply present the documents, unredacted and without context.
Therefore, Ed decided to talk to journalists. He needed to find people who the public trusted and who wouldn’t be scared off by the government trying to stop them from publishing things. At first, Ed tried to find journalists on his own, and then realized the NSA already kept track of the kind of people he needed. He approached two people:
Ed knew better than anyone that it’s hard to be anonymous on the Internet. He got in touch with journalists using a variety of different identities and used encrypted email. He had to convince and/or teach the journalists to use encryption too.
Additionally, Ed used other people’s Internet connections. However, he couldn’t use free public wifi at a cafe or library for two reasons. First, in public places, he’d be recorded by security cameras or seen by other people. Second, every wireless device has a unique Machine Address Code (MAC). Wifi networks store the MACs of every device that connects to them, so his connection would be traceable.
To get around this, he went “war-driving.” War-driving involves driving around looking for wifi connections. All you need is an antenna, GPS sensor, and laptop. The antenna helps you find wifi and the GPS sensor tells you where you’ve found it. Ed’s laptop used an operating system called TAILS, which erases anything he’d ever done on it the moment he shut it down. He used TAILS to hide the laptop’s MAC address and used Tor. Sometimes Ed had to break into other people’s wifi, but often it wasn’t secure or minimally secure.
Interestingly, the law doesn’t care if you share classified information with your enemies or the press, or why you do so. The punishment is the same. The only distinction Ed ever encountered was in his Indoc to the intelligence community, when he was told that selling enemies secrets is slightly better than sharing them with the press because at least the enemy won’t tell the public.
Context: Counterintelligence
NSA Counterintelligence
The NSA keeps an eye on the people who have worked for it via counterintelligence programs such as logs (keeping track of what’s done on a computer) and single-user documents (marking files with an invisible tag to indicate their source).
FBI
The FBI handles crime in the intelligence community. Most of the time, the FBI arrests people on their way home from work as they’re trying to smuggle out documents. Additionally, the FBI wires people’s houses when it suspects them.
Ed decided he was going to leak the intelligence community’s original documents rather than simply describe STELLARWIND to the press. This meant that he had to access the documents, organize them, and then remove them from the NSA building.
Access wasn’t a problem. Heartbeat allowed Ed to collect any information he wanted, and while the NSA would log that Ed had read files, he was the manager of Heartbeat, so no one would find this suspicious.
However, organizing the files was more difficult. Ed didn’t need everything Heartbeat pulled—he only wanted to leak documents about mass surveillance, not the NSA’s other secrets. Additionally, he had to do some work on the files such as encrypting, compressing, and deduplicating. The Heartbeat server kept a log of what was done on it, and if Ed tried to work with the files directly on the server, the NSA would see what he was up to. Additionally, he couldn’t organize the files on a regular office computer because the NSA had upgraded to computers that did all their processing and storage on the cloud.
There were, however, some older computers in the office with enough power to do their own local processing. Ed invented a compatibility project—he wanted to make sure that Heartbeat was compatible with older operating systems—and transferred files onto the old computers. As long as he was careful about what networks he connected the older computers too, no one would see what he was doing on them.
Finally, Ed had to get the files he wanted out of the NSA building. The safest and easiest way to get a file off a computer is to pull it up on the monitor and take a picture. Smartphones aren’t allowed in NSA buildings, but people often bring them in by accident, and Ed might have been able to get away with it. However, he’d need to take thousands of photos to get everything and he’d have to find a way to hide the photos well enough that even NSA forensic experts could search his phone without finding them.
Instead, Ed decided to transfer the files to micro and mini SD cards. He switched to the night shift so he could transfer files off the computers to the cards. Then, Ed would smuggle the cards out of the building inside a Rubik’s Cube, in his sock, in his cheek (so he could swallow them if he needed to), and finally in his pocket when he got more confident.
Ed had access to a lot of intelligence data including, importantly, FBI reports on how they caught people. Since the FBI would usually arrest people on their way home from work, Ed paid particular attention to how he interacted with security on his way out. He’d worked security back in the job that got him his clearance in Maryland and he knew it was boring, so he’d banter with the guards and chat about his Rubik’s Cube.
After Ed got home from work, he’d hide his laptop under a cotton blanket in case the FBI had bugged his house. Then, he’d transfer the files from the SD cards to a bigger, very securely encrypted, external storage device.
