Permanent Record

by Edward Snowden

  This is the result of two decades of unchecked innovation—the final product of a political and professional class that dreams itself your master. No matter the place, no matter the time, and no matter what you do, your life has now become an open book.

  * * *

  IF MASS SURVEILLANCE was, by definition, a constant presence in daily life, then I wanted the dangers it posed, and the damage it had already done, to be a constant presence too. Through my disclosures to the press, I wanted to make this system known, its existence a fact that my country, and the world, could not ignore.In the years since 2013, awareness has grown, both in scope and subtlety. But in this social media age, we have always to remind ourselves: awareness alone is not enough.

  In America, the initial press reports on the disclosures started a “national conversation,” as President Obama himself conceded. While I appreciated the sentiment, I remember wishing that he had noted that what made it “national,” what made it a “conversation,” was that for the first time the American public was informed enough to have a voice.

  The revelations of 2013 particularly roused Congress, both houses of which launched multiple investigations into NSA abuses. Those investigations concluded that the agency had repeatedly lied regarding the nature and efficacy of its mass surveillance programs, even to the most highly cleared Intelligence Committee legislators.

  In 2015, a federal court of appeals ruled in the matter of ACLU v. Clapper, a suit challenging the legality of the NSA’s phone records collection program. The court ruled that the NSA’s program had violated even the loose standards of the Patriot Act and, moreover, was most probably unconstitutional. The ruling focused on the NSA’s interpretation of Section 215 of the Patriot Act, which allowed the government to demand from third parties “any tangible thing” that it deemed “relevant” to foreign intelligence and terror investigations. In the court’s opinion, the government’s definition of “relevant” was so expansive as to be virtually meaningless. To call some collected data “relevant” merely because it might become relevant at some amorphous point in the future was “unprecedented and unwarranted.” The court’s refusal to accept the government’s definition caused not a few legal scholars to interpret the ruling as casting doubt on the legitimacy of all government bulk-collection programs predicated on this doctrine of future relevance. In the wake of this opinion, Congress passed the USA Freedom Act, which amended Section 215 to explicitly prohibit the bulk collection of Americans’ phone records. Going forward, those records would remain where they originally had been, in the private control of the telecoms, and the government would have to formally request specific ones with a FISC warrant in hand if it wanted to access them.

  ACLU v. Clapper was a notable victory, to be sure. A crucial precedent was set. The court declared that the American public had standing: American citizens had the right to stand in a court of law and challenge the government’s officially secret system of mass surveillance. But as the numerous other cases that resulted from the disclosures continue to wend their slow and deliberate ways through the courts, it becomes ever clearer to me that the American legal resistance to mass surveillance was just the beta phase of what has to be an international opposition movement, fully implemented across both governments and private sector.

  The reaction of technocapitalists to the disclosures was immediate and forceful, proving once again that with extreme hazards come unlikely allies. The documents revealed an NSA so determined to pursue any and all information it perceived as being deliberately kept from it that it had undermined the basic encryption protocols of the Internet—making citizens’ financial and medical records, for example, more vulnerable, and in the process harming businesses that relied on their customers entrusting them with such sensitive data. In response, Apple adopted strong default encryption for its iPhones and iPads, and Google followed suit for its Android products and Chromebooks. But perhaps the most important private-sector change occurred when businesses throughout the world set about switching their website platforms, replacing http (Hypertext Transfer Protocol) with the encrypted https (the S signifies security), which helps prevent third-party interception of Web traffic. The year 2016 was a landmark in tech history, the first year since the invention of the Internet that more Web traffic was encrypted than unencrypted.

  The Internet is certainly more secure now than it was in 2013, especially given the sudden global recognition of the need for encrypted tools and apps. I’ve been involved with the design and creation of a few of these myself, through my work heading the Freedom of the Press Foundation, a nonprofit organization dedicated to protecting and empowering public-interest journalism in the new millennium. A major part of the organization’s brief is to preserve and strengthen First and Fourth Amendment rights through the development of encryption technologies. To that end, the FPF financially supports Signal, an encrypted texting and calling platform created by Open Whisper Systems, and develops SecureDrop (originally coded by the late Aaron Swartz), an open-source submission system that allows media organizations to securely accept documents from anonymous whistleblowers and other sources. Today, SecureDrop is available in ten languages and used by more than seventy media organizations around the world, including the New York Times, the Washington Post, the Guardian, and the New Yorker.

  In a perfect world, which is to say in a world that doesn’t exist, just laws would make these tools obsolete. But in the only world we have, they have never been more necessary. A change in the law is infinitely more difficult to achieve than a change in a technological standard, and as long as legal innovation lags behind technological innovation institutions will seek to abuse that disparity in the furtherance of their interests. It falls to independent, open-source hardware and software developers to close that gap by providing the vital civil liberties protections that the law may be unable, or unwilling, to guarantee.

