Previous parts:

We discovered that entire sections describing domestic U.S. intelligence facilities were deliberately removed from two published documents, while equivalent foreign facilities remained visible. The evidence exists in an unexpected place - the PDF metadata of documents published by The Intercept in 2016, and by The Intercept and the Australian Broadcasting Corporation in a 2017 collaborative investigation. To our knowledge, this is the first time this information has been revealed publicly. The removed sections reveal the operational designations and cover name structure for domestic U.S. NRO Mission Ground Stations.

Using PDF analysis tools, we found hidden text embedded in the metadata versioning of two documents published alongside investigative stories about NSA satellite surveillance facilities. These metadata artifacts prove that earlier versions of the documents contained detailed descriptions of domestic U.S. ground stations that were systematically scrubbed before publication (not just redacted with black boxes, but with text completely removed).

What was published from the Snowden documents: What was removed from the published documents:

The facilities themselves are not unknown. "Aerospace Data Facility" at Buckley Space Force Base is publicly acknowledged as a National Reconnaissance Office (NRO) Mission Ground Station. "Classic Wizard Reporting and Testing Center" at Naval Research Laboratory is publicly acknowledged, though its designation as a Mission Ground Station is less clear. What's NOT public (until now) is the specific operational designations used in classified networks: "Consolidated Denver Mission Ground Station (CDMGS)" and "Potomac Mission Ground Station (PMGS)." The Snowden documents prove these are deliberate cover names (not just alternative terminology) and show exactly what's classified and what's not.

Hidden PDF versions

The first PDF document titled "Menwith satellite classification guide" has two versions in the file metadata: an older one and a newer one. The removed information exists in the earlier version, and is completely removed in the second, published version. This is not standard redaction with black boxes - the text was completely deleted from the visible document while remaining embedded in the PDF's internal version history.

Screenshot from the first version of the document, containing the hidden text (sections 5.1.5.2 - 5.1.5.6).


Screenshot from the second version of the document, where the text is removed.

The removed text:

5.1.5.2 (U) Facility Name: Formally identified as the ,Mission Support Facility(MSF) also re-
    ferred as the Classic Wizard Reporting and Testing Center (CWRTC).
    
5.1.5.3 (S//TK) Cover Story: The fact of a cover story is S//TK, the cover story itself is unclas-
    sified.
    
5.1.5.4 (U) Software development, maintenance, testing, and communications support to a
    world-wide Navy communications and reporting system.
    
5.1.5.5 (U) Associations:

1. The term Potomac Mission Ground Station (PMGS)=S//TK
2. The term Classic Wizard Reporting and Testing Center
   (CWRTC)=UNCLASSIFIED
3. The term Naval Research Laboratory=UNCLASSIFIED
4. The fact that CWRTC is the cover name for the PMGS=S//TK
5. The fact that CWRTC is a communications and data relay location for the
   US=UNCLASSIFIED (no association w/NRO)
6. The fact that PMGS is located on the NRL=S//TK
7. The fact that the NRO has a MGS located on the NRL=S//TK
8. The fact that the CWRTC is located on the NRL=UNCLASSIFIED (no association
   w/NRO)
9. CWRTC associated w/NRO=S//TK
10. Association of NRO, CIA, or NSA personnel with the CWRTC=S//TK
11. Association of CWRTC with other NRO MGS=S//TK
12. Association of MSF with the NRO=S//TK.
13. Association of CWRTC with the ADF=UNCLASSIFIED (no association w/NRO)

5.1.5.6 (U) Visitors: CWRTC is housed within buildings 259 and 260 on the Naval Research
    Laboratory in Southwest Washington, DC.

The second document "NRO SIGINT Guide for Pine Gap" also has two versions in the file metadata: an older one and a newer one.

Screenshot from the first version of the document, containing the hidden text (section 5.1.2).


Screenshot from the second version of the document, where the text is removed.

The removed text:

5.1.2 (S//TK) Consolidated Denver Mission Ground Station (CDMGS)

5.1.2.1 (U) Facility Name: Aerospace Data Facility (ADF)

5.1.2.2 (S//TK) Cover Story: The fact of a cover story is S/TK, the cover story itself is unclassi-
    fied.

Potomac Mission Ground Station (PMGS)

In the "hidden version" of the document "Menwith satellite classification guide" section 5.1.5 describes a facility formally identified by its cover name "Mission Support Facility (MSF)," also referred to as the "Classic Wizard Reporting and Testing Center (CWRTC)." The classified operational designation is Potomac Mission Ground Station (PMGS).

Location: Buildings 259 and 260, Naval Research Laboratory, Southwest Washington, DC.

