The Man in Charge of Stopping the Next Snowden

William Evanina has never met Edward Snowden, but the two are intimately bound. As National Counterintelligence Executive — essentially the man in charge of American counterintelligence — Evanina is tasked with fixing the damage that leaks like Snowden’s have done to the U.S. intelligence community, and preventing new ones.

In the summer of 2013, Evanina was assistant special agent in charge of the FBI’s Washington, D.C., field office. When the Snowden breach was announced, he was put on the case.

“We worked from the FBI perspective: identifying him, what he’s about, trying to identify and drive criminal charges,” said Evania. Snowden was soon charged with violating the Espionage Act. (The former NSA contractor, who currently resides in Russia, is seeking a pardon from the Obama administration.)

In June 2014, after a stint working counterespionage with the CIA, Evanina came to direct the National Counterintelligence and Security Center, or NCSC, which is part of the Office of National Intelligence. He found the intelligence community scrambling to understand what had just happened, how Snowden’s data dump might affect everything from agents in the field to national-level operations. “At the time, my predecessor was busy working on ‘Oh my God, what’s out there, what’s been released, what’s been touched,’” he said.

Today, Evanina is “pretty confident” that the intelligence community could detect an insider theft on the scale of Snowden’s. (That’s 1.5 million classified documents, according to the House Intelligence Committee, a number Snowden calls misleading.)

Evanina says the intelligence community has grown much more adept at watching its people and data. But getting to this point has been a laborious process.

Earlier this summer, a group calling itself the Shadow Brokers came forward to auction off a set of cybertools it said belonged to the NSA. Sam Biddle at The Intercept used previously unreleased Snowden documents to confirm the authenticity of the data.

Many in Washington accused Russia of being behind the theft. But national intelligence writer James Bamford came to a different conclusion: the heist was likely an inside job by a second Snowden.

“Rather than the NSA hacking tools being snatched as a result of a sophisticated cyber operation by Russia or some other nation, it seems more likely that an employee stole them,” Bamford wrote in a Reuters op-ed. “Experts who have analyzed the files suspect that they date to October 2013, five months after Edward Snowden left his contractor position with the NSA and fled to Hong Kong carrying flash drives containing hundreds of thousands of pages of NSA documents.”

Neither the NSA nor Evanina would comment directly on the case, as it's still under investigation. But asked when the IC developed the ability to reliably stop an insider from stealing millions of documents, Evanina answered, “Subsequent to the 2014 [executive correspondence] that Director Clapper put out, [mandating] the requisite stop-gap measures … early winterish of 2014.”

That suggests that Bamford’s hypothesis is plausible.

We put the question to NSA chief Adm. Michael Rogers at the Billington CyberSecurity Summit: could his agency have stopped a second Snowden in fall 2013? He did not answer directly…but he did laugh out loud.

“To no extent are we capable of stopping someone from doing damage who wants to. It’s not possible,” said Evanina, “The same way you can’t stop someone from starting a fire who wants to be an arsonist.”

The questions he asks now, he said, are, “How fast can you get to that fire and put it out, and how fast can you catch him?”

Cleaning Up after Snowden

Figuring out “What’s out there? What’s been released? What’s been touched,” means constructing an inventory of the tactics, techniques, procedures, and operations that Snowden damaged through his disclosure, what Evanina calls the “equities.” It’s a huge part of his job to this day.

The Snowden dump disclosed a wide list of expensive and sophisticated espionage techniques. Among them were the ability of U.S. spies to break into common webcams, target individuals for drone strikes based on cellphones SIM cards, collect Internet communications, and, of course, store telephony metadata in bulk.

(The intelligence community has always maintained that they have used such tools, which have names like Optic Nerve, Gilgamesh, and Xkeyscore, in accordance with U.S. law. After a New York federal appeals court ruled the practice of storing bulk metadata on Americans to be illegal, the government ended the practice.)

“We literally worked to identify the data that he touched, the data that he exposed in the media,” Evanina said. Then his team worked to figure out both the overall national security impact, as well as the effect on individual agencies, such as the National Geospatial Intelligence Agency, the CIA, and FBI.

“Those agencies will dig down deep and figure out what those equities are for themselves,” he said.

