Edward Snowden: the NSA leak that redefined privacy

On 21 June 1983, in Elizabeth City, North Carolina, the man who thirty years later would put a government's mass surveillance on front pages around the world was born. Edward Snowden turns 43 today, and the leak that carries his name is still the obligatory reference whenever the subject is government surveillance, encryption and privacy on the internet.

From IT analyst to NSA contractor

Snowden was neither a hacker nor a secret agent in the classic sense. He passed briefly through the US Army, worked as a technical assistant at the CIA from 2006 and, in 2009, became a Dell contractor providing systems administration services to the NSA (National Security Agency) itself. In March 2013, on his own initiative, he requested a transfer to Booz Allen Hamilton, another of the agency's contractors, at a facility in Hawaii — precisely, as he later told the South China Morning Post, in order to gain access to more classified documents before leaking them.

In May 2013, Snowden took leave from the NSA on the pretext of treating epilepsy and flew to Hong Kong, taking thousands of internal agency documents with him.

The leak that began in a Hong Kong hotel room

In Hong Kong, Snowden met documentary maker Laura Poitras and journalists Glenn Greenwald and Ewen MacAskill. On 5 June 2013, The Guardian published the first story in the series: a secret court order compelling the carrier Verizon to hand the NSA the telephone metadata of millions of American customers, every day, in bulk. The next day, the Guardian and the Washington Post revealed the PRISM programme. On 9 June, Snowden publicly identified himself as the source.

What was the NSA's PRISM programme?

PRISM was a surveillance programme that allowed the NSA to request, directly and on the basis of orders from the secret FISA court, user data stored on the servers of companies such as Google, Microsoft, Apple, Facebook and Yahoo — emails, conversations, files, voice and video call history. Later documents revealed other complementary programmes: XKeyscore, described internally as capable of searching practically all of the internet traffic collected by the agency, and Tempora, run by British counterpart GCHQ, which stored the contents of fibre-optic cables for up to 30 days.

Brazil was a target too

Snowden's documents didn't stop at the United States. Reports on the Brazilian TV programme Fantástico, based on the same files, revealed that the NSA had monitored communications of then-president Dilma Rousseff and close advisers, as well as targeting Petrobras as a possible subject of economic espionage. The reaction was immediate: Rousseff cancelled a state visit to the US scheduled for October 2013 and spoke out against American surveillance at the UN General Assembly. The case also accelerated the passage of the Marco Civil da Internet, Brazil's internet bill of rights, signed into law in April 2014 during the NETmundial conference in São Paulo — until then the bill had been stuck in Congress for years.

Indictment, flight and exile in Moscow

On 14 June 2013, the US Department of Justice charged Snowden with theft of government property and with violating the Espionage Act of 1917 — the same law used historically against spies, not against whistleblowers. With his passport revoked in transit, he was stuck in the transfer area of Moscow airport for more than a month, until Russia granted temporary asylum in July 2013. He has never left the country since: he has lived in Moscow ever since and received Russian citizenship in 2022. In the United States, the criminal case remains open; pardon requests have circulated among political allies over the years, but none has come to anything so far.

What changed after 2013

The most concrete effect in public policy was the USA Freedom Act, passed in 2015, which ended bulk collection of telephone metadata under Section 215 of the Patriot Act and required the NSA to request the data case by case, directly from the carriers. In industry, the leak pushed forward a movement that already existed but gained urgency: end-to-end encryption went from an optional feature to the default in mass-market products. WhatsApp rolled out full end-to-end encryption in 2016, Signal saw its user base multiply, and the public dispute between Apple and the FBI over unlocking an iPhone, also in 2016, showed that technology companies had started treating resistance to government access requests as part of the product itself, not as an exception.

Why this still matters to people who don't work in security

Snowden's practical legacy for the ordinary user isn't about government espionage — it's about the principle it exposed: metadata reveals as much as content, and anyone who doesn't encrypt by default is leaving the decision about their privacy in someone else's hands. The same reasoning that led companies to encrypt messages by default is what justifies encrypting your own browsing — our guide to encrypted DNS with NextDNS shows how to close that specific leak at home.

The case also anticipated a debate that is central to identity security today: a password alone was never enough, and anyone still relying on just a username and password is exposed to any third-party breach. It's worth reviewing our material on passkeys and passwordless authentication and on how MFA fatigue still catches out even people who use a second factor. For anyone administering their own infrastructure, the principle of minimising exposed surface is the same one that guides our SSH hardening guide.

Thirteen years on, the Snowden case still divides opinion — for some, treason; for others, the greatest act of whistleblowing in recent history. What is no longer in dispute is the effect it had: the idea that mass surveillance was technically possible and politically unchecked stopped being a movie plot and became documented fact, with a name, a date and a primary source. If you're interested in how single incidents permanently change the way we treat security, it's also worth knowing the story of the Morris Worm, the event that, five years after Snowden was born, had already shown that the internet needed people looking after it full time.