How America Lost Its Secrets Read online

Not only did Snowden retain his clearance, but unlike when he had applied for his job at the CIA in 2006, he could now list on his résumé two years of experience in information technology and cyber security at the CIA. Dell could check only a single fact: that Snowden was employed at the CIA between 2006 and 2009. His CIA file, which contained the “derog,” was not available to Dell or any other private company because of government privacy regulations. Even though the CIA had “security concerns” about Snowden, it could not convey them to either Dell or the NSA without violating the privacy rules. “So the guy with whom the CIA had concerns left the Agency and joined the ranks of the many contractors working in the intelligence community [IC] before CIA could inform the rest of the IC about its worries,” Michael Morell, then CIA deputy director, explained. “He even got a pay raise.”

  Obviously, this was a glitch in the security system. As a result of it, though, Snowden entered the secret world of the NSA only five months after being forced out of the CIA.

  For the next forty-five months, Dell assigned him various IT tasks at the NSA. In June 2009, he was sent to Japan to work in the NSA complex at the U.S. Yokota Air Base, which is about two hours by car from downtown Tokyo. He moved into a small one-bedroom apartment in Fussa, just outside the sprawling base.

  His initial job for Dell was teaching cyber security to army and air force personnel. In this capacity, he instructed U.S. military officers stationed at the base in how to shield their computers from hackers. Such security training had been required for military personnel dealing with classified material after several successful break-ins to U.S. military networks by China, Russia, and other adversary nations. It was not a challenging or interesting job.

  But Snowden found diversions in Japan. In July 2009, Lindsay Mills joined him there. She had become an amateur photographer, specializing in arty self-portraits. She also saw herself as a global tourist, writing in her blog after arriving in Japan that she had traveled to seventeen countries. Like Snowden, she also deemed herself, tongue in cheek, a “super hero.” In this sense, her Internet avatar was a match for Snowden’s Wolfking Awesomefox.

  In Japan, Mills and Snowden spent time with another American couple, Jennie and Joseph Chamberlin, who also worked at the Yokota base. Jennie, a sergeant in the public affairs section of the U.S. Air Force, had been at art college with Mills and called herself in her blog the Little Red Ninja. Joseph Chamberlin was a decorated U.S. Navy pilot who now flew highly sensitive intelligence-gathering missions from the Yokota base. Jennie described Lindsay in her blog as her “super-model friend.” The two couples also went on expeditions in Japan together. As far as is known, the Chamberlins were the only Americans at the base with whom Snowden socialized. On August 17, 2009, the foursome attempted to walk up Mount Fuji, but they got lost en route and wound up in the Mount Fuji gift shop. Jennie described the misadventure in her blog: “Our adventure started off a little rocky with our attempts to find the interstate. Alas, our iconic mountain was obscured by cloud. A short stop at the Mt. Fuji combination soba noodle stand/gift shop was enough to whet our appetite for the further exploration that is to come.” Photographs taken that day show Snowden wearing Hawaiian shorts and a black tank top emblazoned with an eagle and the letters USA. They also show Mills wearing safari shorts, a brown sweater, and what appears to be an engagement ring. “Ed was looking rather rednecky,” Lindsay commented on one photograph. Snowden described her, in turn, as “nerdy.” They never made it to the top of Mount Fuji.

  Snowden also sought to advance himself by getting credit toward a college certificate by enrolling in a summer online course at the University of Maryland’s Asia program, which had a regional campus on the Yokota base. Known as UMUC, it had a contract with the government to provide military personnel with such educational opportunities. Snowden would later claim that he was taking courses for a graduate degree in computer sciences, but William Stevens, the assistant registrar of UMUC, who I spoke to at the base in 2016, told me that the program in 2009 did not provide graduate courses in computer sciences. According to the program’s record, while Snowden had enrolled as a student in the summer of 2009, he received neither any credits nor a certificate.

