June 28, 2014, by Paul Dietrich

It's often been said that Snowden didn't get any ECI (Exceptionally Controlled Information), but it just isn't true. While Snowden is unlikely to have broken every single ECI compartment, there are nonetheless a handful of documents that are classified at this level, and even some published examples.

The EU Embassy Map:

This document was shown on Der Spiegel's story about embassy bugging. It was pulled from the site after a time, but it remains available on the Internet Archive. The classification string reads as follows: "TOP SECRET//COMINT-ECI RGT//NOFORN" RGT is short for RAGTIME, which protects the product gathered from FISA interceptions.

The STELLARWIND Report:

STELLARWIND was one of the most controversial programs from the Bush Era, it involved bulk domestic surveillance. Even within the NSA, it was known only to a few people. Snowden managed to get the OIG's report on the program. Not only is STELLARWIND already a special compartment, several pages of this report, describing  NSA's relationships with various corporations are further classified at the ECI level. The classification strings read "TS//SI-ECI//NF" here the ECI compartment isn't named, perhaps because the report was still in draft form, and in the final report, the companies would be named, and the ECI compartment would be filled in. Some of the paragraphs in the report contained information that allowed the real names of the companies to be unmasked by researchers, at any rate, it enabled much more informed guesswork. 

TEMPORA
Some aspects of this project are classified at STRAP 3, which is as highly classified as it gets, in the UK (though there are compartments at all levels of classification). Which aspects of the reporting were derived from the Snowden Cache, and the reporters' access to the cache have been left ambiguous by the reporters involved.

There are also references to ECI compartments, and the kinds of information they contain. For example, the REDHARVEST ECI compartment of RAMPART covers names of 3rd party partners, and further details..


It's not entirely clear whether these files are exceptions, or the rule. One of Snowden's jobs was to move data, this would involve a few mis-sorts.  The STELLARWIND report seemed to have been just one such mis-sort, and it also holds the distinction of being the first file Snowden grabbed. According to an interview with James Risen, the file had been "too highly classified to be where it was," and "curiosity prevailed." But this does not preclude the possibility that Snowden had access to the report's proper filing place, in fact, it rather suggests he could at least move documents to that place. Given his job, it seems likely that he could also open files from that system too. Snowden generally avoids the subject of exactly what he took, and how, saying it involves the indictment, but he has said,  in his NBC interview that the documents published so far are a good gauge of what he has given journalists.

Having said that, there are gaps in the cache, which numbers in the "many tens of thousands" of documents. Snowden didn't take every document that the NSA produced, nor raid the CIA, the FBI, or the DHS, and like agencies. Nor could have raided every intelligence agency that the NSA has done business with. There are questions that the documents themselves can't answer.  Perhaps future research, FOIAs, and leaks will cover some of these gaps.