No Place to Hide Read online

  C.’s email did not move me to action. Because I had become known for covering stories the rest of the media often ignores, I frequently hear from all sorts of people offering me a “huge story,” and it usually turns out to be nothing. And at any given moment I am usually working on more stories than I can handle. So I need something concrete to make me drop what I’m doing in order to pursue a new lead. Despite the vague allusion to “people out there” I “would like to hear from,” there was nothing in C.’s email that I found sufficiently enticing. I read it but did not reply.

  Three days later, I heard from C. again, asking me to confirm receipt of the first email. This time I replied quickly. “I got this and am going to work on it. I don’t have a PGP code, and don’t know how to do that, but I will try to find someone who can help me.”

  C. replied later that day with a clear, step-by-step guide to the PGP system: Encryption for Dummies, in essence. At the end of the instructions, which I found complex and confusing, mostly due to my own ignorance, he said these were just “the barest basics. If you can’t find anyone to walk you through installation, generation, and use,” he added, “please let me know. I can facilitate contact with people who understand crypto almost anywhere in the world.”

  This email ended with more a pointed sign-off: “Cryptographically yours, Cincinnatus.”

  Despite my intentions, I never created the time to work on encryption. Seven weeks went by, and my failure to do this weighed a bit on my mind. What if this person really did have an important story, one I would miss just because I failed to install a computer program? Apart from anything else, I knew encryption might be valuable in the future, even if Cincinnatus turned out to have nothing of interest.

  On January 28, 2013, I emailed C. to say that I would get someone to help me with encryption and hopefully would have it done within the next day or so.

  C. replied the next day: “That’s great news! If you need any further help or have questions in the future, you will always be welcome to reach out. Please accept my sincerest thanks for your support of communications privacy! Cincinnatus.”

  But yet again, I did nothing, consumed as I was at the time with other stories, and still unconvinced that C. had anything worthwhile to say. There was no conscious decision to do nothing. It was simply that on my always too-long list of things to take care of, installing encryption technology at the behest of this unknown person never became pressing enough for me to stop other things and focus on it.

  C. and I thus found ourselves in a Catch-22. He was unwilling to tell me anything specific about what he had, or even who he was and where he worked, unless I installed encryption. But without the enticement of specifics, it was not a priority to respond to his request and take the time to install the program.

  In the face of my inaction, C. stepped up his efforts. He produced a ten-minute video entitled PGP for Journalists. Using software that generates a computer voice, the video instructed me in an easy, step-by-step fashion how to install encryption software, complete with charts and visuals.

  Still I did nothing. It was at that point that C., as he later told me, become frustrated. “Here am I,” he thought, “ready to risk my liberty, perhaps even my life, to hand this guy thousands of Top Secret documents from the nation’s most secretive agency—a leak that will produce dozens if not hundreds of huge journalistic scoops. And he can’t even be bothered to install an encryption program.”

  That’s how close I came to blowing off one of the largest and most consequential national security leaks in US history.

  * * *

  The next I heard of any of this was ten weeks later. On April 18, I flew from my home in Rio de Janeiro to New York, where I was scheduled to give some talks on the dangers of government secrecy and civil liberties abuses done in the name of the War on Terror.

  On landing at JFK Airport, I saw that I had an email message from Laura Poitras, the documentary filmmaker, which read: “Any chance you’ll be in the US this coming week? I’d love to touch base about something, though best to do in person.”

  I take seriously any message from Laura Poitras. One of the most focused, fearless, and independent individuals I’ve ever known, she has made film after film in the riskiest of circumstances, with no crew or the support of a news organization, just a modest budget, one camera, and her determination. At the height of the worst violence of the Iraq War, she ventured into the Sunni Triangle to make My Country, My Country, an unflinching look at life under US occupation that was nominated for an Academy award.

  For her next film, The Oath, Poitras traveled to Yemen, where she spent months following two Yemeni men—Osama bin Laden’s bodyguard as well as his driver. Since then, Poitras has been working on a documentary about NSA surveillance. The three films, conceived as a trilogy about US conduct during the War on Terror, made her a constant target of harassment by government authorities every time she entered or left the country.

  Through Laura, I learned a valuable lesson. By the time we first met, in 2010, she had been detained in airports by the Department of Homeland Security more than three dozen times as she entered the United States—interrogated, threatened, her materials seized, including her laptop, cameras, and notebooks. Yet she repeatedly decided not to go public with the relentless harassment, fearing that the repercussions would make her work impossible. That changed after an unusually abusive interrogation at Newark Liberty International Airport. Laura had had enough. “It’s getting worse, not better, from my being silent.” She was ready for me to write about it.

  The article I published in the online political magazine Salon detailing the constant interrogations to which Poitras had been subjected received substantial attention, drawing statements of support and denunciations of the harassment. The next time Poitras flew out of the United States after the article ran, there was no interrogation and she did not have her materials seized. Over the next couple of months, there was no harassment. For the first time in years, Laura was able to travel freely.

