HOUSE_OVERSIGHT_019626.jpg

138 | HOW AMERICA LOST ITS SECRETS

officials to these three key questions "proved maddeningly diffi-
cult." He found that in mid-June NSA officials with whom he dealt
were so "distraught at the massive security breach" that initially
they refused to allow even CIA officers to participate in the ongoing
security review. A former NSA executive told me there was "near
panic" at the NSA. Finally, Morell called Chris Inglis, a former pro-
fessor of computer science who had risen to be the NSA's deputy
director at the time of the breach. Inglis, who headed operations for
the NSA, told him "the news was not good." Among the data copied
by Snowden were a large number of CIA secrets. By the time the
CIA learned that its secrets had been compromised, Snowden was
headed to Russia.

The investigation of a crime involving potential espionage is no
easy task. In this case, it required attempting to solve a jigsaw puz-
zle in which not only were key pieces missing but also, because it
involved adversary intelligence services, some of the found pieces
might deliberately have been twisted to mislead the U.S. investigators.

By late July, NSA investigators had made their initial assessment.
They determined that most of the material had been taken from
sealed-off areas known in intelligence speak as "compartments,"
which in this case were files stored on computers that were isolated
from any network. Each compartment electronically tracks all the
activities that occur in it on its logs, including the password identity
of any person who has gained entry to any compartment. From a
forensic examination of these logs, NSA investigators were quickly
able to reconstruct the timeline of the theft. The logs showed that an
unauthorized party without proper passwords had begun copying
files in mid-April, which was just days after Snowden began his job
at the center. The illicit activity ended just before Snowden's last day
of work there. So this piece fit in with Snowden's guilt.

The size of the theft was another matter. Ledgett was certainly in
a position to know (in the shake-up that followed, he would replace
Inglis as deputy director of the NSA). According to Ledgett, the per-
petrator had "touched" 1.7 million documents, moving from com-
partment to compartment. Of these "touched" documents, according
to the analysis of the logs, more than one million of them had been
moved by the unauthorized party in mid-May to an auxiliary com-

Epst_9780451494566_2p_all_r1.z.indd 138
9/29/16 5:51 PM
HOUSE_OVERSIGHT_019626