Just like at work, Ed was careful not to leave any traces of what he was doing on his technology at home.
Ed thought about trying to keep his name out of the leak, but ultimately decided not to for a couple of reasons:
Lindsay worried about Ed’s health. He couldn’t tell her anything.
Context: Protecting Yourself From Surveillance
It’s Impossible to Truly Delete
It’s not really possible to delete digital files. When people first built computers, they knew users would make mistakes. Engineers also knew that users wanted to feel like they had control and agency. They might not know how to fix computers and had to agree to terms of service, but at least they’d be able to delete their own files.
However, when you delete a file on your computer, it usually only looks like it's gone. What actually happens is the reference to it. It’s deleted from the file tree so you can’t search for it or easily get to it, but it’s still there if you look hard. The best you can do is overwrite it, again and again, until it's so covered up it's unusable, but that’s not foolproof either because your computer might have a copy of it somewhere you can’t find.
Encryption
Encryption is the only way to really protect yourself against surveillance. Think of encryption as a much more advanced version of a cipher. When you encrypt data, you’re using a key to transform it into gibberish. Therefore, anyone trying to look at your data won’t be able to make sense of it because they don’t have the key.
Encryption algorithms are very complicated math problems—problems so complicated even computers can’t solve them. Usually, the longer an encryption key is, the safer it is, because the math is harder. The math and computing power required to break a 4096- or 8162-bit encryption key don’t exist.
As a result, the government doesn’t try to break the encryption, they go after the keys or the locksmiths:
To go after the key, the government attacks the programs that do the encryption.
*To keep keys safe, you can use a method called “zero knowledge.” Zero knowledge involves encrypting data before you upload anything so that the key never leaves your computer.
To go after the locksmith, the government either forces companies who make tech to build weak encryption or tries to get international standards organizations to sign off on insecure algorithms.
In late 2012, laws about mass surveillance were under fire. Both the UK and Australian governments were proposing legislation about recording metadata. These laws were pitched as security measures. This was the point when Ed realized that no matter how much he tried to reconcile technology and the government, it was impossible. He couldn’t be part of both circles, and the government was the one to leave.
Ed still liked teaching and wanted to help the public defend itself against mass surveillance. Even though he was leaking information about mass surveillance, he knew that wasn’t going to be enough to allow people to retain their privacy. He taught a workshop on encryption. This was also practice for explaining things to a layperson’s audience, which he’d have to do when he blew the whistle. Many of the people who showed up weren’t particularly worried about mass surveillance, they just wanted control over their privacy.
Ed’s encrypted drive had zero-knowledge keys within zero-knowledge keys. The key was divided up and separated. For example, pretend you had a party with 20 guests. You give each guest a number as they leave and none of the guests overhear. You can only put the key back together by bringing all the guests back together in the same room and having them regurgitate their number in the same order. Ed also had a number. If even one of the guests, including Ed, lost or destroyed their number, the key was permanently broken.
Ed wondered if there was anyone in the world that the NSA couldn’t get to. He took a new job with the National Threat Operations Center in Hawaii to find out. Ed’s new job was to actually use mass surveillance technology to research targets. He became the person who “acquired” information about particular people who’d thrown up flags.
Ed returned to Fort Meade for training and to meet his new colleagues and bosses. It would be the last time Ed would see his family. He went for dinner with his dad, who he knew wouldn’t have approved of what Ed was about to do—Lonnie would have called the cops or had him committed.
One of the major programs for mass surveillance was called XKEYSCORE. Ed had known that the mass surveillance tech existed from what he’d found, but being trained on it was a whole different matter.
XKEYSCORE allowed Ed to look up almost everything anyone does on the Internet. He could type in almost anyone’s—including the NSA’s director or the president’s—IP address, phone number, or address and have access to their recent online browsing. Sometimes even a recording of their screen was available. Ed hid his searches by typing them in a machine format that was readable by XKEYSCORE but incomprehensible to people.
Most of what he saw was personal rather than professional abuse—LOVEINT. People would spy on their spouses or exes. If you use surveillance like this you can get ten years in prison, but no one in the NSA had ever been sentenced. The NSA couldn’t publicly prosecute anyone because to do so, they’d have to admit the secret mass surveillance system existed.
