From The Times:
Using "web crawler" software designed to search, index and back up a website, Mr. Snowden "scraped data out of our systems" while he went about his day job, according to a senior intelligence official. "We do not believe this was an individual sitting at a machine and downloading this much material in sequence," the official said. The process, he added, was "quite automated."
According to The Times, Snowden apparently set the parameters for the searches, to include documents on internal NSA networks and materials in the internal "wiki," which is used for analysts to share information across the world.
Among the most well-known web crawlers is the Googlebot, Google's automated system for accessing billions of web pages and downloading the contents in order to deliver faster search results. Although likely not as advanced as Google's, the officials speaking to the Times said Snowden's crawler functioned in a similar fashion.
The use of such software would set off red flags at NSA headquarters in Fort Meade, Md., but the government did not catch on since the Hawaii outpost where Snowden worked had not yet been upgraded with security measures designed to detect such activity, according to The Times.
Still, his activity was challenged at some times, but he was reportedly able to parry further questioning. From The Times:
In at least one instance when he was questioned, Mr. Snowden provided what were later described to investigators as legitimate-sounding explanations for his activities: As a systems administrator he was responsible for conducting routine network maintenance. That could include backing up the computer systems and moving information to local servers, investigators were told.
While Snowden continues to live under temporary asylum in Russia, this latest revelation is yet another embarrassment for investigators trying to retrace his steps. Another startling revelation came yesterday, with The Wall Street Journal reporting that the federal contractor tasked with checking into Snowden's background completely bungled its investigation.
The report found that U.S. Investigations Services LLC only spoke with Snowden's mother and then-girlfriend for background references and did not check on any references from Snowden's work at the CIA, because he said his work was "classified."