While the headlines around the disclosure have faded, the details of the programs still make their way into trade and academic journals, says Evanina. The public doesn’t notice, but “foreign adversaries care,” he says.

Every time a new detail, or simply a new analysis of an old detail, hits the web, Evanina and his group have to calculate how it will affect current and future operations. They also analyze who will gain the most from the new revelation.

“For instance,” he says, “imagine there’s an article in Der Spiegel on how the NSA can tell if you have a white phone or a blue phone?” It’s Evanina's job to figure out, “Who would really want to know that? If everybody knows we can tell white and blue phones, the damage is minimal. If no one knows that we have both white and blue telephones, then who benefits the most? The Russians or the Chinese?”

The NCSC does that with the help of a task force whose members, drawn from various intelligence agencies, get together either in person or over the phone on a nearly weekly to figure out exactly how much insider information is still outside and what it means. It reports to Congress and to the Director of National Intelligence every six months.

Spying on Spies

Evanina is also responsible for preventing, or at least mitigating the damage from, new insider leaks. The IC has begun spying on itself more effectively, setting up methods to monitor “patterns of life” — not just of people, but data as well. He says the intelligence community has done “a great job of putting sirens and bells on the movement of data,” applying the same level of scrutiny to a systems administrator as a major operative.

Some of this was conceived years before Snowden made off with the files. Executive Order 13587, issued in 2011, ordered the IC to develop ways to continuously evaluate everyone who holds a Top Secret clearance. The goal is to automatically scan for things like arrests, foreign travel, even worrisome social media content (that’s public-facing, not hidden behind privacy settings), and other potential red flags in real time, as opposed to every five years, as standard background checks do. But continuous evaluation is also supposed to scan for signals such as how often a worker might come in on the weekends, if he or she is attempting to access new data sources, unusual printer use — anything that could indicate a change to pattern of life.

With continuous evaluation now in place across almost all of the intelligence community, the watchers have become the watched. For a group of people that value their own privacy (if not necessarily everyone else’s), that’s a tough sell, one that Evanina must make constantly. He holds town halls roughly every 70 days to answer concerns and questions from the community.

Next comes the Defense Department, a much larger challenge. They may feel differently about insider threat detection than members of the NSA. It’s something that worries Evanina.

It worries the NSA as well.

“If the price of your security becomes: you drive away the very work force that you need to execute your mission, that’s not a great place to be,” the NSA’s Rogers said Tuesday. “If you make it one or the other, you will have a very bad outcome.”

Defense One spoke to one NSA staffer about life under continuous evaluation. “I just assume it’s happening,” said the staffer, who spoke anonymously because his bosses had not authorized him to speak to the media about internal NSA matters. “You consent to that when you work there. I’ve never noticed any degradation to my work performance.”

Evanina is under no illusion that data monitoring or continuous evaluation will end data leakage. Data derives its value the same way it derives its vulnerability, through its utility and sharability. “If someone comes in with intent to steal data? They’ll find a way to do it. We can’t stop it all. We can minimize the data that they can take, minimize the spillage outside of the organization, minimize the damage,” he says.

Edward Snowden, who spoke via the internet to a group in New York on Wednesday,two days before the debut of a major motion picture about his adventure, said essentially the same thing.

At one point, Snowden took a moment to acknowledge Thomas Drake, a computer scientist who attempted to blow the whistle on what he saw as an abuse of power at the agency years ago. Drake attempted to work through proper channels, going to the NSA and to Congress. His efforts yielded no result. When he showed unclassified information to a newspaper reporter, he was charged with violating the Espionage Act. The case against him was dropped after an expensive legal fight. The message Snowden drew: the normal channels don’t work.

Without people like Drake, Snowden said, “there could not have been an Edward Snowden…I get a lot of accolades; I get a lot of acknowledgement for what I did. But it’s really only a continuation of a much larger story and I’m really only a small part of it.”

One way to prevent future Edward Snowdens is to prevent future Thomas Drakes, which will require lawmakers to ensure whistleblowers have a real avenue to disclose information in the public interest. Members of the IC say that avenue exists today; advocates for whistleblowers disagree. Until that debate is resolved, Evanina will be on hand to plug the leaks that occur.