Judge Tells Prosecutors They Need To Prove Contractor Knew He Had Classified Docs In His 50-Terabyte Stash

from the go-big-AND-go-home dept

The federal judge presiding over the prosecution of a government contractor who took home 50 terabytes of sensitive national security documents home with him has sent a message. And the message is this: collect it all.

Harold Martin did what surveillance agencies do best. He built himself a haystack of government documents, some of them designated "top secret." The prosecution is counting on this haystack to put Harold Martin in prison on espionage charges. But the judge has just ordered prosecutors to prove the few "top secret" needles justify a conviction for the entire haystack. Josh Gerstein at Politico has the details.

Baltimore-based U.S. District Court Judge Marvin Garbis suggested in his Feb. 16 order that the sheer volume of information may be a problem for prosecutors because their case is based on 20 felony charges that Martin illegally retained individual classified documents without permission.

Garbis asked the prosecution and defense to explain whether the government must prove that Martin knew he had those specific documents in his possession or whether he could be convicted of the claimed Espionage Act violations without such proof.

Espionage prosecutions are a mess. This mess usually works in the government's favor. The rules surrounding these prosecutions severely restrict the defenses the accused can raise and the evidence they can submit. The sensitivity of the underlying documents results in plenty of ex parte submissions seen only by the judge and the government. In this case, though, the judge is asking the government to prove Martin knowingly took top secret documents, rather than just ending up with some in his massive collection of government paperwork. If it can't, Martin might walk away from charges on the premise he had no idea what was in the 50 terabytes in his possession. Here's law prof Steve Vladeck's take on the order:

"There has not been a lot of really sophisticated litigation about the awkwardness of treating piles of information as being subject to the Espionage Act because of one piece of that pile," said University of Texas law professor Stephen Vladeck. "It's a rare situation where the defendant has a plausible argument that he grabbed the wrong pile of documents."

Prosecutors aren't happy with this order. Their response says they have no obligation to prove Martin knew he had sensitive documents in his stash. This is a questionable assertion, considering the accusing party carries the burden of proof in all criminal cases. The government apparently believes it can secure a conviction without this key evidence.

But prosecutors also make a solid point: a requirement like this encourages people exfiltrating government documents to take as many as possible. The more you grab, the harder it is for prosecutors to prove you knowingly possessed classified material.

If this proves to be a sticking point, prosecutors may decide to go after Martin for theft. It probably won't net them the sentence a 20-count indictment normally would, but probably looks more palatable than accepting Martin's unsolicited offer to plead guilty to a single count of the charges brought against him.

Hopefully, the judge won't back down from this demand. The government's track record with espionage prosecutions is terrible. They've severely harmed people who've done nothing more than try to be a good employee. Lots of people take work home with them. Only a very small percentage of those do anything more nefarious with government documents than work off the clock.

Filed Under: data, harold martin, hoarding, nsa, secrets, top secret

NSA Admits Lots Of People Could Have Done What Snowden Did

from the the-changing-story dept

The NSA keeps changing its story about Snowden. Was he brilliant or a nobody? Did he have access to all these documents or did he have to hack into systems? Did he get the important stuff or not? Each time the story seems to be different. A few months ago, you may recall the NSA insisted that Snowden needed to borrow the identities of others to access the documents he had. They also argued that he must have bypassed or deleted log files. However, in an interview, the NSA's Director of Technology, Lonny Anderson, admits that basically anyone at the NSA with top secret clearance could all access the same stuff and also claims that all the log files were there:

contrary to much of what's been reported about Snowden's work at the NSA, it wasn't his position as a systems administrator and the broad access to networks and databases that came with it that allowed him to steal so many secrets. Rather, Anderson said, "the lion's share" of the information Snowden obtained was available to him because of his top-secret security clearance -- TS/SCI -- which allowed him to access so-called sensitive compartmented information.

