Courage our network

Video: Edward Snowden speaks at the Moment of Truth

On Monday, 15 September, the Intercept published an op-ed by Edward Snowden in which he supported the revelation that New Zealand has implemented a system of mass surveillance, drawing on his own personal experience of using XKeyScore as an analyst.

The reliability of Prime Minister John Key’s statements on the status of domestic surveillance in New Zealand, a Five Eyes partner, has become a live issue in that country’s parliamentary election, which will be held on Saturday 20 September. In his latest statement, John Key has admitted that Edward Snowden “may well be right” about the availability New Zealand citizens’ information in XKeyScore.

On Monday evening, Edward Snowden took part in a public meeting at Auckland’s Town Hall alongside Julian Assange and Glenn Greenwald. The meeting was organised by Kim Dotcom, whose political party is fielding candidates in Saturday’s election. Edward Snowden spoke for just under 20 minutes at the event, answering questions from Glenn Greenwald – a video and transcript follows below.

It was interesting that you said the Town Hall this is taking place in is in Auckland, because we’re talking about mass surveillance, we’re talking about everything that is going on. And the fact that the Prime Minister has denied, [he has said] there is no mass surveillance in New Zealand, that these are only cyber protection programmes and even though they were contemplating them, they never went forward, he heroically put a stop to this at the eleventh hour… None of us know what’s going on.

But you know there are actually NSA facilities in New Zealand that the GCSB is aware of, which means the Prime Minister is aware of, and one of them is in Auckland! Another one is in the north of the country. But I’ll leave it there – Glenn, please go ahead.

It’s a great place to start because, as I think everybody knows, you have created a little bit of a stir over the last year and two months, around the world.

But you have specifically created a stir here in New Zealand with the article you wrote for the Intercept after the past several days, which was published just a couple of hours before we convened here in which you made some very strong statements about the evolving debate taking place here in New Zealand, including that Prime Minister Key’s claims about the GCSB not participating in mass surveillance, of New Zealanders not being subjected to mass surveillance, are as you called them false statements.

Can you talk about, based on your own personal experience working within the NSA and the Five Eyes infrastructure, what your basis is for those conclusions?

Right, absolutely. I think one of the key things to get out in the beginning is to say, when the Prime Minister is making these statements about ‘there is no mass surveillance’, people can disagree about what this is, what it’s not, you’re always entitled to your opinions, but you’re not entitled to your own facts.

When the bulk collection of private citizens’ communications – emails, text messages, location data, metadata, calling records, what you order online, who you buy, who you talk to, who you love, what you do – when these things are collected by any arm of government without an individualised, particularised suspicion of wrongdoing on the individual level, that is a violation of not just of rights on the national level, but of human rights that are not given to us by government but are inherent to our nature.

I think what is happening is a careful parsing of words. He’s saying this isn’t mass surveillance even though GCSB is collecting all of your information and they’re sharing it with NSA. The NSA is doing it and then providing that information to us so we don’t have to do it domestically, we don’t have to collect domestically, we just get to search their copies of our citizens’ data.

He’s saying that it’s not surveillance because, as long as in these trillions of records, not every single record is read by a human being when they come in in the morning, like email. But even that is not entirely true; it’s inaccurate in many ways.

When I worked at the NSA my last position was as an Infrastructure Analyst. You can think of it as sort of a state sponsored hacker. What you do is you look at network infrastructure, you look at routers, you look at all the connection points, you look at companies and you look at targets. You work out how the networks work, how they fit together and how to break in – you’re basically a burglar casing the joint.

That was when I realised the absolute scale of how deep this went, because when I was doing this I would see the communications of individuals from around the world. I could be looking at a system in Japan, I could be looking at a system in Germany, I could be looking at a system in New Zealand – and what was incredible was that I could see records of communications of people from around the world, from every country comprehensively.

You can think of XKeyScore in technical terms as a federated search system. What it means is that the NSA along with the Five Eyes alliance, which includes New Zealand as a significant part of it, put a series of sensors around the world. You can think of these as tapping devices. Some of them are cable taps, some …. well, what’s been reported are cable taps, let’s leave that there.

But there’s a network of sensors around the world, whether that’s racks of equipment, they don’t have to be at telecommunications providers. I’d have to take issue with the Southern Cross gentleman who said that there’s no way this can happen, we would know if it happened, we would see it, we would have evidence of it, we would have to be complicit with the government, there’s no way to tap a fibre optic cable without us knowing and without it taking our cable network.

But we’ve seen over the past year that the NSA has done this around the world in countries that we’re allied with and countries that we’re not. I would have to ask that gentleman, what makes your company unique? Out of every telecommunications provider in the world, [what is unique] that you would know when the GCSB, when the NSA are tapping your lines? No one else can.

The key is that you’ve got this network of censors around the world and then I, sitting in the NSA in Hawaii come in the morning and I type in my search. Let’s say I want to read John Key’s email. I answer his email address and it sends that search to every one of those sensor networks around the world and they search their local database of metadata and content. The content of all communications that pass through these sites is held for about three to five days, depending on the storage. It’s constantly going back further and further in time as we gain in capability.

So I can see everything. I can see what book you looked at at last week. I can see who you talked to. I can see who your friends on Facebook are. I can see the text messages you sent, I can read the emails you wrote. And I can set up things that are called fingerprints that allow me to track where you’ve been on the web, who you’re talking to, even you’ve been using anonymising technologies.

What’s interesting about these sensor networks is that when I’m typing in this description for an email address I can say which of these sensors, where in the world, I want it to go to. And I know there’s mass surveillance happening in New Zealand because one of those check boxes, one of those sensor networks is in New Zealand.

