If the Times, or any paper, did something similar to me—if it took my revelations, reported on them, submitted the reporting for review, and then suppressed its publication—I’d be sunk. Given the likelihood of my identification as the source, it would be tantamount to turning me in before any revelations were brought to the public.
If I couldn’t trust a legacy newspaper, could I trust any institution? Why even bother? I hadn’t signed up for any of this. I had just wanted to screw around with computers and maybe do some good for my country along the way. I had a lease and a lover and my health was improved. Every STOP sign on my commute I took as advice to stop this voluntary madness. My head and heart were in conflict, with the only constant being the desperate hope that somebody else, somewhere else, would figure it out on their own. After all, wasn’t journalism about following the bread crumbs and connecting the dots? What else did reporters do all day, besides tweet?
I knew at least two things about the denizens of the Fourth Estate: they competed for scoops, and they knew very little about technology. It was this lack of expertise or even interest in tech that largely caused journalists to miss two events that stunned me during the course of my fact-gathering about mass surveillance.
The first was the NSA’s announcement of the construction of a vast new data facility in Bluffdale, Utah. The agency called it the Massive Data Repository, until somebody with a knack for PR realized the name might be tough to explain if it ever got out, so it was renamed the Mission Data Repository—because as long as you don’t change the acronym, you don’t have to change all the briefing slides. The MDR was projected to contain a total of four twenty-five-thousand-square-foot halls, filled with servers. It could hold an immense amount of data, basically a rolling history of the entire planet’s pattern of life, insofar as life can be understood through the connection of payments to people, people to phones, phones to calls, calls to networks, and the synoptic array of Internet activity moving along those networks’ lines.
The only prominent journalist who seemed to notice the announcement was James Bamford, who wrote about it for Wired in March 2012. There were a few follow-ups in the nontech press, but none of them furthered the reporting. No one asked what, to me at least, were the most basic questions: Why does any government agency, let alone an intelligence agency, need that much space? What data, and how much of it, do they really intend to store there, and for how long? Because there was simply no reason to build something to those specs unless you were planning on storing absolutely everything, forever. Here was, to my mind, the corpus delicti—the plain-as-day corroboration of a crime, in a gigantic concrete bunker surrounded by barbed wire and guard towers, sucking up a city’s worth of electricity from its own power grid in the middle of the Utah desert. And no one was paying attention.
The second event happened one year later, in March 2013—one week after Clapper lied to Congress and Congress gave him a pass. A few periodicals had covered that testimony, though they merely regurgitated Clapper’s denial that the NSA collected bulk data on Americans. But no so-called mainstream publication at all covered a rare public appearance by Ira “Gus” Hunt, the chief technology officer of the CIA.
I’d known Gus slightly from my Dell stint with the CIA. He was one of our top customers, and every vendor loved his apparent inability to be discreet: he’d always tell you more than he was supposed to. For sales guys, he was like a bag of money with a mouth. Now he was appearing as a special guest speaker at a civilian tech event in New York called the GigaOM Structure: Data conference. Anyone with $40 could go to it. The major talks, such as Gus’s, were streamed for free live online.
The reason I’d made sure to catch his talk was that I’d just read, through internal NSA channels, that the CIA had finally decided on the disposition of its cloud contract. It had refused my old team at Dell, and turned down HP, too, instead signing a ten-year, $600 million cloud development and management deal with Amazon. I had no negative feelings about this—actually, at this juncture, I was pleased that my work wasn’t going to be used by the agency. I was just curious, from a professional standpoint, whether Gus might obliquely address this announcement and offer any insight into why Amazon had been chosen, since rumors were going around that the proposal process had been rigged in Amazon’s favor.
I got insight, certainly, but of an unexpected kind. I had the opportunity of witnessing the highest-ranking technical officer at the CIA stand onstage in a rumpled suit and brief a crowd of uncleared normies—and, via the Internet, the uncleared world—about the agency’s ambitions and capacities. As his presentation unfolded, and he alternated bad jokes with an even worse command of PowerPoint, I grew more and more incredulous.
“At the CIA,” he said, “we fundamentally try to collect everything and hang on to it forever.” As if that wasn’t clear enough, he went on: “It is nearly within our grasp to compute on all human generated information.” The underline was Gus’s own. He was reading from his slide deck, ugly words in an ugly font illustrated with the government’s signature four-color clip art.
There were a few journalists in the crowd, apparently, though it seemed as if almost all of them were from specialty tech-government publications like Federal Computer Week. It was telling that Gus stuck around for a Q & A toward the conclusion of his presentation. Rather, it wasn’t quite a Q & A, but more like an auxiliary presentation, offered directly to the journalists. He must have been trying to get something off his chest, and it wasn’t just his clown tie.
Gus told the journalists that the agency could track their smartphones, even when they were turned off—that the agency could surveil every single one of their communications. Remember: this was a crowd of domestic journalists. American journalists. And the way that Gus said “could” came off as “has,” “does,” and “will.” He perorated in a distinctly disturbed, and disturbing, manner, at least for a CIA high priest: “Technology is moving faster than government or law can keep up. It’s moving faster … than you can keep up: you should be asking the question of what are your rights and who owns your data.” I was floored—anybody more junior than Gus who had given a presentation like this would’ve been wearing orange by the end of the day.
Coverage of Gus’s confession ran only in the Huffington Post. But the performance itself lived on at YouTube, where it still remains, at least at the time of this writing six years later. The last time I checked, it had 313 views—a dozen of them mine.
The lesson I took from this was that for my disclosures to be effective, I had to do more than just hand some journalists some documents—more, even, than help them interpret the documents. I had to become their partner, to provide the technological training and tools to help them do their reporting accurately and safely. Taking this course of action would mean giving myself over totally to one of the capital crimes of intelligence work: whereas other spies have committed espionage, sedition, and treason, I would be aiding and abetting an act of journalism. The perverse fact is that legally, those crimes are virtually synonymous. American law makes no distinction between providing classified information to the press in the public interest and providing it, even selling it, to the enemy. The only opinion I’ve ever found to contradict this came from my first indoctrination into the IC: there, I was told that it was in fact slightly better to offer secrets for sale to the enemy than to offer them for free to a domestic reporter. A reporter will tell the public, whereas an enemy is unlikely to share its prize even with its allies.