  In my current situation, I’m constantly reminded of the fact that the law is country-specific, whereas technology is not. Every nation has its own legal code but the same computer code. Technology crosses borders and carries almost every passport. As the years go by, it has become increasingly apparent to me that legislatively reforming the surveillance regime of the country of my birth won’t necessarily help a journalist or dissident in the country of my exile, but an encrypted smartphone might.

  * * *

  INTERNATIONALLY, THE DISCLOSURES helped to revive debates about surveillance in places with long histories of abuses. The countries whose citizenries were most opposed to American mass surveillance were those whose governments had most cooperated with it, from the Five Eyes nations (especially the UK, whose GCHQ remains the NSA’s primary partner) to nations of the European Union. Germany, which has done much to reckon with its Nazi and Communist past, provides the primary example of this disjunction. Its citizens and legislators were appalled to learn that the NSA was surveilling German communications and had even targeted Chancellor Angela Merkel’s smartphone. At the same time, the BND, Germany’s premier intelligence agency, had collaborated with the NSA in numerous operations, even carrying out certain proxy surveillance initiatives that the NSA was unable or unwilling to undertake on its own.

  Nearly every country in the world found itself in a similar bind: its citizens outraged, its government complicit. Any elected government that relies on surveillance to maintain control of a citizenry that regards surveillance as anathema to democracy has effectively ceased to be a democracy. Such cognitive dissonance on a geopolitical scale has helped to bring individual privacy concerns back into the international dialogue within the context of human rights.

  For the first time since the end of World War II, liberal democratic governments throughout the world were discussing privacy as the natural, inborn right of every man, woman, and child. In doing so they were harking back to the 1948 UN Universal Declaration of Human Rights, whose Article 12 states: “No one shall be subjected to arbitrary interference with his privacy, family, ho
me or correspondence, nor to attacks upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.” Like all UN declarations, this aspirational document was never enforceable, but it had been intended to inculcate a new basis for transnational civil liberties in a world that had just survived nuclear atrocities and attempted genocides and was facing an unprecedented surfeit of refugees and the stateless.

  The EU, still under the sway of this postwar universalist idealism, now became the first transnational body to put these principles into practice, establishing a new directive that seeks to standardize whistleblower protections across its member states, along with a standardized legal framework for privacy protection. In 2016, the EU Parliament passed the General Data Protection Regulation (GDPR), the most significant effort yet made to forestall the incursions of technological hegemony—which the EU tends to regard, not unfairly, as an extension of American hegemony.

  The GDPR treats the citizens of the European Union, whom it calls “natural persons,” as also being “data subjects”—that is, people who generate personally identifiable data. In the US, data is usually regarded as the property of whoever collects it. But the EU posits data as the property of the person it represents, which allows it to treat our data subjecthood as deserving of civil liberties protections.

  The GDPR is undoubtedly a major legal advance, but even its transnationalism is too parochial: the Internet is global. Our natural personhood will never be legally synonymous with our data subjecthood, not least because the former lives in one place at a time while the latter lives in many places simultaneously.

  Today, no matter who you are, or where you are, bodily, physically, you are also elsewhere, abroad—multiple selves wandering along the signal paths, with no country to call your own, and yet beholden to the laws of every country through which you pass. The records of a life lived in Geneva dwell in the Beltway. The photos of a wedding in Tokyo are on a honeymoon in Sydney. The videos of a funeral in Varanasi are up on Apple’s iCloud, which is partially located in my home state of North Carolina and partially scattered across the partner servers of Amazon, Google, Microsoft, and Oracle, throughout the EU, UK, South Korea, Singapore, Taiwan, and China.

  Our data wanders far and wide. Our data wanders endlessly.

  We start generating this data before we are born, when technologies detect us in utero, and our data will continue to proliferate even after we die. Of course, our consciously created memories, the records that we choose to keep, comprise just a sliver of the information that has been wrung out of our lives—most of it unconsciously, or without our consent—by business and government surveillance. We are the first people in the history of the planet for whom this is true, the first people to be burdened with data immortality, the fact that our collected records might have an eternal existence. This is why we have a special duty. We must ensure that these records of our pasts can’t be turned against us, or turned against our children.

  Today, the liberty that we call privacy is being championed by a new generation. Not yet born on 9/11, they have spent their entire lives under the omnipresent specter of this surveillance. These young people who have known no other world have dedicated themselves to imagining one, and it’s their political creativity and technological ingenuity that give me hope.

  Still, if we don’t act to reclaim our data now, our children might not be able to do so. Then they, and their children, will be trapped too—each successive generation forced to live under the data specter of the previous one, subject to a mass aggregation of information whose potential for societal control and human manipulation exceeds not just the restraints of the law but the limits of the imagination.

