Executive Summary ofReview ofthe

Unauthorized Disclosures ofFormer National

Security Agency Contractor Edward Snowden

September 15, 2016

UNCLASSIFIED
INCLASSIFIED

In June 2013, fiormer National Security Agency O\TSA) contractor Edward Snowden

perpetrated the largest and most damaging Public release ofclassified information in U.S.

intelligence history. In August 2014, the Chaimlan and Ranking Member ofthe House

Permanent Select Committee on Intelligence (HPSCI) directed Committee staffto carry out a

comprehensive review ofthe unauthorized disclosures. The aim ofthe review was to allow the

Committee to explain to other Members ofCongress-and, where possible, the American

people-how this breach occurred, what the U.S. Govemment lmows about the man who

committed it, and whether the security shortfalls it highlighted had been remedied.

Over the next two years, Committee staffrequested hundreds ofdocuments from the

Intelligence Community (IC), participated in dozens ofbriefings and meetings with IC

personnel, conducted several interviews with key individuals with lmowledge ofSnowden,s

background and actions, and traveled to NSA Hawaii to visit Snowden,s last two work locations.

The review fiocused on Snowden's background, how he was able to remove more than 1.5

million classifled documents from secure NSA networks, what the 1.5 million documents

contained, and the damage their removal caused to national security.

The Committee,s review was careful not to disturb any criminal investigation or future

prosecution of Snowden, who has remained in Russia since he fled there on June 23, 2013.

Accordingly) the Committee did not interview individuals whom the Depatment ofJustice

identified as possible witnesses at Snowden,s trial, including Snowden himself, nor did the

Committee request any matters that may have occurred befiore a grandjury. Instead, the IC

provided the Committee with access to other individuals who possessed substantively similar

lmowledge as the possible witnesses. Similarly, rather than interview Snowden,s NSA coworkers and supervisors directly, Committee staffinterviewed IC personnel who had reviewed

reports ofinterviews with Snowden,s co-workers and supervisors. The Committee remains

hopeful that Snowden will retum to the United States to facejustice.

The bulk ofthe Committee,s 36-page review, which includes 230 fiootnotes, must remain

classified to avoid causing further harm to national security; however, the Committee has made a

number ofunclassified flndingS. These findings demonstrate that the public narrative

popularized by Snowden and his allies is rife with falsehoods, exaggerations, and crucial

omissions, a pattem that began befiore he stole 1.5 million sensitive documents.

First, Snowden caused tremendous damage to national security, and the vast

majority ofthe documents he stole have nothing to do with programs impacting individual

privacy interests-they instead pertain to military, defense? and intelligence programs of

great interest to America,s adversaries. A review ofthe materials Snowden compromised

makes clear that he handed over secrets that protect American troops overseas and secrets that

provide vital defienses against terrorists and nation-states. Some of Snowden,s disclosures

exacerbated and accelerated existing trends that diminished the IC,s capabilities to collect

against legitimate foreign intelligence targets, while others resulted in the loss ofintelligence

streams that had saved American lives. Snowden insists he has not shared the full cache of 1.5

million classified documents with anyone; however, in June 2016, the deputy chairman ofthe

Russian parliaments defense and security committee publicly conceded that G6Snowden did share

1

INCLASSIFIED
ENCLASSIFIED

intelligence" with his govemment. Additionally, although Snowden's professed objective may

have been to inform the general public, the infiormation he released is also available to Russian,

Chinese, Iranian, and North Korean govemment intelligence services; any terrorist with Intemet

access; and many others who wish to do harm to the United States.

The full scope ofthe damage inflicted by Snowden remains unkno\un. Over the past

three years, the IC and the Department ofDefiense (DOD) have carried out separate reviewswith differing methodologies-fthe damage Snowden caused. Out ofan abundance ofcaution,

DOD reviewed all 1.5 million documents Snowden removed. The IC, by contrast, has carried

out a damage assessment fior only a small subset ofthe documents. The Committee is concemed

that the IC does not plan to assess the damage ofthe vast majority ofdocuments Snowden

removed. Nevertheless, even by a conservative estimate, the U.S. Govemment has spent

hundreds ofmillions ofdollars, and will eventually spend billions, to attempt to mitigate the

damage Snowden caused. These dollars would have been better spent on combating America,s

adversaries in an increasingly dangerous world.

