I’m going to refrain from publishing how exactly I went about my own copying and encryption (a means of securing files, which I’ll explain in greater detail later on)—so that the NSA will still be standing tomorrow. I will mention, however, what storage technology I used for the copied files. Forget thumb drives; they’re too bulky for the relatively small amount they store. I went, instead, for SD cards—the acronym stands for Secure Digital. Actually, I went for the mini- and micro-SD cards.
You’ll recognize SD cards if you’ve ever used a digital camera or video camera, or needed more storage on a tablet. They’re tiny little buggers, basically the size of your pinkie fingernail—eminently concealable. You can fit one inside the pried-off square of a Rubik’s Cube, then stick the square back on, and nobody will notice. In other attempts, I carried a card in my sock or, at my most paranoid, in my cheek, so I could swallow it if I had to. Eventually, as I gained confidence, and certainty in my methods of encryption, I’d just keep a card at the bottom of my pocket. They hardly ever triggered metal detectors, and who wouldn’t believe I’d simply forgotten something so small?
The size of SD cards, however, has one downside: They’re extremely slow. Copying times for massive volumes of data are always long—at least always longer than you want. And the duration stretches even more when you’re copying to a minuscule silicon wafer embedded in plastic. Also, I wasn’t just copying. I was deduplicating, compressing, and encrypting, none of which could be accomplished simultaneously. I was using all the skills I’d ever acquired in my storage work, making an off-site backup of evidence of the IC’s abuses.
It could take eight hours or more—entire shifts—to fill a card. And though I switched to working nights again, those hours were terrifying. There was the old computer chugging, monitor off. And there I was, turning the monitor back on every once in a while to check the rate of progress and cringing. You know the feeling—following the completion bar as it indicates 84 percent completed, 85 percent completed… 1:58:53 left… As it filled toward the sweet relief of 100 percent, all files copied, I’d be sweating, seeing shadows and hearing footsteps around every corner.
Execute: That was the third and final step. As each card filled, I had to run my getaway routine. I had to get them out of the building, past the bosses and military uniforms, down the stairs and out the empty hall, past the badge scans and armed guards and two-doored security zones in which the next door doesn’t open until the previous door shuts. And if anything goes awry, the guards draw their weapons and the doors lock you in and you say, Well, isn’t this embarrassing? This—per all the reports I’d been studying, and all the nightmares I’d been having—was where they’d catch me; I was sure of it. Each time I left, I was petrified. I’d have to force myself not to think about the SD card. When you think about it, you act differently, suspiciously.
One unexpected upshot of gaining a better understanding of NSA surveillance was that I’d also gained a better understanding of the dangers I faced. In other words, learning about the agency’s systems had taught me how not to get caught by them. The FBI—the agency that investigates all crime within the IC—took great pride in explaining exactly how they caught their suspects, and believe me, I didn’t mind benefiting from their experience. It seemed that in almost every case, the FBI would wait to make its arrest until the suspect had finished their work and was about to go home. Sometimes they would let the suspect take the material out into public, where its very presence was a federal crime. I kept imagining a team of FBI agents lying in wait for me—there, out in the public light, just at the far end of the Tunnel.
I’d usually try to banter with the guards, and this was where my Rubik’s Cube came in most handy. I was known to the guards and to everybody else at the Tunnel as the Rubik’s Cube guy, because I was always working the cube as I walked down the halls. I got so adept I could even solve it one-handed. It became a distraction device as much for myself as for my coworkers. Most of them thought it was an affectation, or a nerdy conversation starter. And it was, but primarily it relieved my anxiety. It calmed me.
I bought a few cubes and handed them out. Anyone who took to it, I’d give them pointers. The more that people got used to them, the less they’d ever want a closer look at mine.
I got along with the guards, or I told myself I did, mostly because I knew where their minds were: elsewhere. I’d done something like their job before, back at CASL. I knew how mind-numbing it was to spend all night standing, feigning vigilance. Your feet hurt. After a while, all the rest of you hurts. And you can get so lonely that you’ll talk to a wall.
I aimed to be more entertaining than the wall. There was the one guard I talked to about insomnia and the difficulties of day-sleeping (remember, I was on nights, so this would’ve been around two in the morning). Another guy, we discussed politics. What they all had in common was a reaction to my Rubik’s Cube: It made them smile. Over the course of my employment at the Tunnel, pretty much all the guards said some variation of, “Oh man, I used to play with that when I was a kid,” and then, invariably, “I tried to take the stickers off to solve it.” Me too, buddy. Me too.
It was only once I got home that I was able to relax, even just slightly. I was still worried about the house being wired—that was another one of those charming methods the FBI used against those it suspected of inadequate loyalty. Lindsay would go to bed, and I’d go to the couch, hiding with my laptop under a blanket because cotton beats cameras. With the threat of immediate arrest out of the way, I could focus on transferring the files to a larger external storage device via my laptop—only somebody who didn’t understand technology very well would think I’d keep them on the laptop forever. Then I’d lock them down under multiple layers of encryption algorithms using differing implementations, so that even if one failed the others would keep them safe.
I’d been careful not to leave any traces at my work and to make sure my encryption left no traces of the documents at home. Still, I knew the documents could lead back to me once I’d sent them to the journalists and they’d been decrypted. Any investigator looking at which agency employees had accessed, or could access, all these materials would come up with a list with probably only a single name on it: mine. The fact was that every individual file left me vulnerable, because all digital files contain metadata, invisible tags that can be used to identify their origins.
I struggled with how to handle this metadata situation. I worried that if I didn’t strip the identifying information from the documents, they might incriminate me the moment the journalists decrypted and opened them. But I also worried that by thoroughly stripping the metadata, I risked altering the files. And if they were changed in any way, that could cast doubt on their authenticity. Which was more important: personal safety, or the public good? It might sound like an easy choice, but it took me quite a while before I owned the risk and left the metadata intact.