The one story that stuck with me concerned the twelve sacred islands of the gods. Apparently, there had existed a dozen islands in the Pacific that were so beautiful and pure and blessed with freshwater that they had to be kept secret from humanity, who would spoil them. Three of them were especially revered: Kane-huna-moku, Kahiki, and Pali-uli. The lucky gods who inhabited these islands decided to keep them hidden, because they believed that a glimpse of their bounty would drive people mad. After considering numerous ingenious schemes by which these islands might be concealed, including dyeing them the color of the sea, or sinking them to the bottom of the ocean, they finally decided to make them float in the air.
Once the islands were airborne, they were blown from place to place, staying constantly in motion. At sunrise and sunset, especially, you might think that you’d noticed one, hovering far at the horizon. But the moment you pointed it out to anyone, it would suddenly drift away or assume another form entirely, such as a pumice raft, a hunk of rock ejected by a volcanic eruption—or a cloud.
I thought about that legend a lot while I went about my search. The revelations I was pursuing were exactly like those islands: exotic preserves that a pantheon of self-important, self-appointed rulers were convinced had to be kept secret and hidden from humanity. I wanted to know what the NSA’s surveillance capabilities were exactly; whether and how they extended beyond the agency’s actual surveillance activities; who approved them; who knew about them; and, last but surely not least, how these systems—both technical and institutional—really operated.
The moment I’d think that I spotted one of these “islands”—some capitalized code name I didn’t understand, some program referenced in a note buried at the end of a report—I’d go chasing after further mentions of it in other documents, but find none. It was as if the program I was searching for had floated away from me and was lost. Then, days later, or weeks later, it might surface again under a different designation, in a document from a different department.
Sometimes I’d find a program with a recognizable name, but without an explanation of what it did. Other times I’d just find a nameless explanation, with no indication as to whether the capability it described was an active program or an aspirational desire. I was running up against compartments within compartments, caveats within caveats, suites within suites, programs within programs. This was the nature of the NSA—by design, the left hand rarely knew what the right hand was doing.
In a way, what I was doing reminded me of a documentary I once watched about map-making—specifically, about the way that nautical charts were created in the days before imaging and GPS. Ship captains would keep logs and note their coordinates, which landbound mapmakers would then try to interpret. It was through the gradual accretion of this data, over hundreds of years, that the full extent of the Pacific became known, and all its islands identified.
But I didn’t have hundreds of years or hundreds of ships. I was alone, one man hunched over a blank blue ocean, trying to find where this one speck of dry land, this one data point, belonged in relation to all the others.
20
Heartbeat
Back in 2009 in Japan, when I went to that fateful China conference as a substitute briefer, I guess I’d made some friends, especially at the Joint Counterintelligence Training Academy (JCITA) and its parent agency, the Defense Intelligence Agency (DIA). In the three years since, JCITA had invited me a half-dozen or so times to give seminars and lectures at DIA facilities. Essentially, I was teaching classes in how the American Intelligence Community could protect itself from Chinese hackers and exploit the information gained from analyzing their hacks to hack them in return.
I always enjoyed teaching—certainly more than I ever enjoyed being a student—and in the early days of my disillusionment, toward the end of Japan and through my time at Dell, I had the sense that were I to stay in intelligence work for the rest of my career, the positions in which my principles would be least compromised, and my mind most challenged, would almost certainly be academic. Teaching with JCITA was a way of keeping that door open. It was also a way of keeping up to date—when you’re teaching, you can’t let your students get ahead of you, especially in technology.
This put me in the regular habit of perusing what the NSA called “readboards.” These are digital bulletin boards that function something like news blogs, only the “news” here is the product of classified intelligence activities. Each major NSA site maintains its own, which its local staff updates daily with what they regard as the day’s most important and interesting documents—everything an employee has to read to keep current.
As a holdover from my JCITA lecture preparation, and also, frankly, because I was bored in Hawaii, I got into the habit of checking a number of these boards every day: my own site’s readboard in Hawaii, the readboard of my former posting in Tokyo, and various readboards from Fort Meade. This new low-pressure position gave me as much time to read as I wanted. The scope of my curiosity might have raised a few questions at a prior stage of my career, but now I was the only employee of the Office of Information Sharing—I was the Office of Information Sharing—so my very job was to know what sharable information was out there. Meanwhile, most of my colleagues at the Tunnel spent their breaks streaming Fox News.
In the hopes of organizing all the documents I wanted to read from these various readboards, I put together a personal best-of-the-readboards queue. The files quickly began to pile up, until the nice lady who managed the digital storage quotas complained to me about the folder size. I realized that my personal readboard had become less a daily digest than an archive of sensitive information with relevance far beyond the day’s immediacy. Not wanting to erase it or stop adding to it, which would’ve been a waste, I decided instead to share it with others. This was the best justification for what I was doing that I could think of, especially because it allowed me to more or less legitimately collect material from a wider range of sources. So, with my boss’s approval, I set about creating an automated readboard—one that didn’t rely on anybody posting things to it, but edited itself.
Like EPICSHELTER, my automated readboard platform was designed to perpetually scan for new and unique documents. It did so in a far more comprehensive manner, however, peering beyond NSAnet, the NSA’s network, into the networks of the CIA and the FBI as well as into the Joint Worldwide Intelligence Communications System (JWICS), the Department of Defense’s top-secret intranet. The idea was that its findings would be made available to every NSA officer by comparing their digital identity badges—called PKI certificates—to the classification of the documents, generating a personal readboard customized to their clearances, interests, and office affiliations. Essentially, it would be a readboard of readboards, an individually tailored newsfeed aggregator, bringing each officer all the newest information pertinent to their work, all the documents they had to read to stay current. It would be run from a server that I alone managed, located just down the hall from me. That server would also store a copy of every document it sourced, making it easy for me to perform the kind of deep interagency searches that the heads of most agencies could only dream of.
I called this system Heartbeat, because it took the pulse of the NSA and of the wider IC. The volume of information that crashed through its veins was simply enormous, as it pulled documents from internal sites dedicated to every specialty from updates on the latest cryptographic research projects to minutes of the meetings of the National Security Council. I’d carefully configured it to ingest materials at a slow, constant pace, so as not to monopolize the undersea fiber-optic cable tying Hawaii to Fort Meade, but it still pulled so many more documents than any human ever could that it immediately became the NSAnet’s most comprehensive readboard.