Second, Snowden was not a whistleblower. Under the law, publicly revealing

classifled information does not qualify someone as a whistleblower. However, disclosing

classified infomlatiOn that Shows fraud, Waste, abuse, Or Other illegal activity tO the appropriate

law enforcement or oversight personnel-including to Congressuloes make someone a

whistleblower and affords them with critical protections. Contrary to his public claims that he

notifled numerous NSA offilCialS about What he believed tO be illegal intelligence COllection, the

Committee fiound no evidence that Snowden took any official effort to express concems about

U.S. intelligence activities-legal, moral, or otherwise-to any oversight officials Within the

U.S. Govemment, despite numerous avenues for him to do so. Snowden was aware ofthese

avenues. His only attempt to contact an NSA attomey revolved around a question about the

legal precedence ofexecutive orders, and his only contact to the Central Intelligence Agency

(CIA) Inspector General (IG) revolved around his disagreements with his managers about

training and retention ofinfiormation technology specialists.

Despite Snowden's later public claim that he would have faced retribution for voicing

concems about intelligence activities, the Committee found that laws and regulations in effect at

the time ofSnowden,s actions afforded him protection. The Committee routinely receives

disclosures from IC contractors pursuant to the Intelligence Community lThistleblower

Protection Act of 1998 (IC WPA). IfSnowden had been worried about possible retaliation fior

voicing concems about NSA activities, he could have made a disclosure to the Committee. He

did not. Nor did Snowden remain in the United States to fdee the legal consequences ofhis

actions, contrary to the tradition ofcivil disobedience he profiesses to embrace. Instead, he fled to

China and Russia, two countries whose govemments place scant value on their citizens' privacy

or civil liberties-and whose intelligence services aggressively collect information on both the

United States and their o\hm citizens.

To gather the files he took with him when he left the country for Hong Kong, Snowden

infringed on the privacy ofthousands ofgovemment employees and contractors. He obtained

his colleagues, security credentials through misleading means, abused his access as a systems

2

UNCLASSIFIED
tINCLASSIFIED

administrator to search his co-workers, personal drives, and removed the personally identiflable

infio-ation ofthousands ofIC employees and contractors. From Hong Kong he went to Russia,

where he remains a guest ofthe Kremlin to this day.

It is also not clear Snowden understood the numerous privacy protections that govem the

activities ofthe IC. He failed basic annual training fior NSA employees on Section 702 ofthe

Foreign Intelligence Surveillance Act (FISA) and complained the training was rigged to be

overly difflCult. This training included explanations ofthe privacy protections related to the

PRISM program that Snowden would later disclose.

Third, two weeks before Snowden began mass downloads ofclassified documents,

he was reprimanded after engaging in a workplace spat with NSA managers. Snowden was

repeatedly counseled by his managers regarding his behavior at work. For example, in June

2012, Snowden becanle involved in a fiery e-mail argument With a Supervisor about how

computer updates should be managed. Snowden added an NSA senior executive several levels

above the supervisor to the e-mail thread, an action that eamed him a swift reprimand from his

contracting offlcer for failing to fiollow the proper protocol fior raising grievances through the

chain ofcommand. Two weeks later, Snowden began his mass do\unloads ofclassified

information from NSA networks. Despite Snowden's later claim that the March 2013

congressional testimony ofDirector ofNational Intelligence James Clapper was a 66breaking

point" fior him, these mass do\unloadspredrfed Director Clapper's testimony by eight months.

Fourth, Snowden was, and remains) a serial exaggerator and fabricator. A close

review of Snowden's official employment records and SubmiSSiOnS reveals a Pattem Of

intentional lying. He claimed to have left A-y basic training because ofbroken legs when in

fact he washed out because ofshin splints. He claimed to have obtained a high school degree

equivalent when in fact he never did. He claim,ed to have worked fior the CIA as a c6senior

advisor," which was a gross exaggeration ofhis entry-level duties as a computer technician. He

also doctored his performance evaluations and obtained new positions at NSA by exaggerating

his r6sum6 and stealing the answers to an employment test. In May 2013, Snowden informed his

supervisor that he would be out ofthe offlCe tO receive treatment for worsening epilepsy. In

reality, he was on his way to Hong Kong with stolen secrets.

Finally) the Committee remains concerned that more than three years after the start

ofthe unauthorized disclosures, NSA, and the IC as a whole} have not done enough to

minimize the risk ofanother massive unauthorized disclosure. Although it is impossible to

reduce the chance ofanother Snowden to zero, more work can and should be done to improve

the security ofthe people and computer networks that keep America,s most closely held secrets.

For instance, a recent DOD Inspector General report directed by the Committee found that NSA

has yet to effectively implement its post-Snowden security improvements. The Committee has

taken actions to improve IC information security in the Intelligence Authorization Acts for Fiscal

Years 2014, 2015, 2016, and 2017, and looks forward to working with the IC to continue to

improve security.

3

ENCLASSIFIED