Comment by subjectsigma | Hacker News Reader

Comment by subjectsigma | Hacker News Reader

Parent Full thread

Your comment doesn't really make any sense. It seems to imply that the DoD rules are backwards and that it's actually the fault of the NSA that the guy leaked this. Which I don't understand.

If he emailed a classified document, there is absolutely no way in hell that was an accident. You are never, ever, ever supposed to put classified information onto an unapproved system. This is like saying, "Oh, I forgot which pedal does which, so I slammed the gas instead of the brakes and killed someone, but it was an accident so I shouldn't go to jail." No, you're definitely going to jail, you 'forgetting' how to drive doesn't mean you didn't ruin someone's life.

(There's a small chance that he could have wrote something classified from his brain into the body of an email and sent it. People don't get sent to jail for this, provided it's a one-time incident. If he's getting charges pressed it was pretty egregious. The term "gross negligence" comes to mind.)

And it really could be that critical. Classified information is classified because it can be damaging. If you leak the names of people spying for you in foreign countries, they might be captured or even killed. How do you "design the system" to allow for that "mistake"?

Finally, the prison sentence lets people know that security is serious. There are many rules and it takes effort to follow them. People get lazy and cut corners when there aren't consequences.

> Oh, I forgot which pedal does which, so I slammed the gas instead of the brakes and killed someone, but it was an accident so I shouldn't go to jail.

People do stamp on the wrong pedal sometimes…if it's genuinely an accident I haven't heard about people going to jail?

Yeah, I was thinking to myself in the shower this morning how this wasn't the best analogy and someone was going to nitpick it.

Maybe a better one is a forklift operator dropping something on someone because they didn't do their company-mandated safety training and pressed the wrong button. It was an accident, the guy didn't mean to hurt anyone, but he did because he was negligent and there has to be consequences for that.

> and there has to be consequences for that.

I literally don't get this "revenge" view point. Maybe we're just going to disagree here. The same way punishments don't work on dogs, children, etc. They also don't "stop" security incidents from happening.

Your example is bad because proper access controls would:

1. Be designed in such a way that humans can follow them and that humans __do__ follow them.

2. If humans can't follow them, then humans shouldn't be involved at all.

There are so many examples in this thread of "well this is against security training, but everyone does it anyway". That's a bad design. That's created for selective enforcement and makes the entire thing a joke.

It seems like we are just going to disagree. Talk to literally anyone who works with this kind of information and they would laugh at your comment. Your requirements as written cannot be practically implemented at scale across all organizations accessing classified info. Read an Security Classification Guide sometime, you will very quickly understand. There has to be a policy somewhere that says "We know you can technically do $THING, but don't or you will go to jail."

EDIT: Sorry @dang I know I keep editing my comments a lot and you probably don't like that, but the more I think about it the more ridiculous these claims are the more miffed I get. Seriously, to all these people telling me that the NSA is just incompetent because someone went out of their way to commit a crime, imagine the following scenario: you tell someone a piece of classified information, they then walk over to an unclas computer and type that sentence in verbatim into their Gmail and hit 'Send'. Please design a crypto system, ACL, network architecture, workflow, any technical solution that could practically prevent that from happening across hundreds of organizations and probably millions of employees. I would bet you a lot of money you cannot.

None of what you're suggesting:

1. Undoes the damage done by the leak.

2. Prevents further leaks happening in the future.

The only thing it does is ruin a person and their families life as they were entering retirement.

I have made it pretty clear that you are incorrect about #2 (in a practical sense, not a literal one). There's nothing more to say.

Probably the case, I think we just fundamentally disagree on human behavior

>DoD rules are backwards and that it's actually the fault of the NSA that the guy leaked this

Exactly that, how is it possible to have access to Highly-secret stuff but also to your personal email? Something is not right here.

This isn't really a coherent statement. The DoD's rules do prevent this; the NSA refuses to follow DoD rules.

>The DoD's rules do prevent this; the NSA refuses to follow DoD rules.

Well then it's like i said....there is something wrong ;)

DCSA and whatnot cannot constantly watch everyone all the time. They also cannot prevent every single possible edge case and scenario. If they tried, nobody would get anything done.

You could be told classified information, go home that day, and tell your wife the same thing. There is literally nothing they can do to prevent that except make sure people know there are consequences to doing so.

There are many such examples. Classified CDs is a good one. There are many rules related to classified CDs, but at some level you have to trust your people are following these rules. This is why getting a clearance is more difficult than the average job interview, and why people from the Intel communities take leaks so personally. It has to be part of the culture.

>It has to be part of the culture.

Funny that no one in a financial institute has access to private mail (Switzerland), USB is deactivated, to Surf the Web you need another laptop, no one has access to backups (Mainframe etc) without the knowledge of the CEO but maybe the data is more worth?

But yes at the end of the day you have to trust your peoples....but private email from your working-machine....that's borderline dangerous.

Nearly all classified networks are airgapped. Many are isolated to a single building or even room. I seriously doubt he had his Gmail up on his classified workstation.

>I seriously doubt he had his Gmail up on his classified workstation

I hope not ;)

Reply on news.ycombinator.com