Chris Inglis on the Snowden Era: What NSA Got Wrong, and What CISOs Should Still Be Asking

Key points

• Chris Inglis served as NSA Deputy Director and was the agency's senior civilian official during the 2013 Edward Snowden disclosures.
• Inglis acknowledged specific institutional mistakes made by NSA in the Snowden episode during a Dark Reading podcast interview recorded in 2026.
• Inglis identified insider threat detection, media disclosure strategy, and organizational culture as three distinct failure domains.
• The interview surfaces questions about how CISOs should apply NSA's hard lessons to private-sector insider risk programs.

Chris Inglis was the most senior civilian at the National Security Agency when Edward Snowden walked out with a cache of classified documents in 2013. Thirteen years on, he is willing to say what went wrong.

In episode 17 of Dark Reading Confidential, Inglis speaks with unusual directness about the NSA's failures. Not the Snowden leak as an abstract geopolitical event. The specific, operational mistakes — in detection, in disclosure, in what Inglis calls "enculturation."

That last word is worth sitting with. Enculturation, in Inglis's framing, refers to the process by which an organization transmits its values to the people inside it. When that process fails, policy controls and technical monitoring often cannot compensate. You can log every privileged session. You can gate every sensitive repository. If someone has absorbed the wrong set of values — or no coherent set at all — the audit trail tells you what happened after the fact.

It does not stop anything.

This is not a novel observation in security theory. But hearing it from the official who oversaw NSA's insider threat posture during the largest intelligence breach in American history gives it a different weight. The agency had access controls. It had monitoring. Snowden's exfiltration succeeded anyway.

For CISOs, Inglis's reflections map onto a concrete question: is your organization's insider risk program primarily a technical program, or does it include a cultural diagnostic component? Most mature programs today combine user and entity behavior analytics with access governance. Fewer systematically assess whether employees have internalized the organization's security obligations — and why they should.

Inglis also addressed media disclosure decisions made during and after the leaks. The handling of disclosures shaped public and congressional perception of NSA for years. His candor about the sequencing and framing choices NSA made is a useful case study for any security leader who may one day face a material incident requiring public communication — a domain now governed by hard disclosure timelines under Securities and Exchange Commission Release No. 33-11216, which imposes a four-business-day reporting window for material cybersecurity incidents affecting public companies.

The podcast does not resolve the tension between transparency and operational security. Inglis does not pretend it can be resolved cleanly. That honesty is, itself, the point.