Hacker News Reader

Comment by rcurry | Hacker News Reader

I'm less concerned about the hacker, and more concerned that the Director of the CIA not only has an aol.com email account but also uses that account to transmit sensitive information.

I'm not just saying this to be a jerk - this should be grounds for immediate termination of his employment. This is clearly a guy who shows poor judgement with respect to the management of sensitive material.

Also, from the article:

"[The] problem with these older-generation guys is that they don’t know anything about cybersecurity, and as you can see, it can be problematic.”

On the contrary - these "older-generation guys" cut their teeth in an environment where we were going head-to-head with the KGB on a daily basis. These guys have a solid understanding and awareness of basic information security procedures, as well as a strong understanding of adversary capabilities. I don't buy it.

View on HN

Ultimately, this is the same as when the CEO tells me he's disabled anti-virus protection because the popups annoyed him, or that he's using a personal Dropbox account so he doesn't have to go through that pesky login process onto the network drive.

My guess is that to many people in power, the benefits of using these web services seem to outweigh the disadvantages because they just don't understand the disadvantages. "It's OK - I set a great password!" There's simply nobody powerful enough to monitor what they're doing, independent enough to want to do something about it, and respected enough for people to listen.

We need independent bodies that act as national 'IT departments' and can refuse requests from the very highest powers, in much the same way that any other Head of IT can fire someone for gross misconduct because they were downloading torrents on their company laptop.

You make a totally fair point, but I think it's also a fair criticism of the state of proper computer security that plenty of people opt-out as a result of the inconveniences. Someone will solve this someday and make a lot of money, but I have no idea what the solution is.

The US Federal system was designed to have checks and balances provided by oversight by different branches of government.

Unfortunately today we have people in these branches of government who either won't do their duty because they are terrible at their jobs or because there is a silent quid-pro-quo where these sorts of people look the other way for each other.

While you're absolutely right in your diagnosis of the problem in the US, I doubt these problems are specific to the US government. I'm a Brit, and there are enough stories of technical incompetence here to make me assume it's a global problem. I suspect even non-democracies have the same issue. Who's going to tell Kim Jong-un he needs to rotate passwords?

Thanks for your thoughtful response, not sure what I said that rated downvoting on my comment but apparently members of the CIA and Congressional oversight committee are members of hn ;)

I would flip that around: Make zero-knowledge systems and strong encryption routine in consumer internet products and services. Then you could use your yahoo or AOL mail for anything and there would be no bad consequences. Seems more reliable than trying to enforce the use of some crappy system made by a beltway bandit that is hard to use and inconvenient.

It's plain negligence. Unfortunately, in this political climate it's not favorable to punish a high-ranking government official over mishandling their emails, even if said email is used to transmit sensitive information.

Why, whatever could you be referring to

I suppose he's referring to the Clinton's case.

He was being sarcastic, pretty sure. ;)

>I'm not just saying this to be a jerk - this should be grounds for immediate termination of his employment.

More specifically, his security clearance should be revoked, or modified such that he's not allowed to use a computer without being supervised by a competent person; which ought to have the effect that he's basically disqualified from working for the CIA, or speaking about anything related to information security.

The key point for me is even if we assume that security blunders like this or say keeping a private email server are ignorance rather than malice ignorance is unacceptable at this level of government. Where's the security officer at advising these officials and helping them do it right? That has to be someone's job right?

That someone also is replaced if he gets on the nerves of the guy he is advising to much, at least on this level. Parallel advising/control structures only work if they have someone higher up they can fall back on if necessary.

You've got me there. Ultimately being secure is Brennan's responsibility.

Maybe we need a secret service for tech that's outside the command structure of these agencies.

I'm a bit suspicious of this story. Apparently his top secret security clearance application is in his AOL account, but he's been in the CIA for 25 years so that seems odd (unless his AOL account is very old).

Some part of me hopes it was part of a disinformation campaign in the form of expected-levels-of-incompetence-leads-to-"hacked"-account.

However, the fact its expected levels of incompetence :/

The only sensitive information listed in this article is his application for security clearance. While that may contain a lot of personal information, that file would have been compiled and sent before he had access to classified documents, and before he had a government email address.

I am guessing this kid wiggled his way into a 10+ year old AOL account containing data that was never deleted. We all probably have emails and contacts sitting in a forgotten AOL account.

>The only sensitive information listed in this article is his application for security clearance. While that may contain a lot of personal information, that file would have been compiled and sent before he had access to classified documents, and before he had a government email address.

CNN is reporting he posted his SSN on Twitter.

I guess if this happened to some common employee, he would be fired eventually. But Director of the CIA is a political position. So, it's much harder to fire him, because of political implications.

Except email and pcs that we have in their current form today weren't around in the 60s and 70s when these older guys cut their chops

So far I've seen zero evidence of sensitive information being on that email account.

Oh dont worry - he was probably only emailing with Hillary and as we know, she would regularly wipe her mail server with a cloth to ensure it was secure.

Reply on news.ycombinator.com