In contemporary life, we have a single concept that encompasses all this negative or potential space that’s off-limits to the government. That concept is “privacy.” It is an empty zone that lies beyond the reach of the state, a void into which the law is only permitted to venture with a warrant—and not a warrant “for everybody,” such as the one the US government has arrogated to itself in pursuit of mass surveillance, but a warrant for a specific person or purpose supported by a specific probable cause.
The word “privacy” itself is somewhat empty, because it is essentially indefinable, or over-definable. Each of us has our own idea of what it is. “Privacy” means something to everyone. There is no one to whom it means nothing.
It’s because of this lack of common definition that citizens of pluralistic, technologically sophisticated democracies feel that they have to justify their desire for privacy and frame it as a right. But citizens of democracies don’t have to justify that desire—the state, instead, must justify its violation. To refuse to claim your privacy is actually to cede it, either to a state trespassing its constitutional restraints or to a “private” business.
There is, simply, no way to ignore privacy. Because a citizenry’s freedoms are interdependent, to surrender your own privacy is really to surrender everyone’s. You might choose to give it up out of convenience, or under the popular pretext that privacy is only required by those who have something to hide. But saying that you don’t need or want privacy because you have nothing to hide is to assume that no one should have, or could have, to hide anything—including their immigration status, unemployment history, financial history, and health records. You’re assuming that no one, including yourself, might object to revealing to anyone information about their religious beliefs, political affiliations, and sexual activities, as casually as some choose to reveal their movie and music tastes and reading preferences.
Ultimately, saying that you don’t care about privacy because you have nothing to hide is no different from saying you don’t care about freedom of speech because you have nothing to say. Or that you don’t care about freedom of the press because you don’t like to read. Or that you don’t care about freedom of religion because you don’t believe in God. Or that you don’t care about the freedom to peaceably assemble because you’re a lazy, antisocial agoraphobe. Just because this or that freedom might not have meaning to you today doesn’t mean that it doesn’t or won’t have meaning tomorrow, to you, or to your neighbor—or to the crowds of principled dissidents I was following on my phone who were protesting halfway across the planet, hoping to gain just a fraction of the freedoms that my country was busily dismantling.
I wanted to help, but I didn’t know how. I’d had enough of feeling helpless, of being just an asshole in flannel lying around on a shabby couch eating Cool Ranch Doritos and drinking Diet Coke while the world went up in flames.
The young people of the Middle East were agitating for higher wages, lower prices, and better pensions, but I couldn’t give them any of that, and no one could give them a better shot at self-governance than the one they were taking themselves. They were, however, also agitating for a freer Internet. They were decrying Iran’s Ayatollah Khamenei, who had been increasingly censoring and blocking threatening Web content, tracking and hacking traffic to offending platforms and services, and shutting down certain foreign ISPs entirely. They were protesting Egypt’s president, Hosni Mubarak, who’d cut off Internet access for his whole country—which had merely succeeded in making every young person in the country even more furious and bored, luring them out into the streets.
Ever since I’d been introduced to the Tor Project in Geneva, I’d used its browser and run my own Tor server, wanting to do my professional work from home and my personal Web browsing unmonitored. Now, I shook off my despair, propelled myself off the couch, and staggered over to my home office to set up a bridge relay that would bypass the Iranian Internet blockades. I then distributed its encrypted configuration identity to the Tor core developers.
This was the least I could do. If there was just the slightest chance that even one young kid from Iran who hadn’t been able to get online could now bypass the imposed filters and restrictions and connect to me—connect through me—protected by the Tor system and my server’s anonymity, then it was certainly worth my minimal effort.
I imagined this person reading their email, or checking their social media accounts to make sure that their friends and family had not been arrested. I had no way of knowing whether this was what they did, or whether anyone at all linked to my server from Iran. And that was the point: the aid I offered was private.