  The lesson for me was clear: national security officials do not like the light. They act abusively and thuggishly only when they believe they are safe, in the dark. Secrecy is the linchpin of abuse of power, we discovered, its enabling force. Transparency is the only real antidote.

  * * *

  At JFK, reading Laura’s email, I replied immediately: “Actually, just got to the US this morning.… Where are you?” We arranged a meeting for the next day, in the lobby at my hotel in Yonkers, a Marriott, and found seats in the restaurant, At Laura’s insistence, we moved tables twice before beginning our conversation to be sure that nobody could hear us. Laura then got down to business. She had an “extremely important and sensitive matter” to discuss, she said, and security was critical.

  Since I had my cell phone with me, Laura asked that I either remove the battery or leave it in my hotel room. “It sounds paranoid,” she said, but the government has the capability to activate cell phones and laptops remotely as eavesdropping devices. Powering off the phone or laptop does not defeat the capability: only removing the battery does. I’d heard this before from transparency activists and hackers but tended to write it off as excess caution, but this time I took it seriously because it came from Laura. After discovering that the battery on my cell phone could not be removed, I took it back to my room, then returned to the restaurant.

  Now Laura began to talk. She had received a series of anonymous emails from someone who seemed both honest and serious. He claimed to have access to some extremely secret and incriminating documents about the US government spying on its own citizens and on the rest of the world. He was determined to leak these documents to her and had specifically requested that she work with me on releasing and reporting on them. I made no connection at the time to the long-since-forgotten emails I had received from Cincinnatus months earlier. They had been parked at the back of my mind, out of view.

  Laura then pulled several pages out of her purse from two of the emails
sent by the anonymous leaker, and I read them at the table from start to finish. They were riveting.

  The second of the emails, sent weeks after the first, began: “Still here.” With regard to the question at the forefront of my mind—when would he be ready to furnish documents?—he had written, “All I can say is ‘soon.’”

  After urging her to always remove batteries from cell phones before talking about sensitive matters—or, at least, to put the phones in the freezer, where their eavesdropping capability would be impeded—the leaker told Laura that she should work with me on these documents. He then got to the crux of what he viewed as his mission:

  The shock of this initial period [after the first revelations] will provide the support needed to build a more equal internet, but this will not work to the advantage of the average person unless science outpaces law. By understanding the mechanisms through which our privacy is violated, we can win here. We can guarantee for all people equal protection against unreasonable search through universal laws, but only if the technical community is willing to face the threat and commit to implementing over-engineered solutions. In the end, we must enforce a principle whereby the only way the powerful may enjoy privacy is when it is the same kind shared by the ordinary: one enforced by the laws of nature, rather than the policies of man.

  “He’s real,” I said when I finished reading. “I can’t explain exactly why, but I just feel intuitively that this is serious, that he’s exactly who he says he is.”

  “So do I,” Laura replied. “I have very little doubt.”

  Reasonably and rationally, Laura and I knew that our faith in the leaker’s veracity might have been misplaced. We had no idea who was writing to her. He could have been anyone. He could have been inventing the entire tale. This also could have been some sort of plot by the government to entrap us into collaborating with a criminal leak. Or perhaps it had come from someone who sought to damage our credibility by passing on fraudulent documents to publish.

  We discussed all these possibilities. We knew that a 2008 secret report by the US Army had declared WikiLeaks an enemy of the state and proposed ways to “damage and potentially destroy” the organization. The report (ironically leaked to WikiLeaks) discussed the possibility of passing on fraudulent documents. If WikiLeaks published them as authentic, it would suffer a serious blow to its credibility.

  Laura and I were aware of all the pitfalls but we discounted them, relying instead on our intuition. Something intangible yet powerful about those emails convinced us that their author was genuine. He wrote out of a belief in the dangers of government secrecy and pervasive spying; I instinctively recognized his political passion. I felt a kinship with our correspondent, with his worldview, and with the sense of urgency that was clearly consuming him.

  Over the past seven years, I had been driven by the same conviction, writing almost on a daily basis about the dangerous trends in US state secrecy, radical executive power theories, detention and surveillance abuses, militarism, and the assault on civil liberties. There is a particular tone and attitude that unites journalists, activists, and readers of mine, people who are equally alarmed by these trends. It would be difficult, I reasoned, for someone who did not truly believe and feel this alarm to replicate it so accurately, with such authenticity.

  In one of the last passages of Laura’s emails, her correspondent wrote that he was completing the final steps necessary to provide us with the documents. He needed another four to six weeks, and we should wait to hear from him. He assured us that we would.

  Three days later, Laura and I met again, this time in Manhattan, and with another email from the anonymous leaker, in which he explained why he was willing to risk his liberty, to subject himself to the high likelihood of a very lengthy prison term, in order to disclose these documents. Now I was even more convinced: our source was for real, but as I told my partner, David Miranda, on the flight home to Brazil, I was determined to put the whole thing out of my mind. “It may not happen. He could change his mind. He could get caught.” David is a person of powerful intuition, and he was weirdly certain. “It’s real. He’s real. It’s going to happen,” he declared. “And it’s going to be huge.”