That's an important distinction, because it means any number of the thousands of people at the NSA with the same clearance level could have done what Snowden did -- not just the smaller number of systems administrators, who have a kind of "super user" access that isn't granted to all other employees. That helps explain why Anderson couldn't tell the White House that there were no more Snowdens. Theoretically, there could have been thousands of them.

Of course, who knows if Anderson is telling the truth. Later in the interview he seems to contradict himself -- both claiming that Snowden's activities on the network were tracked ("He was not a ghost. It's not like he was so stealthy that we didn't see his activities") and that Snowden was able to get away with what he did because he was "anonymous" on the network.

"Where I think we were negligent -- if we were negligent -- where we were is that we allowed him some form of anonymity as he did that. Someone wasn't watching all of that. So the lesson learned for us is that you've got to remove anonymity from the network."

I guess it's possible that the actions were tracked without the identification of who it was. Amusingly, you could argue that the NSA had the metadata on Snowden's actions, but not the actual details of who he was. Oh, the irony.

The one area where Snowden's sysadmin role apparently did play a part was in being able to get many of those documents off the network without being noticed. Part of his job was, as revealed earlier, to move documents around within the NSA's network, but his sysadmin status allowed him to download those documents without any alarm bells going off.

What Snowden could do as a systems administrator, as opposed to an employee without those privileges, was to "exfiltrate," or remove data from the NSA networks, Anderson said. "That, a normal user would not have been able to do." He acknowledged that the NSA's information control regime is not currently designed to alert officials when documents are being removed by a systems administrator. That's going to change, Anderson said. In the future, individuals will also be locked out of the networks if they remove data without authorization.

At this point, it's difficult to believe anything that the NSA is saying about Snowden, because so much of it seems to contradict what the NSA itself has said in the past. Perhaps that's just part of the disinformation campaign. Or, perhaps it's a sign that the NSA still has no clue what happened.

Filed Under: clearance, ed snowden, lonny anderson, nsa, surveillance, top secret

Would You Trust Any Organization That Doesn't Trust 4,000 Of Its Employees? What If It's The NSA?

from the something-wrong-here dept

It's becoming increasingly clear that one of the reasons Edward Snowden was able to access so much secret information -- and walk out of the door with it -- is that the NSA is an organizational mess. A fascinating post by David Ignatius in the Washington Post underlines another way in which the NSA is deeply dysfunctional by any normal standard:

the NSA planned to investigate at least 4,000 of its employees and contractors in 2013, thanks in part to new software that could detect "anomalous" behavior by the workforce.

He goes on to ask an extremely important question:

How do you run an organization where 4,000 of your employees are suspect? I fear that if the NSA tries to impose ever-more stringent controls, this will create even more disgruntled workers and a larger pool of anomalies. A new "Red Scare" may well follow the Snowden revelations, but making every employee a suspect is likely to backfire.

Even the most anodyne of organizations that can't fully trust 4000 of its employees is in big trouble; if it's one that handles some of the most sensitive information in the world, with the potential to save or cost many lives, that lack of trust is a recipe for disaster on a massive scale. And as Ignatius notes, the more the NSA tries to clamp down on people, the more likely it is to create further Edward Snowdens.

Ignatius also points out that the solution is not to close down, but to open up. By reducing drastically the number of things that are deemed secret in the first place, it would be possible to concentrate on protecting just those that really matter:

The beneficiaries in a no-secrets world will be relatively open societies, such as the United States, that are slowly developing a culture of accountability and disclosure for their intelligence agencies, however painful the process may be. The fewer secrets, the less to protect.

Although it's arguable to what extent the US has developed that "culture of accountability and disclosure" for the NSA yet, as President Obama inches towards admitting the scale of the problem here, the rest of the analysis in Ignatius' piece is well-worth reading.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: clearance, contractors, ed snowden, nsa, nsa surveillance, review, top secret

For An Intelligence Agency, The NSA Doesn't Seem To Have Much Idea What's Going On Inside Its Own Walls

from the inside-of-a-panopticon-is-the-least-secure-area dept

Better late than never, the NSA seems like it's finally getting around to fixing the problems on the inside of the agency.

