BENGALURU: Read, Write, Execute: in computing, these are called permissions. Functionally speaking, they determine the extent of your authority within a computer or computer network, defining what exactly you can and cannot do. The right to read a file allows you to access its contents, while the right to write a file allows you to modify it. Execution, meanwhile, means that you have the ability to run a file or program, to carry out the actions it was designed to do.
Read, Write, Execute: this was my simple three-step plan. I wanted to burrow into the heart of the world’s most secure net-work to find the truth, make a copy of it, and get it out into the world. And I had to do all this without getting caught—without being read, written, and executed myself.
Almost everything you do on a computer, on any device, leaves a record. Nowhere is this more true than at the NSA. Each log-in and log-out creates a log entry. Each permission I used left its own forensic trace. Every time I opened a file, every time I copied a file, that action was recorded. Every time I downloaded, moved, or deleted a file, that was recorded, too, and security logs were updated to reflect the event. There were network flow records, public key infrastructure records—people even joked about cameras hidden
in the bathrooms, in the bathroom stalls. The agency had a not inconsiderable number of counterintelligence programs spying on the people who were spying on people, and if even one caught me doing something I wasn’t supposed to be doing, it wouldn’t be a file that was getting deleted.
Luckily, the strength of these systems was also their weakness: their complexity meant that not even the people running them necessarily knew how they worked. Nobody actually understood where they overlapped and where their gaps were. Nobody, that is, except the systems administrators. After all, those sophisticated monitoring systems you’re imagining, the ones with scary names like MIDNIGHTRIDER—somebody’s got to install them in the first place. The NSA may have paid for the network, but sysadmins like myself were the ones who really owned it.
The Read phase would involve dancing through the digital grid of tripwires laid across the routes connecting the NSA to every other intelligence agency, domestic and foreign. (Among these was the NSA’s UK partner, the Government Communications Headquarters, or GCHQ, which was setting up dragnets like OPTICNERVE, a program that saved a snapshot every five minutes from the cameras of people video-chatting on platforms like Yahoo Messenger, and PHOTONTORPEDO, which grabbed the IP addresses of MSN Messenger users.) By using Heartbeat to bring in the documents I wanted, I could turn “bulk collection” against those who’d turned it against the public, effectively Frankensteining the IC.
The agency’s security tools kept track of who read what, but it didn’t matter: anyone who bothered to check their logs was used to seeing Heartbeat by now. It would sound no alarms. It was the perfect cover.
But while Heartbeat would work as a way of collecting the files—far too many files—it only brought them to the server in Hawaii, a server that kept logs even I couldn’t get around. I needed a way to work with the files, search them, and discard the irrelevant and uninteresting, along with those containing legitimate secrets that I wouldn’t be giving to journalists. At this point, still in my Read phase, the hazards were manifold, due mainly to the fact that the protocols I was up against were no longer geared to monitoring but to prevention. If I ran my searches on the Heartbeat server, it would light a massive electronic sign blinking arrest me.
Excerpted from Permanent Record by Edward Snowden, with permission from Pan Macmillan Publishing
India Private Limited