Feeds

US and UK spooks alerted over massive Swiss data leak

Rogue IT admin plundered state secrets

Build a business case: developing custom apps

The Swiss intelligence agency (NDB) has been warning its US and UK counterparts that it may have lost terabytes of their secret information, thanks to one of its IT administrators pulling an inside job.

The rogue administrator, whom a source described to Reuters as "very talented," had admin rights to most of the NBD's servers, including sensitive files contributed from other agencies such as Britain's MI6 and the CIA. He'd worked at the NDB for eight years but was reportedly disgruntled at his job and felt management were ignoring his suggestions on systems management.

The source said that the admin had been exhibiting warning signs, like failing to show up for work on a regular basis, and had copied large amounts of data onto small portable drives and smuggled them out of the office in his backpack. It is believed he was trying to sell the data to third parties.

The NDB were only alerted when the Swiss bank UBS told them of a suspicious attempt to set up a numbered account. Investigators raided the admin's home and found large numbers of files stashed on portable drives.

It appears at this stage that he was raided before he managed to sell any of the data, but the NDB has informed partner agencies just in case. Nevertheless, it's an embarrassing situation for the Swiss, given that country's reputation for secrecy and reliability. A Swiss parliamentary committee has been set up to examine the affair and is expected to issue a report in the spring.

While you'd expect the NDB would have some sort of data tracking system to monitor who was downloading what, it's also likely that a senior administrator would have been able to find a way around it. It's another case of a "Layer 8" security problem that's very difficult to deal with.

Here in San Francisco, we had our own version of this with the case of Terry Childs, who was one of the chief admins on the city's intranet. In a fit of pique he locked everyone else out of the system and refused to hand over the passwords to anyone other than the mayor. He got four years in prison and a bill for $1.5m in cleanup costs. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?