So sharp is the fear of threats from within that last year the NSA planned to launch at least 4,000 probes of potentially suspicious or abnormal staff activity after scrutinizing trillions of employee keystrokes at work. The anomalous behavior that sent up red flags could include staffers downloading multiple documents or accessing classified databases they do not normally use for their work, said two people familiar with the software used to monitor employee activity.

Somebody's putting in some overtime! In addition to sifting through the vast amount of data collected in its many quasi-legal (and some completely illegal) programs, the agency has also had to wade through "trillions" of logged employee keystrokes. (The haystacks are coming from inside the house!)

This investigation has chewed up a lot of money with very little in the way of results, suffering from "critical delays" and (go figure) a lack of cohesive implementation. Meanwhile, a sysadmin headed to Hong Kong with an NSA-to-go kit. Not that a more expeditious rollout of the investigations would have mattered.

Contractors like Snowden, an NSA spokeswoman said, were not included in the plans to reinvestigate 4,000 security clearances.

The agency claims these investigations aren't in place to root out offenders (although it's certainly welcome to do so), but to "reduce the potential" of an insider compromise.

“Periodic re-investigations are conducted as one due-diligence component of our multifaceted insider threat program.”

Well, whatever's been put into place so far has failed dramatically, and what's being pursued doesn't look very promising. The agency claims the first rollout was stunted by resources being diverted towards mitigating the fallout from Bradley Manning's leaks. Now, as the agency tries to reignite the investigative process, Snowden (and several media entities) are standing behind it, periodically blowing out the flame.

The NSA still seems to have no idea what exactly Snowden took and that lack of knowledge has forced it to play nothing but defense since the leaks began. The internal vetting process seems to be about as "efficient" as the external process, albeit for very different reasons. An agency that can't search its own email doesn't have a chance against an individual with access and determination.

And then there's this aspect of the whole debacle, as pointed out by Bruce Schneier:

I am completely croggled by the fact that the NSA apparently had absolutely no contingency plans for this sort of thing.

It doesn't, and that's a very worrying issue for a NATIONAL SECURITY AGENCY. At this point, the NSA can't close the barn doors fast enough and every assertion it makes about the limits, oversight or "trustworthiness" of its programs is usually undermined within a few days by yet another leak. Something aimed at nothing more than a "reduction" in leaky insiders just isn't going to be good enough. On the other hand, the public is benefiting from the NSA's pain -- it's now more informed about the agency's activities than it's been for the previous half-decade -- and the cumulative effects of the leak-and-denial cycle have forced the NSA to actually participate in a national discussion and make tentative steps towards transparency.

Filed Under: clearance, employees, insider threats, nsa, top secret

Contractors Providing Background Checks For NSA Caught Falsifying Reports, Interviewing The Dead

from the the-talking-dead dept

The fallout from Ed Snowden's leaks has taken many forms, one of which is the NSA taking a long look at its contractors' hiring processes. Snowden claims to have taken the job solely to gathering damning info. This revelation, combined with some inconsistencies in his educational history, have placed the companies who perform background and credit checks under the microscope.

What these agencies are now discovering can't be making them happy, including the news that one contractor's investigative work apparently involved a seance.

Anthony J. Domico, a former contractor hired to check the backgrounds of U.S. government workers, filed a 2006 report with the results of an investigation.

There was just one snag: A person he claimed to have interviewed had been dead for more than a decade. Domico, who had worked for contractors CACI International Inc. (CACI) and Systems Application & Technologies Inc., found himself the subject of a federal probe.

It's not as if Domico's case is an anomaly.

Domico is among 20 investigators who have pleaded guilty or have been convicted of falsifying such reports since 2006. Half of them worked for companies such as Altegrity Inc., which performed a background check on national-security contractor Edward Snowden. The cases may represent a fraction of the fabrications in a government vetting process with little oversight, according to lawmakers and U.S. watchdog officials.

Who watches the watchers' watchers? It appears as if that crucial link in the chain has been ignored. Give any number of people a job to do and, no matter how important that position is, a certain percentage will cut so many corners their cubicles will start resembling spheres.