The guy who started the Arab Spring was almost exactly my age. He was a produce peddler in Tunisia, selling fruits and vegetables out of a cart. In protest against repeated harassment and extortion by the authorities, he stood in the square and set fire to his life, dying a martyr. If burning himself to death was the last free act he could manage in defiance of an illegitimate regime, I could certainly get up off the couch and press a few buttons.
PART THREE
19
The Tunnel
Imagine you’re entering a tunnel. Imagine the perspective: as you look down the length that stretches ahead of you, notice how the walls seem to narrow to the tiny dot of light at the other end. The light at the end of the tunnel is a symbol of hope, and it’s also what people say they see in near-death experiences. They have to go to it, they say. They’re drawn to it. But then where else is there to go in a tunnel, except through it? Hasn’t everything led up to this point?
My tunnel was the Tunnel: an enormous Pearl Harbor–era airplane factory turned NSA facility located under a pineapple field in Kunia, on the island of Oahu, Hawaii. The facility was built out of reinforced concrete, its eponymous tunnel a kilometer-long tube in the side of a hill opening up into three cavernous floors of server vaults and offices. At the time the Tunnel was built, the hill was covered over with huge amounts of sand, soil, desiccated pineapple plant leaves, and patches of sun-parched grass to camouflage it from Japanese bombers. Sixty years later it resembled the vast burial mound of a lost civilization, or some gigantic arid pile that a weird god had heaped up in the middle of a god-size sandbox. Its official name was the Kunia Regional Security Operations Center.
I went to work there, still on a Dell contract, but now for the NSA again, early in 2012. One day that summer—actually, it was my birthday—as I passed through the security checks and proceeded down the tunnel, it struck me: this, in front of me, was my future.
I’m not saying that I made any decisions at that instant. The most important decisions in life are never made that way. They’re made subconsciously and only express themselves consciously once fully formed—once you’re finally strong enough to admit to yourself that this is what your conscience has already chosen for you, this is the course that your beliefs have decreed. That was my twenty-ninth birthday present to myself: the awareness that I had entered a tunnel that would narrow my life down toward a single, still-indistinct act.
Just as Hawaii has always been an important waystation—historically, the US military treated the island chain as little more than a mid-Pacific refueling depot for boats and planes—it had also become an important switchpoint for American communications. These include the intelligence that flowed between the contiguous forty-eight states and my former place of employment, Japan, as well as other sites in Asia.
The job I’d taken was a significant step down the career ladder, with duties I could at this point perform in my sleep. It was supposed to mean less stress, a lighter burden. I was the sole employee of the aptly named Office of Information Sharing, where I worked as a SharePoint systems administrator. SharePoint is a Microsoft product, a dopey poky program, or rather a grab-bag of programs, focused on internal document management: who can read what, who can edit what, who can send and receive what, and so on. By making me Hawaii’s SharePoint systems administrator, the NSA had made me the mana
ger of document management. I was, in effect, the reader in chief at one of the agency’s most significant facilities. As was my typical practice in any new technical position, I spent the earliest days automating my tasks—meaning writing scripts to do my work for me—so as to free up my time for something more interesting.
Before I go any further, I want to emphasize this: my active searching out of NSA abuses began not with the copying of documents, but with the reading of them. My initial intention was just to confirm the suspicions that I’d first had back in 2009 in Tokyo. Three years later, I was determined to find out if an American system of mass surveillance existed and, if it did, how it functioned. Though I was uncertain about how to conduct this investigation, I was at least sure of this: I had to understand exactly how the system worked before I could decide what, if anything, to do about it.
* * *
THIS, OF COURSE, was not why Lindsay and I had come to Hawaii. We hadn’t hauled all the way out to paradise just so I could throw our lives away for a principle.
We’d come to start over. To start over yet again.
