Permanent Record (Young Readers Edition)

EIGHTEEN ^Heartbeat

Imagine you’re entering a tunnel. As you look down the length that stretches ahead of you, notice how the walls seem to narrow to the tiny dot of light at the other end.

My tunnel was a literal tunnel: an enormous Pearl Harbor–era airplane factory turned NSA facility located under a pineapple field in Kunia, on the island of Oahu, Hawaii. Its official name was the Kunia Regional Security Operations Center.

Lindsay and I had come to Hawaii to start over. To start over yet again.

My doctors had told me that the climate and more relaxed lifestyle in Hawaii might be beneficial for my epilepsy, since lack of sleep was thought to be the leading trigger of the seizures. Also, the move eliminated the driving problem—Maryland law prevented people diagnosed with epilepsy from driving, but Hawaiian law did not. Besides, the tunnel was a pleasant, twenty-minute bike ride to work through sugarcane fields in brilliant sunshine.

I went to work for the NSA early in 2012. The job I’d taken was a significant step down the career ladder, with duties I could at this point perform in my sleep. It was supposed to mean less stress, a lighter burden. I spent the earliest days automating my tasks—writing scripts to do my work for me—so as to free up my time for something more interesting.

Before I go any further, I want to emphasize this: My active searching out of NSA abuses began not with the copying of documents, but with the reading of them. My initial intention was just to confirm the suspicions that I’d first had back in 2009 in Tokyo. Three years later, I was determined to find out if an American system of mass surveillance existed and, if it did, how it functioned. Though I was uncertain about how to conduct this investigation, I was at least sure of this: I had to understand exactly how the system worked before I could decide what, if anything, to do about it.

I wanted to know what the NSA’s surveillance capabilities were exactly, whether and how they extended beyond the agency’s actual surveillance activities, who approved them, who knew about them, and, last but surely not least, how these systems—both technical and institutional—really operated.

Sometimes I’d find a program with a recognizable name but without an explanation of what it did. Other times I’d just find a nameless explanation, with no indication as to whether the capability it described was an active program or an aspirational desire. I was running up against programs within programs. This was the nature of the NSA—by design, the left hand rarely knew what the right hand was doing.

I’m not saying that I made any decisions at that instant. The most important decisions in life are never made that way. They’re made only once you’re finally strong enough to admit to yourself that this is what your conscience has already chosen for you, this is the course that your beliefs have decreed. That was my twenty-ninth birthday present to myself: the awareness that I had entered a tunnel that would narrow my life down toward a single, still-indistinct act.

I got in the regular habit of perusing what the NSA called “readboards.” These are digital bulletin boards that function something like news blogs, featuring the day’s most important and interesting documents—everything an employee has to read to keep current.

My new, low-pressure position gave me as much time to read as I wanted. The scope of my curiosity might have raised a few questions at a prior stage of my career, but now I was the only employee of the Office of Information Sharing. I was the Office of Information Sharing. So my very job was to know what sharable information was out there.

In the hopes of organizing all the documents I wanted to read, I put together a best-of-the-readboards queue. The files quickly began to pile up, until the nice lady who managed the digital storage quotas complained to me about the folder size. Not wanting to erase it or stop adding to it, I decided instead to share it with others. This was the best justification for what I was doing that I could think of, especially because it allowed me to more or less legitimately collect material from a wider range of sources. So, with my boss’s approval, I set about creating an automated readboard—one that edited itself.

Like EPICSHELTER, my automated readboard platform was designed to perpetually scan for new and unique documents in the networks of the NSA, the CIA, and the FBI, as well as others. The idea was that its findings would be made available to every NSA officer. Essentially, it would be a readboard of readboards. It would be run from a server that I alone managed, located just down the hall from me. That server would also store a copy of every document it sourced, making it easy for me to perform the kind of deep interagency searches that the heads of most agencies could only dream of.

I called this system Heartbeat, because it took the pulse of the NSA and of the wider IC. It pulled so many more documents than any human ever could that it immediately became the NSAnet’s most comprehensive readboard.

Early on in its operation I got an email that almost stopped Heartbeat forever. A faraway administrator—apparently the only one in the entire IC who actually bothered to look at his access logs—wanted to know why a system in Hawaii was copying, one by one, every record in his database. He had immediately blocked me, which effectively locked me out, and was demanding an explanation. I told him what I was doing and showed him how to use the internal website that would let him read Heartbeat for himself. Once I gave him access, his wariness instantly turned into curiosity. He could now see that Heartbeat was just doing what it’d been meant to do and was doing it perfectly. He was fascinated. He unblocked me from his repository of records and even offered to help me by circulating information about Heartbeat to his colleagues.

Nearly all of the secret documents that I later disclosed to journalists came to me through Heartbeat. It showed me not just the aims but the abilities of the IC’s mass surveillance system. This is something I want to emphasize: In mid-2012, I was just trying to get a handle on how mass surveillance actually worked. The better you can understand a program’s mechanics, the better you can understand its potential for abuse.

This meant that I wasn’t much interested in the briefing materials—like, for example, what has become perhaps the best-known file I disclosed. It was a slide deck from a 2011 PowerPoint presentation that explained the NSA’s new surveillance approach: “Sniff It All, Know It All, Collect It All, Process It All, Exploit It All, Partner It All.” This was just marketing jargon intended to impress America’s allies: Australia, Canada, New Zealand, and the UK, the primary countries with which the United States shares intelligence. Together with the United States, these countries are known as the Five Eyes.

“Sniff It All” meant finding a data source; “Know It All” meant finding out what that data was; “Collect It All” meant capturing that data; “Process It All” meant analyzing that data for usable intelligence; “Exploit It All” meant using that intelligence to further the agency’s aims; and “Partner It All” meant sharing the new data source with allies. But this document gave me no insight into how the approach was realized technologically.

Much more revealing was a top secret legal demand I found for a private company to turn over its customers’ private information to the federal government. The order made it clear that the NSA had secretly interpreted part of the Patriot Act to mean it could collect all of the metadata coming through American telecoms such as Verizon and AT&T on “an ongoing daily basis.” This included, of course, records of telephone communications between American citizens. That was unconstitutional.

I also found evidence of the NSA using other laws to justify its two most prominent internet surveillance methods: the PRISM program and upstream collection. PRISM enabled the NSA to routinely collect data from Microsoft, Yahoo!, Google, Facebook, and more, including email, photos, video and audio chats, Web-browsing content, search engine queries, and all other data stored on their clouds. Upstream collection, meanwhile, enabled direct collection of data from internet infrastructure—the switches and routers that shunt internet traffic worldwide. Together, PRISM and upstream collection ensured that the world’s information, both stored and in transit, was surveillable.

The next stage of my investigation was to figure out how this collection was actually accomplished. As I came to realize, the tools behind upstream collection are the most invasive elements of the NSA’s mass surveillance system.

Imagine sitting at a computer, about to visit a website. You open a Web browser, type in a URL, and hit enter. The URL is, in effect, a request, and this request goes out in search of its destination server. Before your request gets to that server, though, it will have to pass through one of the NSA’s most powerful weapons.

Specifically, your request passes through a few black servers. These servers contain two critical tools. One handles making copies of the data coming through. The second is in charge of “active collection.”

If the NSA finds any suspicious metadata—a particular email address, credit card, or phone number, or just certain keywords such as protest—then your request is diverted to the NSA’s servers. There, algorithms decide which of the agency’s digital weapons—malware programs—to use against you. Then the malware is delivered to you along with whatever website you requested. The end result: You get all the content you want, along with all the surveillance you don’t. It all happens in less than 686 milliseconds. Completely unbeknownst to you. Now the NSA can access not just your metadata, but your data as well. Your entire digital life belongs to them.

NINETEEN ^{Whistleblowing}

The NSA’s surveillance programs, its domestic surveillance programs in particular, flouted the Constitution’s Fourth Amendment—the one that protects us from unreasonable search and seizure—completely. The agency was essentially making a claim that the amendment’s protections didn’t apply to modern-day lives. The agency’s internal policies neither regarded your data as your legally protected personal property nor regarded their collection of that data as a “search” or “seizure.” Instead, the NSA maintained that because you had already “shared” your phone records with a “third party”—your telephone service provider—you had forfeited any constitutional privacy interest you may once have had. And it insisted that “search” and “seizure” occurred only when its analysts, not its algorithms, actively queried what had already been automatically collected.

This extremist interpretation of the Fourth Amendment—effectively, that the very act of using modern technologies means surrendering your privacy rights—would have been rejected by Congress and the courts if constitutional oversight mechanisms had been functioning properly. But when it came to protecting the privacy of American citizens in the digital age, each of the three branches of US government failed in its own way, causing the entire system to halt and catch fire. The executive branch was the primary cause of this constitutional breach. The president’s office had secretly authorized mass surveillance in the wake of 9/11.

It was time to face the fact that the IC believed themselves above the law, and given how broken the process was, they were right. The IC had come to understand the rules of our system better than the people who had created it, and they used that knowledge to their advantage.

They’d hacked the Constitution.

America was born from an act of treason. The Declaration of Independence was an outrageous violation of the laws of England and yet the fullest expression of what the Founders called the “Laws of Nature,” which included the right to rebel on point of principle. America’s first whistleblower protection law was enacted on July 30, 1778. This law declared it “the duty of all persons in the service of the United States, as well as all other inhabitants thereof, to give the earliest information to Congress or any other proper authority of any misconduct, frauds, or misdemeanors committed by any officers or persons in the service of these states, which may come to their knowledge.”

The law gave me hope—and it still does. Even at the darkest hour of the Revolution, with the very existence of the country at stake, Congress didn’t just welcome an act of principled dissent, it enshrined such acts as duties. By the latter half of 2012, I was resolved to perform this duty myself. In my case, going up “the chain of command,” which the IC prefers to call “the proper channels,” wasn’t an option. My superiors were not only aware of what the agency was doing, they were actively directing it—they were complicit.

