The Snowden Disclosures

The Snowden Disclosures

What one contractor's USB drive contained.

---

A laptop on a hotel desk

Edward Joseph Snowden was born in June 1983 in Elizabeth City, North Carolina, into a family with a history of federal service — his father in the Coast Guard, his mother at the U.S. District Court in Baltimore. He dropped out of high school, completed a GED, washed out of an Army Reserve commitment after breaking both legs in basic training, and by 2006 had begun a series of contractor and full-time positions at the Central Intelligence Agency. By 2009 he had moved to private contracting — first Dell, then Booz Allen Hamilton — assigned to NSA facilities, eventually to the agency's Regional Cryptologic Center in Kunia, Hawaii.

What Snowden saw at Kunia, and what he had access to as a systems administrator inside the NSA's internal network, was at the time of collection the largest signals-intelligence operation in human history. He has said that the experience of watching the work, while also watching senior officials describe the work publicly in language he believed was false, decided him on becoming a leaker.

In late 2012 and early 2013, working from a workstation in Hawaii, Snowden assembled an archive of classified material. The exact size has never been definitively established — published estimates range from "tens of thousands" of documents (the figure Snowden himself has used) to "1.7 million" (the figure cited by the Department of Defense in a 2014 damage assessment), with much of the discrepancy turning on what counts as "taken" versus "touched."

On May 20, 2013, Snowden told his NSA supervisors he needed time off for treatment of his epilepsy. He flew from Honolulu to Hong Kong the same day. He had, by then, made contact via encrypted email with two journalists: Glenn Greenwald, a Guardian columnist living in Brazil, and Laura Poitras, an American documentary filmmaker based at the time in Berlin. He had also reached The Washington Post's Bart Gellman.

Hong Kong

Greenwald, Poitras, and The Guardian's Ewen MacAskill arrived in Hong Kong on June 2, 2013. Snowden met them at the Mira Hotel in Tsim Sha Tsui, on the Kowloon side of Victoria Harbour. They worked in a hotel room for nine days. Mobile phones were placed in a refrigerator to defeat ambient room-microphones. Snowden answered questions on the assumption that any of the meetings might be the last before his arrest.

The first story ran on Wednesday, June 5: Guardian reporting on a FISA Court order, dated April 25, 2013, that required Verizon to hand over to the NSA the metadata of all telephone calls in its system, including domestic calls, on a daily basis. The next day, The Washington Post and The Guardian both published the PRISM slide deck. The day after that, The Guardian added a graphical tool called Boundless Informant. On Sunday, June 9, Snowden's identity was revealed in a 12-minute interview filmed by Poitras and conducted by Greenwald — first published as a YouTube video by The Guardian and watched, in the next 24 hours, by hundreds of thousands of people.¹

Snowden left the Mira on June 10. On June 23 he boarded Aeroflot flight SU213 from Hong Kong to Sheremetyevo International Airport in Moscow, with onward connections planned through Havana to Quito. While he was airborne, the U.S. State Department revoked his passport. When the flight landed in Moscow, he could not legally proceed. He spent the next 39 days in the airport's transit zone.

On August 1, 2013, the Russian Federation granted him one year of temporary asylum, later extended, and finally — in September 2022 — Russian citizenship. The person who travelled with him from Hong Kong through the Sheremetyevo transit zone, and who stayed at his side for all 39 days, was WikiLeaks editor Sarah Harrison. She has not returned to the United Kingdom since.

What the documents described

The archive published over 2013–2014 described a system of signals intelligence operating at a scale the public discussion had not previously assumed. The major programs:

Section 215 bulk metadata. The legal authority cited in the Verizon order — Section 215 of the USA PATRIOT Act of 2001 — had been re-interpreted in secret by the FISA Court to authorize the daily collection of every American's domestic and international call metadata. The collection had been authorized continuously since 2006.

PRISM. A program of "downstream" collection in which the NSA obtained user data directly from major U.S. internet companies under FISA Section 702. The companies confirmed compliance with valid legal orders but disputed the slide deck's wording of "direct access" to their servers. The legal mechanism, however, was real.

Boundless Informant. An NSA-internal tool that produced country-by-country heatmaps of the agency's collection. The headline finding from the heatmap was that the NSA collected nearly 3 billion pieces of intelligence inside the United States in February 2013 alone, contrary to the agency's earlier statements about the proportion of its work directed at U.S. persons.

XKeyscore. Internally described by NSA training documents as "widest-reaching" of the agency's tools — a search interface that allowed analysts to query intercepted internet traffic by selector (email address, IP, target name) across the agency's collection.

MUSCULAR. A joint NSA–GCHQ program that tapped the unencrypted fiber-optic links between Google's and Yahoo's data centers, upstream of where the companies' end-user encryption ended. The disclosure prompted Google to immediately begin encrypting all inter-data-center traffic — a measurable post-disclosure change to internet infrastructure.

