NSA Admits Lots Of People Could Have Done What Snowden Did

from the the-changing-story dept

The NSA keeps changing its story about Snowden. Was he brilliant or a nobody? Did he have access to all these documents or did he have to hack into systems? Did he get the important stuff or not? Each time the story seems to be different. A few months ago, you may recall the NSA insisted that Snowden needed to borrow the identities of others to access the documents he had. They also argued that he must have bypassed or deleted log files. However, in an interview, the NSA's Director of Technology, Lonny Anderson, admits that basically anyone at the NSA with top secret clearance could all access the same stuff and also claims that all the log files were there:

contrary to much of what's been reported about Snowden's work at the NSA, it wasn't his position as a systems administrator and the broad access to networks and databases that came with it that allowed him to steal so many secrets. Rather, Anderson said, "the lion's share" of the information Snowden obtained was available to him because of his top-secret security clearance -- TS/SCI -- which allowed him to access so-called sensitive compartmented information.

That's an important distinction, because it means any number of the thousands of people at the NSA with the same clearance level could have done what Snowden did -- not just the smaller number of systems administrators, who have a kind of "super user" access that isn't granted to all other employees. That helps explain why Anderson couldn't tell the White House that there were no more Snowdens. Theoretically, there could have been thousands of them.

Of course, who knows if Anderson is telling the truth. Later in the interview he seems to contradict himself -- both claiming that Snowden's activities on the network were tracked ("He was not a ghost. It's not like he was so stealthy that we didn't see his activities") and that Snowden was able to get away with what he did because he was "anonymous" on the network.

"Where I think we were negligent -- if we were negligent -- where we were is that we allowed him some form of anonymity as he did that. Someone wasn't watching all of that. So the lesson learned for us is that you've got to remove anonymity from the network."

I guess it's possible that the actions were tracked without the identification of who it was. Amusingly, you could argue that the NSA had the metadata on Snowden's actions, but not the actual details of who he was. Oh, the irony.

The one area where Snowden's sysadmin role apparently did play a part was in being able to get many of those documents off the network without being noticed. Part of his job was, as revealed earlier, to move documents around within the NSA's network, but his sysadmin status allowed him to download those documents without any alarm bells going off.

What Snowden could do as a systems administrator, as opposed to an employee without those privileges, was to "exfiltrate," or remove data from the NSA networks, Anderson said. "That, a normal user would not have been able to do." He acknowledged that the NSA's information control regime is not currently designed to alert officials when documents are being removed by a systems administrator. That's going to change, Anderson said. In the future, individuals will also be locked out of the networks if they remove data without authorization.

At this point, it's difficult to believe anything that the NSA is saying about Snowden, because so much of it seems to contradict what the NSA itself has said in the past. Perhaps that's just part of the disinformation campaign. Or, perhaps it's a sign that the NSA still has no clue what happened.

Filed Under: clearance, ed snowden, lonny anderson, nsa, surveillance, top secret

Would You Trust Any Organization That Doesn't Trust 4,000 Of Its Employees? What If It's The NSA?

from the something-wrong-here dept

It's becoming increasingly clear that one of the reasons Edward Snowden was able to access so much secret information -- and walk out of the door with it -- is that the NSA is an organizational mess. A fascinating post by David Ignatius in the Washington Post underlines another way in which the NSA is deeply dysfunctional by any normal standard:

the NSA planned to investigate at least 4,000 of its employees and contractors in 2013, thanks in part to new software that could detect "anomalous" behavior by the workforce.

He goes on to ask an extremely important question:

How do you run an organization where 4,000 of your employees are suspect? I fear that if the NSA tries to impose ever-more stringent controls, this will create even more disgruntled workers and a larger pool of anomalies. A new "Red Scare" may well follow the Snowden revelations, but making every employee a suspect is likely to backfire.

Even the most anodyne of organizations that can't fully trust 4000 of its employees is in big trouble; if it's one that handles some of the most sensitive information in the world, with the potential to save or cost many lives, that lack of trust is a recipe for disaster on a massive scale. And as Ignatius notes, the more the NSA tries to clamp down on people, the more likely it is to create further Edward Snowdens.

Ignatius also points out that the solution is not to close down, but to open up. By reducing drastically the number of things that are deemed secret in the first place, it would be possible to concentrate on protecting just those that really matter:

The beneficiaries in a no-secrets world will be relatively open societies, such as the United States, that are slowly developing a culture of accountability and disclosure for their intelligence agencies, however painful the process may be. The fewer secrets, the less to protect.

Although it's arguable to what extent the US has developed that "culture of accountability and disclosure" for the NSA yet, as President Obama inches towards admitting the scale of the problem here, the rest of the analysis in Ignatius' piece is well-worth reading.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: clearance, contractors, ed snowden, nsa, nsa surveillance, review, top secret

For An Intelligence Agency, The NSA Doesn't Seem To Have Much Idea What's Going On Inside Its Own Walls

from the inside-of-a-panopticon-is-the-least-secure-area dept

Better late than never, the NSA seems like it's finally getting around to fixing the problems on the inside of the agency.