These are the people entrusted to help ensure our nation's harvested data remains in safe hands, or at least, less abusive ones. Those defending the NSA claim this data is well-protected and surrounded by safeguards against abuse. Those claims were always a tad hollow, but this information shows them to be complete artifice. The NSA, along with several other government agencies, cannot positively say that they have taken the proper steps vetting their personnel.

USIS, the contractor who vetted Ed Snowden, openly admits there were "shortcomings" in its investigation of the whistleblower. Perhaps Snowden's background check was a little off, but overall, calling the USIS' problems "shortcomings" is an understatement.

Among the 10 background-check workers employed by contractors who have been convicted or pleaded guilty to falsifying records since 2006, eight of them had worked for USIS, according to the inspector general for the U.S. Office of Personnel Management. The personnel agency is responsible for about 90 percent of the government’s background checks.

In one case, Kayla M. Smith, a former investigative specialist for USIS, submitted some 1,600 falsified credit reports, according to the inspector general’s office.

Smith spent 18 months turning in these falsified reports, which accounted for a third of her total output. One might wonder how someone like Smith ends up working for a background check contractor. The answer? This problem isn't confined to one level.

[T]he investigator who had vetted Smith was convicted in a separate falsification case, Patrick McFarland, inspector general for the personnel office, said at a June 20 hearing held by two Senate panel.

Will it get better? USIS is already ceding market share to other contractors but it's impossible to say whether its competitors will be more trustworthy. McFarland says his office doesn't have enough funding to perform thorough probes, which indicates what's been caught so far is just skimming the surface. These agencies harvesting our data (and their defenders) all expect Americans (and others around the world) to simply trust them. Meanwhile, the reasons why we shouldn't continue to mount unabated.

A couple of senators are hoping their new piece of oversight legislation will fix the problem. It would provide McFarland's office with more investigation funding, but simply adding more "oversight" isn't going to make the problem go away. The NSA's mouthpieces continue to insist that everything it does is subject to tons and tons of "oversight," but that has done very little to improve its standing in the "trustworthy" department. There are systemic issues that need to be addressed, both in these agencies and the contractors they hire and expecting to paper over the cracks with a little legislation will only result in more revelations of wrongdoing, rather than fewer occurrences.

Filed Under: background checks, clearance, contractors, nsa, nsa surveillance, top secret
Companies: altegrity, caci, usis

How Overclassification Makes Secrets Less Likely To Remain Secret

from the doing-it-wrong dept

There's a really good point in a recent Washington Post article talking about how nearly 4 million people have top secret clearance in the US these days. The problem isn't necessarily that so many people are given that clearance, but that so many people need to be given that clearance because the US government reflexively overclassifies things, meaning that basic banal office work sometimes can't get done unless you hire "low level" people with top secret clearance:

One reason for this trend is that the U.S. government has become so reflexive about classifying information, much of which is not nearly as sensitive as an NSA spying program, that clearance are required even for totally banal work.

One effect of this classification of nearly everything, and subsequent granting of clearances to nearly everyone, is that all it takes is one or two loose cannons among those 4 million clearance-holders to spill out government secrets.

As many people have pointed out, both Ed Snowden and Bradley Manning were relatively "low level" employees, but had access to all sorts of classified materials. While some spin around and attack them, given just how many people have top secret clearance and access to these materials, it's quite likely that this information has already spread widely -- including to foreign governments. I'd much rather these things be discussed in public and via the press, than finding out later that they were just passed along to foreign governments. If the content of these classified files is really so secret and sensitive to national security, then the government needs a better way of handling that information.

As it stands, the overclassification of files leads to more people needing top secret clearance, and that means about 4 million with such clearance, including all sorts of low level employees, doing basic office work, including "packing and shipping." And, rather than keeping that material secret, by exposing it to so many more people, this overclassification is almost guaranteeing that the content is less secret.

Filed Under: access, overclassification, secrecy, top secret