The Chain of Custody

By Ekewaka Lono | Oahu Underground

Editorial note: Readers of The Closed Loop and The Architecture of Access will recognize the method here. The scale is national rather than local, but the question is the same: how do institutional failures, adversarial incentives, and multi-actor exploitation produce an outcome that appears coordinated even when the public record does not show a single hand directing every stage? This investigation applies that records-first framework to the Snowden operation.

On June 23, 2013, a thirty-year-old former NSA contractor named Edward Joseph Snowden walked through Hong Kong International Airport carrying a passport the United States had revoked – on paper – the previous day. He boarded Aeroflot flight SU213 to Moscow. WikiLeaks legal adviser Sarah Harrison walked beside him. Today, he holds Russian citizenship.

Between those two facts sits a contested archive of 1.5 million classified documents, the vast majority of which were never published. Custody of the archive passed through at least three sovereign intelligence services and one non-state organization with documented ties to Russian state media. It came to rest inside a quarter-billion-dollar media venture that shuttered its archive research team in 2019 without publishing roughly 99 percent of the material it held ^{1 2}. The documents that did reach public view revealed the NSA’s bulk telephony metadata collection under Section 215 of the Patriot Act, the PRISM program for collecting internet communications from technology companies under Section 702 of the Foreign Intelligence Surveillance Act, and upstream collection of data transiting fiber-optic cables. These disclosures produced the USA FREEDOM Act of 2015, which ended the government’s bulk collection of domestic phone records – a genuine legislative reform. But they were a fraction of what Snowden took. The question of what happened to the rest, who controlled it, and who benefited from that control has never been satisfactorily answered.

The public debate has been conducted as a referendum on one man’s conscience: was he a whistleblower or a spy? The binary is useful to both sides and clarifying to neither. It obscures the structural questions – about institutional failure, about multi-actor exploitation, about the privatization of classified archives – that the documentary record raises more insistently than any question about motivation.

This article is a reconstruction from the unclassified record. It draws on the declassified executive summary of the House Permanent Select Committee on Intelligence (HPSCI) review, the Department of Justice’s official statements, Hong Kong government press releases, primary diplomatic correspondence, congressional testimony, court filings, and the published reporting of named journalists with access to the underlying material. It evaluates three competing hypotheses about the nature of the Snowden operation. It does not claim to resolve them. The classified record – a 36-page HPSCI report with 230 footnotes, a separate Intelligence Community damage assessment, and the operational files of at least two foreign intelligence services – almost certainly tells a more complicated story than any open-source analysis can reconstruct. What follows is the best approximation the publicly available documentation permits.

Seventy-Two Hours

The window between the unsealing of charges against Snowden and his departure from Hong Kong lasted roughly forty-eight hours. The diplomatic and legal maneuvering within that window set the pattern for everything that followed: contested timelines, bureaucratic friction deployed as cover, and information asymmetries that consistently favored the fugitive.

The Timeline

Sources: DOJ statement, June 26, 2013 ³; HKSAR Government statement, June 23, 2013 ⁴; HK Immigration Department press releases, June 24 and June 27, 2013 ^{5 6}; HK Department of Justice statement, June 25, 2013 ⁷; ABC News, June 23, 2013 ⁸; The Guardian, June 23, 2013 ⁹.

The timeline invites a question that neither Washington nor Hong Kong has answered: how did forty-eight hours of procedural friction align so precisely with the operational requirements of an evacuation?

The Passport Paradox

The record contains three mutually inconsistent official claims about the passport revocation notification.

The U.S. State Department Operations Center notified Hong Kong authorities of the revocation on June 22, 2013. ABC News reported that the notification occurred but flagged uncertainty about “whether notification happened in time before Snowden fled” ⁸.

Hong Kong Immigration stated on June 24 – one day after Snowden’s departure – that it had received “no notification” from the United States about the passport revocation ⁵.

Hong Kong Immigration confirmed on June 27 – four days after departure – that it had received the revocation notification ⁶.

These claims can be partially reconciled without positing an inside leak. The U.S. Consulate may have notified one Hong Kong authority (such as the Department of Justice) while the Immigration Department and airport border systems did not receive or act on the information before departure. Regardless: Snowden passed through immigration and boarded a commercial flight on a passport that the issuing country had formally cancelled.

Whether Aeroflot accepted the revoked passport because its systems did not reflect the revocation, or because a state-level authority instructed the airline to board the passenger regardless, is not established in the publicly available documentation. A Times of Israel report quoted an unnamed U.S. official suggesting that a “senior official” in a country or airline could “overlook” a withdrawn passport ¹⁰. The verb “overlook” carries weight: it implies a conscious decision to ignore information rather than an absence of information. No public document attributes explicit authorization to Aeroflot or any state body.

The plane departed at 10:55 a.m. Hong Kong time. The question of who authorized the boarding has never been answered.

The Middle-Name Discrepancy

Hong Kong’s Secretary for Justice Rimsky Yuen Kwok-keung offered a specific justification for the delay: the U.S. documents alternately referred to “Edward James Snowden” and “Edward J. Snowden,” while Hong Kong records listed the subject as “Edward Joseph Snowden.” The DOJ called this a pretext. Whether it was a genuine bureaucratic confusion or a manufactured rationale for inaction, the discrepancy created the procedural gap through which Snowden departed ^{7 3}.

One detail: the wrong middle name. That was enough.

The “Backseat Driver”

Albert Ho Chun-yan, the Hong Kong legislator and human rights lawyer who advised Snowden during his stay, provided testimony to ABC News that introduced a direct Chinese state actor into the departure sequence.

On Saturday, June 22 – one day before Snowden’s flight – Ho said Snowden was visited by “an intermediary with a degree of authority from the Chinese side” who told him to leave and “assured him he could leave without interruption.” Ho stated to ABC News: “I think Beijing is the backseat driver, and the Hong Kong government just pretends to be in control of the wheel sitting on the front seat” ⁸.