  In October 2009, Dell assigned Snowden a job in which he had direct access to the NSA’s computers. He was now a system administrator, which is essentially a tech-savvy repairman. Dell was working on a backup system code-named EPICSHELTER. For this contract, Dell was transferring large chunks of data from the NSA’s main computers in Maryland to backup drives in Japan so that the system could be quickly restored if there was a communications interruption. Because most of the classified data was in its encrypted form, it had little value to any outside party. Snowden’s job was to maintain the proper functioning of computers, but as a system administrator he also had privileges to call up unencrypted files. He sat in front of a computer screen all day looking for any problems in the transferring of files to backup servers.

  The work was highly repetitive and exceedingly dull. Snowden found time to search for anomalies in the system, and he claimed to have spotted a major flaw in the security system in late 2009. He discovered that a rogue system administrator in Japan could steal secret data without anyone else’s realizing that it had been stolen. Snowden brought that to the attention of his superiors, as he later said.

  The emergence of a rogue system administrator was not that far-fetched in 2009. Hacktivists such as Julian Assange had adopted the battle cry “Sysadmins of the world, unite.” Instead of asking them to “throw off their chains,” as Marx did, he asked them to send classified documents about secret government activity to the WikiLeaks site. Snowden, as a “sys admin,” was aware he had the power to do so. He recalled in Moscow in 2014, “I actually recommended they [the NSA] move to two-man control for administrative access back in 2009.” To make his point even clearer, he added, “A whistleblower could use these things, but so could a spy.” Not without irony, Snowden became that rogue system administrator some three years later. In fact, he later used the very vulnerability he pointed out to steal NSA documents at Dell.

  In September 2009, still on the Dell payroll, Snowden made a ten-day trip to India. He later said he was on an official visit “working at the US embassy.” Hotel records show that he arrived at the Hyatt Regency in New Delhi on September 2 from Japan and at 3:30 p.m. on September 3 checked into the Koenig Inn, an annex to Koenig Solutions, a school that gave crash courses on programming and computer hacking. According to Rohit Aggarwal, head of the school, Snowden stayed there until September 10 while taking classes with a private instructor. It cost $2,000 in tuition and fees, which Snowden prepaid from Japan with his personal credit card. Even though Snowden later said he only took courses in “programming,” the school’s records show that during that week he took intensive courses in sophisticated hacking techniques. The course was titled “Ethical Hacking,” but that was a euphemism for teaching the techniques of illicit hacking. The course provided tutoring on hackers’ tools such as SpyEye and Zeus, which are used to circumvent security procedures. It also demonstrated how these hacking tools could be customized by criminals and spies to break into files, plant surveillance programs, impersonate system administrators, assume the privileges of system administrators in a network, and capture the passwords of others. On September 11, Snowden, according to hotel records, left India for Japan. While the stated purpose of the hacking training was to allow security consultants to detect intruders, it also prepared Snowden to be, if he chose to be, an intruder in the NSA system.

  One problem with working as a contractor is that the standard two-year contracts are not necessarily renewed. Nor is there much possibility for advancement for IT workers. As one contractor told me, “It is a dead-end job with great pay.” In the fall of 2010, Snowden’s contract in Japan with Dell was nearing an end.

  Dell offered Snowden, and he accepted, a new position in the United States. He rented a modest suburban house shaded by a sakura cherry tr
ee in a suburb of Annapolis, Maryland. Lindsay Mills meanwhile was attending a two-week fitness training course at a retreat that qualified her to be a yoga instructor. She had been living on and off with Snowden during the previous two years abroad, including while he worked at the CIA in Switzerland and the NSA in Japan, and now she moved in with Snowden again. The twenty-five-year-old Mills posted on Instagram, “Finally in our first US place together.” She also put pictures online of him in bed with her, affectionately referring to him in her posts as a “computer crusader.”

  He worked on problem solving for corporate clients at Dell headquarters in Annapolis. In preparation for his new corporate role, Snowden shaved off his facial hair and, with Lindsay’s help, bought a Ralph Lauren suit. His corporate clients were assisting the NSA, the CIA, and the DIA. Consequently, Snowden dealt with a wide range of intelligence officers and gave presentations on the vulnerabilities in computer security at the DIA-sponsored Joint Counterintelligence seminar. In February 2011, he attended a black tie Valentine’s Day gala sponsored by corporate members of the Armed Forces Communication and Electronics Association. The guest speaker was Michael Hayden, who had headed the CIA when Snowden was abruptly forced out two years earlier. Nevertheless, Snowden joined the queue to have his photo taken with the former director, a perk of the charity event.

