Snowden pretty much had root - he had access to more or less everything that wasn't airgapped, including things the NSA wasn't supposed to have direct access to

Snowden pretty much had root - he had access to more or less everything that wasn't airgapped, including things the NSA wasn't supposed to have direct access to as part of their data-sharing agreements. (Of course, some ECIs presumably are airgapped - but much less than you probably expect these days.) Not everything is being published, however. There are details from GCHQ STRAP3 (location of individual listening sites) but only STRAP2 documents, and all details of personnel and telephone numbers has been redacted by the journalists (perhaps a little too broadly - for example as in the GCHQ "refer requests for disclosure to" telephone number, you could actually Google it! I think they know by now, however <g>). Snowden wanted to end mass surveillance and sabotage of public security products; not reveal their cryptanalytic advantage to targets. It's the journalists who are doing most of the selection, I gather - but they've seen the whole haul, including what is not being published, and the picture is consistent, though (yes) incomplete. My impression has been for some time that their cryptanalytic advantage is not actually vast, but their operational resources truly are. Throwing money at things doesn't magically give you breaks to the DLP - but it totally can buy you computing resources that can break 1024-bit Diffie-Hellman. (It mentions Cavium cores - suggesting large, parallel RSA/DH-optimised multipliers were on their HPC shopping list. They are much faster at 1024-bit than higher.) It can buy you insiders, or let you conduct operations that threaten or coerce insiders, or conduct astroturfing campaigns to frighten people away from encryption you can't break, or further the goals of your agency (which do not necessarily align with the government paying your way - it's not so much "oversight" as "don't get caught doing anything you shouldn't"). You can throw (a lot of) money at military contractors and hope some malware-by-committee comes out that you can use to hack anyone that looks interesting, grab intelligence or keys, or any of the above. And they typically attack from every angle at once. My take on the HPC resources is that they're mostly used as brute force CPU/GPU power for low-entropy situations - anything where passwords are involved may be vulnerable. Email an encrypted DOC, ZIP or RAR file to someone? They're going to at least try it as a matter of course, even en masse, but they're not going to give it much juice unless you're tasked. Money can't give you magic. However you very, very rarely need magic.