The statement reveals as much about the architecture of Hong Kong’s autonomy as it does about Snowden’s departure. A legislator and human rights lawyer – not a dissident, not a foreign analyst, but a member of the local establishment – assessed that his own government was performing sovereignty rather than exercising it. A member of Ho’s legal team, at the airport on the morning of June 23, observed “three to four people, keeping a distance, and close surveillance of the situation” ⁸.

Senator Dianne Feinstein, then chair of the Senate Intelligence Committee, stated to the Washington Post on June 23, 2013: “China clearly had a role in this, in my view. I don’t think this was just Hong Kong without Chinese acquiescence” ¹¹.

The Hong Kong government’s public posture – that it lacked sufficient legal basis to detain Snowden – rested on a bureaucratic claim about treaty compliance. The DOJ rejected that claim in its June 26 statement, asserting that all treaty requirements had been met ³. The dispute was never adjudicated because there was no one to adjudicate it to: Snowden was gone. The procedural friction had served its purpose. Whether the friction was genuine – a product of the institutional gaps between U.S. and Hong Kong legal systems – or manufactured to provide cover for a decision already made is a question the public record raises but cannot answer.

The middle-name discrepancy, the delayed passport notification, the sudden request for “additional information” after a week of silence: each, in isolation, admits of an innocent explanation. Together, they describe a system that consistently failed in a single direction.

Russian Contact in Hong Kong

On September 4, 2013, at the G-20 summit in St. Petersburg, Russian President Vladimir V. Putin stated publicly that he had been informed of Snowden’s presence and intentions. Putin’s phrasing, as reported by the Los Angeles Times and NBC News, was that Snowden had met with Russian “diplomatic representatives” while in Hong Kong ¹². In a separate appearance, Putin said: “I was informed that there was such a man, agent of special services,” and that he was told of Snowden’s flight “two hours before the plane landed” in Moscow ¹³.

Putin stated that Russia “did not work with” Snowden. Whether the Russian president’s characterization of the contact as involving “diplomatic representatives” rather than intelligence officers reflects an accurate description or a diplomatic euphemism is not determinable from the public record.

The Russian head of state confirmed pre-departure contact between his government’s representatives and a fugitive carrying 1.5 million classified U.S. documents. That much is not in dispute.

The Kommersant Report

On August 26, 2013, the Russian newspaper Kommersant reported, citing an anonymous Russian official, that Snowden had spent “only two days” at the Russian Consulate in Hong Kong, reportedly around June 21, “on Snowden’s initiative” ¹⁴. If accurate, this places Snowden inside a Russian diplomatic facility two days before his departure – contemporaneous with the unsealing of charges and the Hong Kong government’s sudden request for “additional information.”

The HPSCI Finding

The December 2016 declassified executive summary of the HPSCI review stated: “Since Snowden’s arrival in Moscow, he has had, and continues to have, contact with Russian intelligence services” ¹⁵. This is an official assertion by a bipartisan congressional committee with access to the underlying classified intelligence. The specific evidentiary basis – whether signals intelligence, human intelligence, or technical surveillance – remains classified.

In 2016, the deputy chairman of the Russian parliament’s defense and security committee publicly conceded that “Snowden did share intelligence” with the Russian government ¹⁶. Anatoly G. Kucherena, the Russian lawyer who has represented Snowden and managed his asylum application since July 2013, maintains what the Senate Intelligence Committee’s Volume 5 report described as profound Kremlin ties; the report identified him as a conduit for the Federal Security Service (FSB) ¹⁷.

Snowden’s Denial

In a January 22, 2014 interview with the New Yorker, carried by KCUR, Snowden stated: “I clearly and unambiguously acted alone, with no assistance from anyone, much less a government,” and called allegations of Russian intelligence collusion “absurd” ¹⁸. His ACLU attorney, Ben Wizner, stated in January 2014: “Every news organization in the world has been trying to confirm that story. They haven’t been able to, because it’s false” ¹⁹.

The denial stands against Putin’s own public admission and the HPSCI’s classified finding of ongoing intelligence contact. The unclassified record cannot resolve the contradiction.

The WikiLeaks Pipeline

Upon departing Hong Kong, the logistics of Snowden’s movement were assumed by WikiLeaks. The organization provided personnel, legal coordination, travel documentation, transportation, and a sustained physical presence in Moscow that lasted nearly five months.

Sarah Harrison, a British journalist and one of Julian P. Assange’s closest advisers, traveled to Hong Kong and accompanied Snowden on Aeroflot SU213 to Moscow on June 23, 2013 ^{15 20}. She was not a passive companion. WikiLeaks deployed its legal director, former Spanish judge Baltasar Garzon, to manage international communications, connecting legal teams and brokering asylum requests with Ecuador, Venezuela, and Bolivia ⁹.

Harrison stated publicly: “I was travelling with him on our way to Latin America when the United States revoked his passport, stranding him in Russia” ²¹. This framing – that the intended destination was Latin America, not Moscow – is consistent with the documented attempt to continue onward. Snowden held a confirmed seat on Aeroflot SU150 to Havana for June 24. The flight departed. His seat was empty. Journalists who had booked the flight in anticipation of covering his transit watched the plane push back from the gate. He never boarded. Russian sources told Kommersant that Cuba had been pressured by Washington not to accept him ¹⁴. But a ticketed onward route is not the same thing as a politically real destination: by the time Snowden boarded a Russian state carrier after documented Russian diplomatic contact in Hong Kong, Moscow was already the only node in the chain backed by immediate state protection. Whether the Latin American route was a genuine plan or operational cover remains contested.

Harrison remained at Snowden’s side in Moscow’s Sheremetyevo airport transit zone for 39 days, until Russia granted temporary asylum on August 1, 2013 ^{20 22}. She did not leave Moscow until November 2, 2013 ²³. The HPSCI report documented her presence and duration ¹⁵.

Ecuador and the Travel Document

On June 22, 2013, one day before Snowden’s departure, Ecuador’s London consul Fidel Narvaez issued Snowden an emergency travel document, reportedly at Assange’s request from the Ecuadorian embassy in London where Assange was then sheltering ²⁴. Ecuador’s Foreign Minister Ricardo Patino confirmed that Snowden had applied for asylum ²⁵. The Ecuadorian government subsequently distanced itself from the document, and no Latin American country ultimately granted Snowden entry.