  These dealings in no way mitigated his resentment of the intelligence establishment. What began at the CIA in 2009 as objections to what he saw as the incompetence of his superiors grew into well-articulated disapproval of the way the U.S. government conducted its intelligence. He found NSA surveillance particularly worrisome, later telling The Guardian, “They [the NSA] are intent on making every conversation and every form of behavior in the world known to them.” He claimed after defecting to Moscow that he had voiced his concerns about what he considered illicit surveillance to ten NSA officials, “none of whom took any action to address them.” The NSA can find no record of these complaints, but if Snowden had indeed complained to these officials while working for Dell, his superiors at Dell either didn’t notice or didn’t care that they had a very disgruntled employee on their hands.

  Snowden also made no secret on the Internet of his anger at the U.S. government and the corporations that served it. He railed on the Ars Technica site against the complicity of private corporations, such as Dell, that assisted the NSA. In his online posts in 2010, Snowden expressed loathing for the assistance that corporate America was providing the intelligence community. “It really concerns me how little this sort of corporate behavior bothers those outside of technology circles,” he wrote under his TrueHooHa alias. He said he feared that America was already on “a slippery slope,” and he suggested, perhaps adumbrating his own later actions, that this corporate assistance to U.S. intelligence “was entirely within our control to stop.”

  What the “computer crusader” expressed in these angry Internet postings was an almost obsessive concern over individuals’ freely submitting to government authority. “Society really seems to have developed an unquestioning obedience towards spooky types,” he wrote on Ars Technica without mentioning that he himself worked for a corporation that assisted spy agencies. He asked rhetorically on this public forum whether the sinister slide toward a surveillance state “sneaked in undetected because of pervasive government secrecy.”

  The outright contempt he expressed toward this “government secrecy” did not prevent him from seeking even more secret work at Dell for the intelligence services. In February 2011, after his CIA security clearance ran out, he applied to renew it. The new clearance now required a new background check and filling out the government’s 127-page Standard Form 86.

  Since 1996, background investigations for the NSA, like much of the computer work at the NSA, had been outsourced to a private company. It had proceeded from the effort of the Clinton administration to cut the size of government by privatizing tasks that could be more efficiently done by for-profit companies. U.S. Investigations Services, or USIS, as it is now called, which won the contract for background checks, was initially owned by the private equity fund Carlyle Group, which later sold it to another financial group, Providence Equity Partners. For the private equity and hedge funds, profits were the measure of success. To increase its profits from the contract with the NSA, USIS had to move more quickly in concluding background checks because it did not get paid more for extensive investigation. In 2006, the government learned these background checks were often prematurely ended. In Snowden’s case, because the CIA did not share its files with a private concern, USIS did not have access to Snowden’s CIA files, and it therefore did not learn about the threatened security investigation. Nor did it learn from the Internet, where he always employed an alias, that he was a disgruntled employee. So Snowden’s new clearance was approved in the summer of 2011, allowing him to continue working for Dell on secret intelligence projects.

  Meanwhile, in August 2011, Mills began her own blog titled L’s Journey. In it, she described herself as “a world-traveling pole-dancing super hero.” Many of her posted pictures were provocative poses of herself in her underwear and various states of undress. She wrote, “I’ve always wanted to be splashed on the cover of magazines, with my best air-brushed look.” Her wish would be gratified two years later in a way she likely did not anticipate.

  For his part, Snowden seemed happy to encourage her fantasy about being a superhero. He even gave her a Star Trek–inspired head visor. Despite all the concerns he voiced about privacy, he did not seem to mind her provocative posts. On the contrary, he took photographs of her, telling her at one point that her photographs were not “sexy” enough.

  Snowden was soon offered a new position by Dell at the NSA’s Kunia regional base in Hawaii. Dell, which was in the process of expanding its government consulting business, wanted him to be a system administrator on the NSA’s backup system. The NSA needed this system before it could upgrade new security protocols that would audit suspicious activity in real time. In Hawaii, as in Japan, system administrators still worked alone. Snowden knew from his experience in Japan that this solo work in an unaudited workplace provided an opportunity for a system administrator to steal documents. So he might also have realized that as a solo system administrator in Hawaii, he would have this opportunity. Whether this was on his mind or not, on March 15, 2012, he accepted this offer. Dell agreed to pay all his relocation expenses and provide him with a housing allowance.

