On the 10th anniversary of the Snowden revelations

To mark the 10-year anniversary of the start of the Snowden revelations I will discuss some of the most notable aspects, based upon the numerous blog posts which I have written here. Still, it should be noted that this overview is not a complete coverage of this wide-ranging topic.





Books and archives

Between June 2013 and May 2019, the Snowden revelations resulted in over 200 press reports and more than 1200 classified documents were published in full or in part. Additionally, The Intercept published 2148 editions of the NSA's internal newsletter SIDtoday.

A collection that allows a useful visual recognition of the documents can be found on the private website IC Off the Record, while text searches are possible at the Snowden Archive which is a collaboration between Canadian Journalists for Free Expression and the University of Toronto.

There are also at least 12 books about the Snowden revelations. Glenn Greenwald's No Place To Hide from 2014 reads like a pamflet against perceived mass surveillance. A much more factual overview can be found in Der NSA Komplex, which is also from 2014 and written by two journalists from Der Spiegel and unfortunately only in German.

Detailed insights into the political and legal background are provided by Timothy Edgar's Beyond Snowden from 2017, which is in contrast to Snowden's own memoir Permanent Record from 2019, which is more personal than factual.

Finally, and long awaited was Dark Mirror by Washington Post journalist Barton Gellman, which was published in 2020 and offers some important new angles to the stories told by Snowden and Greenwald.





Incentive

Some people assume that Snowden is a spy who worked for a Russian intelligence agency, but nowadays, requests for information come from transparancy activists as well. Wikileaks' wiki-page titled The Most Wanted Leaks of 2009 may have inspired Manning to search for information on the military's SIPRNet and to download hundreds of thousands of military and diplomatic files.

Likewise, the incentive for Snowden may have been come from the news program Democracy Now!, in which on April 20, 2012, former NSA crypto-mathematician Bill Binney, documentary filmmaker Laura Poitras and hacktivist Jacob Appelbaum were interviewed by Amy Goodman (a full transcript can be found here).

In the program, Binney claimed that after 9/11 "all the wraps came off for NSA, and they decided to eliminate the protections on U.S. citizens and collect on domestically". Appelbaum repeated what he said at the HOPE conference in 2010: "I feel that people like Bill need to come forward to talk about what the U.S. government is doing, so that we can make informed choices as a democracy" - which is exactly what Snowden would do: leaking documents because "the public needs to decide whether these programs and policies are right or wrong."

Later that day, Binney and Appelbaum spoke at a "Surveillance Teach-In" in the Whitney Museum, where Appelbaum emphasized that disclosing secret information is also important for privacy and civil liberties organizations: because of a lack of hard evidence and concrete harm it was almost impossible for them to fight NSA surveillance in court.




Just a month earlier, Snowden started a new job as a SharePoint systems administrator at the NSA's regional cryptologic center in the Kunia Tunnel complex in Hawaii. There he started automating his tasks to free up time for something more interesting, which he describes in Permanent Record:

"I want to emphasize this: my active searching out of NSA abuses began not with the copying of documents, but with the reading of them. My initial intention was just to confirm the suspicions that I'd first had back in 2009 in Tokyo. Three years later I was determined to find out if an American system of mass surveillance existed and, if it did, how it functioned."*

With this, Snowden basically admits that he isn't a whistleblower: he wasn't confronted with illegal activities or significant abuses and subsequently secured evidence of that, but acted the other way around by first gathering as much information he could get and then look whether there was something incriminating in it.

Snowden himself doesn't come up with concrete misconducts or other things that could have triggered his decision to hand them over to journalists. He even omits almost all the disclosures made by the press, which makes that Permanent Record contains hardly anything that justifies his unprecedented data theft.



Documents

The actual number of documents which Snowden eventually exfiltrated from the NSA has never been clarified. According to the 2016 report from the US House Intelligence Committee, Snowden removed more than 1.5 million documents from NSANet and the JWICS intelligence network.