The Morales Incident

On July 2, 2013, Bolivian President Evo Morales’ plane was forced to land in Vienna after France, Spain, Portugal, and Italy denied overflight permissions based on suspicion that Snowden was aboard ²⁶. He was not.

The diplomatic fallout was immediate. Bolivia, Argentina, Ecuador, Uruguay, and Venezuela issued joint condemnations. The Organization of American States convened an emergency session. Bolivia’s UN ambassador called it “a kidnapping of the president.” Four European nations denied airspace to the sitting head of state of a sovereign country on the basis of a suspicion. The episode revealed, by negative inference, how thoroughly Snowden’s transit options had been shut down.

By early July, every plausible Latin American route had been operationally foreclosed. Whatever the onward itinerary had been, Moscow was now the only node in the chain offering actual state protection.

WikiLeaks’ Institutional Position

By 2013, WikiLeaks’ relationship with Russian state institutions was documented. In 2012, Assange hosted “The World Tomorrow,” a talk show produced by Quick Roll Productions and broadcast by the Kremlin-funded network RT (Russia Today); twelve episodes aired between April and June 2012 ²⁷. WikiLeaks was under severe financial pressure. Visa, Mastercard, Bank of America, and PayPal had suspended services following the 2010 Cablegate disclosures ²⁸. WikiLeaks’ 2012 financial disclosures showed approximately $93,000 in donations against a $530,000 operating budget ²⁹, leaving a substantial funding gap that has never been publicly explained.

Assange’s own advice to Snowden, as reported, was to remain in Russia: “In Russia, he’s safe, he’s well-regarded, and that is not likely to change” ³⁰.

The question of who funded Harrison’s four-month Moscow stay and WikiLeaks’ broader operational expenditures during the Snowden operation has never been publicly answered. WikiLeaks provided personnel (Harrison as physical escort), legal coordination (Garzon), travel documentation (via the Ecuadorian consulate), transportation logistics (the Aeroflot ticket), and a sustained presence in Moscow. Whether this operational deployment was self-directed, coordinated with Russian state interests, or a convergence of shared anti-American agendas cannot be determined from publicly available documentation. WikiLeaks served as the logistical bridge between Snowden’s Hong Kong staging ground and his permanent Russian destination, and it maintained preexisting financial ties to Russian state media during the period of the operation.

1.5 Million Documents

The scale and composition of what Snowden took is the most important variable in evaluating the whistleblower thesis. It is also the variable most consistently understated in public discourse.

The HPSCI report concluded that Snowden removed “more than 1.5 million classified documents” from NSA systems ¹⁵. The HPSCI review cited a Defense Intelligence Agency assessment that approximately 900,000 of these were Department of Defense files ³¹. The material encompassed programs, capabilities, and operations across the intelligence community.

General Martin E. Dempsey, Chairman of the Joint Chiefs of Staff, testified before the House Armed Services Committee on March 6, 2014: “The vast majority of the documents that Snowden exfiltrated from our highest levels of security had nothing to do with exposing government oversight of domestic activities. The vast majority of those were related to our military capabilities, operations, tactics, techniques, and procedures” ³².

Intelligence Committee Ranking Member Adam B. Schiff stated: “Most of the material he stole had nothing to do with Americans’ privacy, and its compromise has been of great value to America’s adversaries” ¹⁶. The bipartisan consensus on this point was significant: Democrats (Ranking Member Schiff) and Republicans (Chairman Devin Nunes) jointly signed both the HPSCI report and a September 15, 2016 letter to President Obama opposing a pardon for Snowden ³³.

Glenn Greenwald, in describing the unreleased portions of the archive, called them “basically the instruction manual for how the NSA is built” ³⁴.

These are official government assertions and journalist characterizations, not independently verifiable claims. The specific contents of 1.5 million classified documents are, by definition, not public. But they are assertions made by a bipartisan congressional committee with access to the underlying classified intelligence, corroborated by the chairman of the Joint Chiefs and consistent with the observable pattern of Snowden’s own disclosures.

The Hong Kong Disclosures

During the Hong Kong period, Snowden’s public revelations extended beyond the domestic surveillance programs that formed the basis of his whistleblowing rationale.

On June 12, 2013, Snowden gave an exclusive interview to the South China Morning Post. He did not discuss American civil liberties. He revealed that the NSA had been hacking targets in Hong Kong and mainland China “for years,” stating that the NSA conducted “more than 61,000 hacking operations globally, with hundreds of targets in Hong Kong and on the mainland” ³⁵. The specific targets he disclosed included:

• Tsinghua University in Beijing – a premier institution hosting one of China’s six major internet backbone networks, with significant roles in arms control research, advanced technology, and defense. Snowden told the SCMP that on a single day in January 2013, “at least 63 computers and servers” at the university were compromised ³⁶.
• The Chinese University of Hong Kong.
• China Mobile (735 million subscribers) and China Unicom (258 million subscribers), with NSA operations targeting SMS data and “network backbones” through which massive volumes of internet traffic transit ³⁷.
• Pacnet, an Asia-Pacific fiber-optic network operator managing 46,000 kilometers of submarine cable across 13 countries ³⁸.

Greenwald acknowledged the sensitivity of the SCMP disclosures. He stated that he would not have published some of the stories the SCMP ran based on Snowden’s revelations ³⁹. This acknowledgment from Snowden’s primary journalist collaborator is notable: it indicates that the Hong Kong disclosures exceeded what even his closest media partner considered appropriate.

One reading of the SCMP disclosures is that Snowden believed transparency about all NSA operations – foreign and domestic – served the public interest. Another reading, advanced by intelligence analysts and members of Congress, is that the disclosures functioned as an “entrance fee” – a demonstration of the archive’s intelligence value to the host jurisdiction in exchange for freedom of movement. The unclassified record supports both interpretations. It cannot resolve between them.

