On September 5, 2013, The Guardian, the New York Times andProPublica jointly reported — based on documents provided by whistleblower Edward Snowden — that the National Security Agency had compromised some of the encryption that is most commonly used to secure internet transactions. The NYT explained that NSA “has circumvented or cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, protects sensitive data like trade secrets and medical records, and automatically secures the emails, web searches, internet chats and phone calls of Americans and others around the world.” One 2010 memo described that “for the past decade, NSA has led an aggressive, multipronged effort to break widely used internet encryption technologies.”
In support of the reporting, all three papers published redacted portions of documents from the NSA along with its British counterpart, GCHQ. Prior to publication of the story, the NSA vehemently argued that any reporting of any kind on this program would jeopardize national security by alerting terrorists to the fact that encryption products had been successfully compromised. After the stories were published, U.S. officials aggressively attacked the newspapers for endangering national security and helping terrorists with these revelations.
All three newspapers reporting this story rejected those arguments prior to publication and decided to report the encryption-cracking successes. Then-NYT Executive Editor Jill Abramson described the decision to publish as “not a particularly anguished one” in light of the public interest in knowing about this program, and ProPublica editors published a lengthy explanation along with the story justifying their decision.
All three outlets, while reporting the anti-encryption efforts, redacted portions of the documents they published or described. One redaction in particular, found in the NYT documents, from the FY 2013 “black budget,” proved to be especially controversial among tech and security experts, as they believed that the specific identity of compromised encryption standards was being concealed by the redaction.