Feeds

NSA: NOBODY could stop Snowden – he was A SYSADMIN

Virtually unfettered access blew sensitive docs wide open

Providing a secure and efficient Helpdesk

The US National Security Agency may have some of the most sophisticated cyber-surveillance programs in the world, but it was trivial for former NSA contractor Edward Snowden to walk off with sensitive data, sources say, owing to the agency's antiquated internal security.

"The [Defense Department] and especially NSA are known for awesome cyber security, but this seems somewhat misplaced," former US security official Jason Healey told NBC News on Thursday. "They are great at some sophisticated tasks but oddly bad at many of the simplest."

While some sources claimed that it was Snowden's genius for infiltrating electronic systems that allowed him to make off with a cache of at least 20,000 documents – "Every day, they are learning how brilliant [Snowden] was," one former US official said – other sources suggested that all he needed was a little determination and the right business card.

"It's 2013," an insider told NBC, "and the NSA is stuck in 2003 technology."

For example, the NSA policy prevents a typical worker from doing things like copying files to USB thumb drives or other external storage. But Snowden had an easy way around those restrictions, simply by virtue of being classified as a "systems administrator".

With that privilege, Snowden would have been able to move files around at will, sources claim. If higher-ups ever questioned him about it, he could have claimed he was doing so in order to repair a corrupted drive or some other maintenance operation.

Snowden's administrator account also gave him the ability to log into the accounts of other users of the agency's NSAnet computer systems – some of whom had higher security clearance than Snowden himself did.

In essence, Snowden was able to impersonate those NSA employees to gain access to highly sensitive documents, which he was then able to copy to thumb drives. This was so easy to do that one source described him as a "ghost user" of NSAnet, whose activities couldn't easily be traced.

The NSA is reportedly only now piecing together the exact steps Snowden took to infiltrate its systems, including identifying specific users whose accounts he used to access documents. But there's no clear paper trail – investigators are said to be looking for red-flag discrepancies, such as accounts that were accessed while their owners were on vacation.

Once he began collecting documents, Snowden was surely also emboldened by the fact that, as a contractor working for Booz Allen Hamilton in Hawaii, he never once needed to set foot in NSA headquarters. Instead, he could access the files he wanted from a computer terminal some 5,000 miles away.

The NSA reportedly employs around 40,000 people, roughly 1,000 of which are systems administrators. Like Snowden, most of those systems admins are contractors – or they were, at least.

Earlier this month, NSA director General Keith Alexander announced that the agency plans to reduce its total number of sysadmins by 90 per cent, specifically to reduce the number of staffers who have access to secret information.

Such measures come too late to reduce the impact of Snowden's leaks, however. As one former intelligence official described the aftermath of Snowden's disclosures to NBC News, "The damage, on a scale of 1 to 10, is a 12." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.