Dark Mirror Page 2
There was no more time to plan. Verax had rung the starting bell. We had the document in hand and no fixed story date. The interlude could be precarious. Verax declined to say where he was, but we knew he had stopped showing up for work. When his employer began to look for him, the risks to his freedom and safety would become acute. Authorities would discover what he took, and they might try to preempt the story. For sure our window for unhindered work would close.
We were trying to slip the gaze of a surveillance giant while peering through its gates. We could not hope to succeed for long, but we bought time every way we could. The urgent email from Poitras that morning had six miles to travel as the crow flies, from Tribeca to upper Manhattan. She dispatched it through anonymous relays around the world, adding thousands of miles of detours to mask her whereabouts. When I logged on, I did the same. We had bought cheap laptops for cash and used privacy tools to spoof their hardware and network addresses. Poitras, Verax, and I encrypted every word. We used no telephones at all. Every contact left a trail—there was no helping that—but we filled it with false footprints.
Before I could make my way downtown, a second email appeared. Same mundane-looking subject line, signaling “urgent.” As the body of her encrypted message crossed the internet, the ciphertext looked like this:
–––––BEGIN PGP MESSAGE–––––
hQIOA7RnVIVebwveEAgA7OBO1qtnQ1mdDTZwU4eI1ZbfF57dLNIb0UxeunqK8q9Zoo9a0iHGjVreqo0YKip/lpX7rohHmA/T038jjgnsF9E6hNahg1ZWcBRabfOxGUxu8Gzxk5H9m+k0dHCqg6EVwAoIWunkghc6jG2p/seNFNCR36vjgCy2BuF47Jc0oKgc[. . .]
–––––END PGP MESSAGE–––––
I plugged in a thumb drive. On it was my private key, a small digital file required to decrypt her message. I typed two passphrases, one to mount the thumb drive and another to enable use of the key. Unscrambled, the new note from Poitras had only eight words.
You need to prepare yourself for this. Jesus.
What in the hell was going on? I canceled a flight to Washington and hustled to the subway, trotting down the staircase double time. As I boarded a downtown 1 train, I pulled the battery from my phone. A smartphone is an excellent tracking device. It works well as a remote-controlled microphone, too, for someone who knows how to switch it on.
* * *
—
The first time I met Laura Poitras, three days before Christmas 2010, she turned up unannounced at my office, just off Washington Square. Karen Greenberg, a mutual friend who ran a lively policy salon at New York University Law School, kept telling us we should meet. Greenberg had offered me a fellowship when I quit the Washington Post. My new office came with a coffee mug bequeathed to me by the once and future Pentagon official Michael Sheehan. On its side, the mug featured a smiling, square-jawed World War II soldier, java in hand. “How about a nice big cup of shut the fuck up?” the GI said. Secrecy culture, circa 1944, never out of style.
I did not think to ask Poitras how she had made her way to me without a call from security or the fussy receptionist upstairs. That night she let me know I had missed some kind of a scene. “I feel a little bad I had to freak out Karen’s staff to get to you,” she wrote.
Unsurprising, if her press clippings were to be believed. At age forty-six, she was an Oscar-nominated, Peabody-winning force of nature, prone to shouldering a camera through war zones without a crew. Politics on the radical side. “Intense” and “relentless,” the profile writers said. Grew up near Boston, trained as a chef, then turned to film. Her breakthrough film, My Country, My Country, traced the failed attempt to install democracy under U.S. occupation in Iraq. PBS had just broadcast her latest, The Oath, an alternating narrative of Osama bin Laden’s former bodyguard, now a cabdriver in Yemen, and his brother-in-law, a prisoner at the U.S. military detention center at Guantánamo Bay.
Blowback from the Iraq film brought her to me. For four years, since the documentary’s debut in 2006, she had been pulled aside for interrogation and search every time she crossed a U.S. border. Typically, Customs and Border Patrol officers held her for hours, stating no reason. They paged through her notebooks, copied video footage from her memory cards, and sometimes “detained” (that was the legal euphemism) her electronic devices. At New York’s John F. Kennedy Airport that summer, she later recounted, they had “confiscated my laptop, video camera, footage, and cellphone” and held them for forty-one days. At least once they acknowledged making a full forensic image of her laptop, a bit-by-bit copy they could keep forever and use, among other things, to recover deleted files.
I found all that appalling, beginning with the U.S. government’s pretense that computers and smartphones were “containers” no different from a purse or a duffel bag. Seizing, copying, and keeping hundreds of thousands of personal and professional files, by this baroque logic, was no greater intrusion than searching a suitcase for undeclared bottles of scotch. Long precedent held that the Fourth Amendment’s requirement of probable cause did not apply to searches at the border, where authorities needed leeway to defend against security threats and enforce customs laws. The government made a broader claim, far more hostile to common sense and the foundational right of a citizen to be left alone. There was no such thing, the government argued, as an “unreasonable” border search because customs agents could be as arbitrary as they liked about search and seizure. They did not need any reason at all. King George could have embraced the claim verbatim. Federal judges had only just begun to question it.
