The Snowden Disclosures — The Day NSA Mass Surveillance Became Public

Late on 5 June 2013, The Guardian posted a story by Glenn Greenwald with the headline "NSA collecting phone records of millions of Verizon customers daily". Attached to it was a scan of a secret order from the Foreign Intelligence Surveillance Court compelling Verizon to hand over all call metadata — a document that put the Fourth Amendment's prohibition on unreasonable search and seizure squarely back on the table for domestic communications.

The next day, 6 June, The Guardian and The Washington Post simultaneously broke PRISM — a programme through which the NSA obtained communications from nine US providers: Microsoft, Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, and Apple. A leaked NSA slide bluntly described the collection as coming "directly from the servers" of those companies. That phrase turned out to be the most misleading line in the whole archive: PRISM ran under Section 702 of the Foreign Intelligence Surveillance Act, and the providers were served with court-approved directives they were legally compelled to obey — not, as the slide implied, tapped at will.

Then on 9 June, a video filmed in the Mira Hotel in Hong Kong was published. The man on camera identified himself as Edward Snowden, a 29-year-old systems administrator working for the NSA contractor Booz Allen Hamilton.

The Scope of What Was Revealed

Over the following months, journalists Greenwald, Laura Poitras, Barton Gellman, and Ewen MacAskill worked through an archive whose size has never been agreed on: early estimates put it at 50,000 to 200,000 documents, the US Department of Defense later claimed 1.7 million files had been touched, and Greenwald has said he received nine to ten thousand. Only a small fraction was ever published — The Guardian's editor said in December 2013 that the paper had published 26 documents out of the 58,000 it had seen. The major programmes included:

• PRISM. Collection from major US Internet companies under Section 702 of FISA — "downstream" collection, in the NSA's own vocabulary. Each company replied that compliance was statutorily compelled, not voluntary.
• XKeyscore. A query interface that the NSA itself described as giving analysts near-real-time search over global Internet activity — emails, chats, browsing histories, and source IPs.
• Upstream collection. The other half of Section 702, and the one most often confused with PRISM: instead of asking the providers, the NSA took traffic off the Internet backbone itself, via optical splitters installed on the trunk fibres of AT&T, Verizon, and others. The AT&T facility at 611 Folsom Street, San Francisco — "Room 641A", exposed by the technician Mark Klein back in 2006, long before Snowden — became its emblem.
• Bullrun / Edgehill. The NSA's and GCHQ's campaign against encryption: influence on standards bodies, demands for backdoors in commercial crypto products, and the alleged deliberate weakening of Dual_EC_DRBG, a pseudorandom number generator that NIST had standardised.
• MUSCULAR. Direct interception of the unencrypted fibre links running between Google's and Yahoo's own data centres — at the time, intra-company traffic was largely clear-text.
• Tempora. Mass tapping by Britain's GCHQ of transatlantic submarine fibre cables.
• Allied leaders. The interception of Chancellor Angela Merkel's mobile phone, Brazilian President Dilma Rousseff's communications, and traffic from the UN and EU missions — confirming that close allies were also routine targets.

Snowden the Person

Snowden had moved between a CIA technical job and NSA contractor roles, working most recently at the NSA's regional operations centre in Hawaii. He flew out of Hawaii to Hong Kong on 20 May 2013, telling his employer he needed treatment for epilepsy, and there summoned Greenwald and Poitras.

A criminal complaint charging him under the Espionage Act was filed on 14 June and unsealed on 21 June 2013. Hong Kong declined the US extradition request on technical grounds, and Snowden boarded a flight to Moscow intending to continue to Ecuador via Cuba and Venezuela. But the US then revoked his passport, leaving him stranded for 39 days in the transit zone of Sheremetyevo Airport, from 23 June until 1 August 2013, when Russia granted him a year's temporary asylum. In September 2022, by presidential decree, he was granted Russian citizenship. As of 2026 he still lives in Russia.

The Shock to Technology and Society

The technical aftershocks were immediate and large. TLS adoption between services accelerated sharply after 2013, and HTTPS Everywhere moved from a campaign slogan to an industry norm. Google, Yahoo, and Microsoft rushed to encrypt inter-data-centre fibre links. End-to-end-encrypted messaging — Signal (Open Whisper Systems, later the Signal Foundation), WhatsApp (which adopted the Signal Protocol by default in 2016), and iMessage — moved into the mainstream as a direct result of the post-Snowden moment.

Legally, the USA Freedom Act (2015) ended NSA bulk collection of domestic call metadata. In Europe, the Schrems I (2015) and Schrems II (2020) judgements struck down the Safe Harbour and Privacy Shield frameworks for transatlantic data transfer in turn. The question of whether EU citizens' data can sit in US clouds remains live to this day.

Intellectually, Shoshana Zuboff's surveillance capitalism, a re-evaluation of the cypherpunks' framing of encryption as civil rights, and the now-default suspicion that "big tech is a partner of the surveillance state" all belong to the post-2013 landscape.

From Speculation to Documented Evidence

The lasting significance of the Snowden disclosures is that the fact of organised, planet-scale, bulk interception of Internet communications by the US and UK intelligence services — including communications of allied states — moved from speculation to documented evidence. With that, debates about security, encryption, and privacy stopped being a hacker subculture and became a central political question for democracies.

Thirteen years later, parts of the leaked archive remain unpublished, and the battle over surveillance and encryption — the "going dark" debate, client-side scanning, the EU's Chat Control proposals — continues in new forms.