Feeds

US and UK spooks alerted over massive Swiss data leak

Rogue IT admin plundered state secrets

Security for virtualized datacentres

The Swiss intelligence agency (NDB) has been warning its US and UK counterparts that it may have lost terabytes of their secret information, thanks to one of its IT administrators pulling an inside job.

The rogue administrator, whom a source described to Reuters as "very talented," had admin rights to most of the NBD's servers, including sensitive files contributed from other agencies such as Britain's MI6 and the CIA. He'd worked at the NDB for eight years but was reportedly disgruntled at his job and felt management were ignoring his suggestions on systems management.

The source said that the admin had been exhibiting warning signs, like failing to show up for work on a regular basis, and had copied large amounts of data onto small portable drives and smuggled them out of the office in his backpack. It is believed he was trying to sell the data to third parties.

The NDB were only alerted when the Swiss bank UBS told them of a suspicious attempt to set up a numbered account. Investigators raided the admin's home and found large numbers of files stashed on portable drives.

It appears at this stage that he was raided before he managed to sell any of the data, but the NDB has informed partner agencies just in case. Nevertheless, it's an embarrassing situation for the Swiss, given that country's reputation for secrecy and reliability. A Swiss parliamentary committee has been set up to examine the affair and is expected to issue a report in the spring.

While you'd expect the NDB would have some sort of data tracking system to monitor who was downloading what, it's also likely that a senior administrator would have been able to find a way around it. It's another case of a "Layer 8" security problem that's very difficult to deal with.

Here in San Francisco, we had our own version of this with the case of Terry Childs, who was one of the chief admins on the city's intranet. In a fit of pique he locked everyone else out of the system and refused to hand over the passwords to anyone other than the mayor. He got four years in prison and a bill for $1.5m in cleanup costs. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.