Some thoughts on Edward Snowden's book

“Under the guise of compatibility testing, I could transfer the files to these old computers, where I could search, filter, and organize them as much as I wanted, as long as I was careful. I was carrying one of the big old hulks back to my desk when I passed one of the IT directors, who stopped me and asked me what I needed it for - he’d been a major proponent of getting rid of them. ‘Stealing secrets,’ I answered, and we laughed.”

That paragraph still makes me laugh. The context was Edward Snowden trying to figure out how he could get, out of this NSA facility underneath a pineapple field in Hawaii, the documents he wished to share with the US public, to reveal how their own government was spying on them. He could hardly just email the files to a private account, everything on the NSA systems was tracked and logged. Ah, but sitting in the corner were these old desktop computers nobody cared about, and under the guise of wanting to check whether some software he had developed for the NSA worked with older systems he received personal, and apparently unmonitored, use of an old desktop. He was then able to transfer desired files from the main NSA systems to the old desktop, and then copy them to a microSD card, which he then smuggled out of the facility. And the rest is now history.

---

Permanent Record

So, I recently finished Edward Snowden’s book Permanent Record. It was quite a good book, well-written, sometimes reads like a spy thriller (but the story is true), I enjoyed it more than I thought I would. It was also somewhat nostalgic for me because Snowden and I are both 38 years old. The beginning of the book (it is an autobiography) is about how he discovered technology as a child, which has much in common with how I discovered technology as a child. Anyone who ever had a Geocities website will find something to smile about. And ah, the early internet was such a nice place compared to what it has become. He says:

Whatever Web 1.0 might have lacked in user-friendliness and design sensibility, it more than made up for by its fostering of experimentation and originality of expression, and by its emphasis on the creative primacy of the individual.

And:

To this day, I consider the 1990s online to have been the most pleasant and successful anarchy I’ve ever experienced.

He somewhat credits the fact that “being online”, or “being on Twitter” or whatever had a higher entry bar in those days - if you made it, you probably had some technical skill. (And what should that mean about the way we design other systems and online communities?)

But of course the book is also a critique of the US government and the US intelligence community, and in particular the post-9/11 switch from targeted surveillance - I think you are a terrorist so I’m going to watch you, specifically - into mass surveillance, in which the NSA and other agencies seek to collect and permanently store all the digital information they can about everyone, because anyone could be a target of interest tomorrow. I recommend the book for complete reading, because he makes many good side points which I cannot possibly share here. Your trust in the US government will somehow fall even lower, yes it will. But I wanted to give you a few higher-level reactions after reading.

Sometimes the real spy world is like Hollywood

The book does sometimes read like a spy thriller. He describes one situation, in his first overseas posting in Geneva, in which he made the acquaintance of a Saudi banker at a party. His CO (case officer) decided this was a man who should be recruited as an “asset” (someone who would regularly provide information to US intelligence), and the CO began regularly taking the Saudi on trips to bars and strip clubs in hopes of building a friendship with him… but it wasn’t really working.

So, in desperation, the CO got the Saudi drunk as can be, then pressured him to drive home drunk, then called the police to report a drunk driver (the Saudi). Importantly, the Saudi did not know who had called the police on him. The fine was enormous because in Switzerland the fines are proportional to income, and his driver’s license was suspended for three months. The CO, pretend-guilty with the Saudi for having been drinking with him that night, drove the guy between home and work for those three months, and then offered to loan him money to pay the fine. Finally, then, the CO made the formal pitch of “will you be an asset for us?”, the Saudi realized he had been played all along and betrayed, and he cut off all contact with the CO. Mission failure, far as that goes.

Snowden told this story later to a “signals intelligence” guy (someone who spies through technology rather than working with people face-to-face), and was told “next time you meet someone, just give us his email address and we’ll take care of it”. Yeah…

A little more… I’m not going to elaborate here on the details on the NSA’s capabilities, you can read the book or the disclosures for that, but describing the NSA’s systems, Snowden does say:

It was, simply put, the closest thing to science fiction I’ve ever seen in science fact: an interface that allows you to type in pretty much anyone’s address, telephone number, or IP address, and then basically go through the recent history of their online activity.

I mentioned that he smuggled out documents on a microSD card… but where do you put the card when you’re going through the security check?

In other attempts I carried a card in my sock, or, at my most paranoid, in my cheek, so I could swallow it if I had to.

And finally, it is worth noting that the NSA is stopped by encryption too. Once Snowden had the files at home and encrypted he could leave the USB drive out in the open. If it would, mathematically, take 10 million years on average to brute force break an encryption key, the NSA is just as stopped by that mathematics as anyone else. (He even mentions that the switch from http to https caused US surveillance efforts some real difficulty.)

That’s the incomparable beauty of the cryptological art. A little bit of math can accomplish what all the guns and barbed wire can’t: a little bit of math can keep a secret.

If people can sin without consequence, they will sin

If people can sin without consequence, they will sin. As mentioned above, some of the NSA employees had access like “type in this person’s name and see everything we have on them”. And yes, depending on the target, that might include things up to watching them live on their own webcam. Now the NSA was at least ethical enough that it was against the rules to use that system to spy on a love interest or what have you… but there is a problem, right?

Analysts understood that the government would never publicly prosecute them, because you can’t exactly convict someone of abusing your secret system of mass surveillance if you refuse to admit the existence of the system itself.

So they knew they could get away with stuff. Snowden is a big vague on how common abuse was but he does say, for example, that “intercepted nudes were a kind of informal office currency”, and that there was an unwritten rule that if you found an attractive naked photo of a target, you shared it with the other analysts (at least, as long as there weren’t any women around). And once everyone is involved in the crime, everyone is also protected from being reported.