Coming from a Coast Guard family, I’ve always been fascinated by how much of the English language vocabulary of disclosure has a nautical undercurrent. Organizations, like ships, sprang leaks. When steam replaced wind for propulsion, whistles were blown at sea to signal intentions and emergencies: one whistle to pass by port, two whistles to pass by starboard, five for a warning.

Ultimately, every language, including English, demonstrates its culture’s relationship to power by how it chooses to define the act of disclosure. When an institution decries “a leak,” it is implying that the “leaker” damaged or sabotaged something.

Today, leaking and whistleblowing are often treated as interchangeable. But to my mind, the term leaking should be used differently than it commonly is. It should be used to describe acts of disclosure done not out of public interest but out of self-interest. To be more precise, I understand a leak as the selective release of protected information in order to sway popular opinion or affect the course of decision making. The US government has forgiven “unauthorized” leaks when they’ve resulted in unexpected benefits and forgotten “authorized” leaks when they’ve caused harm.

A whistleblower, in my definition, is a person who, through hard experience, has concluded that their life inside an institution has become incompatible with the principles developed in the greater society outside it, to which that institution should be accountable. This person knows that they can’t remain inside the institution and knows that the institution can’t or won’t be dismantled. Reforming the institution might be possible, however, so they blow the whistle and disclose the information to bring public pressure to bear.

My situation had one crucial addition: All the information I intended to disclose was classified top secret. To blow the whistle on secret programs, I’d also have to blow the whistle on the larger system of secrecy. Without bringing to light the full scope of this systemic secrecy, there would be no hope of restoring a balance of power between citizens and their government. Restoration is an essential motive of whistleblowing: The disclosure is not a radical act of dissent or resistance, but a return—signaling the ship to sail back to port.

I was resolved to bring to light a single, all-encompassing fact: that my government had developed and deployed a global system of mass surveillance without the knowledge or consent of its citizenry. The only response appropriate to the scale of the crime was a total exposure of the total apparatus of mass surveillance—not by me, but by the media, protected by the Bill of Rights.

Technologists seeking to report on the misuse of technology must do more than just bring their findings to the public. They have a duty to contextualize and explain—to demystify. A few dozen or so of the people best positioned to do this in the whole entire world were sitting all around me in the Tunnel. My fellow technologists came in every day and sat at their terminals and furthered the work of the state. They weren’t merely oblivious to its abuses but incurious about them, and that lack of curiosity made them not evil but tragic. It didn’t matter why they’d come to the IC: Once they’d gotten inside the machine, they became machines themselves.

TWENTY ^{Fourth Estate}

Nothing is harder than living with a secret that can’t be spoken. Lying to strangers about a cover identity or concealing the fact that your office is under the world’s most top secret pineapple field might sound like it qualifies, but at least you’re part of a team: Though your work may be secret, it’s a shared secret, and therefore a shared burden. There is misery but also laughter.

When you have a real secret, though, that you can’t share with anyone, even the laughter is a lie. I could talk about my concerns, but never about where they were leading me. To the day I die I’ll remember explaining to my colleagues how our work was being applied to violate the oaths we had sworn to uphold, and their response: “What can you do about it?”

I hated that question, its sense of resignation, its sense of defeat, but it still felt valid enough that I had to ask myself, Well, what?

When the answer presented itself, I decided to become a whistleblower. Yet to breathe to Lindsay, the love of my life, even a word about that decision would have put our relationship to an even crueler test than saying nothing. Not wishing to cause her any more harm than I was already resigned to causing, I kept silent, and in my silence I was alone.

I thought that solitude and isolation would be easy for me. Hadn’t each step of my life served as a kind of preparation? Hadn’t I gotten used to being alone after all those years spent in front of a screen? But I was human, too, and the lack of companionship was hard. I had everything I’d ever wanted—love, family, and success far beyond what I ever deserved. The easiest thing should have been to follow the rules.

And even if I was already reconciled to my decision—to risk everything to expose the truth—and the dangers that came with it, I wasn’t yet adjusted to the role. After all, who was I to put this information in front of the American public? Who’d elected me the president of secrets?

The information I intended to disclose about my country’s secret regime of mass surveillance was so explosive, and yet so technical, that I was as scared of being doubted as I was of being misunderstood. That was why my first decision, after resolving to go public, was to go public with the agency’s actual files—as many as necessary to expose the scope of the abuse, though I knew that disclosing even one PDF would be enough to earn me prison.

It was clear to me that some person or institution had to vouch for the documents. Cooperating with some type of media organization would defend me against the worst accusations of rogue activity and correct for whatever biases I had. I didn’t want any political opinion of mine to prejudice anything.

Lindsay had spent years patiently instilling in me the lesson that my interests and concerns weren’t always hers. That just because I shared my knowledge didn’t mean that anyone had to share my opinion. Not everybody who was opposed to invasions of privacy might be ready to drop off the internet entirely. Lindsay was my key to unlocking this truth—that diverse motives and approaches can only improve the chances of achieving common goals. She, without even knowing it, gave me the confidence to reach out to other people.

But which people? Who? I knew that the story the NSA documents told about a global system of mass surveillance deployed in the deepest secrecy was a difficult one to understand. It was a story so tangled and technical that I was increasingly convinced it could not be presented all at once in a “document dump.” Journalists, preferably from multiple independent press institutions, needed to carefully and patiently review everything.

I knew at least two things about the members of the press: They competed for scoops, and they knew very little about technology. It was this lack of expertise or even interest in tech that largely caused journalists to miss two events that had stunned me during the course of my fact gathering about mass surveillance.

The first was the NSA’s announcement of the construction of a vast new data facility in Bluffdale, Utah. The facility was projected to contain a total of four twenty-five-thousand-square-foot halls, filled with servers. It could hold an immense amount of data. The only prominent journalist who seemed to notice the announcement was James Bamford, who wrote about it for Wired in March 2012. But no one asked what, to me, were the most basic questions: Why does any government agency, let alone an intelligence agency, need that much space? What data, and how much of it, do they really intend to store there, and for how long? Because there was simply no reason to build something like that unless you were planning on storing absolutely everything, forever.

The second event happened one year later, in March 2013—no so-called mainstream publication covered a rare public appearance by Ira “Gus” Hunt, the chief technology officer of the CIA. The CIA had finally decided to sign a ten-year, 600-million-dollar cloud development and management deal with Amazon. So I made sure to catch Gus’s appearance, because I was curious whether he might offer any insight into why Amazon had been chosen.

I got insight, certainly, but of an unexpected kind. I had the opportunity to witness the highest-ranking technical officer at the CIA brief a crowd about the agency’s ambitions and capacities.

“At the CIA,” he said, “we fundamentally try to collect everything and hang on to it forever.” As if that wasn’t clear enough, he went on: “It is nearly within our grasp to compute on all human generated information.” The underline was Gus’s own.

Gus would later explain to the journalists in the room that the agency could track their smartphones, even when they were turned off—that the agency could surveil every single one of their communications. He said, “Technology… is moving faster than government or law can keep up. It’s moving faster… than you can keep up: You should be asking the question of what are your rights and who owns your data.”

The lesson I took from this was that for my disclosures to be effective, I had to do more than just hand some journalists some documents. I had to become their partner, to provide the technological training and tools to help them do their reporting accurately and safely. That would mean committing one of the capital crimes of intelligence work: I would be aiding and abetting an act of journalism. American law makes no distinction between providing classified information to the press in the public interest and providing it, even selling it, to the enemy.

Given the risks I was taking, I needed to identify people I could trust who were also trusted by the public. Above all, I had to be sure that whoever I picked wouldn’t ultimately cave to power when put under pressure.

One journalist, one publication, even one country of publication wouldn’t be enough. Ideally, I’d give each journalist their own set of documents simultaneously, leaving me with none. This would shift the focus of scrutiny to them and ensure that even if I were arrested, the truth would still get out.

As I narrowed down my list of potential partners, I realized my best options would be journalists whom the national security state had already targeted.

Laura Poitras I knew as a documentarian, primarily concerned with America’s post-9/11 foreign policy. She had been frequently harassed by the government because of her work, repeatedly detained and interrogated by border agents whenever she traveled in or out of the country.

Glenn Greenwald I knew as a columnist for the US edition of the British Guardian newspaper. I liked him because he was skeptical and argumentative. Ewen MacAskill of the British edition of the Guardian and Bart Gellman of the Washington Post would also later prove steadfast partners (and patient guides to the journalistic wilderness).

The only hitch was getting in touch.

Unable to reveal my true name, I contacted the journalists under a variety of identities. The first of these was Cincinnatus, after a legendary farmer who became a Roman consul and then voluntarily relinquished his power. The final name I used was Verax, Latin for “speaker of truth.”

You can’t really appreciate how hard it is to stay anonymous online until you’ve tried to operate as if your life depended on it. To communicate with the journalists, I decided to use somebody else’s internet connection. I wish that were simply a matter of going to a McDonald’s or Starbucks and signing on to their Wi-Fi. But those places have security cameras and receipts and other people. Moreover, every wireless device, from a phone to a laptop, has a globally unique identifier called a MAC (Machine Address Code), which it leaves on record with every access point it connects to.

So I didn’t go to McDonald’s or Starbucks—I went driving. A high-powered antenna, a magnetic GPS sensor, and a laptop allowed me to turn my car into a roving Wi-Fi sensor.

At nights and on weekends, I drove around what seemed like the entire island of Oahu, letting my antenna pick up the pulses of each Wi-Fi network. My GPS sensor tagged each access point. What resulted was a map of the invisible networks we pass by every day without even noticing.

With this network map in hand, I’d drive around Oahu like a madman, trying to check my email to see which of the journalists had replied. Some of the journalists I’d chosen needed convincing to use a more secure method of communication known as encrypted email, which back in 2012 was a pain. In some cases, I had to show them how, so I’d upload tutorials.

