Laura,
At this stage I can offer nothing more than my word. I am a senior government employee in the intelligence community. I hope you understand that contacting you is extremely high risk and you are willing to agree to the following precautions before I share more. This will not be a waste of your time.
The following sounds complex, but should only take minutes to complete for someone technical. I would like to confirm out of email that the keys we exchanged were not intercepted and replaced by your surveillants. Please confirm that no one has ever had a copy of your private key and that it uses a strong pa**phrase. Assume your adversary is capable of one trillion guesses per second. If the device you store the private key and enter your pa**phrase on has been hacked, it is trivial to decrypt our communications.
Understand that the above steps are not bullet proof, and are intended only to give us breathing room. In the end if you publish the source material, I will likely be immediately implicated. This must not deter you from releasing the information I will provide.
Thank you, and be careful.
Citizen Four
…
You ask why I picked you. I didn't. You did. The surveillance you've experienced means you've been selected, a term which will mean more to you as you learn about how the modern sigint system works.
From now, know that every border you cross, every purchase you make, every call you dial, every cell phone tower you pa**, friend you keep, article you write, site you visit, subject line you type, and packet you route, is in the hands of a system whose reach is unlimited but whose safeguards are not. Your victimization by the NSA system means that you are well aware of the threat that unrestricted, secret abilities pose for democracies. This is a story that few but you can tell.
…
Laura,
I will answer what I remember of your questions as best I can. Forgive the lack of structure…I am not a writer, and I have to draft this in a great hurry.
What you know as Stellar Wind has grown. SSO, the expanded special source operations that took over Stellar Wind's share of the pie has spread all over the world to practically include comprehensive coverage of the United States. Disturbingly, the amount of US communications ingested by the NSA is still increasing.
Publicly, we complain that things are going dark, but in fact, their accesses are improving. The truth is that the NSA in its history has never collected more than it does now. I know the location of most domestic interception points, and that the largest telecommunication companies in the US are betraying the trust of their customers, which I can prove.
We are building the greatest weapon for oppression in the history of man, yet its directors exempt themselves from accountability. NSA director Keith Alexander lied to congress, which I can prove.
Billions of US communications are being intercepted. To gather evidence of wrongdoing, I focused on the wronging of the American people. But believe me when I say that the surveillance we live under is the highest privilege compared to how we treat the rest of the world. This I can also prove.
On cyber operations, the government's public position is that we still lack a policy framework. This too is a lie. There is a detailed policy framework, a kind of marshall law for cyber operations, created by the White House. It's called presidential policy 20 and was finalized at the end of last year. This I can also prove.
I appreciate your concern for my safety, but I already know how this will end for me and I accept the risk. If I have luck, and you are careful, you will have everything you need. I ask only that you ensure this information makes it home to the American public.
…
The encrypted archive should be available to you within seven days. The key will follow when everything else is done. The material provided and the investigative effort required will be too much for any one person. I recommend that at the very minimum you involve Glenn Greenwald. I believe you know him.
The plaintext of the payload will include my true name details for the record, though it will be your decision as to whether or how to declare my involvement. My personal desire is that you paint the target directly on my back. No one, not even my most trusted confidant, is aware of my intentions and it would not be fair for them to fall under suspicion for my actions. You may be the only one who can prevent that, and that is by immediately nailing me to the cross rather than trying to protect me as a source.
On timing, regarding meeting up in Hong Kong, the first rendezvous attempt will be at 10 A.M. local time on Monday. We will meet in the hallway outside of the restaurant in the Mira Hotel. I will be working on a Rubik's cube so that you can identify me. Approach me and ask if I know the hours of the restaurant. I'll respond by stating that I'm not sure and suggest you try the lounge instead. I'll offer to show you where it is, and at that point we're good. You simply need to follow naturally.
…
Let's disa**ociate your metadata one last time, so we don't have a clue or record of your true name in your file communication chain. This is obviously not to say you can't claim your involvement, but as every trick in the book is likely to be used in looking into this, I believe it's better that that particular disclosure come under your own terms. Thank you again for all you've done. …
If all ends well, perhaps the demonstration that our methods work will embolden more to come forward.
Citizen