Permanent Record

Star Wars
’ famous wookie, Chewbacca. I realized, as one of them was
explaining to me the details of his targets’ security routines, that intercepted
nudes were a kind of informal office currency, because his buddy kept spinning
in his chair to interrupt us with a smile, saying, “Check 
her
out,” to which my
instructor would invariably reply “Bonus!” or “Nice!” The unspoken
transactional rule seemed to be that if you found a naked photo or video of an
attractive target—or someone in communication with a target—you had to show
the rest of the boys, at least as long as there weren’t any women around. That
was how you knew you could trust each other: you had shared in one another’s
crimes.
One thing you come to understand very quickly while using XKEYSCORE
is that nearly everyone in the world who’s online has at least two things in
common: they have all watched porn at one time or another, and they all store
photos and videos of their family. This was true for virtually everyone of every
gender, ethnicity, race, and age—from the meanest terrorist to the nicest senior
citizen, who might be the meanest terrorist’s grandparent, or parent, or cousin.
It’s the family stuff that got to me the most. I remember this one child in
particular, a little boy in Indonesia. Technically, I shouldn’t have been interested
in this little boy, but I was, because my employers were interested in his father. I
had been reading through the shared targeting folders of a “persona” analyst,

---

meaning someone who typically spent most of their day sifting through artifacts
like chat logs and Gmail inboxes and Facebook messages, rather than the more
obscure and difficult, typically hacker-generated traffic of the infrastructure
analysts.
The boy’s father, like my own father, was an engineer—but unlike my father,
this guy wasn’t government- or military-affiliated. He was just a regular
academic who’d been caught up in a surveillance dragnet. I can’t even remember
how or why he’d come to the agency’s attention, beyond sending a job
application to a research university in Iran. The grounds for suspicion were often
poorly documented, if they were documented at all, and the connections could be
incredibly tenuous—“believed to be potentially associated with” and then the
name of some international organization that could be anything from a
telecommunications standards body to UNICEF to something you might actually
agree is menacing.
Selections from the man’s communications had been sieved out of the stream
of Internet traffic and assembled into folders—here was the fatal copy of the
résumé sent to the suspect university; here were his texts; here was his Web
browser history; here was the last week or so of his correspondence both sent
and received, tagged to IP addresses. Here were the coordinates of a “geo-fence”
the analyst had placed around him to track whether he strayed too far from
home, or perhaps traveled to the university for his interview.
Then there were his pictures, and a video. He was sitting in front of his
computer, as I was sitting in front of mine. Except that in his lap he had a
toddler, a boy in a diaper.
The father was trying to read something, but the kid kept shifting around,
smacking the keys and giggling. The computer’s internal mic picked up his
giggling and there I was, listening to it on my headphones. The father held the
boy tighter, and the boy straightened up, and, with his dark crescent eyes, looked
directly into the computer’s camera—I couldn’t escape the feeling that he was
looking directly at me. Suddenly I realized that I’d been holding my breath. I
shut the session, got up from the computer, and left the office for the bathroom
in the hall, head down, headphones still on with the cord trailing.
Everything about that kid, everything about his father, reminded me of my
own father, whom I met for dinner one evening during my stint at Fort Meade. I
hadn’t seen him in a while, but there in the midst of dinner, over bites of Caesar
salad and a pink lemonade, I had the thought: