Permanent Record

Part of what convinced me was my fear that even if I had stripped away
the metadata I knew about, there could be other digital watermarks I wasn’t
aware of and couldn’t scan for. Another part had to do with the difficulty of
scrubbing single-user documents. A single-user document is a document
marked with a user-specific code, so that if any publication’s editorial staff
decided to run it by the government, the government would know its
source. Sometimes the unique identifier was hidden in the date and time-
stamp coding, sometimes it involved the pattern of microdots in a graphic
or logo. But it might also be embedded in something, in some way, I hadn’t

---

even thought of. This phenomenon should have discouraged me, but instead
it emboldened me. The technological difficulty forced me, for the first time,
to confront the prospect of discarding my lifetime practice of anonymity
and coming forward to identify myself as the source. I would embrace my
principles by signing my name to them and let myself be condemned.
Altogether, the documents I selected fit on a single drive, which I left
out in the open on my desk at home. I knew that the materials were just as
secure now as they had ever been at the office. Actually, they were more
secure, thanks to multiple levels and methods of encryption. That’s the
incomparable beauty of the cryptological art. A little bit of math can
accomplish what all the guns and barbed wire can’t: a little bit of math can
keep a secret.

---

24
Encrypt
Most people who use computers, and that includes members of the Fourth
Estate, think there’s a fourth basic permission besides Read, Write, and
Execute, called “Delete.”
Delete is everywhere on the user side of computing. It’s in the hardware
as a key on the keyboard, and it’s in the software as an option that can be
chosen from a drop-down menu. There’s a certain finality that comes with
choosing Delete, and a certain sense of responsibility. Sometimes a box
even pops up to double-check: “Are you sure?” If the computer is second-
guessing you by requiring confirmation—click “Yes”—it makes sense that
Delete would be a consequential, perhaps even the ultimate decision.
Undoubtedly, that’s true in the world outside of computing, where the
powers of deletion have historically been vast. Even so, as countless
despots have been reminded, to truly get rid of a document you can’t just
destroy every copy of it. You also have to destroy every memory of it,
which is to say you have to destroy all the people who remember it, along
with every copy of all the other documents that mention it and all the
people who remember all those other documents. And then, maybe, just
maybe, it’s gone.
Delete functions appeared from the very start of digital computing.
Engineers understood that in a world of effectively unlimited options, some
choices would inevitably turn out to be mistakes. Users, regardless of
whether or not they were really in control at the technical level, had to feel
in control, especially with regard to anything that they themselves had
created. If they made a file, they should be able to unmake it at will. The
ability to destroy what they created and start over afresh was a primary

---

function that imparted a sense of agency to the user, despite the fact that
they might be dependent on proprietary hardware they couldn’t repair and
software they couldn’t modify, and bound by the rules of third-party
platforms.
Think about the reasons that you yourself press Delete. On your
personal computer, you might want to get rid of some document you
screwed up, or some file you downloaded but no longer need—or some file
you don’t want anyone to know you ever needed. On your email, you might
delete an email from a former lover that you don’t want to remember or
don’t want your spouse to find, or an RSVP for that protest you went to. On
your phone, you might delete the history of everywhere that phone has
traveled, or some of the pictures, videos, and private records it
automatically uploaded to the cloud. In every instance, you delete, and the
thing—the file—appears to be gone.
The truth, though, is that deletion has never existed technologically in
the way that we conceive of it. Deletion is just a ruse, a figment, a public
fiction, a not-quite-noble lie that computing tells you to reassure you and
give you comfort. Although the deleted file disappears from view, it is
rarely gone. In technical terms, deletion is really just a form of the middle
permission, a kind of Write. Normally, when you press Delete for one of
your files, its data—which has been stashed deep down on a disk
somewhere—is not actually touched. Efficient modern operating systems
are not designed to go all the way into the bowels of a disk purely for the
purposes of erasure. Instead, only the computer’s map of where each file is
stored—a map called the “file table”—is rewritten to say “I’m no longer
using this space for anything important.” What this means is that, like a
neglected book in a vast library, the supposedly erased file can still be read
by anyone who looks hard enough for it. If you only erase the reference to
it, the book itself still remains.
This can be confirmed through experience, actually. Next time you copy
a file, ask yourself why it takes so long when compared with the
instantaneous act of deletion. The answer is that deletion doesn’t really do
anything to a file besides conceal it. Put simply, computers were not
designed to correct mistakes, but to hide them—and to hide them only from
those parties who don’t know where to look.