Ed learned as much as he could about the mass surveillance programs from the people working with them, justifying his curiosity by saying he wanted to teach everyone back in Hawaii the latest methods. Everyone he met was excited about the tech, was happy to show it off for him, and didn’t think about how it was being used.
Ed also learned that almost everyone does two things on the Internet: store images of their family, and watch porn. Ed found the family element the most uncomfortable. Ed found a video of a target working on his computer with a young child sitting on his lap, and the child stared directly into the camera as if he knew Ed was watching.
Encryption is one of the only ways to protect yourself against surveillance.
What programs, apps, and devices do you use on a regular basis?
Which ones are the most secure, and which ones are the least secure? How do you know? (Hint: Look for their policy on encryption and check the terms and conditions.)
How could you make your data more secure? Consider replacing unencrypted apps with encrypted ones (for example, switch to Signal for texts and call).
Parts 1-4 covered Ed’s life until approximately 2012. Part 5 starts on May 20, 2013, the day Ed left the US to blow the whistle, and continues until 2019, when Permanent Record was published.
In spring 2013, Ed made preparations to meet the journalists outside the US. He had a hard time setting up meetings with them because he couldn’t give them a time or date too far in advance, and they didn’t even know who he was. Ed also had trouble finding a place to meet them. He eventually settled on Hong Kong because it had unrestricted Internet and was independent enough to resist the US.
Ed made preparations to leave. He took out cash for Lindsay, so the government couldn’t seize the money in his accounts, and he erased and encrypted his computers. He also encouraged Lindsay to go camping for a weekend and invited his mother to visit immediately after, so that they could support each other after he’d left
The morning Ed left, May 20, 2013, he still couldn’t tell Lindsay anything. She noticed he was being unusually affectionate but believed him when he said he was sorry that he’d been so busy with work lately. The moment she left, he cried.
Then he told work he needed emergency time off because of his epilepsy, packed, left a note for Lindsay that he’d had to go away for work, and flew to Hong Kong.
Ed was in Hong Kong, but the journalists weren’t. He knew Laura Poitras, who already had some documents, was definitely interested in meeting, but she wasn’t coming until she’d convinced Glenn Greenwald to come too. This was very stressful for Ed—if the NSA figured out what Ed was up to before he could share his documents, the world would never find out about STELLARWIND.
Ed hid in the Mira Hotel for ten days, not leaving his room because he worried someone would come in while he was gone and set up bugs. He spent this time pleading with the journalists to come and organized the material he was going to give them. He expected people would be skeptical of what he was saying so he worked on the best way to explain it. While he was most interested in how the tech worked, he planned to explain in terms of programs, using a more narrative approach.
Laura, Glenn, and Glenn’s colleague Ewen MacAskill meet Ed in Hong Kong on June 2. From June 3-9, Ed talked to Glenn and Ewen while Laura filmed. At night, Ewen and Glenn would write up the day’s work, and Laura would edit her video and work remotely with another journalist, Bart Gellman.
The Guardian released Glenn’s first story on June 5. It was about the NSA collecting data from Verizon, which the FISA Court had permitted. On June 6, a story about PRISM appeared in both the Guardian and Washington Post.
Ed’s office had tried to get in touch with him—he was supposed to have returned to work May 31—and he ignored their messages. The US government was working hard to identify the source of the leak and Ed knew that they’d soon figure out it was him. Ed also knew that if they identified him, they’d spin the story to misrepresent him so he looked crazy or morally suspect, and they’d shift the focus from what they’d done to what he’d done.
Ed decided he’d reveal himself as the source of the leak before the government could. Ewen wrote a story about him and Laura suggested doing a video statement. They didn’t have time to polish a video statement, so Laura used footage from the first day they’d met. The video went live on June 9.
Ed knew that coming forward would have consequences including:
After Ed revealed his identity, two attorneys, Jonathan Man and Robert Tibbo, volunteered to take him on. They helped him get out of the Mira hotel when the press figured out he was staying there. Robert was good at finding safe houses, and Ed stayed with some of his other clients, refugees who had been unable to get permanent residency status. They were lovely, hospitable people and Ed was forever grateful for their help.
Ed appealed to the UN High Commissioner on Refugees, but while the UN tried to get him protection in Hong Kong, the Hong Kong government decided to consider the US’s request for extradition. Ed cleared his computers and prepared to run.
