Where I differ from Schneier here is that I think it is quite plausible that the NSA doesn't know what Snowden actually took. One can more easily audit what he

Where I differ from Schneier here is that I think it is quite plausible that the NSA doesn't know what Snowden actually took. One can more easily audit what he had access to and what he could have taken than one can audit what he did and given his long period of service, what he could have taken is likely to be very large. You have to remember that even mandatory access control systems aren't really designed to keep sysadmins out, and logging has its limits both in the sorts of information you can extrapolate from a log entry and what you can log. My point is that it is quite possible that the NSA has a list of documents that Snowden could have taken and has no idea which of those he did.