My doctors told me that the climate and more relaxed lifestyle in Hawaii might be beneficial for my epilepsy, since lack of sleep was thought to be the leading trigger of the seizures. Also, the move eliminated the driving problem: the Tunnel was within bicycling distance of a number of communities in Kunia, the quiet heart of the island’s dry, red interior. It was a pleasant, twenty-minute ride to work, through sugarcane fields in brilliant sunshine. With the mountains rising calm and high in the clear blue distance, the gloomy mood of the last few months lifted like the morning fog.
Lindsay and I found a decent-size bungalow-type house on Eleu Street in Waipahu’s Royal Kunia, which we furnished with our stuff from Columbia, Maryland, since Dell paid relocation expenses. The furniture didn’t get much use, though, since the sun and heat would often cause us to walk in the door, strip off our clothes, and lie naked on the carpet beneath the overworked air conditioner. Eventually, Lindsay turned the garage into a fitness studio, filling it with yoga mats and the spinning pole she’d brought from Columbia. I set up a new Tor server. Soon, traffic from around the world was reaching the Internet via the laptop sitting in our entertainment center, which had the ancillary benefit of hiding my own Internet activity in the noise.
One night during the summer I turned twenty-nine, Lindsay finally prevailed on me to go out with her to a luau. She’d been after me to go for a while, because a few of her pole-fitness friends had been involved in some hula-girl capacity, but I’d been resistant. It had seemed like such a cheesy touristy thing to do, and had felt, somehow, disrespectful. Hawaiian culture is ancient, although its traditions are very much alive; the last thing I wanted was to disturb someone’s sacred ritual.
Finally, however, I capitulated. I’m very glad I did. What impressed me the most was not the luau itself—though it was very much a fire-twirling spectacle—but the old man who was holding court nearby in a little amphitheater down by the sea. He was a native Hawaiian, an erudite man with that soft but nasal island voice, who was telling a group of people gathered around a fire the creation stories of the islands’ indigenous peoples.
The one story that stuck with me concerned the twelve sacred islands of the gods. Apparently, there had existed a dozen islands in the Pacific that were so beautiful and pure and blessed with freshwater that they had to be kept secret from humanity, who would spoil them. Three of them were especially revered: Kane-huna-moku, Kahiki, and Pali-uli. The lucky gods who inhabited these islands decided to keep them hidden, because they believed that a glimpse of their bounty would drive people mad. After considering numerous ingenious schemes by which these islands might be concealed, including dyeing them the color of the sea, or sinking them to the bottom of the ocean, they finally decided to make them float in the air.
Once the islands were airborne, they were blown from place to place, staying constantly in motion. At sunrise and sunset, especially, you might think that you’d noticed one, hovering far at the horizon. But the moment you pointed it out to anyone, it would suddenly drift away or assume another form entirely, such as a pumice raft, a hunk of rock ejected by a volcanic eruption—or a cloud.
I thought about that legend a lot while I went about my search. The revelations I was pursuing were exactly like those islands: exotic preserves that a pantheon of self-important, self-appointed rulers were convinced had to be kept secret and hidden from humanity. I wanted to know what the NSA’s surveillance capabilities were exactly; whether and how they extended beyond the agency’s actual surveillance activities; who approved them; who knew about them; and, last but surely not least, how these systems—both technical and institutional—really operated.
The moment I’d think that I spotted one of these “islands”—some capitalized code name I didn’t understand, some program referenced in a note buried at the end of a report—I’d go chasing after further mentions of it in other documents, but find none. It was as if the program I was searching for had floated away from me and was lost. Then, days later, or weeks later, it might surface again under a different designation, in a document from a different department.
Sometimes I’d find a program with a recognizable name, but without an explanation of what it did. Other times I’d just find a nameless explanation, with no indication as to whether the capability it described was an active program or an aspirational desire. I was running up against compartments within compartments, caveats within caveats, suites within suites, programs within programs. This was the nature of the NSA—by design, the left hand rarely knew what the right hand was doing.