Context: Ecuador
Ecuador and the US aren’t on particularly friendly terms. Rafael Correa, when elected in 2007, rolled out policies intended to correct US interference in Ecuador, one of the major ones being that the country would consider its national debt “odious.” Odious debt is national debt that’s incurred while a country is being oppressed (in Ecuador’s case, by the US). As a result, no one can force the repayment of odious debt. A lot of US foreign policy is made by financiers, and they weren’t happy that Ecuador wouldn’t have to pay debts.
In 2013, Ecuador also supported political asylum and the Ecuadorian embassy in London hosted Julian Assange of WikiLeaks.
Ed decided to head for Ecuador. However, there were no direct flights from Hong Kong, so getting to Ecuador was going to be a challenge—even just passing through other countries could be dangerous. Ed would only be safe if he landed in non-extradition countries, and he shouldn’t even cross the airspace of any countries the US could manipulate.
The route was to fly to Moscow, then Havana, then Caracas, then Quito. It was the only possible route and it wasn’t perfect—there was a 20-hour layover in Russia, and going from Russia to Cuba involved crossing NATO airspace and going over Poland. Poland had helped the US government in the past, notably by allowing the CIA to torture people at black sites.
Julian Assange, founder of WikiLeaks, wanted to help Ed. A lot of people thought he had selfish motives for this, but reflecting back, Ed thinks Assange believed in the public’s right to know and simply wanted to help Ed stay out of prison. (A previous whistleblower who had been involved with WikiLeaks, Chelsea Manning, had gone to prison.) Assange couldn’t personally help because he was also avoiding extradition, so he helped through Sarah Harrison, an editor for WikiLeaks and a journalist.
Sarah helped Ed because of her own conscience. She believed that journalism should challenge the government more than it did and wanted Ed to have a “better outcome.” (She never explained whose or what outcome she was referring to).
Sarah flew to Hong Kong and set Ed up with a laissez-passer—a UN travel document that was usually used for refugees who needed to cross borders. Sarah traveled with Ed and on June 23, they landed in Sheremetyevo in Moscow.
Ed had been trained by the intelligence community, especially the CIA, on how to go through customs inconspicuously. But, of course, his passport had his name on it, so he was automatically noticeable.
As Ed was going through passport control, he was told there was a problem with his passport. Two security guards took him and Sarah to a room where an agent of the Federal Security Service, one of Russia’s intelligence agencies, tried to recruit him. Ed cut the agent off right away—if you don’t stop a pitch and it’s recorded, a listener can decide that you were considering it, and even if you eventually say no, your reputation is still ruined.
The Russian officials told Ed that US minister John Kerry had canceled his passport. Sarah looked it up and discovered it was true. Ed was shocked that the US government would have stranded him in Russia, of all places.
The intelligence officer tried to recruit him again, after showing him a media scrum, and again, Ed refused. The officials ignored the laissez-passer document, and Ed and Sarah were stuck in the airport. Ed got in touch with 27 countries, asking for political asylum, but none of them would take him, or said they’d only consider if after he’d already traveled there, which was impossible.
After 40 days in the airport, Ed eventually got temporary asylum from Russia. The president of Bolivia had attended the Gas Exporting Countries Forum in Moscow, and when he left, the US diverted his plane to Vienna because they thought he had Ed aboard (the president had expressed solidarity for Ed).
This was hugely insulting to Russia and they knew the US would do the same thing again if they ever suspected Ed was on another plane. As a result, Ed got his asylum. Sarah got to go home, and Ed stayed in Russia, where he still lives as of 2019.
Almost right after Lindsay returned from her camping trip, Ed’s mother Wendy arrived for a visit. At first, Lindsay was annoyed that Ed had left while his mom was visiting, but as time went on, both Lindsay and Wendy started to think something was wrong. It had been normal for Ed to be called away during some of his previous jobs, but not since they’d been living in Hawaii. Additionally, the other times he’d been away he was always in touch. Wendy thought he was on medical leave. Lindsay was more worried he might be having an affair.
On June 7, the government started to get in touch with Lindsay about Ed. He was supposed to have returned to work on May 31. Lindsay saw some headlines in the paper about the NSA and started to connect them to Ed.
