Feeds

US and UK spooks alerted over massive Swiss data leak

Rogue IT admin plundered state secrets

High performance access to file storage

The Swiss intelligence agency (NDB) has been warning its US and UK counterparts that it may have lost terabytes of their secret information, thanks to one of its IT administrators pulling an inside job.

The rogue administrator, whom a source described to Reuters as "very talented," had admin rights to most of the NBD's servers, including sensitive files contributed from other agencies such as Britain's MI6 and the CIA. He'd worked at the NDB for eight years but was reportedly disgruntled at his job and felt management were ignoring his suggestions on systems management.

The source said that the admin had been exhibiting warning signs, like failing to show up for work on a regular basis, and had copied large amounts of data onto small portable drives and smuggled them out of the office in his backpack. It is believed he was trying to sell the data to third parties.

The NDB were only alerted when the Swiss bank UBS told them of a suspicious attempt to set up a numbered account. Investigators raided the admin's home and found large numbers of files stashed on portable drives.

It appears at this stage that he was raided before he managed to sell any of the data, but the NDB has informed partner agencies just in case. Nevertheless, it's an embarrassing situation for the Swiss, given that country's reputation for secrecy and reliability. A Swiss parliamentary committee has been set up to examine the affair and is expected to issue a report in the spring.

While you'd expect the NDB would have some sort of data tracking system to monitor who was downloading what, it's also likely that a senior administrator would have been able to find a way around it. It's another case of a "Layer 8" security problem that's very difficult to deal with.

Here in San Francisco, we had our own version of this with the case of Terry Childs, who was one of the chief admins on the city's intranet. In a fit of pique he locked everyone else out of the system and refused to hand over the passwords to anyone other than the mayor. He got four years in prison and a bill for $1.5m in cleanup costs. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.