Hacker News Reader

Comment by jasonthorsness | Hacker News Reader

This article is trying to show it as more scary than it is. The key points are: this is systems up to secret level only and sessions are recorded and watched by an escort; the escort is not as tech savvy as the engineers performing maintenance (who are also Microsoft employees, from many countries of origin) but there are other controls too; they can’t just run unsigned code etc.

The top secret stuff isn’t using this system; it’s using cleared staff.

View on HN

This doesn't reflect what the article says. It only includes unclassified systems, not systems up to secret. That means anything from IL2 to IL5 (secret is impact level 6). In practice, IL2 is basically open access anyway, so it's really IL4 and IL5 as those levels actually restrict access. IL5 can include controlled unclassified information, but that's the highest possible. Remote access to IL5 systems also requires either a common access card issued by the DoD or personal PKI issued by an approved CA that still has to verify your background and identity in person before issuing you a certificate pair.

Along with everyone else they interviewed apparently, I had no idea this program even existed, but there have always been similar programs for other kinds of maintenance and support personnel. The people who repair the toilets and refrigerators in a SCIF don't have clearances. They get an escort, and everyone else in the building gets a warning before anyone needing an escort comes in, telling them to put away any sensitive data and either work on something unclassified or turn off your monitors and stop working completely until these people are done and leave again.

Thanks for the clarification; I was going off "While the ad said that specific technical skills were “highly preferred” and “nice to have,” the main prerequisite was possessing a valid “secret” level clearance issued by the Defense Department" from the article.

Secret because that's generally the lowest level clearance you can get that means something to the DoD. Essentially anyone working in and around the DoD has a secret clearance. Notably a clearance in itself means nothing without need to know.

Secret is still sensitive info and, if released, can cause harm or disruption.

Spying is not based on finding a single discovery of top secret information but a continuous process of pulling various pieces together. A "secret" item by itself may not cause bad things to happen but combined with other information could result in far greater damage.

> they can’t just run unsigned code etc.

They can do everything that the escort's account can, I don't think you can know what that is.

Since it's to solve technical issues, there's a high chance that low-level access will be required, often.

> systems up to secret level only

These aren’t SECRET systems. If they were, that would be catastrophically bad and someone would go to jail.

Does any of this matter any more given that DOGE have total clearance bypass for uncleared staff?

Chinese engineers are operating US government cloud computers by proxy. The Chinese just don't see the computer screen--a proxy copies & pastes their commands and reads back the results.

Reply on news.ycombinator.com