Meanwhile, Gellman worked on the story, alone. He was either sequestered on the seventh floor of the Post building, or wrote in his hotel room. He faced the daunting task of authentication and verification. Over weeks of studying the PRISM document with Poitras, he had understood more and more of it, but he wanted to feel confident about it all. As he told Baron: “I’m morally certain that my source is for real and that this document is authentic and that what it says is true. I’m morally certain of that, but I’m not telling you right now that I could vouch for it in a way that you should publish it. We still have to get there.”

In the best-case scenario, Gellman would make contact with various sources to gain insight into the slides, and then ask the NSA for comment. He hoped its response would be along the lines of “we would like a chance to tell you why you shouldn’t write that story.” That alone would authenticate the PRISM program. But first, he and Baron had to decide what to leave unpublished. Several slides gave examples of PRISM in use, and provided names of targets, email accounts and what had been learned. Such material, the journalists decided, should remain classified. “The potential harm seemed high and the value for public policy debate seemed low,” comments Gellman. ^[27]

Gellman sent unencrypted emails to two of his contacts: one was a senior person in the White House, the second worked in the intelligence community. “I have a very highly sensitive story that you’re going to want to know about and want to talk to me about,” he wrote. “Tell me how you’d like to proceed. I’m not going to say it here.” The message got the government’s attention. Gellman got a phone call, not from either of his two contacts, but from a high-ranking official in the Executive Branch. “What’s up?” the official asked the reporter. “Why don’t you go get a copy of a document with this title, this author, this date and then let me know how you’d like to proceed,” Gellman says he responded.

The official called back, document in hand. “Now that you’ve read it,” Gellman told him, “I imagine you have a lot of concerns. So I think we can shorten the conversation somewhat when I tell you that everything between pages 17 and 24 we’re not even considering publishing.” The official seemed relieved. He also acknowledged, first implicitly and then explicitly, that the document was in fact authentic. But he made it clear that the administration did not want the Post to do the story at all. With that request on the record, the two continued to go through the material. In their several conversations, they coped with the unsecure telephone line by making veiled references to the document. Typically, Gellman gave the official a slide number and specified a spot on the page.

Gellman also checked with his own sources. As he neared the end of his authentication process, other reporters were brought in to call the nine Internet companies for comment. Public relations representatives at Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube and Apple all denied having any knowledge about PRISM. Gellman was not surprised. The denials were carefully ambiguous, there was no reason for companies to know the cover name “PRISM,” and spokesmen probably were not cleared to know anything. Each gave the Post vague, brief prepared statements. “We were trying to reconcile the company statements and the evidence we had from the NSA about what was going on,” remembers Gellman.

Competition . Poitras, meanwhile, had been in touch with freelance national security journalist and constitutional lawyer Glenn Greenwald, whose work often appeared in the Guardian (UK). ^[28] The two became acquainted when Greenwald in 2010 wrote a piece about her detainment at airports for Salon . Verax had told Gellman and Poitras that he had sought out Greenwald first, in late 2012. In an email dated December 1, 2012, “Cincinnatus”—another name chosen by the source—wrote: “The security of people’s communications is very important to me” and asked Greenwald to use encryption software known as PGP, or “pretty good privacy,” so that they could communicate. ^[29] Greenwald, who was contacted regularly by all kinds of people purporting to have government secrets, had rudimentary technical skills; he chose not to follow up.

Verax, however, wanted to involve Greenwald, and asked Poitras to try him. The source still worried that the material might not see publication, and wanted to double the chances. On April 18, 2013, Poitras emailed Greenwald, who happened to be enroute to New York City. ^[30] The two met, and Poitras showed him sample emails from Verax. After reading them, Greenwald was intrigued but skeptical. Plus he knew Poitras was already working with the Post and her reasoning: that working with a newspaper in Washington, DC, would get the federal government’s attention.

Nonetheless, at Poitras’ prompting Greenwald on May 20 contacted Verax. ^[31] Just days later, after learning his whereabouts, Poitras wanted to go to Hong Kong to meet Verax—but not alone. Greenwald agreed to join her and, in the first days of June, they flew to Asia. ^[32] By then, Verax had given Gellman and Poitras some identifying details to prove his bona fides. They knew his name was Edward Snowden. They also had his social security number, the Hawaii address where he had lived, and some details about his job history as a contractor for the NSA. All the information checked out.

Gellman and his editors knew about the Hong Kong trip, and that the Post now faced immediate competition. So Gellman was not surprised when, on Wednesday, June 5, the Guardian published an exclusive by Greenwald: “NSA collecting phone records of millions of Verizon customers daily”—revealing for the first time that a Bush Administration order had continued under the Obama Administration. ^[33] The story was based on a document from the same archive Snowden gave Gellman. The Post assumed that the Guardian would be interested in the PRISM story as well. Gellman redoubled his efforts to fully vet the story for publication.