Poitras had heard that my old newsroom colleagues saw me as an eccentric on privacy, the guy who encrypted his notes and set up spooky online accounts. Possibly I wore a tinfoil sleeping cap to ward off hostile radio beams. To me the need for precautions was apparent. Journalists, same as everyone else, had accepted the gifts of the internet without considering their price. Mobile phones, web browsing, email, and messaging left long trails of data about whom we talked to, when we spoke, where we met, and what we talked about. Changing laws and technology gave the government more access to that data trove with less oversight. Large private employers deployed comparable tools at company scale, enabling them to look over the shoulders of employees at will. Some story targets tried to squelch leaks by hiring private investigators to dig up our communications records. Journalists pledged not to reveal our confidential sources, but we were allowing adversaries to pluck them from our digital exhaust. It had been years since I kept my notes where anyone else, even bosses I trusted, could read them. “The cloud,” as the security analyst Graham Cluley put it, was just another word for “somebody else’s computer.” When you left information there, you gave up control.
Poitras wanted to know how to defend herself. Ordinarily, I would start a conversation like that by asking what she wanted to protect and who she thought was after it. Poitras already knew she had a world-class adversary. That was not good news, but even the U.S. government had to budget time, money, and scarce technical resources. It could not pull out all the stops for everyone on a watch list. Until now, Poitras had been a cheap target, traveling with naked data. She could make herself much more expensive with file encryption. Meanwhile, about that laptop they copied? Had she changed the passwords on her email and online accounts? She had.
That night I sent her what purported to be “a quick note for further reading.” In fact, all self-restraint failed. My thousand-word email was thick with links and recipes for an alphabet soup of software tools: GPG, TrueCrypt, OTR, SOCKS proxies, Tor. It is not hard to see, in retrospect, why my colleagues seldom asked for this kind of advice.
Many of the methods I commended to Poitras had their origins with the cypherpunks of the 1990s, a liberty-minded (and therefore leaderless) collective of visionaries and technologists. In the infancy of the internet, the cypherpunks set out to protect it from censorship, surveillance, and other forms of untoward state control. One of them, John Perry Barlow, a former Grateful Dead lyricist and cofounder of the Electronic Frontier Foundation, wrote a decl
aration of independence, warning governments at large (“you weary giants of flesh and steel”) that “you are not welcome among us.” In “A Cypherpunk’s Manifesto,” Eric Hughes announced an action plan: “We know that someone has to write software to defend privacy, and since we can’t get privacy unless we all do, we’re going to write it.”
That is what they did. They wrote the software, and the software worked, and they gave it away for free. Even the U.S. Naval Research Laboratory, which invented “onion routing” to enable anonymous communications online, released the software and its underlying code for free public use. “Preserving privacy means not only hiding the content of messages, but also hiding who is talking to whom,” wrote the authors of the laboratory’s breakthrough technical paper.
With tools like these, anyone could read and write and meet on the internet without censorship or fear, cloaked in the elegant mathematics of cryptography. Anyone could, and hardly anyone did. Muggles did not treat with the conjurings of wizards. Not many heard tell of such arcana; fewer had the motive or patience to master them. I took a certain nerdy pleasure in the effort, and I had strong incentives as a journalist covering secret diplomacy, intelligence, and war. I started using GPG, the gold standard of email and file encryption, in 2006—not long after Time magazine overrode a reporter’s objections and handed his notes to prosecutors in the criminal case against Vice President Dick Cheney’s chief of staff. I counted Werner Koch, who wrote the software and maintains it still, among the great contributors to civil society.
And still it had to be said: GPG was so hard to navigate that even experts foundered on its novella-sized user guide. The manual could swallow Robert Louis Stevenson’s tale of Jekyll and Hyde with two thousand words to spare. The punch line of that joke wrote itself, but I had no better advice to offer Poitras. Maybe the best tip I sent her was “You should probably have a more experienced adviser.” Today, I should mention, there are easier tools, though not easy enough. I keep an updated list at gellman.us/pgp.
* * *
—
Our collaboration on the NSA story began two years later, on January 31, 2013, when Poitras wrote to say she was passing through New York.
“Do you have time to grab a coffee in the next few days?” she asked. “I could use some advice.” The invitation was not as casual as it looked. An encrypted note followed, asking me to leave my mobile phone behind. Two days later, at Joe, the pocket-sized espresso bar I picked out, she made a face at the tightly spaced tables and said we had better try elsewhere. We switched venues twice more before she found one private enough. She had my attention.
Poitras made small talk until our server brought food and drink. By habit, I pulled out a Moleskine notebook. She shook her head, and I put it away. A nameless informant had come to her, she said, describing himself as a member of the U.S. intelligence community. She did not tell me so at the time, but their conversation had begun five days before. The NSA, by the anonymous correspondent’s account, had built a surveillance machine of such breadth and power that it placed American democracy at risk. He could supply proof, but not yet.
Not a promising start. I kept a poker face, I think, but few subjects in my experience matched the allure of an intelligence plot to delusional tipsters. After writing about warrantless domestic surveillance in my last book, I had been swarmed with letters in spidery script and voicemails that kept going until they filled my queue. Poitras’s source did not sound like a crackpot, but there was another kind of story tip that many reporters file under “Important if True.” This kind of tip sounded plausible, newsworthy if genuine, but by its nature the story was out of reach. I could imagine what proof might look like, but it would take a subpoena or, well, a wiretap to reach it. There might be gold in those files, but you could spend a career looking.