Atop the parking garage of a mall, secure in the knowledge that the moment I closed the lid of my laptop, my secret was safe, I’d draft manifestos explaining why I’d gone public, but then delete them. And then I’d try writing emails to Lindsay, only to delete them, too. I just couldn’t find the words.

TWENTY-ONE ^{Read, Write, Execute}

Read, write, execute: In computing, these are called permissions. The right to read a file allows you to access its contents, while the right to write a file allows you to modify it. Execution, meanwhile, means that you have the ability to run a file or program, to carry out the actions it was designed to do.

Read, write, execute: This was my simple three-step plan. I wanted to burrow into the heart of the world’s most secure network to find the truth, make a copy of it, and get it out into the world. And I had to do all this without getting caught—without being read, written, and executed myself.

Almost everything you do on a computer, on any device, leaves a record. Nowhere is this more true than at the NSA. Each log-in and log-out creates a log entry. Each permission I used left its own forensic trace. Every time I opened a file, every time I copied a file, that action was recorded. Every time I downloaded, moved, or deleted a file, that was recorded, too.

I used Heartbeat to compile the documents I wanted. The agency’s security tools kept track of who read what, but it didn’t matter: Anyone who bothered to check their logs was used to seeing Heartbeat by now. It would sound no alarms. It was the perfect cover.

While Heartbeat would work as a way of collecting the files—far too many files—it only brought them to the server in Hawaii, a server that kept logs even I couldn’t get around. I needed a way to work with the files so I could discard the irrelevant and uninteresting, along with those containing legitimate secrets that I wouldn’t be giving to journalists. But if I ran my searches on the Heartbeat server, it would light a massive electronic sign blinking ARREST ME.

I thought about this for a while. I couldn’t just copy the files directly from the Heartbeat server onto a personal storage device and waltz out of the Tunnel without being caught. What I could do, though, was bring the files closer, directing them to an intermediate way station.

In a forgotten corner of the office was a pyramid of disused desktop computers that the agency had wiped clean and discarded. They were Dell PCs from 2009 or 2010, large gray rectangles that could store and process data on their own without being connected to the cloud. Though they were still in the NSA system, they couldn’t really be closely tracked as long as I kept them off the central networks.

I could easily justify needing to use these stolid, reliable boxes by claiming that I was trying to make sure Heartbeat worked with older operating systems. Under the guise of compatibility testing, I could transfer the files to these old computers, where I could search, filter, and organize them as much as I wanted, as long as I was careful. I was carrying one of the big old hulks back to my desk when I passed one of the IT directors, who stopped me and asked me what I needed it for.

“Stealing secrets,” I answered, and we laughed.

The first phase of my three-step plan ended with the files I wanted all neatly organized into folders. But they were still on a computer that wasn’t mine, which was still in the Tunnel underground. Enter, then, the write phase, which for my purposes meant the agonizingly slow, scary process of copying the files onto something that I could spirit out of the building.

The easiest and safest way to copy a file off any IC workstation is also the oldest: a camera. Smartphones, of course, are banned in NSA buildings, but workers accidentally bring them in all the time without anyone noticing. They leave them in their gym bags or in the pockets of their windbreakers. But getting a smartphone loaded with NSA secrets out of the Tunnel is risky. Odds are that nobody would’ve noticed—or cared—if I walked out with a smartphone, and it might have been an adequate tool for trying to copy a single report. But I wasn’t wild about the idea of taking thousands of pictures of my computer screen in the middle of a top secret facility. Also, the phone would have to be configured in such a way that even the world’s foremost forensic experts could seize and search it without finding anything on it that they shouldn’t.

I’m going to refrain from publishing how exactly I went about my own copying and encryption (a means of securing files, which I’ll explain in greater detail later on)—so that the NSA will still be standing tomorrow. I will mention, however, what storage technology I used for the copied files. Forget thumb drives; they’re too bulky for the relatively small amount they store. I went, instead, for SD cards—the acronym stands for Secure Digital. Actually, I went for the mini- and micro-SD cards.

You’ll recognize SD cards if you’ve ever used a digital camera or video camera, or needed more storage on a tablet. They’re tiny little buggers, basically the size of your pinkie fingernail—eminently concealable. You can fit one inside the pried-off square of a Rubik’s Cube, then stick the square back on, and nobody will notice. In other attempts, I carried a card in my sock or, at my most paranoid, in my cheek, so I could swallow it if I had to. Eventually, as I gained confidence, and certainty in my methods of encryption, I’d just keep a card at the bottom of my pocket. They hardly ever triggered metal detectors, and who wouldn’t believe I’d simply forgotten something so small?

The size of SD cards, however, has one downside: They’re extremely slow. Copying times for massive volumes of data are always long—at least always longer than you want. And the duration stretches even more when you’re copying to a minuscule silicon wafer embedded in plastic. Also, I wasn’t just copying. I was deduplicating, compressing, and encrypting, none of which could be accomplished simultaneously. I was using all the skills I’d ever acquired in my storage work, making an off-site backup of evidence of the IC’s abuses.

It could take eight hours or more—entire shifts—to fill a card. And though I switched to working nights again, those hours were terrifying. There was the old computer chugging, monitor off. And there I was, turning the monitor back on every once in a while to check the rate of progress and cringing. You know the feeling—following the completion bar as it indicates 84 percent completed, 85 percent completed… 1:58:53 left… As it filled toward the sweet relief of 100 percent, all files copied, I’d be sweating, seeing shadows and hearing footsteps around every corner.

Execute: That was the third and final step. As each card filled, I had to run my getaway routine. I had to get them out of the building, past the bosses and military uniforms, down the stairs and out the empty hall, past the badge scans and armed guards and two-doored security zones in which the next door doesn’t open until the previous door shuts. And if anything goes awry, the guards draw their weapons and the doors lock you in and you say, Well, isn’t this embarrassing? This—per all the reports I’d been studying, and all the nightmares I’d been having—was where they’d catch me; I was sure of it. Each time I left, I was petrified. I’d have to force myself not to think about the SD card. When you think about it, you act differently, suspiciously.

One unexpected upshot of gaining a better understanding of NSA surveillance was that I’d also gained a better understanding of the dangers I faced. In other words, learning about the agency’s systems had taught me how not to get caught by them. The FBI—the agency that investigates all crime within the IC—took great pride in explaining exactly how they caught their suspects, and believe me, I didn’t mind benefiting from their experience. It seemed that in almost every case, the FBI would wait to make its arrest until the suspect had finished their work and was about to go home. Sometimes they would let the suspect take the material out into public, where its very presence was a federal crime. I kept imagining a team of FBI agents lying in wait for me—there, out in the public light, just at the far end of the Tunnel.

I’d usually try to banter with the guards, and this was where my Rubik’s Cube came in most handy. I was known to the guards and to everybody else at the Tunnel as the Rubik’s Cube guy, because I was always working the cube as I walked down the halls. I got so adept I could even solve it one-handed. It became a distraction device as much for myself as for my coworkers. Most of them thought it was an affectation, or a nerdy conversation starter. And it was, but primarily it relieved my anxiety. It calmed me.

I bought a few cubes and handed them out. Anyone who took to it, I’d give them pointers. The more that people got used to them, the less they’d ever want a closer look at mine.

I got along with the guards, or I told myself I did, mostly because I knew where their minds were: elsewhere. I’d done something like their job before, back at CASL. I knew how mind-numbing it was to spend all night standing, feigning vigilance. Your feet hurt. After a while, all the rest of you hurts. And you can get so lonely that you’ll talk to a wall.

I aimed to be more entertaining than the wall. There was the one guard I talked to about insomnia and the difficulties of day-sleeping (remember, I was on nights, so this would’ve been around two in the morning). Another guy, we discussed politics. What they all had in common was a reaction to my Rubik’s Cube: It made them smile. Over the course of my employment at the Tunnel, pretty much all the guards said some variation of, “Oh man, I used to play with that when I was a kid,” and then, invariably, “I tried to take the stickers off to solve it.” Me too, buddy. Me too.

It was only once I got home that I was able to relax, even just slightly. I was still worried about the house being wired—that was another one of those charming methods the FBI used against those it suspected of inadequate loyalty. Lindsay would go to bed, and I’d go to the couch, hiding with my laptop under a blanket because cotton beats cameras. With the threat of immediate arrest out of the way, I could focus on transferring the files to a larger external storage device via my laptop—only somebody who didn’t understand technology very well would think I’d keep them on the laptop forever. Then I’d lock them down under multiple layers of encryption algorithms using differing implementations, so that even if one failed the others would keep them safe.

I’d been careful not to leave any traces at my work and to make sure my encryption left no traces of the documents at home. Still, I knew the documents could lead back to me once I’d sent them to the journalists and they’d been decrypted. Any investigator looking at which agency employees had accessed, or could access, all these materials would come up with a list with probably only a single name on it: mine. The fact was that every individual file left me vulnerable, because all digital files contain metadata, invisible tags that can be used to identify their origins.

I struggled with how to handle this metadata situation. I worried that if I didn’t strip the identifying information from the documents, they might incriminate me the moment the journalists decrypted and opened them. But I also worried that by thoroughly stripping the metadata, I risked altering the files. And if they were changed in any way, that could cast doubt on their authenticity. Which was more important: personal safety, or the public good? It might sound like an easy choice, but it took me quite a while before I owned the risk and left the metadata intact.

I was forced, for the first time, to confront the prospect of discarding my lifetime practice of anonymity and coming forward to identify myself as the source. I would embrace my principles by signing my name to them and let myself be condemned.

Altogether, the documents I selected fit on a single drive, which I left out in the open on my desk at home. I knew that the materials were just as secure now as they had ever been at the office. Actually, they were more secure, thanks to the multiple levels and methods of encryption. That’s the incomparable beauty of the cryptological art, the basis of encryption. A little bit of math can accomplish what all the guns and barbed wire can’t; a little bit of math can keep a secret.

TWENTY-TWO ^Encrypt

Most people who use computers think there’s a fourth basic permission besides read, write, and execute called delete.

