Hacker News Reader

> The other half make 200,000 dollars a year from a subcontractor of a subcontractor of Northrop Grumman pushing paper at a desk all year.

That's what happens when you don't want the government to spend money actually hiring skilled employees. Instead we waste money trying to not waste money. The government could pay a very skilled developer $150k/year + benefits. But certain people think that the government only wastes money. So we can't have public sector employees making comparable wages. Instead we pay a "contractor"[1] $200k/year where the contractor gets $110k of that and the employer takes the other $90k.

[1] They are de facto public employees

For specific agencies with a great workforce, it is worse than this.

we've been losing a great deal of technical expertise recently to industry, where Fortune 500s are offering compensation packages 200% to 250% higher than the current compensation of federal contractors & technical civil servants.

I was interviewed for a friend who was applying for clearance. They spent an awful lot of time asking me about his hypothetical interest in child porn. I didn't bother asking why at the time; I've been told that their primary interest in such questions is making sure that somebody doesn't have obvious points of leverage for blackmail.

> who go through rudimentary security clearance checks and have access to all this information.

But just getting a security clearance isn't enough to have access to "all this information", right? My understanding has been that getting security clearance can make one eligible to do work which would involve some specific sensitive information, but that stuff is still meant to be compartmentalized. There's no reason people who are working on e.g. the supply chain for some radar component need to have access to intel on some other country's chemical weapons and vice versa.

It's not really so much about the clearance as it is about network access. A tremendous amount of classified information is essentially public on the high side networks. So, if your job entails access to a classified network (particularly an IC one), you have a lot of reading you can do.

This situation is sort of intentional: one of the big findings of the 9/11 commission is that intelligence information was too siloized and analysts were missing big things because they didn't have access to products of other agencies. But there's a balancing act here, and this is the downside of open access.

So a sibling comment in this tree says there are "about one million US citizens have a top secret clearance" ... is it known roughly how many would have access to those IC networks?

I'm realizing my initial impression of the landscape here is also skewed by some peripheral awareness of how government contractors may have narrow access to specific material for their work. I understand why intentionally, some actual government employees have a much broader view. But how large is that group with broad access?

When it comes to classified networks, "SCIF" usually implies "JWICS." A quote from the DISA CIO [1] puts the JWICS user count at "hundreds of thousands."

Even better, a 2016 article about TS Intellipedia [2], the MediaWiki install on JWICS, says it has "255,402 registered users." That's probably pretty similar to the JWICS user count at the time.

[1] https://fedscoop.com/jwics-modernization-dia-douglas-cossa/

[2] https://www.businessinsider.com/nsa-version-wikipedia-called...

I don't have the sense it's that well separated. Like Reality Winner was doing translations of persian aerospace program stuff when she leaked the russian election interference document.

I can't see how those could sensibly be in the same domain. I imagine it's about like any other huge collection of data, with large variance in how well things are categorized and restricted.

It was reported in the news today that the USA is looking to tighten access to classified material as, currently, about one million US citizens have a top secret clearance.

While it would be intractable to upend the status quo of about 0.5% of American adults using that access to get things done day-to-day, there's a lot that could be improved just by compartmentalizing that access and monitoring it.

It's one thing for an IT admin on a Massachusetts national guard post to get access to a few local secrets. It's another when he's downloading hundreds of documents unrelated to his duties on a war thousands of miles away.

Your average file share or web server for a medium-sized corporation with a negligible amount of confidential data probably has that level of monitoring, it's not particularly surprising that the slower-moving military doesn't yet but it probably should.

The shameful thing is this is the same scenario with the Manning leaks and nothing has been done to institute stronger access restrictions since. The military consistently refuses to operate by the same secrecy requirements that DoD contractors have to adhere to.

There is a constant ebb and flow between more sharing of information and less sharing of information. Bad things happen because of not sharing enough intel (eg. the 9/11 report)? Time to loosen restrictions. Bad things happen because of overly lax sharing of information (eg. Manning)? Time to lock things down. Both postures have costs and benefits that are difficult to quantify. This tends to cause knee-jerk reactions based on the latest crisis.

Failure to adapt to changing threat models. Used to be extortion, now it's just boredom. I imagine there have always been a few bored guards taking stuff home to show off at poker night, but that was as far as it went back then.

>It's a national disgrace.

No, it's s a national sport.