NSA employee indicted for transmission and retention of defense information | Hacker News Reader

NSA employee indicted for transmission and retention of defense information

justice.gov

> According to the 26-count indictment, on thirteen occasions between February 14, 2018 and June 1, 2020, Unkenholz, lawfully having possession of, access to, and control over NDI, which he had reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully transmitted that information to another person who was not entitled to receive it.

Mark Robert Unkenholz has this patent claim for key escrow: "Device for and method of cryptography that allows third party access" https://patents.justia.com/patent/5631961

He also worked on Clipper apparently. But this patent seems to use public-key techniques for escrow, which Clipper didn't... probably because Clipper was hardware and couldn't handle the cost of those operations.

The phrasing in the press release makes it sound like this is some sort of intrinsically grave offense, but it's quite possibly an innocent mistake. It sounds like this guy's colleague switched companies from one where they were cleared to one where they were not, but they continued to communicate about classified stuff.

Maybe that meant Unkenholz emailed a PDF marked TOP SECRET to his colleague in order to help some foreign entity harm US interests (obviously a terrible thing to do and worth being outraged about). But it could have also been him sending an email along the lines of "What SD cards did you order for [classified widget]? We're making more of them and I want to be sure I get all the same parts that you did for the prototype?"

Both cases violate the letter of the law, but locking a human being in a cage for a decade or more over the second one seems like a horrific misinterpretation of the concept of justice. Wish the press release was clearer on what side of the line this case falls on.

It’s a little more than “letter of the law” when he’s using a personal email address for NSA work, and also sending anything classified outside of official channels. He definitely knew better.

Few things in the security world:

- Blaming people for accidents is stupid. Throwing them into prison for accidents is even stupider.

- Proper security is designed in a way that people can make mistakes and it doesn't mean the end of the world.

Him knowing better about this isn't really a response to OP's initial comment of being against a lengthy prison sentence.

The prison sentence accomplishes absolutely nothing. You're just ruining a person's life as they were retiring and breaking a family apart. Makes no sense if this was indeed an accident.

Your comment doesn't really make any sense. It seems to imply that the DoD rules are backwards and that it's actually the fault of the NSA that the guy leaked this. Which I don't understand.

If he emailed a classified document, there is absolutely no way in hell that was an accident. You are never, ever, ever supposed to put classified information onto an unapproved system. This is like saying, "Oh, I forgot which pedal does which, so I slammed the gas instead of the brakes and killed someone, but it was an accident so I shouldn't go to jail." No, you're definitely going to jail, you 'forgetting' how to drive doesn't mean you didn't ruin someone's life.

(There's a small chance that he could have wrote something classified from his brain into the body of an email and sent it. People don't get sent to jail for this, provided it's a one-time incident. If he's getting charges pressed it was pretty egregious. The term "gross negligence" comes to mind.)

And it really could be that critical. Classified information is classified because it can be damaging. If you leak the names of people spying for you in foreign countries, they might be captured or even killed. How do you "design the system" to allow for that "mistake"?

Finally, the prison sentence lets people know that security is serious. There are many rules and it takes effort to follow them. People get lazy and cut corners when there aren't consequences.

> Oh, I forgot which pedal does which, so I slammed the gas instead of the brakes and killed someone, but it was an accident so I shouldn't go to jail.

People do stamp on the wrong pedal sometimes…if it's genuinely an accident I haven't heard about people going to jail?

Yeah, I was thinking to myself in the shower this morning how this wasn't the best analogy and someone was going to nitpick it.

Maybe a better one is a forklift operator dropping something on someone because they didn't do their company-mandated safety training and pressed the wrong button. It was an accident, the guy didn't mean to hurt anyone, but he did because he was negligent and there has to be consequences for that.

> and there has to be consequences for that.

I literally don't get this "revenge" view point. Maybe we're just going to disagree here. The same way punishments don't work on dogs, children, etc. They also don't "stop" security incidents from happening.

