1. Russia/China have got hold of the files, and know how to decrypt PGP (Very unlikely).
2. A journalist with access to the files and the encryption keys has left them lying around, or was cooerced into decrypting them. (Unlikely but possible).
3. Intelligence services are lying, possibly for political gain ahead of new legislation (specifically in the UK), and/or have fallen for a bluff by China and Russia. (Most likely).
4. A version left encrypted at any point and time on some old SSD or NAND cells that were then recovered, without journalist or other handlers aware this could happen.
5. GCHQ or NSA had same or similar documents lifted (umm... leveraging Office of Personnel Management or a similar type hack) and they are preparing a cover story.
plenty of conspiracies to go around but as someone else said... until some proof is shown there's no reason to give much weight to the statement that individuals needed to be moved.
Is it that unlikely that a journalist left the encryption keys on an internet-facing machine? The protection on an essentially unguarded computer (let's face it, if someone wants to break into any of our home machines, they can) would then be the weakest link.
poitras and the intercept are both very well versed in opsec and the necessity for airgapping, and the latter hired Morgan Marquis-Boire to handle security for first look media. i don't think it's as likely as you believe
The NSA is also well versed in OPSEC, but a guy took a ton of their documents and is currently residing in Russia. There are always holes in the system.
More likely is that the Snowden documents have been widely distributed in encrypted form (as one of the Wikileaks insurance releases) and Russia/China have managed to brute force the key.
That broadly speaking comes under point 1, and in my opinion, that's very unlikely, given that at the point Snowden stopped contracting for the NSA, PGP was still considered uncrackable by them.
Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it.
> “The best advice here is to shift your thinking from passWORDs to passPHRASES,” Snowden recommended. “Think about a common phrase that works for you. It’s too long to brute force and also make them unlikely to be in the dictionary.”
It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can be extended to passphrases. Attacking a specific individual also tends to be easier - you can profile them and build targeted word and phrase lists.
XKCD is bad specifically because it is specifically talking about attacking a password via an internet based oracle rather than attacking a hash, but people generalized it. A search space of ten or twenty trillion is laughable when a few GPUs can make a billions of guesses per second against a vanilla hash algorithm.
Ultimately, if you want a password or passphrase that a computer can't guess, you should let a computer pick it for you, or if you're really paranoid, use diceware.
1. Russia/China have got hold of the files, and know how to decrypt PGP (Very unlikely).
2. A journalist with access to the files and the encryption keys has left them lying around, or was cooerced into decrypting them. (Unlikely but possible).
3. Intelligence services are lying, possibly for political gain ahead of new legislation (specifically in the UK), and/or have fallen for a bluff by China and Russia. (Most likely).