It may be hard to believe, but the agency at the time had no good answer for what a case officer should do to remain anonymous online. Formally, the way this ridiculous procedure was supposed to work was that someone back in McLean would go online from a specific computer terminal and set up a fake origin for a query before sending it to Google. If anyone tried to look into who had run that particular search, all they would find would be a fake business located somewhere in America that the CIA used as cover. I can say with absolute certainty that the process was ineffective, onerous, and expensive.
During my stint in Geneva, whenever a CO would ask me if there was a safer, faster, and all-around more efficient way to do this, I introduced them to Tor.
Tor is free and open-source software that, if used carefully, allows its users to browse online with the closest thing to perfect anonymity. Its protocols were developed by the US Naval Research Laboratory throughout the mid-1990s, and in 2003 it was released to the public. Tor operates on a cooperative community model, relying on tech-savvy volunteers all over the globe who run their own Tor servers out of their basements, attics, and garages.
For me, Tor was a life changer, bringing me back to the internet of my childhood by giving me just the slightest taste of freedom from being observed.
None of this is meant to imply that the agency wasn’t still doing some significant HUMINT, in the same manner in which it had always done so. Even I got involved, though my most memorable operation was a failure. Geneva was the first and only time in my intelligence career in which I made the personal acquaintance of a “target.”
I met the man at an embassy party. The embassy had lots of those. The COs always went, and sometimes they would bring me along. As a technologist, I found it incredibly easy to defend my cover. The moment someone asked me what I did, and I responded with the four words “I work in IT,” their interest in me was over.
The party I’m recalling took place on a warm night on the outside terrace of an upscale café. I took my plate and sat down at a table next to a well-dressed Middle Eastern man. He seemed lonely and totally exasperated that no one seemed interested in him, so I asked him about himself. That’s the usual technique: just be curious and let them talk. In this case, the man did so much talking that it was like I wasn’t even there. He was Saudi and told me about how much he loved Geneva. With a touch of a conspiratorial tone, he then said that he worked in private wealth management and mentioned his clients.
“Your clients?” I asked.
That’s when he said, “Most of my work is on Saudi accounts.”
After a few minutes, I excused myself to go to the bathroom, and on the way there I leaned over to tell the CO what I’d learned. I passed along this information because Saudi Arabia was suspected of financing terrorism. After an intentionally long interval “fixing my hair,” or texting Lindsay in front of the bathroom mirror, I returned to find the CO sitting in my chair. I waved to my new Saudi friend before sitting down at a different table. My job identifying an asset was done.
The next day, the CO, whom I’ll call Cal, heaped me with praise and thanked me effusively. COs are promoted or passed over based primarily on how effective they are at recruiting assets with access to information on matters substantial enough to be formally reported back to headquarters.
Despite Cal’s regular meetings with the banker, the banker wasn’t warming up to him—and Cal was getting impatient. After a month of failures, Cal was so frustrated that he took the banker out and intentionally got him drunk. Then he pressured the guy to drive home drunk instead of taking a cab. Before the guy had even left the last bar of the night, Cal called the Geneva police, who not fifteen minutes later arrested the banker for driving under the influence. The banker faced an enormous fine. When the fine was levied, and his “friend” couldn’t afford to pay, Cal was ready with a loan. Suddenly the banker had become dependent on him, the dream of every CO.
In the end, though, when the CO finally made the pitch to the banker to become an asset, the man turned him down. He cut off all contact and returned to Saudi Arabia. The CO was rotated back to the States. It was a waste, which I myself had put in motion and then was powerless to stop. After that experience, the prioritizing of SIGINT over HUMINT made all the more sense to me.
In the summer of 2008, the city had its annual giant carnival that culminates in fireworks. I remember sitting with the local personnel of the Special Collection Service, a joint CIA-NSA program responsible for installing and operating surveillance equipment that allows US embassies to spy on foreign signals. The work these guys did was way beyond my abilities, and they had access to NSA tools that I didn’t even know existed. Still, we were friendly: I looked up to them, and they looked out for me.
As the fireworks exploded overhead, I was talking about the banker’s case, lamenting the disaster it had been. One of the guys turned to me and said, “Next time you meet someone, Ed, don’t bother with the COs—just give us his email address, and we’ll take care of it.” At the time I barely had a clue of the full implications of what that comment meant.
FIFTEEN
Tokyo
The internet is fundamentally American, but I had to leave America to fully understand what that meant. Over 90 percent of the world’s internet traffic passes through technologies developed, owned, and/or operated by the American government and American businesses.
Though some of these companies might manufacture their devices in, say, China, the companies themselves are American and are subject to American law. They’re also subject to classified American policies that permit the US government to surveil virtually every man, woman, and child who has ever touched a computer or picked up a phone.
It should have been obvious that the US government would engage in this type of mass surveillance. It should have been especially obvious to me. Yet it wasn’t—mostly because the government kept insisting that it did nothing of the sort. All of us were too trusting. But I didn’t know that until some time after I moved to Japan in 2009 to work for the NSA.
It was a dream job, not only because it was with the most advanced intelligence agency on the planet, but also because it was based in Japan, a place that had always fascinated Lindsay and me. It felt like a country from the future. Mine was officially a contractor position, and it’s ironic that only by going private again was I put in a position to understand what my government was doing.
The NSA’s Pacific Technical Center (PTC) occupied one half of a building inside the enormous Yokota Air Base. As the headquarters of US Forces Japan, the base was surrounded by high walls, steel gates, and guarded checkpoints. Yokota and the PTC were just a short bike ride from where Lindsay and I got an apartment in Fussa, a city at the western edge of Tokyo.
My official job title was systems analyst, with responsibility for maintaining the local NSA systems. Much of my initial work was that of a systems administrator, though, helping to connect the NSA’s systems with the CIA’s.
Two things about the NSA stunned me right off the bat: how technologically sophisticated it was compared with the CIA, and how much less vigilant it was about security.