http://boingboing.net/2016/10/20/nsa-contractor-harold-thoma...
http://boingboing.net/2016/10/20/nsa-contractor-harold-thoma...
My wife works in electronic discovery, processing huge caches of corporate documents for complex litigation. 50tb is a lot of data but it's not that much in organizational terms. From what I remember when her firm was processing material for the SEC-Goldman Sachs litigation over the financial crisis (a case which involved several years of discovery work), they were dealing with a roughly similar quality, 30 or 60tb of data. I've got an unopened 5tb drive sitting right here on my desk.
No offense, but I feel you're arguing against the existence of large trucks because you've never had any reason to drive one.
You think they would be watching everything like a hawk.
You would, but in my experience managers pay about as much attention to IT people as they do to the janitors. That goes double for contractors, because the buyers tend to assume security screening and so on was built into the terms of the contract. At one point I was the only IT guy for a small private bank in London; I was contracted to work for Digital Equipment Corp, who in turn had the corporate contract with this bank due the contractual arrangements between DEC and the much larger corporate parent of the private bank.
I got the job because their existing guy fired or quit in a hurry or something and they were desperate. Technically it was easy, I just ran backups, did a few service calls around the office each day if anyone had a problem, and most of the actual work consisted of passing on the bank's procurement requests to the DEC people. Eventually I lost the gig because the bank got sick of dealing with DEC and terminated the contract but I got glowing personal references which was nice.
I remember being sort of amazed at the degree of freedom I had. As you may know, small private banks cater exclusively to the ultra-rich, and I was the only IT person on site and had total access to anything. If I were more financially oriented I could have enriched myself in any number of ways.
I'm not saying that companies don't have 50TB of documents, or that you cannot transfer 50TB, either via the network or physically. I am saying that for a place which prides itself as the "National Security Agency", they should have extremely tight security about transferring 50TB of their crown jewels, either via the network or physically. So, I think we are talking about different things. Goldman Sachs and DEC are in totally different ballparks, or should be, compared to the NSA.
I don't really care either way. I just think logistically this is a crazy amount of data for someone to walk off with at a place that should be the model of a secure site.
I'm sure they do have elaborate security procedures but the size and scope of the organization means that any operational issue (including security) is almost always Someone Else's Problem. And since the NSA's purview is basically ELINT + crypto, they don't have the same sensitivity to more traditional espionage methods that a HUMINT organization like the CIA does.
Incidentally I'm thinking of setting up an OSINT entity if you're interested.
I have a vision for the post-web environment, but it's inchoate and will take many years to realize. In the more immediate term, I want to build a prototype and use it to thwart my political enemies :)
same name at gmail for anyone who's interested.
Does anyone monitor amounts of data transferred? Honest question, I don't know of any ACL levels that say 'after x MB, deny access' (or send alerts or whatever). You monitor/restrict directories or servers, i.e. pieces of information, whether they're 5KB or 5TB (I mean, that's what I've seen, I'm not in opsec/admin myself). Still you'd need to make several trips to take out that much data; although you can fit 6GB on a $35 LTO tape...
It also alerted if in the last hour more than 80gb was moved around.
I would have thought that the NSA would have similar policies...
Should have been done 20 years ago. An intrusion detection switch and restrictive policies to lock down hardware access is all you need for a first line of defense. All 1990's tech.
And remember, even the best systems can be socially engineered. With patience and cash there is no door that cannot be opened.
Or 100 512GB micro SD cards which are available to consumers; say 5 a day for a month...
Physical exfiltration is not the problem.
If you don't know how the NSA works why on earth pretend like you do?
What does huge storage array even mean in today's context? I recently built a 20TB server at a price point less than a new 13" MacBook Pro for personal use that occupies a cross section the size of a notebook sitting at the edge my desk...all from commercial-grade hardware that's been on the market for at least 2 years. I would think that the home setup of any serious professional engineer who has been in industry for the better part of my adult life would have some sweet kit up his sleeves.
Imagine this: authorities confiscate anything that looks like storage media, storage capacity rough order of magnitude is calculated, figures reported to media, an assumption is made that it's all highly classified, spin some click bait article.
We're talking about a civilian contractor from private industry who supposedly played an "advisor" role, not some intern whose shoulder was constantly being looked over.
I'm not calling outright fibs here but we're talking 10 2TB sata's here or what?
I'd take maybe a 1U with SFF's, but then again I've not seen how big your laptop is ;)
edit: yep, ok, I missed the words 'server' and 'cross section' there and thought you were talking about some magic home setup...... apologies and: doh!
How much do those cost?
I guess that's a kind of expensive setup for what's being suggested was his home setup though?
20TB in a mirror is cheap as in the DC, at home I've not pushed above about 5 (don't have that much data and thus won't spank so much money on capacity)...
Are you running these things?
This remark suggests that you know the location(s) of where the data was exfiltrated from. It also suggests that you're intimately familiar with not only the exfiltration sites' OPSEC and COMSEC procedures, but of a particular government contractor's as well. Moreover, it suggests that the reported amount of exfiltrated data is unquestionably accurate. Do you see where I'm going with this?
For the sake of curiousity, how would you describe military-grade security, and have you ever legitimately handled classified information in a secure enclave?
