How Did Snowden Steal Millions of Documents? He Had Help

Eraldo Peres/AP

AA Font size + Print

We finally know how Edward Snowden pulled off one of the greatest thefts of classified documents in government history. By Dustin Volz

We finally know how Edward Snowden pulled off one of the greatest thefts of classified documents in government history. And he had some help.

The former National Security Agency contractor was aided by three agency “affiliates” in accessing and downloading what have come to be known as the Snowden files, according to a Feb. 10 agency memo first reported on by NBC News’ Michael Isikoff.

One of the affiliates, described as a civilian NSA employee, allowed Snowden to use his personal passwords to access classified information on a server called NSANet. This employee first told the FBI on June 18—just two weeks after the leaks began—that he let Snowden use his log-in information and that he knew those credentials had been denied to the fugitive, who is currently living in Russia after being granted asylum there last year.

Snowden was then able to capture the employee’s password, which granted him “even greater access to classified information.” But the employee “was not aware that Snowden intended to unlawfully disclose” any of the documents, which have been revealed in major publications around the world and have exposed sweeping phone and Internet data collection techniques employed by the NSA and other countries.

Last month, Snowden participated in an online chat and was asked whether he stole password information from any of his colleagues. Snowden shot back that “I never stole any passwords, nor did I trick an army of coworkers.” He also refuted a November Reuters report that said he used the credentials “unwittingly” provided by his colleagues when he worked for contractor Booz Allen Hamilton in Hawaii.

Additionally, the other two “affiliates,” described as a member of the military and another NSA contractor, were barred from accessing agency information beginning in August 2013, according to the memo written by Ethan Bauman, NSA’s director of legislative affairs. But “further accountability will be determined by their individual employer, not the NSA.”

Earlier this week, James Clapper, director of national intelligence, testified before the Senate Armed Services Committee that Snowden had taken advantage of a “perfect storm” of security vulnerabilities and that he “was pretty skilled at staying below the radar, so what he was doing wasn’t visible.”

Our whole system is based on personal trust,” an exasperated Clapper said, adding that there were no “mousetraps” in place to guarantee there wouldn’t be another Edward Snowden.

The NSA has enacted tighter restrictions on when and how agents can access classified documents since Snowden’s heist, including a “two-man rule” requiring two administrators to work jointly when dealing with certain files.

Close [ x ] More from DefenseOne
 
 

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

    Download
  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Top 5 Findings: Security of Internet of Things To Be Mission-Critical

    As federal agencies increasingly leverage these capabilities, government security stakeholders now must manage and secure a growing number of devices, including those being used remotely at the “edge” of networks in a variety of locations. With such security concerns in mind, Government Business Council undertook an indepth research study of federal government leaders in January 2017. Here are five of the key takeaways below which, taken together, paint a portrait of a government that is increasingly cognizant and concerned for the future security of IoT.

    Download
  • Coordinating Incident Response on Posts, Camps and Stations

    Effective incident response on posts, camps, and stations is an increasingly complex challenge. An effective response calls for seamless conversations between multiple stakeholders on the base and beyond its borders with civilian law enforcement and emergency services personnel. This whitepaper discusses what a modern dispatch solution looks like -- one that brings together diverse channels and media, simplifies the dispatch environment and addresses technical integration challenges to ensure next generation safety and response on Department of Defense posts, camps and stations.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download

When you download a report, your information may be shared with the underwriters of that document.