Permanent Record(78)

With this network map in hand, I’d drive around Oahu like a madman, trying to check my email to see which of the journalists had replied to me. Having made contact with Laura Poitras, I’d spend much of the evening writing to her—sitting behind the wheel of my car at the beach, filching the Wi-Fi from a nearby resort. Some of the journalists I’d chosen needed convincing to use encrypted email, which back in 2012 was a pain. In some cases, I had to show them how, so I’d upload tutorials—sitting in my idling car in a parking lot, availing myself of the network of a library. Or of a school. Or of a gas station. Or of a bank—which had horrifyingly poor protections. The point was to not create any patterns.

Atop the parking garage of a mall, secure in the knowledge that the moment I closed the lid of my laptop, my secret was safe, I’d draft manifestos explaining why I’d gone public, but then delete them. And then I’d try writing emails to Lindsay, only to delete them, too. I just couldn’t find the words.





23



Read, Write, Execute





Read, Write, Execute: in computing, these are called permissions. Functionally speaking, they determine the extent of your authority within a computer or computer network, defining what exactly you can and cannot do. The right to read a file allows you to access its contents, while the right to write a file allows you to modify it. Execution, meanwhile, means that you have the ability to run a file or program, to carry out the actions it was designed to do.

Read, Write, Execute: this was my simple three-step plan. I wanted to burrow into the heart of the world’s most secure network to find the truth, make a copy of it, and get it out into the world. And I had to do all this without getting caught—without being read, written, and executed myself.

Almost everything you do on a computer, on any device, leaves a record. Nowhere is this more true than at the NSA. Each log-in and log-out creates a log entry. Each permission I used left its own forensic trace. Every time I opened a file, every time I copied a file, that action was recorded. Every time I downloaded, moved, or deleted a file, that was recorded, too, and security logs were updated to reflect the event. There were network flow records, public key infrastructure records—people even joked about cameras hidden in the bathrooms, in the bathroom stalls. The agency had a not inconsiderable number of counterintelligence programs spying on the people who were spying on people, and if even one caught me doing something I wasn’t supposed to be doing, it wouldn’t be a file that was getting deleted.

Luckily, the strength of these systems was also their weakness: their complexity meant that not even the people running them necessarily knew how they worked. Nobody actually understood where they overlapped and where their gaps were. Nobody, that is, except the systems administrators. After all, those sophisticated monitoring systems you’re imagining, the ones with scary names like MIDNIGHTRIDER—somebody’s got to install them in the first place. The NSA may have paid for the network, but sysadmins like myself were the ones who really owned it.

The Read phase would involve dancing through the digital grid of tripwires laid across the routes connecting the NSA to every other intelligence agency, domestic and foreign. (Among these was the NSA’s UK partner, the Government Communications Headquarters, or GCHQ, which was setting up dragnets like OPTICNERVE, a program that saved a snapshot every five minutes from the cameras of people video-chatting on platforms like Yahoo Messenger, and PHOTONTORPEDO, which grabbed the IP addresses of MSN Messenger users.) By using Heartbeat to bring in the documents I wanted, I could turn “bulk collection” against those who’d turned it against the public, effectively Frankensteining the IC. The agency’s security tools kept track of who read what, but it didn’t matter: anyone who bothered to check their logs was used to seeing Heartbeat by now. It would sound no alarms. It was the perfect cover.

But while Heartbeat would work as a way of collecting the files—far too many files—it only brought them to the server in Hawaii, a server that kept logs even I couldn’t get around. I needed a way to work with the files, search them, and discard the irrelevant and uninteresting, along with those containing legitimate secrets that I wouldn’t be giving to journalists. At this point, still in my Read phase, the hazards were manifold, due mainly to the fact that the protocols I was up against were no longer geared to monitoring but to prevention. If I ran my searches on the Heartbeat server, it would light a massive electronic sign blinking ARREST ME.

I thought about this for a while. I couldn’t just copy the files directly from the Heartbeat server onto a personal storage device and waltz out of the Tunnel without being caught. What I could do, though, was bring the files closer, directing them to an intermediate way station.

I couldn’t send them to one of our regular computers, because by 2012 all of the Tunnel had been upgraded to new “thin client” machines: small helpless computers with crippled drives and CPUs that couldn’t store or process data on their own, but did all of their storage and processing on the cloud. In a forgotten corner of the office, however, there was a pyramid of disused desktop computers—old, moldering legacy machines the agency had wiped clean and discarded. When I say old here, I mean young by the standards of anyone who doesn’t live on a budget the size of the NSA’s. They were Dell PCs from as recently as 2009 or 2010, large gray rectangles of comforting weight, which could store and process data on their own without being connected to the cloud. What I liked about them was that though they were still in the NSA system, they couldn’t really be closely tracked as long as I kept them off the central networks.