I thought about cautioning Poitras, then caught myself. It was a bad habit. Journalists, like cops and trial lawyers, liked to think we had special instincts for truth. Bullshit detectors. I was not immune to the fantasy, but science offered scant support. In controlled experiments, professional investigators did no better than a coin toss at picking out truth and lies. For sure, I had nothing to boast about. Over the years, I had placed faith where it did not belong and missed or dismissed facts that did not fit my experience. One of my most disquieting flops came on a West Bank hilltop in June 1995, when I interviewed an Israeli settler named Yigal Amir. By then, Amir was already stalking Prime Minister Yitzhak Rabin. Five months later, he edged close enough to put two bullets in Rabin’s back. No spider sense tingled as I spoke to him. I dismissed the assassin’s dark words as cliché. Calling Rabin a traitor, pissing into a hole marked “Oslo Agreement”—that was theater, commonplace among religious nationalists of his stripe. I had met hundreds like him, I thought.
I shut up and took another bite of burger, leaving the floor to Poitras. I could easily have blown the moment with a casual joke. The Poitras I came to know was a stern judge of colleagues who did not share her ferocious sense of mission. As our conversation went on, in any case, I liked what I heard. The source had not shown Poitras all his cards, and Poitras kept some from me, but he spoke fluently in the languages of signals intelligence and communications networks. I thought I heard a weakness for high rhetoric, but Poitras said the source wrote with precision about matters of fact. His willingness to say “I don’t know” encouraged us both. Another small measure of credence came when he lapsed from plain English into shoptalk without appearing to notice. That was the way of many closed tribes and not easy to fake.
Poitras hoped I might recognize some of the jargon. Had I heard of BOUNDLESSINFORMANT? I had not, but I loved its pitch-perfect tone of earnest overreach, ambitious with a touch of sinister. How about SSO? I was pretty sure that stood for Special Source Operations, something to do with NSA access to equipment under friendly corporate control. What did her source mean by DNR? CNO? No idea. All I came up with were “do not resuscitate” and “chief of naval operations,” which were comically inapt. (Correct answers, gleaned later: “dialed number recognition” and “computer network operations.”) NSANet? Yes, I knew that one. It was the agency’s secure global intranet, connecting thirty thousand employees to shared intelligence community resources such as a Top Secret reference site modeled on Wikipedia.
Was her source the whistleblower he claimed to be? A fabricator who used public records to feign inside knowledge? A real intelligence analyst peddling fake intrigue? A half-informed official who misread something benign? I told Poitras I thought I could narrow the possibilities. In research for Angler, my book on Cheney, I had left out small details I learned about the NSA. They were too technical for my purposes, or I did not understand them in context, or they had no connection to events I wrote about. If the source knew what I knew, that might mean something. If he filled in the gaps, or made persuasive corrections, so much the better.
Poitras asked what I thought of combining forces if the story panned out. Print and film had complementary strengths, she said. Neither of us committed in that first meeting, but I was intrigued. As time went on, Poitras passed questions and replies among us. Every exchange chipped away at our doubts. By spring, the two of us were partners. Everything would depend on the written evidence, I wrote to her in early May, but I had reached a turning point.
If this guy was not for real, I wrote, “I will be very surprised.”
* * *
—
When Poitras introduced us, Verax needed convincing about me. He was suspicious of the Washington Post, where I grew up as a journalist. He knew it chiefly by its opinion pages, where op-ed columns and unsigned editorials—the voice of the publisher—denounced WikiLeaks, pressed for war in Iraq, and defended other excesses, as he saw them, of President George W. Bush’s “global war on terror.” Verax wanted “adversarial” voices to tell his story, and he had chosen them already. Poitras had proved herself both a skeptic and a target of th
e wartime establishment, and her short film on another NSA critic had caught Verax’s attention. The Guardian columnist Glenn Greenwald had built his brand as a dogged combatant against the national security state and its apologists. Months of effort, however, had failed to elicit a reply from Greenwald, who disregarded emails from Verax and a how-to video on encryption.
I did not fit the outsider mold. I was a card-carrying member of the mainstream media, and I made no pretense that I would join a campaign for Verax or his cause. On the other hand, I had been digging into domestic surveillance for years. My case to Verax rested on two claims: that I was well positioned, with years of sources, to report beyond the documents themselves, and that straight-up reporting of new disclosures had unequaled power to hold the government to account.
Verax goaded me, probably on purpose, by suggesting that only a fearless dissenter like Greenwald could expose the truth. I took the bait. I knew Greenwald slightly, having tried and failed to moderate him on a 2010 panel titled “The Constitution and National Security.” I had seldom shared the stage with a less tractable panelist. He was clearly intelligent, I told Verax, and a great debunker of hypocrites. He demanded evidence for official claims, which I admired. Like his opponents, he was also selective about it. I thought it better suited a litigator than a news reporter to fix his attention on facts that fit his argument.