Hacker News Reader

Comment by rhino369 | Hacker News Reader

What does AOL have to do with it. Gmail has two factor, but the password reset nullifies it. https://news.ycombinator.com/item?id=8541313

I understand commercial email accounts aren't secure. So I don't treat email as being secure.

Look at what you have here. A pair of half drafted generic position papers. A legal memo about a document review protocol (I carry stuff like that in my unlocked briefcase). And a couple of what appear to be public documents about torture. The most potentially embarrassing thing on there is his SF86. But a quick scan of it doesn't show anything embarrassing on there.

If he was sending actual sensitive information on an insecure email, that is a problem.

View on HN

Isn't the problem with publish sf86 more complicated...? This is basically the security clearance application for the CIA director...Aren't these things classified? Why on earth is this in any unsecure e-mail correspondence, if that is so? If that is not so, HR or homeland security has some gaps in their document handling process. Not that they haven't been hacked independently already, but still.

This is just one SF-86. China already has the entire database of all SF-86s[1].

  Officials said hackers accessed not only personnel records
  of current and former employees but also extensive information
  about friends, relatives and others listed as references in
  applications for security clearances for some of the most
  sensitive jobs in government.

  "It is a very big deal from a national security perspective
  and from a counterintelligence perspective," FBI Director James
  B. Comey said at a meeting with reporters Thursday at the FBI
  headquarters. "It's a treasure trove of information about everybody
  who has worked for, tried to work for, or works for the United
  States government."

[1] https://www.washingtonpost.com/news/federal-eye/wp/2015/07/0...

see the last sentence of my comment

The CIA keeps it's own personnel records, so as I understand it, this SF86 form is a new addition to the previously hacked OPM records.

Not sure if CIA held SF86's are considered classified, but even if they are I suspect we won't see anyone, let alone a director, prosecuted for having a copy of their own "classified" employment questionnaires.

The government is supposed to keep the copy you gave them secret until you die. Coincidentally, the OPM accidentally leaked a bunch of them a few weeks/months ago.

But it's your own information, you can do what you want with your copy.

Most formal document policies cover drafts and works-in-process (ie, so they don't become less classified because they are incomplete or penultimate in version control.)

But the SF86 isn't actually classified. It's just Privacy Act information and FOUO. The Privacy Act says how to protect other people's information and FOUO means "For Official Use Only," but he's not breaking any laws by having his own SF86 on a public email service. He's fine as long as he isn't using it for unofficial business (which I'm not sure how) and he doesn't have other people's SF86 .

Thanks for this clarifying comment. Open issue IMHO is if CIA's "actual process" is subject to levels of scrutiny/protection beyond the statuatory minimum(s). This being an exec appointment w/ senate confirmation etc.

> What does AOL have to do with it.

I cannot help but hear Tina Turner singing. "What's AOL got to do -- got to do with it? What's AOL, but a second-hand email..."

That aside, it is an indicator toward technology adoption. Despite "why fix it" attitudes, a CIA or NSA director should employ more modern email methods -- PGP or other encryption types notwithstanding. Although I'm not picturing a government top dog dialing up for email, what else am I supposed to first imagine when I hear "AOL" and a related governmental acronym? "We internet chat over AIM"?

Reply on news.ycombinator.com