← The canon · AItopiaOrAImageddon?

The Snowden disclosures — the scale of automated collection becomes a public fact

moment · Edward Snowden, who took the documents and chose the journalists; Laura Poitras, Glenn Greenwald and Ewen MacAskill, who reported the first Guardian stories; Barton Gellman, who reported the Washington Post's; and the two newspapers, which decided what to publish and what to hold · 2013

Something that happened and changed what people expected next.

Descends from The TCP/IP cutover — federation without a centre, Nineteen Eighty-Four. Read on: Cambridge Analytica — the harvest is documented, the persuasion never was, March 2020 — the week the platforms told the world their machines would be doing the judging, The Twitter acquisition — the ownership change that closed the most-studied corpus of public speech.

Filed under idea in proposals.md; written here as moment, and unlike apt1-attribution-2013 the correction is worth arguing, because the idea reading is defensible. The proposal describes something framing-shaped: "the point at which the scale of automated collection became a public fact rather than an inference," to be cited "when a capability's reach is being estimated from what an operator says about it." That is a lens, and lenses are what idea is for.

It still fails the kind, on the same clause the canon has now used three times. The house definition of idea — fixed by build.py and by tcp-ip-1983 — is "a framing later work is built out of rather than argued about." The meaning of these disclosures has been argued about continuously for thirteen years, by two federal appellate courts reaching for different remedies, by a five-member oversight board that split three to two, by a congressional committee that called the leaker a "serial exaggerator and fabricator," and by the leaker, who is alive and answers back. There is no settled framing here to inherit. There is a date, and a very large change in what everybody expected next.

Why moment holds, on the clause that has done the work elsewhere. eliza-1966 talked its way out of moment and fixed the definition as a date on which something visibly happened in public; tcp-ip-1983 and unix-linux-1969-1991 both failed on "in public," each having been announced to a few hundred administrators. This one passes as emphatically as apt1-attribution-2013 does and for the same reason: on 5 June 2013 a national newspaper published a secret court order, and the following morning everyone in the world could read what a specific government was actually doing. What changed next is exactly what the kind requires. Within a year the IETF had declared pervasive monitoring a protocol-design attack, the European Court of Justice was being asked to strike down the legal basis for transatlantic data transfer, and the largest technology companies had begun encrypting traffic they had left in the clear.

One kind was genuinely close: interpretation. The strongest version of this entry is not "documents were published" but "the published account of a system and the deployed system were very far apart, and only disclosure closed the gap" — a reading of events, which is what interpretation is for. It is rejected because the reading is downstream of the event and cannot be dated without it, and because the entry has to carry the documents themselves. A reading citing this needs the FISC order and the slide deck, not a thesis about them.

The descent, and three ancestors that are missing

tcp-ip-1983. That entry was written about federation without a centre, and this is the bill for it arriving. A network that routes by agreement rather than by permission ends up with physical chokepoints — cables, exchanges, the front doors of a handful of companies — and everything in this entry is collection at one of those. The protocol also carries no confidentiality of its own, which is why traffic between two of Google's own data centres could be read from a tap without touching Google: the encryption was applied at the front end and removed there, and the private middle was plaintext. The limit of the edge, so it is not over-claimed: tcp-ip-1983 argued the architecture abolished permission's centre, not permission itself. The property this entry needs is the adjacent one — that the design left confidentiality and source authentication to the endpoints — and the canon still has no entry for the end-to-end argument. The same gap was recorded in apt1-attribution-2013; it is now the second entry to want it.

nineteen-eighty-four-1949. This edge is unusually literal. On 16 December 2013 a US federal judge, Richard Leon, described the programme in Klayman v. Obama as "almost-Orwellian technology that enables the government to store and analyze the phone metadata of every telephone user in the United States." The frame reached the bench in six months. Note what the fiction entry establishes and this one inherits: Orwell wrote a satire and refused the role of forecaster, and his machinery was a telescreen watched by a person. The system disclosed in 2013 has the opposite shape — nobody watching, everything retained, the selection done later by query and eventually by classifier. A reading citing both should say that the resemblance is in the ambition and not in the mechanism, because the mechanism is the interesting part and Orwell got it wrong.

