I think the best tidbit here is reporting he set the parameter for “how deeply to follow links.” So two possibilities: they actually have a .bash_history file or similar that logs the command lines for when he was collecting stuff! From what I’ve gathered about Snowden’s technical abilities, he knew some stuff, so this would have to be interpreted as a fuck you on departing, look how easy this was kind of thing. Or, they have logs of which files were downloaded and they reconstructed that it’s what you’d get following N links. That’s probably more likely. Someone higher up must have been doing a periodic manual review of logs, maybe based on some aggregate stats. Doing a full crawl would get you caught, so limit the depth and stay just below radar (and in fact he popped up once but only high enough he needed a reasonable sounding explanation).
1 Like
