officials to these three key questions “proved maddeningly diffi

138 | HOW AMERICA LOST ITS SECRETS officials to these three key questions “proved maddeningly diffi- cult.” He found that in mid-June NSA officials with whom he dealt were so “distraught at the massive security breach” that initially they refused to allow even CIA officers to participate in the ongoing security review. A former NSA executive told me there was “near panic” at the NSA. Finally, Morell called Chris Inglis, a former pro- fessor of computer science who had risen to be the NSA’s deputy director at the time of the breach. Inglis, who headed operations for the NSA, told him “the news was not good.” Among the data copied by Snowden were a large number of CIA secrets. By the time the CIA learned that its secrets had been compromised, Snowden was headed to Russia. The investigation of a crime involving potential espionage is no easy task. In this case, it required attempting to solve a jigsaw puz- zle in which not only were key pieces missing but also, because it involved adversary intelligence services, some of the found pieces might deliberately have been twisted to mislead the U.S. investigators. By late July, NSA investigators had made their initial assessment. © They determined that most of the material had been taken from © sealed-off areas known in intelligence speak as “compartments,” which in this case were files stored on computers that were isolated from any network. Each compartment electronically tracks all the activities that occur in it on its logs, including the password identity of any person who has gained entry to any compartment. From a forensic examination of these logs, NSA investigators were quickly able to reconstruct the timeline of the theft. The logs showed that an unauthorized party without proper passwords had begun copying files in mid-April, which was just days after Snowden began his job at the center. The illicit activity ended just before Snowden’s last day of work there. So this piece fit in with Snowden’s guilt. The size of the theft was another matter. Ledgett was certainly in a position to know (in the shake-up that followed, he would replace Inglis as deputy director of the NSA). According to Ledgett, the per- petrator had “touched” 1.7 million documents, moving from com- partment to compartment. Of these “touched” documents, according to the analysis of the logs, more than one million of them had been moved by the unauthorized party in mid-May to an auxiliary com- | | Epst_9780451494566_2p_all_r1.z.indd 138 ® 9/29/16 5:51 Pa | | HOUSE_OVERSIGHT_019626