Three ancestors wanted and absent. mobile-phone-1973 sits unwritten in proposals.md and is the substrate of the entire second half of this entry: SKYNET is a classifier over GSM records, and GSM records exist because most of the species volunteered to carry a location beacon. There is no id for Smith v. Maryland (1979) and the third-party doctrine, which is the legal hinge — the holding that a person has no reasonable expectation of privacy in numbers dialled because they were handed to the phone company — and without it the legal half of this entry has to be explained from scratch every time. And there is no id for the end-to-end argument, per above. All three are gaps in the canon rather than in the history.

What it is

The week

On 5 June 2013 The Guardian published a secret order of the Foreign Intelligence Surveillance Court. The PCLOB's own report dates it identically — "On June 5, 2013, the British newspaper The Guardian published an article based on unauthorized disclosures of classified documents by Edward Snowden, a contractor for the NSA, which revealed the telephone records program to the public" — which is worth noting because it means the United States government's own oversight body records the leak as the moment of publication. The order, signed by Judge Roger Vinson on 25 April 2013, directed Verizon Business Network Services to produce to the NSA, daily and on an ongoing basis, "all call detail records or 'telephony metadata'" for calls "wholly within the United States, including local telephone calls."

The next day both The Guardian and The Washington Post published PRISM, collection from named US internet companies under section 702. On 9 June, in a video shot in a Hong Kong hotel room, the source identified himself. Over the following eighteen months came programme after programme: BOUNDLESS INFORMANT, the volume-counting tool; XKEYSCORE, the query front end; TEMPORA, GCHQ's cable tapping; MUSCULAR, the interception of Google's and Yahoo's unencrypted internal links; DISHFIRE, bulk text messages; OPTIC NERVE, GCHQ's bulk capture of webcam stills; MYSTIC, whole-country call recording on a rolling buffer.

The single most quoted artifact is a hand-drawn slide. In the MUSCULAR material, a sketch of Google's architecture carries an arrow at the boundary of the private network and the words "SSL added and removed here!" followed by a smiley face. It is quoted so often because it compresses the whole finding: the security was real, it was applied at the wrong boundary, and someone inside the collecting agency thought that was funny enough to draw.

What was already known, by whom, and why it did not matter

This is the part of the story that makes the entry useful, and it is usually left out. The gap was not unsuspected. It had been announced, in public, by people with clearances, and nothing happened.

On 26 May 2011, during the PATRIOT Act reauthorisation debate, Senator Ron Wyden told the Senate: "When the American people find out how their government has secretly interpreted the Patriot Act, they will be stunned and they will be angry." He and Senator Mark Udall said repeatedly, over two years, that there were effectively two PATRIOT Acts — the text and the classified interpretation — and that most members of Congress had read only the one that did not matter. They were on the Intelligence Committee. They could not say more. The reauthorisation passed.

On 12 March 2013, at an open hearing, Wyden asked the Director of National Intelligence, James Clapper: "Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?" Clapper answered: "No, sir." He added, "Not wittingly. There are cases where they could, inadvertently perhaps, collect — but not wittingly." Eighty-five days later the Verizon order was on the front page.

Clapper's own account moved twice. To Andrea Mitchell on NBC on 8 June 2013 he called Wyden's question unanswerable — "when are you going to stop beating your wife" — and said, "So I responded in what I thought was the most truthful, or least untruthful, manner by saying 'no'." In a letter to committee chair Dianne Feinstein dated 21 June 2013 he called the answer "clearly erroneous" and apologised, explaining that he had been thinking of content rather than metadata and had simply not thought of the relevant section of the PATRIOT Act. He was never charged; the statute of limitations ran.

The oversight machinery had also been told, repeatedly, and by the government. On 3 October 2011 the FISC's Judge John D. Bates wrote, in an opinion declassified only in August 2013, that he was "troubled that the government's revelations regarding NSA's acquisition of Internet transactions mark the third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection program." Three times in three years, to the court whose approval was the programme's legal foundation.

