The NSA has, in fact, built a separate, secret internet for signals intelligence, one that relies on fiber and satellite channels that are segregated almost completely from the plain old telephone system. Called NSANet, it allows analysts deployed almost anywhere to access virtually everything the NSA’s extremely vast databanks contain. It has its own bridges, routers, systems, and gateways.

According to several current and former officials who’ve worked on NSANet, every keystroke is logged and subject to random audits. “Screengrabs” are prohibited. Documents can be printed with special facilities but that, too, leaves a record. As a mission support specialist, Snowden would have had access as part of his jobs to the physical servers and hard drives that contain material.

If he did not want to leave an audit trail, he might have disconnected a hard drive containing temporarily cached documents, brought them into an area that included desktops and hardware not cleared for such access, connected them, and then printed documents out. It is also possible that he disabled, under the guise of fixing something, access privileges for auditors. He could have temporarily escalated his own access privileges, although this would have raised flags among his superiors.