That was how you knew you could trust each other: you had shared in one another’s crimes.

He implies elsewhere that the same tactic was employed with elected officials - involve them in a larger misdeed being committed by the state, and you can count on them not to reveal that misdeed to the public.

It’s not a sin, but I’ll mention here that he also talks about other bizarre incentives in government work. When he went to negotiate his salary with a recruiting firm (which was working for BAE systems, which was working for the CIA), he asked for $50,000. The man behind the counter suggested $60,000. They eventually settled at $62,000. Why? Because the government contractors (like BAE) billed the government for whatever their employees got paid, plus a fee of 3-5%. So they were incentivized to raise salaries even for people quite happy to work for less - it was all coming from your taxes, after all.

The war on terror → the war on COVID

I know it’s a common analogy these days but truly, reading again about how the “war on terror” unfolded, it is impossible not to see parallels with the “war on COVID”. Maybe we should stop doing this, America?

On a political level, both began with what was, to some extent anyway, a genuine threat. And at first, both had at least a somewhat precisely defined goal - “get the people who did this” or “flatten the curve”. But over time, that goal expanded, and became vaguer, and a state that came to enjoy its emergency powers found it didn’t really desire that “emergency” to ever end.

After 9/11, the IC’s orders had been ‘never again’, a mission that could never be accomplished.

But on the level of the common folk… you know I’ve mentioned repeatedly that the fight against COVID gave a lot of people something to live for, meaning for their life. Therefore they don’t want it to end, they don’t want full victory (and fortunately for them, just like the fight against terrorism, full victory will never be had, and there is always more we could be doing that we are not doing). Snowden reminded me that many found that same meaning, for a little while, in the fight against terrorism:

There were no new frontiers to conquer or great civic problems to solve, except online. The attacks of 9/11 changed all that. Now, finally, there was a fight.

And finally… Snowden is today an enemy of the state, and he would necessarily have little trust in that state. But it wasn’t always that way, in fact he began adulthood as a sort of hyper-patriot (it literally ran in his family) who thought the US government was one of the ultimate forces for good in the world, and he wished to spread its influence everywhere.

I embraced the truth constructed for the good of the state, which in my passion I confused for the good of the country.

There is a parallel to public health here because, when you trust an institution immensely, it takes a while to lose that trust. Observing one bit of bad behavior isn’t sufficient, you need to see a repeated pattern of bad behavior. Snowden did, over time, observe repeated bad behavior, especially on the part of US intelligence agencies, and it changed his opinion. And many people, over the last few years now, have observed repeated bad behavior by health agencies in the US, and that has changed our opinion.

Divorce is terrible for children

You didn’t expect me to talk about divorce in this post, but the book is an autobiography, and at one point in his teenage life Snowden’s parents divorced. He wrote:

I’ve had friends tell me that you aren’t really an adult until you bury a parent or become one yourself. But what no one mentions is that for kids of a certain age, divorce is like both of those happening simultaneously.

What really got me was that… I assume that the behavior of their children had nearly zero, or exactly zero, influence in their decision to divorce. But that isn’t what child Snowden thought. He was racked with guilt, he played over in his mind times he complained too much, or fussed as a child, or bad report cards he brought home. He blamed himself for their separation. This is what divorce does to children.

Once safetyism is implemented it is difficult to remove it

The book is also a reminder that the physical security apparatus we are now used to, and accept (fences, ID checks, x-ray scans) is largely a post-9/11 creation.

It’s nearly inconceivable now, but at the time Fort Meade was almost entirely accessible to anyone.

The NSA headquarters are at Fort Meade, and a sort of personal employer he was working for in 2001 lived on Fort Meade, and so he regularly drove to her home… and he could. The morning of 9/11 (and all the mornings before) anyone could just drive onto Fort Meade. After the twin towers had been hit, he was told to go home because they might close the gates and they didn’t want him to get trapped… in his narrative you can sense a little incredulity in the idea that they might close the gates. 20+ years later now and I’m guessing they have never reopened the way they were open before. I won’t bore you again with things I’ve said before but… a nation that responds to every bad thing that happens by clamping down a little more, and which never unclamps, is going in one direction only.

Some final odds and ends

Things the technocracy hates about the American system:

America’s fundamental laws exist to make the job of law enforcement not easier but harder. This isn’t a bug, it’s a core feature of democracy.

In an authoritarian state, rights derive from the state and are granted to the people. In a free state, rights derive from the people and are granted to the state.

Thinking hypothetically about a future world in which everyone is constantly surveilled, and in which programmed computers can automatically mete out punishments for infractions:

Most of our lives, even if we don’t realize it, occur not in black and white but in a gray area, where we jaywalk, put trash in the recycling bin and recylables in the trash, ride our bicycles in the improper lane, and borrow a stranger’s Wi-Fi to download a book we didn’t pay for. Put simply, a world in which every law is always enforced would be a world in which everyone was a criminal.

Things that don’t bother journalists, apparently, because they barely mentioned it:

[The head of the CIA] told the journalists that the agency could track their smartphones, even when they were turned off - that the agency could surveil every one of their communications.

How the government deals with a citizen who has become an annoyance:

…instead of addressing the revelations, they’d impugn the credibility and motives of ‘the leaker’.

And until then - and perhaps even after then - they would harass my loved ones and disparage my character, prying into every aspect of my life and career, seeking information (or opportunities for disinformation) with which to smear me.

(Amidst all this chatter about the state doing something about disinformation, it is worth remembering that creating disinformation is literally the job of some people inside of our intelligence agencies.)

THE END