Hacker News Reader

Comment by baybal2 | Hacker News Reader

> it's VERY thorough and personally invasive to minimize the risks

And yet, near completely useless as shown by cases known to wide public.

If you think blackmail is the only thing that can compromise a man, you have a lot to learn about life.

History: some of most baffling espionage cases were "walk ins"

I think, it is the type of personality that services all around the world seek – somebody brilliant, but easy to guide, and motivateable with BS pretenses, that itself makes such people to seek to play with fire.

View on HN

This guy is the textbook case for clearance exclusion: lots of personal debt that he couldn't manage. It's the number one reason people are rejected or have their clearance revoked. While the article doesn't state it, I assume he had already stolen the information prior to losing his clearance, and that they were no longer monitoring his finances (nor could they know he had the information stashed away). It does show some premeditation, though; the fact that he saved information tells me he was always planning to use it if the opportunity arose.

Well, that's a textbook case for sure...

And it is one more reason against having intelligence activities being ran by civilians as in USA.

A CIA case officer isn't exactly a normal civilian. I'm also not sure why you think being in the military would make any difference here. For all we know, he was recruited out of the military. There's nothing magically special about non-civilians that makes them more or less likely to commit espionage.

In fact in the article it states that he spent time in the army before joining the CIA, so there you go...

> There's nothing magically special about non-civilians that makes them more or less likely to commit espionage.

There is quite a lot...

Who else would you suggest ?

> And yet, near completely useless as shown by cases known to wide public.

Just because a system isn't foolproof, doesn't mean it's useless. There are certainly many improvements that can be made to how we protect secrets and conduct investigations into individuals but what we have in place now is far from useless.

> When he received a LinkedIn message from a Chinese headhunter.

At the beginning I wondered how can the Chinese know who to contact.. On LinkedIn! Then a glimpse at the OPM data breach made my realise that the system might not be useless, but certainly dated and suitable to a very different threat model.

It's not easy to update your operating procedures to an information asymmetry at your disadvantage, after decades of advantage in info gathering.

Realising that, the top comment starts to make a lot more sense, even if at first sight it's potentially unrelated to the topic: they need to be much more careful about all sorts of things.

Because people who worked for the CIA have resumes too. Do you think they all have cover jobs? Sure, some do, but most people don't. I've worked for a number of defense intelligence agencies. In my case, indirectly via commercial entities, but it's not hard to read between the lines. We dealt with classified information, but the fact that I worked for them isn't classified, and the nature of the projects isn't classified. I put this all on my resume, and so does almost everyone else who works in intelligence. It's just another career.

That's the point. The US has a loose approach. China is aggressive and takes advantage of every weakness. This is not an isolated case, as you will be well aware.

https://www.justice.gov/opa/pr/state-department-employee-arr... https://sinosphere.blogs.nytimes.com/2014/04/15/using-china-... https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie...

> "the country’s extensive security apparatus makes it exceptionally hard for Western spy services to develop sources there"

That's why I wrote it's an asymmetry.

>Just because a system isn't foolproof, doesn't mean it's useless.

I think this is... a common mistake people make. It's a common mistake I make, really, to look at a system for preventing a bad thing, see a hole, and then argue that system is worthless.

All systems have holes, and just 'cause a system has a hole you can see, that doesn't mean the system doesn't have value.A system that prevents 80% of the bad things it was designed to prevent can be really useful.

Just because a system isn't foolproof, doesn't mean it's useless.

It's just like network security - you take every precaution you reasonably can to prevent breaches, but you also plan for when measures fail. Locks on the doors don't mean you can skip drive encryption, managed antivirus doesn't mean you skip monitoring for ransomware activity or exfiltration, RAID doesn't mean you skip backups.

You want not just the belt and suspenders but also properly fitted pants and underwear so no single point of failure leaves your secrets visible to the world.

> And yet, near completely useless as shown by cases known to wide public.

How do you know that? A few public failures says nothing about how many successes there are or aren't. Any system involving hundreds of thousands (millions?) of people is going to have some failures, no matter how good the system might be.

https://en.wikipedia.org/wiki/Motives_for_spying

I don't think anybody here believes that blackmail is the only thing that can motivate somebody to spy.

Reply on news.ycombinator.com