Delete is everywhere on the user side of computing. It’s in the hardware as a key on the keyboard, and it’s in the software as an option that can be chosen from a drop-down menu. There’s a certain finality that comes with choosing delete, and a certain sense of responsibility. Sometimes a box even pops up to double-check: Are you sure? If the computer is second-guessing you by requiring confirmation—click Yes—it makes sense that delete would be a major decision.

Delete functions appeared from the very start of digital computing. Engineers understood that some choices would inevitably turn out to be mistakes. Users, regardless of whether or not they were really in control at the technical level, had to feel in control. If they made a file, they should be able to unmake it at will. The ability to destroy what they created and start over afresh imparted a sense of agency to the user.

Think about the reasons that you yourself press delete. On your personal computer, you might want to get rid of some document or some file you downloaded but no longer need—or some file you don’t want anyone to know you ever needed. On your phone, you might delete some of the pictures, videos, and private records it automatically uploaded to the cloud. In every instance, you delete, and the thing—the file—appears to be gone.

The truth, though, is that deletion has never existed technologically in the way that we conceive of it. Deletion is a figment, a public fiction, a lie that computing tells you to reassure you and give you comfort. Although the deleted file disappears from view, it is rarely gone. In technical terms, deletion is really just a form of the middle permission, a kind of write. Normally, when you press delete for one of your files, its data—which has been stashed deep down on a disk somewhere—is not actually touched. Instead, only the computer’s map of where each file is stored is rewritten to say I’m no longer using this space for anything important. The supposedly erased file can still be read by anyone who looks hard enough for it.

This can be confirmed through experience, actually. Next time you copy a file, ask yourself why it takes so long compared with the instantaneous act of deletion. The answer is that deletion doesn’t really do anything to a file besides conceal it. Put simply, computers were not designed to correct mistakes, but to hide them—and to hide them only from those parties who don’t know where to look.

The waning days of 2012 brought grim news: The governments of both Australia and the UK were proposing legislation for the mandatory recording of telephone and internet metadata. This was the first time that democratic governments publicly confirmed the ambition to establish a sort of surveillance time machine. Though these laws were justified as public safety measures, they represented a breathtaking intrusion into the daily lives of the innocent.

These public initiatives of mass surveillance proved, once and for all, that there could be no natural alliance between technology and government. The rift between my two strangely interrelated communities, the American IC and the global online tribe of technologists, became pretty much definitive. For years I had been able to fool myself that we were all, ultimately, on the same side of history: We were all trying to protect the internet, to keep it free for speech and free of fear. But now the government, my employer, was definitively the adversary. What my technologist peers had always suspected, I’d only recently confirmed, and I couldn’t tell them. Or I couldn’t tell them yet.

What I could do, however, was help them out. This was how I found myself in Honolulu as one of the hosts and teachers of a CryptoParty. This was a new type of gathering where technologists volunteered their time to teach free classes to the public on the topic of digital self-defense—essentially, showing anyone who was interested how to protect the security of their communications. I jumped at the chance to participate.

Though this might strike you as a dangerous thing for me to have done, given the other activities I was involved with at the time, it should instead just reaffirm how much faith I had in the encryption methods I taught. These were the very methods that protected that drive full of IC abuses sitting back at my house, with locks that couldn’t be cracked even by the NSA. I knew that no number of documents, and no amount of journalism, would ever be enough to address the threat the world was facing. People needed tools to protect themselves, and they needed to know how to use them. Given that I was also trying to provide these tools to journalists, I was worried that my approach had become too technical. After so many sessions spent lecturing colleagues, this opportunity to simplify my subject for a general audience would benefit me as much as anyone. Also, I honestly missed teaching, which I had done often in years prior: It had been a year since I’d stood at the front of a class, and the moment I was back in that position, I realized I’d been teaching the right things to the wrong people all along.

The CryptoParty was held in a one-room art gallery behind a furniture store and coworking space. While I was setting up the projector so I could share slides showing how easy it was to run a Tor server, my students drifted in, a diverse crew of strangers and a few new friends I’d only met online. All in all, I’d say about twenty people showed up that December night to learn from me and my co-lecturer, Runa Sandvik, a bright young Norwegian woman from the Tor Project. (Runa would go on to work as the senior director of information security for the New York Times, which would sponsor her later CryptoParties.) Our audience wanted to re-establish a sense of control over the private spaces in their lives.

I began my presentation by discussing deletion and the fact that total erasure could never be accomplished. The crowd understood this instantly. I went on to explain that, at best, the data they wanted no one to see couldn’t be unwritten so much as overwritten: scribbled over, in a sense, until the original was rendered unreadable. But, I cautioned, even this approach had its drawbacks. There was always a chance that their operating system had silently hidden away a copy of the file they were hoping to delete in some temporary storage nook they weren’t privy to.

That’s when I pivoted to encryption.

Encryption is the only true protection against surveillance. If the whole of your storage drive is encrypted to begin with, your adversaries can’t rummage through it for deleted files—or for anything else—unless they have the encryption key. If all the emails in your inbox are encrypted, Google can’t read them to profile you—unless they have the encryption key. If all your communications that pass through hostile networks are encrypted, spies can’t read them—unless they have the encryption key.

Encryption works, I explained, by way of algorithms. It’s a mathematical method of transforming information—such as your emails, phone calls, photos, videos, and files—in such a way that it becomes incomprehensible to anyone who doesn’t have a copy of the encryption key. And it’s reversible. You can think of a modern encryption algorithm as a magic wand that you can wave over a document to change each letter into a language that only you and those you trust can read. The encryption key is the magic spell that puts the wand to work. It doesn’t matter how many people know that you used the wand, so long as you can keep your personal magic spell from anyone you don’t trust.

Encryption algorithms are basically just sets of math problems designed to be incredibly difficult even for computers to solve. If all of our data, including our communications, were encrypted, then no government would be able to understand them. It could still intercept and collect the signals, but it would be intercepting and collecting pure noise. Encrypting our communications would essentially delete them from the memories of every entity we deal with. It would effectively withdraw permission from those to whom it was never granted to begin with.

Any government hoping to access encrypted communications has only two options: It can either go after the keymasters or go after the keys. The best means we have for keeping our keys safe is called “zero knowledge,” a method that ensures that any data you try to store externally—say, for instance, on a company’s cloud platform—is encrypted by an algorithm running on your device before it is uploaded. With zero knowledge, the key is never shared and remains in the users’ hands—and only in the users’ hands. No company, no agency, no enemy can touch them.

My key to the NSA’s secrets went beyond zero knowledge: It was a zero-knowledge key consisting of multiple zero-knowledge keys.

My keys to the drive were hidden everywhere. But I retained one for myself. And if I destroyed that single lone piece that I kept on my person, I would destroy all access to the NSA’s secrets forever.

TWENTY-THREE ^{The Boy}

I was more curious than ever about the one fact I was still finding elusive: the absolute limit of who the IC could turn its gaze against.

The only way to discover the answer was to narrow my vision to that of the NSA employees with the freest access to the rawest forms of intelligence. They could type into their computers the names of individuals who’d fallen under the agency’s suspicion, foreigners and US citizens alike. The NSA was interested in finding out everything about these individuals and their communications.

The program that enabled this access was called XKEYSCORE, which is perhaps best understood as a search engine. Imagine a kind of Google that instead of showing pages from the public internet returns results from your private email, your private chats, your private files, everything. Though I’d read enough about the program to understand how it worked, I hadn’t yet used it. But I was looking for a personal confirmation of the depths of the NSA’s surveillance intrusions—the kind of confirmation you don’t get from documents but only from direct experience.

One of the few offices in Hawaii with truly unfettered access to XKEYSCORE was the National Threat Operations Center. As luck would have it, NTOC had a position open through a contractor job as an infrastructure analyst. The role involved using the complete spectrum of the NSA’s mass surveillance tools, including XKEYSCORE.

I’d decided to bring my archives out of the country and pass them to the journalists I’d contacted, but before I could even begin to contemplate the logistics of that act I had to go shake some hands. I had to fly east to DC and spend a few weeks meeting and greeting my new bosses and colleagues. This was what brought me back home to the Beltway for the very last time, and back to Fort Meade.

The NSA described XKEYSCORE, in the documents I’d later pass on to journalists, as its “widest-ranging” tool, used to search “nearly everything a user does on the internet.” It was, simply put, the closest thing to science fiction I’ve ever seen in science fact: an interface that allows you to type in pretty much anyone’s address, telephone number, or IP address, and then basically go through the recent history of their online activity. In some cases you could even play back recordings of their online sessions, so that the screen you’d be looking at was their screen, whatever was on their desktop. You could read their emails, their browser history, their search history, their social media postings, everything. You could set up notifications that would pop up when some person or some device you were interested in became active on the internet for the day.

My weeks at Fort Meade, and the short stint I put in at my new job back in Hawaii, were the only times I saw, firsthand, the abuses actually being committed. I didn’t type the names of the agency director or the president into XKEYSCORE, but after enough time with the system I realized I could have. Everyone’s communications were in there—everyone’s. I was initially fearful that if I searched those in the uppermost echelons of state, I’d be caught and fired, or worse.

But it was simple to disguise a query by encoding my search terms. If any of the auditors who were responsible for reviewing the searches ever bothered to look more closely, they would see only a snippet of obfuscated code, while I would be able to scroll through the most personal activities of a Supreme Court justice or a congressperson.

One thing you come to understand very quickly while using XKEYSCORE is that nearly everyone in the world who’s online stores photos and videos of their family. This was true for virtually everyone of every gender, ethnicity, race, and age—from the meanest terrorist to the nicest senior citizen, who might be the meanest terrorist’s grandparent or parent or cousin.

It’s the family stuff that got to me the most. I remember this one child in particular, a little boy in Indonesia. Technically, I shouldn’t have been interested in this little boy, but I was, because my employers were interested in his father.