The whole system runs at 'system high' mode, both computers and people, which is that everything with access is trusted, on penalty of prison time if you even make a mistake. Events are logged but not necessarily verified in real time. There are no metal detectors or routine cavity searches. The risk of leaks is treated by compartmentalisation of information.
There are a few fields, like crypto, where special hardware is used to handle data (e.g. KYK fill devices), but they would be the exception. These techniques were implemented after the Walker spy ring leaked all the USN keymat to the USSR for decades. Its typical that innovation was only allowed to occur in response to a problem. Who is to say the Russians/Chinese/* have not been paying an insider for the same access that Snowden had?
He had to get it out of there somehow, and everything you listed has much higher mass/volume per terabyte than ordinary platter drives. That's why we're confused. (Possibly excepting magnetic tape backups--I'm not sure if they're still smaller than the equivalent hard drive--but you need bulky, very slow hardware to write them.)
Can I buy a vowel as to where there is? Apparently, everyone else seems to be confidently in the know, along with an intimate familiarity of there's OPSEC and COMSEC procedures.
The indictment also alleges that Martin stole documents from U.S. Cyber Command, the CIA and the National Reconnaissance Office.
Why not the office(s) of USCC, CIA, or NRO? Why not internally within BAH itself?
...If he stole data from the NSA, where would it have been besides an NSA office? I mean, he didn't get it from the Tooth Fairy. > Why not the office(s) of USCC, CIA, or NRO? Why not internally within BAH itself? There's an "also" in there. He stole stuff from the NSA, and some other guys too. And all of them should have had the same level of security, so that doesn't really change much.
I was thinking along the lines of “50 terabytes of data seized, some of which may be stolen classified info”, but I agree that your version of events are more likely.
Is it really though?
Probable? Sure, of course without any quantitative measure.
Likely? I simply can't convince myself of that given we know absolutely nothing of the security measures this guy had to overcome to exfiltrate the data he had.
I'm _pretty_ sure that's not how he got the data out. 18 CDs every working day for 20 years? Nope.
(A DVD pile might only be 50 feet high, but they almost didn't exist 20 years ago - certainly not at "I'll just fill up three of these every day at work" prices.)
;-)
Did you even pause for a second to consider that 50TB may be a grossly misrepresented figure, or digest the parent comment to size up the context of my remark?
(Apologies if you thought I was taking you out of context disparagingly - there's some gross misrepresentations here by people including me...)
I cringe thinking NSA would have DVD-burners connected to any machine on their campus. Sure in their labs they probably have every device ever made -- strictly labeled and used only for hacking. But it would be asinine to have their "corporate" machines equipped with them. I bet he either used a microSD card or just put HDDs in his pocket.
Equally, what's to stop them being in the know of exactly what he's doing and abusing their privilege to allow him to do it? You assume he's acting alone... what if he wasn't?
The best lies contain elements of truth... or are almost entirely true. Find a legit reason for bypassing security and while you're bypassed, abuse it without getting caught.
Because violations and exceptions to policy are logged and those logs are periodically audited. There is a process for achieving access with an exception to policy for various approved reasons. Deleting entries from access control logs requires an accomplice that doesn't mind jail time. At some point this starts to sound like a crazy conspiracy theory.
I find the most simple answers are generally the most probable. Let's not forget this went on for nearly 20 years and security staff gets rotated.
$ echo 20*10 | bc
200
Funny counting indeed. <g>My guess is he was addicted to "stealing", the same way some people shoplift for the thrill. It can feel empowering to steal because it gives the thief control. So subconsciously he's thinking "huh, NSA thinks they're so tough and powerful, but look how I can break their rules right under their nose and they can't even figure it out". Or perhaps he exfiltrated people's phone calls/emails. Thats another power theory: "I'm as big and mighty as the NSA because I can tap communication lines and invade privacy just like they can".
Like others in this thread, I dont think he was a spy. A spy wouldn't hoard shit in his basement that could get him life in prison. He would have stolen it, sold it, and GTFO.
A spindle can hold 100 and you get more than 4 of them per cubic foot. So call it 15 cubic feet of DVD's that's basically just a single plastic tub. Granted, more than that with CD's and less than that with Blue Ray disks. But, if he took burnable DVD's home regularly.
Anyway, it would be interesting if he had a fetish for this stuff, wanted to sell it, or was just being really stupid.
PS: Only idea I have for a dumb, but plausible explication is if he was backing up his classified work laptop every week or something.
*edited for grammar
A year ago 6TB drives were already widely available, so now you're down to 10 drives. In other words, a medium sized home NAS for most nerds.
> It was allegedly all kept on computers and drives at Martin’s Glen Burnie, Maryland home.
[0]: http://www.theverge.com/2017/2/8/14555238/nsa-leak-indictmen...
They probably do...but...as they say, "locks keep honest men honest."
At some point, you have to have a level of trust that exists. A long term subersive employee will beat your locks eventually.
Documents with contents that would cost 50 terrabytes to scan and store as uncompressed tiff or whatever cost 5G as ascii.
This is by way of illustration only. Just think "arrested with drugs having a street value of $10M" and ask yourself if that same kind of inflation is likely to be going on here in the prosecutions PR campaign - which is what this story is.[1]
[1] Note that this could be a fair, reasonable, unbiased and accurate story, but it would be a heroic assumption not to consider the alternatives.