Trove of Stolen Data Is Said to Include Top-Secret U.S. Hacking Tools
nytimes.com
nytimes.com
As is his right and what every sensible entirely innocent individual in his position should be doing. If the government (at any level from civic to federal to international) arrests you for any crime with serious charges, it is ABSOLUTELY the most prudent thing to communicate solely through your lawyers.
There is too great of a risk of being convicted due to doubt and natural human inconsistency otherwise.
For anyone that doubts how even the most innocent person can be convicted for not heeding this advice, there is a hilarious and content-dense lecture on the subject: https://www.youtube.com/watch?v=ZGgKLgVNfAo
If the "through his lawyers" comment was explaining the FBI's level of belief, it should have been stated more explicitly. I kind of doubt it though -- local law enforcement might be suspicious of someone who lawyers up, for the FBI, it must be pretty much standard (or at least not unusual).
[1] https://en.wikipedia.org/wiki/Justice_Against_Sponsors_of_Te...
For instance elaboration on why you like this idea, etc would at least give people something to discuss.
His comment is valid, I suppose, but only with added context. Hence why I suggested: "For instance elaboration on why you like this idea, etc would at least give people something to discuss."
The malware on that belgacom server has probably required them to scrub all of their email servers and more that can't be cheap.
edit: I say that now in retrospect that security and freedoms of data seem always at odds. DRM being a keen example. Just wish we had better options..
Without reference to a specific user, all you can talk about is a computing system being restricted or unrestricted, and I don't want my computing devices to have restrictions imposed by someone other than myself.
This explains why most enterprise applications and platforms are a nightmare to work with. This class is called "UserView" oh but you see comrade it actually does not have any view or user, in fact its sole purpose is to be compiled and thrown away - nevermind the JIRA issues for bugs in it. Everything is "business logic" "business specific", noone who hasnt been at the place for 3-5 years can understand that this is not actulaly what it says it is.
This kind of feature was called before JCR, "Just for Curious Russians".
Everyone, the NSA, rest of our government, all governments, all citizens of the world, all businesses should be protected. If we just spent a small percentage of what we spend on endless wars for profit, then I think we could mostly reach these goals.
I would like to think that we could still catch and prosecute criminals, and I include terrorists when I say criminals, without violating rights to privacy and our general rights.
It sounds like they're just mad that he didn't confess immediately, instead of doing the smart thing of having professional handle everything. Do they really expect someone to cooperate gladly when repercussions could be severe?
Comey continues to advocate for backdoors in order to stop ISIS from being able to radicalize marginalized people within the US without them being able to listen. However, there are two obvious problems with this.
1. Why don't you just reach out to the marginalized yourself? Spend that $1M you paid to break into an iPhone on combatting Islamphobia and ISIS will have a tougher job.
2. What is to stop ISIS from using software written outside the US, or software they write themselves, or versions of software older than the mandated backdoors, or open-source software, or... on and on and on. His plan transparently will not work. To quote Schneier, "His problem isn't encryption, it's general purpose computers and a global market for software."
That is stupid.
For better or worse, contractors are easier to hire and fire for the federal government. That gives them more budgetary flexibility. You can also hire people and companies that specialize in the specifics of the project quickly through established contracting channels with established reputations.
Contractors are also able to legally bypass red tape and bureaucracy required of federal employees. For instance if I was directly employed by one of my clients i would be severely limited in the toolchain that I use and I wouldn't even be allowed admin access on my development machine (despite having it on multiple servers which are orders of magnitude more sensitive). If I was their employee, every time I needed to install a java update I'd have to call up IT sit on hold and explain to them exactly why I need to install this update etc.. I've had it literally take a week of futzing around with bizarre errors (from the crazy policy settings and restrictions on the laptop) on hold with some poor schmuck at a national level helpdesk four time zones away who has zero experience with programming trying to get a dev-enviornment set up on a government laptop which would have taken literally an hour on a computer I have local admin access on. I would rather be waterboarded than do that again. Contracting and having our own rules saves literally unending amounts of pointless bullshit. Many things would probably never get completed internally because of situations like this. Of course those contractor advantages cut both ways when considering security.
In OP's situation I'm not sure him being a contractor makes any difference. Either kind of employee can take a usb stick home and transfer stuff to a compromised PC. A contractor or employee may have gotten their clearance a long time ago and unless they have some kind of regular unannounced random inspection of their home you'd never know if they were a hoarder. And if they never caused or were involved in a security incident in the past there would probably be very little desire to bother shaking them down. I'd say problems in this category may be worse internally. I've met many husks of people in government positions who have been there for decades and are completely unemployable. What's worse is they can't be fired easily like a contractor so as long as they show up sober 9-5 they never leave.