The disclosures provided Beijing with confirmation of specific U.S. intelligence targets, tactical knowledge of NSA collection methods, and a diplomatic weapon. Prior to June 2013, the United States had been building international consensus against Chinese cyber-economic espionage, highlighted by the February 2013 Mandiant report identifying PLA Unit 61398 ^{40 41}. Snowden’s revelations allowed China to reframe the debate. Chinese state media – China Daily, Xinhua, and the People’s Daily – weaponized the disclosures within hours, attacking Washington’s “overseas image” and deflecting the ongoing U.S. campaign to curb Chinese state-sponsored hacking ⁴².

By confirming active NSA operations against Tsinghua University and major Chinese state telecommunications firms, Snowden handed Beijing the means to neutralize the international consensus the United States had spent years constructing. The analytical question is not whether the SCMP disclosures had these effects – they demonstrably did. The question is whether they reflect Snowden’s independent editorial judgment or the interests of the jurisdiction in which he was sheltering.

The Mechanics of Theft

How Snowden extracted 1.5 million classified documents from one of the most sensitive intelligence agencies in the world implicates not just one individual but an institutional failure of the first order.

The HPSCI report reconstructed the technical mechanics after Snowden attempted to erase his digital footprint ¹⁵. The committee found that he leveraged systems administrator access to deploy web-scraping and automated download tools – including wget and browser-based bulk download extensions such as DownThemAll – to harvest documents systematically from internal NSA repositories. He wrote custom scripts to automate the collection process.

Credential Compromise

To access compartmentalized systems beyond his own clearance level, Snowden obtained the login credentials of coworkers. According to secondary reporting on the HPSCI findings, 16 coworkers’ credentials were compromised; Reuters independently reported the number at 20 to 25 ^{15 43}. The discrepancy is unresolved; both figures are cited here with attribution. Snowden acquired these credentials through what the HPSCI report called “misleading means” – in some cases persuading colleagues to enter their passwords on his terminal under the pretext of routine systems administration ⁴⁴. At least one coworker lost their security clearance and resigned ¹⁵. No colleague was criminally charged.

A critical additional vector involved the NSA’s public key infrastructure (PKI) system – a framework of digital certificates used to authenticate users and encrypt communications on classified networks. An NSA memo to Congress dated February 10, 2014 confirmed that one civilian NSA employee shared his PKI certificate at Snowden’s request, providing elevated access to systems and networks beyond what his Booz Allen Hamilton contractor credentials authorized ¹⁵.

NSA Deputy Director Richard Ledgett, speaking at the RSA Conference in 2017, acknowledged the institutional failure directly: “The controls were relatively low on that – not missing – but low because we wanted that crowd to run at that speed” ⁴⁵.

The Exfiltration Timeline

Snowden began downloading classified material in April 2012, while employed by Dell as a contractor at the NSA ^{15 46}. He continued through his transfer to Booz Allen Hamilton and his assignment to the NSA’s Kunia Regional Security Operations Center in Hawaii in the spring of 2013. The frequently cited “five-week window” refers specifically to the Booz Allen/Hawaii period – not to the total duration of the theft, which spanned more than a year ⁴³.

The planning timeline raises its own questions. Snowden contacted Glenn Greenwald in December 2012 and Laura Poitras in January 2013 ¹⁵. Edward Jay Epstein reported that Snowden had committed to delivering classified material to Poitras six to eight weeks before he commenced work at the Kunia facility ⁴³. He then accomplished the acquisition of multiple peer credentials, navigation of compartmentalized networks, and bulk exfiltration within the compressed Booz Allen window.

The NSA’s Hawaii facility was missing anti-leak software deployed at other NSA sites – software produced by a Raytheon division and specifically designed to detect unauthorized data access under the insider threat program President Obama ordered in December 2010 following the Manning leak ¹⁵. Snowden’s anomalous access patterns – downloading massive volumes of data outside his operational purview – did not trigger automated alerts. The HPSCI report identified 13 malicious insider threat indicators present in Snowden’s behavior that were recognized only in retrospect ¹⁵.

Prior Derogatory Information

The HPSCI report documented patterns of deception in Snowden’s employment history. The committee found that Snowden had stolen answers to an employment test while at the NSA and had doctored performance evaluations ¹⁵. Prior derogatory information from his CIA tenure – including a supervisor’s suspension of his clearance in Geneva due to suspicions that he was attempting to access unauthorized classified files – was not properly transmitted to his subsequent employers, Dell and Booz Allen Hamilton ⁴⁴.

A CIA supervisor identified concerning behavior and suspended Snowden’s clearance. The system, at that point, worked. Then the system failed: the derogatory information was not forwarded to the agencies that subsequently granted Snowden access. The two institutions that gave him the credentials he used to execute the theft did not have the full picture of his prior conduct. The transmission failure is a bureaucratic fact. Its consequences were catastrophic.

The mechanics of the theft – the credential compromise, the scripted downloads, the absent alerts, the untransmitted derogatory information – constitute a picture of institutional failure that is, in some respects, more troubling than the theft itself. The architecture of the NSA’s insider threat defenses was not breached by a sophisticated adversary. It was walked through by one man with a thumb drive and a borrowed password. The system did not detect him. The system did not stop him. And the institutions that employed him did not share the information that a prior employer had already flagged.

Archive Capture

What happened to the documents after they left Snowden’s possession is, in several respects, a more consequential question than how they were taken.

In October 2013, four months after Snowden’s arrival in Moscow, Pierre M. Omidyar – the billionaire founder of eBay – pledged $250 million to create First Look Media ⁴⁷. The venture established The Intercept in February 2014, with Glenn Greenwald, Laura Poitras, and Jeremy Scahill as founding editors ⁴⁸. The Intercept became the primary institutional home for the unpublished Snowden archive.