The boy’s father, like my own father, was an engineer—but unlike my father, this guy wasn’t government or military affiliated. He was just a regular academic who’d been caught up in a surveillance dragnet. I can’t even remember how or why he’d come to the agency’s attention, beyond sending a job application to a research university in Iran. The grounds for suspicion were often poorly documented, if they were documented at all, and the connections could be incredibly tenuous—“believed to be potentially associated with.”

Selections from the man’s communications had been assembled into folders—here was the fatal copy of the résumé sent to the suspect university; here were his texts; here was his Web browser history; here was the last week or so of his correspondence both sent and received, tagged to IP addresses. Here were the coordinates of a “geo-fence” the analyst had placed around him to track whether he strayed too far from home, or perhaps traveled to the university for his interview.

Then there were his pictures, and a video. He was sitting in front of his computer, as I was sitting in front of mine. Except that in his lap he had a toddler, a boy in a diaper.

The father was trying to read something, but the kid kept shifting around, smacking the keys and giggling. The computer’s internal mic picked up his giggling and there I was, listening to it on my headphones. The father held the boy tighter, and the boy straightened up and, with his dark crescent eyes, looked directly into the computer’s camera—I couldn’t escape the feeling that he was looking directly at me. Suddenly I realized that I’d been holding my breath. I shut the session, got up from the computer, and left the office for the bathroom in the hall, head down, headphones still on with the cord trailing.

Everything about that kid, everything about his father, reminded me of my own father, whom I met for dinner one evening during my stint at Fort Meade. I hadn’t seen him in a while, but there in the midst of dinner, over bites of Caesar salad and a pink lemonade, I had the thought: I’ll never see my family again. I knew that if I told him what I was about to do, he would’ve called the cops. Or else he would’ve called me crazy and had me committed to a mental hospital. He would’ve done anything he thought he had to do to prevent me from making the gravest of mistakes.

I could only hope that his hurt would in time be healed by pride.

Back in Hawaii between March and May 2013, a sense of finality hung over nearly every experience for me. It was far less painful to think that this was the last time I’d ever stop at the curry place in Mililani or drop by the art-gallery hacker space in Honolulu or just sit on the roof of my car and scan the nighttime sky for falling stars than to think that I only had another month left with Lindsay.

The preparations I was making were those of a man about to die. I emptied my bank accounts, putting cash into an old steel ammo box for Lindsay to find so that the government couldn’t seize it. I went around the house doing oft-procrastinated chores, like fixing windows and changing light bulbs. I erased and encrypted my old computers. I was putting my affairs in order to try to make everything easier for Lindsay, or just for my conscience.

And yet there were moments when it seemed that the plan I’d developed was collapsing. It was difficult to get the journalists to commit to a meeting, mostly because I couldn’t tell them who they were meeting with, or even, for a while at least, where and when it was happening. I had to reckon with the prospect of them never showing up, or of them showing up but then dropping out. Ultimately, I decided that if either of those happened, I’d just abandon the plan and return to work and to Lindsay as if everything were normal, to wait for my next chance.

During my Wi-Fi scavenger hunt drives I’d been researching various countries, trying to find a location for my meeting with the journalists. It felt like I was picking out my prison, or rather my grave. All of the Five Eyes countries were obviously off-limits. In fact, all of Europe was out, as were Africa and Latin America, because for various political reasons, I knew I wouldn’t be safe from the American government’s wrath if I got caught there. Russia was out because it was Russia, and China was China: Both were totally out of bounds. Due to the US government’s contentious relationship with both countries, I knew that I’d be painted as a traitor if I settled in either country.

The process of elimination left me with Hong Kong. In geopolitical terms, it was the closest I could get to no-man’s-land, but with a vibrant media and protest culture, not to mention largely unfiltered internet. In a situation with no promise of safety, it was enough to have the guarantee of time. Chances were that things weren’t going to end well for me, anyway: The best I could hope for was getting the disclosures out before I was caught.

The last morning I woke up with Lindsay—she was leaving on a camping trip to Kauai with friends—I told her how sorry I was for how busy I’d been and that I was going to miss her. And that she was the best person I’d ever met in my life. She smiled, pecked me on the cheek, and then got up to pack.

The moment she was out the door, I started crying, for the first time in years.

At least I had the benefit of knowing what was coming. Lindsay would return from her camping trip to find me gone, ostensibly on a work assignment, and my mother basically waiting on our doorstep. I’d invited my mother to visit, in a move so uncharacteristic that she must have expected another type of surprise—like an announcement that Lindsay and I were engaged. I felt horrible about the false pretenses, but I kept telling myself I was justified. My mother would take care of Lindsay, and Lindsay would take care of her. Each would need the other’s strength to weather the coming storm.

The day after Lindsay left, I took an emergency medical leave of absence from work, citing epilepsy, and packed scant luggage and four laptops: secure communications, normal communications, a decoy, and an “air gap” (a computer that had never gone and would never go online). I left my smartphone on the kitchen counter alongside a notepad on which I scribbled in pen Got called away for work. I love you. Then I went to the airport and bought a ticket in cash for the next flight to Tokyo. In Tokyo, I bought another ticket in cash, and on May 20 arrived in Hong Kong, the city where the world first met me.

TWENTY-FOUR ^{Hong Kong}

The deep appeal of games, which are really just a series of increasingly difficult challenges, is the belief that they can be won. Nowhere is this more clear to me than in the case of the Rubik’s Cube. It satisfies a fantasy that if you just work hard enough and twist yourself through all of the possibilities, everything in the world that appears scrambled and incoherent will finally click into position and become perfectly aligned.

I’d had a plan—I’d had multiple plans—in which a single mistake would have meant getting caught, and yet I hadn’t been: I’d made it out of the NSA; I’d made it out of the country. I had beaten the game. By every standard I could imagine, the hard part was over.

But my imagination hadn’t been good enough, because the journalists I’d asked to come meet me weren’t showing up. They kept postponing, giving excuses, apologizing.

I knew that Laura Poitras—to whom I’d already sent a few documents and the promise of many more—was ready to fly anywhere from New York City at a moment’s notice, but she wasn’t going to come alone. She was busy trying to get Glenn Greenwald to commit, trying to get him to buy a new laptop that he wouldn’t put online. Trying to get him to install encryption programs so we could better communicate. And there I was, in Hong Kong, watching the clock tick away the hours, watching the calendar tick off the days. I was begging: Please come before the NSA realizes I’ve been gone from work too long. It was tough to face the prospect of being left in Hong Kong high and dry. I thought about my family and Lindsay and how foolish it was to have put my life in the hands of people who didn’t even know my name.

I barricaded myself in my room at the Mira Hotel, which I chose because of its central location in a crowded shopping and business district. I put the PRIVACY PLEASE—DO NOT DISTURB sign on the door handle to keep housekeeping out. For ten days, I didn’t leave the room for fear of giving a foreign spy the chance to sneak in and bug the place. With the stakes so high, the only move I had was to wait. I sent increasingly shrill pleas to my contacts. Then I’d stand at the window hoping for a reply, looking out onto the beautiful park I’d never visit. By the time Laura and Glenn finally arrived, I’d eaten every item on the room service menu.

That isn’t to say that I just sat around during that week and a half writing messages. I also tried to organize the last briefing I’d ever give—going through the archive, figuring out the most effective way to explain its contents to the journalists in the surely limited time we’d have together. It was an interesting problem: how best to express to nontechnical people who were inclined to be skeptical of me that the US government was surveilling the world and the methods by which it was doing so. I put together dictionaries of terms like metadata. I put together glossaries of acronyms and abbreviations.

I had to find a way to help Laura and Glenn understand something in the span of a few days that it had taken me years to puzzle out. Then there was another thing: I had to help them understand who I was and why I’d decided to do this.

At long last, Glenn and Laura showed up in Hong Kong on June 2. When they came to meet me at the Mira, I think I disappointed them, at least initially. They even told me as much, or Glenn did: He didn’t understand how a person as young as I was—he kept asking me my age—not only had access to such sensitive documents, but was also so willing to throw his life away. For my part, I didn’t know how they could have expected someone older, given my instructions about how to meet: Go to a certain quiet alcove by the hotel restaurant, furnished with a pleather couch, and wait around for a guy holding a Rubik’s Cube. The funny thing was that I’d originally been wary of using that bit of tradecraft, but the cube was the only thing I’d brought with me that was likely to be unique and identifiable from a distance. It also helped me hide the stress of waiting for what I feared might be the surprise of handcuffs.

That stress would reach its peak just ten or so minutes later, when I’d brought Laura and Glenn up to my room—#1014, on the tenth floor. Glenn had barely had the chance to stow his smartphone in my minibar fridge at my request when Laura started rearranging and adjusting the lights in the room. Then she unpacked her digital video camera. Though we’d agreed, over encrypted email, that she could film our encounter, I wasn’t ready for the reality.

Nothing could have prepared me for the moment when she pointed her camera at me, sprawled out on my unmade bed in a cramped, messy room that I hadn’t left for the past ten days. Though today nearly all of my interactions take place via camera, I’m still not sure which experience I find more uncomfortable: seeing myself on film or being filmed.

In a situation that was already high intensity, I stiffened. The red light of Laura’s camera, like a sniper’s sight, kept reminding me that at any moment the door might be smashed in and I’d be dragged off forever. And whenever I wasn’t having that thought, I kept thinking about how this footage was going to look when it was played back in court. I realized there were so many things I should have done, like putting on nicer clothes and shaving. Room service plates and trash had accumulated throughout the room. There were noodle containers and half-eaten burgers, piles of dirty laundry and damp towels on the floor.

It was a surreal dynamic. I had never met any journalists before serving as their source. The first time I ever spoke aloud to anyone about the US government’s system of mass surveillance, I was speaking to everyone in the world with an internet connection. In the end, though, regardless of how rumpled I looked and stilted I sounded, Laura’s filming was indispensable, because it showed the world exactly what happened in that hotel room in a way that newsprint never could. The footage she shot over the course of our days together in Hong Kong can’t be distorted. Its existence is a tribute not just to her professionalism as a documentarian but to her foresight.

