Metadata Forensics Reveal Deliberate Removal of Domestic Spy Facility Details in Published Snowden Documents

Technical scrutiny of PDF documents released alongside major Snowden reporting reveals previously undisclosed evidence of deliberate editorial removal: Detailed sections describing domestic U.S. intelligence facilities were excised before publication, while equivalent foreign facilities remained fully documented. This discovery emerges from forensic analysis of PDF versioning metadata in documents published by The Intercept in 2016 and The Intercept/Australian Broadcasting Corporation in 2017.

Two classification guides contained hidden metadata artifacts proving earlier versions included comprehensive details about National Reconnaissance Office (NRO) Mission Ground Stations on U.S. soil:

1. Potomac Mission Ground Station (PMGS) in Washington DC, operating under the unclassified cover name "Classic Wizard Reporting and Testing Center" (CWRTC)
2. Consolidated Denver Mission Ground Station (CDMGS) near Denver, operating as the publicly acknowledged "Aerospace Data Facility" (ADF)

While the facilities themselves aren't secret, the Snowden documents provide unprecedented evidence of classification boundaries:

• Operational designations (PMGS/CDMGS) remain classified SECRET/Talent Keyhole
• Cover names (CWRTC/ADF) are unclassified
• The existence of cover stories themselves is classified
• Agency associations (NSA/CIA/NRO) with these facilities are classified

Screenshot from initial version of Menwith Hill classification guide showing section 5.1.5 describing PMGS

Forensic evidence shows systematic removal rather than standard redaction. The "Menwith Satellite Classification Guide" contained two metadata versions: An early version with operational details of PMGS in section 5.1.5, and a modified version where the entire section was deleted. Similar versioning appears in the "NRO SIGINT Guide for Pine Gap", where section 5.1.2 describing CDMGS was removed prior to publication.

Same document after removal of domestic facility section

The Pine Gap guide's organizational table (released publicly) provides architectural evidence of classification strategy through deliberate formatting:

Classification table showing grouped entries for each facility

Thicker borders separate facility groups containing:

• Classified operational designations (PMGS/CDMGS)
• Unclassified cover names (CWRTC/ADF)
• Additional cover designations (Field Station Denver)

This structure creates layered disclosure: Public discussion can reference cover names while concealing operational designations and intelligence agency connections. Domestic facilities appear to have additional cover names compared to foreign counterparts, suggesting enhanced operational security for U.S.-based stations.

PDF metadata timestamps indicate precise editorial actions. For the Pine Gap guide, two versions were created minutes apart on July 31, 2017 using Nitro Pro 8 software:

• 13:48:54 version containing CDMGS details
• 13:50:48 version with CDMGS removed

The identical metadata in documents published by both The Intercept and ABC indicates centralized editing before distribution. Despite requests for comment, journalist Ryan Gallagher—who led both investigations—has not explained why domestic facility sections were removed while foreign equivalents (Menwith Hill and Pine Gap) remained published.

This discovery demonstrates how PDF metadata can serve as a forensic archive of editorial decisions. Technical analysis tools like pdfresurrect enable extraction of these historical versions, revealing content evolution invisible in final published documents. The findings raise questions about editorial transparency in handling classified materials and reveal previously undocumented classification boundaries for domestic intelligence facilities.

Upcoming analysis will examine versioning patterns across the entire corpus of published Snowden documents, including cases of failed redactions and metadata-preserved usernames of NSA personnel. Original document versions referenced in this analysis remain available:

• Menwith Hill Classification Guide Version 1
• Menwith Hill Classification Guide Version 2
• Pine Gap SIGINT Guide Version 1
• Pine Gap SIGINT Guide Version 2