The operational architecture of archive control was specific. Greenwald stated that both he and Poitras maintained “full copies of the archives,” held securely offline. The Intercept employed a dedicated research team and a Director of Information Security to manage access ⁴⁹. First Look Media constructed a private Sensitive Compartmented Information Facility (SCIF) – a physically secured room meeting government specifications for handling classified material – to store the documents ⁵⁰. Other news organizations – The Guardian and the Washington Post through Barton Gellman – also held copies of portions of the archive ⁴⁹. The classified material that the NSA could not protect from a single contractor was now distributed across multiple private institutions, each applying its own editorial judgment about what to publish, what to withhold, and how long to maintain custody.

Over the next five years, The Intercept published stories based on a small fraction of the archive. The most rigorous public accounting suggests substantially less than 1 percent of the 1.5 million documents were ever published or formed the basis of published reporting ¹. According to a Vanity Fair profile of First Look Media, the archive research team consumed only 1.5 percent of the organization’s total budget ⁵¹ – a quarter-billion-dollar media venture devoting 1.5 percent of its resources to the archive that was its reason for existing.

In March 2019, The Intercept shut down the Snowden archive operation. The research team was laid off. Access to the documents was terminated ². The decision was attributed to a “change in editorial priorities.” Laura Poitras, one of the archive’s original custodians, called the shutdown “sickening” ⁵². Snowden was reportedly not consulted or informed before the decision.

Jacob Appelbaum, the security researcher and WikiLeaks associate, subsequently stated that the archive had been “reportedly destroyed” ⁵³. If true, the sequence is worth stating plainly. A billionaire-funded media organization took custody of 1.5 million classified U.S. government documents. It published less than 1 percent of them. It shut down the research operation. It reportedly destroyed the rest. No known government subpoena compelled the archive’s return. No known government subpoena compelled its preservation. The most consequential intelligence archive in modern American history passed from government control, through journalistic custody, into nonexistence – and no court order accompanied any stage of that passage.

News organizations routinely exercise editorial discretion over classified material. The Washington Post, the New York Times, and the Guardian have all made judgments about what to publish and what to withhold from the Snowden archive and other classified leaks. The question is not whether editorial judgment was applied but whether 99 percent non-publication followed by reported destruction represents editorial judgment or something else.

One feature of that private custody deserves separate treatment: who Pierre Omidyar was, and what else he was funding while the archive moved into his institution’s control.

Omidyar’s Dual Position

Through the Omidyar Network, his philanthropic investment firm, Pierre M. Omidyar was concurrently funding civic initiatives in Ukraine that aligned with U.S. foreign policy objectives. According to a Nonprofit Quarterly analysis of Ukrainian organizational disclosures, between 2011 and 2014 the Omidyar Network co-invested with the U.S. Agency for International Development (USAID) in Ukrainian civil society organizations, including Center UA, an NGO involved in the pro-Western civic movements that preceded the 2014 revolution. In 2012, the Omidyar Network provided approximately $200,000 to Center UA, accounting for 36 percent of the organization’s budget, while USAID provided 54 percent of the remainder ⁵⁴.

That meant the archive’s principal private custodian was simultaneously financing U.S.-aligned democracy-promotion efforts in Eastern Europe while his media venture held 1.5 million classified U.S. intelligence documents supplied by a fugitive living under Russian government protection. Whether this dual position reflects diversification, a hedge, or something less visible is a question the open record raises but cannot answer.

The Government’s Non-Pursuit

The absence of aggressive government legal action to recover the archive is itself a datum. The U.S. government possesses well-established mechanisms for compelling the return of classified material. No publicly known subpoena, court order, or legal proceeding was directed at First Look Media or The Intercept to compel production of the classified documents.

One plausible explanation is strategic: the government calculated that aggressive legal action risked triggering the mass release the “insurance” mechanism was designed to produce. Another is that undisclosed agreements exist between the government and the archive’s custodians. A third is institutional inertia: the government preferred private sequestration to uncontrolled release and chose containment over confrontation. The HPSCI report noted the government spent “hundreds of millions of dollars” on damage mitigation ¹⁵.

The archive’s trajectory – from Snowden’s encrypted drives, through journalistic institutions, into a billionaire-funded SCIF, and finally into reported destruction – traces a path from classified government material to permanent inaccessibility. Whether that outcome represents the success of a press-freedom model that protected sources and methods from reckless disclosure, or the failure of a system that allowed classified material to be privatized, sequestered, and ultimately destroyed without democratic accountability, depends entirely on what was in the 99 percent that was never published.

Structural Deterrence

The failure of the United States to recover the Snowden archive or compel his return reflects a multi-layered deterrence architecture that Snowden and his allies constructed – one that effectively constrained U.S. government action through cryptographic leverage, institutional embedding, and legal positioning.

Glenn Greenwald confirmed to The Daily Beast that Snowden had “distributed thousands of documents and made sure that various people around the world have his complete archive,” which was “highly encrypted” ⁵⁵. Security researcher Bruce Schneier analyzed the operational logic: the more likely architecture was a distributed key system, possibly employing Shamir’s Secret Sharing or comparable threshold cryptographic schemes, rather than a true automatic-release mechanism that would create perverse incentives for adversarial services to eliminate Snowden and trigger the release ⁵⁶.

Snowden himself claimed that he brought no leaked documents into Russia and had left the material with journalists in Hong Kong, asserting he did not want to provide Russian intelligence with leverage ⁵⁷. This claim exists in tension with the operational requirement of the insurance mechanism: a deterrent requires the credible threat that its contents can be released, which requires that the contents exist in recoverable form somewhere.

On July 23, 2013, Attorney General Eric H. Holder Jr. sent a formal letter to Russian Minister of Justice Alexander V. Konovalov – a primary document preserved in the public record ⁵⁸. The letter, drafted on Department of Justice letterhead and addressed to the Russian Federation’s Ministry of Justice, guaranteed that the United States would not seek the death penalty for Snowden, would not torture him, and would provide him full proceedings before an Article III civilian court (a federal court established under Article III of the Constitution, presided over by a life-tenured judge, with a public jury trial and appellate rights). These concessions, designed to eliminate the legal basis for Russian asylum, simultaneously constrained the U.S. government’s own prosecutorial options.

