previous post next post  

Wikileaks

First up - it's a wonderful way to highlight some, um, *issues* with cyber-security, and allows the chattering classes to bloviate ponderously on topics they don't know that much about. I for one, am not stunned by what PFC Manning managed to get access to, as anyone with a modicum of ability with access to the SIPRnet can attest. The goodness from this will probably be quicker tightening of security within the classified networks, by the expanded institution of some simple-to-implement checks on the "need-to-know" side of things.

Access to classified information has two parts - clearance at the appropriate level, *and* need-to-know. All "clearance" does is vet that your life-to-date has been examined and there are no huge warning signs that you aren't trustworthy to be considered for access to defined levels of information. Think of it as having passed your written test for a driver's license. That just allows you to take the driving test. If you don't pass the actual driving test, you don't get a license. In this case, if you don't have the need to know, you don't get access. Manning clearly had access to things he had no "need-to-know" reason to be accessing. For those who have been operating in that environment there has been steady and stuttering-but-inexorable movement to stitching up those seams, all tempered by a real desire to make information available to people who need it without going through a huge number of hoops to get it in a timely fashion in a time of war.

PFC Manning was poking about in places he had no business poking about in. While that's covered by the user agreement you sign when you are granted access to the networks - i.e., you promise to not go fishing - the real problem lies in the fact that State had (apparently) no internal controls on who had access to their data. Once you figured out where it was, you could have it. There should have been some form of vetting process to cover the need-to-know. Mind you, given PFC Manning's hacker-bent, even if he'd had the need to know, he'd have stolen the data. Which points to the fact that you have to monitor the activities of people who have access.

The devil will be in the details.

Second. It has been an interesting look into the State Department's world, and how things going on behind the scenes oft-times have little bearing to what's happening on the public side of things, as all governments have reason to present a public face that differs from the private. Sausage-making isn't pretty, but there didn't strike me that there was/were horrible revelations in there. More of it was along the lines of, "Yep, okay, that doesn't surprise me." and "People still don't get that some things should be said face-to-face and not in potentially record communications." But I don't believe that exposing what amounts to working papers is a good idea.

Third. My thinking on China's view of what was happening on the Korean Peninsula used to be that they were willing to let the South Koreans take it over, since it's clear that the North isn't a viable nation-state in any meaningful sense of the term, and has in reality become politically estranged from China as China has moved away from Maoism. I also thought that the Chinese had more influence in North Korea than is apparently the case. I was coming around to a pundit-driven view of China as mischief-maker and playing a different game in the Peninsula (as we discussed in this post) - but the Wikileaks document drop indicates my earlier views might be more correct and the Chinese are as baffled as we are - but no one is yet ready to take the bull by the horns, preferring to wait until the bull dies of it's self-inflicted mad-cow disease. Given the potential death toll and infrastructure damage, that may be a smarter game long-term, however bad the suffering short-term is (and lord knows it hasn't been short in human terms) among the North Korean people. But the potential cure of military action may well result in a lot more dead North Koreans than this horrible wasting disease. I dunno.

Fourth - the document dump gave the New York Times an opportunity to excel, and they predicatably flubbed it, preferring instead to stay in their comfort zone of doctrinaire biased hypocritical hackery, all while swirling their Mantle of Morality around their head.

Quick! Who said this? "The documents appear to have been acquired illegally and contain all manner of private information and statements that were never intended for the public eye, so they won't be posted here."

Hint: It wasn't a Times reporter or editor talking about the Wikileaks dump.

It was the Times' former environmental blogger, Andy Revkin, discussing the so-called ClimateGate emails. Rules for thee, not for me.

Feh.

16 Comments

The Brit press is reporting:
It was childishly easy, according to the published chatlog of a conversation Manning had with a fellow-hacker. "I would come in with music on a CD-RW labelled with something like 'Lady Gaga' … erase the music … then write a compressed split file. No one suspected a thing ... [I] listened and lip-synched to Lady Gaga's Telephone while exfiltrating possibly the largest data spillage in American history." He said that he "had unprecedented access to classified networks 14 hours a day 7 days a week for 8+ months".


 
To this 72F40 TS/C sergeant emeritus it is unfathomable that Manning would be allowed to bring a recording device into an area with classified material.
 
If only DADT hadn't been in place, this would NEVER have happened!
 
It may have already been said, back when the military documents purloined by PFC Manning were dumped, but whatever HQ he worked in had amazingly bad procedures in place for accounting for portable copies of classified information. 

He was able to burn multiple CD-ROMs full of classified data, then just walk out with them.  Those CD, when created, should have become accountable documents, and he damn sure shouldn't have been allowed to leave the building with them without courier orders and the appropriate bag, plus accounting for them when he got to the destination of the documents.