  He found a 1,559-square-foot house in Oahu, located at 94-1044 Eleu Street in the middle-class suburb of Waipahu. It was part of the Royal Kunia development, which contained three hundred similar-looking homes. According to Albi Matco, the manager of the community association for the development, many of the residents worked at military facilities in the area. The corner house Snowden rented was comfortable enough, with three bedrooms, a walk-in closet, a living room with a high ceiling, and a single-car garage, but in no way lavish. It did not even have a backyard. He moved in on April 2, 2012, which entailed a brief separation from his girlfriend, Mills, who had committed herself to attending a girlfriend’s wedding the following month. After he left for his new assignment, she wrote on Instagram, “Sex toy party and then saying goodbye to my man—well not goodbye so much as see you in two months.”

  CHAPTER 4

  Thief

  We begin by coveting what we see every day.

  —HANNIBAL LECTER, The Silence of the Lambs

  IN HAWAII IN 2012, Snowden was living a very comfortable life. He was earning just over $120,000 a year from Dell. His housing allowance covered the rent and the lease on his car. He worked five days a week at the NSA base. The commute, as I timed it, took only ten minutes. Driving past a sign marked “Restricted Area: Keep Out,” and the security booth where NSA guards checked his credentials, he left his car in the outdoor lot for the Kunia Regional Security Operations Center. (When I drove into the base in 2016, I was detained nearly two hours at the security booth before being turned bac
k.)

  Snowden worked in a three-story reinforced concrete building called “the tunnel,” even though it was above the ground. It had been built during World War II to serve as an aircraft assembly plant. During the war, it was entirely covered with earth and shrubbery to proof it against Japanese bomber attacks. In 1980, the NSA converted it to its regional base in Hawaii for its intelligence gathering. Its lack of windows and the dirt covering gave it the appearance, when I viewed it in 2016, of an oblong-shaped anthill. Workers, both military and civilian, entered through an exterior staircase in the center of the mound. Snowden said in describing the atmosphere, “You’re in a vaulted space. Everybody has sort of similar clearances, everybody knows everybody. It’s a small world.” He said that to relieve the tediousness of the work, every two months or so his fellow workers would circulate a picture of a naked person that showed up on their screens as part of the NSA’s surveillance of foreign suspects. He explained, “You’ve got young enlisted guys, 18 to 22 years old [who have] suddenly been thrust into a position of extraordinary responsibility where they now have access to all of your private records. In the course of their daily work they stumble across…an intimate nude photo of someone in a sexually compromising position.”

  He knew that copying any files, including photographs, was a violation of NSA rules. But he did not report this illicit activity to the NSA, even though he later claimed that it occurred regularly. He joked in his Moscow interview with The Guardian that some of the nudes were “extremely attractive” and that viewing them was, as he put it, “the fringe benefits of surveillance positions.”

  Snowden identified with the Libertarian Party, and at the NSA he made no effort to conceal his political support of its causes. He became an active partisan of Congressman Ron Paul, the leading figure in the party in 2012. “He’s so dreamy,” Snowden posted on the Ars Technica site in March 2009 (just after he registered to vote in North Carolina, though he no longer lived there). Paul was running in the 2012 Republican presidential primaries, and Snowden made a contribution of $500 to his election committee. Snowden’s attraction to Paul’s libertarian ideology was not that surprising. At the core of Paul’s worldview was a deep hostility to the intrusion of the government into private lives. Snowden shared this hostility, as was clear from his Internet postings. Like other Libertarians, Snowden believed that citizens should not be “shackled” by federal law. He later addressed from Moscow via an Internet hookup a libertarian gathering at which Ron Paul also spoke. “Law is a lot like medicine,” he said. “When you have too much it can be fatal.” Like Paul, Snowden ardently opposed any form of gun control, as did Lindsay Mills in her online postings.