Snowden – Five Years Later

Edward Snowden has no regrets five years on from leaking the biggest cache of top-secret documents in history.

He is wanted by the US. He is in exile in Russia. But he is satisfied with the way his revelations of mass surveillance have rocked governments, intelligence agencies and major internet companies.

In a phone interview to mark the anniversary of the day the Guardian broke the story, he recalled the day his world, and that of many others around the globe, changed for good. He went to sleep in his Hong Kong hotel room and when he woke, the news that the National Security Agency had been vacuuming up the phone data of millions of Americans had been live for several hours.

Snowden knew at that moment his old life was over. “It was scary but it was liberating,” he said. “There was a sense of finality. There was no going back.”

What has happened in the five years since? He is one of the most famous fugitives in the world, the subject of an Oscar-winning documentary, a Hollywood movie, and at least a dozen books.

The US and UK governments, on the basis of his revelations, have faced court challenges to surveillance laws. New legislation has been passed in both countries. The Internet companies, responding to a public backlash over privacy, have made encryption commonplace.

Snowden, weighing up the changes, said some privacy campaigners had expressed disappointment with how things have developed, but he did not share it. “People say nothing has changed: that there is still mass surveillance. That is not how you measure change. Look back before 2013 and look at what has happened since. Everything changed.”

The most important change, he said, was public awareness. “The government and corporate sector preyed on our ignorance. But now we know. People are aware now. People are still powerless to stop it but we are trying. The revelations made the fight more even.”

He said he had no regrets. “If I had wanted to be safe, I would not have left Hawaii (where he had been based, working for the NSA, before flying to Hong Kong).”

His own life is uncertain, perhaps now more than ever, he said. His sanctuary in Russia depends on the whims of the Putin government, and the US and UK intelligence agencies have not forgiven him. For them, the issue is as raw as ever, an act of betrayal they say caused damage on a scale the public does not realise.

This was reflected in a rare statement from Jeremy Fleming, the director of the UK surveillance agency GCHQ, which, along with the US National Security Agency. was the main subject of the leak. In response to a question from the Guardian about the anniversary, Fleming said GCHQ’s mission was to keep the UK safe: “What Edward Snowden did five years ago was illegal and compromised our ability to do that, causing real and unnecessary damage to the security of the UK and our allies. He should be accountable for that.”

The anger in the US and UK intelligence communities is over not just what was published, fewer than 1% of the documents, but extends to the unpublished material too. They say they were forced to work on the assumption everything Snowden ever had access to had been compromised and had to be dumped.

There was a plus for the agencies. Having scrapped so much, they were forced to develop and install new and better capabilities faster than planned. Another change came in the area of transparency. Before Snowden, media requests to GCHQ were usually met with no comment whereas now there is more of a willingness to engage. That Fleming responds with a statement reflects that step change.

In his statement, he expressed a commitment to openness but pointedly did not credit Snowden, saying the change predated 2013. “It is important that we continue to be as open as we can be, and I am committed to the journey we began over a decade ago to greater transparency,” he said.

Others in the intelligence community, especially in the US, will grudgingly credit Snowden for starting a much-needed debate about where the line should be drawn between privacy and surveillance. The former deputy director of the NSA Richard Ledgett, when retiring last year, said the government should have made public the fact there was bulk collection of phone data.

The former GCHQ director Sir David Omand shared Fleming’s assessment of the damage but admitted Snowden had contributed to the introduction of new legislation. “A sounder and more transparent legal framework is now in place for necessary intelligence gathering. That would have happened eventually, of course, but his actions certainly hastened the process,” Omand said.

The US Congress passed the Freedom Act in 2015, curbing the mass collection of phone data. The UK parliament passed the contentious Investigatory Powers Act a year later.

Ross Anderson, a leading academic specialising in cybersecurity and privacy, sees the Snowden revelations as a seminal moment. Anderson, a professor of security engineering at Cambridge University’s computer laboratory, said:
“Snowden’s revelations are one of these flashbulb moments which change the way people look at things. They may not have changed things much in Britain because of our culture for adoring James Bond and all his works. But around the world it brought home to everyone that surveillance really is an issue.”

MPs and much of the UK media did not engage to the same extent of their counterparts elsewhere in Europe, the US, Latin America, Asia and Australia. Among the exceptions was the Liberal Democrat MP Julian Huppert, who pressed the issue until he lost his seat in 2015. “The Snowden revelations were a huge shock but they have led to a much greater transparency from some of the agencies about the sort of the things they were doing,” he said.

One of the disclosures to have most impact was around the extent of collaboration between the intelligence agencies and internet companies. In 2013, the US companies were outsmarting the EU in negotiations over data protection. Snowden landed like a bomb in the middle of the negotiations and the data protection law that took effect last month is a consequence.

One of the most visible effects of the Snowden revelations was the small yellow bubble that began popping up on the messaging service WhatsApp in April 2016: “Messages to this chat and calls are now secured with end-to-end encryption.”

