Edward Lucas - The Snowden Operation

Security becomes outright impossible when the material is handled by a team of amateurs. How many people have access? Who has screened them? What are their vulnerabilities—financial and psychological? Does anyone check their bank accounts? Are any of them vulnerable to blackmail? Do they have any training in avoiding ‘social-engineering’ attacks (such as impersonation)? What about the use of force? What happens if someone becomes disillusioned and leaves the team? A shocking example of carelessness came when Greenwald’s partner, David Miranda, was stopped while changing planes at London’s Heathrow Airport in August. His luggage included a number of ‘thumb’ USB drives and electronic devices, carrying some of the Snowden trove (as well as, some reports say, a password, apparently written on a bit of paper). Any public official who carried secret data this way would be fired and then prosecuted. A similarly sackable offence would be sending secret material across international borders by a commercial courier company such as FedEx. The editor of the Guardian , Alan Rusbridger, admits that he did just this, and jokes about it on his Twitter profile. [64] He is excoriated here by the former British MP Louise Mensch: http://unfashionista.com/2013/12/04/has-alan-rusbridger-exposed-names-of-thousands-of-gchq-personnel (Mr Rusbridger’s defenders say that the material was heavily encrypted and that both the sender and receiver were third parties; he may feel that this ruse is fail-safe but security professionals would not.)

It is hard to avoid the conclusion that Snowden conducted his activities within the NSA in order to be as damaging as possible. Among the so far unpublished material are (by the NSA’s account) 31,000 files which show what government customers asked the agency to find out about countries such as China, Iran and Russia, and its assessments of how it could respond. These ‘shopping lists’ are among the most closely guarded secrets in any intelligence agency. Once you know what the other side needs to find out, you can infer what they already know. [65] In John le Carré’s novel The Russia House the plot revolves around a brilliant and successful attempt to make British intelligence hand over its crown jewels: the list of what it most wants to know about Russia.

All this counts as primary damage: to the sources, methods and self-confidence of an intelligence or security agency. But the ripples extend farther. A spy agency’s greatest asset is its reputation. Britain’s MI6, for example, enjoys free publicity from decades of films featuring James Bond. The real-life business of intelligence has little to do with the stunts on screen. But the brand helps attract able people to work as intelligence officers. A reputation for integrity and skill also makes it easier to recruit sources. If you are pondering whether to trust your life to a foreign country’s spies, you will want to have confidence in their ability to keep secrets. It is hard to conceive of a definition of America’s national interest that does not include keeping secret the identity of foreigners who trust the country with their views, secrets—and lives. [66] This caustic piece in the National Interest , by former CIA officer David Gioe, outlines well the damage to American intelligence’s reputation—and effectiveness: http://nationalinterest.org/article/tinker-tailor-leaker-spy-the-future-costs-mass-leaks-9644?page=show But the Snowden fan club, like the cheerleaders for WikiLeaks, takes no account of this. The NSA and other agencies cannot assume that, as Snowden so blithely puts it, there is a “zero chance” that adversaries have seen the stolen documents. They have to work on the assumption that they have done, or eventually will do so.

For all these reasons, the Snowden disclosures have had a catastrophic long-term effect on British and American intelligence. As I have explained above, even the threat of a breach is enough to endanger an intelligence operation. But publishing secrets in the media introduces a whole extra level of risk. It is bad enough if the Chinese and Russian intelligence services have knowledge of (or access to) the programmes compromised by Snowden. But when they are actively publicised, even the dimmest and worst informed terrorist, anarchist or criminal gets the message. Capabilities that work when deployed stealthily become useless once everyone knows about them. Once you learn that a computer screen can be read from far away through an open window, you draw the curtains. Once you know that a computer can plant malware on a mobile phone, or vice versa, you start keeping mobile devices in a lead-lined box. To be sure, the agencies will develop new capabilities. But if your navy has been sunk, it is little comfort to be told that you can always build another one. What are you going to do in the meantime?

The pleas of the Snowden-friendly media that they screen the material before publishing it cut little ice. It is nice of them to take advice, in some cases, from government security sources about disclosures that might be particularly damaging, and even to refrain from making them. Many of the more responsible media outlets have partially redacted the documents they have published, at least protecting the names of intelligence officers. But that does not stop Greenwald from offering the same material elsewhere. His petulant remarks after his partner Miranda was stopped at Heathrow Airport did not suggest a responsible attitude to the secrets he guards. ‘I will be far more aggressive in my reporting from now. I am going to publish many more documents. I am going to publish things on England too. I have many documents on England’s spy system. I think they will be sorry for what they did.’ [67] http://www.huffingtonpost.com/2013/08/19/glenn-greenwald-uk-secrets-britain-detains-partner_n_3779667.html . Greenwald said later that his remarks, in Portuguese, were not meant to be construed this way. But he has given little reason to doubt the sentiment. Publishing secret documents is a grave responsibility. Surely the justification should be to expose wrongdoing, not to satisfy personal pique?

The damage was foreshadowed by WikiLeaks—a forerunner of the Snowden disclosures. A German politician, Helmut Metzner, had to resign and faced prosecution when he was outed as the anonymous source mentioned in a leaked American diplomatic cable (he denied wrongdoing and charges of espionage were eventually dropped). America’s State Department has spent a great deal of time and money trying to safeguard other individuals whose identities have been wholly or partially exposed in the leaked cables. To be fair, in the versions that WikiLeaks published initially, the names of interlocutors were redacted. But a mixture of carelessness and ignorance meant that the passphrase for the unedited versions of the cables became available. The result is unlikely to have increased foreigners’ willingness to meet and speak frankly with American diplomats about even mundane matters.

When intelligence sources, as opposed to mere diplomatic ones, are put at risk the damage is far greater. The stolen documents include the names of many NSA and GCHQ officers. Some of them will have been posted abroad—and may well have had sensitive contacts with locals. If their names and identities become known, then anyone who has met them, say in China, Iran or Russia, is in danger. Snowden says he will not release such material. So why did he steal it in the first place? In any case, as I have argued above, he cannot be sure that it will not leak out, given the amateurish way in which it is safeguarded. That is a profound worry to existing sources, and a grave deterrent to new ones. [68] Paul Pilar has argued this well in the National Interest : http://nationalinterest.org/print/blog/paul-pillar/leaks-irresponsible-press-9633