Эдвард Сноуден: Permanent Record (Young Readers Edition): How One Man Exposed the Truth about Government Spying and Digital Security

The Boy

I was more curious than ever about the one fact I was still finding elusive: the absolute limit of who the IC could turn its gaze against.

The only way to discover the answer was to narrow my vision to that of the NSA employees with the freest access to the rawest forms of intelligence. They could type into their computers the names of individuals who’d fallen under the agency’s suspicion, foreigners and US citizens alike. The NSA was interested in finding out everything about these individuals and their communications.

The program that enabled this access was called XKEYSCORE, which is perhaps best understood as a search engine. Imagine a kind of Google that instead of showing pages from the public internet returns results from your private email, your private chats, your private files, everything. Though I’d read enough about the program to understand how it worked, I hadn’t yet used it. But I was looking for a personal confirmation of the depths of the NSA’s surveillance intrusions—the kind of confirmation you don’t get from documents but only from direct experience.

One of the few offices in Hawaii with truly unfettered access to XKEYSCORE was the National Threat Operations Center. As luck would have it, NTOC had a position open through a contractor job as an infrastructure analyst. The role involved using the complete spectrum of the NSA’s mass surveillance tools, including XKEYSCORE.

I’d decided to bring my archives out of the country and pass them to the journalists I’d contacted, but before I could even begin to contemplate the logistics of that act I had to go shake some hands. I had to fly east to DC and spend a few weeks meeting and greeting my new bosses and colleagues. This was what brought me back home to the Beltway for the very last time, and back to Fort Meade.

The NSA described XKEYSCORE, in the documents I’d later pass on to journalists, as its “widest-ranging” tool, used to search “nearly everything a user does on the internet.” It was, simply put, the closest thing to science fiction I’ve ever seen in science fact: an interface that allows you to type in pretty much anyone’s address, telephone number, or IP address, and then basically go through the recent history of their online activity. In some cases you could even play back recordings of their online sessions, so that the screen you’d be looking at was their screen, whatever was on their desktop. You could read their emails, their browser history, their search history, their social media postings, everything. You could set up notifications that would pop up when some person or some device you were interested in became active on the internet for the day.

My weeks at Fort Meade, and the short stint I put in at my new job back in Hawaii, were the only times I saw, firsthand, the abuses actually being committed. I didn’t type the names of the agency director or the president into XKEYSCORE, but after enough time with the system I realized I could have. Everyone’s communications were in there—everyone’s. I was initially fearful that if I searched those in the uppermost echelons of state, I’d be caught and fired, or worse.

But it was simple to disguise a query by encoding my search terms. If any of the auditors who were responsible for reviewing the searches ever bothered to look more closely, they would see only a snippet of obfuscated code, while I would be able to scroll through the most personal activities of a Supreme Court justice or a congressperson.

One thing you come to understand very quickly while using XKEYSCORE is that nearly everyone in the world who’s online stores photos and videos of their family. This was true for virtually everyone of every gender, ethnicity, race, and age—from the meanest terrorist to the nicest senior citizen, who might be the meanest terrorist’s grandparent or parent or cousin.

It’s the family stuff that got to me the most. I remember this one child in particular, a little boy in Indonesia. Technically, I shouldn’t have been interested in this little boy, but I was, because my employers were interested in his father.

The boy’s father, like my own father, was an engineer—but unlike my father, this guy wasn’t government or military affiliated. He was just a regular academic who’d been caught up in a surveillance dragnet. I can’t even remember how or why he’d come to the agency’s attention, beyond sending a job application to a research university in Iran. The grounds for suspicion were often poorly documented, if they were documented at all, and the connections could be incredibly tenuous—“believed to be potentially associated with.”

Selections from the man’s communications had been assembled into folders—here was the fatal copy of the résumé sent to the suspect university; here were his texts; here was his Web browser history; here was the last week or so of his correspondence both sent and received, tagged to IP addresses. Here were the coordinates of a “geo-fence” the analyst had placed around him to track whether he strayed too far from home, or perhaps traveled to the university for his interview.

Then there were his pictures, and a video. He was sitting in front of his computer, as I was sitting in front of mine. Except that in his lap he had a toddler, a boy in a diaper.

The father was trying to read something, but the kid kept shifting around, smacking the keys and giggling. The computer’s internal mic picked up his giggling and there I was, listening to it on my headphones. The father held the boy tighter, and the boy straightened up and, with his dark crescent eyes, looked directly into the computer’s camera—I couldn’t escape the feeling that he was looking directly at me. Suddenly I realized that I’d been holding my breath. I shut the session, got up from the computer, and left the office for the bathroom in the hall, head down, headphones still on with the cord trailing.

Everything about that kid, everything about his father, reminded me of my own father, whom I met for dinner one evening during my stint at Fort Meade. I hadn’t seen him in a while, but there in the midst of dinner, over bites of Caesar salad and a pink lemonade, I had the thought: I’ll never see my family again . I knew that if I told him what I was about to do, he would’ve called the cops. Or else he would’ve called me crazy and had me committed to a mental hospital. He would’ve done anything he thought he had to do to prevent me from making the gravest of mistakes.

I could only hope that his hurt would in time be healed by pride.

Back in Hawaii between March and May 2013, a sense of finality hung over nearly every experience for me. It was far less painful to think that this was the last time I’d ever stop at the curry place in Mililani or drop by the art-gallery hacker space in Honolulu or just sit on the roof of my car and scan the nighttime sky for falling stars than to think that I only had another month left with Lindsay.

The preparations I was making were those of a man about to die. I emptied my bank accounts, putting cash into an old steel ammo box for Lindsay to find so that the government couldn’t seize it. I went around the house doing oft-procrastinated chores, like fixing windows and changing light bulbs. I erased and encrypted my old computers. I was putting my affairs in order to try to make everything easier for Lindsay, or just for my conscience.

And yet there were moments when it seemed that the plan I’d developed was collapsing. It was difficult to get the journalists to commit to a meeting, mostly because I couldn’t tell them who they were meeting with, or even, for a while at least, where and when it was happening. I had to reckon with the prospect of them never showing up, or of them showing up but then dropping out. Ultimately, I decided that if either of those happened, I’d just abandon the plan and return to work and to Lindsay as if everything were normal, to wait for my next chance.