Before Snowden, such encryption was for the targeted and the paranoid. “If I can take myself back to 2013,” said Jillian York, the director for international freedom of expression at the digital rights group the Electronic Frontier Foundation, “I maybe had the precursor to [the encrypted communication app] Signal on my phone, TextSecure. I had [another email encryption tool] PGP, but nobody used it.” The only major exception was Apple’s iMessage, which has been end-to-end encrypted since it was launched in 2011.

Developers at major technology companies, outraged by the Snowden disclosures, started pushing back. Some, such as those at WhatsApp, which was bought by Facebook a year after the story broke, implemented their own encryption. Others, such as Yahoo’s Alex Stamos, quit rather than support further eavesdropping. Stamos is now the head of security at Facebook.

“Without Snowden,” said York. “I don’t think Signal would have got the funding. I don’t think Facebook would have had Alex Stamos, because he would have been at Yahoo. These little things led to big things. It’s not like all these companies were like “we care about privacy”. I think they were pushed.”

Other shifts in the technology sector show Snowden’s influence has in many ways been limited. The rise of the “smart speaker”, exemplified by Amazon’s Echo, has left many privacy activists baffled. Why, just a few years after a global scandal involving government surveillance, would people willingly install always-on microphones in their homes?

“The new-found privacy conundrum presented by installing a device that can literally listen to everything you’re saying represents a chilling new development in the age of internet-connected things,” wrote Gizmodo’s Adam Clark Estes last year.

Towards the end of the interview, Snowden recalled one of his early aliases, Cincinnatus, after the Roman who after public service returned to his farm. Snowden said he too felt that, having played his role, he had retreated to a quieter life, spending time developing tools to help journalists protect their sources. “I do not think I have ever been more fulfilled,” he said.

But he will not be marking the anniversary with a “victory lap”, he said. There is still much to be done. “The fightback is just beginning,” said Snowden. “The governments and the corporates have been in this game a long time and we are just getting started.”

Guardian

You Might Also Read:

Russia Faces US Request To Extradite Snowden:

British Police Continue A Secret Snowden Investigation:

« Big Data Becomes Everyone's Job
China Dominates Global Investment In AI »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

International Telecommunication Union (ITU)

International Telecommunication Union (ITU)

ITU is the United Nations specialized agency for information and communication technologies – ICTs. Areas of activity include cybersecurity.

OEDIV SecuSys

OEDIV SecuSys

OEDIV SecuSys (formerly iSM Secu-Sys) develops high-quality IT software solutions, setting standards as a technology leader in the area of identity and access management.

Cofrac

Cofrac

Cofrac is the national accreditation body for France. The directory of members provides details of organisations offering certification services for ISO 27001.

InfoLock

InfoLock

Infolock are experts in data governance, providing consulting and advisory services that help organizations effectively secure, manage, and optimize their data.

SafeTech Informatics & Consulting

SafeTech Informatics & Consulting

Safetech's OTShield detects, prevents and analyses cyber-attacks in SCADA and Industrial IoT systems by utilising state of the art deception techniques.

Edureka

Edureka

Edureka is an online technology training provider with the most effective learning system in the world. We help professionals learn trending technologies for career growth.

Logit.io

Logit.io

Logit.io is a log analysis & management platform that provides a scalable solution for hosting the open-source tools Elasticsearch, Logstash, and Kibana.

blueAllianceIT

blueAllianceIT

blueAlliance IT is an investment and growth platform that unites local MSP and IT companies around the nation, helping them to grow and operate competitively.

RMRF Tech

RMRF Tech

RMRF is a team of cybersecurity engineers and penetration testers which specializes in the development of solutions for early cyber threat detection and prevention.

Concourse Labs

Concourse Labs

Concourse Labs Security Guardrails continuously verify cloud infrastructure and workloads. Continuously assess clouds for security, resiliency, and regulatory compliance.

Trenton Systems

Trenton Systems

Trenton Systems are committed to providing high-performance computing solutions to customers running mission-critical applications in harsh settings worldwide and across various industries.

Persistent Systems

Persistent Systems

Persistent Systems are a trusted Digital Engineering and Enterprise Modernization partner, combining deep technical expertise and industry experience to help our clients.

Quantum Security Services

Quantum Security Services

Quantum Security Services is a specialist information security firm providing a range of risk, compliance and technical security services.

Google Cloud

Google Cloud

Accelerate your digital transformation. Whether your business is early in its journey or well on its way to digital transformation, Google Cloud can help solve your toughest challenges.

B2Bcert

B2Bcert

B2BCERT one of the top companies offering ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 27001, ISO 20000,CE Marking, HACCP, and other globally accepted standards and Management solutions.

Zyxel Networks

Zyxel Networks

Zyxel Networks is a leading provider of secure, AI-powered networking solutions for small to medium businesses (SMBs) and the enterprise edge.