NSA whistleblower says he left detectable digital traces of his removal of documents which the agency did not pick up on

National Security Agency whistleblower Edward Snowden has called into question the competence of the investigation into the aftermath of his disclosures, which was overseen by the NSA’s new deputy director, Rick Ledgett.

In a new cover story for Wired magazine, the former NSA contractor provided writer James Bamford with previously unreported allegations of NSA cyberattack tools, including a piece of software, codenamed MonsterMind, that would automate a hostile response when it detected a network intrusion. He also alleged that a 2012 incident that took Syria’s internet offline was the fault of the NSA.

Snowden told Bamford, a longtime chronicler of the agency, that he left detectable digital traces of his removal of scores of documents from the technically sophisticated agency, allowing the NSA to know precisely what he did and did not take. Yet making a specific determination of the extent of the data breach has escaped the agency, which has simultaneously made vast and dire claims about the damage Snowden caused.

The head of the NSA’s digital forensics investigation into the Snowden disclosures, considered the most extensive in the agency’s history, was Ledgett, who has since been promoted to deputy director, its most senior civilian position.

Ledgett told CBS’s 60 Minutes in December that he “wouldn’t dispute” that Snowden took with him from the NSA 1.7m documents – although subsequent clarifications by the NSA and its congressional allies indicate that the basis for that figure is the number of documents that Snowden was able to access, not what he actually took.

If Snowden’s allegation is true, it raises questions about the technical expertise and competence of Ledgett’s investigation, which informed months of NSA public pushback against Snowden. It would also call into question assurances, made by Ledgett in a December interview with Reuters and other NSA officials, that the agency has implemented robust post-Snowden technical defenses to forestall another mass breach of classified information.

“I figured they would have a hard time,” Snowden told Bamford in an interview in Moscow, where he received asylum last year after his intended plans for asylum in Latin America were blocked, in part by US government officials.

“I didn’t figure they would be completely incapable.”

Earlier this year, Lt Gen Michael Flynn, then the director of the Defense Intelligence Agency, told Congress that the intelligence community’s understanding of how many documents Snowden took was a blanket assessment, not verified fact.

“We assume that Snowden, everything that he touched, we assume that he took, stole,” Flynn testified in February.

That assessment provided NSA and its allies with a basis for publicly alleging that Snowden had done widespread damage to US intelligence efforts worldwide, endangered US military personnel and prompted terrorist organizations to harden their cyber defenses. It has provided public evidence for none of those assertions, the most dire of which the new director, Admiral Michael Rodgers, has abandoned.

The NSA did not address questions about what Bamford called Snowden’s “digital breadcrumbs”. It provided the Guardian with an omnibus response that did not deny any allegation Snowden made to Bamford.

“If Mr Snowden wants to discuss his activities, that conversation should be held with the US Department of Justice. He needs to return to the United States to face the charges against him,” NSA spokeswoman Vanee Vines said. It is the same response she provided to Bamford for his story.

The piece features dramatic photographs by the acclaimed photographer Platon of Snowden in Moscow, including a cover photo of Snowden gripping an American flag to his face. Another photo, presumably provided by Snowden, shows the future whistleblower in a tuxedo with a smiling Michael Hayden, the former NSA and CIA director who began the constellation of post-9/11 warrantless bulk surveillance programs, the extent of which Snowden exposed.

Snowden also told Bamford about two other previously unknown NSA efforts. Both concern cyberattacks.

The MonsterMind software is a digital tool that would detect the beginnings of a hostile cyber incursion and automates a hostile response. If true, the software would turn a potential act of war into an automated command, without input from the chain of command, and not necessarily target at the culprit of the incursion, as many such digital penetrations are routed through third countries.

It is also unclear whether MonsterMind distinguishes between incursions aimed at data destruction, data exfiltration and network disruption; nor if it automates a proportional response.

As well, Snowden identified the elite NSA hacking unit, called Tailored Access Operations, accidentally cut off Syria’s access to the internet in 2012. The unit allegedly attempted to install an exploit in the hardware of an unnamed service provider that would have provided NSA with mass access to internet usage, communications and patterns in Syria, where a civil war was metastasizing into an Islamist insurgency destabilizing the Middle East.

Instead of gaining mass visibility into the internet habits of Syrians, Snowden alleged, a glitch took Syria offline. On 29 November 2012, the analysis firm Renesys reported that 92% of the routed networks providing internet connectivity for Syria, 77 of them, had gone dark.

Snowden told Bamford that NSA officials joked that if they were discovered, they would blame the outage on Israel.

At the time, the government of dictator Bashar al-Assad, blamed the outage on “terrorists”, while opposition groups fighting Assad suspected his government itself was responsible.

NSA did not respond to questions about Ledgett, MonsterMind or the Syrian outage.