So when John Key or anyone in the New Zealand government says there is no mass surveillance in New Zealand and that they have a cyber protection programme or whatever they want to call it – they talk about a Project Cortex – they’re distracted from the main question.

When a journalist hears that ‘there’s no mass surveillance in New Zealand’, they need to follow up, they need to press and they need to say: Mr Prime Minister, what about XKeyScore? What about the GCSB’s involvement in XKeyScore? What about New Zealand’s involvement in the XKeyScore mass surveillance programme? And to this day he’s said, I won’t talk about this, I won’t talk about this because it’s related to foreign intelligence. But is it related to foreign intelligence if it’s collecting the communications of every man, woman and child in the country of New Zealand?

Maybe the people of New Zealand think that’s appropriate, maybe they want to sacrifice a certain measure of their liberty and say it’s ok if the government watches me, I’m concerned about terrorism, I’m concerned about foreign threats. We can have people in every country make that decision because that’s what democracy is about, that’s what self-governance is about. But that decision doesn’t belong to John Key or officials in the GCSB making these decisions behind closed doors, without public debate. That decision belongs exclusively to the people of that country.

I think it’s wrong for him, I think it’s wrong for any politician to take away the public’s seat at the table of government and say you’ll just have to trust us and it’s simply not in the public interest to know about these programmes. Unless it threatens my reputation and then I’m going to throw classified documents in the air…

Just to be very clear about one point, can you be definitive based on your first hand work with XKeyScore and other mass surveillance programmes that within the Five Eyes alliance mechanisms there are large amounts of indiscriminate metadata about the communications, and other online events, of New Zealand citizens? And does the GCSB contribute in any way, analytically or otherwise, to that collection of data?

Yes, absolutely. There’s no question about it. There’s not just metadata.

Although people like to talk about ‘just’ metadata, metadata is extraordinarily intrusive. As an analyst, I’d prefer to be looking at metadata rather than content because it’s quicker and it’s easier and it doesn’t lie. If I were going to listen to your phone call, you could try to talk around things, you could use code words. But if I’m looking at your metadata I know which number called which number. I know which computer talked to which computer. And, yes, that exists comprehensively for all of the Five Eyes allies, for all of their network enabled partners, for all of their telecommunications providers and things like that that are overseas or have a strong national connection they create what are called commercial relationships that allow them to do this.

And specifically yes, the GCSB not only uses XKeyScore, they have expanded, they have contributed to its development. They have proposed algorithms and those fingerprints that are used to track people and targets. That’s a tremendously concerning thing for any public, particularly when these decisions about whether or not intelligence agencies should cross the gap between targeted surveillance, based on judicial warrants and on limited collection that’s necessary and proportionate to the threat faced, are more or less left to the intelligence agencies themselves.

We talk about this GCSB Act that was passed in August of last year and we go, if the Prime Minister is so comfortable in releasing this information this week, why didn’t this happen last year, as has been debated? Why was it not relevant to the public interest when it was our rights on the line, but suddenly it’s critical to get this information out there when it’s one man’s reputation on the line? That’s a question that I think needs to be answered.

Just to clarify on that, XKeyScore does involve both the metadata and content collection of individuals in New Zealand. That’s without question.

Citizens of New Zealand have their private communications in this database and people in the GCSB, people in the NSA, people in the Canadian CSEC, the GCHQ in the UK, the DSD in Australia – they all have access to these communications.

And while they are constrained by policy, and I do believe they try to use these policies appropriately to manage them, they aren’t really overseen. We don’t know what they do – it happens in the dark, without any accountability, without any public say in how these programmes are operated or whether they should exist at all.

And it’s very concerning when a foreign intelligence agency like the National Security Agency can propose a law to be put in place in New Zealand for the GCSB, which is the law that was passed last year. And the GCSB can start proposing programmes that are essentially unlawful at the time they’re being considered and say, hey, pass a law to make this legal and we’re going to go ahead and put this out there immediately.

Why are they considering programmes that are not legal? These are things that the public has not just a right to know but a responsibility to know. How can the government have the consent of the governed if they don’t know what’s going on? Consent has to be informed to be meaningful and I think that is the problem that we’re seeing in New Zealand today.

It doesn’t matter necessarily if there’s mass surveillance in New Zealand if the people have said that’s what they want, but for it to have been conceived and for the highest officials in government to be party to that – and now they’re changing their story, day after day, about what they knew, when they knew and why it happened – this should cause everybody to ask questions. Not just about what’s going to come out next, what we’re going to learn and what they’ve been lying about, but more importantly what are we going to do about it?

The reality is, everyone in New Zealand’s private communications are only protected by a single checkbox, a checkbox that says please don’t show me results from people in New Zealand. That does exist in XKeyScore. These intelligence services do have the capability to say, I don’t want to see this. But after you’ve run one search and don’t get the results you like, you can uncheck the box and then you’re allowed to see everything.

The question becomes: is it right for our governments to have the opportunity to know everything about us, even if we’re not suspected of any crime? To collect everything about us, even the most private details, the most intimate details of our lives without us having any knowledge of it, to say nothing of having vote on it. And then to play politics with it when it becomes a matter of public interest.

I don’t know what the answer to this is – I’m not from New Zealand, I don’t back any parties. This is for each individual citizen in a place to decide what kinds of societies they want. But if the government is checking boxes off about our lives and how we’re going to live, I think election time is when we get to check some boxes off too. That’s how it works.