Like the public, I am conflicted about Snowden.
Clearly he’s a whistleblower, what he did required courage, and I have no reason to question his beliefs or motivations. Moreover, his revelations about government surveillance are very important and in some ways necessary for an informed debate about what our government is doing. I am better off knowing what I know. At the same time, we can’t have insiders scooping up mass documents and taking them out of security controls whenever they personally believe that they are serving the public’s interest.
Some things cannot be left up to the individual conscience because the resulting damage to national security would be too great.
The first issue is that although Snowden was technically an employee of the NSA, he accessed documents that he did not have a right to access. E.g. this is not just a matter of being a whistleblower, but of stealing documents and then reporting them.
Next, removal of classified information has the possibility of endangering on-going operations and risking human assets. It can undo years of work and aid enemies. Even if the media tried to carefully censor the information they released to the public to remove identifying data, they might get this wrong. It is difficult to partially censor a document — simple things like counting the number of letters blacked out on a page leak information. Unredacted fragments from multiple documents can be combined and an educated guess can be taken at the redacted contents. Information leakage is a technical challenge that newsrooms are not trained to prevent. Nor do newsrooms have enough information to determine what needs to be redacted and what doesn’t. If a spy uses the phrase “You can’t shoot Santa Claus”, then if the newsroom does not redact this phrase, a foreign agency might suspect someone using this phrase is a spy. But how would the newsroom know to redact this phrase? Methods and practices are leaked. Finally, by removing classified data you increase the risk that someone else will steal it from you. The IT departments of newsrooms are not very secure, nor should we expect them to adopt the types of security controls that are required to protect information like this. Put together, that means that when a document is leaked, all of it is leaked. Both the parts necessary to establish a law has been broken, and the parts necessary to compromise intelligence work. Leaking documents is the nuclear option.
At the same time, leaking documents isn’t a very effective way of creating reforms or enforcing the law. We are now getting lots of high profile leaks, and not a lot is happening on the policy front. In fact, people are becoming accustomed to the leaks and are growing to expect/accept these privacy violations. Leaking a document also shifts some of the focus away from the content, and onto the process — e.g. the fact that it was leaked. Just like a nuclear bomb, it’s a weapon whose power comes more from the threat of use than from the use itself. And repeated use comes with diminishing returns.
So what to do? A democracy is about compromises. The Snowden revelations tell us that the existing controls to protect our privacy aren’t working, so we can try to add better controls, such as independent review panels with teeth. Ultimately these institutional reforms are going to do the day-to-day work of protecting privacy. The positive effects of leaking, if any, are to strengthen the supervisory institutions by effectively punishing the ones being supervised (the intelligence community) and raise awareness of the lack of effective supervision. Nevertheless, we would like some intermediate options between “report issue to boss” and “release documents to a newspaper”.
One can imagine providing the documents to a third party that belongs to a separate branch of government, such as a division of the courts that has appropriate information security controls to securely conduct a type of grand jury or finding of facts. This “secrets” court cannot be in the executive branch. In this hearing, the accuser would make public statements of which laws were broken, and a private statement of facts to the secrets courts. The accused would have a right to privately dispute the facts or to dispute that laws were broken. If the secrets court determines that any laws were likely to be broken, then the fact findings are made public and the case is moved to an actual court. The accused is granted immunity from any prosecution related to how they obtained the facts or submitted them to the secrets court. Crucial to this is the granting of automatic security clearance to the secrets court, as well as granting blanket permission for any citizen to submit any data to the secrets court, even if the data does not belong to them, without any criminal penalties for submission of the data. Criminal penalties might apply if the citizen obtains the data unlawfully, submits it to the court, and the court finds that no laws were likely to be broken. I.e. if a sysadmin hacks into a network, steals documents that they should not have access to, and submits them to the secret court, then they are liable for criminal penalties if the court rules that no laws were likely to be broken. But if an employee turns over documents to the secret court that they do have clearance to see, then they will not be guilty of any criminal penalties regardless of what the secrets court rules.
It is not possible to meaningfully talk about oversight unless the oversight agency has full visibility. The relationship between the intelligence community and this third party must be one of supervised and supervisor, and should not be viewed as a partnership.
The above might work, as far as it goes, for more routine violations. But if the secrets court itself becomes co-opted, public disclosure is the last resort. But at least now there are other options. In the case of the nuclear option, there should at least be a legal defense that the disclosure was made with the public’s interest at heart in order to expose illegal activities, but even in this case, there should be an obligation on the whistleblower to be selective in the types of data that they remove from their employer. Indiscriminate public disclosure of data, because it contains a few incriminating facts, cannot be made legal, even if it is made in the public interest.