I spent the week between June 3 and June 9 cloistered in that room with Glenn and his colleague from the Guardian, Ewen MacAskill, who joined us a bit later that first day. We talked and talked, going through the NSA’s programs, while Laura hovered and filmed. In contrast to the frenetic days, the nights were empty and desolate. Glenn and Ewen would retreat to their own hotel, the nearby W, to write up their findings into articles. Laura would disappear to edit her footage and do her own reporting with Bart Gellman of the Washington Post, who never made it to Hong Kong but worked remotely with the documents he received from her.

On June 5, the Guardian broke Glenn’s first story, the Foreign Intelligence Surveillance Act court order that authorized the NSA to collect information from the American company Verizon about every phone call it handled. On June 6, it ran another story by Glenn, pretty much simultaneously with a similar account in the Washington Post by Laura and Bart. I knew, and I think we all knew, that the more pieces came out the more likely it was that I’d be identified, particularly because my office had begun emailing me asking for status updates, and I wasn’t answering. Glenn and Ewen and Laura were unfailingly sympathetic to my ticking time-bomb situation. But they never let their desire to serve the truth be influenced by my circumstances. And following their example, neither did I.

As the revelations ran wall to wall on every TV channel and website, it became clear that the US government had thrown the whole of its machinery into identifying the source. It was also clear that when they did, they would use the face they found—my face—to evade accountability: Instead of addressing the revelations, they’d challenge my credibility and the motives of “the leaker.”

The only hope I had of fighting back was to come forward first and identify myself. I’d give the media just enough personal detail to satisfy their mounting curiosity, with a clear statement that what mattered wasn’t me, but rather the subversion of American democracy. Then I’d vanish just as quickly as I’d appeared. That, at least, was the plan.

Ewen and I decided that he’d write a story about my IC career, and Laura suggested filming a video statement to appear alongside it in the Guardian. In it, I’d claim direct and sole responsibility as the source behind the reporting on global mass surveillance. But we just didn’t have the time for her to go through everything she’d shot in search of snippets of me speaking coherently and making eye contact. What she proposed, instead, was my first recorded statement, which she started filming right there and then—the one that begins “Uh, my name is Ed Snowden. I’m, ah, twenty-nine years old.”

Hello, world.

While I’ve never once regretted tugging aside the curtain and revealing my identity, I do wish I had done it with better diction and a better plan in mind for what was next. In truth, I had no plan at all. I hadn’t given much thought to answering the question of what to do once the game was over, mainly because a winning conclusion was always so unlikely. All I’d cared about was getting the facts out into the world. I figured that by putting the documents into the public record, I was essentially putting myself at the public’s mercy. No exit strategy could be the only exit strategy.

If I’d made preexisting arrangements to fly to a specific country and seek asylum—the act of fleeing one’s country for the protection of another—I would’ve been called a foreign agent of that country. Meanwhile, if I returned to my own country, the best I could hope for was to be arrested upon landing and charged under the Espionage Act. That would’ve entitled me to a show trial deprived of any meaningful defense, a sham in which all discussion of the most important facts would be forbidden. I almost certainly would’ve been found guilty.

The major impediment to justice was a major flaw in the law, a purposeful flaw created by the government. Someone in my position would not even be allowed to argue in court that the disclosures I made to journalists were beneficial. Even now, years after the fact, I would not be allowed to argue that the reporting based on my disclosures had caused Congress to change certain laws regarding surveillance, or convinced the courts to strike down a certain mass surveillance program as illegal, or influenced the attorney general and the president of the United States to admit that the debate over mass surveillance was a crucial one for the public to have. All these claims would be deemed not just irrelevant but inadmissible in court.

The only thing my government would have to prove is that I disclosed classified information to journalists, a fact that is not in dispute. This is why anyone who says I have to come back to the States for trial is essentially saying I have to come back to the States for sentencing. And the sentence would, now as then, surely be a cruel one. The penalty for disclosing top secret documents is up to ten years per document.

From the moment Laura’s video of me was posted on the Guardian website on June 9, I was marked. There was a target on my back. I knew that the institutions I’d shamed would not relent until my head was bagged and my limbs were shackled. And until then—and perhaps even after then—they would harass my loved ones and disparage my character. I was familiar enough with how this process went, both from having read classified examples of it within the IC and from having studied the cases of other whistleblowers and leakers.

As sure as I was of my government’s indignation, I was just as sure of the support of my family, and of Lindsay, who I was certain would understand—perhaps not forgive, but understand—the context of my recent behavior. I took comfort from recalling their love: It helped me cope with the fact that there was nothing left for me to do, no further plans in play. I could only hope that my fellow citizens, once they’d been made aware of the full scope of American mass surveillance, would mobilize and call for justice. They’d be empowered to seek that justice for themselves, and, in the process, my own destiny would be decided. This was the ultimate leap of faith: I could hardly trust anyone, so I had to trust everyone.

Within hours after my Guardian video ran, one of Glenn’s regular readers in Hong Kong contacted him and offered to put me in touch with Robert Tibbo and Jonathan Man, two local attorneys who then volunteered to take on my case. These were the men who helped get me out of the Mira when the press finally located me and besieged the hotel. As a diversion, Glenn went out the front lobby door, where he was immediately thronged by the cameras and mics. Meanwhile, I was bundled out of one of the Mira’s myriad other exits, which connected via a sky bridge to a mall.

I like Robert—to have been his client is to be his friend for life. He’s an idealist and a crusader, a tireless champion of lost causes. Even more impressive than his lawyering, however, was his creativity in finding safe houses. While journalists were scouring every five-star hotel in Hong Kong, he took me to one of the poorest neighborhoods of the city and introduced me to some of his other clients, a few of the nearly twelve thousand forgotten refugees in Hong Kong. I wouldn’t usually name them, but since they have bravely identified themselves to the press, I will: Vanessa Mae Bondalian Rodel from the Philippines, and Ajith Pushpakumara, Supun Thilina Kellapatha, and Nadeeka Dilrukshi Nonis, all from Sri Lanka.

These unfailingly kind and generous people came through with charitable grace. The solidarity they showed me was not political. It was human, and I will be forever in their debt. They didn’t care who I was, or what dangers they might face by helping me, only that there was a person in need. They knew all too well what it meant to be forced into a mad escape from mortal threat, having survived ordeals far in excess of anything I’d dealt with and hopefully ever will. They let an exhausted stranger into their homes—and when they saw my face on TV, they didn’t falter. Instead, they smiled and took the opportunity to reassure me of their hospitality.

Though their resources were limited—Supun, Nadeeka, Vanessa, and two little girls lived in a crumbling, cramped apartment smaller than my room at the Mira—they shared everything they had with me, and they shared it unstintingly, refusing my offers to reimburse them for the cost of taking me in so emphatically that I had to hide money in the room to get them to accept it. They fed me, they let me bathe, they let me sleep, and they protected me. I will never be able to explain what it meant to be given so much by those with so little, to be accepted by them without judgment as I perched in corners like a stray street cat, skimming the Wi-Fi of distant hotels with a special antenna that delighted the children.

Their welcome and friendship was a gift, for the world to even have such people is a gift, and so it pains me that, all these years later, the cases of Ajith, Supun, Nadeeka, and Nadeeka’s daughter are still pending. The admiration I feel for these folks is matched only by the resentment I feel toward the bureaucrats in Hong Kong, who continue to deny them the basic dignity of asylum. What gives me hope, however, is that Vanessa and her daughter received asylum in Canada. I look forward to the day when I can visit all of my old Hong Kong friends in their new homes, wherever those may be, and we can make happier memories together in freedom.

On June 14, the US government charged me under the Espionage Act in a sealed complaint, and on June 21 they formally requested my extradition, which, under international law, means the US asked Hong Kong to return me to the States so that I could be put on trial. It was my thirtieth birthday.

Just as the US State Department sent its request, my lawyers received a reply to my appeal for assistance from the UN High Commissioner for Refugees: There was nothing that could be done for me. The Hong Kong government would not provide me international protection on its territory. In other words, Hong Kong was telling me to go home and deal with the UN from prison. I wasn’t just on my own—I was unwelcome. If I was going to leave freely, I had to leave now. I wiped my four laptops completely clean and destroyed the cryptographic key, which meant that I could no longer access any of the documents even if compelled. Then I packed the few clothes I had and headed out.

TWENTY-FIVE ^Moscow

For a coastal country at the northwestern edge of South America, half a globe away from Hong Kong, Ecuador is in the middle of everything. Most of my fellow North Americans would correctly say that it’s a small country. Ecuador, at least in 2013, had a hard-earned belief in the institution of political asylum—the right of a person to live in a foreign country if they have had to leave their own country for political reasons. My Hong Kong lawyers agreed that, given the circumstances, Ecuador seemed to be the most likely country to defend my right to political asylum.

With my government having decided to charge me under the Espionage Act, I stood accused of a political crime, meaning a crime whose victim is the state itself rather than a person. Under international humanitarian law, whistleblowers should be protected against extradition—from being forcibly sent back to the country accusing them of a crime—almost everywhere. In practice, though, this is rarely the case. The most common advice my team received was for me to avoid any route that crossed the airspace of any countries with a record of cooperation with the US military.

The moment the news broke that an American had unmasked a global system of mass surveillance, Sarah Harrison, a journalist and editor for WikiLeaks, had immediately flown to Hong Kong. WikiLeaks is a nonprofit organization that publishes classified information, including news leaks, from anonymous sources on its website. Through Sarah’s experience with WikiLeaks, she was poised to offer me the world’s best asylum advice. It didn’t hurt that she also had family connections with the legal community in Hong Kong.

Laura informed me of Sarah’s presence in Hong Kong only a day or so before she communicated with me on an encrypted channel, which itself was only a day or two before I actually met her in person. Sarah managed to procure a document that would provide me safe passage to Ecuador—it was a UN-recognized one-way travel document typically issued to refugees crossing borders. It had been issued on an emergency basis, and the moment it was in hand, Sarah hired a van to take us to the airport.