Not saying it's a good situation. The contractor knowingly and clearly broke laws, policies, and rules. I annually have to take record keeping and security courses and quizzes to maintain access to the network. I am sure the contractor implicated here had much more stringent requirements than I have due to his clearance level. Thus this guy's screwed, his company is screwed too. legally too. Lord knows this guy can't pull strings at the DoJ to save his ass like some people from recent memory.
For one federal organization I work for literally everyone I work with and talk to at all levels seems to be a contractor except for a couple people. the ratio is at least 20:1 contractors to federal employees. As for why this is, it's mostly related to the reasons I mentioned in my wall of text
There are just so many of them that it projects the attack surface of the DoD out; now you can attack contractors which aren't as tightly regulated, and they might hire people to, say, build their website that aren't even cleared. So now I can steal some web dev's credentials and pivot towards classified networks.
And for high security places why on earth would they allow people to work on laptops that are taken home every night an obvious security risk.
I am not dealing with TS stuff here. There are files on the government network which are confidential and having access does require a clearance, but I don't actually work with confidential data directly.
My bag was checked once in the 5 weeks I worked there - on the way in. The passwords I created for their new servers (containing metrics from the factory's build and test processes) was at one point walking around Cork in their admin's wallet. I used my own laptop (because OSX bleugh) plugged straight into their corporate lan.
But they did have a room which was out of bounds.
Nobody gets security right, however "high security" they think they are.
Oh and let's not get started on what the MoD thinks it's achieving in its immigration office.
The problem is that the level of control required for actual security prevents people from being able to do their jobs effectively. And if no one can get anything done, there's nothing to secure. So this leads to an environment where everything is oversecured by default, and bypassing the nominal level of security is simple, easy, and commonplace--sometimes even expected.
For instance, you don't have local administrator access on your workstation. But you have Visual Studio and its debugger, and can compile and run any source you can type in. You also have physical access to the machine, with its 5.25" removable-media drive. It becomes faster and easier to reimplement an unzip utility from a printed spec than to get 7zip installed on your machine. And the hand-rolled utility probably has a larger exposed attack surface than the open source program.
Every time someone points out the "why'd they give a clearance to X person" argument, I point out that there are close to a million people with security clearances. No screening system is perfect, but for something being ran by the government it is pretty damn good.
http://www.defenseone.com/business/2015/04/number-security-c...
The key difference to the government is hording can be perfectly legal while marijuana use requires you to participate in the black market.
I know that if I wanted to actually blow the whistle on somebody like the NSA, I would make sure to plant the evidence on somebody else to give them a juicy target to latch onto.
We should be talking about the fact whistleblowers need legal protection. The current treatment of whistleblowers leaves those who wish to defend the principles of the country no good options.
We should also be talking about how easy it is to frame someone and have them found guilty. The fact that we both have zero problem believing that it's that easy to set someone up should be terrifying.
If he was the one (with full proof) trying to sell secrets then I won't blink twice.
However nothing in the message proves that it was written recently.
The government isn't currently bad because people in it are bad. It's bad because our government has some bad ideas on what it means to govern successfully externally, in an age that is accelerating internal change in individuals. We want it better faster, too.
If we're going to continue to have government, the government needs to immediately become 90% more transparent and start setting the vision for us to do what we need to do to manage these changes.
And then I look at our current election and just shrug my shoulders.
1) were the tools taken out of a secure environment? Or did he download it from the net when it was published?
2) how could he have taken such sensitive tools out?
3) why so many leaks of an ongoing investigation?
Maybe the NSA needs less James Bond characters and more engineers.
Contracting anything out costs in terms of added security risk and in profits a contractor will want.
It's not like DoD contractors are doing classified work from home in their sleepwear. They're still subject to the same security procedures, and in fact the same security people are overseeing the contractors and direct employees.
I would still roll in before sunrise during what looked to be a beautiful day and work in a windowless chainsaw-resistant room with a steel door. I'd daydream of a nice sunny lunch break just like my direct employee colleagues, and be just as disappointed that it was raining when I exited isolation.
And then they would have some morale event (read: party/picnic) on base, and they could go to it while on the clock, while you were nominally invited, but if you attended it would have to be off the clock.
Then the funding for your project is interrupted. They get furloughed, and will probably be repaid later when the funding is restored, but you just get straight-up laid off, and have to find a new job with zero notice.
But at least you got paid more. That almost makes the crap treatment worthwhile.