Permanent Record

party state. NSA agents, even more than most Americans, just took it for
granted that the place was an authoritarian hellhole. Chinese civil liberties
weren’t my department. There wasn’t anything I could do about them. I
worked, I was sure of it, for the good guys, and that made me a good guy,
too.

---

But there were certain aspects of what I was reading that disturbed me. I
was reminded of what is perhaps the fundamental rule of technological
progress: if something can be done, it probably will be done, and possibly
already has been. There was simply no way for America to have so much
information about what the Chinese were doing without having done some
of the very same things itself, and I had the sneaking sense while I was
looking through all this China material that I was looking at a mirror and
seeing a reflection of America. What China was doing publicly to its own
citizens, America might be—could be—doing secretly to the world.
And although you should hate me for it, I have to say that at the time I
tamped down my unease. Indeed, I did my best to ignore it. The distinctions
were still fairly clear to me. China’s Great Firewall was domestically
censorious and repressive, intended to keep its citizens in and America out
in the most chilling and demonstrative way, while the American systems
were invisible and purely defensive. As I then understood US surveillance,
anyone in the world could come in through America’s Internet
infrastructure and access whatever content they pleased, unblocked and
unfiltered—or at least only blocked and filtered by their home countries and
American businesses, which are, presumptively, not under US government
control. It was only those who’d been expressly targeted for visiting, for
example, jihadist bombing sites or malware marketplaces who would find
themselves tracked and scrutinized.
Understood this way, the US surveillance model was perfectly okay with
me. It was more than okay, actually—I fully supported defensive and
targeted surveillance, a “firewall” that didn’t keep anybody out, but just
burned the guilty.
But in the sleepless days after that sleepless night, some dim suspicion
still stirred in my mind. Long after I gave my China briefing, I couldn’t help
but keep digging around.
A
T THE START
of my employment with the NSA, in 2009, I was only slightly
more knowledgeable about its practices than the rest of the world. From
journalists’ reports, I was aware of the agency’s myriad surveillance
initiatives authorized by President George W. Bush in the immediate

---

aftermath of 9/11. In particular, I knew about its most publicly contested
initiative, the warrantless wiretapping component of the President’s
Surveillance Program (PSP), which had been disclosed by the New York
Times in 2005 thanks to the courage of a few NSA and Department of
Justice whistleblowers.
Officially speaking, the PSP was an “executive order,” essentially a set
of instructions set down by the American president that the government has
to consider the equal of public law—even if they’re just scribbled secretly
on a napkin. The PSP empowered the NSA to collect telephone and Internet
communications between the United States and abroad. Notably, the PSP
allowed the NSA to do this without having to obtain a special warrant from
a Foreign Intelligence Surveillance Court, a secret federal court established
in 1978 to oversee IC requests for surveillance warrants after the agencies
were caught domestically spying on the anti–Vietnam War and civil rights
movements.
Following the outcry that attended the Times revelations, and American
Civil Liberties Union challenges to the constitutionality of the PSP in non-
secret, regular courts, the Bush administration claimed to have let the
program expire in 2007. But the expiration turned out to be a farce.
Congress spent the last two years of the Bush administration passing
legislation that retroactively legalized the PSP. It also retroactively
immunized from prosecution the telecoms and Internet service providers
that had participated in it. This legislation—the Protect America Act of
2007 and the FISA Amendments Act of 2008—employed intentionally
misleading language to reassure US citizens that their communications were
not being explicitly targeted, even as it effectively extended the PSP’s
remit. In addition to collecting inbound communications coming from
foreign countries, the NSA now also had policy approval for the warrantless
collection of outbound telephone and Internet communications originating
within American borders.
That, at least, was the picture I got after reading the government’s own
summary of the situation, which was issued to the public in an unclassified
version in July 2009, the very same summer that I spent delving into
Chinese cyber-capabilities. This summary, which bore the nondescript title