That’s how I met her—in motion. I’d like to say that I started off our acquaintance by offering my thanks, but instead the first thing I said was “When was the last time you slept?” Sarah looked just as ragged and disheveled as I did. She stared out the window, as if trying to recall the answer, but then just shook her head: “I don’t know.”

We were traveling to Quito, Ecuador, via Moscow, Russia, via Havana, Cuba, via Caracas, Venezuela, for a simple reason: It was the only safe route available. There were no direct flights to Quito from Hong Kong, and all of the other connecting flights traveled through US airspace. I was concerned about the massive layover in Russia—we’d have almost twenty hours before the Havana flight departed.

I wore my hat down over my eyes to avoid being recognized, and Sarah did the seeing for me. She took my arm and led me to the gate, where we waited until boarding. This was the last moment for her to back out, and I told her so. “You don’t have to do this,” I said.

“Do what?”

“Protect me like this.”

Sarah stiffened. “Let’s get one thing clear,” she said as we boarded. “I’m not protecting you. No one can protect you. What I’m here for is to make it harder for anyone to interfere. To make sure everyone’s on their best behavior.”

“So you’re my witness,” I said.

She gave a slight wry smile. “Someone has to be the last person to ever see you alive. It might as well be me.”

Though the three points where I’d thought we were most likely to get stopped were now behind us (check-in, passport control, and the gate), I didn’t feel safe on the plane. I didn’t want to get complacent. I took the window seat, and Sarah sat next to me to screen me from the other passengers across the row. After what felt like an eternity, the cabin doors were shut, the sky bridge pulled away, and finally, we were moving.

But just before the plane rolled from the tarmac onto the runway, it halted sharply. I was nervous. Pressing the brim of my hat up against the glass, I strained to catch the sound of sirens or the flashing of blue lights. It felt like I was playing the waiting game all over again—it was a wait that wouldn’t end. Until, suddenly, the plane rolled into motion again and took a turn, and I realized that we were just far back in the line for takeoff.

My spirits rose with the wheels, but it was hard to believe I was out of the fire. Once we were airborne, I loosened my grip from my thighs and felt an urge to take my lucky Rubik’s Cube out of my bag. But I knew I couldn’t, because nothing would make me more conspicuous now that tales of my Rubik’s Cube had spread far and wide. Instead, I sat back, pulled my hat down again, and kept my half-open eyes on the map on the seat-back screen just in front of me, tracking the pixelated route across China, Mongolia, and Russia.

There was no predicting what the Russian government would do once we landed, beyond hauling us into an inspection so they could search through my blank laptops and empty bag. What I hoped might spare us any more invasive treatment was that the world was watching, and my lawyers were aware of our itinerary.

We landed at Sheremetyevo International Airport on June 23 for what we assumed would be a twenty-hour layover. It has now dragged on for over seven years. Exile is an endless layover.

In the IC, and in the CIA in particular, you get a lot of training on how not to get into trouble at customs. You have to think about how you dress, how you act. You have to think about the things in your bag and the things in your pockets and the tales they tell about you. Your goal is to be the most boring person in line, with the most perfectly forgettable face. But none of that really matters when the name on your passport is all over the news.

I handed my little blue book to the guy in the passport-control booth, who scanned it and rifled through its pages. Sarah stood stalwart behind me. I’d made sure to take note of the time it took for the people ahead of us in line to clear the booth, and our turn was taking too long. Then the guy picked up his phone, grumbled some words in Russian, and almost immediately—far too quickly—two security officers in suits approached. They must have been waiting. The officer in front took my little blue book from the guy in the booth and leaned in close to me. “There is problem with passport,” he said. “Please, come with.”

Sarah immediately stepped to my side and unleashed a fast flurry of English: “I’m his legal adviser. Wherever he goes, I go. I’m coming with you. According to the—”

But before she could cite the relevant information, the officer held up his hand and glanced at the line. He said, “Okay, sure, okay. You come.”

I don’t know whether the officer had even understood what she said. He just clearly didn’t want to make a scene.

The two security officers marched us briskly toward what I assumed was going to be a special room for secondary inspection but instead turned out to be one of Sheremetyevo’s plush business lounges—like a business-class or first-class area, with just a few passengers basking obliviously in their luxury seats. Sarah and I were directed past them and down a hall into a conference room of sorts, filled with men in gray sitting around a table. There were a half dozen of them or so, with military haircuts. One guy sat separately, holding a pen. He was a note taker, a kind of secretary, I guessed. He had a folder in front of him containing a pad of paper. On the cover of the folder was a monochrome insignia that I didn’t need Russian in order to understand: It was a sword and shield, the symbol of Russia’s foremost intelligence service, the Federal Security Service (FSB). Like the FBI in the United States, the FSB exists not only to spy and investigate but also to make arrests.

At the center of the table sat an older man in a finer suit than the others, the white of his hair shining like a halo of authority. He gestured for Sarah and me to sit opposite him with an authoritative sweep of the hand and a smile that marked him as a seasoned case officer. Intelligence services the world over are full of such figures—dedicated actors who will try on different emotions until they get the response they want.

He cleared his throat and gave me, in decent English, what the CIA calls a cold pitch, which is basically an offer by a foreign intelligence service that can be summarized as “come and work for us.” In return for cooperation, the foreigners dangle favors, which can be anything from stacks of cash to a get-out-of-jail-free card for pretty much anything from fraud to murder. The catch, of course, is that the foreigners always expect something of equal or better value in exchange.

I knew I had to cut him off. If you don’t cut off a foreign intelligence officer right away, it might not matter whether you ultimately reject their offer, because they can destroy your reputation simply by leaking a recording of you considering it. So as the man apologized for inconveniencing us, I imagined the hidden devices recording us and tried to choose my words carefully.

“Listen, I understand who you are, and what this is,” I said. “Please let me be clear that I have no intention to cooperate with you. I’m not going to cooperate with any intelligence service. I mean no disrespect, but this isn’t going to be that kind of meeting. If you want to search my bag, it’s right here.” And I pointed to it under my chair. “But I promise you, there’s nothing in it that can help you.”

As I was speaking, the man’s face changed. He started to act wounded. “No, we would never do that,” he said. “Please believe me, we only want to help you.”

Sarah cleared her throat and jumped in. “That’s quite kind of you, but I hope you can understand that all we’d like is to make our connecting flight.”

For the briefest instant, the man’s feigned sorrow became irritation. “You are his lawyer?”

“I’m his legal adviser,” Sarah answered.

The man asked me, “So you are not coming to Russia to be in Russia?”

“No.”

“And so may I ask where you are trying to go? What is your final destination?”

I said, “Quito, Ecuador, via Caracas, via Havana,” even though I knew that he already knew the answer. He certainly had a copy of our itinerary, since Sarah and I had traveled from Hong Kong on Aeroflot, the Russian flagship airline.

Up until this point, he and I had been reading from the same intelligence script, but now the conversation swerved. “You haven’t heard?” he said. He stood and looked at me like he was delivering the news of a death in the family. “I am afraid to inform you that your passport is invalid.”

I was so surprised, I just stammered. “I’m sorry, but I—I don’t believe that.”

The man leaned over the table and said, “No, it is true. Believe me. It is the decision of your minister, John Kerry. Your passport has been canceled by your government, and the air services have been instructed not to allow you to travel.”

I was sure it was a trick, but I wasn’t quite sure to what purpose. “Give us a minute,” I said, but even before I could ask, Sarah had snatched her laptop out of her bag and was getting onto the airport Wi-Fi.

“Of course, you will check,” the man said, and he turned to his colleagues and chatted amiably to them in Russian, as if he had all the time in the world.

It was reported on every site Sarah looked at. After the news had broken that I’d left Hong Kong, the US State Department announced that it had canceled my passport. It had revoked my travel document while I was still in midair.

“It’s true,” said Sarah, with a shake of her head. I was incredulous: My own government had trapped me in Russia.

“So what will you do?” the man asked, and he walked around to our side of the table.

Before I could take the Ecuadorean safe-conduct pass out of my pocket, Sarah said, “I’m so sorry, but I’m going to have to advise Mr. Snowden not to answer any more questions.”

The man pointed at me, and said, “You will come.”

He gestured for me to follow him to the far end of the conference room, where there was a window. I went and stood next to him and looked. About three or four floors below was street level and the largest media scrum I’ve ever seen, scads of reporters wielding cameras and mics.

I went back to my chair but didn’t sit down again.

The man turned from the window to face me and said, “Life for a person in your situation can be very difficult without friends who can help.” He let the words linger.

Here it comes, I thought—the direct solicitation.

He said, “If there is some information, perhaps, some small thing you could share with us?”

“We’ll be okay on our own,” I said. Sarah stood up next to me.

The man sighed. He turned to mumble in Russian, and his comrades rose and filed out. “I hope you will not regret your decision,” he said to me. Then he gave a slight bow and made his own exit, just as a pair of officials from the airport administration entered.

I demanded to be allowed to go to the gate for the flight to Havana, but they ignored me. I finally reached into my pocket and brandished the Ecuadorean safe-conduct pass, but they ignored that, too.

All told, we were trapped in the airport for a biblical forty days and forty nights. Over the course of those days, I applied to a total of twenty-seven countries for political asylum. Not a single one of them was willing to stand up to American pressure, with some countries refusing outright and others declaring that they were unable to even consider my request until I arrived in their territory—a feat that was impossible. Ultimately, the only head of state that proved sympathetic to my cause was Burger King, who never denied me a Whopper (hold the tomato and onion).

Soon, my presence in the airport became a global spectacle. Eventually the Russians found it a nuisance. The Russian government must have decided that it would be better off without me and the media swarm clogging up the country’s major airport. On August 1, it granted me temporary asylum. Sarah and I were allowed to leave Sheremetyevo, but eventually only one of us would be heading home. Our time together served to bind us as friends for life. I will always be grateful for the weeks she spent by my side, for her integrity and her fortitude.