Bullrun. The agency's effort to undermine commercial encryption standards, in part by influencing NIST standard-setting and in part by buying or otherwise obtaining weaknesses in commercial cryptographic products. The disclosure recommissioned the U.S. cryptographic research community's relationship to NIST and contributed to the broader move toward end-to-end encryption that defined the rest of the decade.²

Other programs — Stellar Wind, Trailblazer, Pinwale, MARINA, MAINWAY — had operational lifetimes that overlapped with the disclosed era and were named in the published material. The cumulative effect was less "a particular operation went wrong" than "the architecture of post-9/11 surveillance is much larger than the public was previously told."

Clapper before the Senate

On March 12, 2013 — three months before the first Snowden story — Senator Ron Wyden of Oregon had asked Director of National Intelligence James Clapper, in a public Senate Intelligence Committee hearing, a question he had submitted in writing the day before:

"Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?"

Clapper answered: "No, sir." When Wyden gave him a second chance — "It does not?" — Clapper added: "Not wittingly. There are cases where they could inadvertently, perhaps, collect, but not wittingly."

Three months later, the Verizon order made the answer plainly incorrect. Wyden subsequently said he had submitted the question in advance specifically because he believed the truthful answer would contradict the public position of the intelligence community. Clapper later apologized in writing to the committee, saying his answer had been "clearly erroneous" and that he had momentarily "simply didn't think of" Section 215. The Department of Justice never pursued perjury charges. Clapper finished his term as DNI in January 2017.

That a senior intelligence official could give false testimony to Congress about a matter the senator already knew the answer to — and face no charges — became, in the Snowden literature, one of the disclosure's most quoted facts.

The reporting

The journalistic operation around the Snowden archive was complicated in ways unfamiliar to most prior leak reporting. There were three news organizations involved at the start — The Guardian, The Washington Post, and Laura Poitras (independent) — operating across multiple legal jurisdictions and dealing with documents that remained technically classified even as their contents became public. British authorities visited The Guardian's offices in July 2013 to oversee the physical destruction of newsroom hard drives that contained the source files (the paper retained copies abroad). David Miranda, Greenwald's partner, was detained at Heathrow on August 18, 2013 under counter-terrorism statutes and held for nine hours; his electronic devices were seized.

The documents continued to be reported on for years. Der Spiegel published material on the NSA's targeting of European officials, including Chancellor Angela Merkel, in October 2013 — a story that strained the U.S.-German intelligence relationship for the remainder of the Obama administration. The Intercept, founded by Greenwald, Poitras and Jeremy Scahill with Pierre Omidyar's funding in 2014, continued publishing from the archive into 2019.

The reporting won the 2014 Pulitzer Prize for Public Service jointly for The Guardian and The Washington Post. Poitras's documentary Citizenfour, built around the Hong Kong meetings, won the 2015 Academy Award for Best Documentary Feature.

What changed

The two largest concrete consequences of the disclosures, in American law, were:

The USA Freedom Act (2015). Passed by Congress in June 2015 with bipartisan majorities, the act ended the NSA's bulk collection of domestic phone metadata under Section 215. Telecom carriers retained the records; NSA queries required a specific selector and a court order. The structural shift was modest — but it was the first time since the 1978 FISA Act that Congress had voted to reduce, rather than expand, the executive's signals-intelligence authorities.

Industry encryption. The cumulative effect of the disclosures on private-sector engineering was much larger than the legal change. Within eighteen months of the MUSCULAR disclosure, Apple's iOS 8 encrypted user data by default in a way Apple could no longer unilaterally bypass. Google and Yahoo encrypted their inter-data-center fiber. WhatsApp deployed Signal protocol end-to-end encryption to 1 billion users by 2016. The Internet Engineering Task Force published RFC 7258 ("Pervasive Monitoring Is an Attack") in 2014 as official guidance to Internet protocol designers. The technical landscape of 2026 has incorporated, into its routine engineering assumptions, that a state-scale signals-intelligence actor is part of the threat model.

The intelligence cost has been claimed to be high; the public version of that claim is unfalsifiable. The Department of Defense damage assessment cited above was never published in unredacted form.

What proponents and critics still argue

The Snowden case has produced a quarter-century of disagreement that shows little sign of resolving. The arguments worth distinguishing:

Was Snowden a whistleblower or a leaker? A whistleblower, in U.S. legal usage, follows established channels for reporting wrongdoing. Snowden did not — he has argued, plausibly, that the channels did not exist for the kind of disclosure he was making, since the underlying programs were lawful under the executive's then-current interpretation of FISA. Whether that makes him a whistleblower in the spirit but not the letter of the law, or simply a leaker who chose a path he preferred, remains the central interpretive disagreement.