  Who among us can predict the future? Who would dare to? The answer to the first question is no one, really, and the answer to the second is everyone, especially every government and business on the planet. This is what that data of ours is used for. Algorithms analyze it for patterns of established behavior in order to extrapolate behaviors to come, a type of digital prophecy that’s only slightly more accurate than analog methods like palm reading. Once you go digging into the actual technical mechanisms by which predictability is calculated, you come to understand that its science is, in fact, anti-scientific, and fatally misnamed: predictability is actually manipulation. A website that tells you that because you liked this book you might also like books by James Clapper or Michael Hayden isn’t offering an educated guess as much as a mechanism of subtle coercion.

  We can’t allow ourselves to be used in this way, to be used against the future. We can’t permit our data to be used to sell us the very things that must not be sold, such as journalism. If we do, the journalism we get will be merely the journalism we want, or the journalism that the powerful want us to have, not the honest collective conversation that’s necessary. We can’t let the godlike surveillance we’re under be used to “calculate” our citizenship scores, or to “predict” our criminal activity; to tell us what kind of education we can have, or what kind of job we can have, or whether we can have an education or a job at all; to discriminate against us based on our financial, legal, and medical histories, not to mention our ethnicity or race, which are constructs that data often assumes or imposes. And as for our most intimate data, our genetic information: if we allow it to be used to identify us, then it will be used to victimize us, even to modify us—to remake the very essence of our humanity in the image of the technology that seeks its control.

  Of course, all of the above has already happened.

  * * *

  EXILE: NOT A day has passed since August 1, 2013, in which I don’t recall that “exile” was what my teenage self used to call getting booted off-line. The Wi-Fi died? Exile. I’m out of signal range? Exile. The self who used to say that now seems so young to me. He seems so distant.

  When people ask me what my life is like now, I tend to answer that it’s a lot like theirs in that I spend a lot of time in front of the computer—reading, writing, interacting. From what the press likes to describe as an “undisclosed location”—which is really just whatever two-bedroom apartment in Moscow I happen to be renting—I beam myself onto stages around the world, speaking about the protection of civil liberties in the digital age to audiences of students, scholars, lawmakers, and technologists.

  Some days I take virtual meetings with my fellow board members at the Freedom of the Press Foundation, or talk with my European legal team, led by Wolfgang Kaleck, at the European Center for Constitutional and Human Rights. Other days, I just pick up some Burger King—I know where my loyalties lie—and play games I have to pirate because I can no longer use credit cards. One fixture of my existence is my daily check-in with my American lawyer, confidant, and all-around consigliere Ben Wizner at the ACLU, who has been my guide to the world as it is and puts up with my musings about the world as it should be.

  That’s my life. It got significantly brighter during the freezing winter of 2014, when Lindsay came to visit—the first time I’d seen her since Hawaii. I tried not to expect too much, because I knew I didn’t deserve the chance; the only thing I deserved was a slap in the face. But when I opened the door, she placed her hand on my cheek and I told her I loved her.

  “Hush,” she said, “I know.”

  We held each other in silence, each breath like a pledge to make up for lost time.

  From that moment, my world was hers. Previously, I’d been content to hang around indoors—indeed, that was my preference before I was in Russia—but Lindsay was insistent: she’d never been to Russia and now we were going to be tourists together.

  My Russian lawyer, Anatoly Kucherena, who helped me get asylum in the country—he was the only lawyer who had the foresight to show up at the airport with a translator—is a cultured and resourceful man, and he proved as adept at obtaining last-minute tickets to the opera as he is at navigating my legal issues. He helped arrange two box seats at the Bolshoi Theater, so Lindsay and I got dress
ed and went, though I have to admit I was wary. There were so many people, all packed so tightly into a hall. Lindsay could sense my growing unease. As the lights dimmed and the curtain rose, she leaned over, nudged me in the ribs, and whispered, “None of these people are here for you. They’re here for this.”

  Lindsay and I also spent time at some of Moscow’s museums. The Tretyakov Gallery contains one of the world’s richest collection of Russian Orthodox icon paintings. The artists who made these paintings for the Church were essentially contractors, I thought, and so were typically not allowed to sign their names to their handiwork, or preferred not to. The time and tradition that fostered these works was not given much to recognizing individual achievement. As Lindsay and I stood in front of one of the icons, a young tourist, a teenage girl, suddenly stepped between us. This wasn’t the first time I was recognized in public, but given Lindsay’s presence, it certainly threatened to be the most headline-worthy. In German-accented English, the girl asked whether she could take a selfie with us. I’m not sure what explains my reaction—maybe it was this German girl’s shy and polite way of asking, or maybe it was Lindsay’s always mood-improving, live-and-let-live presence—but without hesitation, for once, I agreed. Lindsay smiled as the girl posed between us and took a photo. Then, after a few sweet words of support, she departed.

  I dragged Lindsay out of the museum a moment later. I was afraid that if the girl posted the photo to social media we could be just minutes away from unwanted attention. I feel foolish now for thinking that. I kept nervously checking online, but the photo didn’t appear. Not that day, and not the day after. As far as I can tell, it was never shared—just kept as a private memory of a personal moment.