Snowden’s institutional embedding deepened the deterrence. In February 2014, he joined the board of the Freedom of the Press Foundation (FPF). By 2016, he was president of the board ⁵⁹. The FPF, which reported $3.4 million in revenue for fiscal year 2022, operates secure whistleblowing tools including SecureDrop, the encrypted submission system used by dozens of major newsrooms ^{59 60}. By serving as the figurehead of an organization that protects First Amendment press freedoms, Snowden ensured that any aggressive U.S. action against him or the archive’s journalistic custodians would be reframed as an assault on press freedom.

In February 2017, NBC News reported that Russian intelligence had considered “gifting” Snowden to the Trump administration as a diplomatic gesture ⁶¹. The transfer never materialized. Snowden tweeted in response: “Finally: irrefutable evidence that I never cooperated with Russian intel. No country trades away spies, as the rest would fear they’re next.”

In 2019, the U.S. government pursued a civil lawsuit against Snowden for breach of non-disclosure agreements related to his memoir, Permanent Record. The resulting judgment required Snowden to forfeit approximately $5.2 million in book and speaking proceeds to the U.S. government ⁵⁸. In practical terms, the government’s most visible post-facto legal response was a civil book-proceeds suit, not any publicly known action to recover the archive itself.

His integration into Russian society traces a documented arc: temporary asylum (August 1, 2013), one-year renewable asylum (2014), permanent residency (October 2020), and Russian citizenship by Putin’s personal decree (September 26, 2022) ⁶². Each step deepened his legal ties to the Russian state and reduced the already slim probability of extradition. The progression has a ratchet quality: each grant of status made the next more logical and the possibility of departure less plausible.

The man who said he acted alone is now a citizen of the state that sheltered him, represented by a lawyer the Senate identified as an FSB conduit, in a country whose parliament publicly acknowledged receiving his intelligence. The architecture of his Russian life was not built in a day. It was assembled over nine years, one status grant at a time.

Three Hypotheses

The observable minimum – the floor that all three hypotheses must accommodate – is this:

Snowden executed a pre-planned theft of 1.5 million classified documents over a period exceeding one year. He contacted journalists months in advance. He disclosed Chinese intelligence targets to a Hong Kong newspaper during the precise window when he needed Chinese authorities to refrain from acting on the U.S. extradition request. He communicated with Russian diplomatic representatives before his departure. He boarded a Russian state carrier with a WikiLeaks escort. He ended up under permanent Russian government protection with an FSB-linked legal handler. Whatever his internal motivations, the operational architecture of his exfiltration and the downstream control of his documents served the strategic interests of multiple U.S. adversaries.

Against this floor, three competing explanations have been advanced.

(a) Spontaneous Whistleblower

This hypothesis holds that Snowden was a conscience-driven individual who collected evidence of domestic surveillance overreach, shared it with journalists, and improvised his escape when the legal walls closed in, ending up in Russia due to passport revocation and the collapse of the Latin American route.

Evidence that supports this hypothesis:

The journalist contact timeline is consistent with whistleblower planning. Snowden reached out to Greenwald in December 2012 and to Poitras in January 2013, well before the Hong Kong period ¹⁵. He chose mainstream Western media outlets – not WikiLeaks, not a foreign intelligence service – for the initial disclosures. This is the distribution pattern of someone who believed he was acting in the public interest.

The passport revocation and the documented confusion between U.S. and Hong Kong authorities about notification timing provide a plausible mechanism for his becoming stranded in Moscow. Harrison’s own statement corroborates the Latin American intent ²¹. Snowden held a confirmed seat on the next day’s Havana flight ¹⁴. The Cuba route collapsed under U.S. pressure, as documented above.

The Snowden disclosures produced genuine legislative reform. The USA FREEDOM Act of 2015 ended the NSA’s bulk collection of domestic phone records. Courts subsequently found the bulk metadata program illegal. These outcomes are consistent with a whistleblowing motivation.

Evidence that strains this hypothesis:

The operation was not spontaneous. Snowden executed a technically sophisticated exfiltration over more than a year using fabricated credentials, scripted tools, and multiple compromised colleague accounts ¹⁵. WikiLeaks deployed Harrison to Hong Kong before his departure, indicating advance coordination with an organization that had preexisting Russian state media ties ^{15 27}. Putin’s admission of Russian diplomatic contact in Hong Kong establishes that Snowden was not relying solely on journalists and his legal team ¹². The scale and composition of the material – 1.5 million documents, the vast majority concerning military capabilities, operations, and foreign intelligence methods rather than domestic surveillance – is difficult to reconcile with a civil-liberties motivation ^{15 32}. The SCMP disclosures served Chinese geopolitical interests, as documented above. And the HPSCI’s finding of ongoing Russian intelligence contact after arrival contradicts the stranding narrative ¹⁵.

(b) Guided Witting Participant

This hypothesis holds that Snowden was recruited, directed, or wittingly collaborated with one or more foreign intelligence services from an early stage, and that the operation – from document selection through exfiltration to asylum – was pre-planned with state sponsorship.

Evidence that supports this hypothesis:

Putin’s confirmation of Russian diplomatic contact in Hong Kong prior to the flight ¹². The Kommersant report placing Snowden at the Russian Consulate around June 21 ¹⁴. The HPSCI’s finding of ongoing Russian intelligence contact after arrival ¹⁵. A Russian parliamentarian’s public concession that Snowden shared intelligence with the Russian government ¹⁶. The FSB-linked attorney managing Snowden’s legal affairs ¹⁷. The operational logistics: WikiLeaks escort, Aeroflot ticket, Ecuadorian travel document, Harrison’s extended Moscow deployment ^{15 20 24}. The volume and composition of stolen material far exceeding any domestic surveillance rationale ^{15 32}. The tactical weaponization of disclosures to benefit Chinese interests during the Hong Kong period ³⁵.