---

T
HE WANING DAYS
of 2012 brought grim news: the few remaining legal
protections that prohibited mass surveillance by some of the most
prominent members of the Five Eyes network were being dismantled. The
governments of both Australia and the UK were proposing legislation for
the mandatory recording of telephony and Internet metadata. This was the
first time that notionally democratic governments publicly avowed the
ambition to establish a sort of surveillance time machine, which would
enable them to technologically rewind the events of any person’s life for a
period going back months and even years. These attempts definitively
marked, to my mind at least, the so-called Western world’s transformation
from the creator and defender of the free Internet to its opponent and
prospective destroyer. Though these laws were justified as public safety
measures, they represented such a breathtaking intrusion into the daily lives
of the innocent that they terrified—quite rightly—even the citizens of other
countries who didn’t think themselves affected (perhaps because their own
governments chose to surveil them in secret).
These public initiatives of mass surveillance proved, once and for all,
that there could be no natural alliance between technology and government.
The rift between my two strangely interrelated communities, the American
IC and the global online tribe of technologists, became pretty much
definitive. In my earliest years in the IC, I could still reconcile the two
cultures, transitioning smoothly between my spy work and my relationships
with civilian Internet privacy folks—everyone from the anarchist hackers to
the more sober academic Tor types who kept me current about computing
research and inspired me politically. For years, I was able to fool myself
that we were all, ultimately, on the same side of history: we were all trying
to protect the Internet, to keep it free for speech and free of fear. But my
ability to sustain that delusion was gone. Now the government, my
employer, was definitively the adversary. What my technologist peers had
always suspected, I’d only recently confirmed, and I couldn’t tell them. Or I
couldn’t tell them yet.
What I could do, however, was help them out, so long as that didn’t
imperil my plans. This was how I found myself in Honolulu, a beautiful city
in which I’d never had much interest, as one of the hosts and teachers of a

---

CryptoParty. This was a new type of gathering invented by an international
grassroots cryptological movement, at which technologists volunteered
their time to teach free classes to the public on the topic of digital self-
defense—essentially, showing anyone who was interested how to protect
the security of their communications. In many ways, this was the same
topic I taught for JCITA, so I jumped at the chance to participate.
Though this might strike you as a dangerous thing for me to have done,
given the other activities I was involved with at the time, it should instead
just reaffirm how much faith I had in the encryption methods I taught—the
very methods that protected that drive full of IC abuses sitting back at my
house, with locks that couldn’t be cracked even by the NSA. I knew that no
number of documents, and no amount of journalism, would ever be enough
to address the threat the world was facing. People needed tools to protect
themselves, and they needed to know how to use them. Given that I was
also trying to provide these tools to journalists, I was worried that my
approach had become too technical. After so many sessions spent lecturing
colleagues, this opportunity to simplify my treatment of the subject for a
general audience would benefit me as much as anyone. Also, I honestly
missed teaching: it had been a year since I’d stood at the front of a class,
and the moment I was back in that position I realized I’d been teaching the
right things to the wrong people all along.
When I say class, I don’t mean anything like the IC’s schools or briefing
rooms. The CryptoParty was held in a one-room art gallery behind a
furniture store and coworking space. While I was setting up the projector so
I could share slides showing how easy it was to run a Tor server to help, for
example, the citizens of Iran—but also the citizens of Australia, the UK,
and the States—my students drifted in, a diverse crew of strangers and a
few new friends I’d only met online. All in all, I’d say about twenty people
showed up that December night to learn from me and my co-lecturer, Runa
Sandvik, a bright young Norwegian woman from the Tor Project. (Runa
would go on to work as the senior director of information security for the