Now, having worked in a HQ downrange where SIPR (now the NATO CX-I) is pretty much the default net for all business, and where reams of classified paper is generated every day, I can attest that accounting for all of it would be a nightmare.

But I would think that at least the digital (and thus both easily transportable and transmittable) copies should be accounted for.
 
 Fred
He apparently had a functional CD burner on his desktop machine, which I found quite 'interesting'. Also the inexplicable status of how USB ports are treated.

Cheers
 
Forget that Wikileaks is an internet based group with no identified national allegiance. Consider instead Wikileaks as a foreign intelligence service with the objective of inflicting maximum damage to the USA.

Maybe the data release to the media was chaff, released precisely for its embarrassement value, while the good stuff was passed to others best able to exploit the intelligence.
 
Jeeese-Louise!!

Who in the hell was the Secret Documents Custudian charged with safeguarding this material? 

Who's getting fired becasue of the lax application of even the most minimal of security procedures?

Why hasn't this little E-3 turd been charged with treason?

Why isn't there a Hellfire missile with Assage's name on it?  Why is Big Sis able to shut down file sharing and counterfet purse websites, but nothing is being done to shut down WikiLeaks?

Can anyone in our half-assed government do anything worthwhile towards the defense of this country against the like of these motherless lowlifes?
 
Sadly, this is what America has become.
 
Back when I was an Intel Analyst (once upon a time), one mid shift I stupidly walked into the SCIF with a copy of Tombstone on VHS (store bought, not recorded... and no, we didn't have DVD in those days) to loan to a buddy on shift.  As soon as I walked in, I realized I had brought magnetic recording material into the SCIF.  I didn't even leave the MP checkpoint before turning myself in.  They were "forced" to watch it in order to make sure all it had on it was the movie, and I went about my shift.  I was able to pick up the tape from them as I left.  They thanked me for the night's entertainment.

Moral of the story is, I didn't get stopped, I stopped me.  They hadn't even thought about it till I said something.  The fact that the kid was allowed to bring in a CD doesn't surprise me.  Hell, even if he had snuck in a thumb drive, he could have downloaded what he wanted.  The fact is, you can only get betrayed by those you trust.  He was intent on stealing secrets, so he did.  Let me stress this for everyone... YOU CANNOT STOP THIS.  There is no way.

What you do is punish the ones who do betray you SO harshly that no one dares do it.  This kid thought he was invincible and really, the Army's done it's level best to act like he is.  Why is he not facing a capital charge of espionage?  The can even (for a rare treat) reveal what secrets he stole, since they're in the public domain now.  No further harm can come of revealing it.  Charge him, he'll be found guilty by any court martial and just about any civilian court, then put him in front of a firing squad.  Let everyone see the awful consequence of treason and you will go much further in preventing future cases than any attempt to close the barn door now that the horse is out.
 
@MikeD -- works for me.

Is no one in the chain of custody/command responsible for anything anymore?

We seem to worry more about hurting people's feelings than we worry about national survival.
 
For MikeD and MAJ Mike:

Do either of you REALLY expect that to be done to a Preferred Species, especially in light of the current Commander in Chief?
 
@Mark -- Sadly my expectations exceed reality.  I have an terrible tendancy to expect people to do their jobs.

Guess I'll just continue to stockpile ammunition in military calibers and practice headshots. 
   
And...Assange is in hiding, and doesn't want to be found. 
 
 Cricket, this character is a “Person of Interest” for many countries, including China, Russia, Sweden and United States. Good grief, this may be the  first-time these three countries have worked together on any one issue.  Even the nation of Ecuador has the same type of interests in this  “individual”. 
 
 The thread that you have written here is a good assessment of this whole Charlie Foxtrot issue. But the question remains, is this the first time or the last time that we will visit this issue? You raise a critically important point, there are two essential points to this puzzle. They are, “Access” and “Need to Know”. The real question is this, “how do we establish need to know?”  Many times politicians appear to  have the  authority.  Many times we have seen this type of action, but what has been the compound result?  My personal belief is the Constitution of the United States establishes certain patterns to answer this question.   I believe the answer is Constitutionally, delegated to certain Individuals. They are not to be delegated to other Individuals. i know over the years, we have expanded The Executive Branch Of Government. in some ways, this has been to the detriment of the Whole Nation. We may need to rethink this whole concept. As we learned from Watergate, the concept of “Plausible Deniability” is not a viable defense. The Irony is this, It applies to both parties. There have been many moves to bring politics into different parts of the US Gov't  that were "off-limits" to the whole political world. We must remember, The US Government's Executive Branch and Legislative Branch and their component parts are neither, Kingdoms, nor Sheikdoms. The Law is our King.