Glenn Greenwald repeatedly said that number was "pure fabrication" and probably he could agree with former NSA director Keith Alexander who in November 2013 estimated that Snowden had exposed only between 50,000 and 200,000 documents.

According to Barton Gellman, Snowden provided him and Laura Poitras an encrypted archive of documents called "Pandora" on May 21, 2013. This archive was 8 gigabytes and contained over 50,000 separate documents, all neatly organized in folders.*

Poitras gave Greenwald a copy of the Pandora archive just before they boarded their flight to Hong Kong. There, Snowden handed over all the remaining files to Greenwald and Poitras, who are believed to be the only ones with a complete set. Other media outlets only got partial sets.

Greenwald gave his cache to The Intercept, the online news outlet he co-founded with Jeremy Scahil and Laura Poitras in 2014 to report about the Snowden documents. In March 2019, The Intercept closed its Snowden archive and reportedly destroyed it.





Non-Snowden leaks

In a message to Gellman, Snowden said that "he was not resigned to life in prison or worse. He wanted to show other whistleblowers that there could be a happy ending." Later, whistleblower attorney Jesselyn Radack hoped that "courage is contagious, and we see more and more people from the NSA coming through our door after Snowden made these revelations."

Indeed, other sources started to leak documents to the press. The first one was a so-called tasking record showing that the NSA had targeted the non-secure cell phone of German chancellor Angela Merkel. This was revealed by Der Spiegel on October 23, 2013, which is less than five months after the start of Snowden's revelations.

The second leaked document that wasn't attributed to Snowden was just as spectacular: the ANT product catalog with a range of sophisticated spying gadgets from the NSA's hacking division. This catalog was also published by Der Spiegel and discussed by Jacob Appelbaum on the 2013 CCC.

Initially hardly anyone noticed that these documents didn't come from Snowden, and so a mysterious "second source" was able to publish files that were sometimes even more embarrassing and damagaging than those from the Snowden trove, like intercepted conversations from foreign leaders.

Later, other piggybackers who called themselves The Shadow Brokers leaked highly sensitive information about NSA hacking tools. Snowden never addressed these leaks, nor distantiated himself from them.





Section 215

The very first disclosure of a document that did come from Snowden was the Verizon order of the Foreign Intelligence Surveillance Court (FISC). It was published by The Guardian on June 6, 2013.

The Verizon order showed that the NSA was collecting domestic telephone metadata under the so-called Section 215 program. This became the most controversial issue and initially it seemed to confirm cryptic public warnings by US senators Ron Wyden and Mark Udall, as well as the aforementioned claims by Bill Binney about domestic mass surveillance.

In reaction, Director of National Intelligence (DNI) James Clapper started an unprecedented declassification effort and released numerous FISC and NSA documents about the Section 215 program on a new Tumblr site called IC On the Record.

This was meant to clarify a central misunderstanding: the fact that the NSA collects data inside the US doesn't mean they are spying on Americans. The NSA is still focused on foreign targets, but because they are using American internet services, it proved to be fruitful to intercept their data not only abroad, but at telecoms and internet companies inside the US as well.

Accordingly, the purpose of the Section 215 program was to find out whether foreign terrorists were in contact with conspirators inside the US, which was one of the failures that could have prevented the attacks of 9/11.

Therefore, the only thing the domestic telephone records were used for was contact chaining: NSA started with a phone number of a foreign terrorist and then the MAINWAY system presented the phone numbers with which that initial number had been in contact with.




In 2012, the NSA used 288 phone numbers as a "seed" for such a contact-chaining query, resulting in 6000 phone numbers that analysts actually looked at. When this led to a suspicious American phone number, the NSA passed it on to the FBI for further investigation.

Regardless of how one may think of storing all those domestic telephone records in an NSA database, they were not used to spy on ordinary Americans. The Verizon order did not only made the general public aware of this program, but also gave civil liberty organizations standing in court, which fulfilled Jacob Appelbaum's wish from the 2012 Surveillance Teach-In.