Your example is bad because proper access controls would:

1. Be designed in such a way that humans can follow them and that humans __do__ follow them.

2. If humans can't follow them, then humans shouldn't be involved at all.

There are so many examples in this thread of "well this is against security training, but everyone does it anyway". That's a bad design. That's created for selective enforcement and makes the entire thing a joke.

It seems like we are just going to disagree. Talk to literally anyone who works with this kind of information and they would laugh at your comment. Your requirements as written cannot be practically implemented at scale across all organizations accessing classified info. Read an Security Classification Guide sometime, you will very quickly understand. There has to be a policy somewhere that says "We know you can technically do $THING, but don't or you will go to jail."

EDIT: Sorry @dang I know I keep editing my comments a lot and you probably don't like that, but the more I think about it the more ridiculous these claims are the more miffed I get. Seriously, to all these people telling me that the NSA is just incompetent because someone went out of their way to commit a crime, imagine the following scenario: you tell someone a piece of classified information, they then walk over to an unclas computer and type that sentence in verbatim into their Gmail and hit 'Send'. Please design a crypto system, ACL, network architecture, workflow, any technical solution that could practically prevent that from happening across hundreds of organizations and probably millions of employees. I would bet you a lot of money you cannot.

None of what you're suggesting:

1. Undoes the damage done by the leak.

2. Prevents further leaks happening in the future.

The only thing it does is ruin a person and their families life as they were entering retirement.

I have made it pretty clear that you are incorrect about #2 (in a practical sense, not a literal one). There's nothing more to say.

Probably the case, I think we just fundamentally disagree on human behavior

>DoD rules are backwards and that it's actually the fault of the NSA that the guy leaked this

Exactly that, how is it possible to have access to Highly-secret stuff but also to your personal email? Something is not right here.

DCSA and whatnot cannot constantly watch everyone all the time. They also cannot prevent every single possible edge case and scenario. If they tried, nobody would get anything done.

You could be told classified information, go home that day, and tell your wife the same thing. There is literally nothing they can do to prevent that except make sure people know there are consequences to doing so.

There are many such examples. Classified CDs is a good one. There are many rules related to classified CDs, but at some level you have to trust your people are following these rules. This is why getting a clearance is more difficult than the average job interview, and why people from the Intel communities take leaks so personally. It has to be part of the culture.

>It has to be part of the culture.

Funny that no one in a financial institute has access to private mail (Switzerland), USB is deactivated, to Surf the Web you need another laptop, no one has access to backups (Mainframe etc) without the knowledge of the CEO but maybe the data is more worth?

But yes at the end of the day you have to trust your peoples....but private email from your working-machine....that's borderline dangerous.

Nearly all classified networks are airgapped. Many are isolated to a single building or even room. I seriously doubt he had his Gmail up on his classified workstation.

>I seriously doubt he had his Gmail up on his classified workstation

I hope not ;)

This isn't really a coherent statement. The DoD's rules do prevent this; the NSA refuses to follow DoD rules.

>The DoD's rules do prevent this; the NSA refuses to follow DoD rules.

Well then it's like i said....there is something wrong ;)

I have no source on this, but I don't believe NSA employees have unclassified/public email addresses. It might be common to use a "personal" email for some work-related communication like this.

On the subject of classification, that has no excuse.

Um, no. I've definitely sent unclassified emails to @nsa.gov addresses, when I worked in government. They would be crippled if they didn't have some way to email the outside world.

Popehat notes that this kind of reporting often oversells the likely sentence: https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...

So it’s very possible this could end with a far less significant penalty, depending on the circumstances.

> Popehat notes that this kind of reporting often oversells the likely sentence

This isn't reporting and it doesn't even purport to characterize the likely sentence except by saying “Actual sentences for federal crimes are typically less than the maximum penalties.”

