NSA Admits Lots Of People Could Have Done What Snowden Did
from the the-changing-story dept
The NSA keeps changing its story about Snowden. Was he brilliant or a nobody? Did he have access to all these documents or did he have to hack into systems? Did he get the important stuff or not? Each time the story seems to be different. A few months ago, you may recall the NSA insisted that Snowden needed to borrow the identities of others to access the documents he had. They also argued that he must have bypassed or deleted log files. However, in an interview, the NSA's Director of Technology, Lonny Anderson, admits that basically anyone at the NSA with top secret clearance could all access the same stuff and also claims that all the log files were there:contrary to much of what's been reported about Snowden's work at the NSA, it wasn't his position as a systems administrator and the broad access to networks and databases that came with it that allowed him to steal so many secrets. Rather, Anderson said, "the lion's share" of the information Snowden obtained was available to him because of his top-secret security clearance -- TS/SCI -- which allowed him to access so-called sensitive compartmented information.Of course, who knows if Anderson is telling the truth. Later in the interview he seems to contradict himself -- both claiming that Snowden's activities on the network were tracked ("He was not a ghost. It's not like he was so stealthy that we didn't see his activities") and that Snowden was able to get away with what he did because he was "anonymous" on the network.
That's an important distinction, because it means any number of the thousands of people at the NSA with the same clearance level could have done what Snowden did -- not just the smaller number of systems administrators, who have a kind of "super user" access that isn't granted to all other employees. That helps explain why Anderson couldn't tell the White House that there were no more Snowdens. Theoretically, there could have been thousands of them.
"Where I think we were negligent -- if we were negligent -- where we were is that we allowed him some form of anonymity as he did that. Someone wasn't watching all of that. So the lesson learned for us is that you've got to remove anonymity from the network."I guess it's possible that the actions were tracked without the identification of who it was. Amusingly, you could argue that the NSA had the metadata on Snowden's actions, but not the actual details of who he was. Oh, the irony.
The one area where Snowden's sysadmin role apparently did play a part was in being able to get many of those documents off the network without being noticed. Part of his job was, as revealed earlier, to move documents around within the NSA's network, but his sysadmin status allowed him to download those documents without any alarm bells going off.
What Snowden could do as a systems administrator, as opposed to an employee without those privileges, was to "exfiltrate," or remove data from the NSA networks, Anderson said. "That, a normal user would not have been able to do." He acknowledged that the NSA's information control regime is not currently designed to alert officials when documents are being removed by a systems administrator. That's going to change, Anderson said. In the future, individuals will also be locked out of the networks if they remove data without authorization.At this point, it's difficult to believe anything that the NSA is saying about Snowden, because so much of it seems to contradict what the NSA itself has said in the past. Perhaps that's just part of the disinformation campaign. Or, perhaps it's a sign that the NSA still has no clue what happened.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: clearance, ed snowden, lonny anderson, nsa, surveillance, top secret
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Re:
So this opens up the possibility that there's another leaker now.
[ link to this | view in chronology ]
After all if anything on a computer can be manipulated or changed by thousands of NSA employees etc how can it be relied upon beyond reasonable doubt?
[ link to this | view in chronology ]
NSA Scumbags
_____________________
Where the NSA was negligent wasn't in its sysops, but in condoning a culture that plays fast and loose with the rules, and seeing themselves as against the rest of us, innocent Americans and Pakistani terrorists alike. If the NSA had spent a bit more time self-evaluating, respecting and playing by the rules, and focusing on their actual mission instead of accumulating "all the date" (thus making real-world, helpful analysis next to impossible), we might have been able to stop the WTC bombing, 9/11, Madrid, London, Boston and now Volgograd (not to mentioned all the online security breaches: TJ Maxx, Target, Adobe, etc.). Why should the NSA actually stop real threats, terrorist and electronic, when they can justify billion-dollar budgets by creating an overly burdensome process that is self-sustaining in its impotence. When they don't catch the next bad guy, they'll use that failure to justify more money for themselves.
[ link to this | view in chronology ]
Re: NSA Scumbags
[ link to this | view in chronology ]
Re: Re: NSA Scumbags
[ link to this | view in chronology ]
Re: NSA Scumbags
[ link to this | view in chronology ]
Oh the Irony
But they cannot get their story straight on how Snowden took what.
Maybe if they were paying attention to stuff that really mattered rather than where my cell phone is and what my credit card purchased they would have detected that Snowden was taking their documents and that the Underwear Bomber and Boston Bombers were about to strike.
The NSA will Never Stop Anything.
[ link to this | view in chronology ]
If there are thousands of theoretical Snowdens, how many of those theoretical are black hats?
[ link to this | view in chronology ]
Re:
Not really.
If the system they had was set up so you could actually track who did what with what information, then they'd lose their plausible deniability when someone actually tried to audit what exactly they'd been doing, as there would be actual records. With it set up like they're describing here though, anytime someone comes calling for details, they can just respond with 'no such records have been found', or 'we do not track that information'.
Rather hard to hold a group accountable for their actions, if there's no records of their actions after all, and you can bet they know this.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
Note that Snowden having root access as a system administrator may have originally led them to believe that Snowden was using the root user to retrieve the files, and since they couldn't see the root user doing so they would have assumed he altered log files to cover his tracks.
Simply (theoretically, in practice it takes a while to sort everything out) swapping to a user-group model and carefully tracking the invocation of root privilege would address this issue. Such a model has been advocated as a best practice for a fairly long time, but as That One Guy pointed out, the NSA were probably resistant to invoking it.
[ link to this | view in chronology ]
Useless
Priceless
[ link to this | view in chronology ]
If there is anything I've come to expect, it is that the NSA will never own up to it's faults. It will never tell the truth to anyone, no matter who that anyone is, including courts, oversight committees, nor anyone else.
There is only one cure I see for an agency gone rapid. Remove it's funding, shut it down, and go through it with an impartial committee not beholding to any one group.
[ link to this | view in chronology ]
Re:
No, that's only the mark of a bad liar. There are plenty of great liars who have no problem keeping their stories straight.
[ link to this | view in chronology ]
THINK
cui bono?
what changes will result from the Snowden leak? it's a puzzle: spooks always make every effort to be sure their accomplishments are not known. if Snowden was allowed to leak then that means what he has leaked -- was generally known to intelligence organizations around the world and all the uproar is is just part of the show.
we have 2 federal judges conflicting on Section 215 -- setting the stage for a SCOTUS decision
will NSA intelligence become admissible in court? no parallel detective work required to acquire evidence by legal means ? the "writ of assistance" noted in the 30c3 keynote?
who are they after, anyhow?
[ link to this | view in chronology ]
Re: THINK
As for whether the leaks were carefully planned government actions, the response of certain government actors have demonstrated that they had no idea how much Snowden took. Further, such a gambit is a stunningly bad play for any entity with the power to actually pull it off.
[ link to this | view in chronology ]
What's that say about the intelligence of our government?
Needless to say, top ranking officials dropped that attack angle, after they realized how dumb they sounded.
[ link to this | view in chronology ]
NSA's Director of Technology, Lonny Anderson, is talking nonsense, IMHO
[ link to this | view in chronology ]
[ link to this | view in chronology ]
A Lot of People Have Clearance
So pretty much anyone at the agency had access. Unless you were maybe the dishwasher in the cafeteria.
[ link to this | view in chronology ]