Just want to chime in and say that this doesn't imply that PGP is safe. I mean, it probably is. They would not let us know, either way.

It's going to be missed by passive data sweeps. If someone had suspected and was watching him that's a different story.

Crypto is "safe enough" based on an idea of how long the data needs to be protected. Best case it is "safe" for the time it will take to brute force the entire key space, but in reality most crypto will remain safe much shorter than that.

We've increased typical keysizes for PGP many times over the years because we expect there's a reasonable change for smaller keys to be broken too quickly.

In other words: You should not infer that PGP is "safe", but that he believed PGP with the key size he used would protect the messages until it doesn't matter if they're revealed at least from the level of monitoring he feared, which could just mean safe against routine intercepts and security scans for the few months until his identity was revealed anyway.

PGP alone will do nothing for anonymity. Someone with access to sensitive information sending encrypted email to a journalist who was most probably on the radar of intelligence and a film maker (Poitras) who we know was on the watch list should have raised eyebrows.

Being on a remote island with just over a million inhabitants would not make it easier to stay anonymous. Not to speak of the strong military presence there.