In a way, what I was doing reminded me of a documentary I once watched about map-making—specifically, about the way that nautical charts were created in the days before imaging and GPS. Ship captains would keep logs and note their coordinates, which landbound mapmakers would then try to interpret. It was through the gradual accretion of this data, over hundreds of years, that the full extent of the Pacific became known, and all its islands identified.
But I didn’t have hundreds of years or hundreds of ships. I was alone, one man hunched over a blank blue ocean, trying to find where this one speck of dry land, this one data point, belonged in relation to all the others.
20
Heartbeat
Back in 2009 in Japan, when I went to that fateful China conference as a substitute briefer, I guess I’d made some friends, especially at the Joint Counterintelligence Training Academy (JCITA) and its parent agency, the Defense Intelligence Agency (DIA). In the three years since, JCITA had invited me a half-dozen or so times to give seminars and lectures at DIA facilities. Essentially, I was teaching classes in how the American Intelligence Community could protect itself from Chinese hackers and exploit the information gained from analyzing their hacks to hack them in return.
I always enjoyed teaching—certainly more than I ever enjoyed being a student—and in the early days of my disillusionment, toward the end of Japan and through my time at Dell, I had the sense that were I to stay in intelligence work for the rest of my career, the positions in which my principles would be least compromised, and my mind most challenged, would almost certainly be academic. Teaching with JCITA was a way of keeping that door open. It was also a way of keeping up to date—when you’re teaching, you can’t let your students get ahead of you, especially in technology.
This put me in the regular habit of perusing what the NSA called “readboards.” These are digital bulletin boards that function something like news blogs, only the “news” here is the product of classified intelligence activities. Each major NSA site maintains its own, which its local staff updates daily with what they regard as the day’s most important and interesting documents—everything an employee has to read to keep current.
As a holdover from my JCITA lecture preparation, and also, frankly, because I was bored in Hawaii, I got into the habit of checking a number of these boards every day: my own site’s re
adboard in Hawaii, the readboard of my former posting in Tokyo, and various readboards from Fort Meade. This new low-pressure position gave me as much time to read as I wanted. The scope of my curiosity might have raised a few questions at a prior stage of my career, but now I was the only employee of the Office of Information Sharing—I was the Office of Information Sharing—so my very job was to know what sharable information was out there. Meanwhile, most of my colleagues at the Tunnel spent their breaks streaming Fox News.
In the hopes of organizing all the documents I wanted to read from these various readboards, I put together a personal best-of-the-readboards queue. The files quickly began to pile up, until the nice lady who managed the digital storage quotas complained to me about the folder size. I realized that my personal readboard had become less a daily digest than an archive of sensitive information with relevance far beyond the day’s immediacy. Not wanting to erase it or stop adding to it, which would’ve been a waste, I decided instead to share it with others. This was the best justification for what I was doing that I could think of, especially because it allowed me to more or less legitimately collect material from a wider range of sources. So, with my boss’s approval, I set about creating an automated readboard—one that didn’t rely on anybody posting things to it, but edited itself.
Like EPICSHELTER, my automated readboard platform was designed to perpetually scan for new and unique documents. It did so in a far more comprehensive manner, however, peering beyond NSAnet, the NSA’s network, into the networks of the CIA and the FBI as well as into the Joint Worldwide Intelligence Communications System (JWICS), the Department of Defense’s top-secret intranet. The idea was that its findings would be made available to every NSA officer by comparing their digital identity badges—called PKI certificates—to the classification of the documents, generating a personal readboard customized to their clearances, interests, and office affiliations. Essentially, it would be a readboard of readboards, an individually tailored newsfeed aggregator, bringing each officer all the newest information pertinent to their work, all the documents they had to read to stay current. It would be run from a server that I alone managed, located just down the hall from me. That server would also store a copy of every document it sourced, making it easy for me to perform the kind of deep interagency searches that the heads of most agencies could only dream of.
Permanent Record Page 21