And the reasoning itself had never been written down where anyone could read it. The bulk telephone programme ran under presidential authorisation from late 2001, renewed every thirty to forty-five days; the FISC first ordered it under section 215 in May 2006, relying heavily on a 2004 opinion approving bulk internet metadata collection under a different provision. The first judicial opinion explaining the court's legal reasoning was issued by Judge Claire Eagan on 29 August 2013 — seven years after the first order, and twelve weeks after the leak. The programme's justification was published because it had been exposed, not because anything in the design of the oversight required it.

The AI half: SKYNET

The entry's reason for existing in this canon is a twenty-slide NSA deck, classified TOP SECRET//COMINT//REL TO USA, FVEY, titled "SKYNET: Courier Detection via Machine Learning" and dated 5 June 2012 — a date exactly one year before the first Guardian story, which is a coincidence and is recorded as one. It was published by The Intercept on 8 May 2015. This deck was read directly for this entry, page by page, and everything in this section is transcribed from it.

The question on slide two: "Given a handful of courier selectors, can we find others that 'behave similarly' by analyzing GSM metadata?" The method, stated in the same panel: "we are looking for different people using phones in similar ways," "without using any call chaining techniques from known selectors," "by scanning through all selectors seen in Pakistan that have not left Af/Pak (~55M)."

Eighty behavioural features, grouped as "pattern-of-life, social network, and travel behavior." Training data: seven MSISDN/IMSI pairs of known Al-Qa'ida senior leadership couriers, leave-one-out cross-validated, later augmented by scraping selectors out of internal reports matching the keyword "courier." The negative class, stated on the slide as an assumption: "Assume that random draws of Pakistani selectors are nontargets." One hundred thousand random selectors, labelled not-a-courier because they were drawn at random.

The results, in the deck's own words. A centroid detector first, then: "Statistical algorithms are able to find the couriers at very low false alarm rates, if we're allowed to miss half of them" — a random forest at 0.18% false alarm rate at 50% miss rate, improved by the scraped training data to 0.008% at 50% miss, "46x improvement over random performance." Run "on +55M Pakistani selectors via MapReduce." Of the top 500 scoring selectors, 21 were already tasked, "leading us to believe that we're on the right track."

And then slide seventeen. "The highest scoring selector that traveled to Peshawar and Lahore is PROB AHMED ZAIDAN," with a photograph, a redacted TIDE watchlist number, and three bullets: "MEMBER OF AL-QA'IDA," "MEMBER OF MUSLIM BROTHERHOOD," "WORKS FOR AL JAZEERA." Ahmad Muaffaq Zaidan was Al Jazeera's Islamabad bureau chief, a journalist who had spent years interviewing Taliban and al-Qaeda figures including bin Laden. He denied membership of either organisation. His response, as reported: "To assert that myself, or any journalist, has any affiliation with any group on account of their contact book, phone call logs, or sources is an absurd distortion of the truth and a complete violation of the profession of journalism."

The deck's own last slide is candid: "Preliminary results indicate that we're on the right track, but much remains to be done."

The statistical criticism, and why it is the important part. Patrick Ball of the Human Rights Data Analysis Group, reviewing the deck for Ars Technica in February 2016, called the methodology "ridiculously optimistic" and "completely bullshit." The objection is not aesthetic. Training a classifier on seven positives, taking 100,000 random draws as clean negatives when some unknown number of them are couriers, and then quoting the resulting false-alarm rate as though it were measured, produces a number with no defensible relationship to performance in the field. Applied to 55 million people, 0.008% is roughly 4,400 people; the deck's own less-favourable operating point, 0.18%, is roughly 99,000.

What must not be claimed, and the canon says so twice. There is no established causal chain from a SKYNET score to a strike. The deck describes research; the reporting describes a watchlisting; the operational link is contested and undocumented. SCALE.md's 2015 landmark is worded to avoid exactly this claim, and its own note says so — the landmark "is worded to describe the documented programme and its published statistical critique, not to assert a body count." This entry holds the same line. What the deck establishes is narrower and quite bad enough: a classifier trained on seven examples produced a ranked list of 55 million people, the person at the top of one of its lists was a journalist, and the people who built it wrote "much remains to be done" on the last slide.