The prior derogatory information from Snowden’s CIA tenure strengthens this reading. A supervisor in Geneva suspended Snowden’s clearance due to suspicions that he was attempting to access unauthorized classified files ⁴⁴. The HPSCI documented that Snowden stole answers to an employment test and doctored performance evaluations ¹⁵. These patterns of deception and unauthorized access attempts predate the document theft and, under this hypothesis, would constitute early indicators of a recruitment or self-initiated approach to a foreign service.

Evidence that is missing or cuts against this hypothesis:

No publicly available evidence of tasking, payment, recruitment, operational direction, or pre-positioning by a foreign intelligence service. No defector testimony, no intercepted communications, no financial trail linking Snowden to foreign state funding has entered the public record. The journalist contact timeline (December 2012) precedes any alleged Russian contact, which would be unusual for a pre-recruited agent whose handler would typically direct the dissemination channel. Snowden chose to share documents with Western journalists – which would be an unusual distribution strategy for a witting foreign agent. A handler directing Snowden would be unlikely to channel the material through the American and British press, where publication decisions would be made by journalists with no obligation to serve any state’s intelligence interests.

Even Epstein, whose book advanced the most aggressive version of the foreign-agent thesis, acknowledged “no evidence that Snowden was employed by the Russian intelligence service while in the United States” ⁴⁶. The HPSCI report itself, despite its damning conclusions, stopped short of this claim in its declassified summary ¹⁵.

(c) Partially Manipulated Actor

This hypothesis holds that Snowden initiated the operation out of genuine ideological conviction regarding domestic surveillance but that once he entered the Hong Kong-Moscow pipeline, multiple state and non-state actors – Russian intelligence, Chinese security services, WikiLeaks – recognized his value, shaped his trajectory, and exploited his situation in ways he may not have fully understood or controlled.

Evidence that supports this hypothesis:

The dual-track nature of the evidence is itself the strongest indicator. Snowden’s journalist outreach (December 2012-January 2013) is consistent with whistleblower motivation. The subsequent operational execution – Chinese intermediary assuring safe passage ⁸, Russian diplomatic contact in Hong Kong ¹², WikiLeaks logistical takeover ¹⁵, FSB-linked legal representation ¹⁷, progressive Russian integration from asylum to citizenship ⁶² – is consistent with opportunistic exploitation by state actors who recognized a windfall.

The SCMP disclosures may reflect the advice of local contacts who understood what would buy goodwill with Beijing, rather than Snowden’s independent strategic calculation. His trajectory in Moscow – FSB-linked attorney, parliamentary admissions of intelligence sharing, eventual citizenship – may reflect gradual envelopment by Russian state interests rather than a pre-existing recruitment.

This hypothesis also accounts for the document composition problem: Snowden may have collected broadly, as systems administrators can, out of a general conviction that the public should know what the NSA was doing. He may not have appreciated that the vast majority of what he took had intelligence value to foreign adversaries rather than democratic accountability value to domestic audiences. Once the material was in play, multiple services had every incentive to maximize their take.

The timeline, as documented above, supports a scenario in which these phases unfolded sequentially: Snowden acted independently through his journalist contacts and initial departure to Hong Kong. Russian contact was established during the gap between his May 20 arrival and his late-June departure. The Chinese state facilitated his departure through the intermediary described by Albert Ho and the slow-rolling of the extradition request. WikiLeaks provided the logistical framework for extraction. The Latin American route failed – whether through passport revocation, Cuban refusal under U.S. pressure, or both – leaving Snowden in the location where he was most valuable as an intelligence asset. On the public record, that means Moscow cannot be treated as a neutral layover. It was the one jurisdiction in the chain where state protection was real, immediate, and durable. And Omidyar’s First Look Media subsequently captured the documentary archive, publishing less than 1 percent before reportedly destroying the rest.

Each actor in this sequence had its own reasons. None needed to coordinate with the others.

The architecture assembled itself.

What this hypothesis lacks:

Direct evidence of specific manipulation or deception operations targeting Snowden. The classified record may contain such evidence; the public record does not. Hypothesis (c) is also, by its nature, the least operationally clean: it attributes to multiple actors what might be explained by one, and it posits a complexity of motivation that resists the kind of tidy narrative that either a prosecution or a pardon campaign requires.

Why it warrants the most careful attention:

It benefits no powerful constituency. It does not vindicate the intelligence community’s preference for hypothesis (b), which would paint Snowden as a foreign agent and justify aggressive counterintelligence responses while deflecting attention from the catastrophic institutional failures that enabled the theft. It does not vindicate Snowden’s supporters’ preference for hypothesis (a), which preserves the whistleblower narrative. And it does not serve the interests of the foreign states involved, who benefit from ambiguity.

Hypothesis (c) suggests that a genuine whistleblowing impulse was progressively captured and redirected by actors with agendas orthogonal to domestic civil liberties reform – a conclusion that indicts everyone and exonerates no one.

The most dangerous intelligence breaches may not be the ones planned end-to-end by hostile services, but the ones in which a self-motivated insider creates an opportunity that multiple services then exploit simultaneously, each shaping the asset’s trajectory while none bearing visible fingerprints.

Hypothesis Comparison

What Remains Classified

The public debate over the Snowden affair has been conducted with significant portions of the evidentiary record sealed behind classification walls. Understanding what is known to be classified – and reasoning about why it remains so – is essential to evaluating the limits of any open-source analysis.

The HPSCI report is the most significant classified document. The committee produced a 36-page review with 230 footnotes ¹⁵. Only a brief executive summary was declassified. The classified body contains the specific intelligence basis for the committee’s most consequential claims: that Snowden maintained ongoing contact with Russian intelligence services, that the material was overwhelmingly unrelated to domestic surveillance, and that systemic failures in insider threat detection enabled the theft. The committee voted unanimously to maintain classification of the full report ¹⁵.

The HPSCI review has been criticized. Its classified basis cannot be independently verified. The committee conducted its investigation in a political environment in which the Intelligence Community had strong institutional incentives to reframe the Snowden affair as a foreign intelligence matter rather than an insider threat failure. That the report’s conclusions align with IC institutional interests does not make them wrong – but it warrants the same institutional skepticism that should be applied to all parties in this affair.