Public cover story: "Software development, maintenance, testing, and communications support to a world-wide Navy communications and reporting system."

Actual function: Mission Ground Station in the National Reconnaissance Office's satellite intelligence network.

The document explicitly states that "the fact of a cover story is S//TK" - meaning even acknowledging that CWRTC is a cover name (rather than the facility's real identity) is classified Secret/Talent Keyhole.

The classification guide provides a detailed breakdown of what's public and what's secret:

This layered classification allows the facility to operate under a public identity while keeping its actual intelligence designation and function secret.

Consolidated Denver Mission Ground Station (CDMGS)

In the "hidden version" of the document "NRO SIGINT Guide for Pine Gap" section 5.1.2 describes a facility identified by the cover name "Aerospace Data Facility (ADF)". The classified operational designation is "Consolidated Denver Mission Ground Station (CDMGS)."

Location: Buckley Space Force Base, Aurora, Colorado

Public acknowledgment: Publicly known as "Aerospace Data Facility-Colorado." For example ADF-C is openly described in Wikipedia as an NRO facility for "command and control of reconnaissance satellites."

What's NOT public: The operational designation "Consolidated Denver Mission Ground Station" and the fact that "Aerospace Data Facility" is a cover name for it.

As with PMGS, the classification guide shows "the fact of a cover story is S//TK" - the deception itself is classified.

Both hidden facilities appear in an organizational classification table in the Pine Gap guide. The table's visual structure reveals which names refer to the same facilities through deliberate formatting. Thicker borders separate distinct facility groups, while thinner borders separate columns within each group (this might be a bit hard to see from the screenshot/document). Each facility appears multiple times - once under its classified operational designation, and again under its unclassified cover name(s):

The groupings show:

For each facility, the real operational designation (CDMGS, PMGS, HMGS, AMGS) has all agency associations classified S//TK (Secret). But the cover names have NSA and NGA associations marked as unclassified (U) or For Official Use Only (U//FOUO).

This creates a classification system where you can publicly acknowledge intelligence work using sanitized facility names, while the actual operational designations remain secret.

The domestic facilities use two cover names each (ADF + FSD for Denver; MSF + CWRTC for Potomac), while foreign facilities use only one. This suggests layered operational security for facilities on U.S. soil - possibly to navigate Congressional oversight, legal restrictions on domestic intelligence operations, or different audiences requiring different levels of plausible deniability.

There is a deliberate pattern in these two classification guides: detailed sections describing specific U.S. facilities were removed, while equivalent foreign facility sections were published intact. The 2016 Menwith Hill guide had its PMGS section (5.1.5) completely removed. The 2017 Pine Gap guide had its CDMGS section (5.1.2) completely removed. Both guides retained their detailed descriptions of foreign facilities, including operational designations, cover stories, and visitor protocols.

U.S. facilities weren't entirely absent from the published documents. The Pine Gap classification table shows CDMGS, PMGS, ADF, and other U.S. facility designations alongside foreign facilities, revealing the structure of the Mission Ground Station network. Other published documents from both investigations mention U.S. facilities. What was specifically removed were the detailed classification guide sections that would have explained these U.S. facilities the same way Menwith Hill and Pine Gap were explained.

Who edited the documents?

PDF metadata provides forensic evidence of the editing process. The Pine Gap classification guide shows timestamps from July 31, 2017, three weeks before publication. Two versions were created minutes apart using Nitro Pro 8, a commercial PDF editor: version 1 at 13:48:54 (containing the CDMGS section) and version 2 at 13:50:48 (with CDMGS removed). The Intercept and ABC published identical PDFs with the same metadata artifacts, indicating the editing was done once and the same file shared between organizations.

The Intercept, as holder of the Snowden archive, likely handled technical document preparation for publications. The Menwith Hill classification guide, published solely by The Intercept in 2016, shows more thorough metadata sanitization but the same editorial pattern - domestic facility sections removed while foreign equivalents remain.

We contacted Ryan Gallagher, the journalist who led both investigations, to ask about the editorial decision to remove these sections. After more than a week, we have not received a response.

The next part will be a technical deep-dive into PDF metadata across the published Snowden documents. We found that many documents contain multiple versions in their metadata, revealing the editorial redaction process: visible NSA agents' usernames that were later removed, screenshots that were later redacted, and surveillance data that went through multiple rounds of redaction. We'll also document cases of failed redactions - including one where redacted text remained fully copyable, previously reported only by a Polish cybersecurity blog.

Notes

You can extract versions from a PDF file for example with a pdfresurrect tool (pdfresurrect -w filename.pdf).

You can download the document versions directly here:

Menwith satellite classification guide versions: NRO SIGINT Guide for Pine Gap versions: