The Surveillance Scandals

06.10.13

Inside the ‘Q Group,’ the Directorate Hunting Down Edward Snowden

The top-secret ‘Q Group’ has been chasing Edward Snowden since he disappeared in May. Eli Lake on the intel community’s internal police—and why the agency is in ‘complete freakout mode.’

Even before last week’s revelations by The Guardian newspaper that the National Security Agency (NSA) was collecting call records from telecommunications companies and had the ability to mine user data from major U.S. Internet companies, the NSA was already on the trail of the leaker, according to two former U.S. intelligence officers with close ties to the agency.

On Sunday, The Guardian revealed its sourcea 29-year-old former U.S. Army soldier and CIA employee named Edward Snowden. Snowden—who worked as a contract employee at an NSA station in Hawaii—said he agreed to have his identity revealed because he feared that the NSA would put pressure on his family and his friends for information about his whereabouts. From a hotel in Hong Kong, he told The Guardian he expected he would never be allowed to return home and that he could end up imprisoned or murdered because of his decision to leak.

The people who began chasing Snowden work for the Associate Directorate for Security and Counterintelligence, according to former U.S. intelligence officers who spoke on condition of anonymity. The directorate, sometimes known as “the Q Group,” is continuing to track Snowden now that he’s outed himself as The Guardian’s source, according to the intelligence officers. Snowden began final preparations for his departure three weeks ago, The Guardian reports, copying the final documents he intended to share, telling his supervisor that he would need time off for medical treatment, and his girlfriend simply that he would be away. "That is not an uncommon occurrence for someone who has spent the last decade working in the intelligence world," he told the paper in his interview from Hong Kong.

The security and counterintelligence directorate serves as the NSA’s internal police force, in effect watching the agency’s watchers for behavior that could pose an intelligence risk. It has the authority to interview an NSA contractor or employee’s known associates, and even to activate a digital dragnet capable of finding out where a target travels, what the target has purchased, and the target’s online activity.

“We have seen the latest report from The Guardian that identifies an individual claiming to have disclosed information about highly classified intelligence programs in recent days,” Office of the Director of National Intelligence spokesperson Shawn Turner said in a statement issued Sunday. “The Intelligence Community is currently reviewing the damage that has been done by these recent disclosures. Any person who has a security clearance knows that he or she has an obligation to protect classified information and abide by the law.”

The directorate serves as the NSA’s internal police force, in effect watching the agency’s watchers.

“It informs our adversaries. It puts American companies at risk internationally for simply complying with our laws,” said Mike Hayden, a former director of the NSA and a former director of the CIA. “It teaches practically everyone in the world—sources, liaison services—that America can’t keep secrets.”

The impact of the leak inside the NSA has been enormous. “There is complete freakout mode at the agency right now,” one former intelligence officer tells The Daily Beast. “There has never been anything like this in terms of the speed of referral of a crime report to the Justice Department. Normally this kind of thing takes weeks and weeks.”

Snowden’s disappearance in May was immediately noticed by the directorate, and when The Guardian published the first court order and then documents associated with a program called PRISM, Snowden immediately became the leading suspect in the leak, the intelligence sources said, adding that the FBI was now investigating the leak as well.

Video screenshot

Edward Snowden explains why he released top secret information.

In Congress, some members have already called for the United States to pursue Snowden’s extradition and prosecute him for his unauthorized disclosures. “If Edward Snowden did in fact leak the NSA data as he claims, the United States government must prosecute him to the fullest extent of the law and begin extradition proceedings at the earliest date,” Rep. Peter King, the Republican chairman of the Homeland Security Subcommittee on Counterintelligence & Terrorism, said in a statement Sunday.

Hayden dismissed the criticism that terrorists already knew the NSA was collecting vast amounts of telephone metadata before Snowden's leak.

“Let me get this right: I got a religious fanatic in the cave in the Hindu Kush, yet this is a front-page, above-the-fold story and he already knew this?” he asked rhetorically. “That does not make sense. It will teach guys to be far more cautious in the future."

The former U.S. intelligence officers, however, said the case is already being treated as a potential defection. “I think it is really tragic that an American has to move to a place that has a reputation for less freedom,” Snowden told The Guardian. “Still, Hong Kong has a reputation for freedom in spite of the People's Republic of China. It has a strong tradition of free speech."

The former U.S. intelligence officers, though, compared Snowden with William Hamilton Martin and Bernon F. Mitchell, two NSA cryptologists who defected to the Soviet Union on June 25, 1960. Both held a press conference at the time where they disclosed U.S. spying programs from Moscow. An NSA assessment of that defection a few years later called it the worst intelligence breach in the history of the NSA—a mark that may have just been passed.

Press officers for the Office of the Director of National Intelligence and the NSA declined to comment for this story.