PRISM

One day after the publication of the Verizon order, The Guardian and The Washington Post revealed the PRISM program, which became synonymous for an all encompassing NSA spying system, just like ECHELON was before.

In his book Dark Mirror, Barton Gellman tells a different story than Greenwald did in No Place to Hide. Greenwald presented himself als the one who was chosen by Snowden to lead the revelations and claimed that he and Laura Poitras were working with Snowden since February 2013, "long before anyone spoke to Bart Gellman".

According to Gellman, the opposite was the case and he already started to collaborate with Poitras on February 2. On May 20, Snowden sent both Poitras and Gellman the PRISM presentation, after which they signed a contract with The Washington Post to publish about the program. *

But Snowden was under severe time pressure and urged Gellman to publish the full PRISM presentation, which he had signed with a digital signature using his Verax alter ego. Only gradually Gellman realized the implications of Snowden's plan to ask political asylum at a foreign diplomatic mission in Hong Kong, where he wanted to use the cryptographic signature to identify himself as the source of the PRISM document (and didn't rule out to "provide raw source material to a foreign government").*

As a journalist, Gellman protected the identity of his source, but publishing the digitally signed PRISM presentation would make him and The Washington Post complicit in Snowden's flight from American law. In agreement with Poitras, Gellman decided not to do that. On May 27, Snowden withdrew the exclusive right for the Washington Post and turned to Greenwald, who until that moment had no idea who Snowden was, nor had seen any of the documents.*




This time Greenwald managed to get PGP working and Snowden sent him a zip-file with some 25 documents, including the 41-slide PRISM presentation. Greenwald started writing his own story about PRISM, which was published by The Guardian on June 6, 2013.* Just an hour earlier, The Washington Post had released its story about PRISM.

The most controversial part of these stories was the claim that "the National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants", which those companies vigorously denied.

That phrase was taken from one of the slides, but it's unclear why both Gellman and Greenwald stuck to the most simple interpretation of it. Fact is that they also had the accompanying speaker's notes of almost 7000 words* and all the other slides, including two that were published later on, which clearly show that the FBI is in between the NSA and the internet companies:



Another interesting point is that the PRISM presentation is dated April 2013, which is less than one and a half months before Snowden left the NSA. In Dark Mirror, Gellman writes:

"Nothing Snowden had seen until now better suited his plan. He had been talking to Poitras for three months, but he still did not feel confident that his disclosures would seize attention from a public that had seldom responded strongly to privacy warnings. Most of the NSA programs that worried him were legally and technically intricate, not easy to explain. He needed examples that ordinary people would recognize. Along came [the PRISM] presentation, festooned at the top of every slide with iconic logos from the best-known Internet companies in the world "PRISM hits close to people's hearts", he told me."*

Overcollection

While PRISM is no mass surveillance, but targeted collection against individual foreign targets, it still has a problematic aspect: overcollection. Snowden was eager to draw public attention to this issue and, according to Greenwald, took his last job at NSA Hawaii only in order to get access to the NSA's raw data repositories.*

He succeeded and was able to exfiltrate a cache of ca. 22,000 collection reports, containing 160,000 individual conversations (75% of which instant messages), which the NSA collected via the PRISM program between 2009 and 2012.*

Snowden handed them over to Barton Gellman who reported about these files in July 2014. Researchers at The Washington Post found that the intercepted communications contained valuable foreign intelligence information, but also that over 9 out of 10 account holders were not the intended surveillance targets and that nearly half of the files contained US person identifiers.