The Intelligence Community conducted a separate damage assessment that has never been publicly released. This assessment would detail the specific programs compromised, the sources and methods exposed, the foreign services believed to have obtained the material, and the remediation costs. General Dempsey’s testimony – “The vast majority of the documents that Snowden exfiltrated from our highest levels of security had nothing to do with exposing government oversight of domestic activities” ³² – is the closest public approximation of this assessment’s conclusions.

The specific evidence of FSB contact – referenced in the HPSCI report and the Senate Intelligence Committee’s Russia investigation ¹⁷ – remains classified. Whether this evidence derives from signals intelligence, human intelligence, or technical surveillance of Snowden’s Moscow activities is unknown.

The downstream consequences of the disclosures intersected with a separate catastrophe. Between late 2013 and 2015, Chinese hackers breached the U.S. Office of Personnel Management, stealing 22.1 million records – the background investigation files of federal employees and contractors with security clearances. The stolen data included 5.6 million fingerprints and the Standard Form 86 applications in which cleared personnel disclose their foreign contacts, financial vulnerabilities, medical histories, and extramarital affairs ⁶³. The HPSCI review found that Snowden’s disclosures “exacerbated and accelerated existing trends” in adversary cyber operations ¹⁵. The careful wording attributes a catalytic role without claiming sole causation. No direct causal link between the Snowden disclosures and the OPM breach has been publicly established. But the timing is difficult to dismiss: the OPM intrusion began months after Snowden’s revelations exposed NSA collection architectures, and knowledge of those architectures – where the NSA was looking, how it was looking, and what defensive gaps existed in U.S. network monitoring – would be operationally useful to any adversary planning intrusions into adjacent federal systems.

The classified damage assessment would address this question directly. The public record can note the timing, the HPSCI’s qualified finding, and the logical pathway. It cannot establish the causal chain with certainty.

The Sunday Times reported in June 2015 that Russian and Chinese intelligence had decrypted more than one million classified files from the Snowden archive, forcing MI6 to relocate agents ⁶⁴. The report, which relied entirely on anonymous government sources and was criticized by press freedom organizations as a planted narrative, has not been independently confirmed.

The question of what happened to the approximately 1.49 million unpublished documents connects the exfiltration to its downstream intelligence consequences. Several possibilities exist, and they are not mutually exclusive. The documents may have been accessed by Russian intelligence services during Snowden’s time in Moscow – the HPSCI’s finding of ongoing intelligence contact, combined with Snowden’s physical presence on Russian territory under FSB-linked legal representation, creates the conditions under which such access would be operationally straightforward. Russia’s security services control the physical environment in which Snowden has lived for nearly thirteen years.

Snowden has denied providing documents to Russia. The denial exists alongside the HPSCI’s classified finding and alongside the operational reality that a man living under FSB protection does not have the capacity to deny FSB access to material stored on devices within Russian jurisdiction.

The documents held by First Look Media were reportedly destroyed following the 2019 shutdown. The documents held by other outlets – The Guardian, the Washington Post – are subject to their own institutional decisions about custody and access. The Guardian was subjected to direct pressure from British intelligence services, including the supervised destruction of hard drives at its London offices in July 2013 – GCHQ officers stood over Guardian staff as they drilled into the laptop drives with angle grinders – though the paper retained copies of the archive outside the United Kingdom ⁴⁹. Barton Gellman held a separate tranche at the Washington Post. The current status and disposition of these holdings is not publicly documented.

The archive that Greenwald described as “the instruction manual for how the NSA is built” now exists in fragments, scattered across institutions whose custody decisions are private, whose legal obligations to the material are undefined, and whose long-term intentions are unknown.

The pursuit of the archive – or the conspicuous absence of pursuit – is itself the most underexamined thread. The U.S. government spent hundreds of millions of dollars on damage mitigation ¹⁵. It prosecuted a civil lawsuit over memoir proceeds. It sent the Attorney General’s letter to Moscow. It pressured European nations to deny airspace to Morales’ plane. But it never, in any publicly known proceeding, moved to compel the return of the documents themselves from the journalistic entities that held them. The most plausible explanation is that the government feared triggering the uncontrolled release of the most damaging material. But this explanation raises its own question: if the government believed the insurance mechanism was real, it implicitly acknowledged that copies of the full archive existed in recoverable form, which sits uneasily with Snowden’s claim that he brought no leaked documents into Russia and left the material with journalists in Hong Kong.

What the government knows about who accessed the full archive, what agreements may exist between the government and the archive’s custodians, and what the damage assessment concluded about foreign service access constitute the true analytical frontier of the Snowden affair. The public narrative – lone whistleblower versus foreign agent – serves multiple institutional interests precisely because of its simplicity. The classified record almost certainly tells a different story.

Conclusion

The Snowden affair exposed two failures at once: democratic oversight failed before the leak, and counterintelligence failed during and after it. The same institutional culture that normalized bulk surveillance also normalized broad administrative access, weak compartmentation, and delayed transmission of derogatory information about a risky insider. Whatever Snowden’s motives, the record shows a system that prioritized collection over protection and speed over security.

The public record does not answer every decisive question. It does make one point much harder to evade: Moscow can no longer be treated as a mere accidental stopover. The record does not prove it was the destination from the beginning. It does show that by the time Snowden boarded a Russian state carrier after pre-departure Russian contact in Hong Kong, Moscow was where the route acquired actual state protection and strategic coherence. That, in turn, makes four questions unavoidable. How did a single contractor with a documented history of unauthorized access attempts extract 1.5 million documents from the most powerful signals intelligence agency on earth without triggering a single automated alert? How did the actions of three sovereign governments and a non-state organization align, in a window of days, to move a fugitive carrying those documents from one jurisdiction to another? How did a billionaire-funded media organization come to hold 1.5 million classified documents, publish less than 1 percent of them, and then reportedly destroy the rest? And why did the U.S. government – which spent hundreds of millions of dollars on damage mitigation – never issue a known subpoena to recover them?

Sources and Notes