Hacker News Reader

Comment by mhoad | Hacker News Reader

Let me put it to you another way. New guy turns up, starts printing off a whole bunch of highly classified docs that don’t relate to his actual job and then suddenly has to leave due to a vague “family illness”.

He is basically a walking profile of insider threat behaviour modeling.

I don’t think it was anything other than his stupidity that put him on the radar so quickly. Reading the indictment it’s clear he was a bit of an idiot.

View on HN

Yeah, but... why does a new guy even have access to a bunch of highly classified docs that don't relate to his actual job? That's an epic fail by the NSA. I mean, good job catching him. Now close the door that he walked through when he found it open.

Probably because far too many docs have a security tag on them just in case.

The affidavit says that he had access to more documents than he was supposed to because of a "misconfiguration". Or at least, that's what he told the undercover agent.

Given that his access of the documents was logged anyway, it wouldn't surprise me if the misconfiguration was itself a honeypot, using documents that are relatively low-value but still classified.

Wonder what the content of the documents is if they indeed are a honeypot? Presumably one wouldn’t put any actual secrets but that presents the problem that one would need to know the real secrets to plant fake ones. Additionally the fake ones would implicate some real person, presumably which is problematic if a sophisticated hacker exfiltrated successfully without detection.

I could never get anything done in espionage. I’m far too paranoid.

this type of material is known as 'chicken feed' and it is curated in order to look valuable while not disclosing anything more damaging than necessary.

The article mentions it contains information on how the US performs cyberattacks. I'm sure it's fairly easy to make that look very convincing if you're new at the organization. I mean if it just mentions there's an SSL tunnel into an energy company somewhere, are you going to test if it works or consider it juicy enough to sell?

The files were in a folder called “NeWgUyHoNeYpOt”. That’s meant as a joke but could very well be true in this case.

That’s available.

https://www.namecheap.com/domains/registration/results/?doma...

Reply on news.ycombinator.com