TWENTY-SIX ^{From the Diaries of Lindsay Mills}

As far away from home as I was, my thoughts were consumed with Lindsay. I’ve been wary of telling her story—the story of what happened to her once I was gone: the FBI interrogations, the surveillance, the press attention, the online harassment, the confusion and pain, the anger and sadness. Finally, I realized that only Lindsay herself should be the person to recount that period. No one else has the experience, but more than that, no one else has the right. Luckily, Lindsay has long kept a diary, using it to record her life and draft her art. She has graciously agreed to let me include a few pages, which can be accessed via the QR code or URL below. In the entries, all names have been changed (except those of family), some typos fixed, and a few redactions made. Otherwise, this is how it was, from the moment that I left Hawaii.

TWENTY-SEVEN ^{Love and Exile}

If at any point during your journey through this book you paused for a moment over a term you wanted to clarify or investigate further and typed it into a search engine—and if that term happened to be in some way suspicious—then congrats: You’re in the system, a victim of your own curiosity.

But even if you didn’t search for anything online, it wouldn’t take much for an interested government to find out that you’ve been reading this book. At the very least, it wouldn’t take much to find out that you have it, whether you bought a hard copy online or purchased it at a brick-and-mortar store with a credit card.

All you wanted to do was read. But that was more than enough. By creating a world-spanning system that tracked identifiers like your email, your phone, and the IP address of your computer across every available channel of electronic communications, the American Intelligence Community gave itself the power to record and store forever the data of your life.

And that was only the beginning. Because once America’s spy agencies had proven to themselves that it was possible to passively collect all of your communications, they started actively tampering with them, too. By poisoning the messages that were headed your way with snippets of attack code, they developed the ability to gain possession of more than just your words. Now they were capable of winning total control of your whole device, including its camera and microphone. Which means that if you’re reading this now—this sentence—on any sort of modern machine, like a smartphone or tablet, they can follow along and read you. They can tell how quickly or slowly you turn the pages and whether you read the chapters consecutively or skip around. But what they really want is the data that lets them positively identify you.

This is the result of two decades of unchecked innovation. No matter the place, no matter the time, and no matter what you do, your life has now become an open book.

If mass surveillance was, by definition, a constant presence in daily life, then I wanted the dangers it posed, and the damage it had already done, to be a constant presence, too. Through my disclosures to the press, I wanted to make this system known, its existence a fact that my country, and the world, could not ignore. In the years since 2013, awareness has grown. But in this social media age, we have always to remind ourselves: Awareness alone is not enough.

Because of the revelations of 2013, both houses of Congress launched multiple investigations into NSA abuses. Those investigations concluded that the agency had repeatedly lied regarding the nature and efficacy of its mass surveillance programs, even to the most highly cleared Intelligence Committee legislators.

In 2015, a federal court of appeals ruled in the lawsuit ACLU v. Clapper, which challenged the legality of the NSA’s phone records collection program. The court ruled that the NSA’s program had violated the Patriot Act and, moreover, was most probably unconstitutional.

ACLU v. Clapper was a notable victory, to be sure. A crucial precedent was set. The court declared that the American public had standing: American citizens had the right to stand in a court of law and challenge the government’s officially secret system of mass surveillance. But it becomes ever clearer to me that an international opposition movement, fully implemented across both governments and private sector is what’s needed.

Apple has adopted strong default encryption for its iPhones and iPads, and Google followed suit for its Android products and Chromebooks. Perhaps the most important private-sector change occurred when businesses throughout the world set about switching their website platforms, replacing HTTP (Hypertext Transfer Protocol) with the encrypted HTTPS (the S signifies security), which helps prevent third-party interception of Web traffic. 2016 was the first year since the invention of the internet that more Web traffic was encrypted than unencrypted.

The internet is certainly more secure now than it was in 2013, especially given the sudden global recognition of the need for encrypted tools and apps. I’ve been involved with the design and creation of a few of these myself, through my work heading the Freedom of the Press Foundation, a nonprofit organization dedicated to protecting and empowering public-interest journalism in the new millennium. A major goal of the organization is to preserve and strengthen First and Fourth Amendment rights through the development of encryption technologies.

In my current situation, I’m constantly reminded of the fact that the law is country specific, whereas technology is not. Every nation has its own legal code but the same computer code. Technology crosses borders and carries almost every passport. As the years go by, it has become increasingly apparent to me that changing surveillance practices and laws in the US won’t necessarily help a journalist in Russia, but an encrypted smartphone might.

Internationally, the disclosures helped to revive debates about surveillance. For the first time since the end of World War II, liberal democratic governments throughout the world were discussing privacy as the natural, inborn right of every man, woman, and child. The European Union became the first transnational body to establish a new directive that seeks to standardize whistleblower protections across its member states, along with a standardized legal framework for privacy protection. In 2016, the European Parliament passed the General Data Protection Regulation (GDPR).

The GDPR treats the citizens of the European Union, whom it calls “natural persons,” as also being “data subjects”—that is, people who generate personally identifiable data. In the US, data is usually regarded as the property of whoever collects it.

Today, no matter who you are, or where you are physically, you are also elsewhere. Our data wanders far and wide. Our data wanders endlessly.

We start generating this data before we are born, when technologies detect us in utero, and our data will continue to proliferate even after we die. Of course, our consciously created memories, the records that we choose to keep, comprise just a sliver of the information that has been wrung out of our lives—most of it unconsciously, or without our consent—by business and government surveillance. We are the first people in the history of the planet for whom this is true, the first people to be burdened with data immortality. This is why we have a special duty. We must ensure that these records of our pasts can’t be turned against us, or turned against our future children.

Today, a generation that wasn’t yet born when 9/11 took place, those whose entire lives have been spent under the omnipresent specter of this surveillance, is championing privacy. Their political creativity and technological ingenuity give me hope. You, the readers of this book, give me hope.

If we don’t reclaim our data now, future generations might not be able to do so. Then they, and their children, will be trapped, too.

Who among us can predict the future? Who would dare to? The answer to the first question is no one, really, and the answer to the second is everyone, especially every government and business on the planet. This is what that data of ours is used for. Algorithms analyze it for patterns of established behavior. A website that tells you that because you liked this book you might also like books by author A or author B isn’t offering an educated guess as much as a tool of subtle pressure and influence.

We can’t allow ourselves to be used in this way. We can’t permit our data to be used against us. We can’t let the godlike surveillance we’re under be used to “predict” our criminal activity. And as for our genetic information, our most intimate data: If we allow it to be used to identify us, then it will be used to victimize us, even to modify us.

Of course, all of the above has already happened.

Exile: When people ask me what my life is like now, I tend to answer that it’s a lot like theirs in that I spend a lot of time in front of the computer—reading, writing, interacting. From what the press likes to describe as an “undisclosed location”—which is really just whatever two-bedroom apartment in Moscow I happen to be renting—I beam myself onto stages around the world, speaking about the protection of civil liberties in the digital age to audiences of students, scholars, lawmakers, and technologists.

Some days I take virtual meetings. Other days I just pick up some Burger King. One fixture of my existence is my daily check-in with my American lawyer, confidant, and all-around consigliere Ben Wizner at the ACLU, who has been my guide to the world as it is and puts up with my musings about the world as it should be.

That’s my life. It got significantly brighter during the freezing winter of 2014, when Lindsay came to visit—the first time I’d seen her since Hawaii.

From the moment she arrived, my world was hers. Previously, I’d been content to hang around indoors—indeed, that was my preference—but Lindsay was insistent: She’d never been to Russia, and now we were going to be tourists together.

My Russian lawyer, Anatoly Kucherena, who helped me get asylum in the country, arranged two box seats at the Bolshoi Theatre. Lindsay and I got dressed and went, though I have to admit I was wary. There were so many people, all packed so tightly into a hall. Lindsay could sense my growing unease. As the lights dimmed and the curtain rose, she leaned over, nudged me in the ribs, and whispered, “None of these people are here for you. They’re here for this.”

Lindsay and I also spent time at some of Moscow’s museums. At the Tretyakov Gallery, a young tourist, a teenage girl, suddenly stepped between us. This wasn’t the first time I’d been recognized in public, but given Lindsay’s presence, it certainly threatened to be the most headline worthy. In German-accented English, the girl asked whether she could take a selfie with us. I’m not sure what explains my reaction, but without hesitation, for once, I agreed. Lindsay smiled as the girl posed between us and took a photo. Then, after a few sweet words of support, she departed.

I dragged Lindsay out of the museum a moment later. I was afraid that if the girl posted the photo to social media, we could be just minutes away from unwanted attention. I feel foolish now for thinking that. I kept nervously checking online, but the photo didn’t appear. Not that day, and not the day after. As far as I can tell, it was never shared—just kept as a private memory of a personal moment.

Whenever I go outside, I try to change my appearance a bit. Maybe I get rid of my beard; maybe I wear different glasses. I never liked the cold until I realized that a hat and scarf provide the world’s most convenient and inconspicuous anonymity. I change the rhythm and pace of my walk and look away from traffic when crossing the street, which is why I’ve never been caught on any of the car dash cams that are ubiquitous here. Passing buildings equipped with CCTV, I keep my head down, so that no one will see me as I’m usually seen online—head on. I used to worry about the bus and metro, but nowadays everybody’s too busy staring at their phones to give me a second glance. If I take a cab, I’ll have it pick me up at a bus or metro stop a few blocks away from where I live and drop me off at an address a few blocks away from where I’m going.

Today, I’m taking the long way around this vast, strange city, trying to find some roses. Red roses, white roses, even blue violets. Any flowers I can find. I don’t know the Russian names of any of them. I just grunt and point.

Lindsay’s Russian is better than mine. She also laughs more easily and is more patient and generous and kind.

Tonight, we’re celebrating our wedding anniversary. Yes, reader, she married me.