The adjacent quotation, which is real and is routinely stretched: at a Johns Hopkins debate on 1 April 2014, former NSA and CIA director Michael Hayden, agreeing with David Cole's point that metadata is more revealing than people assume, said, "We kill people based on metadata." He was speaking about foreign targeting, and explicitly not about the domestic telephone programme. Both halves of that belong in any citation of it.

Why a reading would cite it

The concrete case, four occasions, all live.

1. When a capability's reach is being estimated from what its operator says about it. This is the entry's primary use and the proposal's own wording. The standing case is that in 2013 the gap between the public account of a deployed system and the system was very large; that the gap was flagged in public by cleared legislators two years early and did not close; that the supervising court was substantively misinformed three times in three years; and that what closed it was an unauthorised disclosure by one contractor. The transferable claim is not "operators lie." It is that the mechanisms designed to close such gaps did not close this one, and a reading estimating a capability from a vendor's or an agency's description should price that in explicitly rather than treat the description as a floor.

2. When an AI company states a limit on how its models may be used, and the limit is contractual. This is the sharpest current occasion and it is only months old. In February and March 2026 the US Department of Defense sought contract language authorising a frontier model for "any lawful use." Anthropic refused, seeking terms excluding fully autonomous lethal targeting and domestic mass surveillance; on 27 February 2026 the administration directed agencies to stop using its products and designated the company a supply-chain risk; litigation followed and a district judge preliminarily enjoined the ban on 26 March 2026. Days later OpenAI announced a Pentagon agreement it described as permitting use "for all lawful purposes, consistent with applicable law" while prohibiting "unconstrained monitoring of Americans' private information."

Cite this entry for the specific question that 2013 answers and 2026 has not. Samir Jain of the Center for Democracy and Technology made the point directly about the OpenAI terms: the referenced policies "could be modified in the future," and "nothing in what they've released would prevent those policies from being changed going forward." That is the 2013 finding restated. In 2013 the constraints were statutes, a court, two oversight committees and an inspector general, and they did not produce a public account that matched the deployed system. A promise in a contract, unpublished and unaudited, is a weaker instrument than the ones that already failed. Which does not mean it is worth nothing — it means a reading should say which of the two it is treating it as.

Interest declared, per rule 7, and it runs the other way this time. One of the two companies above built the model writing this file, and in this story that company is the one that refused the surveillance clause and paid for it. The convenient error is therefore not to be hard on Anthropic; it is to write the paragraph as though a refusal were a verification. It is not. Anthropic's assurance that its models are not used for domestic mass surveillance is exactly as externally checkable as OpenAI's assurance that they are constrained — which is to say, not at all, from outside. The EFF made the general form of the point in March 2026: privacy protections should not depend on the decisions of a few powerful people. A reading that cites this entry to praise one lab's refusal has misused it. The entry is about the unverifiability, not about who is on which side of it.

3. When a machine-learning system produces a ranked list of people. The SKYNET deck is the canon's earliest read-in-full primary document of that shape, and it is useful precisely because it is not impressive: a random forest, eighty hand-built features, seven training positives, MapReduce. No deep learning, two months before AlexNet. Cite it when a scoring system's error rate is quoted without its base rate, when negatives are assumed rather than labelled, or when a demonstration deck's own hedge ("much remains to be done") has been dropped somewhere between the researchers and the deployment. The published critique of it is, as SCALE.md records, the first public argument about a classifier's false-positive rate where the cost of a false positive is a person.

4. When metadata is treated as the harmless half. The PCLOB's finding is the one to quote, because it is a US government body writing about a US government programme: "because telephone calling records can reveal intimate details about a person's life, particularly when aggregated with other information and subjected to sophisticated computer analysis, the government's collection of a person's entire telephone calling history has a significant and detrimental effect on individual privacy." And, on the aggregate: "permitting the government to routinely collect the calling records of the entire nation fundamentally shifts the balance of power between the state and its citizens." Both sentences transfer without modification to training corpora, inference logs and commercially purchased device data — which is what makes the entry live rather than historical.