Did the disclosures harm or help national security? Both sides of this argument have evidence the other cannot rebut. Operations were certainly compromised; adversaries certainly changed behavior. At the same time, the disclosures produced industry encryption changes that have, on balance, hardened ordinary American communications against ordinary criminals and foreign intelligence services. The net sign of the change depends on how the evaluator weighs intelligence loss against private-sector hardening.

Russia. Snowden has consistently said the archive is no longer in his physical custody and that the Russian state has not accessed it. Most U.S. intelligence officials who have commented publicly do not accept that claim. The factual disagreement is, by its nature, not resolvable on public evidence.

How we read the evidence

The Snowden archive is the most thoroughly documented disclosure of state surveillance capability in modern history. The documents are real. The programs they describe operated as described. The legal authorities cited were the legal authorities used. Direction of National Intelligence Clapper did make a false statement under oath about the collection.

What the case cannot be cleanly classified as is either pure heroism or pure betrayal. The same individual exposed both a system that had exceeded democratic oversight and a set of operational capabilities that no informed person believes should not exist in some form. Reasonable people, looking at the same evidence, conclude differently about whether the public benefit outweighed the operational cost.

What the case does cleanly establish is the difference between what intelligence agencies are legally permitted to do and what they are doing, in an era where the legal authorities are increasingly secret and the technical capabilities expand faster than the political processes that supervise them.

Key figures

---

Further reading

Books:

• Glenn Greenwald, No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State (Metropolitan, 2014).
• Barton Gellman, Dark Mirror: Edward Snowden and the American Surveillance State (Penguin Press, 2020).
• Edward Snowden, Permanent Record (Metropolitan, 2019).
• Luke Harding, The Snowden Files (Vintage, 2014).

Films and documentaries:

• Citizenfour (2014, dir. Laura Poitras). Built around the Hong Kong meetings.
• Snowden (2016, dir. Oliver Stone). Dramatization.

Primary archives:

• Snowden Surveillance Archive — CJFE
• The Intercept's coverage
• The Guardian's NSA Files
• EFF: NSA Spying

---

Sources

Primary sources

1. U.S. Foreign Intelligence Surveillance Court. Verizon Business Network Services FISA Order, BR 13-80, April 25, 2013. Declassified June 5, 2013.
2. NSA documents from the Snowden archive. PRISM, XKeyscore, Boundless Informant, MUSCULAR, Bullrun slide decks and internal training materials, published in The Guardian, The Washington Post, Der Spiegel, The Intercept, 2013–2019.
3. U.S. Senate Intelligence Committee. Transcript of hearing, March 12, 2013 (Clapper testimony).
4. President's Review Group on Intelligence and Communications Technologies. Liberty and Security in a Changing World, December 12, 2013 (the "Five Eyes" review group report).

Secondary sources

5. Greenwald, G., MacAskill, E. (2013). "NSA collecting phone records of millions of Verizon customers daily." The Guardian, June 6, 2013.
6. Gellman, B., Poitras, L. (2013). "U.S., British intelligence mining data from nine U.S. Internet companies in broad secret program." The Washington Post, June 6, 2013.
7. Gellman, B. (2020). Dark Mirror: Edward Snowden and the American Surveillance State. Penguin Press.
8. Greenwald, G. (2014). No Place to Hide. Metropolitan Books.
9. Harding, L. (2014). The Snowden Files. Vintage.
10. Poitras, L. (dir.) (2014). Citizenfour [Documentary]. Praxis Films.
11. Schneier, B. (2015). Data and Goliath. W. W. Norton.
12. Bamford, J. (2014). "The Most Wanted Man in the World." Wired, August 13, 2014.
13. Aftergood, S. (2013–2018). Federation of American Scientists, Secrecy News archive.
14. Der Spiegel, October 2013 — Merkel phone tap reporting.

Academic sources

15. Bellovin, S. M., Blaze, M., Clark, S., Landau, S. (2014). "Going Bright: Wiretapping without Weakening Communications Infrastructure." IEEE Security & Privacy, 12(1), 62–72.
16. Lyon, D. (2015). Surveillance after Snowden. Polity Press.

---

Corrections & updates

(None yet.)

Footnotes

1. Glenn Greenwald and Ewen MacAskill, "NSA collecting phone records of millions of Verizon customers daily," The Guardian, June 6, 2013; Greenwald, MacAskill, and Laura Poitras, "Edward Snowden: the whistleblower behind the NSA surveillance revelations," The Guardian, June 11, 2013. The video interview is archived at The Guardian. ↩

2. NSA documents from the Snowden archive have been indexed by the American Civil Liberties Union and the Intercept. The most comprehensive primary source archive is at the Snowden Surveillance Archive, maintained by the Canadian Journalists for Free Expression. ↩