It's probably technically impossible to prevent such overcollection, but instead of deleting irrelevant personal content, the NSA only "minimizes" it, which means that names of Americans are redacted before they are distributed. Gellman saw that NSA personnel takes these procedures seriously, but when he confronted former NSA deputy director Rick Ledgett with his unease, Ledgett's only reply was that the NSA really doesn't care about ordinary people.*




NSA's Mission List

Ledgett's answer is confirmed by a comprehensive listing of the tasks of the NSA in the Strategic Mission List from January 2007. It was published by The New York Times in November 2013, but got hardly any attention, despite that it clearly contradicts the claims by Snowden and Greenwald that the NSA has just one single goal: collect all digital communications from all over the world.

According to the Mission List, six countries are enduring targets: China, North-Korea, Iraq, Iran, Russia and Venezuela. Then there were 16 Topical Missions, which are subject to some change:

- Winning the Global War on Terrorism
- Protecting the U.S. Homeland
- Combating Proliferation of Weapons of Mass Destruction
- Protecting U.S. Military Forces Deployed Overseas
- Providing Warning of Impending State Instability
- Providing Warning of a Strategic Nuclear Missile Attack
- Monitoring Regional Tensions that Could Escalate
- Preventing an Attack on U.S. Critical Information Systems
- Early Detection of Critical Foreign Military Developments
- Preventing Technological Surprise
- Ensuring Diplomatic Advantage for the U.S.
- Ensuring a Steady and Reliable Energy Supply for the U.S.
- Countering Foreign Intelligence Threats
- Countering Narcotics and Transnational Criminal Networks
- Mapping Foreign Military and Civil Communications Infrastructure

Spying among friends

For its mission of "Ensuring Diplomatic Advantage for the U.S.", the NSA intercepts the communications of numerous foreign governments and government leaders. Based upon documents from the Snowden trove, media reported about eavesdropping operations against the Mexican candidate for the presidency, Enrique Peña Nieto, Brazilian president Dilma Rousseff, the Venezuelan oil company PdVSA and many others.


The NSA interest in Germany's chancellor Angela Merkel had the most far-reaching consequences. Merkel herself made clear to president Obama that "spying on friends is not acceptable" and the German parliament started an official investigation into the spying activities of the NSA (German: NSA-Untersuchungsausschuss or NSAUA). This inquiry lasted from March 2014 to June 2017, but soon shifted its focus to Germany's own foreign intelligence agency BND.

Extensive hearing of BND employees resulted in unprecedented insights into the details of the cable tapping and satellite interception operations which the BND conducted in cooperation with the NSA. Eventually it became clear that the NSA wasn't spying on German citizens, but did try to collect communications from European governments and companies of interest - just like the BND itself, which was also targeting American and French foreign ministers, the interior departments of EU member states, and many others.






MUSCULAR

A disclosure that caused outrage in Silicon Valley was about MUSCULAR, a collection program in which the NSA cooperates with its British counterpart GCHQ. In October 2013, The Washington Post reported that the NSA had secretly broken into the main communications links that connect Yahoo and Google data centers around the world.

A big question was: why would the NSA do that, given that they already had "front door" access to Google and Yahoo via the PRISM program? Gellman asked Snowden, but his only answer was: "Because it could" and: "I'm speculating, but NSA doesn't ignore low-hanging fruit". Eventually Gellman realized that inside the US, the NSA had to specify individual targets, but abroad it was possible to collect such data in bulk and to search and analyse it with XKEYSCORE.*

The Post didn't mention the XKEYSCORE system by name and it's also not explained in Gellman's book Dark Mirror. That's unfortunate, because while Greenwald and Snowden presented XKEYSCORE as a global mass surveillance tool, it's actually a smart system to find targets who are communicating anonymously and therefore cannot be traced in the traditional way, via identifiers like phone numbers and e-mail addresses.





BOUNDLESSINFORMANT

Where Section 215 and MUSCULAR were most controversial in the United States, but less-known in Europe, the opposite was the case with BOUNDLESSINFORMANT, which caused fury in Europe, but is hardly known across the ocean. BOUNDLESSINFORMANT isn't a system to collect data, but an internal visualization tool that counts metadata records to provide insights into the NSA's worldwide data collection.