What it got right, and what it got wrong

Not required for moment, and done anyway, because three sets of dated claims collided here and thirteen years is long enough to grade all three.

The claims the disclosures made, graded

Right: the core factual claim about bulk domestic collection. Not merely confirmed — adjudicated. The Second Circuit held on 7 May 2015 in ACLU v. Clapper that section 215 never authorised the programme, that the government's reading of "relevant to an authorized investigation" was unsustainable, and it dismissed the complaint on that ground without reaching the constitutional question. The Ninth Circuit went further on 2 September 2020 in United States v. Moalin: the metadata collection "exceeded the scope of Congress's authorization" and violated FISA, and the government "may have violated the Fourth Amendment." Congress agreed in the same direction with the USA FREEDOM Act on 2 June 2015, ending bulk collection under the authority.

Right, and more damaging than the leak: the value claim was hollow. The PCLOB, on 23 January 2014, having had classified briefings and documentation: "we have not identified a single instance involving a threat to the United States in which the program made a concrete difference in the outcome of a counterterrorism investigation. Moreover, we are aware of no instance in which the program directly contributed to the discovery of a previously unknown terrorist plot or the disruption of a terrorist attack." In the one case over seven years where it arguably helped identify an unknown suspect, "the suspect was not involved in planning a terrorist attack and there is reason to believe that the FBI may have discovered him without the contribution of the NSA's program." The Board found no bad faith and no intentional misuse — it found the programme did not work.

The Ninth Circuit sharpened that into the single most quotable sentence in the whole record, having read the classified file in the one prosecution the government had held up as the programme's success: "to the extent the public statements of government officials created a contrary impression, that impression is inconsistent with the contents of the classified record." Note carefully which way this cuts. The gap ran in both directions: the programme was larger than the public was told, and it was less useful than the public was told. A reading that only carries the first half is carrying half an entry.

Right, and measurable: the technical response. Google encrypted its inter-datacentre links. Apple and Google shipped device encryption on by default in 2014. In May 2014 the IETF published RFC 7258 / BCP 188, Pervasive Monitoring Is an Attack, whose one-line abstract — "Pervasive monitoring is a technical attack that should be mitigated in the design of IETF protocols, where possible" — converted a political grievance into a standing engineering requirement, and whose text traces itself to the November 2013 IETF plenary. Encrypted share of web traffic went from a minority to the overwhelming default within a decade, with Let's Encrypt (public beta December 2015) the largest single lever. Attributing all of that to 2013 would be too much; attributing none of it would be absurd.

Right, and structural: the law of data transfer was rebuilt. Max Schrems complained to the Irish Data Protection Commissioner on 25 June 2013 — three weeks after the first story — arguing that PRISM meant US law gave no meaningful protection to transferred European data. The complaint was rejected as frivolous; it became Schrems I, which invalidated Safe Harbour on 6 October 2015, and Schrems II, which invalidated its replacement, Privacy Shield, on 16 July 2020. Every compliance conversation an AI company now has about training or serving European data descends from a complaint filed three weeks after this entry's date.

Wrong, and it was the very first framing: "direct access to the servers." The initial PRISM reporting in both papers conveyed that the NSA had direct access to the servers of Google, Facebook, Apple and the rest. Every named company denied it in terms, and the denials were substantially correct: PRISM was compelled production under section 702, with delivery through designated channels, not a pipe into the racks. The Washington Post softened its "knowing participation" framing within days. This is the most useful error in the entry — the underlying disclosure was true and enormous, and the first-day characterisation of the mechanism was wrong, and the two facts have been used ever since to prove opposite things.

