Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not cleared for, i.e., that he should not have been able to access. What do we know about how he was able to access them?

Motivation. I think this case study might have fascinating insights for security against the insider threat. It might help us get a better understanding of what the threats are and how to defend against them. We've all heard the Santayana quote: "Those who cannot remember the past are condemned to repeat it". And, of course, if an insider can get this kind of access inside the NSA -- which I'd hope is one of the most locked-down environments around -- that should really teach us something about the insider threat in other environments. So, I think it'd be helpful for us to understand what technical methods Snowden used to access documents he wasn't authorized to access.

Clarification. There's lots and lots of speculation out there. I want to clarify that I'm looking for what we know about how Snowden did it, rather than your personal guesses/speculation. I would ask that you avoid speculation, and instead stick to facts, citable references, reports from those in a position to know, etc. If you absolutely cannot restrain yourself and must include some speculation in your answer, please make sure that you clearly distinguish between speculation (hypotheses, inferences, etc.) vs what's known (e.g., information that's been confirmed by someone in a position to know).

For instance, it's been widely reported that Snowden was a system administrator, which invites the speculation that maybe he used his administrator privileges to access documents that were being viewed by other users on machines he administered. But do we know that, or is that just speculation? It's also been widely reported that Snowden had some training in security and exploitation, which invites the speculation that maybe he used some sort of technical attacks to defeat certain security mechanisms. But do we know that, or is that just a natural hypothesis? What do we know?

share|improve this question

closed as primarily opinion-based by Lucas Kauffman, Adi, Terry Chia, tylerl, Rory Alsop Nov 9 '13 at 19:24

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

Just to clarify. I'm not looking for opinions: I'm looking for facts, references, public reports, etc. – D.W. Nov 8 '13 at 22:52
Facts from Citizenfour and Frontline United States of Secrets: Snowden had TS SCI PRIVA, which means he had a special kind of privileged access to top-secret information because of the fact the he was a sysadmin. Another fact from those sources is that Snowden infiltrated computers owned by GCHQ, not the NSA directly. If the GCHQ had an equivalent of Intellipedia, Snowden used `wget -m' (similar to Zuckerberg at Harvard gathering pictures, portrayed rather cleanly in The Social Network) – atdre Feb 24 '15 at 2:26

A very new Reuters release notes that:

Former U.S. National Security Agency contractor Edward Snowden used login credentials and passwords provided unwittingly by colleagues at a spy base in Hawaii to access some of the classified material he leaked to the media, sources said.

A handful of agency employees who gave their login details to Snowden were identified, questioned and removed from their assignments, said a source close to several U.S. government investigations into the damage caused by the leaks.

Snowden may have persuaded between 20 and 25 fellow workers at the NSA regional operations center in Hawaii to give him their logins and passwords by telling them they were needed for him to do his job as a computer systems administrator, a second source said.

No way to verify if the sources are being truthful. Although the Reuters provenance is somewhat reassuring, everyone makes mistakes.

share|improve this answer

It's be helpful to weed through all the speculation and pick out just the verifiable facts. Unfortunately, all there is is speculation, the facts are not and probably will never be available to the public. Snowden was an NSA contractor with an extraordinary level of access, which means that essentially everything surrounding this case is classified. So anyone who provides any information at all to the public about what they know happened would be breaking the law to do so.

So instead we have unverified accounts from anonymous sources mixed with a healthy dose of inference and speculation. If Snowden himself gave an interview explaining the details, then we'll have something. But until then, all you'll ever have is what the newspapers print.

share|improve this answer

My understanding is that he worked in some sort of (desktop?) support role, where he frequently had access to other employees' computers as part of his job. Presumably some of these employees had access to sensitive information. Snowden used this access to collect this information which he later leaked.

So basically a spook twist on the timeless IT tradition of trawling your laptop for the porn selfies.

share|improve this answer
Yes, I listed this in the question as an example of a natural piece of speculation. But is there any evidence whether he actually did this or not? What do we know? – D.W. Nov 9 '13 at 6:16
Considering where that information would have to come from, I wouldn't hold my breath. The information from the Reuters article quoted above doesn't seem to be presented as conjecture, though. – bizzyunderscore Nov 9 '13 at 20:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.