DOJ doesn’t prosecute “innocent” crime. Unless there’s a pressing political angle, they don’t bring prosecutions unless the wrongdoing rises to a fairly serious level. It’s not normally enough that you violate the letter of the law.

IIRC, classified data is on an airgapped network. How'd he get it out? And after, why then email?

His brain is a possibility.

Various information gets classified at different levels according to the classification guide for a program. It could be as simple as a program name in certain instances.

Now I doubt they'd prosecute for inadvertent inclusion of minor yet technically classified things, but it's hard to know.

See page 24+, in Security Classification Guidance Student Guide, for some examples of things in a classification guide. https://www.cdse.edu/Portals/124/Documents/student-guides/IF...

(The French had a solution for air gapping the brain, but productivity becomes a problem).

Air-gapped doesn't necessarily imply that it's impossible to get data out via e.g. physical media (printing, memory stick...).

Yeah I'm assuming a USB stick. But then he emailed the files off of the stick? Why not mail the stick?

> Unkenholz allegedly retained the classified NDI within his personal email address.

I love how whoever wrote this clearly does not understand technology, and thinks that somehow the _data_ was stored within the _address_.

But besides that, can we just take a facepalm to recognize an NSA employee sending _and_ keeping classified data in a personal email server. Like, how did he not know he would get caught, right?

isnt it obvious that the person believes that they ought to be able to trade that information? rational or irrational, this looks like a fight more than a theft

Tell me more. I would think that everyone with a TOP SECRET/SCI clearance is really clear on what it entails. I can't see someone thinking they could copy it to personal email and send it to someone without a clearance.

It isn't really always clear on what it entails, for example the word "the" will appear in TS documents but you're allowed to use that word without worrying about this happening. Specific pieces of data or groups of data receive a classification based on the harm they can cause if disclosed improperly. However, an entire document receives a classification based on its most sensitive parts so it can be hard to determine what parts of it are actually sensitive. If you don't know, ask, so things like this don't happen. This person should have known better, I can imagine how it's possible to accidently transmit classified data on an unclassified network. But I have a hard time seeing someone make an honest mistake like that 13 times.

What's the point of debating it? The press release seemed to give no information whatsoever that would clue us into motivation.

I would like to see the indictment, if it's not secret itself. There wasn't a link, was there?

Tbh I’d think there would be (technical) mechanisms in place to make this impossible.

Seems to be a recurring issue

It's a useful, if not technically precise, abstraction. Since it's part of an indictment, it is a magnet for pedantry.

Just like how a long fall doesn't kill you, the sudden stop at the end does. It's a distinction without a difference.

Lawyers drafting indictments directly related to a technical subject should have them proof read by someone with knowledge of that subject.

Which is excellent advice - and unless you're both a lawyer, and familiar with the conventions of this particular bit of law, you probably shouldn't make any assumptions about what should, and should not be written in this kind of indictment.

Because you don't have knowledge of the subject.

The subject at hand being the law.

Have you ever tried to explain associativity of boolean operators to a person with a law degree?

No, but I have tried to explain to a number of very intelligent people that their CS degree does not make them a legal expert.

Nobody ever asks programmers to provide legal opinions.

On the other hand, understanding formal logic is of practical value in the legal industry; I was thinking of building searches to find electronic documents which is a real thing that (clueless) people (try to) do. Seems to me like it could potentially be very high stakes, at least in hindsight if you screw it up.

I don't know if boolean logic is or used to be part of a law school curriculum. It just seems to me a bit surprising if it isn't.

Oh come on! This isn't a legal document. It's a press release.

I think the ambiguity is intentional sometimes

To disrupt any empathic thoughts towards the defendant

As well as convey omniscience of the government

If not, I think it’s an effective idea someone should start doing, and i was inspired by reading a few indictments

The crime is supposed to fit the punishment. Many of these leaks can result in American deaths, so why is the death penalty not an option?

260 years jail time is practically the death penalty

Reply on news.ycombinator.com