On June 8, Lindsay went to San Diego to visit her friend Sandra for her birthday. She also needed some emotional support. Lindsay told the police that her grandma was having open-heart surgery, which was true, but it wasn’t happening until the end of June and in Florida.
On June 9, Lindsay’s friend Tiffany called to ask her how she was doing. Lindsay asked her what she was talking about, and Tiffany told her Ed had come forward as the whistleblower. The FBI immediately tracked Lindsay down and interrogated her for days. She hired a lawyer, Jerry Farber. The FBI was convinced that she knew something.
When she wasn’t being interrogated, she was being followed. She had an FBI tail 24/7 for her own protection. The media got a hold of her photo and the public labeled Lindsay a whore and stripper.
Lindsay was angry with Ed, but she knew he’d done the right thing.
Lindsay left Hawaii a couple of months later.
Context: Aftermath of the Leak
Changes
The author’s disclosures resulted in:
National conversations about surveillance. The US president and attorney general admitted that talking about mass surveillance publically was important. Now that people knew about the surveillance, they could have an opinion on it.
Investigation of the NSA. Congress launched investigations into the NSA and discovered that the NSA had lied about their work.
Court cases, notably the 2015 American Civil Liberties Union’s challenge to the NSA about collecting phone records. The federal court of appeals ruled that the program was likely unconstitutional and had violated the Patriot Act. This case also set the precedent that US citizens could challenge the government about mass surveillance.
Redefinition of “relevant.” The Patriot Act allows the NSA to collect data that might be “relevant” to terrorism or foreign intelligence. The NSA justified mass surveillance by defining “relevant” to mean anything that might, at some unknown point in the future, be relevant. The federal court of appeals ruled that this definition was inappropriate. This decision may be used as precedent in future cases related to mass surveillance.
Passing of the USA Freedom Act. One of this act’s sections explicitly forbids any bulk collection of US citizen’s phone records. If the government wants access to phone records, they have to get a warrant for specific records.
Increased encryption. The NSA’s methods damaged the basic security of the Internet; as a result, medical and financial records were more vulnerable. Businesses that people trusted to keep their data safe responded.
Apple put default encryption on iPads and iPhones. Google did the same for Chromebooks and Android.
Business switched from http to the more secure https for their websites. The S stands for “secure,” and https helps stop third parties from intercepting website requests.
More encrypted apps and tools have been developed, such as Signal, an encrypted text and call app, and SecureDrop, which allows people to anonymously share whistleblowing documents with journalists.
By 2016, more than half the traffic on the Internet was encrypted.
International citizen outrage. US mass surveillance affected people all over the world, and the angriest populations were those of countries that had cooperated with the US. People wanted the right to privacy.
EU whistleblower and privacy protections, notably the General Data Protection Regulation. This regulation states that data is owned by the person it’s about, rather than the person who collected it. If people own their data, it’s easier to protect it as a civil liberty.
Continued Need for Opposition
The author’s goal was to tell everyone about mass surveillance, but just being aware of it isn’t enough. Data is global—it travels and is stored all over the world, and data-protection laws only apply in the countries that make them. Opposition to mass surveillance needs to be on a global scale.
Additionally, the law is slow and technology is fast. The law is never going to move quickly enough to keep up with technological advancements, so we need to find ways to protect our data ourselves, such as using encryption.
In 2014, Lindsay visited Ed in Russia. He didn’t think he deserved a second chance, but she gave him one. Ed mostly stayed inside when he was alone, but Lindsay took him to museums and they went to the opera. At one of the museums, a teenage girl recognized him and asked for a photo. Ed agreed and never managed to find the photo online; the girl seems to have kept it private.
Lindsay eventually moved to Russia and she and Ed got married.
As of 2019, Ed works for the Freedom of the Press Foundation. This organization works towards public-interest journalism and to strengthen rights to privacy.
Everyone’s data reveals information about them.
What data do you consciously create and share publicly with the Internet? For example, you might post a profile photo on a social media site.
What data do you consciously create and keep private? For example, you might talk on the phone to your mom about family.
How would you feel if the government were to look through your browsing history or read transcripts of your phone conversations? Why?
The President’s Surveillance Program was established after 9/11, and retroactively legalized in 2008, with the ostensible purpose of protecting Americans from acts of terror. Do you think it’s in Americans’ best interest for the government to wiretap phone and internet communication without a warrant? Why or why not?