Unresolved, and recorded as unresolved: the cost. The House Permanent Select Committee on Intelligence concluded in 2016 that Snowden "did tremendous damage," put the volume at more than 1.5 million documents, and called him a "serial exaggerator and fabricator." The Intercept published a point-by-point rebuttal calling the report "rifled with obvious falsehoods." No public damage assessment has resolved it, and this entry does not adjudicate it. What can be said without picking a side: the 1.5–1.7 million figure describes what an audit concluded he could have touched, not what he took and not what journalists received — DIA director Michael Flynn told Congress, "Everything that he touched, we assume that he took" — and the number of documents actually published is in the low thousands.

The official claims, graded

"Not wittingly" was wrong, and its author said so. Graded above.

"Nobody is listening to your telephone calls" was true and beside the point. Content was not collected under this programme. The PCLOB paragraph in section 2 is why that reassurance failed as a reassurance.

"The programme has stopped 54 terrorist events" collapsed. Variants of that number were given repeatedly in mid-2013. The PCLOB, with the classified file, found none in which section 215 made a concrete difference; the Ninth Circuit, with the file for the government's flagship case, found the public impression inconsistent with the record.

The one official prediction that held: the programme's defenders said losing it would not be catastrophic if replaced, and that is roughly what happened. The USA FREEDOM Act moved queries to the carriers in 2015. The NSA then deleted its entire holding of call detail records in June 2018 after technical irregularities produced overcollection it could not unwind, suspended the successor programme in 2019, and asked Congress to renew an authority it had voluntarily stopped using on the grounds that it might be useful someday. The authority lapsed on 15 March 2020 when reauthorisation stalled, and on the best reading this entry could reach it has not been restored; a later reading should re-check that rather than inherit it. No public account attributes an attack to the lapse.

Commonly misused as

Not required for moment, and the misreadings here are common enough in AI commentary that a reading meeting one should have the correction ready.

"The NSA was recording every American's phone calls." Two errors. It was metadata, not content. And coverage was never universal: reporting in early 2014 put the programme's share of US call records as low as 20–30% at that point, largely because only some carriers received orders while mobile use was growing — a figure the government disputed and which this entry records as reported and contested, not as fact. The legally significant claim was always the one about what the government asserted it could compel, which was everything, and which two appellate courts rejected.

"Snowden proved the government was reading everyone's email." He disclosed authorities, architectures and volumes. Several of the most alarming programmes were foreign-directed; several were partner-run; at least one high-profile mechanism (PRISM) was mischaracterised on day one and corrected. An entry that lets "mass collection" mean whichever programme is convenient is doing what the first-day reporting did.

"The oversight system worked — look at all the reform." The reform is real and every piece of it is post-hoc. The court was misinformed three times in three years and said so in an opinion nobody could read for two years. The reasoning was first published in August 2013. The Board found the programme useless in January 2014. Congress acted in June 2015. Every one of those dates is after 5 June 2013. The system's demonstrated capability is to correct a programme after a contractor has published it, which is a different capability from the one it is usually credited with.

"The oversight system was a sham." Equally wrong, and the entry refuses it. The PCLOB was a statutory body that read the classified file and published a finding hostile to the executive that appointed it; two of its five members, Rachel Brand and Elisebeth Collins Cook, filed separate statements dissenting from the majority's legal analysis and its recommendation to end the programme, and the split is part of the record rather than an embarrassment to it. Two courts of appeals ruled against the government. Congress changed the statute. None of it started on time; all of it happened.

"Metadata is anonymous." Refuted by the primary documents in this entry rather than by argument. SKYNET identified a named journalist as its top-scoring selector on eighty metadata features and no content whatsoever.

"SKYNET killed thousands of people." The deck does not establish it, the reporting does not establish it, and this entry does not assert it. See section 1, and see SCALE.md's own note on the same restraint.

And the one this project must guard against directly. Nothing here is evidence. This entry deposits nothing into history/events.jsonl, moves no needle, and places no landmark — not the 55 million, not the 0.008%, not the 1.5 million documents. The 2015 position on the long-view chart is the owner's and was already set; this entry is its upstream half and does not touch it. What this file is for is that when a reading meets a claim about what a deployed system does, made by the party that deploys it, it can cite the best-documented case there is of that claim being wrong in both directions at once, and name what eventually closed the gap.

Sources

Primary where reachable; every fetch failure recorded.