41–50 of 99 posts
This story just doesn't compute with me. A young guy (21) seemingly had access to all this information, and shared it despite being Portuguese (based on his last name) so seemingly not ethnically tied to Russia, shared it openly on Discord with his gaming club, a full document dump literally hundreds of pages not just screenshots or summaries, but not before faking some of the information, coordinated by a group that…
They focus on the perimeter and who gets access and how.
They essentially have RBAC but not mandatory access control. Your role gets you past a perimeter or a security control but access to data is granted implicitly not explicitly.
What the infosec community has learned is that defense is best done "in depth" or "layered". Even if he needed that information for his work and permission was given to him explicitly why was he allowed to download files? Why was he able to get any sort of electronics in or out of any facility that stored top secret information? How come there was no DLP or hard to defeat watermarking on documents? Document canaries to detect a leak? I mean even in a typical corporate O365 deployment, you can classify documents so that they are encrypted by MSIP so even if you take the document home and open it, you need to authenticate to decrypt it (and that is logged of course), he can take screenshots but you can monitor that too and he needs to get that screenshot out (and hopefully TS clearance computers don't have internet access or USB ports or mass storage device support).
I don't agree that the problem is a million people have clearance. That clearance should mean you will be allowed to request access to documente and have that granted if you need those specific docs, it shouldn't mean access is implied.
And a bit controversial take: this is why the USG can't go easy or forget about assange or snowden and others. They can make a case in court or convince a jury they had no option but to leak classified info but DoJ would be incompetent if it didn't go after all leakers regardless of context.
Earlier quoted context omitted.
The dirty not-so-secret about national defense apparatus in this country is that there are thousands of people in these various sub-sub-wings of our military along side mediocre contractors cashing in on defense contracts who go through rudimentary security clearance checks and have access to all this information. I grew up outside DC and every so often you hear of the security clearance spooks interviewing you or so…
> who go through rudimentary security clearance checks and have access to all this information. But just getting a security clearance isn't enough to have access to "all this information", right? My understanding has been that getting security clearance can make one eligible to do work which would involve some specific sensitive information, but that stuff is still meant to be compartmentalized. There's no reason peo…
This situation is sort of intentional: one of the big findings of the 9/11 commission is that intelligence information was too siloized and analysts were missing big things because they didn't have access to products of other agencies. But there's a balancing act here, and this is the downside of open access.
Earlier quoted context omitted.
Why does it have to make sense? kids (and a 21 year-old is certainly not a full-grown adult) do stupid things all the time. For example, as James Zhong claimed[0]: >He recalled converting some of his Bitcoin into $700,000 in cash. He stated he did this so that he would have a “case full of money like in the movies.” He hoped the visual appeal of the cash would impress a female into having sexual relations with him. H…
Your link is a about a bitcoin case, so unless I missed something this guy wasn't doing it for money (I don't condone it, but money is a reasonable motive for committing a crime). And I said based on his last name he doesn't appear to be ethnically Russian. Why are you going on about foreign nationals?
My point was that they were both kids when they did these stupid things (with Zhong, I'm not talking about stealing bitcoin -- he thought that it would "cool" to have a suitcase full of cash and that it might impress some college coed to fuck him -- hell I even quoted it for you).
Besides, What does your assessment as to what's reasonable have to do with what Jack Teixeira thought was a good idea?
>And I said based on his last name he doesn't appear to be ethnically Russian. Why are you going on about foreign nationals?
Because it's pretty obvious this guy isn't a spook/source for any foreign government. Which was implied by your noting the source of his last name?
And even if he was a spy for Russia or Brazil or Portugal or Grand Fenwick, for that matter, what does his name have to do with it?
why would it matter whether his name is 'Teixeira' or 'Smith' or 'Brin' or 'Nahasaheemapetalan'?
Actual spies like Whittaker Chambers[0] and Alger Hiss[1] didn't have "russian" names. Please.
[0] https://en.wikipedia.org/wiki/Whittaker_Chambers
[1] https://en.wikipedia.org/wiki/Alger_Hiss
Edit: Fixed tense as to Hiss'/Chambers' names -- as they're both dead.
Earlier quoted context omitted.
While it would be intractable to upend the status quo of about 0.5% of American adults using that access to get things done day-to-day, there's a lot that could be improved just by compartmentalizing that access and monitoring it. It's one thing for an IT admin on a Massachusetts national guard post to get access to a few local secrets. It's another when he's downloading hundreds of documents unrelated to his duties…
The shameful thing is this is the same scenario with the Manning leaks and nothing has been done to institute stronger access restrictions since. The military consistently refuses to operate by the same secrecy requirements that DoD contractors have to adhere to.
Would a guy in his position even have access to these documents? I'm thinking that there has to be someone who shared them or at least shared a way to gain access to them. I'm sure the FBI will be following the trail of bread crumbs to the original source. Now if it turns out he is the original source, we're in huge trouble. Because a 21 year old kid working night shift in some remote Cape Cod office for the Massachu…
Earlier quoted context omitted.
> who go through rudimentary security clearance checks and have access to all this information. But just getting a security clearance isn't enough to have access to "all this information", right? My understanding has been that getting security clearance can make one eligible to do work which would involve some specific sensitive information, but that stuff is still meant to be compartmentalized. There's no reason peo…
It's not really so much about the clearance as it is about network access. A tremendous amount of classified information is essentially public on the high side networks. So, if your job entails access to a classified network (particularly an IC one), you have a lot of reading you can do. This situation is sort of intentional: one of the big findings of the 9/11 commission is that intelligence information was too silo…
I'm realizing my initial impression of the landscape here is also skewed by some peripheral awareness of how government contractors may have narrow access to specific material for their work. I understand why intentionally, some actual government employees have a much broader view. But how large is that group with broad access?
Likely going to go away for a long while
I am sure FBI will find that "Although there is evidence of potential violations of the statutes regarding the handling of classified information, our judgment is that no reasonable prosecutor would bring such a case." as it usually does in cases of leaking classified info :) :) :)
Earlier quoted context omitted.
The dirty not-so-secret about national defense apparatus in this country is that there are thousands of people in these various sub-sub-wings of our military along side mediocre contractors cashing in on defense contracts who go through rudimentary security clearance checks and have access to all this information. I grew up outside DC and every so often you hear of the security clearance spooks interviewing you or so…
> who go through rudimentary security clearance checks and have access to all this information. But just getting a security clearance isn't enough to have access to "all this information", right? My understanding has been that getting security clearance can make one eligible to do work which would involve some specific sensitive information, but that stuff is still meant to be compartmentalized. There's no reason peo…
I can't see how those could sensibly be in the same domain. I imagine it's about like any other huge collection of data, with large variance in how well things are categorized and restricted.
Earlier quoted context omitted.
Not proven by facts in evidence! The FBI prioritizes (in theory) successful prosecution. It’s entirely possible that there are agents watching the guy while a judge processes a warrant.
In a case like this, wouldn't the FBI prioritize stopping further leaking ?
It would be on other bodies (correct me if I'm wrong) to review and adjust the internal practices around the handling of confidential documents, and how this can be prevented moving forward.
Edit: Aaaaaaand he's in custody.