Citizenfour

The film opens with text on a black screen and a voice reading it: instructions for staying alive. Assume that your adversary is capable of a trillion guesses per second. Use a machine that has never touched the network. Understand that the metadata of this exchange is more revealing than its contents. Before Citizenfour shows anyone a face it shows a threat model, and the choice sets the register for everything that follows, because a threat model is the most honest document any technical organisation produces. It states what you believe about your adversary's capability and what you have decided to do about it, and it is falsifiable in a way that a security policy never is. Snowden's opening move is not an accusation. It is an engineering brief, delivered to a journalist who at that point cannot install PGP, and its implicit argument is that the properties of the system can be reasoned about from the outside if you are willing to be precise. Everything the film later demonstrates about accountability follows from this: the architecture was knowable, the capabilities were documented internally, and the gap was never one of information but of who had standing to look.

What Snowden actually describes in the hotel room is not a conspiracy but an infrastructure. His written summary is the clearest statement of it — every border crossed, every purchase made, every number dialled, every tower passed, every subject line typed and every packet routed sitting inside a system whose reach is unlimited but whose safeguards are not. The asymmetry in that sentence is the whole argument, and it is an argument about scaling rather than about intent. Collection scaled with the physics of storage and the economics of fibre; the oversight regime scaled with the number of judges on a court and the number of cleared staffers on two congressional committees. One curve was exponential and the other was flat, and nobody chose the divergence, which is precisely why nobody was in a position to stop it. His line about any analyst being able to target anyone, any selector, anywhere, is a statement about permissions, not about villainy. It describes a system whose default access grant was set once, early, in a context where the volume of data made the grant nearly meaningless, and never revisited as the volume made it total.

The structural claim of the film is the one worth sitting with: the surveillance apparatus was built by people who believed it would be used responsibly, and it outlived the belief. William Binney, who designed collection systems for the NSA and left over exactly this, is in the film to make the point that the technical capability and the restraint were developed by the same institution and only one of them was engineered. Snowden's own framing — the greatest weapon for oppression in the history of man, whose directors exempt themselves from accountability — reads as rhetoric until you notice it is a description of an incentive structure. The people who could see the whole system had career reasons not to describe it. The people with the authority to constrain it could not see it. This configuration is not exotic; it is the ordinary condition of any sufficiently large organisation, where the person who understands the failure mode is four levels below the person who could authorise the fix, and the intervening layers are each optimising something reasonable. What is unusual about the NSA case is only the blast radius.

Poitras's decision to film the disclosure while it was happening is what makes the documentary durable, and it is a decision about evidence. There is no re-enactment, no actor, no retrospective narration imposing coherence on events after their outcome is known. We watch a twenty-nine-year-old work out how to hand over the material, negotiate with journalists who are still deciding whether to trust him, dye his hair, and repeat that he is not the story here — a claim he makes because the alternative is a debate about his motives instead of about the programmes. He was right about the risk and largely lost the argument, which is itself instructive about how disclosures land. The film's most affecting passage is his remark that he remembers what the internet was like before it was watched, and that there has never been anything in human history like it. That is a sentence about a thing that already existed and was quietly altered, and it locates the loss in the right place. Nothing was announced. The network kept working, the interfaces stayed the same, and the property that made it what it was had been removed from underneath by people who were, by their own lights, being responsible.