So sharp is the fear of threats from within that last year the NSA planned to launch at least 4,000 probes of potentially suspicious or abnormal staff activity after scrutinizing trillions of employee keystrokes at work. The anomalous behavior that sent up red flags could include staffers downloading multiple documents or accessing classified databases they do not normally use for their work, said two people familiar with the software used to monitor employee activity.

Somebody's putting in some overtime! In addition to sifting through the vast amount of data collected in its many quasi-legal (and some completely illegal) programs, the agency has also had to wade through "trillions" of logged employee keystrokes. (The haystacks are coming from inside the house!)

This investigation has chewed up a lot of money with very little in the way of results, suffering from "critical delays" and (go figure) a lack of cohesive implementation. Meanwhile, a sysadmin headed to Hong Kong with an NSA-to-go kit. Not that a more expeditious rollout of the investigations would have mattered.

Contractors like Snowden, an NSA spokeswoman said, were not included in the plans to reinvestigate 4,000 security clearances.

The agency claims these investigations aren't in place to root out offenders (although it's certainly welcome to do so), but to "reduce the potential" of an insider compromise.

“Periodic re-investigations are conducted as one due-diligence component of our multifaceted insider threat program.”

Well, whatever's been put into place so far has failed dramatically, and what's being pursued doesn't look very promising. The agency claims the first rollout was stunted by resources being diverted towards mitigating the fallout from Bradley Manning's leaks. Now, as the agency tries to reignite the investigative process, Snowden (and several media entities) are standing behind it, periodically blowing out the flame.

The NSA still seems to have no idea what exactly Snowden took and that lack of knowledge has forced it to play nothing but defense since the leaks began. The internal vetting process seems to be about as "efficient" as the external process, albeit for very different reasons. An agency that can't search its own email doesn't have a chance against an individual with access and determination.

And then there's this aspect of the whole debacle, as pointed out by Bruce Schneier:

I am completely croggled by the fact that the NSA apparently had absolutely no contingency plans for this sort of thing.

It doesn't, and that's a very worrying issue for a NATIONAL SECURITY AGENCY. At this point, the NSA can't close the barn doors fast enough and every assertion it makes about the limits, oversight or "trustworthiness" of its programs is usually undermined within a few days by yet another leak. Something aimed at nothing more than a "reduction" in leaky insiders just isn't going to be good enough. On the other hand, the public is benefiting from the NSA's pain -- it's now more informed about the agency's activities than it's been for the previous half-decade -- and the cumulative effects of the leak-and-denial cycle have forced the NSA to actually participate in a national discussion and make tentative steps towards transparency.

Filed Under: clearance, employees, insider threats, nsa, top secret

Contractors Providing Background Checks For NSA Caught Falsifying Reports, Interviewing The Dead

from the the-talking-dead dept

The fallout from Ed Snowden's leaks has taken many forms, one of which is the NSA taking a long look at its contractors' hiring processes. Snowden claims to have taken the job solely to gathering damning info. This revelation, combined with some inconsistencies in his educational history, have placed the companies who perform background and credit checks under the microscope.

What these agencies are now discovering can't be making them happy, including the news that one contractor's investigative work apparently involved a seance.

Anthony J. Domico, a former contractor hired to check the backgrounds of U.S. government workers, filed a 2006 report with the results of an investigation.

There was just one snag: A person he claimed to have interviewed had been dead for more than a decade. Domico, who had worked for contractors CACI International Inc. (CACI) and Systems Application & Technologies Inc., found himself the subject of a federal probe.

It's not as if Domico's case is an anomaly.

Domico is among 20 investigators who have pleaded guilty or have been convicted of falsifying such reports since 2006. Half of them worked for companies such as Altegrity Inc., which performed a background check on national-security contractor Edward Snowden. The cases may represent a fraction of the fabrications in a government vetting process with little oversight, according to lawmakers and U.S. watchdog officials.

Who watches the watchers' watchers? It appears as if that crucial link in the chain has been ignored. Give any number of people a job to do and, no matter how important that position is, a certain percentage will cut so many corners their cubicles will start resembling spheres.

These are the people entrusted to help ensure our nation's harvested data remains in safe hands, or at least, less abusive ones. Those defending the NSA claim this data is well-protected and surrounded by safeguards against abuse. Those claims were always a tad hollow, but this information shows them to be complete artifice. The NSA, along with several other government agencies, cannot positively say that they have taken the proper steps vetting their personnel.

USIS, the contractor who vetted Ed Snowden, openly admits there were "shortcomings" in its investigation of the whistleblower. Perhaps Snowden's background check was a little off, but overall, calling the USIS' problems "shortcomings" is an understatement.