  * * *

  After returning to Rio, I heard nothing for three weeks. I spent almost no time thinking about the source because all I could do was wait. Then, on May 11, I received an email from a tech expert with whom Laura and I had worked in the past. His words were cryptic but his meaning clear: “Hey Glenn, I’m following up with learning to use PGP. Do you have an address I can mail you something to help you get started next week?”

  I was sure that the something he wanted to send was what I needed to begin working on the leaker’s documents. That, in turn, meant Laura had heard from our anonymous emailer and received what we had been waiting for.

  The tech person then sent a package via Federal Express, scheduled to arrive in two days. I did not know what to expect: a program, or the documents themselves? For the next forty-eight hours, it was impossible to focus on anything else. But on the day of scheduled delivery, 5:30 p.m. came and went and nothing arrived. I called FedEx and was told that the package was being held in customs for “unknown reasons.” Two days went by. Then five. Then a full week. Every day FedEx said the same thing—that the package was being held in customs, for reasons unknown.

  I briefly entertained the suspicion that some government authority—American, Brazilian, or otherwise—was responsible for this delay because they knew something, but I held on to the far likelier explanation that it was just one of those coincidental bureaucratic annoyances.

  By this point, Laura was very reluctant to discuss any of this by phone or online, so I didn’t know what exactly was in the package.

  Finally, roughly ten days after the package had been sent to me, FedEx delivered it. I tore open the envelope and found two USB thumb drives, along with a typewritten note containing detailed instructions for using various computer programs designed to provide maximum security, as well as numerous passphrases to encrypted email accounts and other programs I had never heard of.

  I had no idea what all this meant. I had never heard of these specific programs before, although I knew about passphrases, basically long passwords containing randomly arranged case-sensitive letters and punctuation, designed to make them difficult to crack. With Poitras deeply reluctant to talk by phone or online, I was still frustrated: finally in possession of what I was waiting for, but with no clue where it would lead me.

  I was about to find out, from the best possible guide.

  The day after the package arrived, during the week of May 20, Laura told me we needed to speak urgently, but only through OTR (off-the-record) chat, an encrypted instrument for talking online securely. I had used OTR previously, and managed to install the chat program, signed up for an account, and added Laura’s user name to my “buddy list.” She showed up instantly.

  I asked about whether I now had access to the secret documents. They would only come to me from the source, she told me, not from her. Laura then added some startling new information, that we might have to travel to Hong Kong immediately, to meet our source. Now I was baffled. What was someone with access to top secret US government documents doing in Hong Kong? I had assumed that our anonymous source was in Maryland or northern Virginia. What did Hong Kong have to do with any of this? I was willing to travel anywhere, of course, but I wanted more information about why I was going. But Laura’s inability to speak freely forced us to postpone that discussion.

  She asked whether I’d be willing to travel to Hong Kong within the next few days. I wanted to be certain that this would be worthwhile, meaning: Had she obtained verification that this source was real? She cryptically replied, “Of course, I wouldn’t ask you to go to Hong Kong if I hadn’t.” I assumed this meant she had received some serious documents from the source.

  But she also told me about a brewing problem. The source was upset by how things had gone thus far, particul
arly about a new turn: the possible involvement of the Washington Post. Laura said it was critical that I speak to him directly, to assure him and placate his growing concerns.

  Within an hour, the source himself emailed me.

  This email came from Verax@. Verax means “truth teller” in Latin. The subject line read, “Need to talk.”

  “I’ve been working on a major project with a mutual friend of ours,” the email began, letting me know that it was he, the anonymous source, clearly referring to his contacts with Laura.

  “You recently had to decline short-term travel to meet with me. You need to be involved in this story,” he wrote. “Is there any way we can talk on short notice? I understand you don’t have much in the way of secure infrastructure, but I’ll work around what you have.” He suggested that we speak via OTR and provided his user name.

  I was uncertain what he had meant about “declining short-term travel”: I had expressed confusion about why he was in Hong Kong but certainly hadn’t refused to go. I chalked that up to miscommunication and replied immediately. “I want to do everything possible to be involved in this,” I told him, suggesting that we talk right away on OTR. I added his user name to my OTR buddy list and waited.

  Within fifteen minutes, my computer sounded a bell-like chime, signaling that he had signed on. Slightly nervous, I clicked on his name and typed “hello.” He answered, and I found myself speaking directly to someone who I assumed had, at that point, revealed a number of secret documents about US surveillance programs and who wanted to reveal more.

  Right off the bat, I told him I was absolutely committed to the story. “I’m willing to do what I have to do to report this,” I said. The source—whose name, place of employment, age, and all other attributes were still unknown to me—asked if I would come to Hong Kong to meet him. I did not ask why he was in Hong Kong; I wanted to avoid appearing to be fishing for information.