Cincinnatus, who could not wait any longer
How one program that never got installed nearly buried the biggest leak in intelligence history - and what the Edward Snowden affair teaches us.
In December 2012, Glenn Greenwald, a journalist writing for The Guardian, received a message from someone who signed himself "Cincinnatus". The stranger claimed to have something important and asked for just one thing: that Greenwald install PGP, a program for encrypting e-mail. When no reply came, Cincinnatus even recorded a short step-by-step video tutorial. Greenwald had other things on his plate. He put it off for weeks. He never installed it.
One of the most important journalistic stories of the 21st century almost vanished because a journalist could not find an hour to set up encryption.
A second attempt
Cincinnatus did not give up. In early 2013 he wrote to Laura Poitras, an American documentary filmmaker who had been in the sights of the security services for years - after her films about the Iraq war, she had been stopped at airports dozens of times. This time he signed himself "Citizenfour". Poitras did use encryption. The correspondence went on for months before the sender decided to take the next step.
In May 2013, Poitras and Greenwald flew to Hong Kong. At the Mira Hotel they arranged to meet the stranger at a specific spot - he would be holding a Rubik's Cube. They saw a thin, pale 29-year-old. His name was Edward Snowden. He was a computer specialist who had previously worked for the CIA and, most recently, as a contractor for Booz Allen Hamilton at an NSA facility in Hawaii. He had with him documents whose number US authorities would later estimate at hundreds of thousands, perhaps more than a million.
In the hotel room, Snowden asked his guests to put their phones in the fridge. Sound from a microphone could be intercepted even from a switched-off handset. When typing passwords, he covered his head and laptop with a blanket - in case of cameras. It looked like paranoia. A few weeks later the whole world knew it was simply knowledge of how things work.
"Not wittingly"
Why did he do it? Snowden has repeatedly pointed to one moment. On 12 March 2013, Senator Ron Wyden asked the Director of National Intelligence, James Clapper, in Congress: does the NSA collect any type of data at all on millions or hundreds of millions of Americans? Clapper replied: "No, sir." After a moment he added: "Not wittingly."
Snowden knew this was untrue. He sat at the systems that did exactly what was being denied under oath. By his account, he had earlier tried to raise concerns through internal channels - the NSA maintains there is no evidence of this. He concluded that if the highest officials could lie to the legislature without consequences, the only way for the public to decide anything was to show it the evidence. He did not want to choose for himself what would be published - he handed the documents to journalists, insisting that they judge what was in the public interest and what might harm someone.
Five days in June
On 5 June 2013, The Guardian published a secret court order under which the operator Verizon handed the NSA, every day, the metadata of millions of Americans' phone calls: who called whom, when and for how long. This was not surveillance of suspects. It was surveillance of everyone.
A day later, The Guardian and The Washington Post revealed PRISM - a programme that gave the NSA access to user data held by the largest internet companies. Then came more code names: XKeyscore - a search engine in which an analyst could browse almost everything someone does online simply by typing in an e-mail or IP address. Tempora - a British programme in which GCHQ tapped undersea fibre-optic cables and stored the entire traffic flowing through them for several days. Boundless Informant - a tool that showed on colourful maps which countries the agency collected the most data from.
On 9 June, Snowden revealed his identity himself in a video recorded by Poitras. "I don't want to live in a world where everything I do and say is recorded," he said. A few days later he disappeared from the hotel. On 23 June he boarded a plane to Moscow, from where he intended to fly on to Latin America. While he was in the air, the United States revoked his passport. He was stranded in the transit zone of Sheremetyevo airport for 39 days. In August he was granted temporary asylum in Russia. He still lives there, and in 2022 he received Russian citizenship - which some see as proof of his naivety and others as the consequence of no Western country being willing to take him in.
"Tor Stinks"
Among the documents was an NSA presentation with the telling title "Tor Stinks". Published by The Guardian in October 2013, it contained a sentence that has become one of the most quoted in the history of online privacy: "We will never be able to de-anonymize all Tor users all the time."
The agency with the largest intelligence budget in the world admitted, in its own secret document, that it could not break a network any student could use. At most it managed to pick out individual users - and not by breaking Tor, but by attacking what surrounded it. Another leaked document described a programme called EgotisticalGiraffe, which exploited flaws in the Firefox browser on which the Tor Browser bundle was based. The target was not Tor itself. The target was the browser the user opened pages with.
This is one of the most important lessons of the whole affair: well-designed cryptography works. What fails is everything around it - outdated software, a badly configured system, human habits. Snowden put it this way in June 2013, answering questions from Guardian readers: "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it."
What changed
Quite a lot. In 2015 the US Congress passed the USA Freedom Act, which ended the NSA's bulk collection of telephone metadata - from then on, the data was to stay with the operators. In 2020 a federal appeals court ruled that the programme Snowden exposed was most likely unlawful. In Europe, the Court of Justice of the EU twice struck down agreements on transferring data to the US, citing precisely the scale of American surveillance.
Technology changed too. Before 2013, most websites ran without encryption - today HTTPS is the standard. Messengers such as Signal encrypt conversations end to end, and Apple and Google introduced default encryption on phones. Laura Poitras's film "Citizenfour" won an Oscar in 2015. Many engineers later admitted that it was Snowden's documents that convinced their companies to invest in encryption.
Finally, Snowden himself changed - from whistleblower into one of the most listened-to voices on privacy. For years he has pointed to the tools he trusts himself: the Signal messenger, the Tor network, the Tails system he used when contacting journalists, and above all Qubes OS - a system created by the Polish researcher Joanna Rutkowska. "If you're serious about security, Qubes OS is the best OS available today. It's what I use, and free," he wrote. It is hard to imagine a stronger recommendation than one from a man who has seen up close what the NSA is capable of.
But not everything changed. Metadata is still being collected - by states and by companies. In many countries, including in the European Union, the idea of telecommunications data retention and scanning private correspondence keeps coming back. Phones send telemetry. Operating systems "phone home". Apps know your location better than you do. The difference is that since 2013, nobody can say they did not know.
Greenwald's lesson
Let us go back to the beginning. Snowden had access to the most secret systems in the world. He managed to take documents out of them, get through security checks and reach Hong Kong. And his biggest problem turned out to be a journalist who had not installed PGP.
Not because it was difficult. It simply seemed unnecessary. Greenwald had no reason at the time to think anyone was watching his e-mail. He did not feel threatened - so he saw no point in the effort. Until the day it turned out that whether the story would ever see the light of day depended on that one hour.
This is the most common mistake we see: security treated as something to deal with later, once a real threat appears. Except that by the time it appears, it is usually too late. The source will not write a second time. Leaked data will not come back. Intercepted conversations cannot be "un-heard".
Security does not begin at the moment you need it. It begins earlier. Or not at all.