The results are shown in heat maps and various charts, for example for countries and collection units. Such charts for Germany and a few other countries were published on July 29, 2013 by Der Spiegel, but on August 5, the German foreign intelligence agency BND said that they collected these data during military operations abroad and subsequently shared them with the NSA.

Despite this statement, Glenn Greenwald interpreted these charts as evidence of American mass surveillance on European citizens and started publishing them in major European newspapers.





On October 21, for example, the French paper Le Monde came with a story saying that "telephone communications of French citizens are intercepted on a massive scale." After a similar story appeared in Spain, NSA director Keith Alexander came with a remarkable clarification, saying: "This is not information that we collected on European citizens. It represents information that we and our NATO allies have collected in defense of our countries and in support of military operations."

Greenwald continued his framing in Norwegian and Italian papers. Only in The Netherlands it was found out that the BOUNDLESSINFORMANT charts were not about content, but about metadata. Dutch interior minister Ronald Plasterk, however, still followed Greenwald's interpretation and assumed the Americans were spying on Dutch citizens. Due to a court case he also had to admit that Dutch military intelligence collected the data during operations abroad.


It was only in May 2019 that The Intercept put the puzzle pieces together and set the record straight: the various BOUNDLESSINFORMANT charts showed cellphone metadata that had been collected by members of the Afghanistan SIGINT Coalition (AFSC, also known as the 9 Eyes) and fed them into the NSA's Real-Time Regional Gateway (RT-RG) big data analysis platform.

When The Intercept confronted Greenwald with this new research, he still tried to blame the NSA: "At the time, Der Spiegel had already reported this interpretation, the NSA wouldn’t answer our questions, and they wouldn’t give us any additional information. I am totally in favor of correcting the record if the reporting was inaccurate."

While Greenwald ignores the declaration by general Alexander, he is right when he said that the NSA's internal documentation about BOUNDLESSINFORMANT was somewhat confusing. Apparently, Greenwald had to rely on that documentation because Snowden was of little help, just like he was for various other programs that journalists did not fully understand.






Truth

Many of the documents that Snowden provided to the press have been misinterpreted or exaggerated, sometimes unintentional, but in other cases maybe deliberately. In Dark Mirror, Barton Gellman writes:

"There were signs that Snowden was capable of an instrumental approach to truth. In conversations about my work, when I got stuck on a hard reporting problem, he sometimes suggested that I provoke fresh disclosures from government officials by pretending to know more than I did."

"Another time he went further, proposing that I actually publish informed speculation as fact. If my story outran the evidence, he said, the government would be forced to respond and thereby reveal more. There would be a net gain for public information either way."

"He said misinformation from people like Mike Hayden, supporters of the intelligence establishment, pushed the terms of debate so far off center that only rhetorical counterforce could set the record straight."*

Gellman declined this approach because it would make his reporting unreliable and it undermines confidence in the press if it would turn out that certain things weren't true. However, claims made by Greenwald and Snowden himself showed that his "counterforce" method sometimes did work: the government came up with new facts - but those never got the same attention as the original story, which is already stuck in people's minds.

Snowden gives the best example of this in his own book Permanent Record, which is written as if nothing has happened after the day he took the flight to Moscow. Hardly anything about all the things revealed by the press, let alone about things that had subsequently been set straight.


There's no doubt that the Snowden revelations provided unprecedented insight into modern-day signals intelligence as conducted by the NSA and its Five Eyes partners. In part this was much needed to understand how the legal framework is implemented and where things need improvement. On the other hand many things have been published that were merely sensational and weakened the US and its signals intelligence system.



Links and sources
- Der Tagesspiegel: Edward Snowden und die Whistleblower-Frage Feiert die Verräter! (June 2023)
- Netkwesties: Barton Gellman herziet NSA-onthullingen (Dec. 2020)