| ® | Did Snowden Act Alone? | 149 other whistle-blowers who uncovered what they considered gov- ernment malfeasance by virtue of their jobs, Snowden, by his own admission, took a new job in 2013 specifically to get access to the SCI files concerning NSA sources that he stole from the Threat Opera- tions Center. Switching jobs in order to widen one’s access to state secrets is an activity usually associated with penetration agents, not whistle-blowers. While the technical distinction between a whistle- blower and a spy may still serve the media in the case of Snowden, it does not help in solving the counterintelligence conundrum. A complex theft of state secrets had been successfully carried out in a supposedly secure site. The only known witness, Snowden, had escaped to Russia, where he could be of no help in reconstructing the crime for American intelligence agencies. The stolen data was kept in the equivalent of sealed “vaults”—actually computer drives that were not connected to the NSA network. If ever there was a locked- room mystery, this was it. According to the FBI investigation, Snowden pierced these barri- ers by using passwords that belonged to other people and using cre- © dentials that allowed him to masquerade as a system administrator. re) It was a feat that must have required meticulous planning, To address such a mystery, a counterintelligence investigation starts with a tabula rasa, stripping away all the previous assump- tions, including that Snowden was the lone perpetrator. It builds alternative scenarios to test against the known facts. To be sure, sce- nario building differs from that of a conventional forensic investiga- tion aimed at finding pieces of evidence that can be used to persuade a jury ina courtroom. Unlike a judicial investigation concerned with guilt and innocence, scenario building looks to develop a story that is, concurrently, intrinsically consistent and humanly plausible, and in the process it also identifies and explore