Among the 10 background-check workers employed by contractors who have been convicted or pleaded guilty to falsifying records since 2006, eight of them had worked for USIS, according to the inspector general for the U.S. Office of Personnel Management. The personnel agency is responsible for about 90 percent of the government’s background checks.

In one case, Kayla M. Smith, a former investigative specialist for USIS, submitted some 1,600 falsified credit reports, according to the inspector general’s office.

Smith spent 18 months turning in these falsified reports, which accounted for a third of her total output. One might wonder how someone like Smith ends up working for a background check contractor. The answer? This problem isn't confined to one level.

[T]he investigator who had vetted Smith was convicted in a separate falsification case, Patrick McFarland, inspector general for the personnel office, said at a June 20 hearing held by two Senate panel.

Will it get better? USIS is already ceding market share to other contractors but it's impossible to say whether its competitors will be more trustworthy. McFarland says his office doesn't have enough funding to perform thorough probes, which indicates what's been caught so far is just skimming the surface. These agencies harvesting our data (and their defenders) all expect Americans (and others around the world) to simply trust them. Meanwhile, the reasons why we shouldn't continue to mount unabated.

A couple of senators are hoping their new piece of oversight legislation will fix the problem. It would provide McFarland's office with more investigation funding, but simply adding more "oversight" isn't going to make the problem go away. The NSA's mouthpieces continue to insist that everything it does is subject to tons and tons of "oversight," but that has done very little to improve its standing in the "trustworthy" department. There are systemic issues that need to be addressed, both in these agencies and the contractors they hire and expecting to paper over the cracks with a little legislation will only result in more revelations of wrongdoing, rather than fewer occurrences.

Filed Under: background checks, clearance, contractors, nsa, nsa surveillance, top secret
Companies: altegrity, caci, usis

Universal Music Album Recalled... For Infringing Content?

from the seize-'em! dept

Probably the most aggressive major record label, when it comes to supporting ridiculously overaggressive attacks on infringement and things like taking down websites, would be Universal Music -- the company whose ex-CEO once gleefully declared to the world that he was too clueless to hire someone who understands technology (he has since moved on to lead Sony Music). Of course, we always discover that the most aggressive copyright maximalists are later caught infringing themselves... So it's not surprising to hear that the release of the album for Universal Music recording artist Tyga has run into some copyright problems. While the album had been sent to retailers and was available for pre-order on iTunes, it was yanked off iTunes, and a note was sent to retailers telling them to "pull and return" the album.

The issue? Apparently the title track, "Careless World," has some sound clips from a Martin Luther King speech... and no one bothered to clear it. Oops. Of course, many of us think that locking up MLK's works are a travesty, but his heirs have been incredibly aggressive over the years in claiming that they deserve to get paid for any attempts to honor MLK. Of course, if Universal Music wasn't such an extreme copyright maximalist we might have a bit of sympathy for their plight. But given that they've made this bed, there's a bit of irony in noting that they now have to lie in it.

Filed Under: clearance, copyright, infringement, martin luther king, mlk, tyga
Companies: universal music

The Ridiculousness Of Copyright Clearances: Fight Club Producers Had To Pay Off Marla Singer?

from the the-first-rule-of-copyright-clearance:-you-don't-talk-about-copyright-cleara dept

Last August, we wrote about the sheer insanity that movie makers need to go through to make sure no "unauthorized" brands appear in a movie. The process of clearing every single right is mind-boggling, and appears to serve only one purpose: to transfer money from creators to lawyers. I'm reminded of the massive spreadsheet Brett Gaylor showed when he discussed his movie, and the process of trying to secure insurance for it. It went on and on and on and listed every single thing in the movie, and whether it was cleared or not. The more you learn about this stuff, the more ridiculous it seems.

Ry Jones writes in to let us know that he transcribed a part of the Fight Club Director's commentary by David Fincher, where he discusses the insanity of rights clearance for that movie. He mainly discusses two key points, both of which seem ridiculous. First, with the character of Marla Singer, they had to do a search and find out if there are real Marla Singers who might be upset and claim that the movie is about them. If there are lots of Marla Singers, no problem, since they can just say "hey, not you." But if there's one, then it becomes an issue. Guess what?

There's only one Marla Singer in the continental United States, in Illinois somewhere, of course, as soon as attorneys get involved, the whole thing gets completely fucked up. Somebody called her and told her there's this book, and we're making a movie based on this character that had her name. All of a sudden, her attorneys are calling and we have to pay this person off.

On top of that, they had wanted to base the movie in Wilmington, Delaware, which is where the book takes place. But, apparently, that would require all sorts of rights clearances as well, to the point that they weren't even able to show the Delaware state flag because it would require a new set of rights clearances. How does this make any sense at all? Unlike the Aboriginal flag of Australia, the state flag of Delaware certainly should not be covered by copyright, and it makes little sense that there would be any requirement at all for clearing the rights. If the book can take place in Wilmington, Delaware without rights clearances, why can't a movie?

Filed Under: clearance, copyright, david fincher, fight club